Orgivafood API
A single REST backend serving both the Orgivafood storefront and the admin panel โ products, categories, orders, customers, reviews, coupons, banners, blog, newsletter, contact messages and authentication. Not yet wired into either frontend; this API is complete and independently testable.
Getting Started
Three steps to a running, seeded API.
# 1. install dependencies npm install # 2. copy the env file and set your MongoDB connection string cp .env.example .env # 3. seed demo data, then start the server npm run seed npm run dev
The seed script creates one admin account (admin@orgivafood.pk /
Admin@123) and 8 demo customers (any seeded email, password
Customer@123), plus products, categories, orders, reviews, coupons,
banners, blog posts, testimonials, FAQs and site settings.
Every response follows the same JSON envelope:
{ "success": true, "message": "Success", "data": { ... }, "meta": { "total": 40, "page": 1, "limit": 20, "totalPages": 2 } }
Errors follow the same shape with success: false:
{ "success": false, "message": "Product not found" }
Protected routes require an Authorization: Bearer <token> header, obtained
from /api/auth/login, /api/auth/admin/login, or the OTP flow.
Routes tagged Admin additionally require
the token's user to have role: "admin".
๐ Auth
Base path: /api/auth โ registration, login and phone OTP for customers, plus a dedicated admin login.
Create a customer account with email + password.
{ "name": "Ayesha Malik", "email": "ayesha@example.com", "phone": "+92 300 1234567", "password": "secret123" }
Log in with email + password. Returns { user, token }.
{ "email": "ayesha@example.com", "password": "secret123" }
Dedicated login for the admin panel โ only succeeds for accounts with role: "admin".
{ "email": "admin@orgivafood.pk", "password": "Admin@123" }
Request a 4-digit OTP for a phone number, valid for OTP_EXPIRES_MINUTES. Demo backend โ no SMS gateway is wired up, so the response includes devOtp for testing.
{ "phone": "+92 300 1234567" }
Verify the OTP and log in, auto-creating a bare customer account on first login. Returns { user, token }.
{ "phone": "+92 300 1234567", "code": "4821" }
Return the currently authenticated user's profile.
๐ฅ Users (Customers)
Base path: /api/users โ admin-only management of customer accounts.
List customers.
search, status, page, limitGet one customer plus their order history.
Update a customer's name, phone, status, or address.
{ "status": "Blocked" }
Delete a customer account.
๐ Products
Base path: /api/products โ the storefront catalog and its admin management.
List products with filtering, search, sorting and pagination.
search, category, tag, minPrice,
maxPrice, status, inStock (true/false),
sort (price-asc | price-desc | newest | rating), page, limit
Get one product by its Mongo id or its slug (e.g. turmeric-powder).
Create a product. slug is auto-generated from name if omitted.
{
"name": "Turmeric Powder", "sku": "ORG-TUR-200", "category": "Spices",
"price": 149, "mrp": 199, "unit": "200g", "stock": 84,
"image": "https://images.unsplash.com/photo-...", "tags": ["Best Sellers", "Spices"]
}
Update any product fields.
Quick status toggle: Active, Draft, Out of Stock, Low Stock.
{ "status": "Out of Stock" }
Delete a product.
๐ Categories
Base path: /api/categories โ product categories, with a live product count.
List categories (optionally ?status=Active). Each includes productCount.
Get one category by id or slug.
Create a category.
{ "name": "Organic Oil", "image": "https://...", "description": "Cold-pressed cooking oils." }
Update a category.
Delete a category.
โญ Reviews
Base path: /api/reviews โ product reviews, moderated before going live.
Guests see only Published reviews. An authenticated admin can filter by any status.
product, status (admin only), page, limitSubmit a review โ works for guests (pass name) or logged-in customers. Always starts as Pending.
{ "product": "<productId>", "rating": 5, "title": "Great quality", "text": "Loved it!", "name": "Ayesha" }
Moderate a review โ approving or rejecting it also recalculates the product's average rating.
{ "status": "Published" }
Delete a review.
๐งบ Cart
Base path: /api/cart โ server-side cart for a logged-in customer, or a guest identified by an x-session-id header.
x-session-id header (e.g. a UUID stored in localStorage). Logged-in requests use the Bearer token instead.Get (or lazily create) the current cart.
Add a product, or increase its quantity (capped at 10).
{ "productId": "<productId>", "quantity": 2 }
Set an item's exact quantity.
{ "quantity": 3 }
Remove one item from the cart.
Clear the cart.
๐ฆ Orders
Base path: /api/orders โ checkout and order management.
Place an order (checkout). Works for guests or logged-in customers; applies a coupon if given, decrements product stock, and computes shipping (free โฅ Rs 499, otherwise Rs 49).
{
"contactInfo": { "firstName": "Ahmed", "lastName": "Khan", "email": "ahmed@example.com", "phone": "+92 300 1234567" },
"shippingAddress": { "street": "House 12, Street 4", "city": "Lahore", "province": "Punjab", "postalCode": "54000" },
"items": [{ "product": "<productId>", "name": "Turmeric Powder", "price": 149, "quantity": 2 }],
"paymentMethod": "COD",
"couponCode": "FLAT50"
}
Admins see every order; customers see only their own.
status, paymentStatus, search, page, limitGet one order (customers can only fetch their own).
Update order and/or payment status.
{ "orderStatus": "Shipped", "paymentStatus": "Paid" }
Delete an order.
๐ท Coupons
Base path: /api/coupons
Validate a coupon at checkout before it's applied โ checks status, expiry, usage limit and minimum order.
List all coupons.
Create a coupon.
{ "code": "FLAT50", "type": "Fixed", "value": 50, "minOrder": 499, "usageLimit": 2000, "expiryDate": "2026-12-31" }
Update a coupon.
Delete a coupon.
๐ผ Banners
Base path: /api/banners โ hero slider, promo row and brand banners.
List banners โ only Active ones by default.
placement (Hero Slider | Promo Row | Brand Banner), all=true (admin: include every status)Create a banner.
{ "title": "Everything You Love in One Place", "placement": "Hero Slider", "image": "https://...", "linkTo": "/collections/all" }
Update a banner.
Delete a banner.
๐ Blog
Base path: /api/blog
List posts โ only Published by default.
category, all=true (admin: include drafts), page, limitGet one post by slug โ increments its view counter.
Create a post. slug auto-generates from title if omitted.
{ "title": "5 Reasons to Switch to Cold-Pressed Oils", "excerpt": "...", "image": "https://...", "body": ["Paragraph one.", "Paragraph two."], "status": "Published" }
Update a post.
Delete a post.
๐ฌ Testimonials
Base path: /api/testimonials
List testimonials (?all=true for admin to include hidden ones).
Create a testimonial.
{ "name": "Ayesha Malik", "location": "Karachi", "rating": 5, "text": "..." }
Update a testimonial.
Delete a testimonial.
โ FAQs
Base path: /api/faqs
List FAQs, ordered by order. Optional ?category= filter.
Create an FAQ.
{ "question": "Do you deliver across Pakistan?", "answer": "Yes, nationwide in 3โ7 business days.", "category": "Shipping" }
Update an FAQ.
Delete an FAQ.
๐ง Subscribers
Base path: /api/subscribers โ newsletter sign-ups from the footer, coupon popup, or checkout opt-in.
Subscribe an email (re-subscribes if it already exists).
{ "email": "ahmed@example.com", "source": "Footer Newsletter" }
List subscribers (?status=, page, limit).
Update a subscriber's status.
Delete a subscriber.
โ๏ธ Contact
Base path: /api/contact โ the storefront's contact form.
Submit a contact message.
{ "name": "Ahmed Khan", "email": "ahmed@example.com", "phone": "+92 300 1234567", "subject": "Bulk order", "message": "..." }
List messages (?status=, page, limit).
Mark a message Read or Responded.
Delete a message.
โ๏ธ Settings
Base path: /api/settings โ a single site-wide settings document (currency, shipping thresholds, contact details, certifications).
Get site settings (auto-created with sensible defaults on first request).
Update site settings.
{ "freeShippingThreshold": 599, "standardShippingFee": 60 }
๐ Dashboard
Base path: /api/dashboard โ aggregate analytics for the admin panel's home screen.
Headline totals: revenue (from paid orders), order count, customer count, product count.
Revenue grouped by day for the last 7 days.
Order counts grouped by orderStatus, for a pie/bar chart.