# Staff Login API Documentation

## Base URL
```
http://localhost:8001/api/staff
```

## Authentication
The API uses Laravel Sanctum for authentication. After login, include the token in the Authorization header:
```
Authorization: Bearer {token}
```

## Endpoints

### 1. Staff Login
**POST** `/api/staff/login`

Authenticate a staff member and receive an access token.

#### Request Body
```json
{
    "email": "staff@example.com",
    "password": "password123",
    "device_name": "Mobile App" // Optional
}
```

#### Response (200 OK)
```json
{
    "status": "success",
    "message": "Login successful",
    "data": {
        "user": {
            "id": 1,
            "name": "John Doe",
            "email": "staff@example.com",
            "role": "staff",
            "is_active": true,
            "created_at": "2024-01-01T00:00:00.000000Z"
        },
        "token": "1|abc123def456...",
        "token_type": "Bearer",
        "expires_at": "2024-01-08T00:00:00.000000Z"
    }
}
```

#### Error Responses
- **401 Unauthorized** - Invalid credentials
```json
{
    "status": "error",
    "message": "Invalid credentials"
}
```

- **403 Forbidden** - Account deactivated or unauthorized role
```json
{
    "status": "error",
    "message": "Account is deactivated"
}
```

- **422 Unprocessable Entity** - Validation errors
```json
{
    "status": "error",
    "message": "Validation failed",
    "errors": {
        "email": ["The email field is required."],
        "password": ["The password field is required."]
    }
}
```

### 2. Staff Logout
**POST** `/api/staff/logout`

Logout the authenticated staff member and revoke the current token.

#### Headers
```
Authorization: Bearer {token}
```

#### Response (200 OK)
```json
{
    "status": "success",
    "message": "Logout successful"
}
```

### 3. Get Staff Information
**GET** `/api/staff/me`

Get the authenticated staff member's information.

#### Headers
```
Authorization: Bearer {token}
```

#### Response (200 OK)
```json
{
    "status": "success",
    "data": {
        "user": {
            "id": 1,
            "name": "John Doe",
            "email": "staff@example.com",
            "role": "staff",
            "is_active": true,
            "created_at": "2024-01-01T00:00:00.000000Z",
            "updated_at": "2024-01-01T00:00:00.000000Z"
        }
    }
}
```

### 4. Refresh Token
**POST** `/api/staff/refresh`

Refresh the authentication token.

#### Headers
```
Authorization: Bearer {token}
```

#### Response (200 OK)
```json
{
    "status": "success",
    "message": "Token refreshed successfully",
    "data": {
        "token": "2|newtoken123...",
        "token_type": "Bearer",
        "expires_at": "2024-01-08T00:00:00.000000Z"
    }
}
```

## Usage Examples

### Using cURL
```bash
# Login
curl -X POST http://localhost:8001/api/staff/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "staff@example.com",
    "password": "password123"
  }'

# Get staff info (replace TOKEN with actual token)
curl -X GET http://localhost:8001/api/staff/me \
  -H "Authorization: Bearer TOKEN"

# Logout
curl -X POST http://localhost:8001/api/staff/logout \
  -H "Authorization: Bearer TOKEN"
```

### Using JavaScript (fetch)
```javascript
// Login
const login = async (email, password) => {
    const response = await fetch('http://localhost:8001/api/staff/login', {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json',
        },
        body: JSON.stringify({ email, password })
    });
    
    const data = await response.json();
    if (data.status === 'success') {
        localStorage.setItem('token', data.data.token);
        return data.data.user;
    } else {
        throw new Error(data.message);
    }
};

// Get staff info
const getStaffInfo = async () => {
    const token = localStorage.getItem('token');
    const response = await fetch('http://localhost:8001/api/staff/me', {
        headers: {
            'Authorization': `Bearer ${token}`
        }
    });
    
    return await response.json();
};
```

## Notes

1. **Token Expiration**: Tokens expire based on your Sanctum configuration (default: 1 week)
2. **Role Requirements**: Only users with 'admin' or 'staff' roles can access the API
3. **Active Status**: Users must have `is_active = true` to login
4. **Device Names**: Optional device names help identify different client sessions
5. **Security**: Always use HTTPS in production environments

## Setup Requirements

1. Ensure Laravel Sanctum is installed and configured
2. Run database migrations
3. Add `HasApiTokens` trait to your User model if not already present
4. Configure API routes in `routes/api.php`