Fixed new basic feature

backend/app/Http/Controllers/Api/AuditLogController.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\MonthlyBill;
+use Illuminate\Http\JsonResponse;
+use Spatie\Activitylog\Models\Activity;
+
+class AuditLogController extends Controller
+{
+    public function __construct()
+    {
+        // Require accountant role or admin
+    }
+
+    public function monthlyBillLogs(MonthlyBill $monthlyBill): JsonResponse
+    {
+        $this->authorize('view', $monthlyBill);
+
+        // Get logs for the MonthlyBill itself
+        $billLogs = Activity::where('subject_type', MonthlyBill::class)
+            ->where('subject_id', $monthlyBill->id)
+            ->with('causer')
+            ->get();
+
+        // Get logs for the related UserMonthlyBills
+        $userBillIds = $monthlyBill->userBills()->pluck('id');
+
+        $userBillLogs = Activity::where('subject_type', 'App\Models\UserMonthlyBill')
+            ->whereIn('subject_id', $userBillIds)
+            ->with(['causer', 'subject.user'])
+            ->get();
+
+        $allLogs = $billLogs->concat($userBillLogs)->sortByDesc('created_at')->values();
+
+        $formattedLogs = $allLogs->map(function ($log) {
+            $subjectName = $log->subject_type === MonthlyBill::class
+                ? 'Monthly Bill'
+                : 'User Bill (' . ($log->subject->user->name ?? 'Unknown') . ')';
+
+            return [
+                'id' => $log->id,
+                'description' => $log->description,
+                'event' => $log->event,
+                'subject' => $subjectName,
+                'causer' => $log->causer ? $log->causer->name : 'System',
+                'properties' => $log->properties,
+                'created_at' => $log->created_at,
+            ];
+        });
+
+        return response()->json([
+            'data' => $formattedLogs,
+        ]);
+    }
+}

backend/app/Http/Controllers/Api/AuthController.php

@@ -6,7 +6,9 @@
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Password;
 use Illuminate\Validation\ValidationException;
 
 use Illuminate\Support\Facades\Storage;
@@ -27,53 +29,50 @@ public function register(Request $request)
             'name' => 'required|string|max:255',
             'email' => 'required|string|email|max:255|unique:users',
             'password' => $passwordRules,
-            'role' => 'nullable|string|in:employee,chef,accountant',
         ]);
 
         $user = User::create([
             'name' => $request->name,
             'email' => $request->email,
             'password' => Hash::make($request->password),
-            'role' => $request->role ?? 'employee',
+            'role' => 'employee',
             'is_active' => true,
         ]);
 
-        $token = $user->createToken('auth_token')->plainTextToken;
+        Auth::guard('web')->login($user);
+        $request->session()->regenerate();
 
         return response()->json([
-            'access_token' => $token,
-            'token_type' => 'Bearer',
             'user' => $user,
         ]);
     }
 
     public function login(Request $request)
     {
-        $request->validate([
+        $credentials = $request->validate([
             'email' => 'required|string|email',
             'password' => 'required|string',
         ]);
 
-        $user = User::where('email', $request->email)->first();
+        if (Auth::guard('web')->attempt($credentials)) {
+            $request->session()->regenerate();
 
-        if (! $user || ! Hash::check($request->password, $user->password)) {
-            throw ValidationException::withMessages([
-                'email' => ['The provided credentials are incorrect.'],
+            return response()->json([
+                'user' => Auth::guard('web')->user(),
             ]);
         }
 
-        $token = $user->createToken('auth_token')->plainTextToken;
-
-        return response()->json([
-            'access_token' => $token,
-            'token_type' => 'Bearer',
-            'user' => $user,
+        throw ValidationException::withMessages([
+            'email' => ['The provided credentials are incorrect.'],
         ]);
     }
 
     public function logout(Request $request)
     {
-        $request->user()->currentAccessToken()->delete();
+        Auth::guard('web')->logout();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
 
         return response()->json([
             'message' => 'Successfully logged out',
@@ -125,4 +124,41 @@ public function updateProfile(Request $request)
             'user' => $user->fresh(),
         ]);
     }
+
+    public function forgotPassword(Request $request)
+    {
+        $request->validate(['email' => 'required|email']);
+
+        $status = Password::broker()->sendResetLink(
+            $request->only('email')
+        );
+
+        return $status === Password::RESET_LINK_SENT
+                    ? response()->json(['message' => __($status)])
+                    : response()->json(['message' => __($status)], 400);
+    }
+
+    public function resetPassword(Request $request)
+    {
+        $request->validate([
+            'token' => 'required',
+            'email' => 'required|email',
+            'password' => 'required|min:8|confirmed',
+        ]);
+
+        $status = Password::broker()->reset(
+            $request->only('email', 'password', 'password_confirmation', 'token'),
+            function ($user, $password) {
+                $user->forceFill([
+                    'password' => Hash::make($password)
+                ])->setRememberToken(\Illuminate\Support\Str::random(60));
+
+                $user->save();
+            }
+        );
+
+        return $status === Password::PASSWORD_RESET
+                    ? response()->json(['message' => __($status)])
+                    : response()->json(['message' => __($status)], 400);
+    }
 }

backend/app/Models/MonthlyBill.php

@@ -6,9 +6,12 @@
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Support\Facades\Storage;
+use Spatie\Activitylog\LogOptions;
+use Spatie\Activitylog\Traits\LogsActivity;
 
 class MonthlyBill extends Model
 {
+    use LogsActivity;
     protected $fillable = [
         'month',
         'year',
@@ -21,6 +24,14 @@ class MonthlyBill extends Model
         'status',
     ];
 
+    public function getActivitylogOptions(): LogOptions
+    {
+        return LogOptions::defaults()
+            ->logFillable()
+            ->logOnlyDirty()
+            ->dontSubmitEmptyLogs();
+    }
+
     protected function casts(): array
     {
         return [

backend/app/Models/UserMonthlyBill.php

@@ -4,9 +4,12 @@
 
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Spatie\Activitylog\LogOptions;
+use Spatie\Activitylog\Traits\LogsActivity;
 
 class UserMonthlyBill extends Model
 {
+    use LogsActivity;
     protected $fillable = [
         'monthly_bill_id',
         'user_id',
@@ -16,6 +19,14 @@ class UserMonthlyBill extends Model
         'paid_at',
     ];
 
+    public function getActivitylogOptions(): LogOptions
+    {
+        return LogOptions::defaults()
+            ->logFillable()
+            ->logOnlyDirty()
+            ->dontSubmitEmptyLogs();
+    }
+
     protected function casts(): array
     {
         return [

backend/app/Providers/AppServiceProvider.php

@@ -13,6 +13,7 @@
 use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Validation\Rules\Password;
+use Illuminate\Auth\Notifications\ResetPassword;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -36,6 +37,11 @@ public function boot(): void
         Gate::policy(MonthlyBill::class, MonthlyBillPolicy::class);
         Gate::policy(UserMonthlyBill::class, UserMonthlyBillPolicy::class);
 
+        ResetPassword::createUrlUsing(function ($notifiable, string $token) {
+            $frontendUrl = env('FRONTEND_URL', 'http://localhost:3000');
+            return "{$frontendUrl}/reset-password?token={$token}&email={$notifiable->getEmailForPasswordReset()}";
+        });
+
         $this->configureDefaults();
     }
 

backend/bootstrap/app.php

@@ -28,6 +28,10 @@
 
     $middleware->encryptCookies(except: ['appearance', 'sidebar_state']);
 
+    $middleware->api(prepend: [
+        \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
+    ]);
+
     $middleware->web(append: [
         HandleAppearance::class,
         HandleInertiaRequests::class,

backend/composer.json

@@ -13,7 +13,8 @@
         "laravel/framework": "^13.0",
         "laravel/sanctum": "^4.3",
         "laravel/tinker": "^3.0",
-        "laravel/wayfinder": "^0.1.14"
+        "laravel/wayfinder": "^0.1.14",
+        "spatie/laravel-activitylog": "^4.12"
     },
     "require-dev": {
         "fakerphp/faker": "^1.24",