diff --git a/.DS_Store b/.DS_Store
new file mode 100644
index 00000000..9f17780a
Binary files /dev/null and b/.DS_Store differ
diff --git a/.idea/.gitignore b/.idea/.gitignore
new file mode 100644
index 00000000..26d33521
--- /dev/null
+++ b/.idea/.gitignore
@@ -0,0 +1,3 @@
+# Default ignored files
+/shelf/
+/workspace.xml
diff --git a/.idea/inspectionProfiles/profiles_settings.xml b/.idea/inspectionProfiles/profiles_settings.xml
new file mode 100644
index 00000000..105ce2da
--- /dev/null
+++ b/.idea/inspectionProfiles/profiles_settings.xml
@@ -0,0 +1,6 @@
+
+
+
+
+
+
\ No newline at end of file
diff --git a/.idea/misc.xml b/.idea/misc.xml
new file mode 100644
index 00000000..28ae6aa4
--- /dev/null
+++ b/.idea/misc.xml
@@ -0,0 +1,4 @@
+
+
+
+
\ No newline at end of file
diff --git a/.idea/modules.xml b/.idea/modules.xml
new file mode 100644
index 00000000..d15356e4
--- /dev/null
+++ b/.idea/modules.xml
@@ -0,0 +1,8 @@
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/.idea/vcs.xml b/.idea/vcs.xml
new file mode 100644
index 00000000..35eb1ddf
--- /dev/null
+++ b/.idea/vcs.xml
@@ -0,0 +1,6 @@
+
+
+
+
+
+
\ No newline at end of file
diff --git a/.idea/wecode-hack.iml b/.idea/wecode-hack.iml
new file mode 100644
index 00000000..d0876a78
--- /dev/null
+++ b/.idea/wecode-hack.iml
@@ -0,0 +1,8 @@
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/API_DOCUMENTATION.md b/API_DOCUMENTATION.md
new file mode 100644
index 00000000..a180dbf0
--- /dev/null
+++ b/API_DOCUMENTATION.md
@@ -0,0 +1,819 @@
+# BookIt - Complete API Documentation
+
+## Base URL
+```
+http://localhost:8081/api
+```
+
+## Authentication
+All protected endpoints require:
+- **userId** as query parameter
+- Role-based access control (RBAC)
+- User must be logged in with valid role
+
+---
+
+# 📋 Table of Contents
+
+1. [Authentication APIs](#authentication-apis)
+2. [Admin APIs](#admin-apis)
+3. [Manager APIs](#manager-apis)
+4. [Member APIs](#member-apis)
+
+---
+
+# Authentication APIs
+
+## 1. Sign Up
+**Endpoint:** `POST /auth/signUp`
+**Access:** Public
+**Description:** Register a new user
+
+**Request Body:**
+```json
+{
+ "name": "John Doe",
+ "email": "john@example.com",
+ "password": "password123",
+ "role": "MEMBER"
+}
+```
+
+**Response:**
+```json
+{
+ "userId": "uuid",
+ "name": "John Doe",
+ "email": "john@example.com",
+ "role": "MEMBER",
+ "message": "User registered successfully"
+}
+```
+
+---
+
+## 2. Login
+**Endpoint:** `POST /auth/login`
+**Access:** Public
+**Description:** Login and receive user credentials
+
+**Request Body:**
+```json
+{
+ "email": "john@example.com",
+ "password": "password123"
+}
+```
+
+**Response:**
+```json
+{
+ "token": "jwt-token-here",
+ "userId": "uuid",
+ "name": "John Doe",
+ "email": "john@example.com",
+ "role": "MEMBER",
+ "credits": 0
+}
+```
+
+---
+
+## 3. Logout
+**Endpoint:** `POST /auth/logout`
+**Access:** Protected
+**Description:** Logout current user
+
+**Response:**
+```json
+{
+ "message": "Logged out successfully"
+}
+```
+
+---
+
+# Admin APIs
+
+## Room Management
+
+### 1. Get All Rooms
+**Endpoint:** `GET /admin/getAllRoom`
+**Access:** ADMIN only
+**Description:** Retrieve all meeting rooms
+
+**Response:**
+```json
+[
+ {
+ "roomId": "uuid",
+ "roomName": "Conference Room A",
+ "roomType": "CONFERENCE",
+ "seatingCapacity": 10,
+ "perHourCost": 50,
+ "amenities": [
+ {
+ "amenityId": "uuid",
+ "amenityName": "PROJECTOR",
+ "creditCost": 10
+ }
+ ],
+ "isAvailable": true
+ }
+]
+```
+
+---
+
+### 2. Get Room by ID
+**Endpoint:** `GET /admin/getRoomById/{roomId}`
+**Access:** ADMIN only
+**Description:** Get details of a specific room
+
+**Path Parameters:**
+- `roomId` (UUID) - ID of the room
+
+**Response:**
+```json
+{
+ "roomId": "uuid",
+ "roomName": "Conference Room A",
+ "roomType": "CONFERENCE",
+ "seatingCapacity": 10,
+ "perHourCost": 50,
+ "amenities": [...],
+ "isAvailable": true
+}
+```
+
+---
+
+### 3. Create Room
+**Endpoint:** `POST /admin/createRoom`
+**Access:** ADMIN only
+**Description:** Create a new meeting room
+
+**Request Body:**
+```json
+{
+ "roomName": "Conference Room A",
+ "roomType": "CONFERENCE",
+ "seatingCapacity": 10,
+ "perHourCost": 50,
+ "amenityIds": ["uuid1", "uuid2"]
+}
+```
+
+**Response:**
+```json
+{
+ "roomId": "uuid",
+ "roomName": "Conference Room A",
+ "message": "Room created successfully"
+}
+```
+
+---
+
+### 4. Update Room
+**Endpoint:** `PUT /admin/updateRoom`
+**Access:** ADMIN only
+**Description:** Update an existing room
+
+**Request Body:**
+```json
+{
+ "roomId": "uuid",
+ "roomName": "Conference Room A - Updated",
+ "roomType": "CONFERENCE",
+ "seatingCapacity": 15,
+ "perHourCost": 60,
+ "amenityIds": ["uuid1", "uuid2", "uuid3"]
+}
+```
+
+**Response:**
+```json
+{
+ "roomId": "uuid",
+ "roomName": "Conference Room A - Updated",
+ "message": "Room updated successfully"
+}
+```
+
+---
+
+### 5. Delete Room
+**Endpoint:** `DELETE /admin/rooms/{roomId}`
+**Access:** ADMIN only
+**Description:** Delete a meeting room
+
+**Path Parameters:**
+- `roomId` (UUID) - ID of the room to delete
+
+**Response:**
+```json
+{
+ "message": "Room deleted successfully"
+}
+```
+
+---
+
+## Amenity Management
+
+### 1. Get All Amenities
+**Endpoint:** `GET /admin/getAllAmenities`
+**Access:** ADMIN only
+**Description:** Retrieve all amenities
+
+**Response:**
+```json
+[
+ {
+ "amenityId": "uuid",
+ "amenityName": "PROJECTOR",
+ "description": "HD Projector with HDMI",
+ "creditCost": 10
+ },
+ {
+ "amenityId": "uuid",
+ "amenityName": "WHITEBOARD",
+ "description": "Large whiteboard with markers",
+ "creditCost": 5
+ }
+]
+```
+
+---
+
+### 2. Get Amenity by ID
+**Endpoint:** `GET /admin/getAmenitieById/{amenityId}`
+**Access:** ADMIN only
+**Description:** Get details of a specific amenity
+
+**Path Parameters:**
+- `amenityId` (UUID) - ID of the amenity
+
+**Response:**
+```json
+{
+ "amenityId": "uuid",
+ "amenityName": "PROJECTOR",
+ "description": "HD Projector with HDMI",
+ "creditCost": 10
+}
+```
+
+---
+
+### 3. Create Amenity
+**Endpoint:** `POST /admin/addAmenitie`
+**Access:** ADMIN only
+**Description:** Create a new amenity
+
+**Request Body:**
+```json
+{
+ "amenityName": "SMART_TV",
+ "description": "55 inch Smart TV",
+ "creditCost": 15
+}
+```
+
+**Response:**
+```json
+{
+ "amenityId": "uuid",
+ "amenityName": "SMART_TV",
+ "message": "Amenity created successfully"
+}
+```
+
+---
+
+### 4. Update Amenity
+**Endpoint:** `PUT /admin/updateAmenitie`
+**Access:** ADMIN only
+**Description:** Update an existing amenity
+
+**Request Body:**
+```json
+{
+ "amenityId": "uuid",
+ "amenityName": "SMART_TV",
+ "description": "65 inch Smart TV - Updated",
+ "creditCost": 20
+}
+```
+
+**Response:**
+```json
+{
+ "amenityId": "uuid",
+ "amenityName": "SMART_TV",
+ "message": "Amenity updated successfully"
+}
+```
+
+---
+
+### 5. Delete Amenity
+**Endpoint:** `DELETE /admin/amenities/{amenityId}`
+**Access:** ADMIN only
+**Description:** Delete an amenity
+
+**Path Parameters:**
+- `amenityId` (UUID) - ID of the amenity to delete
+
+**Response:**
+```json
+{
+ "message": "Amenity deleted successfully"
+}
+```
+
+---
+
+# Manager APIs
+
+## Profile & Credits
+
+### 1. Get Manager Profile
+**Endpoint:** `GET /auth/manager/profile?userId={userId}`
+**Access:** MANAGER only
+**Description:** Get manager profile information
+
+**Query Parameters:**
+- `userId` (UUID) - Manager's user ID
+
+**Response:**
+```json
+{
+ "userId": "uuid",
+ "name": "John Manager",
+ "email": "manager@example.com",
+ "role": "MANAGER",
+ "credits": 1500
+}
+```
+
+---
+
+### 2. Get Credit Summary
+**Endpoint:** `GET /auth/manager/credit-summary?userId={userId}`
+**Access:** MANAGER only
+**Description:** Get detailed credit summary for manager
+
+**Query Parameters:**
+- `userId` (UUID) - Manager's user ID
+
+**Response:**
+```json
+{
+ "userId": "uuid",
+ "managerName": "John Manager",
+ "email": "manager@example.com",
+ "totalCredits": 2000,
+ "creditsUsed": 500,
+ "creditsRemaining": 1450,
+ "penalty": 50,
+ "lastResetAt": "2026-01-01T00:00:00Z",
+ "updatedAt": "2026-01-09T00:00:00Z"
+}
+```
+
+**Business Logic:**
+```
+creditsRemaining = totalCredits - creditsUsed - penalty
+```
+
+---
+
+## Room & Meeting Management
+
+### 3. View Available Meeting Rooms
+**Endpoint:** `GET /auth/manager/viewAvailableMeetingRoom?userId={userId}`
+**Access:** MANAGER only
+**Description:** View all available meeting rooms
+
+**Query Parameters:**
+- `userId` (UUID) - Manager's user ID
+
+**Response:**
+```json
+[
+ {
+ "roomId": "uuid",
+ "roomName": "Conference Room A",
+ "roomType": "CONFERENCE",
+ "seatingCapacity": 10,
+ "perHourCost": 50,
+ "amenities": [
+ {
+ "amenityId": "uuid",
+ "amenityName": "PROJECTOR",
+ "creditCost": 10
+ }
+ ],
+ "isAvailable": true
+ }
+]
+```
+
+---
+
+### 4. Book a Room
+**Endpoint:** `POST /auth/manager/bookRoom?userId={userId}`
+**Access:** MANAGER only
+**Description:** Book a meeting room
+
+**Query Parameters:**
+- `userId` (UUID) - Manager's user ID
+
+**Request Body:**
+```json
+{
+ "userId": "uuid",
+ "roomId": "uuid",
+ "startTime": "2026-01-10T09:00:00Z",
+ "endTime": "2026-01-10T11:00:00Z",
+ "purpose": "Team Meeting",
+ "amenityIds": ["uuid1", "uuid2"]
+}
+```
+
+**Response:**
+```json
+{
+ "bookingId": "uuid",
+ "roomId": "uuid",
+ "roomName": "Conference Room A",
+ "userId": "uuid",
+ "startTime": "2026-01-10T09:00:00Z",
+ "endTime": "2026-01-10T11:00:00Z",
+ "status": "CONFIRMED",
+ "creditsCost": 120,
+ "statusCode": 201,
+ "message": "Room booked successfully by manager: uuid"
+}
+```
+
+**Important:**
+- Manager's `creditsUsed` in `manager_credit_summary` table is automatically updated
+- Credits are deducted: `roomCost * hours + amenityCosts`
+
+---
+
+### 5. Get My Bookings
+**Endpoint:** `GET /auth/manager/myBookings?userId={userId}`
+**Access:** MANAGER only
+**Description:** Get all bookings made by manager
+
+**Query Parameters:**
+- `userId` (UUID) - Manager's user ID
+
+**Response:**
+```json
+[
+ {
+ "bookingId": "uuid",
+ "roomId": "uuid",
+ "roomName": "Conference Room A",
+ "startTime": "2026-01-10T09:00:00Z",
+ "endTime": "2026-01-10T11:00:00Z",
+ "status": "CONFIRMED",
+ "creditsCost": 120,
+ "createdAt": "2026-01-09T10:00:00Z"
+ }
+]
+```
+
+---
+
+### 6. Get Booking by ID
+**Endpoint:** `GET /auth/manager/booking/{bookingId}?userId={userId}`
+**Access:** MANAGER only
+**Description:** Get details of a specific booking
+
+**Path Parameters:**
+- `bookingId` (UUID) - ID of the booking
+
+**Query Parameters:**
+- `userId` (UUID) - Manager's user ID
+
+**Response:**
+```json
+{
+ "bookingId": "uuid",
+ "roomId": "uuid",
+ "roomName": "Conference Room A",
+ "userId": "uuid",
+ "startTime": "2026-01-10T09:00:00Z",
+ "endTime": "2026-01-10T11:00:00Z",
+ "status": "CONFIRMED",
+ "creditsCost": 120,
+ "amenities": [...],
+ "createdAt": "2026-01-09T10:00:00Z"
+}
+```
+
+---
+
+### 7. Cancel Booking
+**Endpoint:** `DELETE /auth/manager/booking/{bookingId}?userId={userId}`
+**Access:** MANAGER only
+**Description:** Cancel a booking
+
+**Path Parameters:**
+- `bookingId` (UUID) - ID of the booking to cancel
+
+**Query Parameters:**
+- `userId` (UUID) - Manager's user ID
+
+**Response:**
+```json
+{
+ "message": "Booking cancelled successfully by manager: uuid",
+ "statusCode": "200",
+ "refundedCredits": 120
+}
+```
+
+**Important:**
+- If cancelled before meeting time: Full credit refund
+- If cancelled late or no-show: Penalty applied
+- `creditsUsed` is adjusted in `manager_credit_summary`
+
+---
+
+## Check-in Management
+
+### 8. Get Today's Bookings
+**Endpoint:** `GET /auth/manager/check-in/today-bookings?userId={userId}&date={date}`
+**Access:** MANAGER only
+**Description:** Get all bookings for today for check-in
+
+**Query Parameters:**
+- `userId` (UUID) - Manager's user ID
+- `date` (String) - Date in format YYYY-MM-DD (e.g., "2026-01-09")
+
+**Response:**
+```json
+[
+ {
+ "bookingId": "uuid",
+ "roomName": "Conference Room A",
+ "startTime": "2026-01-09T09:00:00Z",
+ "endTime": "2026-01-09T11:00:00Z",
+ "status": "CONFIRMED",
+ "checkedIn": false
+ },
+ {
+ "bookingId": "uuid",
+ "roomName": "Meeting Room B",
+ "startTime": "2026-01-09T14:00:00Z",
+ "endTime": "2026-01-09T15:00:00Z",
+ "status": "CONFIRMED",
+ "checkedIn": true
+ }
+]
+```
+
+---
+
+### 9. Check In to Meeting
+**Endpoint:** `POST /auth/manager/check-in/{bookingId}?userId={userId}`
+**Access:** MANAGER only
+**Description:** Check in to a booked meeting
+
+**Path Parameters:**
+- `bookingId` (UUID) - ID of the booking
+
+**Query Parameters:**
+- `userId` (UUID) - Manager's user ID
+
+**Response:**
+```json
+{
+ "bookingId": "uuid",
+ "status": "CHECKED_IN",
+ "checkedInAt": "2026-01-09T09:05:00Z",
+ "message": "Checked in successfully"
+}
+```
+
+---
+
+# Member APIs
+
+## Meeting Management
+
+### 1. Get Manager Meetings
+**Endpoint:** `GET /member/manager-meetings?managerName={name}&meetingDate={date}`
+**Access:** MEMBER only
+**Description:** View meetings organized by a specific manager
+
+**Query Parameters:**
+- `managerName` (String, optional) - Filter by manager name
+- `meetingDate` (String, optional) - Filter by date (YYYY-MM-DD)
+
+**Response:**
+```json
+[
+ {
+ "meetingId": "uuid",
+ "managerName": "John Manager",
+ "roomName": "Conference Room A",
+ "startTime": "2026-01-10T09:00:00Z",
+ "endTime": "2026-01-10T11:00:00Z",
+ "purpose": "Team Meeting",
+ "status": "SCHEDULED"
+ }
+]
+```
+
+---
+
+# Error Responses
+
+## Standard Error Format
+```json
+{
+ "error": "Error message",
+ "statusCode": 400,
+ "timestamp": "2026-01-09T10:00:00Z"
+}
+```
+
+## Common HTTP Status Codes
+
+| Code | Meaning | Description |
+|------|---------|-------------|
+| 200 | OK | Request successful |
+| 201 | Created | Resource created successfully |
+| 400 | Bad Request | Invalid request parameters |
+| 401 | Unauthorized | Authentication required |
+| 403 | Forbidden | Access denied - insufficient permissions |
+| 404 | Not Found | Resource not found |
+| 409 | Conflict | Resource already exists or conflict |
+| 500 | Internal Server Error | Server error |
+
+---
+
+# Database Schema Reference
+
+## Users Table
+```sql
+CREATE TABLE USERS (
+ user_id UUID PRIMARY KEY,
+ name VARCHAR(100) NOT NULL,
+ email VARCHAR(255) UNIQUE NOT NULL,
+ password_hash VARCHAR(255) NOT NULL,
+ role VARCHAR(20) NOT NULL CHECK (role IN ('ADMIN', 'MANAGER', 'MEMBER')),
+ credits INTEGER DEFAULT 0 CHECK (credits >= 0),
+ created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+ updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+);
+```
+
+## Manager Credit Summary Table
+```sql
+CREATE TABLE manager_credit_summary (
+ user_id UUID PRIMARY KEY,
+ manager_name VARCHAR(100) NOT NULL,
+ email VARCHAR(255) NOT NULL,
+ total_credits INTEGER NOT NULL DEFAULT 2000,
+ credits_used INTEGER NOT NULL DEFAULT 0,
+ penalty INTEGER NOT NULL DEFAULT 0,
+ last_reset_at TIMESTAMP,
+ updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+
+ CONSTRAINT fk_manager_summary_user
+ FOREIGN KEY (user_id)
+ REFERENCES users(user_id)
+);
+```
+
+---
+
+# Frontend-Backend Integration
+
+## LocalStorage Structure
+
+After successful login, the following is stored in localStorage:
+
+```javascript
+{
+ userToken: "jwt-token-or-dummy-token",
+ userId: "uuid",
+ userName: "John Doe",
+ userEmail: "john@example.com",
+ userRole: "MANAGER" // Always uppercase: ADMIN, MANAGER, or MEMBER
+}
+```
+
+## API Call Example (Frontend)
+
+```javascript
+// Using the API module
+const response = await ManagerAPI.bookRoom({
+ userId: localStorage.getItem('userId'),
+ roomId: "room-uuid",
+ startTime: "2026-01-10T09:00:00Z",
+ endTime: "2026-01-10T11:00:00Z",
+ purpose: "Team Meeting",
+ amenityIds: ["amenity-uuid-1"]
+});
+
+if (response.success) {
+ console.log('Booking successful:', response.data);
+} else {
+ console.error('Booking failed:', response.error);
+}
+```
+
+---
+
+# Role-Based Access Control (RBAC)
+
+## Dashboard Access
+
+| Role | Allowed Dashboard | File |
+|------|------------------|------|
+| ADMIN | Admin Dashboard | `admindashboard.html` |
+| MANAGER | Manager Dashboard | `manager-dashboard.html` |
+| MEMBER | Member Dashboard | `member-dashboard.html` |
+
+## Security Rules
+
+1. ✅ Users can only access their role's dashboard
+2. ✅ Attempting to access another role's dashboard = redirect to their own
+3. ✅ Not authenticated = redirect to login page
+4. ✅ All API calls automatically include `userId` for manager endpoints
+5. ✅ Backend validates role on every request
+
+---
+
+# Testing Guide
+
+## Test with Postman/Curl
+
+### Example: Login
+```bash
+curl -X POST http://localhost:8081/api/auth/login \
+ -H "Content-Type: application/json" \
+ -d '{
+ "email": "manager@example.com",
+ "password": "password123"
+ }'
+```
+
+### Example: Get Manager Bookings
+```bash
+curl -X GET "http://localhost:8081/api/auth/manager/myBookings?userId=your-uuid-here"
+```
+
+### Example: Book a Room
+```bash
+curl -X POST "http://localhost:8081/api/auth/manager/bookRoom?userId=your-uuid-here" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "userId": "your-uuid-here",
+ "roomId": "room-uuid",
+ "startTime": "2026-01-10T09:00:00Z",
+ "endTime": "2026-01-10T11:00:00Z",
+ "purpose": "Team Meeting"
+ }'
+```
+
+---
+
+# Change Log
+
+## Version 1.0 (Current)
+- ✅ Authentication endpoints
+- ✅ Admin room & amenity management
+- ✅ Manager booking & credit system
+- ✅ Member meeting viewing
+- ✅ Role-based access control
+- ✅ Check-in functionality
+
+## Planned Features
+- 🔄 Email notifications
+- 🔄 Calendar integration
+- 🔄 Recurring meetings
+- 🔄 Meeting analytics
+- 🔄 Advanced search & filters
+
+---
+
+# Support & Contact
+
+For API issues or questions, please check:
+1. Console logs (F12 in browser)
+2. Network tab for API responses
+3. This documentation for endpoint details
+
+**Developer Contact:** Your Team
+**Last Updated:** January 9, 2026
diff --git a/README.md b/README.md
deleted file mode 100644
index 1be1a271..00000000
--- a/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# wecode-hack
-Lets contribute together
-to bookit
diff --git a/SECURITY_RBAC.md b/SECURITY_RBAC.md
new file mode 100644
index 00000000..cf060d6c
--- /dev/null
+++ b/SECURITY_RBAC.md
@@ -0,0 +1,214 @@
+# Role-Based Access Control (RBAC) Security Layer
+
+## Overview
+The application now has a security middleware that prevents users from accessing dashboards they don't have permission for.
+
+## How It Works
+
+### 🔐 Automatic Protection
+The security layer automatically runs on every dashboard page load and:
+1. Checks if the user is logged in
+2. Verifies their role matches the dashboard they're trying to access
+3. Redirects them if they don't have permission
+
+### 🎭 Role-Dashboard Mapping
+
+| Role | Allowed Dashboard | File |
+|------|------------------|------|
+| ADMIN | Admin Dashboard | `admindashboard.html` |
+| MANAGER | Manager Dashboard | `manager-dashboard.html` |
+| MEMBER | Member Dashboard | `member-dashboard.html` |
+
+## What Happens When...
+
+### ✅ Correct Access
+**User:** ADMIN role
+**Tries to access:** `admindashboard.html`
+**Result:** ✅ Access granted
+
+```
+🔐 Checking dashboard access...
+📄 Current page: admindashboard.html
+👤 User Role: ADMIN
+🎭 Required role for this dashboard: ADMIN
+✅ Access granted for ADMIN to admindashboard.html
+```
+
+### ❌ Wrong Dashboard
+**User:** MANAGER role
+**Tries to access:** `admindashboard.html`
+**Result:** ❌ Blocked and redirected to `manager-dashboard.html`
+
+```
+🔐 Checking dashboard access...
+📄 Current page: admindashboard.html
+👤 User Role: MANAGER
+🎭 Required role for this dashboard: ADMIN
+❌ Access denied! User role "MANAGER" cannot access "ADMIN" dashboard
+🔄 Redirecting MANAGER to their dashboard: manager-dashboard.html
+```
+
+**User sees alert:**
+```
+Access Denied!
+
+You are logged in as MANAGER.
+Redirecting to your dashboard...
+```
+
+### ⚠️ Not Logged In
+**User:** No authentication
+**Tries to access:** Any dashboard
+**Result:** ⚠️ Redirected to `login.html`
+
+```
+🔐 Checking dashboard access...
+📄 Current page: manager-dashboard.html
+⚠️ User not authenticated, redirecting to login
+🔄 Redirecting to login page...
+```
+
+## Implementation Details
+
+### Files Modified
+
+1. **`js/common.js`** - Security middleware
+ - `DashboardAccess` object with all security logic
+ - `initDashboardSecurity()` - Auto-runs on page load
+ - `checkAccess()` - Validates user permissions
+ - `redirectToLogin()` - Handles unauthenticated users
+ - `redirectToCorrectDashboard()` - Redirects to proper dashboard
+
+2. **Dashboard Files** - Security script included
+ - `admindashboard.html` ✅
+ - `manager-dashboard.html` ✅
+ - `member-dashboard.html` ✅
+
+### Security Checks
+
+```javascript
+// What gets checked:
+1. userToken - Must exist in localStorage
+2. userRole - Must match dashboard requirement
+3. userId - Must be present
+```
+
+### LocalStorage Data Used
+
+```javascript
+localStorage.getItem('userToken') // Authentication token
+localStorage.getItem('userRole') // 'ADMIN', 'MANAGER', or 'MEMBER'
+localStorage.getItem('userId') // User's UUID
+```
+
+## Testing the Security
+
+### Test Case 1: Login as ADMIN, try to access Manager Dashboard
+1. Login as ADMIN
+2. Manually navigate to `manager-dashboard.html`
+3. **Expected:** Alert shown, redirected to `admindashboard.html`
+
+### Test Case 2: Login as MANAGER, try to access Admin Dashboard
+1. Login as MANAGER
+2. Manually navigate to `admindashboard.html`
+3. **Expected:** Alert shown, redirected to `manager-dashboard.html`
+
+### Test Case 3: Not logged in, try to access any dashboard
+1. Clear localStorage (logout)
+2. Navigate to any dashboard
+3. **Expected:** Redirected to `login.html`
+
+### Test Case 4: Correct access
+1. Login as ADMIN
+2. Navigate to `admindashboard.html`
+3. **Expected:** ✅ Dashboard loads normally
+
+## Console Debugging
+
+Open browser console (F12) to see detailed security logs:
+
+```javascript
+🔐 Checking dashboard access...
+📄 Current page: admindashboard.html
+👤 User Role: ADMIN
+🔑 Has Token: true
+🆔 User ID: 550e8400-e29b-41d4-a716-446655440000
+🎭 Required role for this dashboard: ADMIN
+✅ Access granted for ADMIN to admindashboard.html
+```
+
+## Adding New Dashboards
+
+To add a new dashboard to the security layer:
+
+1. **Add to `js/common.js`:**
+
+```javascript
+dashboards: {
+ 'admindashboard.html': 'ADMIN',
+ 'manager-dashboard.html': 'MANAGER',
+ 'member-dashboard.html': 'MEMBER',
+ 'new-dashboard.html': 'NEW_ROLE' // Add this
+},
+
+roleDashboards: {
+ 'ADMIN': 'admindashboard.html',
+ 'MANAGER': 'manager-dashboard.html',
+ 'MEMBER': 'member-dashboard.html',
+ 'NEW_ROLE': 'new-dashboard.html' // Add this
+}
+```
+
+2. **Include security script in new dashboard:**
+
+```html
+
+```
+
+## Logout Functionality
+
+To add a logout button to any dashboard:
+
+```html
+
+```
+
+This will:
+- Clear all localStorage data
+- Redirect to login page
+
+## Security Features
+
+✅ **Role-based access control**
+✅ **Automatic redirect to correct dashboard**
+✅ **Fallback to login if not authenticated**
+✅ **Console logging for debugging**
+✅ **User-friendly alerts**
+✅ **Prevents URL manipulation**
+✅ **Clears corrupted auth data**
+
+## Important Notes
+
+⚠️ **This is client-side security only!**
+- Backend must also validate roles on every API request
+- Never trust client-side data alone
+- This prevents accidental access and improves UX
+- Backend should check JWT token and role for all protected endpoints
+
+⚠️ **Clear browser cache after deploying**
+- Users should hard refresh (Ctrl + F5)
+- Or clear localStorage manually
+
+## Troubleshooting
+
+### Issue: Infinite redirect loop
+**Cause:** Role in localStorage doesn't match any dashboard
+**Solution:** Clear localStorage and login again
+
+### Issue: Security not working
+**Cause:** `common.js` not loaded
+**Solution:** Verify `` is in HTML
+
+### Issue: User can still access wrong dashboard
+**Cause:** Browser cached old version
+**Solution:** Hard refresh (Ctrl + F5) or clear cache
diff --git a/addamenity.html b/addamenity.html
new file mode 100644
index 00000000..9c667a28
--- /dev/null
+++ b/addamenity.html
@@ -0,0 +1,184 @@
+
+
+
+
+
+
+
+ Admin Dashboard - Add Amenity
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Add an amenity
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/admindashboard.html b/admindashboard.html
new file mode 100644
index 00000000..85d54f3f
--- /dev/null
+++ b/admindashboard.html
@@ -0,0 +1,1194 @@
+
+
+
+
+
+ Admin Dashboard - BookIt
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/analytics.html b/analytics.html
new file mode 100644
index 00000000..b5765c23
--- /dev/null
+++ b/analytics.html
@@ -0,0 +1,825 @@
+
+
+
+
+
+
+ Analyze Meetings - Bookit
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
Average Duration
+
+
+
+
+
+
+
+
+
+
+
+
+
Select a room to view occupancy trends.
+
+
+
+
+
+
+
+
Select a room to view booking patterns.
+
+
+
+
+
+
+
+
+
+
diff --git a/api.js b/api.js
new file mode 100644
index 00000000..d3235bc3
--- /dev/null
+++ b/api.js
@@ -0,0 +1,450 @@
+// API Configuration
+const API_BASE_URL = 'http://localhost:8081/api';
+
+// API Endpoints
+const API_ENDPOINTS = {
+ AUTH: {
+ SIGNUP: '/auth/signUp',
+ LOGIN: '/auth/login',
+ LOGOUT: '/auth/logout'
+ },
+ ADMIN: {
+ // Rooms
+ GET_ALL_ROOMS: '/admin/getAllRoom',
+ GET_ROOM_BY_ID: '/admin/getRoomById/{roomId}',
+ CREATE_ROOM: '/admin/createRoom',
+ UPDATE_ROOM: '/admin/updateRoom',
+ DELETE_ROOM: '/admin/rooms/{roomId}',
+ // Amenities
+ GET_ALL_AMENITIES: '/admin/getAllAmenities',
+ GET_AMENITY_BY_ID: '/admin/getAmenitieById/{amenityId}',
+ CREATE_AMENITY: '/admin/addAmenitie',
+ UPDATE_AMENITY: '/admin/updateAmenitie',
+ DELETE_AMENITY: '/admin/amenities/{amenityId}'
+ },
+ MANAGER: {
+ GET_PROFILE: '/auth/manager/profile',
+ VIEW_AVAILABLE_MEETINGS: '/auth/manager/viewAvailableMeetingRoom',
+ BOOK_ROOM: '/auth/manager/bookRoom',
+ GET_MY_BOOKINGS: '/auth/manager/myBookings',
+ CANCEL_BOOKING: '/auth/manager/booking/{bookingId}',
+ GET_TODAY_BOOKING: '/auth/manager/check-in/today-bookings',
+ GET_CREDIT_SUMMARY: '/auth/manager/credit-summary',
+ GET_ALL_ROOMS: '/auth/manager/viewAvailableMeetingRoom'
+ },
+ MEMBER: {
+ GET_MANAGER_MEETINGS: '/member/manager-meetings'
+ }
+};
+
+// Helper function to build full URL
+function buildUrl(endpoint, params = {}) {
+ let url = API_BASE_URL + endpoint;
+ Object.keys(params).forEach(key => {
+ url = url.replace(`{${key}}`, params[key]);
+ });
+ return url;
+}
+
+// Generic API call function
+async function apiCall(endpoint, options = {}) {
+ const defaultOptions = {
+ method: 'GET',
+ headers: {
+ 'Content-Type': 'application/json'
+ }
+ };
+
+ // Add auth token if available
+ const token = localStorage.getItem('userToken');
+ if (token) {
+ defaultOptions.headers['Authorization'] = `Bearer ${token}`;
+ }
+
+ // Add userId to query params for manager endpoints if available
+ const userId = localStorage.getItem('userId');
+ if (userId && endpoint.includes('/auth/manager/')) {
+ const separator = endpoint.includes('?') ? '&' : '?';
+ endpoint = `${endpoint}${separator}userId=${userId}`;
+ }
+
+ const config = {
+ ...defaultOptions,
+ ...options,
+ headers: {
+ ...defaultOptions.headers,
+ ...(options.headers || {})
+ }
+ };
+
+ console.log('🌐 API Call:', {
+ endpoint,
+ method: config.method,
+ body: config.body,
+ headers: config.headers
+ });
+
+ try {
+ const response = await fetch(endpoint, config);
+
+ if (!response.ok) {
+ const errorText = await response.text();
+ throw new Error(errorText || `HTTP error! status: ${response.status}`);
+ }
+
+ const contentType = response.headers.get('content-type');
+ if (contentType && contentType.includes('application/json')) {
+ const data = await response.json();
+ return { success: true, data };
+ } else {
+ const text = await response.text();
+ return { success: true, data: text };
+ }
+ } catch (error) {
+ console.error('API call failed:', error);
+ return { success: false, error: error.message };
+ }
+}
+
+// Authentication API
+const AuthAPI = {
+ signUp: async (userData) => {
+ const url = buildUrl(API_ENDPOINTS.AUTH.SIGNUP);
+ return await apiCall(url, {
+ method: 'POST',
+ body: JSON.stringify(userData)
+ });
+ },
+
+ login: async (credentials) => {
+ const url = buildUrl(API_ENDPOINTS.AUTH.LOGIN);
+ return await apiCall(url, {
+ method: 'POST',
+ body: JSON.stringify(credentials)
+ });
+ },
+
+ logout: async () => {
+ const url = buildUrl(API_ENDPOINTS.AUTH.LOGOUT);
+ return await apiCall(url, { method: 'POST' });
+ }
+};
+
+// Admin Room API
+const AdminRoomAPI = {
+ getAll: async () => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.GET_ALL_ROOMS);
+ return await apiCall(url);
+ },
+
+ getById: async (roomId) => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.GET_ROOM_BY_ID, { roomId });
+ return await apiCall(url);
+ },
+
+ create: async (roomData) => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.CREATE_ROOM);
+ return await apiCall(url, {
+ method: 'POST',
+ body: JSON.stringify(roomData)
+ });
+ },
+
+ update: async (roomData) => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.UPDATE_ROOM);
+ return await apiCall(url, {
+ method: 'PUT',
+ body: JSON.stringify(roomData)
+ });
+ },
+
+ delete: async (roomId) => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.DELETE_ROOM, { roomId });
+ return await apiCall(url, { method: 'DELETE' });
+ }
+};
+
+// Admin Amenity API
+const AdminAmenityAPI = {
+ getAll: async () => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.GET_ALL_AMENITIES);
+ return await apiCall(url);
+ },
+
+ getById: async (amenityId) => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.GET_AMENITY_BY_ID, { amenityId });
+ return await apiCall(url);
+ },
+
+ create: async (amenityData) => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.CREATE_AMENITY);
+ return await apiCall(url, {
+ method: 'POST',
+ body: JSON.stringify(amenityData)
+ });
+ },
+
+ update: async (amenityData) => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.UPDATE_AMENITY);
+ return await apiCall(url, {
+ method: 'PUT',
+ body: JSON.stringify(amenityData)
+ });
+ },
+
+ delete: async (amenityId) => {
+ const url = buildUrl(API_ENDPOINTS.ADMIN.DELETE_AMENITY, { amenityId });
+ return await apiCall(url, { method: 'DELETE' });
+ }
+};
+
+// Manager API
+const ManagerAPI = {
+ getProfile: async () => {
+ const url = buildUrl(API_ENDPOINTS.MANAGER.GET_PROFILE);
+ return await apiCall(url);
+ },
+
+ getCreditSummary: async () => {
+ const url = buildUrl(API_ENDPOINTS.MANAGER.GET_CREDIT_SUMMARY);
+ return await apiCall(url);
+ },
+
+ viewAvailableMeetings: async () => {
+ const url = buildUrl(API_ENDPOINTS.MANAGER.VIEW_AVAILABLE_MEETINGS);
+ return await apiCall(url);
+ },
+
+ bookRoom: async (bookingData) => {
+ const url = buildUrl(API_ENDPOINTS.MANAGER.BOOK_ROOM);
+ console.log('🔵 ManagerAPI.bookRoom called');
+ console.log('📤 URL:', url);
+ console.log('📦 Booking Data:', bookingData);
+ console.log('📝 JSON String:', JSON.stringify(bookingData));
+ return await apiCall(url, {
+ method: 'POST',
+ body: JSON.stringify(bookingData)
+ });
+ },
+
+ getMyBookings: async () => {
+ const url = buildUrl(API_ENDPOINTS.MANAGER.GET_MY_BOOKINGS);
+ return await apiCall(url);
+ },
+
+ cancelBooking: async (bookingId) => {
+ const url = buildUrl(API_ENDPOINTS.MANAGER.CANCEL_BOOKING, { bookingId });
+ return await apiCall(url, { method: 'DELETE' });
+ },
+
+ getTodayBookings: async (date) => {
+ // If no date provided, use today's date
+ if (!date) {
+ date = new Date().toISOString().split('T')[0]; // Format: YYYY-MM-DD
+ }
+ const url = buildUrl(API_ENDPOINTS.MANAGER.GET_TODAY_BOOKING);
+ const fullUrl = `${url}&date=${date}`;
+ return await apiCall(fullUrl);
+ },
+
+ getAllRooms: async () => {
+ const url = buildUrl(API_ENDPOINTS.MANAGER.GET_ALL_ROOMS);
+ return await apiCall(url);
+ }
+};
+
+// Member API
+const MemberAPI = {
+ getManagerMeetings: async (managerName = '', meetingDate = '') => {
+ const params = new URLSearchParams();
+ if (managerName) params.append('managerName', managerName);
+ if (meetingDate) params.append('meetingDate', meetingDate);
+
+ const url = buildUrl(API_ENDPOINTS.MEMBER.GET_MANAGER_MEETINGS);
+ const fullUrl = params.toString() ? `${url}?${params.toString()}` : url;
+ return await apiCall(fullUrl);
+ }
+};
+
+// Export all API modules
+const API = {
+ Auth: AuthAPI,
+ AdminRoom: AdminRoomAPI,
+ AdminAmenity: AdminAmenityAPI,
+ Manager: ManagerAPI,
+ Member: MemberAPI
+};
+
+
+// ============================================
+// BACKWARD COMPATIBILITY FUNCTIONS
+// Keep old function names for existing code
+// ============================================
+
+async function getAllRooms() {
+ console.log('🔄 getAllRooms() called');
+
+ // Try to get user role from localStorage
+ const userRole = localStorage.getItem('userRole');
+ const userId = localStorage.getItem('userId');
+
+ console.log('👤 User Role:', userRole);
+ console.log('🆔 User ID:', userId);
+
+ // If user is a manager, use manager endpoint
+ if (userRole === 'MANAGER') {
+ console.log('📡 Fetching rooms from Manager API...');
+ const result = await ManagerAPI.getAllRooms();
+ console.log('✅ Manager API result:', result);
+
+ if (!result.success) {
+ console.error('❌ Manager API failed:', result.error);
+ }
+
+ return result.success ? result.data : [];
+ }
+
+ // Otherwise use admin endpoint
+ console.log('📡 Fetching rooms from Admin API...');
+ const result = await AdminRoomAPI.getAll();
+ console.log('✅ Admin API result:', result);
+
+ if (!result.success) {
+ console.error('❌ Admin API failed:', result.error);
+ }
+
+ return result.success ? result.data : [];
+}
+
+async function getRoomById(roomId) {
+ const result = await AdminRoomAPI.getById(roomId);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function createRoom(roomData) {
+ const result = await AdminRoomAPI.create(roomData);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function updateRoom(roomData) {
+ const result = await AdminRoomAPI.update(roomData);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function deleteRoom(roomId) {
+ const result = await AdminRoomAPI.delete(roomId);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function getAllAmenities() {
+ const result = await AdminAmenityAPI.getAll();
+ return result.success ? result.data : [];
+}
+
+async function getAmenityById(amenityId) {
+ const result = await AdminAmenityAPI.getById(amenityId);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function createAmenity(amenityData) {
+ const result = await AdminAmenityAPI.create(amenityData);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function updateAmenity(amenityData) {
+ const result = await AdminAmenityAPI.update(amenityData);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function deleteAmenity(amenityId) {
+ const result = await AdminAmenityAPI.delete(amenityId);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function getManagerProfile() {
+ const result = await ManagerAPI.getProfile();
+ if (!result.success) {
+ console.error('Failed to load manager profile:', result.error);
+ throw new Error(result.error || 'Failed to load profile');
+ }
+ return result.data;
+}
+
+async function getManagerCreditSummary() {
+ const result = await ManagerAPI.getCreditSummary();
+ if (!result.success) {
+ console.error('Failed to load credit summary:', result.error);
+ // Return default values if API fails
+ return {
+ totalCredits: 2000,
+ creditsUsed: 0,
+ creditsRemaining: 2000,
+ penalty: 0
+ };
+ }
+ return result.data;
+}
+
+async function viewAvailableMeetings() {
+ const result = await ManagerAPI.viewAvailableMeetings();
+ return result.success ? result.data : [];
+}
+
+async function bookRoom(bookingData) {
+ const result = await ManagerAPI.bookRoom(bookingData);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function getMyBookings() {
+ const result = await ManagerAPI.getMyBookings();
+ return result.success ? result.data : [];
+}
+
+async function cancelBooking(bookingId) {
+ const result = await ManagerAPI.cancelBooking(bookingId);
+ if (!result.success) throw new Error(result.error);
+ return result.data;
+}
+
+async function getTodayBookings() {
+ const result = await ManagerAPI.getTodayBookings();
+ return result.success ? result.data : [];
+}
+
+// ============================================
+// UTILITY FUNCTIONS
+// ============================================
+
+/**
+ * Format amenity name for display
+ * @param {string} amenityName - Amenity name in uppercase with underscores
+ * @returns {string} Formatted amenity name
+ */
+function formatAmenityName(amenityName) {
+ if (!amenityName) return '';
+ return amenityName
+ .toLowerCase()
+ .split('_')
+ .map(word => word.charAt(0).toUpperCase() + word.slice(1))
+ .join(' ');
+}
+
+/**
+ * Calculate room cost including amenities
+ * @param {number} perHourCost - Base cost per hour
+ * @param {Array