# Summit Staffing — Admin API (PostgreSQL + Express) Uses **Railway Postgres** (`DATABASE_URL`). No MongoDB, no Docker required. The React site in `summit-staffing-website` calls `/api/*` (Vite proxies to this server in dev). ## Railway **Important:** Variables in `backend/.env` on your PC only affect **local** `npm run dev`. The live API uses variables set in the **Railway dashboard** → your API service → **Variables**. After changing them, click **Redeploy**. 1. In your Railway project, open the **Postgres** service and copy **`DATABASE_URL`** (or use a reference variable from your API service). 2. On the **summit-staffing** (or admin API) service, set: - `DATABASE_URL` — same as Postgres plugin - `JWT_SECRET` — use the same secret you already have on the backend (must match login token verification) - `FRONTEND_ORIGIN` — comma-separated browser origins, e.g. `http://localhost:5173,http://localhost:5174,https://admin.summitstaffing.com.au,https://summitstaffing.com.au` Without `https://admin.summitstaffing.com.au`, login on the admin subdomain shows **Network error** / **CORS** in the browser. 3. Deploy this `backend` folder as the service root (`npm start`). **If login works on localhost but CORS fails on `admin.summitstaffing.com.au` even with `FRONTEND_ORIGIN` set:** Railway is probably still running an **older** `athletic-heart-backend` build that only allows `localhost`. Redeploy **this** folder (see below). After a good deploy, `GET /` returns `"Summit Staffing Admin API"` and `GET /api/health` returns `{"ok":true}` (not `/health` with `"summit-backend"`). 4. **Redeploy on Railway (pick one):** - **GitHub:** Push repo → Railway service → Settings → Root Directory = `backend` → Connect repo → Deploy. - **CLI:** `cd backend` → `railway link` (choose `athletic-heart-backend`) → `railway up`. - After deploy, open **Deployments → View logs** and confirm: `CORS allowed origins: ... admin.summitstaffing.com.au ...` On each deploy, `npm start` runs **migrations** (`schema.sql`) automatically so admin tables exist. ## Local 1. Copy `.env.example` to `.env` and set **`DATABASE_URL` to Railway’s `DATABASE_PUBLIC_URL`** when you run migrate/seed/dev **on your laptop**. The variable named `DATABASE_URL` on the Postgres plugin is often **internal** (`*.railway.internal`) and will **not** resolve off Railway — use the **public** URL from the same Postgres → Variables tab. 2. `npm install` 3. **If the DB already has real data:** do **not** run `npm run seed` (it truncates admin tables). Use **`npm run seed:admin`** once to create the login admin only (no deletes). Optional: `ADMIN_EMAIL`, `ADMIN_PASSWORD`; to reset only that admin’s password: `FORCE_RESET_ADMIN=1 npm run seed:admin`. 4. `npm run dev` Default admin credentials (only if you use `seed` or `seed:admin` with defaults): `admin@summitstaffing.com` / `Admin@123` ## Scripts | Script | Purpose | |--------|---------| | `npm run dev` | Dev server with watch | | `npm start` | Production server | | `npm run migrate` | Apply `schema.sql` only | | `npm run seed` | Migrate + **truncate** admin tables + demo data — **unsafe** if you store real data there | | `npm run seed:admin` | Migrate + add admin login **only** if missing (or password reset with `FORCE_RESET_ADMIN=1`) | ## Tables Admin tables are namespaced (`platform_users`, `worker_documents`, etc.) to reduce clashes if the same Postgres is shared. If another app already owns a name, change `schema.sql` and the route table names. ## Environment | Variable | Description | |----------|-------------| | `PORT` | API port (Railway sets this) | | `DATABASE_URL` | PostgreSQL connection string | | `DATABASE_SSL` | `false` to disable SSL for plain local Postgres | | `JWT_SECRET` | JWT signing secret | | `FRONTEND_ORIGIN` | CORS allowlist | | `APP_USERS_API_URL` | Optional remote JSON with `count` / `totalUsers` / `users` | | `APP_USERS_API_KEY` | Optional Bearer token for that URL | # summit-backend # summit-backend