🍱 Food Bridge — Crumbs to Care

Transforming Food Waste into Hope for Orphan Children

A full-stack food-rescue platform that connects surplus food from restaurants, events and households with orphan children who need it — through a free, door-to-door pickup and delivery network.

Rescue • Nourish • Care

---

🎯 Overview

Food Bridge is a role-based web application with four kinds of users — Guest, User, Admin, and Delivery Agent — each with their own dashboard and permissions. A donor submits surplus food, an admin oversees everything, and a delivery agent picks it up and delivers it to Crumbs to Care. Live status tracking connects all three, end to end.

Live demo: add your Render URL here after deploying → see DEPLOYMENT.md

---

✨ Key Features

Area	What it does
🔐 Role-based auth	User / Admin / Delivery logins, each issuing a signed JWT; passwords hashed with bcrypt
🍱 Donation flow	Guests or users submit food; it's stored in MySQL and instantly visible to admin + agents
🛵 Delivery job board	Agents see available pickups, accept (race-safe), mark Picked Up → Delivered
🛠️ Admin control panel	Approve / assign / cancel donations, view users, agents and contact messages — all live from the DB
📦 Status tracking	Donors track a donation from Pending → Accepted → Picked Up → Delivered
💬 Contact + chatbot	Contact form saved to DB; in-page support assistant
🛡️ Hardened backend	JWT role checks, rate-limiting, input validation, helmet, configurable CORS

---

🧰 Tech Stack

• Frontend: HTML5, CSS3, vanilla JavaScript (no framework — lightweight & fast)
• Backend: Node.js, Express
• Database: MySQL (mysql2)
• Auth & Security: JSON Web Tokens, bcryptjs, helmet, express-rate-limit
• Config: dotenv, CORS

---

🏗️ Architecture

                ┌─────────────────────────────────────────┐
  Browser  ───▶ │  Express server (server.js)             │
  (HTML/JS)     │  • serves the website (static files)    │
                │  • REST API under /api/*                 │
                │  • JWT auth + role checks + validation   │
                └───────────────────┬─────────────────────┘
                                    │  mysql2
                                    ▼
                        ┌───────────────────────┐
                        │   MySQL: fooddonate    │
                        │  users · donations ·   │
                        │  delivery_agents ·     │
                        │  contact_messages      │
                        └───────────────────────┘

One server hosts everything — the frontend and the API — so it runs with a single command and deploys as a single service.

---

🚀 Quick Start (local)

Requirements: Node.js (LTS) and MySQL.

# 1. Install dependencies
npm install

# 2. Set up the database (in MySQL Workbench, run BOTH files)
#    - database.sql          (creates the tables)
#    - database-phase2.sql   (adds delivery-agent tracking columns)

# 3. Create your .env from the template and fill in your MySQL password
cp .env.example .env        # Windows: copy .env.example .env

# 4. Start the server
node server.js

Then open http://localhost:3000 — the whole site works from one place. ✅

🔐 Default admin: laxtline@gmail.com / laxtline123. Change it for real use — hash a new password with: node -e "console.log(require('bcryptjs').hashSync('NEW_PASSWORD',10))" and paste it into ADMIN_PASSWORD_HASH in .env.

Deploying live? See DEPLOYMENT.md.

---

📸 Gallery

💡 Tip: run the app locally and drop screenshots of the Home, Donate, Admin Dashboard, and Delivery Board pages here to make the repo shine.

---

📁 Project Structure

Food-Bridge/
├── server.js              ← Express backend (serves site + REST API)
├── database.sql           ← MySQL schema (run first)
├── database-phase2.sql    ← Migration: delivery-agent columns
├── render.yaml            ← One-click Render deploy blueprint
├── .env.example           ← Copy to .env and fill in
├── package.json
│
├── js/
│   └── config.js          ← API base URL + token helpers (single source)
│
├── index.html             ← Home + role login popup
├── about.html · crumbs-to-care.html
├── fooddonate.html        ← Donation form
├── profile.html           ← Track my donations
├── user-signup.html       ← User auth
├── admin-login.html · admin-dashboard.html
├── delivery-register.html · delivery-login.html   (agent auth + dashboard)
├── contact.html
├── location/              ← Map + address
└── images/                ← Logos & images

---

🔌 API Endpoints

Method	URL	Auth	What it does
POST	/api/signup	—	Register a new user
POST	/api/login	—	User login → returns token
POST	/api/donate	—	Submit a food donation (guests allowed)
GET	/api/donation/:id	—	Check one donation's status
GET	/api/donations/search	—	Guest tracking by name/phone
GET	/api/donations/user/:id	user	A user's own donations
POST	/api/admin/login	—	Admin login → returns token
GET	/api/admin/donations	admin	All donations
PUT	/api/admin/donation/:id	admin	Update donation status
DELETE	/api/admin/donation/:id	admin	Delete a donation
GET	/api/admin/users	admin	List users
GET	/api/admin/agents	admin	List delivery agents
GET	/api/admin/messages	admin	Contact-form inbox
POST	/api/delivery/signup	—	Register delivery agent
POST	/api/delivery/login	—	Agent login → returns token
GET	/api/delivery/available	delivery	Unassigned pickups
GET	/api/delivery/mine	delivery	This agent's orders
PUT	/api/delivery/accept/:id	delivery	Accept an order (race-safe)
PUT	/api/delivery/donation/:id	delivery	Mark Picked Up / Delivered
POST	/api/contact	—	Send a contact message
GET	/api/health	—	Health check

---

🔐 Security Highlights

• Passwords hashed with bcrypt — never stored or sent as plain text.
• No credentials in frontend code — every login is checked server-side; the browser only holds a short-lived JWT.
• Role-scoped tokens — a user token can't call admin routes (returns 403).
• Race-safe accept — two agents can't grab the same pickup; status updates are checked against the owning agent_id.
• Users see only their own donations (/api/donations/user/:id matches token id).
• Login rate-limiting (8 tries / 15 min), input validation, whitelisted status values, helmet headers, and configurable CORS.
• Secrets in .env only, kept out of Git via .gitignore.

---

🗺️ Roadmap

• Automated password reset via email (nodemailer + OTP)
• Real-time delivery tracking bar (WebSocket / polling)
• Email/SMS notifications on status changes
• Unit + API tests (Jest / Supertest) and CI

---

👤 Author

Suryakanta Pradhan — built as a full-stack portfolio project. 📧 laxtline@gmail.com

📄 License

MIT — free to use and learn from.