✅ Rork Full Functionality Verification

Complete integration guide for Customer, Driver, and Merchant features

Critical Requirement: credentials: 'include'

ALL authenticated mobileAPI calls MUST include:

fetch('https://your-app.base44.com/functions/mobileAPI', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // ✅ CRITICAL: Sends auth cookies
  body: JSON.stringify({ action: 'myOrders' })
})

❌ Without credentials: 'include': Authentication will fail with 401 errors

Customer Features (20+ Actions)

Orders & Checkout

createOrder

Create order with payment auth

myOrders

Get all orders

activeOrders

Get in-progress orders

orderDetail

Get order details

updateOrder

Update order data

approveReplacement

Approve item replacement

rejectReplacement

Reject replacement

Cart Management

getCart

Fetch cart data

updateCart

Update cart items

saveCart

Save cart state

clearCart

Empty cart

testCart

Debug cart operations

Profile & Settings

profile / me

Get user profile

updateProfile

Update user data

getSettings

Get notification preferences

saveSettings

Update settings

Addresses & Payments

getAddresses

Get saved addresses

saveAddress

Add/update address

deleteAddress

Remove address

getPaymentMethods

Get payment methods

addPaymentMethod

Add new payment

updatePaymentMethod

Update payment

deletePaymentMethod

Remove payment

setDefaultPaymentMethod

Set default

Loyalty & Rewards

loyaltyMembership

Get memberships

enrollLoyalty

Enroll in program

loyaltyTransactions

Get points history

redeemPoints

Redeem loyalty points

getLoyalty

Get all loyalty data

Support & Refunds

requestRefund

Request post-delivery refund

getRefundStatus

Check refund status

getMyRefunds

Get all refunds

reportIssue

Create dispute

getMyIssues

Get reported issues

Health & Sustainability

getMealPlans

Get meal plans

saveMealPlan

Save meal plan

deleteMealPlan

Delete meal plan

getSustainability

Get carbon tracking

getDietaryTracking

Get dietary goals

saveDietaryTracking

Update dietary data

Social Features

getFoodCirclePosts

Get social feed

createFoodCirclePost

Create post

Driver Features (5 Actions)

Order Management

driverOrders

Get assigned orders

driverAcceptOrder

Accept delivery

driverCompleteOrder

Mark delivered

Location & Status

driverUpdateLocation

Update GPS location

driverUpdateStatus

Update online/offline status

Note: All driver actions require role: 'driver' in user profile

Merchant Features (20+ Actions) - Multi-Location Support

Profile & Settings

merchantProfile

Get merchant data (requires role=merchant)

updateMerchant

Update merchant info

merchantGetNotificationSettings

Get notification prefs

merchantUpdateNotificationSettings

Update notifications

Order Management

merchantOrders

Get orders (+ store_id filter)

merchantAcceptOrder

Accept order

merchantRejectOrder

Reject order

merchantMarkReady

Mark ready for pickup

merchantUpdateOrderStatus

Update status

Menu Management

merchantMenu

Get menu (+ store_id)

merchantUpdateMenu

Update menu sections

merchantCreateMenuItem

Add new item

merchantUpdateMenuItem

Update item

merchantToggleItemAvailability

Enable/disable item

Multi-Location Support

merchantGetStores

Get stores + GPS auto-detect nearest

merchantUpdateStore

Update store data

merchantGetAnalytics

Get analytics (+ store_id filter)

Payments & Payouts

merchantGetPayouts

Get payout history

createMerchantStripeAccount

Create Stripe Connect

getMerchantStripeStatus

Check Stripe status

getMerchantOnboardingLink

Get onboarding URL

Authentication: Merchants use email + OTP login via sendMerchantOTP and verifyMerchantOTP

Authentication Flows

Customer/Driver Authentication

1

User logs in via Rork mobile app (phone-based auth)

2

Base44 sets authentication cookie

3

All mobileAPI calls include credentials: "include"

4

mobileAPI validates via base44.auth.me()

5

✅ User authenticated and authorized

Merchant Authentication

1

Send OTP: Call sendMerchantOTP with email

2

Merchant enters 6-digit code from email

3

Verify OTP: Call verifyMerchantOTP with email + code

4

Authenticate: GET /auth/magic-link?token={magicLinkToken}

5

Base44 sets authentication cookie

6

All mobileAPI calls include credentials: "include"

7

✅ Merchant authenticated with role=merchant

Testing Checklist

Public endpoints work without auth

merchants, categories, stores, deliveryZones, banners

Customer features require authentication

createOrder, myOrders, profile, cart, etc.

Driver features require role='driver'

driverOrders, driverAcceptOrder, driverUpdateLocation

Merchant features require role='merchant'

merchantProfile, merchantOrders, merchantMenu

Multi-location support works

merchantOrders with store_id, merchantGetStores with GPS

Authentication cookies persist

credentials: 'include' in all fetch calls

Error messages are helpful

401 errors include hints about missing credentials

Payment authorization works

createOrder includes 20% buffer for replacements

Example: Complete Order Flow
// 1. Customer browses merchants (public)
const merchants = await fetch('https://your-app.base44.com/functions/mobileAPI', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    action: 'merchants',
    customer_lat: 41.3083,
    customer_lng: -72.9279
  })
}).then(r => r.json());

// 2. Customer creates order (authenticated)
const order = await fetch('https://your-app.base44.com/functions/mobileAPI', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // ✅
  body: JSON.stringify({
    action: 'createOrder',
    data: {
      merchant_id: 'merchant_123',
      store_id: 'store_456',
      items: [{ name: 'Pizza', quantity: 1, unit_price: 12.99 }],
      subtotal: 12.99,
      delivery_fee: 2.99,
      tax: 1.30,
      total: 17.28,
      delivery_address: { street: '123 Main St', city: 'New Haven' }
    }
  })
}).then(r => r.json());

// 3. Merchant receives order (authenticated, role=merchant)
const orders = await fetch('https://your-app.base44.com/functions/mobileAPI', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // ✅
  body: JSON.stringify({
    action: 'merchantOrders',
    params: {
      store_id: 'store_456', // Filter by location
      status_filter: ['created', 'authorized']
    }
  })
}).then(r => r.json());

// 4. Merchant accepts order
await fetch('https://your-app.base44.com/functions/mobileAPI', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // ✅
  body: JSON.stringify({
    action: 'merchantAcceptOrder',
    data: {
      order_id: order.data.id,
      expected_prep_time: 20
    }
  })
});

// 5. Driver accepts delivery (authenticated, role=driver)
await fetch('https://your-app.base44.com/functions/mobileAPI', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // ✅
  body: JSON.stringify({
    action: 'driverAcceptOrder',
    orderId: order.data.id
  })
});

// 6. Driver delivers order
await fetch('https://your-app.base44.com/functions/mobileAPI', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // ✅
  body: JSON.stringify({
    action: 'driverCompleteOrder',
    orderId: order.data.id
  })
});

// 7. Customer reviews order
await fetch('https://your-app.base44.com/functions/mobileAPI', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // ✅
  body: JSON.stringify({
    action: 'reportIssue',
    data: {
      order_id: order.data.id,
      issue_type: 'quality_issue',
      description: 'Pizza was cold'
    }
  })
});