$ curl -s -c jar.txt -H "Content-Type: application/json" \
    -d '{"email":"kasir5@profitina-laundry.example","password":"Laundry#2026"}' \
    http://127.0.0.1:6101/api/login
{
  "employee": {
    "id": "E0012",
    "name": "Fitri Handayani",
    "email": "kasir5@profitina-laundry.example",
    "section": "transaction",
    "outlet_id": "O03",
    "role": "cashier"
  },
  "csrf_token": "(random, 43 characters)"
}

$ curl -s -b jar.txt -X POST -H "Content-Type: application/json" \
    -d '{"customer_id":"C0151","service_id":"S0001","unit":5,"rack":"A03","payment":1}' \
    -w ' [%{http_code}]\n' http://127.0.0.1:6101/api/bills
{"error":{"code":"csrf_failed","message":"The form has expired or the security token is missing. Reload the page and try again."}}
 [403]

$ curl -s -b jar.txt -X POST -H "Content-Type: application/json" \
    -H "X-CSRF-Token: $TOKEN" \
    -d '{"customer_id":"C0151","service_id":"S0001","unit":5,"rack":"A03","payment":1}' \
    -w ' [%{http_code}]\n' http://127.0.0.1:6101/api/bills
{
  "id": "B2954",
  "arrived": "2026-09-30 21:00:00",
  "status": "queued",
  "rack": "A03",
  "unit": 5,
  "payment": 40000,
  "paid": 0,
  "balance": 40000,
  "outlet": {
    "id": "O03",
    "name": "Profitina Laundry Wiyung",
    "phone": "031-0000-2103"
  },
  "employee": {
    "id": "E0012",
    "name": "Fitri Handayani"
  },
  "history": [
    {
      "status": "queued",
      "changed_at": "2026-09-30 21:00:00",
      "employee": {
        "id": "E0012",
        "name": "Fitri Handayani"
      }
    }
  ]
}

$ curl -s -b jar.txt -X POST -H "Content-Type: application/json" \
    -H "X-CSRF-Token: $TOKEN" -d '{"status":"departed"}' \
    -w ' [%{http_code}]\n' http://127.0.0.1:6101/api/bills/B2938/status
{"error":{"code":"conflict","message":"Balance Rp 40.000 open. Record the payment or tick 'customer pays later'."}}
 [409]

$ curl -s -b jar.txt -w ' [%{http_code}]\n' http://127.0.0.1:6101/api/reports/monthly
{"error":{"code":"forbidden","message":"Your role (cashier) cannot open this page."}}
 [403]
