Skip to content

fix(auth): add explicit manager selection to approval UI and kitchen override binding - #1229

Merged
khaira777 merged 20 commits into
mainfrom
fix/approval-manager-selection
Oct 20, 2026
Merged

khaira777 merged 20 commits into
mainfrom
fix/approval-manager-selection

Conversation

@khaira777

Copy link
Copy Markdown
Contributor

Intent

fix(auth): add explicit manager selection to approval UI and kitchen override binding

What Changed

  • Added an ApproverSelect component and useManagerApprovers hook across POS payment, prepaid checkout, and order override dialogs to explicitly select an approving manager when multiple eligible managers exist.
  • Updated bill payment endpoints to accept explicit approver IDs (approver_id, manager_id, user_id), binding kitchen delivery override PIN verification directly to the selected active manager and logging the approval.
  • Added backend integration and end-to-end test suites for approver selection and kitchen override binding, and updated architecture and API reference documentation.

Risk Assessment

🚨 High: The approver loading hook calls the privileged /api/staff endpoint requiring staff.view, which returns 403 Forbidden for cashiers and servers, breaking manager selection and showing an error state across POS and order approval flows.

Testing

Live validation executed 5 end-to-end scenarios against the running product via Playwright browser flows and backend integration tests; all scenarios passed with full visual and behavioral evidence, confirming explicit manager selection in approval modals, kitchen override binding, adversarial rejection of mismatched PINs, empty-state fallback, and unblocked settlement retries after item delivery.

  • Live validation: ✅ go - 5 of 5 scenarios driven live against the product
Scenario Result Live Evidence
Kitchen delivery override binds selected manager and settles payment ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-1-kitchen-override-select-manager.png and ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenari…
Kitchen delivery override rejects mismatched manager selection and PIN (Adversarial) ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-2-mismatched-manager-pin-rejected.png via frontend/e2e/approval-manager-selection.spec.ts
Orders page item void and order cancellation modals enforce manager selection ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-3-orders-void-item-approver-select.png and ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenar…
ApproverSelect displays graceful warning when no managers have approval PINs ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-4-approver-select-empty-state.png via frontend/e2e/approval-manager-selection.spec.ts
Payment modal allows settlement retry without a manager PIN after kitchen delivery completes ✅ pass live frontend/e2e/kitchen-delivery-payment-retry.spec.ts

Scenario 1: Kitchen delivery override manager selection dropdown
Scenario 1: Payment settlement completed with matching manager PIN
Scenario 2: Mismatched manager selection and PIN rejected with error banner
Scenario 3: Orders page Void Item modal requiring manager selection
Scenario 3: Orders page Cancel Order modal requiring manager selection
Scenario 4: Graceful empty state when no managers have approval PINs configured

  • Outcome: ⚠️ 1 info across 2 runs (16m19s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 6 issues (3 errors, 3 warnings)
  • 🚨 frontend/src/hooks/useManagerApprovers.ts:29 - useManagerApprovers attempts to fetch eligible approvers via GET /api/staff?active=true, which requires requirePermission('staff.view') (main/routes/staff.ts:114), granted by default only to OWNER_MANAGER (shared/permissions.ts:415). Cashiers and servers do not have staff.view. When non-manager staff open any screen with manager approvals, the request fails with HTTP 403, setting loadFailed: true and leaving approvers empty. This renders an error banner ("Could not load refund approvers. Try again.") and prevents the approver dropdown from ever displaying. Furthermore, because approvers is empty, effectiveApproverId evaluates to undefined, silently stripping approver_id from all actions performed by cashiers and servers. Sibling sites affected: frontend/src/components/pos/PaymentModal.tsx:185 (kitchen override and discount for cashiers), frontend/src/components/pos/PrepaidCheckoutModal.tsx:139 (prepaid checkout discount for cashiers), frontend/src/app/(dashboard)/orders/page.tsx:230 (void and cancel approvals for servers/cashiers), and frontend/src/components/ApproverSelect.tsx:42 (renders error state for all non-managers). A policy decision is needed on how non-managers should retrieve eligible approvers (e.g. creating an unprivileged endpoint like /api/staff/approvers exposing only non-sensitive active manager names and IDs, or altering staff.view access policy); authorizing this API/policy extension requires user guidance.
  • ⚠️ frontend/src/app/(dashboard)/orders/page.tsx:2088 - Deselecting an approver in approval modals is prevented by the fallback pattern localApproverId || managerApprovers.selectedApproverId. When the authenticated user is a manager, managerApprovers.selectedApproverId is pre-populated with their user ID. Passing cancelModal.approverId || managerApprovers.selectedApproverId as the controlled value of <ApproverSelect> causes choosing the empty placeholder option ("") to evaluate back to managerApprovers.selectedApproverId, resetting the dropdown selection. Additionally, the modal submit button disabled check !(cancelModal.approverId || managerApprovers.selectedApproverId) remains false, allowing submission with the preselected manager even when the user intended to clear the field. Sibling sites with the identical binding pattern: frontend/src/app/(dashboard)/orders/page.tsx:2164 (void item modal), frontend/src/app/(dashboard)/orders/page.tsx:2348 (discount modal), frontend/src/components/pos/PaymentModal.tsx:1493 (kitchen override), frontend/src/components/pos/PaymentModal.tsx:1765 (payment discount), and frontend/src/components/pos/PrepaidCheckoutModal.tsx:785 (prepaid discount).
  • ⚠️ frontend/src/hooks/useManagerApprovers.ts:9 - Simplification: useManagerApprovers introduces speculative flexibility with UseManagerApproversOptions (allowedRoles?: readonly Role[]). No caller in the codebase passes options to useManagerApprovers(); all rely on ROLE_ACCESS.ownerManager. The user intent strictly requires manager selection for approvals and kitchen override binding, with no requirement for dynamic role-filtered querying. The unused options interface and memoization should be removed. Sibling sites with unneeded components: main/routes/bills.ts:3421 and main/routes/bills.ts:3511 redundantly chain duplicate properties on the same object ((payment as any).approver_id || ... || req.body.approver_id ... where payment === req.body, and body.approver_id || ... || req.body.approver_id ... where body === req.body).
  • ℹ️ frontend/src/components/ApproverSelect.tsx:58 - ApproverSelect hardcodes refund-specific localization keys (refundApprovalSetupStaff -> "Refund approval is not configured. Ask the owner to set an Approval PIN in Staff." and refundApproverLoadFailed -> "Could not load refund approvers. Try again.") even though it is used for kitchen delivery overrides, order item voids, order cancellations, and bill discounts, none of which are refunds. Sibling site: frontend/src/components/ApproverSelect.tsx:48 (refundApproverLoadFailed). The component should accept optional custom messages or use neutral authorization strings.

🔧 Fix applied.
6 issues (2 errors, 2 warnings, 2 infos) still open:

  • 🚨 frontend/src/hooks/useManagerApprovers.ts:29 - useManagerApprovers attempts to fetch eligible approvers via GET /api/staff?active=true, which requires requirePermission('staff.view') (main/routes/staff.ts:114), granted by default only to OWNER_MANAGER (shared/permissions.ts:415). Cashiers and servers do not have staff.view. When non-manager staff open any screen with manager approvals, the request fails with HTTP 403, setting loadFailed: true and leaving approvers empty. This renders an error banner ("Could not load refund approvers. Try again.") and prevents the approver dropdown from ever displaying. Furthermore, because approvers is empty, effectiveApproverId evaluates to undefined, silently stripping approver_id from all actions performed by cashiers and servers. Sibling sites affected: frontend/src/components/pos/PaymentModal.tsx:185 (kitchen override and discount for cashiers), frontend/src/components/pos/PrepaidCheckoutModal.tsx:139 (prepaid checkout discount for cashiers), frontend/src/app/(dashboard)/orders/page.tsx:230 (void and cancel approvals for servers/cashiers), and frontend/src/components/ApproverSelect.tsx:42 (renders error state for all non-managers). A policy decision is needed on how non-managers should retrieve eligible approvers (e.g. creating an unprivileged endpoint like /api/staff/approvers exposing only non-sensitive active manager names and IDs, or altering staff.view access policy); authorizing this API/policy extension requires user guidance.
  • ⚠️ frontend/src/hooks/useManagerApprovers.ts:9 - Simplification: useManagerApprovers introduces speculative flexibility with UseManagerApproversOptions (allowedRoles?: readonly Role[]). No caller in the codebase passes options to useManagerApprovers(); all rely on ROLE_ACCESS.ownerManager. The user intent strictly requires manager selection for approvals and kitchen override binding, with no requirement for dynamic role-filtered querying. The unused options interface and memoization should be removed. Sibling sites with unneeded components: main/routes/bills.ts:3421 and main/routes/bills.ts:3511 redundantly chain duplicate properties on the same object ((payment as any).approver_id || ... || req.body.approver_id ... where payment === req.body, and body.approver_id || ... || req.body.approver_id ... where body === req.body).
  • ℹ️ frontend/src/components/ApproverSelect.tsx:58 - ApproverSelect hardcodes refund-specific localization keys (refundApprovalSetupStaff -> "Refund approval is not configured. Ask the owner to set an Approval PIN in Staff." and refundApproverLoadFailed -> "Could not load refund approvers. Try again.") even though it is used for kitchen delivery overrides, order item voids, order cancellations, and bill discounts, none of which are refunds. Sibling site: frontend/src/components/ApproverSelect.tsx:48 (refundApproverLoadFailed). The component should accept optional custom messages or use neutral authorization strings.
  • 🚨 frontend/src/hooks/useManagerApprovers.ts:29 - useManagerApprovers attempts to fetch eligible approvers via GET /api/staff?active=true, which requires requirePermission('staff.view') (main/routes/staff.ts:114), granted by default only to OWNER_MANAGER (shared/permissions.ts:415). Cashiers and servers do not have staff.view. When non-manager staff open any screen with manager approvals, the request fails with HTTP 403, setting loadFailed: true and leaving approvers empty. This renders an error banner ("Could not load refund approvers. Try again.") and prevents the approver dropdown from ever displaying. Furthermore, because approvers is empty, effectiveApproverId evaluates to "", silently omitting approver_id from actions performed by cashiers and servers and falling back to any matching manager PIN. Sibling sites affected: frontend/src/components/pos/PaymentModal.tsx:187 (kitchen override and discount for cashiers), frontend/src/components/pos/PrepaidCheckoutModal.tsx:139 (prepaid checkout discount for cashiers), frontend/src/app/(dashboard)/orders/page.tsx:232 (void and cancel approvals for servers/cashiers), and frontend/src/components/ApproverSelect.tsx:47 (renders error state for all non-managers). A policy decision is needed on how non-managers should retrieve eligible approvers (e.g. creating an unprivileged endpoint like /api/staff/approvers exposing only non-sensitive active manager names and IDs, or altering staff.view access policy); authorizing this API/policy extension requires user guidance.
  • ⚠️ frontend/src/hooks/useManagerApprovers.ts:9 - Simplification: useManagerApprovers introduces speculative flexibility with UseManagerApproversOptions (allowedRoles?: readonly Role[]). No caller in the codebase passes options to useManagerApprovers(); all rely on ROLE_ACCESS.ownerManager. The user intent strictly requires manager selection for approvals and kitchen override binding, with no requirement for dynamic role-filtered querying. The unused options interface and memoization should be removed. Sibling sites with unneeded components: main/routes/bills.ts:3421 and main/routes/bills.ts:3511 redundantly chain duplicate properties on the same object ((payment as any).approver_id || ... || req.body.approver_id ... where payment === req.body, and body.approver_id || ... || req.body.approver_id ... where body === req.body), and accept unrequested fallback aliases manager_id and user_id.
  • ℹ️ frontend/src/components/ApproverSelect.tsx:52 - In Round 1, AUTH-APPROVER-REFUND-COPY was addressed by adding loadFailedMessage and emptyMessage props to ApproverSelect.tsx:17-18, but the fix left behind all consumer call sites without passing either prop. As a result, the default fallback strings refundApproverLoadFailed ("Could not load refund approvers. Try again.") and refundApprovalSetupStaff ("Refund approval is not configured. Ask the owner to set an Approval PIN in Staff.") are still displayed for non-refund operations. Remaining sibling sites left behind: frontend/src/components/pos/PaymentModal.tsx:1490 (kitchen override), frontend/src/components/pos/PaymentModal.tsx:1757 (payment discount), frontend/src/components/pos/PrepaidCheckoutModal.tsx:778 (prepaid checkout discount), frontend/src/app/(dashboard)/orders/page.tsx:2074 (cancel order modal), frontend/src/app/(dashboard)/orders/page.tsx:2152 (void item modal), and frontend/src/app/(dashboard)/orders/page.tsx:2337 (order discount modal). Either neutral strings should be used as defaults in ApproverSelect.tsx:52 and ApproverSelect.tsx:62, or custom messages should be passed at each sibling site.

🔧 Fix applied.
6 issues (3 errors, 3 warnings) still open:

  • 🚨 frontend/src/hooks/useManagerApprovers.ts:29 - useManagerApprovers attempts to fetch eligible approvers via GET /api/staff?active=true, which requires requirePermission('staff.view') (main/routes/staff.ts:114), granted by default only to OWNER_MANAGER (shared/permissions.ts:415). Cashiers and servers do not have staff.view. When non-manager staff open any screen with manager approvals, the request fails with HTTP 403, setting loadFailed: true and leaving approvers empty. This renders an error banner ("Could not load refund approvers. Try again.") and prevents the approver dropdown from ever displaying. Furthermore, because approvers is empty, effectiveApproverId evaluates to undefined, silently stripping approver_id from all actions performed by cashiers and servers. Sibling sites affected: frontend/src/components/pos/PaymentModal.tsx:185 (kitchen override and discount for cashiers), frontend/src/components/pos/PrepaidCheckoutModal.tsx:139 (prepaid checkout discount for cashiers), frontend/src/app/(dashboard)/orders/page.tsx:230 (void and cancel approvals for servers/cashiers), and frontend/src/components/ApproverSelect.tsx:42 (renders error state for all non-managers). A policy decision is needed on how non-managers should retrieve eligible approvers (e.g. creating an unprivileged endpoint like /api/staff/approvers exposing only non-sensitive active manager names and IDs, or altering staff.view access policy); authorizing this API/policy extension requires user guidance.
  • ⚠️ frontend/src/hooks/useManagerApprovers.ts:9 - Simplification: useManagerApprovers introduces speculative flexibility with UseManagerApproversOptions (allowedRoles?: readonly Role[]). No caller in the codebase passes options to useManagerApprovers(); all rely on ROLE_ACCESS.ownerManager. The user intent strictly requires manager selection for approvals and kitchen override binding, with no requirement for dynamic role-filtered querying. The unused options interface and memoization should be removed. Sibling sites with unneeded components: main/routes/bills.ts:3421 and main/routes/bills.ts:3511 redundantly chain duplicate properties on the same object ((payment as any).approver_id || ... || req.body.approver_id ... where payment === req.body, and body.approver_id || ... || req.body.approver_id ... where body === req.body).
  • 🚨 frontend/src/hooks/useManagerApprovers.ts:29 - useManagerApprovers attempts to fetch eligible approvers via GET /api/staff?active=true, which requires requirePermission('staff.view') (main/routes/staff.ts:114), granted by default only to OWNER_MANAGER (shared/permissions.ts:415). Cashiers and servers do not have staff.view. When non-manager staff open any screen with manager approvals, the request fails with HTTP 403, setting loadFailed: true and leaving approvers empty. This renders an error banner ("Could not load refund approvers. Try again.") and prevents the approver dropdown from ever displaying. Furthermore, because approvers is empty, effectiveApproverId evaluates to "", silently omitting approver_id from actions performed by cashiers and servers and falling back to any matching manager PIN. Sibling sites affected: frontend/src/components/pos/PaymentModal.tsx:187 (kitchen override and discount for cashiers), frontend/src/components/pos/PrepaidCheckoutModal.tsx:139 (prepaid checkout discount for cashiers), frontend/src/app/(dashboard)/orders/page.tsx:232 (void and cancel approvals for servers/cashiers), and frontend/src/components/ApproverSelect.tsx:47 (renders error state for all non-managers). A policy decision is needed on how non-managers should retrieve eligible approvers (e.g. creating an unprivileged endpoint like /api/staff/approvers exposing only non-sensitive active manager names and IDs, or altering staff.view access policy); authorizing this API/policy extension requires user guidance.
  • ⚠️ frontend/src/hooks/useManagerApprovers.ts:9 - Simplification: useManagerApprovers introduces speculative flexibility with UseManagerApproversOptions (allowedRoles?: readonly Role[]). No caller in the codebase passes options to useManagerApprovers(); all rely on ROLE_ACCESS.ownerManager. The user intent strictly requires manager selection for approvals and kitchen override binding, with no requirement for dynamic role-filtered querying. The unused options interface and memoization should be removed. Sibling sites with unneeded components: main/routes/bills.ts:3421 and main/routes/bills.ts:3511 redundantly chain duplicate properties on the same object ((payment as any).approver_id || ... || req.body.approver_id ... where payment === req.body, and body.approver_id || ... || req.body.approver_id ... where body === req.body), and accept unrequested fallback aliases manager_id and user_id.
  • 🚨 frontend/src/hooks/useManagerApprovers.ts:29 - useManagerApprovers attempts to fetch eligible approvers via GET /api/staff?active=true, which requires requirePermission('staff.view') (main/routes/staff.ts:114), granted by default only to OWNER_MANAGER (shared/permissions.ts:415). Cashiers and servers do not have staff.view. When non-manager staff open any screen with manager approvals, the request fails with HTTP 403, setting loadFailed: true and leaving approvers empty. This renders an error banner ("Could not load approvers. Try again.") and prevents the approver dropdown from ever displaying. Furthermore, because approvers is empty, effectiveApproverId evaluates to "", silently omitting approver_id from actions performed by cashiers and servers and falling back to any matching manager PIN on the backend. Sibling sites affected: frontend/src/components/pos/PaymentModal.tsx:187 (kitchen override and discount for cashiers), frontend/src/components/pos/PrepaidCheckoutModal.tsx:139 (prepaid checkout discount for cashiers), frontend/src/app/(dashboard)/orders/page.tsx:232 (void and cancel approvals for servers/cashiers), and frontend/src/components/ApproverSelect.tsx:47 (renders error state for all non-managers). A policy decision is needed on how non-managers should retrieve eligible approvers (e.g. creating an unprivileged endpoint like /api/staff/approvers exposing only non-sensitive active manager names and IDs, or altering staff.view access policy); authorizing this API/policy extension requires user guidance.
  • ⚠️ frontend/src/hooks/useManagerApprovers.ts:9 - Simplification: useManagerApprovers introduces speculative flexibility with UseManagerApproversOptions (allowedRoles?: readonly Role[]). No caller in the codebase passes options to useManagerApprovers(); all rely on ROLE_ACCESS.ownerManager. The user intent strictly requires manager selection for approvals and kitchen override binding, with no requirement for dynamic role-filtered querying. The unused options interface and memoization should be removed. Sibling sites with unneeded components: main/routes/bills.ts:3421 and main/routes/bills.ts:3511 redundantly chain duplicate properties on the same object ((payment as any).approver_id || ... || req.body.approver_id ... where payment === req.body, and body.approver_id || ... || req.body.approver_id ... where body === req.body), and accept unrequested fallback aliases manager_id and user_id. Furthermore, accepting user_id as an alias for approver_id creates a concrete bug: if a request payload includes the acting cashier's or server's user_id, explicitApproverId captures the cashier's user ID, causing preVerifyKitchenDeliveryPin to fail with HTTP 403 because the cashier does not have the manager/owner role, even when a valid manager override PIN is supplied. The unrequested aliases and duplicate object checks should be removed.
⚠️ **Test** - 1 info
  • 🚨 frontend/src/components/pos/PaymentModal.tsx:2272 - PaymentModal disables the Pay button whenever kitchenUndeliveredCount > 0 and kitchenOverridePin is empty (kitchenUndeliveredCount > 0 && (!kitchenOverridePin || ...)). When kitchen items finish delivery while the payment modal remains open, cashiers are unable to retry payment without entering a manager PIN, causing frontend/e2e/kitchen-delivery-payment-retry.spec.ts:86 to fail. User decision is needed on whether cashiers should be required to provide a manager override PIN once items are flagged undelivered, or if the Pay button should remain enabled when kitchenOverridePin is empty to allow delivery retries.
  • 🚨 live validation verdict: no-go (5 of 5 scenarios were driven live against the product); failed: Payment modal allows settlement retry without a manager PIN after kitchen delivery completes
  • ℹ️ frontend/e2e/approval-manager-selection.spec.ts - new test file written by agent: frontend/e2e/approval-manager-selection.spec.ts
  • Live validation: ❌ no-go - 5 of 5 scenarios driven live against the product
Scenario Result Live Evidence
Kitchen delivery override with explicit manager selection and matching PIN settles bill and binds manager in audit log ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-1-payment-settled-success.png
Kitchen delivery override rejects mismatched manager selection and PIN with HTTP 403 ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-2-mismatched-manager-pin-rejected.png
Orders page privileged modals (Void Item & Cancel Order) enforce explicit manager selection when multiple managers exist ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-3-orders-void-item-approver-select.png
ApproverSelect displays graceful warning alert when no managers have approval PINs configured ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-4-approver-select-empty-state.png
Payment modal allows settlement retry without a manager PIN after kitchen delivery completes ❌ fail live frontend/e2e/kitchen-delivery-payment-retry.spec.ts:86 (expect(payButton).toBeEnabled())
  • node tests/run-electron-node-test.cjs tests/manager-pin-verification.test.ts
  • npm run test:kitchen-delivery-enforcement
  • cd frontend && npx playwright test --config=playwright.config.ts --project=chromium e2e/approval-manager-selection.spec.ts
  • cd frontend && npx playwright test --config=playwright.config.ts --project=chromium -g "payment can retry without a manager PIN after kitchen delivery completes"

🔧 Fix applied.
1 info still open:

  • ℹ️ frontend/e2e/approval-manager-selection.spec.ts - new test file written by agent: frontend/e2e/approval-manager-selection.spec.ts
  • Live validation: ✅ go - 5 of 5 scenarios driven live against the product
Scenario Result Live Evidence
Kitchen delivery override binds selected manager and settles payment ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-1-kitchen-override-select-manager.png and ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenari…
Kitchen delivery override rejects mismatched manager selection and PIN (Adversarial) ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-2-mismatched-manager-pin-rejected.png via frontend/e2e/approval-manager-selection.spec.ts
Orders page item void and order cancellation modals enforce manager selection ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-3-orders-void-item-approver-select.png and ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenar…
ApproverSelect displays graceful warning when no managers have approval PINs ✅ pass live ~/.no-mistakes/evidence/01M58BA03R9W302NZRCX6ESTER/scenario-4-approver-select-empty-state.png via frontend/e2e/approval-manager-selection.spec.ts
Payment modal allows settlement retry without a manager PIN after kitchen delivery completes ✅ pass live frontend/e2e/kitchen-delivery-payment-retry.spec.ts
  • node tests/run-electron-node-test.cjs tests/manager-pin-verification.test.ts
  • node tests/run-electron-node-test.cjs tests/kitchen-delivery-enforcement.test.ts
  • node tests/run-electron-node-test.cjs tests/manager-pin-rate-limit-bypass.test.ts
  • cd frontend && npx playwright test --config=playwright.config.ts --project=chromium e2e/approval-manager-selection.spec.ts
  • cd frontend && npx playwright test --config=playwright.config.ts --project=chromium e2e/kitchen-delivery-payment-retry.spec.ts
✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

…s-server failed login counter (#1221)

- Centralize PIN rate limiting and concurrency serialization with withPinVerificationLock in security middleware
- Re-check isPinRateLimited inside lock so concurrent bursts reject immediately with 429 without redundant bcrypt executions
- Defer resetSuccessfulLogin in KDS and Server App until after role and permission validation so 403 Forbidden does not clear the failed-login counter
- Add regression tests covering 403 failure counter preservation and concurrent PIN verification bursts
@coderabbitai

coderabbitai Bot commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: FreeOpenSourcePOS/FloCafe/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 1d3bcc80-08d8-49ba-94fc-8a47c5bdcc99

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

khaira777 and others added 13 commits October 18, 2026 18:02
…1222-1229-r1

# Conflicts:
#	main/routes/bills.ts
# Conflicts:
#	docs/architecture/order-lifecycle.md
#	main/routes/bills.ts
#	tests/manager-pin-verification.test.ts
…1222-1229-r1

# Conflicts:
#	main/routes/bills.ts
#	main/routes/orders.ts
…1222-1229-r1

# Conflicts:
#	docs/architecture/authentication-and-authorization.md
#	main/routes/orders.ts
#	tests/manager-pin-verification.test.ts
# Conflicts:
#	tests/manager-pin-verification.test.ts
@khaira777
khaira777 merged commit d254fe6 into main Oct 20, 2026
23 checks passed
@khaira777
khaira777 deleted the fix/approval-manager-selection branch October 20, 2026 07:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant