fix(orders): guard financial status changes

[khaira777]

Intent

PR 3 - Financial order-status safeguards (Fixes #1056 and Fixes #1057)
Branch: codex/order-financial-status-guards
Title: fix(orders): guard financial status changes

Locked product decisions:

• Unpaid completion may use an explicit owner/manager PIN override. Being logged in as owner/manager does not silently bypass this approval.
• Preserve existing kitchen-delivery policy, including its configured applicability and audited manager override.
• Cancelling an order holding collected funds requires manager PIN approval. Approval does not automatically refund, erase or settle that money.

Requirements:

• Evaluate current order, bill/payment and kitchen state inside the transaction.
• Ordinary completion requires settled payable bills. An unbilled positive-total order is not considered paid. Apply currency-aware amount comparisons and cover split checks.
• If payment or the applicable kitchen requirement blocks completion, require a valid active owner/manager PIN.
• Preserve existing kitchen-policy exceptions and approval behaviour.
• Record actor and approver identity, which safeguards were overridden, bill IDs and outstanding amounts. Never record the PIN.
• Completion override must not mark bills paid, erase balances or manufacture payment records.
• Cancellation requires PIN approval when any bill holds recorded collected funds, even if order/items remain pending.
• Preserve payment/refund records; refunds remain a separate existing operation.
• Update cancellation UI eligibility so the PIN field appears for collected-payment cases. Keep the dialog open on recoverable rejection so staff can supply/correct the PIN.
• In the cancellation path being modified, restore only pending inventory. Prepared items use existing void/waste semantics and do not restore product, add-on or recipe stock.
• Acceptance: no-PIN, invalid-PIN, inactive approver, insufficient approver permissions and rate-limited PIN attempts cannot mutate state. Valid approval produces exactly one audited transition. Same-state retry remains harmless.
• Update the canonical permission/workflow documentation for the approved override policy.

What Changed

• Evaluated order, split-bill payment, and kitchen delivery state inside the PATCH /api/orders/:id/status transaction so completing orders with unsettled balances or undelivered kitchen items (when policy applies) and cancelling orders that are in progress or hold collected funds require an active owner/manager PIN override with audited safeguard, bill, and balance metadata while leaving payment and bill records untouched.
• Restricted order-cancellation inventory restoration in PATCH /api/orders/:id/status to pending items so prepared or in-progress items follow void/waste semantics without restoring product, add-on, or recipe stock.
• Updated OrderCard, OrderDetailPanel, and the orders page to prompt for a manager PIN when cancelling orders with collected payments or completing orders that require override approval, keeping the dialog open on recoverable PIN errors, and updated order-lifecycle and authorization tests and documentation.

Risk Assessment

✅ Low: The changes cleanly enforce financial settlement, kitchen delivery, and collected-payment safeguards on PATCH /api/orders/:id/status inside the authoritative SQLite transaction, verify both role (owner/manager) and effective permissions (orders.status.update, orders.item.cancel, payments.take) on the PIN approver, restrict order-cancel stock restoration to pending items so prepared items are not double-restored or silently returned to stock, update the Orders UI cancel flow to prompt for a manager PIN when funds have been collected, and cover all new paths with unit, integration, and E2E tests.

Testing

Built the backend and static frontend, ran targeted Electron/SQLite integration suites (test:orders-authz, test:cancel-override, test:addon-inventory-lifecycle, test:issue-252, test:recipe-order-lifecycle, authorization-static-audit.test.ts) and docs:check, executed the Playwright E2E suites (e2e/ops-admin/orders-lifecycle.spec.ts and e2e/ops-admin/order-history.spec.ts), and captured live browser screenshots and API/database verification artifacts in ~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M; all scenarios passed.

• Live validation: ✅ go - 4 of 4 scenarios driven live against the product

Scenario	Result	Live	Evidence
Adversarial: Completing an unpaid, unbilled, or partially-paid split-check order without a valid active owner/manager PIN (including when logged in as owner/manager, using an invalid/inactive PIN, lac…	✅ pass	live	npm run test:orders-authz and ~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M/financial-status-guards-live-verification.json
Completing an unpaid or kitchen-undelivered order with a valid owner/manager PIN transitions the order to completed, preserves unpaid bill balances without fabricating payment records, writes a single…	✅ pass	live	npm run test:orders-authz and ~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M/financial-status-guards-live-verification.json
Cancelling a pending order holding collected payment requires a manager/owner PIN in the Orders UI, keeps the Cancel Order modal open on invalid PIN or concurrent payment so staff can enter a valid PI…	✅ pass	live	npx playwright test --config=playwright.config.ts --project=chromium --retries=0 e2e/ops-admin/orders-lifecycle.spec.ts, `~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M/cance…
Cancelling an order with mixed pending and in-progress items restores only pending inventory across product stock, tracked add-ons, and recipe supplies while leaving prepared/in-progress items un-rest…	✅ pass	live	npm run test:cancel-override, npm run test:addon-inventory-lifecycle, npm run test:issue-252, and npm run test:recipe-order-lifecycle

Evidence: Live API and persisted bill state verification for collected-funds cancellation and unpaid completion override

{ "cancelledOrderWithCollectedFunds": { "orderNumber": "ORD-20261015-0001", "billId": 1, "billPaymentStatusAfterCancel": "partial", "billPaidAmountAfterCancel": 20 }, "unpaidCompletionSafeguard": { "orderNumber": "ORD-20261015-0002", "noPinStatus": 400, "noPinBody": { "error": "Manager PIN required to complete unpaid order" }, "badPinStatus": 403, "badPinBody": { "error": "Invalid manager PIN" }, "validPinOverrideStatus": 200, "sameStateRetryStatus": 200, "billAfterCompletionOverride": { "payment_status": "unpaid", "paid_amount": 0, "balance": 64.2 } } }

{
  "cancelledOrderWithCollectedFunds": {
    "orderNumber": "ORD-20261015-0001",
    "billId": 1,
    "billPaymentStatusAfterCancel": "partial",
    "billPaidAmountAfterCancel": 20
  },
  "unpaidCompletionSafeguard": {
    "orderNumber": "ORD-20261015-0002",
    "noPinStatus": 400,
    "noPinBody": {
      "error": "Manager PIN required to complete unpaid order"
    },
    "badPinStatus": 403,
    "badPinBody": {
      "error": "Invalid manager PIN"
    },
    "validPinOverrideStatus": 200,
    "sameStateRetryStatus": 200,
    "billAfterCompletionOverride": {
      "payment_status": "unpaid",
      "paid_amount": 0,
      "balance": 64.2
    }
  }
}

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Live validation: ✅ go - 4 of 4 scenarios driven live against the product

Scenario	Result	Live	Evidence
Adversarial: Completing an unpaid, unbilled, or partially-paid split-check order without a valid active owner/manager PIN (including when logged in as owner/manager, using an invalid/inactive PIN, lac…	✅ pass	live	npm run test:orders-authz and ~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M/financial-status-guards-live-verification.json
Completing an unpaid or kitchen-undelivered order with a valid owner/manager PIN transitions the order to completed, preserves unpaid bill balances without fabricating payment records, writes a single…	✅ pass	live	npm run test:orders-authz and ~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M/financial-status-guards-live-verification.json
Cancelling a pending order holding collected payment requires a manager/owner PIN in the Orders UI, keeps the Cancel Order modal open on invalid PIN or concurrent payment so staff can enter a valid PI…	✅ pass	live	npx playwright test --config=playwright.config.ts --project=chromium --retries=0 e2e/ops-admin/orders-lifecycle.spec.ts, `~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M/cance…
Cancelling an order with mixed pending and in-progress items restores only pending inventory across product stock, tracked add-ons, and recipe supplies while leaving prepared/in-progress items un-rest…	✅ pass	live	npm run test:cancel-override, npm run test:addon-inventory-lifecycle, npm run test:issue-252, and npm run test:recipe-order-lifecycle

• npm run test:orders-authz
• npm run test:cancel-override
• npm run test:addon-inventory-lifecycle
• npm run test:issue-252
• npm run test:recipe-order-lifecycle
• node tests/run-electron-node-test.cjs tests/authorization-static-audit.test.ts
• npm run docs:check
• npm run build && npm run build:frontend
• npx playwright test --config=playwright.config.ts --project=chromium --retries=0 e2e/ops-admin/orders-lifecycle.spec.ts e2e/ops-admin/order-history.spec.ts --grep-invert='FINDING:|a paid order offers a refund, and issuing it settles against the recorded sale'
• Live Playwright browser + API verification script capturing ~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M/cancel-collected-payment-pin-modal.png, ~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M/cancel-collected-payment-confirmed.png, and ~/.no-mistakes/evidence/01M4YM4R1ZR6CVHWQHPZ0F1S0M/financial-status-guards-live-verification.json

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: FreeOpenSourcePOS/FloCafe/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 96655a2c-fe6c-428c-a3fc-b1f31e6a3b88

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[khaira777]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; no new actionable issue was found.

Summary

Adds transaction-based payment and kitchen checks before order completion, plus PIN approval for cancellation when funds have been collected.

• Order status changes ask for approval when safeguards block them.
• Cancelling an order restores stock only for pending items.
• The Orders screen shows a PIN prompt for collected-payment cancellations.

Reviewed the full PR because the previous and current commits have different merge bases with the supplied target commit. Verification was by code inspection; no tests or browser checks were run.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Status request] --> B[Read current state inside transaction]
  B --> C{Same status?}
  C -->|Yes| D[Return without writes]
  C -->|No| E[Check payment, kitchen, and cancellation safeguards]
  E --> F{Approval required?}
  F -->|Yes| G[Check PIN, active approver, permissions, and attempt limit]
  G -->|Rejected| H[Return without writes]
  G -->|Approved| I[Change status and write audit]
  F -->|No| I
  I --> J[Commit and notify clients]

Loading

_{Reviews (4) · Last reviewed commit: "no-mistakes(document): docs: deduplicate..." · Reviewed by Greptile}

[khaira777]

@greptileai review

[khaira777]

@greptileai review

[khaira777]

@greptileai review

[khaira777]

@greptileai review