Appendices
On this page
Appendix A: Permissions matrix
Roles: ADMIN, SUPER_ADMIN, MANAGER, SERVER, CASHIER, BARTENDER, CHEF, HOST. Manager-gated actions require a MANAGER (or above) PIN.
| Action | Server / Cashier / Bartender / Chef / Host | Manager+ |
|---|---|---|
| Ring & send orders, take payment | ✓ | ✓ |
| Open/settle tabs, work the KDS, tick checklists | ✓ | ✓ |
| Log wastage | ✓ | ✓ |
| Discounts, voids, comps, no-sale | Request only | ✓ authorise by PIN |
| Refunds | — | ✓ (button hidden otherwise) |
| Terminal Settings, floor editing (arrange mode) | — | ✓ |
| Back Office (menu/staff/tables/reports/promotions) | — | ✓ |
| Create staff | — | ✓ (only at or below their own role) |
Enforcement is server-side; the client UI is a convenience, not the gate.
Appendix B: Demo tenant
Tenant demo-cape-town; Back Office login manager@aurapos.co.za / Aura-Pos123!. Demo PINs:
| PIN | Name | Role |
|---|---|---|
| 1234 | Andy | Manager |
| 2345 | Thandi | Server |
| 3456 | Sipho | Server |
| 4567 | Naledi | Bartender |
| 5678 | Johan | Chef |
| 6789 | Lerato | Server |
Appendix C: Server configuration reference
For installers. The server is configured entirely through environment variables. Nothing is required to trade in dev; items marked prod must be set (and non-default) when AURA_ENV=production.
| Variable | Configures | Default |
|---|---|---|
DATABASE_URL, DATABASE_USER, DATABASE_PASSWORD | Postgres connection | Cloud SQL via socket factory |
CLOUD_SQL_INSTANCE | Cloud SQL instance (project:region:instance) | baked-in demo instance |
DATABASE_POOL_SIZE | Connection pool size | 10 |
JWT_SECRET | Signs access tokens — prod | dev placeholder |
AURA_ENV | production enables boot guards + HSTS | dev |
AURA_SEED_DEMO | Seed the demo tenant on boot | on in dev, off in prod |
AURA_WEB_ROOT | Directory serving /admin/, /order/ and /pos/ | /app/web |
RECEIPT_SIGNING_SECRET | Signs public receipt links (90-day validity) — prod | dev placeholder |
RECEIPT_PUBLIC_BASE_URL | Public base URL used in receipt links | http://localhost:8080 |
YOCO_SECRET_KEY, YOCO_WEBHOOK_SECRET | Yoco card payments, refunds, tab pre-auth + webhook | unset (disabled) |
SNAPSCAN_API_KEY, SNAPSCAN_WEBHOOK_SECRET | SnapScan payments + webhook | unset |
SNAPSCAN_MERCHANT_CODE | Enables per-order SnapScan QR on guest orders (with the webhook secret) | unset (guests see "pay at counter") |
ZAPPER_API_KEY, ZAPPER_WEBHOOK_SECRET | Zapper QR payments + webhook (blank secret disables the webhook) | unset |
WHATSAPP_PHONE_NUMBER_ID, WHATSAPP_ACCESS_TOKEN | WhatsApp Cloud API — receipts + booking confirmations (blank = sends no-op) | unset |
MAILJET_API_KEY, MAILJET_SECRET_KEY, MAILJET_FROM | Email (Mailjet) — checklist daily summaries | unset |
CHECKLIST_SUMMARY_TO | Recipient(s) of the checklist daily summary (comma-separated) | unset |
PORT, HOST | HTTP bind | 8080 / 0.0.0.0 |
Terminal-side (desktop) environment overrides: AURA_API_URL (server URL), AURA_PRINTER_HOST / AURA_PRINTER_PORT (receipt printer), AURA_DB_PATH (database file, default ~/.aura/aura.db).
Scheduled jobs: two endpoints are designed to be hit daily by a scheduler (e.g. Cloud Scheduler) with a manager token — POST /api/v1/loyalty/birthday-vouchers (issues the automatic birthday vouchers) and POST /api/v1/checklists/summary/send (emails the checklist digest).
Rate limits (per minute, built in): login 10 · token refresh 30 · guest QR ordering 600 · guest booking 60 per client IP · sync 600 · webhooks 1000.
Appendix D: For developers
Interactive API sandbox at https://<your-server>/docs (Swagger UI with one-click demo token, try-it-out). Full reference — auth flow, rate limits, error catalogue, webhook verification, idempotency, and the sync protocol — in docs/API.md. Realtime events stream on WS /api/v1/sync/ws (kitchen fired/bumped/ready/rush/recalled, table seated/cleared, payment captured).
Appendix E: Getting help
In-app: Back Office → Settings shows your app version and server; the terminal shows its version on the sign-in screen and in Settings → About. For support, contact support@aurapos.co.za with your tenant id and app version.