# self-service-now
Restaurant POS, Self-Ordering Kiosk, Android POS and Restaurant Management System.

## Mobile order privacy (Milestone 4B.1)

Mobile order history is server-authoritative and scoped to the authenticated
customer context:

- signed-in customers receive orders attributed to their verified loyalty member;
- guests receive only unattributed orders subscribed to their installation;
- the individual order-status endpoint applies the same ownership check;
- account changes use separate on-device guest/member caches and never delete
  kitchen, bill, payment, or subscriber records;
- queued push notifications are delivered only while the installation's current
  member context still owns the order.

This milestone uses the existing `loyalty_member_id` and installation subscriber
relationships. It does not require a database migration.

## Exactly-once mobile loyalty earning (Milestone 4C)

A newly confirmed native HitPay payment earns points only when its immutable
`loyalty_member_id` is present. Guest payments do not earn points. The order,
bill, ledger entry, member balance, tier update, and processed payment status
are committed in one database transaction.

`loyalty_points_ledger.hitpay_payment_request_id` is nullable for historical and
non-HitPay activity, but unique when present. This database constraint prevents
webhook, payment-status, network, or concurrency retries from awarding the same
payment twice. Tierless new members use the active tier eligible at zero points
(normally Bronze) for their first purchase.