Complete Captain workflows and prepare 1.3.30

access-denied.html

@@ -1,80 +1,25 @@
 <!DOCTYPE html>
 <html lang="en">
-
 <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover" />
-    <title>Access Denied</title>
-    <style>
-        body {
-            margin: 0;
-            padding: 0;
-            font-family: "Segoe UI", Tahoma, Geneva, Verdana, sans-serif;
-            background-color: #f8f9fa;
-            display: flex;
-            justify-content: center;
-            align-items: center;
-            height: 100vh;
-            text-align: center;
-        }
-
-        .container {
-            padding: 2rem;
-            background-color: #fff;
-            border-radius: 16px;
-            box-shadow: 0 4px 12px rgba(0, 0, 0, 0.1);
-            max-width: 90%;
-        }
-
-        .container h1 {
-            font-size: 2rem;
-            color: #dc3545;
-            margin-bottom: 1rem;
-        }
-
-        .container p {
-            font-size: 1rem;
-            color: #555;
-            margin-bottom: 2rem;
-        }
-
-        .btn {
-            display: inline-block;
-            padding: 0.75rem 1.5rem;
-            font-size: 1rem;
-            color: white;
-            background-color: #007bff;
-            border: none;
-            border-radius: 8px;
-            text-decoration: none;
-        }
-
-        .btn:hover {
-            background-color: #0056b3;
-        }
-
-        @media (max-width: 480px) {
-            .container h1 {
-                font-size: 1.5rem;
-            }
-
-            .container p {
-                font-size: 0.9rem;
-            }
-        }
-    </style>
-    <link href="assets/common/ui-theme.css" rel="stylesheet">
-    <script src="assets/common/i18n.js"></script>
-    <script src="assets/common/languages.js"></script>
-    <link rel="stylesheet" href="assets/common/i18n.css">
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <title>Access Denied</title>
+  <link rel="stylesheet" href="assets/common/design.css">
+  <link rel="stylesheet" href="assets/common/ui-theme.css">
+  <link rel="stylesheet" href="assets/common/i18n.css">
+  <link rel="stylesheet" href="assets/common/app-design.css">
+  <link rel="stylesheet" href="assets/common/access-denied.css">
+  <script src="assets/common/i18n.js"></script>
+  <script src="assets/common/languages.js"></script>
+  <script src="assets/common/access-denied.js" defer></script>
 </head>
-
-<body>
-    <div class="container">
-        <h1>Access Denied</h1>
-        <p>You are not authorized to view this page.</p>
-        <a href="index.html" class="btn">Go to Home</a>
-    </div>
+<body class="permission-screen">
+  <header><button type="button" data-permission-back aria-label="Back"><span class="permission-back-arrow" aria-hidden="true">←</span><span>Back</span></button></header>
+  <main>
+    <div class="permission-icon" aria-hidden="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7"><rect x="5" y="10" width="14" height="11" rx="3"/><path d="M8 10V7a4 4 0 0 1 8 0v3M12 14v3"/></svg></div>
+    <h1>Permission is required.</h1>
+    <p>You are not authorized to view this page.</p>
+    <div class="permission-actions"><button type="button" data-permission-back>Back</button><a href="kot-management.html">Go to Home</a></div>
+  </main>
 </body>
-
 </html>

assets/cart/notes-modal.js

@@ -53,6 +53,9 @@ $(document).ready(function () {
         // Set product name and existing notes
         $("#cart-notes-product-name").text(productName);
         $("#cart-notes-text").val(currentNotes);
+        buildNoteChips("#cart-notes-chips");
+        markChips("#cart-notes-text");
+        window.I18N?.apply(document.getElementById("cart-notes-modal"));
 
         // Show modal
         $("#cart-notes-modal").css("display", "flex");

assets/common/access-denied.css

@@ -0,0 +1,14 @@
+.permission-screen{min-height:100dvh;box-sizing:border-box;padding:env(safe-area-inset-top,0px) 20px max(24px,env(safe-area-inset-bottom));display:flex;flex-direction:column}
+.permission-screen header{width:min(960px,100%);margin:0 auto;padding:12px 0}
+.permission-screen button,.permission-screen a{display:inline-flex;gap:8px;align-items:center;justify-content:center;min-height:48px;padding:12px 20px;box-sizing:border-box;border:1px solid var(--line);background:var(--surface);color:var(--ink);border-radius:12px;font:inherit;font-weight:600;text-decoration:none}
+.permission-screen header button{border:0;padding-inline:0}
+.permission-screen main{width:min(460px,100%);margin:auto;box-sizing:border-box;padding:32px 0;text-align:center}
+.permission-screen h1{font-size:26px;line-height:1.3;margin:20px 0 12px;overflow-wrap:anywhere}
+.permission-screen p{color:var(--ink-soft);line-height:1.6;margin:0 0 28px}
+.permission-icon{display:grid;place-items:center;width:64px;height:64px;border-radius:20px;margin:auto;color:var(--ink-soft);background:var(--surface-sunk)}
+.permission-icon svg{width:30px;height:30px}
+.permission-actions{display:flex;gap:12px;flex-wrap:wrap}
+.permission-actions>*{flex:1 1 130px}
+.permission-actions a{background:var(--accent);border-color:var(--accent);color:var(--accent-ink,#fff)}
+
+[dir=rtl] .permission-back-arrow{transform:rotate(180deg)}

assets/common/access-denied.js

@@ -0,0 +1,16 @@
+(function () {
+  'use strict';
+  function back() {
+    // Never return to the rejected receipt page or trust a cross-origin referrer.
+    let destination = 'kot-management.html';
+    try {
+      const previous = new URL(document.referrer);
+      const allowed = ['kot-management.html', 'products.html', 'cart.html', 'order-history.html', 'me.html', 'my-sales.html', 'pending.html'];
+      if (previous.origin === location.origin && allowed.includes(previous.pathname.split('/').pop()))
+        destination = previous.href;
+    } catch {}
+    location.href = destination;
+  }
+  document.querySelectorAll('[data-permission-back]').forEach(button => button.addEventListener('click', back));
+  window.addEventListener('captain:back', event => { event.preventDefault(); back(); });
+})();

assets/common/access.js

@@ -161,13 +161,13 @@
         return null;
       }
     };
-    async function prove(base, credential = state, remember = true) {
+    async function prove(base, credential = state, remember = true, signal) {
       const nonce = random();
       const answer = await post(
         base,
         "/captain/v1/route-proof",
         { sessionId: credential.sessionId, nonce },
-        null,
+        signal,
         2000,
       );
       const key = await cryptoApi.subtle.importKey(
@@ -552,6 +552,13 @@
       get user() {
         return state.user || profile?.user || null;
       },
+      async updateProfile(value) {
+        await ready;
+        if (locked || !state.user || String(value.id) !== String(state.user.id || state.user._id)) return false;
+        state.user = { ...state.user, name: value.name };
+        await persist();
+        return true;
+      },
       get shopKey() {
         return state.shopKey || profile?.shopKey || null;
       },
@@ -630,30 +637,42 @@
         return [state, ...(state.connections || [])].some(credential =>
           credential.routeKey && [credential.base, ...(credential.routes || [])].some(base => local(base)));
       },
-      async addAddress(base) {
-        await session.whenReady();
+      async addAddress(base, signal) {
         const started = generation;
+        await session.whenReady();
+        if (signal?.aborted || generation !== started) throw new Error("Connection cancelled.");
         const clean = safeRoute(base);
         if (!clean || locked) throw new Error("Unlock this phone first.");
         for (const credential of [state, ...(state.connections || [])]) {
-          if (generation !== started) throw new Error("Connection cancelled.");
+          if (signal?.aborted || generation !== started) throw new Error("Connection cancelled.");
           if (!credential.routeKey) continue;
           try {
-            await prove(clean, credential, false);
-            if (generation !== started) throw new Error("Connection cancelled.");
-            verified.add(clean);
-            credential.routes = [
-              ...new Set([...(credential.routes || []), clean]),
-            ];
-            await persist();
-            if (generation !== started) throw new Error("Connection cancelled.");
-            host.POSNIC?.server.remember({
-              [local(clean) ? "lan" : "cloud"]: clean,
-            });
-            return;
+            await prove(clean, credential, false, signal);
           } catch {
-            /* A candidate must prove the existing session before use. */
+            if (signal?.aborted || generation !== started) throw new Error("Connection cancelled.");
+            // Only proof failures can try another credential. A secure-storage
+            // failure must not be presented as the wrong shop or as success.
+            continue;
           }
+          if (signal?.aborted || generation !== started) throw new Error("Connection cancelled.");
+          const previousRoutes = credential.routes;
+          const nextRoutes = [...new Set([...(previousRoutes || []), clean])];
+          credential.routes = nextRoutes;
+          try {
+            await persist();
+          } catch (error) {
+            if (generation === started && credential.routes === nextRoutes) {
+              if (previousRoutes === undefined) delete credential.routes;
+              else credential.routes = previousRoutes;
+            }
+            throw error;
+          }
+          if (signal?.aborted || generation !== started) throw new Error("Connection cancelled.");
+          verified.add(clean);
+          host.POSNIC?.server.remember({
+            [local(clean) ? "lan" : "cloud"]: clean,
+          });
+          return;
         }
         throw new Error(
           "This address is not the server that approved this phone.",

assets/common/account.js

@@ -1,5 +1,56 @@
 (function () {
   let changing = false;
+  const t = (text) => window.I18N?.t(text) || text;
+  function confirmChange(hasCart) {
+    return new Promise((resolve) => {
+      const previous = document.activeElement;
+      const dialog = document.createElement("dialog");
+      dialog.id = "account-signout";
+      dialog.setAttribute("aria-labelledby", "account-signout-title");
+      const title = document.createElement("h2");
+      title.id = "account-signout-title";
+      title.textContent = t("Sign out");
+      const who = document.createElement("p");
+      who.translate = false;
+      who.textContent =
+        POSNIC.session.user?.name || POSNIC.session.user?.email || "";
+      const info = document.createElement("p");
+      info.textContent = t(
+        hasCart
+          ? "Discard changes?"
+          : "Signing out clears this phone's menu, tables and cart, and asks for the shop password next time.",
+      );
+      const actions = document.createElement("footer");
+      const cancel = document.createElement("button");
+      cancel.type = "button";
+      cancel.textContent = t("Cancel");
+      const confirm = document.createElement("button");
+      confirm.type = "button";
+      confirm.dataset.confirmSignout = "";
+      confirm.textContent = t("Sign out");
+      const finish = (value) => {
+        window.removeEventListener("captain:back", back, true);
+        dialog.close();
+        dialog.remove();
+        previous?.focus();
+        resolve(value);
+      };
+      const back = (event) => {
+        event.preventDefault();
+        event.stopImmediatePropagation();
+        finish(false);
+      };
+      cancel.onclick = () => finish(false);
+      confirm.onclick = () => finish(true);
+      dialog.addEventListener("cancel", back);
+      window.addEventListener("captain:back", back, true);
+      actions.append(cancel, confirm);
+      dialog.append(title, who, info, actions);
+      document.body.append(dialog);
+      dialog.showModal();
+      cancel.focus();
+    });
+  }
   async function change(mode = "staff") {
     if (changing) return;
     const say = (text) =>
@@ -12,17 +63,25 @@
       );
       return;
     }
-    const cart =
-      typeof getData === "function"
-        ? await getData("cart").catch(() => [])
-        : [];
-    if (
-      cart.length &&
-      !confirm(window.I18N ? I18N.t("Discard changes?") : "Discard changes?")
-    )
-      return;
     changing = true;
+    const owner = JSON.stringify([
+      POSNIC.session.shopKey,
+      POSNIC.session.user?.id,
+    ]);
     try {
+      const cart = typeof getData === "function" ? await getData("cart") : [];
+      if (!(await confirmChange(cart.length > 0))) return;
+      if (
+        JSON.stringify([POSNIC.session.shopKey, POSNIC.session.user?.id]) !==
+        owner
+      )
+        return;
+      if (window.OrderQueue?.all().length) {
+        say(
+          "Send saved orders before switching accounts. Connection settings remain available.",
+        );
+        return;
+      }
       await POSNIC.session.end();
       localStorage.removeItem("user_id");
       sessionStorage.removeItem("posnic_editing_server");