POS and Admin Orders API
Routes: backend-main/pos/urls.py. Auth overview: Authentication. Order status semantics: Order lifecycle.
Auth split
| Surface | Auth | Enforcement |
|---|---|---|
POS terminal (/api/pos-*, /api/pos-orders/…) | X-POS-Access-Key | Manual get_pos_from_access_key in views; AllowAny at DRF layer |
| Admin orders / reports / workflows | JWT + role permissions | IsAdminUser, IsAdminOrAccounts, IsAuthenticated, etc. |
POS entity CRUD /api/pos/ | JWT IsAuthenticated | PointOfSaleViewSet |
POS session and catalog
| Method | Path | Notes |
|---|---|---|
GET | /api/pos-info/<slug>/ | Public login page info |
POST | /api/pos-auth/ | {slug, password} → access_key (12h) |
GET | /api/pos-products/ | Access key |
GET | /api/pos-catalog/ | Access key |
GET | /api/pos-catalog/banners/ | Access key |
GET | /api/pos-catalog/offers/ | Access key |
GET | /api/pos-design-collections/, …/<slug>/ | Access key |
GET | /api/pos-designs/<slug>/, …/wizard/ | Access key |
GET/PATCH | /api/pos-store-address/ | Access key |
GET/POST | /api/pos-upi-qr/ | Access key |
POST | /api/pos-upload-image/ | Access key |
GET | /api/pos-orders-search/ | Access key |
Admin manages POS records: /api/pos/ ViewSet (+ GET /api/pos/pricing-categories-for-warehouses/?warehouse_ids=).
POS orders
| Method | Path | Notes |
|---|---|---|
GET/POST | /api/pos-orders/ | List (optional status, search) / create |
GET | /api/pos-orders/archived/ | Paginated; source=customer_link|ecommerce|pos |
GET/PATCH/DELETE | /api/pos-orders/<order_id>/ | Detail / update / soft-archive style delete |
GET/POST | /api/pos-orders/<order_id>/comments/ | Comments |
POST | /api/pos-orders/<order_id>/request-edit/ | Edit request |
POST | /api/pos-orders/<order_id>/workflow-units/<unit_id>/approve/ | Customer-facing approval from POS |
POST | /api/pos-orders/<order_id>/workflow-units/<unit_id>/reject/ | Reject |
POS notifications (persisted)
| Method | Path |
|---|---|
GET | /api/pos-notifications/ |
POST | /api/pos-notifications/<uuid>/read/ |
DELETE | /api/pos-notifications/<uuid>/ |
POST | /api/pos-notifications/mark-all-read/ |
Admin orders and ops
| Method | Path | Permission (code) |
|---|---|---|
GET | /api/admin/orders/ | IsAdminOrAccounts (count_only for badge) |
GET | /api/admin/orders/archived/ | IsAdminUser |
POST | /api/admin/orders/run-archive/ | IsAdminUser |
POST | /api/admin/orders/<order_id>/restore/ | IsAdminUser |
GET/PATCH… | /api/admin/orders/<order_id>/ | Detail; write rules via get_permissions (IsAdminOrAccounts read / IsAdminUser write) |
GET | /api/admin/orders/<order_id>/items/<item_id>/print-file/ | Print file download |
GET/POST | /api/admin/orders/<order_id>/comments/ | Comments |
… | /api/admin/orders/<order_id>/workflow-units/<unit_id>/ | Unit detail |
… | …/design-files/, …/design-files/<file_id>/ | Design files |
GET | …/timeline/ | Unit timeline |
… | /api/admin/orders/<order_id>/edit-request/ | Approve/deny edit request |
Dashboard, reports, workflows
| Method | Path | Permission |
|---|---|---|
GET | /api/admin/dashboard/ | IsAdminUser |
GET | /api/admin/reports/summary/ | IsAdminOrAccounts |
GET | /api/admin/reports/trends/ | IsAdminOrAccounts |
GET | /api/admin/reports/orders/ | IsAdminOrAccounts |
GET | /api/admin/reports/export/ | IsAdminOrAccounts |
GET | /api/admin/reports/pending-payments/ | IsAdminOrAccounts |
GET | /api/admin/workflows/ | IsAuthenticated (role checks inside board view) |
Admin notifications
| Method | Path |
|---|---|
GET | /api/admin/notifications/ |
POST | /api/admin/notifications/<uuid>/read/ |
DELETE | /api/admin/notifications/<uuid>/ |
POST | /api/admin/notifications/mark-all-read/ |
SSE (orders)
Declared next to these routes; full detail in SSE and realtime:
GET /api/pos-orders/stream/— POS consolidated (access key)GET /api/admin/orders/stream/— Admin consolidated (?token=)GET /api/admin/notifications/stream/— Admin notifications (?token=)GET /api/orders/<order_id>/comments/stream/— Legacy per-order