Item #3l — POS lockdown (middleware redirect + manager-PIN override + sidebar filter)PROD

Summary

Status

16/16 prod · 51/51 regression = 67/67 · shipped

Commits

nix-cafe 007b135 + 2da5394 (basePath fix)

Files

10 modified + 4 new · ~790 LOC · no migration · reuses existing PIN infra

Architecture

Middleware redirect (Edge runtime, signature-only) + manager-override JWT cookie (30 min TTL) + nav-model lockdown filter + persistent amber banner with countdown

What ships

• Middleware redirect: any admin page route (Dashboard / Settings / Products / Customers / Inventory / Team / Reports / Finance / Configurations / Telegram / Subscription / POS Settings / POS Sessions) 302s back to /cafe/pos/register/<configId> when nix_active_cashier cookie is present and no valid nix_manager_override cookie. /api/* routes are excluded (they self-gate via readActiveCashier() where needed).
• Allow-list: /pos/register/[configId] + sub-routes, /pos exact (landing/picker), /pos/orders + sub-routes (cashier needs order list for refunds/lookups during shift).
• Manager-override flow: requestManagerOverrideAction gates on nix_cafe.pos.session_open permission + verifies POS PIN via existing verifyPosPinForUser. New nix_manager_override JWT cookie (HttpOnly, SameSite=Lax, path=/cafe, 30 min TTL, signed with same JWT_SECRET as nix_session / nix_active_cashier). Audit log pos.manager_override.granted / .cleared via Next after().
• Sidebar filter: filterNavForPermissions(perms, { lockdownActive }) narrows the nav to POS group (Registers + Orders only) when lockdown is active; admin sections stripped. Mirrors the middleware allow-list patterns exactly (/^\/pos$/ exact + /^\/pos\/orders(\/|$)/) to avoid /pos/sessions matching the /pos prefix.
• Manager Mode button in PosMoreMenu (⋮) — visible only when caller has POS PIN set. Threaded through 3 PosMoreMenu callsites: Pro fullscreen lockable-shell.tsx, Starter in-app starter-lockable-shell.tsx, Starter starter-top-bar.tsx. Starter starter-register-page.tsx gains the userHasPosPin probe + permission check (mirrors the Pro page.tsx pattern).
• Manager Override Dialog: PIN input with 4-6 digit validation, wrong-PIN error surface, redirects to /dashboard on success.
• Persistent banner: amber stripe at top of every authed page during override, server-authoritative expiresAt from JWT payload, client-side countdown ticker (15s interval), "Return to POS" button calls clearManagerOverrideAction + redirects to register cookie's fromPosConfigId.

16/16 prod checks ✓

Screenshots (click to enlarge)

Mid-Gate-2 finds

• basePath double-prepend bug — first prod run hit 14/16, with a 500 on /cafe/cafe/dashboard?_rsc=.... Root cause: router.push("/cafe/dashboard") in the dialog and banner. Next 15 with basePath: "/cafe" automatically prepends; passing the full path produces /cafe/cafe/.... Fixed in commit 2da5394 — paths reduced to /dashboard and /pos/register/X.
• Cold-Worker DOM-swap race — second run dropped to 6/16. The PIN screen state transition (CashierPickerScreen → PinKeypadScreen via local setTarget) was racing Playwright on a freshly cold Worker. Added page.waitForTimeout(800) before click (hydration settle) + 500ms after click before the next selector wait, per feedback_playwright_useState_dom_swap. Same pattern as the Slice O cold-Worker fix.
• commerce vs cafe schema — initial probe used commerce.pos_configs but the table lives at cafe.pos_configs. Migration shift was earlier in the multi-register arc (R10/Bundle 3); the test query was stale. One-line fix.
• prodSql escape chain — bash → node -e → knex.raw mangles single-quoted SQL literals. Switched to prodProbe (temp .mjs with knex parametrized) for all cleanup queries per project_prodsql_escape_limits.

Regression sweep — 51/51 ✓