Restropress POS

RestroPress POS provides the server side for the RestroPress POS mobile app. Staff use the app on a tablet or phone to take orders at the counter or table, update order status, manage simple stock, view sales reports and print kitchen (KOT) and bar (BOT) tickets. The extension itself has no settings screen in WordPress. It registers a REST API under restro-pos/v1, stores the app's settings, and sends push notifications for new and updated orders.

Requirements#

• RestroPress (free plugin) active. Otherwise an error notice is shown and the plugin deactivates itself.
• The RestroPress POS mobile app.
• A WordPress user for each person who signs in, with a password or an Application Password.
• A Firebase project for push notifications. The plugin reads service_account.json from its own folder.
• Optional: the DineIn extension (adds the Dinein service and table/floor routes), Delivery Fee (delivery fee route), Multi-Location (branch topics for notifications).

Installation#

1. Go to Plugins › Add New › Upload Plugin, upload the ZIP and click Activate.
2. The plugin passes your licence key (option rpress_restropress___pos) to the RestroPress updater so updates can be delivered. Enter your key on the RestroPress Extensions screen (RestroPress › Extensions) if your site lists this extension there. The plugin itself registers no licence field.
3. For each user who will sign in to the app, open Users › Edit user, create an Application Password if you want to use one, and make sure the user has RestroPress API keys (the login response returns the user's RestroPress API public key, private key and token).
4. Open the POS app, enter your site address and sign in.

Settings#

There are no settings in the WordPress admin. The app saves its own preferences (such as printer and category settings for KOT and BOT) through the API into the option _restropress_pos_user_settings, and the app reads them back from there. Services shown in the app follow your RestroPress service settings (delivery, pickup, delivery and pickup), plus Dinein when the DineIn extension is active.

How it works#

1. Sign in. The app posts to restro-pos/v1/login with HTTP Basic credentials (the Authorization or X-Authorization header; body fields are accepted as a fallback). On success it receives the user's id, name, roles and RestroPress API keys. After login the app calls the other routes using the user's credentials or an Application Password.
2. Orders. The app lists, creates and updates orders through the RestroPress order controller, mounted at restro-pos/v1/order. Orders created with order_from set to pos_app skip the standard new-order push to avoid duplicates. For Dinein orders the plugin saves the table (rpress_dinein_table_id), service type, date and time on the order, sets the status to pending, and notifies waiters through the DineIn extension.
3. Status updates. order/update-status/(id)/(status) accepts accept and complete as aliases for accepted and completed.
4. Menu and stock. Food items come from food and others/fooditems. others/stock_status updates a food item's stock quantity and stock status (rp_item_stock, rp_stock_status). Customers are exposed at customers.
5. Reports. others/sales-report returns a sales summary for a date range and others/top-food-sales returns best-selling items.
6. Printing. others/get-categories-printable-list splits an order's items into KOT and BOT lists using the categories chosen in the app's printer settings.
7. Staff. employee lists, creates, updates and deletes users with the shop_worker role (name, email, phone, status, profile image).
8. Notifications. When a new order is placed outside the POS app, or an order status changes, a push notification is sent to the topic stored in the option ota_fcm_topic (the same topic key as the Order Tracking extension). If Order Tracking is active it sends these notifications instead. With Multi-Location, the branch name is appended to the topic.

Developer reference#

Namespace restro-pos/v1. Authentication on the others/* and dinein/* routes uses the logged-in user or a WordPress Application Password.

Route	Methods	Purpose
login	POST	Sign in; returns user and RestroPress API keys
order, order/(id), order/statuses, order/update-status/(id)/(status)	REST posts routes, GET, PUT, PATCH	List, create, update orders; list statuses; change status
food, customers, customers/(id)	Posts routes	Food items (with POS sales data) and customers
employee, employee/(id)	GET, POST, PUT, DELETE	Manage shop workers
dinein/tables, dinein/floors	GET	Table and floor lists (from the DineIn options)
dinein/update-tables, dinein/update-floors	POST	Replace tables or floors; requires the manage_options capability
others/services	GET	Enabled services and default service (also at the legacy namespace rp/v1)
others/settings	GET, PUT/PATCH	Read or replace the app settings
others/restropress-settings	GET	Tax settings (with settings_key=tax_settings) or the full RestroPress settings array
others/service-time-slots, others/get-delivery-fee, others/active-plugins	GET, POST	Time slots, delivery fee (needs Delivery Fee), delivery fee plugin status
others/update-profile, others/firebase_token_refresh	POST	Update the user's first and last name; register a device token for push topics
others/update-kitchen-time/(order_id)/(minutes)	POST	Sets the kitchen ready time on an order (dinein_order_take_time)
others/sales-report, others/top-food-sales, others/stock_status, others/fooditems, others/get-categories-printable-list	GET, POST	Reports, stock and printing helpers

Hook	Type	Parameters	Purpose
rp_api_auth_error_message	filter	$message	Changes the message returned when authentication fails on others/* and dinein/*.
rpress_before_payment_receipt	action (core, used)	$payment, $args	The plugin sends the new-order notification here.
rpress_update_order_status	action (core, used)	$payment_id, $new_status	The plugin sends the status-update notification here.

// Replace the unauthenticated message
add_filter( 'rp_api_auth_error_message', function () {
    return 'Please sign in again.';
} );

Troubleshooting#

• "Email/username and password are required." or "Invalid email/username or password." The login request carried no credentials, or they are wrong. Use the user's WordPress username and password.
• "Authentication failed. Please check your credentials." The app sent no valid session or Application Password. Create an Application Password for the user and use it in the app.
• "Sorry, you are not allowed to perform this action." The user lacks the capability required by the route.
• "Please active delivery fee" (HTTP 401) from others/get-delivery-fee: install and activate the Delivery Fee extension.
• No push notifications. Check that service_account.json belongs to the Firebase project your app uses, and that the device registered through others/firebase_token_refresh. Notification responses are appended to pos-notification.log in the WordPress root.
• Dinein orders missing from the app. Install and activate the DineIn extension; the Dinein service is only offered when it is active.

Changelog highlights#

• 1.2.1: settings-aware services endpoint; Dinein POS orders with waiter notifications; order updates keep Dinein service data; login accepts standard Authorization, X-Authorization, PHP auth and request body credentials.
• 1.2: API security fix, tax fix, employee endpoint authentication fix.
• 1.1.1: new settings endpoints.