~/sajjad $ cat projects/qr-order-and-pay
← cd ../projects
Systems
QR order-and-pay platform
Live since Aug 2026
At-table ordering and card payment for tables inside, outside and in the letting rooms. Guest scans, orders and pays; the order lands on a bar tablet in realtime. Runs on its own subdomain, independent of the venue EPOS.
// watch · 27s
What I built
- Schema from scratch — orders, items, catalogue, locations, settings, refunds, audit — with every table and room seeded against an unguessable token.
- Stripe live payments with webhook reconciliation across four event types, and three Edge Functions covering order creation, webhook handling and refunds.
- Realtime bar screen: per-order timers, a chime at two minutes escalating at four and six to a full-screen alarm, accept and delivered actions, refuse-with-reason, live sold-out toggle. Refuse-and-refund proven end to end in live service.
- Food ordering with allergen data enforced at schema level, so no dish can go live without allergen text.
- Admin console for pricing, menu toggles and service hours, plus a QR print module generating error-correction-level-H cards.
What went wrong
- Closed a token-enumeration vulnerability before launch by replacing direct table reads with a security-definer lookup returning at most one row.
- Diagnosed a gateway-level CORS rejection blocking every guest request before the function ever ran.
- Traced a payment failure to a mangled key value rather than an account problem, by reading the raw error instead of the dashboard.
Schematics
