# User manual

## Administrator

- View the dashboard, customer orders, payment records, reports, and audit history.
- Manage menu items, categories, prices, availability, and Administrator/Cashier/Customer accounts.
- View every customer order and monitor cashier payment-verification history, reviewer, timestamp, and rejection reason.
- Update order status and record historical cash payments when applicable.
- Payment approval and rejection are restricted to Cashier accounts.
- A paid order cannot be cancelled through the order-status action until a real refund workflow is available.

Administrators can create and edit Administrator, Cashier, and Customer accounts, reset individual passwords, mark demo accounts, disable accounts, and delete an individual login after typing its username to confirm. Deleting a login preserves linked orders, payments, transactions, and audit history. The demo reset is local-only, requires typing `RESET DEMO ACCOUNTS`, resets only marked demo users, and preserves every other account.

## Cashier

- Review pending customer-submitted GCash receipts. Previously approved and rejected GCash receipts remain visible with their verification history; only payments awaiting verification have review actions.
- Inspect the uploaded receipt and verify the transaction in the merchant account before approving. The cashier must confirm the exact reference and merchant-confirmed amount; receipt upload alone is not proof of payment.
- Reject invalid or mismatched payments with a reason visible to the customer.
- Cashiers cannot create walk-in orders, record cash payments, change order status, browse non-GCash orders, or access user, product, dashboard, report, or audit administration.

## Customer

- Browse available menu items, manage a cart, place an order, view its receipt and status history, and review only their own orders.
- New customer registration requires a 6-digit code sent to the registered email address; the code expires after five minutes and can be resent after the cooldown. The account cannot be used until verified.
- Changing a customer's phone number continues to require OTP verification sent to the new number.
- Customer checkout is GCash-only. Online GCash through Xendit and manual QR GCash are shown when configured; pay-at-counter is not offered.

## Order and payment flow

1. Sign in and add available menu items to the basket. Checkout recalculates prices and totals on the server; each item quantity must be from 1 to 99.
2. Choose an order type and, for delivery, confirm a validated address.
3. For online GCash, follow the Xendit-hosted checkout and wait for server-verified payment confirmation. A browser success screen alone is not proof. For manual GCash, scan the configured QR, pay the displayed total, and upload the receipt. The order Payment section keeps the receipt available to view or zoom, shows OCR progress separately from payment status, and lets you retry OCR, copy, check, correct, and save the reference. The payment remains unpaid until a Cashier reviews it. OCR, screenshot, amount, or reference alone is not proof.
4. An authorized Cashier checks the merchant account and may approve or reject submitted manual GCash transfers. Administrators can monitor all orders and the cashier's verification history but cannot approve or reject manual GCash payments. Rejected payments show the reason and allow the customer to correct and resubmit the reference; if the payment evidence itself must be replaced, place a new order. Historical counter-payment records remain preserved.
5. Administrators advance eligible orders through preparing and ready. Delivery orders move from ready to out for delivery. The customer may confirm receipt at the supported receipt-confirmation stage.
6. Completed orders appear in Successful Orders; active and cancelled orders remain in the Orders view. Sales summaries exclude unpaid, refunded, and cancelled payments.
7. Use reports to filter by date, payment method, order status, and category, then print or export CSV.

## Account security

- Use a unique password of at least 8 characters.
- Administrators create Administrator, Cashier, or Customer accounts from Users; passwords are hashed on the server and are not displayed again after ordinary account creation.
- Migration 14 disables legacy cashier/staff accounts; migration 15 restores a restricted Cashier role without reactivating legacy accounts. Staff remains obsolete.
- Demo passwords are privately configured and hashed in the database; the login page shows them only when all active, marked demo account hashes match. Public demos require explicit production opt-in and must use an isolated deployment without real customer or payment data; public demo administrators can change application data.
- Sign out when finished, especially on shared devices.