fix: image processing

2026-10-21 16:29:32 +02:00
parent e826e98c89
commit 4dae99786f
5 changed files with 219 additions and 46 deletions
@@ -19,8 +19,10 @@
 ## Authorization

 ### Role-Based Access
- `admin`: Full access, including users, device pairing, planned customers and sending reminders
- `viewer` (shown as staff): views tabs and commands and can close tabs
+- `admin`: Full access, including users and pairing or unpairing terminals
+- `manager` (the people running the venue): products and their pictures, stock, tabs, planned customers and
+  reminders. Accounts and tokens with the former role `viewer` are treated as managers
+- Product pictures are public by id (`GET /images/:imageId`); the id is a SHA-256 hash, so it can't be guessed

 ### Venue Isolation
 - Every user and device is scoped to exactly one venue