Restaurant mode Phase 3: table-QR self-ordering into the kitchen

The "links" slice — a guest scans a table's QR, browses the menu (with
modifiers), and submits an order that lands on that table's open tab and fires
straight to the Kitchen Display.

- Public, auth-free flow scoped by an unguessable table short_code:
  GET /t/{code} (menu + client cart), POST /t/{code}/order (throttled),
  GET /t/{code}/done. Orders open/append the table's dine-in tab, add lines as
  source=guest, and send to the kitchen.
- Staff print a per-table QR (Settings → table → QR; renders client-side to the
  public menu URL). short_code is generated lazily.
- Guest lines are badged on the ticket and the KDS so staff can tell them apart;
  staff still settle the tab as usual (cash / Ladill Pay).
- Extracted PosSaleService::buildProductLine as the single product+modifier
  price resolver, now shared by staff and guest ordering (client prices never
  trusted).

Schema additive: pos_tables.short_code, pos_sale_lines.source. New
PosRestaurantTest covers the guest order firing to the kitchen; suite green (12).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Http/Controllers/Pos/KitchenController.php

@@ -63,6 +63,7 @@ class KitchenController extends Controller
                     'course' => $l->course,
                     'station' => $l->station?->name,
                     'station_id' => $l->station_id,
+                    'source' => $l->source,
                     'modifiers' => $l->modifiers->map(fn ($m) => $m->name)->all(),
                     'state' => $l->kitchen_state,
                 ])->all(),

app/Http/Controllers/Pos/TableController.php

@@ -42,4 +42,14 @@ class TableController extends Controller
             'openTickets' => $openTickets,
         ]);
     }
+
+    public function qr(Request $request, PosTable $table): View
+    {
+        $this->authorizeOwner($request, $table);
+
+        return view('pos.tables.qr', [
+            'table' => $table,
+            'url' => route('pos.table.menu', $table->ensureShortCode()),
+        ]);
+    }
 }

app/Http/Controllers/Pos/TicketController.php

@@ -107,29 +107,19 @@ class TicketController extends Controller
         ];
 
         if (! empty($data['product_id'])) {
-            $product = PosProduct::owned($this->ownerRef($request))
-                ->with('modifierGroups.modifiers')
-                ->find($data['product_id']);
+            $resolved = $this->sales->buildProductLine(
+                $this->ownerRef($request),
+                (int) $data['product_id'],
+                $data['modifier_ids'] ?? [],
+                $payload['quantity'],
+                $payload['notes'],
+                $payload['course'],
+            );
 
-            if (! $product) {
+            if ($resolved === null) {
                 return response()->json(['message' => 'Unknown product.'], 422);
             }
-
-            // Only modifiers that belong to this product's groups count.
-            $allowed = $product->modifierGroups->flatMap->modifiers->keyBy('id');
-            $chosen = collect($data['modifier_ids'] ?? [])
-                ->map(fn ($id) => $allowed->get((int) $id))
-                ->filter()
-                ->values();
-
-            $payload['product_id'] = $product->id;
-            $payload['name'] = $product->name;
-            $payload['station_id'] = $product->station_id;
-            $payload['course'] = $payload['course'] ?? $product->course;
-            $payload['unit_price_minor'] = max(1, $product->price_minor + (int) $chosen->sum('price_delta_minor'));
-            $payload['modifiers'] = $chosen->map(fn ($m) => [
-                'modifier_id' => $m->id, 'name' => $m->name, 'price_delta_minor' => $m->price_delta_minor,
-            ])->all();
+            $payload = $resolved;
         } else {
             // Custom (open-price) line.
             $payload['name'] = (string) ($data['name'] ?? '');
@@ -260,6 +250,7 @@ class TicketController extends Controller
             'kitchen_state' => $l->kitchen_state,
             'notes' => $l->notes,
             'course' => $l->course,
+            'source' => $l->source,
             'modifiers' => $l->modifiers->map(fn ($m) => $m->name)->all(),
             'fired' => $l->kitchen_state !== PosSaleLine::KITCHEN_NEW,
         ])->all();

app/Http/Controllers/Public/TableOrderController.php

@@ -0,0 +1,139 @@
+<?php
+
+namespace App\Http\Controllers\Public;
+
+use App\Http\Controllers\Controller;
+use App\Models\PosLocation;
+use App\Models\PosProduct;
+use App\Models\PosSale;
+use App\Models\PosTable;
+use App\Models\User;
+use App\Services\Pos\PosSaleService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+
+/**
+ * Public table-QR ordering: a guest scans a table's QR, browses the menu, and
+ * submits an order that lands on that table's open tab and fires to the kitchen.
+ * No auth — scoped entirely by the table's unguessable short_code.
+ */
+class TableOrderController extends Controller
+{
+    public function __construct(private PosSaleService $sales) {}
+
+    public function menu(string $code): View
+    {
+        $table = PosTable::where('short_code', $code)->firstOrFail();
+        $owner = (string) $table->owner_ref;
+        $location = PosLocation::owned($owner)->first();
+
+        $products = PosProduct::owned($owner)->active()
+            ->with(['category', 'modifierGroups.modifiers'])
+            ->orderBy('name')->get();
+
+        return view('public.table-menu', [
+            'table' => $table,
+            'storeName' => $location?->name ?: 'Menu',
+            'currency' => $location?->currency ?: config('pos.default_currency', 'GHS'),
+            'products' => $products->map(fn (PosProduct $p) => [
+                'id' => $p->id,
+                'name' => $p->name,
+                'price_minor' => $p->price_minor,
+                'category' => $p->category?->name,
+                'modifier_groups' => $p->modifierGroups->map(fn ($g) => [
+                    'id' => $g->id, 'name' => $g->name, 'min' => $g->min_select, 'max' => $g->max_select,
+                    'modifiers' => $g->modifiers->map(fn ($m) => [
+                        'id' => $m->id, 'name' => $m->name, 'price_delta_minor' => $m->price_delta_minor,
+                    ])->values()->all(),
+                ])->values()->all(),
+            ])->values()->all(),
+        ]);
+    }
+
+    public function store(Request $request, string $code): JsonResponse
+    {
+        $table = PosTable::where('short_code', $code)->firstOrFail();
+        $owner = (string) $table->owner_ref;
+
+        $data = $request->validate([
+            'items' => ['required', 'array', 'min:1', 'max:50'],
+            'items.*.product_id' => ['required', 'integer'],
+            'items.*.quantity' => ['required', 'integer', 'min:1', 'max:50'],
+            'items.*.modifier_ids' => ['nullable', 'array'],
+            'items.*.modifier_ids.*' => ['integer'],
+            'items.*.notes' => ['nullable', 'string', 'max:200'],
+            'customer_name' => ['nullable', 'string', 'max:120'],
+        ]);
+
+        $sale = $this->resolveTab($table, $owner);
+        if ($sale === null) {
+            return response()->json(['message' => 'This table is not available for ordering right now.'], 422);
+        }
+
+        if (! empty($data['customer_name']) && ! $sale->customer_name) {
+            $sale->forceFill(['customer_name' => $data['customer_name']])->save();
+        }
+
+        $added = 0;
+        foreach ($data['items'] as $item) {
+            $payload = $this->sales->buildProductLine(
+                $owner,
+                (int) $item['product_id'],
+                $item['modifier_ids'] ?? [],
+                (int) $item['quantity'],
+                $item['notes'] ?? null,
+                null,
+                'guest',
+            );
+            if ($payload !== null) {
+                $this->sales->addLine($sale, $payload);
+                $added++;
+            }
+        }
+
+        if ($added === 0) {
+            return response()->json(['message' => 'Those items are no longer available.'], 422);
+        }
+
+        // Guest orders go straight to the kitchen.
+        $this->sales->sendToKitchen($sale);
+
+        return response()->json(['redirect' => route('pos.table.confirmed', $code)]);
+    }
+
+    public function confirmed(string $code): View
+    {
+        $table = PosTable::where('short_code', $code)->firstOrFail();
+        $location = PosLocation::owned((string) $table->owner_ref)->first();
+
+        return view('public.table-confirmed', [
+            'table' => $table,
+            'storeName' => $location?->name ?: 'Thanks',
+        ]);
+    }
+
+    private function resolveTab(PosTable $table, string $owner): ?PosSale
+    {
+        if ($table->current_sale_id) {
+            $existing = PosSale::owned($owner)->openTickets()->find($table->current_sale_id);
+            if ($existing) {
+                return $existing;
+            }
+        }
+
+        $merchant = User::where('public_id', $owner)->first();
+        if (! $merchant) {
+            return null;
+        }
+
+        $location = PosLocation::owned($owner)->first();
+
+        return $this->sales->openTicket($merchant, [
+            'order_type' => PosSale::ORDER_DINE_IN,
+            'table_id' => $table->id,
+            'location_id' => $location?->id,
+            'currency' => $location?->currency,
+        ]);
+    }
+}