${name} — Queue

This was a demo order — nothing was sent to \" + venueName + \", nothing was charged.

\"\n: \"

Your order has been placed with \" + venueName + \".

\";\nconst html =\n\"

\" +\n\"

Thanks for trying iTabs\" + (isDemo ? \" — here's what just happened\" : \"\") + \"

\" +\ndemoNote +\n\"

Order reference: \" + orderId + \"

\" +\n\"

Want a menu like this for your own venue? Set it up here:

\" +\n\"

Set up your iTabs menu

\" +\n\"

\";\ntry {\nawait fetch(\"https://api.resend.com/emails\", {\nmethod: \"POST\",\nheaders: {\n\"Authorization\": \"Bearer \" + RESEND_API_KEY,\n\"Content-Type\": \"application/json\",\n},\nbody: JSON.stringify({\nfrom: RESEND_FROM,\nto: toEmail,\nsubject: isDemo ? \"Your iTabs demo order\" : \"Your order from \" + venueName,\nhtml: html,\n}),\n});\n} catch (e) {}\n}\nfunction getIp(req) {\nconst fwd = req.headers.get(\"x-forwarded-for\");\nif (fwd) return fwd.split(\",\")[0].trim();\nreturn \"unknown\";\n}\nfunction jsonResponse(obj, status) {\nreturn new Response(JSON.stringify(obj), {\nstatus: status || 200,\nheaders: { \"Content-Type\": \"application/json\" },\n});\n}\n// venue = { venue, accent, queueEmoji } pulled live from state.settings so the\n// queue always matches whatever's currently saved via the menu editor.\nfunction queuePage(venue) {\nconst accent = venue.accent || \"#22c55e\";\nconst emoji = venue.queueEmoji || DEFAULT_EMOJI;\nconst name = venue.venue || \"Venue\";\nreturn `\n\n${name} — Queue\n\n\n

${emoji} ${name}

0 waiting

Add Item

Options

\n\n\n

Order so far

No items added yet

Name (optional)

\n\n

Notes (optional)

\n\n\n

\n\n`;\n}\nconst HTML_TEMPLATE = String.raw`\n\n\n\n\nWasabi Monkey | Fiona Stanley Hospital | Order\n\n\n\n\n\n\n\n

\n\n

\n\n\n\n

\n\n\n

\n\n

0 items

$0.00

\n\n

Connect

\nGet directions to Fiona Stanley Hospital food court\n

Pickup only at this location — no delivery

\n\n

Your order

Total$0.00

\n\n

Pickup time

Name

\n\n

Email (for your receipt)

\n\n

Dietary

Notes for the kitchen

\n\n

Pay at the counter and show this screen

\n\n

\n\n\n\n

Owner access

\n\n\n\n\n

\n\n

Venue settings & menu

\n\n\n

Venue name

\n\n

Tagline

\n\n

Phone

\n\n

WhatsApp (intl format, e.g. 61412345678)

\n\n

Map link

\n\n

Orders go to

\n\n

Item photos

\n\n

Demo mode

Demo mode ON — orders marked as test, not sent to venue

\n\n

Brand colour (no purple)

\n\n

Logo (URL or upload)

\n\nUpload\n

\n\n

Hero banner image (URL or upload)

\n\nUpload\n

Change PIN

New PIN (4 digits)

\n\n

Confirm new PIN

\n\n

\n\n\n\n

\n\n\n\n`;\nexport default async function (req: Request): Promise {\nconst url = new URL(req.url);\nif (req.method === \"GET\" && url.pathname === \"/\") {\nconst state = await getState();\nconst dataForClient = {\nsettings: Object.assign({}, state.settings, { pin: undefined }),\ncategories: state.categories,\n};\ndelete dataForClient.settings.pin;\nlet json = JSON.stringify(dataForClient);\njson = json.split(\"\nconst html = HTML_TEMPLATE.replace(\"__ITABS_DATA__\", json);\nreturn new Response(html, {\nheaders: { \"Content-Type\": \"text/html; charset=utf-8\" },\n});\n}\nif (req.method === \"GET\" && url.pathname === \"/recover-pin\") {\nconst code = url.searchParams.get(\"code\");\nif (code !== RECOVERY_CODE) {\nreturn new Response(\"Not found\", { status: 404 });\n}\nconst state = await getState();\nconst newState = {\nsettings: Object.assign({}, state.settings, { pin: DEFAULT_PIN }),\ncategories: state.categories,\n};\nawait saveState(newState);\nreturn new Response(\n\"PIN reset to \" + DEFAULT_PIN +\n\". Everything else (colours, photos, contact details) is untouched. Unlock the editor with this PIN and set a new one from Venue & Hero \\u2192 Change PIN.\",\n{ headers: { \"Content-Type\": \"text/plain\" } },\n);\n}\nif (req.method === \"POST\" && url.pathname === \"/unlock\") {\nconst ip = getIp(req);\nconst lock = await getLock(ip);\nif (lock.lockedUntil > Date.now()) {\nconst minutesLeft = Math.ceil((lock.lockedUntil - Date.now()) / 60000);\nreturn jsonResponse({\nok: false,\nlocked: true,\nminutesLeft: minutesLeft,\n});\n}\nlet body;\ntry {\nbody = await req.json();\n} catch (e) {\nreturn jsonResponse({ ok: false });\n}\nconst state = await getState();\nconst currentPin = state.settings.pin || DEFAULT_PIN;\nif (body && body.pin === currentPin) {\nawait setLock(ip, { attempts: 0, lockedUntil: 0 });\nreturn jsonResponse({ ok: true });\n}\nconst attempts = (lock.attempts || 0) + 1;\nif (attempts >= MAX_ATTEMPTS) {\nawait setLock(ip, {\nattempts: 0,\nlockedUntil: Date.now() + LOCK_MINUTES * 60000,\n});\nreturn jsonResponse({\nok: false,\nlocked: true,\nminutesLeft: LOCK_MINUTES,\n});\n}\nawait setLock(ip, { attempts: attempts, lockedUntil: 0 });\nreturn jsonResponse({ ok: false, locked: false });\n}\nif (req.method === \"POST\" && url.pathname === \"/save\") {\nconst ip = getIp(req);\nconst lock = await getLock(ip);\nif (lock.lockedUntil > Date.now()) {\nconst minutesLeft = Math.ceil((lock.lockedUntil - Date.now()) / 60000);\nreturn jsonResponse({\nok: false,\nmessage: \"Too many attempts. Try again in \" + minutesLeft + \" min.\",\n});\n}\nlet body;\ntry {\nbody = await req.json();\n} catch (e) {\nreturn jsonResponse({ ok: false, message: \"Bad request.\" });\n}\nconst state = await getState();\nconst currentPin = state.settings.pin || DEFAULT_PIN;\nif (!body || body.pin !== currentPin) {\nreturn jsonResponse({\nok: false,\nmessage: \"PIN check failed — please unlock again.\",\n});\n}\nif (!body.settings || !body.categories) {\nreturn jsonResponse({ ok: false, message: \"Missing data.\" });\n}\nconst newState = {\nsettings: Object.assign({}, state.settings, body.settings),\ncategories: body.categories,\n};\nif (body.newPin && /^[0-9]{4}$/.test(body.newPin)) {\nnewState.settings.pin = body.newPin;\n} else {\nnewState.settings.pin = currentPin;\n}\nawait saveState(newState);\nconst responseSettings = Object.assign({}, newState.settings, {\npin: undefined,\n});\ndelete responseSettings.pin;\nconst result = {\nok: true,\nsettings: responseSettings,\ncategories: newState.categories,\n};\nif (body.newPin && /^[0-9]{4}$/.test(body.newPin)) result.pin = body.newPin;\nreturn jsonResponse(result);\n}\nif (req.method === \"POST\" && url.pathname === \"/order\") {\nlet body;\ntry {\nbody = await req.json();\n} catch (e) {\nreturn jsonResponse({ ok: false, message: \"Bad request.\" });\n}\nconst state = await getState();\nconst isDemo = !!state.settings.demoMode;\nconst orderId = SLUG + \"-\" + Date.now().toString(36).toUpperCase();\nconst items = (body && body.items) || [];\nconst itemsText = items.map((i) => i.qty + \"× \" + i.name).join(\", \");\nconst orders = await getOrders();\nconst orderNumber = await nextOrderNumber(orders);\nconst order = {\nid: orderId,\norderNumber: orderNumber,\nname: (body && body.name) || \"Guest\",\nemail: (body && body.email) || \"\",\nitems: items,\nitemsText: itemsText,\nnotes: (body && body.notes) || \"\",\ntotal: (body && body.total) || 0,\npaid: false,\ndone: false,\nisDemo: isDemo,\ncreatedAt: new Date().toISOString(),\n};\norders.push(order);\nawait saveOrders(orders);\nconst editUrl = url.origin + url.pathname.replace(/\\/order$/, \"/\") + \"?edit=1\";\nlet emailed = false;\nif (order.email) {\nawait sendConfirmationEmail(order.email, state.settings.venue, url.origin + \"/\", isDemo, orderId);\nemailed = !!RESEND_API_KEY;\n}\nreturn jsonResponse({ ok: true, orderId: orderId, isDemo: isDemo, emailed: emailed });\n}\nif (req.method === \"POST\" && url.pathname === \"/clear-demo-orders\") {\nlet body;\ntry {\nbody = await req.json();\n} catch (e) {\nreturn jsonResponse({ ok: false, message: \"Bad request.\" });\n}\nconst state = await getState();\nconst currentPin = state.settings.pin || DEFAULT_PIN;\nif (!body || body.pin !== currentPin) {\nreturn jsonResponse({ ok: false, message: \"PIN check failed — please unlock again.\" });\n}\nconst orders = await getOrders();\nconst remaining = orders.filter((o) => !o.isDemo);\nconst cleared = orders.length - remaining.length;\nawait saveOrders(remaining);\nreturn jsonResponse({ ok: true, cleared: cleared });\n}\n// --- staff queue routes (bookmark /queue on the staff device) ---\nif (req.method === \"GET\" && url.pathname === \"/queue\") {\nconst state = await getState();\nreturn new Response(queuePage(state.settings), {\nheaders: { \"Content-Type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" },\n});\n}\nif (req.method === \"POST\" && url.pathname === \"/queue-order\") {\nlet body;\ntry {\nbody = await req.json();\n} catch (e) {\nreturn jsonResponse({ ok: false });\n}\nconst orders = await getOrders();\nconst items = body.items || [];\nconst state = await getState();\nconst flatMenu = [];\nstate.categories.forEach((c) => c.items.forEach((it) => flatMenu.push(it)));\nlet total = 0;\nconst itemsText = items.map((i) => {\nconst menuItem = flatMenu.find((m) => m.name === i.name);\nconst price = menuItem ? menuItem.price : 0;\ntotal += price * i.qty;\nreturn i.qty + \"× \" + i.name;\n}).join(\", \");\nconst orderNumber = await nextOrderNumber(orders);\nconst order = {\nid: SLUG + \"-\" + Date.now().toString(36).toUpperCase(),\norderNumber: orderNumber,\nname: body.name || \"\",\nemail: \"\",\nitems: items,\nitemsText: itemsText,\nnotes: body.notes || \"\",\ntotal: Math.round(total * 100) / 100,\npaid: false,\ndone: false,\nisDemo: false,\ncreatedAt: new Date().toISOString(),\n};\norders.push(order);\nawait saveOrders(orders);\nreturn jsonResponse({ ok: true, orderId: order.id });\n}\nif (req.method === \"GET\" && url.pathname === \"/queue-data\") {\nconst tab = url.searchParams.get(\"tab\") || \"active\";\nconst orders = await getOrders();\nconst state = await getState();\nconst menuNames = [];\nstate.categories.forEach((c) => c.items.forEach((it) => menuNames.push(it.name)));\nconst filtered = tab === \"active\"\n? orders.filter((o) => !o.done).sort((a, b) => a.orderNumber - b.orderNumber)\n: orders.filter((o) => o.done).sort((a, b) => b.orderNumber - a.orderNumber).slice(0, 100);\nreturn jsonResponse({ orders: filtered, menuNames: menuNames });\n}\nif (req.method === \"POST\" && url.pathname === \"/mark-paid\") {\nconst body = await req.json();\nconst orders = await getOrders();\nconst order = orders.find((o) => o.id === body.id);\nif (order) order.paid = true;\nawait saveOrders(orders);\nreturn jsonResponse({ ok: true });\n}\nif (req.method === \"POST\" && url.pathname === \"/mark-done\") {\nconst body = await req.json();\nconst orders = await getOrders();\nconst order = orders.find((o) => o.id === body.id);\nif (order) order.done = true;\nawait saveOrders(orders);\nreturn jsonResponse({ ok: true });\n}\nreturn new Response(\"Not found\", { status: 404 });\n}","label",[18],"pulls","branches","forks","envVars",{"_179":26,"_181":26},"connections",{"_179":26,"_180":26},"count","unfilledCount","emptyCount",{"_35":164,"_13":18,"_63":64,"_45":-5,"_37":38,"_165":88,"_166":106,"_39":183,"_41":80,"_65":85,"_168":169,"_67":24,"_170":-5,"_184":185,"_17":186},["D",1788919076617],"children",[],[18],["D",1788918663976],{"_11":12,"_142":70},{"_11":12,"_137":138,"_69":70,"_30":68,"_139":140,"_141":24},{"_41":88,"_13":16,"_35":38,"_129":94,"_130":-5,"_131":-5,"_132":-5,"_133":-5,"_134":-5,"_135":14,"_136":12},"ctx",{"_53":-5,"_161":224,"_225":226,"_227":228,"_229":24,"_230":24,"_231":24,"_232":106,"_233":-5,"_234":-7,"_235":-7,"_236":26,"_237":24,"_238":24,"_239":-5,"_240":24,"_241":24,"_242":24,"_243":-5},"ENV",{"_195":196,"_197":198,"_199":16,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Thanks for trying iTabs\" + (isDemo ? \" — here's what just happened\" : \"\") + \"

Order Placed

History · main.ts