The kitchen can actually make a sound

[sridharkalaibala]

Three faults, each of which alone was enough to keep a kitchen silent. All three were found on a customer machine with the current build installed, by reading files and a log rather than by listening, which is itself the point of the third change.

1. The CSP blocked every sound in the product

Every noise this product makes is a WAV synthesised in the main process and handed to the page as a data: URL: the new order alarm and the kitchen ting both. Nothing is shipped as a sound file, nothing is read off disk and nothing is fetched, which is the right design for a till that has to work with the internet unplugged.

helmet's default directives do not name media-src. Without one declared it falls back to default-src 'self', and 'self' does not include data:, so the browser refused all of them. From the customer machine's log, 240ms after a QR order arrived:

Loading media from 'data:audio/wav;base64,UklGRhYTAABXQVZF...' violates the
following Content Security Policy directive: "default-src 'self'". Note that
'media-src' was not explicitly set, so 'default-src' is used as a fallback.
The action has been blocked.

That is the new order alarm being silenced. The same mechanism carries the kitchen ting.

Fixed with one directive, media-src 'self' data:. data: only and media only: a data: URL cannot reach the network and cannot execute, so the worst a bad one does is make a noise.

2. There was no way to turn it on

The setting was real and the IPC was real. The only way to reach either was to open the developer console on the machine at the pass and type:

posnic.kitchenCall.set({ ting: true, speak: true })

Nobody was going to do that, so nobody did. A setting nobody can find is not a setting.

Two switches now sit on Core Settings beside the auto-focus ones, stored the same way: per machine, saved immediately, because somebody flipping this is standing next to the speaker waiting to hear the difference. They hide themselves outside the desktop app, where there is no bridge behind them, because a dead control is worse than an absent one.

3. There was no way to test it without a real order

Which is why both of the faults above went unnoticed for the feature's whole life, and why they were eventually found by reading a log.

A Test button on the same block goes down the road a real ticket takes: the same switches, the same tone, the same sentence, the same window. A test that took a shortcut would be the thing that passes while the kitchen stays silent. It says why when nothing happened, because "I pressed it and nothing happened" is where this feature has spent its life.

Not in this PR, but needed with it

The installed build carries a stale frontend bundle. frontend/static/script/js/core/kitchen-call.js is the half that plays the tone and speaks, and it is correctly listed under dashboard in pages_css_js_map.json on main, but the shipped dashboard.20f9c50d.js does not contain it: no kitchenCall, no speechSynthesis. Building the frontend from main produces a bundle that does (verified locally). So whatever staged that exe did not run prepare:frontend. The next installer has to be built through npm run build, which runs it and rejects stale artifacts.

Tests

tests/a-sound-the-browser-will-actually-play.test.js

• helmet still does not provide media-src itself, so the line stays load-bearing
• the CSP declares media-src and allows data:
• it does not grow a remote origin or a wildcard

tests/the-kitchen-switch-has-somewhere-to-live.test.js

• both switches exist on a page somebody can open, and are two switches rather than one
• they show what the machine is actually set to, rather than always rendering off
• the Test button reaches the main process, and the handler uses the real announcer and the real switches
• the block hides itself where there is no bridge

The CSP test was verified failing on the parent commit and passing on this one.

[github-actions]

Merged to develop. Anyone can test this - you do not need write access.

Try it at https://develop.posnic.io, or run it yourself:

git fetch origin develop && git checkout develop
npm install && npm --prefix api install
npm run dev   # then http://localhost:3000

When you have tested it, say what you did and what happened, and set
QA passed or QA failed. If you cannot set labels, just comment -
a maintainer will.

Reporting that something is broken is as useful as fixing it. It is
better found here than by a shopkeeper.