50 lines
2.6 KiB
Markdown
50 lines
2.6 KiB
Markdown
# Tillo Developer Console (API Dashboard)
|
|
|
|
Welcome to the **Tillo Developer Console**, a premium management dashboard and integration interface for creating, managing, and testing developer API Keys for external system widgets and program modules.
|
|
|
|
## 🏗️ Architecture & Security Model
|
|
|
|
To protect sensitive canteen financials and limit key usage footprint, this module operates under a robust security architecture:
|
|
|
|
1. **Usage Quota Limits**: Each system administrator or customer user is strictly limited to obtaining a maximum of **3 active API keys**.
|
|
2. **Access Control Scopes**: API Keys obtain a specialized **Read-Only** access scope. Write operations, wallet top-ups, session creations, or master configurations are rejected with a HTTP `401 Unauthorized` or `403 Forbidden` response.
|
|
3. **Financial Exclusion Guard**: All developer API key requests are barred from viewing financial statistics (e.g. daily store revenue, hourly billing graphs, transaction tables, master ledgers, and vendor settlement logs). General non-sensitive counters like active product pricing lists, public store stalls, and order statuses are open for querying.
|
|
4. **Wallet Safeguard**:
|
|
- **Customer API Keys** can query the active wallet balance of the owner user account.
|
|
- **System API Keys** can query general system token circulation statistics, but cannot access individual customer transaction lines or private ledger balances.
|
|
|
|
---
|
|
|
|
## 🚀 Getting Started
|
|
|
|
### 1. Run the Dev Server
|
|
Navigate to this directory and boot Vite:
|
|
```bash
|
|
npm run dev
|
|
```
|
|
|
|
### 2. Authentication
|
|
Log in with either:
|
|
- **System Admin / Staff Credentials**: email/password credentials.
|
|
- **Customer Mobile Credentials**: 10-digit mobile number and 4-digit PIN.
|
|
|
|
*Credentials matches your core Tillo application database.*
|
|
|
|
---
|
|
|
|
## 📡 API Reference Directory
|
|
|
|
Include the custom header `X-Developer-Key: DEV-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX` in all requests to query:
|
|
|
|
| Method | Path | Description | Access Level |
|
|
| :--- | :--- | :--- | :--- |
|
|
| `GET` | `/api/developer/v1/validate` | Verify API key health and view owner details. | Key validated |
|
|
| `GET` | `/api/developer/v1/stalls` | Fetch catalog listings of active canteen stalls. | Key validated |
|
|
| `GET` | `/api/developer/v1/products` | Retrieve catalog list of products and current stock. | Key validated |
|
|
| `GET` | `/api/developer/v1/wallet` | Fetch wallet balance (owner only) or total circulation volume. | Owner scope |
|
|
| `GET` | `/api/developer/v1/orders` | Retrieve list of active orders (owner only) or order statuses. | Owner scope |
|
|
|
|
---
|
|
|
|
*Developed by the Canteen Automation Team.*
|