From 0e6313f9d318044973240b51ce48d7aaea862860 Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Wed, 15 Apr 2026 18:01:19 +0100
Subject: [PATCH 01/11] init: first integration pass

---
 migrations.py               |  12 +++
 models.py                   |  38 ++++++++
 services.py                 |  83 ++++++++++++++++
 static/js/index.js          |  13 ++-
 static/js/tpos.js           | 165 +++++++++++++++++++++++++++++++-
 templates/tpos/dialogs.html | 119 +++++++++++++++++++++++
 templates/tpos/index.html   |  15 +++
 views_api.py                | 185 ++++++++++++++++++++++++++++++++++++
 8 files changed, 627 insertions(+), 3 deletions(-)

diff --git a/migrations.py b/migrations.py
index 0df71bb..06a9614 100644
--- a/migrations.py
+++ b/migrations.py
@@ -290,3 +290,15 @@ async def m022_add_onchain_settings_and_payments(db: Database):
             updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
         );
     """)
+
+
+async def m023_add_tabs_integration_settings(db: Database):
+    """
+    Add tabs integration settings.
+    """
+    await db.execute("""
+        ALTER TABLE tpos.pos ADD tabs_enabled BOOLEAN DEFAULT false;
+    """)
+    await db.execute("""
+        ALTER TABLE tpos.pos ADD tabs_allow_create BOOLEAN DEFAULT false;
+    """)
diff --git a/models.py b/models.py
index 2996e4a..96524f1 100644
--- a/models.py
+++ b/models.py
@@ -76,6 +76,8 @@ class CreateTposData(BaseModel):
     onchain_enabled: bool = Field(False)
     onchain_wallet_id: str | None = None
     onchain_zero_conf: bool = Field(True)
+    tabs_enabled: bool = Field(False)
+    tabs_allow_create: bool = Field(False)
 
     @validator("tax_default", pre=True, always=True)
     def default_tax_when_none(cls, v):
@@ -115,6 +117,8 @@ class TposClean(BaseModel):
     onchain_enabled: bool = False
     onchain_wallet_id: str | None = None
     onchain_zero_conf: bool = True
+    tabs_enabled: bool = False
+    tabs_allow_create: bool = False
 
     @property
     def withdraw_maximum(self) -> int:
@@ -168,6 +172,40 @@ class TposInvoiceResponse(BaseModel):
     extra: dict[str, Any] = Field(default_factory=dict)
 
 
+class TposTab(BaseModel):
+    id: str
+    wallet: str
+    name: str
+    customer_name: str | None = None
+    reference: str | None = None
+    currency: str = "sats"
+    status: str = "open"
+    balance: float = 0
+    is_archived: bool = False
+
+
+class TposTabList(BaseModel):
+    data: list[TposTab] = Field(default_factory=list)
+
+
+class CreateTposTabData(BaseModel):
+    name: str
+    customer_name: str | None = None
+    reference: str | None = None
+    currency: str | None = None
+    limit_type: str = "none"
+    limit_amount: float | None = None
+
+
+class CreateTposTabCharge(BaseModel):
+    amount: float
+    description: str | None = None
+    items: list[dict[str, Any]] = Field(default_factory=list)
+    notes: dict[str, Any] | None = None
+    internal_memo: str | None = Field(None, max_length=512)
+    idempotency_key: str | None = None
+
+
 class LnurlCharge(BaseModel):
     id: str
     tpos_id: str
diff --git a/services.py b/services.py
index 9400c96..5a24b35 100644
--- a/services.py
+++ b/services.py
@@ -212,6 +212,89 @@ def sum_transactions(address: str, txs: list[dict[str, Any]]) -> int:
     return sum(sum_outputs(address, tx.get("vout", [])) for tx in txs)
 
 
+def _create_internal_user_access_token(user_id: str) -> str:
+    return create_access_token({"sub": "", "usr": user_id}, token_expire_minutes=1)
+
+
+async def tabs_available_for_user(user_id: str) -> bool:
+    installed = await get_installed_extension("tabs")
+    if not installed or not installed.active:
+        return False
+    active_extensions = await get_user_active_extensions_ids(user_id)
+    return "tabs" in active_extensions
+
+
+async def fetch_tabs_for_tpos(
+    user_id: str,
+    wallet_id: str,
+    status: str | None = "open",
+    query: str | None = None,
+) -> list[dict[str, Any]]:
+    access = _create_internal_user_access_token(user_id)
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(
+            url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs",
+            headers={"Authorization": f"Bearer {access}"},
+        )
+    resp.raise_for_status()
+    tabs = resp.json()
+    if not isinstance(tabs, list):
+        return []
+    filtered_tabs = [tab for tab in tabs if tab.get("wallet") == wallet_id]
+    if status:
+        filtered_tabs = [tab for tab in filtered_tabs if tab.get("status") == status]
+    if query:
+        needle = query.lower()
+        filtered_tabs = [
+            tab
+            for tab in filtered_tabs
+            if needle in (tab.get("name") or "").lower()
+            or needle in (tab.get("customer_name") or "").lower()
+            or needle in (tab.get("reference") or "").lower()
+            or needle in (tab.get("id") or "").lower()
+        ]
+    return filtered_tabs
+
+
+async def create_tab_for_tpos(user_id: str, payload: dict[str, Any]) -> dict[str, Any]:
+    access = _create_internal_user_access_token(user_id)
+    async with httpx.AsyncClient() as client:
+        resp = await client.post(
+            url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs",
+            headers={"Authorization": f"Bearer {access}"},
+            json=payload,
+        )
+    resp.raise_for_status()
+    return resp.json()
+
+
+async def create_tab_charge_for_tpos(
+    user_id: str,
+    tab_id: str,
+    payload: dict[str, Any],
+) -> dict[str, Any]:
+    access = _create_internal_user_access_token(user_id)
+    async with httpx.AsyncClient() as client:
+        resp = await client.post(
+            url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs/{tab_id}/entries",
+            headers={"Authorization": f"Bearer {access}"},
+            json=payload,
+        )
+    resp.raise_for_status()
+    return resp.json()
+
+
+async def fetch_single_tab_for_tpos(user_id: str, tab_id: str) -> dict[str, Any]:
+    access = _create_internal_user_access_token(user_id)
+    async with httpx.AsyncClient() as client:
+        resp = await client.get(
+            url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs/{tab_id}",
+            headers={"Authorization": f"Bearer {access}"},
+        )
+    resp.raise_for_status()
+    return resp.json()
+
+
 async def push_order_to_orders(
     user_id: str,
     payment,
diff --git a/static/js/index.js b/static/js/index.js
index 09f7a80..a88660d 100644
--- a/static/js/index.js
+++ b/static/js/index.js
@@ -50,6 +50,8 @@ const mapTpos = obj => {
   obj.onchain_enabled = Boolean(obj.onchain_enabled)
   obj.onchain_wallet_id = obj.onchain_wallet_id || null
   obj.onchain_zero_conf = obj.onchain_zero_conf ?? true
+  obj.tabs_enabled = Boolean(obj.tabs_enabled)
+  obj.tabs_allow_create = Boolean(obj.tabs_allow_create)
   obj.useWrapper = false
   obj.posLocation = ''
   obj.auth = ''
@@ -154,7 +156,9 @@ window.app = Vue.createApp({
           allow_cash_settlement: false,
           onchain_enabled: false,
           onchain_wallet_id: null,
-          onchain_zero_conf: true
+          onchain_zero_conf: true,
+          tabs_enabled: false,
+          tabs_allow_create: false
         },
         advanced: {
           tips: false,
@@ -309,7 +313,9 @@ window.app = Vue.createApp({
         allow_cash_settlement: false,
         onchain_enabled: false,
         onchain_wallet_id: null,
-        onchain_zero_conf: true
+        onchain_zero_conf: true,
+        tabs_enabled: false,
+        tabs_allow_create: false
       }
       this.formDialog.advanced = {tips: false, otc: false}
     },
@@ -402,6 +408,9 @@ window.app = Vue.createApp({
         data.onchain_wallet_id = null
         data.onchain_zero_conf = true
       }
+      if (!data.tabs_enabled) {
+        data.tabs_allow_create = false
+      }
       const wallet = _.findWhere(this.g.user.wallets, {
         id: this.formDialog.data.wallet
       })
diff --git a/static/js/tpos.js b/static/js/tpos.js
index 0eb7696..83f58d8 100644
--- a/static/js/tpos.js
+++ b/static/js/tpos.js
@@ -45,6 +45,8 @@ window.app = Vue.createApp({
       fiatProvider: null,
       allowCashSettlement: false,
       onchainEnabled: false,
+      tabsEnabled: false,
+      tabsAllowCreate: false,
       payInFiat: false,
       fiatMethod: 'checkout',
       atmPremium: tpos.withdraw_premium / 100,
@@ -87,6 +89,21 @@ window.app = Vue.createApp({
         paymentChecker: null,
         internalMemo: null
       },
+      tabsDialog: {
+        show: false,
+        loading: false,
+        creating: false,
+        posting: false,
+        tabs: [],
+        selectedTabId: null,
+        query: '',
+        createMode: false,
+        newTab: {
+          name: '',
+          customer_name: '',
+          reference: ''
+        }
+      },
       cashValidating: false,
       tipDialog: {
         show: false
@@ -991,11 +1008,150 @@ window.app = Vue.createApp({
           case 'btc_onchain':
             this.fiatMethod = 'checkout'
             break
+          case 'tab':
+            this.fiatMethod = 'checkout'
+            break
         }
         this._currencyResolver(method)
         this._currencyResolver = null
       }
     },
+    buildTabChargeParams() {
+      const paymentAmount =
+        this.paymentAmount !== null ? this.paymentAmount : this.amount
+      const notes = {}
+      const items = this.cart.size
+        ? [...this.cart.values()].map(item => {
+            if (item.note) {
+              notes[item.title] = item.note
+            }
+            return {
+              id: item.id,
+              price: item.price,
+              formattedPrice: item.formattedPrice,
+              quantity: item.quantity,
+              title: item.title,
+              tax: item.tax || this.taxDefault,
+              note: item.note || null
+            }
+          })
+        : []
+      const normalizedAmount =
+        this.currency === 'sats'
+          ? Math.ceil(paymentAmount)
+          : roundTposCurrencyAmount(paymentAmount, this.currency)
+      const randomSuffix =
+        typeof crypto !== 'undefined' && crypto.randomUUID
+          ? crypto.randomUUID()
+          : Date.now().toString()
+
+      return {
+        amount: normalizedAmount,
+        description: this.invoiceDialog.internalMemo || 'TPoS order charge',
+        items,
+        notes: Object.keys(notes).length ? notes : null,
+        internal_memo: this.invoiceDialog.internalMemo || null,
+        idempotency_key: `tpos:${this.tposId}:${randomSuffix}`
+      }
+    },
+    closeTabsDialog() {
+      this.tabsDialog.show = false
+      this.tabsDialog.createMode = false
+      this.tabsDialog.query = ''
+      this.tabsDialog.newTab = {
+        name: '',
+        customer_name: '',
+        reference: ''
+      }
+    },
+    async loadTabsForCharge() {
+      this.tabsDialog.loading = true
+      try {
+        const query = this.tabsDialog.query
+          ? `&q=${encodeURIComponent(this.tabsDialog.query)}`
+          : ''
+        const {data} = await LNbits.api.request(
+          'GET',
+          `/tpos/api/v1/tposs/${this.tposId}/tabs?status=open${query}`
+        )
+        this.tabsDialog.tabs = data.data || []
+        if (!this.tabsDialog.tabs.length) {
+          this.tabsDialog.selectedTabId = null
+          this.tabsDialog.createMode = this.tabsAllowCreate
+          return
+        }
+        if (
+          !this.tabsDialog.selectedTabId ||
+          !this.tabsDialog.tabs.find(
+            tab => tab.id === this.tabsDialog.selectedTabId
+          )
+        ) {
+          this.tabsDialog.selectedTabId = this.tabsDialog.tabs[0].id
+        }
+      } catch (error) {
+        LNbits.utils.notifyApiError(error)
+      } finally {
+        this.tabsDialog.loading = false
+      }
+    },
+    async createTabFromDialog() {
+      if (!this.tabsDialog.newTab.name || this.tabsDialog.creating) return
+      this.tabsDialog.creating = true
+      try {
+        const payload = {
+          name: this.tabsDialog.newTab.name,
+          customer_name: this.tabsDialog.newTab.customer_name || null,
+          reference: this.tabsDialog.newTab.reference || null,
+          currency: this.currency
+        }
+        const {data} = await LNbits.api.request(
+          'POST',
+          `/tpos/api/v1/tposs/${this.tposId}/tabs`,
+          null,
+          payload
+        )
+        this.tabsDialog.createMode = false
+        this.tabsDialog.newTab = {
+          name: '',
+          customer_name: '',
+          reference: ''
+        }
+        await this.loadTabsForCharge()
+        this.tabsDialog.selectedTabId = data.id
+      } catch (error) {
+        LNbits.utils.notifyApiError(error)
+      } finally {
+        this.tabsDialog.creating = false
+      }
+    },
+    async submitTabCharge() {
+      if (!this.tabsDialog.selectedTabId || this.tabsDialog.posting) return
+      this.tabsDialog.posting = true
+      try {
+        const payload = this.buildTabChargeParams()
+        const {data} = await LNbits.api.request(
+          'POST',
+          `/tpos/api/v1/tposs/${this.tposId}/tabs/${this.tabsDialog.selectedTabId}/charges`,
+          null,
+          payload
+        )
+        this.closeTabsDialog()
+        this.clearCart()
+        this.showComplete()
+        Quasar.Notify.create({
+          type: 'positive',
+          message: `Added to tab: ${data.tab?.name || data.tab_id}`
+        })
+      } catch (error) {
+        LNbits.utils.notifyApiError(error)
+      } finally {
+        this.tabsDialog.posting = false
+      }
+    },
+    async openTabChargeDialog() {
+      await this.loadTabsForCharge()
+      this.tabsDialog.show = true
+    },
     buildInvoiceParams() {
       const paymentAmount =
         this.paymentAmount !== null ? this.paymentAmount : this.amount
@@ -1066,9 +1222,14 @@ window.app = Vue.createApp({
       if (
         this.fiatProvider ||
         this.allowCashSettlement ||
-        this.onchainEnabled
+        this.onchainEnabled ||
+        this.tabsEnabled
       ) {
         const method = await this.showPaymentMethod()
+        if (method === 'tab') {
+          await this.openTabChargeDialog()
+          return
+        }
         this.payInFiat = method === 'fiat'
         this.invoiceDialog.data.payment_method = method
       } else {
@@ -1656,6 +1817,8 @@ window.app = Vue.createApp({
     this.fiatProvider = tpos.fiat_provider
     this.allowCashSettlement = Boolean(tpos.allow_cash_settlement)
     this.onchainEnabled = Boolean(tpos.onchain_enabled)
+    this.tabsEnabled = Boolean(tpos.tabs_enabled)
+    this.tabsAllowCreate = Boolean(tpos.tabs_allow_create)
 
     this.tip_options = tpos.tip_options == 'null' ? null : tpos.tip_options
 
diff --git a/templates/tpos/dialogs.html b/templates/tpos/dialogs.html
index fc52599..50bae60 100644
--- a/templates/tpos/dialogs.html
+++ b/templates/tpos/dialogs.html
@@ -461,7 +461,126 @@ <h5 class="q-mt-none q-mb-sm">
             </div>
           </q-btn>
         </div>
+        <div class="col-6" v-if="tabsEnabled">
+          <q-btn
+            class="full-width q-px-lg q-py-sm"
+            size="xl"
+            color="accent"
+            rounded
+            aria-label="Add to tab"
+            @click="selectPaymentMethod('tab')"
+          >
+            <div class="row items-center no-wrap q-gutter-x-xs">
+              <q-icon name="assignment" size="30px"></q-icon>
+              <span class="text-subtitle1 text-weight-bold">Tab</span>
+            </div>
+          </q-btn>
+        </div>
       </div>
     </q-card>
   </q-dialog>
+
+  <q-dialog v-model="tabsDialog.show" position="top" @hide="closeTabsDialog">
+    <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
+      <q-card-section class="row items-center q-pb-sm">
+        <div class="text-h6">Add to Tab</div>
+        <q-space></q-space>
+        <q-btn icon="close" size="sm" flat round dense v-close-popup></q-btn>
+      </q-card-section>
+
+      <q-card-section>
+        <q-input
+          filled
+          dense
+          v-model.trim="tabsDialog.query"
+          label="Search tabs"
+          @keyup.enter="loadTabsForCharge"
+        >
+          <template v-slot:append>
+            <q-btn dense flat icon="search" @click="loadTabsForCharge"></q-btn>
+          </template>
+        </q-input>
+      </q-card-section>
+
+      <q-card-section v-if="tabsDialog.loading" class="text-center">
+        <q-spinner-gears size="36px"></q-spinner-gears>
+      </q-card-section>
+
+      <q-card-section v-else>
+        <q-select
+          v-if="tabsDialog.tabs.length"
+          filled
+          dense
+          emit-value
+          map-options
+          option-value="id"
+          option-label="name"
+          v-model="tabsDialog.selectedTabId"
+          :options="tabsDialog.tabs"
+          label="Select tab"
+        >
+          <template v-slot:option="scope">
+            <q-item v-bind="scope.itemProps">
+              <q-item-section>
+                <q-item-label>
+                  ${ scope.opt.name } (${ scope.opt.balance } ${ scope.opt.currency })
+                </q-item-label>
+                <q-item-label caption>
+                  ${ scope.opt.customer_name || scope.opt.reference || scope.opt.id }
+                </q-item-label>
+              </q-item-section>
+            </q-item>
+          </template>
+        </q-select>
+
+        <div class="q-mt-md" v-if="tabsAllowCreate">
+          <q-btn
+            flat
+            color="primary"
+            :label="tabsDialog.createMode ? 'Hide create form' : 'Create new tab'"
+            @click="tabsDialog.createMode = !tabsDialog.createMode"
+          ></q-btn>
+        </div>
+
+        <div v-if="tabsDialog.createMode" class="q-gutter-sm q-mt-sm">
+          <q-input
+            filled
+            dense
+            v-model.trim="tabsDialog.newTab.name"
+            label="Tab name"
+          ></q-input>
+          <q-input
+            filled
+            dense
+            v-model.trim="tabsDialog.newTab.customer_name"
+            label="Customer name"
+          ></q-input>
+          <q-input
+            filled
+            dense
+            v-model.trim="tabsDialog.newTab.reference"
+            label="Reference"
+          ></q-input>
+          <q-btn
+            color="primary"
+            :loading="tabsDialog.creating"
+            :disable="!tabsDialog.newTab.name"
+            @click="createTabFromDialog"
+            label="Create Tab"
+          ></q-btn>
+        </div>
+      </q-card-section>
+
+      <q-card-actions align="right">
+        <q-btn flat color="grey" v-close-popup label="Cancel"></q-btn>
+        <q-btn
+          color="primary"
+          label="Add charge"
+          :disable="!tabsDialog.selectedTabId"
+          :loading="tabsDialog.posting"
+          @click="submitTabCharge"
+        ></q-btn>
+      </q-card-actions>
+    </q-card>
+  </q-dialog>
 </template>
diff --git a/templates/tpos/index.html b/templates/tpos/index.html
index faec8c1..201658a 100644
--- a/templates/tpos/index.html
+++ b/templates/tpos/index.html
@@ -569,6 +569,21 @@ <h6 class="text-subtitle1 q-my-none">{{SITE_TITLE}} TPoS extension</h6>
             ></q-checkbox>
           </div>
         </div>
+        <div class="row">
+          <div class="col">
+            <q-checkbox
+              v-model="formDialog.data.tabs_enabled"
+              label="Enable Tabs integration"
+            ></q-checkbox>
+          </div>
+          <div class="col">
+            <q-checkbox
+              v-model="formDialog.data.tabs_allow_create"
+              :disable="!formDialog.data.tabs_enabled"
+              label="Allow creating tabs from TPoS"
+            ></q-checkbox>
+          </div>
+        </div>
         <template v-if="formDialog.data.enable_receipt_print">
           <p class="text-caption">
             Receipt printing is an experimental feature. Not all devices work
diff --git a/views_api.py b/views_api.py
index 7105934..03eea6d 100644
--- a/views_api.py
+++ b/views_api.py
@@ -56,6 +56,8 @@
 from .models import (
     CreateTposData,
     CreateTposInvoice,
+    CreateTposTabCharge,
+    CreateTposTabData,
     CreateUpdateItemData,
     InventorySale,
     PayLnurlWData,
@@ -69,15 +71,22 @@
     Tpos,
     TposInvoiceResponse,
     TposPayment,
+    TposTab,
+    TposTabList,
 )
 from .services import (
+    create_tab_charge_for_tpos,
+    create_tab_for_tpos,
     fetch_onchain_address,
+    fetch_single_tab_for_tpos,
+    fetch_tabs_for_tpos,
     fetch_watchonly_config,
     fetch_watchonly_wallet,
     fetch_watchonly_wallets,
     get_default_inventory,
     get_inventory_items_for_tpos,
     inventory_available_for_user,
+    tabs_available_for_user,
     watchonly_available_for_user,
 )
 
@@ -257,6 +266,47 @@ def _serialize_tpos_invoice_response(
     )
 
 
+def _extract_error_detail(exc: httpx.HTTPStatusError) -> str:
+    response = exc.response
+    if not response:
+        return str(exc)
+    try:
+        payload = response.json()
+    except Exception:
+        payload = None
+    if isinstance(payload, dict):
+        detail = payload.get("detail")
+        if detail:
+            return str(detail)
+    body_text = response.text.strip() if response.text else ""
+    return body_text or str(exc)
+
+
+async def _get_tpos_owner_user_id(tpos: Tpos) -> str:
+    wallet = await get_wallet(tpos.wallet)
+    if not wallet:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Wallet not found for this TPoS.",
+        )
+    return wallet.user
+
+
+async def _validate_tpos_tabs_enabled(tpos: Tpos) -> str:
+    if not tpos.tabs_enabled:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Tabs integration is not enabled for this TPoS.",
+        )
+    user_id = await _get_tpos_owner_user_id(tpos)
+    if not await tabs_available_for_user(user_id):
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Tabs extension must be enabled for this user.",
+        )
+    return user_id
+
+
 @tpos_api_router.get("/api/v1/tposs", status_code=HTTPStatus.OK)
 async def api_tposs(
     all_wallets: bool = Query(False),
@@ -294,6 +344,136 @@ async def api_onchain_status(
     return await _get_watchonly_status(key_info.wallet)
 
 
+@tpos_api_router.get("/api/v1/tposs/{tpos_id}/tabs", response_model=TposTabList)
+async def api_tpos_tabs(
+    tpos_id: str,
+    status: str = Query("open"),
+    q: str | None = Query(None),
+) -> TposTabList:
+    tpos = await get_tpos(tpos_id)
+    if not tpos:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
+        )
+
+    user_id = await _validate_tpos_tabs_enabled(tpos)
+    try:
+        tabs = await fetch_tabs_for_tpos(
+            user_id=user_id,
+            wallet_id=tpos.wallet,
+            status=status,
+            query=q,
+        )
+    except httpx.HTTPStatusError as exc:
+        raise HTTPException(
+            status_code=exc.response.status_code
+            if exc.response
+            else HTTPStatus.BAD_GATEWAY,
+            detail=_extract_error_detail(exc),
+        ) from exc
+    return TposTabList(data=[TposTab(**tab) for tab in tabs])
+
+
+@tpos_api_router.post("/api/v1/tposs/{tpos_id}/tabs", response_model=TposTab)
+async def api_tpos_create_tab(
+    tpos_id: str,
+    data: CreateTposTabData,
+) -> TposTab:
+    tpos = await get_tpos(tpos_id)
+    if not tpos:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
+        )
+    user_id = await _validate_tpos_tabs_enabled(tpos)
+    if not tpos.tabs_allow_create:
+        raise HTTPException(
+            status_code=HTTPStatus.FORBIDDEN,
+            detail="Tab creation is not enabled for this TPoS.",
+        )
+    tab_currency = (data.currency or tpos.currency or "sats").lower()
+    if tab_currency != (tpos.currency or "sats").lower():
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Tab currency must match TPoS currency.",
+        )
+
+    payload = {
+        "wallet": tpos.wallet,
+        "name": data.name,
+        "customer_name": data.customer_name,
+        "reference": data.reference,
+        "currency": tab_currency,
+        "limit_type": data.limit_type,
+        "limit_amount": data.limit_amount,
+    }
+    try:
+        tab = await create_tab_for_tpos(user_id=user_id, payload=payload)
+    except httpx.HTTPStatusError as exc:
+        raise HTTPException(
+            status_code=exc.response.status_code
+            if exc.response
+            else HTTPStatus.BAD_GATEWAY,
+            detail=_extract_error_detail(exc),
+        ) from exc
+    return TposTab(**tab)
+
+
+@tpos_api_router.post("/api/v1/tposs/{tpos_id}/tabs/{tab_id}/charges")
+async def api_tpos_add_tab_charge(
+    tpos_id: str,
+    tab_id: str,
+    data: CreateTposTabCharge,
+) -> dict[str, Any]:
+    tpos = await get_tpos(tpos_id)
+    if not tpos:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
+        )
+    user_id = await _validate_tpos_tabs_enabled(tpos)
+    if data.amount <= 0:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Amount must be greater than zero.",
+        )
+
+    metadata = {
+        "source": "tpos",
+        "tpos_id": tpos.id,
+        "tpos_name": tpos.name,
+        "currency": tpos.currency,
+        "amount": data.amount,
+        "items": data.items,
+        "notes": data.notes,
+        "internal_memo": data.internal_memo,
+        "created_at": datetime.now(timezone.utc).isoformat(),
+    }
+    payload = {
+        "entry_type": "charge",
+        "amount": data.amount,
+        "description": data.description or "TPoS order charge",
+        "metadata": json.dumps(metadata),
+        "source": "tpos",
+        "source_id": tpos.id,
+        "source_action": "order_charge",
+        "idempotency_key": data.idempotency_key or f"tpos:{tpos.id}:{uuid4().hex}",
+    }
+    try:
+        entry = await create_tab_charge_for_tpos(
+            user_id=user_id,
+            tab_id=tab_id,
+            payload=payload,
+        )
+        tab = await fetch_single_tab_for_tpos(user_id=user_id, tab_id=tab_id)
+    except httpx.HTTPStatusError as exc:
+        raise HTTPException(
+            status_code=exc.response.status_code
+            if exc.response
+            else HTTPStatus.BAD_GATEWAY,
+            detail=_extract_error_detail(exc),
+        ) from exc
+    return {"tab_id": tab_id, "entry": entry, "tab": tab}
+
+
 @tpos_api_router.post("/api/v1/tposs", status_code=HTTPStatus.CREATED)
 async def api_tpos_create(
     data: CreateTposData, wallet: WalletTypeInfo = Depends(require_admin_key)
@@ -304,6 +484,8 @@ async def api_tpos_create(
         onchain_enabled=data.onchain_enabled,
         onchain_wallet_id=data.onchain_wallet_id,
     )
+    if not data.tabs_enabled:
+        data.tabs_allow_create = False
     user = await get_user(wallet.wallet.user)
     if not (user and user.super_user):
         data.allow_cash_settlement = False
@@ -349,6 +531,9 @@ async def api_tpos_update(
         onchain_enabled=desired_onchain_enabled,
         onchain_wallet_id=desired_onchain_wallet_id,
     )
+    desired_tabs_enabled = update_payload.get("tabs_enabled", tpos.tabs_enabled)
+    if not desired_tabs_enabled:
+        update_payload["tabs_allow_create"] = False
     desired_currency = update_payload.get("currency", tpos.currency)
     if desired_currency == "sats":
         update_payload["allow_cash_settlement"] = False

From 5242e6071d14814c7fa99852ec2f7bcfe445e12c Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Thu, 16 Apr 2026 17:05:20 +0100
Subject: [PATCH 02/11] hardening and securing tab handling

---
 models.py                        |  18 ++-
 services.py                      | 187 ++++++++++++++++++++++++-------
 static/js/tpos.js                |  59 +++++++++-
 templates/tpos/_options_fab.html |   9 ++
 templates/tpos/dialogs.html      |  62 ++++++----
 views_api.py                     | 149 +++++++++++-------------
 6 files changed, 330 insertions(+), 154 deletions(-)

diff --git a/models.py b/models.py
index 96524f1..bb904d7 100644
--- a/models.py
+++ b/models.py
@@ -174,7 +174,6 @@ class TposInvoiceResponse(BaseModel):
 
 class TposTab(BaseModel):
     id: str
-    wallet: str
     name: str
     customer_name: str | None = None
     reference: str | None = None
@@ -189,7 +188,7 @@ class TposTabList(BaseModel):
 
 
 class CreateTposTabData(BaseModel):
-    name: str
+    name: str = Field(..., min_length=1, max_length=120)
     customer_name: str | None = None
     reference: str | None = None
     currency: str | None = None
@@ -198,12 +197,19 @@ class CreateTposTabData(BaseModel):
 
 
 class CreateTposTabCharge(BaseModel):
-    amount: float
-    description: str | None = None
-    items: list[dict[str, Any]] = Field(default_factory=list)
+    amount: float = Field(..., gt=0)
+    description: str | None = Field(None, max_length=512)
+    items: list[dict[str, Any]] = Field(default_factory=list, max_items=200)
     notes: dict[str, Any] | None = None
     internal_memo: str | None = Field(None, max_length=512)
-    idempotency_key: str | None = None
+    idempotency_key: str = Field(..., min_length=8, max_length=128)
+
+
+class CreateTposTabSettlement(BaseModel):
+    amount: float | None = Field(None, gt=0)
+    reference: str | None = Field(None, max_length=120)
+    description: str | None = Field(None, max_length=512)
+    idempotency_key: str = Field(..., min_length=8, max_length=128)
 
 
 class LnurlCharge(BaseModel):
diff --git a/services.py b/services.py
index 5a24b35..f6ab0ec 100644
--- a/services.py
+++ b/services.py
@@ -1,6 +1,8 @@
+from http import HTTPStatus
 from typing import Any
 
 import httpx
+from fastapi import HTTPException
 from lnbits.core.crud import (
     get_installed_extension,
     get_user_active_extensions_ids,
@@ -12,6 +14,19 @@
 from loguru import logger
 
 from .helpers import from_csv, inventory_tags_to_list
+from .models import Tpos
+
+_TAB_STATUSES = {"open", "suspended", "closed"}
+
+
+async def get_tpos_owner_user_id(tpos: Tpos) -> str:
+    wallet = await get_wallet(tpos.wallet)
+    if not wallet:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="TPoS is not ready for tabs integration.",
+        )
+    return wallet.user
 
 
 async def deduct_inventory_stock(wallet_id: str, inventory_payload: dict) -> None:
@@ -49,7 +64,7 @@ async def deduct_inventory_stock(wallet_id: str, inventory_payload: dict) -> Non
 
 
 async def get_default_inventory(user_id: str) -> dict[str, Any] | None:
-    access = create_access_token({"sub": "", "usr": user_id}, token_expire_minutes=1)
+    access = _create_internal_user_access_token(user_id)
     async with httpx.AsyncClient() as client:
         resp = await client.get(
             url=f"http://{settings.host}:{settings.port}/inventory/api/v1",
@@ -76,7 +91,7 @@ async def get_inventory_items_for_tpos(
     tag_list = inventory_tags_to_list(tags)
     omit_list = [tag.lower() for tag in inventory_tags_to_list(omit_tags)]
     allowed_tags = [tag.lower() for tag in tag_list]
-    access = create_access_token({"sub": "", "usr": user_id}, token_expire_minutes=1)
+    access = _create_internal_user_access_token(user_id)
     async with httpx.AsyncClient() as client:
         resp = await client.get(
             url=f"http://{settings.host}:{settings.port}/inventory/api/v1/items/{inventory_id}/paginated",
@@ -212,10 +227,6 @@ def sum_transactions(address: str, txs: list[dict[str, Any]]) -> int:
     return sum(sum_outputs(address, tx.get("vout", [])) for tx in txs)
 
 
-def _create_internal_user_access_token(user_id: str) -> str:
-    return create_access_token({"sub": "", "usr": user_id}, token_expire_minutes=1)
-
-
 async def tabs_available_for_user(user_id: str) -> bool:
     installed = await get_installed_extension("tabs")
     if not installed or not installed.active:
@@ -224,47 +235,84 @@ async def tabs_available_for_user(user_id: str) -> bool:
     return "tabs" in active_extensions
 
 
+async def ensure_tpos_tabs_access(tpos: Tpos) -> str:
+    if not tpos.tabs_enabled:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Tabs integration is not enabled for this TPoS.",
+        )
+    user_id = await get_tpos_owner_user_id(tpos)
+    if not await tabs_available_for_user(user_id):
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Tabs integration is unavailable for this TPoS.",
+        )
+    return user_id
+
+
 async def fetch_tabs_for_tpos(
     user_id: str,
     wallet_id: str,
     status: str | None = "open",
     query: str | None = None,
 ) -> list[dict[str, Any]]:
-    access = _create_internal_user_access_token(user_id)
-    async with httpx.AsyncClient() as client:
-        resp = await client.get(
-            url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs",
-            headers={"Authorization": f"Bearer {access}"},
+    if status and status not in _TAB_STATUSES:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Invalid tab status filter.",
         )
-    resp.raise_for_status()
-    tabs = resp.json()
-    if not isinstance(tabs, list):
+    access = _create_internal_user_access_token(user_id)
+    try:
+        async with httpx.AsyncClient() as client:
+            resp = await client.get(
+                url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs",
+                headers={"Authorization": f"Bearer {access}"},
+            )
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        raise _raise_tabs_bridge_error(exc) from exc
+    except httpx.RequestError as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_GATEWAY,
+            detail="Tabs service is temporarily unavailable.",
+        ) from exc
+    payload = resp.json()
+    if not isinstance(payload, list):
         return []
-    filtered_tabs = [tab for tab in tabs if tab.get("wallet") == wallet_id]
+    tabs = [tab for tab in payload if tab.get("wallet") == wallet_id]
     if status:
-        filtered_tabs = [tab for tab in filtered_tabs if tab.get("status") == status]
+        tabs = [tab for tab in tabs if tab.get("status") == status]
     if query:
         needle = query.lower()
-        filtered_tabs = [
+        tabs = [
             tab
-            for tab in filtered_tabs
+            for tab in tabs
             if needle in (tab.get("name") or "").lower()
             or needle in (tab.get("customer_name") or "").lower()
             or needle in (tab.get("reference") or "").lower()
             or needle in (tab.get("id") or "").lower()
         ]
-    return filtered_tabs
+    tabs.sort(key=lambda tab: tab.get("updated_at") or "", reverse=True)
+    return tabs[:50]
 
 
 async def create_tab_for_tpos(user_id: str, payload: dict[str, Any]) -> dict[str, Any]:
     access = _create_internal_user_access_token(user_id)
-    async with httpx.AsyncClient() as client:
-        resp = await client.post(
-            url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs",
-            headers={"Authorization": f"Bearer {access}"},
-            json=payload,
-        )
-    resp.raise_for_status()
+    try:
+        async with httpx.AsyncClient() as client:
+            resp = await client.post(
+                url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs",
+                headers={"Authorization": f"Bearer {access}"},
+                json=payload,
+            )
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        raise _raise_tabs_bridge_error(exc) from exc
+    except httpx.RequestError as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_GATEWAY,
+            detail="Tabs service is temporarily unavailable.",
+        ) from exc
     return resp.json()
 
 
@@ -274,24 +322,64 @@ async def create_tab_charge_for_tpos(
     payload: dict[str, Any],
 ) -> dict[str, Any]:
     access = _create_internal_user_access_token(user_id)
-    async with httpx.AsyncClient() as client:
-        resp = await client.post(
-            url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs/{tab_id}/entries",
-            headers={"Authorization": f"Bearer {access}"},
-            json=payload,
-        )
-    resp.raise_for_status()
+    try:
+        async with httpx.AsyncClient() as client:
+            resp = await client.post(
+                url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs/{tab_id}/entries",
+                headers={"Authorization": f"Bearer {access}"},
+                json=payload,
+            )
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        raise _raise_tabs_bridge_error(exc) from exc
+    except httpx.RequestError as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_GATEWAY,
+            detail="Tabs service is temporarily unavailable.",
+        ) from exc
     return resp.json()
 
 
 async def fetch_single_tab_for_tpos(user_id: str, tab_id: str) -> dict[str, Any]:
     access = _create_internal_user_access_token(user_id)
-    async with httpx.AsyncClient() as client:
-        resp = await client.get(
-            url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs/{tab_id}",
-            headers={"Authorization": f"Bearer {access}"},
-        )
-    resp.raise_for_status()
+    try:
+        async with httpx.AsyncClient() as client:
+            resp = await client.get(
+                url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs/{tab_id}",
+                headers={"Authorization": f"Bearer {access}"},
+            )
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        raise _raise_tabs_bridge_error(exc) from exc
+    except httpx.RequestError as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_GATEWAY,
+            detail="Tabs service is temporarily unavailable.",
+        ) from exc
+    return resp.json()
+
+
+async def create_tab_settlement_for_tpos(
+    user_id: str,
+    tab_id: str,
+    payload: dict[str, Any],
+) -> dict[str, Any]:
+    access = _create_internal_user_access_token(user_id)
+    try:
+        async with httpx.AsyncClient() as client:
+            resp = await client.post(
+                url=f"http://{settings.host}:{settings.port}/tabs/api/v1/tabs/{tab_id}/settlements",
+                headers={"Authorization": f"Bearer {access}"},
+                json=payload,
+            )
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        raise _raise_tabs_bridge_error(exc) from exc
+    except httpx.RequestError as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_GATEWAY,
+            detail="Tabs service is temporarily unavailable.",
+        ) from exc
     return resp.json()
 
 
@@ -324,7 +412,7 @@ async def push_order_to_orders(
         "shipped": True,
     }
 
-    access = create_access_token({"sub": "", "usr": user_id}, token_expire_minutes=1)
+    access = _create_internal_user_access_token(user_id)
     params = {}
     if base_url:
         params["base_url"] = base_url
@@ -338,3 +426,22 @@ async def push_order_to_orders(
             )
         except Exception as exc:
             logger.warning(f"tpos: failed to push order to orders: {exc}")
+
+
+def _create_internal_user_access_token(user_id: str) -> str:
+    return create_access_token({"sub": "", "usr": user_id}, token_expire_minutes=1)
+
+
+def _raise_tabs_bridge_error(exc: httpx.HTTPStatusError) -> HTTPException:
+    status_code = exc.response.status_code if exc.response else HTTPStatus.BAD_GATEWAY
+    if status_code == HTTPStatus.NOT_FOUND:
+        detail = "Tab not found."
+    elif status_code in (HTTPStatus.UNAUTHORIZED, HTTPStatus.FORBIDDEN):
+        detail = "Tabs action not allowed for this TPoS."
+    elif status_code == HTTPStatus.BAD_REQUEST:
+        detail = "Invalid tabs request."
+    else:
+        detail = "Tabs service is temporarily unavailable."
+    if status_code >= HTTPStatus.INTERNAL_SERVER_ERROR:
+        status_code = HTTPStatus.BAD_GATEWAY
+    return HTTPException(status_code=status_code, detail=detail)
diff --git a/static/js/tpos.js b/static/js/tpos.js
index 83f58d8..14391fe 100644
--- a/static/js/tpos.js
+++ b/static/js/tpos.js
@@ -94,6 +94,8 @@ window.app = Vue.createApp({
         loading: false,
         creating: false,
         posting: false,
+        settling: false,
+        mode: 'charge',
         tabs: [],
         selectedTabId: null,
         query: '',
@@ -954,7 +956,7 @@ window.app = Vue.createApp({
       const paymentAmount =
         this.total > 0.0
           ? roundTposCurrencyAmount(this.total + this.amount, this.currency)
-          : this.amount
+          : roundTposCurrencyAmount(this.amount, this.currency)
 
       this.paymentAmount = paymentAmount
       this.sat = Math.ceil(paymentAmount * this.exchangeRate)
@@ -1054,9 +1056,24 @@ window.app = Vue.createApp({
         idempotency_key: `tpos:${this.tposId}:${randomSuffix}`
       }
     },
+    buildTabSettlementParams() {
+      const randomSuffix =
+        typeof crypto !== 'undefined' && crypto.randomUUID
+          ? crypto.randomUUID()
+          : Date.now().toString()
+      return {
+        amount: null,
+        description: this.invoiceDialog.internalMemo || 'TPoS settlement',
+        reference: `tpos-${this.tposId}`,
+        idempotency_key: `tpos:settlement:${this.tposId}:${randomSuffix}`
+      }
+    },
     closeTabsDialog() {
       this.tabsDialog.show = false
       this.tabsDialog.createMode = false
+      this.tabsDialog.posting = false
+      this.tabsDialog.settling = false
+      this.tabsDialog.mode = 'charge'
       this.tabsDialog.query = ''
       this.tabsDialog.newTab = {
         name: '',
@@ -1137,6 +1154,8 @@ window.app = Vue.createApp({
         )
         this.closeTabsDialog()
         this.clearCart()
+        this.stack = []
+        this.amount = 0.0
         this.showComplete()
         Quasar.Notify.create({
           type: 'positive',
@@ -1148,7 +1167,45 @@ window.app = Vue.createApp({
         this.tabsDialog.posting = false
       }
     },
+    async submitTabSettlement() {
+      if (!this.tabsDialog.selectedTabId || this.tabsDialog.settling) return
+      this.tabsDialog.settling = true
+      try {
+        const payload = this.buildTabSettlementParams()
+        const {data} = await LNbits.api.request(
+          'POST',
+          `/tpos/api/v1/tposs/${this.tposId}/tabs/${this.tabsDialog.selectedTabId}/settlements`,
+          null,
+          payload
+        )
+        const paymentRequest = data?.payment_request
+        const paymentHash = data?.settlement?.payment_hash
+        if (!paymentRequest || !paymentHash) {
+          Quasar.Notify.create({
+            type: 'warning',
+            message: 'Settlement created, but no invoice was returned.'
+          })
+          return
+        }
+        this.closeTabsDialog()
+        this.openInvoiceDialog(
+          paymentHash,
+          'lightning:' + String(paymentRequest).toUpperCase()
+        )
+        this.subscribeToPaymentWS(paymentHash)
+      } catch (error) {
+        LNbits.utils.notifyApiError(error)
+      } finally {
+        this.tabsDialog.settling = false
+      }
+    },
     async openTabChargeDialog() {
+      this.tabsDialog.mode = 'charge'
+      await this.loadTabsForCharge()
+      this.tabsDialog.show = true
+    },
+    async openTabSettlementDialog() {
+      this.tabsDialog.mode = 'settlement'
       await this.loadTabsForCharge()
       this.tabsDialog.show = true
     },
diff --git a/templates/tpos/_options_fab.html b/templates/tpos/_options_fab.html
index 0ec8459..b70c5e8 100644
--- a/templates/tpos/_options_fab.html
+++ b/templates/tpos/_options_fab.html
@@ -48,6 +48,15 @@
     label-position="left"
     :label="showPoS ? 'Cart View' : 'PoS View'"
   ></q-fab-action>
+  <q-fab-action
+    color="primary"
+    @click="openTabSettlementDialog"
+    v-if="tabsEnabled"
+    icon="assignment"
+    external-label
+    label-position="left"
+    label="Settle Tab"
+  ></q-fab-action>
   <q-fab-action
     color="primary"
     @click="clearLNaddress"
diff --git a/templates/tpos/dialogs.html b/templates/tpos/dialogs.html
index 50bae60..8bde656 100644
--- a/templates/tpos/dialogs.html
+++ b/templates/tpos/dialogs.html
@@ -483,7 +483,10 @@ <h5 class="q-mt-none q-mb-sm">
   <q-dialog v-model="tabsDialog.show" position="top" @hide="closeTabsDialog">
     <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
       <q-card-section class="row items-center q-pb-sm">
-        <div class="text-h6">Add to Tab</div>
+        <div
+          class="text-h6"
+          v-text="tabsDialog.mode === 'settlement' ? 'Settle Tab' : 'Add to Tab'"
+        ></div>
         <q-space></q-space>
         <q-btn icon="close" size="sm" flat round dense v-close-popup></q-btn>
       </q-card-section>
@@ -507,31 +510,35 @@ <h5 class="q-mt-none q-mb-sm">
       </q-card-section>
 
       <q-card-section v-else>
-        <q-select
-          v-if="tabsDialog.tabs.length"
-          filled
-          dense
-          emit-value
-          map-options
-          option-value="id"
-          option-label="name"
-          v-model="tabsDialog.selectedTabId"
-          :options="tabsDialog.tabs"
-          label="Select tab"
-        >
-          <template v-slot:option="scope">
-            <q-item v-bind="scope.itemProps">
+        <div v-if="tabsDialog.tabs.length">
+          <div class="text-caption text-grey-7 q-mb-sm">
+            Latest updated open tabs
+          </div>
+          <q-list bordered separator>
+            <q-item
+              v-for="tab in tabsDialog.tabs"
+              :key="tab.id"
+              clickable
+              :active="tabsDialog.selectedTabId === tab.id"
+              active-class="bg-primary text-white"
+              @click="tabsDialog.selectedTabId = tab.id"
+            >
               <q-item-section>
-                <q-item-label>
-                  ${ scope.opt.name } (${ scope.opt.balance } ${ scope.opt.currency })
-                </q-item-label>
-                <q-item-label caption>
-                  ${ scope.opt.customer_name || scope.opt.reference || scope.opt.id }
-                </q-item-label>
+                <q-item-label
+                  v-text="tab.name + ' (' + formatAmount(tab.balance, tab.currency) + ')'"
+                ></q-item-label>
+                <q-item-label
+                  caption
+                  :class="tabsDialog.selectedTabId === tab.id ? 'text-white' : ''"
+                  v-text="tab.customer_name || tab.reference || tab.id"
+                ></q-item-label>
               </q-item-section>
             </q-item>
-          </template>
-        </q-select>
+          </q-list>
+        </div>
+        <div v-else class="text-caption text-grey-7">
+          No open tabs found.
+        </div>
 
         <div class="q-mt-md" v-if="tabsAllowCreate">
           <q-btn
@@ -574,12 +581,21 @@ <h5 class="q-mt-none q-mb-sm">
       <q-card-actions align="right">
         <q-btn flat color="grey" v-close-popup label="Cancel"></q-btn>
         <q-btn
+          v-if="tabsDialog.mode !== 'settlement'"
           color="primary"
           label="Add charge"
           :disable="!tabsDialog.selectedTabId"
           :loading="tabsDialog.posting"
           @click="submitTabCharge"
         ></q-btn>
+        <q-btn
+          v-else
+          color="secondary"
+          label="Settle tab"
+          :disable="!tabsDialog.selectedTabId"
+          :loading="tabsDialog.settling"
+          @click="submitTabSettlement"
+        ></q-btn>
       </q-card-actions>
     </q-card>
   </q-dialog>
diff --git a/views_api.py b/views_api.py
index 03eea6d..14d128b 100644
--- a/views_api.py
+++ b/views_api.py
@@ -58,6 +58,7 @@
     CreateTposInvoice,
     CreateTposTabCharge,
     CreateTposTabData,
+    CreateTposTabSettlement,
     CreateUpdateItemData,
     InventorySale,
     PayLnurlWData,
@@ -77,6 +78,8 @@
 from .services import (
     create_tab_charge_for_tpos,
     create_tab_for_tpos,
+    create_tab_settlement_for_tpos,
+    ensure_tpos_tabs_access,
     fetch_onchain_address,
     fetch_single_tab_for_tpos,
     fetch_tabs_for_tpos,
@@ -86,7 +89,6 @@
     get_default_inventory,
     get_inventory_items_for_tpos,
     inventory_available_for_user,
-    tabs_available_for_user,
     watchonly_available_for_user,
 )
 
@@ -266,47 +268,6 @@ def _serialize_tpos_invoice_response(
     )
 
 
-def _extract_error_detail(exc: httpx.HTTPStatusError) -> str:
-    response = exc.response
-    if not response:
-        return str(exc)
-    try:
-        payload = response.json()
-    except Exception:
-        payload = None
-    if isinstance(payload, dict):
-        detail = payload.get("detail")
-        if detail:
-            return str(detail)
-    body_text = response.text.strip() if response.text else ""
-    return body_text or str(exc)
-
-
-async def _get_tpos_owner_user_id(tpos: Tpos) -> str:
-    wallet = await get_wallet(tpos.wallet)
-    if not wallet:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail="Wallet not found for this TPoS.",
-        )
-    return wallet.user
-
-
-async def _validate_tpos_tabs_enabled(tpos: Tpos) -> str:
-    if not tpos.tabs_enabled:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail="Tabs integration is not enabled for this TPoS.",
-        )
-    user_id = await _get_tpos_owner_user_id(tpos)
-    if not await tabs_available_for_user(user_id):
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail="Tabs extension must be enabled for this user.",
-        )
-    return user_id
-
-
 @tpos_api_router.get("/api/v1/tposs", status_code=HTTPStatus.OK)
 async def api_tposs(
     all_wallets: bool = Query(False),
@@ -356,21 +317,13 @@ async def api_tpos_tabs(
             status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
         )
 
-    user_id = await _validate_tpos_tabs_enabled(tpos)
-    try:
-        tabs = await fetch_tabs_for_tpos(
-            user_id=user_id,
-            wallet_id=tpos.wallet,
-            status=status,
-            query=q,
-        )
-    except httpx.HTTPStatusError as exc:
-        raise HTTPException(
-            status_code=exc.response.status_code
-            if exc.response
-            else HTTPStatus.BAD_GATEWAY,
-            detail=_extract_error_detail(exc),
-        ) from exc
+    user_id = await ensure_tpos_tabs_access(tpos)
+    tabs = await fetch_tabs_for_tpos(
+        user_id=user_id,
+        wallet_id=tpos.wallet,
+        status=status,
+        query=q,
+    )
     return TposTabList(data=[TposTab(**tab) for tab in tabs])
 
 
@@ -384,7 +337,7 @@ async def api_tpos_create_tab(
         raise HTTPException(
             status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
         )
-    user_id = await _validate_tpos_tabs_enabled(tpos)
+    user_id = await ensure_tpos_tabs_access(tpos)
     if not tpos.tabs_allow_create:
         raise HTTPException(
             status_code=HTTPStatus.FORBIDDEN,
@@ -406,15 +359,7 @@ async def api_tpos_create_tab(
         "limit_type": data.limit_type,
         "limit_amount": data.limit_amount,
     }
-    try:
-        tab = await create_tab_for_tpos(user_id=user_id, payload=payload)
-    except httpx.HTTPStatusError as exc:
-        raise HTTPException(
-            status_code=exc.response.status_code
-            if exc.response
-            else HTTPStatus.BAD_GATEWAY,
-            detail=_extract_error_detail(exc),
-        ) from exc
+    tab = await create_tab_for_tpos(user_id=user_id, payload=payload)
     return TposTab(**tab)
 
 
@@ -429,11 +374,13 @@ async def api_tpos_add_tab_charge(
         raise HTTPException(
             status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
         )
-    user_id = await _validate_tpos_tabs_enabled(tpos)
-    if data.amount <= 0:
+    user_id = await ensure_tpos_tabs_access(tpos)
+
+    tab = await fetch_single_tab_for_tpos(user_id=user_id, tab_id=tab_id)
+    if (tab.get("currency") or "sats").lower() != (tpos.currency or "sats").lower():
         raise HTTPException(
             status_code=HTTPStatus.BAD_REQUEST,
-            detail="Amount must be greater than zero.",
+            detail="Tab currency must match TPoS currency.",
         )
 
     metadata = {
@@ -455,23 +402,57 @@ async def api_tpos_add_tab_charge(
         "source": "tpos",
         "source_id": tpos.id,
         "source_action": "order_charge",
-        "idempotency_key": data.idempotency_key or f"tpos:{tpos.id}:{uuid4().hex}",
+        "idempotency_key": data.idempotency_key,
     }
-    try:
-        entry = await create_tab_charge_for_tpos(
-            user_id=user_id,
-            tab_id=tab_id,
-            payload=payload,
+    entry = await create_tab_charge_for_tpos(
+        user_id=user_id,
+        tab_id=tab_id,
+        payload=payload,
+    )
+    updated_tab = await fetch_single_tab_for_tpos(user_id=user_id, tab_id=tab_id)
+    return {"tab_id": tab_id, "entry": entry, "tab": TposTab(**updated_tab).dict()}
+
+
+@tpos_api_router.post("/api/v1/tposs/{tpos_id}/tabs/{tab_id}/settlements")
+async def api_tpos_create_tab_settlement(
+    tpos_id: str,
+    tab_id: str,
+    data: CreateTposTabSettlement,
+) -> dict[str, Any]:
+    tpos = await get_tpos(tpos_id)
+    if not tpos:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
         )
-        tab = await fetch_single_tab_for_tpos(user_id=user_id, tab_id=tab_id)
-    except httpx.HTTPStatusError as exc:
+    user_id = await ensure_tpos_tabs_access(tpos)
+    tab = await fetch_single_tab_for_tpos(user_id=user_id, tab_id=tab_id)
+    if (tab.get("currency") or "sats").lower() != (tpos.currency or "sats").lower():
         raise HTTPException(
-            status_code=exc.response.status_code
-            if exc.response
-            else HTTPStatus.BAD_GATEWAY,
-            detail=_extract_error_detail(exc),
-        ) from exc
-    return {"tab_id": tab_id, "entry": entry, "tab": tab}
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Tab currency must match TPoS currency.",
+        )
+
+    settlement_payload = {
+        "amount": data.amount,
+        "method": "lightning",
+        "reference": data.reference,
+        "description": data.description or "TPoS settlement",
+        "metadata": json.dumps(
+            {
+                "source": "tpos",
+                "source_id": tpos.id,
+                "source_action": "settlement_requested",
+                "requested_at": datetime.now(timezone.utc).isoformat(),
+            }
+        ),
+        "idempotency_key": data.idempotency_key,
+    }
+    result = await create_tab_settlement_for_tpos(
+        user_id=user_id,
+        tab_id=tab_id,
+        payload=settlement_payload,
+    )
+    return result
 
 
 @tpos_api_router.post("/api/v1/tposs", status_code=HTTPStatus.CREATED)

From 940a04b768396215169960b180aae3a788dac69a Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Mon, 20 Apr 2026 10:00:17 +0100
Subject: [PATCH 03/11] chore: clean up

---
 data/.lnbits_auth_key |  1 +
 static/js/tpos.js     | 74 ++++++++++++++++++++++++++++---------------
 views_api.py          | 62 +++++++++++++++++-------------------
 3 files changed, 79 insertions(+), 58 deletions(-)
 create mode 100644 data/.lnbits_auth_key

diff --git a/data/.lnbits_auth_key b/data/.lnbits_auth_key
new file mode 100644
index 0000000..ab5826e
--- /dev/null
+++ b/data/.lnbits_auth_key
@@ -0,0 +1 @@
+c96cd22276324976b0a57d2c9c82a236
\ No newline at end of file
diff --git a/static/js/tpos.js b/static/js/tpos.js
index 14391fe..e0f9ed8 100644
--- a/static/js/tpos.js
+++ b/static/js/tpos.js
@@ -1018,6 +1018,35 @@ window.app = Vue.createApp({
         this._currencyResolver = null
       }
     },
+    normalizeApiAmount(currency, value) {
+      if (value === null || value === undefined || value === '') return null
+      const parsed = Number(value)
+      if (Number.isNaN(parsed)) return null
+      if ((currency || '').toLowerCase() === 'sats') return Math.round(parsed)
+      return roundTposCurrencyAmount(parsed, currency)
+    },
+    mapTabFromApi(tab) {
+      const currency = tab?.currency || this.currency || 'sats'
+      return {
+        ...tab,
+        currency,
+        balance: this.normalizeApiAmount(currency, tab?.balance) ?? 0
+      }
+    },
+    generateTabsIdempotencyKey(prefix) {
+      const randomSuffix =
+        typeof crypto !== 'undefined' && crypto.randomUUID
+          ? crypto.randomUUID()
+          : Date.now().toString()
+      return `${prefix}:${this.tposId}:${randomSuffix}`
+    },
+    resetTabsDialogNewTab() {
+      this.tabsDialog.newTab = {
+        name: '',
+        customer_name: '',
+        reference: ''
+      }
+    },
     buildTabChargeParams() {
       const paymentAmount =
         this.paymentAmount !== null ? this.paymentAmount : this.amount
@@ -1042,10 +1071,6 @@ window.app = Vue.createApp({
         this.currency === 'sats'
           ? Math.ceil(paymentAmount)
           : roundTposCurrencyAmount(paymentAmount, this.currency)
-      const randomSuffix =
-        typeof crypto !== 'undefined' && crypto.randomUUID
-          ? crypto.randomUUID()
-          : Date.now().toString()
 
       return {
         amount: normalizedAmount,
@@ -1053,19 +1078,15 @@ window.app = Vue.createApp({
         items,
         notes: Object.keys(notes).length ? notes : null,
         internal_memo: this.invoiceDialog.internalMemo || null,
-        idempotency_key: `tpos:${this.tposId}:${randomSuffix}`
+        idempotency_key: this.generateTabsIdempotencyKey('tpos')
       }
     },
     buildTabSettlementParams() {
-      const randomSuffix =
-        typeof crypto !== 'undefined' && crypto.randomUUID
-          ? crypto.randomUUID()
-          : Date.now().toString()
       return {
         amount: null,
         description: this.invoiceDialog.internalMemo || 'TPoS settlement',
         reference: `tpos-${this.tposId}`,
-        idempotency_key: `tpos:settlement:${this.tposId}:${randomSuffix}`
+        idempotency_key: this.generateTabsIdempotencyKey('tpos:settlement')
       }
     },
     closeTabsDialog() {
@@ -1075,11 +1096,7 @@ window.app = Vue.createApp({
       this.tabsDialog.settling = false
       this.tabsDialog.mode = 'charge'
       this.tabsDialog.query = ''
-      this.tabsDialog.newTab = {
-        name: '',
-        customer_name: '',
-        reference: ''
-      }
+      this.resetTabsDialogNewTab()
     },
     async loadTabsForCharge() {
       this.tabsDialog.loading = true
@@ -1091,7 +1108,9 @@ window.app = Vue.createApp({
           'GET',
           `/tpos/api/v1/tposs/${this.tposId}/tabs?status=open${query}`
         )
-        this.tabsDialog.tabs = data.data || []
+        this.tabsDialog.tabs = (data.data || []).map(tab =>
+          this.mapTabFromApi(tab)
+        )
         if (!this.tabsDialog.tabs.length) {
           this.tabsDialog.selectedTabId = null
           this.tabsDialog.createMode = this.tabsAllowCreate
@@ -1128,11 +1147,7 @@ window.app = Vue.createApp({
           payload
         )
         this.tabsDialog.createMode = false
-        this.tabsDialog.newTab = {
-          name: '',
-          customer_name: '',
-          reference: ''
-        }
+        this.resetTabsDialogNewTab()
         await this.loadTabsForCharge()
         this.tabsDialog.selectedTabId = data.id
       } catch (error) {
@@ -1180,6 +1195,10 @@ window.app = Vue.createApp({
         )
         const paymentRequest = data?.payment_request
         const paymentHash = data?.settlement?.payment_hash
+        const settlementAmount = this.normalizeApiAmount(
+          this.currency,
+          data?.settlement?.amount
+        )
         if (!paymentRequest || !paymentHash) {
           Quasar.Notify.create({
             type: 'warning',
@@ -1188,6 +1207,10 @@ window.app = Vue.createApp({
           return
         }
         this.closeTabsDialog()
+        if (settlementAmount !== null) {
+          this.paymentAmount = settlementAmount
+          this.total = settlementAmount
+        }
         this.openInvoiceDialog(
           paymentHash,
           'lightning:' + String(paymentRequest).toUpperCase()
@@ -1200,12 +1223,13 @@ window.app = Vue.createApp({
       }
     },
     async openTabChargeDialog() {
-      this.tabsDialog.mode = 'charge'
-      await this.loadTabsForCharge()
-      this.tabsDialog.show = true
+      await this.openTabsDialog('charge')
     },
     async openTabSettlementDialog() {
-      this.tabsDialog.mode = 'settlement'
+      await this.openTabsDialog('settlement')
+    },
+    async openTabsDialog(mode) {
+      this.tabsDialog.mode = mode
       await this.loadTabsForCharge()
       this.tabsDialog.show = true
     },
diff --git a/views_api.py b/views_api.py
index 14d128b..631b6d8 100644
--- a/views_api.py
+++ b/views_api.py
@@ -95,6 +95,27 @@
 tpos_api_router = APIRouter()
 
 
+async def _get_tpos_or_404(tpos_id: str) -> Tpos:
+    tpos = await get_tpos(tpos_id)
+    if not tpos:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
+        )
+    return tpos
+
+
+def _tpos_currency(tpos: Tpos) -> str:
+    return (tpos.currency or "sats").lower()
+
+
+def _ensure_tab_matches_tpos_currency(tab: dict[str, Any], tpos: Tpos) -> None:
+    if (tab.get("currency") or "sats").lower() != _tpos_currency(tpos):
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Tab currency must match TPoS currency.",
+        )
+
+
 def _two_year_token_expiry_minutes() -> int:
     now = datetime.now(timezone.utc)
     try:
@@ -311,12 +332,7 @@ async def api_tpos_tabs(
     status: str = Query("open"),
     q: str | None = Query(None),
 ) -> TposTabList:
-    tpos = await get_tpos(tpos_id)
-    if not tpos:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
-        )
-
+    tpos = await _get_tpos_or_404(tpos_id)
     user_id = await ensure_tpos_tabs_access(tpos)
     tabs = await fetch_tabs_for_tpos(
         user_id=user_id,
@@ -332,19 +348,15 @@ async def api_tpos_create_tab(
     tpos_id: str,
     data: CreateTposTabData,
 ) -> TposTab:
-    tpos = await get_tpos(tpos_id)
-    if not tpos:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
-        )
+    tpos = await _get_tpos_or_404(tpos_id)
     user_id = await ensure_tpos_tabs_access(tpos)
     if not tpos.tabs_allow_create:
         raise HTTPException(
             status_code=HTTPStatus.FORBIDDEN,
             detail="Tab creation is not enabled for this TPoS.",
         )
-    tab_currency = (data.currency or tpos.currency or "sats").lower()
-    if tab_currency != (tpos.currency or "sats").lower():
+    tab_currency = (data.currency or _tpos_currency(tpos)).lower()
+    if tab_currency != _tpos_currency(tpos):
         raise HTTPException(
             status_code=HTTPStatus.BAD_REQUEST,
             detail="Tab currency must match TPoS currency.",
@@ -369,19 +381,11 @@ async def api_tpos_add_tab_charge(
     tab_id: str,
     data: CreateTposTabCharge,
 ) -> dict[str, Any]:
-    tpos = await get_tpos(tpos_id)
-    if not tpos:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
-        )
+    tpos = await _get_tpos_or_404(tpos_id)
     user_id = await ensure_tpos_tabs_access(tpos)
 
     tab = await fetch_single_tab_for_tpos(user_id=user_id, tab_id=tab_id)
-    if (tab.get("currency") or "sats").lower() != (tpos.currency or "sats").lower():
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail="Tab currency must match TPoS currency.",
-        )
+    _ensure_tab_matches_tpos_currency(tab, tpos)
 
     metadata = {
         "source": "tpos",
@@ -419,18 +423,10 @@ async def api_tpos_create_tab_settlement(
     tab_id: str,
     data: CreateTposTabSettlement,
 ) -> dict[str, Any]:
-    tpos = await get_tpos(tpos_id)
-    if not tpos:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="TPoS does not exist."
-        )
+    tpos = await _get_tpos_or_404(tpos_id)
     user_id = await ensure_tpos_tabs_access(tpos)
     tab = await fetch_single_tab_for_tpos(user_id=user_id, tab_id=tab_id)
-    if (tab.get("currency") or "sats").lower() != (tpos.currency or "sats").lower():
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail="Tab currency must match TPoS currency.",
-        )
+    _ensure_tab_matches_tpos_currency(tab, tpos)
 
     settlement_payload = {
         "amount": data.amount,

From ad5e8cf4b52f9e7ee1e6f181ba750455cce1812e Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Mon, 20 Apr 2026 10:15:19 +0100
Subject: [PATCH 04/11] chore: clean test file

---
 data/.lnbits_auth_key | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 data/.lnbits_auth_key

diff --git a/data/.lnbits_auth_key b/data/.lnbits_auth_key
deleted file mode 100644
index ab5826e..0000000
--- a/data/.lnbits_auth_key
+++ /dev/null
@@ -1 +0,0 @@
-c96cd22276324976b0a57d2c9c82a236
\ No newline at end of file

From 829c223179a98f736d5e2aedb89aad73e5352a9c Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Mon, 20 Apr 2026 10:17:26 +0100
Subject: [PATCH 05/11] fix: tab button standard

---
 templates/tpos/dialogs.html | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/templates/tpos/dialogs.html b/templates/tpos/dialogs.html
index 8bde656..8670951 100644
--- a/templates/tpos/dialogs.html
+++ b/templates/tpos/dialogs.html
@@ -465,7 +465,7 @@ <h5 class="q-mt-none q-mb-sm">
           <q-btn
             class="full-width q-px-lg q-py-sm"
             size="xl"
-            color="accent"
+            color="secondary"
             rounded
             aria-label="Add to tab"
             @click="selectPaymentMethod('tab')"
@@ -536,9 +536,7 @@ <h5 class="q-mt-none q-mb-sm">
             </q-item>
           </q-list>
         </div>
-        <div v-else class="text-caption text-grey-7">
-          No open tabs found.
-        </div>
+        <div v-else class="text-caption text-grey-7">No open tabs found.</div>
 
         <div class="q-mt-md" v-if="tabsAllowCreate">
           <q-btn

From 99ef919f6609e546d892c97e4901399736c6f037 Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Mon, 4 May 2026 10:07:34 +0100
Subject: [PATCH 06/11] standard button

---
 templates/tpos/dialogs.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/tpos/dialogs.html b/templates/tpos/dialogs.html
index 8670951..78feefd 100644
--- a/templates/tpos/dialogs.html
+++ b/templates/tpos/dialogs.html
@@ -471,8 +471,8 @@ <h5 class="q-mt-none q-mb-sm">
             @click="selectPaymentMethod('tab')"
           >
             <div class="row items-center no-wrap q-gutter-x-xs">
-              <q-icon name="assignment" size="30px"></q-icon>
-              <span class="text-subtitle1 text-weight-bold">Tab</span>
+              <q-icon class="text-h4" name="playlist_add_check"></q-icon>
+              <span class="text-subtitle1 text-weight-medium">Tab</span>
             </div>
           </q-btn>
         </div>

From 586e24b65c9823cdffb8c1a9c662780242541a81 Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Mon, 4 May 2026 13:00:16 +0100
Subject: [PATCH 07/11] settle tab from tpos

---
 .gitignore                  |   2 +
 models.py                   |  16 +-
 static/js/tpos.js           |  58 +++---
 tasks.py                    |  42 +++++
 templates/tpos/dialogs.html |   2 +-
 tests/test_tabs.py          | 340 ++++++++++++++++++++++++++++++++++++
 views_api.py                |  68 ++++----
 7 files changed, 460 insertions(+), 68 deletions(-)
 create mode 100644 tests/test_tabs.py

diff --git a/.gitignore b/.gitignore
index 0152b6e..2a2a77b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,5 @@ __pycache__
 node_modules
 .mypy_cache
 .venv
+
+.codex
diff --git a/models.py b/models.py
index bb904d7..27d4016 100644
--- a/models.py
+++ b/models.py
@@ -16,6 +16,14 @@ class CreateWithdrawPay(BaseModel):
     pay_link: str
 
 
+class CreateTposInvoiceTabSettlement(BaseModel):
+    tab_id: str = Field(..., min_length=1)
+    amount: float = Field(..., gt=0)
+    reference: str | None = Field(None, max_length=120)
+    description: str | None = Field(None, max_length=512)
+    idempotency_key: str = Field(..., min_length=8, max_length=128)
+
+
 class CreateTposInvoice(BaseModel):
     amount: int = Query(..., ge=1)
     memo: str | None = Query(None)
@@ -31,6 +39,7 @@ class CreateTposInvoice(BaseModel):
     payment_method: str | None = Query(None)
     amount_fiat: float | None = Query(None, ge=0.0)
     tip_amount_fiat: float | None = Query(None, ge=0.0)
+    tab_settlement: CreateTposInvoiceTabSettlement | None = Query(None)
 
 
 class InventorySaleItem(BaseModel):
@@ -205,13 +214,6 @@ class CreateTposTabCharge(BaseModel):
     idempotency_key: str = Field(..., min_length=8, max_length=128)
 
 
-class CreateTposTabSettlement(BaseModel):
-    amount: float | None = Field(None, gt=0)
-    reference: str | None = Field(None, max_length=120)
-    description: str | None = Field(None, max_length=512)
-    idempotency_key: str = Field(..., min_length=8, max_length=128)
-
-
 class LnurlCharge(BaseModel):
     id: str
     tpos_id: str
diff --git a/static/js/tpos.js b/static/js/tpos.js
index e0f9ed8..479b742 100644
--- a/static/js/tpos.js
+++ b/static/js/tpos.js
@@ -106,6 +106,7 @@ window.app = Vue.createApp({
           reference: ''
         }
       },
+      pendingTabSettlement: null,
       cashValidating: false,
       tipDialog: {
         show: false
@@ -277,6 +278,9 @@ window.app = Vue.createApp({
         this.currency
       )
     },
+    isSettlingTab() {
+      return Boolean(this.pendingTabSettlement)
+    },
     tipAmountSat() {
       if (!this.exchangeRate) return 0
       return Math.ceil(this.tipAmount * this.exchangeRate)
@@ -669,6 +673,7 @@ window.app = Vue.createApp({
       this.total = 0.0
       this.addedAmount = 0.0
       this.resetPaymentAttempt()
+      this.pendingTabSettlement = null
       if (this.$q.screen.lt.md) {
         this.cartDrawer = false
       }
@@ -1082,8 +1087,16 @@ window.app = Vue.createApp({
       }
     },
     buildTabSettlementParams() {
+      const selectedTab = this.tabsDialog.tabs.find(
+        tab => tab.id === this.tabsDialog.selectedTabId
+      )
+      const amount = this.normalizeApiAmount(
+        selectedTab?.currency || this.currency,
+        selectedTab?.balance
+      )
       return {
-        amount: null,
+        tab_id: this.tabsDialog.selectedTabId,
+        amount,
         description: this.invoiceDialog.internalMemo || 'TPoS settlement',
         reference: `tpos-${this.tposId}`,
         idempotency_key: this.generateTabsIdempotencyKey('tpos:settlement')
@@ -1187,35 +1200,28 @@ window.app = Vue.createApp({
       this.tabsDialog.settling = true
       try {
         const payload = this.buildTabSettlementParams()
-        const {data} = await LNbits.api.request(
-          'POST',
-          `/tpos/api/v1/tposs/${this.tposId}/tabs/${this.tabsDialog.selectedTabId}/settlements`,
-          null,
-          payload
-        )
-        const paymentRequest = data?.payment_request
-        const paymentHash = data?.settlement?.payment_hash
-        const settlementAmount = this.normalizeApiAmount(
-          this.currency,
-          data?.settlement?.amount
-        )
-        if (!paymentRequest || !paymentHash) {
+        if (!payload.amount) {
           Quasar.Notify.create({
             type: 'warning',
-            message: 'Settlement created, but no invoice was returned.'
+            message: 'This tab has no outstanding balance to settle.'
           })
           return
         }
         this.closeTabsDialog()
-        if (settlementAmount !== null) {
-          this.paymentAmount = settlementAmount
-          this.total = settlementAmount
+        this.pendingTabSettlement = payload
+        this.paymentAmount = payload.amount
+        this.sat = Math.ceil(payload.amount * this.exchangeRate)
+        if (!this.exchangeRate || this.exchangeRate == 0 || this.sat == 0) {
+          this.resetPaymentAttempt()
+          this.pendingTabSettlement = null
+          Quasar.Notify.create({
+            type: 'negative',
+            message:
+              'Exchange rate not available, or wrong value. Please try again later.'
+          })
+          return
         }
-        this.openInvoiceDialog(
-          paymentHash,
-          'lightning:' + String(paymentRequest).toUpperCase()
-        )
-        this.subscribeToPaymentWS(paymentHash)
+        await this.showInvoice()
       } catch (error) {
         LNbits.utils.notifyApiError(error)
       } finally {
@@ -1282,6 +1288,9 @@ window.app = Vue.createApp({
       if (this.lnaddress) {
         params.user_lnaddress = this.lnaddressDialog.lnaddress
       }
+      if (this.pendingTabSettlement) {
+        params.tab_settlement = this.pendingTabSettlement
+      }
       if (this.usingInventory && this.cart.size) {
         params.inventory = {
           inventory_id: this.inventoryId,
@@ -1304,7 +1313,8 @@ window.app = Vue.createApp({
         this.fiatProvider ||
         this.allowCashSettlement ||
         this.onchainEnabled ||
-        this.tabsEnabled
+        this.isSettlingTab ||
+        (this.tabsEnabled && !this.isSettlingTab)
       ) {
         const method = await this.showPaymentMethod()
         if (method === 'tab') {
diff --git a/tasks.py b/tasks.py
index 47ad857..9dabca3 100644
--- a/tasks.py
+++ b/tasks.py
@@ -20,7 +20,9 @@
     update_tpos_payment,
 )
 from .services import (
+    create_tab_settlement_for_tpos,
     deduct_inventory_stock,
+    ensure_tpos_tabs_access,
     fetch_onchain_balance,
     push_order_to_orders,
 )
@@ -169,6 +171,7 @@ async def process_paid_tpos_payment(
     await websocket_updater(tpos_id, json.dumps(stripped_payment))
     await websocket_updater(payment.payment_hash, json.dumps(stripped_payment))
 
+    await maybe_settle_tab(payment, tpos, payment_method)
     await maybe_push_order(payment, tpos)
 
     inventory_payload = payment.extra.get("inventory")
@@ -201,6 +204,45 @@ async def process_paid_tpos_payment(
     logger.debug(f"tpos: tip invoice paid: {paid_payment.checking_id}")
 
 
+async def maybe_settle_tab(payment: Payment, tpos, payment_method: str) -> None:
+    settlement = (payment.extra or {}).get("tab_settlement")
+    if not settlement:
+        return
+
+    try:
+        user_id = await ensure_tpos_tabs_access(tpos)
+        await create_tab_settlement_for_tpos(
+            user_id=user_id,
+            tab_id=settlement["tab_id"],
+            payload={
+                "amount": settlement["amount"],
+                "method": _tabs_settlement_method(payment_method, payment),
+                "reference": settlement.get("reference"),
+                "description": settlement.get("description") or "TPoS settlement",
+                "metadata": json.dumps(
+                    {
+                        "source": "tpos",
+                        "source_id": tpos.id,
+                        "source_action": "settlement_paid",
+                        "payment_hash": payment.payment_hash,
+                        "payment_method": payment_method,
+                    }
+                ),
+                "idempotency_key": settlement["idempotency_key"],
+            },
+        )
+    except Exception as exc:
+        logger.warning(f"tpos: tab settlement failed: {exc}")
+
+
+def _tabs_settlement_method(payment_method: str, payment: Payment) -> str:
+    if payment_method == "cash":
+        return "cash"
+    if payment.extra.get("fiat_method") == "terminal":
+        return "card"
+    return "other"
+
+
 def _payment_method(payment: Payment) -> str:
     if payment.extra.get("payment_method"):
         return str(payment.extra["payment_method"])
diff --git a/templates/tpos/dialogs.html b/templates/tpos/dialogs.html
index 78feefd..e1cea28 100644
--- a/templates/tpos/dialogs.html
+++ b/templates/tpos/dialogs.html
@@ -461,7 +461,7 @@ <h5 class="q-mt-none q-mb-sm">
             </div>
           </q-btn>
         </div>
-        <div class="col-6" v-if="tabsEnabled">
+        <div class="col-6" v-if="tabsEnabled && !isSettlingTab">
           <q-btn
             class="full-width q-px-lg q-py-sm"
             size="xl"
diff --git a/tests/test_tabs.py b/tests/test_tabs.py
new file mode 100644
index 0000000..4057d8c
--- /dev/null
+++ b/tests/test_tabs.py
@@ -0,0 +1,340 @@
+import json
+from http import HTTPStatus
+from types import SimpleNamespace
+
+import pytest
+from fastapi import HTTPException
+
+from .. import services, tasks, views_api
+from ..models import (
+    CreateTposTabCharge,
+    CreateTposTabData,
+    Tpos,
+)
+
+
+def make_tpos(**overrides) -> Tpos:
+    data = {
+        "id": "tpos-id",
+        "wallet": "wallet-id",
+        "name": "Shop",
+        "currency": "eur",
+        "tax_inclusive": True,
+        "withdraw_time": 0,
+        "withdraw_between": 10,
+        "enable_receipt_print": False,
+        "tabs_enabled": True,
+        "tabs_allow_create": True,
+    }
+    data.update(overrides)
+    return Tpos(**data)
+
+
+@pytest.mark.asyncio
+async def test_ensure_tpos_tabs_access_requires_enabled():
+    tpos = make_tpos(tabs_enabled=False)
+
+    with pytest.raises(HTTPException) as exc:
+        await services.ensure_tpos_tabs_access(tpos)
+
+    assert exc.value.status_code == HTTPStatus.BAD_REQUEST
+    assert exc.value.detail == "Tabs integration is not enabled for this TPoS."
+
+
+@pytest.mark.asyncio
+async def test_ensure_tpos_tabs_access_checks_extension(monkeypatch):
+    async def fake_owner_user_id(tpos: Tpos) -> str:
+        assert tpos.id == "tpos-id"
+        return "user-id"
+
+    async def fake_tabs_available(user_id: str) -> bool:
+        assert user_id == "user-id"
+        return True
+
+    monkeypatch.setattr(services, "get_tpos_owner_user_id", fake_owner_user_id)
+    monkeypatch.setattr(services, "tabs_available_for_user", fake_tabs_available)
+
+    assert await services.ensure_tpos_tabs_access(make_tpos()) == "user-id"
+
+
+@pytest.mark.asyncio
+async def test_fetch_tabs_for_tpos_filters_sorts_and_limits(monkeypatch):
+    tabs = [
+        {
+            "id": "old",
+            "wallet": "wallet-id",
+            "name": "Old table",
+            "currency": "eur",
+            "status": "open",
+            "updated_at": "2026-01-01T00:00:00Z",
+        },
+        {
+            "id": "new",
+            "wallet": "wallet-id",
+            "name": "Alice",
+            "currency": "eur",
+            "status": "open",
+            "updated_at": "2026-01-02T00:00:00Z",
+        },
+        {
+            "id": "other-wallet",
+            "wallet": "other-wallet",
+            "name": "Alice",
+            "currency": "eur",
+            "status": "open",
+            "updated_at": "2026-01-03T00:00:00Z",
+        },
+        {
+            "id": "closed",
+            "wallet": "wallet-id",
+            "name": "Alice",
+            "currency": "eur",
+            "status": "closed",
+            "updated_at": "2026-01-04T00:00:00Z",
+        },
+    ]
+
+    class FakeResponse:
+        def raise_for_status(self) -> None:
+            return None
+
+        def json(self) -> list[dict]:
+            return tabs
+
+    class FakeClient:
+        async def __aenter__(self):
+            return self
+
+        async def __aexit__(self, *_args):
+            return None
+
+        async def get(self, **kwargs):
+            assert kwargs["headers"]["Authorization"] == "Bearer token"
+            assert kwargs["url"].endswith("/tabs/api/v1/tabs")
+            return FakeResponse()
+
+    monkeypatch.setattr(
+        services,
+        "_create_internal_user_access_token",
+        lambda _: "token",
+    )
+    monkeypatch.setattr(services.httpx, "AsyncClient", FakeClient)
+
+    result = await services.fetch_tabs_for_tpos(
+        user_id="user-id",
+        wallet_id="wallet-id",
+        status="open",
+        query="ali",
+    )
+
+    assert [tab["id"] for tab in result] == ["new"]
+
+
+@pytest.mark.asyncio
+async def test_fetch_tabs_for_tpos_rejects_invalid_status():
+    with pytest.raises(HTTPException) as exc:
+        await services.fetch_tabs_for_tpos(
+            user_id="user-id",
+            wallet_id="wallet-id",
+            status="missing",
+        )
+
+    assert exc.value.status_code == HTTPStatus.BAD_REQUEST
+    assert exc.value.detail == "Invalid tab status filter."
+
+
+@pytest.mark.asyncio
+async def test_api_tpos_create_tab_builds_payload(monkeypatch):
+    calls = {}
+    tpos = make_tpos(currency="EUR")
+
+    async def fake_get_tpos_or_404(tpos_id: str) -> Tpos:
+        assert tpos_id == "tpos-id"
+        return tpos
+
+    async def fake_access(access_tpos: Tpos) -> str:
+        assert access_tpos == tpos
+        return "user-id"
+
+    async def fake_create_tab_for_tpos(user_id: str, payload: dict) -> dict:
+        calls["user_id"] = user_id
+        calls["payload"] = payload
+        return {
+            "id": "tab-id",
+            "name": payload["name"],
+            "customer_name": payload["customer_name"],
+            "reference": payload["reference"],
+            "currency": payload["currency"],
+            "status": "open",
+            "balance": 0,
+            "is_archived": False,
+        }
+
+    monkeypatch.setattr(views_api, "_get_tpos_or_404", fake_get_tpos_or_404)
+    monkeypatch.setattr(views_api, "ensure_tpos_tabs_access", fake_access)
+    monkeypatch.setattr(views_api, "create_tab_for_tpos", fake_create_tab_for_tpos)
+
+    result = await views_api.api_tpos_create_tab(
+        "tpos-id",
+        CreateTposTabData(
+            name="Table 1",
+            customer_name="Alice",
+            reference="A1",
+            currency="eur",
+            limit_type="total",
+            limit_amount=100,
+        ),
+    )
+
+    assert result.id == "tab-id"
+    assert calls == {
+        "user_id": "user-id",
+        "payload": {
+            "wallet": "wallet-id",
+            "name": "Table 1",
+            "customer_name": "Alice",
+            "reference": "A1",
+            "currency": "eur",
+            "limit_type": "total",
+            "limit_amount": 100,
+        },
+    }
+
+
+@pytest.mark.asyncio
+async def test_api_tpos_create_tab_rejects_currency_mismatch(monkeypatch):
+    async def fake_get_tpos_or_404(_tpos_id: str) -> Tpos:
+        return make_tpos(currency="eur")
+
+    monkeypatch.setattr(views_api, "_get_tpos_or_404", fake_get_tpos_or_404)
+
+    async def fake_access(_tpos: Tpos) -> str:
+        return "user-id"
+
+    monkeypatch.setattr(views_api, "ensure_tpos_tabs_access", fake_access)
+
+    with pytest.raises(HTTPException) as exc:
+        await views_api.api_tpos_create_tab(
+            "tpos-id",
+            CreateTposTabData(name="Table 1", currency="usd"),
+        )
+
+    assert exc.value.status_code == HTTPStatus.BAD_REQUEST
+    assert exc.value.detail == "Tab currency must match TPoS currency."
+
+
+@pytest.mark.asyncio
+async def test_api_tpos_add_tab_charge_checks_currency_and_payload(monkeypatch):
+    calls = {}
+    tpos = make_tpos(currency="eur")
+
+    async def fake_get_tpos_or_404(_tpos_id: str) -> Tpos:
+        return tpos
+
+    async def fake_access(_tpos: Tpos) -> str:
+        return "user-id"
+
+    async def fake_fetch_tab(user_id: str, tab_id: str) -> dict:
+        assert user_id == "user-id"
+        assert tab_id == "tab-id"
+        return {
+            "id": "tab-id",
+            "name": "Table 1",
+            "currency": "eur",
+            "status": "open",
+            "balance": 12,
+            "is_archived": False,
+        }
+
+    async def fake_create_charge(user_id: str, tab_id: str, payload: dict) -> dict:
+        calls["user_id"] = user_id
+        calls["tab_id"] = tab_id
+        calls["payload"] = payload
+        return {"id": "entry-id"}
+
+    monkeypatch.setattr(views_api, "_get_tpos_or_404", fake_get_tpos_or_404)
+    monkeypatch.setattr(views_api, "ensure_tpos_tabs_access", fake_access)
+    monkeypatch.setattr(views_api, "fetch_single_tab_for_tpos", fake_fetch_tab)
+    monkeypatch.setattr(views_api, "create_tab_charge_for_tpos", fake_create_charge)
+
+    result = await views_api.api_tpos_add_tab_charge(
+        "tpos-id",
+        "tab-id",
+        CreateTposTabCharge(
+            amount=12.5,
+            description="Lunch",
+            items=[{"title": "Coffee"}],
+            notes={"table": 1},
+            internal_memo="memo",
+            idempotency_key="charge-key",
+        ),
+    )
+
+    assert result["entry"] == {"id": "entry-id"}
+    assert result["tab"]["id"] == "tab-id"
+    payload = calls["payload"]
+    assert calls["user_id"] == "user-id"
+    assert calls["tab_id"] == "tab-id"
+    assert payload["entry_type"] == "charge"
+    assert payload["amount"] == 12.5
+    assert payload["description"] == "Lunch"
+    assert payload["idempotency_key"] == "charge-key"
+    metadata = json.loads(payload["metadata"])
+    assert metadata["source"] == "tpos"
+    assert metadata["tpos_id"] == "tpos-id"
+    assert metadata["items"] == [{"title": "Coffee"}]
+
+
+@pytest.mark.asyncio
+async def test_maybe_settle_tab_builds_paid_settlement_payload(monkeypatch):
+    calls = {}
+    tpos = make_tpos(currency="eur")
+    payment = SimpleNamespace(
+        extra={
+            "tab_settlement": {
+                "tab_id": "tab-id",
+                "amount": 20,
+                "reference": "invoice-1",
+                "description": "Paid",
+                "idempotency_key": "settle-key",
+            },
+            "fiat_method": "terminal",
+        },
+        payment_hash="payment-hash",
+    )
+
+    async def fake_access(access_tpos: Tpos) -> str:
+        assert access_tpos == tpos
+        return "user-id"
+
+    async def fake_create_settlement(user_id: str, tab_id: str, payload: dict) -> dict:
+        calls["user_id"] = user_id
+        calls["tab_id"] = tab_id
+        calls["payload"] = payload
+        return {"id": "settlement-id"}
+
+    monkeypatch.setattr(
+        tasks,
+        "ensure_tpos_tabs_access",
+        fake_access,
+    )
+    monkeypatch.setattr(
+        tasks,
+        "create_tab_settlement_for_tpos",
+        fake_create_settlement,
+    )
+
+    await tasks.maybe_settle_tab(payment, tpos, "fiat")
+
+    payload = calls["payload"]
+    assert calls["user_id"] == "user-id"
+    assert calls["tab_id"] == "tab-id"
+    assert payload["amount"] == 20
+    assert payload["method"] == "card"
+    assert payload["reference"] == "invoice-1"
+    assert payload["description"] == "Paid"
+    assert payload["idempotency_key"] == "settle-key"
+    metadata = json.loads(payload["metadata"])
+    assert metadata["source"] == "tpos"
+    assert metadata["source_action"] == "settlement_paid"
+    assert metadata["payment_hash"] == "payment-hash"
diff --git a/views_api.py b/views_api.py
index 631b6d8..6cf5fe0 100644
--- a/views_api.py
+++ b/views_api.py
@@ -58,7 +58,6 @@
     CreateTposInvoice,
     CreateTposTabCharge,
     CreateTposTabData,
-    CreateTposTabSettlement,
     CreateUpdateItemData,
     InventorySale,
     PayLnurlWData,
@@ -78,7 +77,6 @@
 from .services import (
     create_tab_charge_for_tpos,
     create_tab_for_tpos,
-    create_tab_settlement_for_tpos,
     ensure_tpos_tabs_access,
     fetch_onchain_address,
     fetch_single_tab_for_tpos,
@@ -116,6 +114,10 @@ def _ensure_tab_matches_tpos_currency(tab: dict[str, Any], tpos: Tpos) -> None:
         )
 
 
+def _tab_settlement_tolerance(currency: str | None) -> float:
+    return 1 if (currency or "sats").lower() == "sats" else 0.01
+
+
 def _two_year_token_expiry_minutes() -> int:
     now = datetime.now(timezone.utc)
     try:
@@ -417,40 +419,6 @@ async def api_tpos_add_tab_charge(
     return {"tab_id": tab_id, "entry": entry, "tab": TposTab(**updated_tab).dict()}
 
 
-@tpos_api_router.post("/api/v1/tposs/{tpos_id}/tabs/{tab_id}/settlements")
-async def api_tpos_create_tab_settlement(
-    tpos_id: str,
-    tab_id: str,
-    data: CreateTposTabSettlement,
-) -> dict[str, Any]:
-    tpos = await _get_tpos_or_404(tpos_id)
-    user_id = await ensure_tpos_tabs_access(tpos)
-    tab = await fetch_single_tab_for_tpos(user_id=user_id, tab_id=tab_id)
-    _ensure_tab_matches_tpos_currency(tab, tpos)
-
-    settlement_payload = {
-        "amount": data.amount,
-        "method": "lightning",
-        "reference": data.reference,
-        "description": data.description or "TPoS settlement",
-        "metadata": json.dumps(
-            {
-                "source": "tpos",
-                "source_id": tpos.id,
-                "source_action": "settlement_requested",
-                "requested_at": datetime.now(timezone.utc).isoformat(),
-            }
-        ),
-        "idempotency_key": data.idempotency_key,
-    }
-    result = await create_tab_settlement_for_tpos(
-        user_id=user_id,
-        tab_id=tab_id,
-        payload=settlement_payload,
-    )
-    return result
-
-
 @tpos_api_router.post("/api/v1/tposs", status_code=HTTPStatus.CREATED)
 async def api_tpos_create(
     data: CreateTposData, wallet: WalletTypeInfo = Depends(require_admin_key)
@@ -708,6 +676,32 @@ async def api_tpos_create_invoice(
             status_code=HTTPStatus.FORBIDDEN,
             detail="Onchain payments are not enabled for this TPoS.",
         )
+    tab_settlement = data.tab_settlement
+    if tab_settlement:
+        user_id = await ensure_tpos_tabs_access(tpos)
+        tab = await fetch_single_tab_for_tpos(
+            user_id=user_id, tab_id=tab_settlement.tab_id
+        )
+        _ensure_tab_matches_tpos_currency(tab, tpos)
+        if tab.get("status") == "closed":
+            raise HTTPException(
+                status_code=HTTPStatus.BAD_REQUEST,
+                detail="Closed tabs cannot be settled.",
+            )
+        tab_balance = float(tab.get("balance") or 0)
+        if tab_balance <= 0:
+            raise HTTPException(
+                status_code=HTTPStatus.BAD_REQUEST,
+                detail="This tab has no outstanding balance to settle.",
+            )
+        amount_over_balance = tab_settlement.amount - tab_balance
+        if amount_over_balance > _tab_settlement_tolerance(tab.get("currency")):
+            raise HTTPException(
+                status_code=HTTPStatus.BAD_REQUEST,
+                detail="Settlement amount cannot exceed the outstanding balance.",
+            )
+        if amount_over_balance > 0:
+            tab_settlement.amount = tab_balance
     currency = tpos.currency if data.pay_in_fiat else "sat"
     amount = data.amount + (data.tip_amount or 0.0)
     if data.pay_in_fiat:
@@ -727,6 +721,8 @@ async def api_tpos_create_invoice(
             "paid_in_fiat": data.pay_in_fiat,
             "base_url": str(request.base_url),
         }
+        if tab_settlement:
+            extra["tab_settlement"] = tab_settlement.dict()
         if cash_method or onchain_method:
             wallet = await get_wallet(tpos.wallet)
             if wallet:

From 36fb3565be60242de0714af27d01d3b7219b4eff Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Tue, 5 May 2026 15:42:40 +0100
Subject: [PATCH 08/11] fix: linting on tests

make tests use real payment
---
 tests/conftest.py  |  35 ++++
 tests/test_tabs.py | 391 ++++++++-------------------------------------
 2 files changed, 103 insertions(+), 323 deletions(-)
 create mode 100644 tests/conftest.py

diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..99e1195
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,35 @@
+import os
+from typing import Any, cast
+
+import pytest_asyncio
+from fastapi import FastAPI
+from httpx import ASGITransport, AsyncClient
+from lnbits.core import migrations as core_migrations  # type: ignore[import]
+from lnbits.core.db import db as core_db
+from lnbits.core.helpers import run_migration
+
+import tpos.migrations as ext_migrations  # type: ignore[import]
+from tpos import tpos_ext  # type: ignore[import]
+from tpos.crud import db  # type: ignore[import]
+
+
+@pytest_asyncio.fixture(scope="session", autouse=True)
+async def init_ext():
+    if os.path.isfile(core_db.path):
+        os.remove(core_db.path)
+    async with core_db.connect() as conn:
+        await run_migration(conn, core_migrations, "core")
+
+    if os.path.isfile(db.path):
+        os.remove(db.path)
+    async with db.connect() as conn:
+        await run_migration(conn, ext_migrations, "tpos")
+
+
+@pytest_asyncio.fixture
+async def client():
+    app = FastAPI()
+    app.include_router(tpos_ext)
+    transport = ASGITransport(app=cast(Any, app))
+    async with AsyncClient(transport=transport, base_url="http://testserver") as client:
+        yield client
diff --git a/tests/test_tabs.py b/tests/test_tabs.py
index 4057d8c..f5b83ed 100644
--- a/tests/test_tabs.py
+++ b/tests/test_tabs.py
@@ -1,340 +1,85 @@
-import json
-from http import HTTPStatus
-from types import SimpleNamespace
+import asyncio
 
 import pytest
-from fastapi import HTTPException
+from httpx import AsyncClient
+from lnbits.core.crud import get_standalone_payment
+from lnbits.core.services import pay_invoice, update_wallet_balance
+from lnbits.core.services.users import create_user_account_no_ckeck
+from lnbits.tasks import internal_invoice_queue
 
-from .. import services, tasks, views_api
-from ..models import (
-    CreateTposTabCharge,
-    CreateTposTabData,
-    Tpos,
-)
+from tpos.crud import get_tpos_payment_by_hash  # type: ignore[import]
+from tpos.tasks import on_invoice_paid  # type: ignore[import]
 
 
-def make_tpos(**overrides) -> Tpos:
-    data = {
-        "id": "tpos-id",
-        "wallet": "wallet-id",
-        "name": "Shop",
-        "currency": "eur",
-        "tax_inclusive": True,
-        "withdraw_time": 0,
-        "withdraw_between": 10,
-        "enable_receipt_print": False,
-        "tabs_enabled": True,
-        "tabs_allow_create": True,
-    }
-    data.update(overrides)
-    return Tpos(**data)
+async def _drain_internal_invoice_queue() -> None:
+    while True:
+        try:
+            internal_invoice_queue.get_nowait()
+        except asyncio.QueueEmpty:
+            return
 
 
 @pytest.mark.asyncio
-async def test_ensure_tpos_tabs_access_requires_enabled():
-    tpos = make_tpos(tabs_enabled=False)
-
-    with pytest.raises(HTTPException) as exc:
-        await services.ensure_tpos_tabs_access(tpos)
-
-    assert exc.value.status_code == HTTPStatus.BAD_REQUEST
-    assert exc.value.detail == "Tabs integration is not enabled for this TPoS."
-
-
-@pytest.mark.asyncio
-async def test_ensure_tpos_tabs_access_checks_extension(monkeypatch):
-    async def fake_owner_user_id(tpos: Tpos) -> str:
-        assert tpos.id == "tpos-id"
-        return "user-id"
-
-    async def fake_tabs_available(user_id: str) -> bool:
-        assert user_id == "user-id"
-        return True
-
-    monkeypatch.setattr(services, "get_tpos_owner_user_id", fake_owner_user_id)
-    monkeypatch.setattr(services, "tabs_available_for_user", fake_tabs_available)
-
-    assert await services.ensure_tpos_tabs_access(make_tpos()) == "user-id"
-
-
-@pytest.mark.asyncio
-async def test_fetch_tabs_for_tpos_filters_sorts_and_limits(monkeypatch):
-    tabs = [
-        {
-            "id": "old",
-            "wallet": "wallet-id",
-            "name": "Old table",
-            "currency": "eur",
-            "status": "open",
-            "updated_at": "2026-01-01T00:00:00Z",
-        },
-        {
-            "id": "new",
-            "wallet": "wallet-id",
-            "name": "Alice",
-            "currency": "eur",
-            "status": "open",
-            "updated_at": "2026-01-02T00:00:00Z",
+async def test_tpos_invoice_can_be_paid_through_api_flow(client: AsyncClient):
+    await _drain_internal_invoice_queue()
+    user = await create_user_account_no_ckeck()
+    wallet = user.wallets[0]
+    headers = {"X-API-KEY": wallet.adminkey}
+
+    create_tpos_response = await client.post(
+        "/tpos/api/v1/tposs",
+        json={
+            "wallet": wallet.id,
+            "name": "Main Bar",
+            "currency": "sats",
+            "business_name": None,
+            "business_address": None,
+            "business_vat_id": None,
         },
-        {
-            "id": "other-wallet",
-            "wallet": "other-wallet",
-            "name": "Alice",
-            "currency": "eur",
-            "status": "open",
-            "updated_at": "2026-01-03T00:00:00Z",
-        },
-        {
-            "id": "closed",
-            "wallet": "wallet-id",
-            "name": "Alice",
-            "currency": "eur",
-            "status": "closed",
-            "updated_at": "2026-01-04T00:00:00Z",
-        },
-    ]
-
-    class FakeResponse:
-        def raise_for_status(self) -> None:
-            return None
-
-        def json(self) -> list[dict]:
-            return tabs
-
-    class FakeClient:
-        async def __aenter__(self):
-            return self
-
-        async def __aexit__(self, *_args):
-            return None
-
-        async def get(self, **kwargs):
-            assert kwargs["headers"]["Authorization"] == "Bearer token"
-            assert kwargs["url"].endswith("/tabs/api/v1/tabs")
-            return FakeResponse()
-
-    monkeypatch.setattr(
-        services,
-        "_create_internal_user_access_token",
-        lambda _: "token",
-    )
-    monkeypatch.setattr(services.httpx, "AsyncClient", FakeClient)
-
-    result = await services.fetch_tabs_for_tpos(
-        user_id="user-id",
-        wallet_id="wallet-id",
-        status="open",
-        query="ali",
-    )
-
-    assert [tab["id"] for tab in result] == ["new"]
-
-
-@pytest.mark.asyncio
-async def test_fetch_tabs_for_tpos_rejects_invalid_status():
-    with pytest.raises(HTTPException) as exc:
-        await services.fetch_tabs_for_tpos(
-            user_id="user-id",
-            wallet_id="wallet-id",
-            status="missing",
-        )
-
-    assert exc.value.status_code == HTTPStatus.BAD_REQUEST
-    assert exc.value.detail == "Invalid tab status filter."
-
-
-@pytest.mark.asyncio
-async def test_api_tpos_create_tab_builds_payload(monkeypatch):
-    calls = {}
-    tpos = make_tpos(currency="EUR")
-
-    async def fake_get_tpos_or_404(tpos_id: str) -> Tpos:
-        assert tpos_id == "tpos-id"
-        return tpos
-
-    async def fake_access(access_tpos: Tpos) -> str:
-        assert access_tpos == tpos
-        return "user-id"
-
-    async def fake_create_tab_for_tpos(user_id: str, payload: dict) -> dict:
-        calls["user_id"] = user_id
-        calls["payload"] = payload
-        return {
-            "id": "tab-id",
-            "name": payload["name"],
-            "customer_name": payload["customer_name"],
-            "reference": payload["reference"],
-            "currency": payload["currency"],
-            "status": "open",
-            "balance": 0,
-            "is_archived": False,
-        }
-
-    monkeypatch.setattr(views_api, "_get_tpos_or_404", fake_get_tpos_or_404)
-    monkeypatch.setattr(views_api, "ensure_tpos_tabs_access", fake_access)
-    monkeypatch.setattr(views_api, "create_tab_for_tpos", fake_create_tab_for_tpos)
-
-    result = await views_api.api_tpos_create_tab(
-        "tpos-id",
-        CreateTposTabData(
-            name="Table 1",
-            customer_name="Alice",
-            reference="A1",
-            currency="eur",
-            limit_type="total",
-            limit_amount=100,
-        ),
+        headers=headers,
     )
+    assert create_tpos_response.status_code == 201
+    tpos = create_tpos_response.json()
 
-    assert result.id == "tab-id"
-    assert calls == {
-        "user_id": "user-id",
-        "payload": {
-            "wallet": "wallet-id",
-            "name": "Table 1",
-            "customer_name": "Alice",
-            "reference": "A1",
-            "currency": "eur",
-            "limit_type": "total",
-            "limit_amount": 100,
-        },
-    }
-
-
-@pytest.mark.asyncio
-async def test_api_tpos_create_tab_rejects_currency_mismatch(monkeypatch):
-    async def fake_get_tpos_or_404(_tpos_id: str) -> Tpos:
-        return make_tpos(currency="eur")
-
-    monkeypatch.setattr(views_api, "_get_tpos_or_404", fake_get_tpos_or_404)
-
-    async def fake_access(_tpos: Tpos) -> str:
-        return "user-id"
-
-    monkeypatch.setattr(views_api, "ensure_tpos_tabs_access", fake_access)
-
-    with pytest.raises(HTTPException) as exc:
-        await views_api.api_tpos_create_tab(
-            "tpos-id",
-            CreateTposTabData(name="Table 1", currency="usd"),
-        )
-
-    assert exc.value.status_code == HTTPStatus.BAD_REQUEST
-    assert exc.value.detail == "Tab currency must match TPoS currency."
-
-
-@pytest.mark.asyncio
-async def test_api_tpos_add_tab_charge_checks_currency_and_payload(monkeypatch):
-    calls = {}
-    tpos = make_tpos(currency="eur")
-
-    async def fake_get_tpos_or_404(_tpos_id: str) -> Tpos:
-        return tpos
-
-    async def fake_access(_tpos: Tpos) -> str:
-        return "user-id"
-
-    async def fake_fetch_tab(user_id: str, tab_id: str) -> dict:
-        assert user_id == "user-id"
-        assert tab_id == "tab-id"
-        return {
-            "id": "tab-id",
-            "name": "Table 1",
-            "currency": "eur",
-            "status": "open",
-            "balance": 12,
-            "is_archived": False,
-        }
-
-    async def fake_create_charge(user_id: str, tab_id: str, payload: dict) -> dict:
-        calls["user_id"] = user_id
-        calls["tab_id"] = tab_id
-        calls["payload"] = payload
-        return {"id": "entry-id"}
-
-    monkeypatch.setattr(views_api, "_get_tpos_or_404", fake_get_tpos_or_404)
-    monkeypatch.setattr(views_api, "ensure_tpos_tabs_access", fake_access)
-    monkeypatch.setattr(views_api, "fetch_single_tab_for_tpos", fake_fetch_tab)
-    monkeypatch.setattr(views_api, "create_tab_charge_for_tpos", fake_create_charge)
-
-    result = await views_api.api_tpos_add_tab_charge(
-        "tpos-id",
-        "tab-id",
-        CreateTposTabCharge(
-            amount=12.5,
-            description="Lunch",
-            items=[{"title": "Coffee"}],
-            notes={"table": 1},
-            internal_memo="memo",
-            idempotency_key="charge-key",
-        ),
+    invoice_response = await client.post(
+        f"/tpos/api/v1/tposs/{tpos['id']}/invoices",
+        json={"amount": 21, "memo": "Table 4"},
     )
-
-    assert result["entry"] == {"id": "entry-id"}
-    assert result["tab"]["id"] == "tab-id"
-    payload = calls["payload"]
-    assert calls["user_id"] == "user-id"
-    assert calls["tab_id"] == "tab-id"
-    assert payload["entry_type"] == "charge"
-    assert payload["amount"] == 12.5
-    assert payload["description"] == "Lunch"
-    assert payload["idempotency_key"] == "charge-key"
-    metadata = json.loads(payload["metadata"])
-    assert metadata["source"] == "tpos"
-    assert metadata["tpos_id"] == "tpos-id"
-    assert metadata["items"] == [{"title": "Coffee"}]
-
-
-@pytest.mark.asyncio
-async def test_maybe_settle_tab_builds_paid_settlement_payload(monkeypatch):
-    calls = {}
-    tpos = make_tpos(currency="eur")
-    payment = SimpleNamespace(
-        extra={
-            "tab_settlement": {
-                "tab_id": "tab-id",
-                "amount": 20,
-                "reference": "invoice-1",
-                "description": "Paid",
-                "idempotency_key": "settle-key",
-            },
-            "fiat_method": "terminal",
-        },
-        payment_hash="payment-hash",
+    assert invoice_response.status_code == 201
+    invoice = invoice_response.json()
+    assert invoice["payment_hash"]
+    assert invoice["bolt11"]
+    assert invoice["payment_request"].startswith("lightning:")
+
+    check_response = await client.get(
+        f"/tpos/api/v1/tposs/{tpos['id']}/invoices/{invoice['payment_hash']}"
     )
+    assert check_response.status_code == 200
+    assert check_response.json() == {"paid": False}
 
-    async def fake_access(access_tpos: Tpos) -> str:
-        assert access_tpos == tpos
-        return "user-id"
+    await update_wallet_balance(wallet, 100)
+    await _drain_internal_invoice_queue()
+    await pay_invoice(wallet_id=wallet.id, payment_request=invoice["bolt11"])
+    await _drain_internal_invoice_queue()
 
-    async def fake_create_settlement(user_id: str, tab_id: str, payload: dict) -> dict:
-        calls["user_id"] = user_id
-        calls["tab_id"] = tab_id
-        calls["payload"] = payload
-        return {"id": "settlement-id"}
+    payment = await get_standalone_payment(invoice["payment_hash"], incoming=True)
+    assert payment is not None
+    await on_invoice_paid(payment)
 
-    monkeypatch.setattr(
-        tasks,
-        "ensure_tpos_tabs_access",
-        fake_access,
+    paid_response = await client.get(
+        f"/tpos/api/v1/tposs/{tpos['id']}/invoices/{invoice['payment_hash']}"
     )
-    monkeypatch.setattr(
-        tasks,
-        "create_tab_settlement_for_tpos",
-        fake_create_settlement,
-    )
-
-    await tasks.maybe_settle_tab(payment, tpos, "fiat")
-
-    payload = calls["payload"]
-    assert calls["user_id"] == "user-id"
-    assert calls["tab_id"] == "tab-id"
-    assert payload["amount"] == 20
-    assert payload["method"] == "card"
-    assert payload["reference"] == "invoice-1"
-    assert payload["description"] == "Paid"
-    assert payload["idempotency_key"] == "settle-key"
-    metadata = json.loads(payload["metadata"])
-    assert metadata["source"] == "tpos"
-    assert metadata["source_action"] == "settlement_paid"
-    assert metadata["payment_hash"] == "payment-hash"
+    assert paid_response.status_code == 200
+    assert paid_response.json() == {"paid": True}
+
+    tpos_payment = await get_tpos_payment_by_hash(invoice["payment_hash"])
+    assert tpos_payment is not None
+    assert tpos_payment.paid is True
+    assert tpos_payment.payment_method == "lightning"
+
+    latest_response = await client.get(f"/tpos/api/v1/tposs/{tpos['id']}/invoices")
+    assert latest_response.status_code == 200
+    latest = latest_response.json()
+    assert len(latest) == 1
+    assert latest[0]["pending"] is False
+    assert latest[0]["payment_method"] == "lightning"

From b37398e8c152d0820ee50d3d30b475590c201390 Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Tue, 5 May 2026 15:43:02 +0100
Subject: [PATCH 09/11] fix: deprecated uv dev depencies

---
 pyproject.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 3a8e9f5..d3c5420 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,8 +7,8 @@ authors = [{ name = "Alan Bits", email = "alan@lnbits.com" }]
 urls = { Homepage = "https://lnbits.com", Repository = "https://github.com/lnbits/tpos" }
 dependencies = [ "lnbits>1" ]
 
-[tool.uv]
-dev-dependencies = [
+[dependency-groups]
+dev = [
     "black",
     "pytest-asyncio",
     "pytest",

From aa05fabf0e6c95d140f3ab6ac32cd585123a1f42 Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Tue, 5 May 2026 16:02:52 +0100
Subject: [PATCH 10/11] more tests

---
 tests/conftest.py |  32 +++++-
 tests/test_api.py | 280 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 311 insertions(+), 1 deletion(-)
 create mode 100644 tests/test_api.py

diff --git a/tests/conftest.py b/tests/conftest.py
index 99e1195..58304de 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -2,13 +2,20 @@
 from typing import Any, cast
 
 import pytest_asyncio
+import tabs.migrations as tabs_migrations  # type: ignore[import]
 from fastapi import FastAPI
 from httpx import ASGITransport, AsyncClient
 from lnbits.core import migrations as core_migrations  # type: ignore[import]
+from lnbits.core.crud.extensions import create_installed_extension
 from lnbits.core.db import db as core_db
 from lnbits.core.helpers import run_migration
+from lnbits.core.models.extensions import InstallableExtension
+from lnbits.settings import settings
+from tabs import tabs_ext  # type: ignore[import]
+from tabs.crud import db as tabs_db  # type: ignore[import]
 
 import tpos.migrations as ext_migrations  # type: ignore[import]
+import tpos.services as tpos_services  # type: ignore[import]
 from tpos import tpos_ext  # type: ignore[import]
 from tpos.crud import db  # type: ignore[import]
 
@@ -19,17 +26,40 @@ async def init_ext():
         os.remove(core_db.path)
     async with core_db.connect() as conn:
         await run_migration(conn, core_migrations, "core")
+        await create_installed_extension(
+            InstallableExtension(
+                id="tabs",
+                name="Tabs",
+                version="0.0.0",
+                active=True,
+            ),
+            conn=conn,
+        )
+    settings.lnbits_installed_extensions_ids.add("tabs")
 
     if os.path.isfile(db.path):
         os.remove(db.path)
     async with db.connect() as conn:
         await run_migration(conn, ext_migrations, "tpos")
 
+    if os.path.isfile(tabs_db.path):
+        os.remove(tabs_db.path)
+    async with tabs_db.connect() as conn:
+        await run_migration(conn, tabs_migrations, "tabs")
+
 
 @pytest_asyncio.fixture
-async def client():
+async def client(monkeypatch):
     app = FastAPI()
     app.include_router(tpos_ext)
+    app.include_router(tabs_ext)
     transport = ASGITransport(app=cast(Any, app))
+
+    def app_client(*args, **kwargs):
+        kwargs["transport"] = transport
+        kwargs.setdefault("base_url", "http://testserver")
+        return AsyncClient(*args, **kwargs)
+
+    monkeypatch.setattr(tpos_services.httpx, "AsyncClient", app_client)
     async with AsyncClient(transport=transport, base_url="http://testserver") as client:
         yield client
diff --git a/tests/test_api.py b/tests/test_api.py
new file mode 100644
index 0000000..3559d22
--- /dev/null
+++ b/tests/test_api.py
@@ -0,0 +1,280 @@
+import asyncio
+import json
+from uuid import uuid4
+
+import pytest
+from httpx import AsyncClient
+from lnbits.core.crud import get_standalone_payment
+from lnbits.core.models.users import Account
+from lnbits.core.services import pay_invoice, update_wallet_balance
+from lnbits.core.services.users import create_user_account_no_ckeck
+from lnbits.settings import settings
+from lnbits.tasks import internal_invoice_queue
+from tabs.crud import (  # type: ignore[import]
+    get_tab_by_id,
+    get_tab_entries,
+    get_tab_settlements,
+)
+
+from tpos.crud import get_tpos, get_tpos_payment_by_hash  # type: ignore[import]
+from tpos.tasks import on_invoice_paid  # type: ignore[import]
+
+
+def _tpos_payload(**overrides):
+    payload = {
+        "wallet": None,
+        "name": "Main TPoS",
+        "currency": "sats",
+        "business_name": "Main Shop",
+        "business_address": "1 Market Street",
+        "business_vat_id": "VAT123",
+        "tip_options": "[]",
+        "tip_wallet": "",
+        "withdraw_between": 1,
+        "withdraw_limit": 100,
+        "withdraw_time_option": "secs",
+        "enable_receipt_print": True,
+        "enable_remote": True,
+    }
+    payload.update(overrides)
+    return payload
+
+
+async def _user_with_tabs(username: str = "tposuser"):
+    account = Account(id=uuid4().hex, username=username)
+    user = await create_user_account_no_ckeck(account=account, default_exts=["tabs"])
+    return user, user.wallets[0]
+
+
+async def _drain_internal_invoice_queue() -> None:
+    while True:
+        try:
+            internal_invoice_queue.get_nowait()
+        except asyncio.QueueEmpty:
+            return
+
+
+@pytest.mark.asyncio
+async def test_tpos_crud_settings_and_wrapper_token(client: AsyncClient):
+    user, wallet = await _user_with_tabs()
+    settings.super_user = user.id
+    headers = {"X-API-KEY": wallet.adminkey}
+
+    listed_empty = await client.get("/tpos/api/v1/tposs", headers=headers)
+    assert listed_empty.status_code == 200
+    assert listed_empty.json() == []
+
+    create = await client.post(
+        "/tpos/api/v1/tposs",
+        json=_tpos_payload(currency="EUR", allow_cash_settlement=True),
+        headers=headers,
+    )
+    assert create.status_code == 201
+    tpos = create.json()
+    assert tpos["wallet"] == wallet.id
+    assert tpos["allow_cash_settlement"] is True
+
+    listed = await client.get("/tpos/api/v1/tposs?all_wallets=true", headers=headers)
+    assert listed.status_code == 200
+    assert [item["id"] for item in listed.json()] == [tpos["id"]]
+
+    update = await client.put(
+        f"/tpos/api/v1/tposs/{tpos['id']}",
+        json=_tpos_payload(
+            name="Updated TPoS",
+            currency="EUR",
+            allow_cash_settlement=True,
+            tabs_enabled=True,
+            tabs_allow_create=True,
+            inventory_tags=["coffee", "tea"],
+            inventory_omit_tags=["hidden"],
+        ),
+        headers=headers,
+    )
+    assert update.status_code == 200
+    updated = update.json()
+    assert updated["name"] == "Updated TPoS"
+    assert updated["tabs_enabled"] is True
+    assert updated["tabs_allow_create"] is True
+    assert updated["inventory_tags"] == "coffee,tea"
+
+    token = await client.post(
+        f"/tpos/api/v1/tposs/{tpos['id']}/wrapper-token", headers=headers
+    )
+    assert token.status_code == 200
+    assert token.json()["auth"]
+    assert token.json()["expiration_time_minutes"] > 500_000
+
+    items = await client.put(
+        f"/tpos/api/v1/tposs/{tpos['id']}/items",
+        json={
+            "items": [
+                {
+                    "image": None,
+                    "price": 2.5,
+                    "title": "Coffee",
+                    "description": "Hot",
+                    "tax": 10,
+                    "disabled": False,
+                    "categories": ["coffee"],
+                }
+            ]
+        },
+        headers=headers,
+    )
+    assert items.status_code == 201
+    assert json.loads(items.json()["items"])[0]["title"] == "Coffee"
+
+    delete = await client.delete(f"/tpos/api/v1/tposs/{tpos['id']}", headers=headers)
+    assert delete.status_code == 200
+    assert await get_tpos(tpos["id"]) is None
+
+
+@pytest.mark.asyncio
+async def test_tabs_endpoints_use_real_tabs_api(client: AsyncClient):
+    _user, wallet = await _user_with_tabs("tabsuser")
+    headers = {"X-API-KEY": wallet.adminkey}
+
+    create = await client.post(
+        "/tpos/api/v1/tposs",
+        json=_tpos_payload(tabs_enabled=True, tabs_allow_create=True),
+        headers=headers,
+    )
+    assert create.status_code == 201
+    tpos = create.json()
+
+    create_tab = await client.post(
+        f"/tpos/api/v1/tposs/{tpos['id']}/tabs",
+        json={
+            "name": "Patio",
+            "customer_name": "Alice",
+            "reference": "Table 7",
+        },
+    )
+    assert create_tab.status_code == 200
+    tab = create_tab.json()
+    assert tab["name"] == "Patio"
+    assert tab["currency"] == "sats"
+
+    tabs = await client.get(f"/tpos/api/v1/tposs/{tpos['id']}/tabs?status=open")
+    assert tabs.status_code == 200
+    assert [item["id"] for item in tabs.json()["data"]] == [tab["id"]]
+
+    charge = await client.post(
+        f"/tpos/api/v1/tposs/{tpos['id']}/tabs/{tab['id']}/charges",
+        json={
+            "amount": 25000,
+            "description": "Drinks",
+            "items": [{"title": "Coffee", "quantity": 2, "price": 12500}],
+            "idempotency_key": "tpos-charge-1",
+        },
+    )
+    assert charge.status_code == 200
+    charge_payload = charge.json()
+    assert charge_payload["entry"]["entry_type"] == "charge"
+    assert charge_payload["entry"]["amount"] == 25000
+    assert charge_payload["tab"]["balance"] == 25000
+
+    entries = await get_tab_entries(tab["id"])
+    assert len(entries) == 1
+    assert entries[0].source == "tpos"
+
+
+@pytest.mark.asyncio
+async def test_paid_tpos_invoice_settles_tab_via_real_tabs_api(client: AsyncClient):
+    await _drain_internal_invoice_queue()
+    _user, wallet = await _user_with_tabs("settlementuser")
+    headers = {"X-API-KEY": wallet.adminkey}
+
+    create = await client.post(
+        "/tpos/api/v1/tposs",
+        json=_tpos_payload(tabs_enabled=True, tabs_allow_create=True),
+        headers=headers,
+    )
+    tpos = create.json()
+    create_tab = await client.post(
+        f"/tpos/api/v1/tposs/{tpos['id']}/tabs",
+        json={"name": "Counter"},
+    )
+    tab = create_tab.json()
+    charge = await client.post(
+        f"/tpos/api/v1/tposs/{tpos['id']}/tabs/{tab['id']}/charges",
+        json={
+            "amount": 21,
+            "description": "Cake",
+            "idempotency_key": "tpos-charge-settlement",
+        },
+    )
+    assert charge.status_code == 200
+
+    invoice_response = await client.post(
+        f"/tpos/api/v1/tposs/{tpos['id']}/invoices",
+        json={
+            "amount": 21,
+            "memo": "Settle tab",
+            "tab_settlement": {
+                "tab_id": tab["id"],
+                "amount": 21,
+                "reference": "counter-close",
+                "description": "TPoS settlement",
+                "idempotency_key": "tpos-settlement-1",
+            },
+        },
+    )
+    assert invoice_response.status_code == 201
+    invoice = invoice_response.json()
+
+    await update_wallet_balance(wallet, 100)
+    await _drain_internal_invoice_queue()
+    await pay_invoice(wallet_id=wallet.id, payment_request=invoice["bolt11"])
+    await _drain_internal_invoice_queue()
+
+    payment = await get_standalone_payment(invoice["payment_hash"], incoming=True)
+    assert payment is not None
+    await on_invoice_paid(payment)
+
+    tpos_payment = await get_tpos_payment_by_hash(invoice["payment_hash"])
+    assert tpos_payment is not None
+    assert tpos_payment.paid is True
+
+    settled_tab = await get_tab_by_id(tab["id"])
+    assert settled_tab is not None
+    assert settled_tab.balance == 0
+    assert settled_tab.status == "closed"
+
+    settlements = await get_tab_settlements(tab["id"])
+    assert len(settlements) == 1
+    assert settlements[0].status == "completed"
+    assert settlements[0].method == "other"
+    assert settlements[0].idempotency_key == "tpos-settlement-1"
+
+
+@pytest.mark.asyncio
+async def test_tpos_rejects_invalid_tab_flows(client: AsyncClient):
+    _user, wallet = await _user_with_tabs("invalidtabsuser")
+    headers = {"X-API-KEY": wallet.adminkey}
+
+    create = await client.post(
+        "/tpos/api/v1/tposs",
+        json=_tpos_payload(tabs_enabled=False, tabs_allow_create=True),
+        headers=headers,
+    )
+    assert create.status_code == 201
+    tpos = create.json()
+    assert tpos["tabs_allow_create"] is False
+
+    tabs_disabled = await client.get(f"/tpos/api/v1/tposs/{tpos['id']}/tabs")
+    assert tabs_disabled.status_code == 400
+
+    update = await client.put(
+        f"/tpos/api/v1/tposs/{tpos['id']}",
+        json=_tpos_payload(tabs_enabled=True, tabs_allow_create=False),
+        headers=headers,
+    )
+    assert update.status_code == 200
+
+    create_denied = await client.post(
+        f"/tpos/api/v1/tposs/{tpos['id']}/tabs",
+        json={"name": "Denied"},
+    )
+    assert create_denied.status_code == 403

From 38974e5ba2754bf2d51143e5e7f8f084a96e8e5a Mon Sep 17 00:00:00 2001
From: Tiago Vasconcelos <talvasconcelos@gmail.com>
Date: Tue, 5 May 2026 16:03:36 +0100
Subject: [PATCH 11/11] fix: null `wallet` could break tpos on PUT

---
 views_api.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/views_api.py b/views_api.py
index 6cf5fe0..e0e00ec 100644
--- a/views_api.py
+++ b/views_api.py
@@ -465,6 +465,7 @@ async def api_tpos_update(
         raise HTTPException(status_code=HTTPStatus.FORBIDDEN, detail="Not your TPoS.")
     user = await get_user(wallet.wallet.user)
     update_payload = data.dict(exclude_unset=True)
+    update_payload.pop("wallet", None)
     desired_onchain_enabled = update_payload.get(
         "onchain_enabled", tpos.onchain_enabled
     )