taler-docs

commit 3c6d0b8536e21287d1333986743e282277a66995
parent b80321f7a9f34b27ab3fc721b64c84bd5448d6d3
Author: bohdan-potuzhnyi <bohdan.potuzhnyi@gmail.com>
Date:   Tue, 18 Aug 2026 15:25:20 +0200

dd96 + bump of permissions for the order-pos

Diffstat:
M
core/api-merchant.rst
 | 
11
++++++-----
M
core/merchant/post-private-orders-ORDER_ID-refund-external.rst
 | 
7
++++---
M
design-documents/096-partial-payments.rst
 | 
5
++++-

3 files changed, 14 insertions(+), 9 deletions(-)
diff --git a/core/api-merchant.rst b/core/api-merchant.rst
@@ -398,9 +398,10 @@ and the permissions they grant are:
     - Allows the creation of orders and checking of payment status.
       @since **v19**
   * - ``order-pos``
-    - ``orders-read``, ``orders-write``, ``pos-read``, ``products-lock``
-    - Same as ``order-simple``, plus reading the point-of-sale configuration
-      and inventory locking.  @since **v19**
+    - ``orders-read``, ``orders-write``, ``pos-read``, ``products-lock``,
+      ``products-read``
+    - Same as ``order-simple`` and allows inventory locking (@since **v19**),
+      and ``products-read`` since **v32**.
   * - ``order-mgmt``
     - ``orders-read``, ``orders-write``, ``pos-read``, ``orders-refund``
     - Same as ``order-simple``, plus reading the point-of-sale configuration
@@ -1811,8 +1812,8 @@ Orders
 
     interface ExternalPaymentInfo {
       // External payment method, for example "cash" or "card".
-      // Must be a stable, non-empty ASCII identifier and must
-      // never be "taler".
+      // Must be a stable, non-empty identifier of ASCII
+      // alphanumerics and "-", and must never be "taler".
       method: string;
 
       // Identifier of the payment action within the order, unique
diff --git a/core/merchant/post-private-orders-ORDER_ID-refund-external.rst b/core/merchant/post-private-orders-ORDER_ID-refund-external.rst
@@ -46,7 +46,8 @@
     refund.
   :http:statuscode:`400 Bad Request`:
     The request body is malformed, for example the ``method`` is empty,
-    is ``taler``, contains non-ASCII characters, or the ``id`` is empty.
+    is ``taler``, contains characters other than ASCII alphanumerics
+    and ``-``, or the ``id`` is empty.
     Returned with ``TALER_EC_GENERIC_PARAMETER_MALFORMED``.
   :http:statuscode:`401 Unauthorized`:
     The request is unauthorized.
@@ -83,8 +84,8 @@
     interface ExternalRefundRequest {
       // Method by which the funds were returned to the customer,
       // for example "cash" or "card". May differ from the methods used
-      // to pay the order. Must be a stable, non-empty ASCII identifier
-      // and must never be "taler".
+      // to pay the order. Must be a stable, non-empty identifier of
+      // ASCII alphanumerics and "-", and must never be "taler".
       method: string;
 
       // Identifier of this refund within the order, chosen by the
diff --git a/design-documents/096-partial-payments.rst b/design-documents/096-partial-payments.rst
@@ -183,7 +183,10 @@ The initial reserved method name is:
 * ``cash`` for cash accepted by the merchant or cashier
 
 For now, payment method names are not centrally registered. Integrations may
-use any stable ASCII identifier.
+use any stable identifier consisting of ASCII alphanumerics and ``-`` (as in
+``credit-card``). The restriction is deliberately tight: it can be relaxed
+later without invalidating names already recorded by merchants, whereas
+tightening it later could not.
 
 The name ``taler`` is reserved and must not be used in ``amount_external``.
 Taler is represented by the existing ``amount`` field.