u

src/v1/middleware/posAuth.js

@@ -57,6 +57,11 @@ export async function posAuthMiddleware(req, res, next) {
             return res.status(401).json({ Message: 'Authorization has been denied for this request.' });
         }
 
+        if (terminal.enabled === 0 || terminal.enabled === false) {
+            console.log(chalk.yellow(`  [posAuth] Terminal "${terminal.id}" is disabled`));
+            return res.status(403).json({ Message: 'Authorization has been denied for this request.' });
+        }
+
         req.posterminal = terminal;
         db.touchLastseen(terminal.id).catch((err) => {
             console.error('Failed to touch lastseen for posterminal:', err);

src/v1/routes/client.js

@@ -83,6 +83,13 @@ export function buildClientStep2(authCode, config) {
  *           type: string
  *         description: Client device name or serial identifier (default 'JTL-POS')
  *         example: "Kasse 1"
+ *       - in: query
+ *         name: clientversion
+ *         required: false
+ *         schema:
+ *           type: string
+ *         description: Optional client app version (for future POS clients during pairing)
+ *         example: "1.10.12.0"
  *     responses:
  *       200:
  *         description: Discovery or pairing successful
@@ -160,11 +167,13 @@ export async function handleClient(req, res) {
                 const token = terminal.token;
                 const strToken = String(token || crypto.randomBytes(16).toString('hex')).trim();
                 const pairedAt = serverTimestamp();
+                const clientversion = req.query.clientversion || req.query.version || req.query.clientVersion || null;
 
                 await db.pair(terminal.id, {
                     token: strToken,
                     clientserial: name,
                     pairedAt,
+                    clientversion: clientversion ? String(clientversion).trim() : null,
                 });
 
                 if (terminal.companyId) {