WhatsOrder
WhatsOrder is a lightweight, multi-country WhatsApp ordering and order management system for small restaurants in the UAE and India.
It does not replace WhatsApp. It gives restaurants a public menu link, structured checkout, click-to-WhatsApp order messages, order tracking, customer history, and simple analytics.
Current Pilot
- Restaurant: Chai Xpress
- Slug:
chaixpress
- Public menu URL:
/r/chaixpress
- Location: Al Rawda 3, Ajman, UAE
- Currency: AED
The app remains multi-restaurant ready because every restaurant-owned table includes restaurant_id.
Country Profiles
Each restaurant is onboarded with one immutable country profile. The profile is
used by customer, staff, reporting, printing, and database flows:
- UAE: AED,
en-AE, Asia/Dubai, calling code 971, Cash/Card.
- India: INR,
en-IN, Asia/Kolkata, calling code 91, Cash/Card/UPI.
Country is fixed after onboarding so historical prices, reports, and normalized
customer phone numbers cannot be silently reinterpreted. Tenant data isolation,
server-side repricing, and service-role-only writes are unchanged.
Tech Stack
- Next.js App Router
- TypeScript
- Tailwind CSS
- Supabase
- Vercel
- PWA-friendly metadata and manifest
Core Flow
- Customer opens
/r/chaixpress.
- Customer adds menu items to cart.
- Customer enters contact, delivery, payment, and consent details.
- Customer can optionally share current location, generating a Google Maps delivery link.
- Order and customer totals are saved atomically to Supabase with status
New.
- WhatsOrder generates a structured WhatsApp message.
- WhatsApp opens with the restaurant number and encoded order message.
- Restaurant staff manage the order in
/admin.
Local Setup
Use Node.js 20.9 or newer.
nvm use
npm install
cp .env.example .env.local
npm run dev
Open:
- Landing page:
http://localhost:3000
- Chai Xpress menu:
http://localhost:3000/r/chaixpress
- Admin dashboard:
http://localhost:3000/admin
- Restaurant admin login:
http://localhost:3000/admin-login
- Super Admin login:
http://localhost:3000/super-admin/login
Environment Variables
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
SUPABASE_SERVICE_ROLE_KEY=
NEXT_PUBLIC_DEFAULT_RESTAURANT_SLUG=chaixpress
NEXT_PUBLIC_DEMO_WHATSAPP_NUMBER=971551150068
NEXT_PUBLIC_APP_URL=http://localhost:3000
ENABLE_DEMO_DATA=false
Use SUPABASE_SERVICE_ROLE_KEY only on the server. Never expose it in browser code, screenshots, or client-side environment variables.
Supabase
Run the schema and migrations in this order:
supabase/schema.sql
supabase/customer_profile_loyalty_migration.sql
supabase/super_admin_migration.sql
supabase/security_hardening_migration.sql
supabase/fulfilment_options_migration.sql
supabase/arabic_menu_fields_migration.sql
supabase/customer_feedback_migration.sql
supabase/dine_in_migration.sql
supabase/new_order_realtime_migration.sql
supabase/menu_offers_migration.sql
supabase/pilot_launch_hardening_migration.sql
supabase/20260620_lock_down_public_order_creation.sql
supabase/20260620_p1_pilot_operations.sql
supabase/migrations/*.sql (all files, in filename order)
Security checkpoints within that ordered directory include:
supabase/migrations/20260620162000_p0_2b_enforce_public_restaurant_projection.sql
supabase/migrations/20260620163000_p0_3_least_privilege_rls.sql
supabase/migrations/20260620163100_p0_3_allow_public_policy_helpers.sql
supabase/migrations/20260713000000_security_and_reliability_fixes.sql
More setup details are in SUPABASE_SETUP.md.
For an existing Supabase project, do not rerun schema.sql merely because the
application code changed. Apply only migrations that have not already been run,
in the order shown above. The timestamped migration directory is a single
ordered sequence; do not skip feature migrations between security migrations.
Super Admin
The protected Super Admin area supports multi-restaurant setup, onboarding, plans, QR codes, and
portfolio-level reporting. Run supabase/super_admin_migration.sql, create a Supabase Auth user,
and promote its profile to super_admin.
Restaurant owners, managers, and staff use the shared /admin-login endpoint. Their assigned
restaurant is resolved from restaurant_users, so each account sees only its own dashboard data.
See SUPER_ADMIN_SETUP.md for the complete setup and security notes.
Delivery Location
Checkout supports optional browser geolocation and manual address entry. See LOCATION_FEATURE.md for stored fields, Google Maps URL generation, and future Google Places ideas.
Customer Profiles and Loyalty
Admins can view customer order history, and completed orders can award future-ready loyalty points.
Public saved-address lookup is disabled because a phone number alone is not sufficient identity
verification. It should only return after customer OTP or account authentication is added. See
CUSTOMER_PROFILE_AND_LOYALTY.md.
Daily Coach
The daily recap uses completed orders to compare each open trading period with
the same weekday over the previous four weeks. It ranks up to three actions from
period demand, basket size, cancellations, repeat customers, consent-aware
contact capture, fulfilment and privacy-thresholded delivery areas. The concise
recap is suitable for WhatsApp; the admin dashboard can expand every period.
Recommendations are deterministic and tenant-scoped. AI is not allowed to
alter counts, money, consent rules or location claims.
Menu Images
Restaurant staff can upload optional menu item images from their phone or laptop through Supabase Storage. See MENU_IMAGE_UPLOAD.md.
Deployment
The recommended deployment is:
- GitHub for source control
- Vercel for hosting
- Supabase for database and future image storage
See DEPLOYMENT.md.
Pilot Testing
Use PILOT_TESTING.md to test the live flow with Chai Xpress staff and customers.
Commands
npm run lint
npm run typecheck
npm run build
Current feature scope
Included:
-
Multi-restaurant data model
-
Public restaurant menu route
-
Cart and checkout
-
Delivery, takeaway, Bring to My Car, and table-aware Dine In fulfilment
-
Bilingual, swipeable promotional offers linked to server-validated menu pricing
-
Verified completed-order feedback with restaurant moderation
-
Optional customer location capture
-
Restaurant-side customer history
-
Consent capture
-
Click-to-WhatsApp
-
Supabase order persistence
-
Customer creation/update by phone number
-
Loyalty points foundation for completed orders
-
Admin orders, menu, customers, settings, and analytics
-
WhatsApp Cloud API and a separate QR-linked WhatsApp Web connector
-
AI receptionist and human handoff
-
Staff offline order queue, shifts, payment reconciliation, and printing
-
Saved-order confirmation and WhatsApp resend
-
Subscription administration, jobs, and demo onboarding
-
Background order notifications and owner daily recaps (transport configuration required)
Not included:
- Marketplace
- Payment gateway
- Delivery fleet
Payment collection records cash/card/UPI; it does not process online payments. See delivery rollout for notification scheduling, delivery status, and release checks.
