stustapay / stustapay

Electronic Payment System for Events using NFC Wristbands

StuStaPay

Electronic Payment System for Festivals, developed for StuStaCulum

Use NFC wristbands to quickly pay at events!

Idea

• Free software digital payment system for festivals
• Every user has a NFC chip (in their wristband)
• Users can top up their credit via Cash, card or online payment services
• They can buy products at points of sales, where their credits are deduced
• Designed to comply with German fiscal laws (digital signatures with TSE)

Documentation

Components

Core

All transactions go through the core.

It provides library functions to process changes in the database.

The database ensures transaction-safe handling of the payment processing logic. It's the source of truth for account funds, order processing and offered products.

Terminalserver

API contacted by point of sale terminal requests, uses features from the core.

Administration

API contacted by the management interface, uses features from the core.

TSE signatures

All transactions need to be signed by a federally approved security module (as defined by Kassensicherungsverordnung - KassenSichV)

App

• Operated at points of sale
• Is connected via HTTP calls to StuStaPay core
• Registers customer's orders
• Can scan and validate NFC tags

Webapps

Each one runs on separate Python webserver, which talks to the core database.

Administration site

Configuration of products, cash desks, accounts, ...

User Self Service Portal

• Top up account with online payment
• Get payment receipts
• Pay back money after the event

Tech stack

Core

• Python
• PostgreSQL DB
• asyncpg
• FastAPI
• uvicorn

TSE integration

• TSE hardware module

Ordering Terminal

• Android telephone with NFC reader
• Kotlin
• jetpack compose

Webapps for Management and User Self-Service

• react
• nodejs

License

Released under the GNU Affero General Public License version 3 or later, see authors and license for details.

stustapay's Issues

I'm struggling to run for tests...

I'm very interested on this project, had the same idea and your project seems wonderful. But i'm having dificulties on setting this up. My plan is to run on a Raspberry Pi4. I saw that on github workflows ci.yml, it is said something about ubuntu. Is this needed to run ubuntu tho? If you could tell about how to setup properly the server would be great! Thanks in advance! o/

fix highlighting of links in navigation bar for sub routes

add option to set events as archived / read only

• take the customer portal url into account, either null it or allow the same customer portal url for multiple archived events -> probably easier to null it
• take into account for tse control server
• take into account for bon generator

add screen to view node revenue statistics in app

• statistics should be viewable when the logged in user has the privilege node_statistics
• statistics should only be viewable for the node of the current till

Problem with stustapay db add-data

Tell me please why "stustapay db add-data" gives an error message?

this is right after:
stustapay db rebuild

Obviously the problem is in NODE-ID. It is related to the secret key.

Creating a Fresh Install with clean Database

hello I have managed to get the service up and running using some of the test DB

I have the following questions ??

how can I set up administrative access to avoid cluttering the database with test information."

"Why are these fields needed? What data should be there?
secret_key: "very secret"
sumup_affiliate_key: "pretty secret"

I want to create a clean install with no test data

thank you for all your help

Problem with edit User and tag

Good afternoon

1. There is nothing written in the logs about the error.
   Please explain, there is a problem with editing users
   
   I have this problem
   

the project was assembled by npx nx build administration

But i found how can i resolve this:

1. i can edit roles
   
2. after that i already can edit and users
   

2. I have tag, I added it to the db after that created a user with this UID
   

But when i try to check it (I bring the tag to the android with app), nothing happens

What could be the problem?

Error when Accessing Customer Panel - "Currency code is required with currency style"

Hi team,

Firstly, I want to say that I'm enjoying using StustaPay. It seems like a fantastic solution so far! However, I encountered an issue when trying to access the customer panel. After entering the PIN, I receive the following error message:

Oops!
Sorry, an unexpected error has occurred.
Currency code is required with currency style.

I'm not sure if I've missed something during the installation process or if there's a setting I've overlooked. Could you please assist me in resolving this issue?

Thank you in advance for your help!

Best regards,
MineTech13 | Nils Z.

Installation

I'm trying to install by following the documentation https://stustapay.de/docs/administrator-documentation/installation.
At the first step: sudo apt install ./stustapay_+bookworm1_amd64.deb, what am I supposed to put in to replace ? When I'm heading over to the release page, It's empty.

Can someone help me with this?
Many thanks!

Terminal configuration

Good afternoon, I have a question about terminal I don't understand how to test it.

Because when you open it, it says the error "no terminal configuration"
There is a scanner in the settings, the configuration is loaded through it, as far as I understand.
But where to get this particular setting?
Or can make it download automatically, but I need "core_url" and "registration_uuid"
But I also don’t understand where i can get them

add system overview page at root node

• status of bon generator
• status of tses

Installation Guide

Hello, congratulations on the project!
Do you have any installation guide?
Thanks

increase test coverage in core

Mifare DESFire EV 1/2/3 compatibility

Would be great to have compatibility with DESFire

Can I haz GNU Taler support?

Dear Stustapay developers,

First off: Kudos to this great piece of software. I used it at last year's Stustaculum and it worked flawlessly. You did a great job developing it and an even greater job publishing it openly for everyone to use!

To my question / feature request: Would it be possible to implement support for GNU Taler in Stustapay? GNU Taler is a payment system that allows privacy-friendly transactions via NFC or QR code. It's main selling point (from my point of view) is that transactions cannot be traced back to the paying party (Nobody can tell that I bought 10 beers at the Bierkarussell. Unless I drink them all. Then it's easy to tell...). Generally, GNU Taler aims to become a payment solution for the broad public and supported by all major retail banks. However, they are now in the pilot phase and first trials are running as a payment system for events (e.g. LugCamp 2024). Maybe Stustaculum 2025 could be one of them? I definitely believe their cause is worth supporting! :)

Cheers
Ben

Refund

The refunding system does not seem to operate.

Observed behaviour
After login in at provided website and filling up the fields for transferring the left over money, agreeing to the privacy policy and submitting the request, the money is not transferred back to the bank account.

adapt dsfinvk export to node tree and allow zip download in frontend

log out of sumup when deregistering from core

otherwise one might use a cached login (in the sumup sdk) for the wrong instance.

Customer Portal: Make use of browsers credential management capabilities

The inputs for the wristbands id and pin when logging into the Customer Portal are plain text inputs. If they were type="username" and type="password" fields or had the autocomplete attribute set accordingly 1, the browser would be able to prompt the user to save the credentials for their next login.

add backlinks from account and user tag to user if one exists

pdf export for sales and revenue statistics on node level

eliminate and recheck all tree TODOs

Booth Features

• Booths should be able to provide their bank information for automated IBAN generation
• Booths should be able to see their payout in a booth frontend
• Booth payout should lead to a exit transaction for both cash and bank transfers
• Booth reports should be reproduce able and the latest should always start from the previous exit transaction

add option to prevent customers from updating their payout information

pytest

any reason we don't use pytest? makes a much cleaner experience using fixtures.

Example

@pytest.fixture(scope="session")
async def token(user_service):
    user_login_result = await user_service.login_user(username="admin", password="rolf")
    return user_login_result.token

Instead of

 self.admin_token = (await self.user_service.login_user(username=self.admin_user.login, password="rolf")).token

gracefully handle customer portal config errors

when the customer portal config is not provided by the backend (e.g. because of a misconfiguration), the customer portal site has to show the config error.

otherwise currently if api/config?base_url=<bla> fails, firefox is happy, but M$Edge apparently fails due to Intl.NumberFormat not getting a valid currency spefication.

clear up ticket sale in customer portal so it does not look like it was deducted from the chip balance

book payouts to customer account to set balances to 0

improve payout clarity in customerportal

• immediately display that the payout information has been entered on the payout page (but still allow updates until a payout_run is created)
• if a payout exists for a customer disable information updates
• display that a payout is scheduled for the customer if a payout exists
• display that the payout has occurred if the payout_run is set to done

improve user creation in app

• change form to firstname, lastname
• auto generate login from firstname and lastname
• auto generate display name from firstname and lastname