diff --git a/.githooks/security-audit.js b/.githooks/security-audit.js old mode 100644 new mode 100755 diff --git a/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md similarity index 97% rename from CODE_OF_CONDUCT.md rename to .github/CODE_OF_CONDUCT.md index c76625809..a8adf9e61 100644 --- a/CODE_OF_CONDUCT.md +++ b/.github/CODE_OF_CONDUCT.md @@ -77,7 +77,7 @@ Roughly in order, starting at the lowest step that fits: severe act — harassment, threats, or deliberately putting shops' data at risk. Decisions are made by the maintainers, currently as described in -[GOVERNANCE.md](GOVERNANCE.md#where-the-project-is-today). If you believe one +[GOVERNANCE.md](../docs/GOVERNANCE.md#where-the-project-is-today). If you believe one was wrong, say so at the same address; where a second maintainer exists, they review it. diff --git a/CONTRIBUTING.md b/.github/CONTRIBUTING.md similarity index 59% rename from CONTRIBUTING.md rename to .github/CONTRIBUTING.md index 9b894376a..66f12bb9e 100644 --- a/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -6,6 +6,11 @@ hardware quirks from real shops. ## Getting started +If this is your first Posnic contribution, start with the +[contributor quickstart](../docs/CONTRIBUTOR_QUICKSTART.md). It has the local +setup commands, common test commands, and task map for translations, GST, +e-invoicing, AI helper work, integrations and hardware evidence. + ```bash git clone https://github.com/Posnic/POS.git cd POS @@ -18,20 +23,28 @@ You do **not** need to install MongoDB. Posnic bundles its own and picks a port derived from the application name, so it never collides with a database you already run. The first launch takes a few minutes while it unpacks. -- [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) — full developer guide: tests, +- [Contributor quickstart](../docs/CONTRIBUTOR_QUICKSTART.md) — first setup, + task map and test matrix +- [docs/DEVELOPMENT.md](../docs/DEVELOPMENT.md) — full developer guide: tests, linting, conventions, and what not to rename -- [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) — how the pieces fit together -- [docs/API.md](docs/API.md) — REST reference, 478 endpoints -- [docs/BUILD_INSTRUCTIONS.md](docs/BUILD_INSTRUCTIONS.md) — installer builds +- [docs/ARCHITECTURE.md](../docs/ARCHITECTURE.md) — how the pieces fit together +- [docs/API.md](../docs/API.md) — REST reference +- [docs/BUILD_INSTRUCTIONS.md](../docs/BUILD_INSTRUCTIONS.md) — installer builds ## How to contribute 1. **Open an issue first** for anything non-trivial — a bug report or a short proposal for a feature. It avoids wasted work on both sides. -2. Fork, create a branch (`fix/receipt-rounding`, `feat/tamil-translation`). -3. Keep pull requests focused — one change per PR. -4. Match the style of the surrounding code; avoid drive-by reformatting. -5. Run the tests: `cd api && npm test` (7,744 unit tests, about a minute), plus +2. Pick a task from the + [contributor roadmap](https://github.com/Posnic/POS/issues/35) or the + [`good first issue`](https://github.com/Posnic/POS/labels/good%20first%20issue) + label. +3. Read the issue acceptance criteria and choose one small checkbox or PR slice. + If the issue does not yet define "done", start by proposing that checklist. +4. Fork, create a branch (`fix/receipt-rounding`, `feat/tamil-translation`). +5. Keep pull requests focused — one change per PR. +6. Match the style of the surrounding code; avoid drive-by reformatting. +7. Run the tests: `cd api && npm test` (7,744 unit tests, about a minute), plus `npm test` at the repo root for the desktop side (294 more). Both should pass on a clean checkout — if they do not, that is worth an issue on its own. @@ -46,7 +59,7 @@ that one is yours. **Do not rename a persisted field or collection in a pull request.** Those names travel over the sync wire to desktop installations that cannot be force-updated, so renaming them needs a versioned migration. See -[docs/DEVELOPMENT.md](docs/DEVELOPMENT.md#what-not-to-rename). +[docs/DEVELOPMENT.md](../docs/DEVELOPMENT.md#what-not-to-rename). ## What happens to your pull request @@ -55,7 +68,7 @@ So you know what you are waiting for. 1. **CI runs** — unit tests, the desktop tests, lint, the packaging check and the API docs check. All of them gate: if CI is red, the pull request waits. 2. **A maintainer reads it.** Usually within a week. The project is small; see - [GOVERNANCE.md](GOVERNANCE.md). + [GOVERNANCE.md](../docs/GOVERNANCE.md). 3. **You may get comments.** Comments are not rejection. A pull request with twenty comments is one someone is taking seriously. 4. **It merges**, or it does not — and if it does not, the reason is written in @@ -99,6 +112,38 @@ Two things worth repeating here: are trying to do tells us more than the button you imagined, and often has a better answer. +## Contribute evidence without changing code + +Reproducible observations are useful contributions. They help turn a broad +feature statement into a versioned result with an exact input, environment and +limitation. + +- If you are reviewing Posnic independently, start with the public + [review brief](https://posnic.com/assets/posnic-independent-review-brief.txt) + and [24-control protocol](https://posnic.com/assets/posnic-independent-review-protocol.csv). + Review access does not require payment, positive coverage, a backlink or + advance approval. Publish failures, conflicts and untested areas as well as + successful results. +- Run the public + [vendor-neutral POS acceptance fixture](https://posnic.com/open-source-pos-benchmark#vendor-neutral-pos-acceptance-fixture) + and submit the structured + [acceptance result form](https://github.com/Posnic/POS/issues/new?template=pos_acceptance_run.yml). +- Test an exact printer, scanner, cash drawer, scale or display against the + [hardware matrix](../docs/HARDWARE_MATRIX.md), then submit the structured + [hardware evidence form](https://github.com/Posnic/POS/issues/new?template=hardware_evidence.yml). +- If you operate, piloted, installed, evaluated or stopped using Posnic, read + the [adoption evidence policy](../docs/ADOPTION_EVIDENCE.md) and submit a + structured + [deployment evidence report](https://github.com/Posnic/POS/issues/new?template=deployment_evidence.yml). + Failures, workarounds and reasons not to adopt are useful evidence. +- Read [ROADMAP.md](../docs/ROADMAP.md) for the current evidence gaps and the boundary + between released, reproduced, in-validation and planned work. + +An evidence issue is public and is not a certification or testimonial. Use +fictional transactions and remove customer data, payment data, credentials, +tokens, production logs and database files before attaching anything. Security +problems still go through [SECURITY.md](SECURITY.md), never a public issue. + ## Sign your commits (DCO) We use the [Developer Certificate of Origin](https://developercertificate.org/). diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index d07e976bb..da1396974 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -6,6 +6,10 @@ blank_issues_enabled: false contact_links: + - name: Start contributing + url: https://github.com/Posnic/POS/blob/main/docs/CONTRIBUTOR_QUICKSTART.md + about: Local setup, test commands, good first issues, PR flow and safety rules. + - name: Question or help using Posnic url: https://github.com/Posnic/POS/discussions/categories/q-a about: How do I do X, is this normal, hardware advice. Faster than an issue. diff --git a/.github/ISSUE_TEMPLATE/deployment_evidence.yml b/.github/ISSUE_TEMPLATE/deployment_evidence.yml new file mode 100644 index 000000000..c4fd2f64f --- /dev/null +++ b/.github/ISSUE_TEMPLATE/deployment_evidence.yml @@ -0,0 +1,154 @@ +name: Real deployment evidence report +description: Report bounded, versioned experience from operating or evaluating Posnic +title: "[Deployment evidence]: " +labels: [] +body: + - type: markdown + attributes: + value: | + Use this form for honest experience from a real deployment, pilot, installation, or sustained evaluation. Failures, workarounds, stopped trials, and reasons Posnic was not selected are as useful as successful use. + + GitHub issues are public. Do not include customer records, card or bank data, credentials, tokens, tax identifiers, staff identities, production database files, private logs, an exact shop address, or anything you are not authorised to publish. + + A submitted report is not automatically a testimonial, case study, certification, endorsement, uptime claim, or proof that another business will obtain the same result. + + - type: dropdown + id: reporter_relationship + attributes: + label: Your relationship to this deployment + options: + - Business owner or operator + - Employee using Posnic at work + - Installer, consultant, or implementation partner + - Independent evaluator or researcher + - Posnic employee, contractor, affiliate, or investor + - Former user or stopped pilot + - Other relationship explained below + validations: + required: true + + - type: textarea + id: relationship_details + attributes: + label: Relationship and financial disclosure + description: State who selected, configured, paid for, supplied, or reviewed the software and disclose any payment, free service, discount, employment, referral, or other material connection to Posnic. + placeholder: I operate the shop and used the free local edition; no payment or incentive was received for this report. + validations: + required: true + + - type: input + id: product_identity + attributes: + label: Exact Posnic version or source commit + description: Include the release tag, About-screen version, or full source commit. Add the package filename and SHA-256 when available. + placeholder: v1.3.0, Posnic-1.3.0-windows-x64-installer.exe, SHA-256 ... + validations: + required: true + + - type: dropdown + id: deployment_status + attributes: + label: Deployment status + options: + - Currently used for live business operations + - Time-bounded live pilot + - Production-like evaluation with synthetic data + - Installation or migration attempt that stopped + - Previously used and no longer in use + validations: + required: true + + - type: input + id: observation_window + attributes: + label: Observation window + description: Give calendar dates or a bounded duration. Do not say "for a while". + placeholder: 1 June 2026 to 31 July 2026, or 12 operating days + validations: + required: true + + - type: input + id: market_scope + attributes: + label: Country, business type, and deployment size + description: Country and state or region are enough. Do not publish an exact address. Use a range for staff or transaction volume if the exact value is sensitive. + placeholder: India, Tamil Nadu; one bakery; one till; 1-5 staff + validations: + required: true + + - type: input + id: environment + attributes: + label: Operating system and relevant hardware + description: Include OS version, architecture, installation type, and only the exact device models relevant to your observations. + placeholder: Windows 11 23H2 x64; local edition; printer model and connection if discussed + validations: + required: true + + - type: checkboxes + id: workflows_observed + attributes: + label: Workflows actually observed + description: Select only paths used during the stated window. Explain depth and exceptions below. + options: + - label: Installation, setup, or migration + - label: Catalog, stock, or purchasing + - label: Sale, tender recording, receipt, or return + - label: Restaurant, table, kitchen, or kiosk workflow + - label: Register, close, report, or export + - label: Backup, restore, restart, or outage recovery + - label: Printer, scanner, drawer, scale, or display + - label: Multi-till, branch, sync, or Posnic Cloud + - label: Support, issue reporting, or update process + validations: + required: true + + - type: textarea + id: observed_results + attributes: + label: What happened + description: Describe expected and observed behavior with counts or dates where you can support them. Include failures, retries, workarounds, abandoned paths, and unresolved issues. + placeholder: What was attempted; what worked; what failed; what changed; links to related public issues. + validations: + required: true + + - type: textarea + id: evidence_and_method + attributes: + label: Evidence and method + description: Explain how the observations were recorded. Link public issues or attach only synthetic, aggregated, or fully redacted material. + placeholder: Version screen, synthetic test receipt, issue links, redacted setup notes, or measured aggregate with its calculation. + validations: + required: true + + - type: textarea + id: limitations + attributes: + label: Limitations and untested paths + description: State what this report does not establish, including workflows, platforms, hardware, providers, countries, loads, recovery conditions, or time periods not observed. + validations: + required: true + + - type: dropdown + id: citation_permission + attributes: + label: Permission to cite this report + description: This choice can be changed later by commenting on the issue. Separate written approval is still required before publishing a named business case study, logo, quotation, or private evidence. + options: + - Do not use this as marketing; keep it as a public issue only + - Posnic may link to this public issue with my GitHub username only + - Posnic may summarise this public report after I approve the exact wording + validations: + required: true + + - type: checkboxes + id: public_data_confirmation + attributes: + label: Public report confirmation + options: + - label: I am authorised to publish this report and removed private customer, payment, staff, credential, tax, address, log, and database data. + required: true + - label: I disclosed my relationship and any payment, free service, discount, referral, employment, or other material connection. + required: true + - label: I understand that maintainers may ask for correction, label the result unverified, or close it without turning it into a marketing claim. + required: true diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index cfec07365..9c9ccbf33 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -33,6 +33,19 @@ the one you had in mind. +## Acceptance criteria + + + +- [ ] The user can... +- [ ] The app still... +- [ ] Tests or evidence prove... +- [ ] Documentation or operator wording explains... + ## Does it need an internet connection? + ## What does this PR do? +## Acceptance criteria covered + + + +- [ ] Linked issue has clear acceptance criteria, or this PR adds them first +- [ ] This PR completes the listed criteria or names the remaining work + ## How was it tested? -- [ ] Ran locally (`npm start`) +- [ ] Ran locally (`npm start` for the desktop app, or `npm run dev` for a browser at http://localhost:3000) - [ ] Built the installer (`npm run build`) if build/packaging was touched - [ ] Relevant tests pass +- [ ] Used the relevant checks from [`docs/CONTRIBUTOR_QUICKSTART.md`](../docs/CONTRIBUTOR_QUICKSTART.md#test-the-right-thing) ## Checklist @@ -14,3 +31,4 @@ - [ ] Commits are signed off (`git commit -s`, DCO) - [ ] Works fully offline (no new external network calls in the local edition) - [ ] Matches surrounding code style +- [ ] No real customer, tax, payment, credential, token, or production data is included diff --git a/SECURITY.md b/.github/SECURITY.md similarity index 94% rename from SECURITY.md rename to .github/SECURITY.md index ebe802370..68bc6310f 100644 --- a/SECURITY.md +++ b/.github/SECURITY.md @@ -29,7 +29,7 @@ follows, so it is worth being explicit rather than leaving people to discover it |---|---| | The network | MongoDB binds to `127.0.0.1`. Nothing on the LAN or the internet can reach it. | | Other Windows accounts | The database requires a password, generated per install and stored in the shop's own user profile. No shared secret between shops. | -| A stolen or resold disk | With device encryption enabled — see the [user guide](docs/USER_GUIDE.md#keeping-your-till-secure). Without it, the disk is readable. | +| A stolen or resold disk | With device encryption enabled — see the [user guide](../docs/USER_GUIDE.md#keeping-your-till-secure). Without it, the disk is readable. | | The till while unattended | PIN lock, and close-to-tray locks the screen. | **What is not protected, and cannot be** @@ -62,7 +62,7 @@ these are the properties to weigh. Run the till on a standard, non-administrator Windows account, keep a separate administrator account with a real password, and turn on device encryption. Those three steps do more than anything in this codebase can. The -[user guide](docs/USER_GUIDE.md#keeping-your-till-secure) walks through them. +[user guide](../docs/USER_GUIDE.md#keeping-your-till-secure) walks through them. ## Scope @@ -97,8 +97,8 @@ rather than left quiet. | Secret scan of the full git history | Every CI run — `scripts/scan-git-history.js` | | Electron and Node major versions | Quarterly, and within 30 days of a security release | | Review of IPC surface, permissions and navigation guards | Every release that adds an IPC channel | -| Backup restore drill on a clean machine | Every release — see [docs/DISASTER_RECOVERY.md](docs/DISASTER_RECOVERY.md) | -| Incident response walk-through | Annually — see [docs/INCIDENT_RESPONSE.md](docs/INCIDENT_RESPONSE.md) | +| Backup restore drill on a clean machine | Every release — see [docs/DISASTER_RECOVERY.md](../docs/DISASTER_RECOVERY.md) | +| Incident response walk-through | Annually — see [docs/INCIDENT_RESPONSE.md](../docs/INCIDENT_RESPONSE.md) | | Third-party licence and notice review | Annually, and whenever a bundled asset changes | An independent security audit has **not** been commissioned. When one is, the diff --git a/SUPPORT.md b/.github/SUPPORT.md similarity index 98% rename from SUPPORT.md rename to .github/SUPPORT.md index e255f6a88..ffd4a07be 100644 --- a/SUPPORT.md +++ b/.github/SUPPORT.md @@ -49,7 +49,7 @@ attaching them. Issues are public. ## What happens next **Within a few days** someone reads it and adds labels. That is a person, not a -bot, and the project is small — see [GOVERNANCE.md](GOVERNANCE.md) for who. +bot, and the project is small — see [GOVERNANCE.md](../docs/GOVERNANCE.md) for who. Every issue ends up in one of these: diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml index 5be1b245f..50cbfc245 100644 --- a/.github/workflows/beta.yml +++ b/.github/workflows/beta.yml @@ -115,8 +115,8 @@ jobs: shell: bash run: | set -euo pipefail - VERSION=$(grep -oE 'set MONGODB_VERSION=[0-9.]+' download-mongodb.bat | cut -d= -f2) - echo "MongoDB $VERSION, the version download-mongodb.bat pins" + VERSION=$(grep -oE 'set MONGODB_VERSION=[0-9.]+' src/download-mongodb.bat | cut -d= -f2) + echo "MongoDB $VERSION, the version src/download-mongodb.bat pins" fetch_tgz() { # url, destination bin directory curl -fsSL -o mongo.tgz "$1" @@ -154,8 +154,13 @@ jobs: - name: Prepare everything the installer bundles run: npm run prepare:bundle + # Betas are deliberately unsigned test builds, so THEY must not bake in + # update-signature verification: a beta till that verified would refuse + # the next unsigned beta and silently stop updating. Stable keeps the + # repo default (verifyUpdateCodeSignature: true) - the desk build signs, + # so stable tills verify every download came from the same publisher. - name: Build - run: npx electron-builder ${{ matrix.flag }} --publish never + run: npx electron-builder ${{ matrix.flag }} --publish never --config.win.verifyUpdateCodeSignature=false env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -182,7 +187,13 @@ jobs: cp -v "$f" "dist/$(basename "$f" | sed 's/^beta/latest/')" done echo "manifests present:" - ls -1 dist/*.yml || echo " NONE - the update path cannot work" + shopt -s nullglob + latest_manifests=(dist/latest*.yml) + if (( ${#latest_manifests[@]} == 0 )); then + echo " NONE - the update path cannot work" + exit 1 + fi + printf ' %s\n' "${latest_manifests[@]}" - name: Upload installers uses: actions/upload-artifact@v7 @@ -196,7 +207,8 @@ jobs: dist/*.deb # Without these an installed tester is never offered the build, and # the Updates screen reports that it cannot reach the update server. - dist/*.yml + # builder-debug.yml is build diagnostics, not updater input. + dist/latest*.yml dist/*.blockmap if-no-files-found: error retention-days: 7 @@ -205,6 +217,11 @@ jobs: name: Publish test build needs: [version, build] runs-on: ubuntu-latest + permissions: + contents: write + id-token: write + attestations: write + artifact-metadata: write steps: - uses: actions/checkout@v7 - uses: actions/download-artifact@v8 @@ -214,12 +231,19 @@ jobs: run: | mkdir -p release find artifacts -type f \( -name '*.exe' -o -name '*.dmg' -o -name '*.zip' \ - -o -name '*.AppImage' -o -name '*.deb' -o -name '*.yml' \ + -o -name '*.AppImage' -o -name '*.deb' -o -name 'latest*.yml' \ -o -name '*.blockmap' \) -exec mv {} release/ \; cd release sha256sum $(ls | grep -vE 'latest.*\.yml$|\.blockmap$') > SHA256SUMS.txt echo "Publishing:"; ls -lh + # Test builds are downloadable executables too. Attest only the exact + # package subjects already named by the published checksum file. + - name: Attest test-build artifact provenance + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 + with: + subject-checksums: release/SHA256SUMS.txt + - uses: softprops/action-gh-release@v3 with: tag_name: ${{ needs.version.outputs.tag }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0a3cb639f..fc57661ce 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,7 +9,7 @@ name: CI on: push: - branches: [main] + branches: [main, develop] pull_request: # Release calls this so a tag is gated on exactly what a pull request meets. # It used to run the API unit suite alone, which meant a release could ship @@ -48,6 +48,11 @@ concurrency: # silently does nothing on the runner - which is the one place it was needed. env: TZ: Asia/Kolkata + # puppeteer arrives as a transitive dependency (whatsapp-web.js) and its + # postinstall downloads a whole Chrome from Google's CDN - which 403s + # often enough to fail unrelated commits at `npm ci`. No CI job launches + # a browser, so the download is pure risk with no benefit. + PUPPETEER_SKIP_DOWNLOAD: '1' # Least privilege for GITHUB_TOKEN. # @@ -237,6 +242,10 @@ jobs: - name: Install run: npm ci --omit=optional --ignore-scripts + - name: Install API dependencies used by desktop contract tests + working-directory: api + run: npm ci + # The rollback drill releases the REAL artifact - the manifest signed # over an actually-built frontend/public - so the suite needs the pages # built first. Same steps as deploy-frontend.yml. Without this the drill @@ -260,6 +269,15 @@ jobs: with: node-version: 22 + # Linux software centers and AppImage catalogs read this file before a + # user installs Posnic. Validate it with the reference implementation so + # a typo cannot silently remove the app identity, screenshot or links. + - name: AppStream metadata is valid + run: | + sudo apt-get update + sudo apt-get install --no-install-recommends -y appstream + appstreamcli validate --pedantic builds/linux/com.posnic.app.metainfo.xml + # A module that is required but never packaged produces "Cannot find # module" on a user's machine and nowhere else. This has happened, so it # is checked here rather than after an installer ships. diff --git a/.github/workflows/deploy-api.yml b/.github/workflows/deploy-api.yml index 196da51b8..d6a821cb6 100644 --- a/.github/workflows/deploy-api.yml +++ b/.github/workflows/deploy-api.yml @@ -57,6 +57,8 @@ jobs: AWS_REGION: ${{ secrets.AWS_REGION }} AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + BREVO_API_KEY: ${{ secrets.BREVO_API_KEY }} + EMAIL_FROM: ${{ secrets.EMAIL_FROM }} run: | if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ] || [ -z "$AWS_S3_BUCKET" ]; then echo "::warning::S3 secrets not set in this repo; skipping env write - uploads will keep falling back to local disk" @@ -68,6 +70,10 @@ jobs: echo "AWS_REGION=${AWS_REGION:-ap-south-1}" echo "AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID" echo "AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" + # Platform mail (Brevo) - the proven send path; empty until the + # BREVO_API_KEY secret is set, and harmless while empty. + [ -n "$BREVO_API_KEY" ] && echo "BREVO_API_KEY=$BREVO_API_KEY" + [ -n "$EMAIL_FROM" ] && echo "EMAIL_FROM=$EMAIL_FROM" } | ssh -i ~/.ssh/deploy.pem "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \ 'umask 077; cat > ~/apps/tenants/app/api/.env && echo "storage env written ($(grep -c = ~/apps/tenants/app/api/.env) keys)"' diff --git a/.github/workflows/deploy-develop.yml b/.github/workflows/deploy-develop.yml new file mode 100644 index 000000000..daf35f96e --- /dev/null +++ b/.github/workflows/deploy-develop.yml @@ -0,0 +1,130 @@ +# Puts whatever is on develop onto develop.posnic.io, so anybody can try it. +# +# THIS MACHINE RUNS UNREVIEWED CONTRIBUTOR CODE. That single fact decides +# everything below. +# +# It is NOT registered in the estate console. A registered instance can be +# handed a real customer's shop by the provisioner, and no amount of care +# afterwards would undo that. +# +# It gets its OWN database and its OWN secrets. It never receives the +# control-plane credentials, the S3 keys, the payment keys or the mail keys +# that the production deploys carry - deliberately, by simply not sending +# them, so nothing on that box can reach anything real. +# +# It holds demo data only, and says so on every page. +# +# It is a public sandbox that happens to run our code. Treat anything on it as +# readable by anyone, because it is. +name: Deploy develop + +on: + push: + branches: [develop] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: deploy-develop + cancel-in-progress: false + +jobs: + deploy: + # Off until the machine exists and DEVELOP_DEPLOY_ENABLED is set to true. + # A workflow that fails on every push teaches people to ignore red marks. + if: vars.DEVELOP_DEPLOY_ENABLED == 'true' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + + - uses: actions/setup-node@v7 + with: + node-version: '22' + + # Built here rather than on the box: a 2 GB machine running mongod and + # the API should not also be running a gulp build, and building in CI + # means a broken build never reaches the sandbox at all. + # Every language ships in every build now, the unreviewed ones marked + # beta in the menu (frontend/gulpfile.js/config.js). Nothing to switch + # on here: the sandbox shows exactly what an installer shows. + - name: Build the frontend + run: | + npm --prefix frontend install --no-audit --no-fund + cd frontend && npx gulp build + + - name: Check discovery files + run: | + set -e + for f in \ + frontend/public/robots.txt \ + frontend/public/sitemap.xml \ + frontend/public/llms.txt + do + test -s "$f" || { echo "missing or empty after build: $f"; exit 1; } + done + + - name: Setup SSH + run: | + mkdir -p ~/.ssh + echo "${{ secrets.DEVELOP_SSH_KEY }}" > ~/.ssh/develop.pem + chmod 600 ~/.ssh/develop.pem + ssh-keyscan -H "${{ secrets.DEVELOP_HOST }}" >> ~/.ssh/known_hosts + + - name: Sync the app + run: | + # .env is excluded on purpose. The sandbox generates its own secrets + # once and keeps them; overwriting them on every deploy would sign + # out every tester mid-test. + rsync -az --delete \ + --exclude node_modules --exclude .env --exclude uploads \ + -e "ssh -i ~/.ssh/develop.pem" \ + api/ "${{ secrets.DEVELOP_USER }}@${{ secrets.DEVELOP_HOST }}:~/posnic-develop/api/" + rsync -az --delete \ + -e "ssh -i ~/.ssh/develop.pem" \ + frontend/public/ "${{ secrets.DEVELOP_USER }}@${{ secrets.DEVELOP_HOST }}:~/posnic-develop/frontend/public/" + rsync -az \ + -e "ssh -i ~/.ssh/develop.pem" \ + languages/ "${{ secrets.DEVELOP_USER }}@${{ secrets.DEVELOP_HOST }}:~/posnic-develop/languages/" + + - name: Install and restart + run: | + ssh -i ~/.ssh/develop.pem \ + "${{ secrets.DEVELOP_USER }}@${{ secrets.DEVELOP_HOST }}" \ + 'bash -lc "cd ~/posnic-develop/api && npm install --omit=dev --no-audit --no-fund && pm2 reload posnic-develop --update-env || pm2 start server.js --name posnic-develop"' + + - name: Prove it is actually serving + run: | + # A deploy that reports success without checking is how a box sits + # broken for a week while the badge stays green. + # + # Asked of the APP, on the box, over SSH - not through nginx and not + # through Cloudflare. The deploy changed the application; nginx, DNS + # and TLS are separate concerns owned elsewhere, and a job that goes + # red because of one of those is reporting on somebody else's work. + # + # This checked http:// until TLS was set up, at which point nginx + # started answering 301 and every deploy failed on a healthy box - + # the check was measuring the redirect, not the app. + for i in 1 2 3 4 5 6; do + CODE=$(ssh -i ~/.ssh/develop.pem -o StrictHostKeyChecking=no \ + "${{ secrets.DEVELOP_USER }}@${{ secrets.DEVELOP_HOST }}" \ + "curl -s -o /dev/null -m 10 -w '%{http_code}' http://127.0.0.1:3000/public/login.html" 2>/dev/null || echo 000) + echo "attempt $i: $CODE" + if [ "$CODE" = "200" ]; then + echo "the application is serving on the box" + # Reported, never required: this depends on DNS, Cloudflare and a + # certificate, none of which this deploy touched. + PUB=$(curl -s -o /dev/null -m 20 -w '%{http_code}' https://develop.posnic.io/public/login.html || echo 000) + if [ "$PUB" = "200" ]; then + echo "develop.posnic.io is live" + else + echo "::notice::develop.posnic.io answered ${PUB}. The deploy itself succeeded - check DNS, Cloudflare or the certificate." + fi + exit 0 + fi + sleep 10 + done + echo "::error::the application did not answer 200 on the box after the deploy" + exit 1 diff --git a/.github/workflows/deploy-frontend.yml b/.github/workflows/deploy-frontend.yml index 08e25eeb6..5c0bd2c01 100644 --- a/.github/workflows/deploy-frontend.yml +++ b/.github/workflows/deploy-frontend.yml @@ -62,7 +62,10 @@ jobs: set -e for f in \ frontend/public/dashboard.html \ - frontend/public/login.html + frontend/public/login.html \ + frontend/public/robots.txt \ + frontend/public/sitemap.xml \ + frontend/public/llms.txt do test -s "$f" || { echo "missing or empty after build: $f"; exit 1; } done @@ -93,14 +96,44 @@ jobs: # Keeping it means an instance is a mirror of a known build rather than # a pile of whatever any deploy ever left behind, which is what made the # original failure so hard to see. + # Hashed bundles are PROTECTED from --delete (rsync filter), because a + # page already open in a browser still references the previous hashes - + # deleting them mid-session strips a working shop of its stylesheet + # ("mobile view add category shown and page broken. crashed" was an open + # tab meeting a deploy that had pruned style/dashboard..css). + # The CDN workflow learned this on day one; this one learns it now. + # The mirror principle survives via the retention step below: newest 3 + # per bundle family stay, older ones go. - name: Sync to the tenant instance run: | rsync -az --delete \ + --filter='protect public/script/*.js' \ + --filter='protect public/style/*.css' \ --exclude node_modules --exclude .git --exclude '.gitignore' \ --exclude 'public/all.zip' \ -e "ssh -i ~/.ssh/deploy.pem" \ frontend/ "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:~/apps/tenants/app/frontend/" + # Retention: for every hashed bundle family (name..ext), keep the + # newest 3 and remove the rest. An open tab survives at least two more + # deploys; the instance never accumulates unboundedly. + - name: Prune old hashed bundles (keep newest 3 per family) + run: | + ssh -i ~/.ssh/deploy.pem "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" 'bash -s' <<'REMOTE' + set -u + for d in ~/apps/tenants/app/frontend/public/script ~/apps/tenants/app/frontend/public/style; do + [ -d "$d" ] || continue + cd "$d" + ls -1 2>/dev/null | grep -E '^[A-Za-z0-9_-]+\.[0-9a-f]{8}\.(js|css)$' \ + | sed -E 's/\.[0-9a-f]{8}\.(js|css)$/.\1/' | sort -u \ + | while read -r fam; do + base="${fam%.*}"; ext="${fam##*.}" + ls -1t "$base".????????."$ext" 2>/dev/null | tail -n +4 \ + | while read -r old; do rm -f -- "$old" && echo "pruned $d/$old"; done + done + done + REMOTE + # No pm2 restart on purpose: these are static files read from disk per # request, so the tenants pick them up with no interruption to a shop # that is mid-sale. @@ -117,7 +150,7 @@ jobs: # The pages by name; the bundles by hashed pattern (the name # carries a content hash and changes every deploy). - for f in public/dashboard.html public/login.html; do + for f in public/dashboard.html public/login.html public/robots.txt public/sitemap.xml public/llms.txt; do if [ -s "$f" ]; then echo " ok $f"; else echo " MISSING $f"; fail=1; fi done ls public/style/dashboard.*.css >/dev/null 2>&1 && echo " ok hashed dashboard css" || { echo " MISSING hashed dashboard css"; fail=1; } diff --git a/.github/workflows/develop-qa.yml b/.github/workflows/develop-qa.yml new file mode 100644 index 000000000..8bc3f8645 --- /dev/null +++ b/.github/workflows/develop-qa.yml @@ -0,0 +1,71 @@ +# When a change lands on develop, say so on the pull request. +# +# The QA loop only works if somebody knows there is something to test. Left to +# people to remember, "ready for QA" gets set for the first week and then +# never again, and the label stops meaning anything. +# +# This labels the merged PR and comments where to try it, so a tester can find +# work by filtering one label rather than reading the commit log. +name: Develop QA + +on: + pull_request_target: + types: [closed] + branches: [develop] + +# pull_request_target runs with a token that can write to the repository, so it +# is deliberately given the least that allows: labels and a comment, nothing +# that touches code. It never checks the pull request out, which is the thing +# that makes this trigger dangerous. +permissions: + pull-requests: write + issues: write + +jobs: + label: + # Closed is not merged. A PR somebody abandoned should not be announced as + # something to test. + if: github.event.pull_request.merged == true + runs-on: ubuntu-latest + steps: + - name: Mark ready for QA + uses: actions/github-script@v9 + with: + script: | + const pr = context.payload.pull_request; + const common = { owner: context.repo.owner, repo: context.repo.repo, issue_number: pr.number }; + + await github.rest.issues.addLabels({ ...common, labels: ['ready for QA'] }); + + // A previous round's verdict is about a previous version of the + // change. Leaving it would let a stale "QA passed" travel with a + // commit nobody tested. + for (const stale of ['QA passed', 'QA failed', 'needs rebase']) { + try { + await github.rest.issues.removeLabel({ ...common, name: stale }); + } catch (e) { + if (e.status !== 404) throw e; + } + } + + await github.rest.issues.createComment({ + ...common, + body: [ + 'Merged to `develop`. **Anyone can test this** - you do not need write access.', + '', + 'Try it at https://develop.posnic.io, or run it yourself:', + '', + '```bash', + 'git fetch origin develop && git checkout develop', + 'npm install && npm --prefix api install', + 'npm run dev # then http://localhost:3000', + '```', + '', + 'When you have tested it, say what you did and what happened, and set', + '`QA passed` or `QA failed`. If you cannot set labels, just comment -', + 'a maintainer will.', + '', + 'Reporting that something is broken is as useful as fixing it. It is', + 'better found here than by a shopkeeper.', + ].join('\n'), + }); diff --git a/.github/workflows/notify-site-of-release.yml b/.github/workflows/notify-site-of-release.yml new file mode 100644 index 000000000..1d3ebd1b6 --- /dev/null +++ b/.github/workflows/notify-site-of-release.yml @@ -0,0 +1,65 @@ +# Tell the website when a release is published, so the download page follows. +# +# The download page names the version in about a dozen places, and those names +# come from a manifest in the web-frontend repo that somebody updates by +# running a script. Nobody remembers every time, and the failure is silent - +# every link still works, it just hands new customers an older build than the +# one we shipped. +# +# This fires on `release: published`, which is the moment the decision is made, +# rather than on the tag push that starts the build. A tag exists long before +# the artefacts do, and pointing the download page at a release whose installers +# have not finished uploading is worse than pointing it at the previous one. +# +# Deliberately narrow: pre-releases and drafts are skipped. The site tool +# refuses them anyway - it reads GitHub's own /releases/latest, which never +# returns either - so dispatching for them would only produce a run that fails +# for a reason that is not a fault. +# +# The site also checks daily on its own, so a missed dispatch costs a day +# rather than costing the update. + +name: Tell the site about a published release + +on: + release: + types: [published] + workflow_dispatch: + +jobs: + notify: + # `prerelease` is false for a stable publish; drafts never reach this event. + if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false + runs-on: ubuntu-latest + steps: + - name: Dispatch to web-frontend + env: + # A token that can dispatch into the other repo. Without it this step + # is skipped rather than failed: the site's daily check still catches + # up, and a release must never be held up by a notification. + TOKEN: ${{ secrets.SITE_DISPATCH_TOKEN }} + run: | + if [ -z "$TOKEN" ]; then + echo "SITE_DISPATCH_TOKEN is not set - skipping." + echo "The site checks for new releases daily, so it will catch up on its own." + exit 0 + fi + + tag="${{ github.event.release.tag_name }}" + echo "telling web-frontend about ${tag:-a new release}" + + code=$(curl -sS -o /tmp/dispatch.out -w '%{http_code}' \ + -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer $TOKEN" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + https://api.github.com/repos/Posnic/web-frontend/dispatches \ + -d "{\"event_type\":\"stable-release-published\",\"client_payload\":{\"tag\":\"$tag\"}}") + + if [ "$code" != "204" ]; then + echo "dispatch returned HTTP $code" + cat /tmp/dispatch.out || true + echo "The site's daily check will still pick this release up." + exit 1 + fi + echo "dispatched." diff --git a/.github/workflows/publish-apt.yml b/.github/workflows/publish-apt.yml new file mode 100644 index 000000000..1bdde6ff8 --- /dev/null +++ b/.github/workflows/publish-apt.yml @@ -0,0 +1,111 @@ +# packages.posnic.com - the signed APT repository (RELEASE_TRUST_PLAN §4). +# +# Runs when a release is PUBLISHED - not when the draft is assembled - so the +# apt repo can never get ahead of the human decision that makes a release +# public. Everything is dormant until the Linux signing secrets exist; until +# then each run says exactly what is missing and succeeds without publishing. +# +# What it does with the secrets in place: +# 1. downloads the published release's .deb and AppImage, +# 2. signs them (detached .asc) and uploads the signatures back to the +# release beside the artifacts, +# 3. rebuilds the APT repository tree with the new .deb and syncs it to the +# packages bucket that Cloudflare serves as packages.posnic.com. +# +# Secrets/vars it waits for: +# LINUX_GPG_KEY - armored private signing subkey (offline master +# stays on the desk - see the key ceremony notes) +# LINUX_GPG_KEY_ID - fingerprint of that subkey +# PACKAGES_AWS_KEY_ID / PACKAGES_AWS_SECRET - scoped to the bucket only +# vars.PACKAGES_BUCKET - e.g. posnic-packages +name: Publish APT repository + +on: + release: + types: [published] + workflow_dispatch: + inputs: + tag: + description: "Release tag to (re)publish, e.g. v1.6.0" + required: true + +permissions: + contents: write # uploads .asc signatures back to the release + +jobs: + publish: + runs-on: ubuntu-latest + # secrets are not legal in step-level `if:` - presence is computed here + env: + HAVE_GPG: ${{ secrets.LINUX_GPG_KEY != '' }} + HAVE_BUCKET: ${{ vars.PACKAGES_BUCKET != '' }} + steps: + - uses: actions/checkout@v7 + + - name: Explain and stop when signing is not configured yet + if: env.HAVE_GPG != 'true' + run: | + echo "::warning::Linux signing is not configured (LINUX_GPG_KEY missing) - the apt repo was NOT updated. See RELEASE_TRUST_PLAN.md §4." + + - name: Download the release artifacts + if: env.HAVE_GPG == 'true' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ inputs.tag || github.event.release.tag_name }} + run: | + set -euo pipefail + mkdir -p artifacts + gh release download "$TAG" --dir artifacts --pattern '*.deb' --pattern '*.AppImage' + ls -l artifacts + + - name: Import the signing subkey + if: env.HAVE_GPG == 'true' + env: + LINUX_GPG_KEY: ${{ secrets.LINUX_GPG_KEY }} + run: | + set -euo pipefail + echo "$LINUX_GPG_KEY" | gpg --batch --import + gpg --list-secret-keys --keyid-format long + + - name: Sign the artifacts and upload signatures to the release + if: env.HAVE_GPG == 'true' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ inputs.tag || github.event.release.tag_name }} + KEY_ID: ${{ secrets.LINUX_GPG_KEY_ID }} + run: | + set -euo pipefail + cd artifacts + for f in *.deb *.AppImage; do + [ -e "$f" ] || continue + gpg --batch --yes -u "$KEY_ID" --armor --detach-sign "$f" + sha256sum "$f" > "$f.sha256" + done + gh release upload "$TAG" ./*.asc ./*.sha256 --clobber + + - name: Build the APT repository + if: env.HAVE_GPG == 'true' + env: + APT_GPG_KEY_ID: ${{ secrets.LINUX_GPG_KEY_ID }} + run: | + set -euo pipefail + sudo apt-get update -qq && sudo apt-get install -y -qq reprepro + bash scripts/build-apt-repo.sh artifacts/*.deb apt-repo + + - name: Sync to packages.posnic.com + if: env.HAVE_GPG == 'true' && env.HAVE_BUCKET == 'true' + env: + AWS_ACCESS_KEY_ID: ${{ secrets.PACKAGES_AWS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.PACKAGES_AWS_SECRET }} + AWS_DEFAULT_REGION: ap-south-1 + BUCKET: ${{ vars.PACKAGES_BUCKET }} + TAG: ${{ inputs.tag || github.event.release.tag_name }} + run: | + set -euo pipefail + # pool/ is content-addressed and append-only; dists/ metadata must + # replace atomically enough that apt never sees a half-written index, + # so the pool syncs first and the signed index last. + aws s3 sync apt-repo/pool "s3://$BUCKET/apt/pool" + aws s3 sync apt-repo/dists "s3://$BUCKET/apt/dists" --delete + aws s3 cp apt-repo/gpg.key "s3://$BUCKET/gpg.key" + echo "packages.posnic.com updated for $TAG" diff --git a/.github/workflows/publish-snap.yml b/.github/workflows/publish-snap.yml new file mode 100644 index 000000000..da9c57342 --- /dev/null +++ b/.github/workflows/publish-snap.yml @@ -0,0 +1,64 @@ +# Snap Store publication (RELEASE_TRUST_PLAN §4, phase approved 2026-08-27). +# +# Same shape and same reasoning as publish-apt.yml: runs only when a release +# is PUBLISHED - the human decision - and stays dormant, loudly, until the +# store credential exists. The .snap itself is built by the normal release +# matrix (electron-builder's snap target); this job only moves it to the +# store, where Canonical's infrastructure handles trust and updates. +# +# Secrets it waits for: +# SNAPCRAFT_STORE_CREDENTIALS - `snapcraft export-login` output for the +# account that registered the name `posnic` +name: Publish to Snap Store + +on: + release: + types: [published] + workflow_dispatch: + inputs: + tag: + description: "Release tag to (re)publish, e.g. v1.6.0" + required: true + +permissions: + contents: read + +jobs: + publish: + runs-on: ubuntu-latest + # secrets are not legal in step-level `if:` - presence is computed here + env: + HAVE_SNAP_LOGIN: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS != '' }} + steps: + - name: Explain and stop when the store login is not configured yet + if: env.HAVE_SNAP_LOGIN != 'true' + run: | + echo "::warning::Snap publishing is not configured (SNAPCRAFT_STORE_CREDENTIALS missing) - the store was NOT updated. See RELEASE_TRUST_PLAN.md Appendix D." + + - name: Download the release .snap + if: env.HAVE_SNAP_LOGIN == 'true' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ inputs.tag || github.event.release.tag_name }} + REPO: ${{ github.repository }} + run: | + set -euo pipefail + gh release download "$TAG" --repo "$REPO" --pattern '*.snap' --dir . + ls -l ./*.snap + + - name: Upload to the Snap Store + if: env.HAVE_SNAP_LOGIN == 'true' + env: + SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }} + run: | + set -euo pipefail + sudo snap install snapcraft --classic + # Betas land in the beta channel; stable tags in stable. A visitor + # running `snap install posnic` only ever gets the stable channel. + TAG="${{ inputs.tag || github.event.release.tag_name }}" + case "$TAG" in + *beta*) CHANNEL=beta ;; + *) CHANNEL=stable ;; + esac + snapcraft upload ./*.snap --release "$CHANNEL" + echo "published to the $CHANNEL channel" diff --git a/.github/workflows/release-promote.yml b/.github/workflows/release-promote.yml new file mode 100644 index 000000000..21ace3dc6 --- /dev/null +++ b/.github/workflows/release-promote.yml @@ -0,0 +1,96 @@ +# Open the pull request that promotes develop to main. +# +# The release itself is tag-driven and unchanged: tag main, release.yml builds +# and publishes. This is the step before that - turning "develop has some +# tested work on it" into one reviewable thing the owner can read and merge. +# +# Run by hand, never on a schedule. Deciding that what is on develop is worth +# releasing is a judgement about whether it has been tested enough, and that +# judgement is the owner's. A timer would only ever guess. +name: Promote develop to main + +on: + workflow_dispatch: + inputs: + note: + description: "Anything to say about this release (optional)" + required: false + +permissions: + contents: read + pull-requests: write + +jobs: + promote: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + with: + fetch-depth: 0 + + - name: What would this release? + id: what + run: | + git fetch origin main develop + AHEAD=$(git rev-list --count origin/main..origin/develop) + echo "ahead=$AHEAD" >> "$GITHUB_OUTPUT" + if [ "$AHEAD" = "0" ]; then + echo "::notice::develop has nothing main does not already have." + exit 0 + fi + + # The subjects, not the hashes. Somebody deciding whether to release + # wants to read what changed, and a list of shas is not that. + git log --no-merges --format='- %s' origin/main..origin/develop > /tmp/commits.txt + echo "$AHEAD commit(s) to promote:" + cat /tmp/commits.txt + + # Anyone whose work is in this release, so the release notes are not + # the first time they see their name. + git log --format='%an' origin/main..origin/develop \ + | sort -u | grep -v 'github-actions' > /tmp/authors.txt || true + + - name: Open the release pull request + if: steps.what.outputs.ahead != '0' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NOTE: ${{ inputs.note }} + run: | + { + echo "Promotes **${{ steps.what.outputs.ahead }} commit(s)** from \`develop\` to \`main\`." + echo + if [ -n "$NOTE" ]; then echo "$NOTE"; echo; fi + echo "### What is in it" + echo + cat /tmp/commits.txt + echo + echo "### Contributors in this release" + echo + sed 's/^/- /' /tmp/authors.txt + echo + echo "### Before merging" + echo + echo "- [ ] Everything here has been tried on develop.posnic.io or locally" + echo "- [ ] Anything labelled \`QA failed\` has been fixed or reverted" + echo "- [ ] CI is green" + echo + echo "Merging this does **not** release anything. Tag main afterwards:" + echo + echo '```bash' + echo 'git checkout main && git pull' + echo 'git tag vX.Y.Z && git push origin vX.Y.Z' + echo '```' + echo + echo "That is what builds the installers and publishes the release." + } > /tmp/body.md + + if gh pr list --base main --head develop --state open --json number --jq 'length' | grep -q '^0$'; then + gh pr create --base main --head develop \ + --title "Release: promote develop to main" --body-file /tmp/body.md + else + # Reusing the open one keeps the discussion in a single place + # rather than starting a second thread about the same release. + NUM=$(gh pr list --base main --head develop --state open --json number --jq '.[0].number') + gh pr edit "$NUM" --body-file /tmp/body.md + echo "updated the open release pull request #$NUM" + fi diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5ec4ec426..c2ac28958 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,4 +1,5 @@ -# Tagged public releases for Windows, macOS and Linux. +# Tagged public releases for macOS and Linux. +# Windows is signed on a card and published separately - see the matrix below. # # git tag v1.4.0 && git push origin v1.4.0 # @@ -70,11 +71,32 @@ jobs: strategy: fail-fast: false matrix: + # WINDOWS IS NOT BUILT HERE, on purpose. + # + # Its code signing key lives on a Certum card - CA/Browser Forum rules + # have required code signing keys to sit on certified hardware since + # June 2023, so there is no .pfx and no secret to configure - and a + # GitHub-hosted runner has no card reader. A Windows build produced here + # could only ever be UNSIGNED, and shipping that is worse than shipping + # nothing: every customer sees "Unknown publisher". + # + # It is built and published from a desk instead: + # npm run build (with POSNIC_SIGN_SHA1 set) + # npm run release:windows -- + # + # That command refuses to publish anything unsigned, untimestamped, or + # whose latest.yml does not match the installer beside it. include: - - { os: windows-latest, name: Windows, flag: '--win --x64' } - { os: macos-latest, name: macOS, flag: '--mac' } - { os: ubuntu-latest, name: Linux, flag: '--linux --x64' } runs-on: ${{ matrix.os }} + # secrets cannot appear in step-level `if:` expressions (GitHub refuses + # the whole file, silently, as a 0-second startup failure) - so their + # PRESENCE is computed here, where secrets are legal, and the steps + # branch on these strings instead. + env: + HAVE_MAC_CERT: ${{ secrets.MAC_CERT_P12 != '' }} + HAVE_NOTARY: ${{ secrets.ASC_API_KEY_P8 != '' }} steps: - uses: actions/checkout@v7 with: @@ -108,7 +130,7 @@ jobs: # MongoDB ships inside the installer and its binaries are not in git - # they are 90 MB of someone else's build output. A developer gets them - # from download-mongodb.bat; a runner has to fetch them itself, and + # from src/download-mongodb.bat; a runner has to fetch them itself, and # without this the packaged app has no database to start. # The database, for whichever machine this is. # @@ -122,8 +144,8 @@ jobs: shell: bash run: | set -euo pipefail - VERSION=$(grep -oE 'set MONGODB_VERSION=[0-9.]+' download-mongodb.bat | cut -d= -f2) - echo "MongoDB $VERSION, the version download-mongodb.bat pins" + VERSION=$(grep -oE 'set MONGODB_VERSION=[0-9.]+' src/download-mongodb.bat | cut -d= -f2) + echo "MongoDB $VERSION, the version src/download-mongodb.bat pins" fetch_tgz() { # url, destination bin directory curl -fsSL -o mongo.tgz "$1" @@ -179,22 +201,78 @@ jobs: - name: Prepare everything the installer bundles run: npm run prepare:bundle + # macOS signing + notarization (RELEASE_TRUST_PLAN §3). Everything here + # is DORMANT until the Apple secrets exist: without them the build is + # exactly what it was before - unsigned, loudly labelled as such - and + # with them electron-builder signs with the Developer ID certificate, + # submits to Apple's notary service and staples the ticket. Unlike the + # Windows key (hardware card, desk only), Apple credentials are files, + # so CI is the right place for them. + - name: Stage Apple notarization credentials + if: matrix.name == 'macOS' && env.HAVE_NOTARY == 'true' + env: + ASC_API_KEY_P8: ${{ secrets.ASC_API_KEY_P8 }} + run: | + echo "$ASC_API_KEY_P8" > "$RUNNER_TEMP/asc_api_key.p8" + echo "APPLE_API_KEY=$RUNNER_TEMP/asc_api_key.p8" >> "$GITHUB_ENV" + # electron-builder would publish to the release by itself; it is turned # off here so that a half-finished matrix never leaves a release with # only one platform attached. - name: Build - run: npx electron-builder ${{ matrix.flag }} --publish never + run: > + npx electron-builder ${{ matrix.flag }} --publish never + ${{ matrix.name == 'macOS' && env.HAVE_NOTARY == 'true' && '--config.mac.notarize=true' || '' }} env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - # Windows does not include the Visual C++ runtime. A binary that needs it - # and cannot find one runs on every machine we test and dies with - # 0xC0000135 on a customer's clean install, before it can log anything. - # Checked here because that is the last point where the answer is still - # cheap. - - name: Native binaries can load on a clean Windows - if: matrix.name == 'Windows' - run: node scripts/check-native-runtime.js + CSC_LINK: ${{ matrix.name == 'macOS' && secrets.MAC_CERT_P12 || '' }} + CSC_KEY_PASSWORD: ${{ matrix.name == 'macOS' && secrets.MAC_CERT_PASSWORD || '' }} + APPLE_API_KEY_ID: ${{ secrets.ASC_API_KEY_ID }} + APPLE_API_ISSUER: ${{ secrets.ASC_API_ISSUER }} + + # The gate that makes an un-notarized dmg impossible to publish once the + # credentials exist - the same promise scripts/release-windows.js makes + # for the exe: signed and accepted by the OS's own assessor, or no build. + - name: Verify macOS signature and notarization + if: matrix.name == 'macOS' && env.HAVE_MAC_CERT == 'true' + env: + APPLE_API_KEY_ID: ${{ secrets.ASC_API_KEY_ID }} + APPLE_API_ISSUER: ${{ secrets.ASC_API_ISSUER }} + run: | + set -euo pipefail + APP=$(find dist/mac* -maxdepth 1 -name '*.app' | head -1) + codesign --verify --deep --strict --verbose=2 "$APP" + if [ "$HAVE_NOTARY" = "true" ]; then + spctl -a -vv "$APP" + # electron-builder notarizes the APP while packing - the dmg is + # born afterwards, signed but ticketless, and Gatekeeper's + # assessment of the container then says "Unnotarized Developer + # ID". The container earns its own ticket here, stapled so an + # offline install verifies too. + for DMG in dist/*.dmg; do + xcrun notarytool submit "$DMG" --key "$APPLE_API_KEY" --key-id "$APPLE_API_KEY_ID" --issuer "$APPLE_API_ISSUER" --wait + xcrun stapler staple "$DMG" + spctl -a -t open -vv --context context:primary-signature "$DMG" + done + echo "macOS artifacts are signed, notarized and Gatekeeper-approved" + else + echo "::warning::signed but NOT notarized - ASC API key not configured yet (RELEASE_TRUST_PLAN Appendix A2)" + fi + + - name: Warn when the macOS build ships unsigned + if: matrix.name == 'macOS' && env.HAVE_MAC_CERT != 'true' + run: echo "::warning::macOS build is UNSIGNED - Apple secrets (MAC_CERT_P12 etc.) are not configured yet. See RELEASE_TRUST_PLAN.md §3." + + # The clean-Windows runtime check moved to scripts/release-windows.js + # along with the Windows build itself. Left here it would have been a step + # that never runs - `if: matrix.name == 'Windows'` against a matrix with + # no Windows in it - which reads as coverage and is not. + + # One CycloneDX document per downloadable package. Each file carries the + # package SHA-256, exact source commit, locked API graph, Electron runtime + # and the separately licensed MongoDB server bundled with the package. + - name: Generate artifact SBOMs + run: npm run release:sbom - name: Upload installers uses: actions/upload-artifact@v7 @@ -206,6 +284,12 @@ jobs: dist/*.zip dist/*.AppImage dist/*.deb + # Built on every Linux run (package.json declares the snap target) + # and then dropped here, so publish-snap.yml failed on every release + # trying to download a .snap the release never carried - a red X + # beside a store that was silently never updated. + dist/*.snap + dist/*.cdx.json # The update manifest, without which auto-update cannot work at all: # electron-updater fetches latest.yml - latest-mac.yml, latest-linux.yml # on the others - to learn what the newest version is. It was built on @@ -221,6 +305,11 @@ jobs: name: Publish release needs: build runs-on: ubuntu-latest + permissions: + contents: write + id-token: write + attestations: write + artifact-metadata: write env: ASSET_SIGNING_KEY: ${{ secrets.POSNIC_ASSET_SIGNING_KEY }} steps: @@ -254,8 +343,8 @@ jobs: run: | mkdir -p release find artifacts -type f \( -name '*.exe' -o -name '*.dmg' -o -name '*.zip' \ - -o -name '*.AppImage' -o -name '*.deb' -o -name 'latest*.yml' \ - -o -name '*.blockmap' \) -exec mv {} release/ \; + -o -name '*.AppImage' -o -name '*.deb' -o -name '*.snap' -o -name 'latest*.yml' \ + -o -name '*.blockmap' -o -name '*.cdx.json' \) -exec mv {} release/ \; # The machine-readable statement of what this release IS (version, # channel, schema + sync-protocol, oldest supported client). Fleet # tooling and the gateway read this instead of parsing file names. @@ -268,6 +357,95 @@ jobs: sha256sum $(ls | grep -vE 'latest.*\.yml$|\.blockmap$|release-manifest\.json$|asset-manifest\.json$') > SHA256SUMS.txt echo "Publishing:"; ls -lh + # Bind every package and package SBOM named in SHA256SUMS.txt to this + # repository, workflow, ref and commit. The action uses a short-lived + # GitHub OIDC identity; no long-lived signing key is stored in secrets. + - name: Attest release artifact provenance + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 + with: + subject-checksums: release/SHA256SUMS.txt + + # The notes serve two kinds of tag: the beta channel builds from here + # too (this workflow triggers on every v*), and a stable release must + # not greet customers with "this is an early public build". The beta + # warning is written only when the tag says beta; everything below it + # is true of both. + - name: Compose the release notes + env: + TAG: ${{ inputs.tag || github.ref_name }} + run: | + mkdir -p release + case "$TAG" in + *beta*|*alpha*|*rc*) + cat > release/NOTES.md <<'POSNIC_BETA' + ## Beta - please read before installing + + This is an early public build. It works, it is tested, and it is **not + finished**. Expect rough edges, and please report them. + POSNIC_BETA + ;; + *) + cat > release/NOTES.md <> release/NOTES.md <<'POSNIC_COMMON' + + ### About the installers + + - **Windows** is signed and timestamped. The installer names its + publisher, and no warning should appear. + - **macOS is signed and notarized** (Developer ID, checked by Apple's + notary service, ticket stapled) - Gatekeeper opens it like any app + from the App Store era. If you see a publisher warning, you are not + holding our build. + - **Linux**: install through the signed APT repository at + [packages.posnic.com](https://packages.posnic.com) and `apt` verifies + every package and every update from then on. The direct `.deb` and + AppImage remain, with checksums and detached GPG signatures beside them. + + Whatever you download, `SHA256SUMS.txt` on this page lists what the + bytes should be - and the release is provenance-attested, so GitHub can + prove it was built by this repository's own workflow. + + To check that for yourself, with the GitHub CLI installed: + + `gh attestation verify --repo Posnic/POS` + + That confirms the repository, workflow, ref and commit recorded for the + file. It is not a code signature, an independent audit, or proof that + the software is safe. It answers one question: did this file come out + of our build. + + Automatic updates check both the hash they were promised and, on + Windows and macOS, the code signature of what actually arrived - + an update that is not ours does not install. + + ### What to expect + + - Your data stays on your own computer. No account, and no internet needed. + - **Take your own backups.** *Backup Manager -> Backup Now*, and keep a copy on + another machine or a USB drive. This software holds your sales. + - Printing, scales and cash drawers are tested, but not on every model. Test + your hardware from *Config -> Device Setup* before a trading day. + - First launch takes a few minutes while the database is prepared. Later + launches take seconds. + + ### If something goes wrong + + Open an issue with what you did, what happened, and your log file attached - + `%APPDATA%\posnic\app.log` on Windows. For an urgent problem where a shop + cannot trade: **+91 94941 11161**, answered any hour. + + Free and open source under AGPL-3.0-only. Posnic Cloud (sync, off-site backups, + remote dashboard) is a separate paid service, and nothing here needs it. + POSNIC_COMMON + echo "--- release notes ---"; cat release/NOTES.md + - uses: softprops/action-gh-release@v3 with: tag_name: ${{ inputs.tag || github.ref_name }} @@ -283,44 +461,4 @@ jobs: # should be offered to installed copies - which is what verifying the # update path requires. prerelease: ${{ vars.POSNIC_PRERELEASE != 'no' }} - body: | - ## Beta - please read before installing - - This is an early public build. It works, it is tested, and it is **not - finished**. Expect rough edges, and please report them. - - ### The installers are not signed yet - - A code signing certificate is on the way. Until it arrives: - - - **Windows** will say *"Windows protected your PC"* and name an unknown - publisher. Choose **More info -> Run anyway**. - - **macOS** will refuse to open it. Right-click the app -> **Open**, or use - *System Settings -> Privacy & Security -> Open Anyway*. - - That warning is accurate. You are trusting the download rather than a - certificate, so **check `SHA256SUMS.txt` against your file before installing**, - and download only from this releases page. - - Automatic updates are not signature-verified in this build either. Posnic - checks the download against the hash it was told to expect, but nothing yet - proves that hash came from us. - - ### What to expect - - - Your data stays on your own computer. No account, and no internet needed. - - **Take your own backups.** *Backup Manager -> Backup Now*, and keep a copy on - another machine or a USB drive. This is a beta holding your sales. - - Printing, scales and cash drawers are tested, but not on every model. Test - your hardware from *Config -> Device Setup* before a trading day. - - First launch takes a few minutes while the database is prepared. Later - launches take seconds. - - ### If something goes wrong - - Open an issue with what you did, what happened, and your log file attached - - `%APPDATA%\posnic\app.log` on Windows. For an urgent problem where a shop - cannot trade: **+91 94941 11161**, answered any hour. - - Free and open source under AGPL-3.0-only. Posnic Cloud (sync, off-site backups, - remote dashboard) is a separate paid service, and nothing here needs it. + body_path: release/NOTES.md diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 000000000..6947c578a --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,50 @@ +name: OpenSSF Scorecard + +on: + push: + branches: [develop] + schedule: + - cron: '31 4 * * 3' + workflow_dispatch: + +permissions: read-all + +jobs: + analysis: + name: Supply-chain security analysis + if: github.event.repository.private == false + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + actions: read + checks: read + contents: read + id-token: write + issues: read + pull-requests: read + security-events: write + + steps: + - name: Check out the repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run OpenSSF Scorecard + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: Retain the SARIF result for diagnosis + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: openssf-scorecard-sarif + path: results.sarif + retention-days: 5 + + - name: Upload findings to code scanning + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + with: + sarif_file: results.sarif diff --git a/.github/workflows/sync-main-to-develop.yml b/.github/workflows/sync-main-to-develop.yml new file mode 100644 index 000000000..25ffaf03e --- /dev/null +++ b/.github/workflows/sync-main-to-develop.yml @@ -0,0 +1,83 @@ +# Keep develop from drifting behind main. +# +# The normal direction is develop -> main: work lands on develop, gets tested, +# and the owner promotes it. main only moves ahead of develop when something +# skipped that path - a hotfix applied directly, or the merge commit a release +# creates. Left alone, develop then silently lacks a fix that is already live, +# and the next contributor branches from a tree that is missing it. +# +# This opens a pull request rather than pushing. Both branches are restricted to +# the owner on purpose, and a workflow that force-pushed past that would make +# the protection a decoration. The owner stays the only thing that merges; +# this only notices and asks. +name: Sync main to develop + +on: + push: + branches: [main] + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +concurrency: + group: sync-main-to-develop + cancel-in-progress: true + +jobs: + sync: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + with: + fetch-depth: 0 + + - name: Is develop actually behind? + id: check + run: | + git fetch origin main develop + # Commits on main that develop does not have. Zero is the normal + # case - after a release develop already contains everything. + BEHIND=$(git rev-list --count origin/develop..origin/main) + echo "behind=$BEHIND" >> "$GITHUB_OUTPUT" + echo "develop is $BEHIND commit(s) behind main" + + - name: Open or update the sync pull request + if: steps.check.outputs.behind != '0' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + BRANCH="sync/main-to-develop" + + # A real merge, not a reset: develop may carry work main has never + # seen, and resetting it to main would delete that silently. + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git checkout -B "$BRANCH" origin/develop + + if git merge --no-edit origin/main; then + CONFLICT="" + else + # Conflicts are left in the branch deliberately. A person has to + # resolve them, and hiding that by aborting would leave develop + # quietly behind with nothing to show for it. + git merge --abort || true + git checkout -B "$BRANCH" origin/main + CONFLICT=" (main had conflicts with develop - this branch is main, so review carefully)" + fi + + git push -f origin "$BRANCH" + + BODY="main has moved ahead of develop by ${{ steps.check.outputs.behind }} commit(s)${CONFLICT}. + + That normally means a hotfix went straight to main, or this is the merge a release created. Either way develop should pick it up, or the next contributor branches from a tree that is missing a fix which is already live. + + Nothing here is new work - it is main's own commits." + + if gh pr list --head "$BRANCH" --state open --json number --jq 'length' | grep -q '^0$'; then + gh pr create --base develop --head "$BRANCH" \ + --title "Sync main into develop" --body "$BODY" --label "area: contributor" + else + echo "a sync pull request is already open" + fi diff --git a/.github/workflows/translations.yml b/.github/workflows/translations.yml new file mode 100644 index 000000000..f0cabb484 --- /dev/null +++ b/.github/workflows/translations.yml @@ -0,0 +1,89 @@ +# Checks a translation pull request the way a maintainer would, but instantly. +# +# A translation PR needs almost none of the repository's CI - no Electron, no +# MongoDB, no packaging. It needs three questions answered, and answered fast +# enough that a first-time contributor is not left guessing: +# +# is the file still valid JSON +# did the encoding survive the round trip +# did anything outside the language files change +# +# The encoding question is the one a human reviewer cannot answer. Nine Tamil +# strings shipped to the sale screen as UTF-8-saved-as-cp1252 and were live for +# months, because mojibake is invisible to anyone who does not read the script. +name: Translations + +on: + pull_request: + paths: + - 'languages/**' + - 'frontend/gulpfile.js/config.js' + - 'tests/tools/i18n-coverage.js' + +# A contributor pushing three times in a row should not queue three runs. +concurrency: + group: translations-${{ github.event.pull_request.number }} + cancel-in-progress: true + +permissions: + contents: read + # To ask the API which files the PR touches, rather than trying to work it + # out from a shallow clone that does not contain both ends of the diff. + pull-requests: read + +jobs: + check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + + - uses: actions/setup-node@v7 + with: + node-version: '22' + + # No npm install. These checks read files; pulling a dependency tree to + # do that would make the run slower than the contribution. + - name: Language files are valid + run: node tests/tools/check-translations.js + + - name: Coverage + run: node tests/tools/i18n-coverage.js + + # ADVISORY ONLY. This step must never fail a run, and it has to be written + # that way rather than intended that way. + # + # It used to read the diff with git, from a checkout that is both shallow + # and - on a pull_request event - the MERGE commit, so the head sha was + # simply not in local history. `git diff BASE HEAD` said "bad object", the + # HEAD~1 fallback said "unknown revision" on a depth-1 clone, and `bash -e` + # turned an advisory note into exit 128. Every translation PR would have + # gone red with a git error, which is exactly the experience the rest of + # this file exists to avoid. + # + # The API knows the file list without any history, so ask it. + - name: Nothing outside the language files changed + continue-on-error: true + env: + BASE: ${{ github.event.pull_request.base.sha }} + GH_TOKEN: ${{ github.token }} + PR: ${{ github.event.pull_request.number }} + run: | + # A translation PR that also edits application code is not a + # translation PR. Saying so here is quicker and kinder than a + # reviewer noticing on the third read. + git fetch --no-tags --depth=1 origin "$BASE" >/dev/null 2>&1 || true + CHANGED=$(git diff --name-only "$BASE" HEAD || git diff --name-only HEAD~1 HEAD) + CHANGED=$(gh pr diff "$PR" --name-only) || { + echo "::notice::Could not read the file list; skipping this check." + exit 0 + } + echo "Changed:"; echo "$CHANGED" | sed 's/^/ /' + UNEXPECTED=$(echo "$CHANGED" | grep -v -E '^(languages/|docs/|\.github/)' \ + | grep -v -E '^(frontend/gulpfile\.js/config\.js|tests/tools/[a-z-]+\.js|tests/i18n\.test\.js)$' \ + || true) + if [ -n "$UNEXPECTED" ]; then + echo "" + echo "::warning::This PR changes files outside languages/. That may be" + echo "fine, but it needs a maintainer rather than a translation review:" + echo "$UNEXPECTED" | sed 's/^/ /' + fi diff --git a/.gitignore b/.gitignore index 78da4af2e..6845fced7 100644 --- a/.gitignore +++ b/.gitignore @@ -98,3 +98,12 @@ builds/brand-seed/ *-debug.jpg screenshot-*.png asset-signing-key.private.pem +.demo-review/ + +# a dev till pointed at the wrong anchor once wrote its database here +src/mongodb/ + +# Translator worksheets (tests/tools/i18n-coverage.js --worksheet). A working +# file on its way to a person and back; the translations belong in +# frontend/languages/.json once merged, not in a half-filled sheet. +*-to-translate.json diff --git a/.husky/pre-commit b/.husky/pre-commit new file mode 100755 index 000000000..f841cf21a --- /dev/null +++ b/.husky/pre-commit @@ -0,0 +1,2 @@ +#!/usr/bin/env sh +npx lint-staged diff --git a/CITATION.cff b/CITATION.cff new file mode 100644 index 000000000..ad557e522 --- /dev/null +++ b/CITATION.cff @@ -0,0 +1,30 @@ +cff-version: 1.2.0 +message: >- + If you use Posnic POS in research, cite the exact release or commit you + evaluated together with these project metadata. +title: Posnic POS +type: software +abstract: >- + Posnic POS is zero-price, offline-first open source POS and billing software + for retail shops and restaurants. Posnic's own source is AGPL-3.0-only. + Release packages include separately licensed components, including MongoDB + Community Server under SSPL-1.0. Its primary API and database run on the shop + computer or on a server you control, with optional external payment, cloud, + and integration dependencies. +authors: + - name: Posnic Innovations Private Limited +repository-code: https://github.com/Posnic/POS +url: https://posnic.io/ +license: AGPL-3.0-only +version: 1.6.1 +keywords: + - point of sale + - POS software + - open source POS + - offline POS + - online/offline POS + - offline-first + - retail + - restaurant + - inventory management + - billing software diff --git a/README.md b/README.md index 4a1c85a82..4e62680dd 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,22 @@
-Posnic +Posnic # Posnic -**Point of sale that never goes down.** +**Free open source POS and billing software with public source, local checkout +and online/offline workflows.** -A complete, offline-first POS for shops, restaurants and pharmacies. -Your data lives on your own computer. No internet required, ever. +An offline-first POS for retail shops and restaurants. The primary API and +database run on the shop computer or on a server you control; electronic +payments, optional cloud services, downloads and integrations can still need a +network. + +Posnic's own source is AGPL-3.0-only. Release packages also bundle separately +licensed components, including MongoDB Community Server under SSPL-1.0. Review +the [package notices](THIRD-PARTY-NOTICES.md) and +[reproduced package evidence](https://posnic.com/assets/posnic-package-license-evidence.json) +before making a package-level licence statement. [![CI](https://github.com/Posnic/POS/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/Posnic/POS/actions/workflows/ci.yml) [![Release](https://github.com/Posnic/POS/actions/workflows/release.yml/badge.svg)](https://github.com/Posnic/POS/actions/workflows/release.yml) @@ -15,29 +24,75 @@ Your data lives on your own computer. No internet required, ever. [![Latest release](https://img.shields.io/github/v/release/Posnic/POS?include_prereleases&label=latest&color=blue)](https://github.com/Posnic/POS/releases/latest) [![Tests](https://img.shields.io/badge/tests-9%2C000%2B%20passing-brightgreen)](docs/DEVELOPMENT.md#running-the-tests) [![Coverage](https://img.shields.io/badge/coverage-66%25%20statements-yellow)](docs/DEVELOPMENT.md#running-the-tests) -[![API](https://img.shields.io/badge/REST%20API-571%20endpoints-blue)](docs/API.md) -[![Licence](https://img.shields.io/badge/licence-AGPL--3.0-blue)](LICENSE) +[![API](https://img.shields.io/badge/REST%20API-608%20endpoints-blue)](docs/API.md) +[![Source licence](https://img.shields.io/badge/source%20licence-AGPL--3.0-blue)](LICENSE) +[![Package notices](https://img.shields.io/badge/package%20notices-component%20licences-informational)](THIRD-PARTY-NOTICES.md) [![Platforms](https://img.shields.io/badge/platforms-Windows%20%7C%20macOS%20%7C%20Linux-lightgrey)](https://github.com/Posnic/POS/releases/latest) ### [⬇ Download for Windows](https://github.com/Posnic/POS/releases/latest) · [macOS](https://github.com/Posnic/POS/releases/latest) · [Linux](https://github.com/Posnic/POS/releases/latest) -[User guide](docs/USER_GUIDE.md) · [Developer guide](docs/DEVELOPMENT.md) · [Architecture](docs/ARCHITECTURE.md) · [API](docs/API.md) · [Discussions](https://github.com/Posnic/POS/discussions) +### [▶ Try the live demo](https://demo.posnic.io) — nothing to install, resets on the hour + +Log in as `admin` / `admin`, `manager` / `manager` or `cashier` / `cashier` — +the login page has one-tap buttons for all three. It is a real supermarket +shop with a week of sample trading, running the same code as this repository; +ring up sales, break things freely, and the whole shop is restored on the +hour. Outbound email, SMS and password changes are switched off there. + +[Website](https://posnic.io/) · [Product facts](https://posnic.com/posnic-facts) · [Package evidence](https://posnic.com/assets/posnic-package-license-evidence.json) · [CodeMeta metadata](codemeta.json) · [Citation metadata](CITATION.cff) · [Roadmap](docs/ROADMAP.md) · [Contributor quickstart](docs/CONTRIBUTOR_QUICKSTART.md) · [User guide](docs/USER_GUIDE.md) · [Developer guide](docs/DEVELOPMENT.md) · [Architecture](docs/ARCHITECTURE.md) · [API](docs/API.md) · [Discussions](https://github.com/Posnic/POS/discussions)
--- -## Why Posnic +## Posnic in use + +![A completed cash sale in Posnic v1.3.0](docs/images/offline-sale-v1-3-0.png) -Most point-of-sale software stops working when the internet does. Posnic runs -its database and its API on the till itself, so a dropped connection is not an -outage — it is nothing at all. A shop can unplug the router and keep selling. +This synthetic cash sale was completed and reopened during the bounded +[offline workflow verification](https://posnic.com/posnic-facts). The published +test notes state what was blocked, what passed and what the result does not +prove. -- **Free forever, and complete.** Not a trial, not a crippled edition. A shop - can run its entire business on it without paying anyone. -- **Your data stays yours.** It is on your machine. No account, no signup, no - telemetry. See [PRIVACY.md](PRIVACY.md). -- **Open source under AGPL-3.0-only.** Read it, change it, self-host it, fork it. +## Why Posnic + +Posnic runs its primary database and API on the till itself. In a bounded +v1.3.0 Windows test, one synthetic cash sale completed and reopened while +external hosts were blocked inside Electron. This does not prove an +operating-system-wide outage, complete shift, payment-terminal path, power-loss +recovery or every workflow. Review the +[versioned evidence and limitations](https://posnic.com/posnic-facts). + +- **Free local edition.** The v1.3.0 desktop packages have no trial clock and + have a zero software price. Posnic's own source is AGPL-3.0-only; packaged + dependencies retain their own licences. Hardware, support, backups, optional + services and downtime can still create operating costs. +- **Local data path.** The local edition needs no Posnic account, and its + published privacy policy says it sends no analytics or telemetry to Posnic. + See [PRIVACY.md](docs/PRIVACY.md). +- **Posnic source under AGPL-3.0-only.** Read it, change it, self-host it and + fork it under the licence terms. Review each bundled component separately. + +### Using Posnic in a real business or pilot? + +Share a bounded +[deployment evidence report](https://github.com/Posnic/POS/issues/new?template=deployment_evidence.yml), +including failures, workarounds, or why a trial stopped. The form records the +exact version, relationship, observation window, workflows and limitations while +letting you refuse marketing reuse. Read the +[adoption evidence policy](docs/ADOPTION_EVIDENCE.md) before posting private or +production information. + +### Reviewing Posnic independently? + +Use the public [review brief](https://posnic.com/assets/posnic-independent-review-brief.txt) +and [24-control protocol](https://posnic.com/assets/posnic-independent-review-protocol.csv) +with the exact release, package filename and SHA-256 you tested. Review access +does not require payment, positive coverage, a backlink or advance approval. +Publish failures, conflicts and untested areas beside successful results. An +independent evaluator can submit a bounded public result through the +[deployment evidence form](https://github.com/Posnic/POS/issues/new?template=deployment_evidence.yml) +without granting marketing reuse. ## Features @@ -48,17 +103,38 @@ outage — it is nothing at all. A shop can unplug the router and keep selling. | **Customers** | Customer accounts, categories with their own pricing, outstanding balances | | **Tax** | GST invoices, IGST and CGST/SGST, HSN codes, GST reports for filing | | **Restaurants** | Kitchen order tickets, table management, kiosk and customer displays | -| **Hardware** | Thermal printers, barcode scanners, cash drawers, weighing scales, second displays | +| **Hardware** | Documented paths for thermal printers, barcode scanners, cash drawers, weighing scales and second displays; verify the exact device in the [hardware matrix](docs/HARDWARE_MATRIX.md) | | **Reports** | Sales, purchases, inventory, expenses, profit, staff activity — all exportable | | **Branches** | Multiple outlets, per-branch stock, staff roles and permissions | ## Install -Download the installer for your platform from +Posnic installs two ways, both free and both the same AGPL-3.0 software. +**Most shops want the desktop app.** + +| | **Desktop** | **Your own server** | +|---|---|---| +| Install | Download and run | One command on Ubuntu | +| Used from | That computer | A browser on any till, tablet or phone on the network | +| Data lives | That computer | Your server | +| Needs internet | No | No — your own network is enough | +| Somebody maintains it | No | **You** — updates, backups, certificate | +| Sync between shops | Posnic Cloud | Posnic Cloud | + +A server is not a better desktop; it is a machine somebody has to look after. If +one person rings up sales on one computer, the desktop app is the right answer +and always will be. + +### Desktop + +Download the package for your platform from **[the latest release](https://github.com/Posnic/POS/releases/latest)**, run it, -and follow the wizard. Nothing else to install — the database ships inside. +and follow the wizard. Current v1.6.1 packages include MongoDB Community Server +under its separate SSPL-1.0 licence, so no separate database install is needed +for the bundled setup. See [third-party notices](THIRD-PARTY-NOTICES.md). -Verify your download against `SHA256SUMS.txt` in the release. +Verify your download against `SHA256SUMS.txt`. For releases that provide an +artifact-bound SBOM and provenance, follow the [release verification guide](docs/VERIFY_RELEASE.md). > **Windows** may warn that the publisher is unrecognised: *More info* → *Run > anyway*. **macOS**: *System Settings → Privacy & Security → Open Anyway*. @@ -67,6 +143,35 @@ Verify your download against `SHA256SUMS.txt` in the release. First launch takes a few minutes while it sets up its database. After that, seconds. Full walkthrough in the **[user guide](docs/USER_GUIDE.md)**. +### Your own server + +Ubuntu 24.04, 2 GB of memory, 8 GB of disk. A 2 GB virtual machine from any +provider runs a single shop comfortably. + +```bash +curl -fsSL https://raw.githubusercontent.com/Posnic/POS/main/scripts/install-server.sh -o install-server.sh +less install-server.sh # read it first - you are about to run it as root +sudo bash install-server.sh +``` + +It installs Node.js 22, MongoDB 8 and Posnic into `/opt/posnic`, generates that +machine's own secrets, and runs it under systemd so it survives a reboot. When +it finishes it prints the address to open. Re-running it updates Posnic and +leaves your secrets and your data alone. + +Three things it cannot do for you, none of them optional on a shop taking real +money: **get a certificate** (without one, passwords cross the network in the +clear), **keep port 27017 off the internet**, and **restore a backup once** to +prove it is a backup rather than a file. + +**Self-hosting does not include sync between tills or branches.** That is +[Posnic Cloud](https://posnic.com/pricing.html). A self-hosted Posnic is one +database several people use at once — which is what most single-shop setups +actually want — not several databases kept in step. + +Full guide, including installing by hand on other systems: +**[docs/SELF_HOSTING.md](docs/SELF_HOSTING.md)**. + ## Build from source ```bash @@ -77,9 +182,10 @@ npm --prefix api install npm start ``` -Needs Node 22.12+. You do **not** need to install MongoDB — Posnic brings its own -and picks a port derived from the app name so it never collides with a database -you already run. +Needs Node 22.12+. The build tooling fetches MongoDB Community Server 7.0.14 and +the desktop process chooses a port derived from the app name to reduce collision +risk. Review [the architecture](docs/ARCHITECTURE.md) and package licences before +building or distributing an artifact. ```bash npm run build # Windows installer @@ -87,66 +193,82 @@ npm run build:mac npm run build:linux ``` -See the **[developer guide](docs/DEVELOPMENT.md)** for tests, linting and +New contributors should start with the +**[contributor quickstart](docs/CONTRIBUTOR_QUICKSTART.md)**. See the +**[developer guide](docs/DEVELOPMENT.md)** for deeper tests, linting and conventions. ## Editions -The desktop application is free and open source. **Posnic Cloud** is a paid -service for shops that want more than one till. +The desktop packages have a zero software price and no trial clock. Posnic's own +source is AGPL-3.0-only, while bundled components keep their separate licences. +**Posnic Cloud** is a paid service for shops that want more than one till. | | Posnic (this repo) | Posnic Cloud | |---|---|---| -| Full POS, offline, unlimited items and sales | ✅ | ✅ | +| Selected local workflows and local operational records | ✅ | ✅ | | Local database and backups | ✅ | ✅ | -| Hardware: printers, scanners, drawers, scales | ✅ | ✅ | +| Documented printer, scanner, drawer and scale paths | ✅ | ✅ | | GST invoicing and reports | ✅ | ✅ | +| Runs on your own server, used from a browser | ✅ | ✅ | | Sync across tills and branches | | ✅ | | Off-site backups, remote dashboard | | ✅ | | Installer under your own brand | | ✅ | +Both ways of running Posnic — [desktop and your own server](#install) — sit in +the left column. Neither is a trial and neither expires. + **We do not move features from the left column to the right.** What is free today stays free. Cloud has to earn its price by being useful, not by making -the free edition worse. This is written down in [GOVERNANCE.md](GOVERNANCE.md). +the free edition worse. This is written down in [GOVERNANCE.md](docs/GOVERNANCE.md). ## Documentation | | | |---|---| | [User guide](docs/USER_GUIDE.md) | Running a shop with Posnic, first sale to closing the till | +| [Contributor quickstart](docs/CONTRIBUTOR_QUICKSTART.md) | Local setup, test commands, issue map, PR flow and safety rules | | [Developer guide](docs/DEVELOPMENT.md) | Setup, tests, conventions, good first issues | | [Architecture](docs/ARCHITECTURE.md) | How it fits together, and the parts that bite | -| [REST API](docs/API.md) | 571 endpoints, generated from the routes | +| [REST API](docs/API.md) | 608 endpoints, generated from the routes | | [Hardware](docs/HARDWARE_MATRIX.md) | Printers, scanners, drawers, scales — and how far each claim is checked | +| [India e-invoicing](docs/INDIA_EINVOICING_DESIGN.md) | Research, readiness inventory and design for GST e-invoicing as an optional feature; no live IRP submission is built | | [Backups](docs/BACKUP_POLICY.md) | What is backed up, when, and what it does not protect you from | | [Disaster recovery](docs/DISASTER_RECOVERY.md) | Getting back to working, with RPO and RTO as numbers | | [Release runbook](docs/RELEASE_RUNBOOK.md) | How a release goes out, and four ways to take one back | +| [Release verification](docs/VERIFY_RELEASE.md) | Match a package to its checksum, CycloneDX inventory, provenance and component licences | | [Support lifecycle](docs/SUPPORT_LIFECYCLE.md) | Which versions get fixes, and for how long | | [Incident response](docs/INCIDENT_RESPONSE.md) | Who decides, who is told, and when | -| [Terms of use](TERMS_OF_USE.md) | Customer terms for Posnic Cloud | +| [Terms of use](docs/TERMS_OF_USE.md) | Customer terms for Posnic Cloud | | [Subprocessors](docs/SUBPROCESSORS.md) | Who else can touch your data. For the local edition: nobody | | [Cloud operations](docs/CLOUD_OPERATIONS.md) | What the paid service is made of, and what is still to be decided | | [Data processing addendum](docs/DATA_PROCESSING_ADDENDUM.md) | For customers who need a written DPA | -| [Contributing](CONTRIBUTING.md) | How to get a change merged | -| [Support](SUPPORT.md) | Where to ask, and what happens to your issue | -| [Governance](GOVERNANCE.md) | Who decides what, and what we have promised | -| [Privacy](PRIVACY.md) | What the app collects, and what it does not | -| [Security](SECURITY.md) | What Posnic protects, what it cannot, and reporting a vulnerability | -| [Third-party notices](THIRD-PARTY-NOTICES.md) | Other people's software that ships inside the installer | -| [Code of conduct](CODE_OF_CONDUCT.md) | How we treat each other | +| [Contributing](.github/CONTRIBUTING.md) | How to get a change merged | +| [Public roadmap](docs/ROADMAP.md) | Current priorities, evidence gaps and structured ways to help | +| [Citation metadata](CITATION.cff) | Human and tool-readable citation identity for exact releases or commits | +| [Adoption evidence](docs/ADOPTION_EVIDENCE.md) | How real deployment reports are scoped, reviewed, cited, corrected and kept privacy-safe | +| [Support](.github/SUPPORT.md) | Where to ask, and what happens to your issue | +| [Governance](docs/GOVERNANCE.md) | Who decides what, and what we have promised | +| [Privacy](docs/PRIVACY.md) | What the app collects, and what it does not | +| [Security](.github/SECURITY.md) | What Posnic protects, what it cannot, and reporting a vulnerability | +| [Third-party notices](THIRD-PARTY-NOTICES.md) | Separately licensed software included in release packages | +| [CodeMeta](codemeta.json) | Machine-readable product, publisher, source, licence and platform identity | +| [Code of conduct](.github/CODE_OF_CONDUCT.md) | How we treat each other | ## Contributing Bug reports, fixes, translations, hardware quirks from real shops, documentation -— all welcome, and none of it requires permission to start. +— all welcome, and none of it requires permission to start. The +[contributor quickstart](docs/CONTRIBUTOR_QUICKSTART.md) gives the local setup, +test commands and public feature-ticket map. Good places to begin are listed in the [developer guide](docs/DEVELOPMENT.md#good-first-issues): 19 known-failing tests, 21 real latent bugs the linter found, and two very large files that want splitting. -Read [CONTRIBUTING.md](CONTRIBUTING.md) first. Security issues go to -[SECURITY.md](SECURITY.md), privately — never a public issue. +Read [CONTRIBUTING.md](.github/CONTRIBUTING.md) first. Security issues go to +[SECURITY.md](.github/SECURITY.md), privately — never a public issue. ## Buy the team a chai ☕ @@ -157,7 +279,7 @@ little back is what keeps the next release coming. | | | |---|---| | ☕ **[Buy us a chai](https://github.com/sponsors/Posnic)** | one-off or monthly, from a dollar up | -| ☁️ **[Posnic Cloud](https://posnic.com/pricing.html)** | sync, off-site backups, remote dashboards — the paid service that funds this one | +| ☁️ **[Posnic Cloud](https://posnic.com/pricing)** | sync, off-site backups, remote dashboards — the paid service that funds this one | | 🏢 **Commercial licence** | keep your modifications private — **info@posnic.com** | Sponsors are named in releases unless they would rather not be. @@ -169,27 +291,29 @@ Sponsors are named in releases unless they would rather not be. | | | |---|---| | Sales and licensing | **info@posnic.com** | -| Support | [SUPPORT.md](SUPPORT.md) · [Discussions](https://github.com/Posnic/POS/discussions) | -| Security | **security@posnic.com** — privately, never a public issue ([SECURITY.md](SECURITY.md)) | -| Web | [posnic.com](https://posnic.com) | +| Support | [SUPPORT.md](.github/SUPPORT.md) · [Discussions](https://github.com/Posnic/POS/discussions) | +| Security | **security@posnic.com** — privately, never a public issue ([SECURITY.md](.github/SECURITY.md)) | +| Web | [posnic.io](https://posnic.io/) · [posnic.com](https://posnic.com) | Paid setup, migration from an existing till, hardware selection, custom reporting and white-labelled installers are all available. The software stays -free either way — see [GOVERNANCE.md](GOVERNANCE.md) for what we have promised +free either way — see [GOVERNANCE.md](docs/GOVERNANCE.md) for what we have promised never to move behind a paywall. -## Licence +## Source and package licences -[GNU AGPL-3.0-only](LICENSE). Use it, change it, self-host it, including for clients. -If you run a modified version as a hosted service, the AGPL requires you to -publish your modifications. +Posnic's own source is [GNU AGPL-3.0-only](LICENSE). Use, change, self-host and +redistribute that source under the licence terms. Release packages also include +separately licensed components; read [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) +and the licence material shipped with the exact artifact. This summary is not +legal advice. The **Posnic name and logo are trademarks** and are not covered by the AGPL — -see [GOVERNANCE.md § Trademark](GOVERNANCE.md#trademark-and-reserved-rights). +see [GOVERNANCE.md § Trademark](docs/GOVERNANCE.md#trademark-and-reserved-rights). Companies needing to keep modifications private can buy a commercial licence: **info@posnic.com**. Such a licence covers the code Posnic owns. Contributors keep the copyright in what they write and there is no CLA, so community code can only be relicensed with its author's agreement — a deliberate limit on our own power, set out in [GOVERNANCE.md § Contributor -copyright](GOVERNANCE.md#contributor-copyright). +copyright](docs/GOVERNANCE.md#contributor-copyright). diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md index d089b281b..8ea3b365f 100644 --- a/THIRD-PARTY-NOTICES.md +++ b/THIRD-PARTY-NOTICES.md @@ -1,10 +1,10 @@ # Third-party notices -Posnic is distributed under the GNU Affero General Public License v3.0 -(see [LICENSE](LICENSE)). The Windows installer also carries software written by -other people, under their own licences. Those licences are listed here, and the -obligation to name them is why this file exists — several of them require that -their notice travel with any copy. +Posnic's own source is distributed under GNU AGPL-3.0-only (see +[LICENSE](LICENSE)). Windows, macOS and Linux release packages also carry +software written by other people under their own licences. Those components +and known package notices are listed here. The root Posnic licence does not +replace a bundled component's licence. This covers what ships **inside the installer**. Node packages pulled in at build time carry their own licences in `node_modules`; `npm ls --omit=dev` will list @@ -14,24 +14,26 @@ them for a given build. ## MongoDB Community Server -**Shipped as:** `resources/mongodb/bin/mongod.exe` -**Version:** 7.0.x +**Shipped as:** `resources/mongodb/bin/mongod.exe` on Windows and +`resources/mongodb/bin/mongod` on macOS and Linux +**Version:** 7.0.14 (exact bundled release matching installer build pin) **Copyright:** © MongoDB, Inc. **Licence:** Server Side Public License, Version 1 (SSPL-1.0) -**Source and licence text:** +**Source:** +**Official licensing information:** + Posnic keeps a shop's data in a MongoDB instance running on the shop's own computer. The server binary is redistributed unmodified. -The SSPL is not an OSI-approved open source licence, and it is not the same -licence as Posnic's own. It applies to `mongod.exe` alone: it does not extend to -Posnic's source code, which is separate work that talks to MongoDB over its wire -protocol. Its principal condition concerns offering MongoDB itself to third -parties as a service, which Posnic does not do — it runs a local database for the -shop that installed it. +MongoDB states that SSPL is not an OSI-approved open-source licence. Posnic's +own source and the MongoDB binary are recorded as separately licensed +components. Review the exact licences, package contents and intended use or +distribution rather than assigning one licence to the complete bundle. This +notice records technical provenance and is not legal advice. If you would rather not receive it, the installer can be built without a bundled -MongoDB and pointed at one you already run; see `download-mongodb.bat` and +MongoDB and pointed at one you already run; see `download-mongodb.bat` and `MONGODB_URI`. ## Node.js @@ -71,7 +73,7 @@ listed in `LICENSES.chromium.html` beside the installed application) ## Microsoft Visual C++ Runtime **Shipped as:** `resources/mongodb/bin/msvcp140.dll`, -`vcruntime140.dll`, `vcruntime140_1.dll` +`vcruntime140.dll`, `vcruntime140_1.dll` (Windows package only) **Copyright:** © Microsoft Corporation **Licence:** Redistributed under the Microsoft Visual Studio redistributable terms, as files MongoDB requires to run. @@ -175,6 +177,21 @@ page loads are Font Awesome's. If that holds up under a proper check, most of these sets can be deleted outright and the question goes away rather than being answered. +### Flag icons + +**Shipped as:** `frontend/static/images/flags/1x1/` and `4x3/` - one SVG per +language the app offers (in, us, lk, np, sa, fr, es, pt, id, th, de, tz, nl, +it), and nothing else. The 238 other countries the stylesheet knows are not +bundled. + +| Set | Licence | Source | +| --- | --- | --- | +| flag-icons (formerly flag-icon-css) | MIT | `flag-icons` 7.5.0, `npm view flag-icons license`, 2 September 2026 | + +The eight added on 2 September 2026 and the four on 4 September (de, tz, nl, +it) were copied unmodified from that package for the language menu; `in.svg` and `us.svg` were already here from the +same project's earlier name. MIT needs its notice carried, which this file does. + ### What has been removed `flag-icon-css-master` — 528 files — is gone. Nothing referenced that path, and diff --git a/api/.gitignore b/api/.gitignore index 49c1834ec..72a3f39a7 100644 --- a/api/.gitignore +++ b/api/.gitignore @@ -171,3 +171,6 @@ test-install.sh *.clean.js *-refactored.controller.js + +# local dev database + machine-only secrets (never committed) +.local-db/ diff --git a/api/app.js b/api/app.js index 386c6f423..29147161a 100644 --- a/api/app.js +++ b/api/app.js @@ -130,16 +130,52 @@ const cspDirectives = { 'http://127.0.0.1:5555', ], }; -app.use( - helmet({ - contentSecurityPolicy: { - directives: cspDirectives, - }, - referrerPolicy: { - policy: 'strict-origin-when-cross-origin', - }, - }) -); + +/* + * upgrade-insecure-requests comes in with helmet's default directives. On + * the https production origin it is right; on a plain-http origin it + * rewrites every asset fetch to https:// and the page loads + * nothing. localhost is exempt (browsers treat it as trustworthy), which is + * why this only ever bites when the local copy is opened from another + * device - the owner's phone on the LAN (http://192.168.1.11:5055) got raw + * HTML with every script and stylesheet red in the network tab. + */ +if (process.env.NODE_ENV !== 'production') { + /* null, not delete: helmet merges these onto its defaults (useDefaults), + so a missing key silently comes back - null is the documented way to + switch a default directive off. */ + cspDirectives['upgrade-insecure-requests'] = null; +} + +/* + * Two policies, chosen per request: the locked-down one, and - only while + * the shop's own Google Analytics feature is ON (a Settings toggle plus the + * shop's own measurement id) - one that admits the Google domains. An + * unconfigured shop never carries the wider policy, so the PRIVACY.md + * promise is enforced by the header itself, not by convention. + */ +const { getAnalytics } = require('./src/services/analytics-config'); +const gaCspDirectives = { + ...cspDirectives, + 'script-src': [...cspDirectives['script-src'], 'https://www.googletagmanager.com'], + 'connect-src': [ + ...cspDirectives['connect-src'], + 'https://*.google-analytics.com', + 'https://*.analytics.google.com', + 'https://*.googletagmanager.com', + ], +}; +const helmetOptions = (directives) => ({ + contentSecurityPolicy: { directives }, + referrerPolicy: { policy: 'strict-origin-when-cross-origin' }, +}); +const helmetBase = helmet(helmetOptions(cspDirectives)); +const helmetGa = helmet(helmetOptions(gaCspDirectives)); +app.use((req, res, next) => { + getAnalytics() + .then((a) => (a.enabled ? helmetGa : helmetBase)(req, res, next)) + .catch(() => helmetBase(req, res, next)); +}); /* * Health, for a supervisor rather than a person. Registered here, before the @@ -174,13 +210,29 @@ app.use( * tenant-free by design - the login page and the update machinery read it * before any authentication exists. */ -app.get('/api/runtime-info', (req, res) => { +app.get('/api/runtime-info', async (req, res) => { const { buildRuntimeInfo } = require('./src/utils/runtime-info'); - return res.status(200).json(buildRuntimeInfo()); + const info = buildRuntimeInfo(); + /* the login page injects the shop's own GA pre-auth from here - the id is + not a secret (it sits in the page source of every GA-carrying site) */ + try { + info.analytics = await getAnalytics(); + } catch (e) { + info.analytics = { enabled: false, id: '' }; + } + info.demo = require('./src/config/demo-mode').isDemoMode(); + return res.status(200).json(info); }); -app.get('/runtime-info', (req, res) => { +app.get('/runtime-info', async (req, res) => { const { buildRuntimeInfo } = require('./src/utils/runtime-info'); - return res.status(200).json(buildRuntimeInfo()); + const info = buildRuntimeInfo(); + try { + info.analytics = await getAnalytics(); + } catch (e) { + info.analytics = { enabled: false, id: '' }; + } + info.demo = require('./src/config/demo-mode').isDemoMode(); + return res.status(200).json(info); }); app.get('/api/healthz', (req, res) => { @@ -331,6 +383,8 @@ app.use((err, req, res, next) => { next(err); // Pass other errors through }); +const { filterGuard } = require('./src/middleware/filter-guard'); + // Sanitization function to prevent NoSQL injection const sanitize = (obj) => { if (!obj || typeof obj !== 'object') return obj; @@ -369,7 +423,12 @@ app.use((req, res, next) => { req.body = sanitize({ ...req.body }); } - next(); + /* The gap the sanitiser above cannot see into: a filter arriving as a JSON + STRING is one ordinary-looking value to that walk, so its operators + survive to be parsed and spread into a live query. See + src/middleware/filter-guard.js - it is its own file so the behaviour can + be tested, which an inline closure in this file could not be. */ + return filterGuard(req, res, next); }); // XSS protection middleware @@ -624,17 +683,31 @@ const UPDATED_ASSETS = process.env.POSNIC_ASSET_DIR; * to the new hashed URLs, so it is the one thing that may never be stale. */ const HASHED_ASSET = /\.[0-9a-f]{8}\.(js|css)$/; +const STATIC_MEDIA = /\.(png|jpe?g|gif|svg|webp|ico|woff2?|ttf|eot|otf|mp3|wav)(\?.*)?$/i; function assetCacheHeaders(res, filePath) { if (HASHED_ASSET.test(filePath)) { res.setHeader('Cache-Control', 'public, max-age=31536000, immutable'); } else if (filePath.endsWith('.html')) { res.setHeader('Cache-Control', 'no-cache'); + } else if (STATIC_MEDIA.test(filePath)) { + /* + * Fonts and images went out with NO Cache-Control (this function only + * labelled the hashed bundles and html), so Cloudflare stamped its 4h + * default - Lighthouse: "use efficient cache lifetimes, 2,718 KiB". + * These names are not hashed, so not immutable - but a week is honest + * for artwork and font files that change a few times a year, and the + * service worker's versioned cache still refreshes them per release. + */ + res.setHeader('Cache-Control', 'public, max-age=604800'); } } if (UPDATED_ASSETS && fs.existsSync(UPDATED_ASSETS)) { console.log('[assets] serving updated assets from ' + UPDATED_ASSETS); - app.use('/', express.static(UPDATED_ASSETS, { fallthrough: true, setHeaders: assetCacheHeaders })); + app.use( + '/', + express.static(UPDATED_ASSETS, { fallthrough: true, setHeaders: assetCacheHeaders }) + ); } // Serve transformed frontend assets (used for login page, etc.) @@ -688,9 +761,15 @@ app.get('/print/:token', (req, res) => { let store; try { + /* packaged: resources/api beside resources/print-document-store.js */ store = require('../print-document-store'); } catch (e) { - return res.status(503).end(); + try { + /* dev checkout: the desktop shell lives in src/ */ + store = require('../src/print-document-store'); + } catch (e2) { + return res.status(503).end(); + } } const html = store.take(req.params.token); @@ -703,7 +782,10 @@ app.get('/print/:token', (req, res) => { }); // The compiled stylesheets reference ../fonts, which resolves to /fonts. -app.use('/fonts', express.static(path.join(BUILT_STATIC, 'fonts'), { fallthrough: true, maxAge: STATIC_MAX_AGE })); +app.use( + '/fonts', + express.static(path.join(BUILT_STATIC, 'fonts'), { fallthrough: true, maxAge: STATIC_MAX_AGE }) +); // Serving backend-specific static files (exports, uploads, etc.) app.use(express.static(path.join(__dirname, 'public'))); @@ -1052,9 +1134,10 @@ app.get(['/push/key', '/api/push/key'], sseProtect, async (req, res) => { }); app.post(['/push/subscribe', '/api/push/subscribe'], sseProtect, async (req, res) => { try { - const result = req.db && req.user - ? await pushInfra.subscribe(req.db, req.user._id, req.body && req.body.subscription) - : { ok: false }; + const result = + req.db && req.user + ? await pushInfra.subscribe(req.db, req.user._id, req.body && req.body.subscription) + : { ok: false }; if (!result.ok) return res.status(400).json({ type: 'error', message: 'Invalid subscription' }); res.json({ type: 'success', data: null, message: 'Subscribed' }); } catch (e) { @@ -1079,8 +1162,12 @@ app.get(['/webhooks', '/api/webhooks'], sseProtect, requireBranchWrite, async (r res.json({ type: 'success', data: rows.map((r) => ({ - id: r._id, url: r.url, events: r.events, - description: r.description, active: r.active, createdAt: r.createdAt, + id: r._id, + url: r.url, + events: r.events, + description: r.description, + active: r.active, + createdAt: r.createdAt, })), }); } catch (e) { @@ -1091,21 +1178,100 @@ app.post(['/webhooks', '/api/webhooks'], sseProtect, requireBranchWrite, async ( try { const result = await webhookInfra.addSubscription(req.db, req.body || {}); if (!result.ok) return res.status(400).json({ type: 'error', message: result.reason }); - res.json({ type: 'success', data: { id: result.id, secret: result.secret }, - message: 'Webhook registered. Store the secret now - it is not shown again.' }); + res.json({ + type: 'success', + data: { id: result.id, secret: result.secret }, + message: 'Webhook registered. Store the secret now - it is not shown again.', + }); } catch (e) { res.status(500).json({ type: 'error', message: 'Could not register webhook' }); } }); -app.delete(['/webhooks/:id', '/api/webhooks/:id'], sseProtect, requireBranchWrite, async (req, res) => { - try { - const result = await webhookInfra.removeSubscription(req.db, req.params.id); - res.json({ type: result.ok ? 'success' : 'error', data: null, - message: result.ok ? 'Webhook removed' : 'Not found' }); - } catch (e) { - res.status(500).json({ type: 'error', message: 'Could not remove webhook' }); +app.delete( + ['/webhooks/:id', '/api/webhooks/:id'], + sseProtect, + requireBranchWrite, + async (req, res) => { + try { + const result = await webhookInfra.removeSubscription(req.db, req.params.id); + res.json({ + type: result.ok ? 'success' : 'error', + data: null, + message: result.ok ? 'Webhook removed' : 'Not found', + }); + } catch (e) { + res.status(500).json({ type: 'error', message: 'Could not remove webhook' }); + } } -}); +); +/* + * Report email (owner ask): the client renders the exact PDF the user + * saw on screen and posts it here; the server only addresses and sends + * it through the same transport chain as the purchase-order mailer. + * Branch-write holders: mailing a report sends shop data outward. + */ +app.post( + ['/reports/email', '/api/reports/email'], + sseProtect, + requireBranchWrite, + express.json({ limit: '12mb' }), + async (req, res) => { + try { + const to = String(req.body?.to || '').trim(); + if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(to)) { + return res.status(400).json({ type: 'error', message: 'Enter a valid email address' }); + } + const b64 = String(req.body?.pdf_base64 || ''); + if (!b64 || b64.length > 12 * 1024 * 1024) { + return res.status(400).json({ type: 'error', message: 'Report PDF missing or too large' }); + } + const filename = + String(req.body?.filename || 'report') + .replace(/[^a-z0-9-_]/gi, '') + .slice(0, 60) || 'report'; + const title = String(req.body?.title || 'Report').slice(0, 120); + // Owner rule: the shop's own SMTP first, the platform chain otherwise. + const { resolveShopTransport } = require('./src/utils/email'); + let branchDoc = null; + try { + const bid = req.user && req.user.branch_id; + if (bid && req.db) { + branchDoc = await req.db + .collection('branches') + .findOne({ _id: new (require('mongodb').ObjectId)(String(bid)) }); + } + } catch (e) { + /* platform chain covers it */ + } + const resolved = resolveShopTransport(branchDoc); + const transporter = resolved.transporter; + const shopName = (req.user && req.user.branch_name) || 'Posnic POS'; + const info = await transporter.sendMail({ + from: `${shopName} <${resolved.from}>`, + to, + subject: `${title} - ${shopName}`, + text: `Please find attached: ${title}.`, + attachments: [{ filename: `${filename}.pdf`, content: Buffer.from(b64, 'base64') }], + }); + /* The dev fallback transport prints to console instead of delivering - + say so rather than claiming a send that never left the box. */ + if (!resolved.shopOwned && transporter.options && transporter.options.jsonTransport) { + return res.status(503).json({ + type: 'error', + message: 'Email is not configured on this server - the PDF was generated but not sent', + }); + } + return res.json({ + type: 'success', + data: { to, messageId: info.messageId || '' }, + message: 'Report emailed', + }); + } catch (e) { + console.error('Error in reports/email:', e); + return res.status(500).json({ type: 'error', message: 'Could not email the report' }); + } + } +); /* * Scoped API tokens (integration platform step 2) - minted with an explicit * ACL subset, hashed at rest, plaintext shown exactly once. Branch-write @@ -1118,8 +1284,13 @@ app.get(['/api-tokens', '/api/api-tokens'], sseProtect, requireBranchWrite, asyn res.json({ type: 'success', data: rows.map((r) => ({ - id: r._id, name: r.name, hint: r.token_hint, access: r.access, - active: r.active, createdAt: r.createdAt, last_used_at: r.last_used_at, + id: r._id, + name: r.name, + hint: r.token_hint, + access: r.access, + active: r.active, + createdAt: r.createdAt, + last_used_at: r.last_used_at, })), }); } catch (e) { @@ -1143,23 +1314,36 @@ app.post(['/api-tokens', '/api/api-tokens'], sseProtect, requireBranchWrite, asy res.status(500).json({ type: 'error', message: 'Could not create token' }); } }); -app.delete(['/api-tokens/:id', '/api/api-tokens/:id'], sseProtect, requireBranchWrite, async (req, res) => { - try { - const result = await apiTokens.revokeToken(req.db, req.params.id); - res.json({ type: result.ok ? 'success' : 'error', data: null, - message: result.ok ? 'Token revoked' : 'Not found' }); - } catch (e) { - res.status(500).json({ type: 'error', message: 'Could not revoke token' }); +app.delete( + ['/api-tokens/:id', '/api/api-tokens/:id'], + sseProtect, + requireBranchWrite, + async (req, res) => { + try { + const result = await apiTokens.revokeToken(req.db, req.params.id); + res.json({ + type: result.ok ? 'success' : 'error', + data: null, + message: result.ok ? 'Token revoked' : 'Not found', + }); + } catch (e) { + res.status(500).json({ type: 'error', message: 'Could not revoke token' }); + } } -}); +); -app.get(['/webhooks/deliveries', '/api/webhooks/deliveries'], sseProtect, requireBranchWrite, async (req, res) => { - try { - res.json({ type: 'success', data: await webhookInfra.recentDeliveries(req.db) }); - } catch (e) { - res.status(500).json({ type: 'error', message: 'Could not list deliveries' }); +app.get( + ['/webhooks/deliveries', '/api/webhooks/deliveries'], + sseProtect, + requireBranchWrite, + async (req, res) => { + try { + res.json({ type: 'success', data: await webhookInfra.recentDeliveries(req.db) }); + } catch (e) { + res.status(500).json({ type: 'error', message: 'Could not list deliveries' }); + } } -}); +); /* * WhatsApp connector lane (I6): the signed connector (I5) drains the @@ -1174,68 +1358,95 @@ const requireCustomerWrite = (req, res, next) => { return res.status(403).json({ type: 'error', message: 'This token cannot message customers' }); }; -app.post(['/connector/whatsapp/claim', '/api/connector/whatsapp/claim'], sseProtect, requireCustomerWrite, async (req, res) => { - try { - if (!req.db) return res.status(503).json({ type: 'error', message: 'No shop in context' }); - const rows = await waOutbox.claim(req.db, req.user.license, { limit: (req.body || {}).limit }); - res.json({ type: 'success', data: rows }); - } catch (e) { - res.status(500).json({ type: 'error', message: 'Claim failed' }); +app.post( + ['/connector/whatsapp/claim', '/api/connector/whatsapp/claim'], + sseProtect, + requireCustomerWrite, + async (req, res) => { + try { + if (!req.db) return res.status(503).json({ type: 'error', message: 'No shop in context' }); + const rows = await waOutbox.claim(req.db, req.user.license, { + limit: (req.body || {}).limit, + }); + res.json({ type: 'success', data: rows }); + } catch (e) { + res.status(500).json({ type: 'error', message: 'Claim failed' }); + } } -}); +); -app.post(['/connector/whatsapp/result', '/api/connector/whatsapp/result'], sseProtect, requireCustomerWrite, async (req, res) => { - try { - if (!req.db) return res.status(503).json({ type: 'error', message: 'No shop in context' }); - const { id, ok, error } = req.body || {}; - const r = await waOutbox.report(req.db, req.user.license, id, { ok: ok === true, error }); - res.json({ type: 'success', data: r }); - } catch (e) { - res.status(500).json({ type: 'error', message: 'Report failed' }); +app.post( + ['/connector/whatsapp/result', '/api/connector/whatsapp/result'], + sseProtect, + requireCustomerWrite, + async (req, res) => { + try { + if (!req.db) return res.status(503).json({ type: 'error', message: 'No shop in context' }); + const { id, ok, error } = req.body || {}; + const r = await waOutbox.report(req.db, req.user.license, id, { ok: ok === true, error }); + res.json({ type: 'success', data: r }); + } catch (e) { + res.status(500).json({ type: 'error', message: 'Report failed' }); + } } -}); +); -app.get(['/connector/whatsapp/state', '/api/connector/whatsapp/state'], sseProtect, requireCustomerWrite, async (req, res) => { - try { - if (!req.db) return res.status(503).json({ type: 'error', message: 'No shop in context' }); - // The connector's view: every branch's link state, including the - // 'init_requested' rows that tell it a screen is waiting for a QR. - const rows = await req.db.collection('whatsapp_connector_state').find({}).toArray(); - res.json({ - type: 'success', - data: rows.map((r) => ({ - branch_id: r.branch_id ? String(r.branch_id) : null, - device_id: r.device_id || '', - status: r.status || 'unknown', - updated_date: r.updated_date, - })), - }); - } catch (e) { - res.status(500).json({ type: 'error', message: 'Could not read state' }); +app.get( + ['/connector/whatsapp/state', '/api/connector/whatsapp/state'], + sseProtect, + requireCustomerWrite, + async (req, res) => { + try { + if (!req.db) return res.status(503).json({ type: 'error', message: 'No shop in context' }); + // The connector's view: every branch's link state, including the + // 'init_requested' rows that tell it a screen is waiting for a QR. + const rows = await req.db.collection('whatsapp_connector_state').find({}).toArray(); + res.json({ + type: 'success', + data: rows.map((r) => ({ + branch_id: r.branch_id ? String(r.branch_id) : null, + device_id: r.device_id || '', + status: r.status || 'unknown', + updated_date: r.updated_date, + })), + }); + } catch (e) { + res.status(500).json({ type: 'error', message: 'Could not read state' }); + } } -}); +); -app.post(['/connector/whatsapp/state', '/api/connector/whatsapp/state'], sseProtect, requireCustomerWrite, async (req, res) => { - try { - if (!req.db) return res.status(503).json({ type: 'error', message: 'No shop in context' }); - const { branch_id, device_id, status, qr } = req.body || {}; - await waOutbox.recordState(req.db, req.user.license, { branch_id, device_id, status, qr }); - res.json({ type: 'success' }); - } catch (e) { - res.status(500).json({ type: 'error', message: 'State update failed' }); +app.post( + ['/connector/whatsapp/state', '/api/connector/whatsapp/state'], + sseProtect, + requireCustomerWrite, + async (req, res) => { + try { + if (!req.db) return res.status(503).json({ type: 'error', message: 'No shop in context' }); + const { branch_id, device_id, status, qr } = req.body || {}; + await waOutbox.recordState(req.db, req.user.license, { branch_id, device_id, status, qr }); + res.json({ type: 'success' }); + } catch (e) { + res.status(500).json({ type: 'error', message: 'State update failed' }); + } } -}); +); app.post(['/push/test', '/api/push/test'], sseProtect, async (req, res) => { try { - const result = req.db && req.user - ? await pushInfra.sendToUser(req.db, req.user._id, { - title: 'Posnic', - body: 'Notifications are working on this device.', - url: '/dashboard.html#/dashboard', - }) - : { sent: 0 }; - res.json({ type: 'success', data: result, message: result.sent ? 'Sent' : 'No subscriptions on this device yet' }); + const result = + req.db && req.user + ? await pushInfra.sendToUser(req.db, req.user._id, { + title: 'Posnic', + body: 'Notifications are working on this device.', + url: '/dashboard.html#/dashboard', + }) + : { sent: 0 }; + res.json({ + type: 'success', + data: result, + message: result.sent ? 'Sent' : 'No subscriptions on this device yet', + }); } catch (e) { res.status(500).json({ type: 'error', message: 'Send failed' }); } @@ -1262,15 +1473,30 @@ app.use('/suppliers', suppliersRoutes); // Serve frontend static files const frontendPath = path.join(__dirname, '..', 'frontend'); app.use('/static', express.static(path.join(frontendPath, 'static'), { maxAge: STATIC_MAX_AGE })); -app.use('/images', express.static(path.join(frontendPath, 'static', 'images'), { maxAge: STATIC_MAX_AGE })); -app.use('/fonts', express.static(path.join(frontendPath, 'static', 'fonts'), { maxAge: STATIC_MAX_AGE })); -app.use('/style', express.static(path.join(frontendPath, 'public', 'style'), { setHeaders: assetCacheHeaders })); -app.use('/script', express.static(path.join(frontendPath, 'public', 'script'), { setHeaders: assetCacheHeaders })); +app.use( + '/images', + express.static(path.join(frontendPath, 'static', 'images'), { maxAge: STATIC_MAX_AGE }) +); +app.use( + '/fonts', + express.static(path.join(frontendPath, 'static', 'fonts'), { maxAge: STATIC_MAX_AGE }) +); +app.use( + '/style', + express.static(path.join(frontendPath, 'public', 'style'), { setHeaders: assetCacheHeaders }) +); +app.use( + '/script', + express.static(path.join(frontendPath, 'public', 'script'), { setHeaders: assetCacheHeaders }) +); // Serve static files from /public/static for pages loaded from /public/ app.use('/public/static', express.static(path.join(frontendPath, 'static'))); app.use('/public/images', express.static(path.join(frontendPath, 'static', 'images'))); app.use('/public/fonts', express.static(path.join(frontendPath, 'static', 'fonts'))); -app.use('/public', express.static(path.join(frontendPath, 'public'), { setHeaders: assetCacheHeaders })); +app.use( + '/public', + express.static(path.join(frontendPath, 'public'), { setHeaders: assetCacheHeaders }) +); app.use(express.static(path.join(frontendPath, 'public'), { setHeaders: assetCacheHeaders })); // Also mount API routes at root for backward compatibility diff --git a/api/package-lock.json b/api/package-lock.json index 4dc82af51..9fd520b58 100644 --- a/api/package-lock.json +++ b/api/package-lock.json @@ -1,19 +1,19 @@ { "name": "Api_v2_express", - "version": "2.0.0", + "version": "1.6.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "Api_v2_express", - "version": "2.0.0", + "version": "1.6.1", "license": "AGPL-3.0-only", "dependencies": { - "@aws-sdk/client-s3": "^3.1106.0", - "@getbrevo/brevo": "^6.0.2", - "axios": "^1.19.0", + "@aws-sdk/client-s3": "^3.1121.0", + "@getbrevo/brevo": "^6.0.3", + "axios": "^1.20.0", "bcryptjs": "^3.0.3", - "bson": "^7.3.1", + "bson": "^7.3.2", "compression": "^1.8.1", "connect-mongo": "^6.0.0", "cookie-parser": "^1.4.7", @@ -27,25 +27,26 @@ "express-validator": "^7.3.2", "helmet": "^8.3.0", "hpp": "^0.2.3", - "html-to-text": "^10.0.0", + "html-to-text": "^10.0.1", "http-status": "^2.1.0", - "joi": "^18.2.3", + "joi": "^18.2.5", "jsonwebtoken": "^9.0.3", "lodash": "^4.18.1", "moment": "^2.30.1", "moment-timezone": "^0.6.3", - "mongodb": "^7.5.0", - "mongoose": "^9.9.1", + "mongodb": "^7.6.0", + "mongoose": "^9.9.4", "mongoose-paginate-v2": "^1.9.5", - "morgan": "^1.11.0", - "multer": "^2.2.0", - "nodemailer": "^9.0.5", - "pdfkit": "^0.19.1", + "morgan": "^1.12.0", + "multer": "^2.3.0", + "nodemailer": "^9.0.6", + "pdfkit": "^0.20.1", "pug": "^3.0.4", "qrcode": "^1.5.4", "razorpay": "^2.9.8", "sib-api-v3-sdk": "^8.5.0", - "uuid": "^14.0.1", + "unzipper": "^0.12.5", + "uuid": "^14.0.2", "validator": "^13.15.35", "web-push": "^3.6.7", "whatsapp-web.js": "^1.34.7", @@ -53,13 +54,14 @@ }, "devDependencies": { "@eslint/js": "^10.0.1", - "@redocly/cli": "^2.46.0", - "@types/node": "^26.2.0", - "eslint": "^10.8.1", + "@redocly/cli": "^2.49.0", + "@types/node": "^26.4.0", + "eslint": "^10.9.1", "eslint-config-prettier": "^10.1.8", "glob": "^13.0.6", - "globals": "^17.9.0", - "jest": "^30.4.2", + "globals": "^17.11.0", + "jest": "^30.5.0", + "mongodb-memory-server": "^11.2.0", "nodemon": "^3.1.14", "prettier": "^3.9.6", "swagger-ui-express": "^5.0.1" @@ -69,15 +71,15 @@ } }, "node_modules/@aws-sdk/checksums": { - "version": "3.1000.27", - "resolved": "https://registry.npmjs.org/@aws-sdk/checksums/-/checksums-3.1000.27.tgz", - "integrity": "sha512-insWOqKKNUrbN/dohEG7BJ0U5GkyqhjbMb/NHNaLUtq+7my2M8C4EnZZZoxMmXRqCC+P9dEr+KyJA2JGGzoKLg==", + "version": "3.1000.29", + "resolved": "https://registry.npmjs.org/@aws-sdk/checksums/-/checksums-3.1000.29.tgz", + "integrity": "sha512-Dtu0gr4dnATZAPwEYbpCsG+MpLM7OAliy2gTepEFQwl1vZ6DL3QMH2FveMa3HLvPsOdhJsPRB3KtxVhph9T75A==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -85,21 +87,21 @@ } }, "node_modules/@aws-sdk/client-s3": { - "version": "3.1106.0", - "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1106.0.tgz", - "integrity": "sha512-hUTlnyRRGlVdfvJLL3hCEnMm7CmunSzc/lxFVRX8g1fjJTMUVbyQCfhfMhp7dZ7JBftLU6OYresu3Hje4nvkJw==", + "version": "3.1121.0", + "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1121.0.tgz", + "integrity": "sha512-hBnoqaVBeWdkgXcJElMXA2yUZWkBCBntu2qmN+tfqmzC+j4LzJC3ox8qIgS2WdMS1cb8UwyBogUVrkRXybNm0A==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/checksums": "^3.1000.26", - "@aws-sdk/core": "^3.977.6", - "@aws-sdk/credential-provider-node": "^3.972.78", - "@aws-sdk/middleware-sdk-s3": "^3.972.72", - "@aws-sdk/signature-v4-multi-region": "^3.996.43", - "@aws-sdk/types": "^3.974.2", - "@smithy/core": "^3.31.1", - "@smithy/fetch-http-handler": "^5.6.13", - "@smithy/node-http-handler": "^4.9.13", - "@smithy/types": "^4.16.1", + "@aws-sdk/checksums": "^3.1000.29", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/credential-provider-node": "^3.972.81", + "@aws-sdk/middleware-sdk-s3": "^3.972.75", + "@aws-sdk/signature-v4-multi-region": "^3.996.46", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/fetch-http-handler": "^5.7.2", + "@smithy/node-http-handler": "^4.11.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -107,17 +109,17 @@ } }, "node_modules/@aws-sdk/core": { - "version": "3.977.7", - "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.977.7.tgz", - "integrity": "sha512-I88Iov89NVmjSmJLKSv7Cn9M2J+a2942OkA8nZCbz+sl4ZeY4zEOcoLOrbt1GRfQ8zEQKnjAJdXixA3J/p1fDQ==", + "version": "3.977.9", + "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.977.9.tgz", + "integrity": "sha512-reqPFEQrZxDZpeGj4PFMepBeR5LGYHRqq/L0motTzgFkCRBA4rFdaVXDSLYyGHhxVz7sT2PDnPN9CluGSfgyJA==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/types": "^3.974.3", - "@aws-sdk/xml-builder": "^3.972.38", + "@aws-sdk/types": "^3.974.5", + "@aws-sdk/xml-builder": "^3.972.40", "@aws/lambda-invoke-store": "^0.3.0", - "@smithy/core": "^3.31.1", + "@smithy/core": "^3.33.3", "@smithy/signature-v4": "^5.6.12", - "@smithy/types": "^4.16.1", + "@smithy/types": "^4.17.2", "bowser": "^2.11.0", "tslib": "^2.6.2" }, @@ -126,15 +128,15 @@ } }, "node_modules/@aws-sdk/credential-provider-env": { - "version": "3.972.68", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.68.tgz", - "integrity": "sha512-2a20A/IdNOwUvaDq91iqqS7BA0XlNMfW3iLGZGZLJv0EbUqhSxB0PIx4rQQqssvWj1uXImb3/UCCdHz/+1dOiA==", + "version": "3.972.70", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.70.tgz", + "integrity": "sha512-H404B7dJl2mCrBqahDEYsanB0xhdDp6tXnXcTUnXmmpy2Q3J0Ho0bUajZ2jr/RdwzCyS59Gi8xXIFwPLGBl6Uw==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -142,17 +144,17 @@ } }, "node_modules/@aws-sdk/credential-provider-http": { - "version": "3.972.70", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.70.tgz", - "integrity": "sha512-0yRem2Fs52r/Nn6UAqIlpjexfaYj8ziEozOe9tamtAVT/5bzFLKx8O2r7MaRqgS3hGKHIa1Jij9nKHSsNnb04A==", + "version": "3.972.72", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.72.tgz", + "integrity": "sha512-X98zYOrVOeuosCX+6ktf29FC2N2GHPLia7qv6mzPzTc+RPAuHWCDS++Z6JK7eGYqb/v6uaW7bAXaOvDBfol+0w==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/fetch-http-handler": "^5.6.13", - "@smithy/node-http-handler": "^4.9.13", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/fetch-http-handler": "^5.7.2", + "@smithy/node-http-handler": "^4.11.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -160,23 +162,23 @@ } }, "node_modules/@aws-sdk/credential-provider-ini": { - "version": "3.973.13", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.973.13.tgz", - "integrity": "sha512-2M39DE02XpYYaSWYk/4AsImXYUU/1L2xmTMLUpMMWq7DfLv191/vCRy3baKtdr45AkJQyVgSjmuVOLm15SwrRQ==", + "version": "3.973.15", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.973.15.tgz", + "integrity": "sha512-Rykg6s5ceBuynMOGWgoowO4N+27JfnqXAnVaSunZl0hOO1XodSrxGNz6sCEbnmS0lAfQZDKyb3fbr46gSuv6Sg==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/credential-provider-env": "^3.972.68", - "@aws-sdk/credential-provider-http": "^3.972.70", - "@aws-sdk/credential-provider-login": "^3.972.75", - "@aws-sdk/credential-provider-process": "^3.972.68", - "@aws-sdk/credential-provider-sso": "^3.973.12", - "@aws-sdk/credential-provider-web-identity": "^3.972.74", - "@aws-sdk/nested-clients": "^3.997.42", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/credential-provider-env": "^3.972.70", + "@aws-sdk/credential-provider-http": "^3.972.72", + "@aws-sdk/credential-provider-login": "^3.972.77", + "@aws-sdk/credential-provider-process": "^3.972.70", + "@aws-sdk/credential-provider-sso": "^3.973.14", + "@aws-sdk/credential-provider-web-identity": "^3.972.76", + "@aws-sdk/nested-clients": "^3.997.44", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", "@smithy/credential-provider-imds": "^4.4.16", - "@smithy/types": "^4.16.1", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -184,16 +186,16 @@ } }, "node_modules/@aws-sdk/credential-provider-login": { - "version": "3.972.75", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.75.tgz", - "integrity": "sha512-jaTESuJlQsoUZ44f/i2puyPt8VlF/dMMJ9HM3cStYtk7eKX4N9UWi83OLixUkoOJH3BwWlPLCq9YIK9nfWhVBg==", + "version": "3.972.77", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.77.tgz", + "integrity": "sha512-Jb59xfEISoN5mmbnA+HYqdtrSX3CgCtJoof+V5D8/TgUI56W63GEEd5Y58WijU3Ou6+WEgaLD1feVzaRXV5IDQ==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/nested-clients": "^3.997.42", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/nested-clients": "^3.997.44", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -201,21 +203,21 @@ } }, "node_modules/@aws-sdk/credential-provider-node": { - "version": "3.972.79", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.79.tgz", - "integrity": "sha512-RIw5dof1EHkWubrZzPC941CDtnFG1iAXsxbFgLkhdYZXHc4icU13c/uxSMI0J5eUx9bxa7LjfpdjfClBB1QsDA==", + "version": "3.972.81", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.81.tgz", + "integrity": "sha512-Rml+WitoFvXmv6JZ18U/xGdGDGGvB/mOin0ya0lTnTrdC0Z1lrVxTYh7iNklZBcvcRMrs4DoEf6xy1KWyrLQQw==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/credential-provider-env": "^3.972.68", - "@aws-sdk/credential-provider-http": "^3.972.70", - "@aws-sdk/credential-provider-ini": "^3.973.13", - "@aws-sdk/credential-provider-process": "^3.972.68", - "@aws-sdk/credential-provider-sso": "^3.973.12", - "@aws-sdk/credential-provider-web-identity": "^3.972.74", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", + "@aws-sdk/credential-provider-env": "^3.972.70", + "@aws-sdk/credential-provider-http": "^3.972.72", + "@aws-sdk/credential-provider-ini": "^3.973.15", + "@aws-sdk/credential-provider-process": "^3.972.70", + "@aws-sdk/credential-provider-sso": "^3.973.14", + "@aws-sdk/credential-provider-web-identity": "^3.972.76", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", "@smithy/credential-provider-imds": "^4.4.16", - "@smithy/types": "^4.16.1", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -223,15 +225,15 @@ } }, "node_modules/@aws-sdk/credential-provider-process": { - "version": "3.972.68", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.68.tgz", - "integrity": "sha512-nLP3Pda2MQTFJ25hKBMmUuB9Uv+bTZQNlufbeCwklP549Vwnkd8bRLJoCKp5k6xjmdyptrPrOfGOhN0mKuca8A==", + "version": "3.972.70", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.70.tgz", + "integrity": "sha512-2ry03fGRJr4sV3jI+ocjj5JqALnFD6ymM5KiNCDZMvq8bX2GSbE0vji4aM43TVCl2nXqqLRZaUxdq/KeWRAY4Q==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -239,17 +241,17 @@ } }, "node_modules/@aws-sdk/credential-provider-sso": { - "version": "3.973.12", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.973.12.tgz", - "integrity": "sha512-EmgyyHn+f9WCcelp3L/vci+LGbX8GigWaVphRArjVo5Pktkr9YnLy/mQ6VDkDyBD72dtfRNTgHmD2ts4rTDXKQ==", + "version": "3.973.14", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.973.14.tgz", + "integrity": "sha512-jkhg/8ocAAoc0RFyLMhCw+/zZh7gystQgd4F4hznNa8P4Cc501PQmxd+jGLiMHodPJ+7Zv/3znM62gZojyasmA==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/nested-clients": "^3.997.42", - "@aws-sdk/token-providers": "3.1108.0", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/nested-clients": "^3.997.44", + "@aws-sdk/token-providers": "3.1116.0", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -257,16 +259,16 @@ } }, "node_modules/@aws-sdk/credential-provider-web-identity": { - "version": "3.972.74", - "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.74.tgz", - "integrity": "sha512-0YfczxGXF3RjGj8z7QG/Ho2HnLGKDHfPSHiTs47UU1U/+mmwISDN+rvGKt2zh+3FX8NdT4xd95LGBGyhQw2dgQ==", + "version": "3.972.76", + "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.76.tgz", + "integrity": "sha512-d3AGyVu759PGr35mEB2s22xxlNEA5rpdxtSPJthfPFJvoQ8dt357iVPECqWfUxXp1toJAvKmbtcIYVGigaGsCA==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/nested-clients": "^3.997.42", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/nested-clients": "^3.997.44", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -274,16 +276,16 @@ } }, "node_modules/@aws-sdk/middleware-sdk-s3": { - "version": "3.972.73", - "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.73.tgz", - "integrity": "sha512-oy7sRA5HvHcAvkcKX6F8RI240jcOf3c8y/Gqjs9qemIibdKQqGBIi0uwa+47ZRYqGLpdEO28TQU4G73yUzo06Q==", + "version": "3.972.75", + "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.75.tgz", + "integrity": "sha512-wMIsNumRVKaNMKhvU/s9VrdEwE8S6gSzXp4RygFG5BEMnGkkXf8cjh8zf7cKJBpUDpqTWqwbz5isEgp9rH6Lng==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/signature-v4-multi-region": "^3.996.44", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/signature-v4-multi-region": "^3.996.46", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -291,18 +293,18 @@ } }, "node_modules/@aws-sdk/nested-clients": { - "version": "3.997.42", - "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.42.tgz", - "integrity": "sha512-XWRyon2MTHXD/zMoo0Mbge6Vwf+iE0qQaM/RyGO6NfZ9WukCFiQL27nQVZjYy2JwSIg+iXZxKOX95OBXqlSM4w==", + "version": "3.997.44", + "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.44.tgz", + "integrity": "sha512-NhEgryjlBF9w38ZXqGymQV28IhkYa1mKhlbYnqIis57AYwWGVYfUPgg/qC2rLRqOUfblxx++irvju10kVTa8Vw==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/signature-v4-multi-region": "^3.996.44", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/fetch-http-handler": "^5.6.13", - "@smithy/node-http-handler": "^4.9.13", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/signature-v4-multi-region": "^3.996.46", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/fetch-http-handler": "^5.7.2", + "@smithy/node-http-handler": "^4.11.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -310,14 +312,14 @@ } }, "node_modules/@aws-sdk/signature-v4-multi-region": { - "version": "3.996.44", - "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.44.tgz", - "integrity": "sha512-ZSfQ35Qn4MhSY+A0Whyr+KBx+wJKZUyBsOrjB2pSHOafRzbFe47T8XcXM8hZqUAC69qnqIy0C9ArxTuud0CC2w==", + "version": "3.996.46", + "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.46.tgz", + "integrity": "sha512-L+2xZTye/2T96f3lwCws0Zw6GG2JHZW9e8FpVgGBeeExSKyeoZ6CWRpBml/7DNiK/O26jrgPM9F+Ay8VkgzUWQ==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/types": "^3.974.3", + "@aws-sdk/types": "^3.974.5", "@smithy/signature-v4": "^5.6.12", - "@smithy/types": "^4.16.1", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -325,16 +327,16 @@ } }, "node_modules/@aws-sdk/token-providers": { - "version": "3.1108.0", - "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1108.0.tgz", - "integrity": "sha512-rI80zxDxGJ6904eC/YbjkdjY6JdaZvQ01kOmrMvw7cFQGIHo27fhnIVbMSVDS4T6foQImjxYSRoOu/uSJscXDw==", + "version": "3.1116.0", + "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1116.0.tgz", + "integrity": "sha512-ygIivKqh8aHzNkucOCXHyIBgBpLPfrSI0mCqXF+vLBsPTUKqj0VSqAY0GFPe7lQl4HntjOcQ+KSyS7oUV2C54Q==", "license": "Apache-2.0", "dependencies": { - "@aws-sdk/core": "^3.977.7", - "@aws-sdk/nested-clients": "^3.997.42", - "@aws-sdk/types": "^3.974.3", - "@smithy/core": "^3.31.1", - "@smithy/types": "^4.16.1", + "@aws-sdk/core": "^3.977.9", + "@aws-sdk/nested-clients": "^3.997.44", + "@aws-sdk/types": "^3.974.5", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -342,12 +344,12 @@ } }, "node_modules/@aws-sdk/types": { - "version": "3.974.3", - "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.974.3.tgz", - "integrity": "sha512-ECAqfpNsef+7MO8qtR0h9KcFIBAygaE7Cm6UOiQl+ft+uVap+1G7bNEjs4mdJE2OnA4m6k7i8peH8uGIAsOMGw==", + "version": "3.974.5", + "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.974.5.tgz", + "integrity": "sha512-LkwLL2BLbC6wNNm4JaH9mbEqBMdOZCct6VAYqhdN4U1xrWM+fUJQEfbHwQgDypapOWTRtlk25akb5afM0P8CIQ==", "license": "Apache-2.0", "dependencies": { - "@smithy/types": "^4.16.1", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -355,12 +357,12 @@ } }, "node_modules/@aws-sdk/xml-builder": { - "version": "3.972.38", - "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.38.tgz", - "integrity": "sha512-grf7mzfVxBS5AlsuTvBN7uDpzqohFww9fRPCO+EBSUdvtsYMcPSKdz54h/7XiscqNcUM1Ae1MF7JLHmiYYuzbQ==", + "version": "3.972.40", + "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.40.tgz", + "integrity": "sha512-wlFmCIGUlwF4zx/kncw+bmxTQh1HeSJq4mYV/V5cZUSJadDP3kXvGW8Rn21cimj/7y9ju+47oYWXi97vF7czaA==", "license": "Apache-2.0", "dependencies": { - "@smithy/types": "^4.16.1", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -442,14 +444,14 @@ } }, "node_modules/@babel/generator": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz", - "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==", + "version": "7.29.8", + "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz", + "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==", "dev": true, "license": "MIT", "dependencies": { - "@babel/parser": "^7.29.7", - "@babel/types": "^7.29.7", + "@babel/parser": "^7.29.8", + "@babel/types": "^7.29.8", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" @@ -590,12 +592,12 @@ } }, "node_modules/@babel/parser": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz", - "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==", + "version": "7.29.8", + "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz", + "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==", "license": "MIT", "dependencies": { - "@babel/types": "^7.29.7" + "@babel/types": "^7.29.8" }, "bin": { "parser": "bin/babel-parser.js" @@ -859,18 +861,18 @@ } }, "node_modules/@babel/traverse": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz", - "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==", + "version": "7.29.8", + "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz", + "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==", "dev": true, "license": "MIT", "dependencies": { "@babel/code-frame": "^7.29.7", - "@babel/generator": "^7.29.7", + "@babel/generator": "^7.29.8", "@babel/helper-globals": "^7.29.7", - "@babel/parser": "^7.29.7", + "@babel/parser": "^7.29.8", "@babel/template": "^7.29.7", - "@babel/types": "^7.29.7", + "@babel/types": "^7.29.8", "debug": "^4.3.1" }, "engines": { @@ -878,9 +880,9 @@ } }, "node_modules/@babel/types": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz", - "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==", + "version": "7.29.8", + "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz", + "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==", "license": "MIT", "dependencies": { "@babel/helper-string-parser": "^7.29.7", @@ -1136,9 +1138,9 @@ "integrity": "sha512-fAtCfv4jJg+ExtXhvCkCqUKZ+4ok/JQk01qDKhL5BDDoS3AxKXhV5/MAVUZyQnSEd2GT92fkgZl0pz0Q0AzcIQ==" }, "node_modules/@getbrevo/brevo": { - "version": "6.0.2", - "resolved": "https://registry.npmjs.org/@getbrevo/brevo/-/brevo-6.0.2.tgz", - "integrity": "sha512-yxyacx4wkuWcCbFDdFE3RxklaHSGXEP3d0gZaxPy+9aBquvl4ksr7IQgbRCcF8crx5aRvpStVBLeh5iCbWHJrg==", + "version": "6.0.3", + "resolved": "https://registry.npmjs.org/@getbrevo/brevo/-/brevo-6.0.3.tgz", + "integrity": "sha512-yWBLKoHC8P5HLZ8z6iRuqDYLpCRKPTUETnZOLZzNDWGFYL78y4SHOTxQVrKH5ROX7f4q+SQ19LD3GWtJlIuNXA==", "engines": { "node": ">=18.0.0" } @@ -1388,9 +1390,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "dev": true, "license": "MIT", "dependencies": { @@ -1422,17 +1424,17 @@ } }, "node_modules/@jest/console": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.4.1.tgz", - "integrity": "sha512-v3bhyxUh9Hgmo5p6hAOXe14/R3ZxZDOsvHleh4B07z3m/x4/ngPUXEm9XwK4sF4u+f+P2ORb0Ge+MgpaqRMVDA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.5.0.tgz", + "integrity": "sha512-BI1DpOedrJqbrYVi9yNhDWGjqphR/+gsM4STmg2+VaeXm7851hvpBDyKOZGMXATTrGEnFuEseQvLCtrrRmG0GQ==", "dev": true, "license": "MIT", "dependencies": { - "@jest/types": "30.4.1", + "@jest/types": "30.5.0", "@types/node": "*", "chalk": "^4.1.2", - "jest-message-util": "30.4.1", - "jest-util": "30.4.1", + "jest-message-util": "30.5.0", + "jest-util": "30.5.0", "slash": "^3.0.0" }, "engines": { @@ -1440,18 +1442,18 @@ } }, "node_modules/@jest/core": { - "version": "30.4.2", - "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.4.2.tgz", - "integrity": "sha512-TZJA6cPJUFxoWhxaLo8t0VX/MZX2wPWr0uIDvLSHIvN4gu9h02vSzqI2kBADG1ExqQlC+cY09xKMSreivvrChQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.5.0.tgz", + "integrity": "sha512-DLjRME+NY//j+UDTSfWnjoP0srrdR3DrJRy7yFZktGIwzpN2iVy2vMo0jziZ5c2Ij7bOwlJRXKVWtxZusazOJg==", "dev": true, "license": "MIT", "dependencies": { - "@jest/console": "30.4.1", - "@jest/pattern": "30.4.0", - "@jest/reporters": "30.4.1", - "@jest/test-result": "30.4.1", - "@jest/transform": "30.4.1", - "@jest/types": "30.4.1", + "@jest/console": "30.5.0", + "@jest/pattern": "30.5.0", + "@jest/reporters": "30.5.0", + "@jest/test-result": "30.5.0", + "@jest/transform": "30.5.0", + "@jest/types": "30.5.0", "@types/node": "*", "ansi-escapes": "^4.3.2", "chalk": "^4.1.2", @@ -1459,20 +1461,20 @@ "exit-x": "^0.2.2", "fast-json-stable-stringify": "^2.1.0", "graceful-fs": "^4.2.11", - "jest-changed-files": "30.4.1", - "jest-config": "30.4.2", - "jest-haste-map": "30.4.1", - "jest-message-util": "30.4.1", - "jest-regex-util": "30.4.0", - "jest-resolve": "30.4.1", - "jest-resolve-dependencies": "30.4.2", - "jest-runner": "30.4.2", - "jest-runtime": "30.4.2", - "jest-snapshot": "30.4.1", - "jest-util": "30.4.1", - "jest-validate": "30.4.1", - "jest-watcher": "30.4.1", - "pretty-format": "30.4.1", + "jest-changed-files": "30.5.0", + "jest-config": "30.5.0", + "jest-haste-map": "30.5.0", + "jest-message-util": "30.5.0", + "jest-regex-util": "30.5.0", + "jest-resolve": "30.5.0", + "jest-resolve-dependencies": "30.5.0", + "jest-runner": "30.5.0", + "jest-runtime": "30.5.0", + "jest-snapshot": "30.5.0", + "jest-util": "30.5.0", + "jest-validate": "30.5.0", + "jest-watcher": "30.5.0", + "pretty-format": "30.5.0", "slash": "^3.0.0" }, "engines": { @@ -1488,9 +1490,9 @@ } }, "node_modules/@jest/diff-sequences": { - "version": "30.4.0", - "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.4.0.tgz", - "integrity": "sha512-zOpzlfUs45l6u7jm39qr87JCHUDsaeCtvL+kQe/Vn9jSnRB4/5IPXISm0h9I1vZW/o00Kn4UTJ2MOlhnUGwv3g==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.5.0.tgz", + "integrity": "sha512-OsqBjHXCn8cadasoAZBP6nWYvMsRhpMzGXTpxJ5aO04NlbdhIz+FVe3q49l0AwVhsz/cEmIpBes6gAFl1/dWQg==", "dev": true, "license": "MIT", "engines": { @@ -1498,70 +1500,70 @@ } }, "node_modules/@jest/environment": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.4.1.tgz", - "integrity": "sha512-AK9yNRqgKxiabqMoe4oW+3/TSSeV8vkdC7BGaxZdU0AFXfOpofTLqdru2GXKZghP3sdgwE9XXpnVwfZ8JnFV4w==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.5.0.tgz", + "integrity": "sha512-HUaqexIauIh69IQ4NTuPDEUCB8g8T4TOPSIzQOS18mwI/KEHKQk1j013K2o6ra031szZE2t5jGmVx3xbzdjgKA==", "dev": true, "license": "MIT", "dependencies": { - "@jest/fake-timers": "30.4.1", - "@jest/types": "30.4.1", + "@jest/fake-timers": "30.5.0", + "@jest/types": "30.5.0", "@types/node": "*", - "jest-mock": "30.4.1" + "jest-mock": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/@jest/expect": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.4.1.tgz", - "integrity": "sha512-ginrj6TMgh2GshLUGCjO94Ptx9HhdZA/I6A9iUfyeLKFtdAjnKzHDgzgP9HYQgbxM1lbXScQ2eUBz2lGeVDPWA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.5.0.tgz", + "integrity": "sha512-jEmgmgJEobJ3zEhDOGp1VAJ6JkoVelpS8uZ1ae1Ul/5lP78UKJKmmU0lciJwd6JdnqOXHaaS/QCKwbf1dHI9MA==", "dev": true, "license": "MIT", "dependencies": { - "expect": "30.4.1", - "jest-snapshot": "30.4.1" + "expect": "30.5.0", + "jest-snapshot": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/@jest/expect-utils": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.4.1.tgz", - "integrity": "sha512-ZBn5CglH8fBsQsvs4VWNzD4aWfUYks+IdOOQU3MEK71ol/BcVm+P+rtb1KpiFBpSWSCE27uOahyyf1vfqOVbcQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.5.0.tgz", + "integrity": "sha512-5j0ztPxSy3McUJihjkDdCyCfjvT2hxykFTWsgEBZKB8qsw9ALdCiGTpTRH5gnf/d+qI4SflYUJ0dWNbzjQCWbA==", "dev": true, "license": "MIT", "dependencies": { - "@jest/get-type": "30.1.0" + "@jest/get-type": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/@jest/fake-timers": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.4.1.tgz", - "integrity": "sha512-iW5umdmfPeWzehrVhugFQZqCchSCud5S1l2YT0O9ZhjRR0ExclANDZkiSBwzqtnlOn0J1JXvO+HZ6rkuyOVOgQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.5.0.tgz", + "integrity": "sha512-sg8xIbYwe5GdB/vT3/0qrDIpO7Ov9mazHi++M95uynmDKEZ70G1r169AWct73H07VrTZhrz1SJEfLtjYv8tE3A==", "dev": true, "license": "MIT", "dependencies": { - "@jest/types": "30.4.1", + "@jest/types": "30.5.0", "@sinonjs/fake-timers": "^15.4.0", "@types/node": "*", - "jest-message-util": "30.4.1", - "jest-mock": "30.4.1", - "jest-util": "30.4.1" + "jest-message-util": "30.5.0", + "jest-mock": "30.5.0", + "jest-util": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/@jest/get-type": { - "version": "30.1.0", - "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz", - "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.5.0.tgz", + "integrity": "sha512-9/2VUPitAjmBzbvDvqrxmvB7BzWsBW0WmkkojX1ODuxX1NLGxx9gfaZpHB0z8DtJ9uhGNmZG/VXBhf8uO0OV8Q==", "dev": true, "license": "MIT", "engines": { @@ -1569,62 +1571,78 @@ } }, "node_modules/@jest/globals": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.4.1.tgz", - "integrity": "sha512-ZbuY4cmXC8DkxYjfvT2DbcHWL2T6vmsMhXCDcmTB2T0y0gaezBI77ufq5ZAIdcRkYZ7NEQEDg1xFeKbxUJ5v5Q==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.5.0.tgz", + "integrity": "sha512-h7eJx534czwL8lQMYB0hwLT4/HquO8EX/RtYL7RNUHyUyWWVciYjoudN4Ns5JmNvn2/jh0Vm9UstZjEzJJ5EsQ==", "dev": true, "license": "MIT", "dependencies": { - "@jest/environment": "30.4.1", - "@jest/expect": "30.4.1", - "@jest/types": "30.4.1", - "jest-mock": "30.4.1" + "@jest/environment": "30.5.0", + "@jest/expect": "30.5.0", + "@jest/types": "30.5.0", + "jest-mock": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/@jest/pattern": { - "version": "30.4.0", - "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.4.0.tgz", - "integrity": "sha512-RAWn3+f9u8BsHijKJ71uHcFp6vmyEt6VvoWXkl6hKF3qVIuWNmudVjg12DlBPGup/frIl5UcUlH5HfEuvHpEXg==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.5.0.tgz", + "integrity": "sha512-HdNQYSdRTEBNrginaqzQtTjG0HRMfrra/z6Ok7uL3S87vSlarIVohEsJsSj5edu3MiHoHjAkvPROz5ZjoKai+w==", "dev": true, "license": "MIT", "dependencies": { "@types/node": "*", - "jest-regex-util": "30.4.0" + "jest-regex-util": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, + "node_modules/@jest/react-is-18": { + "name": "react-is", + "version": "18.3.1", + "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz", + "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==", + "dev": true, + "license": "MIT" + }, + "node_modules/@jest/react-is-19": { + "name": "react-is", + "version": "19.2.8", + "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.8.tgz", + "integrity": "sha512-s5un28nYxKJw5gvUHyW5PCC28CvBqLu9r3cWgzHT4Vo/5fqqkFcdRYsGcKf50WMPpjjFZS5d76fn3YCo2njKwQ==", + "dev": true, + "license": "MIT" + }, "node_modules/@jest/reporters": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.4.1.tgz", - "integrity": "sha512-/SnkPCzEQpUaBH81kjdEdDdo2WZl5hxw+BmLDGWjRkm8o7XlhjwsU36cqwe5PGBE5WYpBvDzRSdXx9rbGuJtNA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.5.0.tgz", + "integrity": "sha512-FEAuusWm+PUOn9ydjaHhpOpyPmS6IbGE04HaKTuUI4zd8eqYZiXiNLoCsdCog/l2XnNj53E9pFy64UltcvfJKg==", "dev": true, "license": "MIT", "dependencies": { "@bcoe/v8-coverage": "^0.2.3", - "@jest/console": "30.4.1", - "@jest/test-result": "30.4.1", - "@jest/transform": "30.4.1", - "@jest/types": "30.4.1", - "@jridgewell/trace-mapping": "^0.3.25", + "@jest/console": "30.5.0", + "@jest/test-result": "30.5.0", + "@jest/transform": "30.5.0", + "@jest/types": "30.5.0", + "@jridgewell/trace-mapping": "^0.3.31", "@types/node": "*", "chalk": "^4.1.2", "collect-v8-coverage": "^1.0.2", "exit-x": "^0.2.2", - "glob": "^10.5.0", + "glob": "^13.0.6", "graceful-fs": "^4.2.11", "istanbul-lib-coverage": "^3.0.0", "istanbul-lib-instrument": "^6.0.0", "istanbul-lib-report": "^3.0.0", "istanbul-lib-source-maps": "^5.0.0", "istanbul-reports": "^3.1.3", - "jest-message-util": "30.4.1", - "jest-util": "30.4.1", - "jest-worker": "30.4.1", + "jest-message-util": "30.5.0", + "jest-util": "30.5.0", + "jest-worker": "30.5.0", "slash": "^3.0.0", "string-length": "^4.0.2", "v8-to-istanbul": "^9.0.1" @@ -1641,82 +1659,10 @@ } } }, - "node_modules/@jest/reporters/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, - "node_modules/@jest/reporters/node_modules/glob": { - "version": "10.5.0", - "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz", - "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==", - "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me", - "dev": true, - "license": "ISC", - "dependencies": { - "foreground-child": "^3.1.0", - "jackspeak": "^3.1.2", - "minimatch": "^9.0.4", - "minipass": "^7.1.2", - "package-json-from-dist": "^1.0.0", - "path-scurry": "^1.11.1" - }, - "bin": { - "glob": "dist/esm/bin.mjs" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/@jest/reporters/node_modules/lru-cache": { - "version": "10.4.3", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz", - "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==", - "dev": true, - "license": "ISC" - }, - "node_modules/@jest/reporters/node_modules/minimatch": { - "version": "9.0.9", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", - "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", - "dev": true, - "license": "ISC", - "dependencies": { - "brace-expansion": "^2.0.2" - }, - "engines": { - "node": ">=16 || 14 >=14.17" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/@jest/reporters/node_modules/path-scurry": { - "version": "1.11.1", - "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz", - "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==", - "dev": true, - "license": "BlueOak-1.0.0", - "dependencies": { - "lru-cache": "^10.2.0", - "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" - }, - "engines": { - "node": ">=16 || 14 >=14.18" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, "node_modules/@jest/schemas": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.4.1.tgz", - "integrity": "sha512-i6b4qw5qnP8c5FEeBJg/uZQ4ddrkN6Ca8qISJh0pr7a5hfn3h3v5x60BEbOC7OYAGZNMs1LfFLwnW2CuK8F57Q==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.5.0.tgz", + "integrity": "sha512-/hunigyNpc4RCjC0VaW3f5RCUZVM2+WQ65qP7z083Gmvac7or2LI50XVNOtE4YPgBpV0yxYiAgorAPGniCoJmg==", "dev": true, "license": "MIT", "dependencies": { @@ -1727,13 +1673,13 @@ } }, "node_modules/@jest/snapshot-utils": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.4.1.tgz", - "integrity": "sha512-ObY4ljvQ95mt6iwKtVLetR/4yXiAgl3H4nJxhztr0MTjrN97TwDYrnCp/kF60Ec9HdhkWTHSu+Hg05aXfngpOA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.5.0.tgz", + "integrity": "sha512-iWQtIsi2dRsO2oWzVceOeynuRJiYTW8gsDVp5wFQ02ipHluQsNgBpasWSHiawVxukIlsGLdCtCSbIEK7fPtpvQ==", "dev": true, "license": "MIT", "dependencies": { - "@jest/types": "30.4.1", + "@jest/types": "30.5.0", "chalk": "^4.1.2", "graceful-fs": "^4.2.11", "natural-compare": "^1.4.0" @@ -1743,14 +1689,15 @@ } }, "node_modules/@jest/source-map": { - "version": "30.0.1", - "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.0.1.tgz", - "integrity": "sha512-MIRWMUUR3sdbP36oyNyhbThLHyJ2eEDClPCiHVbrYAe5g3CHRArIVpBw7cdSB5fr+ofSfIb2Tnsw8iEHL0PYQg==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.5.0.tgz", + "integrity": "sha512-xWpTJP9D0bDFGbPGT8XuWSwwha/iHADyyKzUnMx4UbdgnHugxrDaQFO4RZ8x4ZsFzRP6pNii8uvlgKCDxCIuDg==", "dev": true, "license": "MIT", "dependencies": { - "@jridgewell/trace-mapping": "^0.3.25", + "@jridgewell/trace-mapping": "^0.3.31", "callsites": "^3.1.0", + "convert-source-map": "^2.0.0", "graceful-fs": "^4.2.11" }, "engines": { @@ -1758,14 +1705,14 @@ } }, "node_modules/@jest/test-result": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.4.1.tgz", - "integrity": "sha512-/ZG7pgEiOmmWkN9TplKbOu4id2N5lh7FHwRwlkgBVAzGdRH+OkkQ8wX/kIxg4zmd3ZQvAL1RwL2yWsvNYYECTw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.5.0.tgz", + "integrity": "sha512-9IlPqUzUMkVDmoDqSSrVVLroVotgN3hTUPWPwq24XWXhh1Zpg915RXZ5pgRJ/7j4YE/kng5nqjSn4p3S68SZJA==", "dev": true, "license": "MIT", "dependencies": { - "@jest/console": "30.4.1", - "@jest/types": "30.4.1", + "@jest/console": "30.5.0", + "@jest/types": "30.5.0", "@types/istanbul-lib-coverage": "^2.0.6", "collect-v8-coverage": "^1.0.2" }, @@ -1774,15 +1721,15 @@ } }, "node_modules/@jest/test-sequencer": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.4.1.tgz", - "integrity": "sha512-PeYE+4td5rKjoRPxztObrXU+H8hsjZfxKMXOcmrr34JerSyB/ROOxbbicz8B7A5j9R9VayDnVPvBmedqCsFCdw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.5.0.tgz", + "integrity": "sha512-TXlvSDIVv482b83hD8A8WtxDJEmGF47f60W6jRXOQL0Isfs3hKtk4rZIm9R/jLzAibg8+c56y+Q00BQs8R7Xcg==", "dev": true, "license": "MIT", "dependencies": { - "@jest/test-result": "30.4.1", + "@jest/test-result": "30.5.0", "graceful-fs": "^4.2.11", - "jest-haste-map": "30.4.1", + "jest-haste-map": "30.5.0", "slash": "^3.0.0" }, "engines": { @@ -1790,23 +1737,23 @@ } }, "node_modules/@jest/transform": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.4.1.tgz", - "integrity": "sha512-Wz0LyktlTvRefoymh+n64hQ84KNXsRGcwdoZ8CSa0Ea+fgYcHZlnk+hDP7v2MS7il2bQ5uTEIxf4/NNfhMN4KQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.5.0.tgz", + "integrity": "sha512-n1cYhoByyULEIXi64wbT4Lq91qeT1E6bwpM//sprFXhw955qaiHTdAmy1c1rNFGB6fCf1J+nxDUSf3RGwgZP5A==", "dev": true, "license": "MIT", "dependencies": { "@babel/core": "^7.27.4", - "@jest/types": "30.4.1", - "@jridgewell/trace-mapping": "^0.3.25", - "babel-plugin-istanbul": "^7.0.1", + "@jest/types": "30.5.0", + "@jridgewell/trace-mapping": "^0.3.31", + "babel-plugin-istanbul": "^8.0.0", "chalk": "^4.1.2", "convert-source-map": "^2.0.0", "fast-json-stable-stringify": "^2.1.0", "graceful-fs": "^4.2.11", - "jest-haste-map": "30.4.1", - "jest-regex-util": "30.4.0", - "jest-util": "30.4.1", + "jest-haste-map": "30.5.0", + "jest-regex-util": "30.5.0", + "jest-util": "30.5.0", "pirates": "^4.0.7", "slash": "^3.0.0", "write-file-atomic": "^5.0.1" @@ -1816,14 +1763,14 @@ } }, "node_modules/@jest/types": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.4.1.tgz", - "integrity": "sha512-f1x/vJXIfjOlEmejYpbkbgw1gOqpPECwMvMEtBqe47j7H2Hg8h8w3o3ikhSXq3MI15kg+oQ0exWO0uCtTNJLoQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.5.0.tgz", + "integrity": "sha512-s1N+79S4Yp9ZgklCauZXi+YPJdCdtStNYQT32stuD6EeQaIBGHoUfyj2P0YWy8RmuQfaJboO+ulxEvEheR/POQ==", "dev": true, "license": "MIT", "dependencies": { - "@jest/pattern": "30.4.0", - "@jest/schemas": "30.4.1", + "@jest/pattern": "30.5.0", + "@jest/schemas": "30.5.0", "@types/istanbul-lib-coverage": "^2.0.6", "@types/istanbul-reports": "^3.0.4", "@types/node": "*", @@ -1867,9 +1814,9 @@ } }, "node_modules/@jridgewell/sourcemap-codec": { - "version": "1.5.5", - "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz", - "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==", + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz", + "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==", "dev": true, "license": "MIT" }, @@ -1894,22 +1841,25 @@ } }, "node_modules/@napi-rs/wasm-runtime": { - "version": "1.1.4", - "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz", - "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==", + "version": "1.2.3", + "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.3.tgz", + "integrity": "sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q==", "dev": true, "license": "MIT", "optional": true, "dependencies": { - "@tybys/wasm-util": "^0.10.1" + "@tybys/wasm-util": "^0.10.3" + }, + "engines": { + "node": "^20.19.0 || ^22.13.0 || >=23.5.0" }, "funding": { "type": "github", "url": "https://github.com/sponsors/Brooooooklyn" }, "peerDependencies": { - "@emnapi/core": "^1.7.1", - "@emnapi/runtime": "^1.7.1" + "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4", + "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4" } }, "node_modules/@noble/ciphers": { @@ -1936,6 +1886,324 @@ "url": "https://paulmillr.com/funding/" } }, + "node_modules/@parcel/watcher": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.6.0.tgz", + "integrity": "sha512-7FNeNl8NCE7aINx7WXiKQrPYZWC/hvrTsmk6zmxbI7LTXE7hVek/n8AfVgpe2y82zl3w0HvCHN0bVKMBoJcC0w==", + "dev": true, + "hasInstallScript": true, + "license": "MIT", + "dependencies": { + "detect-libc": "^2.0.3", + "is-glob": "^4.0.3", + "node-addon-api": "^7.0.0", + "picomatch": "^4.0.4" + }, + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + }, + "optionalDependencies": { + "@parcel/watcher-android-arm64": "2.6.0", + "@parcel/watcher-darwin-arm64": "2.6.0", + "@parcel/watcher-darwin-x64": "2.6.0", + "@parcel/watcher-freebsd-x64": "2.6.0", + "@parcel/watcher-linux-arm-glibc": "2.6.0", + "@parcel/watcher-linux-arm-musl": "2.6.0", + "@parcel/watcher-linux-arm64-glibc": "2.6.0", + "@parcel/watcher-linux-arm64-musl": "2.6.0", + "@parcel/watcher-linux-x64-glibc": "2.6.0", + "@parcel/watcher-linux-x64-musl": "2.6.0", + "@parcel/watcher-win32-arm64": "2.6.0", + "@parcel/watcher-win32-x64": "2.6.0" + } + }, + "node_modules/@parcel/watcher-android-arm64": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.6.0.tgz", + "integrity": "sha512-trgpLSCKRC/huFjXX/Smh+0sWe4+YtKfktIToiMl59ghz7z+qkH6kMvNnUbLyRs9N11t8l4svSCs1+5B3rOAhA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-darwin-arm64": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.6.0.tgz", + "integrity": "sha512-Y3QV0gl7Q1zbfueunkWIERICbEojQFCgpyG7YqOGNFLsckXyI1xu9mAIUpKY9QBYzBtSkN8dBPwd3yiAO9ovMw==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-darwin-x64": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.6.0.tgz", + "integrity": "sha512-Ohv6OpzhUfKYD7Beb8kDvG0jbIxORCYY1JRdZnaBtnjjkJxgD7ZVL0nw2sCYd0yTMKTvz3nnTnOF3cDifK+kvw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-freebsd-x64": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.6.0.tgz", + "integrity": "sha512-5HmXvDgs8VK+74jF9y9/2FE3/OnlcKmc56tjmSrEuZjpSZOGL+fvAu+HKJBdPs9uwoP2hE6TlSUpXZ/C5jUFmQ==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-linux-arm-glibc": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.6.0.tgz", + "integrity": "sha512-Ps/hui3A+vMbjdqlqAowK2ZL8+BO8dBjxeWXj6npTBs3jx4wWmbPpaLuqwrQrSqIVMCnpWo238bJ1U37GhQOYg==", + "cpu": [ + "arm" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-linux-arm-musl": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.6.0.tgz", + "integrity": "sha512-9c6AUHgHoG+IY88MRIHupztQiQnrbqHYQjkM2btA+Bf/wQnQMuiD0Wfk1EVv3TlNT3x41uU71rn6E4xh/+zvkw==", + "cpu": [ + "arm" + ], + "dev": true, + "libc": [ + "musl" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-linux-arm64-glibc": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.6.0.tgz", + "integrity": "sha512-yHRqS2owEXe6Hic9z6Mh1ECsCd+ODVOGvZDyciqRd21+v+o+DnXMOrw50DSpIG2sb8GPEaPPmfeCAWKPJdq46g==", + "cpu": [ + "arm64" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-linux-arm64-musl": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.6.0.tgz", + "integrity": "sha512-WhB2e/V7rqdHHWZusBSPuy5Ei8S6lSz6FE5TKKQz5h3a0O+C+mhY7vxU9b/stqvMb8beLnPY82ZrFTLKs+SrKA==", + "cpu": [ + "arm64" + ], + "dev": true, + "libc": [ + "musl" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-linux-x64-glibc": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.6.0.tgz", + "integrity": "sha512-ulGE6x6Oz6iAwg75T8YQSoguBWasniIbX+QWpaYPcCnDOpdWX3k+4xbEYPZVLxOuoJI+svJJPD3sEj8G7lrQ3A==", + "cpu": [ + "x64" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-linux-x64-musl": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.6.0.tgz", + "integrity": "sha512-tkBYKt7YQrjIJWYDnto2YgO8MRkjlMTSNoRHzsXinBqbLdeOM3L32wPZJvIZxqaLMfSlS/4sUjH/6STVP/XDLw==", + "cpu": [ + "x64" + ], + "dev": true, + "libc": [ + "musl" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-win32-arm64": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.6.0.tgz", + "integrity": "sha512-gIZAP23jaHjGWasY/TY6yL7NHFClf0Ga7FN+iINvk+KN94rhm94lYZhFsbYFNcA04/onvGD9kKmiJLJB2HbNwQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher-win32-x64": { + "version": "2.6.0", + "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.6.0.tgz", + "integrity": "sha512-cA+/pXV2YkfxlIcXOQ5fSWqAzzPyD78/x5qbK/I0vUkrlYHA8TIz+MXjAbGouguKVSI4bOmkTSJ1/poVSsgt+A==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 10.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/@parcel/watcher/node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } + }, "node_modules/@pkgjs/parseargs": { "version": "0.11.0", "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz", @@ -2048,9 +2316,9 @@ } }, "node_modules/@redocly/cli": { - "version": "2.46.0", - "resolved": "https://registry.npmjs.org/@redocly/cli/-/cli-2.46.0.tgz", - "integrity": "sha512-Hx4dIYwFhMkE6fZXDl0TwuVsvE8INX7dzEOgAcEhl0mhTkHC95o/rhUTlVLbNRg4mWHQ27jbdgKXPZBJJANWYA==", + "version": "2.49.0", + "resolved": "https://registry.npmjs.org/@redocly/cli/-/cli-2.49.0.tgz", + "integrity": "sha512-87UuARXYrPIiHhd/UriamL4BApuPgB0E91coBtoPG6PK4giTwiuo3dI4RoyMGhsC7TwgAnL8PJuhCwGymgwbVA==", "dev": true, "license": "MIT", "bin": { @@ -2087,9 +2355,9 @@ } }, "node_modules/@sinclair/typebox": { - "version": "0.34.49", - "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.49.tgz", - "integrity": "sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==", + "version": "0.34.52", + "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.52.tgz", + "integrity": "sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw==", "dev": true, "license": "MIT" }, @@ -2114,12 +2382,12 @@ } }, "node_modules/@smithy/core": { - "version": "3.32.0", - "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.32.0.tgz", - "integrity": "sha512-NAiCSC78fzbNIEWoheoF74Ob5ZorLijCHpMY26Fqvqg/+9LuyIqMfHDg2p8Yk1rqOyowtiL3y7WX0AW+teL6zw==", + "version": "3.33.3", + "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.33.3.tgz", + "integrity": "sha512-CsOeKq/9kA3y6VJHt+/+VTCtBaxJ4OTFpgrjIUhPpDIKxBci1k2bJaQASF2h/ELWrulGp+t97DZ0mevfAD8idg==", "license": "Apache-2.0", "dependencies": { - "@smithy/types": "^4.17.0", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -2127,13 +2395,13 @@ } }, "node_modules/@smithy/credential-provider-imds": { - "version": "4.5.0", - "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.5.0.tgz", - "integrity": "sha512-2jsPi+7Zv2hSzD9IXR9D7DTqSn7mv4XalzRm+bESh53jiaUS3NKEUbpQFTJP0HhQy9qzZvluxQ3yS24zdRrqsA==", + "version": "4.5.2", + "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.5.2.tgz", + "integrity": "sha512-A9uSdn72ozbRUSit0eib0TW7nXuNPlaeM0zcGkJ+nE6tFcSDbnmtwoxbTCFBukVQcszDAyvsd7+rTduPTXpygg==", "license": "Apache-2.0", "dependencies": { - "@smithy/core": "^3.32.0", - "@smithy/types": "^4.17.0", + "@smithy/core": "^3.33.2", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -2141,13 +2409,13 @@ } }, "node_modules/@smithy/fetch-http-handler": { - "version": "5.7.0", - "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.7.0.tgz", - "integrity": "sha512-W/exA8T0LEzCQtJ02w4IzaEQPIspgarqZprb7W8FwnYiDowgCrjl2fTQ6FvuSSUnJORuepBF81abmBJwqh+0XQ==", + "version": "5.7.2", + "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.7.2.tgz", + "integrity": "sha512-nZyWTmSpJEXl6VtWVMBJve/7x12DZu6sIX1z1a+ZMaHlQQRs9Zpu6NbTe/gmxYXVRpkjxyDYpZ5gx2IM6f/Wkw==", "license": "Apache-2.0", "dependencies": { - "@smithy/core": "^3.32.0", - "@smithy/types": "^4.17.0", + "@smithy/core": "^3.33.2", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -2155,13 +2423,13 @@ } }, "node_modules/@smithy/node-http-handler": { - "version": "4.10.0", - "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.10.0.tgz", - "integrity": "sha512-nrh7VxqzPQS/ip1hS293aI/OAWDWARQvjUxCfuKhyrfHa2gTdk28066RNeWLI1uuoHXaKAkOF8IcSAHuOp0+SA==", + "version": "4.11.3", + "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.11.3.tgz", + "integrity": "sha512-2jY1tSpERfPfWqyBV2pH+iGFaghVsIJszJNsT7hxtQYhVJpWDyc0LqOWI+nXOxOAHaEfZ4PXXtp1wW1TGpHhkA==", "license": "Apache-2.0", "dependencies": { - "@smithy/core": "^3.32.0", - "@smithy/types": "^4.17.0", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -2169,13 +2437,13 @@ } }, "node_modules/@smithy/signature-v4": { - "version": "5.7.0", - "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.7.0.tgz", - "integrity": "sha512-hCynhm22wMJ8wTF9crcwu8mxggtUrSLLJgDcGUvYFBqpofxycYJCGKOMYg4xtPPFtgNiDJSYmhsWLTrcU/g59Q==", + "version": "5.7.3", + "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.7.3.tgz", + "integrity": "sha512-7ImGm+FkHRLcBaRttIAMZ6bzJZWb2cJGoYjq46F2UjycujWzrL9GEN9h4w7eQyXJYnltrUhxbbieBAIRrdqpow==", "license": "Apache-2.0", "dependencies": { - "@smithy/core": "^3.32.0", - "@smithy/types": "^4.17.0", + "@smithy/core": "^3.33.3", + "@smithy/types": "^4.17.2", "tslib": "^2.6.2" }, "engines": { @@ -2183,9 +2451,9 @@ } }, "node_modules/@smithy/types": { - "version": "4.17.0", - "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.17.0.tgz", - "integrity": "sha512-Aw4joiM0ZdErpo39lCj8phT2lxoiKZV+KZzBxnnQhWVtU2Is/WffQSL04uUWRcXUse9Ln8vXZK6V/FwqRVnQpg==", + "version": "4.17.2", + "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.17.2.tgz", + "integrity": "sha512-FOKpVZob9MPTn2znRzGrnsMHv7BOsKVw3XiP/cOyYLDVZ9qKp4nifIiSCuUU/fIj5Vu0UOAxCFr+qRAtG0NUkA==", "license": "Apache-2.0", "dependencies": { "tslib": "^2.6.2" @@ -2215,9 +2483,9 @@ "license": "MIT" }, "node_modules/@tybys/wasm-util": { - "version": "0.10.2", - "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz", - "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==", + "version": "0.10.3", + "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz", + "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==", "dev": true, "license": "MIT", "optional": true, @@ -2319,9 +2587,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.2.0", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.2.0.tgz", - "integrity": "sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==", + "version": "26.4.0", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.4.0.tgz", + "integrity": "sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ==", "devOptional": true, "license": "MIT", "dependencies": { @@ -2378,9 +2646,9 @@ } }, "node_modules/@ungap/structured-clone": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz", - "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==", + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz", + "integrity": "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==", "dev": true, "license": "ISC" }, @@ -2490,6 +2758,9 @@ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2504,6 +2775,9 @@ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -2518,6 +2792,9 @@ "loong64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2532,6 +2809,9 @@ "loong64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -2546,6 +2826,9 @@ "ppc64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2560,6 +2843,9 @@ "riscv64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2574,6 +2860,9 @@ "riscv64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -2588,6 +2877,9 @@ "s390x" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2602,6 +2894,9 @@ "x64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2616,6 +2911,9 @@ "x64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -2957,6 +3255,16 @@ "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz", "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==" }, + "node_modules/async-mutex": { + "version": "0.5.0", + "resolved": "https://registry.npmjs.org/async-mutex/-/async-mutex-0.5.0.tgz", + "integrity": "sha512-1A94B18jkJ3DYq284ohPxoXbfTA5HsQ7/Mf4DEhcyLx3Bz27Rh59iScbB6EPiP+B+joue6YCxcMXSbFC1tZKwA==", + "dev": true, + "license": "MIT", + "dependencies": { + "tslib": "^2.4.0" + } + }, "node_modules/asynckit": { "version": "0.4.0", "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", @@ -2964,9 +3272,9 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.19.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.19.0.tgz", - "integrity": "sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw==", + "version": "1.20.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz", + "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", @@ -3061,16 +3369,16 @@ } }, "node_modules/babel-jest": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.4.1.tgz", - "integrity": "sha512-fATAbM8piYxkiXQp3RBXmZHxZVNJZAVXXfyeyCN2Tida3+qJ8ea9UxhiJ2y4fLO90ZImKt6k9FlcH2+rLkJGhw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.5.0.tgz", + "integrity": "sha512-PrhPHlKC+MsLnuNzgIH/y1dkz1f6cSfKWaQeaG8WxLMuG44dYWQ8E9uRrsBbAGCU/3+BEFYPN4d6G3Zc5Y+waA==", "dev": true, "license": "MIT", "dependencies": { - "@jest/transform": "30.4.1", + "@jest/transform": "30.5.0", "@types/babel__core": "^7.20.5", - "babel-plugin-istanbul": "^7.0.1", - "babel-preset-jest": "30.4.0", + "babel-plugin-istanbul": "^8.0.0", + "babel-preset-jest": "30.5.0", "chalk": "^4.1.2", "graceful-fs": "^4.2.11", "slash": "^3.0.0" @@ -3083,9 +3391,9 @@ } }, "node_modules/babel-plugin-istanbul": { - "version": "7.0.1", - "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-7.0.1.tgz", - "integrity": "sha512-D8Z6Qm8jCvVXtIRkBnqNHX0zJ37rQcFJ9u8WOS6tkYOsRdHBzypCstaxWiu5ZIlqQtviRYbgnRLSoCEvjqcqbA==", + "version": "8.0.0", + "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-8.0.0.tgz", + "integrity": "sha512-18wCskrN3DgbuBmp1gr7LBGT8xdz5xhQQqFvFhVxbkl8VBCrMKQ2YtqBWtUal1Zrc1HTuX0011+Brjw78TCFkg==", "dev": true, "license": "BSD-3-Clause", "workspaces": [ @@ -3096,16 +3404,16 @@ "@istanbuljs/load-nyc-config": "^1.0.0", "@istanbuljs/schema": "^0.1.3", "istanbul-lib-instrument": "^6.0.2", - "test-exclude": "^6.0.0" + "test-exclude": "^7.0.1" }, "engines": { - "node": ">=12" + "node": ">=18" } }, "node_modules/babel-plugin-jest-hoist": { - "version": "30.4.0", - "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.4.0.tgz", - "integrity": "sha512-9EdtWM/sSfXLOGLwSn+GS6pIXyBnL07/8gyJlwFXjWy4DxMOyItqyUT29d4lQiS380EZwYlX7/At4PgBS+m2aA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.5.0.tgz", + "integrity": "sha512-gtGo1B+u14jrZQv6TdSWIWkTqclboo7Qn+dFAGUOIuXLFuJKAdg3U5MIWzZnW4vfUb4dX9skmAMiby86e/SF4A==", "dev": true, "license": "MIT", "dependencies": { @@ -3143,20 +3451,20 @@ } }, "node_modules/babel-preset-jest": { - "version": "30.4.0", - "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.4.0.tgz", - "integrity": "sha512-lBY4jxsNmCnSiu7kquw8ZC9F4+XLMOKypT3RnNHPvU2Kpd4W0xaPuLr5ZkRyOsvLYAY4yaW1ZwTW4xB7NIiZzg==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.5.0.tgz", + "integrity": "sha512-ZGPn5ClP4lBDpuOK8W1yQIOy359HmbnZv3suucAlIe+SEE9yDsxV4S2PjSbH2Vc97U+WmzYD7vw3kr8NsQ/i6w==", "dev": true, "license": "MIT", "dependencies": { - "babel-plugin-jest-hoist": "30.4.0", + "babel-plugin-jest-hoist": "30.5.0", "babel-preset-current-node-syntax": "^1.2.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" }, "peerDependencies": { - "@babel/core": "^7.11.0 || ^8.0.0-beta.1" + "@babel/core": "^7.11.0 || ^8.0.0-beta.1 || ^8.0.0" } }, "node_modules/babel-walk": { @@ -3276,9 +3584,9 @@ ] }, "node_modules/baseline-browser-mapping": { - "version": "2.10.32", - "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.32.tgz", - "integrity": "sha512-wbPvpyjJPC0zdfdKXxqEL3Ea+bOMD/87X4lftiJkkaBiuG6ALQy1SLmEd7BSmVCuwCQsBrCamgBoLyfFDD1EPg==", + "version": "2.11.20", + "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz", + "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==", "dev": true, "license": "Apache-2.0", "bin": { @@ -3326,6 +3634,7 @@ "version": "1.6.52", "resolved": "https://registry.npmjs.org/big-integer/-/big-integer-1.6.52.tgz", "integrity": "sha512-QxD8cf2eVqJOOz63z6JIN9BzvVs/dlySa5HGSBH5xtR8dPteIRQnBxxKqkNTiT6jbDTF6jAfrd4oMcND9RGbQg==", + "license": "Unlicense", "engines": { "node": ">=0.6" } @@ -3334,6 +3643,7 @@ "version": "0.3.0", "resolved": "https://registry.npmjs.org/binary/-/binary-0.3.0.tgz", "integrity": "sha512-D4H1y5KYwpJgK8wk1Cue5LLPgmwHKYSChkbspQg5JtVuR5ulGckxfR62H3AE9UDkdMC8yyXlqYihuz3Aqg2XZg==", + "license": "MIT", "dependencies": { "buffers": "~0.1.1", "chainsaw": "~0.1.0" @@ -3365,9 +3675,10 @@ } }, "node_modules/bluebird": { - "version": "3.4.7", - "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.4.7.tgz", - "integrity": "sha512-iD3898SR7sWVRHbiQv+sHUtHnMvC1o3nW5rAcqnq3uOn07DSAppZYUkIGslDz6gXC7HfunPe7YVBgoEJASPcHA==" + "version": "3.7.2", + "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz", + "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==", + "license": "MIT" }, "node_modules/bn.js": { "version": "4.12.5", @@ -3448,25 +3759,10 @@ "base64-js": "^1.1.2" } }, - "node_modules/browserify-zlib": { - "version": "0.2.0", - "resolved": "https://registry.npmjs.org/browserify-zlib/-/browserify-zlib-0.2.0.tgz", - "integrity": "sha512-Z942RysHXmJrhqk88FmKBVq/v5tqmSkDz7p54G/MGyjMnCFFnC79XWNbg+Vta8W6Wb2qtSZTSxIGkJrRpCFEiA==", - "license": "MIT", - "dependencies": { - "pako": "~1.0.5" - } - }, - "node_modules/browserify-zlib/node_modules/pako": { - "version": "1.0.11", - "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz", - "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==", - "license": "(MIT AND Zlib)" - }, "node_modules/browserslist": { - "version": "4.28.2", - "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz", - "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==", + "version": "4.28.8", + "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz", + "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==", "dev": true, "funding": [ { @@ -3484,11 +3780,11 @@ ], "license": "MIT", "dependencies": { - "baseline-browser-mapping": "^2.10.12", - "caniuse-lite": "^1.0.30001782", - "electron-to-chromium": "^1.5.328", - "node-releases": "^2.0.36", - "update-browserslist-db": "^1.2.3" + "baseline-browser-mapping": "^2.11.12", + "caniuse-lite": "^1.0.30001809", + "electron-to-chromium": "^1.5.402", + "node-releases": "^2.0.53", + "update-browserslist-db": "^1.3.0" }, "bin": { "browserslist": "cli.js" @@ -3508,9 +3804,9 @@ } }, "node_modules/bson": { - "version": "7.3.1", - "resolved": "https://registry.npmjs.org/bson/-/bson-7.3.1.tgz", - "integrity": "sha512-h/C0qe6857pQhcSJHLfsR1uYGj98Ge3wKAD3Ed9KqH3wcVh+BM4Jq4xISD7vs9OPuT07n+q3QQVjslJ286j6ag==", + "version": "7.3.2", + "resolved": "https://registry.npmjs.org/bson/-/bson-7.3.2.tgz", + "integrity": "sha512-1w0ra+ho1cuE+w8jzwgzTFIimFtCfZeCoOsvIPQg6uyFCsp8M29U7bNNf5GrFh88TXbYg1g3TyKUGpd6O7q6zA==", "license": "Apache-2.0", "engines": { "node": ">=20.19.0" @@ -3562,6 +3858,7 @@ "version": "1.0.2", "resolved": "https://registry.npmjs.org/buffer-indexof-polyfill/-/buffer-indexof-polyfill-1.0.2.tgz", "integrity": "sha512-I7wzHwA3t1/lwXQh+A5PbNvJxgfo5r3xulgpYDB5zckTu/Z9oUK9biouBKQUjEqzaz3HnAT6TYoovmE+GqSf7A==", + "license": "MIT", "engines": { "node": ">=0.10" } @@ -3639,9 +3936,9 @@ } }, "node_modules/caniuse-lite": { - "version": "1.0.30001793", - "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001793.tgz", - "integrity": "sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==", + "version": "1.0.30001810", + "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz", + "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==", "dev": true, "funding": [ { @@ -3663,6 +3960,7 @@ "version": "0.1.0", "resolved": "https://registry.npmjs.org/chainsaw/-/chainsaw-0.1.0.tgz", "integrity": "sha512-75kWfWt6MEKNC8xYXIdRpDehRYY/tNSgwKaJq+dbbDcxORuVrrQ+SEHoWsniVn9XPYfP4gmdWIeDk/4YNp1rNQ==", + "license": "MIT/X11", "dependencies": { "traverse": ">=0.3.0 <0.4" }, @@ -3782,9 +4080,9 @@ } }, "node_modules/cjs-module-lexer": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.0.tgz", - "integrity": "sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==", + "version": "2.2.1", + "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.1.tgz", + "integrity": "sha512-Ca8swihM+/4yKecYHY52kgJd300hi2lADU/a1RxNTRe+RJ9jvqQlESpbz9DnG9mowez8qwXHB8qYdIUw9e+F5Q==", "dev": true, "license": "MIT" }, @@ -3860,6 +4158,13 @@ "resolved": "https://registry.npmmirror.com/commander/-/commander-2.20.3.tgz", "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==" }, + "node_modules/commondir": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz", + "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==", + "dev": true, + "license": "MIT" + }, "node_modules/component-emitter": { "version": "1.3.1", "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.1.tgz", @@ -4212,9 +4517,10 @@ }, "node_modules/deepmerge": { "version": "4.3.1", - "resolved": "https://registry.npmmirror.com/deepmerge/-/deepmerge-4.3.1.tgz", + "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz", "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==", "dev": true, + "license": "MIT", "engines": { "node": ">=0.10.0" } @@ -4269,6 +4575,16 @@ "node": ">= 0.8" } }, + "node_modules/detect-libc": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz", + "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==", + "dev": true, + "license": "Apache-2.0", + "engines": { + "node": ">=8" + } + }, "node_modules/detect-newline": { "version": "3.1.0", "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz", @@ -4439,9 +4755,9 @@ "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==" }, "node_modules/electron-to-chromium": { - "version": "1.5.364", - "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.364.tgz", - "integrity": "sha512-G/dYE3+AYhyHwzTwg8UbnXf7zqMERYh7l2jJ3QujhFsH8agSYwtnGAR2aZ7f0AakIKJXd5En/Hre4igIUrdlYw==", + "version": "1.5.416", + "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.416.tgz", + "integrity": "sha512-K6bvB2BjnNrugtIih6ewlbBI9DXa976jIdiIlRLHhBoEI9a4JaQjjHyF+A1IQI543aQYR4LnmOrT/K5fZj0aPA==", "dev": true, "license": "ISC" }, @@ -4526,6 +4842,13 @@ "node": ">= 0.4" } }, + "node_modules/es-module-lexer": { + "version": "2.3.2", + "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz", + "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==", + "dev": true, + "license": "MIT" + }, "node_modules/es-object-atoms": { "version": "1.1.1", "resolved": "https://registry.npmmirror.com/es-object-atoms/-/es-object-atoms-1.1.1.tgz", @@ -4598,9 +4921,9 @@ } }, "node_modules/eslint": { - "version": "10.8.1", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.1.tgz", - "integrity": "sha512-wqA7W2jbsC/BnV9Iv1UZpKVFkO1AdNoSmYW8NWG4HNOBbkAMvIqDZ27pI2f07dqn583NcIC44ckjAcOXDL1QbQ==", + "version": "10.9.1", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.9.1.tgz", + "integrity": "sha512-9VaAkDURekixUQJy0oJYl2DcN6oKMfxay7XzaGYAWQwsb6qfKf+x76R2k1L8kb1boc+FyCAaTA9GmiKaaiaF+A==", "dev": true, "license": "MIT", "workspaces": [ @@ -4978,6 +5301,60 @@ "node": ">=8.3.0" } }, + "node_modules/exceljs/node_modules/bluebird": { + "version": "3.4.7", + "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.4.7.tgz", + "integrity": "sha512-iD3898SR7sWVRHbiQv+sHUtHnMvC1o3nW5rAcqnq3uOn07DSAppZYUkIGslDz6gXC7HfunPe7YVBgoEJASPcHA==", + "license": "MIT" + }, + "node_modules/exceljs/node_modules/safe-buffer": { + "version": "5.1.2", + "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz", + "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==", + "license": "MIT" + }, + "node_modules/exceljs/node_modules/string_decoder": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz", + "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==", + "license": "MIT", + "dependencies": { + "safe-buffer": "~5.1.0" + } + }, + "node_modules/exceljs/node_modules/unzipper": { + "version": "0.10.14", + "resolved": "https://registry.npmjs.org/unzipper/-/unzipper-0.10.14.tgz", + "integrity": "sha512-ti4wZj+0bQTiX2KmKWuwj7lhV+2n//uXEotUmGuQqrbVZSEGFMbI68+c6JCQ8aAmUWYvtHEz2A8K6wXvueR/6g==", + "license": "MIT", + "dependencies": { + "big-integer": "^1.6.17", + "binary": "~0.3.0", + "bluebird": "~3.4.1", + "buffer-indexof-polyfill": "~1.0.0", + "duplexer2": "~0.1.4", + "fstream": "^1.0.12", + "graceful-fs": "^4.2.2", + "listenercount": "~1.0.1", + "readable-stream": "~2.3.6", + "setimmediate": "~1.0.4" + } + }, + "node_modules/exceljs/node_modules/unzipper/node_modules/readable-stream": { + "version": "2.3.8", + "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz", + "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==", + "license": "MIT", + "dependencies": { + "core-util-is": "~1.0.0", + "inherits": "~2.0.3", + "isarray": "~1.0.0", + "process-nextick-args": "~2.0.0", + "safe-buffer": "~5.1.1", + "string_decoder": "~1.1.1", + "util-deprecate": "~1.0.1" + } + }, "node_modules/exceljs/node_modules/uuid": { "version": "11.1.1", "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", @@ -5039,18 +5416,18 @@ } }, "node_modules/expect": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/expect/-/expect-30.4.1.tgz", - "integrity": "sha512-PMARsyh/JtqC20HoGqlFcIlQAyqUtW4PlI1rup1uhYJtKuwAjbvWi3GQMAn+STdHum/dk8xrKfUM1+5SAwpolA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/expect/-/expect-30.5.0.tgz", + "integrity": "sha512-8fiMWcEjPU7B9nErC4FtFcCzf2tC6I75Qf7m8wzBAWC2taZmcno3yAFEjIQL34SwoGZNgPf63UDiJLyh4SMPaw==", "dev": true, "license": "MIT", "dependencies": { - "@jest/expect-utils": "30.4.1", - "@jest/get-type": "30.1.0", - "jest-matcher-utils": "30.4.1", - "jest-message-util": "30.4.1", - "jest-mock": "30.4.1", - "jest-util": "30.4.1" + "@jest/expect-utils": "30.5.0", + "@jest/get-type": "30.5.0", + "jest-matcher-utils": "30.5.0", + "jest-message-util": "30.5.0", + "jest-mock": "30.5.0", + "jest-util": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" @@ -5259,6 +5636,12 @@ "pend": "~1.2.0" } }, + "node_modules/fflate": { + "version": "0.8.3", + "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz", + "integrity": "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==", + "license": "MIT" + }, "node_modules/file-entry-cache": { "version": "8.0.0", "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz", @@ -5300,6 +5683,50 @@ "node": ">= 0.8" } }, + "node_modules/find-cache-dir": { + "version": "3.3.2", + "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-3.3.2.tgz", + "integrity": "sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==", + "dev": true, + "license": "MIT", + "dependencies": { + "commondir": "^1.0.1", + "make-dir": "^3.0.2", + "pkg-dir": "^4.1.0" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/avajs/find-cache-dir?sponsor=1" + } + }, + "node_modules/find-cache-dir/node_modules/make-dir": { + "version": "3.1.0", + "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz", + "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==", + "dev": true, + "license": "MIT", + "dependencies": { + "semver": "^6.0.0" + }, + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/find-cache-dir/node_modules/semver": { + "version": "6.3.1", + "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", + "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==", + "dev": true, + "license": "ISC", + "bin": { + "semver": "bin/semver.js" + } + }, "node_modules/find-up": { "version": "4.1.0", "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz", @@ -5528,6 +5955,7 @@ "resolved": "https://registry.npmjs.org/fstream/-/fstream-1.0.12.tgz", "integrity": "sha512-WvJ193OHa0GHPEL+AycEJgxvBEwyfRkN1vhjca23OaPVMCaLCXTd5qAu82AjTcgP1UJmytkOKb63Ypde7raDIg==", "deprecated": "This package is no longer supported.", + "license": "ISC", "dependencies": { "graceful-fs": "^4.1.2", "inherits": "~2.0.0", @@ -5709,9 +6137,9 @@ } }, "node_modules/globals": { - "version": "17.9.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.9.0.tgz", - "integrity": "sha512-m/MvAW61QVU5VDNF1Vj8axt016h8w7L5TU1e9zlab7XIttAT2YAlCwl75K1fOqvMM9apmD7lbCIRhpfkhmxhCg==", + "version": "17.11.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.11.0.tgz", + "integrity": "sha512-Z2I8hM+PbJDXQDq3Icgpzv+mPdwr68iZUU9d5WW4FuXfDUQfkZaZuvjMv42/5crNyw154+9+VWXbYrUgDXbxNw==", "dev": true, "license": "MIT", "engines": { @@ -5854,13 +6282,13 @@ "license": "MIT" }, "node_modules/html-to-text": { - "version": "10.0.0", - "resolved": "https://registry.npmjs.org/html-to-text/-/html-to-text-10.0.0.tgz", - "integrity": "sha512-2OH59Gtprdczel+7Rxgpz9hGVJREaf8Lt1H4kZwWHpEn70VQKRuMNGsb2eDbwaTzrYzb0hheiOG1P7Dim0B4dQ==", + "version": "10.0.1", + "resolved": "https://registry.npmjs.org/html-to-text/-/html-to-text-10.0.1.tgz", + "integrity": "sha512-GiVhRI1BatGARSCmlXWNCjDT0cWrwBWoeduLoV0WSKAgaV/wa+hUWy5LiQLUs4UwiUrE52ZCMfBGiKD87TDPrg==", "license": "MIT", "dependencies": { "@selderee/plugin-htmlparser2": "~0.12.0", - "deepmerge-ts": "^7.1.5", + "deepmerge-ts": "^8.0.1", "dom-serializer": "^2.0.0", "htmlparser2": "^10.1.0", "selderee": "~0.12.0" @@ -6358,16 +6786,16 @@ } }, "node_modules/jest": { - "version": "30.4.2", - "resolved": "https://registry.npmjs.org/jest/-/jest-30.4.2.tgz", - "integrity": "sha512-Yi1jqNC/Oq0N4hBgNH/YvBpP1P57QqundgytzYqy3yqAa7NZPNjSoi4SGbRAXDMdBzNE6xBCi5U7RgfrvMEUVQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest/-/jest-30.5.0.tgz", + "integrity": "sha512-HeFeOUEKh5gjnp1rjuSCse8Dhj0Y3KA8lsZ3azr4Wnq1nCxwMBu35MDc9mp8iblZxmeAz6wV4P241tyUB7J2Ew==", "dev": true, "license": "MIT", "dependencies": { - "@jest/core": "30.4.2", - "@jest/types": "30.4.1", + "@jest/core": "30.5.0", + "@jest/types": "30.5.0", "import-local": "^3.2.0", - "jest-cli": "30.4.2" + "jest-cli": "30.5.0" }, "bin": { "jest": "bin/jest.js" @@ -6385,14 +6813,14 @@ } }, "node_modules/jest-changed-files": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.4.1.tgz", - "integrity": "sha512-IuctmYrxi21iOSOaIXpJWalHyPAsVv0GeBHKDn8C1CA4W5htHn7INL+wdnL4Bo0+olEndvAFkmb++tIQJG+vvg==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.5.0.tgz", + "integrity": "sha512-dq1x8JiEnHkJDxxOrF6UJDivBRAQMwAa5tzr+VX3um0SfyMFseUPQUbe51wLwggfoa5h/EmOtSpdJxxkzSlNRQ==", "dev": true, "license": "MIT", "dependencies": { "execa": "^5.1.1", - "jest-util": "30.4.1", + "jest-util": "30.5.0", "p-limit": "^3.1.0" }, "engines": { @@ -6416,29 +6844,29 @@ } }, "node_modules/jest-circus": { - "version": "30.4.2", - "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.4.2.tgz", - "integrity": "sha512-rvHH7VlY6LgbJXJTQ87GW62g1FntOtbhh0zT+v04kC+pgL6aBKyYINXxWukCpj3dcIBMw5/XUbtDS9dU9JTXeQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.5.0.tgz", + "integrity": "sha512-T3v7uM4wwCu+RQicjsAWCgoL3CiyuX3THSKwv2uMb9N2bMUgb+HfwDWEUma85vOGbvQNQ/YfoCXF1OCZot0ZEw==", "dev": true, "license": "MIT", "dependencies": { - "@jest/environment": "30.4.1", - "@jest/expect": "30.4.1", - "@jest/test-result": "30.4.1", - "@jest/types": "30.4.1", + "@jest/environment": "30.5.0", + "@jest/expect": "30.5.0", + "@jest/test-result": "30.5.0", + "@jest/types": "30.5.0", "@types/node": "*", "chalk": "^4.1.2", "co": "^4.6.0", "dedent": "^1.6.0", "is-generator-fn": "^2.1.0", - "jest-each": "30.4.1", - "jest-matcher-utils": "30.4.1", - "jest-message-util": "30.4.1", - "jest-runtime": "30.4.2", - "jest-snapshot": "30.4.1", - "jest-util": "30.4.1", + "jest-each": "30.5.0", + "jest-matcher-utils": "30.5.0", + "jest-message-util": "30.5.0", + "jest-runtime": "30.5.0", + "jest-snapshot": "30.5.0", + "jest-util": "30.5.0", "p-limit": "^3.1.0", - "pretty-format": "30.4.1", + "pretty-format": "30.5.0", "pure-rand": "^7.0.0", "slash": "^3.0.0", "stack-utils": "^2.0.6" @@ -6464,21 +6892,21 @@ } }, "node_modules/jest-cli": { - "version": "30.4.2", - "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.4.2.tgz", - "integrity": "sha512-jfA2ocvVHMXS2QijrJ0d31ektP+d/W0T5RpcTX2Pq+3sVqHlsXVCM2+FmwpL+bdY8OfHpIg9xMxLF17Zg0U49Q==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.5.0.tgz", + "integrity": "sha512-QHZMiy32x2K+NzJ1AuuoCAVc1Y5co0VXib3R7kD9MWcWFflzsD1eJN0wR+mkNlM+ts7C+Bjz0oOoFE5IiHylCg==", "dev": true, "license": "MIT", "dependencies": { - "@jest/core": "30.4.2", - "@jest/test-result": "30.4.1", - "@jest/types": "30.4.1", + "@jest/core": "30.5.0", + "@jest/test-result": "30.5.0", + "@jest/types": "30.5.0", "chalk": "^4.1.2", "exit-x": "^0.2.2", "import-local": "^3.2.0", - "jest-config": "30.4.2", - "jest-util": "30.4.1", - "jest-validate": "30.4.1", + "jest-config": "30.5.0", + "jest-util": "30.5.0", + "jest-validate": "30.5.0", "yargs": "^17.7.2" }, "bin": { @@ -6540,9 +6968,9 @@ } }, "node_modules/jest-cli/node_modules/yargs": { - "version": "17.7.2", - "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz", - "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==", + "version": "17.7.3", + "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz", + "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==", "dev": true, "license": "MIT", "dependencies": { @@ -6569,33 +6997,33 @@ } }, "node_modules/jest-config": { - "version": "30.4.2", - "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.4.2.tgz", - "integrity": "sha512-rNHAShJQqQwFNoL0hbf3BphSBOWnpOUAKvidLS/AjNVLPfoj5mSf4jQMfW3cYOs6hXeZC7nF7mDHaBnbxELOzg==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.5.0.tgz", + "integrity": "sha512-gYQl2FqYgiVpyuB7DutBIbJRWaq5VcHdzOXJJ51HNa8J5JrsZehIlzNFW0/9s5uvvcbzM5/LTUizYSbsFErv+w==", "dev": true, "license": "MIT", "dependencies": { "@babel/core": "^7.27.4", - "@jest/get-type": "30.1.0", - "@jest/pattern": "30.4.0", - "@jest/test-sequencer": "30.4.1", - "@jest/types": "30.4.1", - "babel-jest": "30.4.1", + "@jest/get-type": "30.5.0", + "@jest/pattern": "30.5.0", + "@jest/test-sequencer": "30.5.0", + "@jest/types": "30.5.0", + "babel-jest": "30.5.0", "chalk": "^4.1.2", "ci-info": "^4.2.0", "deepmerge": "^4.3.1", - "glob": "^10.5.0", + "glob": "^13.0.6", "graceful-fs": "^4.2.11", - "jest-circus": "30.4.2", - "jest-docblock": "30.4.0", - "jest-environment-node": "30.4.1", - "jest-regex-util": "30.4.0", - "jest-resolve": "30.4.1", - "jest-runner": "30.4.2", - "jest-util": "30.4.1", - "jest-validate": "30.4.1", + "jest-circus": "30.5.0", + "jest-docblock": "30.5.0", + "jest-environment-node": "30.5.0", + "jest-regex-util": "30.5.0", + "jest-resolve": "30.5.0", + "jest-runner": "30.5.0", + "jest-util": "30.5.0", + "jest-validate": "30.5.0", "parse-json": "^5.2.0", - "pretty-format": "30.4.1", + "pretty-format": "30.5.0", "slash": "^3.0.0", "strip-json-comments": "^3.1.1" }, @@ -6619,98 +7047,26 @@ } } }, - "node_modules/jest-config/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, - "node_modules/jest-config/node_modules/glob": { - "version": "10.5.0", - "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz", - "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==", - "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me", - "dev": true, - "license": "ISC", - "dependencies": { - "foreground-child": "^3.1.0", - "jackspeak": "^3.1.2", - "minimatch": "^9.0.4", - "minipass": "^7.1.2", - "package-json-from-dist": "^1.0.0", - "path-scurry": "^1.11.1" - }, - "bin": { - "glob": "dist/esm/bin.mjs" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/jest-config/node_modules/lru-cache": { - "version": "10.4.3", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz", - "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==", - "dev": true, - "license": "ISC" - }, - "node_modules/jest-config/node_modules/minimatch": { - "version": "9.0.9", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", - "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", - "dev": true, - "license": "ISC", - "dependencies": { - "brace-expansion": "^2.0.2" - }, - "engines": { - "node": ">=16 || 14 >=14.17" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/jest-config/node_modules/path-scurry": { - "version": "1.11.1", - "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz", - "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==", - "dev": true, - "license": "BlueOak-1.0.0", - "dependencies": { - "lru-cache": "^10.2.0", - "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" - }, - "engines": { - "node": ">=16 || 14 >=14.18" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, "node_modules/jest-diff": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.4.1.tgz", - "integrity": "sha512-CRpFK0RtLriVDGcPPAnR6HMVI8bSR2jnUIgralhauzYQZIb4RH9AtEInTuQr65LmmGggGcRT6HIASxwqsVsmlA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.5.0.tgz", + "integrity": "sha512-QjCfDMwdPFvLxTQmS4/Dswx3PUCiqmSXVLGljMC3SU7YG1qHVoR6b86IH/O2G9k9OMyKXz2vS2Q60VnAozNDwA==", "dev": true, "license": "MIT", "dependencies": { - "@jest/diff-sequences": "30.4.0", - "@jest/get-type": "30.1.0", + "@jest/diff-sequences": "30.5.0", + "@jest/get-type": "30.5.0", "chalk": "^4.1.2", - "pretty-format": "30.4.1" + "pretty-format": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/jest-docblock": { - "version": "30.4.0", - "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.4.0.tgz", - "integrity": "sha512-ZPMabUZCx5MpbZ2eBYSvZ0J8fvo3dR9oM+eeUpb3aKNQFuS2tu3Duw1TNlMoP8k3WQgKGJuhcMFvwcVuq6T7oA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.5.0.tgz", + "integrity": "sha512-NwDqcxtoZi33RhuW+zJS/RVA3rmheQ8BnwpYZuc/Eruaz6seQb7+aoCeDZu/3X7W2XmD8DbSo9Pn72DbKsBFYw==", "dev": true, "license": "MIT", "dependencies": { @@ -6721,70 +7077,86 @@ } }, "node_modules/jest-each": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.4.1.tgz", - "integrity": "sha512-/8MJbH6fuj48TstjrMf+u/pd06Qezz5xOXvZA6442heNOWr8bdeoGZX2d9fCn028CoMgYmroH9//zky5GfyYmA==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.5.0.tgz", + "integrity": "sha512-NiMFNhRygJEFqYNt8pnkxppUF6CR486GEpt9rSU6lPBf7KeccaOL0zbjxG8fgJgD//6e7zYdssnlt6j+1kI31A==", "dev": true, "license": "MIT", "dependencies": { - "@jest/get-type": "30.1.0", - "@jest/types": "30.4.1", + "@jest/get-type": "30.5.0", + "@jest/types": "30.5.0", "chalk": "^4.1.2", - "jest-util": "30.4.1", - "pretty-format": "30.4.1" + "jest-util": "30.5.0", + "pretty-format": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/jest-environment-node": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.4.1.tgz", - "integrity": "sha512-4FZYVOk85hz2AyT6BbarKy9u37g6DbrDyCdFhsnDdXqyrueYQvB+0zO4f/kqLCRD0BsPRXPMNJeQwihKZV8naw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.5.0.tgz", + "integrity": "sha512-bTc79ywKLz0ogbT3JIYuEhgWV4Ffd/cJe06co4v8CyRtlmju8x5gokMlGFR8ARWhmk5SnbDRxmf50XWnlZVhDg==", "dev": true, "license": "MIT", "dependencies": { - "@jest/environment": "30.4.1", - "@jest/fake-timers": "30.4.1", - "@jest/types": "30.4.1", + "@jest/environment": "30.5.0", + "@jest/fake-timers": "30.5.0", + "@jest/types": "30.5.0", "@types/node": "*", - "jest-mock": "30.4.1", - "jest-util": "30.4.1", - "jest-validate": "30.4.1" + "jest-mock": "30.5.0", + "jest-util": "30.5.0", + "jest-validate": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/jest-haste-map": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.4.1.tgz", - "integrity": "sha512-rFrcONd8jeFsyw+Z9CrScJgglRf2+NFmNam8dKu7n+SoHqNYT47mn0DdEcVUZJpvh7Iz6/si7f7yUH7GJHVgnw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.5.0.tgz", + "integrity": "sha512-0FStogBslBVOEqTOJr4oXMtFitmrWp9WscG6Gbns88i0YAuMXijCT2G5VMfg/HCR4QAnL+OF2C2ednag+HlDuA==", "dev": true, "license": "MIT", "dependencies": { - "@jest/types": "30.4.1", + "@jest/types": "30.5.0", + "@parcel/watcher": "^2.6.0", "@types/node": "*", "anymatch": "^3.1.3", "fb-watchman": "^2.0.2", + "fdir": "^6.5.0", "graceful-fs": "^4.2.11", - "jest-regex-util": "30.4.0", - "jest-util": "30.4.1", - "jest-worker": "30.4.1", - "picomatch": "^4.0.3", - "walker": "^1.0.8" + "jest-regex-util": "30.5.0", + "jest-util": "30.5.0", + "jest-worker": "30.5.0", + "picomatch": "^4.0.3" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" + } + }, + "node_modules/jest-haste-map/node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" }, - "optionalDependencies": { - "fsevents": "^2.3.3" + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } } }, "node_modules/jest-haste-map/node_modules/picomatch": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", - "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==", + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", "dev": true, "license": "MIT", "engines": { @@ -6795,50 +7167,50 @@ } }, "node_modules/jest-leak-detector": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.4.1.tgz", - "integrity": "sha512-IpmyiioeHxiWDhesHnUFmOxcTzwCwKpgACgWajtAP+nYQXiY7DakTxB6Bx9JFiRMljr0AX1PvnQdaU1KFoz6NQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.5.0.tgz", + "integrity": "sha512-Mq11ceAkNR250Iv45RoOwuG9fb4kYbJ02qoyL7A0nCI8FV5+aG/THmcEUx5uR2dNSa4KOtz+xBKrJ8cZPhPpuQ==", "dev": true, "license": "MIT", "dependencies": { - "@jest/get-type": "30.1.0", - "pretty-format": "30.4.1" + "@jest/get-type": "30.5.0", + "pretty-format": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/jest-matcher-utils": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.4.1.tgz", - "integrity": "sha512-zvYfX5CaeEkFrrLS9suWe9rvJrm9J1Iv3ua8kIBv9GEPzcnsfBf0bob37la7s67fs0nlBC3EuvkOLnXQKxtx4A==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.5.0.tgz", + "integrity": "sha512-EfaYMC9f9ds7fahB/LYFTgd1Z2RS9Vpm2e46gazij0onkpoQG7Daq+MLm8/gQVqWwRVjL/RNDggbFx9MsrJEmQ==", "dev": true, "license": "MIT", "dependencies": { - "@jest/get-type": "30.1.0", + "@jest/get-type": "30.5.0", "chalk": "^4.1.2", - "jest-diff": "30.4.1", - "pretty-format": "30.4.1" + "jest-diff": "30.5.0", + "pretty-format": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/jest-message-util": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.4.1.tgz", - "integrity": "sha512-kwCKIvq0MCW1HzLoGola9Te6JUdzgV0loyKJ3Qghrkz9i5/RRIHsL95BMQc2HBBhlBKC4j22K9p11TGHH8RBpQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.5.0.tgz", + "integrity": "sha512-dBYMhplGfspKaCnVk9TUy1cZnknWubpuPNEputjz0YJk1G/92R45rn45BvbPMPMtC5LVcIdxJGPOaOSQTiuzJw==", "dev": true, "license": "MIT", "dependencies": { "@babel/code-frame": "^7.27.1", - "@jest/types": "30.4.1", + "@jest/types": "30.5.0", "@types/stack-utils": "^2.0.3", "chalk": "^4.1.2", "graceful-fs": "^4.2.11", - "jest-util": "30.4.1", + "jest-util": "30.5.0", "picomatch": "^4.0.3", - "pretty-format": "30.4.1", + "pretty-format": "30.5.0", "slash": "^3.0.0", "stack-utils": "^2.0.6" }, @@ -6847,9 +7219,9 @@ } }, "node_modules/jest-message-util/node_modules/picomatch": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", - "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==", + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", "dev": true, "license": "MIT", "engines": { @@ -6860,42 +7232,25 @@ } }, "node_modules/jest-mock": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.4.1.tgz", - "integrity": "sha512-/i8SVb8/NSB7RfNi8gfqu8gxLV23KaL5EpAttyb9iz8qWRIqXRLflycz/32wXsYkOnaUlx8NAKnJYtpsmXUmfw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.5.0.tgz", + "integrity": "sha512-bP5MHZpkYrV7xpV+yvhl36DPcXoEmTR57Un5EACcdVpMY7mpkDefCBq+V4mhcjE/3rwUajT6OTrcJTN7EwN1BA==", "dev": true, "license": "MIT", "dependencies": { - "@jest/types": "30.4.1", + "@jest/expect-utils": "30.5.0", + "@jest/types": "30.5.0", "@types/node": "*", - "jest-util": "30.4.1" + "jest-util": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, - "node_modules/jest-pnp-resolver": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz", - "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=6" - }, - "peerDependencies": { - "jest-resolve": "*" - }, - "peerDependenciesMeta": { - "jest-resolve": { - "optional": true - } - } - }, "node_modules/jest-regex-util": { - "version": "30.4.0", - "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.4.0.tgz", - "integrity": "sha512-mWlvLviKIgIQ8VCuM1xRdD0TWp3zlzionlmDBjuXVBs+VkmXq6FgW9T4Emr7oGz/Rk6feDCGyiugolcQEyp3mg==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.5.0.tgz", + "integrity": "sha512-Mg0WK7A6xRHLSA1udJ8y9f3lM0uUhFTBnLKzwPmqB9AylvpleJ6BLemR8K9dK27DY+cesDryoA7yLZCAHsPG1A==", "dev": true, "license": "MIT", "engines": { @@ -6903,68 +7258,67 @@ } }, "node_modules/jest-resolve": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.4.1.tgz", - "integrity": "sha512-Zry8Yq/yJcNAZ7dJ5F2heic8AheXvbFZ7XI5V+h28nrYZ7Qoyy4dItq8OodjnYD270mvX+ZudmrNV9cysqhW5Q==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.5.0.tgz", + "integrity": "sha512-NFvQWJ4G7e2kN5712iG+12Xr325NRFGAIhovrwLfgq5Oqd4bFHITw4CzcFkZGp1GTCqemC4v1l8/yZzedKZkjw==", "dev": true, "license": "MIT", "dependencies": { "chalk": "^4.1.2", "graceful-fs": "^4.2.11", - "jest-haste-map": "30.4.1", - "jest-pnp-resolver": "^1.2.3", - "jest-util": "30.4.1", - "jest-validate": "30.4.1", + "jest-haste-map": "30.5.0", + "jest-util": "30.5.0", + "jest-validate": "30.5.0", "slash": "^3.0.0", - "unrs-resolver": "^1.7.11" + "unrs-resolver": "^1.12.1" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/jest-resolve-dependencies": { - "version": "30.4.2", - "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.4.2.tgz", - "integrity": "sha512-gDiVh1I+GxYzz9oXlyw+1wv6VOYX1WYxMOfjsA3iGKePV2oxmbHhwxfkALxNxYy1ciw6APWwkW2zZONwP97aEQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.5.0.tgz", + "integrity": "sha512-TnSBAp3wGOnqXBmLT3OXtJkugw6Vj2KU0IPde2EJmbGns/QMoNlkauJ7jZ8KYaxONSpx0o4pUvi+u1Q/LSk3Pg==", "dev": true, "license": "MIT", "dependencies": { - "jest-regex-util": "30.4.0", - "jest-snapshot": "30.4.1" + "jest-regex-util": "30.5.0", + "jest-snapshot": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, "node_modules/jest-runner": { - "version": "30.4.2", - "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.4.2.tgz", - "integrity": "sha512-2dw0PslVYXxffXGpLo+Ejad+KcI1Qkjn7f4X4619gf21oCUmL+SPfjqIa/losUem3yEOvfNZe/F1HWUcNpODcg==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.5.0.tgz", + "integrity": "sha512-Q6Yt+1LvXvEstvru6sQLT7OQYC77VNl6dK0KEvBkeOHgThmXDqNp3Ox9TglDWFHU85pemqTNdKwxfnmO3vgrdA==", "dev": true, "license": "MIT", "dependencies": { - "@jest/console": "30.4.1", - "@jest/environment": "30.4.1", - "@jest/test-result": "30.4.1", - "@jest/transform": "30.4.1", - "@jest/types": "30.4.1", + "@jest/console": "30.5.0", + "@jest/environment": "30.5.0", + "@jest/source-map": "30.5.0", + "@jest/test-result": "30.5.0", + "@jest/transform": "30.5.0", + "@jest/types": "30.5.0", "@types/node": "*", "chalk": "^4.1.2", "emittery": "^0.13.1", "exit-x": "^0.2.2", "graceful-fs": "^4.2.11", - "jest-docblock": "30.4.0", - "jest-environment-node": "30.4.1", - "jest-haste-map": "30.4.1", - "jest-leak-detector": "30.4.1", - "jest-message-util": "30.4.1", - "jest-resolve": "30.4.1", - "jest-runtime": "30.4.2", - "jest-util": "30.4.1", - "jest-watcher": "30.4.1", - "jest-worker": "30.4.1", - "p-limit": "^3.1.0", - "source-map-support": "0.5.13" + "jest-docblock": "30.5.0", + "jest-environment-node": "30.5.0", + "jest-haste-map": "30.5.0", + "jest-leak-detector": "30.5.0", + "jest-message-util": "30.5.0", + "jest-resolve": "30.5.0", + "jest-runtime": "30.5.0", + "jest-util": "30.5.0", + "jest-watcher": "30.5.0", + "jest-worker": "30.5.0", + "p-limit": "^3.1.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" @@ -6987,32 +7341,33 @@ } }, "node_modules/jest-runtime": { - "version": "30.4.2", - "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.4.2.tgz", - "integrity": "sha512-3/5e8iPz2k/VLqlr8DgTftYyLUv8Su3FkCAO2/Od81UsUTpSxOrS6O5x5KkoQwyUjmpYyDJKeyAvg2T2nvpNkQ==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.5.0.tgz", + "integrity": "sha512-VTRz0sRIw2EISeHigx1O+CMuwoG4+RKJjF8dp8okzFaDNQEcv5Mw0h5QW8VJXgb2CRF4gZIjSEBb2jdzXPagFQ==", "dev": true, "license": "MIT", "dependencies": { - "@jest/environment": "30.4.1", - "@jest/fake-timers": "30.4.1", - "@jest/globals": "30.4.1", - "@jest/source-map": "30.0.1", - "@jest/test-result": "30.4.1", - "@jest/transform": "30.4.1", - "@jest/types": "30.4.1", + "@jest/environment": "30.5.0", + "@jest/fake-timers": "30.5.0", + "@jest/globals": "30.5.0", + "@jest/source-map": "30.5.0", + "@jest/test-result": "30.5.0", + "@jest/transform": "30.5.0", + "@jest/types": "30.5.0", "@types/node": "*", "chalk": "^4.1.2", - "cjs-module-lexer": "^2.1.0", + "cjs-module-lexer": "^2.2.0", "collect-v8-coverage": "^1.0.2", - "glob": "^10.5.0", + "es-module-lexer": "^2.1.0", + "glob": "^13.0.6", "graceful-fs": "^4.2.11", - "jest-haste-map": "30.4.1", - "jest-message-util": "30.4.1", - "jest-mock": "30.4.1", - "jest-regex-util": "30.4.0", - "jest-resolve": "30.4.1", - "jest-snapshot": "30.4.1", - "jest-util": "30.4.1", + "jest-haste-map": "30.5.0", + "jest-message-util": "30.5.0", + "jest-mock": "30.5.0", + "jest-regex-util": "30.5.0", + "jest-resolve": "30.5.0", + "jest-snapshot": "30.5.0", + "jest-util": "30.5.0", "slash": "^3.0.0", "strip-bom": "^4.0.0" }, @@ -7020,82 +7375,10 @@ "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" } }, - "node_modules/jest-runtime/node_modules/brace-expansion": { - "version": "2.1.4", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", - "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0" - } - }, - "node_modules/jest-runtime/node_modules/glob": { - "version": "10.5.0", - "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz", - "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==", - "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me", - "dev": true, - "license": "ISC", - "dependencies": { - "foreground-child": "^3.1.0", - "jackspeak": "^3.1.2", - "minimatch": "^9.0.4", - "minipass": "^7.1.2", - "package-json-from-dist": "^1.0.0", - "path-scurry": "^1.11.1" - }, - "bin": { - "glob": "dist/esm/bin.mjs" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/jest-runtime/node_modules/lru-cache": { - "version": "10.4.3", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz", - "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==", - "dev": true, - "license": "ISC" - }, - "node_modules/jest-runtime/node_modules/minimatch": { - "version": "9.0.9", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", - "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", - "dev": true, - "license": "ISC", - "dependencies": { - "brace-expansion": "^2.0.2" - }, - "engines": { - "node": ">=16 || 14 >=14.17" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, - "node_modules/jest-runtime/node_modules/path-scurry": { - "version": "1.11.1", - "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz", - "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==", - "dev": true, - "license": "BlueOak-1.0.0", - "dependencies": { - "lru-cache": "^10.2.0", - "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" - }, - "engines": { - "node": ">=16 || 14 >=14.18" - }, - "funding": { - "url": "https://github.com/sponsors/isaacs" - } - }, "node_modules/jest-snapshot": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.4.1.tgz", - "integrity": "sha512-tEOkkfOMppUyeiHwjZswOQ3lcnoTnws/q5FnGIaeIh/jmoU0ZlgMYRR8sTlTj+nNGCoJ0RDq6SfxGxCsyMTPmw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.5.0.tgz", + "integrity": "sha512-pZWETdcqmKve9MDTE/AX6RaeAbRhzKhhAXGozAW8Pg2FfOSdUrQ/7D+VdwE3fLQsqjpITXJVQvYVZoMEzrUl0Q==", "dev": true, "license": "MIT", "dependencies": { @@ -7104,20 +7387,20 @@ "@babel/plugin-syntax-jsx": "^7.27.1", "@babel/plugin-syntax-typescript": "^7.27.1", "@babel/types": "^7.27.3", - "@jest/expect-utils": "30.4.1", - "@jest/get-type": "30.1.0", - "@jest/snapshot-utils": "30.4.1", - "@jest/transform": "30.4.1", - "@jest/types": "30.4.1", + "@jest/expect-utils": "30.5.0", + "@jest/get-type": "30.5.0", + "@jest/snapshot-utils": "30.5.0", + "@jest/transform": "30.5.0", + "@jest/types": "30.5.0", "babel-preset-current-node-syntax": "^1.2.0", "chalk": "^4.1.2", - "expect": "30.4.1", + "expect": "30.5.0", "graceful-fs": "^4.2.11", - "jest-diff": "30.4.1", - "jest-matcher-utils": "30.4.1", - "jest-message-util": "30.4.1", - "jest-util": "30.4.1", - "pretty-format": "30.4.1", + "jest-diff": "30.5.0", + "jest-matcher-utils": "30.5.0", + "jest-message-util": "30.5.0", + "jest-util": "30.5.0", + "pretty-format": "30.5.0", "semver": "^7.7.2", "synckit": "^0.11.8" }, @@ -7126,13 +7409,13 @@ } }, "node_modules/jest-util": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.4.1.tgz", - "integrity": "sha512-vjQb1sACEiv13DKJMDToJpzVW0joCsIQrmbg0fi7CyOOt+g9jTuQl2A216pWRBYhOVt53XbL/2LbMKg1BECWOw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.5.0.tgz", + "integrity": "sha512-lzU4aGUWaS+2X/B0CmgheDasfnsVlRfZh/rNQxB9b9s8cSYUq5BcqdQA95ld+KqJXBUVVt1sqnMQ2T3OxIalmg==", "dev": true, "license": "MIT", "dependencies": { - "@jest/types": "30.4.1", + "@jest/types": "30.5.0", "@types/node": "*", "chalk": "^4.1.2", "ci-info": "^4.2.0", @@ -7144,9 +7427,9 @@ } }, "node_modules/jest-util/node_modules/picomatch": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", - "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==", + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", "dev": true, "license": "MIT", "engines": { @@ -7157,18 +7440,18 @@ } }, "node_modules/jest-validate": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.4.1.tgz", - "integrity": "sha512-PDWi4SOwLnwqNDfHZjOcsEFyZ4fc/2W2gVL3DEoyqnB6jCQMLRtfBong8s6omIw3lI0HWOus12xfnFmQtjW3fw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.5.0.tgz", + "integrity": "sha512-N/hsPYKgBSzBeVZ2RHCs3yvBbTZNPX7Be8q33zhyo/yeFneBL1swzly31LYU4LJ3zJM9e8TxSM8IYLo2SDJZYQ==", "dev": true, "license": "MIT", "dependencies": { - "@jest/get-type": "30.1.0", - "@jest/types": "30.4.1", + "@jest/get-type": "30.5.0", + "@jest/types": "30.5.0", "camelcase": "^6.3.0", "chalk": "^4.1.2", "leven": "^3.1.0", - "pretty-format": "30.4.1" + "pretty-format": "30.5.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" @@ -7188,19 +7471,19 @@ } }, "node_modules/jest-watcher": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.4.1.tgz", - "integrity": "sha512-/l9UonmvCwjHH7d2h3iAwIloLc1H0S8mJZ/LNK3i86hqwPAz8otUJjP9MfYtz9Tt77Su5FD2xGjZn8d31IZHlw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.5.0.tgz", + "integrity": "sha512-ujjnEoL4Uu+Swu3WRwYenWMB9JMEiD2T3OypnveMJ64S/1r/5G8eC4OQ1wEOgYWQqMi+mT+buzccflCHr/XJ9Q==", "dev": true, "license": "MIT", "dependencies": { - "@jest/test-result": "30.4.1", - "@jest/types": "30.4.1", + "@jest/test-result": "30.5.0", + "@jest/types": "30.5.0", "@types/node": "*", "ansi-escapes": "^4.3.2", "chalk": "^4.1.2", "emittery": "^0.13.1", - "jest-util": "30.4.1", + "jest-util": "30.5.0", "string-length": "^4.0.2" }, "engines": { @@ -7208,15 +7491,15 @@ } }, "node_modules/jest-worker": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.4.1.tgz", - "integrity": "sha512-SHynN/q/QD++iNyvMdy+WMmbCGk8jIsNcRxycXbWubSOhvo6T+j2afcfUSl+3hYsiBebOTo0cT7c2H7CXugu1g==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.5.0.tgz", + "integrity": "sha512-7kFk/607EoynNHLJa20daivkElM+c9PrCLduYy6AlMkYrXbh5TmVtW1BLXE05Y8baAFsJHMoC3xs2QRRTotwLw==", "dev": true, "license": "MIT", "dependencies": { "@types/node": "*", "@ungap/structured-clone": "^1.3.0", - "jest-util": "30.4.1", + "jest-util": "30.5.0", "merge-stream": "^2.0.0", "supports-color": "^8.1.1" }, @@ -7251,9 +7534,9 @@ } }, "node_modules/joi": { - "version": "18.2.3", - "resolved": "https://registry.npmjs.org/joi/-/joi-18.2.3.tgz", - "integrity": "sha512-N5A3KTWQpPWT4ExxxPlUx7WmykGXRzhNidWhV41d6Abu9YfI2NyWCJuxdPnslJCPWtbRpSVOWSnSS6GakLM/Rg==", + "version": "18.2.5", + "resolved": "https://registry.npmjs.org/joi/-/joi-18.2.5.tgz", + "integrity": "sha512-+gEA7rLfaNWx9JzawWPrPetSZwT16NUqHtECDgjyAJreXcs4TM7tx2Pa+VVJJK0YHM83ybrVdaT6UekHH50FJQ==", "license": "BSD-3-Clause", "dependencies": { "@hapi/address": "^5.1.1", @@ -7268,12 +7551,6 @@ "node": ">= 20" } }, - "node_modules/js-md5": { - "version": "0.8.3", - "resolved": "https://registry.npmjs.org/js-md5/-/js-md5-0.8.3.tgz", - "integrity": "sha512-qR0HB5uP6wCuRMrWPTrkMaev7MJZwJuuw4fnwAzRgP4J4/F8RwtodOKpGp4XpqsLBFzzgqIO42efFAyz2Et6KQ==", - "license": "MIT" - }, "node_modules/js-stringify": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/js-stringify/-/js-stringify-1.0.2.tgz", @@ -7366,7 +7643,6 @@ "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz", "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==", "license": "MIT", - "optional": true, "dependencies": { "universalify": "^2.0.0" }, @@ -7609,7 +7885,8 @@ "node_modules/listenercount": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/listenercount/-/listenercount-1.0.1.tgz", - "integrity": "sha512-3mk/Zag0+IJxeDrxSgaDPy4zZ3w05PRZeJNnlWhzFz5OkX49J4krc+A8X2d2M69vGMBEX0uyl8M+W+8gH+kBqQ==" + "integrity": "sha512-3mk/Zag0+IJxeDrxSgaDPy4zZ3w05PRZeJNnlWhzFz5OkX49J4krc+A8X2d2M69vGMBEX0uyl8M+W+8gH+kBqQ==", + "license": "ISC" }, "node_modules/locate-path": { "version": "5.0.0", @@ -7746,16 +8023,6 @@ "url": "https://github.com/sponsors/sindresorhus" } }, - "node_modules/makeerror": { - "version": "1.0.12", - "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz", - "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==", - "dev": true, - "license": "BSD-3-Clause", - "dependencies": { - "tmpl": "1.0.5" - } - }, "node_modules/math-intrinsics": { "version": "1.1.0", "resolved": "https://registry.npmmirror.com/math-intrinsics/-/math-intrinsics-1.1.0.tgz", @@ -7889,8 +8156,9 @@ }, "node_modules/mkdirp": { "version": "0.5.6", - "resolved": "https://registry.npmmirror.com/mkdirp/-/mkdirp-0.5.6.tgz", + "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz", "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==", + "license": "MIT", "dependencies": { "minimist": "^1.2.6" }, @@ -7919,9 +8187,9 @@ } }, "node_modules/mongodb": { - "version": "7.5.0", - "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-7.5.0.tgz", - "integrity": "sha512-5FnrEDLnvp6ycUOGLNLLU33BfCx2qmp2mJjGPDwKLruYsVzXVSK5fsGpoDXvsXJwBfBsD7ebMRdawbDxC2814g==", + "version": "7.6.0", + "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-7.6.0.tgz", + "integrity": "sha512-WbZ6OCjYw2c53LOjfkQa+reXr7kIiOVpXXglnASFuiMtif0BvsMwHe3ClJHLm1/r7wJFwaasfFtD6iYIktB01g==", "license": "Apache-2.0", "dependencies": { "@mongodb-js/saslprep": "^1.4.11", @@ -7977,10 +8245,88 @@ "node": ">=20.19.0" } }, + "node_modules/mongodb-memory-server": { + "version": "11.2.0", + "resolved": "https://registry.npmjs.org/mongodb-memory-server/-/mongodb-memory-server-11.2.0.tgz", + "integrity": "sha512-506AD8qvClVx8Raw/WhAUUWBgIXPyi856iC01aa5vAzHmn6WOXC6ulvudkTF7oTMzJxkyA0A84VpD4BpyfqJ9w==", + "dev": true, + "hasInstallScript": true, + "license": "MIT", + "dependencies": { + "mongodb-memory-server-core": "11.2.0", + "tslib": "^2.8.1" + }, + "engines": { + "node": ">=20.19.0" + } + }, + "node_modules/mongodb-memory-server-core": { + "version": "11.2.0", + "resolved": "https://registry.npmjs.org/mongodb-memory-server-core/-/mongodb-memory-server-core-11.2.0.tgz", + "integrity": "sha512-vOoDtn0JiLrHvZY81Rp/UtKXXK0rtJHZGZFVnccvJwYitPLNspO0Ty0grqFQOe7iAET8+GI4zAQcphg+R3vxQg==", + "dev": true, + "license": "MIT", + "dependencies": { + "async-mutex": "^0.5.0", + "camelcase": "^6.3.0", + "debug": "^4.4.3", + "find-cache-dir": "^3.3.2", + "follow-redirects": "^1.16.0", + "https-proxy-agent": "^7.0.6", + "mongodb": "^7.2.0", + "new-find-package-json": "^2.0.0", + "semver": "^7.7.3", + "tar-stream": "^3.1.8", + "tslib": "^2.8.1", + "yauzl": "^3.3.1" + }, + "engines": { + "node": ">=20.19.0" + } + }, + "node_modules/mongodb-memory-server-core/node_modules/camelcase": { + "version": "6.3.0", + "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz", + "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=10" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/mongodb-memory-server-core/node_modules/tar-stream": { + "version": "3.2.1", + "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.2.1.tgz", + "integrity": "sha512-nqsEO8zLZJvrOMdEwkA0QdCLFbetHMn95Zqu4fKwX+hkaTWJPZZOrxx/PwtxoK0MMGQmBQNRW3CPs8IFYQz4cQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "b4a": "^1.6.4", + "bare-fs": "^4.5.5", + "fast-fifo": "^1.2.0", + "streamx": "^2.15.0" + } + }, + "node_modules/mongodb-memory-server-core/node_modules/yauzl": { + "version": "3.4.0", + "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-3.4.0.tgz", + "integrity": "sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==", + "dev": true, + "license": "MIT", + "dependencies": { + "pend": "~1.2.0" + }, + "engines": { + "node": ">=12" + } + }, "node_modules/mongoose": { - "version": "9.9.1", - "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-9.9.1.tgz", - "integrity": "sha512-hI00baDVPjV5VfYA3j+oLuPvLfmCQICWot9zJZgkuDMXnWEYhIx9xCPEOt2IC3lDJz6ajsz2bpgO24E+xsP6wg==", + "version": "9.9.4", + "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-9.9.4.tgz", + "integrity": "sha512-Gc7buf0ExrOZ3t8MD8tVzTek7Qr5d+tEwj4GRFmHCtTZvpaDb38EVsXgCkYacPL9ICAftgS+FGe+dQHLRLHhcw==", "license": "MIT", "dependencies": { "@standard-schema/spec": "^1.1.0", @@ -8033,10 +8379,56 @@ "node": ">=4.0.0" } }, + "node_modules/mongoose/node_modules/mongodb": { + "version": "7.5.0", + "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-7.5.0.tgz", + "integrity": "sha512-5FnrEDLnvp6ycUOGLNLLU33BfCx2qmp2mJjGPDwKLruYsVzXVSK5fsGpoDXvsXJwBfBsD7ebMRdawbDxC2814g==", + "license": "Apache-2.0", + "dependencies": { + "@mongodb-js/saslprep": "^1.4.11", + "bson": "^7.2.0", + "mongodb-connection-string-url": "^7.0.1" + }, + "engines": { + "node": ">=20.19.0" + }, + "peerDependencies": { + "@aws-sdk/credential-providers": "^3.806.0", + "@mongodb-js/zstd": "^7.0.0", + "gcp-metadata": "^7.0.1", + "kerberos": "^7.0.0", + "mongodb-client-encryption": "^7.2.0", + "snappy": "^7.3.2", + "socks": "^2.8.6" + }, + "peerDependenciesMeta": { + "@aws-sdk/credential-providers": { + "optional": true + }, + "@mongodb-js/zstd": { + "optional": true + }, + "gcp-metadata": { + "optional": true + }, + "kerberos": { + "optional": true + }, + "mongodb-client-encryption": { + "optional": true + }, + "snappy": { + "optional": true + }, + "socks": { + "optional": true + } + } + }, "node_modules/morgan": { - "version": "1.11.0", - "resolved": "https://registry.npmjs.org/morgan/-/morgan-1.11.0.tgz", - "integrity": "sha512-zSkVu3t18r39pw4ixfBKvfZi3y2UOqr7d4WYwcj3m8nXpEQK4rPO6GLzs/CExoRgmX3y9EjmmcXqv6jq0SK46g==", + "version": "1.12.0", + "resolved": "https://registry.npmjs.org/morgan/-/morgan-1.12.0.tgz", + "integrity": "sha512-OHpTRQwn2ezasILW8iKe+Yww1XsfWsZIpUOLF7RDb2g5GwO3trPaRwi7+8BDiJ7HFx2Kg2mfUdCBcVhwYlOz2g==", "license": "MIT", "dependencies": { "basic-auth": "~2.0.1", @@ -8089,9 +8481,9 @@ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==" }, "node_modules/multer": { - "version": "2.2.0", - "resolved": "https://registry.npmjs.org/multer/-/multer-2.2.0.tgz", - "integrity": "sha512-6rdyFg2kLrMh9Jee7/BMPuV9lEAd7lLW2YUpF9/YxR7njyoUwwQ0ZPh3TaIY50Sw6vlyD2HW3wGOkTS4P79xrQ==", + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/multer/-/multer-2.3.0.tgz", + "integrity": "sha512-cjNbm3sttszgZeGfJR124D+jFEfkXCVAsoPBmFn9X7UxmDSFHWqE2CoEj0vrmSpuAFnqWR1Szcm9QTsiHr60Xw==", "license": "MIT", "dependencies": { "append-field": "^1.0.0", @@ -8186,6 +8578,26 @@ "node": ">= 0.4.0" } }, + "node_modules/new-find-package-json": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/new-find-package-json/-/new-find-package-json-2.0.0.tgz", + "integrity": "sha512-lDcBsjBSMlj3LXH2v/FW3txlh2pYTjmbOXPYJD93HI5EwuLzI11tdHSIpUMmfq/IOsldj4Ps8M8flhm+pCK4Ew==", + "dev": true, + "license": "MIT", + "dependencies": { + "debug": "^4.3.4" + }, + "engines": { + "node": ">=12.22.0" + } + }, + "node_modules/node-addon-api": { + "version": "7.1.1", + "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz", + "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==", + "dev": true, + "license": "MIT" + }, "node_modules/node-fetch": { "version": "2.7.0", "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz", @@ -8232,13 +8644,12 @@ "version": "0.4.0", "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz", "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==", - "devOptional": true, "license": "MIT" }, "node_modules/node-releases": { - "version": "2.0.46", - "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.46.tgz", - "integrity": "sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ==", + "version": "2.0.54", + "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz", + "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==", "dev": true, "license": "MIT", "engines": { @@ -8252,9 +8663,9 @@ "license": "LGPL-3.0-or-later" }, "node_modules/nodemailer": { - "version": "9.0.5", - "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.5.tgz", - "integrity": "sha512-wvjiKvjczmsN7U/8006JOdXubgBk2XFAbioDMbT+sM7cPs0QrhJTa6KBRX7P5REGGkDcLUz/EarWidb8G8C1jQ==", + "version": "9.0.6", + "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.6.tgz", + "integrity": "sha512-IQUGFdhdGwI9+AWX+FpUt4DLmvFaOjTMEoneTIWX/RXxuy1TdenPwWrvFMSfLkPKl+HQEXWuSAxEMMbPYXtBmg==", "license": "MIT-0", "engines": { "node": ">=6.0.0" @@ -8622,17 +9033,17 @@ } }, "node_modules/pdfkit": { - "version": "0.19.1", - "resolved": "https://registry.npmjs.org/pdfkit/-/pdfkit-0.19.1.tgz", - "integrity": "sha512-6Gzk+wDwTs4VSxsR5rCMTnIl5nlmkye1oWB0l2hDB1EX6ZNSIBroKQEv+2+fPPn+stVjyqzmsqRJVDfB9fo5DA==", + "version": "0.20.1", + "resolved": "https://registry.npmjs.org/pdfkit/-/pdfkit-0.20.1.tgz", + "integrity": "sha512-1rRXK6x5o8I/3dBrBzXfxibpHpkfCnIA7EBAES7pEpGFc/65inMLlA8SalGWpJfal7BGekxeLf6A30IOpQpc5Q==", "license": "MIT", "dependencies": { - "@noble/ciphers": "^1.0.0", - "@noble/hashes": "^1.6.0", + "@noble/ciphers": "^1.3.0", + "@noble/hashes": "^1.8.0", + "fflate": "^0.8.3", "fontkit": "^2.0.4", - "js-md5": "^0.8.3", "linebreak": "^1.1.0", - "png-js": "^1.1.0" + "png-js": "^2.0.0" } }, "node_modules/peberminta": { @@ -8693,11 +9104,11 @@ } }, "node_modules/png-js": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/png-js/-/png-js-1.1.0.tgz", - "integrity": "sha512-PM/uYGzGdNSzqeOgly68+6wKQDL1SY0a/N+OEa/+br6LnHWOAJB0Npiamnodfq3jd2LS/i2fMeOKSAILjA+m5Q==", + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/png-js/-/png-js-2.0.0.tgz", + "integrity": "sha512-GdzJuUMc6ZSpxFJWVxtOH1bzYHym+TOnveqUjb+VJIbZWbZzyiRGFiKhbiielfpYbgMlhHVhsJ0FTazfuRFkMA==", "dependencies": { - "browserify-zlib": "^0.2.0" + "fflate": "^0.8.2" } }, "node_modules/pngjs": { @@ -8736,16 +9147,16 @@ } }, "node_modules/pretty-format": { - "version": "30.4.1", - "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz", - "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==", + "version": "30.5.0", + "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.5.0.tgz", + "integrity": "sha512-mzNzBErpHwM0zpmWS7ExOv62yhQhvd546nUuFqVR0dmnJB59tfrw9sjDF0DJknwsr59OXP0buwJ7PaKguczHSg==", "dev": true, "license": "MIT", "dependencies": { - "@jest/schemas": "30.4.1", - "ansi-styles": "^5.2.0", - "react-is-18": "npm:react-is@^18.3.1", - "react-is-19": "npm:react-is@^19.2.5" + "@jest/react-is-18": "npm:react-is@^18.3.1", + "@jest/react-is-19": "npm:react-is@^19.2.5", + "@jest/schemas": "30.5.0", + "ansi-styles": "^5.2.0" }, "engines": { "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0" @@ -9056,9 +9467,9 @@ } }, "node_modules/qs": { - "version": "6.15.3", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", - "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", + "version": "6.16.0", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", @@ -9120,22 +9531,6 @@ "axios": "^1.18.1" } }, - "node_modules/react-is-18": { - "name": "react-is", - "version": "18.3.1", - "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz", - "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==", - "dev": true, - "license": "MIT" - }, - "node_modules/react-is-19": { - "name": "react-is", - "version": "19.2.6", - "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.6.tgz", - "integrity": "sha512-XjBR15BhXuylgWGuslhDKqlSayuqvqBX91BP8pauG8kd1zY8kotkNWbXksTCNRarse4kuGbe2kIY05ARtwNIvw==", - "dev": true, - "license": "MIT" - }, "node_modules/readable-stream": { "version": "3.6.2", "resolved": "https://registry.npmmirror.com/readable-stream/-/readable-stream-3.6.2.tgz", @@ -9266,6 +9661,7 @@ "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.7.1.tgz", "integrity": "sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==", "deprecated": "Rimraf versions prior to v4 are no longer supported", + "license": "ISC", "dependencies": { "glob": "^7.1.3" }, @@ -9601,23 +9997,12 @@ "version": "0.6.1", "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz", "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==", - "devOptional": true, "license": "BSD-3-Clause", + "optional": true, "engines": { "node": ">=0.10.0" } }, - "node_modules/source-map-support": { - "version": "0.5.13", - "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.13.tgz", - "integrity": "sha512-SHSKFHadjVA5oR4PPqhtAVdcBWwRYVd6g6cAXnIbRiIwc2EhPrTuKUBdSLvlEKyIP3GCf89fltvcZiP9MMFA1w==", - "dev": true, - "license": "MIT", - "dependencies": { - "buffer-from": "^1.0.0", - "source-map": "^0.6.0" - } - }, "node_modules/sparse-bitfield": { "version": "3.0.3", "resolved": "https://registry.npmjs.org/sparse-bitfield/-/sparse-bitfield-3.0.3.tgz", @@ -9962,37 +10347,133 @@ } }, "node_modules/test-exclude": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz", - "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==", + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-7.0.2.tgz", + "integrity": "sha512-u9E6A+ZDYdp7a4WnarkXPZOx8Ilz46+kby6p1yZ8zsGTz9gYa6FIS7lj2oezzNKmtdyyJNNmmXDppga5GB7kSw==", "dev": true, "license": "ISC", "dependencies": { "@istanbuljs/schema": "^0.1.2", - "glob": "^7.1.4", - "minimatch": "^3.0.4" + "glob": "^10.4.1", + "minimatch": "^10.2.2" }, "engines": { - "node": ">=8" + "node": ">=18" + } + }, + "node_modules/test-exclude/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, + "node_modules/test-exclude/node_modules/brace-expansion": { + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" } }, "node_modules/test-exclude/node_modules/glob": { - "version": "7.2.3", - "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz", - "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz", + "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==", "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me", "dev": true, "license": "ISC", "dependencies": { - "fs.realpath": "^1.0.0", - "inflight": "^1.0.4", - "inherits": "2", - "minimatch": "^3.1.1", - "once": "^1.3.0", - "path-is-absolute": "^1.0.0" + "foreground-child": "^3.1.0", + "jackspeak": "^3.1.2", + "minimatch": "^9.0.4", + "minipass": "^7.1.2", + "package-json-from-dist": "^1.0.0", + "path-scurry": "^1.11.1" + }, + "bin": { + "glob": "dist/esm/bin.mjs" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/test-exclude/node_modules/glob/node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "dev": true, + "license": "MIT" + }, + "node_modules/test-exclude/node_modules/glob/node_modules/brace-expansion": { + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0" + } + }, + "node_modules/test-exclude/node_modules/glob/node_modules/minimatch": { + "version": "9.0.9", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", + "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", + "dev": true, + "license": "ISC", + "dependencies": { + "brace-expansion": "^2.0.2" }, "engines": { - "node": "*" + "node": ">=16 || 14 >=14.17" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/test-exclude/node_modules/lru-cache": { + "version": "10.4.3", + "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz", + "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==", + "dev": true, + "license": "ISC" + }, + "node_modules/test-exclude/node_modules/minimatch": { + "version": "10.2.6", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", + "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "brace-expansion": "^5.0.8" + }, + "engines": { + "node": "18 || 20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/test-exclude/node_modules/path-scurry": { + "version": "1.11.1", + "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz", + "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "lru-cache": "^10.2.0", + "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0" + }, + "engines": { + "node": ">=16 || 14 >=14.18" }, "funding": { "url": "https://github.com/sponsors/isaacs" @@ -10021,13 +10502,6 @@ "node": ">=14.14" } }, - "node_modules/tmpl": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz", - "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==", - "dev": true, - "license": "BSD-3-Clause" - }, "node_modules/to-regex-range": { "version": "5.0.1", "resolved": "https://registry.npmmirror.com/to-regex-range/-/to-regex-range-5.0.1.tgz", @@ -10078,6 +10552,7 @@ "version": "0.3.9", "resolved": "https://registry.npmjs.org/traverse/-/traverse-0.3.9.tgz", "integrity": "sha512-iawgk0hLP3SxGKDfnDJf8wTz4p2qImnyihM5Hh/sGvQ3K37dPi/w8sRhdNIxYA1TwFwc5mDhIJq+O0RsvXBKdQ==", + "license": "MIT/X11", "engines": { "node": "*" } @@ -10212,7 +10687,6 @@ "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz", "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==", "license": "MIT", - "optional": true, "engines": { "node": ">= 10.0.0" } @@ -10265,53 +10739,36 @@ } }, "node_modules/unzipper": { - "version": "0.10.14", - "resolved": "https://registry.npmjs.org/unzipper/-/unzipper-0.10.14.tgz", - "integrity": "sha512-ti4wZj+0bQTiX2KmKWuwj7lhV+2n//uXEotUmGuQqrbVZSEGFMbI68+c6JCQ8aAmUWYvtHEz2A8K6wXvueR/6g==", + "version": "0.12.5", + "resolved": "https://registry.npmjs.org/unzipper/-/unzipper-0.12.5.tgz", + "integrity": "sha512-tXYOi9R57Uj/2Z25SOs5RRSzq886MBQj2gY8dPL+xl/kv6s6SvByoKfAtvfVeEuhntWDgjd2o9p2lb4TVPAz0A==", + "license": "MIT", "dependencies": { - "big-integer": "^1.6.17", - "binary": "~0.3.0", - "bluebird": "~3.4.1", - "buffer-indexof-polyfill": "~1.0.0", + "bluebird": "~3.7.2", "duplexer2": "~0.1.4", - "fstream": "^1.0.12", + "fs-extra": "11.3.1", "graceful-fs": "^4.2.2", - "listenercount": "~1.0.1", - "readable-stream": "~2.3.6", - "setimmediate": "~1.0.4" - } - }, - "node_modules/unzipper/node_modules/readable-stream": { - "version": "2.3.8", - "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz", - "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==", - "dependencies": { - "core-util-is": "~1.0.0", - "inherits": "~2.0.3", - "isarray": "~1.0.0", - "process-nextick-args": "~2.0.0", - "safe-buffer": "~5.1.1", - "string_decoder": "~1.1.1", - "util-deprecate": "~1.0.1" + "node-int64": "^0.4.0" } }, - "node_modules/unzipper/node_modules/safe-buffer": { - "version": "5.1.2", - "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz", - "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==" - }, - "node_modules/unzipper/node_modules/string_decoder": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz", - "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==", + "node_modules/unzipper/node_modules/fs-extra": { + "version": "11.3.1", + "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.1.tgz", + "integrity": "sha512-eXvGGwZ5CL17ZSwHWd3bbgk7UUpF6IFHtP57NYYakPvHOs8GDgDe5KJI36jIJzDkJ6eJjuzRA8eBQb6SkKue0g==", + "license": "MIT", "dependencies": { - "safe-buffer": "~5.1.0" + "graceful-fs": "^4.2.0", + "jsonfile": "^6.0.1", + "universalify": "^2.0.0" + }, + "engines": { + "node": ">=14.14" } }, "node_modules/update-browserslist-db": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz", - "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==", + "version": "1.3.2", + "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz", + "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==", "dev": true, "funding": [ { @@ -10355,9 +10812,9 @@ "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==" }, "node_modules/uuid": { - "version": "14.0.1", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz", - "integrity": "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==", + "version": "14.0.2", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz", + "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==", "funding": [ "https://github.com/sponsors/broofa", "https://github.com/sponsors/ctavan" @@ -10408,16 +10865,6 @@ "node": ">=0.10.0" } }, - "node_modules/walker": { - "version": "1.0.8", - "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz", - "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==", - "dev": true, - "license": "Apache-2.0", - "dependencies": { - "makeerror": "1.0.12" - } - }, "node_modules/web-push": { "version": "3.6.7", "resolved": "https://registry.npmjs.org/web-push/-/web-push-3.6.7.tgz", @@ -10511,13 +10958,6 @@ "node": ">= 14" } }, - "node_modules/whatsapp-web.js/node_modules/bluebird": { - "version": "3.7.2", - "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz", - "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==", - "license": "MIT", - "optional": true - }, "node_modules/whatsapp-web.js/node_modules/brace-expansion": { "version": "2.1.4", "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", diff --git a/api/package.json b/api/package.json index 71690e914..9b6e7668d 100644 --- a/api/package.json +++ b/api/package.json @@ -1,6 +1,6 @@ { "name": "Api_v2_express", - "version": "2.0.0", + "version": "1.6.1", "description": "Posnic API v2 - Express.js Backend (1:1 PHP Replica)", "main": "server.js", "scripts": { @@ -25,7 +25,8 @@ "test:api": "node scripts/test-local.js tests/api --forceExit --runInBand", "audit:money": "node scripts/audit-money.js", "test:all": "jest --detectOpenHandles --forceExit", - "test:coverage:all": "jest --coverage --detectOpenHandles --forceExit" + "test:coverage:all": "jest --coverage --detectOpenHandles --forceExit", + "local": "node scripts/local-dev.js" }, "keywords": [ "posnic", @@ -38,11 +39,11 @@ "author": "Posnic Team", "license": "AGPL-3.0-only", "dependencies": { - "@aws-sdk/client-s3": "^3.1106.0", - "@getbrevo/brevo": "^6.0.2", - "axios": "^1.19.0", + "@aws-sdk/client-s3": "^3.1121.0", + "@getbrevo/brevo": "^6.0.3", + "axios": "^1.20.0", "bcryptjs": "^3.0.3", - "bson": "^7.3.1", + "bson": "^7.3.2", "compression": "^1.8.1", "connect-mongo": "^6.0.0", "cookie-parser": "^1.4.7", @@ -56,25 +57,26 @@ "express-validator": "^7.3.2", "helmet": "^8.3.0", "hpp": "^0.2.3", - "html-to-text": "^10.0.0", + "html-to-text": "^10.0.1", "http-status": "^2.1.0", - "joi": "^18.2.3", + "joi": "^18.2.5", "jsonwebtoken": "^9.0.3", "lodash": "^4.18.1", "moment": "^2.30.1", "moment-timezone": "^0.6.3", - "mongodb": "^7.5.0", - "mongoose": "^9.9.1", + "mongodb": "^7.6.0", + "mongoose": "^9.9.4", "mongoose-paginate-v2": "^1.9.5", - "morgan": "^1.11.0", - "multer": "^2.2.0", - "nodemailer": "^9.0.5", - "pdfkit": "^0.19.1", + "morgan": "^1.12.0", + "multer": "^2.3.0", + "nodemailer": "^9.0.6", + "pdfkit": "^0.20.1", "pug": "^3.0.4", "qrcode": "^1.5.4", "razorpay": "^2.9.8", "sib-api-v3-sdk": "^8.5.0", - "uuid": "^14.0.1", + "unzipper": "^0.12.5", + "uuid": "^14.0.2", "validator": "^13.15.35", "web-push": "^3.6.7", "whatsapp-web.js": "^1.34.7", @@ -82,13 +84,14 @@ }, "devDependencies": { "@eslint/js": "^10.0.1", - "@redocly/cli": "^2.46.0", - "@types/node": "^26.2.0", - "eslint": "^10.8.1", + "@redocly/cli": "^2.49.0", + "@types/node": "^26.4.0", + "eslint": "^10.9.1", "eslint-config-prettier": "^10.1.8", "glob": "^13.0.6", - "globals": "^17.9.0", - "jest": "^30.4.2", + "globals": "^17.11.0", + "jest": "^30.5.0", + "mongodb-memory-server": "^11.2.0", "nodemon": "^3.1.14", "prettier": "^3.9.6", "swagger-ui-express": "^5.0.1" @@ -108,6 +111,7 @@ "exceljs": { "uuid": "^11.1.1" }, - "deepmerge-ts": "^8.0.0" + "deepmerge-ts": "^8.0.0", + "qs": "^6.16.0" } } diff --git a/api/scripts/audit-module-keys.js b/api/scripts/audit-module-keys.js old mode 100644 new mode 100755 diff --git a/api/scripts/audit-money.js b/api/scripts/audit-money.js old mode 100644 new mode 100755 diff --git a/api/scripts/check-ci-database.js b/api/scripts/check-ci-database.js old mode 100644 new mode 100755 diff --git a/api/scripts/known-failures.js b/api/scripts/known-failures.js old mode 100644 new mode 100755 diff --git a/api/scripts/local-dev.js b/api/scripts/local-dev.js new file mode 100755 index 000000000..fde9bb63a --- /dev/null +++ b/api/scripts/local-dev.js @@ -0,0 +1,166 @@ +#!/usr/bin/env node +'use strict'; + +/* + * A whole Posnic on this machine, with nothing shared with production. + * + * Owner, before the vendor-stack upgrade: "create one local mongodb and + * install all local... i dont want existing customer affected." + * + * Starts an embedded MongoDB (downloaded once into the mongodb-memory-server + * cache) with its files under api/.local-db so the data SURVIVES restarts - + * an in-memory database would make every test session start from nothing. + * Then boots the API against it on a local port. The frontend is served by + * the same API process out of frontend/public, so one URL is the whole app. + * + * Nothing here reads production credentials: the URI is localhost, the JWT + * secret is a throwaway, and the tenant is whatever you seed. + */ +const path = require('path'); +const fs = require('fs'); + +const DB_DIR = path.join(__dirname, '..', '.local-db'); +const PORT = process.env.LOCAL_PORT || 5055; +const DB_PORT = process.env.LOCAL_DB_PORT || 27055; + +async function main() { + fs.mkdirSync(DB_DIR, { recursive: true }); + + /* + * A previous run that was killed (rather than shut down) leaves + * mongod.lock behind and the next start dies on DBPathInUse. Clear a + * stale lock when no mongod is actually holding the port. + */ + const lock = path.join(DB_DIR, 'mongod.lock'); + if (fs.existsSync(lock)) { + try { + fs.unlinkSync(lock); + console.log('[local] cleared a stale database lock from a previous run'); + } catch (e) { + console.error('[local] a previous MongoDB is still running and holding ' + DB_DIR); + console.error('[local] stop it first: powershell "Get-Process *mongo* | Stop-Process -Force"'); + process.exit(1); + } + } + + const { MongoMemoryServer } = require('mongodb-memory-server'); + console.log('[local] starting embedded MongoDB (first run downloads it)…'); + const mongo = await MongoMemoryServer.create({ + instance: { port: Number(DB_PORT), dbName: 'PosnicPro', dbPath: DB_DIR, storageEngine: 'wiredTiger' }, + }); + const uri = mongo.getUri('PosnicPro'); + console.log('[local] mongodb ready on port ' + DB_PORT + ' (data kept in api/.local-db)'); + + /* + * Secrets: generated once for THIS machine and kept beside the local + * database. The API refuses to boot without them by design (a shipped + * default would be shared by every installation), and these never leave + * the box - .local-db is gitignored. + */ + const crypto = require('crypto'); + const secretsFile = path.join(DB_DIR, 'local-secrets.json'); + let secrets; + if (fs.existsSync(secretsFile)) { + secrets = JSON.parse(fs.readFileSync(secretsFile, 'utf8')); + } else { + const rand = () => crypto.randomBytes(32).toString('hex'); + secrets = { + SESSION_SECRET: rand(), + ENCRYPTION_KEY: rand(), + ENCRYPTION_IV: rand(), + JWT_SECRET: rand(), + KIOSK_API_KEY: rand(), + POSNIC_KEY: rand(), + POSNIC_SECRET: rand(), + }; + fs.writeFileSync(secretsFile, JSON.stringify(secrets, null, 2)); + console.log('[local] generated local-only secrets (api/.local-db/local-secrets.json)'); + } + for (const [k, v] of Object.entries(secrets)) { + if (!process.env[k]) process.env[k] = v; + } + + process.env.NODE_ENV = process.env.NODE_ENV || 'development'; + process.env.MONGODB_URI = uri; + process.env.PORT = String(PORT); + process.env.JWT_EXPIRE = process.env.JWT_EXPIRE || '30d'; + + console.log('[local] booting the API…'); + require(path.join(__dirname, '..', 'server.js')); + + /* + * A shop to log into. Installed once through the real installation + * endpoint - the same path a genuine tenant takes - so the local copy + * exercises production code rather than a special test fixture. + */ + const LOGIN = { user: 'local@posnic.test', pass: 'Local@12345' }; + setTimeout(async () => { + try { + const base = 'http://localhost:' + PORT; + /* + * Install exactly ONCE per local database. Re-running install/add on + * an existing license does NOT upsert - it creates a NEW branch id + * every time, orphaning the previous branch's items and settings + * (that is how the local shop kept "losing" its catalogue between + * restarts). Until the endpoint is made idempotent server-side, a + * marker beside the data files is the guard. + */ + const installedMarker = path.join(DB_DIR, 'installed.marker'); + if (!fs.existsSync(installedMarker)) { + const res = await fetch(base + '/api/install/add', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ + key: process.env.POSNIC_KEY, + secret: process.env.POSNIC_SECRET, + register_companyname: 'Local Test Shop', + register_username: LOGIN.user, + register_useremail: LOGIN.user, + register_userphone: '9000000000', + register_userpassword: LOGIN.pass, + /* a real, stable ObjectId so restarts reuse the same shop */ + register_license: 'local'.split('').map(function (c) { return c.charCodeAt(0).toString(16); }).join('').padEnd(24, '0'), + register_firstname: 'Local', + register_lastname: 'Tester', + /* the installer builds a default customer from these */ + register_country: 'India', + register_countryid: '101', + register_state: 'Tamil Nadu', + register_stateid: '4035', + register_currency: 'INR', + register_timezone: 'Asia/Kolkata', + /* register_demo, not demo_data. The install service reads only + the former, so this script has been creating an EMPTY local shop + all along - 'demo_data' was silently ignored. */ + register_demo: 'yes', + businessType: 'supermarket', + }), + }).then((r) => r.json()).catch((e) => ({ error: e.message })); + console.log('[local] shop install: ' + (res && (res.message || res.type || res.error || 'done'))); + if (res && res.type !== 'error' && !res.error) { + fs.writeFileSync(installedMarker, new Date().toISOString()); + } + } + } catch (e) { + console.log('[local] shop install skipped: ' + e.message); + } + console.log('\n' + '='.repeat(66)); + console.log(' POSNIC (LOCAL) -> http://localhost:' + PORT + '/login.html'); + console.log(' login: ' + LOGIN.user + ' password: ' + LOGIN.pass); + console.log(' database: local only (api/.local-db) - production untouched'); + console.log('='.repeat(66) + '\n'); + }, 3000); + + const shutdown = async () => { + console.log('\n[local] stopping…'); + await mongo.stop().catch(() => {}); + process.exit(0); + }; + process.on('SIGINT', shutdown); + process.on('SIGTERM', shutdown); +} + +main().catch((err) => { + console.error('[local] failed to start:', err && err.message); + process.exit(1); +}); diff --git a/api/scripts/retro-link-variants.js b/api/scripts/retro-link-variants.js old mode 100644 new mode 100755 diff --git a/api/scripts/ring-reload.sh b/api/scripts/ring-reload.sh old mode 100644 new mode 100755 index a3cba652a..2dc4d796b --- a/api/scripts/ring-reload.sh +++ b/api/scripts/ring-reload.sh @@ -44,6 +44,15 @@ ADMIN_DIR="$HOME/apps/admin" API_DIR="$(pwd)" RINGS_FILE="$ADMIN_DIR/provisioning/rings.json" +# A planned reload is not an outage. The watchdog honors ~/maintenance and +# stays quiet while it exists - without this, every deploy mailed the owner +# an ALERT + recovered pair the moment its blip crossed a watchdog tick. +# The trap clears it on ANY exit: after a FAILED deploy the processes are +# genuinely down and the very next tick should alert as loudly as ever. +MAINTENANCE_FLAG="$HOME/maintenance" +touch "$MAINTENANCE_FLAG" +trap 'rm -f "$MAINTENANCE_FLAG"' EXIT + cd "$APP_DIR" online_names() { @@ -145,10 +154,19 @@ smoke() { # deploy, and a heavy shipping day drained the fixture to zero - every # deploy then failed its own gate for a reason unrelated to the code. # Top the fixture back up before proving the ring. Never a gate itself. + # The SAME tenant the smoke below uses, or the two halves top up one shop + # while selling from another. It comes from the sourced admin .env so the + # target can be changed without a public repo commit if the owner rotates + # the test shop. if [ -f "$API_DIR/scripts/smoke-restock.js" ]; then - node "$API_DIR/scripts/smoke-restock.js" || true + SMOKE_WRITE_TENANT="${SMOKE_WRITE_TENANT:-}" \ + node "$API_DIR/scripts/smoke-restock.js" || true fi - SMOKE_QUIET=true SMOKE_WRITE_TENANT="${SMOKE_WRITE_TENANT:-tech}" \ + # The billing write test deliberately has no code default: it creates and + # deletes a real sale, so the target must be an operator-owned test shop. + # If SMOKE_WRITE_TENANT is absent, smoke.js reports the write check as + # skipped instead of guessing a customer shop. + SMOKE_QUIET=true SMOKE_WRITE_TENANT="${SMOKE_WRITE_TENANT:-}" \ node provisioning/smoke.js --quiet ) } diff --git a/api/scripts/smoke-restock.js b/api/scripts/smoke-restock.js old mode 100644 new mode 100755 index d87c3606e..f42b30eaa --- a/api/scripts/smoke-restock.js +++ b/api/scripts/smoke-restock.js @@ -40,6 +40,49 @@ async function main() { const client = new MongoClient(uri); await client.connect(); try { + /* + * THE WRITE SHOP'S OWN FIXTURE, FIRST. + * + * The billing smoke sells whatever item db.items.find().limit(1) returns + * in SMOKE_WRITE_TENANT's database - not the legacy fixture below. When + * the write shop moved off the old sbala shop, this helper kept topping + * up an item nobody was selling any more while the item actually being + * drained crept toward zero, one unit per deploy, with the freeze + * arriving weeks later on a commit that had nothing to do with it. + * + * The tenant db is derived exactly the way the provisioner names them: + * posnic_t_. + */ + const writeTenant = String(process.env.SMOKE_WRITE_TENANT || '').trim(); + if (writeTenant) { + const dbName = 'posnic_t_' + writeTenant.replace(/-/g, ''); + const items = client.db(dbName).collection('items'); + const first = await items + .find({}) + .project({ name: 1, available_quantity: 1 }) + .limit(1) + .toArray() + .catch(() => []); + if (first.length) { + const qty = Number(first[0].available_quantity) || 0; + if (qty < RESTOCK_BELOW) { + await items.updateOne( + { _id: first[0]._id }, + { $set: { available_quantity: RESTOCK_TO } } + ); + console.log( + `[smoke-restock] "${first[0].name}" in ${dbName} topped up ${qty} -> ${RESTOCK_TO}` + ); + } else { + console.log( + `[smoke-restock] "${first[0].name}" in ${dbName} has ${qty} - no top-up needed` + ); + } + } + } + + /* The legacy fixture, kept for as long as the old shop exists: pointing + SMOKE_WRITE_TENANT back at it must not reopen the drain. */ const { databases } = await client.db().admin().listDatabases({ nameOnly: true }); for (const { name } of databases) { if (['admin', 'local', 'config'].includes(name)) continue; diff --git a/api/scripts/test-local.js b/api/scripts/test-local.js old mode 100644 new mode 100755 diff --git a/api/shard.js b/api/shard.js index a77ce0d55..1bb9a0549 100644 --- a/api/shard.js +++ b/api/shard.js @@ -103,11 +103,79 @@ let lastMiss = 0; let controlClient = null; +/* + * Which shops this shard is responsible for. + * + * Unset means every provisioned shop, which is what a single-machine estate + * wants and what shipped. SHARD_INSTANCE narrows it to the shops assigned to + * one machine - necessary the moment a second machine runs a shard, because + * otherwise both would try to open every shop in the fleet and each would fail + * on the databases that live on the other one. + */ +const SHARD_INSTANCE = String(process.env.SHARD_INSTANCE || '').trim(); + +/* + * A registry from a FILE instead of the control database. + * + * The demo estate needs this. Reading the control registry means holding the + * control credential and TENANT_SECRET_KEY, which unseals every shop's secrets + * across the whole fleet - and the demo box is a public machine whose logins + * are printed on its own login page. Putting the fleet master key there to + * serve shops that contain nothing would be a poor trade. + * + * The file carries its own plaintext secrets, which is the same posture the + * single-shop demo already has: its JWT_SECRET sits in a 0600 .env beside it. + * The difference from the control path is only WHERE the shop list comes from; + * every tenant still gets its own scope and its own keys, and currentSecret + * still refuses to fall through to the environment. + * + * Unset - which is every production shard - and nothing here runs. + */ +const REGISTRY_FILE = String(process.env.SHARD_REGISTRY_FILE || '').trim(); + +/* Lower-cased once: node lower-cases incoming header names, and comparing + against a mixed-case env value would simply never match. */ +const SHOP_HEADER = String(process.env.SHARD_SHOP_HEADER || '').trim().toLowerCase(); + +function loadRegistryFromFile() { + const raw = JSON.parse(require('fs').readFileSync(REGISTRY_FILE, 'utf8')); + const rows = Array.isArray(raw) ? raw : raw.shops || []; + const next = new Map(); + + for (const r of rows) { + if (!r || !r.host || !r.tenantDb) continue; + /* Same rule as the control path: a shop whose keys are missing is not + served, because serving it would sign tokens nothing can verify. */ + const secrets = r.secrets && typeof r.secrets === 'object' ? r.secrets : null; + if (!secrets || !secrets.JWT_SECRET) { + console.error(`[shard] ${r.host}: no JWT_SECRET in the registry file; not served`); + continue; + } + const connection = mongoose.connection.useDb(r.tenantDb, { useCache: true }); + next.set(String(r.host).toLowerCase(), { + subdomain: r.subdomain || r.host, + tenantDb: r.tenantDb, + suspended: !!r.suspended, + connection, + db: connection.db, + secrets, + }); + } + + byHost.clear(); + for (const [k, v] of next) byHost.set(k, v); + lastLoad = Date.now(); + console.log(`[shard] serving ${next.size} hostname(s) from ${REGISTRY_FILE}`); +} + async function loadRegistry() { + if (REGISTRY_FILE) return loadRegistryFromFile(); + const query = { provisioned: true, subdomain: { $exists: true, $nin: [null, ''] } }; + if (SHARD_INSTANCE) query.instance = SHARD_INSTANCE; const tenants = await controlClient .db(CONTROL_DB) .collection('tenants') - .find({ provisioned: true, subdomain: { $exists: true, $nin: [null, ''] } }) + .find(query) .project({ subdomain: 1, tenantDb: 1, secrets: 1, suspended: 1, webDomain: 1 }) .toArray(); @@ -153,7 +221,8 @@ async function loadRegistry() { byHost.clear(); for (const [k, v] of next) byHost.set(k, v); lastLoad = Date.now(); - console.log(`[shard] serving ${next.size} hostname(s) across ${tenants.length} shop(s)`); + console.log(`[shard] serving ${next.size} hostname(s) across ${tenants.length} shop(s)` + + (SHARD_INSTANCE ? ` on ${SHARD_INSTANCE}` : '')); } /** The shop a request belongs to, or null. */ @@ -183,7 +252,8 @@ async function resolve(hostHeader) { async function main() { if (!CONTROL_URI) throw new Error('CONTROL_URI or MONGODB_URI must be set'); - if (!CONTROL_DB) throw new Error('CONTROL_DB must be set'); + /* Only the control path needs a control database to read. */ + if (!REGISTRY_FILE && !CONTROL_DB) throw new Error('CONTROL_DB must be set'); /* * Declared before anything is served. @@ -196,8 +266,10 @@ async function main() { enableMultiTenant(true); await mongoose.connect(CONTROL_URI, { maxPoolSize: POOL_SIZE }); - controlClient = new MongoClient(CONTROL_URI, { maxPoolSize: 5 }); - await controlClient.connect(); + if (!REGISTRY_FILE) { + controlClient = new MongoClient(CONTROL_URI, { maxPoolSize: 5 }); + await controlClient.connect(); + } await loadRegistry(); setInterval(() => { @@ -205,7 +277,21 @@ async function main() { }, RELOAD_MS).unref(); const server = http.createServer((req, res) => { - resolve(req.headers.host) + /* + * Which header names the shop. + * + * Host, normally - a shop is its own hostname and that is the whole + * addressing scheme. The demo estate is the exception: fifty shops share + * ONE public hostname and are chosen by a cookie, so the front end has to + * name the shop some other way. + * + * Rewriting Host would do it, and would also put an internal name into + * every absolute URL the application generates - links to a hostname that + * does not resolve for anybody. A header of its own costs nothing and + * cannot leak into a page. + */ + const named = SHOP_HEADER ? req.headers[SHOP_HEADER] : null; + resolve(named || req.headers.host) .then((tenant) => { if (!tenant) { res.writeHead(404, { 'content-type': 'text/plain' }); diff --git a/api/src/config/demo-mode.js b/api/src/config/demo-mode.js new file mode 100644 index 000000000..dd9c2a42b --- /dev/null +++ b/api/src/config/demo-mode.js @@ -0,0 +1,36 @@ +'use strict'; + +/* + * The public demo's collar (DEMO_SHOP_PLAN §4). + * + * One env flag, read here and nowhere else. Everything it changes is + * enforced SERVER-side - hiding a button is a courtesy, not a control - + * and every install without the flag behaves byte-identically to today: + * this ships to every till and every tenant, inert. + * + * What it collars, and why: + * - outbound email / SMS / WhatsApp: the demo holds published logins; + * an open relay with a web UI is what spammers dream about at night. + * - password and user changes: admin/admin, manager/manager and + * cashier/cashier are permanent fixtures - the next visitor needs + * them exactly as printed on the login page. + * + * Data entry stays OPEN on purpose. Making sales, adding items, breaking + * the layout - that IS the product tour, and the hourly restore makes the + * shop whole again. + */ +const isDemoMode = () => + ['1', 'true', 'yes', 'on'].includes(String(process.env.DEMO_MODE || '').toLowerCase()); + +const DEMO_BLOCKED_MESSAGE = + 'This is the public demo, so this action is switched off. Everything here resets on the hour - explore freely.'; + +/* Route middleware for the endpoints a demo must refuse. 403 with the reason + in plain words: the person who taps "change password" in a demo deserves + to know it is the demo saying no, not a bug. */ +const demoGuard = (req, res, next) => { + if (!isDemoMode()) return next(); + return res.status(403).json({ type: 'error', message: DEMO_BLOCKED_MESSAGE }); +}; + +module.exports = { isDemoMode, demoGuard, DEMO_BLOCKED_MESSAGE }; diff --git a/api/src/config/index.js b/api/src/config/index.js index 7119dc8a9..dd23985ec 100644 --- a/api/src/config/index.js +++ b/api/src/config/index.js @@ -47,7 +47,7 @@ const envVarsSchema = Joi.object() .default(15 * 60 * 1000), // 15 minutes RATE_LIMIT_MAX: Joi.alternatives().try(Joi.number(), Joi.string()).default(100), - // Email (optional – allow empty to avoid hard-failing when SMTP is not configured) + // Email (optional - allow empty to avoid hard-failing when SMTP is not configured) EMAIL_HOST: Joi.string().optional().allow('').description('SMTP host'), EMAIL_PORT: Joi.alternatives() .try(Joi.number(), Joi.string()) diff --git a/api/src/constants/roles.constants.js b/api/src/constants/roles.constants.js index f14a4c4f6..f3b5fef92 100644 --- a/api/src/constants/roles.constants.js +++ b/api/src/constants/roles.constants.js @@ -15,7 +15,7 @@ * `role.pos` in Phase 2. * * These DEFAULT_ROLES are seeded per tenant as `is_system` roles (clone to make - * a custom role). They are the STARTING presets — a shop can edit them. + * a custom role). They are the STARTING presets - a shop can edit them. */ // access-triple helpers @@ -71,6 +71,8 @@ const POS_PERMISSIONS = { REGISTER_CLOSE: 'register_close', CASH_IN_OUT: 'cash_in_out', CASH_DROP: 'cash_drop', + // Owner ask: quick sale grantable per cashier; deny only when unticked. + QUICK_SALE: 'quick_sale', }; const pos = (o = {}) => ({ @@ -87,6 +89,8 @@ const pos = (o = {}) => ({ register_close: !!o.register_close, cash_in_out: !!o.cash_in_out, cash_drop: !!o.cash_drop, + // Default allowed: selling fast is the norm; deny is the explicit act. + quick_sale: o.quick_sale !== false, }); const POS_FULL = { discount_apply: true, @@ -101,6 +105,7 @@ const POS_FULL = { register_close: true, cash_in_out: true, cash_drop: true, + quick_sale: true, }; const ROLE_KEYS = { diff --git a/api/src/constants/users.constants.js b/api/src/constants/users.constants.js index 953aceae4..1d1b60a69 100644 --- a/api/src/constants/users.constants.js +++ b/api/src/constants/users.constants.js @@ -92,17 +92,26 @@ const HTTP_STATUS = { INTERNAL_ERROR: 500, }; -// Languages +// Languages the app can show. Mirrors LANGUAGES in frontend/gulpfile.js/config.js, +// which is where a language is actually added; this is the server-side allow +// list for a user's stored preference. const LANGUAGES = { ENGLISH: 'en', - SPANISH: 'es', - FRENCH: 'fr', - GERMAN: 'de', - HINDI: 'hi', TAMIL: 'ta', - TELUGU: 'te', - KANNADA: 'kn', + HINDI: 'hi', MALAYALAM: 'ml', + KANNADA: 'kn', + TELUGU: 'te', + SINHALA: 'si', + NEPALI: 'ne', + ARABIC: 'ar', + FRENCH: 'fr', + SPANISH: 'es', + PORTUGUESE: 'pt', + INDONESIAN: 'id', + THAI: 'th', + // Kept for records that already hold it; the app does not offer it. + GERMAN: 'de', }; // Theme preferences diff --git a/api/src/controllers/activity-logs.controller.js b/api/src/controllers/activity-logs.controller.js index 416d30eff..95046ccb3 100644 --- a/api/src/controllers/activity-logs.controller.js +++ b/api/src/controllers/activity-logs.controller.js @@ -1,4 +1,5 @@ const activityLogger = require('../utils/activityLogger'); +const { clientIp } = require('../utils/client-ip'); const catchAsync = require('../utils/catchAsync'); const { AppError } = require('../utils/appError'); const mongoose = require('mongoose'); @@ -156,7 +157,7 @@ exports.createActivityLog = catchAsync(async (req, res, next) => { entity: req.body.entity, entityId: req.body.entityId, details: req.body.details, - ipAddress: req.ip, + ipAddress: clientIp(req), userAgent: req.get('user-agent'), ...(scope || {}), }); diff --git a/api/src/controllers/auth-utils.controller.js b/api/src/controllers/auth-utils.controller.js index e017f7997..860c94285 100644 --- a/api/src/controllers/auth-utils.controller.js +++ b/api/src/controllers/auth-utils.controller.js @@ -1,4 +1,5 @@ const jwt = require('jsonwebtoken'); +const { clientIp } = require('../utils/client-ip'); const { promisify } = require('util'); const { authCookieOptions } = require('../utils/auth-cookie'); /* Per request. A signing key read once at module load is the process's key, @@ -119,7 +120,7 @@ const createAndSendToken = async (user, statusCode, res, req) => { login_time: loginTime, logout_time: null, is_active: true, - ip_address: req.ip || '127.0.0.1', + ip_address: clientIp(req), created_date: loginTime, }; diff --git a/api/src/controllers/base.controller.js b/api/src/controllers/base.controller.js index 0bdf780d0..d931ef802 100644 --- a/api/src/controllers/base.controller.js +++ b/api/src/controllers/base.controller.js @@ -256,7 +256,7 @@ class BaseController { const process = (item) => { if (!item || typeof item !== 'object') return item; - // Preserve Date and ObjectId instances — spreading them creates empty {} + // Preserve Date and ObjectId instances - spreading them creates empty {} if (item instanceof Date) return item; if (item._bsontype) return item; diff --git a/api/src/controllers/branches.controller.js b/api/src/controllers/branches.controller.js index 1cebebf08..66311fbaf 100644 --- a/api/src/controllers/branches.controller.js +++ b/api/src/controllers/branches.controller.js @@ -4,6 +4,12 @@ const BranchModel = BranchModule.BranchModel; const branchesService = require('../services/branch.service'); const User = require('../models/user.model'); const { ObjectId } = require('mongodb'); +const { redactBranchSecrets, stripBranchSecrets } = require('../services/settings-groups'); +const SettingsRepository = require('../repositories/settings.repository'); +const dataSharing = require('../services/data-sharing'); +const catalogueCopy = require('../services/catalogue-copy'); + +const settingsRepository = new SettingsRepository(); class BranchesController extends BaseController { constructor() { @@ -51,7 +57,9 @@ class BranchesController extends BaseController { if (result.status === true) { if (result.data && result.data.list) { - result.data.list = this.mongoIDFilter(result.data.list); + /* Credentials never belong in a LIST - unstripped this hands out + every branch's mail and SMS passwords in one response. */ + result.data.list = stripBranchSecrets(this.mongoIDFilter(result.data.list)); } return this.success(res, result.data, result.message, 200); } else { @@ -100,7 +108,11 @@ class BranchesController extends BaseController { return this.error(res, 'Branch Not found', 404); } - return this.success(res, result.data, result.message || 'Branch retrieved successfully'); + return this.success( + res, + stripBranchSecrets(result.data), + result.message || 'Branch retrieved successfully' + ); } catch (error) { console.error('Error in getOne branch:', error); return this.error(res, 'Failed to retrieve branch', 500); @@ -131,7 +143,122 @@ class BranchesController extends BaseController { return this.error(res, result.message, 404, result.data); } - return this.success(res, result.data, result.message, 200); + /* + * S6 (D4): start a new shop from an existing one. + * + * The design says this replaces the hardcoded defaults in createBranch. + * It OVERLAYS them instead, deliberately: those defaults also seed the + * print templates and currency, and a source branch that happens to + * lack one would otherwise leave the new shop with nothing there. The + * defaults stay the floor, the copy states the preferences on top, and + * a create without the option behaves exactly as it always has. + * + * A failure here never fails the create - the branch exists and can be + * configured by hand; losing it because a copy went wrong would be far + * worse. The reason is reported alongside the branch instead. + */ + const copyFrom = req.body?.copy_settings_from; + if (copyFrom && result.data?._id) { + const groups = + Array.isArray(req.body.copy_groups) && req.body.copy_groups.length + ? req.body.copy_groups + : ['features', 'preferences', 'documents']; + try { + const copied = await settingsRepository.copyGroups(groups, copyFrom, result.data._id, { + licenseId: req.user?.license || req.user?.license_id || null, + }); + result.data.settings_copied = copied.status ? copied.data.copied : null; + if (!copied.status) result.data.settings_copy_error = copied.message; + } catch (e) { + console.error('[branch] settings copy skipped:', e && e.message); + result.data.settings_copy_error = e.message; + } + } + + /* + * Owner ask #85, the "inventory copy" half. + * + * Not a sharing switch, deliberately - see services/catalogue-copy.js. + * Stock lives on the item document and each branch owns its own items, + * so a shared item read would show N copies of every product with N + * different counts, and selling the wrong row would decrement another + * shop's stock. A new shop wants the CATALOGUE, with its own counts + * starting at zero, and that is a copy. + * + * Like the settings copy, a failure never fails the create: the branch + * exists and products can be added by hand, and losing a just-created + * shop over a catalogue copy would be far worse. + */ + const itemsFrom = req.body?.copy_items_from; + if (itemsFrom && result.data?._id) { + try { + const BaseModel = require('../models/base.model'); + const db = await BaseModel.getDb(); + const copied = await catalogueCopy.copyCatalogue(db, { + sourceBranchId: itemsFrom, + targetBranchId: result.data._id, + targetBranchName: result.data.name || req.body?.name || '', + licenseId: req.user?.license || req.user?.license_id || null, + userId: req.user?._id || null, + userName: req.user?.username || '', + }); + result.data.items_copied = copied.status ? copied.data : null; + if (!copied.status) result.data.items_copy_error = copied.message; + } catch (e) { + console.error('[branch] catalogue copy skipped:', e && e.message); + result.data.items_copy_error = e.message; + } + } + + /* + * Owner ask #85: sharing is decided when a second shop appears. + * + * "Whenever new branch created mandatory information needs to be auto + * filled... we should auto selected as true based on standard values." + * The default customer, supplier and tax are already seeded by + * createBranch; this is the other half - who the new shop can SEE. + * + * ONLY IF THE ACCOUNT HAS NOT ALREADY DECIDED. Creating a third shop + * must not silently re-impose a default over a rule someone deliberately + * set when they created the second. `accountGroup` answers exactly that + * question - `set` names the keys the account itself decides - so an + * existing choice is left alone key by key rather than wholesale. + * + * Written at ACCOUNT level, because "can this shop see that shop's + * customers" is not a fact about one shop. A branch can still override + * it afterwards; that is what S5 inheritance is for. + * + * Like the settings copy above, a failure here never fails the create. + */ + if (result.data?._id) { + try { + const ctx = { + licenseId: req.user?.license || req.user?.license_id || null, + branchId: result.data._id, + }; + const current = await settingsRepository.accountGroup('sharing', ctx); + const decided = (current.status && current.data?.set) || []; + const seed = {}; + for (const [key, fallback] of Object.entries(dataSharing.CREATE_DEFAULTS)) { + if (decided.includes(key)) continue; + seed[key] = + req.body?.[key] === undefined ? fallback : dataSharing.truthy(req.body[key]); + } + if (Object.keys(seed).length) { + const wrote = await settingsRepository.saveGroup('sharing', seed, ctx, { + level: 'account', + }); + result.data.sharing_defaults = wrote.status ? seed : null; + if (!wrote.status) result.data.sharing_error = wrote.message; + } + dataSharing.invalidate(ctx.licenseId); + } catch (e) { + console.error('[branch] sharing defaults skipped:', e && e.message); + result.data.sharing_error = e.message; + } + } + + return this.success(res, stripBranchSecrets(result.data), result.message, 200); } catch (error) { console.error('Error in add branch:', error); return this.error(res, 'Failed to create branch: ' + error.message, 500); @@ -163,7 +290,7 @@ class BranchesController extends BaseController { return this.error(res, result.message, 404); } - return this.success(res, result.data, result.message); + return this.success(res, stripBranchSecrets(result.data), result.message); } catch (error) { console.error('Error in edit branch:', error); return this.error(res, 'Failed to update branch: ' + error.message, 500); @@ -494,10 +621,15 @@ class BranchesController extends BaseController { }); } + /* S4: this returns the whole branch document, and the settings screen + reads its email and SMS cards from it - so the SMTP password, the SMS + gateway password and two API keys were being handed to the browser of + anyone who could open Settings. They leave as a configured/not map; + the values only ever travel inwards now. */ return res.status(200).json({ type: 'success', message: 'Get store details successfully', - data: result.data, + data: redactBranchSecrets(result.data), }); } catch (error) { console.error('Error in getOneStore:', error); @@ -535,7 +667,7 @@ class BranchesController extends BaseController { return this.error(res, 'Branch not found', 404); } - return this.success(res, branch, 'Branch details retrieved successfully'); + return this.success(res, stripBranchSecrets(branch), 'Branch details retrieved successfully'); } catch (error) { console.error('Error in getBranchDetails:', error); return this.error(res, error.message, 500); diff --git a/api/src/controllers/categories.controller.js b/api/src/controllers/categories.controller.js index bfc439668..d61889f04 100644 --- a/api/src/controllers/categories.controller.js +++ b/api/src/controllers/categories.controller.js @@ -241,6 +241,63 @@ class CategoriesController extends BaseController { * Get all categories with pagination * GET /categories */ + /** + * GET /categories/getDataChanges + * + * The route for this has been live and calling a method that was never + * written, so the endpoint answered 500 to anything that asked. Nothing in + * the frontend calls it today, which is the only reason it went unnoticed - + * a sync client picking it up would have found it broken. + * + * Thin by design: the service and repository already implement the query, + * exactly as customer-categories does. All this adds is the branch the + * changes are scoped to, resolved the same way every other method here + * resolves it rather than trusting a query parameter. + */ + getDataChanges = asyncHandler(async (req, res) => { + try { + const from = req.query.from || ''; + if (!from) { + return res.status(400).json({ + type: 'error', + message: 'A "from" date is required', + data: null, + }); + } + + const { branch_id: branchId } = await this.resolveBranchContext(req); + if (!branchId) { + return res.status(400).json({ + type: 'error', + message: 'Branch could not be resolved', + data: null, + }); + } + + const result = await this.service.getDataChanges(from, branchId); + if (!result.status) { + return res.status(200).json({ + type: 'error', + message: result.message || 'Not valid Input', + data: result.data || null, + }); + } + + return res.status(200).json({ + type: 'success', + message: 'Changes Retrieved', + data: result.data, + }); + } catch (error) { + console.error('Error in getDataChanges:', error); + return res.status(500).json({ + type: 'error', + message: error.message, + data: null, + }); + } + }); + getAll = asyncHandler(async (req, res) => { if (!this.checkPermission('category', 'read', req.user)) { return this.error(res, 'Unauthorized', 403); @@ -311,11 +368,49 @@ class CategoriesController extends BaseController { const result = await this.service.getAllCategories(filters, { page, limit }); if (result.status) { + // The number a retailer actually scans this list for: how many items + // live under each category. One pass over the page's categories - + // items carrying category_id group under the id, legacy name-only + // items group under the name, so the two sets cannot double count. + let itemCounts = null; + try { + const rows = result.data.data || []; + const ids = rows + .map((c) => c._id) + .filter(Boolean) + .map((v) => new Types.ObjectId(String(v))); + const names = rows.map((c) => c.name).filter(Boolean); + if (ids.length || names.length) { + const itemsCol = await new BaseModel('items').getCollection('items'); + const groups = await itemsCol + .aggregate([ + { + $match: { + $or: [{ category_id: { $in: ids } }, { category_name: { $in: names } }], + }, + }, + { $project: { key: { $ifNull: ['$category_id', '$category_name'] } } }, + { $group: { _id: '$key', n: { $sum: 1 } } }, + ]) + .toArray(); + itemCounts = {}; + groups.forEach((g) => { + itemCounts[String(g._id)] = g.n; + }); + } + } catch (e) { + // the count is a garnish - the list must never fail over it + itemCounts = null; + } + const list = (result.data.data || []).map((category) => ({ ...category, image: this.normalizeCategoryImage(category.image, req), discount_amount: category.discount_amount || DEFAULTS.DISCOUNT_AMOUNT, discount_percentage: category.discount_percentage || DEFAULTS.DISCOUNT_PERCENTAGE, + items_count: itemCounts + ? (itemCounts[String(category._id)] || 0) + (itemCounts[String(category.name)] || 0) + : null, })); return this.success( @@ -406,7 +501,7 @@ class CategoriesController extends BaseController { // Always derive branch_name from the RESOLVED branch_id so the two can never // disagree (PHP: branch_name => self::$currentBranchName, always the current // branch). The candidate-based branch_name from resolveBranchContext can belong - // to a DIFFERENT branch (e.g. branch_access[0]) — that bug stamped every + // to a DIFFERENT branch (e.g. branch_access[0]) - that bug stamped every // category with the first branch's name ("posnic") regardless of the actual // branch_id. The branches collection's only name field is `branch_name`. let finalBranchName = ''; @@ -440,6 +535,19 @@ class CategoriesController extends BaseController { branch_name: finalBranchName, // PHP: self::$currentBranchName }; + // Category tiles (CATEGORY_TILE_INHERITANCE_DESIGN.md): a colour and + // shape items without their own can inherit at render time. + if (req.body.tile_color !== undefined) { + const tileColor = String(req.body.tile_color || '').trim(); + categoryData.tile_color = /^#[0-9a-fA-F]{6}$/.test(tileColor) ? tileColor : ''; + } + if (req.body.tile_shape !== undefined) { + const tileShape = String(req.body.tile_shape || '').trim(); + categoryData.tile_shape = ['square', 'rounded', 'circle', 'diamond'].includes(tileShape) + ? tileShape + : ''; + } + const license = req.tenantContext?.licenseId || req.user?.license || req.user?.license_id; if (!license) { return this.error(res, 'License context is required', 400); @@ -494,6 +602,19 @@ class CategoriesController extends BaseController { if (req.body.is_active !== undefined) updateData.is_active = req.body.is_active; if (req.body.sort_order !== undefined) updateData.sort_order = parseInt(req.body.sort_order); + // Category tiles (CATEGORY_TILE_INHERITANCE_DESIGN.md): a colour and + // shape items without their own can inherit at render time. + if (req.body.tile_color !== undefined) { + const tileColor = String(req.body.tile_color || '').trim(); + updateData.tile_color = /^#[0-9a-fA-F]{6}$/.test(tileColor) ? tileColor : ''; + } + if (req.body.tile_shape !== undefined) { + const tileShape = String(req.body.tile_shape || '').trim(); + updateData.tile_shape = ['square', 'rounded', 'circle', 'diamond'].includes(tileShape) + ? tileShape + : ''; + } + // Handle discount fields with mutual exclusivity if (req.body.discount_amount !== undefined && req.body.discount_percentage === undefined) { updateData.discount_amount = parseFloat(req.body.discount_amount) || 0; diff --git a/api/src/controllers/customerCategory.controller.js b/api/src/controllers/customerCategory.controller.js index 7b2fa222b..34152fb19 100644 --- a/api/src/controllers/customerCategory.controller.js +++ b/api/src/controllers/customerCategory.controller.js @@ -33,8 +33,17 @@ class CustomerCategoryController extends BaseController { const result = await model.categoryPage(filters, options); if (result.status === true) { - // Apply MongoIDFilter to convert ObjectIds to strings - result.data.list = this.MongoIDFilter(result.data.list); + /* + * this.MongoIDFilter never existed - not here, not on the base - so + * this line has thrown into the catch and answered 500 on every call + * since it was written. Found by the phantom-helper sweep, which was + * itself written because three demo handlers shipped the same way. + * The ObjectId-to-string job it named is real, so it is done inline: + * one field, no invented helper to go phantom again. + */ + result.data.list = (result.data.list || []).map((row) => + row && row._id ? { ...row, _id: String(row._id) } : row + ); return this.success(res, result.data, result.message); } else { return this.error(res, 'Details Not Found', 404, result.data); diff --git a/api/src/controllers/customers.controller.js b/api/src/controllers/customers.controller.js index 50fb413e0..d70ecf191 100644 --- a/api/src/controllers/customers.controller.js +++ b/api/src/controllers/customers.controller.js @@ -242,10 +242,7 @@ class CustomerController extends BaseController { if (branchId && !branchName) { try { const BaseModel = require('../models/base.model'); - const branchesCollection = await BaseModel.prototype.getCollection.call( - { collectionName: 'branches' }, - 'branches' - ); + const branchesCollection = await new BaseModel('branches').getCollection('branches'); const branchDoc = await branchesCollection.findOne({ _id: new ObjectId(branchId), license: req.tenantContext?.licenseId, @@ -660,10 +657,7 @@ class CustomerController extends BaseController { let branchCity = ''; try { - const branchesCollection = await BaseModel.prototype.getCollection.call( - { collectionName: 'branches' }, - 'branches' - ); + const branchesCollection = await new BaseModel('branches').getCollection('branches'); const branchDoc = await branchesCollection.findOne({ _id: new ObjectId(branchId), license: req.tenantContext?.licenseId, @@ -945,10 +939,7 @@ class CustomerController extends BaseController { } // Get transaction collection - const transactionCollection = await BaseModel.prototype.getCollection.call( - { collectionName: 'transaction' }, - 'transaction' - ); + const transactionCollection = await new BaseModel('transaction').getCollection('transaction'); // Get paginated transactions const skip = (page - 1) * limit; @@ -1084,10 +1075,7 @@ class CustomerController extends BaseController { } // Get customer details - const customerCollection = await BaseModel.prototype.getCollection.call( - { collectionName: 'customers' }, - 'customers' - ); + const customerCollection = await new BaseModel('customers').getCollection('customers'); const customer = await customerCollection.findOne({ _id: new ObjectId(id), @@ -1103,10 +1091,7 @@ class CustomerController extends BaseController { } // Get transaction collection - const transactionCollection = await BaseModel.prototype.getCollection.call( - { collectionName: 'transaction' }, - 'transaction' - ); + const transactionCollection = await new BaseModel('transaction').getCollection('transaction'); // Create transaction document const transactionDate = date ? new Date(date) : new Date(); @@ -1203,6 +1188,120 @@ class CustomerController extends BaseController { } }); + /** + * DELETE /customers/deleteTransaction + * + * The route for this has been live and calling a method that was never + * written, so the trash icon on a customer's transaction list returned 500 + * every time. Express did not catch it at startup because the route wraps + * the call in an arrow function - the wrapper IS a function, so the server + * boots clean and the TypeError waits for someone to press delete. + * + * WHY THIS IS SAFE TO WRITE, when reversing a money record usually is not: + * the balance here is DERIVED, not maintained. `transaction` above computes + * it as sum(in) - sum(out) over every transaction for the customer and $sets + * the result. So a delete does not need bespoke reversal arithmetic that + * could drift from the original - it removes the row and re-runs the exact + * same derivation. The aggregate below is a copy of that one deliberately; + * if the definition of balance ever changes, both must change together. + * + * A transaction that belongs to a SALE is refused. The UI already shows a + * link icon rather than a trash for those, but the server must not trust + * that: deleting one would leave the sale believing it had been paid while + * the customer's ledger says otherwise, and nothing would flag the gap. + */ + deleteTransaction = asyncHandler(async (req, res) => { + try { + const { id, customer_id } = req.body || {}; + if (!id || !customer_id) { + return res.status(400).json({ + type: 'error', + message: 'Transaction id and customer id are required', + data: null, + }); + } + + const transactionCollection = await new BaseModel('transaction').getCollection('transaction'); + + /* Scoped by customer AND license, never by id alone: an id on its own + would let one customer's row be deleted from another's screen. */ + const scope = { + _id: new ObjectId(id), + customer_id: new ObjectId(customer_id), + license: BaseModel.license, + }; + + const existing = await transactionCollection.findOne(scope); + if (!existing) { + return res.status(404).json({ + type: 'error', + message: 'Transaction not found', + data: null, + }); + } + + if (existing.sale_id) { + return res.status(400).json({ + type: 'error', + message: 'This transaction belongs to a sale. Cancel the sale instead.', + data: null, + }); + } + + await transactionCollection.deleteOne(scope); + + // Recalculate customer balance from all transactions - the same + // derivation the add path uses, so the two can never disagree. + const aggregateResult = await transactionCollection + .aggregate([ + { + $match: { + customer_id: new ObjectId(customer_id), + license: BaseModel.license, + }, + }, + { + $group: { + _id: null, + totalIn: { + $sum: { $cond: [{ $eq: ['$type', 'in'] }, '$amount', 0] }, + }, + totalOut: { + $sum: { $cond: [{ $eq: ['$type', 'out'] }, '$amount', 0] }, + }, + }, + }, + { + $addFields: { + balance: { $subtract: ['$totalIn', '$totalOut'] }, + }, + }, + ]) + .toArray(); + + const newBalance = aggregateResult.length > 0 ? aggregateResult[0].balance : 0; + + const customerCollection = await new BaseModel('customers').getCollection('customers'); + await customerCollection.updateOne( + { _id: new ObjectId(customer_id), license: BaseModel.license }, + { $set: { balance: newBalance, updated_date: new Date() } } + ); + + return res.status(200).json({ + type: 'success', + message: 'Transaction deleted successfully', + data: newBalance, + }); + } catch (error) { + console.error('Error in deleteTransaction:', error); + return res.status(500).json({ + type: 'error', + message: error.message, + data: null, + }); + } + }); + /** * PHP: uploadTransactionImage() * Upload transaction image diff --git a/api/src/controllers/easy-tables.controller.js b/api/src/controllers/easy-tables.controller.js index b18ebeb70..583094f54 100644 --- a/api/src/controllers/easy-tables.controller.js +++ b/api/src/controllers/easy-tables.controller.js @@ -65,28 +65,13 @@ const FORBIDDEN_FIELD = /pass(word|wd)?|secret|token|apikey|api_key|hash|salt|ot * seconds per request and at worst is a way to read documents the query was * never scoped to. $function and $accumulator are the same class. * - * Checked recursively: these are just as dangerous nested inside $and or $or - * as they are at the top level, and only checking the top would be a guard - * that looks present. + * This rule was written here first and was needed in nine other places: the + * list endpoints take their filter as a JSON string, which the app-level '$' + * sanitiser cannot see inside. It now lives in utils/mongo-guard.js and is + * enforced for every query parameter in app.js, so this file uses the shared + * one rather than keeping the second copy that would only be fixed here. */ -const CODE_OPERATORS = new Set(['$where', '$function', '$accumulator', '$expr']); - -function findCodeOperator(value, depth = 0) { - if (depth > 8 || !value || typeof value !== 'object') return null; - if (Array.isArray(value)) { - for (const v of value) { - const hit = findCodeOperator(v, depth + 1); - if (hit) return hit; - } - return null; - } - for (const [key, v] of Object.entries(value)) { - if (CODE_OPERATORS.has(key)) return key; - const hit = findCodeOperator(v, depth + 1); - if (hit) return hit; - } - return null; -} +const { findCodeOperator } = require('../utils/mongo-guard'); class EasyTableController extends BaseController { constructor() { diff --git a/api/src/controllers/invoices.controller.js b/api/src/controllers/invoices.controller.js new file mode 100644 index 000000000..3ed12646a --- /dev/null +++ b/api/src/controllers/invoices.controller.js @@ -0,0 +1,275 @@ +'use strict'; + +/* + * Invoices (INVOICING_MODULE_DESIGN). ACL: the sale permission, like quotes - + * an invoice is a sales document. Reads need sale.read, anything that changes + * an invoice needs sale.write. + * + * Money is never touched here. Issuing books the SALE (services/invoice- + * booking); recording a payment pays that sale down (services/invoice-sync); + * the invoice repeats what the sale then says. + */ + +const InvoiceRepository = require('../repositories/invoice.repository'); +const QuoteRepository = require('../repositories/quote.repository'); +const invoiceSync = require('../services/invoice-sync'); +const invoiceBooking = require('../services/invoice-booking'); + +const repository = new InvoiceRepository(); +const quotes = new QuoteRepository(); + +function contextOf(req) { + const user = req.user || {}; + return { + branchId: + req.tenantContext?.branchId || + user.branch_id || + (Array.isArray(user.branch_access) && user.branch_access[0]?.branch_id) || + null, + branchName: req.tenantContext?.branchName || user.branch_name || '', + licenseId: req.tenantContext?.licenseId || user.license || null, + userId: user._id || null, + userName: user.username || user.email || '', + }; +} + +function can(req, perm) { + return req.user?.access?.sale?.[perm] !== false; +} + +const fail = (res, message, code = 400) => + res.status(code).json({ type: 'error', message, data: null }); +const ok = (res, data, message, meta) => + res.json({ type: 'success', message, data, ...(meta ? { meta } : {}) }); + +module.exports = { + async create(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const r = await repository.upsertInvoice(req.body || {}, '', contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in invoices create:', error); + return fail(res, error.message, 500); + } + }, + + async update(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const r = await repository.upsertInvoice(req.body || {}, req.params.id, contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in invoices update:', error); + return fail(res, error.message, 500); + } + }, + + /* + * Quote -> invoice. The invoice is created from the quote's own numbers as + * a draft (a proforma), then the quote is stamped `invoiced` so it cannot + * be converted twice. If the stamp is refused - the quote was invoiced + * meanwhile - the invoice just created is removed again rather than left + * as a second bill for one promise. + */ + async fromQuote(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const ctx = contextOf(req); + const q = await quotes.getQuote(req.params.quoteId, ctx); + if (!q.status) return fail(res, q.message, 404); + const quote = q.data; + if (quote.status === 'invoiced' && quote.invoice_id) { + return ok( + res, + { id: String(quote.invoice_id), invoice_id: quote.invoice_number || '', existing: true }, + 'This quote already has an invoice' + ); + } + if (!['open', 'draft', 'sent', 'accepted'].includes(quote.status)) { + return fail(res, 'Only an open or accepted quote can become an invoice'); + } + const created = await repository.createFromQuote(quote, ctx); + if (!created.status) return fail(res, created.message); + const stamped = await quotes.transition( + String(quote._id), + 'invoice', + { invoice_id: created.data.id, invoice_number: created.data.invoice_id }, + ctx + ); + if (!stamped.status) { + await repository.deleteInvoice(created.data.id, ctx); + return fail(res, stamped.message); + } + return ok( + res, + created.data, + 'Invoice ' + created.data.invoice_id + ' created from the quote' + ); + } catch (error) { + console.error('Error in invoices fromQuote:', error); + return fail(res, error.message, 500); + } + }, + + async share(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const { s3Config, uploadObject } = require('../utils/s3'); + if (!s3Config().bucket) { + return fail( + res, + 'Invoice links are not configured on this server - PDF, Email and WhatsApp text still work', + 503 + ); + } + const b64 = String((req.body && req.body.pdf_base64) || ''); + if (!b64) return fail(res, 'A rendered PDF is required', 400); + if (b64.length > 14 * 1024 * 1024) return fail(res, 'PDF too large', 400); + const ctx = contextOf(req); + const found = await repository.getInvoice(req.params.id, ctx); + if (!found.status) return fail(res, found.message, 404); + const doc = found.data; + const rev = ((doc.share && doc.share.rev) || 0) + 1; + const crypto = require('crypto'); + /* b/: bills, beside the sales' i/ and the quotes' q/. + 12 url-safe chars = 72 random bits; the key is the secret. */ + const key = `${process.env.SHARE_LINK_PREFIX || ''}b/${crypto.randomBytes(9).toString('base64url')}`; + const up = await uploadObject({ + key, + body: Buffer.from(b64, 'base64'), + contentType: 'application/pdf', + contentDisposition: `inline; filename="invoice-${String(doc.invoice_id || 'invoice').replace(/[^\w.-]/g, '_')}.pdf"`, + }); + const rec = await repository.recordShare(req.params.id, { key, url: up.Location, rev }, ctx); + if (!rec.status) return fail(res, rec.message); + return ok(res, { url: up.Location, rev }, 'Invoice link ready'); + } catch (error) { + console.error('Error in invoices share:', error); + return fail(res, error.message, 500); + } + }, + + async list(req, res) { + try { + if (!can(req, 'read')) return fail(res, 'Unauthorized access', 403); + const r = await repository.listInvoices( + { + status: req.query.status, + limit: req.query.limit, + page: req.query.page, + search: req.query.search, + field: req.query.field, + exact: req.query.exact, + from: req.query.from, + to: req.query.to, + sort: req.query.sort, + }, + contextOf(req) + ); + return r.status ? ok(res, r.data, r.message, r.meta) : fail(res, r.message); + } catch (error) { + console.error('Error in invoices list:', error); + return fail(res, error.message, 500); + } + }, + + async summary(req, res) { + try { + if (!can(req, 'read')) return fail(res, 'Unauthorized access', 403); + const r = await repository.summary(contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in invoices summary:', error); + return fail(res, error.message, 500); + } + }, + + async getById(req, res) { + try { + if (!can(req, 'read')) return fail(res, 'Unauthorized access', 403); + const r = await repository.getInvoice(req.params.id, contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message, 404); + } catch (error) { + console.error('Error in invoices getById:', error); + return fail(res, error.message, 500); + } + }, + + /* Issue: the draft becomes the sale. The server books it; nobody is sent + to a till screen. Replay-safe. */ + async issue(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const r = await invoiceBooking.issueInvoice(req.params.id, contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in invoices issue:', error); + return fail(res, error.message, 500); + } + }, + + /* + * cancel changes the document alone (drafts only). sync re-reads the sale: + * the invoice is rewritten FROM the sale, never from what a client claims. + */ + async transition(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const ctx = contextOf(req); + const action = String(req.body?.action || ''); + if (action === 'sync') { + const found = await repository.getInvoice(req.params.id, ctx); + if (!found.status) return fail(res, found.message, 404); + if (!found.data.sale_id) return fail(res, 'This invoice has not been issued yet'); + const r = await invoiceSync.syncSale(found.data.sale_id, { invoiceId: req.params.id }); + return r.synced ? ok(res, r.data, r.message) : fail(res, r.message); + } + const r = await repository.transition(req.params.id, action, req.body || {}, ctx); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in invoices transition:', error); + return fail(res, error.message, 500); + } + }, + + /* + * Record a payment, in full or in part. A draft is issued first - the + * customer paying IS the moment the bill is real - so nobody has to press + * two buttons to record one thing. + */ + async payment(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const ctx = contextOf(req); + let found = await repository.getInvoice(req.params.id, ctx); + if (!found.status) return fail(res, found.message, 404); + let inv = found.data; + if (inv.status === 'cancelled') return fail(res, 'This invoice was cancelled'); + if (inv.status === 'paid') return fail(res, 'This invoice is already paid'); + if (!inv.sale_id) { + const issued = await invoiceBooking.issueInvoice(req.params.id, ctx); + if (!issued.status) return fail(res, issued.message); + found = await repository.getInvoice(req.params.id, ctx); + if (!found.status) return fail(res, found.message, 404); + inv = found.data; + } + const r = await invoiceSync.recordPayment(inv, req.body || {}, ctx); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in invoices payment:', error); + return fail(res, error.message, 500); + } + }, + + async remove(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const r = await repository.deleteInvoice(req.params.id, contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in invoices remove:', error); + return fail(res, error.message, 500); + } + }, +}; diff --git a/api/src/controllers/items.controller.js b/api/src/controllers/items.controller.js index eab16c4c0..e3f935f45 100644 --- a/api/src/controllers/items.controller.js +++ b/api/src/controllers/items.controller.js @@ -7,6 +7,8 @@ const { ERROR_MESSAGES, SUCCESS_MESSAGES } = require('../constants/items.constan const sessionFilterUtil = require('../utils/session-filter.util'); const { toObjectId } = require('../utils/tenant-context'); const { isKioskConfigured } = require('../utils/kiosk'); +const { parseFilterParam } = require('../utils/mongo-guard'); +const { scanItems } = require('../services/gst-readiness'); class ItemsController extends BaseController { constructor() { @@ -126,7 +128,12 @@ class ItemsController extends BaseController { return requestContext; } + /* Kept for any caller that still wants the lenient shape, but it goes + through the same guard - a helper that parses client filters must not be + the one place a code operator can still get through. */ parseFilters(rawFilters) { + const guarded = parseFilterParam(rawFilters); + if (guarded.rejected) return {}; if (!rawFilters) { return {}; } @@ -220,20 +227,41 @@ class ItemsController extends BaseController { const limit = Number.isFinite(limitParam) && limitParam > 0 ? Math.min(limitParam, 100) : 5; const page = Number.isFinite(pageParam) && pageParam > 0 ? pageParam : 1; - // Preserve existing flexible filter parsing semantics - let filters = {}; - if (req.query.filters) { - if (typeof req.query.filters === 'string') { - const parsedFilters = safeJsonParse(req.query.filters, null); - if (parsedFilters && typeof parsedFilters === 'object' && !Array.isArray(parsedFilters)) { - filters = parsedFilters; - } - } else if (typeof req.query.filters === 'object' && !Array.isArray(req.query.filters)) { - filters = req.query.filters; - } + /* + * Preserve existing flexible filter parsing semantics, minus the + * operators that execute code. + * + * app.js strips '$' keys from req.query, but this filter arrives as a + * JSON STRING - one ordinary-looking value the sanitiser copies across + * untouched, then parsed back here with its operators intact and spread + * into a live query. See utils/mongo-guard.js for why the line is drawn + * at code execution rather than at '$': the real query operators are in + * use ($ne keeps KOT out of Sales History, $gte/$lte drive date windows) + * and removing those would un-filter lists rather than harden them. + */ + const { filters, rejected } = parseFilterParam(req.query.filters); + if (rejected) { + return this.sendError(res, `Filter operator "${rejected}" is not allowed`, 400); } - const options = { limit, page, sort: { _id: -1 } }; + /* + * Sort, whitelisted (owner: high/low margin, recent, low stock, cost, + * price). Only these names reach the query; { $margin } is the + * repository's computed-sort marker, not a Mongo operator. + */ + const ITEM_SORTS = { + recent: { updated_date: -1, _id: -1 }, + name: { name: 1 }, + margin_desc: { $margin: -1 }, + margin_asc: { $margin: 1 }, + price_desc: { selling_price: -1, _id: -1 }, + price_asc: { selling_price: 1, _id: -1 }, + cost_desc: { company_price: -1, _id: -1 }, + cost_asc: { company_price: 1, _id: -1 }, + stock_asc: { available_quantity: 1, _id: -1 }, + stock_desc: { available_quantity: -1, _id: -1 }, + }; + const options = { limit, page, sort: ITEM_SORTS[req.query.sort] || { _id: -1 } }; // Use the service layer (ItemService → ItemRepository → LegacyItemModel) const branchId = this.model?.branchId || null; @@ -294,7 +322,12 @@ class ItemsController extends BaseController { ? parseInt(notificationRaw, 10) : null; - const filters = this.parseFilters(req.query.filters); + /* Same string-shaped filter, same guard - the low-stock list spreads it + into a query exactly as the main list does. */ + const { filters, rejected } = parseFilterParam(req.query.filters); + if (rejected) { + return this.sendError(res, `Filter operator "${rejected}" is not allowed`, 400); + } const branchId = this.model?.branchId || null; const licenseId = this.model?.licenseId || null; @@ -862,6 +895,55 @@ class ItemsController extends BaseController { } } + /* + * The sale screen's inline editors: when the cashier chooses "update + * the item too", only the changed money fields land on the record. + * Item write ACL - the same right the full edit form needs. + */ + async quickPatch(req, res) { + try { + if (req.user?.access?.item?.write === false) { + return this.error(res, 'Unauthorized access', 403); + } + const { id } = req.body || {}; + if (!id) return this.error(res, 'Item id is required', 400); + const result = await this.service.quickPatch(id, req.body); + if (!result || result.status !== true) { + return this.error(res, (result && result.message) || 'Could not update the item', 400); + } + return this.success(res, null, 'Item updated'); + } catch (error) { + console.error('Error in quickPatch:', error); + return this.error(res, error.message, 500); + } + } + + /* + * GST 2.0 readiness (HSN_GST2_RATE_REFRESH_DESIGN increment 2): a + * read-only checklist of items whose tax rate needs a human look - + * those on a withdrawn slab, and those disagreeing with the bundled + * HSN reference where that reference still names a live slab. Report + * ACL, because it is a report; it writes nothing. + */ + async gstReadiness(req, res) { + try { + if (req.user?.access?.report?.read !== true) { + return this.error(res, 'Unauthorized access', 403); + } + this.setRequestContext(req); + const { branchId, licenseId } = req.itemContext || {}; + if (!branchId || !licenseId) { + return this.error(res, 'Branch context is required', 400); + } + const items = await this.service.listForGstReadiness({ branchId, licenseId }); + const result = scanItems(items || []); + return this.success(res, result, 'GST readiness scan complete'); + } catch (error) { + console.error('Error in gstReadiness:', error); + return this.error(res, error.message, 500); + } + } + async updateItemQuantity(req, res) { try { const { id, value } = req.body; @@ -1140,6 +1222,188 @@ class ItemsController extends BaseController { } } + /* + * GET /api/items/export/jsonld + * + * The catalogue in a format somebody else's software can read, rather than + * the 18-column CSV that exportItems produces. See PRODUCT_EXPORT_FORMATS.md + * for why schema.org and not GDSN or UBL. + * + * Read-only, and gated on the same item:read the list is gated on - this + * exposes nothing a user cannot already see, only in a different shape. + */ + /* + * DELETE the demo data, as opposed to hiding it. + * + * Guarded by the item DELETE permission, not read or write: this destroys + * records, and the person who may edit a price is not automatically the + * person who may clear a catalogue. + */ + /* + * Put the sample data back. + * + * Guarded by item WRITE rather than delete: this creates records. The + * service refuses when demo data is already present, so a double click + * cannot give a shop two of everything. + */ + async reseedDemoData(req, res) { + try { + if (req.user?.access?.item?.write === false) { + return this.sendError(res, ERROR_MESSAGES.UNAUTHORIZED, 403); + } + await this.ensureContext(req); + const InstallService = require('../services/install.service'); + const installer = new InstallService(); + const result = await installer.reseedDemoData({ + branchId: this.model?.branchId || null, + licenseId: this.model?.licenseId || null, + user: req.user, + /* Optional. Absent means "put back whatever this shop had", which is + what the Demo Data switch asks for; a value means the shop has + chosen a different trade from the list on its Demo Data page. */ + businessType: req.body?.businessType, + }); + if (!result.status) return this.sendError(res, result.message, 400); + return this.success(res, result.data, result.message); + } catch (error) { + console.error('Error in reseedDemoData:', error); + return this.sendError(res, error.message, 500); + } + } + + /* + * The packs a shop can choose from. + * + * Served rather than hard-coded in the page, so the chooser cannot drift + * from what the server will actually install. A list typed into the + * frontend is correct until somebody adds a pack, and then it is a menu + * that silently omits an option nobody knows exists. + * + * Read permission, not write: this says what is available, not what is + * installed, and a cashier looking at the Demo Data page should see the + * page rather than an error. + */ + async listDemoPacks(req, res) { + try { + if (req.user?.access?.item?.read === false) { + return this.sendError(res, ERROR_MESSAGES.UNAUTHORIZED, 403); + } + await this.ensureContext(req); + const { listDemoPacks } = require('../../utils/demoData'); + const packs = listDemoPacks(); + + /* + * Plus the website's per-currency trades, when this shop's currency has + * the zip. The probe is cached ten minutes and can only ADD rows - a + * posnic.com hiccup costs the extra trades, never the page. + */ + try { + const demoDatasetSvc = require('../services/demo-dataset'); + const BaseModelC = require('../models/base.model'); + const dbc = await BaseModelC.getDb(); + const { ObjectId: OIDC } = require('mongodb'); + const br = await dbc + .collection('branches') + .findOne( + { _id: new OIDC(String(this.model.branchId)) }, + { projection: { currency_value: 1, country: 1 } } + ); + const cur = + br && Array.isArray(br.currency_value) && br.currency_value[0] + ? br.currency_value[0].currency_text + : null; + if (cur) { + const extra = await demoDatasetSvc.listDatasetPacks(cur); + for (const row of extra) { + if (!packs.some((x) => x.key === row.key)) packs.push(row); + } + } + } catch (e) { + /* the built-in list stands on its own */ + } + + /* Which one this shop is on now, so the chooser opens on the right + answer instead of on the first row of the list. */ + let current = null; + try { + const BaseModel = require('../models/base.model'); + const db = await BaseModel.getDb(); + const { ObjectId } = require('mongodb'); + const row = await db.collection('items').findOne( + { + demo_pack: { $exists: true }, + license: new ObjectId(String(this.model.licenseId)), + }, + { projection: { demo_pack: 1 } } + ); + current = (row && row.demo_pack) || null; + } catch (e) { + /* A shop with no samples has no current pack, which is a fact about + the shop and not a failure to report. */ + current = null; + } + + return this.success(res, { packs, current }, 'success'); + } catch (error) { + console.error('Error in listDemoPacks:', error); + return this.sendError(res, error.message, 500); + } + } + + async purgeDemoData(req, res) { + try { + if (req.user?.access?.item?.delete === false) { + return this.sendError(res, ERROR_MESSAGES.UNAUTHORIZED, 403); + } + await this.ensureContext(req); + const result = await this.service.purgeDemoData({ + branchId: this.model?.branchId || null, + licenseId: this.model?.licenseId || null, + user: req.user, + }); + if (!result.status) return this.sendError(res, result.message, 400); + return this.success(res, result.data, result.message); + } catch (error) { + console.error('Error in purgeDemoData:', error); + return this.sendError(res, error.message, 500); + } + } + + async exportCatalogueJsonLd(req, res) { + try { + if (req.user?.access?.item?.read === false) { + return this.sendError(res, ERROR_MESSAGES.UNAUTHORIZED, 403); + } + await this.ensureContext(req); + + const branchId = this.model?.branchId || null; + const licenseId = this.model?.licenseId || null; + + /* + * ISO 4217, not the symbol. schema.org wants "INR"; the shop stores a + * sign (Rs) for display and the code separately. A symbol in + * priceCurrency is invalid, and "$" would not even identify a currency - + * it is used by a dozen of them. + */ + const currency = String(req.query.currency || '') + .trim() + .toUpperCase(); + const result = await this.service.exportCatalogueJsonLd({ + branchId, + licenseId, + currency: /^[A-Z]{3}$/.test(currency) ? currency : null, + }); + + if (!result.status) return this.sendError(res, result.message, 400); + + res.setHeader('Content-Type', 'application/ld+json; charset=utf-8'); + return res.status(200).send(JSON.stringify(result.data)); + } catch (error) { + console.error('Error in exportCatalogueJsonLd:', error); + return this.sendError(res, error.message, 500); + } + } + async exportItems(req, res) { try { const userAccess = req.user?.access?.item?.read; diff --git a/api/src/controllers/quotes.controller.js b/api/src/controllers/quotes.controller.js new file mode 100644 index 000000000..833655139 --- /dev/null +++ b/api/src/controllers/quotes.controller.js @@ -0,0 +1,173 @@ +'use strict'; + +/* + * Quotes (LS2). ACL: the sale permission - a quote is a sales document. + * Reads need sale.read, anything that changes a quote needs sale.write. + * Stock and payments are never touched here - see the repository header. + */ + +const QuoteRepository = require('../repositories/quote.repository'); + +const repository = new QuoteRepository(); + +function contextOf(req) { + const user = req.user || {}; + return { + branchId: + req.tenantContext?.branchId || + user.branch_id || + (Array.isArray(user.branch_access) && user.branch_access[0]?.branch_id) || + null, + branchName: req.tenantContext?.branchName || user.branch_name || '', + licenseId: req.tenantContext?.licenseId || user.license || null, + userId: user._id || null, + userName: user.username || user.email || '', + }; +} + +function can(req, perm) { + return req.user?.access?.sale?.[perm] !== false; +} + +const fail = (res, message, code = 400) => + res.status(code).json({ type: 'error', message, data: null }); +// `meta` rides alongside data (paging totals); omitted when there is none, +// so every existing caller sees exactly the payload it saw before. +const ok = (res, data, message, meta) => + res.json({ type: 'success', message, data, ...(meta ? { meta } : {}) }); + +module.exports = { + async create(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const r = await repository.upsertQuote(req.body || {}, '', contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in quotes create:', error); + return fail(res, error.message, 500); + } + }, + + async update(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const r = await repository.upsertQuote(req.body || {}, req.params.id, contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in quotes update:', error); + return fail(res, error.message, 500); + } + }, + + /* + * Share: the till renders the professional PDF (the same document the + * user saw) and posts it here; it lands in S3 under an unguessable + * random key (same convention as invoice links) and the quote records + * the newest revision - an edited quote re-shares as a new file, so an + * old link never silently shows different numbers. + */ + async share(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const { s3Config, uploadObject } = require('../utils/s3'); + if (!s3Config().bucket) { + return fail( + res, + 'Quote links are not configured on this server - PDF, Email and WhatsApp text still work', + 503 + ); + } + const b64 = String((req.body && req.body.pdf_base64) || ''); + if (!b64) return fail(res, 'A rendered PDF is required', 400); + if (b64.length > 14 * 1024 * 1024) return fail(res, 'PDF too large', 400); + const ctx = contextOf(req); + const found = await repository.getQuote(req.params.id, ctx); + if (!found.status) return fail(res, found.message, 404); + const doc = found.data; + const rev = ((doc.share && doc.share.rev) || 0) + 1; + const crypto = require('crypto'); + /* + * q/, matching the invoices' i/ (owner: short links, + * nothing brandable in them). 12 url-safe chars = 72 random bits; + * the rev still rides the recorded share, not the path. Old + * quotes/... keys stay served. + */ + const key = `${process.env.SHARE_LINK_PREFIX || ''}q/${crypto.randomBytes(9).toString('base64url')}`; + const up = await uploadObject({ + key, + body: Buffer.from(b64, 'base64'), + contentType: 'application/pdf', + contentDisposition: `inline; filename="quote-${String(doc.quote_id || 'quote').replace(/[^\w.-]/g, '_')}.pdf"`, + }); + const rec = await repository.recordShare(req.params.id, { key, url: up.Location, rev }, ctx); + if (!rec.status) return fail(res, rec.message); + return ok(res, { url: up.Location, rev }, 'Quote link ready'); + } catch (error) { + console.error('Error in quotes share:', error); + return fail(res, error.message, 500); + } + }, + + async list(req, res) { + try { + if (!can(req, 'read')) return fail(res, 'Unauthorized access', 403); + const r = await repository.listQuotes( + { + status: req.query.status, + limit: req.query.limit, + page: req.query.page, + search: req.query.search, + // which column to search, whether to anchor it, and the date window + field: req.query.field, + exact: req.query.exact, + from: req.query.from, + to: req.query.to, + sort: req.query.sort, + }, + contextOf(req) + ); + return r.status ? ok(res, r.data, r.message, r.meta) : fail(res, r.message); + } catch (error) { + console.error('Error in quotes list:', error); + return fail(res, error.message, 500); + } + }, + + async getById(req, res) { + try { + if (!can(req, 'read')) return fail(res, 'Unauthorized access', 403); + const r = await repository.getQuote(req.params.id, contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message, 404); + } catch (error) { + console.error('Error in quotes getById:', error); + return fail(res, error.message, 500); + } + }, + + async transition(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const r = await repository.transition( + req.params.id, + req.body?.action, + req.body || {}, + contextOf(req) + ); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in quotes transition:', error); + return fail(res, error.message, 500); + } + }, + + async remove(req, res) { + try { + if (!can(req, 'write')) return fail(res, 'Unauthorized access', 403); + const r = await repository.deleteQuote(req.params.id, contextOf(req)); + return r.status ? ok(res, r.data, r.message) : fail(res, r.message); + } catch (error) { + console.error('Error in quotes remove:', error); + return fail(res, error.message, 500); + } + }, +}; diff --git a/api/src/controllers/receivings.controller.js b/api/src/controllers/receivings.controller.js index 06ee511fd..da07c2eb7 100644 --- a/api/src/controllers/receivings.controller.js +++ b/api/src/controllers/receivings.controller.js @@ -174,6 +174,57 @@ class ReceivingsController extends BaseController { } } + /* + * Void a purchase (G8): delete-level permission, reason mandatory, + * record kept, stock reversed, credit withdrawn. Never a delete. + */ + /* + * Receive goods in steps (international partial receiving): {all:true}, + * or {lines:[{item_id, qty}]}, plus {close_short:true} to cancel the + * remainder. Write access - receiving goods is the module's core act. + */ + async receive(req, res) { + try { + if (!this.checkPermission('receiving', 'write', req.user)) { + return this.error(res, 'Unauthorized', 403); + } + await this.ensureContext(req); + const result = await Receiving.receivePartial( + req.params.id, + { + all: req.body?.all === true, + lines: Array.isArray(req.body?.lines) ? req.body.lines : [], + close_short: req.body?.close_short === true, + }, + {} + ); + if (result.status === true) return this.success(res, result.data, result.message); + return this.error(res, result.message || 'Could not receive', 400); + } catch (error) { + console.error('Error in receive:', error); + return this.error(res, error.message, 500); + } + } + + async void(req, res) { + try { + if (!this.checkPermission('receiving', 'delete', req.user)) { + return this.error(res, 'Unauthorized - voiding needs delete access', 403); + } + await this.ensureContext(req); + const reason = String(req.body?.reason || '').trim(); + if (!reason) { + return this.error(res, 'A reason is required to void a purchase', 400); + } + const result = await Receiving.voidReceiving(req.params.id, reason, {}); + if (result.status === true) return this.success(res, null, result.message); + return this.error(res, result.message || 'Could not void this purchase', 400); + } catch (error) { + console.error('Error in void:', error); + return this.error(res, error.message, 500); + } + } + /** * PHP: edit() * Update an existing receiving order @@ -781,6 +832,74 @@ class ReceivingsController extends BaseController { * PHP: receivingReportTable() * Get receiving report table */ + /* + * Attach a document to a purchase: the supplier's own PO, an invoice + * scan, a delivery note. Owner: "we cant upload any file. supplier po or + * some other stuff." Files live under /uploads/attachments (multer wrote + * them before this runs); the receiving doc carries the metadata, so the + * purchase view can list and open them. + */ + async addAttachment(req, res) { + try { + if (req.user?.access?.receiving?.write === false) { + return this.error(res, 'Unauthorized', 403); + } + if (!req.file) { + return this.error(res, 'Attach a PDF or an image file.', 400); + } + const { ObjectId } = require('mongodb'); + const id = String(req.params.id || ''); + if (!ObjectId.isValid(id)) return this.error(res, 'Purchase not found', 404); + const meta = { + id: String(new ObjectId()), + name: String(req.file.originalname || 'attachment').slice(0, 120), + url: '/uploads/attachments/' + req.file.filename, + size: req.file.size || 0, + type: req.file.mimetype || '', + uploaded_by: (req.user && (req.user.username || req.user.email)) || '', + date: new Date(), + }; + const r = await req.db + .collection('receivings') + .updateOne({ _id: new ObjectId(id) }, { $push: { attachments: meta } }); + if (!r.matchedCount) { + /* A purchase ORDER id can arrive here too - the one purchases door + attaches to either record. */ + const po = await req.db + .collection('purchase_orders') + .updateOne({ _id: new ObjectId(id) }, { $push: { attachments: meta } }); + if (!po.matchedCount) return this.error(res, 'Purchase not found', 404); + } + return this.success(res, meta, 'Attached'); + } catch (error) { + console.error('Error in addAttachment:', error); + return this.error(res, error.message, 500); + } + } + + async removeAttachment(req, res) { + try { + if (req.user?.access?.receiving?.write === false) { + return this.error(res, 'Unauthorized', 403); + } + const { ObjectId } = require('mongodb'); + const id = String(req.params.id || ''); + const attId = String(req.params.attId || ''); + if (!ObjectId.isValid(id) || !attId) return this.error(res, 'Not found', 404); + const pull = { $pull: { attachments: { id: attId } } }; + const r = await req.db.collection('receivings').updateOne({ _id: new ObjectId(id) }, pull); + if (!r.modifiedCount) { + await req.db.collection('purchase_orders').updateOne({ _id: new ObjectId(id) }, pull); + } + /* The file itself stays on disk deliberately: a removed listing must + be recoverable by support, and disk is cheaper than a regret. */ + return this.success(res, { removed: attId }, 'Attachment removed'); + } catch (error) { + console.error('Error in removeAttachment:', error); + return this.error(res, error.message, 500); + } + } + async receivingReportTable(req, res) { try { if (!this.checkPermission('report', 'read', req.user)) { @@ -1334,26 +1453,44 @@ class ReceivingsController extends BaseController { await done; const pdfBuffer = Buffer.concat(chunks); - const { Email } = require('../utils/email'); - const transporter = new Email( - { email: to, name: receiving.supplier?.supplier_name }, - '' - ).newTransport(); + // Owner rule: the shop's own SMTP first, the platform chain otherwise. + const { resolveShopTransport } = require('../utils/email'); + const resolved = resolveShopTransport(branch); + const transporter = resolved.transporter; const shopName = branch.branch_name || 'Posnic POS'; const orderId = receiving.receiving_id || String(receiving._id); + const { brandFor, renderEmail, kvBlock } = require('../utils/email-layout'); + const brand = brandFor(branch); + const customMessage = String(req.body.message || '').trim(); const info = await transporter.sendMail({ - from: `${shopName} <${process.env.EMAIL_FROM || 'no-reply@posnic.local'}>`, + from: `${shopName} <${resolved.from}>`, to, subject: - String(req.body.subject || '').trim() || `Purchase order from ${shopName} (${orderId})`, - text: - String(req.body.message || '').trim() || - `Please find attached purchase order ${orderId} from ${shopName}.`, + String(req.body.subject || '').trim() || `Purchase order ${orderId} from ${shopName}`, + html: renderEmail({ + brand, + title: 'Purchase order', + preheader: `Purchase order ${orderId} from ${shopName} - PDF attached`, + greeting: receiving.supplier_name ? `Dear ${receiving.supplier_name},` : undefined, + bodyHtml: + '

' + + (customMessage + ? require('../utils/email-layout').esc(customMessage) + : 'Please find our purchase order attached as a PDF.') + + '

' + + kvBlock([ + ['Order #', orderId], + ['Items', receiving.number_of_items], + ['Order value', receiving.total_amount], + ]), + footerNote: 'Reply to this email to confirm availability and delivery.', + }), + text: customMessage || `Please find attached purchase order ${orderId} from ${shopName}.`, attachments: [{ filename: `${orderId}.pdf`, content: pdfBuffer }], }); /* The dev fallback transport prints to console instead of delivering - say so rather than claiming a send that never left the box. */ - if (transporter.options && transporter.options.jsonTransport) { + if (!resolved.shopOwned && transporter.options && transporter.options.jsonTransport) { return this.error( res, 'Email is not configured on this server - the PDF was generated but not sent', @@ -1424,7 +1561,12 @@ class ReceivingsController extends BaseController { branch_id: { $in: branchObjectIds }, // For supplier receiving summary, only include completed/partially returned // documents; exclude "Open" receivings from the report. - receiving_status: { $in: ['Received', 'PartialReturn'] }, + /* Deny-list, not allow-list. Legacy and imported rows carry other + spellings ('completed', absent entirely) and an allow-list of two + words silently dropped them from every purchase report and + dashboard number - the owner's "purchase not showing report". + Goods are IN unless the status says they never arrived. */ + receiving_status: { $nin: ['Open', 'Cancelled', 'FullReturn'] }, }, { updated_date: { $gte: fromDate, $lte: toDate }, diff --git a/api/src/controllers/sales.controller.js b/api/src/controllers/sales.controller.js index 48eebbd87..b881966d6 100644 --- a/api/src/controllers/sales.controller.js +++ b/api/src/controllers/sales.controller.js @@ -1,10 +1,31 @@ // src/controllers/sales_controller.js const BaseController = require('./base.controller'); +const { clientIp } = require('../utils/client-ip'); const { currentConnection } = require('../db/tenant-context'); const Sale = require('../models/sale.model'); const BaseModel = require('../models/base.model'); const mongoose = require('mongoose'); const salesService = require('../services/sale.service'); + +/* The branch doc carries the shop's own SMTP settings; owner rule is + theirs first, the platform chain otherwise. Absent config, bad ids + and read errors all fall through to the platform transport. */ +async function shopTransportOf(req) { + const { resolveShopTransport } = require('../utils/email'); + let branchDoc = null; + try { + const { ObjectId } = require('mongodb'); + const bid = req.user && req.user.branch_id; + if (bid && req.db && ObjectId.isValid(String(bid))) { + branchDoc = await req.db.collection('branches').findOne({ _id: new ObjectId(String(bid)) }); + } + } catch (e) { + /* platform chain covers it */ + } + /* The branch rides along: the mail LAYOUT needs the same document the + transport was resolved from (shop name, address, white-label). */ + return { ...resolveShopTransport(branchDoc), branch: branchDoc }; +} const ItemService = require('../services/item.service'); const LoyaltyService = require('../services/loyalty.service'); const loyaltyService = new LoyaltyService(); @@ -45,14 +66,43 @@ const path = require('path'); const fs = require('fs'); const { getRequestDeviceId } = require('../utils/device-id.util'); +/* + * The sale screen sends several of these fields as DISPLAY text, straight out + * of the totals row - "1,459.00", not 1459. Number.parseFloat stops at the + * thousands separator and returns 1, which made a 34-rupee discount look like + * 3400% of the bill and tripped the manager-approval cap on every discounted + * sale over a thousand rupees. The role's discount cap was therefore broken + * for exactly the bills big enough to need it. + * + * So: strip anything that is not part of a number, then work out which + * separator is the decimal one. The rightmost of '.' and ',' wins when both + * appear ("1,459.00" and "1.459,00" both parse); a lone comma is a thousands + * group only when every group is three digits, otherwise it is a decimal + * comma. NaN is preserved for genuinely non-numeric text because + * auditFirstNumber relies on it to fall through to the next candidate field. + */ +const parseAuditNumber = (value) => { + if (typeof value === 'number') return value; + let s = String(value === null || value === undefined ? '' : value).trim(); + if (!s) return NaN; + s = s.replace(/[^\d.,-]/g, ''); + const lastDot = s.lastIndexOf('.'); + const lastComma = s.lastIndexOf(','); + if (lastDot >= 0 && lastComma >= 0) { + s = lastComma > lastDot ? s.replace(/\./g, '').replace(',', '.') : s.replace(/,/g, ''); + } else if (lastComma >= 0) { + s = /^-?\d{1,3}(,\d{3})+$/.test(s) ? s.replace(/,/g, '') : s.replace(',', '.'); + } + return Number.parseFloat(s); +}; const auditNumber = (value) => { - const parsed = Number.parseFloat(value); + const parsed = parseAuditNumber(value); return Number.isFinite(parsed) ? parsed : 0; }; const auditFirstNumber = (...values) => { for (const value of values) { if (value === null || value === undefined || value === '' || value === 'undefined') continue; - const parsed = Number.parseFloat(value); + const parsed = parseAuditNumber(value); if (Number.isFinite(parsed)) return parsed; } return 0; @@ -195,7 +245,7 @@ const writeSaleAudit = async (req, action, entityId, description, changes) => { changes, branch: resolveBranchId(user, req.session) || BaseModel.currentBranch, license: user.license || user.licenseId || BaseModel.license, - ipAddress: req.ip, + ipAddress: clientIp(req), userAgent: typeof req.get === 'function' ? req.get('user-agent') : req.headers?.['user-agent'], }); @@ -497,7 +547,7 @@ class SalesController extends BaseController { if (r && !r.allowed) { return { blocked: true, - error: `Credit limit exceeded — limit ${r.limit}, already outstanding ${r.outstanding}, this sale would make it ${r.wouldBe}.`, + error: `Credit limit exceeded. Limit ${r.limit}, already outstanding ${r.outstanding}, this sale would make it ${r.wouldBe}.`, data: r, }; } @@ -540,12 +590,25 @@ class SalesController extends BaseController { // Then earn on what they actually paid (already net of the redemption). const amount = Number(sale.sales_total || sale.total || 0); if (amount > 0) { - await loyaltyService.earn(sale.customer_id, { + const earned = await loyaltyService.earn(sale.customer_id, { amount, saleId: sale._id || saleId, reference: sale.sales_id || '', ctx, }); + /* Hand the points back to the till. This runs before the response is + written, so attaching them here puts them in it - and the cashier + can tell the customer what they just earned while they are still + standing there, which is the only moment it is worth anything. + Absent or zero simply means the strip says nothing about loyalty. */ + const pts = Number(earned?.data?.points) || 0; + if (pts > 0) { + saleData.loyalty_earned = { + points: pts, + balance: Number(earned?.data?.balance) || 0, + tier: earned?.data?.tier || '', + }; + } // If this is the referred customer's first qualifying purchase, reward // both them and whoever referred them. await loyaltyService.grantReferralIfEligible(sale.customer_id, { @@ -984,6 +1047,23 @@ class SalesController extends BaseController { sortBy: 'created_date:desc,_id:desc', }; + /* + * Sort, whitelisted (owner: highest bill, most items, date). Only + * these names reach the query - a raw client-supplied field would + * sort by anything on the document. + */ + const SALE_SORTS = { + recent: 'created_date:desc,_id:desc', + date_desc: 'date:desc,_id:desc', + date_asc: 'date:asc,_id:asc', + total_desc: 'sales_total:desc,_id:desc', + total_asc: 'sales_total:asc,_id:desc', + items_desc: 'number_of_items:desc,_id:desc', + }; + if (SALE_SORTS[req.query.sort]) { + options.sortBy = SALE_SORTS[req.query.sort]; + } + const result = await salesService.listSales(filter, options, { SaleModel }); const docs = Array.isArray(result?.results) ? result.results : []; @@ -1113,7 +1193,7 @@ class SalesController extends BaseController { } // Fallback: body itself may be an array or an object like - // { "0": "id1", "1": "id2" } – treat all string values as IDs. + // { "0": "id1", "1": "id2" } - treat all string values as IDs. if (Array.isArray(body)) { return body; } @@ -1196,6 +1276,8 @@ class SalesController extends BaseController { { branchId, licenseId: BaseModel.license, + // type=hold: the sale screen's Parked tab - holds only, more rows. + holdOnly: req.query?.type === 'hold', }, { SaleModel } ); @@ -3148,7 +3230,82 @@ class SalesController extends BaseController { }), { net: 0, tax: 0, gross: 0 } ); - return this.success(res, { list, totals }, 'Tax summary retrieved successfully'); + + /* + * THE INPUT SIDE. Owner: "for GST we need to know how we already paid + * tax while purchase. so that we know exactly how much need to pay." + * That is the standard GST position (GSTR-3B shape): tax COLLECTED on + * outward supplies, minus the INPUT TAX CREDIT already paid to + * suppliers on inward supplies, is what the period actually owes. + * Purchases have carried per-line tax and tax_percentage since the + * receiving form gained exclusive tax - it was recorded and never + * accounted. Failure here degrades to an absent block, never a dead + * sales summary. + */ + const purchases = { list: [], totals: { net: 0, tax: 0, gross: 0 } }; + try { + const num = (expr) => ({ + $convert: { input: expr, to: 'double', onError: 0, onNull: 0 }, + }); + const rMatch = { + branch_id: { $in: branchIds }, + del_status: { $nin: [1, '1', true] }, + }; + if (Object.keys(dateFilter).length) rMatch.date = dateFilter; + const rrows = await req.db + .collection('receivings') + .aggregate([ + { $match: rMatch }, + { $unwind: '$items' }, + { + $group: { + _id: num('$items.tax_percentage'), + tax: { $sum: num('$items.tax') }, + net: { + $sum: { + $multiply: [num('$items.item_price'), num('$items.item_quantity')], + }, + }, + lines: { $sum: 1 }, + }, + }, + { $sort: { _id: 1 } }, + ]) + .toArray(); + purchases.list = rrows.map((r) => ({ + rate: roundToTwo(r._id || 0), + net: roundToTwo(r.net || 0), + tax: roundToTwo(r.tax || 0), + gross: roundToTwo((r.net || 0) + (r.tax || 0)), + lines: r.lines || 0, + })); + purchases.totals = purchases.list.reduce( + (acc, r) => ({ + net: roundToTwo(acc.net + r.net), + tax: roundToTwo(acc.tax + r.tax), + gross: roundToTwo(acc.gross + r.gross), + }), + { net: 0, tax: 0, gross: 0 } + ); + } catch (purchErr) { + console.error('taxSummary: purchase side skipped:', purchErr.message); + } + + /* The position, stated the way it is owed. A period where credit + exceeds output does not go negative - the excess carries forward, + which is how GST actually works. */ + const gst = { + output_tax: totals.tax, + input_tax_credit: purchases.totals.tax, + net_payable: roundToTwo(Math.max(0, totals.tax - purchases.totals.tax)), + credit_carry_forward: roundToTwo(Math.max(0, purchases.totals.tax - totals.tax)), + }; + + return this.success( + res, + { list, totals, purchases, gst }, + 'Tax summary retrieved successfully' + ); } catch (error) { console.error('Error in taxSummaryReportTable:', error); return this.error(res, 'Unable to load the tax summary. Please try again later.', 500, { @@ -4970,38 +5127,55 @@ class SalesController extends BaseController { return this.error(res, ERROR_MESSAGES.SALE_NOT_FOUND, 404); } - // Send email receipt (basic implementation - enhance based on email service) - const nodemailer = require('nodemailer'); - - // Configure email transporter - const transporter = nodemailer.createTransport({ - host: process.env.SMTP_HOST || 'smtp.gmail.com', - port: process.env.SMTP_PORT || 587, - secure: false, - auth: { - user: process.env.SMTP_USER, - pass: process.env.SMTP_PASSWORD, - }, - }); - - // Email content + // Shop SMTP first, platform chain otherwise (owner rule). + const resolved = await shopTransportOf(req); + const transporter = resolved.transporter; + + // Email content - the shared layout, not a bare

(owner: "not + // just unprofessional few text"). + const { + brandFor, + renderEmail, + kvBlock, + itemsTable, + totalRow, + } = require('../utils/email-layout'); + const brand = brandFor(resolved.branch || { branch_name: req.user?.branch_name }); + const currency = (resolved.branch && resolved.branch.currency) || ''; + const lines = (Array.isArray(sale.items) ? sale.items : []).map((it) => ({ + name: it.item_name || it.name || '', + qty: it.item_quantity || it.quantity || '', + price: Number(it.item_price ?? it.price ?? it.unit_price) || 0, + total: Number(it.total_amount ?? it.total) || 0, + })); const emailContent = { - from: process.env.EMAIL_FROM || 'noreply@posnic.com', + from: `${brand.shopName || brand.name} <${resolved.from}>`, to: email, - subject: `Receipt - ${sale.sales_id}`, - html: ` -

Sale Receipt

-

Invoice #: ${sale.sales_id}

-

Date: ${new Date(sale.date).toLocaleDateString()}

-

Customer: ${sale.customer_name}

-

Total: ${sale.items_total}

-

Payment Mode: ${sale.payment_mode}

-

Thank you for your business!

- `, + subject: `Receipt ${sale.sales_id} from ${brand.shopName || brand.name}`, + html: renderEmail({ + brand, + title: 'Your receipt', + preheader: `Receipt ${sale.sales_id} - thank you for your purchase`, + greeting: sale.customer_name ? `Dear ${sale.customer_name},` : undefined, + bodyHtml: + kvBlock([ + ['Receipt #', sale.sales_id], + ['Date', new Date(sale.date).toLocaleDateString()], + ['Payment', sale.payment_mode], + ]) + + (lines.length ? itemsTable(lines, currency) : '') + + totalRow('Total', Number(sale.items_total) || sale.items_total, currency), + footerNote: 'Thank you for your business - we hope to see you again.', + }), }; try { await transporter.sendMail(emailContent); + /* The dev fallback transport prints to console instead of + delivering - say so rather than claiming a send. */ + if (!resolved.shopOwned && transporter.options && transporter.options.jsonTransport) { + return this.error(res, 'Email is not configured on this server - nothing was sent', 503); + } return this.success(res, { sent: true }, 'Receipt sent successfully'); } catch (emailError) { console.error('Email error:', emailError); @@ -5056,7 +5230,7 @@ class SalesController extends BaseController { return this.error(res, ERROR_MESSAGES.SALE_NOT_FOUND, 404); } - // Format print details — must match PHP getCustomerPrintDetails() exactly, + // Format print details - must match PHP getCustomerPrintDetails() exactly, // because the frontend (customer_mail.js) reads these precise field names // and calls .toFixed()/loops on them. A missing field (e.g. sales_sub_total) // throws in the browser and blanks the whole receipt below the header. @@ -5217,9 +5391,19 @@ class SalesController extends BaseController { const pdfBuffer = Buffer.concat(chunks); const crypto = require('crypto'); - const year = new Date().getFullYear(); - const licensePart = String(sale.license || 'shop').slice(-8); - const key = `invoices/${licensePart}/${year}/${crypto.randomBytes(16).toString('hex')}.pdf`; + /* + * i/, nothing else (owner: "link can make short"). The key IS + * the secret and the whole path a customer sees - 12 url-safe chars + * carry 72 random bits, and behind the short domain the link reads + * https://xbill.in/i/AbC9xYz12Qw3. No folders: the DB holds the key + * per sale, and a path that organises nothing for anyone reading it + * only makes the message longer. No .pdf either - the object's + * content type renders it. Old invoices/... keys stay served. + */ + /* One short domain for EVERY instance (owner): each non-production + * instance namespaces its keys with SHARE_LINK_PREFIX (demo: 'd/'), + * and CloudFront routes each prefix to that instance's bucket. */ + const key = `${process.env.SHARE_LINK_PREFIX || ''}i/${crypto.randomBytes(9).toString('base64url')}`; const { PutObjectCommand } = require('@aws-sdk/client-s3'); await getS3Client().send( @@ -5228,6 +5412,9 @@ class SalesController extends BaseController { Key: key, Body: pdfBuffer, ContentType: 'application/pdf', + // The short key has no extension, so the object names its own + // download - the browser renders inline and saves a real .pdf. + ContentDisposition: `inline; filename="invoice-${String(sale.sales_id || 'invoice').replace(/[^\w.-]/g, '_')}.pdf"`, }) ); @@ -5280,31 +5467,31 @@ class SalesController extends BaseController { doc.on('end', async () => { const pdfBuffer = Buffer.concat(chunks); - // Send email with PDF attachment - const nodemailer = require('nodemailer'); - const transporter = nodemailer.createTransport({ - host: process.env.SMTP_HOST || 'smtp.gmail.com', - port: process.env.SMTP_PORT || 587, - secure: false, - auth: { - user: process.env.SMTP_USER, - pass: process.env.SMTP_PASSWORD, - }, - }); + // Shop SMTP first, platform chain otherwise (owner rule). + const resolved = await shopTransportOf(req); + const transporter = resolved.transporter; try { + const { brandFor, renderEmail, kvBlock } = require('../utils/email-layout'); + const brand = brandFor(resolved.branch || { branch_name: req.user?.branch_name }); await transporter.sendMail({ - from: process.env.EMAIL_FROM || 'noreply@posnic.com', + from: `${brand.shopName || brand.name} <${resolved.from}>`, to: email, - subject: `Invoice - ${sale.sales_id}`, - html: ` -

Invoice

-

Dear ${sale.customer_name},

-

Please find attached your invoice.

-

Invoice #: ${sale.sales_id}

-

Amount: ${sale.items_total}

-

Thank you for your business!

- `, + subject: `Invoice ${sale.sales_id} from ${brand.shopName || brand.name}`, + html: renderEmail({ + brand, + title: 'Your invoice', + preheader: `Invoice ${sale.sales_id} attached as PDF`, + greeting: sale.customer_name ? `Dear ${sale.customer_name},` : undefined, + bodyHtml: + '

' + + 'Please find your invoice attached as a PDF.

' + + kvBlock([ + ['Invoice #', sale.sales_id], + ['Amount', sale.items_total], + ]), + footerNote: 'Thank you for your business!', + }), attachments: [ { filename: `invoice-${sale.sales_id}.pdf`, @@ -5314,6 +5501,13 @@ class SalesController extends BaseController { ], }); + if (!resolved.shopOwned && transporter.options && transporter.options.jsonTransport) { + return this.error( + res, + 'Email is not configured on this server - nothing was sent', + 503 + ); + } return this.success(res, { sent: true, email }, 'PDF invoice emailed successfully'); } catch (emailError) { console.error('Email error:', emailError); @@ -6080,6 +6274,55 @@ class SalesController extends BaseController { } } + /* + * The Tax Payable view (PURCHASE_TAX_PLAN P4): months of output vs input + * tax and the net owed per head, credits applied in the statutory order. + */ + async taxPayable(req, res) { + try { + if (req.user?.access?.report?.read !== true) { + return this.error(res, ERROR_MESSAGES.UNAUTHORIZED, 403); + } + const data = { + starting_date: req.query.starting_date, + ending_date: req.query.ending_date, + branch_id: req.session?.branch_id, + license: req.user?.license, + }; + const response = await salesService.taxPayablePage(data); + if (response.status === true) { + return this.success(res, response.data, SUCCESS_MESSAGES.GET_SUCCESSFULLY); + } + return this.error(res, response.message || ERROR_MESSAGES.SALES_DETAILS_NOT_FOUND, 404); + } catch (error) { + console.error('Error in taxPayable:', error); + return this.error(res, error.message, 500); + } + } + + /* The purchase register beneath it - the accountant's working paper. */ + async taxPayableRegister(req, res) { + try { + if (req.user?.access?.report?.read !== true) { + return this.error(res, ERROR_MESSAGES.UNAUTHORIZED, 403); + } + const data = { + starting_date: req.query.starting_date, + ending_date: req.query.ending_date, + branch_id: req.session?.branch_id, + license: req.user?.license, + }; + const response = await salesService.taxPayableRegisterPage(data); + if (response.status === true) { + return this.success(res, response.data, SUCCESS_MESSAGES.GET_SUCCESSFULLY); + } + return this.error(res, response.message || ERROR_MESSAGES.SALES_DETAILS_NOT_FOUND, 404); + } catch (error) { + console.error('Error in taxPayableRegister:', error); + return this.error(res, error.message, 500); + } + } + /** * PHP: gstOneReportTableJson() * Get GST-1 report as JSON @@ -6138,8 +6381,8 @@ class SalesController extends BaseController { return this.error(res, ERROR_MESSAGES.VALID_EMAIL_REQUIRED, 400); } - const userAccess = req.user?.access?.report?.read; - if (userAccess !== true) { + // Standard check - the raw read lacked the owner-class bypass. + if (!this.checkPermission('report', 'read', req.user)) { return this.error(res, 'Unauthorized', 403); } @@ -6148,14 +6391,17 @@ class SalesController extends BaseController { } const SaleModel = this.model || Sale; + const resolvedBranch = await shopTransportOf(req); const response = await salesService.sendDailySalesMail(input, { SaleModel, + shopTransport: resolvedBranch, }); if (response.status) { return this.success(res, response.data, response.message || 'Mail sent'); } else { - return this.error(res, response.message || 'Mail failed', 502); + // 503 with the real reason - a mail-config gap is not a gateway fault. + return this.error(res, response.message || 'Email is not configured on this server', 503); } } catch (error) { console.error('Error in dailySalesMail:', error); @@ -6581,7 +6827,7 @@ class SalesController extends BaseController { /** * PHP: multiKitchenPrint() - * Multi-printer KOT polling — returns pending print_jobs per sale + * Multi-printer KOT polling - returns pending print_jobs per sale */ async multiKitchenPrint(req, res) { try { @@ -6641,8 +6887,9 @@ class SalesController extends BaseController { */ async getNewSale(req, res) { try { - const userAccess = req.user?.access?.sales?.write; - if (userAccess !== true) { + // The standard check carries the owner-class bypass the raw access + // read lacked - super admins 403d here on the unpaid path. + if (!this.checkPermission('sales', 'write', req.user)) { return this.error(res, ERROR_MESSAGES.UNAUTHORIZED, 403); } @@ -7331,3 +7578,10 @@ class SalesController extends BaseController { } module.exports = new SalesController(); +/* + * Exposed for tests: the discount-cap estimate decides whether a sale is + * refused for want of manager approval, and it is worth pinning directly + * rather than only through a full request. + */ +module.exports.estimateManualDiscountPct = estimateManualDiscountPct; +module.exports.auditNumber = auditNumber; diff --git a/api/src/controllers/settings-groups.controller.js b/api/src/controllers/settings-groups.controller.js new file mode 100644 index 000000000..014c398bd --- /dev/null +++ b/api/src/controllers/settings-groups.controller.js @@ -0,0 +1,191 @@ +'use strict'; + +/* + * One endpoint per settings group (SETTINGS_AND_BRANCH_SCOPE_DESIGN, D2/S3). + * + * The whole point: an endpoint that only knows its own group cannot be asked + * for a field that belongs to another one. The three bugs of 2026-08-20 were + * all the same shape - a single endpoint serving both the full settings form + * and small partial saves, demanding fields the caller never had: + * + * - a non-empty notification_value on every call (5c84111) + * - one $set built from the whole form, wiping unsent keys (5c84111) + * - default_customer / default_supplier required to upload a signature + * image (69bc0cd) + * + * None of those can be expressed here. + * + * SECRETS ARE WRITE-ONLY. GET /settings/secrets answers which credentials are + * configured, never their values. Today an SMTP password sits in the same + * document as roundOff and is handed to any client that reads settings; this + * is where that stops. + */ + +const SettingsRepository = require('../repositories/settings.repository'); +const { GROUPS } = require('../services/settings-groups'); +const dataSharing = require('../services/data-sharing'); + +const repository = new SettingsRepository(); + +const GROUP_NAMES = Object.keys(GROUPS); + +function contextOf(req) { + const user = req.user || {}; + return { + branchId: + req.tenantContext?.branchId || + req.session?.selectedBranchId || + req.session?.branch_id || + user.branch_id || + (Array.isArray(user.branch_access) && user.branch_access[0]?.branch_id) || + null, + licenseId: req.tenantContext?.licenseId || user.license || user.license_id || null, + }; +} + +/* Reading settings needs the settings permission; writing needs it too, and + secrets additionally require an owner-class account - a cashier has no + business setting the shop's outgoing mail password. */ +const canRead = (req) => req.user?.access?.setting?.read !== false; +const canWrite = (req) => req.user?.access?.setting?.write !== false; +const OWNER_TYPES = ['owner', 'admin', 'super_admin', 'manager', 'store_manager']; +const isOwnerClass = (req) => + OWNER_TYPES.includes(String(req.user?.usertype || req.user?.role || '').toLowerCase()); + +/* Which branches this user may act on. A copy touches TWO of them, and the + destination is the dangerous one - it is the branch being overwritten. An + account with no branch_access list is an unrestricted one (owner/admin), so + an empty list means "all", not "none". */ +const branchesAllowed = (req) => { + const list = req.user?.branch_access; + if (!Array.isArray(list) || !list.length) return null; // null = unrestricted + return new Set(list.map((b) => String(b?.branch_id || b))); +}; +const mayTouchBranch = (req, branchId) => { + const allowed = branchesAllowed(req); + return allowed === null || allowed.has(String(branchId)); +}; + +const fail = (res, message, code = 400, data = null) => + res.status(code).json({ type: 'error', message, data }); +const ok = (res, data, message) => res.json({ type: 'success', message, data }); + +/* Which secrets exist, never what they are. */ +const describeSecrets = (values) => { + const out = {}; + for (const key of GROUPS.secrets) { + const v = values[key]; + // a boolean flag is enough to render "configured / not configured" + out[key] = v !== undefined && v !== null && String(v) !== ''; + } + return out; +}; + +module.exports = { + async read(req, res) { + try { + if (!canRead(req)) return fail(res, 'Unauthorized access', 403); + const group = String(req.params.group || ''); + if (!GROUP_NAMES.includes(group)) return fail(res, 'Unknown settings group', 404); + if (group === 'secrets' && !isOwnerClass(req)) { + return fail(res, 'Unauthorized access', 403); + } + + /* ?level=account reads what the ACCOUNT itself decides, unresolved. + Editing a shop-wide rule must not start from one branch's override - + saving that back would push that branch's choice onto every other + shop without anyone asking for it. */ + const wantsAccount = String(req.query?.level || '') === 'account'; + const r = wantsAccount + ? await repository.accountGroup(group, contextOf(req)) + : await repository.resolveGroup(group, contextOf(req)); + if (!r.status) return fail(res, r.message); + + if (group === 'secrets') { + // values, and now `inherited` too, never leave for this group + return ok(res, { group, configured: describeSecrets(r.data.values) }, 'success'); + } + return ok(res, r.data, 'success'); + } catch (error) { + console.error('Error in settings-groups read:', error); + return fail(res, error.message, 500); + } + }, + + /* + * S6 (D4). Copy settings from one branch to another. + * + * Owner-class only, and both branches must be ones this account may act on - + * the destination especially, since that is the branch being overwritten. + * Secrets are refused by name rather than quietly dropped: a caller that + * asked to copy credentials should be told it did not happen. + */ + async copy(req, res) { + try { + if (!canWrite(req)) return fail(res, 'Unauthorized access', 403); + if (!isOwnerClass(req)) return fail(res, 'Unauthorized access', 403); + + const body = req.body && typeof req.body === 'object' ? req.body : {}; + const from = body.from || contextOf(req).branchId; + const to = body.to; + if (!to) return fail(res, 'Pick a branch to copy to'); + for (const [label, id] of [ + ['source', from], + ['destination', to], + ]) { + if (!mayTouchBranch(req, id)) { + return fail(res, `You do not have access to the ${label} branch`, 403); + } + } + + const groups = Array.isArray(body.groups) ? body.groups : []; + const r = await repository.copyGroups(groups, from, to, { + licenseId: contextOf(req).licenseId, + }); + if (!r.status) return fail(res, r.message, 400, r.data); + return ok(res, r.data, 'Settings copied'); + } catch (error) { + console.error('Error in settings-groups copy:', error); + return fail(res, error.message, 500); + } + }, + + async write(req, res) { + try { + if (!canWrite(req)) return fail(res, 'Unauthorized access', 403); + const group = String(req.params.group || ''); + if (!GROUP_NAMES.includes(group)) return fail(res, 'Unknown settings group', 404); + /* + * `sharing` is owner-class to WRITE, like secrets - and for the same + * reason, though it is not a credential. It is the only group where a + * value decides what data a person can READ: switching it on makes every + * shop's customers visible from every till at once. Reading it is left + * open, because a screen has to be able to say why a list looks the way + * it does. + */ + if ((group === 'secrets' || group === 'sharing') && !isOwnerClass(req)) { + return fail(res, 'Unauthorized access', 403); + } + + const body = req.body && typeof req.body === 'object' ? req.body : {}; + /* `level` is how a value is set for every branch at once. It is not a + settings key, so it is pulled out before the payload is validated - + otherwise it would be refused as belonging to no group. */ + const { level, ...values } = body; + if (level && level !== 'account' && level !== 'branch') { + return fail(res, "level must be 'account' or 'branch'"); + } + + const r = await repository.saveGroup(group, values, contextOf(req), { level }); + if (!r.status) return fail(res, r.message, 400, r.data); + /* The read path caches this for thirty seconds. Whoever just flipped the + switch must not be told to wait for it - the delay exists for OTHER + processes serving the same account, not for the person at the screen. */ + if (group === 'sharing') dataSharing.invalidate(contextOf(req).licenseId); + return ok(res, r.data, 'Settings saved'); + } catch (error) { + console.error('Error in settings-groups write:', error); + return fail(res, error.message, 500); + } + }, +}; diff --git a/api/src/controllers/settings.controller.js b/api/src/controllers/settings.controller.js index 771b1fee3..2405ab7fc 100644 --- a/api/src/controllers/settings.controller.js +++ b/api/src/controllers/settings.controller.js @@ -1,6 +1,7 @@ const fs = require('fs').promises; const path = require('path'); const BaseController = require('./base.controller'); +const { clientIp } = require('../utils/client-ip'); const SettingModel = require('../models/setting.model'); const settingsService = require('../services/setting.service'); @@ -121,6 +122,12 @@ class SettingController extends BaseController { branchId, licenseId, user: req.user, + /* Carried so security-relevant writes can record where they came from. + Models have never seen a request, which is exactly why the change log + has no addresses in it and why a changed password could not be traced + to anybody. */ + ip: clientIp(req), + userAgent: (req.headers && req.headers['user-agent']) || '', }); return model; } @@ -282,14 +289,9 @@ class SettingController extends BaseController { const data = req.query?.data || this.parseNestedQueryParam(req.query, 'data') || {}; const customerId = data.customer || req.query.customer; - if (!customerId) { - return res.status(400).json({ - type: 'error', - message: 'Customer ID is required', - data: null, - }); - } - + // No early refusal: the model self-heals a missing id from the branch + // context (finds or creates the branch's Walk-in) and only a truly + // contextless call fails. The 400 here kept the heal dead code. const settingModel = this.createModelWithContext(req); const result = await settingModel.getDefaultCustomer(customerId); @@ -325,14 +327,7 @@ class SettingController extends BaseController { const data = req.query?.data || this.parseNestedQueryParam(req.query, 'data') || {}; const supplierId = data.supplier || req.query.supplier; - if (!supplierId) { - return res.status(400).json({ - type: 'error', - message: 'Supplier ID is required', - data: null, - }); - } - + // Same rule as the customer: heal in the model, never refuse here. const settingModel = this.createModelWithContext(req); const result = await settingModel.getDefaultSupplier(supplierId); @@ -365,14 +360,7 @@ class SettingController extends BaseController { const customerId = data.customer || req.query.customer || req.query.customer_id; const supplierId = data.supplier || req.query.supplier || req.query.supplier_id; - if (!customerId || !supplierId) { - return res.status(400).json({ - type: 'error', - message: 'Customer and supplier ids are required', - data: null, - }); - } - + // Both ids heal in the model from the branch context. const settingModel = this.createModelWithContext(req); const result = await settingModel.getDefaultCustomerSupplier(customerId, supplierId); @@ -512,6 +500,28 @@ class SettingController extends BaseController { } } + async updateStarterLocale(req, res) { + try { + const settingModel = this.createModelWithContext(req); + settingsService.setModel(settingModel); + + const result = await settingsService.updateStarterLocale(req.body); + if (result.status) { + return res + .status(200) + .json({ type: 'success', message: 'Starter settings updated', data: result.data }); + } + return res.status(404).json({ + type: 'error', + message: result.message || 'Starter settings not updated', + data: result.data, + }); + } catch (error) { + console.error('Error updating starter locale:', error); + return res.status(500).json({ type: 'error', message: error.message }); + } + } + /* * One branch's module switches (M4 branch selector). Any branch of THIS * license only - the model's license filter is the wall; a foreign id @@ -546,32 +556,35 @@ class SettingController extends BaseController { const data = req.body; - // Sales prefix validation (exact length check not in middleware) - if (data.sales_prefix && data.sales_prefix.length !== 3) { - return res.status(400).json({ - type: 'error', - message: 'Data Not Valid: sales_prefix required (exactly 3 chars)', - data: null, - }); - } - if (!data.receiving_prefix || data.receiving_prefix.length !== 3) { + /* + * Prefixes: 1-6 characters. The old exactly-3 rule rejected the + * form's own default ('S'), so every settings save on such shops + * failed with a 400 and the form reset - toggles never persisted + * (owner's "I enabled quote and I see reset form"). + */ + if (data.sales_prefix && (data.sales_prefix.length < 1 || data.sales_prefix.length > 6)) { return res.status(400).json({ type: 'error', - message: 'Data Not Valid: receiving_prefix required (exactly 3 chars)', + message: 'Data Not Valid: sales_prefix must be 1-6 characters', data: null, }); } if ( - data.notification_value === undefined || - data.notification_value === null || - data.notification_value === '' + data.receiving_prefix !== undefined && + (String(data.receiving_prefix).length < 1 || String(data.receiving_prefix).length > 6) ) { return res.status(400).json({ type: 'error', - message: 'Data Not Valid: notification_value required', + message: 'Data Not Valid: receiving_prefix must be 1-6 characters', data: null, }); } + /* + * notification_value is OPTIONAL. Requiring it non-empty broke every + * shop that simply has no notification range configured: the Features + * save and the signature save both 400'd on a field their forms don't + * own. Empty means "none" and partial payloads may omit it entirely. + */ const result = await settingsService.updateCommonSettings(data); @@ -782,7 +795,7 @@ class SettingController extends BaseController { return res.status(400).json({ type: 'error', message: 'Valid email required' }); } const settingModel = this.createModelWithContext(req); - const result = await settingModel.getForgotUserDetails(req.body.email); + const result = await settingModel.getForgotUserDetails(req.body.email, req); if (result.status) { return res .status(200) diff --git a/api/src/controllers/shadow-login.controller.js b/api/src/controllers/shadow-login.controller.js index c0dee5a43..82db49bad 100644 --- a/api/src/controllers/shadow-login.controller.js +++ b/api/src/controllers/shadow-login.controller.js @@ -39,6 +39,16 @@ const BaseModel = require('../models/base.model'); otherwise the console could mint a permanent key to any shop by accident. */ const MAX_LIFETIME_SEC = 120; +function clientIp(req) { + const forwardedFor = req.headers && req.headers['x-forwarded-for']; + const forwardedIp = Array.isArray(forwardedFor) + ? forwardedFor[0] + : String(forwardedFor || '') + .split(',')[0] + .trim(); + return req.ip || req.connection?.remoteAddress || forwardedIp || 'unknown'; +} + async function shadowLogin(req, res) { const token = req.query.token || req.body?.token; if (!token) return res.status(400).send('This link is missing its token.'); @@ -77,10 +87,30 @@ async function shadowLogin(req, res) { * only needed for as long as a token could still be replayed. */ const spent = db.collection('shadow_login_tokens'); + /* + * Who is behind this link: the shop's owner, or one of our staff. + * + * `claims.actor` is the answer web-api now signs into the token. It used to + * be inferred by exact-matching a human-readable reason string, which meant + * that rewording the sentence would silently reclassify every owner sign-in + * as support and stop recording any of them. The string is still accepted so + * tokens minted by an older web-api keep working. + */ + const shadowActor = + claims.actor === 'owner' || claims.reason === 'owner sign-in from posnic.com' + ? 'owner' + : 'support'; try { await spent.createIndex({ jti: 1 }, { unique: true, name: 'jti_once' }); await spent.createIndex({ usedAt: 1 }, { expireAfterSeconds: 24 * 60 * 60, name: 'jti_ttl' }); - await spent.insertOne({ jti: claims.jti, usedAt: new Date(), by: claims.by || null }); + await spent.insertOne({ + jti: claims.jti, + usedAt: new Date(), + by: claims.by || null, + reason: claims.reason || null, + actor: shadowActor, + from: claims.from || null, + }); } catch (e) { if (e && e.code === 11000) { return res.status(401).send('This link has already been used. Ask for a new one.'); @@ -160,7 +190,76 @@ async function shadowLogin(req, res) { * and dated. One day, because that is what a normal sign-in uses and a * support session has no business outliving it. */ - const payload = JSON.stringify({ token: authToken, user: user.email }); + /* + * The identity fields a NORMAL sign-in stores, not just the token. + * + * The page stored token + email and nothing else, and the frontend reads + * localStorage for the rest: usertype gates admin-only screens (the + * first-run welcome refused its bypass because usertype was null), + * username's ABSENCE makes the ajax layer bounce any failed call to + * login.html, and branchname/branch_id feed the header and the per-shop + * keys. Every shadow session - which is also how the owner opens shops + * from My Account - ran half-signed-in, and each missing field failed as + * its own separate mystery. + */ + /* + * Where to land after signing in. The diagnostic rig needs this: a page + * that only breaks on #/variants or one item's view can't be captured by + * a run that always lands on the dashboard, and a second browser launch + * loses the first one's storage when the harness kills Chrome before the + * profile flushes. One launch, straight to the route, is the only shape + * that always works. Strictly a hash ROUTE - a handful of safe characters, + * never a URL - so this can't become an open redirect or script injection. + */ + const nextRaw = String((req.query && req.query.next) || ''); + const nextRoute = /^[a-zA-Z0-9/_-]{1,80}$/.test(nextRaw) ? nextRaw : ''; + const firstBranch = + Array.isArray(user.branch_access) && user.branch_access[0] ? user.branch_access[0] : {}; + if (shadowActor === 'owner') { + const branchId = user.branch_id || firstBranch.branch_id; + const licenseId = user.license || user.license_id; + if (branchId && licenseId) { + const activity = await BaseModel.changeUserLog( + user._id, + user.username || user.name || user.email, + new Date(), + branchId, + firstBranch.branch_name || '', + licenseId, + { + userAgent: req.headers['user-agent'] || '', + ip: clientIp(req), + /* + * 'signup' when this is the shop being opened for somebody the + * moment they created it. That is not the same event as a customer + * choosing to come back, and the console needs to tell them apart or + * "opened the shop" ends up measuring our own redirect. + */ + source: claims.from === 'signup' ? 'signup' : 'owner_link', + } + ); + if (!activity || activity.status === false) { + // eslint-disable-next-line no-console + console.warn('shadow owner activity log failed:', activity && activity.message); + } + } else { + // eslint-disable-next-line no-console + console.warn('shadow owner activity log skipped: branch or license missing'); + } + } + const payload = JSON.stringify({ + next: nextRoute, + token: authToken, + user: user.email, + username: user.username || user.name || user.email, + usertype: user.usertype || '', + branch_id: user.branch_id + ? String(user.branch_id) + : firstBranch.branch_id + ? String(firstBranch.branch_id) + : '', + branch_name: firstBranch.branch_name || '', + }); res.set('content-type', 'text/html; charset=utf-8'); /* Never cached, never indexed. For the next two hours this page body is a working credential for someone else's shop. */ @@ -176,6 +275,12 @@ async function shadowLogin(req, res) { (function () { var d = ${payload}; try { localStorage.setItem('posnic_jwt_token', d.token); } catch (e) {} + try { + if (d.username) localStorage.setItem('username', d.username); + if (d.usertype) localStorage.setItem('usertype', d.usertype); + if (d.branch_id) localStorage.setItem('branch_id_set', d.branch_id); + if (d.branch_name) localStorage.setItem('branchname', d.branch_name); + } catch (e) {} /* The other half a real sign-in sets. Without it the app has the token and still redirects to login.html - see the comment above this template. */ try { @@ -184,8 +289,9 @@ async function shadowLogin(req, res) { document.cookie = 'loginuser=yes; expires=' + until.toGMTString() + '; path=/'; } catch (e) {} /* replace, not assign: the back button should not return to a page that - still holds the token in its source. */ - location.replace('/'); + still holds the token in its source. d.next is server-sanitised to a + bare hash route (letters, digits, slash, dash, underscore only). */ + location.replace(d.next ? '/dashboard.html#/' + d.next : '/'); })(); `); } diff --git a/api/src/controllers/users.controller.js b/api/src/controllers/users.controller.js index c37025964..337ee9ecc 100644 --- a/api/src/controllers/users.controller.js +++ b/api/src/controllers/users.controller.js @@ -1,4 +1,5 @@ const { redact } = require('../utils/redact'); +const { clientIp } = require('../utils/client-ip'); const { currentConnection } = require('../db/tenant-context'); const { searchPattern } = require('../utils/safe-search'); const BaseController = require('./base.controller'); @@ -13,6 +14,23 @@ const BaseModel = require('../models/base.model'); const { authCookieOptions } = require('../utils/auth-cookie'); const sessionFilterUtil = require('../utils/session-filter.util'); const { setActiveTenantContext } = require('../utils/tenant-context'); +const { recordAudit } = require('../utils/audit-trail'); + +/* + * What somebody sees when a sign-in fails. + * + * Shown for BOTH an unknown user and a wrong password, on purpose: telling + * them apart would let anybody enumerate which emails have accounts here. + * + * The old wording was "Invalid account. Please contact your branch manager." + * A sole shop owner locked out of their own till read that as an instruction + * to contact himself, and it said nothing about the thing that had actually + * happened - somebody had changed the password the day before. Naming that + * possibility costs nothing, leaks nothing, and is the first thing to try. + */ +const LOGIN_FAILED_MESSAGE = + 'Username or password is incorrect. If the password was changed recently, ' + + 'use the new one - otherwise ask an administrator to reset it.'; const persistActiveTenant = async (req, data, fallbackLicense) => { const context = setActiveTenantContext(req, { @@ -202,6 +220,40 @@ class UsersController extends BaseController { * The frontend posts { username, password } to /users/verify. * This method authenticates the user, checks rate limiting, and returns user data with JWT token. */ + /* + * Record a failed sign-in where support can read it. + * + * The client is told one thing; this keeps the detail. When a shop says "we + * cannot get in", the two questions are which account was tried and from + * where - and, if the account exists, whether its password was changed + * recently. That last field is what took a database session and a bcrypt + * comparison by hand to establish, the one time it mattered. + * + * Never throws: a login must not fail because its audit line could not be + * written. Never records the attempted password, not even hashed. + */ + async recordFailedLogin(req, loginId, reason, user = null) { + try { + const db = await BaseModel.getDb(); + await recordAudit(db, { + event: 'login_failed', + actor: { id: user ? String(user._id) : null, name: loginId }, + target: user ? { id: String(user._id), name: user.email || '', type: 'user' } : null, + ip: clientIp(req), + userAgent: (req.headers && req.headers['user-agent']) || '', + extra: { + reason, + attempted: loginId, + /* Only meaningful when the account exists. Equal to creation means + it has never been changed. */ + passwordChangedAt: user ? user.updated_date || user.updated_at || null : null, + }, + }); + } catch (err) { + console.error('[audit] failed login not recorded:', err.message); + } + } + async legacyVerifyLogin(req, res) { try { // 🔍 DEBUG - Check if this method is called @@ -233,11 +285,27 @@ class UsersController extends BaseController { ) .lean(); - // PHP: if (isset($recordsFiltered) && ... password_verify(...)) + /* + * ONE MESSAGE FOR BOTH FAILURES, DELIBERATELY. + * + * Saying "no such user" here would tell anybody who asks which email + * addresses have accounts on this shop, one guess at a time. So an + * unknown user and a wrong password answer identically, and the reason + * is recorded on the server instead, where support can see it and an + * attacker cannot. + * + * The wording changed after a real shop was locked out for five days. + * The old text - "Invalid account. Please contact your branch manager." + * - told a sole owner, who IS the branch manager, to contact himself, + * and never mentioned the thing that had actually happened: the + * password had been changed. It now names that possibility, for both + * cases, which gives the person at the till something to try. + */ if (!user) { + await this.recordFailedLogin(req, loginId, 'no_such_user'); return res.status(404).json({ type: 'error', - message: 'Invalid account. Please contact your branch manager.', + message: LOGIN_FAILED_MESSAGE, data: 'incorrect', }); } @@ -253,7 +321,11 @@ class UsersController extends BaseController { // If base64 fails, try without base64 (old format) if (!passwordValid) { - passwordValid = await bcrypt.compare(password, user.password); + /* String() here as well as above: bcrypt.compare on a non-string + behaves differently across versions, and `password` arrives + straight from the request body where it can be an object or an + array. The base64 branch already coerced; this one did not. */ + passwordValid = await bcrypt.compare(String(password), user.password); } } @@ -261,9 +333,14 @@ class UsersController extends BaseController { // Match legacy PHP behaviour for incorrect credentials: // response('error', $response['message'], 'incorrect', 404); + /* Same message as the unknown-user case above. The distinction is + recorded server-side, including whether this account's password was + changed recently, which is the single most useful fact when + somebody says "it worked yesterday". */ + await this.recordFailedLogin(req, loginId, 'bad_password', user); return res.status(404).json({ type: 'error', - message: 'Invalid account. Please contact your branch manager.', + message: LOGIN_FAILED_MESSAGE, data: 'incorrect', }); } @@ -571,7 +648,7 @@ class UsersController extends BaseController { session_id: req.sessionID, license: user.license, branch_id: branchId, - ip_address: req.ip || req.connection.remoteAddress, + ip_address: clientIp(req), user_agent: req.get('User-Agent'), updated_date: currentTime, }, @@ -596,7 +673,7 @@ class UsersController extends BaseController { updated_date: currentTime, license: user.license, branch_id: branchId, - ip_address: req.ip || req.connection.remoteAddress, + ip_address: clientIp(req), user_agent: req.get('User-Agent'), }; @@ -1011,11 +1088,7 @@ class UsersController extends BaseController { activeTenant.licenseId, { userAgent: req.headers['user-agent'] || '', - ip: - req.ip || - req.connection?.remoteAddress || - req.headers['x-forwarded-for']?.split(',')[0] || - 'unknown', + ip: clientIp(req), } ).catch((err) => console.warn('changeUserLog failed:', err.message)); @@ -1723,35 +1796,107 @@ class UsersController extends BaseController { } } + /** + * Validate that an extracted S3 key is a legitimate Posnic user-image filename. + * Must match format generated by uploadUserImage(): + * YYYY-MM-DDTHH-mm-ss-posnic_user-{randomId}.{extension} + * + * Examples accepted: + * - 2025-12-25T14-30-45-posnic_user-abc123.jpg ✓ + * - 2025-09-02T15-22-08-posnic_user-k9j8l7m6n5.png ✓ + * + * Examples rejected: + * - backups/2025-12-25T14-30-45-posnic_user-abc123.jpg ✗ (contains /) + * - user.svg ✗ (doesn't match pattern) + * - arbitrary.jpg ✗ (no -posnic_user- marker) + * - 2025-12-25T14-30-45-posnic_category-abc123.jpg ✗ (wrong marker) + * + * @param {string} key - The S3 key or bare filename to validate + * @returns {boolean} True if valid Posnic user-image filename, false otherwise + */ + isValidPosnicUserImageFilename(key) { + if (!key || typeof key !== 'string') return false; + if (key.includes('/') || key.includes('\\')) return false; + + // Match: YYYY-MM-DDTHH-mm-ss-posnic_user-{2-15 alphanumeric chars}.{extension} + const userImagePattern = + /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-posnic_user-[a-z0-9]{2,15}\.(gif|jpg|png|jpeg|bmp)$/i; + return userImagePattern.test(key); + } + /** * PHP: userImageDelete() * Delete user profile image */ async userImageDelete(req, res) { try { - const imageUrl = req.body.data; - const userId = req.body.id; + const requestedImageUrl = req.body.data; + const bodyUserId = req.body.id; + + // Resolve the target user ID from body or authenticated request + const userId = + (bodyUserId && String(bodyUserId).trim()) || (req.user && (req.user._id || req.user.id)); + + if (!userId) { + return this.error(res, 'No user identified', 401); + } + + /* + * The rule getUser already uses: your own picture is always yours to + * remove, anybody else's needs the user-management permission. Without + * it the id simply arrives in the body and is obeyed, which was + * survivable while this only reset a database field and is not now that + * it destroys the file in the bucket. + */ + const isSelf = String(req.user && (req.user._id || req.user.id)) === String(userId); + if (!isSelf && !this.checkPermission('user', 'write', req.user)) { + return this.error(res, 'Unauthorized', 403); + } + + const User = this.userModel; + const user = await User.findById(userId).select('image').lean(); + + if (!user) { + return this.error(res, 'User not found', 404); + } + + const storedImageUrl = user.image || 'user.svg'; // Handle empty/default image - idempotent operation - // If no image or already default, just return success - if (!imageUrl || imageUrl.trim() === '' || imageUrl.includes('user.svg')) { + if (!storedImageUrl || storedImageUrl.trim() === '' || storedImageUrl.includes('user.svg')) { return this.success(res, 'user.svg', 'Image was deleted'); } - // TODO: Implement S3 deletion logic when S3 is configured - // For now, just update the database record to point to default image - const updateData = { image: 'user.svg' }; - const User = this.userModel; + const storageType = process.env.STORAGE_TYPE || 'local'; - // If an explicit user id is provided (e.g. from Users module), update that user - if (userId && userId.trim() !== '') { - await User.findByIdAndUpdate(userId, updateData); - } else if (req.user && (req.user._id || req.user.id)) { - // Otherwise fall back to currently authenticated user - const currentUserId = req.user._id || req.user.id; - await User.findByIdAndUpdate(currentUserId, updateData); + /* + * Clearing the object out of the bucket is BEST EFFORT, the way + * categories.controller already treats category images. + * + * Two rules pulling in opposite directions. Never delete an object we + * cannot positively identify as this user's picture, so anything + * unrecognised is left where it is rather than guessed at. And never let + * the bucket decide whether somebody may clear their own photograph: a + * stale URL, a bucket renamed since, a key written by the old PHP app, + * or an IAM policy without DeleteObject would otherwise leave that + * person stuck with a picture they cannot remove. An orphaned file is + * the cheaper failure. + * + * So every branch below skips the delete and carries on to the database. + */ + if (storageType === 's3' && process.env.AWS_S3_BUCKET) { + try { + const key = this.resolveUserImageS3Key(storedImageUrl, requestedImageUrl); + if (key) { + await require('../utils/s3').deleteObject(key); + } + } catch (err) { + console.error('Error deleting user image from S3:', err); + } } + await User.findByIdAndUpdate(userId, { image: 'user.svg' }); + return this.success(res, 'user.svg', 'Image was deleted'); } catch (error) { console.error('Error in userImageDelete:', error); @@ -1759,6 +1904,71 @@ class UsersController extends BaseController { } } + /** + * The S3 key to remove for a stored user image, or null when the object + * cannot be positively identified as one of ours. Never throws for a reason + * that should merely skip the delete; the caller treats null as "leave it". + * + * @param {string} storedImageUrl the URL held in the user record + * @param {string} [requestedImageUrl] what the client believed it was + * @returns {string|null} + */ + resolveUserImageS3Key(storedImageUrl, requestedImageUrl) { + // The client is working from a stale record; do not act on its guess. + if (requestedImageUrl && requestedImageUrl !== storedImageUrl) { + console.warn( + '[userImageDelete] request does not match the stored image, leaving the object in place' + ); + return null; + } + + let parsedUrl; + try { + parsedUrl = new URL(storedImageUrl); + } catch (err) { + // A relative path, written by an older install, is not an S3 object. + console.warn('[userImageDelete] stored image is not an absolute URL, leaving it in place'); + return null; + } + + const key = parsedUrl.pathname.replace(/^\/+/, ''); + const bucket = process.env.AWS_S3_BUCKET; + const region = process.env.AWS_REGION; + const publicUrl = process.env.AWS_S3_PUBLIC_URL; + + const allowedHosts = []; + if (publicUrl) { + try { + allowedHosts.push(new URL(publicUrl).hostname); + } catch (err) { + // Ignore invalid public URL configuration and fall back to the bucket hosts. + } + } + if (bucket) { + allowedHosts.push(`${bucket}.s3.amazonaws.com`); + if (region) { + allowedHosts.push(`${bucket}.s3.${region}.amazonaws.com`); + } + } + + const prefix = 'uploads/user_images/'; + const isBareKey = this.isValidPosnicUserImageFilename(key); + const isPrefixedKey = + key.startsWith(prefix) && this.isValidPosnicUserImageFilename(key.substring(prefix.length)); + + if (!isBareKey && !isPrefixedKey) { + console.warn('[userImageDelete] key is not a Posnic user image, leaving it in place'); + return null; + } + + if (!allowedHosts.includes(parsedUrl.hostname)) { + console.warn('[userImageDelete] image is not on a known bucket host, leaving it in place'); + return null; + } + + return key; + } + /** * PHP: updatePrintSetting() * Update user print settings @@ -1882,11 +2092,7 @@ class UsersController extends BaseController { activeTenant.licenseId, { userAgent: req.headers['user-agent'] || '', - ip: - req.ip || - req.connection?.remoteAddress || - req.headers['x-forwarded-for']?.split(',')[0] || - 'unknown', + ip: clientIp(req), } ).catch((err) => console.warn('changeUserLog failed:', err.message)); @@ -2389,7 +2595,7 @@ class UsersController extends BaseController { return res.status(404).json({ type: 'error', - message: 'Invalid account. Please contact your branch manager.', + message: LOGIN_FAILED_MESSAGE, data: null, }); } @@ -2581,7 +2787,7 @@ class UsersController extends BaseController { return res.status(404).json({ type: 'error', - message: 'Invalid account. Please contact your branch manager.', + message: LOGIN_FAILED_MESSAGE, data: null, }); } @@ -2718,18 +2924,22 @@ class UsersController extends BaseController { }); } - // Temporary hardcoded values for testing - TODO: Move to .env const posnicKey = process.env.GUZZLE_KEY || process.env.POSNIC_KEY; const posnicSecret = process.env.GUZZLE_SECRET || process.env.POSNIC_SECRET; - // Allow overriding the SSO endpoint via env for local/dev flexibility + /* + * The website mints the token now, not a PHP script. + * + * This pointed at api.posnic.com/user.php on a machine that has since + * been deleted - and it had already stopped working before that, because + * that origin no longer answered HTTPS, so Cloudflare returned 522 and + * this button failed silently for anyone who pressed it. + * + * SSO_URL still overrides, for local work against a dev website. + */ const ssoUrlFromEnv = process.env.SSO_URL; - const isDev = process.env.NODE_ENV !== 'production'; - const domainName = ssoUrlFromEnv - ? ssoUrlFromEnv - : isDev - ? 'http://api.dev.posnic.com/user.php?action=ssoToken' - : 'https://api.posnic.com/user.php?action=ssoToken'; + const siteBase = (process.env.POSNIC_SITE_URL || 'https://posnic.com').replace(/\/+$/, ''); + const domainName = ssoUrlFromEnv || `${siteBase}/api/sso/token`; console.log('[ssoClientLogin] Calling SSO API:', domainName); console.log('[ssoClientLogin] User ID:', String(userRecords._id)); @@ -2740,21 +2950,37 @@ class UsersController extends BaseController { formData.append('id', String(userRecords._id)); formData.append('email', userRecords.email); - const response = await axios.post(domainName, formData, { - headers: { - 'Content-Type': 'application/x-www-form-urlencoded', - posnickey: posnicKey, - posnicsecret: posnicSecret, - posnicsso: 'sso', - }, - proxy: false, - }); + /* + * JSON, because the endpoint answering is now our own Node service + * rather than a PHP script expecting form_params. The headers are + * unchanged so an older website that still speaks the old shape keeps + * working during a deploy where the two sides move separately. + */ + const response = await axios.post( + domainName, + { id: String(userRecords._id), email: userRecords.email }, + { + headers: { + 'Content-Type': 'application/json', + posnickey: posnicKey, + posnicsecret: posnicSecret, + posnicsso: 'sso', + }, + proxy: false, + timeout: 10000, + } + ); console.log('[ssoClientLogin] SSO API response:', JSON.stringify(response.data, null, 2)); if (response.data?.data?.token) { - const domainPath = isDev ? 'http://dev.posnic.com' : 'https://www.posnic.com/'; - const path = domainPath + '/ssoauth.html?token=' + response.data.data.token; + /* One slash. The old line joined 'https://www.posnic.com/' to + '/ssoauth.html' and produced a double slash in every link it ever + made. And the page is a route now, not a .html file. */ + /* /api/... because posnic.com is fronted by CloudFront, which forwards + only that prefix to the service; a bare /ssoauth answers 403 from the + CDN, exactly as the old /ssoauth.html did. */ + const path = `${siteBase}/api/sso/auth?token=${encodeURIComponent(response.data.data.token)}`; console.log('[ssoClientLogin] Success! Returning path:', path); // Match PHP: type 'success', message 'valid', HTTP 200 diff --git a/api/src/controllers/variants-v2.controller.js b/api/src/controllers/variants-v2.controller.js index 1aef752a8..35dd5e2e2 100644 --- a/api/src/controllers/variants-v2.controller.js +++ b/api/src/controllers/variants-v2.controller.js @@ -3,6 +3,7 @@ const Variant = require('../models/variant.model'); const mongoose = require('mongoose'); const { validationResult } = require('express-validator'); const { createActivityLog } = require('../utils/activityLogger'); +const { normalizeVariantFields } = require('../helpers/variants.helper'); const escapeRegExp = (str = '') => str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); @@ -34,19 +35,10 @@ const formatVariant = (variant = {}) => { ? variant.product_type : []; - const fields = rawFields - .map((entry) => { - if (!entry) return null; - if (typeof entry === 'string') { - const name = entry.trim(); - return name ? { name } : null; - } - if (typeof entry === 'object' && entry.name) { - return { name: String(entry.name).trim() }; - } - return null; - }) - .filter(Boolean); + /* De-duplicated on READ as well as write. Variants saved before the + write-side guard existed still hold repeated values, and those are + exactly the ones showing the same size twice in the item form. */ + const fields = normalizeVariantFields(rawFields); const product_type = fields.map((f) => f.name); @@ -234,11 +226,9 @@ class VariantControllerV2 { return sendError(res, 'Variant name is required', 400); } - const rawTypes = Array.isArray(product_type) ? product_type : []; - const fields = rawTypes - .map((val) => (val != null ? String(val).trim() : '')) - .filter(Boolean) - .map((val) => ({ name: val })); + /* Trims, drops blanks, and collapses duplicates - see the helper for + why a repeated value is silently dropped rather than refused. */ + const fields = normalizeVariantFields(product_type); if (!fields.length) { return sendError(res, 'At least one variant value is required', 400); @@ -304,11 +294,9 @@ class VariantControllerV2 { return sendError(res, 'Variant name is required', 400); } - const rawTypes = Array.isArray(product_type) ? product_type : []; - const fields = rawTypes - .map((val) => (val != null ? String(val).trim() : '')) - .filter(Boolean) - .map((val) => ({ name: val })); + /* Trims, drops blanks, and collapses duplicates - see the helper for + why a repeated value is silently dropped rather than refused. */ + const fields = normalizeVariantFields(product_type); if (!fields.length) { return sendError(res, 'At least one variant value is required', 400); diff --git a/api/src/controllers/whatsapp.controller.js b/api/src/controllers/whatsapp.controller.js index 06256984d..d9cbef350 100644 --- a/api/src/controllers/whatsapp.controller.js +++ b/api/src/controllers/whatsapp.controller.js @@ -610,6 +610,70 @@ class WhatsAppController extends BaseController { /** * Save WhatsApp template */ + /* + * Edit a template that already exists. + * + * The route for this has been live and calling a method that was never + * written, so every "Template updated" attempt returned a 500. Express did + * not catch it at startup because the route wraps the call in an arrow + * function - the wrapper IS a function, so registration succeeds and the + * TypeError only surfaces when someone actually presses save. + * + * Scoped the same way saveTemplate scopes: the lookup carries templateScope, + * so a template id from another shop finds nothing rather than being + * rewritten. Never trust the id alone. + */ + async updateTemplate(req, res) { + try { + const { template_id, name, message, template_type } = req.body; + + if (!template_id) { + return res.json({ type: 'error', message: 'Template id is required' }); + } + if (!name || !message) { + return res.json({ + type: 'error', + message: 'Template name and message are required', + }); + } + + const branchId = activeBranchId(req); + if (!branchId && !req.tenantContext) { + return res.json({ + type: 'error', + message: 'Branch ID not found. Please ensure you are logged in.', + }); + } + + const Template = require('../models/whatsapp-template.model'); + const template = await Template.findOneAndUpdate( + { _id: template_id, ...templateScope(req) }, + { + $set: { + name, + message, + template_type: template_type || 'general', + updated_at: new Date(), + }, + }, + { new: true } + ); + + if (!template) { + return res.json({ type: 'error', message: 'Template not found' }); + } + + return res.json({ + type: 'success', + message: 'Template updated successfully', + data: template, + }); + } catch (error) { + console.error('Error in updateTemplate:', error); + return res.json({ type: 'error', message: error.message }); + } + } + async saveTemplate(req, res) { try { const { name, message, template_type } = req.body; diff --git a/api/src/db/ensure-index.js b/api/src/db/ensure-index.js new file mode 100644 index 000000000..7d9b22819 --- /dev/null +++ b/api/src/db/ensure-index.js @@ -0,0 +1,68 @@ +'use strict'; + +/* + * Create an index once per DATABASE, not once per process. + * + * A shop's data lives in its own database (see db/tenant-connections.js) and + * one process serves many shops. So the obvious latch is wrong in a way that + * is invisible in testing and total in production: + * + * if (this.constructor._ensured) return; // <- per PROCESS + * + * The first shop to hit the endpoint after a restart sets that flag, and every + * other shop on the same process never gets the index at all. It looks like it + * worked, because it did - once, for whoever was first. + * + * Keying the latch by database name fixes it: each shop gets exactly one + * attempt, and a restart re-attempts for everyone. createIndex is itself + * idempotent, so the latch is only there to avoid the round trip. + * + * WHERE THIS SHOULD EVENTUALLY LIVE: db/migrations.js runs versioned, ledgered + * migrations against each tenant database before it serves traffic, which is + * the right home for schema shape. It is written but not yet wired - nothing + * calls runMigrations and the registry is empty - so index creation still + * happens lazily here. When migrations are wired, these move and this file + * goes away. + */ + +const ensured = new Set(); + +/* The database a collection belongs to, however the driver exposes it. */ +function databaseNameOf(collection) { + return ( + collection?.dbName || collection?.s?.db?.databaseName || collection?.conn?.name || 'default' + ); +} + +/** + * Ensure `keys` exists on `collection`, at most once per database per process. + * + * Best effort by design: an index build that fails - a shop mid-build, a + * permission quirk, a legacy duplicate blocking a unique index - must never + * fail the request that happened to trigger it. It simply is not latched, so + * the next request tries again. + * + * @returns {Promise} true if the index is now believed to exist + */ +async function ensureIndexOnce(collection, keys, options = {}) { + if (!collection || !keys) return false; + + const name = options.name || JSON.stringify(keys); + const key = `${databaseNameOf(collection)}::${name}`; + if (ensured.has(key)) return true; + + try { + await collection.createIndex(keys, options); + ensured.add(key); + return true; + } catch (e) { + return false; + } +} + +/* Tests only: forget what has been ensured. */ +function _reset() { + ensured.clear(); +} + +module.exports = { ensureIndexOnce, databaseNameOf, _reset }; diff --git a/api/src/fonts/DEJAVU-LICENSE b/api/src/fonts/DEJAVU-LICENSE new file mode 100644 index 000000000..df52c1709 --- /dev/null +++ b/api/src/fonts/DEJAVU-LICENSE @@ -0,0 +1,187 @@ +Fonts are (c) Bitstream (see below). DejaVu changes are in public domain. +Glyphs imported from Arev fonts are (c) Tavmjong Bah (see below) + + +Bitstream Vera Fonts Copyright +------------------------------ + +Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is +a trademark of Bitstream, Inc. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of the fonts accompanying this license ("Fonts") and associated +documentation files (the "Font Software"), to reproduce and distribute the +Font Software, including without limitation the rights to use, copy, merge, +publish, distribute, and/or sell copies of the Font Software, and to permit +persons to whom the Font Software is furnished to do so, subject to the +following conditions: + +The above copyright and trademark notices and this permission notice shall +be included in all copies of one or more of the Font Software typefaces. + +The Font Software may be modified, altered, or added to, and in particular +the designs of glyphs or characters in the Fonts may be modified and +additional glyphs or characters may be added to the Fonts, only if the fonts +are renamed to names not containing either the words "Bitstream" or the word +"Vera". + +This License becomes null and void to the extent applicable to Fonts or Font +Software that has been modified and is distributed under the "Bitstream +Vera" names. + +The Font Software may be sold as part of a larger software package but no +copy of one or more of the Font Software typefaces may be sold by itself. + +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT, +TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME +FOUNDATION BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING +ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, +WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF +THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE +FONT SOFTWARE. + +Except as contained in this notice, the names of Gnome, the Gnome +Foundation, and Bitstream Inc., shall not be used in advertising or +otherwise to promote the sale, use or other dealings in this Font Software +without prior written authorization from the Gnome Foundation or Bitstream +Inc., respectively. For further information, contact: fonts at gnome dot +org. + +Arev Fonts Copyright +------------------------------ + +Copyright (c) 2006 by Tavmjong Bah. All Rights Reserved. + +Permission is hereby granted, free of charge, to any person obtaining +a copy of the fonts accompanying this license ("Fonts") and +associated documentation files (the "Font Software"), to reproduce +and distribute the modifications to the Bitstream Vera Font Software, +including without limitation the rights to use, copy, merge, publish, +distribute, and/or sell copies of the Font Software, and to permit +persons to whom the Font Software is furnished to do so, subject to +the following conditions: + +The above copyright and trademark notices and this permission notice +shall be included in all copies of one or more of the Font Software +typefaces. + +The Font Software may be modified, altered, or added to, and in +particular the designs of glyphs or characters in the Fonts may be +modified and additional glyphs or characters may be added to the +Fonts, only if the fonts are renamed to names not containing either +the words "Tavmjong Bah" or the word "Arev". + +This License becomes null and void to the extent applicable to Fonts +or Font Software that has been modified and is distributed under the +"Tavmjong Bah Arev" names. + +The Font Software may be sold as part of a larger software package but +no copy of one or more of the Font Software typefaces may be sold by +itself. + +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT +OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL +TAVMJONG BAH BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM +OTHER DEALINGS IN THE FONT SOFTWARE. + +Except as contained in this notice, the name of Tavmjong Bah shall not +be used in advertising or otherwise to promote the sale, use or other +dealings in this Font Software without prior written authorization +from Tavmjong Bah. For further information, contact: tavmjong @ free +. fr. + +TeX Gyre DJV Math +----------------- +Fonts are (c) Bitstream (see below). DejaVu changes are in public domain. + +Math extensions done by B. Jackowski, P. Strzelczyk and P. Pianowski +(on behalf of TeX users groups) are in public domain. + +Letters imported from Euler Fraktur from AMSfonts are (c) American +Mathematical Society (see below). +Bitstream Vera Fonts Copyright +Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera +is a trademark of Bitstream, Inc. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of the fonts accompanying this license (“Fonts”) and associated +documentation +files (the “Font Software”), to reproduce and distribute the Font Software, +including without limitation the rights to use, copy, merge, publish, +distribute, +and/or sell copies of the Font Software, and to permit persons to whom +the Font Software is furnished to do so, subject to the following +conditions: + +The above copyright and trademark notices and this permission notice +shall be +included in all copies of one or more of the Font Software typefaces. + +The Font Software may be modified, altered, or added to, and in particular +the designs of glyphs or characters in the Fonts may be modified and +additional +glyphs or characters may be added to the Fonts, only if the fonts are +renamed +to names not containing either the words “Bitstream” or the word “Vera”. + +This License becomes null and void to the extent applicable to Fonts or +Font Software +that has been modified and is distributed under the “Bitstream Vera” +names. + +The Font Software may be sold as part of a larger software package but +no copy +of one or more of the Font Software typefaces may be sold by itself. + +THE FONT SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS +OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT, +TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME +FOUNDATION +BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, +SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER IN AN +ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF THE USE OR +INABILITY TO USE +THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE FONT SOFTWARE. +Except as contained in this notice, the names of GNOME, the GNOME +Foundation, +and Bitstream Inc., shall not be used in advertising or otherwise to promote +the sale, use or other dealings in this Font Software without prior written +authorization from the GNOME Foundation or Bitstream Inc., respectively. +For further information, contact: fonts at gnome dot org. + +AMSFonts (v. 2.2) copyright + +The PostScript Type 1 implementation of the AMSFonts produced by and +previously distributed by Blue Sky Research and Y&Y, Inc. are now freely +available for general use. This has been accomplished through the +cooperation +of a consortium of scientific publishers with Blue Sky Research and Y&Y. +Members of this consortium include: + +Elsevier Science IBM Corporation Society for Industrial and Applied +Mathematics (SIAM) Springer-Verlag American Mathematical Society (AMS) + +In order to assure the authenticity of these fonts, copyright will be +held by +the American Mathematical Society. This is not meant to restrict in any way +the legitimate use of the fonts, such as (but not limited to) electronic +distribution of documents containing these fonts, inclusion of these fonts +into other public domain or commercial font collections or computer +applications, use of the outline data to create derivative fonts and/or +faces, etc. However, the AMS does require that the AMS copyright notice be +removed from any derivative versions of the fonts which have been altered in +any way. In addition, to ensure the fidelity of TeX documents using Computer +Modern fonts, Professor Donald Knuth, creator of the Computer Modern faces, +has requested that any alterations which yield different font metrics be +given a different name. + +$Id$ diff --git a/api/src/fonts/DejaVuSansCondensed-Bold.ttf b/api/src/fonts/DejaVuSansCondensed-Bold.ttf new file mode 100644 index 000000000..22987c62d Binary files /dev/null and b/api/src/fonts/DejaVuSansCondensed-Bold.ttf differ diff --git a/api/src/fonts/DejaVuSansCondensed.ttf b/api/src/fonts/DejaVuSansCondensed.ttf new file mode 100644 index 000000000..3259bc21a Binary files /dev/null and b/api/src/fonts/DejaVuSansCondensed.ttf differ diff --git a/api/src/helpers/install.helper.js b/api/src/helpers/install.helper.js index 6cbdb4f02..b5592f56a 100644 --- a/api/src/helpers/install.helper.js +++ b/api/src/helpers/install.helper.js @@ -30,11 +30,16 @@ const toObjectId = (id) => { return null; }; +/* Every way a caller has said yes to demo data. Compared lower-cased and + trimmed, so 'Yes' and ' on ' are the same answer as 'yes'. */ +const TRUTHY_DEMO = new Set(['yes', 'on', 'true', '1', 'y']); + /** * Sanitize installation data * @param {Object} data - Raw installation data * @returns {Object} */ + const sanitizeInstallData = (data) => { return { register_companyname: (data.register_companyname || '').trim(), @@ -51,8 +56,30 @@ const sanitizeInstallData = (data) => { register_countryid: (data.register_countryid || '').trim(), register_state: (data.register_state || '').trim(), register_timezone: (data.register_timezone || '').trim(), - register_demo: data.register_demo || false, - businessType: (data.businessType || '').trim(), + /* + * The provisioner's words, not ours. + * + * Gateway sends `register_demo: 'yes'` and `business: 'retail'` + * (apps/provisioner/provision.js). This side checked for `'on'` and read + * `businessType`, so BOTH missed - every cloud shop was created with no + * demo data at all and, had it run, always the supermarket pack. + * + * Silent, because each miss has a plausible fallback: no demo data looks + * like a shop that asked for none, and a supermarket pack looks like a + * default somebody chose. A new customer opened their till and found one + * product in it. + * + * Normalised here rather than changed in Gateway: this is the side that + * consumes the value, it already normalises businessType for the pack + * lookup, and a provisioner mid-flight for live signups is the wrong + * thing to edit to fix a reader. + */ + register_demo: TRUTHY_DEMO.has( + String(data.register_demo == null ? '' : data.register_demo) + .trim() + .toLowerCase() + ), + businessType: (data.businessType || data.business || '').trim(), }; }; diff --git a/api/src/helpers/items.helper.js b/api/src/helpers/items.helper.js index b68facbb1..6bcb4473c 100644 --- a/api/src/helpers/items.helper.js +++ b/api/src/helpers/items.helper.js @@ -4,6 +4,7 @@ */ const { FIELD_LIMITS, ERROR_MESSAGES } = require('../constants/items.constants'); +const gtin = require('../utils/gtin'); /** * Sanitize item data before persistence @@ -48,6 +49,32 @@ const sanitizeItemData = (data = {}) => { } }); + /* + * The GTIN is derived here, not trusted. + * + * This is the one funnel every create and every edit passes through, so it is + * the only place the rule can be enforced once: a gtin is stored only when it + * validates, and gtin14 - the zero-padded comparison form - is computed from + * it rather than accepted from the caller. + * + * Anything that fails validation clears BOTH fields rather than being left + * alone. Leaving the old value would mean a shop that corrected a mistyped + * barcode still has the wrong global identifier attached, which is precisely + * the error a shared database cannot recover from. + * + * barcode_id is deliberately NOT used as a source. It may hold an in-store + * code, a supplier reference, or free text, and promoting that to a global + * identifier is how a public database gets poisoned. + */ + if (Object.prototype.hasOwnProperty.call(sanitized, 'gtin')) { + const parsed = gtin.parse(sanitized.gtin); + sanitized.gtin = parsed ? parsed.gtin : ''; + sanitized.gtin14 = parsed ? parsed.gtin14 : ''; + } else { + /* Never let a caller set the comparison form directly - it is derived. */ + delete sanitized.gtin14; + } + return sanitized; }; diff --git a/api/src/helpers/variants.helper.js b/api/src/helpers/variants.helper.js new file mode 100644 index 000000000..1fa73c7bd --- /dev/null +++ b/api/src/helpers/variants.helper.js @@ -0,0 +1,56 @@ +/** + * Variant Helper Functions + * + * A variant's values are a set of CHOICES - "Size: 38, 40, 42". The one thing + * a set cannot contain is the same member twice, and nothing enforced that: + * saving Size as 38, 40, 40 stored 40 twice, the item form then offered it + * twice, and both copies could be picked. That produced two items called + * "Shirt / 40" - same name, same axis, different prices and stock, and no way + * for anyone to tell which one the barcode meant. + * + * Collapsed rather than rejected on purpose. The second 40 carries no + * information, so dropping it loses nothing a person meant to say - and + * refusing the save would block real work over a slip we can obviously + * resolve. Errors are for what we cannot decide; this we can. + */ + +/** + * Turn whatever the form sent into a clean, duplicate-free field list. + * + * Compared case- and space-insensitively: "40 " and "40" are the same size, + * and "Red" and "red" are the same colour. Someone typing both meant one. + * + * The FIRST spelling wins, so the shop's own capitalisation survives - keeping + * the later one would let a stray lowercase entry silently rename a value + * that is already printed on labels. + * + * @param {Array} rawTypes - values as submitted (strings, or {name} objects) + * @returns {Array<{name: String}>} - trimmed, non-empty, de-duplicated + */ +const normalizeVariantFields = (rawTypes) => { + if (!Array.isArray(rawTypes)) return []; + + const seen = new Set(); + const fields = []; + + rawTypes.forEach((entry) => { + let name = ''; + if (entry != null && typeof entry === 'object') { + name = entry.name != null ? String(entry.name).trim() : ''; + } else if (entry != null) { + name = String(entry).trim(); + } + if (!name) return; + + const key = name.toLowerCase(); + if (seen.has(key)) return; + seen.add(key); + fields.push({ name }); + }); + + return fields; +}; + +module.exports = { + normalizeVariantFields, +}; diff --git a/api/src/json/country_currency.json b/api/src/json/country_currency.json new file mode 100644 index 000000000..7e9b0bff8 --- /dev/null +++ b/api/src/json/country_currency.json @@ -0,0 +1,259 @@ +{ +"_comment": "ISO 3166-1 alpha-2 country code -> ISO 4217 currency code. Source of truth for resolving a shop's currency from its country; currency.json supplies the symbol for a code. Added 2026-08-26 after 73 of 246 countries fell through name-prefix matching to INR.", +"AF": "AFN", +"AL": "ALL", +"DZ": "DZD", +"AS": "USD", +"AD": "EUR", +"AO": "AOA", +"AI": "XCD", +"AQ": "USD", +"AG": "XCD", +"AR": "ARS", +"AM": "AMD", +"AW": "AWG", +"AU": "AUD", +"AT": "EUR", +"AZ": "AZN", +"BS": "BSD", +"BH": "BHD", +"BD": "BDT", +"BB": "BBD", +"BY": "BYN", +"BE": "EUR", +"BZ": "BZD", +"BJ": "XOF", +"BM": "BMD", +"BT": "BTN", +"BO": "BOB", +"BQ": "USD", +"BA": "BAM", +"BW": "BWP", +"BV": "NOK", +"BR": "BRL", +"IO": "USD", +"BN": "BND", +"BG": "BGN", +"BF": "XOF", +"BI": "BIF", +"CV": "CVE", +"KH": "KHR", +"CM": "XAF", +"CA": "CAD", +"KY": "KYD", +"CF": "XAF", +"TD": "XAF", +"CL": "CLP", +"CN": "CNY", +"CX": "AUD", +"CC": "AUD", +"CO": "COP", +"KM": "KMF", +"CG": "XAF", +"CD": "CDF", +"CK": "NZD", +"CR": "CRC", +"CI": "XOF", +"HR": "EUR", +"CU": "CUP", +"CW": "ANG", +"CY": "EUR", +"CZ": "CZK", +"DK": "DKK", +"DJ": "DJF", +"DM": "XCD", +"DO": "DOP", +"EC": "USD", +"EG": "EGP", +"SV": "USD", +"GQ": "XAF", +"ER": "ERN", +"EE": "EUR", +"SZ": "SZL", +"ET": "ETB", +"FK": "FKP", +"FO": "DKK", +"FJ": "FJD", +"FI": "EUR", +"FR": "EUR", +"GF": "EUR", +"PF": "XPF", +"TF": "EUR", +"GA": "XAF", +"GM": "GMD", +"GE": "GEL", +"DE": "EUR", +"GH": "GHS", +"GI": "GIP", +"GR": "EUR", +"GL": "DKK", +"GD": "XCD", +"GP": "EUR", +"GU": "USD", +"GT": "GTQ", +"GG": "GBP", +"GN": "GNF", +"GW": "XOF", +"GY": "GYD", +"HT": "HTG", +"HM": "AUD", +"HN": "HNL", +"HK": "HKD", +"HU": "HUF", +"IS": "ISK", +"IN": "INR", +"ID": "IDR", +"IR": "IRR", +"IQ": "IQD", +"IE": "EUR", +"IM": "GBP", +"IL": "ILS", +"IT": "EUR", +"JM": "JMD", +"JP": "JPY", +"JE": "GBP", +"JO": "JOD", +"KZ": "KZT", +"KE": "KES", +"KI": "AUD", +"KP": "KPW", +"KR": "KRW", +"XK": "EUR", +"KW": "KWD", +"KG": "KGS", +"LA": "LAK", +"LV": "EUR", +"LB": "LBP", +"LS": "LSL", +"LR": "LRD", +"LY": "LYD", +"LI": "CHF", +"LT": "EUR", +"LU": "EUR", +"MO": "MOP", +"MK": "MKD", +"MG": "MGA", +"MW": "MWK", +"MY": "MYR", +"MV": "MVR", +"ML": "XOF", +"MT": "EUR", +"MH": "USD", +"MQ": "EUR", +"MR": "MRU", +"MU": "MUR", +"YT": "EUR", +"MX": "MXN", +"FM": "USD", +"MD": "MDL", +"MC": "EUR", +"MN": "MNT", +"ME": "EUR", +"MS": "XCD", +"MA": "MAD", +"MZ": "MZN", +"MM": "MMK", +"NA": "NAD", +"NR": "AUD", +"NP": "NPR", +"NL": "EUR", +"NC": "XPF", +"NZ": "NZD", +"NI": "NIO", +"NE": "XOF", +"NG": "NGN", +"NU": "NZD", +"NF": "AUD", +"MP": "USD", +"NO": "NOK", +"OM": "OMR", +"PK": "PKR", +"PW": "USD", +"PS": "ILS", +"PA": "PAB", +"PG": "PGK", +"PY": "PYG", +"PE": "PEN", +"PH": "PHP", +"PN": "NZD", +"PL": "PLN", +"PT": "EUR", +"PR": "USD", +"QA": "QAR", +"RE": "EUR", +"RO": "RON", +"RU": "RUB", +"RW": "RWF", +"SH": "SHP", +"KN": "XCD", +"LC": "XCD", +"PM": "EUR", +"VC": "XCD", +"WS": "WST", +"SM": "EUR", +"ST": "STN", +"SA": "SAR", +"SN": "XOF", +"RS": "RSD", +"SC": "SCR", +"SL": "SLE", +"SG": "SGD", +"SX": "ANG", +"SK": "EUR", +"SI": "EUR", +"SB": "SBD", +"SO": "SOS", +"ZA": "ZAR", +"GS": "GBP", +"SS": "SSP", +"ES": "EUR", +"LK": "LKR", +"SD": "SDG", +"SR": "SRD", +"SJ": "NOK", +"SE": "SEK", +"CH": "CHF", +"SY": "SYP", +"TW": "TWD", +"TJ": "TJS", +"TZ": "TZS", +"TH": "THB", +"TL": "USD", +"TG": "XOF", +"TK": "NZD", +"TO": "TOP", +"TT": "TTD", +"TN": "TND", +"TR": "TRY", +"TM": "TMT", +"TC": "USD", +"TV": "AUD", +"UG": "UGX", +"UA": "UAH", +"AE": "AED", +"GB": "GBP", +"US": "USD", +"UM": "USD", +"UY": "UYU", +"UZ": "UZS", +"VU": "VUV", +"VA": "EUR", +"VE": "VES", +"VN": "VND", +"VG": "USD", +"VI": "USD", +"WF": "XPF", +"EH": "MAD", +"YE": "YER", +"ZM": "ZMW", +"ZW": "ZWG", +"AX": "EUR", +"TP": "USD", +"XA": "AUD", +"XU": "GBP", +"XJ": "GBP", +"XM": "GBP", +"AN": "ANG", +"XG": "GBP", +"YU": "RSD" +} \ No newline at end of file diff --git a/api/src/json/country_tax_rates.json b/api/src/json/country_tax_rates.json new file mode 100644 index 000000000..b9cde52be --- /dev/null +++ b/api/src/json/country_tax_rates.json @@ -0,0 +1,355 @@ +{ + "_comment": "Consumption-tax rates per country, for provisioning a new shop. Read by api/src/services/country-tax.js. A rate here OVERRIDES the legacy `tax` array in countries.json; a country absent from this file, or present but not `verified`, falls back to that array, and a country whose only legacy row is a 0% placeholder gets NO tax at all. See country-tax.js for why that order.", + "_rules": [ + "No rate without sourceUrl and checkedAt. A rate that cannot be cited is not entered - set verified:false and leave the rates out.", + "Cite the country's own tax authority or finance ministry. Not blog posts, not aggregators, not recollection.", + "regime:'none' means PROVEN to have no consumption tax, with a source saying so. That is different from unverified, and the two must never be collapsed.", + "An incomplete but sourced entry beats a complete invented one. Record only the bands you can cite.", + "verified:true means the rate was read from the cited source. reviewer records a PERSON having checked it, and is null until one has - the two are separate claims and the file keeps them apart on purpose.", + "A country ABSENT from this file is not an oversight to fill in from memory. Australia, Canada, Saudi Arabia and Singapore were attempted and their sites refused automated reads or render the rate in JavaScript - they are deliberately absent, and fall back to countries.json." + ], + "_schema": { + "regime": "vat_credit | sales_tax | none", + "label": "what the country calls it, eg VAT, GST, Consumption tax", + "rates": "[{ category, name, value }] - category is one of standard, reduced, zero, exempt", + "verified": "boolean - whether the rates were read from the cited source", + "sourceUrl": "the tax authority page the rates were read from", + "sourceName": "the authority", + "checkedAt": "YYYY-MM-DD", + "reviewer": "person who checked it, or null if nobody has yet", + "provenance": "read-from-source (fetched and read during the change) | reviewed (a person checked it). verified gates USE; reviewer records a PERSON having signed off, and is null until one has." + }, + "GB": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 20, + "name": "VAT 20%" + }, + { + "category": "reduced", + "value": 5, + "name": "VAT 5%" + }, + { + "category": "zero", + "value": 0, + "name": "VAT 0%" + } + ], + "verified": true, + "sourceUrl": "https://www.gov.uk/vat-rates", + "sourceName": "GOV.UK (HM Revenue & Customs)", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "AE": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 5, + "name": "VAT 5%" + } + ], + "verified": true, + "sourceUrl": "https://tax.gov.ae/en/taxes/vat.aspx", + "sourceName": "UAE Federal Tax Authority", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "NZ": { + "regime": "vat_credit", + "label": "GST", + "rates": [ + { + "category": "standard", + "value": 15, + "name": "GST 15%" + } + ], + "verified": true, + "sourceUrl": "https://www.ird.govt.nz/gst", + "sourceName": "Inland Revenue (New Zealand)", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "ZA": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 15, + "name": "VAT 15%" + } + ], + "verified": true, + "sourceUrl": "https://www.sars.gov.za/types-of-tax/value-added-tax/", + "sourceName": "South African Revenue Service", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "JP": { + "regime": "vat_credit", + "label": "Consumption tax", + "rates": [ + { + "category": "standard", + "value": 10, + "name": "Consumption tax 10%" + }, + { + "category": "reduced", + "value": 8, + "name": "Consumption tax 8%" + } + ], + "verified": true, + "sourceUrl": "https://www.nta.go.jp/english/taxes/consumption_tax/01.htm", + "sourceName": "National Tax Agency (Japan)", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "CH": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 8.1, + "name": "VAT 8.1%" + }, + { + "category": "reduced", + "value": 2.6, + "name": "VAT 2.6%" + }, + { + "category": "reduced", + "value": 3.8, + "name": "VAT 3.8%" + } + ], + "verified": true, + "sourceUrl": "https://www.estv.admin.ch/estv/en/home/value-added-tax/vat-rates-switzerland.html", + "sourceName": "Federal Tax Administration (Switzerland)", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "NO": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 25, + "name": "VAT 25%" + }, + { + "category": "reduced", + "value": 15, + "name": "VAT 15%" + }, + { + "category": "reduced", + "value": 12, + "name": "VAT 12%" + } + ], + "verified": true, + "sourceUrl": "https://www.skatteetaten.no/en/rates/value-added-tax/", + "sourceName": "Norwegian Tax Administration", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "TH": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 7, + "name": "VAT 7%" + } + ], + "verified": true, + "sourceUrl": "https://www.rd.go.th/english/6043.html", + "sourceName": "Revenue Department (Thailand)", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "DE": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 19, + "name": "VAT 19%" + }, + { + "category": "reduced", + "value": 7, + "name": "VAT 7%" + } + ], + "verified": true, + "sourceUrl": "https://europa.eu/youreurope/business/taxation/vat/vat-rules-rates/index_en.htm", + "sourceName": "European Commission - Your Europe", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "FR": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 20, + "name": "VAT 20%" + }, + { + "category": "reduced", + "value": 10, + "name": "VAT 10%" + }, + { + "category": "reduced", + "value": 5.5, + "name": "VAT 5.5%" + }, + { + "category": "reduced", + "value": 2.1, + "name": "VAT 2.1%" + } + ], + "verified": true, + "sourceUrl": "https://europa.eu/youreurope/business/taxation/vat/vat-rules-rates/index_en.htm", + "sourceName": "European Commission - Your Europe", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "IE": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 23, + "name": "VAT 23%" + }, + { + "category": "reduced", + "value": 13.5, + "name": "VAT 13.5%" + }, + { + "category": "reduced", + "value": 9, + "name": "VAT 9%" + } + ], + "verified": true, + "sourceUrl": "https://europa.eu/youreurope/business/taxation/vat/vat-rules-rates/index_en.htm", + "sourceName": "European Commission - Your Europe", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "ES": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 21, + "name": "VAT 21%" + }, + { + "category": "reduced", + "value": 10, + "name": "VAT 10%" + }, + { + "category": "reduced", + "value": 4, + "name": "VAT 4%" + } + ], + "verified": true, + "sourceUrl": "https://europa.eu/youreurope/business/taxation/vat/vat-rules-rates/index_en.htm", + "sourceName": "European Commission - Your Europe", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "IT": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 22, + "name": "VAT 22%" + }, + { + "category": "reduced", + "value": 10, + "name": "VAT 10%" + }, + { + "category": "reduced", + "value": 5, + "name": "VAT 5%" + }, + { + "category": "reduced", + "value": 4, + "name": "VAT 4%" + } + ], + "verified": true, + "sourceUrl": "https://europa.eu/youreurope/business/taxation/vat/vat-rules-rates/index_en.htm", + "sourceName": "European Commission - Your Europe", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + }, + "NL": { + "regime": "vat_credit", + "label": "VAT", + "rates": [ + { + "category": "standard", + "value": 21, + "name": "VAT 21%" + }, + { + "category": "reduced", + "value": 9, + "name": "VAT 9%" + } + ], + "verified": true, + "sourceUrl": "https://europa.eu/youreurope/business/taxation/vat/vat-rules-rates/index_en.htm", + "sourceName": "European Commission - Your Europe", + "checkedAt": "2026-08-30", + "provenance": "read-from-source", + "reviewer": null + } +} diff --git a/api/src/json/currency.json b/api/src/json/currency.json index 6fb76eabd..73e37fd3a 100644 --- a/api/src/json/currency.json +++ b/api/src/json/currency.json @@ -1,1207 +1,1426 @@ { - "currency": [ - { - "id": 1, - "value": "Afghanistan Afghani / AFN or؋ ", - "text": "AFN", - "symbol": "؋" - }, - { - "id": 2, - "value": "Albania Lek / ALL or Lek", - "text": "ALL", - "symbol": "Lek" - }, - - { - "id": 3, - "value": "American Samoa US Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - - { - "id": 4, - "value": "Andorra Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 5, - "value": "Angola Kwanza / AOA or Kz", - "text": "AOA", - "symbol": "Kz" - }, - { - "id": 6, - "value": "Anguilla Dollar / XCD or $", - "text": "XCD", - "symbol": "$" - }, - - { - "id": 7, - "value": "Antigua and Barbuda Dollar / XCD or $", - "text": "XCD", - "symbol": "$" - }, - { - "id": 8, - "value": "Argentina Peso / ARS or $", - "text": "ARS", - "symbol": "$" - }, - - { - "id": 9, - "value": "Aruba Guilder / AWG or ƒ ", - "text": "AWG", - "symbol": "ƒ" - }, - { - "id": 10, - "value": "Australia Dollar / AUD or $", - "text": "AUD", - "symbol": "$" - }, - { - "id": 11, - "value": "Austria Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 12, - "value": "Azerbaijan Manat / AZN or ман", - "text": "AZN", - "symbol": "ман" - }, - { - "id": 13, - "value": "Bahamas Dollar / BSD or $", - "text": "BSD", - "symbol": "$" - }, - - { - "id": 14, - "value": "Barbados Dollar / BBD or $", - "text": "BBD", - "symbol": "$" - }, - - { - "id": 15, - "value": "Venezuela Bolivar / VEF or Bs", - "text": "VEF", - "symbol": "Bs" - }, - { - "id": 16, - "value": "Vietnam Dong / VND or ₫", - "text": "VND", - "symbol": "₫" - }, - - { - "id": 17, - "value": "Yemen Rial / YER or ﷼", - "text": "YER", - "symbol": "﷼" - }, - { - "id": 18, - "value": "Zambia Kwacha / ZMK or ZK", - "text": "ZMK", - "symbol": "ZK" - }, - { - "id": 19, - "value": "Zimbabwe Dollar / ZWD or Z$", - "text": "ZWD", - "symbol": "Z$" - }, - - { - "id": 20, - "value": "Belarus Ruble / BYR or p.", - "text": "BYR", - "symbol": "p." - }, - { - "id": 21, - "value": "Belgium Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 22, - "value": "Belize Dollar / BZD or BZ$", - "text": "BZD", - "symbol": "BZ$" - }, - - { - "id": 23, - "value": "Bermuda Dollar / BMD or $", - "text": "BMD", - "symbol": "$" - }, - { - "id": 24, - "value": "Vanuatu Vatu / VUV or Vt", - "text": "VUV", - "symbol": "Vt" - }, - { - "id": 25, - "value": "Vatican Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - - { - "id": 26, - "value": "Bolivia Boliviano / BOB or $b", - "text": "BOB", - "symbol": "$b" - }, - { - "id": 27, - "value": "Bosnia and Herzegovina Marka / BAM or KM", - "text": "BAM", - "symbol": "KM" - }, - { - "id": 28, - "value": "Botswana Pula / BWP or P", - "text": "BWP", - "symbol": "P" - }, - { - "id": 29, - "value": "Bouvet Island Krone / NOK or kr", - "text": "NOK", - "symbol": "kr" - }, - { - "id": 30, - "value": "Brazil Real / BRL or R$", - "text": "BRL", - "symbol": "R$" - }, - { - "id": 31, - "value": "British Indian Ocean Territory Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 32, - "value": "British Virgin Islands Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 33, - "value": "Brunei Dollar / BND or $", - "text": "BND", - "symbol": "$" - }, - { - "id": 34, - "value": "Bulgaria Lev / BGN or лв", - "text": "BGN", - "symbol": "лв" - }, - { - "id": 35, - "value": "Uruguay Peso / UYU or $U", - "text": "UYU", - "symbol": "$U" - }, - { - "id": 36, - "value": "Uzbekistan Som / UZS or лв", - "text": "UZS", - "symbol": "лв" - }, - - { - "id": 37, - "value": "Cambodia Riels / KHR or ៛", - "text": "KHR", - "symbol": "៛" - }, - { - "id": 38, - "value": "Cameroon Franc / XAF or FCF", - "text": "XAF", - "symbol": "FCF" - }, - { - "id": 39, - "value": "Canada Dollar / CAD or $", - "text": "CAD", - "symbol": "$" - }, - { - "id": 40, - "value": "United States Minor Outlying Islands Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - - { - "id": 41, - "value": "Cayman Islands Dollar / KYD or $", - "text": "KYD", - "symbol": "$" - }, - { - "id": 42, - "value": "Central African Republic Franc / XAF or FCF", - "text": "XAF", - "symbol": "FCF" - }, - - { - "id": 43, - "value": "China YuanRenminbi / CNY or ¥", - "text": "CNY", - "symbol": "¥" - }, - { - "id": 44, - "value": "United Kingdom Pound / GBP or £", - "text": "GBP", - "symbol": "£" - }, - { - "id": 45, - "value": "United States Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - - { - "id": 46, - "value": "Christmas Island Dollar / AUD or $", - "text": "AUD", - "symbol": "$" - }, - { - "id": 47, - "value": "Cocos Islands Dollar / AUD or $", - "text": "AUD", - "symbol": "$" - }, - { - "id": 48, - "value": "Colombia Peso / COP or $", - "text": "COP", - "symbol": "$" - }, - { - "id": 49, - "value": "Ukraine Hryvnia / UAH or ₴", - "text": "UAH", - "symbol": "₴" - }, - - { - "id": 50, - "value": "Cook Islands Dollar / NZD or $", - "text": "NZD", - "symbol": "$" - }, - { - "id": 51, - "value": "Costa Rica Colon / CRC or ₡", - "text": "CRC", - "symbol": "₡" - }, - { - "id": 52, - "value": "Croatia Kuna / HRK or kn", - "text": "HRK", - "symbol": "kn" - }, - { - "id": 53, - "value": "Cuba Peso / CUP or ₱", - "text": "CUP", - "symbol": "₱" - }, - - { - "id": 54, - "value": "Czech Republic Koruna / CZK or Kč", - "text": "CZK", - "symbol": "Kč" - }, - - { - "id": 55, - "value": "Denmark Krone / DKK or kr", - "text": "DKK", - "symbol": "kr" - }, - - { - "id": 56, - "value": "Turks and Caicos Islands Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 57, - "value": "Tuvalu Dollar / AUD or $", - "text": "AUD", - "symbol": "$" - }, - { - "id": 58, - "value": "U.S. Virgin Islands Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - - { - "id": 59, - "value": "Dominica Dollar / XCD or $", - "text": "XCD", - "symbol": "$" - }, - { - "id": 60, - "value": "Dominican Republic Peso / DOP or RD$", - "text": "DOP", - "symbol": "RD$" - }, - { - "id": 61, - "value": "East Timor Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 62, - "value": "Ecuador Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 63, - "value": "Egypt Pound / EGP or £", - "text": "EGP", - "symbol": "£" - }, - { - "id": 64, - "value": "El Salvador Colone / SVC or $", - "text": "SVC", - "symbol": "$" - }, - { - "id": 65, - "value": "Equatorial Guinea Franc / XAF or FCF", - "text": "XAF", - "symbol": "FCF" - }, - { - "id": 66, - "value": "Eritrea Nakfa / ERN or Nfk", - "text": "ERN", - "symbol": "Nfk" - }, - { - "id": 67, - "value": "Estonia Kroon / EEK or kr", - "text": "EEK", - "symbol": "kr" - }, - - { - "id": 68, - "value": "Turkmenistan Manat / TMM or m", - "text": "TMM", - "symbol": "m" - }, - - { - "id": 69, - "value": "Falkland Islands Pound / FKP or £", - "text": "FKP", - "symbol": "£" - }, - { - "id": 70, - "value": "Faroe Islands Krone / DKK or kr", - "text": "DKK", - "symbol": "kr" - }, - { - "id": 71, - "value": "Fiji Dollar / FJD or $", - "text": "FJD ", - "symbol": "$" - }, - { - "id": 72, - "value": "Finland Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 73, - "value": "France Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 74, - "value": "French Guiana Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 75, - "value": "Turkmenistan Manat / TMM or m", - "text": "TMM", - "symbol": "m" - }, - - { - "id": 76, - "value": "French Southern Territories Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 77, - "value": "Gabon Franc / XAF or FCF", - "text": "XAF", - "symbol": "FCF" - }, - { - "id": 78, - "value": "Gambia Dalasi / GMD or D", - "text": "GMD", - "symbol": "D" - }, - { - "id": 79, - "value": "Turkey Lira / TRY or YTL", - "text": "TRY", - "symbol": "YTL" - }, - - { - "id": 80, - "value": "Germany Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 81, - "value": "Ghana Cedi / GHC or ¢", - "text": "GHC", - "symbol": "¢" - }, - { - "id": 82, - "value": "Gibraltar Pound / GIP or £", - "text": "GIP", - "symbol": "£" - }, - { - "id": 83, - "value": "Greece Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 84, - "value": "Greenland Krone / DKK or kr", - "text": "DKK", - "symbol": "kr" - }, - { - "id": 85, - "value": "Grenada Dollar / XCD or $", - "text": "XCD", - "symbol": "$" - }, - { - "id": 86, - "value": "Guadeloupe Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 87, - "value": "Guam Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 88, - "value": "Guatemala Quetzal / GTQ or Q", - "text": "GTQ", - "symbol": "Q" - }, - { - "id": 89, - "value": "Tonga Paanga / TOP or T$", - "text": "TOP", - "symbol": "T$" - }, - { - "id": 90, - "value": "Trinidad and Tobago Dollar / TTD or TT$", - "text": "TTD", - "symbol": "TT$" - }, - - { - "id": 91, - "value": "Guyana Dollar / GYD or $", - "text": "GYD", - "symbol": "$" - }, - { - "id": 92, - "value": "Haiti Gourde / HTG or G", - "text": "HTG", - "symbol": "G" - }, - { - "id": 93, - "value": "Heard Island and McDonald Islands Dollar / AUD or $", - "text": "AUD", - "symbol": "$" - }, - { - "id": 94, - "value": "Honduras Lempira / HNL or L", - "text": "HNL", - "symbol": "L" - }, - { - "id": 95, - "value": "Hong Kong Dollar / HKD or $", - "text": "HKD", - "symbol": "$" - }, - { - "id": 96, - "value": "Hungary Forint / HUF or Ft", - "text": "HUF", - "symbol": "Ft" - }, - { - "id": 97, - "value": "Iceland Krona / ISK or kr", - "text": "ISK", - "symbol": "kr" - }, - { - "id": 98, - "value": "India Rupee / INR or ₹", - "text": "INR", - "symbol": "₹" - }, - { - "id": 99, - "value": "Indonesia Rupiah / IDR or Rp", - "text": "IDR", - "symbol": "Rp" - }, - { - "id": 100, - "value": "Iran Rial / IRR or ﷼", - "text": "IRR", - "symbol": "﷼" - }, - { - "id": 101, - "value": "Tokelau Dollar / NZD or $", - "text": "NZD", - "symbol": "$" - }, - - { - "id": 102, - "value": "Ireland Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 103, - "value": "Israel Shekel / ILS or ₪", - "text": "ILS", - "symbol": "₪" - }, - { - "id": 104, - "value": "Italy Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - - { - "id": 105, - "value": "Jamaica Dollar / JMD or $", - "text": "JMD", - "symbol": "$" - }, - { - "id": 106, - "value": "Japan Yen / JPY or ¥", - "text": "JPY", - "symbol": "¥" - }, - - { - "id": 107, - "value": "Kazakhstan Tenge / KZT or лв", - "text": "KZT", - "symbol": "лв" - }, - - { - "id": 108, - "value": "Kiribati Dollar / AUD or $", - "text": "AUD", - "symbol": "$" - }, - { - "id": 109, - "value": "Switzerland Franc / CHF or CHF", - "text": "CHF", - "symbol": "CHF" - }, - { - "id": 110, - "value": "Syria Pound / SYP or £", - "text": "SYP", - "symbol": "£" - }, - { - "id": 111, - "value": "Taiwan Dollar / TWD or NT$", - "text": "TWD", - "symbol": "NT$" - }, - - { - "id": 112, - "value": "Thailand Baht / THB or ฿", - "text": "THB", - "symbol": "฿" - }, - - { - "id": 113, - "value": "Kyrgyzstan Som / KGS or лв", - "text": "KGS", - "symbol": "лв" - }, - { - "id": 114, - "value": "Laos Kip / LAK or ₭", - "text": "LAK", - "symbol": "₭" - }, - { - "id": 115, - "value": "Latvia Lat / LVL or Ls", - "text": "LVL", - "symbol": "Ls" - }, - { - "id": 116, - "value": "Lebanon Pound / LBP or £", - "text": "LBP", - "symbol": "£" - }, - { - "id": 117, - "value": "Lesotho Loti / LSL or L", - "text": "LSL", - "symbol": "L" - }, - { - "id": 118, - "value": "Liberia Dollar / LRD or $", - "text": "LRD", - "symbol": "$" - }, - { - "id": 119, - "value": "Sweden Krona / SEK or kr", - "text": "SEK", - "symbol": "kr" - }, - - { - "id": 120, - "value": "Liechtenstein Franc / CHF or CHF", - "text": "CHF", - "symbol": "CHF" - }, - { - "id": 121, - "value": "Lithuania Litas / LTL or Lt", - "text": "LTL", - "symbol": "Lt" - }, - { - "id": 122, - "value": "Luxembourg Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 123, - "value": "Macao Pataca / MOP or MOP", - "text": "MOP", - "symbol": "MOP" - }, - { - "id": 124, - "value": "Macedonia Denar / MKD or ден", - "text": "MKD", - "symbol": "ден" - }, - { - "id": 125, - "value": "Svalbard and Jan Mayen Krone / NOK or kr", - "text": "NOK", - "symbol": "kr" - }, - - { - "id": 126, - "value": "Malawi Kwacha / MWK or MK", - "text": "MWK", - "symbol": "MK" - }, - { - "id": 127, - "value": "Malaysia Ringgit / MYR or RM", - "text": "MYR", - "symbol": "RM" - }, - { - "id": 128, - "value": "Maldives Rufiyaa / MVR or Rf", - "text": "MVR", - "symbol": "Rf" - }, - { - "id": 129, - "value": "Sri Lanka Rupee / LKR or ₨", - "text": "LKR", - "symbol": "₨" - }, - - { - "id": 130, - "value": "Surivalue Dollar / SRD or $", - "text": "SRD", - "symbol": "$" - }, - - { - "id": 131, - "value": "Marshall Islands Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 132, - "value": "Martinique Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 133, - "value": "Mauritania Ouguiya / MRO or UM", - "text": "MRO", - "symbol": "UM" - }, - { - "id": 134, - "value": "Mauritius Rupee / MUR or ₨", - "text": "MUR", - "symbol": "₨" - }, - { - "id": 135, - "value": "Mayotte Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 136, - "value": "Mexico Peso / MXN or $", - "text": "MXN", - "symbol": "$" - }, - { - "id": 137, - "value": "Micronesia Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - - { - "id": 138, - "value": "Spain Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - - { - "id": 139, - "value": "Monaco Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 140, - "value": "Mongolia Tugrik / MNT or ₮", - "text": "MNT", - "symbol": "₮" - }, - { - "id": 141, - "value": "Montserrat Dollar / XCD or $", - "text": "XCD", - "symbol": "$" - }, - { - "id": 142, - "value": "South Korea Won / KRW or ₩", - "text": "KRW", - "symbol": "₩" - }, - - { - "id": 143, - "value": "Mozambique Meticail / MZN or MT", - "text": "MZN", - "symbol": "MT" - }, - { - "id": 144, - "value": "Myanmar Kyat / MMK or K", - "text": "MMK", - "symbol": "K" - }, - { - "id": 145, - "value": "Namibia Dollar / NAD or $", - "text": "NAD", - "symbol": "$" - }, - { - "id": 146, - "value": "Nauru Dollar / AUD or $", - "text": "AUD", - "symbol": "$" - }, - { - "id": 147, - "value": "Nepal Rupee / NPR or ₨", - "text": "NPR", - "symbol": "₨" - }, - { - "id": 148, - "value": "Netherlands Euro/ EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 149, - "value": "Netherlands Antilles Guilder / ANG or ƒ", - "text": "ANG", - "symbol": "ƒ" - }, - - { - "id": 150, - "value": "New Zealand Dollar / NZD or $", - "text": "NZD", - "symbol": "$" - }, - { - "id": 151, - "value": "Nicaragua Cordoba / NIO or C$", - "text": "NIO", - "symbol": "C$" - }, - { - "id": 152, - "value": "South Georgia and the South Sandwich Islands Pound / GBP or £", - "text": "GBP", - "symbol": "£" - }, - - { - "id": 153, - "value": "South Africa Rand / ZAR or R", - "text": "ZAR", - "symbol": "R" - }, - - { - "id": 154, - "value": "Nigeria Naira / NGN or ₦", - "text": "NGN", - "symbol": "₦" - }, - { - "id": 155, - "value": "Niue Dollar / NZD or $", - "text": "NZD", - "symbol": "$" - }, - { - "id": 156, - "value": "Norfolk Island Dollar / AUD or $", - "text": "AUD", - "symbol": "$" - }, - { - "id": 157, - "value": "North Korea Won / KPW or ₩", - "text": "KPW", - "symbol": "₩" - }, - { - "id": 158, - "value": "Northern Mariana Islands Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 159, - "value": "Norway Krone / NOK or kr", - "text": "NOK", - "symbol": "kr" - }, - { - "id": 160, - "value": "Oman Rial / OMR or ﷼", - "text": "OMR", - "symbol": "﷼" - }, - { - "id": 161, - "value": "Pakistan Rupee / PKR or ₨", - "text": "PKR", - "symbol": "₨" - }, - { - "id": 162, - "value": "Palau Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 163, - "value": "Palestinian Territory Shekel / ILS or ₪", - "text": "ILS", - "symbol": "₪" - }, - { - "id": 164, - "value": "Panama Balboa / PAB or B/.", - "text": "PAB", - "symbol": "B/." - }, - { - "id": 165, - "value": "Somalia Shilling / SOS or S", - "text": "SOS", - "symbol": "S" - }, - - { - "id": 166, - "value": "Paraguay Guarani / PYG or Gs", - "text": "PYG", - "symbol": "Gs" - }, - { - "id": 167, - "value": "Peru Sol / PEN or S/.", - "text": "PEN", - "symbol": "S/." - }, - { - "id": 168, - "value": "Philippines Peso / PHP or Php", - "text": "PHP", - "symbol": "Php" - }, - { - "id": 169, - "value": "Pitcairn Dollar / NZD or $", - "text": "NZD", - "symbol": "$" - }, - { - "id": 170, - "value": "Poland Zloty / PLN or zł", - "text": "PLN", - "symbol": "zł" - }, - { - "id": 171, - "value": "Portugal Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 172, - "value": "Puerto Rico Dollar / USD or $", - "text": "USD", - "symbol": "$" - }, - { - "id": 173, - "value": "Qatar Rial / QAR or ﷼", - "text": "QAR", - "symbol": "﷼" - }, - { - "id": 174, - "value": "Republic of the Congo Franc / XAF or FCF", - "text": "XAF", - "symbol": "FCF" - }, - { - "id": 175, - "value": "Reunion Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 176, - "value": "Romania Leu / RON or lei", - "text": "RON", - "symbol": "lei" - }, - { - "id": 177, - "value": "Russia Ruble / RUB or руб", - "text": "RUB", - "symbol": "руб" - }, - - { - "id": 178, - "value": "Solomon Islands Dollar / SBD or $", - "text": "SBD", - "symbol": "$" - }, - - { - "id": 179, - "value": "Saint Helena Pound / SHP or £", - "text": "SHP", - "symbol": "£" - }, - { - "id": 180, - "value": "Saint Kitts and Nevis Dollar / XCD or $", - "text": "XCD", - "symbol": "$" - }, - { - "id": 181, - "value": "Saint Lucia Dollar / XCD or $", - "text": "XCD", - "symbol": "$" - }, - { - "id": 182, - "value": "Saint Pierre and Miquelon Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 183, - "value": "Saint Vincent and the Grenadines Dollar / XCD or $", - "text": "XCD", - "symbol": "$" - }, - { - "id": 184, - "value": "Samoa Tala / WST or WS$", - "text": "WST", - "symbol": "WS$" - }, - { - "id": 185, - "value": "San Marino Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - { - "id": 186, - "value": "Sao Tome and Principe Dobra/ STD or Db", - "text": "STD", - "symbol": "Db" - }, - { - "id": 187, - "value": "Saudi Arabia Rial / SAR or ﷼", - "text": "SAR", - "symbol": "﷼" - }, - { - "id": 188, - "value": "Slovenia Euro / EUR or €", - "text": "EUR", - "symbol": "€" - }, - - { - "id": 189, - "value": "Serbia and Montenegro Dinar / RSD or Дин", - "text": "RSD", - "symbol": "Дин" - }, - { - "id": 190, - "value": "Seychelles Rupee / SCR or ₨", - "text": "SCR", - "symbol": "₨" - }, - { - "id": 191, - "value": "Sierra Leone Leone / SLL or Le", - "text": "SLL", - "symbol": "Le" - }, - { - "id": 192, - "value": "Singapore Dollar / SGD or $", - "text": "SGD", - "symbol": "$" - }, - { - "id": 193, - "value": "Slovakia Koruna / SKK or Sk", - "text": "SKK", - "symbol": "Sk" - } - - ] + "currency": [ + { + "id": 1, + "value": "Afghanistan Afghani / AFN or؋ ", + "text": "AFN", + "symbol": "؋" + }, + { + "id": 2, + "value": "Albania Lek / ALL or Lek", + "text": "ALL", + "symbol": "Lek" + }, + { + "id": 3, + "value": "American Samoa US Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 4, + "value": "Andorra Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 5, + "value": "Angola Kwanza / AOA or Kz", + "text": "AOA", + "symbol": "Kz" + }, + { + "id": 6, + "value": "Anguilla Dollar / XCD or $", + "text": "XCD", + "symbol": "$" + }, + { + "id": 7, + "value": "Antigua and Barbuda Dollar / XCD or $", + "text": "XCD", + "symbol": "$" + }, + { + "id": 8, + "value": "Argentina Peso / ARS or $", + "text": "ARS", + "symbol": "$" + }, + { + "id": 9, + "value": "Aruba Guilder / AWG or ƒ ", + "text": "AWG", + "symbol": "ƒ" + }, + { + "id": 10, + "value": "Australia Dollar / AUD or $", + "text": "AUD", + "symbol": "$" + }, + { + "id": 11, + "value": "Austria Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 12, + "value": "Azerbaijan Manat / AZN or ман", + "text": "AZN", + "symbol": "ман" + }, + { + "id": 13, + "value": "Bahamas Dollar / BSD or $", + "text": "BSD", + "symbol": "$" + }, + { + "id": 14, + "value": "Barbados Dollar / BBD or $", + "text": "BBD", + "symbol": "$" + }, + { + "id": 15, + "value": "Venezuela Bolivar / VEF or Bs", + "text": "VEF", + "symbol": "Bs" + }, + { + "id": 16, + "value": "Vietnam Dong / VND or ₫", + "text": "VND", + "symbol": "₫" + }, + { + "id": 17, + "value": "Yemen Rial / YER or ﷼", + "text": "YER", + "symbol": "﷼" + }, + { + "id": 18, + "value": "Zambia Kwacha / ZMK or ZK", + "text": "ZMK", + "symbol": "ZK" + }, + { + "id": 19, + "value": "Zimbabwe Dollar / ZWD or Z$", + "text": "ZWD", + "symbol": "Z$" + }, + { + "id": 20, + "value": "Belarus Ruble / BYR or p.", + "text": "BYR", + "symbol": "p." + }, + { + "id": 21, + "value": "Belgium Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 22, + "value": "Belize Dollar / BZD or BZ$", + "text": "BZD", + "symbol": "BZ$" + }, + { + "id": 23, + "value": "Bermuda Dollar / BMD or $", + "text": "BMD", + "symbol": "$" + }, + { + "id": 24, + "value": "Vanuatu Vatu / VUV or Vt", + "text": "VUV", + "symbol": "Vt" + }, + { + "id": 25, + "value": "Vatican Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 26, + "value": "Bolivia Boliviano / BOB or $b", + "text": "BOB", + "symbol": "$b" + }, + { + "id": 27, + "value": "Bosnia and Herzegovina Marka / BAM or KM", + "text": "BAM", + "symbol": "KM" + }, + { + "id": 28, + "value": "Botswana Pula / BWP or P", + "text": "BWP", + "symbol": "P" + }, + { + "id": 29, + "value": "Bouvet Island Krone / NOK or kr", + "text": "NOK", + "symbol": "kr" + }, + { + "id": 30, + "value": "Brazil Real / BRL or R$", + "text": "BRL", + "symbol": "R$" + }, + { + "id": 31, + "value": "British Indian Ocean Territory Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 32, + "value": "British Virgin Islands Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 33, + "value": "Brunei Dollar / BND or $", + "text": "BND", + "symbol": "$" + }, + { + "id": 34, + "value": "Bulgaria Lev / BGN or лв", + "text": "BGN", + "symbol": "лв" + }, + { + "id": 35, + "value": "Uruguay Peso / UYU or $U", + "text": "UYU", + "symbol": "$U" + }, + { + "id": 36, + "value": "Uzbekistan Som / UZS or лв", + "text": "UZS", + "symbol": "лв" + }, + { + "id": 37, + "value": "Cambodia Riels / KHR or ៛", + "text": "KHR", + "symbol": "៛" + }, + { + "id": 38, + "value": "Cameroon Franc / XAF or FCF", + "text": "XAF", + "symbol": "FCF" + }, + { + "id": 39, + "value": "Canada Dollar / CAD or $", + "text": "CAD", + "symbol": "$" + }, + { + "id": 40, + "value": "United States Minor Outlying Islands Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 41, + "value": "Cayman Islands Dollar / KYD or $", + "text": "KYD", + "symbol": "$" + }, + { + "id": 42, + "value": "Central African Republic Franc / XAF or FCF", + "text": "XAF", + "symbol": "FCF" + }, + { + "id": 43, + "value": "China YuanRenminbi / CNY or ¥", + "text": "CNY", + "symbol": "¥" + }, + { + "id": 44, + "value": "United Kingdom Pound / GBP or £", + "text": "GBP", + "symbol": "£" + }, + { + "id": 45, + "value": "United States Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 46, + "value": "Christmas Island Dollar / AUD or $", + "text": "AUD", + "symbol": "$" + }, + { + "id": 47, + "value": "Cocos Islands Dollar / AUD or $", + "text": "AUD", + "symbol": "$" + }, + { + "id": 48, + "value": "Colombia Peso / COP or $", + "text": "COP", + "symbol": "$" + }, + { + "id": 49, + "value": "Ukraine Hryvnia / UAH or ₴", + "text": "UAH", + "symbol": "₴" + }, + { + "id": 50, + "value": "Cook Islands Dollar / NZD or $", + "text": "NZD", + "symbol": "$" + }, + { + "id": 51, + "value": "Costa Rica Colon / CRC or ₡", + "text": "CRC", + "symbol": "₡" + }, + { + "id": 52, + "value": "Croatia Kuna / HRK or kn", + "text": "HRK", + "symbol": "kn" + }, + { + "id": 53, + "value": "Cuba Peso / CUP or ₱", + "text": "CUP", + "symbol": "₱" + }, + { + "id": 54, + "value": "Czech Republic Koruna / CZK or Kč", + "text": "CZK", + "symbol": "Kč" + }, + { + "id": 55, + "value": "Denmark Krone / DKK or kr", + "text": "DKK", + "symbol": "kr" + }, + { + "id": 56, + "value": "Turks and Caicos Islands Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 57, + "value": "Tuvalu Dollar / AUD or $", + "text": "AUD", + "symbol": "$" + }, + { + "id": 58, + "value": "U.S. Virgin Islands Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 59, + "value": "Dominica Dollar / XCD or $", + "text": "XCD", + "symbol": "$" + }, + { + "id": 60, + "value": "Dominican Republic Peso / DOP or RD$", + "text": "DOP", + "symbol": "RD$" + }, + { + "id": 61, + "value": "East Timor Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 62, + "value": "Ecuador Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 63, + "value": "Egypt Pound / EGP or £", + "text": "EGP", + "symbol": "£" + }, + { + "id": 64, + "value": "El Salvador Colone / SVC or $", + "text": "SVC", + "symbol": "$" + }, + { + "id": 65, + "value": "Equatorial Guinea Franc / XAF or FCF", + "text": "XAF", + "symbol": "FCF" + }, + { + "id": 66, + "value": "Eritrea Nakfa / ERN or Nfk", + "text": "ERN", + "symbol": "Nfk" + }, + { + "id": 67, + "value": "Estonia Kroon / EEK or kr", + "text": "EEK", + "symbol": "kr" + }, + { + "id": 68, + "value": "Turkmenistan Manat / TMM or m", + "text": "TMM", + "symbol": "m" + }, + { + "id": 69, + "value": "Falkland Islands Pound / FKP or £", + "text": "FKP", + "symbol": "£" + }, + { + "id": 70, + "value": "Faroe Islands Krone / DKK or kr", + "text": "DKK", + "symbol": "kr" + }, + { + "id": 71, + "value": "Fiji Dollar / FJD or $", + "text": "FJD ", + "symbol": "$" + }, + { + "id": 72, + "value": "Finland Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 73, + "value": "France Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 74, + "value": "French Guiana Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 75, + "value": "Turkmenistan Manat / TMM or m", + "text": "TMM", + "symbol": "m" + }, + { + "id": 76, + "value": "French Southern Territories Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 77, + "value": "Gabon Franc / XAF or FCF", + "text": "XAF", + "symbol": "FCF" + }, + { + "id": 78, + "value": "Gambia Dalasi / GMD or D", + "text": "GMD", + "symbol": "D" + }, + { + "id": 79, + "value": "Turkey Lira / TRY or YTL", + "text": "TRY", + "symbol": "YTL" + }, + { + "id": 80, + "value": "Germany Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 81, + "value": "Ghana Cedi / GHC or ¢", + "text": "GHC", + "symbol": "¢" + }, + { + "id": 82, + "value": "Gibraltar Pound / GIP or £", + "text": "GIP", + "symbol": "£" + }, + { + "id": 83, + "value": "Greece Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 84, + "value": "Greenland Krone / DKK or kr", + "text": "DKK", + "symbol": "kr" + }, + { + "id": 85, + "value": "Grenada Dollar / XCD or $", + "text": "XCD", + "symbol": "$" + }, + { + "id": 86, + "value": "Guadeloupe Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 87, + "value": "Guam Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 88, + "value": "Guatemala Quetzal / GTQ or Q", + "text": "GTQ", + "symbol": "Q" + }, + { + "id": 89, + "value": "Tonga Paanga / TOP or T$", + "text": "TOP", + "symbol": "T$" + }, + { + "id": 90, + "value": "Trinidad and Tobago Dollar / TTD or TT$", + "text": "TTD", + "symbol": "TT$" + }, + { + "id": 91, + "value": "Guyana Dollar / GYD or $", + "text": "GYD", + "symbol": "$" + }, + { + "id": 92, + "value": "Haiti Gourde / HTG or G", + "text": "HTG", + "symbol": "G" + }, + { + "id": 93, + "value": "Heard Island and McDonald Islands Dollar / AUD or $", + "text": "AUD", + "symbol": "$" + }, + { + "id": 94, + "value": "Honduras Lempira / HNL or L", + "text": "HNL", + "symbol": "L" + }, + { + "id": 95, + "value": "Hong Kong Dollar / HKD or $", + "text": "HKD", + "symbol": "$" + }, + { + "id": 96, + "value": "Hungary Forint / HUF or Ft", + "text": "HUF", + "symbol": "Ft" + }, + { + "id": 97, + "value": "Iceland Krona / ISK or kr", + "text": "ISK", + "symbol": "kr" + }, + { + "id": 98, + "value": "India Rupee / INR or ₹", + "text": "INR", + "symbol": "₹" + }, + { + "id": 99, + "value": "Indonesia Rupiah / IDR or Rp", + "text": "IDR", + "symbol": "Rp" + }, + { + "id": 100, + "value": "Iran Rial / IRR or ﷼", + "text": "IRR", + "symbol": "﷼" + }, + { + "id": 101, + "value": "Tokelau Dollar / NZD or $", + "text": "NZD", + "symbol": "$" + }, + { + "id": 102, + "value": "Ireland Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 103, + "value": "Israel Shekel / ILS or ₪", + "text": "ILS", + "symbol": "₪" + }, + { + "id": 104, + "value": "Italy Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 105, + "value": "Jamaica Dollar / JMD or $", + "text": "JMD", + "symbol": "$" + }, + { + "id": 106, + "value": "Japan Yen / JPY or ¥", + "text": "JPY", + "symbol": "¥" + }, + { + "id": 107, + "value": "Kazakhstan Tenge / KZT or лв", + "text": "KZT", + "symbol": "лв" + }, + { + "id": 108, + "value": "Kiribati Dollar / AUD or $", + "text": "AUD", + "symbol": "$" + }, + { + "id": 109, + "value": "Switzerland Franc / CHF or CHF", + "text": "CHF", + "symbol": "CHF" + }, + { + "id": 110, + "value": "Syria Pound / SYP or £", + "text": "SYP", + "symbol": "£" + }, + { + "id": 111, + "value": "Taiwan Dollar / TWD or NT$", + "text": "TWD", + "symbol": "NT$" + }, + { + "id": 112, + "value": "Thailand Baht / THB or ฿", + "text": "THB", + "symbol": "฿" + }, + { + "id": 113, + "value": "Kyrgyzstan Som / KGS or лв", + "text": "KGS", + "symbol": "лв" + }, + { + "id": 114, + "value": "Laos Kip / LAK or ₭", + "text": "LAK", + "symbol": "₭" + }, + { + "id": 115, + "value": "Latvia Lat / LVL or Ls", + "text": "LVL", + "symbol": "Ls" + }, + { + "id": 116, + "value": "Lebanon Pound / LBP or £", + "text": "LBP", + "symbol": "£" + }, + { + "id": 117, + "value": "Lesotho Loti / LSL or L", + "text": "LSL", + "symbol": "L" + }, + { + "id": 118, + "value": "Liberia Dollar / LRD or $", + "text": "LRD", + "symbol": "$" + }, + { + "id": 119, + "value": "Sweden Krona / SEK or kr", + "text": "SEK", + "symbol": "kr" + }, + { + "id": 120, + "value": "Liechtenstein Franc / CHF or CHF", + "text": "CHF", + "symbol": "CHF" + }, + { + "id": 121, + "value": "Lithuania Litas / LTL or Lt", + "text": "LTL", + "symbol": "Lt" + }, + { + "id": 122, + "value": "Luxembourg Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 123, + "value": "Macao Pataca / MOP or MOP", + "text": "MOP", + "symbol": "MOP" + }, + { + "id": 124, + "value": "Macedonia Denar / MKD or ден", + "text": "MKD", + "symbol": "ден" + }, + { + "id": 125, + "value": "Svalbard and Jan Mayen Krone / NOK or kr", + "text": "NOK", + "symbol": "kr" + }, + { + "id": 126, + "value": "Malawi Kwacha / MWK or MK", + "text": "MWK", + "symbol": "MK" + }, + { + "id": 127, + "value": "Malaysia Ringgit / MYR or RM", + "text": "MYR", + "symbol": "RM" + }, + { + "id": 128, + "value": "Maldives Rufiyaa / MVR or Rf", + "text": "MVR", + "symbol": "Rf" + }, + { + "id": 129, + "value": "Sri Lanka Rupee / LKR or ₨", + "text": "LKR", + "symbol": "₨" + }, + { + "id": 130, + "value": "Surivalue Dollar / SRD or $", + "text": "SRD", + "symbol": "$" + }, + { + "id": 131, + "value": "Marshall Islands Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 132, + "value": "Martinique Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 133, + "value": "Mauritania Ouguiya / MRO or UM", + "text": "MRO", + "symbol": "UM" + }, + { + "id": 134, + "value": "Mauritius Rupee / MUR or ₨", + "text": "MUR", + "symbol": "₨" + }, + { + "id": 135, + "value": "Mayotte Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 136, + "value": "Mexico Peso / MXN or $", + "text": "MXN", + "symbol": "$" + }, + { + "id": 137, + "value": "Micronesia Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 138, + "value": "Spain Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 139, + "value": "Monaco Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 140, + "value": "Mongolia Tugrik / MNT or ₮", + "text": "MNT", + "symbol": "₮" + }, + { + "id": 141, + "value": "Montserrat Dollar / XCD or $", + "text": "XCD", + "symbol": "$" + }, + { + "id": 142, + "value": "South Korea Won / KRW or ₩", + "text": "KRW", + "symbol": "₩" + }, + { + "id": 143, + "value": "Mozambique Meticail / MZN or MT", + "text": "MZN", + "symbol": "MT" + }, + { + "id": 144, + "value": "Myanmar Kyat / MMK or K", + "text": "MMK", + "symbol": "K" + }, + { + "id": 145, + "value": "Namibia Dollar / NAD or $", + "text": "NAD", + "symbol": "$" + }, + { + "id": 146, + "value": "Nauru Dollar / AUD or $", + "text": "AUD", + "symbol": "$" + }, + { + "id": 147, + "value": "Nepal Rupee / NPR or ₨", + "text": "NPR", + "symbol": "₨" + }, + { + "id": 148, + "value": "Netherlands Euro/ EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 149, + "value": "Netherlands Antilles Guilder / ANG or ƒ", + "text": "ANG", + "symbol": "ƒ" + }, + { + "id": 150, + "value": "New Zealand Dollar / NZD or $", + "text": "NZD", + "symbol": "$" + }, + { + "id": 151, + "value": "Nicaragua Cordoba / NIO or C$", + "text": "NIO", + "symbol": "C$" + }, + { + "id": 152, + "value": "South Georgia and the South Sandwich Islands Pound / GBP or £", + "text": "GBP", + "symbol": "£" + }, + { + "id": 153, + "value": "South Africa Rand / ZAR or R", + "text": "ZAR", + "symbol": "R" + }, + { + "id": 154, + "value": "Nigeria Naira / NGN or ₦", + "text": "NGN", + "symbol": "₦" + }, + { + "id": 155, + "value": "Niue Dollar / NZD or $", + "text": "NZD", + "symbol": "$" + }, + { + "id": 156, + "value": "Norfolk Island Dollar / AUD or $", + "text": "AUD", + "symbol": "$" + }, + { + "id": 157, + "value": "North Korea Won / KPW or ₩", + "text": "KPW", + "symbol": "₩" + }, + { + "id": 158, + "value": "Northern Mariana Islands Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 159, + "value": "Norway Krone / NOK or kr", + "text": "NOK", + "symbol": "kr" + }, + { + "id": 160, + "value": "Oman Rial / OMR or ﷼", + "text": "OMR", + "symbol": "﷼" + }, + { + "id": 161, + "value": "Pakistan Rupee / PKR or ₨", + "text": "PKR", + "symbol": "₨" + }, + { + "id": 162, + "value": "Palau Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 163, + "value": "Palestinian Territory Shekel / ILS or ₪", + "text": "ILS", + "symbol": "₪" + }, + { + "id": 164, + "value": "Panama Balboa / PAB or B/.", + "text": "PAB", + "symbol": "B/." + }, + { + "id": 165, + "value": "Somalia Shilling / SOS or S", + "text": "SOS", + "symbol": "S" + }, + { + "id": 166, + "value": "Paraguay Guarani / PYG or Gs", + "text": "PYG", + "symbol": "Gs" + }, + { + "id": 167, + "value": "Peru Sol / PEN or S/.", + "text": "PEN", + "symbol": "S/." + }, + { + "id": 168, + "value": "Philippines Peso / PHP or Php", + "text": "PHP", + "symbol": "Php" + }, + { + "id": 169, + "value": "Pitcairn Dollar / NZD or $", + "text": "NZD", + "symbol": "$" + }, + { + "id": 170, + "value": "Poland Zloty / PLN or zł", + "text": "PLN", + "symbol": "zł" + }, + { + "id": 171, + "value": "Portugal Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 172, + "value": "Puerto Rico Dollar / USD or $", + "text": "USD", + "symbol": "$" + }, + { + "id": 173, + "value": "Qatar Rial / QAR or ﷼", + "text": "QAR", + "symbol": "﷼" + }, + { + "id": 174, + "value": "Republic of the Congo Franc / XAF or FCF", + "text": "XAF", + "symbol": "FCF" + }, + { + "id": 175, + "value": "Reunion Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 176, + "value": "Romania Leu / RON or lei", + "text": "RON", + "symbol": "lei" + }, + { + "id": 177, + "value": "Russia Ruble / RUB or руб", + "text": "RUB", + "symbol": "руб" + }, + { + "id": 178, + "value": "Solomon Islands Dollar / SBD or $", + "text": "SBD", + "symbol": "$" + }, + { + "id": 179, + "value": "Saint Helena Pound / SHP or £", + "text": "SHP", + "symbol": "£" + }, + { + "id": 180, + "value": "Saint Kitts and Nevis Dollar / XCD or $", + "text": "XCD", + "symbol": "$" + }, + { + "id": 181, + "value": "Saint Lucia Dollar / XCD or $", + "text": "XCD", + "symbol": "$" + }, + { + "id": 182, + "value": "Saint Pierre and Miquelon Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 183, + "value": "Saint Vincent and the Grenadines Dollar / XCD or $", + "text": "XCD", + "symbol": "$" + }, + { + "id": 184, + "value": "Samoa Tala / WST or WS$", + "text": "WST", + "symbol": "WS$" + }, + { + "id": 185, + "value": "San Marino Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 186, + "value": "Sao Tome and Principe Dobra/ STD or Db", + "text": "STD", + "symbol": "Db" + }, + { + "id": 187, + "value": "Saudi Arabia Rial / SAR or ﷼", + "text": "SAR", + "symbol": "﷼" + }, + { + "id": 188, + "value": "Slovenia Euro / EUR or €", + "text": "EUR", + "symbol": "€" + }, + { + "id": 189, + "value": "Serbia and Montenegro Dinar / RSD or Дин", + "text": "RSD", + "symbol": "Дин" + }, + { + "id": 190, + "value": "Seychelles Rupee / SCR or ₨", + "text": "SCR", + "symbol": "₨" + }, + { + "id": 191, + "value": "Sierra Leone Leone / SLL or Le", + "text": "SLL", + "symbol": "Le" + }, + { + "id": 192, + "value": "Singapore Dollar / SGD or $", + "text": "SGD", + "symbol": "$" + }, + { + "id": 193, + "value": "Slovakia Koruna / SKK or Sk", + "text": "SKK", + "symbol": "Sk" + }, + { + "id": 194, + "value": "Algeria Dinar / DZD or دج", + "text": "DZD", + "symbol": "دج" + }, + { + "id": 195, + "value": "Armenia Dram / AMD or ֏", + "text": "AMD", + "symbol": "֏" + }, + { + "id": 196, + "value": "Bahrain Dinar / BHD or .د.ب", + "text": "BHD", + "symbol": ".د.ب" + }, + { + "id": 197, + "value": "Bangladesh Taka / BDT or ৳", + "text": "BDT", + "symbol": "৳" + }, + { + "id": 198, + "value": "Belarus Ruble / BYN or Br", + "text": "BYN", + "symbol": "Br" + }, + { + "id": 199, + "value": "West African CFA Franc / XOF or CFA", + "text": "XOF", + "symbol": "CFA" + }, + { + "id": 200, + "value": "Bhutan Ngultrum / BTN or Nu.", + "text": "BTN", + "symbol": "Nu." + }, + { + "id": 201, + "value": "Burundi Franc / BIF or FBu", + "text": "BIF", + "symbol": "FBu" + }, + { + "id": 202, + "value": "Cape Verde Escudo / CVE or $", + "text": "CVE", + "symbol": "$" + }, + { + "id": 203, + "value": "Chile Peso / CLP or $", + "text": "CLP", + "symbol": "$" + }, + { + "id": 204, + "value": "Comoros Franc / KMF or CF", + "text": "KMF", + "symbol": "CF" + }, + { + "id": 205, + "value": "Congo Franc / CDF or FC", + "text": "CDF", + "symbol": "FC" + }, + { + "id": 206, + "value": "Djibouti Franc / DJF or Fdj", + "text": "DJF", + "symbol": "Fdj" + }, + { + "id": 207, + "value": "Swaziland Lilangeni / SZL or E", + "text": "SZL", + "symbol": "E" + }, + { + "id": 208, + "value": "Ethiopia Birr / ETB or Br", + "text": "ETB", + "symbol": "Br" + }, + { + "id": 209, + "value": "Fiji Islands Dollar / FJD or FJ$", + "text": "FJD", + "symbol": "FJ$" + }, + { + "id": 210, + "value": "CFP Franc / XPF or ₣", + "text": "XPF", + "symbol": "₣" + }, + { + "id": 211, + "value": "Georgia Lari / GEL or ₾", + "text": "GEL", + "symbol": "₾" + }, + { + "id": 212, + "value": "Ghana Cedi / GHS or GH₵", + "text": "GHS", + "symbol": "GH₵" + }, + { + "id": 213, + "value": "Guinea Franc / GNF or FG", + "text": "GNF", + "symbol": "FG" + }, + { + "id": 214, + "value": "Iraq Dinar / IQD or ع.د", + "text": "IQD", + "symbol": "ع.د" + }, + { + "id": 215, + "value": "Jordan Dinar / JOD or د.ا", + "text": "JOD", + "symbol": "د.ا" + }, + { + "id": 216, + "value": "Kenya Shilling / KES or KSh", + "text": "KES", + "symbol": "KSh" + }, + { + "id": 217, + "value": "Kuwait Dinar / KWD or د.ك", + "text": "KWD", + "symbol": "د.ك" + }, + { + "id": 218, + "value": "Libya Dinar / LYD or ل.د", + "text": "LYD", + "symbol": "ل.د" + }, + { + "id": 219, + "value": "Madagascar Ariary / MGA or Ar", + "text": "MGA", + "symbol": "Ar" + }, + { + "id": 220, + "value": "Mauritania Ouguiya / MRU or UM", + "text": "MRU", + "symbol": "UM" + }, + { + "id": 221, + "value": "Moldova Leu / MDL or L", + "text": "MDL", + "symbol": "L" + }, + { + "id": 222, + "value": "Morocco Dirham / MAD or د.م.", + "text": "MAD", + "symbol": "د.م." + }, + { + "id": 223, + "value": "Papua new Guinea Kina / PGK or K", + "text": "PGK", + "symbol": "K" + }, + { + "id": 224, + "value": "Rwanda Franc / RWF or FRw", + "text": "RWF", + "symbol": "FRw" + }, + { + "id": 225, + "value": "Sao Tome and Principe Dobra / STN or Db", + "text": "STN", + "symbol": "Db" + }, + { + "id": 226, + "value": "Sierra Leone Leone / SLE or Le", + "text": "SLE", + "symbol": "Le" + }, + { + "id": 227, + "value": "South Sudan Pound / SSP or £", + "text": "SSP", + "symbol": "£" + }, + { + "id": 228, + "value": "Sudan Pound / SDG or ج.س", + "text": "SDG", + "symbol": "ج.س" + }, + { + "id": 229, + "value": "Tajikistan Somoni / TJS or SM", + "text": "TJS", + "symbol": "SM" + }, + { + "id": 230, + "value": "Tanzania Shilling / TZS or TSh", + "text": "TZS", + "symbol": "TSh" + }, + { + "id": 231, + "value": "Tunisia Dinar / TND or د.ت", + "text": "TND", + "symbol": "د.ت" + }, + { + "id": 232, + "value": "Turkmenistan Manat / TMT or m", + "text": "TMT", + "symbol": "m" + }, + { + "id": 233, + "value": "Uganda Shilling / UGX or USh", + "text": "UGX", + "symbol": "USh" + }, + { + "id": 234, + "value": "United Arab Emirates Dirham / AED or د.إ", + "text": "AED", + "symbol": "د.إ" + }, + { + "id": 235, + "value": "Venezuela Bolivar / VES or Bs.", + "text": "VES", + "symbol": "Bs." + }, + { + "id": 236, + "value": "Zambia Kwacha / ZMW or ZK", + "text": "ZMW", + "symbol": "ZK" + }, + { + "id": 237, + "value": "Zimbabwe Gold / ZWG or ZiG", + "text": "ZWG", + "symbol": "ZiG" + } + ] } \ No newline at end of file diff --git a/api/src/json/gst_rates_2025.json b/api/src/json/gst_rates_2025.json new file mode 100644 index 000000000..bfba98cbf --- /dev/null +++ b/api/src/json/gst_rates_2025.json @@ -0,0 +1,817 @@ +{ + "source": { + "notification": "Notification No. 9/2025-Integrated Tax (Rate)", + "dated": "2025-09-17", + "effective_from": "2025-09-22", + "corrigendum": "2025-09-18", + "retrieved_from": "https://courier.cbic.gov.in/ECCS/advisory/2025/NOTIFICATION%20NO.%209_2025-INTEGRATED%20TAX%20(RATE)%20-1759486719.pdf", + "provenance_note": "Official CBIC courier domain; the file is the ICAI reprint of the notification. Rates are the IGST rates, which are the full GST rate a shop sets (CGST+SGST split that figure in half for intra-state sales).", + "schedules": { + "I": 5, + "II": 18, + "III": 40, + "IV": 3, + "V": 0.25, + "VI": 1.5, + "VII": 28 + } + }, + "rates": { + "01012100": 5.0, + "010129": 5.0, + "0202": 5.0, + "0203": 5.0, + "0204": 5.0, + "0205": 5.0, + "0206": 5.0, + "0207": 5.0, + "0303": 5.0, + "0304": 5.0, + "0305": 5.0, + "0306": 5.0, + "0307": 5.0, + "0308": 5.0, + "0402": 5.0, + "0403": 5.0, + "0404": 5.0, + "0405": 5.0, + "0406": 5.0, + "0408": 5.0, + "0409": 5.0, + "0410": 5.0, + "0502": 5.0, + "0504": 5.0, + "0505": 5.0, + "0508": 5.0, + "0510": 5.0, + "0511": 5.0, + "0713": 5.0, + "0714": 5.0, + "0801": 5.0, + "0802": 5.0, + "0804": 5.0, + "0805": 5.0, + "0806": 5.0, + "0811": 5.0, + "0812": 5.0, + "0813": 5.0, + "0814": 5.0, + "0901": 5.0, + "0902": 5.0, + "0903": 5.0, + "0904": 5.0, + "0905": 5.0, + "0906": 5.0, + "0907": 5.0, + "0908": 5.0, + "0909": 5.0, + "1001": 5.0, + "1002": 5.0, + "1003": 5.0, + "1004": 5.0, + "1005": 5.0, + "1006": 5.0, + "1007": 5.0, + "1008": 5.0, + "1101": 5.0, + "1102": 5.0, + "1103": 5.0, + "1104": 5.0, + "1105": 5.0, + "1106": 5.0, + "1107": 5.0, + "1108": 5.0, + "11090000": 5.0, + "1201": 5.0, + "1202": 5.0, + "1203": 5.0, + "1204": 5.0, + "1205": 5.0, + "1206": 5.0, + "1207": 5.0, + "1208": 5.0, + "1209": 5.0, + "12102000": 5.0, + "1211": 5.0, + "1212": 5.0, + "1301": 5.0, + "1302": 5.0, + "1401": 5.0, + "1501": 5.0, + "1502": 5.0, + "1503": 5.0, + "1504": 5.0, + "1505": 5.0, + "1506": 5.0, + "1507": 5.0, + "1508": 5.0, + "1509": 5.0, + "1510": 5.0, + "1511": 5.0, + "1512": 5.0, + "1513": 5.0, + "1514": 5.0, + "1515": 5.0, + "1516": 5.0, + "1517": 5.0, + "1518": 5.0, + "15200000": 5.0, + "1521": 5.0, + "1522": 5.0, + "1702": 18.0, + "21069020": 28.0, + "2202": 40.0, + "220210": 40.0, + "22029100": 40.0, + "220299": 40.0, + "22029990": 40.0, + "2207": 18.0, + "22071012": 18.0, + "2209": 18.0, + "2401": 28.0, + "2402": 28.0, + "2403": 28.0, + "24041100": 28.0, + "24041200": 18.0, + "24041900": 28.0, + "24049100": 18.0, + "25151220": 18.0, + "25151290": 18.0, + "25161200": 18.0, + "2523": 18.0, + "2601": 18.0, + "2602": 18.0, + "2603": 18.0, + "2604": 18.0, + "2605": 18.0, + "2606": 18.0, + "2607": 18.0, + "2608": 18.0, + "2609": 18.0, + "2610": 18.0, + "2619": 18.0, + "2620": 18.0, + "2621": 18.0, + "2701": 18.0, + "2702": 18.0, + "2703": 18.0, + "2706": 18.0, + "2707": 18.0, + "2708": 18.0, + "2710": 18.0, + "2711": 18.0, + "2712": 18.0, + "2713": 18.0, + "2714": 18.0, + "2715": 18.0, + "29061190": 18.0, + "3102": 18.0, + "3103": 18.0, + "3104": 18.0, + "3105": 18.0, + "3201": 18.0, + "3202": 18.0, + "3203": 18.0, + "3204": 18.0, + "3205": 18.0, + "3206": 18.0, + "3207": 18.0, + "3208": 18.0, + "3209": 18.0, + "3210": 18.0, + "32110000": 18.0, + "3212": 18.0, + "3213": 18.0, + "3214": 18.0, + "3215": 18.0, + "3301": 18.0, + "3302": 18.0, + "3303": 18.0, + "3304": 18.0, + "3305": 18.0, + "3306": 18.0, + "3307": 18.0, + "33074100": 18.0, + "3401": 18.0, + "3402": 18.0, + "3403": 18.0, + "3404": 18.0, + "3405": 18.0, + "3407": 18.0, + "3501": 18.0, + "3502": 18.0, + "3504": 18.0, + "3506": 18.0, + "3507": 18.0, + "3601": 18.0, + "3602": 18.0, + "3603": 18.0, + "3604": 18.0, + "3606": 18.0, + "3701": 18.0, + "3702": 18.0, + "3703": 18.0, + "3704": 18.0, + "3706": 18.0, + "3707": 18.0, + "3801": 18.0, + "3802": 18.0, + "38030000": 18.0, + "3804": 18.0, + "3805": 18.0, + "3806": 18.0, + "3807": 18.0, + "3808": 18.0, + "3809": 18.0, + "3810": 18.0, + "3811": 18.0, + "3812": 18.0, + "3813": 18.0, + "3814": 18.0, + "3815": 18.0, + "3816": 18.0, + "3817": 18.0, + "3818": 18.0, + "3819": 18.0, + "3820": 18.0, + "3821": 18.0, + "3823": 18.0, + "3824": 18.0, + "3825": 18.0, + "3826": 18.0, + "3827": 18.0, + "3901": 18.0, + "3902": 18.0, + "3903": 18.0, + "3904": 18.0, + "3905": 18.0, + "3906": 18.0, + "3907": 18.0, + "3908": 18.0, + "3909": 18.0, + "3910": 18.0, + "3911": 18.0, + "3912": 18.0, + "3913": 18.0, + "3914": 18.0, + "3915": 18.0, + "3916": 18.0, + "3917": 18.0, + "3918": 18.0, + "3919": 18.0, + "3920": 18.0, + "3921": 18.0, + "3922": 18.0, + "3923": 18.0, + "3924": 18.0, + "3925": 18.0, + "3926": 18.0, + "4002": 18.0, + "4003": 18.0, + "4004": 18.0, + "4005": 18.0, + "4006": 18.0, + "4007": 18.0, + "4008": 18.0, + "4009": 18.0, + "4010": 18.0, + "4011": 18.0, + "4012": 18.0, + "4013": 18.0, + "4014": 18.0, + "4015": 18.0, + "4016": 18.0, + "4017": 18.0, + "4201": 18.0, + "4202": 18.0, + "4203": 18.0, + "4205": 18.0, + "4206": 18.0, + "4301": 18.0, + "4302": 18.0, + "4303": 18.0, + "4304": 18.0, + "4403": 18.0, + "4407": 18.0, + "4408": 18.0, + "4409": 18.0, + "4410": 18.0, + "4411": 18.0, + "4412": 18.0, + "4413": 18.0, + "4414": 18.0, + "4418": 18.0, + "4421": 18.0, + "4501": 18.0, + "4702": 18.0, + "4802": 18.0, + "4803": 18.0, + "4804": 18.0, + "4805": 18.0, + "4806": 18.0, + "48062000": 18.0, + "48064010": 18.0, + "4807": 18.0, + "4808": 18.0, + "4809": 18.0, + "4810": 18.0, + "4811": 18.0, + "4812": 18.0, + "4813": 18.0, + "4814": 18.0, + "4816": 18.0, + "4818": 18.0, + "4820": 18.0, + "4821": 18.0, + "4822": 18.0, + "4823": 18.0, + "49060000": 18.0, + "4907": 18.0, + "4908": 18.0, + "4909": 18.0, + "4910": 18.0, + "4911": 18.0, + "56012200": 18.0, + "63053200": 18.0, + "6401": 18.0, + "6402": 18.0, + "6403": 18.0, + "6404": 18.0, + "6405": 18.0, + "6406": 18.0, + "6501": 18.0, + "6502": 18.0, + "65040000": 18.0, + "6505": 18.0, + "6506": 18.0, + "6507": 18.0, + "6702": 18.0, + "6703": 18.0, + "6704": 18.0, + "6801": 18.0, + "6802": 18.0, + "6803": 18.0, + "6804": 18.0, + "6805": 18.0, + "6806": 18.0, + "6807": 18.0, + "6808": 18.0, + "6809": 18.0, + "6810": 18.0, + "6811": 18.0, + "6812": 18.0, + "6813": 18.0, + "6814": 18.0, + "6815": 18.0, + "6901": 18.0, + "6902": 18.0, + "6903": 18.0, + "6904": 18.0, + "6905": 18.0, + "6906": 18.0, + "6907": 18.0, + "6909": 18.0, + "6910": 18.0, + "6914": 18.0, + "7002": 18.0, + "7003": 18.0, + "7004": 18.0, + "7005": 18.0, + "70060000": 18.0, + "7007": 18.0, + "7008": 18.0, + "7009": 18.0, + "7010": 18.0, + "7011": 18.0, + "7013": 18.0, + "7014": 18.0, + "7015": 18.0, + "7016": 18.0, + "7017": 18.0, + "7018": 18.0, + "7019": 18.0, + "7020": 18.0, + "7101": 3.0, + "7103": 0.25, + "7105": 3.0, + "7106": 3.0, + "7107": 3.0, + "7108": 3.0, + "7109": 3.0, + "7110": 3.0, + "7111": 3.0, + "7112": 3.0, + "7113": 3.0, + "7114": 3.0, + "7115": 3.0, + "7116": 3.0, + "7117": 3.0, + "7118": 3.0, + "7201": 18.0, + "7202": 18.0, + "7203": 18.0, + "7204": 18.0, + "7205": 18.0, + "7206": 18.0, + "7207": 18.0, + "7208": 18.0, + "7209": 18.0, + "7210": 18.0, + "7211": 18.0, + "7212": 18.0, + "7213": 18.0, + "7214": 18.0, + "7215": 18.0, + "7216": 18.0, + "7217": 18.0, + "7218": 18.0, + "7219": 18.0, + "7220": 18.0, + "7221": 18.0, + "7222": 18.0, + "7223": 18.0, + "7224": 18.0, + "7225": 18.0, + "7226": 18.0, + "7227": 18.0, + "7228": 18.0, + "7229": 18.0, + "7301": 18.0, + "7302": 18.0, + "7303": 18.0, + "7304": 18.0, + "7305": 18.0, + "7306": 18.0, + "7307": 18.0, + "7308": 18.0, + "7309": 18.0, + "7310": 18.0, + "7311": 18.0, + "7312": 18.0, + "7313": 18.0, + "7314": 18.0, + "7315": 18.0, + "7316": 18.0, + "7317": 18.0, + "7318": 18.0, + "7319": 18.0, + "7320": 18.0, + "7321": 18.0, + "7322": 18.0, + "7323": 18.0, + "73239410": 18.0, + "7324": 18.0, + "7325": 18.0, + "7326": 18.0, + "7401": 18.0, + "7402": 18.0, + "7403": 18.0, + "7404": 18.0, + "7405": 18.0, + "7406": 18.0, + "7407": 18.0, + "7408": 18.0, + "7409": 18.0, + "7410": 18.0, + "7411": 18.0, + "7412": 18.0, + "7413": 18.0, + "7415": 18.0, + "7418": 18.0, + "7419": 18.0, + "7501": 18.0, + "7502": 18.0, + "7503": 18.0, + "7504": 18.0, + "7505": 18.0, + "7506": 18.0, + "7507": 18.0, + "7508": 18.0, + "7601": 18.0, + "7602": 18.0, + "7603": 18.0, + "7604": 18.0, + "7605": 18.0, + "7606": 18.0, + "7607": 18.0, + "7608": 18.0, + "7609": 18.0, + "7610": 18.0, + "7611": 18.0, + "7612": 18.0, + "7613": 18.0, + "7614": 18.0, + "7615": 18.0, + "7616": 18.0, + "7801": 18.0, + "7802": 18.0, + "7804": 18.0, + "7806": 18.0, + "7901": 18.0, + "7902": 18.0, + "7903": 18.0, + "7904": 18.0, + "7905": 18.0, + "7907": 18.0, + "8001": 18.0, + "8002": 18.0, + "8003": 18.0, + "8007": 18.0, + "8101": 18.0, + "8102": 18.0, + "8103": 18.0, + "8104": 18.0, + "8105": 18.0, + "8106": 18.0, + "8107": 18.0, + "8108": 18.0, + "8109": 18.0, + "8110": 18.0, + "8111": 18.0, + "8112": 18.0, + "8113": 18.0, + "8202": 18.0, + "8203": 18.0, + "8204": 18.0, + "8205": 18.0, + "8206": 18.0, + "8207": 18.0, + "8208": 18.0, + "8209": 18.0, + "82100000": 18.0, + "8211": 18.0, + "8212": 18.0, + "82130000": 18.0, + "8214": 18.0, + "8215": 18.0, + "8301": 18.0, + "8302": 18.0, + "8303": 18.0, + "8304": 18.0, + "8305": 18.0, + "8307": 18.0, + "8308": 18.0, + "8309": 18.0, + "8310": 18.0, + "8311": 18.0, + "8401": 18.0, + "8402": 18.0, + "8403": 18.0, + "8404": 18.0, + "8405": 18.0, + "8406": 18.0, + "8407": 18.0, + "8408": 18.0, + "8409": 18.0, + "8410": 18.0, + "8411": 18.0, + "8412": 18.0, + "8413": 18.0, + "8414": 18.0, + "84142010": 18.0, + "84149012": 18.0, + "8415": 18.0, + "8416": 18.0, + "8417": 18.0, + "8418": 18.0, + "8420": 18.0, + "8421": 18.0, + "8422": 18.0, + "8423": 18.0, + "8424": 18.0, + "8425": 18.0, + "8426": 18.0, + "8427": 18.0, + "8428": 18.0, + "8429": 18.0, + "8430": 18.0, + "8431": 18.0, + "8433": 18.0, + "8434": 18.0, + "8435": 18.0, + "8437": 18.0, + "8438": 18.0, + "8439": 18.0, + "8440": 18.0, + "8441": 18.0, + "8442": 18.0, + "8443": 18.0, + "8444": 18.0, + "8445": 18.0, + "8446": 18.0, + "8447": 18.0, + "8448": 18.0, + "8449": 18.0, + "8450": 18.0, + "8451": 18.0, + "8453": 18.0, + "8454": 18.0, + "8455": 18.0, + "8456": 18.0, + "8457": 18.0, + "8458": 18.0, + "8459": 18.0, + "8460": 18.0, + "8461": 18.0, + "8462": 18.0, + "8463": 18.0, + "8464": 18.0, + "8465": 18.0, + "8466": 18.0, + "8467": 18.0, + "8468": 18.0, + "8470": 18.0, + "8471": 18.0, + "8472": 18.0, + "8473": 18.0, + "8474": 18.0, + "8475": 18.0, + "8476": 18.0, + "8477": 18.0, + "8478": 18.0, + "8479": 18.0, + "8480": 18.0, + "8481": 18.0, + "8482": 18.0, + "8483": 18.0, + "8484": 18.0, + "8485": 18.0, + "8486": 18.0, + "8487": 18.0, + "8501": 18.0, + "8502": 18.0, + "8503": 18.0, + "8504": 18.0, + "8505": 18.0, + "8506": 18.0, + "8507": 18.0, + "8508": 18.0, + "8509": 18.0, + "8510": 18.0, + "8511": 18.0, + "8512": 18.0, + "8513": 18.0, + "8514": 18.0, + "8515": 18.0, + "8516": 18.0, + "8517": 18.0, + "8518": 18.0, + "8519": 18.0, + "8521": 18.0, + "8522": 18.0, + "8523": 18.0, + "8524": 18.0, + "8525": 18.0, + "8526": 18.0, + "8527": 18.0, + "8528": 18.0, + "8529": 18.0, + "8530": 18.0, + "8531": 18.0, + "8532": 18.0, + "8533": 18.0, + "85340000": 18.0, + "8535": 18.0, + "8536": 18.0, + "8537": 18.0, + "8538": 18.0, + "8539": 18.0, + "8540": 18.0, + "8541": 18.0, + "8542": 18.0, + "8543": 18.0, + "8544": 18.0, + "8545": 18.0, + "8546": 18.0, + "8547": 18.0, + "85480000": 18.0, + "8549": 18.0, + "8601": 18.0, + "8602": 18.0, + "8603": 18.0, + "8604": 18.0, + "8605": 18.0, + "8606": 18.0, + "8607": 18.0, + "8608": 18.0, + "8609": 18.0, + "8701": 18.0, + "8702": 18.0, + "870331": 18.0, + "8704": 18.0, + "8705": 18.0, + "8706": 18.0, + "8707": 18.0, + "8708": 18.0, + "8709": 18.0, + "8714": 18.0, + "8715": 18.0, + "8716": 18.0, + "8801": 18.0, + "8802": 40.0, + "8804": 18.0, + "8805": 18.0, + "8807": 18.0, + "8903": 18.0, + "89080000": 18.0, + "9001": 18.0, + "9002": 18.0, + "9004": 18.0, + "9005": 18.0, + "9006": 18.0, + "9007": 18.0, + "9008": 18.0, + "9010": 18.0, + "9011": 18.0, + "9012": 18.0, + "9013": 18.0, + "9014": 18.0, + "9015": 18.0, + "9016": 18.0, + "9017": 18.0, + "9022": 18.0, + "9023": 18.0, + "9024": 18.0, + "9025": 18.0, + "9026": 18.0, + "9027": 18.0, + "9028": 18.0, + "9029": 18.0, + "9030": 18.0, + "9031": 18.0, + "9032": 18.0, + "9033": 18.0, + "9101": 18.0, + "9102": 18.0, + "9103": 18.0, + "9104": 18.0, + "9105": 18.0, + "9106": 18.0, + "9107": 18.0, + "9108": 18.0, + "9109": 18.0, + "9110": 18.0, + "9111": 18.0, + "9112": 18.0, + "9113": 18.0, + "9114": 18.0, + "9201": 18.0, + "9202": 18.0, + "9205": 18.0, + "92060000": 18.0, + "9207": 18.0, + "9208": 18.0, + "9209": 18.0, + "9301": 18.0, + "9303": 18.0, + "9304": 18.0, + "9305": 18.0, + "9306": 18.0, + "9307": 18.0, + "9402": 18.0, + "9403": 18.0, + "9404": 18.0, + "9405": 18.0, + "9406": 18.0, + "9503": 18.0, + "9504": 18.0, + "9505": 18.0, + "9506": 18.0, + "9508": 18.0, + "9602": 18.0, + "96040000": 18.0, + "9605": 18.0, + "96062100": 18.0, + "96062200": 18.0, + "9608": 18.0, + "96100000": 18.0, + "9611": 18.0, + "9612": 18.0, + "9613": 18.0, + "9616": 18.0, + "9617": 18.0, + "9618": 18.0, + "96200000": 18.0, + "9801": 18.0, + "9802": 18.0, + "9804": 18.0 + }, + "qualified": { + "0507": 5.0, + "0910": 5.0, + "1404": 5.0, + "4817": 18.0, + "4819": 18.0, + "7102": 1.5, + "7104": 1.5, + "8419": 18.0, + "8703": 40.0, + "870340": 40.0, + "870350": 40.0, + "870360": 40.0, + "870370": 40.0, + "8711": 40.0, + "9401": 18.0, + "9603": 18.0 + } +} \ No newline at end of file diff --git a/api/src/json/state_124);.json b/api/src/json/state_124);.json deleted file mode 100644 index e9a0618e3..000000000 --- a/api/src/json/state_124);.json +++ /dev/null @@ -1 +0,0 @@ -["Ajdabiya"] \ No newline at end of file diff --git a/api/src/json/states.json b/api/src/json/states.json index aef012af5..9e8acfd45 100644 --- a/api/src/json/states.json +++ b/api/src/json/states.json @@ -13557,7 +13557,7 @@ }, { "id": "2712", - "name": "Østfold", + "name": "\u00d8stfold", "country_id": "164" }, { @@ -20601,4 +20601,4 @@ "country_id": "246" } ] -} \ No newline at end of file +} diff --git a/api/src/json/tax_profiles.json b/api/src/json/tax_profiles.json index 404281e38..3b77f4248 100644 --- a/api/src/json/tax_profiles.json +++ b/api/src/json/tax_profiles.json @@ -2,12 +2,28 @@ "_comment": "Country tax profiles (TAX_INTERNATIONALIZATION_RESEARCH.md T0). Keyed by ISO sortname, which branch.sortname stores. _default covers every country without its own entry - single tax, exclusive display, generic wording. Profiles describe presentation and policy; rates stay in each shop's grouptax collection, seeded from countries.json.", "_default": { "label": "Tax", - "registration": { "label": "Tax No.", "regex": null, "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "Tax No.", + "regex": null, + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "exclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": null, "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": null, + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "IN": { "label": "GST", @@ -18,158 +34,436 @@ }, "components": { "mode": "split_equal", - "intra": ["CGST", "SGST"], - "inter": ["IGST"], + "intra": [ + "CGST", + "SGST" + ], + "inter": [ + "IGST" + ], "placeOfSupply": "state" }, "display": "inclusive", - "rounding": { "granularity": "invoice", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Tax Invoice", "itemCode": "HSN" }, - "reports": ["gstr", "tax-summary-by-rate"], - "counterpartyTypes": ["consumer", "regular", "composite", "unregistered"] + "rounding": { + "granularity": "invoice", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Tax Invoice", + "itemCode": "HSN" + }, + "reports": [ + "gstr", + "tax-summary-by-rate" + ], + "counterpartyTypes": [ + "consumer", + "regular", + "composite", + "unregistered" + ], + "regime": "vat_credit" }, "US": { "label": "Sales Tax", - "registration": { "label": "Seller's Permit", "regex": null, "onReceipt": false }, - "components": { "mode": "stacked" }, + "registration": { + "label": "Seller's Permit", + "regex": null, + "onReceipt": false + }, + "components": { + "mode": "stacked" + }, "display": "exclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": false, "wording": null, "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": false, + "wording": null, + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "sales_tax" }, "GB": { "label": "VAT", - "registration": { "label": "VAT No.", "regex": "^GB[0-9]{9}([0-9]{3})?$", "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "VAT No.", + "regex": "^GB[0-9]{9}([0-9]{3})?$", + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "VAT Receipt", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "VAT Receipt", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "CA": { "label": "GST/HST", - "registration": { "label": "GST/HST No.", "regex": null, "onReceipt": true }, - "components": { "mode": "stacked", "separateLines": true }, + "registration": { + "label": "GST/HST No.", + "regex": null, + "onReceipt": true + }, + "components": { + "mode": "stacked", + "separateLines": true + }, "display": "exclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": null, "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": null, + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "AU": { "label": "GST", - "registration": { "label": "ABN", "regex": "^[0-9]{11}$", "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "ABN", + "regex": "^[0-9]{11}$", + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "invoice", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Tax Invoice", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "invoice", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Tax Invoice", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "NZ": { "label": "GST", - "registration": { "label": "GST No.", "regex": null, "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "GST No.", + "regex": null, + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Tax Invoice", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Tax Invoice", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "DE": { "label": "USt.", - "registration": { "label": "USt-IdNr.", "regex": "^DE[0-9]{9}$", "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "USt-IdNr.", + "regex": "^DE[0-9]{9}$", + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": null, "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": null, + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "FR": { "label": "TVA", - "registration": { "label": "No. TVA", "regex": "^FR[0-9A-Z]{2}[0-9]{9}$", "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "No. TVA", + "regex": "^FR[0-9A-Z]{2}[0-9]{9}$", + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": null, "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": null, + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "JP": { "label": "Consumption Tax", - "registration": { "label": "Registration No.", "regex": "^T[0-9]{13}$", "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "Registration No.", + "regex": "^T[0-9]{13}$", + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "invoice", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Qualified Invoice", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "invoice", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Qualified Invoice", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "SG": { "label": "GST", - "registration": { "label": "GST Reg. No.", "regex": null, "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "GST Reg. No.", + "regex": null, + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Tax Invoice", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Tax Invoice", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "AE": { "label": "VAT", - "registration": { "label": "TRN", "regex": "^[0-9]{15}$", "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "TRN", + "regex": "^[0-9]{15}$", + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Tax Invoice", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Tax Invoice", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "SA": { "label": "VAT", - "registration": { "label": "VAT No.", "regex": "^3[0-9]{13}3$", "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "VAT No.", + "regex": "^3[0-9]{13}3$", + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Tax Invoice", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Tax Invoice", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "ZA": { "label": "VAT", - "registration": { "label": "VAT No.", "regex": "^4[0-9]{9}$", "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "VAT No.", + "regex": "^4[0-9]{9}$", + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Tax Invoice", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Tax Invoice", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "MY": { "label": "SST", - "registration": { "label": "SST No.", "regex": null, "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "SST No.", + "regex": null, + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "exclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": null, "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": null, + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "PH": { "label": "VAT", - "registration": { "label": "TIN", "regex": null, "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "TIN", + "regex": null, + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Official Receipt", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Official Receipt", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "ID": { "label": "PPN", - "registration": { "label": "NPWP", "regex": null, "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "NPWP", + "regex": null, + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": null, "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": null, + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" }, "TH": { "label": "VAT", - "registration": { "label": "Tax ID", "regex": "^[0-9]{13}$", "onReceipt": true }, - "components": { "mode": "single" }, + "registration": { + "label": "Tax ID", + "regex": "^[0-9]{13}$", + "onReceipt": true + }, + "components": { + "mode": "single" + }, "display": "inclusive", - "rounding": { "granularity": "line", "mode": "half-up" }, - "receipt": { "breakdownPerRate": true, "wording": "Tax Invoice", "itemCode": null }, - "reports": ["tax-summary-by-rate"] + "rounding": { + "granularity": "line", + "mode": "half-up" + }, + "receipt": { + "breakdownPerRate": true, + "wording": "Tax Invoice", + "itemCode": null + }, + "reports": [ + "tax-summary-by-rate" + ], + "regime": "vat_credit" } } diff --git a/api/src/middleware/auth-rate-limit.js b/api/src/middleware/auth-rate-limit.js index 636cca89a..ef5c8aba4 100644 --- a/api/src/middleware/auth-rate-limit.js +++ b/api/src/middleware/auth-rate-limit.js @@ -1,6 +1,6 @@ const rateLimit = require('express-rate-limit'); const { MongoRateLimitStore } = require('./rate-limit-store'); -const { perClientKey } = require('./rate-limit-key'); +const { perClientKey, perShopKey } = require('./rate-limit-key'); /* * Counters in the database, not in this process's memory. @@ -109,4 +109,23 @@ const registerLimiter = rateLimit({ legacyHeaders: false, }); -module.exports = { loginLimiter, passwordResetLimiter, registerLimiter }; +/* + * Invoice routes are also mounted at the legacy root path, where app.js's + * /api-wide limiter does not run. Keep a separate availability budget here so + * both route prefixes are protected without making a normal till workflow + * share a small credential-guessing budget. + */ +const invoiceLimiter = rateLimit({ + store: new MongoRateLimitStore({ prefix: 'invoice' }), + keyGenerator: perShopKey, + windowMs: 15 * 60 * 1000, + limit: 300, + message: { + status: false, + message: 'Too many invoice requests. Please wait a few minutes and try again.', + }, + standardHeaders: true, + legacyHeaders: false, +}); + +module.exports = { loginLimiter, passwordResetLimiter, registerLimiter, invoiceLimiter }; diff --git a/api/src/middleware/auth.js b/api/src/middleware/auth.js index e15f69679..ef25d7c1f 100644 --- a/api/src/middleware/auth.js +++ b/api/src/middleware/auth.js @@ -175,7 +175,26 @@ const auth = async (req, res, next) => { // GRANT ACCESS TO PROTECTED ROUTE return continueWithTenant(req, res, next, currentUser); } catch (error) { - next(new UnauthorizedError('Invalid token or user not found')); + /* + * Only a BAD TOKEN is a 401 here. This catch used to stamp every + * failure "Invalid token" - including the database timing out under + * load - and this middleware guards users/verify, the session + * heartbeat. So a demo-data install (a zip download and hundreds of + * inserts on a small shared instance) could make one heartbeat's user + * lookup fail, the client saw 401, and it did the only correct thing + * with a 401: signed the owner out, mid-install. An infrastructure + * hiccup is a 500 and a toast, never a sign-out; `protect` below has + * always drawn the line this way. + */ + if ( + error && + (error.name === 'JsonWebTokenError' || + error.name === 'TokenExpiredError' || + error.name === 'NotBeforeError') + ) { + return next(new UnauthorizedError('Invalid token or user not found')); + } + return next(error); } }; @@ -367,7 +386,7 @@ const isLoggedIn = async (req, res, next) => { }; /** - * Optional auth middleware — mirrors PHP session-exceptional behaviour. + * Optional auth middleware - mirrors PHP session-exceptional behaviour. * * PHP dispatcher.php starts a session on EVERY request. For routes listed in * $sessionExceptionalRequest the dispatcher simply skips the "is authenticated?" @@ -411,7 +430,7 @@ const optionalProtect = async (req, res, next) => { } } - // 3) No valid auth — continue anyway (session-exceptional) + // 3) No valid auth - continue anyway (session-exceptional) next(); } catch (_) { next(); diff --git a/api/src/middleware/filter-guard.js b/api/src/middleware/filter-guard.js new file mode 100644 index 000000000..ff012746a --- /dev/null +++ b/api/src/middleware/filter-guard.js @@ -0,0 +1,65 @@ +'use strict'; + +const { findCodeOperator } = require('../utils/mongo-guard'); + +/* + * The gap the app-level '$' sanitiser cannot see into. + * + * app.js walks req.query and req.body and drops any key beginning with '$'. + * That is right for ordinary parameters and genuinely load bearing. But the + * list endpoints take their filter as a JSON STRING: + * + * GET /api/items?filters={"$where":"sleep(5000)"} + * + * To that walk, `filters` is one string value with an ordinary name, so it is + * copied across untouched. The controller then JSON.parses it back into an + * object with its operators intact and spreads the result into a live query. + * The sanitiser is not defeated by cleverness - it simply never sees inside. + * + * Eight controllers parse a filter string this way (items, sales, customers, + * categories, customer-categories, customerCategory, branches, receivings), so + * this belongs in one place rather than eight, and it covers the ninth + * whenever somebody writes it. + * + * NOT a '$' strip, deliberately. These filters are a real query language and + * the app uses it: Sales History sends { sale_process: { $ne: 'KOT' } } to keep + * kitchen tickets out of the list, and date windows are $gte/$lte. Removing + * those would not harden anything - it would silently un-filter lists, and a + * list quietly showing rows it was told to hide is its own kind of bug. The + * line is drawn at CODE EXECUTION instead. + * + * Rejected loudly rather than emptied. A filter silently dropped reads as "no + * results", which sends somebody hunting for missing data instead of fixing + * the request that was refused. + */ +function filterGuard(req, res, next) { + const sources = [req.query, req.body]; + for (const source of sources) { + if (!source || typeof source !== 'object') continue; + for (const [key, value] of Object.entries(source)) { + if (typeof value !== 'string') continue; + const head = value.trim()[0]; + /* Only things that could be an object or an array. Parsing every string + parameter on every request would be real work for no answer. */ + if (head !== '{' && head !== '[') continue; + let parsed; + try { + parsed = JSON.parse(value); + } catch (e) { + continue; /* not JSON - every endpoint here already tolerates that */ + } + const bad = findCodeOperator(parsed); + if (bad) { + console.warn(`Blocked code operator '${bad}' in parameter '${key}'`); + return res.status(400).json({ + type: 'error', + message: `Filter operator "${bad}" is not allowed`, + data: null, + }); + } + } + } + return next(); +} + +module.exports = { filterGuard }; diff --git a/api/src/middleware/settings.validation.js b/api/src/middleware/settings.validation.js index e683e06c0..8bd98f288 100644 --- a/api/src/middleware/settings.validation.js +++ b/api/src/middleware/settings.validation.js @@ -191,8 +191,20 @@ const validatePayment = [ * Validation for updateCommonSettings * PHP: setting.php lines 672-691 */ +/* + * This endpoint takes PARTIAL payloads - the quotation-defaults card and the + * signature upload each send a handful of their own keys and nothing else. + * Demanding fields they never carry made an image upload fail with "Default + * customer is required", which is a question the form never asked the user. + * + * So each rule is skipped when its key is absent (`.optional()`), and only + * validated when the caller actually sends it. A full settings-form save + * sends both keys and is checked exactly as before. Absent means "leave it + * alone"; present-but-empty is still refused. + */ const validateCommonSettings = [ body('default_customer') + .optional() .trim() .notEmpty() .withMessage('Default customer is required') @@ -205,6 +217,7 @@ const validateCommonSettings = [ ), body('default_supplier') + .optional() .trim() .notEmpty() .withMessage('Default supplier is required') diff --git a/api/src/middleware/upload.js b/api/src/middleware/upload.js index e4c75da64..911b95688 100644 --- a/api/src/middleware/upload.js +++ b/api/src/middleware/upload.js @@ -99,5 +99,34 @@ async function attachImageKey(req, res, next) { return next(); } +/* + * Document uploads: the supplier's own PO, an invoice scan, a delivery + * note - attached to a purchase (owner: "we cant upload any file. + * supplier po or some other stuff"). PDFs join the image types; the + * name is regenerated server-side so nothing a filename carries ever + * reaches the filesystem. + */ +const documentUpload = multer({ + storage: multer.diskStorage({ + destination: function (req, file, cb) { + const dir = path.join(uploadDir, 'attachments'); + if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); + cb(null, dir); + }, + filename: function (req, file, cb) { + const uniqueSuffix = Date.now() + '-' + Math.round(Math.random() * 1e9); + const ext = (path.extname(file.originalname) || '').toLowerCase().slice(0, 8); + cb(null, 'doc-' + uniqueSuffix + ext); + }, + }), + limits: { fileSize: 10 * 1024 * 1024 }, + fileFilter: (req, file, cb) => { + const ok = ['application/pdf', 'image/jpeg', 'image/png', 'image/jpg', 'image/webp']; + if (ok.includes(file.mimetype)) cb(null, true); + else cb(new Error('Only PDF and image files can be attached.'), false); + }, +}); + module.exports = upload; module.exports.attachImageKey = attachImageKey; +module.exports.documentUpload = documentUpload; diff --git a/api/src/models/audit.model.js b/api/src/models/audit.model.js index a64daf483..81c2527c7 100644 --- a/api/src/models/audit.model.js +++ b/api/src/models/audit.model.js @@ -5,7 +5,7 @@ // approval, role/permission change). Multi-tenant scoped by license + branch. // // Complements `data_change_log` (field-level CRUD diffs, written by -// BaseModel.changeLog) — this records the ACTION, not the row diff. +// BaseModel.changeLog) - this records the ACTION, not the row diff. // // Native-driver data-access class extending BaseModel (not Mongoose). All DB // operations are inherited; this class only declares the collection + fields. diff --git a/api/src/models/base.model.js b/api/src/models/base.model.js index 696553c95..83d68988b 100644 --- a/api/src/models/base.model.js +++ b/api/src/models/base.model.js @@ -159,7 +159,7 @@ class BaseModel { * optimisation - it is a bug fix. * * MONGODB_URI is set twice during startup. main.js sets a bare - * mongodb://localhost:/PosnicPro as a fallback, and server.js later + * mongodb://127.0.0.1:/PosnicPro as a fallback, and server.js later * replaces it with the credentialed URI that setup-mongodb.js validated. * Requiring the API's routes constructs repositories, each of which builds * a BaseModel, whose constructor starts connecting immediately - with @@ -1285,6 +1285,17 @@ class BaseModel { user_id: userId instanceof ObjectId ? userId : new ObjectId(String(userId)), user_name: userName || '', license: license instanceof ObjectId ? license : new ObjectId(String(license)), + /* + * How this session began, when the caller knows. + * + * 'signup' is the shop being opened FOR somebody the moment they + * created it, not somebody choosing to come back. Both are real + * sessions and both belong in the log, but only one of them answers + * "did this customer return", and the console cannot tell them apart + * from a timestamp. Absent on an ordinary sign-in, which is the vast + * majority of rows and needs no field. + */ + ...(reqInfo.source ? { source: String(reqInfo.source).slice(0, 32) } : {}), }; const insertResult = await collection.insertOne(document); diff --git a/api/src/models/branch.model.js b/api/src/models/branch.model.js index 18193e2af..cee818db8 100644 --- a/api/src/models/branch.model.js +++ b/api/src/models/branch.model.js @@ -11,6 +11,7 @@ const { Schema, Types } = require('mongoose'); * Not Found": a missing-data error for what was really a wrong-database one. */ const { defineModel } = require('../db/model-registry'); +const { featureToggleRepairs } = require('../services/settings-groups'); const BaseModel = require('./base.model'); const User = require('./user.model'); const CustomerModel = require('./customer.model'); @@ -619,6 +620,24 @@ class BranchModel { }; } + /* + * Self-healing read: a features key stored as the STRING 'true'/'false' + * (the group endpoint stored the welcome's checkbox map verbatim) reads + * as enabled through every `!== false` gate in the app. This endpoint + * is the whole legacy frontend's settings read, so the poisoned shops + * heal on their next open - answered fixed, and written back fixed. The + * write is best-effort: failing to repair must not fail the read. + */ + const stringToggleFixes = featureToggleRepairs(branch); + if (Object.keys(stringToggleFixes).length) { + Object.assign(branch, stringToggleFixes); + try { + await this.model.updateOne({ _id: branch._id }, { $set: stringToggleFixes }); + } catch (repairErr) { + console.error('branch toggle repair skipped:', repairErr.message); + } + } + // Simplify ObjectIds and Dates const simplified = BranchModel.simplifyDocument(branch); diff --git a/api/src/models/customer.model.js b/api/src/models/customer.model.js index 7fb4a880e..72ab28ab2 100644 --- a/api/src/models/customer.model.js +++ b/api/src/models/customer.model.js @@ -19,6 +19,11 @@ class CustomerModel extends BaseModel { // Branch Information branch_id: { type: 'ObjectId', select: true }, branch_name: { type: 'String', select: true }, + /* S7 (D5): the account-level relation, mirroring items. Seeded with the + owning branch so nothing moves; sharing a customer between shops is a + deliberate grant, never a migration side effect. select:false keeps it + out of list payloads, exactly as items do. */ + branch_access: { type: 'Array', select: false }, // Basic Information name: { type: 'String', select: true, required: true }, diff --git a/api/src/models/dashboard.model.js b/api/src/models/dashboard.model.js index dc3046364..f0654724f 100644 --- a/api/src/models/dashboard.model.js +++ b/api/src/models/dashboard.model.js @@ -576,7 +576,12 @@ class DashboardModel extends BaseModel { $gte: new Date(fromTimestamp || 0), $lte: new Date(toTimestamp || Date.now()), }, - receiving_status: { $in: ['Received', 'PartialReturn'] }, + /* Deny-list, not allow-list. Legacy and imported rows carry other + spellings ('completed', absent entirely) and an allow-list of two + words silently dropped them from every purchase report and + dashboard number - the owner's "purchase not showing report". + Goods are IN unless the status says they never arrived. */ + receiving_status: { $nin: ['Open', 'Cancelled', 'FullReturn'] }, }); const [salesTotal, purchaseTotal] = await Promise.all([ @@ -626,7 +631,12 @@ class DashboardModel extends BaseModel { }); const purchaseMatch = this.getContextMatch({ ...inRange, - receiving_status: { $in: ['Received', 'PartialReturn'] }, + /* Deny-list, not allow-list. Legacy and imported rows carry other + spellings ('completed', absent entirely) and an allow-list of two + words silently dropped them from every purchase report and + dashboard number - the owner's "purchase not showing report". + Goods are IN unless the status says they never arrived. */ + receiving_status: { $nin: ['Open', 'Cancelled', 'FullReturn'] }, }); const expenseMatch = this.getContextMatch({ ...inRange }); @@ -954,7 +964,12 @@ class DashboardModel extends BaseModel { const purchasecondition = this.getContextMatch({ date: dateRange, - receiving_status: { $in: ['Received', 'PartialReturn'] }, + /* Deny-list, not allow-list. Legacy and imported rows carry other + spellings ('completed', absent entirely) and an allow-list of two + words silently dropped them from every purchase report and + dashboard number - the owner's "purchase not showing report". + Goods are IN unless the status says they never arrived. */ + receiving_status: { $nin: ['Open', 'Cancelled', 'FullReturn'] }, }); const return_condition = this.getContextMatch({ diff --git a/api/src/models/expense.model.js b/api/src/models/expense.model.js index c0448097d..763622be1 100644 --- a/api/src/models/expense.model.js +++ b/api/src/models/expense.model.js @@ -84,7 +84,7 @@ class ExpenseModel extends BaseModel { message: 'Expense added successfully', }; } else { - // Update existing expense — never modify created_date/created_by fields + // Update existing expense - never modify created_date/created_by fields delete expenseData.created_date; delete expenseData.created_by; delete expenseData.created_by_id; diff --git a/api/src/models/install.model.js b/api/src/models/install.model.js index de71e6f9c..d4b5c54f5 100644 --- a/api/src/models/install.model.js +++ b/api/src/models/install.model.js @@ -516,6 +516,21 @@ class InstallModel extends BaseModel { unitId, } = params; + /* + * Everything below is DEMO data, and is tagged as such. + * + * Tagged rather than remembered in a list: a list drifts the moment a + * shop edits or deletes one row, and then switching demo data off either + * misses records or removes the wrong ones. The tag travels with the + * record, so the answer is always on the record itself. + * + * DEMO_PACK names the pack. Today every shop receives the same mixed set + * - a restaurant gets a power amplifier - so it is recorded as what it + * is. Per-industry packs will change this value, not the mechanism. + */ + const DEMO_PACK = 'starter-mixed'; + const demoTag = { demo_pack: DEMO_PACK, demo_seeded_at: now }; + // Load demo data const installDocuments = JSON.parse( fs.readFileSync(path.join(__dirname, '../json/install_documents.json'), 'utf8') @@ -524,6 +539,7 @@ class InstallModel extends BaseModel { // Insert categories const categoryCollection = await this.getCollection('categories'); const categoryMultiData = installDocuments.documents[0].categories.map((cat) => ({ + ...demoTag, name: cat.name, discount_percentage: 0.0, discount_amount: 0, @@ -564,6 +580,7 @@ class InstallModel extends BaseModel { const category = categoryMap[itemValue.category_name]; if (category) { itemMultiData.push({ + ...demoTag, name: itemValue.name, category_id: category.id, category_name: category.name, diff --git a/api/src/models/item.model.js b/api/src/models/item.model.js index 47bdd4fd0..d36ab7f3b 100644 --- a/api/src/models/item.model.js +++ b/api/src/models/item.model.js @@ -44,6 +44,18 @@ const itemSchema = new mongoose.Schema( itemSchema.plugin(toJSON); itemSchema.plugin(paginate); +/* + * The Item List's whitelisted sorts (price, cost, stock, recency, name) each + * walk one of these; without them every re-sort scans the branch's whole + * catalogue. Margin sort is computed per query and cannot use an index - + * that one is documented as a scan in item.repository.findPage. + */ +itemSchema.index({ license: 1, branch_id: 1, selling_price: -1 }); +itemSchema.index({ license: 1, branch_id: 1, company_price: -1 }); +itemSchema.index({ license: 1, branch_id: 1, available_quantity: 1 }); +itemSchema.index({ license: 1, branch_id: 1, updated_date: -1 }); +itemSchema.index({ license: 1, branch_id: 1, name: 1 }); + const Item = defineModel('Item', itemSchema); // Attach the legacy BaseModel-based implementation so callers can import @@ -54,7 +66,7 @@ const Item = defineModel('Item', itemSchema); // ItemRepository. Most instance methods below are legacy-only and should // not be used by new code. // -// Usage examples (legacy only – new code should NOT use these directly): +// Usage examples (legacy only - new code should NOT use these directly): // const Item = require("../models/item.model"); // Mongoose // const LegacyItem = Item.LegacyItemModel; // Legacy class alias // const { LegacyItemModel } = require("../models/item.model"); @@ -67,6 +79,21 @@ class ItemModel { name: { type: 'String', select: true }, itemid: { type: 'String', select: true }, barcode_id: { type: 'String', select: true }, + /* + * The GLOBAL identifier, kept apart from barcode_id on purpose. + * + * barcode_id is whatever this shop prints or scans - it may be a GTIN, an + * in-store code, or a supplier reference somebody typed. gtin is only ever + * set when it validates (see utils/gtin.js), because a wrong GTIN is worse + * than a missing one: it claims to be a product it is not, and anyone + * matching against it inherits the error. + * + * gtin14 is the zero-padded comparison form. A UPC-A and the EAN-13 of the + * same product differ only by a leading zero, so matching on the raw string + * is how one product becomes two rows. + */ + gtin: { type: 'String', select: true }, + gtin14: { type: 'String', select: true }, image: { type: 'String', select: true }, multi_image: { type: 'Array', select: true }, category_id: { type: 'ObjectId', select: true }, @@ -115,8 +142,11 @@ class ItemModel { modifier_group_ids: { type: 'Array', select: true }, // IC1: deliberate ask-at-the-till pricing, set from the item form. open_price: { type: 'Boolean', select: true }, - // Loyverse study L2: the no-image sale-grid tile's colour. + // Loyverse study L2: the no-image sale-grid tile's colour and shape. tile_color: { type: 'String', select: true }, + tile_shape: { type: 'String', select: true }, + // Quick code (owner ask): "22 is hamam soap" - typed + Enter carts it. + plu_code: { type: 'String', select: true }, // Square study Q3: services - a second sellable kind, no stock. item_kind: { type: 'String', select: true }, service_unit: { type: 'String', select: true }, diff --git a/api/src/models/receiving.model.js b/api/src/models/receiving.model.js index c03a11878..0fc9cf249 100644 --- a/api/src/models/receiving.model.js +++ b/api/src/models/receiving.model.js @@ -1100,7 +1100,12 @@ receivingSchema.statics.supplierReceivingReportPage = async function (value, opt branch_id: { $in: branchIds }, // Supplier receiving summary should only include fully/partially // received documents; exclude Open receivings. - receiving_status: { $in: ['Received', 'PartialReturn'] }, + /* Deny-list, not allow-list. Legacy and imported rows carry other + spellings ('completed', absent entirely) and an allow-list of two + words silently dropped them from every purchase report and + dashboard number - the owner's "purchase not showing report". + Goods are IN unless the status says they never arrived. */ + receiving_status: { $nin: ['Open', 'Cancelled', 'FullReturn'] }, }, { updated_date: { $gte: new Date(fromDate), $lte: new Date(toDate) }, @@ -1228,7 +1233,12 @@ receivingSchema.statics.receivingReportPage = async function (value, options = { const andConditions = [ { branch_id: { $in: branchIds }, - receiving_status: { $in: ['Received', 'PartialReturn'] }, + /* Deny-list, not allow-list. Legacy and imported rows carry other + spellings ('completed', absent entirely) and an allow-list of two + words silently dropped them from every purchase report and + dashboard number - the owner's "purchase not showing report". + Goods are IN unless the status says they never arrived. */ + receiving_status: { $nin: ['Open', 'Cancelled', 'FullReturn'] }, }, { date: { $gte: fromDate, $lte: toDate }, @@ -1338,7 +1348,12 @@ receivingSchema.statics.receivingsGraphicalReports = async function (value) { // Received/PartialReturn receivings aggregation const receivedCondition = { branch_id: { $in: branchIds }, - receiving_status: { $in: ['Received', 'PartialReturn'] }, + /* Deny-list, not allow-list. Legacy and imported rows carry other + spellings ('completed', absent entirely) and an allow-list of two + words silently dropped them from every purchase report and + dashboard number - the owner's "purchase not showing report". + Goods are IN unless the status says they never arrived. */ + receiving_status: { $nin: ['Open', 'Cancelled', 'FullReturn'] }, updated_date: { $gte: new Date(fromDate), $lte: new Date(toDate) }, }; if (licenseId) receivedCondition.license = licenseId; @@ -1597,6 +1612,267 @@ receivingSchema.statics.getReceivingOrder = async function (receiving_id) { * @param {String} id - Receiving ID (null for create, ID for update) * @returns {Promise} */ +/* + * Void a purchase (PURCHASE_TAX_PLAN G8). Never a delete: the record stays + * whole and gains an audit line; stock moved by a Received purchase is + * reversed through the same stocklog machinery that put it in; a voided + * purchase leaves the input-credit side of Tax Payable because the + * aggregations exclude Cancelled. An Open order never moved stock, so + * voiding it is bookkeeping only. + */ +receivingSchema.statics.voidReceiving = async function (id, reason, context = {}) { + try { + const baseModel = new BaseModel('receivings'); + const collection = await baseModel.getCollection('receivings'); + const itemsCollection = await baseModel.getCollection('items'); + const stockLogsCollection = await baseModel.getCollection('stocklogs'); + const license = context.license || BaseModel.license; + const loggedUser = context.userId || BaseModel.loggedUser; + const loggedUserName = context.userName || BaseModel.loggedUserName || ''; + const now = new Date(); + + const receiving = await collection.findOne({ + _id: new ObjectId(String(id)), + license: new ObjectId(String(license)), + }); + if (!receiving) return { status: false, message: 'Purchase not found' }; + if (receiving.receiving_status === 'Cancelled') { + return { status: false, message: 'This purchase is already voided' }; + } + + if (receiving.receiving_status === 'Received' || receiving.receiving_status === 'Partial') { + for (const line of receiving.items || []) { + if (!line.item_id || !ObjectId.isValid(String(line.item_id))) continue; + const itemId = new ObjectId(String(line.item_id)); + /* Reverse what actually went INTO stock - on a partial document + that is the cumulative qty_received, not the face quantity. */ + const qty = + line.qty_received !== undefined && line.qty_received !== null + ? parseFloat(line.qty_received) || 0 + : parseFloat(line.item_quantity || 0); + if (!qty) continue; + const itemDoc = await itemsCollection.findOne({ + _id: itemId, + license: new ObjectId(String(license)), + }); + if (!itemDoc) continue; + const tracks = itemDoc.track_inventory === true || itemDoc.track_inventory === 'true'; + if (!tracks) continue; + const currentQty = parseFloat(itemDoc.available_quantity || 0); + const newQty = currentQty - qty; + await itemsCollection.updateOne( + { _id: itemId, license: new ObjectId(String(license)) }, + { $set: { available_quantity: newQty } } + ); + await stockLogsCollection.insertOne({ + stocklog: true, + branch_id: receiving.branch_id, + view_item_id: itemId, + item_barcode_id: itemDoc.barcode_id || '', + item_name: line.item_name || itemDoc.name || '', + item_quantity: qty, + process: 'Void Purchase', + reference: receiving.receiving_id, + opening_balance: currentQty, + closing_balance: newQty, + count: -qty, + date: now, + action: 'Void', + changed_by_userid: loggedUser ? new ObjectId(String(loggedUser)) : null, + changed_by: loggedUserName, + license: new ObjectId(String(license)), + created_date: now, + updated_date: now, + }); + } + } + + await collection.updateOne( + { _id: receiving._id }, + { + $set: { + receiving_status: 'Cancelled', + voided_by: loggedUserName, + voided_by_id: loggedUser ? new ObjectId(String(loggedUser)) : null, + voided_at: now, + void_reason: String(reason || '').trim(), + updated_date: now, + updated_by: loggedUserName, + }, + } + ); + return { status: true, message: 'Purchase voided - stock reversed, record kept' }; + } catch (error) { + console.error('Error in voidReceiving:', error); + return { status: false, message: error.message }; + } +}; + +/* + * Receive goods against an Ordered or Partial purchase - all remaining, + * or entered per line (owner: "received 5 items but remaining will + * receive later"). Stock moves by exactly what arrives NOW; each event + * leaves a 'Receive Purchase' stocklog; the document's status settles to + * Partial or Received from its lines. close_short stops expecting the + * rest: the status closes at Received, the shortfall stays visible on the + * lines, and no stock moves for goods that never came. + */ +receivingSchema.statics.receivePartial = async function (id, payload = {}, context = {}) { + try { + const baseModel = new BaseModel('receivings'); + const collection = await baseModel.getCollection('receivings'); + const itemsCollection = await baseModel.getCollection('items'); + const stockLogsCollection = await baseModel.getCollection('stocklogs'); + const license = context.license || BaseModel.license; + const loggedUser = context.userId || BaseModel.loggedUser; + const loggedUserName = context.userName || BaseModel.loggedUserName || ''; + const now = new Date(); + + const receiving = await collection.findOne({ + _id: new ObjectId(String(id)), + license: new ObjectId(String(license)), + }); + if (!receiving) return { status: false, message: 'Purchase not found' }; + if (receiving.receiving_status === 'Cancelled') { + return { status: false, message: 'This purchase was voided - nothing can be received' }; + } + if (receiving.receiving_status === 'Received') { + return { status: false, message: 'This purchase is already fully received' }; + } + + const receivedOf = (line) => { + if (line.qty_received !== undefined && line.qty_received !== null) { + return parseFloat(line.qty_received) || 0; + } + return 0; + }; + + /* How much of each item is being received in THIS event. */ + const pool = {}; + if (payload.all === true) { + for (const line of receiving.items || []) { + if (!line.item_id) continue; + const key = String(line.item_id); + const remaining = (parseFloat(line.item_quantity) || 0) - receivedOf(line); + if (remaining > 0) pool[key] = (pool[key] || 0) + remaining; + } + } else { + for (const req of payload.lines || []) { + if (!req || !req.item_id) continue; + const qty = parseFloat(req.qty); + if (!qty || qty <= 0) continue; + pool[String(req.item_id)] = (pool[String(req.item_id)] || 0) + qty; + } + } + const receivingNow = Object.keys(pool).length > 0; + if (!receivingNow && payload.close_short !== true) { + return { status: false, message: 'Nothing to receive - enter a quantity' }; + } + + /* Apply to the lines, capped at each line's remainder, and total the + stock movement per item. */ + const stockDelta = {}; + const lines = (receiving.items || []).map((line) => ({ ...line })); + for (const line of lines) { + if (!line.item_id) continue; + const key = String(line.item_id); + const already = receivedOf(line); + const remaining = Math.max(0, (parseFloat(line.item_quantity) || 0) - already); + const take = Math.min(remaining, pool[key] || 0); + pool[key] = (pool[key] || 0) - take; + line.qty_received = Math.round((already + take) * 1000) / 1000; + if (take > 0) stockDelta[key] = (stockDelta[key] || 0) + take; + } + + /* Move the stock that arrived. The log is gated by stock_management, + the quantity is not - same contract as every other door. */ + const branchesCollection = await baseModel.getCollection('branches'); + const branchDoc = receiving.branch_id + ? await branchesCollection.findOne({ _id: new ObjectId(String(receiving.branch_id)) }) + : null; + const stockManagement = branchDoc?.stock_management === true; + const stockLogStatus = branchDoc?.stock_management_log !== false; + for (const key of Object.keys(stockDelta)) { + if (!ObjectId.isValid(key)) continue; + const delta = stockDelta[key]; + const itemDoc = await itemsCollection.findOne({ + _id: new ObjectId(key), + license: new ObjectId(String(license)), + }); + if (!itemDoc || !(itemDoc.track_inventory === true || itemDoc.track_inventory === 'true')) { + continue; + } + const currentQty = parseFloat(itemDoc.available_quantity || 0); + const newQty = currentQty + delta; + if (stockManagement) { + await stockLogsCollection.insertOne({ + stocklog: stockLogStatus, + branch_id: receiving.branch_id, + view_item_id: itemDoc._id, + item_barcode_id: itemDoc.barcode_id || '', + item_name: itemDoc.name || '', + item_quantity: delta, + process: 'Receive Purchase', + reference: receiving.receiving_id, + opening_balance: currentQty, + closing_balance: newQty, + count: delta, + date: now, + action: 'Add', + changed_by_userid: loggedUser ? new ObjectId(String(loggedUser)) : null, + changed_by: loggedUserName, + license: new ObjectId(String(license)), + created_date: now, + updated_date: now, + }); + } + await itemsCollection.updateOne( + { _id: itemDoc._id, license: new ObjectId(String(license)) }, + { $set: { available_quantity: newQty } } + ); + } + + /* Settle the document. */ + let anyReceived = false; + let allFull = true; + for (const line of lines) { + const ordered = parseFloat(line.item_quantity) || 0; + const got = receivedOf(line); + if (got > 0) anyReceived = true; + if (got < ordered) allFull = false; + } + let newStatus = allFull ? 'Received' : anyReceived ? 'Partial' : 'Open'; + const set = { + items: lines, + receiving_status: newStatus, + updated_date: now, + updated_by: loggedUserName, + }; + if (payload.close_short === true && newStatus !== 'Received') { + set.receiving_status = 'Received'; + set.closed_short = true; + set.closed_short_at = now; + set.closed_short_by = loggedUserName; + newStatus = 'Received'; + } + await collection.updateOne({ _id: receiving._id }, { $set: set }); + const movedTotal = Object.values(stockDelta).reduce((a, b) => a + b, 0); + return { + status: true, + message: + payload.close_short === true && movedTotal === 0 + ? 'Remaining quantities cancelled - the purchase is closed' + : newStatus === 'Received' + ? 'All goods received into stock' + : 'Received into stock - the rest stays expected', + data: { receiving_status: newStatus }, + }; + } catch (error) { + console.error('Error in receivePartial:', error); + return { status: false, message: error.message }; + } +}; + receivingSchema.statics.receivingInsertUpdate = async function (data, id) { try { const BaseModel = require('./base.model'); @@ -1796,7 +2072,24 @@ receivingSchema.statics.receivingInsertUpdate = async function (data, id) { let csgstValue = 0.0; if (indianGstSetting === 'gst_on') { - if (data.supplier_state !== currentBranchState) { + /* + * PURCHASE_TAX_PLAN P2: when the supplier's GSTIN is present and + * well-formed, its first two digits ARE the state code - a fact the + * invoice itself certifies - so the intra/inter decision stops + * depending on a hand-typed state name. The name comparison stays as + * the fallback for suppliers recorded without a GSTIN. + */ + let interState = data.supplier_state !== currentBranchState; + const gstin = String(data.supplier_gst_number || '').trim(); + if (/^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$/.test(gstin)) { + const supplierCode = gstin.slice(0, 2); + const states = require('../json/gst_state_code.json').gststate || []; + const branchRow = states.find( + (s) => String(s.value).toLowerCase() === String(currentBranchState).toLowerCase() + ); + if (branchRow) interState = supplierCode !== branchRow.id; + } + if (interState) { igstValue = parseFloat(item.gst || 0); } else { csgstValue = parseFloat(item.gst || 0) / 2; @@ -1943,6 +2236,63 @@ receivingSchema.statics.receivingInsertUpdate = async function (data, id) { updateData.source_po_id = new ObjectId(String(data.source_po_id)); } + /* + * PURCHASE_TAX_PLAN P2: the shop's tax decisions on this purchase. + * Presence-gated like source_po_id - the PO-receive door and older + * clients that do not send them change nothing, and an edit that omits + * them keeps what is stored. + * + * itc_eligible: whether this purchase's tax counts as input credit + * (composition suppliers and blocked credits switch it off). Default at + * READ time is true, so absent means eligible - the common case. + * + * invoice_total_declared: the total the SUPPLIER'S invoice states, + * including tax. Compared against what the lines add up to; a mismatch + * is recorded and shown, never blocked - the goods are already in the + * shop, and a visible flag beats a save that refuses (owner's call). + */ + /* The order's promised delivery date - the purchase-order module's one + field worth keeping when the two doors became one. Presence-gated. */ + if (data.expected_date !== undefined) { + const expected = String(data.expected_date || '').trim(); + updateData.expected_date = expected ? new Date(expected) : null; + } + if (data.itc_eligible !== undefined) { + updateData.itc_eligible = + data.itc_eligible === true || data.itc_eligible === 'true' || data.itc_eligible === 'on'; + } + /* Additional charges (freight, loading ...) ride on the purchase + TOTAL - never on item cost, never on the tax heads, so Tax Payable + and per-line costing stay untouched. Presence-gated like the rest: + a door that does not send them changes nothing. */ + let chargesTotal = 0; + if (data.additional_charges !== undefined) { + const cleaned = (Array.isArray(data.additional_charges) ? data.additional_charges : []) + .map((c) => ({ + label: String((c && c.label) || '').trim(), + amount: Math.round((parseFloat(c && c.amount) || 0) * 100) / 100, + })) + .filter((c) => c.amount > 0 || c.label); + chargesTotal = cleaned.reduce((sum, c) => sum + c.amount, 0); + updateData.additional_charges = cleaned; + updateData.additional_charges_total = Math.round(chargesTotal * 100) / 100; + updateData.total_amount = parseFloat((receivingTotalAmount + chargesTotal).toFixed(2)); + } + if (data.invoice_total_declared !== undefined && String(data.invoice_total_declared) !== '') { + const declared = parseFloat(data.invoice_total_declared); + if (!Number.isNaN(declared)) { + /* The supplier's printed total includes the charges. */ + const computedGrand = + parseFloat(receivingTotalAmount) + + chargesTotal + + ((data.exclusive_tax || '').trim() === 'on' + ? Math.round(receivingTaxAmount * 100) / 100 + : 0); + updateData.invoice_total_declared = Math.round(declared * 100) / 100; + updateData.invoice_total_mismatch = Math.abs(declared - computedGrand) > 0.5; + } + } + if (!id) { // INSERT new receiving const receivingData = { ...insertData, ...updateData }; @@ -2104,6 +2454,16 @@ receivingSchema.statics.receivingInsertUpdate = async function (data, id) { }; } + /* A voided purchase is a closed book: its stock reversal and audit + line are already written, and an edit would contradict both. */ + if (existingReceiving.receiving_status === 'Cancelled') { + return { + status: false, + data: null, + message: 'This purchase was voided - it can no longer be edited', + }; + } + // Preserve original date unless explicitly provided in update if (!data.date && existingReceiving.date) { updateData.date = existingReceiving.date; @@ -2125,71 +2485,127 @@ receivingSchema.statics.receivingInsertUpdate = async function (data, id) { itemCount: items.length, }); - // Update item quantities and create stock logs if status is 'Received' (PHP line 439-443) - if (data.status === 'Received') { - for (const itemUpdate of items) { - const itemId = new ObjectId(itemUpdate.item_id); - const itemQuantity = parseFloat(itemUpdate.item_quantity || 0); - const itemName = itemUpdate.item_name || ''; - + /* + * Stock moves on TRANSITIONS, never on saves. The legacy path (a + * faithful port of the PHP) re-added every line's full quantity each + * time a Received purchase was saved - invisible for years only + * because the edit form's status radio targeted ids that never + * existed and posted every edit back as Open. The ledger now reads + * the PREVIOUS state from the stored document: + * + * Ordered -> Received : count the received quantities in + * Received -> Received : apply per-line DELTAS (edited quantities, + * added lines, removed lines) + * Received -> Ordered : give back everything previously counted + * + * Every movement leaves one stocklog whose count carries its sign, + * so the stock register reads as the item's true history. + */ + const prevStatus = existingReceiving.receiving_status; + const nextStatus = (data.status || '').trim(); + /* What a line has actually put INTO stock: its cumulative + qty_received when the partial machinery has stamped one, else the + full quantity on a fully Received document, else nothing. */ + const receivedOf = (line, docStatus) => { + if (line.qty_received !== undefined && line.qty_received !== null) { + return parseFloat(line.qty_received) || 0; + } + return docStatus === 'Received' ? parseFloat(line.item_quantity) || 0 : 0; + }; + const countedBefore = {}; + for (const line of existingReceiving.items || []) { + if (!line.item_id) continue; + const key = String(line.item_id); + countedBefore[key] = (countedBefore[key] || 0) + receivedOf(line, prevStatus); + } + const countedAfter = {}; + const lineNames = {}; + if (nextStatus === 'Received') { + for (const line of items) { + if (!line.item_id) continue; + const key = String(line.item_id); + countedAfter[key] = (countedAfter[key] || 0) + (parseFloat(line.item_quantity) || 0); + if (line.item_name) lineNames[key] = line.item_name; + } + } else if (nextStatus === 'Partial') { + /* Editing a partially received document: what already arrived is a + FACT and rides along - matched per item, capped at the edited + ordered quantity. The edit cannot receive or un-receive; only + the Receive flow moves goods. */ + for (const line of items) { + if (!line.item_id) continue; + const key = String(line.item_id); + const already = countedBefore[key] || 0; + const ordered = parseFloat(line.item_quantity) || 0; + countedAfter[key] = Math.min(already, (countedAfter[key] || 0) + ordered); + if (line.item_name) lineNames[key] = line.item_name; + } + } + /* Stamp the received quantities onto the stored lines and settle the + document's status from them. */ + { + const pool = { ...countedAfter }; + let anyReceived = false; + let allFull = true; + for (const line of updateData.items || []) { + const key = String(line.item_id || ''); + const ordered = parseFloat(line.item_quantity) || 0; + const take = Math.min(ordered, pool[key] || 0); + pool[key] = (pool[key] || 0) - take; + line.qty_received = Math.round(take * 1000) / 1000; + if (take > 0) anyReceived = true; + if (take < ordered) allFull = false; + } + if (nextStatus === 'Partial') { + updateData.receiving_status = allFull ? 'Received' : anyReceived ? 'Partial' : 'Open'; + } + } + const touchedIds = new Set([...Object.keys(countedBefore), ...Object.keys(countedAfter)]); + if (touchedIds.size > 0) { + const stockLogsCollection = await baseModel.getCollection('stocklogs'); + for (const key of touchedIds) { + const delta = (countedAfter[key] || 0) - (countedBefore[key] || 0); + if (!delta || !ObjectId.isValid(key)) continue; const itemDoc = await itemsCollection.findOne({ - _id: itemId, + _id: new ObjectId(key), license: new ObjectId(license), }); - - console.log('[RECEIVING UPDATE DEBUG] Item check:', { - item_id: itemUpdate.item_id, - track_inventory: itemDoc?.track_inventory, - track_inventory_type: typeof itemDoc?.track_inventory, - }); - - // PHP checks: $documents['track_inventory'] === true (boolean or string 'true') - if (itemDoc && (itemDoc.track_inventory === true || itemDoc.track_inventory === 'true')) { - const availableQty = parseFloat(itemDoc.available_quantity || 0); - const newQty = itemQuantity + availableQty; - - // Create stock log for EDIT Receiving (PHP line 439-441) - // Only if stock_management is enabled - if (stockManagement) { - console.log( - '[RECEIVING UPDATE DEBUG] Creating stock log for item:', - itemUpdate.item_id - ); - - const stockLogData = { - stocklog: stockLogStatus, - branch_id: new ObjectId(currentBranch), - view_item_id: itemId, - item_barcode_id: itemDoc.barcode_id || '', - item_name: itemName || itemDoc.name || '', - item_quantity: itemQuantity, - process: 'Edit Receiving', - reference: data.alternative_id || '', - opening_balance: availableQty, - closing_balance: newQty, - count: itemQuantity, - date: receivingDate, - action: 'Add', - changed_by_userid: new ObjectId(loggedUser), - changed_by: loggedUserName, - license: new ObjectId(license), - created_date: receivingDate, - updated_date: receivingDate, - }; - - const stockLogsCollection = await baseModel.getCollection('stocklogs'); - await stockLogsCollection.insertOne(stockLogData); - console.log('[RECEIVING UPDATE] Stock log created successfully'); - } else { - console.log('[RECEIVING UPDATE DEBUG] Stock management disabled, skipping stock log'); - } - - // Update item quantity (PHP line 442) - await itemsCollection.updateOne( - { _id: itemId, license: new ObjectId(license) }, - { $set: { available_quantity: newQty } } - ); + if ( + !itemDoc || + !(itemDoc.track_inventory === true || itemDoc.track_inventory === 'true') + ) { + continue; } + const currentQty = parseFloat(itemDoc.available_quantity || 0); + const newQty = currentQty + delta; + if (stockManagement) { + await stockLogsCollection.insertOne({ + stocklog: stockLogStatus, + branch_id: new ObjectId(currentBranch), + view_item_id: itemDoc._id, + item_barcode_id: itemDoc.barcode_id || '', + item_name: lineNames[key] || itemDoc.name || '', + item_quantity: Math.abs(delta), + process: 'Edit Receiving', + reference: data.alternative_id || existingReceiving.receiving_id || '', + opening_balance: currentQty, + closing_balance: newQty, + count: delta, + date: receivingDate, + action: delta > 0 ? 'Add' : 'Deduct', + changed_by_userid: new ObjectId(loggedUser), + changed_by: loggedUserName, + license: new ObjectId(license), + created_date: receivingDate, + updated_date: receivingDate, + }); + } + // Quantities move even with stock_management off (the insert path + // has always behaved this way); only the LOG is optional. + await itemsCollection.updateOne( + { _id: itemDoc._id, license: new ObjectId(license) }, + { $set: { available_quantity: newQty } } + ); } } @@ -2676,6 +3092,7 @@ Receiving.receivingReportPage = receivingSchema.statics.receivingReportPage; Receiving.receivingsGraphicalReports = receivingSchema.statics.receivingsGraphicalReports; Receiving.getReceivingOrder = receivingSchema.statics.getReceivingOrder; Receiving.receivingInsertUpdate = receivingSchema.statics.receivingInsertUpdate; +Receiving.receivePartial = receivingSchema.statics.receivePartial; const { returnReceivingOrder } = require('./receiving-return.model'); Receiving.returnReceivingOrder = returnReceivingOrder; Receiving.deleteReceivingCollectionData = receivingSchema.statics.deleteReceivingCollectionData; diff --git a/api/src/models/sale.model.js b/api/src/models/sale.model.js index 5b347d86b..4d4ad7d15 100644 --- a/api/src/models/sale.model.js +++ b/api/src/models/sale.model.js @@ -116,7 +116,15 @@ const saleItemSchema = new mongoose.Schema( item_available_quantity: { type: Number, default: 0, - min: 0, + /* + * No `min`. This is a SNAPSHOT of the item's stock at sale time, not + * a quantity being sold - and stock legitimately goes negative on + * items whose `negative_stock` flag allows overselling. With min: 0 + * the whole sale was refused ("Path `item_available_quantity` (-1) is + * less than minimum allowed value (0)"), so one item already in the + * red blocked the cashier from taking money for the entire basket. + * A record of what stock WAS must never be able to fail validation. + */ }, item_id: { type: String, @@ -592,6 +600,23 @@ const saleSchema = new mongoose.Schema( trim: true, }, + // Permanent public invoice link: the S3 key IS the secret. One key for + // the sale's lifetime - createInvoiceLink answers the stored key on + // every later call. Without this schema entry the strict schema silently + // strips the $set and every share mints a fresh PDF. + invoice_key: { + type: String, + trim: true, + }, + + // The invoice this sale was recorded from (INVOICING_MODULE_DESIGN). + // Same lesson as invoice_key: the schema is strict, so an undeclared + // field is stripped without a word and the invoice never learns it was + // paid. Declared here, pinned by test, mirrored by services/invoice-sync. + source_invoice_id: { + type: mongoose.Schema.Types.ObjectId, + }, + // For strict PHP parity we do not require subtotal/total on the document; // they may be omitted entirely when saving via the legacy sales service. subtotal: { @@ -878,6 +903,14 @@ saleSchema.pre('save', async function () { // Validate that the original sale quantities are still available in stock // for the given sale id. Mirrors Api/src/model/sales_model.php::getSaleQtyDetailModel. // Static method for exporting sales data (ported from PHP exportSalesOrder) +/* + * Sales History's whitelisted sorts (bill total, item count, business date) + * each walk one of these; created_date already rides the default listing. + */ +saleSchema.index({ license: 1, branch_id: 1, sales_total: -1 }); +saleSchema.index({ license: 1, branch_id: 1, number_of_items: -1 }); +saleSchema.index({ license: 1, branch_id: 1, date: -1 }); + saleSchema.index( { license: 1, billing_transaction_id: 1 }, { @@ -950,6 +983,11 @@ class LegacySaleModel { sale_extra_discount: { type: 'Number', select: true }, extra_discount: { type: 'Number', select: true }, tip_amount: { type: 'Number', select: true }, + tip_in_total: { type: 'Boolean', select: true }, + source_quote_id: { type: 'ObjectId', select: true }, + quote_price_honoured: { type: 'Boolean', select: true }, + source_invoice_id: { type: 'ObjectId', select: true }, + charges: { type: 'Mixed', select: true }, discount_description: { type: 'String', select: true }, return_extra_discount: { type: 'Number', select: true }, extra_discount_type: { type: 'String', select: true }, @@ -1042,7 +1080,7 @@ Sale.LegacySaleModel = LegacySaleModel; * @param {Object} input - { email, data: { product_details, payment_details, tax_details, branch_details, dine_details, table_summary, extra_discount } } * @returns {Promise} */ -Sale.sendDailySalesMail = async function (input) { +Sale.sendDailySalesMail = async function (input, shopTransport = null) { try { const { BrevoClient } = require('@getbrevo/brevo'); const config = require('../config'); @@ -1199,6 +1237,36 @@ Sale.sendDailySalesMail = async function (input) { const apiKey = config.sendinblue_key || process.env.SENDINBLUE_KEY || process.env.BREVO_API_KEY || ''; + /* Owner rule: a shop that configured its own SMTP sends through it - + before Brevo, before the platform chain. */ + if (shopTransport && shopTransport.shopOwned) { + const subject = ((sales_type ? sales_type + ' ' : '') + 'sales report').trim(); + /* The layout every mail wears now - a report over shop SMTP was the + last plain-text straggler. */ + const { brandFor, renderEmail, kvBlock } = require('../utils/email-layout'); + const brand = brandFor(shopTransport.branch || { branch_name: branch.branch_name }); + await shopTransport.transporter.sendMail({ + from: `${branch.branch_name || 'Posnic POS'} <${shopTransport.from}>`, + to: input.email, + subject, + html: renderEmail({ + brand, + title: subject.charAt(0).toUpperCase() + subject.slice(1), + preheader: `Sales from ${from_date || '-'} to ${to_date || '-'}`, + bodyHtml: kvBlock([ + ['Period', `${from_date || '-'} to ${to_date || '-'}`], + ['Total quantity', qty_total], + ['Subtotal', `${currency} ${price_total.toFixed(2)}`], + ['Grand total', `${currency} ${amount_total.toFixed(2)}`], + ['Profit', `${currency} ${profit_total.toFixed(2)}`], + ['Tax total', `${currency} ${tax_total.toFixed(2)}`], + ['Tender total', `${currency} ${tender_total.toFixed(2)}`], + ]), + }), + }); + return { status: true, data: { sent: true }, message: 'Mail sent successfully' }; + } + if (apiKey) { // Preferred path: use Brevo transactional template const client = new BrevoClient({ apiKey }); @@ -1767,7 +1835,7 @@ Sale.getQrStatusModel = async function (id) { /** * PHP: kioskOrderModel($data) - * Process a kiosk order — calculate item totals, generate sales_id, + * Process a kiosk order - calculate item totals, generate sales_id, * find/create customer, insert sale document, return receipt data. * Ported from Api/src/model/sales_model.php lines 8297-8764. */ diff --git a/api/src/models/setting.model.js b/api/src/models/setting.model.js index e23ed00b2..0f9c21c18 100644 --- a/api/src/models/setting.model.js +++ b/api/src/models/setting.model.js @@ -3,6 +3,9 @@ const BaseModel = require('./base.model'); const { ObjectId } = require('mongodb'); const fs = require('fs'); const path = require('path'); +const { secretUpdate } = require('../services/settings-groups'); +const { recordAudit } = require('../utils/audit-trail'); +const { publicPageUrl } = require('../utils/public-url'); class SettingModel extends BaseModel { constructor() { @@ -28,10 +31,14 @@ class SettingModel extends BaseModel { this.cachedFallbackTax = null; } - setContext({ branchId = null, licenseId = null, user = null } = {}) { + setContext({ branchId = null, licenseId = null, user = null, ip = null, userAgent = null } = {}) { this.branchId = branchId; this.licenseId = licenseId; this.user = user; + /* Where the request came from. Only the audit trail uses these, and only + for the handful of events where "from where" is the whole question. */ + this.ip = ip; + this.userAgent = userAgent; this.branchName = null; // Will be loaded lazily when needed } @@ -125,15 +132,65 @@ class SettingModel extends BaseModel { * Get default customer details by ID */ async getDefaultCustomer(customerId) { - if (!customerId) { - return { - status: false, - data: null, - message: 'Customer ID is required', - }; - } - try { + /* + * Self-heal (owner ask): a branch without a configured default + * customer sells to Walk-In. Asked with no id, find - or create - + * this branch's Walk-in and repoint the branch doc, instead of + * failing every till on that branch with "Customer ID is required". + */ + if (!customerId && this.branchId) { + const customersHeal = await this.getCollection('customers'); + const healLicense = this.licenseId ? { license: this.normalizeId(this.licenseId) } : {}; + const branchIdNorm = this.normalizeId(this.branchId); + let walkin = await customersHeal.findOne({ + branch_id: branchIdNorm, + name: { $regex: /walk[- ]?in/i }, + ...healLicense, + }); + if (!walkin) { + const now = new Date(); + const seed = { + branch_id: branchIdNorm, + name: 'Walk-in Customer', + date: now, + phone: '', + // No email key: customers carries a unique sparse index on it. + address: '', + sortname: '', + country: '', + state: '', + city: '', + gst: 'disable', + gst_number: '', + gst_type: 'consumer', + created_date: now, + updated_date: now, + }; + if (this.licenseId) seed.license = this.normalizeId(this.licenseId); + const ins = await customersHeal.insertOne(seed); + walkin = { ...seed, _id: ins.insertedId }; + } + try { + const branches = await this.getCollection('branch'); + await branches.updateOne( + { _id: branchIdNorm }, + { $set: { default_customer: walkin._id } } + ); + } catch (e) { + /* pointer update is best-effort - the lookup below still answers */ + } + customerId = walkin._id; + } + + if (!customerId) { + return { + status: false, + data: null, + message: 'Customer ID is required', + }; + } + const customersCollection = await this.getCollection('customers'); const licenseFilter = this.licenseId ? { license: this.normalizeId(this.licenseId) } : {}; @@ -188,6 +245,58 @@ class SettingModel extends BaseModel { * Get default supplier details by ID */ async getDefaultSupplier(supplierId) { + /* + * Heal like the customer: with a branch context a missing id resolves + * to the branch's General Supplier - found or created, branch doc + * repointed. Contextless still refuses below. + */ + if (!supplierId && this.branchId) { + try { + const suppliers = await this.getCollection('suppliers'); + const healLicense = this.licenseId ? { license: this.normalizeId(this.licenseId) } : {}; + const branchIdNorm = this.normalizeId(this.branchId); + let general = await suppliers.findOne({ + branch_id: branchIdNorm, + name: { $regex: /general supplier/i }, + ...healLicense, + }); + if (!general) { + const now = new Date(); + const seed = { + branch_id: branchIdNorm, + name: 'General Supplier', + email: `anonymous-supplier-${branchIdNorm}@posnic.local`, + phone: '', + address: '', + sortname: '', + country: '', + state: '', + city: '', + gst: 'disable', + gst_number: '', + gst_type: 'consumer', + created_date: now, + updated_date: now, + }; + if (this.licenseId) seed.license = this.normalizeId(this.licenseId); + const ins = await suppliers.insertOne(seed); + general = { ...seed, _id: ins.insertedId }; + } + try { + const branches = await this.getCollection('branch'); + await branches.updateOne( + { _id: branchIdNorm }, + { $set: { default_supplier: general._id } } + ); + } catch (e) { + /* best-effort pointer */ + } + supplierId = general._id; + } catch (e) { + /* fall through to the plain refusal below */ + } + } + if (!supplierId) { return { status: false, @@ -244,13 +353,25 @@ class SettingModel extends BaseModel { } async getDefaultCustomerSupplier(customerId, supplierId) { - if (!customerId || !supplierId) { + /* + * Branch switch lands here with whatever the previous branch left in + * localStorage - possibly nothing. With a branch context BOTH defaults + * self-heal: the customer through the Walk-in heal, the supplier below. + */ + if (!customerId && this.branchId) { + const healed = await this.getDefaultCustomer(''); + if (healed.status && healed.data && healed.data.customer_id) { + customerId = healed.data.customer_id; + } + } + if ((!customerId || !supplierId) && !this.branchId) { return { status: false, data: null, message: 'Customer and supplier ids are required', }; } + // (supplier may be empty - with a branch context it self-heals below) try { const [customersCollection, suppliersCollection] = await Promise.all([ @@ -258,6 +379,54 @@ class SettingModel extends BaseModel { this.getCollection('suppliers'), ]); + /* + * Self-heal on branch switch (owner report): a branch without a + * default supplier gets its General Supplier found or created and + * the branch doc repointed - same medicine as the Walk-in customer. + */ + if (!supplierId && this.branchId) { + const healLicense = this.licenseId ? { license: this.normalizeId(this.licenseId) } : {}; + const branchIdNorm = this.normalizeId(this.branchId); + let general = await suppliersCollection.findOne({ + branch_id: branchIdNorm, + name: { $regex: /general supplier/i }, + ...healLicense, + }); + if (!general) { + const now = new Date(); + const seed = { + branch_id: branchIdNorm, + name: 'General Supplier', + // suppliers carries a unique index on email - unique per branch. + email: `anonymous-supplier-${branchIdNorm}@posnic.local`, + phone: '', + address: '', + sortname: '', + country: '', + state: '', + city: '', + gst: 'disable', + gst_number: '', + gst_type: 'consumer', + created_date: now, + updated_date: now, + }; + if (this.licenseId) seed.license = this.normalizeId(this.licenseId); + const ins = await suppliersCollection.insertOne(seed); + general = { ...seed, _id: ins.insertedId }; + } + try { + const branches = await this.getCollection('branch'); + await branches.updateOne( + { _id: branchIdNorm }, + { $set: { default_supplier: general._id } } + ); + } catch (e) { + /* pointer update is best-effort */ + } + supplierId = general._id; + } + const licenseFilter = this.licenseId ? { license: this.normalizeId(this.licenseId) } : {}; const [customer, supplier] = await Promise.all([ @@ -621,7 +790,10 @@ class SettingModel extends BaseModel { const module_recyclebin_enable = offOnly(data.module_recyclebin_enable); const module_themes_enable = offOnly(data.module_themes_enable); const module_cashbook_enable = offOnly(data.module_cashbook_enable); + const module_demo_data_enable = offOnly(data.module_demo_data_enable); const quick_sale_enable = offOnly(data.quick_sale_enable); + const quotes_enable = offOnly(data.quotes_enable); + const invoices_enable = offOnly(data.invoices_enable); /* * Two different forms save through here now: the Module On/Off tab @@ -769,7 +941,16 @@ class SettingModel extends BaseModel { module_recyclebin_enable: module_recyclebin_enable, module_themes_enable: module_themes_enable, module_cashbook_enable: module_cashbook_enable, + module_demo_data_enable: module_demo_data_enable, quick_sale_enable: quick_sale_enable, + quotes_enable: quotes_enable, + invoices_enable: invoices_enable, + ...(data.custom_charges_enable !== undefined + ? { + custom_charges_enable: + data.custom_charges_enable === true || data.custom_charges_enable === 'true', + } + : {}), }; // Update branch_name across all collections - for the branch actually @@ -801,6 +982,108 @@ class SettingModel extends BaseModel { } } + async updateStarterLocale(data = {}) { + try { + if (!this.branchId || !this.licenseId) { + throw new Error('Branch context is required'); + } + + const collection = await this.getCollection(); + const text = (value) => (value === undefined || value === null ? '' : String(value).trim()); + const currencySymbol = text(data.currencyText || data.currency_type) || '₹'; + const currencyName = text(data.currencyTextname || data.currency_setting) || currencySymbol; + const currencyValue = [ + { + currency_text: currencyName, + currency_sign: currencySymbol, + }, + ]; + + let sortname = ''; + try { + const countriesJsonPath = path.join( + __dirname, + '..', + '..', + '..', + 'api', + 'src', + 'json', + 'countries.json' + ); + const countriesData = JSON.parse(fs.readFileSync(countriesJsonPath, 'utf8')); + const countryMatch = countriesData.countries?.find( + (c) => c.value === text(data.setting_country) + ); + if (countryMatch?.sortname) { + sortname = countryMatch.sortname; + } + } catch (err) { + console.warn( + 'Could not load countries.json for starter locale sortname lookup:', + err.message + ); + } + + let cleanTimezone = text(data.time_zone) || 'Asia/Kolkata'; + const gmtOffsetMatch = cleanTimezone.match(/^([^(]+)\s*\(GMT[^)]+\)$/); + if (gmtOffsetMatch) { + cleanTimezone = gmtOffsetMatch[1].trim(); + } + + const updateData = { + country: text(data.setting_country), + country_id: text(data.country_id), + state: text(data.setting_state), + sortname, + currency: currencySymbol, + currency_text: text(data.currency_setting) || currencyName, + currency_type: currencySymbol, + currency_value: currencyValue, + time_zone: cleanTimezone, + client_dateformat: text(data.storedate) || 'dd/mm/yyyy', + server_dateformat: text(data.serverdate) || 'd/m/Y', + dateformat_text: text(data.dateText) || '01/01/2018 - dd/mm/yyyy', + }; + + const filter = { + _id: this.normalizeId(this.branchId), + license: this.normalizeId(this.licenseId), + }; + const result = await collection.updateOne(filter, { $set: updateData }); + if (result.matchedCount === 0) { + return { + status: false, + data: null, + message: 'Branch not found or license mismatch', + }; + } + + return { + status: true, + data: { + country: updateData.country, + state: updateData.state, + country_id: updateData.country_id, + currency_text: updateData.currency_text, + currency_type: updateData.currency_type, + time_zone: updateData.time_zone, + clientdate: updateData.client_dateformat, + serverdate: updateData.server_dateformat, + dateformat_text: updateData.dateformat_text, + }, + message: 'success', + }; + } catch (error) { + console.error('Error in updateStarterLocale:', error); + return { + status: false, + data: null, + message: error.message, + }; + } + } + toBoolean(value) { if (typeof value === 'boolean') return value; if (typeof value === 'string') { @@ -861,27 +1144,33 @@ class SettingModel extends BaseModel { // Update user printing_design using positional operator (matches PHP logic line 330-339) // Wrapped in try-catch: if user doesn't have printing_design for this branch, continue anyway - try { - await usersCollection.updateOne( - { - _id: this.normalizeId(this.user._id), - 'printing_design.branch_id': this.normalizeId(this.branchId), - }, - { - $set: { - 'printing_design.$.printing_design': data.print_type, - 'printing_design.$.printing_max_char': data.print_character, - 'printing_design.$.printing_size': data.print_size, - // Paper width in millimetres. Added alongside the others rather - // than replacing any: printing_size is the font size, this is - // the roll the receipt has to fit on. - 'printing_design.$.print_width': data.print_width, + // Skipped entirely for partial payloads that carry no printing fields. + if (data.print_type !== undefined) { + try { + await usersCollection.updateOne( + { + _id: this.normalizeId(this.user._id), + 'printing_design.branch_id': this.normalizeId(this.branchId), }, - } - ); - } catch (userPrintError) { - // Non-blocking: continue even if user printing update fails - console.warn('User printing_design update failed (non-critical):', userPrintError.message); + { + $set: { + 'printing_design.$.printing_design': data.print_type, + 'printing_design.$.printing_max_char': data.print_character, + 'printing_design.$.printing_size': data.print_size, + // Paper width in millimetres. Added alongside the others rather + // than replacing any: printing_size is the font size, this is + // the roll the receipt has to fit on. + 'printing_design.$.print_width': data.print_width, + }, + } + ); + } catch (userPrintError) { + // Non-blocking: continue even if user printing update fails + console.warn( + 'User printing_design update failed (non-critical):', + userPrintError.message + ); + } } // Default values - matches PHP lines 342-351 @@ -935,6 +1224,8 @@ class SettingModel extends BaseModel { const supplierCheckbox = this.toBoolean(data.supplier_checkbox); const taxCheckbox = this.toBoolean(data.tax_checkbox); const saleInlineEditor = this.toBoolean(data.sale_inline_editor); + // the double-click editor's own switch (replaces the old inline pencils) + const saleQuickEdit = data.sale_quick_edit_enable; const enableMultiPayment = this.toBoolean(data.enable_multi_payment); const tableOptions = this.toBoolean(data.table_options); const roundOff = this.toBoolean(data.roundOff); @@ -949,6 +1240,58 @@ class SettingModel extends BaseModel { discount_percentage: parseFloat(data.discount_percentage), discount_amount: parseFloat(data.discount_amount), sales_prefix: data.sales_prefix, + // Shop's own outgoing mail (owner rule: theirs first, ours as the + // cloud fallback). Password stored as given - it must be usable. + ...(data.email_smtp_host !== undefined + ? { email_smtp_host: String(data.email_smtp_host || '').trim() } + : {}), + ...(data.email_smtp_port !== undefined + ? { email_smtp_port: String(data.email_smtp_port || '').trim() } + : {}), + ...(data.email_smtp_secure !== undefined + ? { email_smtp_secure: String(data.email_smtp_secure) === 'true' } + : {}), + ...(data.email_smtp_username !== undefined + ? { email_smtp_username: String(data.email_smtp_username || '').trim() } + : {}), + /* S4: the password is never sent to the browser any more, so the form + loads with this field empty. Empty therefore means "keep the saved + one" - writing it through would blank the shop's mail the first + time anyone saved an unrelated setting. */ + ...secretUpdate('email_smtp_password', data.email_smtp_password), + ...(data.email_smtp_from !== undefined + ? { email_smtp_from: String(data.email_smtp_from || '').trim() } + : {}), + // Quotation defaults: prefilled into every NEW quote server-side, + // still editable per quote on its preview. Presence-gated so older + // tills that do not send them cannot wipe them. + ...(data.quote_default_payment_method !== undefined + ? { + quote_default_payment_method: String(data.quote_default_payment_method || '') + .trim() + .slice(0, 60), + } + : {}), + ...(data.quote_default_bank_details !== undefined + ? { + quote_default_bank_details: String(data.quote_default_bank_details || '') + .trim() + .slice(0, 500), + } + : {}), + ...(data.quote_default_terms !== undefined + ? { + quote_default_terms: String(data.quote_default_terms || '') + .trim() + .slice(0, 1500), + } + : {}), + ...(data.quote_default_signature !== undefined + ? { + // a small data-URL image; empty string removes it + quote_default_signature: String(data.quote_default_signature || '').slice(0, 400000), + } + : {}), indian_gst: data.indian_gst, receiving_prefix: data.receiving_prefix, branch_gstin_number: data.branch_gstin_number || '', @@ -982,6 +1325,9 @@ class SettingModel extends BaseModel { header_print: data.header_print, footer_print: data.footer_print, sale_inline_editor: saleInlineEditor, + ...(saleQuickEdit !== undefined + ? { sale_quick_edit_enable: String(saleQuickEdit) === 'true' } + : {}), enable_multi_payment: enableMultiPayment, table_options: tableOptions, hardware_weight_machine_enable: hardwareWeightMachineEnable, @@ -1020,7 +1366,17 @@ class SettingModel extends BaseModel { module_recyclebin_enable: offOnly, module_themes_enable: offOnly, module_cashbook_enable: offOnly, + module_demo_data_enable: offOnly, quick_sale_enable: offOnly, + /* Not a module: a record that the welcome has been shown. onOnly, + because absent must mean "not yet welcomed" - the opposite + default would mean nobody is ever welcomed and nothing looks + wrong. Presence-gated by the loop below, so a settings save + that does not mention it cannot set it either way. */ + first_run_done: onOnly, + first_run_decided: onOnly, + quotes_enable: offOnly, + invoices_enable: offOnly, pl_include_cashbook: offOnly, }; for (const [key, parse] of Object.entries(TOGGLES)) { @@ -1034,6 +1390,67 @@ class SettingModel extends BaseModel { updateFields.till_lock_idle_minutes = Math.min(idle, 120); } + /* + * Partial-save safety: this endpoint also takes small PATCH-style + * payloads (the quotation defaults card, the signature upload from the + * quote page). Any $set field whose SOURCE key was not sent is dropped + * here, so a partial payload can never wipe the rest of the shop's + * settings with undefined/false derived from absent controls. Full + * settings-form saves send every key, so they are unaffected. + */ + const SOURCE_OF = { + default_customer: 'default_customer', + default_supplier: 'default_supplier', + default_tax: 'default_tax', + notification_range: 'notification_value', + discount_percentage: 'discount_percentage', + discount_amount: 'discount_amount', + sales_prefix: 'sales_prefix', + indian_gst: 'indian_gst', + receiving_prefix: 'receiving_prefix', + branch_gstin_number: 'branch_gstin_number', + roundOff: 'roundOff', + receipt_barcode: 'receipt_barcode', + stock_management: 'stock_management', + stock_management_log: 'stock_log_management', + printall: 'printall', + sales_mail: 'sales_mail', + customer_print: 'customer_print', + print_url: 'print_url', + print_logoimg: 'print_logoimg', + print_sale_notes: 'print_sale_notes', + sales_sms: 'sales_sms', + auto_sms: 'auto_sms', + enable_sms_reminders: 'enable_sms_reminders', + enable_sms_auto_send: 'enable_sms_auto_send', + sms_auto_send_time: 'enable_sms_auto_send', + sms_retry_period: 'enable_sms_auto_send', + sms_max_retries: 'enable_sms_auto_send', + keyboard_view: 'keyboard_view', + whatsapp_receipt: 'whatsapp_receipt', + balance_view: 'balance_view', + customer_checkbox: 'customer_checkbox', + supplier_checkbox: 'supplier_checkbox', + tax_checkbox: 'tax_checkbox', + print_type: 'print_type', + printing_size: 'print_size', + print_width: 'print_width', + print_character: 'print_character', + header_print: 'header_print', + footer_print: 'footer_print', + sale_inline_editor: 'sale_inline_editor', + enable_multi_payment: 'enable_multi_payment', + table_options: 'table_options', + hardware_weight_machine_enable: 'hardware_weight_machine_enable', + enable_notification_reminders: 'enable_notification_reminders', + enable_email_reminders: 'enable_email_reminders', + }; + for (const [field, src] of Object.entries(SOURCE_OF)) { + if (data[src] === undefined && field in updateFields) { + delete updateFields[field]; + } + } + // Update branch collection (matches PHP $set logic line 389-434) await branchCollection.updateOne( { _id: this.normalizeId(this.branchId), license: this.normalizeId(this.licenseId) }, @@ -1089,7 +1506,11 @@ class SettingModel extends BaseModel { module_recyclebin_enable: { parse: offOnly, dflt: true }, module_themes_enable: { parse: offOnly, dflt: true }, module_cashbook_enable: { parse: offOnly, dflt: true }, + module_demo_data_enable: { parse: offOnly, dflt: true }, quick_sale_enable: { parse: offOnly, dflt: true }, + quotes_enable: { parse: offOnly, dflt: true }, + invoices_enable: { parse: offOnly, dflt: true }, + custom_charges_enable: { parse: (v) => v === true || v === 'true', dflt: false }, pl_include_cashbook: { parse: offOnly, dflt: true }, }; } @@ -1814,6 +2235,19 @@ class SettingModel extends BaseModel { } if (!oldPasswordValid) { + /* Recorded too. Somebody repeatedly failing to change a password is + either a person who has forgotten it or somebody working through a + list, and the address is what tells those apart. */ + await recordAudit(await this.getDB().catch(() => null), { + event: 'password_change_failed', + actor: { id: String(user._id), name: user.email || user.username || '' }, + target: { id: String(user._id), name: user.email || user.username || '', type: 'user' }, + ip: this.ip, + userAgent: this.userAgent, + branchId: this.branchId, + license: this.licenseId, + extra: { reason: 'current password did not match' }, + }); return { status: false, message: 'Current password is incorrect' }; } @@ -1841,6 +2275,26 @@ class SettingModel extends BaseModel { return { status: false, message: 'Failed to update password' }; } + /* + * The event that could not be answered. + * + * When a shop was locked out, the only evidence a password had changed + * was a timestamp on the user document - no actor, no address, nothing + * to tell the owner whether it was them last Tuesday or somebody else. + * The password itself is never written here; recordAudit redacts any + * field whose name looks like a secret regardless of what is passed. + */ + await recordAudit(await this.getDB().catch(() => null), { + event: 'password_changed', + actor: { id: String(user._id), name: user.email || user.username || '' }, + target: { id: String(user._id), name: user.email || user.username || '', type: 'user' }, + ip: this.ip, + userAgent: this.userAgent, + branchId: this.branchId, + license: this.licenseId, + extra: { method: 'self_service_change_password' }, + }); + return { status: true, data: result.modifiedCount, @@ -2274,15 +2728,17 @@ class SettingModel extends BaseModel { if (type === 'way2sms') { updateData = { ...updateData, - way2sms_api: data.way2sms_api?.trim() || '', + // the userid is an identifier; the key and password are credentials + // and are no longer sent back to the form, so empty means unchanged way2sms_userid: data.way2sms_userid?.trim() || '', - way2sms_password: data.way2sms_password?.trim() || '', + ...secretUpdate('way2sms_api', data.way2sms_api), + ...secretUpdate('way2sms_password', data.way2sms_password), }; } else if (type === 'textlocal') { updateData = { ...updateData, textlocal_sender: data.textlocal_sender?.trim() || '', - textlocal_api: data.textlocal_api?.trim() || '', + ...secretUpdate('textlocal_api', data.textlocal_api), }; } @@ -3040,14 +3496,33 @@ class SettingModel extends BaseModel { }); const taxProfiles = require('../services/tax-profiles'); const { code, profile } = taxProfiles.profileForBranch(branch || {}); + /* The regime rides along so the Tax Configuration page can say which + family the shop lives in without a second request; the shop's own + override (the tax settings group) is applied by resolveRegime. */ + const { resolveRegime } = require('../services/tax-regime'); + let taxGroup = {}; + try { + const SettingsRepository = require('../repositories/settings.repository'); + const r = await new SettingsRepository().resolveGroup('tax', { + licenseId: this.licenseId, + branchId: this.branchId, + }); + if (r && r.status && r.data && r.data.values) taxGroup = r.data.values; + } catch (e) { + /* decisions unavailable -> profile alone answers */ + } + const { regime } = resolveRegime(branch || {}, taxGroup); return { status: true, data: { code, + regime, + country: (branch && branch.country) || '', label: profile.label, registration: profile.registration, components: { mode: profile.components.mode }, display: profile.display, + decisions: taxGroup, }, message: 'success', }; @@ -3515,10 +3990,24 @@ class SettingModel extends BaseModel { } // Forgot Password - async getForgotUserDetails(email) { + /* + * @param {object} [req] the request, used ONLY to work out this shop's own + * public address for the link in the email. + */ + async getForgotUserDetails(email, req = null) { try { const usersCollection = await this.getCollection('users'); - const user = await usersCollection.findOne({ email: email }); + /* + * String(), because this value came from a request body and Mongo reads + * an object as operators. `{"email": {"$ne": null}}` posted to + * forgot-password would otherwise match the FIRST user in the shop and + * send a reset link for somebody else's account. + * + * The controller's regex happens to reject an object today - test() + * stringifies it to "[object Object]" - but that is the caller being + * careful, and this method is what actually touches the database. + */ + const user = await usersCollection.findOne({ email: String(email) }); if (!user) { return { @@ -3533,20 +4022,36 @@ class SettingModel extends BaseModel { const expireDate = new Date(Date.now() + 10 * 60 * 1000); await usersCollection.updateOne({ _id: user._id }, { $set: { expire_date: expireDate } }); - // Build reset link using userkey (matching PHP lines 700-711) - const serverName = process.env.SERVER_NAME || 'localhost'; - const cleanServerName = serverName.replace(/^api\./, ''); - const forgotPasswordId = encodeURIComponent(user.userkey); - - let basePath; - if (cleanServerName.includes('dev.posnic.io')) { - basePath = `http://pro.dev.posnic.io/forgotpassword.html?forgotpassword_Id=${forgotPasswordId}`; - } else if (cleanServerName.includes('localhost')) { - // For local development - const frontendUrl = process.env.FRONTEND_URL || 'http://localhost:3000'; - basePath = `${frontendUrl}/forgotpassword.html?forgotpassword_Id=${forgotPasswordId}`; - } else { - basePath = `https://www.posnic.io/forgotpassword?forgotpassword_Id=${forgotPasswordId}`; + /* + * The link goes to THIS shop, not to a hardcoded address. + * + * This used to read SERVER_NAME, which is set on no process in the + * estate, fall through to the localhost branch, and mail every hosted + * shop a link to http://localhost:3000 - the recipient's own computer, + * on a port with nothing listening. Self-service recovery has therefore + * never once worked for a cloud shop, which is why a locked-out owner + * needed five days and a database session to get back into his till. + * + * publicPageUrl derives the address from the request, but accepts only a + * host on a domain we actually run: a link inside an email we send is + * exactly what password-reset poisoning targets. + */ + const basePath = publicPageUrl(req, 'forgotpassword.html', { + forgotpassword_Id: user.userkey, + }); + + if (!basePath) { + /* Refused rather than sent. A dead link and a poisoned link are both + worse than an error somebody can see and fix. */ + console.error( + '[forgot-password] no trustworthy public address for this shop - ' + + 'set PUBLIC_BASE_URL. No email sent.' + ); + return { + status: false, + data: null, + message: 'Password reset is not configured for this shop. Please contact support.', + }; } // Send email via Brevo (matching PHP lines 714-729) diff --git a/api/src/models/supplier-legacy.model.js b/api/src/models/supplier-legacy.model.js index 75399c28b..f0aa03948 100644 --- a/api/src/models/supplier-legacy.model.js +++ b/api/src/models/supplier-legacy.model.js @@ -18,6 +18,10 @@ class SupplierModel extends BaseModel { _id: { type: 'ObjectId', select: true, name: 'id' }, branch_id: { type: 'ObjectId', select: false }, branch_name: { type: 'String', select: false }, + /* S7 (D5): the account-level relation, same shape as items and customers. + Seeded with the owning branch so nothing moves; sharing a supplier + between shops is a deliberate grant. */ + branch_access: { type: 'Array', select: false }, name: { type: 'String', select: true }, email: { type: 'String', select: true }, phone: { type: 'String', select: true }, diff --git a/api/src/models/user.model.js b/api/src/models/user.model.js index 32df696d8..19dcfa756 100644 --- a/api/src/models/user.model.js +++ b/api/src/models/user.model.js @@ -375,7 +375,25 @@ const userSchema = new mongoose.Schema( preferredLanguage: { type: String, default: 'en', - enum: ['en', 'es', 'fr', 'de', 'hi', 'ta', 'te', 'kn', 'ml'], + /* The languages the app offers (frontend/gulpfile.js/config.js), plus + 'de' for records that already hold it. */ + enum: [ + 'en', + 'ta', + 'hi', + 'ml', + 'kn', + 'te', + 'si', + 'ne', + 'ar', + 'fr', + 'es', + 'pt', + 'id', + 'th', + 'de', + ], }, themePreference: { type: String, diff --git a/api/src/realtime/webhooks.js b/api/src/realtime/webhooks.js index 6f872844a..2e5724e79 100644 --- a/api/src/realtime/webhooks.js +++ b/api/src/realtime/webhooks.js @@ -38,6 +38,21 @@ const TIMEOUT_MS = 10_000; const DRAIN_EVERY_MS = 60_000; // how often lazy draining may run, per process const drainLast = new Map(); // dbName -> ts +/* Store only stable, non-sensitive failure categories. Raw exception messages can + * contain hostnames, query strings, credentials or payload fragments and do not + * belong in durable delivery records. */ +function classifyFailure(outcome) { + const status = Number(outcome && outcome.status) || 0; + if (status === 408) return { code: 'http_408', retryable: true }; + if (status === 429) return { code: 'http_429', retryable: true }; + if (status >= 500) return { code: 'http_5xx', retryable: true }; + if (status >= 400) return { code: 'http_4xx', retryable: false }; + if (outcome && ['AbortError', 'TimeoutError'].includes(outcome.errorName)) { + return { code: 'timeout', retryable: true }; + } + return { code: 'network_error', retryable: true }; +} + function sign(secret, body) { return 'sha256=' + crypto.createHmac('sha256', String(secret)).update(body).digest('hex'); } @@ -100,10 +115,11 @@ async function attempt(db, delivery, sub) { }); outcome = { ok: res.status >= 200 && res.status < 300, status: res.status }; } catch (err) { - outcome = { ok: false, status: 0, error: err.message }; + outcome = { ok: false, status: 0, errorName: err && err.name }; } const attempts = (delivery.attempts || 0) + 1; + const failure = outcome.ok ? null : classifyFailure(outcome); if (outcome.ok) { await db.collection(DELIVERIES).updateOne( { _id: delivery._id }, @@ -116,7 +132,7 @@ async function attempt(db, delivery, sub) { }, } ); - } else if (attempts >= MAX_ATTEMPTS) { + } else if (!failure.retryable || attempts >= MAX_ATTEMPTS) { await db.collection(DELIVERIES).updateOne( { _id: delivery._id }, { @@ -124,8 +140,10 @@ async function attempt(db, delivery, sub) { status: 'dead', attempts, lastStatus: outcome.status, - lastError: outcome.error || '', + lastErrorCode: failure.code, + deadLetteredAt: new Date(), }, + $unset: { lastError: '', 'payload.at': '', 'payload.shop': '' }, } ); } else { @@ -137,8 +155,9 @@ async function attempt(db, delivery, sub) { attempts, nextAt: new Date(Date.now() + BACKOFF_MS[Math.min(attempts - 1, BACKOFF_MS.length - 1)]), lastStatus: outcome.status, - lastError: outcome.error || '', + lastErrorCode: failure.code, }, + $unset: { lastError: '' }, } ); } @@ -206,12 +225,17 @@ async function drainDue(db, dbName) { for (const d of due) { const sub = subs.get(String(d.subscription_id)); if (!sub || !sub.active) { - await db - .collection(DELIVERIES) - .updateOne( - { _id: d._id }, - { $set: { status: 'dead', lastError: 'subscription removed' } } - ); + await db.collection(DELIVERIES).updateOne( + { _id: d._id }, + { + $set: { + status: 'dead', + lastErrorCode: 'subscription_removed', + deadLetteredAt: new Date(), + }, + $unset: { lastError: '', 'payload.at': '', 'payload.shop': '' }, + } + ); continue; } attempt(db, d, sub).catch(() => {}); @@ -236,7 +260,8 @@ async function recentDeliveries(db, limit = 50) { createdAt: 1, deliveredAt: 1, lastStatus: 1, - lastError: 1, + lastErrorCode: 1, + deadLetteredAt: 1, subscription_id: 1, }, } @@ -255,6 +280,7 @@ module.exports = { recentDeliveries, sign, urlAllowed, + classifyFailure, SUBS, DELIVERIES, MAX_ATTEMPTS, diff --git a/api/src/repositories/category.repository.js b/api/src/repositories/category.repository.js index 36e12d850..e974a395c 100644 --- a/api/src/repositories/category.repository.js +++ b/api/src/repositories/category.repository.js @@ -358,15 +358,15 @@ class CategoryRepository extends BaseModel { // not the intended multi-channel selector). is_deleted: { $ne: true }, $or: [ - // Case 1: Inventory not tracked — always allowed + // Case 1: Inventory not tracked - always allowed { track_inventory: false }, - // Case 2: Negative stock allowed — quantity >= 0 + // Case 2: Negative stock allowed - quantity >= 0 { $and: [{ negative_stock: true }, { available_quantity: { $gte: 0 } }], }, - // Case 3: Normal stock — quantity > 0 + // Case 3: Normal stock - quantity > 0 { $and: [ { diff --git a/api/src/repositories/customer.repository.js b/api/src/repositories/customer.repository.js index 697e7a379..2c3fc116c 100644 --- a/api/src/repositories/customer.repository.js +++ b/api/src/repositories/customer.repository.js @@ -1,6 +1,8 @@ // src/repositories/customer.repository.js const BaseModel = require('../models/base.model'); const { ObjectId } = require('mongodb'); +const { withBranchScope } = require('../services/branch-scope'); +const dataSharing = require('../services/data-sharing'); /** * Customer Repository @@ -50,12 +52,19 @@ class CustomerRepository extends BaseModel { */ async findById(id) { const collection = await this.getCollection(this.collectionName); - return await collection.findOne({ - _id: new ObjectId(id), - license: BaseModel.license, - ...(BaseModel.currentBranch ? { branch_id: BaseModel.currentBranch } : {}), - is_deleted: { $ne: true }, - }); + return await collection.findOne( + withBranchScope( + { + _id: new ObjectId(id), + license: BaseModel.license, + is_deleted: { $ne: true }, + }, + await dataSharing.scopeBranch('customers', BaseModel.currentBranch, { + licenseId: BaseModel.license, + branchId: BaseModel.currentBranch, + }) + ) + ); } /** @@ -102,7 +111,7 @@ class CustomerRepository extends BaseModel { async search(searchTerm, options = {}) { const { page = 1, limit = 10, branchId = null } = options; - const query = { + let query = { license: BaseModel.license, is_deleted: { $ne: true }, $or: [ @@ -112,8 +121,18 @@ class CustomerRepository extends BaseModel { ], }; + /* withBranchScope, not `query.branch_id = ...`: this query already owns a + top-level $or for name/email/phone, and a second one would replace those + terms instead of adding to them - a search that quietly returns every + customer. The scope goes under $and. */ if (branchId) { - query.branch_id = new ObjectId(branchId); + query = withBranchScope( + query, + await dataSharing.scopeBranch('customers', branchId, { + licenseId: BaseModel.license, + branchId, + }) + ); } const collection = await this.getCollection(this.collectionName); @@ -147,6 +166,29 @@ class CustomerRepository extends BaseModel { is_deleted: false, }; + /* + * S7 step one (D5). Customers are branch-scoped here while every + * comparable product keeps them account-level: a customer who buys at one + * shop is the same person at the next, and today their loyalty, credit and + * consent fragment across branches. + * + * This writes the relation ITEMS already use - branch_access[] - alongside + * the existing branch_id, seeded with the branch that owns the record. + * Nothing moves and nothing reads it yet: with access listing only the + * owning branch, every customer stays exactly as visible as before. + * Sharing one is then a deliberate grant, not a migration side effect. + * + * The rule that matters for the phase after this: LINK, never merge. Two + * shops may hold same-name customers with different balances, and deciding + * they are one person is the owner's call, not a script's. + */ + if (!Array.isArray(document.branch_access)) { + const owning = document.branch_id || BaseModel.currentBranch || null; + document.branch_access = owning + ? [{ branch_id: owning, branch_name: document.branch_name || '' }] + : []; + } + const result = await collection.insertOne(document); return await this.findById(result.insertedId); } @@ -318,12 +360,19 @@ class CustomerRepository extends BaseModel { update.$set = { last_purchase: lastPurchaseDate }; } + /* The guard follows visibility: a sale at a branch the customer is shared + with should update that customer's totals. */ return collection.updateOne( - { - _id: id, - ...(BaseModel.license ? { license: BaseModel.license } : {}), - ...(BaseModel.currentBranch ? { branch_id: BaseModel.currentBranch } : {}), - }, + withBranchScope( + { + _id: id, + ...(BaseModel.license ? { license: BaseModel.license } : {}), + }, + await dataSharing.scopeBranch('customers', BaseModel.currentBranch, { + licenseId: BaseModel.license, + branchId: BaseModel.currentBranch, + }) + ), update ); } diff --git a/api/src/repositories/expense.repository.js b/api/src/repositories/expense.repository.js index d9f64a70f..635cd98c7 100644 --- a/api/src/repositories/expense.repository.js +++ b/api/src/repositories/expense.repository.js @@ -133,7 +133,7 @@ class ExpenseRepository extends BaseModel { updated_by_id: updateData.updated_by_id || null, }; - // Only add fields that are provided — never modify created_date/created_by + // Only add fields that are provided - never modify created_date/created_by if (updateData.amount !== undefined) updateFields.amount = parseFloat(updateData.amount); if (updateData.type) updateFields.type = updateData.type; if (expenseDate) updateFields.date = expenseDate; diff --git a/api/src/repositories/install.repository.js b/api/src/repositories/install.repository.js index 40ebcf320..d861ee888 100644 --- a/api/src/repositories/install.repository.js +++ b/api/src/repositories/install.repository.js @@ -13,6 +13,25 @@ class InstallRepository extends BaseModel { super('branches'); } + /** + * How many branches this database already holds. + * + * The one question that separates "install a new shop" from "destroy an + * existing one". Every installed shop has a branch and no empty database + * does, so a non-zero answer means somebody's shop is on the other end of + * the call. + * + * Asked by processInstallation before it writes anything. On 28 August 2026 + * a live customer's five branches, 265 products and 87 sales were replaced + * because nothing asked it. + * + * @returns {Promise} + */ + async countExistingBranches() { + const branches = await this.getCollection('branches'); + return branches.countDocuments({}); + } + /** * Check if user already exists by username, email, or license * @param {Object} params @@ -86,6 +105,20 @@ class InstallRepository extends BaseModel { ); } + /** + * The units a branch already has, so the demo seed joins the shop's own + * master instead of duplicating it. + * @param {ObjectId} branchId + * @param {ObjectId} licenseId + * @returns {Promise} + */ + async findUnitsByBranch(branchId, licenseId) { + const unitCollection = await this.getCollection('unit'); + return unitCollection + .find({ branch_id: branchId, license: licenseId }, { projection: { _id: 1, value: 1 } }) + .toArray(); + } + /** * Insert a tax record * @param {Object} taxData - Tax data to insert @@ -138,8 +171,25 @@ class InstallRepository extends BaseModel { async insertCategories(categoriesData) { const categoryCollection = await this.getCollection('categories'); console.log(`🗄️ Repository: Inserting ${categoriesData.length} categories into DB...`); - const result = await categoryCollection.insertMany(categoriesData); - const ids = Object.values(result.insertedIds); + /* + * Upsert, never blind-insert. Categories carry a unique + * (name, branch_id) index, and a RESEED meets survivors: the purge + * keeps sold items and their categories, so the next pack's + * "Paper & Office" collides with the old pack's, insertMany threw + * E11000, and the whole demo install died half-done - the owner saw + * "restored 30 products" and a list of 11. An existing category is + * simply reused; only genuinely new ones are created. + */ + const ids = []; + for (const cat of categoriesData) { + const found = await categoryCollection.findOneAndUpdate( + { name: cat.name, branch_id: cat.branch_id }, + { $setOnInsert: cat }, + { upsert: true, returnDocument: 'after' } + ); + const doc = found && (found.value || found); + if (doc && doc._id) ids.push(doc._id); + } return ids; } diff --git a/api/src/repositories/invoice.repository.js b/api/src/repositories/invoice.repository.js new file mode 100644 index 000000000..2fdf04d9a --- /dev/null +++ b/api/src/repositories/invoice.repository.js @@ -0,0 +1,773 @@ +'use strict'; + +/* + * Invoices (INVOICING_MODULE_DESIGN): the bill a customer is asked to pay. + * + * The governing rule, stated where the code lives: + * + * AN INVOICE NEVER HOLDS MONEY. THE SALE DOES. + * + * An invoice is authored, shared and chased like a quote - lines, charges, + * discounts, an A4 sheet, a due date. What it is NOT is a second ledger. The + * accounting moment is still the sale: stock, tax, the customer's outstanding + * balance and every report read the `sales` collection and nothing else. + * + * The international model (Zoho, Odoo, QuickBooks, GST practice): a DRAFT is + * a proforma - editable, no stock, no tax. ISSUING it is the sale: the + * server books the sale record itself (services/invoice-booking), stock + * moves, the tax point is set, the numbers freeze. From then on the + * invoice's unpaid/partial/paid state is a MIRROR of that sale's + * payment_status, written by services/invoice-sync whenever the sale + * changes. Recording a payment - in full or in part - settles the SALE and + * the mirror follows. Nobody is walked through a till screen in between. + * + * So this repository writes only its own collection. It READS `branches` for + * the shop's invoice defaults, exactly as quotes read their own. A test pins + * that no write ever lands anywhere but `invoices`. + * + * Lifecycle: + * draft ──┬─ cancelled + * └─ (issue: the sale is booked) ─ unpaid ─ partial ─ paid + * `overdue` is not a state; it is a fact about an ISSUED, still-owed invoice + * past its due date, computed at read time so it can never go stale. A + * proforma is not a receivable, so a draft is never overdue. + */ + +const BaseModel = require('../models/base.model'); +const { ObjectId } = require('mongodb'); +const { ensureIndexOnce } = require('../db/ensure-index'); +const docMath = require('../services/document-math'); + +const STATUSES = Object.freeze(['draft', 'unpaid', 'partial', 'paid', 'cancelled']); +/* Still authoring: the numbers may change. Once the sale exists they may not - + a customer holds a document and the books hold a record, and they must + agree. */ +const EDITABLE = Object.freeze(['draft']); +/* Money is owed on these - issued, not yet paid off; what "overdue" applies to. */ +const OWED = Object.freeze(['unpaid', 'partial']); +/* A sale has been recorded against these. */ +const BOOKED = Object.freeze(['unpaid', 'partial', 'paid']); + +const DEFAULT_PREFIX = 'INV-'; +const DEFAULT_DUE_DAYS = 30; + +class InvoiceRepository extends BaseModel { + constructor() { + super('invoices'); + } + + static get STATUSES() { + return STATUSES; + } + + static get OWED() { + return OWED; + } + + _wall(context) { + const branchId = context && context.branchId; + const licenseId = context && context.licenseId; + if (!branchId || !ObjectId.isValid(String(branchId))) return null; + const wall = { branch_id: new ObjectId(String(branchId)) }; + if (licenseId && ObjectId.isValid(String(licenseId))) { + wall.license = new ObjectId(String(licenseId)); + } + return wall; + } + + /* + * The shop's invoice defaults, from the branch document. The settings + * group endpoint mirrors branch-level writes onto `branches`, so reading + * it here sees what the Invoices settings pane saved. A lookup that fails + * is a nicety missed, never a failed save - hence the empty object. + */ + async _defaults(wall) { + try { + const branches = await this.getCollection('branches'); + const b = await branches.findOne( + { _id: wall.branch_id }, + { + projection: { + invoice_prefix: 1, + invoice_due_days: 1, + invoice_terms: 1, + quote_default_payment_method: 1, + quote_default_bank_details: 1, + }, + } + ); + return b || {}; + } catch (e) { + return {}; + } + } + + static _prefixOf(defaults) { + const raw = String((defaults && defaults.invoice_prefix) || '').trim(); + return (raw || DEFAULT_PREFIX).slice(0, 12); + } + + static _dueDaysOf(defaults) { + const n = parseInt(defaults && defaults.invoice_due_days, 10); + if (!Number.isFinite(n) || n < 0) return DEFAULT_DUE_DAYS; + return Math.min(n, 365); + } + + /* + * Next invoice number for the branch: 000001, resilient to holes + * AND to a prefix change - the trailing digits are what count, whatever + * text sits before them, so renaming INV- to BILL- continues the sequence + * rather than restarting it at 1 beside the old numbers. + */ + async _nextInvoiceId(collection, wall, prefix) { + const rows = await collection + .find({ branch_id: wall.branch_id }, { projection: { invoice_id: 1 } }) + .toArray(); + let max = 0; + for (const r of rows) { + const m = String((r && r.invoice_id) || '').match(/(\d+)\s*$/); + const n = m ? Number(m[1]) : NaN; + if (Number.isFinite(n)) max = Math.max(max, n); + } + return prefix + String(max + 1).padStart(6, '0'); + } + + /* The list index - same reasoning as quote_list_by_branch: the wall plus + the sort, so listing is a walk and not a scan, per DATABASE. */ + async _ensureListIndex(collection) { + await ensureIndexOnce( + collection, + { branch_id: 1, license: 1, created_date: -1 }, + { name: 'invoice_list_by_branch' } + ); + await ensureIndexOnce( + collection, + { branch_id: 1, license: 1, due_date: 1 }, + { name: 'invoice_list_by_due' } + ); + await ensureIndexOnce( + collection, + { branch_id: 1, license: 1, total: -1 }, + { name: 'invoice_list_by_total' } + ); + } + + /* Overdue is a reading of the document, never a stored state. */ + static isOverdue(doc, now = new Date()) { + if (!doc || !OWED.includes(doc.status)) return false; + const due = doc.due_date ? new Date(doc.due_date) : null; + return !!(due && !Number.isNaN(due.getTime()) && due < now); + } + + static _decorate(doc, now = new Date()) { + if (!doc) return doc; + return { ...doc, is_overdue: InvoiceRepository.isOverdue(doc, now) }; + } + + /* Create (id empty) or update - draft/sent only; a booked invoice's numbers + belong to the sale that was recorded from it. */ + async upsertInvoice(data = {}, id = '', context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + + const parsed = docMath.normalizeLines(data.lines || data.items, 'invoice'); + if (parsed.error) return { status: false, data: null, message: parsed.error }; + + const money = docMath.computeTotals({ + lines: parsed.lines, + charges: docMath.normalizeCharges(data.charges), + discount: data.discount, + clientTotal: data.total, + clientTaxTotal: data.tax_total, + }); + + const now = new Date(); + const collection = await this.getCollection(this.collectionName); + + const doc = { + branch_id: wall.branch_id, + branch_name: String(context.branchName || '').trim(), + customer_id: + data.customer_id && ObjectId.isValid(String(data.customer_id)) + ? new ObjectId(String(data.customer_id)) + : null, + customer_name: String(data.customer_name || '').trim(), + customer_phone: String(data.customer_phone || '').trim(), + customer_address: String(data.customer_address || '') + .trim() + .slice(0, 300), + customer_gstin: String(data.customer_gstin || '') + .trim() + .slice(0, 20), + customer_email: String(data.customer_email || '') + .trim() + .slice(0, 120), + payment_method: String(data.payment_method || '') + .trim() + .slice(0, 60), + bank_details: String(data.bank_details || '') + .trim() + .slice(0, 500), + terms: String(data.terms || '') + .trim() + .slice(0, 1500), + /* A reference the CUSTOMER gave - their PO number, a job id - printed + on the document because their accounts department matches on it. */ + reference: String(data.reference || '') + .trim() + .slice(0, 60), + items: parsed.lines, + charges: money.charges, + discount: money.discount, + charges_total: money.charges_total, + custom_blocks: docMath.normalizeBlocks(data.custom_blocks), + layout: docMath.normalizeLayout(data.layout), + notes: String(data.notes || '') + .trim() + .slice(0, 2000), + subtotal: money.subtotal, + tax_total: money.tax_total, + total: money.total, + due_date: docMath.dateOrNull(data.due_date), + updated_date: now, + updated_by: String(context.userName || ''), + }; + if (wall.license) doc.license = wall.license; + + if (id) { + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid invoice id' }; + } + /* An edit keeps the balance honest: nothing is owed on a draft, so + the balance IS the total until a sale says otherwise. */ + doc.balance = money.total; + doc.paid_amount = 0; + const result = await collection.updateOne( + { _id: new ObjectId(String(id)), ...wall, status: { $in: EDITABLE } }, + { $set: doc } + ); + if (!result.matchedCount) { + return { + status: false, + data: null, + message: 'This invoice can no longer be edited - it has been issued, or it is closed', + }; + } + return { status: true, data: { id: String(id) }, message: 'Invoice updated' }; + } + + /* A new invoice starts from the shop's invoice defaults wherever the + editor sent nothing: payment method and bank details are shared with + quotations (a shop has one bank account), the terms are the invoice's + own, and the due date follows the shop's credit days. */ + const defaults = await this._defaults(wall); + if (!doc.payment_method) + doc.payment_method = String(defaults.quote_default_payment_method || '') + .trim() + .slice(0, 60); + if (!doc.bank_details) + doc.bank_details = String(defaults.quote_default_bank_details || '') + .trim() + .slice(0, 500); + if (!doc.terms) + doc.terms = String(defaults.invoice_terms || '') + .trim() + .slice(0, 1500); + if (!doc.due_date) { + const days = InvoiceRepository._dueDaysOf(defaults); + doc.due_date = new Date(now.getTime() + days * 86400000); + } + + doc.invoice_id = await this._nextInvoiceId( + collection, + wall, + InvoiceRepository._prefixOf(defaults) + ); + doc.status = 'draft'; + doc.issue_date = now; + doc.paid_amount = 0; + doc.balance = money.total; + doc.sale_id = null; + doc.sale_number = ''; + /* Lineage: the quote this invoice grew from, if any. */ + doc.source_quote_id = + data.source_quote_id && ObjectId.isValid(String(data.source_quote_id)) + ? new ObjectId(String(data.source_quote_id)) + : null; + doc.source_quote_number = String(data.source_quote_number || '') + .trim() + .slice(0, 40); + doc.created_date = now; + doc.created_by = String(context.userName || ''); + const inserted = await collection.insertOne(doc); + return { + status: true, + data: { id: String(inserted.insertedId), invoice_id: doc.invoice_id }, + message: 'Invoice saved', + }; + } catch (error) { + console.error('Error in InvoiceRepository.upsertInvoice:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* + * Quote -> invoice. The quote's lines, charges and discount become the + * invoice's, at the quoted prices - the promise the quote made is what the + * invoice bills. Terms are the shop's INVOICE terms (a quotation's "valid + * till" wording has no place on a bill); everything else carries over. + */ + async createFromQuote(quote, context = {}) { + if (!quote || !Array.isArray(quote.items) || !quote.items.length) { + return { status: false, data: null, message: 'This quote has no lines to invoice' }; + } + const payload = { + lines: quote.items.map((l) => ({ + kind: l.kind, + item_id: l.item_id ? String(l.item_id) : '', + item_name: l.item_name, + description: l.description || '', + barcode_id: l.barcode_id || '', + qty: l.qty, + unit_price: l.unit_price, + discount: l.discount ? { type: l.discount.type, value: l.discount.value } : undefined, + tax_name: l.tax_name || '', + tax_value: l.tax_value || 0, + tax_type: l.tax_type || '', + })), + charges: (quote.charges || []).map((c) => ({ + name: c.name, + type: c.type, + value: c.value, + sign: c.sign, + })), + discount: quote.discount + ? { type: quote.discount.type, value: quote.discount.value } + : undefined, + customer_id: quote.customer_id ? String(quote.customer_id) : '', + customer_name: quote.customer_name || '', + customer_phone: quote.customer_phone || '', + customer_address: quote.customer_address || '', + customer_gstin: quote.customer_gstin || '', + customer_email: quote.customer_email || '', + payment_method: quote.payment_method || '', + bank_details: quote.bank_details || '', + custom_blocks: quote.custom_blocks || [], + layout: quote.layout || undefined, + notes: quote.notes || '', + tax_total: quote.tax_total, + total: quote.total, + source_quote_id: String(quote._id || ''), + source_quote_number: quote.quote_id || '', + }; + return this.upsertInvoice(payload, '', context); + } + + async listInvoices(params = {}, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + const filter = { ...wall }; + const now = new Date(); + const status = String(params.status || ''); + if (STATUSES.includes(status)) { + filter.status = status; + } else if (status === 'overdue') { + /* the read-time fact, as a query: owed and past due */ + filter.status = { $in: OWED }; + filter.due_date = { $lt: now }; + } else if (status === 'owed') { + filter.status = { $in: OWED }; + } + + const term = String(params.search || '') + .trim() + .slice(0, 80); + if (term) { + const safe = term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); + const rx = + String(params.exact) === 'true' ? new RegExp(`^${safe}$`, 'i') : new RegExp(safe, 'i'); + const field = String(params.field || 'all'); + if (field === 'invoice_id') filter.invoice_id = rx; + else if (field === 'customer_name') filter.customer_name = rx; + else filter.$or = [{ customer_name: rx }, { invoice_id: rx }]; + } + + /* Date range on created_date, same day-end rule as quotes: a date-only + "to" includes its whole day; a precise instant is kept as sent. */ + const range = {}; + const rawFrom = params.from ? String(params.from) : ''; + const rawTo = params.to ? String(params.to) : ''; + const from = rawFrom ? new Date(rawFrom) : null; + const to = rawTo ? new Date(rawTo) : null; + if (from && !Number.isNaN(from.getTime())) range.$gte = from; + if (to && !Number.isNaN(to.getTime())) { + if (/^\d{4}-\d{2}-\d{2}$/.test(rawTo.trim())) to.setHours(23, 59, 59, 999); + range.$lte = to; + } + if (Object.keys(range).length) filter.created_date = range; + + const limit = Math.min(Math.max(Number(params.limit) || 100, 1), 200); + const page = Math.max(Number(params.page) || 1, 1); + const collection = await this.getCollection(this.collectionName); + await this._ensureListIndex(collection); + + const SORTS = { + recent: { created_date: -1 }, + total_desc: { total: -1, _id: -1 }, + total_asc: { total: 1, _id: -1 }, + due_asc: { due_date: 1, _id: -1 }, + due_desc: { due_date: -1, _id: -1 }, + balance_desc: { balance: -1, _id: -1 }, + }; + const sort = SORTS[String(params.sort || '')] || { created_date: -1 }; + + /* A text search skips the count on purpose (see quotes): one extra row + answers "is there more" without a second regex pass. */ + const countable = !term; + let total = null; + let rows; + if (countable) { + total = await collection.countDocuments(filter); + rows = await collection + .find(filter) + .sort(sort) + .skip((page - 1) * limit) + .limit(limit) + .toArray(); + } else { + rows = await collection + .find(filter) + .sort(sort) + .skip((page - 1) * limit) + .limit(limit + 1) + .toArray(); + } + const hasMore = countable ? page * limit < total : rows.length > limit; + if (!countable && rows.length > limit) rows = rows.slice(0, limit); + + return { + status: true, + data: rows.map((r) => InvoiceRepository._decorate(r, now)), + meta: { + total, + page, + limit, + hasMore, + pages: total === null ? null : Math.max(1, Math.ceil(total / limit)), + }, + message: 'success', + }; + } catch (error) { + console.error('Error in InvoiceRepository.listInvoices:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* What the shop is owed, for the list's header strip: count and sum of + every owed invoice, and of the overdue subset. Two cheap aggregations + down the list index. */ + async summary(context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + const collection = await this.getCollection(this.collectionName); + const now = new Date(); + const rows = await collection + .aggregate([ + { $match: { ...wall, status: { $in: OWED } } }, + { + $group: { + _id: null, + owed_count: { $sum: 1 }, + owed_total: { $sum: { $ifNull: ['$balance', '$total'] } }, + overdue_count: { + $sum: { $cond: [{ $lt: ['$due_date', now] }, 1, 0] }, + }, + overdue_total: { + $sum: { + $cond: [{ $lt: ['$due_date', now] }, { $ifNull: ['$balance', '$total'] }, 0], + }, + }, + }, + }, + ]) + .toArray(); + const s = rows[0] || {}; + return { + status: true, + data: { + owed_count: s.owed_count || 0, + owed_total: docMath.round2(s.owed_total || 0), + overdue_count: s.overdue_count || 0, + overdue_total: docMath.round2(s.overdue_total || 0), + }, + message: 'success', + }; + } catch (error) { + console.error('Error in InvoiceRepository.summary:', error); + return { status: false, data: null, message: error.message }; + } + } + + async getInvoice(id, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid invoice id' }; + } + const collection = await this.getCollection(this.collectionName); + const doc = await collection.findOne({ _id: new ObjectId(String(id)), ...wall }); + if (!doc) return { status: false, data: null, message: 'Invoice not found' }; + return { status: true, data: InvoiceRepository._decorate(doc), message: 'success' }; + } catch (error) { + console.error('Error in InvoiceRepository.getInvoice:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* + * The mirror. A snapshot of the sale's payment state (built by + * services/invoice-sync from the sale document) becomes the invoice's + * status and balance. Replay-safe: the same snapshot twice is the same + * document. A cancelled invoice is left alone - the sale that reached it + * is somebody else's problem to explain, and silently un-cancelling a + * document a customer was told is void would be worse. + */ + async applySaleSnapshot(id, snapshot = {}, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid invoice id' }; + } + const saleId = + snapshot.sale_id && ObjectId.isValid(String(snapshot.sale_id)) + ? new ObjectId(String(snapshot.sale_id)) + : null; + if (!saleId) return { status: false, data: null, message: 'A sale id is required' }; + + const collection = await this.getCollection(this.collectionName); + const doc = await collection.findOne({ _id: new ObjectId(String(id)), ...wall }); + if (!doc) return { status: false, data: null, message: 'Invoice not found' }; + if (doc.status === 'cancelled') { + return { status: false, data: null, message: 'This invoice was cancelled' }; + } + /* One invoice, one sale. A different sale arriving is refused, not + merged - two tills booking the same invoice is a mistake to surface. */ + if (doc.sale_id && String(doc.sale_id) !== String(saleId)) { + return { + status: false, + data: null, + message: 'This invoice was already recorded as sale ' + (doc.sale_number || ''), + }; + } + + /* What is owed is what the SALE says - a shop with round-off on books + 210 for a 209.85 document, and the customer pays the sale's figure. + The printed total stays the document's own; sale_total is kept beside + it so the sheet can show both when they differ. */ + const saleTotal = docMath.round2( + Number.isFinite(Number(snapshot.total)) && Number(snapshot.total) > 0 + ? Number(snapshot.total) + : Number(doc.total) || 0 + ); + const paid = Math.max( + 0, + Math.min(saleTotal, docMath.round2(Number(snapshot.paid_amount) || 0)) + ); + const balance = docMath.round2(Math.max(0, saleTotal - paid)); + const status = balance <= 0 ? 'paid' : paid > 0 ? 'partial' : 'unpaid'; + const now = new Date(); + const set = { + status, + sale_id: saleId, + sale_number: String(snapshot.sale_number || doc.sale_number || '').slice(0, 40), + sale_total: saleTotal, + paid_amount: paid, + balance, + sale_payment_status: String(snapshot.payment_status || '').slice(0, 20), + synced_date: now, + updated_date: now, + }; + if (!doc.sale_id) set.issued_date = now; + if (status === 'paid' && !doc.paid_date) set.paid_date = now; + if (status !== 'paid' && doc.paid_date) set.paid_date = null; + await collection.updateOne({ _id: doc._id }, { $set: set }); + return { + status: true, + data: { id: String(doc._id), status, paid_amount: paid, balance }, + message: 'Invoice ' + status, + }; + } catch (error) { + console.error('Error in InvoiceRepository.applySaleSnapshot:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* + * The one transition that needs no sale: cancel, while the document is a + * draft. Once issued, stock and tax have moved and a customer may hold the + * paper - the reversal is a return on the sale (a credit note is the + * follow-up), never a word written over a record that says otherwise. + */ + async transition(id, action, data = {}, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid invoice id' }; + } + const collection = await this.getCollection(this.collectionName); + const doc = await collection.findOne({ _id: new ObjectId(String(id)), ...wall }); + if (!doc) return { status: false, data: null, message: 'Invoice not found' }; + + if (action === 'cancel') { + if (doc.status === 'cancelled') { + return { status: false, data: null, message: 'This invoice is already cancelled' }; + } + if (doc.status !== 'draft') { + return { + status: false, + data: null, + message: + 'This invoice has been issued - reverse it with a return on sale ' + + (doc.sale_number || '') + + ' instead', + }; + } + await collection.updateOne( + { _id: doc._id }, + { + $set: { + status: 'cancelled', + cancelled_date: new Date(), + cancel_reason: String(data.reason || '') + .trim() + .slice(0, 200), + updated_date: new Date(), + }, + } + ); + return { status: true, data: { id: String(doc._id) }, message: 'Invoice cancelled' }; + } + + return { status: false, data: null, message: 'Unknown action' }; + } catch (error) { + console.error('Error in InvoiceRepository.transition:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* + * The document's own memory of a payment recorded against it: who, when, + * how, which reference. The MONEY lives on the sale; this is the note on + * the paper. Appended, never totalled - the balance comes from the sale. + * + * This method was lost once, between two edits of the block above it, and + * the mirror's own tests did not notice because they mock this class. The + * contract test in invoice.repository.test.js now reads the callers. + */ + async recordPayment(id, entry = {}, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid invoice id' }; + } + const collection = await this.getCollection(this.collectionName); + const result = await collection.updateOne( + { _id: new ObjectId(String(id)), ...wall }, + { + $push: { + payments: { + amount: docMath.round2(Number(entry.amount) || 0), + method: String(entry.method || '').slice(0, 40), + reference: String(entry.reference || '').slice(0, 80), + note: String(entry.note || '').slice(0, 200), + date: entry.date instanceof Date ? entry.date : new Date(), + by: String(entry.by || context.userName || '').slice(0, 80), + }, + }, + $set: { updated_date: new Date() }, + } + ); + if (!result.matchedCount) return { status: false, data: null, message: 'Invoice not found' }; + return { status: true, data: { id: String(id) }, message: 'Payment noted' }; + } catch (error) { + console.error('Error in InvoiceRepository.recordPayment:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* Share metadata: which S3 object currently represents this invoice, and + when it first left the shop. Sharing changes no status - a shared draft + is a proforma, a shared issued invoice is a bill - so `sent_date` is + a fact on the record, not a state of it. */ + async recordShare(id, share, context) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid invoice id' }; + } + const collection = await this.getCollection(this.collectionName); + const result = await collection.updateOne( + { _id: new ObjectId(String(id)), ...wall }, + { + $set: { + share: { + key: String(share.key || ''), + url: String(share.url || ''), + rev: Number(share.rev) || 1, + at: new Date(), + }, + updated_date: new Date(), + }, + } + ); + if (!result.matchedCount) return { status: false, data: null, message: 'Invoice not found' }; + await collection.updateOne( + { _id: new ObjectId(String(id)), ...wall, sent_date: { $exists: false } }, + { $set: { sent_date: new Date() } } + ); + return { status: true, data: { rev: Number(share.rev) || 1 }, message: 'Share recorded' }; + } catch (error) { + console.error('Error in InvoiceRepository.recordShare:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* Delete: drafts only - an issued invoice has a sale behind it. */ + async deleteInvoice(id, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid invoice id' }; + } + const collection = await this.getCollection(this.collectionName); + const result = await collection.deleteOne({ + _id: new ObjectId(String(id)), + ...wall, + status: { $in: EDITABLE }, + }); + if (!result.deletedCount) { + return { + status: false, + data: null, + message: 'Only a draft can be deleted - an issued invoice is reversed on its sale', + }; + } + return { status: true, data: { id: String(id) }, message: 'Invoice deleted' }; + } catch (error) { + console.error('Error in InvoiceRepository.deleteInvoice:', error); + return { status: false, data: null, message: error.message }; + } + } +} + +module.exports = InvoiceRepository; +module.exports.BOOKED = BOOKED; diff --git a/api/src/repositories/item.repository.js b/api/src/repositories/item.repository.js index 379b945f9..77378380d 100644 --- a/api/src/repositories/item.repository.js +++ b/api/src/repositories/item.repository.js @@ -1,6 +1,7 @@ const { searchPattern } = require('../utils/safe-search'); // src/repositories/item.repository.js const BaseModel = require('../models/base.model'); +const demoData = require('../services/demo-data'); const Item = require('../models/item.model'); const Branch = require('../models/branch.model'); const { @@ -9,6 +10,11 @@ const { SUCCESS_MESSAGES, ERROR_MESSAGES, } = require('../constants/items.constants'); + +/* One definition of "not deleted", shared by every item query. It used to + live inside a single method, which is how the purchase picker ended up + without it. */ +const NOT_DELETED = Object.freeze({ del_status: { $nin: [1, '1', true] } }); const { ObjectId } = require('mongodb'); const { formatDate } = require('../utils/helpers'); const StockLogsRepository = require('./stock-log.repository'); @@ -85,7 +91,6 @@ class ItemRepository extends BaseModel { } static withoutTombstones(coll) { - const NOT_DELETED = { del_status: { $nin: [1, '1', true] } }; const merge = (f) => { if (!f || typeof f !== 'object' || Array.isArray(f)) return { ...NOT_DELETED }; /* A filter already using $or at the top level (the branch filters do) @@ -110,24 +115,20 @@ class ItemRepository extends BaseModel { } /** - * Find items with pagination and filters (equivalent to itemPage) + * The collection and the authoritative filter for one branch's item list. + * + * Shared by the flat list and the grouped one. Two copies of this would be + * two places to forget that client-supplied scope must be stripped - and the + * failure mode of forgetting is not an error, it is a query that quietly + * returns the wrong shop's items or none at all. * * @param {Object} params * @param {string|ObjectId} params.branchId - Branch context * @param {string|ObjectId} params.licenseId - License context - * @param {Object} [params.filters] - Additional filters - * @param {number} [params.page] - Page number (1-based) - * @param {number} [params.limit] - Page size - * @param {Object} [params.sort] - Sort object + * @param {Object} [params.filters] - Client-supplied business filters + * @returns {Promise<{collection: Object, filter: Object}>} */ - async findPage({ - branchId, - licenseId, - filters = {}, - page = 1, - limit = 5, - sort = { _id: -1 }, - } = {}) { + async listScope({ branchId, licenseId, filters = {} } = {}) { const collection = await this.getCollection(this.collectionName); const branchObjectId = this.toObjectId(branchId); @@ -143,10 +144,6 @@ class ItemRepository extends BaseModel { throw new Error('Active branch does not belong to the current license'); } - const effectiveLimit = parseInt(limit, 10) || 5; - const effectivePage = parseInt(page, 10) || 1; - const skip = (effectivePage - 1) * effectiveLimit; - const clientFilters = this.assignFilterObjects({ ...filters }, LegacyItemModel.fields); // Client-supplied scope is never part of the business filter. Leaving a // stale branch_name/branch_id alongside the authoritative scope can turn @@ -164,26 +161,107 @@ class ItemRepository extends BaseModel { delete clientFilters[key]; } + /* + * Demo products are hidden when the shop has switched Demo Data off. + * + * Resolved here, in the ONE place the item list builds its filter, so it + * cannot be applied to some reads and forgotten on others - a catalogue + * that hides sample items on the manage screen and shows them on the sale + * grid is worse than not hiding them at all. + * + * Nothing is written and nothing is deleted, so switching it back on + * restores everything instantly. See services/demo-data.js for why a + * demo item that has been sold must never simply be removed. + */ + const demoClause = await demoData.filter({ licenseId, branchId }); + const filter = { // branch_access is the canonical item-to-branch relation. branch_id and // branch_name are denormalized legacy fields and can be absent or stale // in production data after a branch rename. ...clientFilters, + ...demoClause, 'branch_access.branch_id': branchObjectId, license: licenseObjectId, }; - const [total, items] = await Promise.all([ - collection.countDocuments(filter), - collection + return { collection, filter }; + } + + /** + * Find items with pagination and filters (equivalent to itemPage) + * + * @param {Object} params + * @param {string|ObjectId} params.branchId - Branch context + * @param {string|ObjectId} params.licenseId - License context + * @param {Object} [params.filters] - Additional filters + * @param {number} [params.page] - Page number (1-based) + * @param {number} [params.limit] - Page size + * @param {Object} [params.sort] - Sort object + */ + async findPage({ + branchId, + licenseId, + filters = {}, + page = 1, + limit = 5, + sort = { _id: -1 }, + } = {}) { + const { collection, filter } = await this.listScope({ branchId, licenseId, filters }); + + const effectiveLimit = parseInt(limit, 10) || 5; + const effectivePage = parseInt(page, 10) || 1; + const skip = (effectivePage - 1) * effectiveLimit; + + /* + * Margin is COMPUTED (selling vs cost), so it cannot ride a find().sort() + * - the special { $margin: 1|-1 } marker switches to an aggregation that + * derives it per item. Items missing a selling price sort LAST in either + * direction: an uncomputable margin is not a low one, and surfacing it + * first would read as "these are your worst items" when nothing is known. + */ + const marginDir = sort && sort.$margin; + let itemsPromise; + if (marginDir === 1 || marginDir === -1) { + itemsPromise = collection + .aggregate([ + { $match: filter }, + { + $addFields: { + _margin: { + $cond: [ + { $gt: [{ $ifNull: ['$selling_price', 0] }, 0] }, + { + $divide: [ + { + $subtract: ['$selling_price', { $ifNull: ['$company_price', 0] }], + }, + '$selling_price', + ], + }, + marginDir === 1 ? Number.MAX_SAFE_INTEGER : -Number.MAX_SAFE_INTEGER, + ], + }, + }, + }, + { $sort: { _margin: marginDir, _id: -1 } }, + { $skip: skip }, + { $limit: effectiveLimit }, + { $project: BaseModel.getSelectFields(LegacyItemModel.fields) }, + ]) + .toArray(); + } else { + itemsPromise = collection .find(filter, { projection: BaseModel.getSelectFields(LegacyItemModel.fields), }) .sort(sort) .skip(skip) .limit(effectiveLimit) - .toArray(), - ]); + .toArray(); + } + + const [total, items] = await Promise.all([collection.countDocuments(filter), itemsPromise]); const list = items.map((doc) => BaseModel.simplifyFields(doc)); @@ -971,6 +1049,284 @@ class ItemRepository extends BaseModel { * (a tombstone would SYNC the non-event fleet-wide) - and their freshly * written 'Add Item' stock logs go with them. */ + /* + * Remove the demo data for good, and refuse to remove anything real. + * + * The switch hides; this destroys. So the whole value of it is in what it + * declines to touch: + * + * SOLD. A demo item exists to be rung up - that is how somebody finds out + * whether the till suits them - and a sale line stores item_id. Delete the + * item and the sale becomes a purchase of a product that does not exist. + * The sale is real even though the product was not, so nothing can put + * that right afterwards. + * + * RECEIVED. Same argument for a purchase or a stock receipt. + * + * EDITED. Changing the price on a sample and putting it on the shelf is + * how a small shop starts its real catalogue. By the time they press this + * button that row is THEIRS, whatever tag it still carries. + * + * What survives is reported by name, not counted. "Removed 128, kept 6" + * invites the question this function already knows the answer to, and a + * silent partial delete is worse than no delete at all. + * + * Soft, not hard: del_status is what the Recycle Bin reads, so this is still + * undoable by the shop that asked for it. A hard delete here would make + * "permanent" mean permanent in a way nobody asked for. + */ + async purgeDemoData({ branchId, licenseId, user } = {}) { + const items = await this.getCollection(this.collectionName); + const branch = this.toObjectId(branchId); + const license = this.toObjectId(licenseId); + + /* + * The sample sales and quotes go FIRST, and the order is the point. + * + * A demo sale references demo items. Remove the items while those sales + * still exist and every one of them is protected as "sold" - so the demo + * data would refuse to remove itself, held in place by its own samples. + * + * These are hard deletes, unlike the items. A sample sale is not a record + * of anything that happened, so keeping it in the Recycle Bin would only + * put invented money somewhere a shop can restore it from by accident. + */ + let salesRemoved = 0; + let quotesRemoved = 0; + let purchasesRemoved = 0; + let peopleRemoved = 0; + try { + const demoScope = { demo_pack: { $exists: true }, branch_id: branch, license }; + const salesCol = await this.getCollection('sales'); + salesRemoved = (await salesCol.deleteMany(demoScope)).deletedCount || 0; + const quotesCol = await this.getCollection('quotes'); + quotesRemoved = (await quotesCol.deleteMany(demoScope)).deletedCount || 0; + /* The sample purchases leave with the sample sales, or a Purchase + History full of DEMO rows survives the switch that promised to + remove them. */ + const receivingsCol = await this.getCollection('receivings'); + purchasesRemoved = (await receivingsCol.deleteMany(demoScope)).deletedCount || 0; + /* The sample people go with them. A demo customer left behind after the + samples are cleared is a stranger in the shop's own list, and nothing + on the row says where they came from. */ + const customersCol = await this.getCollection('customers'); + peopleRemoved += (await customersCol.deleteMany(demoScope)).deletedCount || 0; + const suppliersCol = await this.getCollection('suppliers'); + peopleRemoved += (await suppliersCol.deleteMany(demoScope)).deletedCount || 0; + } catch (e) { + /* Leaving the products behind is the safe half. Reported rather than + thrown, because a shop asking to clear samples should not be told the + whole thing failed when most of it worked. */ + console.error('purgeDemoData: sample sales/quotes:', e.message); + } + + const scope = { demo_pack: { $exists: true }, 'branch_access.branch_id': branch, license }; + const candidates = await items + .find(scope, { projection: { _id: 1, name: 1, demo_seeded_at: 1, updated_date: 1 } }) + .toArray(); + + if (!candidates.length) { + return { + status: true, + removed: 0, + salesRemoved, + quotesRemoved, + purchasesRemoved, + kept: [], + message: + salesRemoved || quotesRemoved || purchasesRemoved + ? `Removed ${salesRemoved} sample sale(s), ${quotesRemoved} sample quote(s) and ${purchasesRemoved} sample purchase(s).` + : 'There is no demo data to remove.', + }; + } + + /* Both shapes, because item_id is stored as a string in some collections + and an ObjectId in others. Matching only one silently finds nothing, + which here means deleting something that was sold. */ + const ids = candidates.map((c) => c._id); + const idPairs = ids.flatMap((id) => [id, String(id)]); + + const used = new Set(); + const noteUsed = (rows, pick) => { + for (const r of rows) { + for (const v of pick(r)) if (v) used.add(String(v)); + } + }; + + try { + const sales = await this.getCollection('sales'); + noteUsed( + await sales + .find({ 'items.item_id': { $in: idPairs } }, { projection: { 'items.item_id': 1 } }) + .toArray(), + (r) => (r.items || []).map((i) => i.item_id) + ); + } catch (e) { + /* Unreadable history is not permission to delete. Treat every candidate + as used rather than guess - the cost is that nothing is removed and + somebody asks why, which is recoverable. */ + console.error('purgeDemoData: could not read sales:', e.message); + return { + status: false, + removed: 0, + kept: [], + message: 'Could not check the sales history, so nothing was removed.', + }; + } + + try { + const receivings = await this.getCollection('receivings'); + noteUsed( + await receivings + .find({ 'items.item_id': { $in: idPairs } }, { projection: { 'items.item_id': 1 } }) + .toArray(), + (r) => (r.items || []).map((i) => i.item_id) + ); + } catch (e) { + console.error('purgeDemoData: could not read receivings:', e.message); + return { + status: false, + removed: 0, + kept: [], + message: 'Could not check the purchase history, so nothing was removed.', + }; + } + + const kept = []; + const removable = []; + for (const c of candidates) { + if (used.has(String(c._id))) { + kept.push({ name: c.name, why: 'sold or received' }); + continue; + } + const seeded = c.demo_seeded_at ? new Date(c.demo_seeded_at).getTime() : 0; + const touched = c.updated_date ? new Date(c.updated_date).getTime() : 0; + /* A second of slack: the seed writes created_date and updated_date in + the same pass, and clock resolution should not make every row look + edited. */ + if (seeded && touched && touched > seeded + 1000) { + kept.push({ name: c.name, why: 'you have edited it' }); + continue; + } + removable.push(c._id); + } + + let removed = 0; + if (removable.length) { + const now = new Date(); + const r = await items.updateMany( + { _id: { $in: removable }, license }, + { + $set: { + del_status: 1, + deleted_date: now, + updated_date: now, + deleted_by: (user && (user.name || user.username)) || 'System', + }, + } + ); + removed = r.modifiedCount || 0; + } + + /* + * Categories go only when nothing is left in them. A demo category still + * holding a product the shop kept is now their category, and emptying the + * shelf label out from under a product is its own small disaster. + */ + let categoriesRemoved = 0; + try { + const cats = await this.getCollection('categories'); + const demoCats = await cats + .find( + { demo_pack: { $exists: true }, branch_id: branch, license }, + { projection: { _id: 1 } } + ) + .toArray(); + for (const cat of demoCats) { + // eslint-disable-next-line no-await-in-loop + const remaining = await items.countDocuments({ + category_id: cat._id, + 'branch_access.branch_id': branch, + license, + /* LIVE products only. The purge itself soft-deletes the samples + into the Recycle Bin, so counting binned rows meant every demo + category was held in place by the very products this purge had + just removed - "switch off demo data" left the categories + standing, every time, and nothing said why. */ + del_status: { $nin: [1, '1', true] }, + }); + if (remaining === 0) { + // eslint-disable-next-line no-await-in-loop + await cats.deleteOne({ _id: cat._id, license }); + categoriesRemoved++; + } + } + } catch (e) { + /* The products are gone either way; a leftover empty category is untidy, + not harmful, and must not turn a successful removal into a failure. */ + console.error('purgeDemoData: category cleanup:', e.message); + } + + /* + * Units, by the category rule: a demo unit still measuring anything + * alive - a sample the shop sold or edited (kept above), an item of + * their own that adopted it - is now the shop's unit and stays. Only a + * unit measuring nothing leaves. Seed and purge are a pair: the seed + * writes these rows (install.service demo units), so the switch that + * promises "removed" must know how to remove them. + */ + let unitsRemoved = 0; + try { + const unitsCol = await this.getCollection('unit'); + const demoUnits = await unitsCol + .find( + { demo_pack: { $exists: true }, branch_id: branch, license }, + { projection: { _id: 1 } } + ) + .toArray(); + for (const u of demoUnits) { + // eslint-disable-next-line no-await-in-loop + const remaining = await items.countDocuments({ + /* unit_id is an ObjectId on rows the seed wrote and a string on + rows some editors write; matching one shape silently keeps or + orphans the other. */ + unit_id: { $in: [u._id, String(u._id)] }, + 'branch_access.branch_id': branch, + license, + del_status: { $nin: [1, '1', true] }, + }); + if (remaining === 0) { + // eslint-disable-next-line no-await-in-loop + await unitsCol.deleteOne({ _id: u._id, license }); + unitsRemoved++; + } + } + } catch (e) { + console.error('purgeDemoData: unit cleanup:', e.message); + } + + return { + status: true, + removed, + categoriesRemoved, + unitsRemoved, + salesRemoved, + purchasesRemoved, + quotesRemoved, + peopleRemoved, + kept, + message: kept.length + ? `Removed ${removed} sample product${removed === 1 ? '' : 's'}. Kept ${kept.length}: ` + + kept + .slice(0, 6) + .map((k) => `${k.name} (${k.why})`) + .join(', ') + + (kept.length > 6 ? ` and ${kept.length - 6} more` : '') + + '.' + : `Removed ${removed} sample product${removed === 1 ? '' : 's'}.`, + }; + } + async hardDeleteItems(ids, { licenseId } = {}) { const objectIds = (ids || []) .map((v) => (ObjectId.isValid(String(v)) ? new ObjectId(String(v)) : null)) @@ -1229,6 +1585,30 @@ class ItemRepository extends BaseModel { updateData.tile_color = /^#[0-9a-fA-F]{6}$/.test(tileColor) ? tileColor : ''; } + // Quick code (owner ask): digits only, up to 6, or empty clears. + if (data.plu_code !== undefined) { + const plu = String(data.plu_code || '').trim(); + updateData.plu_code = /^\d{1,6}$/.test(plu) ? plu : ''; + } + + // The tile's shape rides the same rules: a known shape or empty. + if (data.tile_shape !== undefined) { + const tileShape = String(data.tile_shape || '').trim(); + updateData.tile_shape = [ + 'square', + 'rounded', + 'circle', + 'diamond', + 'triangle', + 'pentagon', + 'hexagon', + 'star', + 'octagon', + ].includes(tileShape) + ? tileShape + : ''; + } + /* * Lightspeed study LS1 trio, all presence-gated: brand (a name, for * filtering and the future community catalog), tags (free keywords), @@ -2003,6 +2383,10 @@ class ItemRepository extends BaseModel { { barcode_id: regex }, { barcodes: regex }, ]; + // An all-digits query is how quick codes are typed. + if (/^\d{1,6}$/.test(String(query))) { + searchConditions.push({ plu_code: String(query) }); + } } // Stock availability logic @@ -2018,9 +2402,15 @@ class ItemRepository extends BaseModel { ], }; + /* Same two clauses as the sale grid, same reason: search is a doorway + to selling, and a hidden or deleted sample reachable by typing its + name is not hidden at all. */ + const demoClause = await demoData.filter({ licenseId, branchId }); const match = { $and: [ searchConditions.length ? { $or: searchConditions } : null, + Object.keys(demoClause).length ? demoClause : null, + { del_status: { $nin: [1, '1', true] } }, { 'branch_access.branch_id': branchObjectId }, { item_status: { $ne: 'instant' } }, stockCondition, @@ -2060,6 +2450,8 @@ class ItemRepository extends BaseModel { items_expiry_date: 1, item_kind: 1, tile_color: 1, + tile_shape: 1, + plu_code: 1, }, }, ]) @@ -2088,8 +2480,17 @@ class ItemRepository extends BaseModel { items_expiry_date: item.items_expiry_date != null ? String(item.items_expiry_date) : '', item_kind: item.item_kind || 'product', tile_color: item.tile_color || '', + tile_shape: item.tile_shape || '', + plu_code: item.plu_code || '', })); + // Exact quick-code hits lead the list - Enter carts them instantly. + if (/^\d{1,6}$/.test(String(query))) { + suggestions.sort( + (a, b) => (b.plu_code === String(query) ? 1 : 0) - (a.plu_code === String(query) ? 1 : 0) + ); + } + return { status: true, data: suggestions, @@ -2121,8 +2522,27 @@ class ItemRepository extends BaseModel { const licenseObjectId = licenseId && ObjectId.isValid(licenseId) ? new ObjectId(licenseId) : licenseId || null; + /* + * The demo filter and the deleted filter, HERE TOO. + * + * listScope's comment promised the demo clause lived in "the ONE place + * the item list builds its filter... so it cannot be applied to some + * reads and forgotten on others - a catalogue that hides sample items + * on the manage screen and shows them on the sale grid is worse than + * not hiding them at all." This query is the sale grid, it never went + * through listScope, and the exact failure that sentence names is the + * owner's report, verbatim: "i see nothing in item list but sales page + * is showing item... i hard refreshed page. not removed." + * + * del_status for the same reason: with Demo Data's off now a DELETION, + * a sale grid that ignores the deleted flag re-shells every purged + * sample the moment the purge lands. + */ + const demoClause = await demoData.filter({ licenseId, branchId }); const match = { $and: [ + ...(Object.keys(demoClause).length ? [demoClause] : []), + { del_status: { $nin: [1, '1', true] } }, { 'branch_access.branch_id': branchObjectId }, { item_status: { $ne: 'instant' } }, { sales_channel: true }, @@ -2174,6 +2594,7 @@ class ItemRepository extends BaseModel { track_inventory: item.track_inventory === true, // Tile colour (Loyverse study L2): the no-image tile's look. tile_color: item.tile_color || '', + tile_shape: item.tile_shape || '', })); return { @@ -2298,6 +2719,8 @@ class ItemRepository extends BaseModel { image: DEFAULTS.IMAGE, sort_order: 0, track_inventory: false, + // Instant lines sell any quantity - stock never blocks them. + negative_stock: true, sales_channel: true, ecommerce: false, item_status: ITEM_STATUS.INSTANT, @@ -2458,6 +2881,7 @@ class ItemRepository extends BaseModel { track_inventory: item.track_inventory !== false, item_kind: item.item_kind || 'product', tile_color: item.tile_color || '', + tile_shape: item.tile_shape || '', })); return { status: true, data: list, message: 'success' }; @@ -2491,6 +2915,12 @@ class ItemRepository extends BaseModel { { 'branch_access.branch_id': new ObjectId(String(branchId)) }, { item_status: { $ne: ITEM_STATUS.INSTANT } }, { supplier_id: new ObjectId(String(supplierId)) }, + /* A deleted product is not purchasable. Every other item query + carries NOT_DELETED; this one did not, so the purchase picker + happily offered items the catalogue had already removed - the + owner found it as "item list not showing but purchase shows + all items", which is the same fact seen from both ends. */ + NOT_DELETED, ]; if (licenseId && ObjectId.isValid(String(licenseId))) { conditions.push({ license: new ObjectId(String(licenseId)) }); @@ -3023,7 +3453,12 @@ class ItemRepository extends BaseModel { const licenseObjectId = licenseId && ObjectId.isValid(licenseId) ? new ObjectId(licenseId) : licenseId; + /* Same two clauses as the sale grid, same reason: a category tab is + just the shelf filtered, and it showed what the shelf hid. */ + const demoClause = await demoData.filter({ licenseId, branchId }); const conditions = [ + ...(Object.keys(demoClause).length ? [demoClause] : []), + { del_status: { $nin: [1, '1', true] } }, { item_status: { $ne: ITEM_STATUS.INSTANT } }, { $or: [{ available_quantity: { $gt: 0 } }, { negative_stock: true }], @@ -3477,6 +3912,71 @@ class ItemRepository extends BaseModel { } } + /* + * Targeted money-field patch from the sale screen's "update item too" + * choice: only the fields the cashier actually changed, nothing else on + * the item is touched. + */ + /* + * Every item this branch can sell, reduced to the four fields the GST + * readiness scan compares. Scoped by branch_access + license like the + * paged list above (branch_id/branch_name are stale legacy fields). + * Projected rather than fetched whole: this walks the entire catalogue. + */ + async listForGstReadiness({ branchId, licenseId } = {}) { + const collection = await this.getCollection(this.collectionName); + const filter = { + 'branch_access.branch_id': this.toObjectId(branchId), + license: this.toObjectId(licenseId), + }; + return collection + .find(filter, { + projection: { item_name: 1, name: 1, tax: 1, hsncode: 1, hsndescription: 1 }, + }) + .sort({ item_name: 1 }) + .toArray(); + } + + async quickPatch(id, fields) { + try { + const collection = await this.getCollection(this.collectionName); + const objectId = ObjectId.isValid(id) ? new ObjectId(id) : id; + const set = {}; + if (fields.selling_price !== undefined) { + const v = parseFloat(fields.selling_price); + if (Number.isFinite(v) && v >= 0) set.selling_price = Math.round(v * 100) / 100; + } + if (fields.tax !== undefined) { + const v = parseFloat(fields.tax); + if (Number.isFinite(v) && v >= 0 && v <= 100) set.tax = v; + } + if (fields.discount_percentage !== undefined) { + const v = parseFloat(fields.discount_percentage); + if (Number.isFinite(v) && v >= 0 && v <= 100) { + set.discount_percentage = v; + set.discount_amount = 0; + } + } + if (fields.discount_amount !== undefined) { + const v = parseFloat(fields.discount_amount); + if (Number.isFinite(v) && v >= 0) { + set.discount_amount = Math.round(v * 100) / 100; + set.discount_percentage = 0; + } + } + if (!Object.keys(set).length) { + return { status: false, message: 'Nothing to update' }; + } + set.updated_date = new Date(); + const result = await collection.updateOne({ _id: objectId }, { $set: set }); + if (!result.matchedCount) return { status: false, message: 'Item not found' }; + return { status: true, message: 'Item updated' }; + } catch (error) { + console.error('Error in ItemRepository.quickPatch:', error); + throw error; + } + } + async updateItemQuantity(id, value) { try { const collection = await this.getCollection(this.collectionName); @@ -4232,7 +4732,7 @@ class ItemRepository extends BaseModel { let taxDocuments = null; // Detect whether this import row is HSN-based. For HSN items we do - // not create/attach tax groups – they use HSN codes instead. + // not create/attach tax groups - they use HSN codes instead. const rawImportHsn = items.hsncode !== undefined && items.hsncode !== null ? items.hsncode @@ -4284,7 +4784,7 @@ class ItemRepository extends BaseModel { const taxRate = Number(items.tax); if (!hasHsnForTax && importTaxName) { - // Non-HSN item with explicit tax_name from CSV – treat as a + // Non-HSN item with explicit tax_name from CSV - treat as a // tax group name (e.g. "mugrt8"). // 1) Try existing tax group with this name @@ -4671,6 +5171,62 @@ class ItemRepository extends BaseModel { * an optional category and search so "select all N" matches exactly what the * filtered list showed, not just the 100 rows on the current page. */ + /* + * Every item in the catalogue, grouped into families, without holding the + * catalogue in memory. + * + * The export has to group variants together, and the obvious way to do that + * is to read everything and bucket it. This repository has already paid for + * that once: the catalogue copy called .toArray() and then built a second + * full array of the same rows, so two copies of a shop's entire item list + * were resident at once, on a process shared with every other shop. + * + * Sorting by variant_group_id means a family arrives contiguously, so the + * grouping can be done as the cursor advances - one family resident at a + * time. The caller gets each family as it completes and decides what to do + * with it. + * + * The sort is the load-bearing part. Without it a family is scattered + * through the stream and the "flush when the id changes" rule silently emits + * the same family several times, each with some of its variants. + */ + async streamCatalogue({ branchId, licenseId }, onGroup) { + const collection = await this.getCollection(this.collectionName); + + const filter = { + 'branch_access.branch_id': this.toObjectId(branchId), + license: this.toObjectId(licenseId), + }; + + const cursor = collection.find(filter).sort({ variant_group_id: 1, _id: 1 }); + + let current = null; + let pending = []; + let count = 0; + + const flush = async () => { + if (!pending.length) return; + await onGroup(pending); + count += pending.length; + pending = []; + }; + + for await (const row of cursor) { + const gid = row.variant_group_id ? String(row.variant_group_id) : ''; + /* Items with no family are each their own group, so an empty id must not + collapse them all into one enormous "family". */ + if (!gid || gid !== current) { + await flush(); + current = gid || null; + } + pending.push(row); + if (!gid) await flush(); + } + await flush(); + + return count; + } + _buildExportFilter(selection, context = {}) { const licenseId = context.licenseId || null; const licenseClause = licenseId diff --git a/api/src/repositories/quote.repository.js b/api/src/repositories/quote.repository.js new file mode 100644 index 000000000..796275455 --- /dev/null +++ b/api/src/repositories/quote.repository.js @@ -0,0 +1,671 @@ +'use strict'; + +/* + * Quotes (Lightspeed study LS2): a priced offer, printable and convertible, + * and NOTHING else. A quote never touches stock, never records a payment, + * never becomes revenue by itself - the sale it converts into does all of + * that through the ordinary sale path, which sends source_quote_id so the + * quote can be stamped converted. A test pins that the only collection this + * repository touches is its own. + */ + +const BaseModel = require('../models/base.model'); +const { ObjectId } = require('mongodb'); +const { ensureIndexOnce } = require('../db/ensure-index'); +const docMath = require('../services/document-math'); + +const STATUSES = Object.freeze([ + 'open', + 'draft', + 'sent', + 'accepted', + 'declined', + 'invoiced', + 'converted', + 'cancelled', +]); +/* draft and sent behave like open: still editable, still convertible. + accepted freezes edits (the promise is made); declined/converted/ + cancelled are history. invoiced (INVOICING_MODULE_DESIGN) means an + invoice now carries the numbers: the quote is frozen like accepted, and + it is the INVOICE that converts to the sale - which stamps the quote + converted in turn, so the chain reads quote -> invoice -> sale. */ +const EDITABLE = Object.freeze(['open', 'draft', 'sent']); + +class QuoteRepository extends BaseModel { + constructor() { + super('quotes'); + } + + _wall(context) { + const branchId = context && context.branchId; + const licenseId = context && context.licenseId; + if (!branchId || !ObjectId.isValid(String(branchId))) return null; + const wall = { branch_id: new ObjectId(String(branchId)) }; + if (licenseId && ObjectId.isValid(String(licenseId))) { + wall.license = new ObjectId(String(licenseId)); + } + return wall; + } + + /* Next quote number for the branch: QUO-000001 style, resilient to holes. */ + async _nextQuoteId(collection, wall) { + const rows = await collection + .find({ branch_id: wall.branch_id }, { projection: { quote_id: 1 } }) + .toArray(); + let max = 0; + for (const r of rows) { + const n = Number(String((r && r.quote_id) || '').replace(/^QUO-?/i, '')); + if (Number.isFinite(n)) max = Math.max(max, n); + } + return 'QUO-' + String(max + 1).padStart(6, '0'); + } + + /* + * The money arithmetic moved to services/document-math when invoices + * arrived: a quote becomes an invoice becomes a sale, and one copy of the + * rounding rules is the only way the three documents agree. These thin + * delegates keep the repository's own surface unchanged. + */ + static _round2(n) { + return docMath.round2(n); + } + + static _discountOf(raw, gross) { + return docMath.discountOf(raw, gross); + } + + _normalizeLines(rows) { + return docMath.normalizeLines(rows, 'quote'); + } + + _normalizeCharges(rows) { + return docMath.normalizeCharges(rows); + } + + _normalizeBlocks(rows) { + return docMath.normalizeBlocks(rows); + } + + _normalizeLayout(value) { + return docMath.normalizeLayout(value); + } + + _validUntil(value) { + return docMath.dateOrNull(value); + } + + /* Create (id empty) or update - open quotes only; history is not editable. */ + async upsertQuote(data = {}, id = '', context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + + const parsed = this._normalizeLines(data.lines || data.items); + if (parsed.error) return { status: false, data: null, message: parsed.error }; + + /* Money authority (QUOTATION_MODULE_DESIGN rule 4) lives in + document-math.computeTotals, shared with invoices. */ + const money = docMath.computeTotals({ + lines: parsed.lines, + charges: this._normalizeCharges(data.charges), + discount: data.discount, + clientTotal: data.total, + clientTaxTotal: data.tax_total, + }); + + const now = new Date(); + const collection = await this.getCollection(this.collectionName); + + const doc = { + branch_id: wall.branch_id, + branch_name: String(context.branchName || '').trim(), + customer_id: + data.customer_id && ObjectId.isValid(String(data.customer_id)) + ? new ObjectId(String(data.customer_id)) + : null, + customer_name: String(data.customer_name || '').trim(), + customer_phone: String(data.customer_phone || '').trim(), + // Professional quotation fields (owner spec): all presence-tolerant + // strings the preview edits in place. + customer_address: String(data.customer_address || '') + .trim() + .slice(0, 300), + customer_gstin: String(data.customer_gstin || '') + .trim() + .slice(0, 20), + customer_email: String(data.customer_email || '') + .trim() + .slice(0, 120), + payment_method: String(data.payment_method || '') + .trim() + .slice(0, 60), + bank_details: String(data.bank_details || '') + .trim() + .slice(0, 500), + terms: String(data.terms || '') + .trim() + .slice(0, 1500), + items: parsed.lines, + charges: money.charges, + discount: money.discount, + charges_total: money.charges_total, + custom_blocks: this._normalizeBlocks(data.custom_blocks), + layout: this._normalizeLayout(data.layout), + notes: String(data.notes || '') + .trim() + .slice(0, 2000), + subtotal: money.subtotal, + tax_total: money.tax_total, + total: money.total, + valid_until: this._validUntil(data.valid_until), + note: String(data.note || '') + .trim() + .slice(0, 500), + updated_date: now, + updated_by: String(context.userName || ''), + }; + if (wall.license) doc.license = wall.license; + + if (id) { + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid quote id' }; + } + const result = await collection.updateOne( + { _id: new ObjectId(String(id)), ...wall, status: { $in: EDITABLE } }, + { $set: doc } + ); + if (!result.matchedCount) { + return { + status: false, + data: null, + message: 'This quote can no longer be edited - it is accepted, converted or closed', + }; + } + return { status: true, data: { id: String(id) }, message: 'Quote updated' }; + } + + /* A new quote starts from the shop's quotation defaults (settings) + wherever the sale screen sent nothing - each stays editable on the + quote's preview. A defaults lookup that fails is only a nicety + missed, never a failed save. */ + if (!doc.payment_method || !doc.bank_details || !doc.terms) { + try { + const branches = await this.getCollection('branches'); + const b = await branches.findOne( + { _id: wall.branch_id }, + { + projection: { + quote_default_payment_method: 1, + quote_default_bank_details: 1, + quote_default_terms: 1, + }, + } + ); + if (b) { + if (!doc.payment_method) + doc.payment_method = String(b.quote_default_payment_method || '') + .trim() + .slice(0, 60); + if (!doc.bank_details) + doc.bank_details = String(b.quote_default_bank_details || '') + .trim() + .slice(0, 500); + if (!doc.terms) + doc.terms = String(b.quote_default_terms || '') + .trim() + .slice(0, 1500); + } + } catch (e) { + /* defaults are a nicety */ + } + } + + doc.quote_id = await this._nextQuoteId(collection, wall); + doc.status = 'open'; + doc.converted_sale_id = null; + doc.created_date = now; + doc.created_by = String(context.userName || ''); + const inserted = await collection.insertOne(doc); + return { + status: true, + data: { id: String(inserted.insertedId), quote_id: doc.quote_id }, + message: 'Quote saved', + }; + } catch (error) { + console.error('Error in QuoteRepository.upsertQuote:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* + * Quote list: status filter, free-text search and paging all decided + * HERE. They used to be decided in the browser over whatever the first + * 100 rows happened to be, which was not merely slow - past 100 quotes a + * search for an older one returned "no quotes here yet" for a quote that + * plainly exists, and the pager only ever walked that same first 100. + * `meta` carries the true total so the pager knows how far the list goes. + */ + /* + * The index the quote list needs. + * + * Without it every list request is a full collection scan, and the cost is + * paid three times over: + * + * - the scan itself, on a filter that is always branch + license + * - AGAIN for countDocuments, which the pager needs and which runs the + * same filter a second time on every request + * - and the sort. Sorting created_date with no index behind it happens in + * memory, which Mongo caps at 32MB. Past that it does not get slower, it + * ERRORS - so the list would go from working to "Could not load quotes" + * at some unannounced number of quotes. + * + * `{ branch_id, license, created_date }` fixes all three: Mongo walks only + * this branch's quotes, already in the order the list wants them. + * + * It does NOT help the search regex - /term/i is unanchored and + * case-insensitive, so no index can serve it. But the wall runs first, so + * the regex is then tested against one branch's quotes rather than every + * quote in the database, which is where the real cost was. + * + * Best-effort and once per process, following the sales precedent: an index + * build that fails must never fail a page load. + */ + async _ensureListIndex(collection) { + /* Once per DATABASE, not once per process. Each shop has its own database + and one process serves many, so a static boolean would give the index to + whichever shop happened to ask first and to nobody else. */ + await ensureIndexOnce( + collection, + { branch_id: 1, license: 1, created_date: -1 }, + { name: 'quote_list_by_branch' } + ); + /* The whitelisted sorts (high amount, valid-till) walk these. */ + await ensureIndexOnce( + collection, + { branch_id: 1, license: 1, total: -1 }, + { name: 'quote_list_by_total' } + ); + await ensureIndexOnce( + collection, + { branch_id: 1, license: 1, valid_until: 1 }, + { name: 'quote_list_by_valid_until' } + ); + } + + async listQuotes(params = {}, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + const filter = { ...wall }; + if (params.status && STATUSES.includes(String(params.status))) { + filter.status = String(params.status); + } + /* + * Free text, plus the two filters that actually get used on a long + * list: WHICH field, and WHEN. + * + * `field` narrows the search to one column instead of both. `exact` + * anchors it, and anchoring is not cosmetic: /^QUO-000012$/ can be + * served by an index where /QUO/ cannot. A shop that searches by quote + * number gets a seek instead of a scan of its whole history, which is + * the difference that matters once the list is long. + */ + const term = String(params.search || '') + .trim() + .slice(0, 80); + if (term) { + // user text becomes a regex: escape it, or a stray '(' is a 500 + const safe = term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); + const rx = + String(params.exact) === 'true' ? new RegExp(`^${safe}$`, 'i') : new RegExp(safe, 'i'); + const field = String(params.field || 'all'); + if (field === 'quote_id') filter.quote_id = rx; + else if (field === 'customer_name') filter.customer_name = rx; + else filter.$or = [{ customer_name: rx }, { quote_id: rx }]; + } + + /* + * Date range on created_date. The list index is + * { branch_id, license, created_date }, so a range is a seek down that + * index and the sort it already needs comes free from the same walk. + * + * `to` is pushed to the END of its day. Picking 21 Aug means "including + * the 21st"; comparing against midnight would silently drop a day of + * quotes and read as data loss. + */ + const range = {}; + const rawFrom = params.from ? String(params.from) : ''; + const rawTo = params.to ? String(params.to) : ''; + const from = rawFrom ? new Date(rawFrom) : null; + const to = rawTo ? new Date(rawTo) : null; + if (from && !Number.isNaN(from.getTime())) range.$gte = from; + if (to && !Number.isNaN(to.getTime())) { + /* Only a DATE-ONLY value gets pushed to the end of its day. + "2026-08-21" means "including the 21st", and comparing it against + midnight would silently drop a day. But the filter bar now sends a + precise instant, and forcing 23:59 onto that would widen a range the + user deliberately narrowed - "up to 2pm" would quietly mean "up to + midnight". The presence of a time is what tells the two apart. */ + if (/^\d{4}-\d{2}-\d{2}$/.test(rawTo.trim())) to.setHours(23, 59, 59, 999); + range.$lte = to; + } + if (Object.keys(range).length) filter.created_date = range; + const limit = Math.min(Math.max(Number(params.limit) || 100, 1), 200); + const page = Math.max(Number(params.page) || 1, 1); + const collection = await this.getCollection(this.collectionName); + await this._ensureListIndex(collection); + + /* + * The exact total is the most expensive thing on this screen and the + * least useful, so it is only paid for when it is cheap. + * + * countDocuments runs the whole filter a SECOND time. Branch, status and + * a date range are all served by the list index, so counting them is a + * seek and worth having - real totals, real page numbers. An unanchored + * regex cannot use any index, so counting a text search means running + * that regex across every candidate row, twice per request. + * + * Nobody acts on "1,247 quotes". They act on "is mine here" and "is + * there more". The second needs ONE extra row, not a count: ask for + * limit + 1, and if it comes back there is a next page. One query + * instead of two, on exactly the case that would hurt. + */ + const countable = !term; + let total = null; + let rows; + + /* + * Sort, whitelisted (owner: high amount, valid-till, date). Only + * these names reach the query - a raw client field would sort by + * anything on the document. + */ + const QUOTE_SORTS = { + recent: { created_date: -1 }, + total_desc: { total: -1, _id: -1 }, + total_asc: { total: 1, _id: -1 }, + valid_asc: { valid_until: 1, _id: -1 }, + valid_desc: { valid_until: -1, _id: -1 }, + }; + const sort = QUOTE_SORTS[String(params.sort || '')] || { created_date: -1 }; + + if (countable) { + total = await collection.countDocuments(filter); + rows = await collection + .find(filter) + .sort(sort) + .skip((page - 1) * limit) + .limit(limit) + .toArray(); + } else { + rows = await collection + .find(filter) + .sort(sort) + .skip((page - 1) * limit) + .limit(limit + 1) + .toArray(); + } + + // the probe row is proof of a next page, never something to display + const hasMore = countable ? page * limit < total : rows.length > limit; + if (!countable && rows.length > limit) rows = rows.slice(0, limit); + + return { + status: true, + data: rows, + meta: { + total, + page, + limit, + hasMore, + // pages is only honest when a total was actually measured + pages: total === null ? null : Math.max(1, Math.ceil(total / limit)), + }, + message: 'success', + }; + } catch (error) { + console.error('Error in QuoteRepository.listQuotes:', error); + return { status: false, data: null, message: error.message }; + } + } + + async getQuote(id, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid quote id' }; + } + const collection = await this.getCollection(this.collectionName); + const doc = await collection.findOne({ _id: new ObjectId(String(id)), ...wall }); + if (!doc) return { status: false, data: null, message: 'Quote not found' }; + return { status: true, data: doc, message: 'success' }; + } catch (error) { + console.error('Error in QuoteRepository.getQuote:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* + * Transitions: convert (open -> converted, stamping the sale that came + * from it) and cancel (open -> cancelled). Converting an already + * converted quote with the SAME sale id is a replay and succeeds; + * with a different sale id it is refused - one quote, one sale. + */ + async transition(id, action, data = {}, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid quote id' }; + } + const collection = await this.getCollection(this.collectionName); + const doc = await collection.findOne({ _id: new ObjectId(String(id)), ...wall }); + if (!doc) return { status: false, data: null, message: 'Quote not found' }; + + if (action === 'cancel') { + if (doc.status === 'converted' || doc.status === 'cancelled') { + return { status: false, data: null, message: 'This quote is already closed' }; + } + if (doc.status === 'invoiced') { + return { + status: false, + data: null, + message: 'This quote became an invoice - cancel the invoice instead', + }; + } + await collection.updateOne( + { _id: doc._id }, + { $set: { status: 'cancelled', updated_date: new Date() } } + ); + return { status: true, data: { id: String(doc._id) }, message: 'Quote cancelled' }; + } + + /* + * The quote left the shop (emailed, WhatsApped, linked): open/draft + * become 'sent'. Idempotent and quiet - re-sending an already-sent + * quote succeeds without touching it, and history states refuse. + */ + if (action === 'send') { + if (doc.status === 'sent') { + return { status: true, data: { id: String(doc._id) }, message: 'Quote already sent' }; + } + if (!EDITABLE.includes(doc.status)) { + return { status: false, data: null, message: 'This quote is closed - nothing to send' }; + } + await collection.updateOne( + { _id: doc._id }, + { $set: { status: 'sent', sent_date: new Date(), updated_date: new Date() } } + ); + return { status: true, data: { id: String(doc._id) }, message: 'Quote marked sent' }; + } + + /* The customer said yes / no. Accepting freezes edits - the numbers + are now a promise; converting is still allowed (that IS the point). */ + if (action === 'accept' || action === 'decline') { + if (!EDITABLE.includes(doc.status)) { + return { + status: false, + data: null, + message: 'Only an open quote can be accepted or declined', + }; + } + const status = action === 'accept' ? 'accepted' : 'declined'; + await collection.updateOne( + { _id: doc._id }, + { $set: { status, [action + 'ed_date']: new Date(), updated_date: new Date() } } + ); + return { status: true, data: { id: String(doc._id) }, message: 'Quote ' + status }; + } + + /* + * The quote became an invoice (INVOICING_MODULE_DESIGN): the invoice + * repository creates the document and then stamps the quote here. One + * quote, one invoice - a replay with the same invoice id succeeds, a + * different one is refused. + */ + if (action === 'invoice') { + const invoiceId = + data.invoice_id && ObjectId.isValid(String(data.invoice_id)) + ? new ObjectId(String(data.invoice_id)) + : null; + if (!invoiceId) return { status: false, data: null, message: 'An invoice id is required' }; + if (doc.status === 'invoiced') { + const same = doc.invoice_id && String(doc.invoice_id) === String(invoiceId); + return same + ? { status: true, data: { id: String(doc._id) }, message: 'Quote already invoiced' } + : { status: false, data: null, message: 'This quote already has an invoice' }; + } + if (!EDITABLE.includes(doc.status) && doc.status !== 'accepted') { + return { + status: false, + data: null, + message: 'Only an open or accepted quote can become an invoice', + }; + } + await collection.updateOne( + { _id: doc._id }, + { + $set: { + status: 'invoiced', + invoice_id: invoiceId, + invoice_number: String(data.invoice_number || '').slice(0, 40), + invoiced_date: new Date(), + updated_date: new Date(), + }, + } + ); + return { status: true, data: { id: String(doc._id) }, message: 'Quote invoiced' }; + } + + if (action === 'convert') { + const saleId = + data.sale_id && ObjectId.isValid(String(data.sale_id)) + ? new ObjectId(String(data.sale_id)) + : null; + if (doc.status === 'converted') { + const same = + saleId && doc.converted_sale_id && String(doc.converted_sale_id) === String(saleId); + return same + ? { status: true, data: { id: String(doc._id) }, message: 'Quote already converted' } + : { status: false, data: null, message: 'This quote was already converted to a sale' }; + } + /* invoiced joins the list: the invoice's own conversion stamps the + quote it came from, closing the chain. */ + if ( + !EDITABLE.includes(doc.status) && + doc.status !== 'accepted' && + doc.status !== 'invoiced' + ) { + return { + status: false, + data: null, + message: 'Only an open or accepted quote can be converted', + }; + } + await collection.updateOne( + { _id: doc._id }, + { + $set: { + status: 'converted', + converted_sale_id: saleId, + converted_date: new Date(), + updated_date: new Date(), + }, + } + ); + return { status: true, data: { id: String(doc._id) }, message: 'Quote converted' }; + } + + return { status: false, data: null, message: 'Unknown action' }; + } catch (error) { + console.error('Error in QuoteRepository.transition:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* Share metadata: which S3 object currently represents this quote. Any + status may share - sending a converted quote's record is legitimate. + Revisions are the caller's job; this only persists the newest one. */ + async recordShare(id, share, context) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid quote id' }; + } + const collection = await this.getCollection(this.collectionName); + const result = await collection.updateOne( + { _id: new ObjectId(String(id)), ...wall }, + { + $set: { + share: { + key: String(share.key || ''), + url: String(share.url || ''), + rev: Number(share.rev) || 1, + at: new Date(), + }, + updated_date: new Date(), + }, + } + ); + if (!result.matchedCount) return { status: false, data: null, message: 'Quote not found' }; + /* A shared quote has been SENT - open/draft move on; anything else + (sent already, accepted, history) is left exactly as it is. */ + await collection.updateOne( + { _id: new ObjectId(String(id)), ...wall, status: { $in: ['open', 'draft'] } }, + { $set: { status: 'sent', sent_date: new Date() } } + ); + return { status: true, data: { rev: Number(share.rev) || 1 }, message: 'Share recorded' }; + } catch (error) { + console.error('Error in QuoteRepository.recordShare:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* Delete: open quotes only, enforced in the query itself. */ + async deleteQuote(id, context = {}) { + try { + const wall = this._wall(context); + if (!wall) return { status: false, data: null, message: 'Branch ID not found' }; + if (!ObjectId.isValid(String(id))) { + return { status: false, data: null, message: 'Invalid quote id' }; + } + const collection = await this.getCollection(this.collectionName); + const result = await collection.deleteOne({ + _id: new ObjectId(String(id)), + ...wall, + status: { $in: EDITABLE }, + }); + if (!result.deletedCount) { + return { status: false, data: null, message: 'Only an open quote can be deleted' }; + } + return { status: true, data: { id: String(id) }, message: 'Quote deleted' }; + } catch (error) { + console.error('Error in QuoteRepository.deleteQuote:', error); + return { status: false, data: null, message: error.message }; + } + } +} + +module.exports = QuoteRepository; diff --git a/api/src/repositories/sale.repository.js b/api/src/repositories/sale.repository.js index 9f008c444..d51069ea3 100644 --- a/api/src/repositories/sale.repository.js +++ b/api/src/repositories/sale.repository.js @@ -3,6 +3,7 @@ const { currentConnection } = require('../db/tenant-context'); const { ObjectId } = require('mongodb'); const crypto = require('crypto'); const BaseModel = require('../models/base.model'); +const { ensureIndexOnce } = require('../db/ensure-index'); const { formatDate } = require('../utils/helpers'); const StockLogsRepository = require('./stock-log.repository'); const { PAYMENT_STATUS } = require('../constants'); @@ -12,6 +13,37 @@ const activeTenantFilter = () => ({ ...(BaseModel.currentBranch ? { branch_id: BaseModel.currentBranch } : {}), }); +/* + * GST place-of-supply code for a B2B invoice. + * + * A GSTIN's first two digits ARE the state code (35AAAA...), so the + * customer's own number is the authoritative source and needs no table. + * The stored state NAME is the fallback for rows whose GSTIN is missing + * or malformed. Returns '' when neither resolves - better an empty field + * the shop can see and fix than a wrong state silently filed. + */ +let _gstStateByName = null; +const gstStateCode = (gstin, stateName) => { + const num = String(gstin || '').trim(); + if (/^\d{2}/.test(num)) return num.slice(0, 2); + const name = String(stateName || '') + .trim() + .toLowerCase(); + if (!name) return ''; + if (!_gstStateByName) { + _gstStateByName = new Map(); + try { + const list = require('../json/gst_state_code.json').gststate || []; + for (const row of list) { + _gstStateByName.set(String(row.value || '').toLowerCase(), String(row.id || '')); + } + } catch (e) { + /* file unreadable: GSTIN-derived codes still work */ + } + } + return _gstStateByName.get(name) || ''; +}; + const round = (value, decimals = 2) => { const num = typeof value === 'number' ? value : Number(value); if (!Number.isFinite(num)) return 0; @@ -2910,6 +2942,23 @@ class SalesRepository { } } + /* + * The item/category details tables send these rows to the client RAW, and + * the client renders row.items_total.toFixed(2) per row - so one sale + * document without the denormalised totals (demo-seeded sales carry + * sales_total only; imports and old PHP data vary too) white-paged the + * whole details view. The totals are answered here with the same fallbacks + * the sales list formatter uses, so every row is renderable. + */ + _renderableSaleRows(rawList) { + const round2 = (v) => Math.round((Number(v) || 0) * 100) / 100; + return (rawList || []).map((doc) => ({ + ...doc, + items_total: round2(doc.items_total ?? doc.sales_total ?? doc.total ?? 0), + items_return_total: round2(doc.items_return_total ?? 0), + })); + } + async itemSaleDetailsPage(value, options = {}, { SaleModel } = {}) { try { const Model = this.getModel(SaleModel); @@ -3004,7 +3053,9 @@ class SalesRepository { const sort = options.sort || { _id: 1 }; // Fetch paginated list for table (similar to PHP parent::page result) - const list = await Model.find(tableFilters).sort(sort).skip(skip).limit(limit).lean(); + const list = this._renderableSaleRows( + await Model.find(tableFilters).sort(sort).skip(skip).limit(limit).lean() + ); const totalCount = await Model.countDocuments(tableFilters); @@ -3157,7 +3208,9 @@ class SalesRepository { const sort = options.sort || { _id: 1 }; // Fetch paginated list for table (similar to PHP parent::page result) - const list = await Model.find(tableFilters).sort(sort).skip(skip).limit(limit).lean(); + const list = this._renderableSaleRows( + await Model.find(tableFilters).sort(sort).skip(skip).limit(limit).lean() + ); const totalCount = await Model.countDocuments(tableFilters); @@ -3289,7 +3342,9 @@ class SalesRepository { const skip = Math.max(0, (page - 1) * limit); const sort = options.sort || { _id: 1 }; - const list = await Model.find(filters).sort(sort).skip(skip).limit(limit).lean(); + const list = this._renderableSaleRows( + await Model.find(filters).sort(sort).skip(skip).limit(limit).lean() + ); const totalCount = await Model.countDocuments(filters); @@ -4233,7 +4288,9 @@ class SalesRepository { const sort = options.sort || { _id: 1 }; // Fetch paginated list of sales for this customer - const list = await Model.find(matchFilter).sort(sort).skip(skip).limit(limit).lean(); + const list = this._renderableSaleRows( + await Model.find(matchFilter).sort(sort).skip(skip).limit(limit).lean() + ); const totalCount = await Model.countDocuments(matchFilter); @@ -4334,7 +4391,9 @@ class SalesRepository { const sort = options.sort || { _id: 1 }; // Fetch paginated list of sales for this customer category - const list = await Model.find(matchFilter).sort(sort).skip(skip).limit(limit).lean(); + const list = this._renderableSaleRows( + await Model.find(matchFilter).sort(sort).skip(skip).limit(limit).lean() + ); const totalCount = await Model.countDocuments(matchFilter); @@ -5851,6 +5910,9 @@ class SalesRepository { return_sales_id: '$sales_id', return_sales_date: '$date', return_customer_state: '$customer_state', + // the credit-note rows printed a placeholder GSTIN; carry + // the real one so the 9B table shows the actual customer + return_customer_gst_number: '$customer_gst_number', return_id: '$items_return.returnArray.returnValue.return_id', return_date: '$items_return.returnArray.returnValue.return_date', return_tax: '$items_return.returnArray.returnValue.tax', @@ -5888,6 +5950,7 @@ class SalesRepository { ? new Date(item._id.return_sales_date).toLocaleDateString('en-GB') : '', return_customer_state: item._id.return_customer_state || '', + return_customer_gst_number: item._id.return_customer_gst_number || '', return_total: Math.round(item._id.return_total * 100) / 100, return_tax: Math.round(item._id.return_tax * 100) / 100, return_subtotal: Math.round((item._id.return_total - returnMultipleValue) * 100) / 100, @@ -6025,6 +6088,182 @@ class SalesRepository { } } + /* + * The Tax Payable view (PURCHASE_TAX_PLAN P4/G4): the plain-words answer + * to "how much do I owe this period" that every regime gets. + * + * Month by month: output tax collected on sales | input tax paid on + * credit-claimable purchases | net payable per head, with the credits + * applied in the statutory order - IGST credit spends against IGST, then + * CGST, then SGST; CGST credit against CGST then IGST; SGST against SGST + * then IGST; CGST and SGST NEVER pay each other. Single-head regimes fall + * out naturally: their cgst/sgst columns are simply zero. + * + * Purchases whose itc_eligible flag is false are excluded from the input + * side; ABSENT means eligible - every purchase recorded before the flag + * existed keeps the credit it always represented. + */ + async taxPayablePage(data) { + try { + const { starting_date, ending_date, branch_id, license } = data; + const FromDate = new Date(starting_date); + const ToDate = new Date(ending_date); + const salesCollection = currentConnection(mongoose.connection).collection('sales'); + const receivingsCollection = currentConnection(mongoose.connection).collection('receivings'); + + const monthKey = { year: { $year: '$date' }, month: { $month: '$date' } }; + const headSums = { + igst: { $sum: { $ifNull: ['$items.igst_tax', 0] } }, + cgst: { $sum: { $ifNull: ['$items.cgst_tax', 0] } }, + sgst: { $sum: { $ifNull: ['$items.sgst_tax', 0] } }, + taxable: { $sum: { $ifNull: ['$items.subtotal', '$items.total_amount'] } }, + }; + + const scope = { + branch_id: new ObjectId(branch_id), + license: new ObjectId(license), + date: { $gte: FromDate, $lte: ToDate }, + }; + + const [salesRows, purchaseRows] = await Promise.all([ + salesCollection + .aggregate([ + { $match: scope }, + { $unwind: '$items' }, + { $group: { _id: monthKey, ...headSums } }, + ]) + .toArray(), + receivingsCollection + .aggregate([ + { + $match: { + ...scope, + itc_eligible: { $ne: false }, + receiving_status: { $ne: 'Cancelled' }, + }, + }, + { $unwind: '$items' }, + { $group: { _id: monthKey, ...headSums } }, + ]) + .toArray(), + ]); + + const r2 = (n) => Math.round((Number(n) || 0) * 100) / 100; + const months = new Map(); + const bucket = (id) => { + const key = `${id.year}-${String(id.month).padStart(2, '0')}`; + if (!months.has(key)) { + months.set(key, { + period: key, + output: { igst: 0, cgst: 0, sgst: 0, taxable: 0 }, + input: { igst: 0, cgst: 0, sgst: 0, taxable: 0 }, + }); + } + return months.get(key); + }; + for (const row of salesRows) { + const b = bucket(row._id).output; + b.igst = r2(row.igst); + b.cgst = r2(row.cgst); + b.sgst = r2(row.sgst); + b.taxable = r2(row.taxable); + } + for (const row of purchaseRows) { + const b = bucket(row._id).input; + b.igst = r2(row.igst); + b.cgst = r2(row.cgst); + b.sgst = r2(row.sgst); + b.taxable = r2(row.taxable); + } + + const rows = Array.from(months.values()).sort((a, b) => a.period.localeCompare(b.period)); + const { netTaxHeads } = require('../utils/tax-netting'); + for (const m of rows) { + const netted = netTaxHeads(m.output, m.input); + m.net = netted.net; + m.credit_carried = netted.credit_carried; + m.output.total = r2(m.output.igst + m.output.cgst + m.output.sgst); + m.input.total = r2(m.input.igst + m.input.cgst + m.input.sgst); + } + + return { status: true, data: { months: rows }, message: 'success' }; + } catch (error) { + console.error('Error in taxPayablePage:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* + * The purchase register beneath the payable view: every purchase in the + * period with its tax identity - supplier, tax-ID, the three heads, the + * credit flag and whether the declared invoice total disagreed. The + * accountant's working paper, exportable like every other report. + */ + async taxPayableRegisterPage(data) { + try { + const { starting_date, ending_date, branch_id, license } = data; + const receivingsCollection = currentConnection(mongoose.connection).collection('receivings'); + const rows = await receivingsCollection + .aggregate([ + { + $match: { + branch_id: new ObjectId(branch_id), + license: new ObjectId(license), + date: { $gte: new Date(starting_date), $lte: new Date(ending_date) }, + }, + }, + { + $project: { + receiving_id: 1, + receiving_status: 1, + date: 1, + supplier_name: 1, + supplier_gst_number: 1, + itc_eligible: 1, + invoice_total_declared: 1, + invoice_total_mismatch: 1, + total_amount: 1, + subtotal_amount: 1, + has_document: { $gt: [{ $size: { $ifNull: ['$image', []] } }, 0] }, + igst: { + $sum: { + $map: { + input: { $ifNull: ['$items', []] }, + as: 'i', + in: { $ifNull: ['$$i.igst_tax', 0] }, + }, + }, + }, + cgst: { + $sum: { + $map: { + input: { $ifNull: ['$items', []] }, + as: 'i', + in: { $ifNull: ['$$i.cgst_tax', 0] }, + }, + }, + }, + sgst: { + $sum: { + $map: { + input: { $ifNull: ['$items', []] }, + as: 'i', + in: { $ifNull: ['$$i.sgst_tax', 0] }, + }, + }, + }, + }, + }, + { $sort: { date: -1 } }, + ]) + .toArray(); + return { status: true, data: { list: rows }, message: 'success' }; + } catch (error) { + console.error('Error in taxPayableRegisterPage:', error); + return { status: false, data: null, message: error.message }; + } + } + async gstThreeReportPage(data, { SaleModel } = {}) { try { const { starting_date, ending_date, branch_id, license, branch_state } = data; @@ -6342,13 +6581,26 @@ class SalesRepository { } } + /* + * GSTR-1 B2B section for the government offline tool. + * + * Rewritten 2026-08-20 - the previous shape could not be filed: + * - CGST and SGST were summed into `csamt`, which is the CESS field. + * The correct fields are `camt` and `samt`; cess stays 0 until the + * product actually records cess. + * - Every aggregation row became its own b2b entry, so one customer + * appeared many times and one invoice split across entries. The + * tool needs ONE entry per GSTIN holding all of its invoices, and + * one `itms` line per TAX RATE inside each invoice. + * - `rt` summed the rate column across items (9 + 9 = 18%), and both + * `pos` (place of supply) and `num` were hardcoded. + * Money is summed per (invoice, rate) in Mongo, then assembled here. + */ async gstOneReportPageJson(data, { SaleModel } = {}) { try { - // Parse dates const fromDate = new Date(data.starting_date); const toDate = new Date(data.ending_date); - // Get current branch and license from session/context const branchId = data.branch_id ? new ObjectId(data.branch_id) : null; const license = data.license ? new ObjectId(data.license) : null; @@ -6360,7 +6612,7 @@ class SalesRepository { }; } - // Filter for registered customers (regular/composite) + // Registered customers only - B2B is what this section reports. const filters = { $and: [ { @@ -6377,70 +6629,84 @@ class SalesRepository { const salesCollection = currentConnection(mongoose.connection).collection('sales'); - // Sales details aggregation - const salesList = await salesCollection + // One row per (invoice, tax rate) - the exact grain of an `itms` line. + const rows = await salesCollection .aggregate([ { $unwind: '$items' }, { $match: filters }, { $group: { _id: { - item_sales_id: '$sales_id', - item_date: '$date', - item_customer_gst_number: '$customer_gst_number', - tax_amount: '$items.tax_amount', - total_amount: '$items.total_amount', - item_price: '$items.item_price', - }, - total_amount: { $sum: '$items.total_amount' }, - tax_value: { $sum: '$items.tax' }, - item_igst_tax: { $sum: '$items.igst_tax' }, - csgst_multiply: { - $sum: { $add: ['$items.cgst_tax', '$items.sgst_tax'] }, + sales_id: '$sales_id', + ctin: '$customer_gst_number', + rate: '$items.tax', }, + date: { $first: '$date' }, + customer_state: { $first: '$customer_state' }, + invoice_value: { $first: '$sales_total' }, + items_value: { $sum: '$items.total_amount' }, + igst: { $sum: '$items.igst_tax' }, + cgst: { $sum: '$items.cgst_tax' }, + sgst: { $sum: '$items.sgst_tax' }, }, }, - { $sort: { _id: 1 } }, + { $sort: { '_id.ctin': 1, '_id.sales_id': 1, '_id.rate': 1 } }, ]) .toArray(); - // Format data for GST-1 JSON format - const gstOne = salesList.map((item) => { - const multipleValue = item.item_igst_tax > 0 ? item.item_igst_tax : item.csgst_multiply; + const byCtin = new Map(); + for (const row of rows) { + const ctin = String(row._id.ctin || '').trim(); + const inum = String(row._id.sales_id || '').trim(); + if (!inum) continue; + + if (!byCtin.has(ctin)) byCtin.set(ctin, new Map()); + const invoices = byCtin.get(ctin); + + if (!invoices.has(inum)) { + const d = row.date ? new Date(row.date) : null; + const idt = + d && !Number.isNaN(d.getTime()) + ? `${String(d.getDate()).padStart(2, '0')}-${String(d.getMonth() + 1).padStart( + 2, + '0' + )}-${d.getFullYear()}` + : ''; + invoices.set(inum, { + inum, + idt, + // Invoice value: the sale's own total, not a sum of lines - + // charges, round-off and bill-level discounts belong in it. + val: round(Number(row.invoice_value) || 0), + pos: gstStateCode(ctin, row.customer_state), + rchrg: 'N', + inv_typ: 'R', + itms: [], + }); + } + + const invoice = invoices.get(inum); + const igst = round(Number(row.igst) || 0); + const cgst = round(Number(row.cgst) || 0); + const sgst = round(Number(row.sgst) || 0); + invoice.itms.push({ + num: invoice.itms.length + 1, + itm_det: { + rt: round(Number(row._id.rate) || 0), + // taxable value = what the lines came to, less their tax + txval: round((Number(row.items_value) || 0) - (igst + cgst + sgst)), + iamt: igst, + camt: cgst, + samt: sgst, + csamt: 0, + }, + }); + } - return { - ctin: item._id.item_customer_gst_number || '', - inv: [ - { - inum: item._id.item_sales_id || '', - idt: item._id.item_date - ? new Date(item._id.item_date) - .toLocaleDateString('en-GB', { - day: '2-digit', - month: '2-digit', - year: 'numeric', - }) - .replace(/\//g, '-') - : '', - val: Math.round(item._id.total_amount * 100) / 100, - pos: '27', - rchrg: 'N', - inv_typ: 'R', - itms: [ - { - num: 151, - itm_det: { - rt: item.tax_value || 0, - txval: Math.round((item._id.total_amount - multipleValue) * 100) / 100, - iamt: Math.round(item.item_igst_tax * 100) / 100, - csamt: Math.round(item.csgst_multiply * 100) / 100, - }, - }, - ], - }, - ], - }; - }); + const gstOne = []; + for (const [ctin, invoices] of byCtin) { + gstOne.push({ ctin, inv: Array.from(invoices.values()) }); + } return { status: true, @@ -6457,9 +6723,9 @@ class SalesRepository { } } - async sendDailySalesMail(input, { SaleModel } = {}) { + async sendDailySalesMail(input, { SaleModel, shopTransport } = {}) { const Model = this.getModel(SaleModel); - return Model.sendDailySalesMail(input); + return Model.sendDailySalesMail(input, shopTransport); } async salesPaymentCloseModel(data, { SaleModel } = {}) { @@ -6549,6 +6815,21 @@ class SalesRepository { wallet_amount: (saleDetails.wallet_amount || 0) + parseFloat(saleData.amount), }, }); + + /* A settled sale that came from an invoice tells the invoice it is + paid (INVOICING_MODULE_DESIGN) - fire-safe, after the sale's own + writes have landed. */ + if (saleDetails.source_invoice_id) { + await require('../services/invoice-sync').afterSaleSettled(saleDetails._id); + } + } + + /* A settlement with no customer to recompute (a walk-in sale marked + paid from its invoice) stops here: the sales are settled, and there + is no ledger to total. Before this guard, ObjectId(undefined) threw + AFTER the sales were already marked paid. */ + if (!data.id || !ObjectId.isValid(String(data.id))) { + return { status: true, data: 0, message: 'Sales settled successfully' }; } // Recalculate customer balance @@ -6932,7 +7213,7 @@ class SalesRepository { // Generate token ID const tokenId = String(clientTokenId || String(Math.floor(Math.random() * 900) + 100)); - // Map items — use raw shape (no Mongoose ObjectId for item ref to avoid validation errors) + // Map items - use raw shape (no Mongoose ObjectId for item ref to avoid validation errors) const itemCollection = db.collection('items'); const saleItems = []; for (const item of items) { @@ -7097,9 +7378,50 @@ class SalesRepository { } } + /* + * The id of the newest sale on this branch. + * + * The multi-till poller asks for this while the sales list is open and + * refreshes the table when the id changes, so a sale rung up on another till + * appears without anyone pressing refresh. + * + * It used to call Model.getNewSaleModel(), which no model has ever defined. + * The route in front of it answered 403 to everyone - it sat in the no-auth + * block while demanding a permission - so the call never ran and the + * TypeError behind it stayed hidden. Fixing the route uncovered this one. + * + * Deliberately the cheapest query that answers the question: one document, + * one field, newest first. It runs on a timer, so anything more would be + * paid over and over for a value that is usually unchanged. + */ async getNewSaleModel({ SaleModel } = {}) { - const Model = this.getModel(SaleModel); - return Model.getNewSaleModel(); + try { + const { ObjectId } = require('mongodb'); + const Model = this.getModel(SaleModel); + + const branchId = BaseModel.currentBranch; + const query = {}; + if (branchId) { + query.branch_id = ObjectId.isValid(branchId) ? new ObjectId(branchId) : branchId; + } + if (BaseModel.license) query.license = BaseModel.license; + + const latest = await Model.findOne(query) + .sort({ created_date: -1 }) + .select({ _id: 1 }) + .lean(); + + return { + status: true, + // null on a branch with no sales yet: the poller stores it and waits, + // which is exactly right for a till that has not sold anything today + data: { sales_document_id: latest ? String(latest._id) : null }, + message: 'success', + }; + } catch (error) { + console.error('Error in getNewSaleModel:', error); + return { status: false, data: null, message: error.message }; + } } async getOrderHistoryModel(branchId, limit, page, status, userId, { SaleModel } = {}) { @@ -7316,7 +7638,7 @@ class SalesRepository { }); } if (!itemDoc) { - // Item not in catalog (e.g. KOT order item) — update in-place using existing data + // Item not in catalog (e.g. KOT order item) - update in-place using existing data if (existingIndex[productId] !== undefined) { const i = existingIndex[productId]; updatedItems[i] = { @@ -9108,20 +9430,20 @@ class SalesRepository { * documents without one are ignored. */ async _ensureSalesIdIndex(db) { - if (this.constructor._salesIdIndexEnsured) return; - try { - await db.collection('sales').createIndex( - { license: 1, sales_id: 1 }, - { - unique: true, - partialFilterExpression: { sales_id: { $type: 'string' } }, - name: 'unique_sales_id_per_license', - } - ); - this.constructor._salesIdIndexEnsured = true; - } catch (e) { - /* legacy duplicates still present - try again on a later sale */ - } + /* Once per DATABASE. The old latch was a static boolean, which on a + process serving many shops meant the FIRST shop to make a sale got this + index and no other shop ever did. For a unique index that guards bill + numbers, that is not a missing optimisation - it is the guarantee + quietly not applying to almost everyone. */ + await ensureIndexOnce( + db.collection('sales'), + { license: 1, sales_id: 1 }, + { + unique: true, + partialFilterExpression: { sales_id: { $type: 'string' } }, + name: 'unique_sales_id_per_license', + } + ); } isDuplicateSalesIdError(err) { diff --git a/api/src/repositories/setting.repository.js b/api/src/repositories/setting.repository.js index 81fdbfbd4..b20091cd7 100644 --- a/api/src/repositories/setting.repository.js +++ b/api/src/repositories/setting.repository.js @@ -213,6 +213,10 @@ class SettingsRepository { return await this.settingModel.editGeneralSetting(data); } + async updateStarterLocale(data) { + return await this.settingModel.updateStarterLocale(data); + } + /** * Update common settings */ diff --git a/api/src/repositories/settings.repository.js b/api/src/repositories/settings.repository.js new file mode 100644 index 000000000..89f55d8ce --- /dev/null +++ b/api/src/repositories/settings.repository.js @@ -0,0 +1,412 @@ +'use strict'; + +/* + * Settings read path (SETTINGS_AND_BRANCH_SCOPE_DESIGN, step S1). + * + * Reads the four new per-group collections and falls back to the legacy + * `branches` document for anything not stored there yet. NOTHING writes + * through here: while the migration runs, the branches document stays the + * source of truth and these collections are additive, so rolling back is + * deleting rows rather than restoring data. + * + * Resolution order for every key, most specific first: + * + * branch row -> account row -> legacy branches doc -> absent + * + * The account row is the level the design calls for and every comparable + * product has: change a policy once and it lands everywhere that has not + * deliberately diverged. That is why `null` in a branch row means INHERIT + * and is not the same as `false` - a distinction a flat copy cannot make, + * and the reason copying settings between branches drifts while inheriting + * them does not. + */ + +const BaseModel = require('../models/base.model'); +const { ObjectId } = require('mongodb'); +const { + GROUPS, + coerceFeatureToggle, + featureToggleRepairs, +} = require('../services/settings-groups'); + +/* group -> collection. Named per group so an ACL can be put on secrets + alone without teaching it about individual keys. */ +const COLLECTION_OF = Object.freeze({ + features: 'branch_features', + preferences: 'branch_preferences', + documents: 'branch_documents', + secrets: 'branch_secrets', + sharing: 'branch_sharing', + tax: 'branch_tax', +}); + +class SettingsRepository extends BaseModel { + constructor() { + super('branches'); + } + + _ids(context) { + const branchId = context && context.branchId; + const licenseId = context && context.licenseId; + if (!branchId || !ObjectId.isValid(String(branchId))) return null; + if (!licenseId || !ObjectId.isValid(String(licenseId))) return null; + return { + branch: new ObjectId(String(branchId)), + license: new ObjectId(String(licenseId)), + }; + } + + /* + * One group, resolved. `values` carries only keys that group owns, so a + * caller handed `secrets` cannot accidentally read a printing preference + * and vice versa. + */ + async resolveGroup(group, context = {}) { + const collectionName = COLLECTION_OF[group]; + if (!collectionName) { + return { status: false, data: null, message: 'Unknown settings group' }; + } + const ids = this._ids(context); + if (!ids) return { status: false, data: null, message: 'Branch context is required' }; + + try { + const collection = await this.getCollection(collectionName); + const [accountRow, branchRow] = await Promise.all([ + collection.findOne({ license: ids.license, branch_id: null }), + collection.findOne({ license: ids.license, branch_id: ids.branch }), + ]); + + const legacy = await this._legacyBranchDoc(ids); + const keys = GROUPS[group] || []; + const values = {}; + const source = {}; + /* S5. What this branch WOULD show if its own override were removed. + Without it a screen can say "overridden here" but cannot say what + "reset to inherited" would actually do - so the one control the whole + inheritance model exists for would be a leap in the dark. */ + const inherited = {}; + + const has = (row, key) => row && row[key] !== undefined && row[key] !== null; + + for (const key of keys) { + // the value in force below this branch, whatever the branch itself says + if (has(accountRow, key)) inherited[key] = accountRow[key]; + else if (legacy && legacy[key] !== undefined) inherited[key] = legacy[key]; + + // null in a branch row means INHERIT, so it must not shadow the + // account value the way false would + if (has(branchRow, key)) { + values[key] = branchRow[key]; + source[key] = 'branch'; + continue; + } + if (has(accountRow, key)) { + values[key] = accountRow[key]; + source[key] = 'account'; + continue; + } + if (legacy && legacy[key] !== undefined) { + values[key] = legacy[key]; + source[key] = 'legacy'; + } + } + + /* Rows written before the save path coerced still hold string + booleans; the resolver answers with the boolean they meant, so a + poisoned row cannot show a switched-off shop as all-on. */ + if (group === 'features') { + for (const k of Object.keys(values)) values[k] = coerceFeatureToggle(values[k]); + for (const k of Object.keys(inherited)) inherited[k] = coerceFeatureToggle(inherited[k]); + } + + return { status: true, data: { group, values, source, inherited }, message: 'success' }; + } catch (error) { + console.error('Error in SettingsRepository.resolveGroup:', error); + return { status: false, data: null, message: error.message }; + } + } + + async _legacyBranchDoc(ids) { + const branches = await this.getCollection('branches'); + return branches.findOne({ _id: ids.branch, license: ids.license }); + } + + /* + * Write one group (S2 - dual write). + * + * Only the keys ACTUALLY SENT are written, and only those belonging to this + * group. That is the whole point of the split: the old path built one $set + * from the entire settings form, so a four-key payload wrote undefined over + * every control the caller never showed. Here a key that was not sent + * cannot appear in the update at all, so that bug is not merely fixed - it + * is unsayable. + * + * Dual write: the same keys also go to the legacy branches document, which + * stays the source of truth until the migration finishes. Both stores are + * true at once, so rolling back means deleting the new rows and nothing is + * lost. `level: 'account'` writes the inherited row (branch_id null). + */ + /* + * S5. The ACCOUNT row on its own, unresolved. + * + * resolveGroup answers "what is in force at this branch". Editing the + * account level needs the opposite: what this level itself says, with + * nothing merged in - otherwise the form would show a branch's override, + * and saving it would silently push that one branch's choice onto every + * other shop. `set` names the keys the account actually decides, so the + * screen can tell "all shops say false" from "no shop-wide rule". + */ + async accountGroup(group, context = {}) { + const collectionName = COLLECTION_OF[group]; + if (!collectionName) { + return { status: false, data: null, message: 'Unknown settings group' }; + } + const ids = this._ids(context); + if (!ids) return { status: false, data: null, message: 'Branch context is required' }; + + try { + const collection = await this.getCollection(collectionName); + const accountRow = await collection.findOne({ license: ids.license, branch_id: null }); + const values = {}; + const set = []; + for (const key of GROUPS[group] || []) { + if (accountRow && accountRow[key] !== undefined && accountRow[key] !== null) { + values[key] = accountRow[key]; + set.push(key); + } + } + return { status: true, data: { group, level: 'account', values, set }, message: 'success' }; + } catch (error) { + console.error('Error in SettingsRepository.accountGroup:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* + * S6 (D4). Make one branch behave like another. + * + * WHAT GETS COPIED is the whole design question. Copying the resolved value + * of every key would bake the source's entire configuration into the target + * as explicit overrides - and the target would then never follow an + * account-level change again. Copying only the target-collection row would + * copy almost nothing today, because most shops still hold their values in + * the legacy branches document. + * + * So: copy the keys the source branch DECIDES - source 'branch' or 'legacy' + * - and skip the ones it merely INHERITS. The target ends up behaving like + * the source, while both keep inheriting the shop-wide rules together. That + * is the difference the design draws between copying, which drifts, and + * inheritance, which stays true. + * + * Secrets are never copied. Credentials belong to the shop that owns them, + * and a copy would silently duplicate a password into a branch nobody + * intended to give it to. + */ + async copyGroups(groups, fromBranchId, toBranchId, context = {}) { + const wanted = Array.isArray(groups) ? groups : []; + if (!wanted.length) { + return { status: false, data: null, message: 'Pick at least one group to copy' }; + } + if (wanted.includes('secrets')) { + return { + status: false, + data: { refused: ['secrets'] }, + message: 'Credentials are never copied between branches', + }; + } + const unknown = wanted.filter((g) => !COLLECTION_OF[g]); + if (unknown.length) { + return { + status: false, + data: { unknown }, + message: 'Unknown settings group: ' + unknown.join(', '), + }; + } + if (!fromBranchId || !toBranchId || String(fromBranchId) === String(toBranchId)) { + return { status: false, data: null, message: 'Pick two different branches' }; + } + + const licenseId = context.licenseId; + const copied = {}; + try { + for (const group of wanted) { + const read = await this.resolveGroup(group, { branchId: fromBranchId, licenseId }); + if (!read.status) return read; + + const own = {}; + for (const [key, where] of Object.entries(read.data.source || {})) { + // 'account' means the source inherits it too - leave the target to + // inherit it as well rather than freezing today's answer into it + if (where === 'branch' || where === 'legacy') own[key] = read.data.values[key]; + } + + if (!Object.keys(own).length) { + copied[group] = []; + continue; + } + const write = await this.saveGroup(group, own, { branchId: toBranchId, licenseId }); + if (!write.status) return write; + copied[group] = write.data.written; + } + return { + status: true, + data: { from: String(fromBranchId), to: String(toBranchId), copied }, + message: 'success', + }; + } catch (error) { + console.error('Error in SettingsRepository.copyGroups:', error); + return { status: false, data: null, message: error.message }; + } + } + + async saveGroup(group, values = {}, context = {}, options = {}) { + const collectionName = COLLECTION_OF[group]; + if (!collectionName) { + return { status: false, data: null, message: 'Unknown settings group' }; + } + const ids = this._ids(context); + if (!ids) return { status: false, data: null, message: 'Branch context is required' }; + + const owned = new Set(GROUPS[group] || []); + /* + * The public demo's analytics id is not the visitor's to change. + * + * Anyone can sign in to the demo as admin - the logins are printed on the + * login page - and settings are deliberately left explorable, because + * poking at them IS the product tour. The measurement id is the one + * exception: it points at the owner's own Google property, and a visitor + * repointing it would send the demo's traffic to a stranger, silently and + * until somebody noticed. Refused server-side; the rest of the group still + * saves, so the tour is unaffected. + */ + const DEMO_LOCKED = new Set(['analytics_enable', 'analytics_ga_id']); + const demoLocked = require('../config/demo-mode').isDemoMode(); + + const accepted = {}; + const rejected = []; + for (const [key, value] of Object.entries(values || {})) { + if (demoLocked && DEMO_LOCKED.has(key)) { + rejected.push(key); + continue; + } + if (owned.has(key)) { + /* The welcome (and any checkbox map) sends 'true'/'false' strings. + Stored verbatim they read as ENABLED through every `!== false` + gate - the all-toggles-on incident. The boolean is stored, so no + reader ever meets the string. null still means inherit. */ + if (key === 'analytics_enable') { + /* same string-boolean trap as the feature toggles */ + accepted[key] = coerceFeatureToggle(value); + } else if (key === 'analytics_ga_id') { + const id = String(value == null ? '' : value) + .trim() + .toUpperCase(); + if (id !== '' && !require('../services/analytics-config').isPlausibleGaId(id)) { + return { + status: false, + data: null, + message: 'The Google Analytics id should look like G-XXXXXXXXXX', + }; + } + accepted[key] = id; + } else { + accepted[key] = group === 'features' ? coerceFeatureToggle(value) : value; + } + } else { + rejected.push(key); + } + } + if (rejected.length) { + // refused, not ignored - a setting that vanishes without a word is the + // failure mode this whole design exists to end + return { + status: false, + data: { rejected }, + message: 'These keys do not belong to ' + group + ': ' + rejected.join(', '), + }; + } + /* S5. `null` means INHERIT - "stop deciding this here and take whatever + the level above says". It is a different instruction from writing a + value, so it is separated out before anything touches the database. + The key is UNSET rather than stored as null: undefined and null already + resolve identically, and an absent key cannot later be mistaken for a + deliberate blank. */ + const toSet = {}; + const toClear = []; + for (const [key, value] of Object.entries(accepted)) { + if (value === null) toClear.push(key); + else toSet[key] = value; + } + + if (!Object.keys(toSet).length && !toClear.length) { + return { status: true, data: { written: [], cleared: [] }, message: 'Nothing to write' }; + } + + try { + const isAccount = options.level === 'account'; + const collection = await this.getCollection(collectionName); + const update = { + $set: { license: ids.license, branch_id: isAccount ? null : ids.branch }, + }; + if (Object.keys(toSet).length) Object.assign(update.$set, toSet); + if (toClear.length) { + update.$unset = toClear.reduce((acc, k) => ({ ...acc, [k]: '' }), {}); + } + await collection.updateOne( + { license: ids.license, branch_id: isAccount ? null : ids.branch }, + update, + { upsert: true } + ); + + /* Legacy mirror. An account-level write has no single branch to mirror + to, so it deliberately does not touch the old document - the resolver + already falls back to it, and account values are new behaviour that + no legacy reader knows about. + ONLY the set keys are mirrored. Mirroring a cleared one would write + null over the legacy value, destroying the very thing the branch is + being told to fall back ON - "reset to inherited" would delete what it + meant to inherit. */ + if (!isAccount && Object.keys(toSet).length) { + const branches = await this.getCollection('branches'); + await branches.updateOne({ _id: ids.branch, license: ids.license }, { $set: toSet }); + } + + /* the CSP + runtime-info read analytics through a 30s cache - a + toggle must bite on the very next request */ + if (group === 'preferences') { + try { + require('../services/analytics-config').invalidate(); + } catch (e) { + /* the cache TTL still catches up */ + } + } + + return { + status: true, + data: { + written: Object.keys(toSet), + cleared: toClear, + level: isAccount ? 'account' : 'branch', + }, + message: 'success', + }; + } catch (error) { + console.error('Error in SettingsRepository.saveGroup:', error); + return { status: false, data: null, message: error.message }; + } + } + + /* Every group at once, for the screens that still show all of it. */ + async resolveAll(context = {}) { + const out = {}; + for (const group of Object.keys(COLLECTION_OF)) { + const r = await this.resolveGroup(group, context); + if (!r.status) return r; + out[group] = r.data.values; + } + return { status: true, data: out, message: 'success' }; + } +} + +module.exports = SettingsRepository; +module.exports.COLLECTION_OF = COLLECTION_OF; diff --git a/api/src/repositories/supplier.repository.js b/api/src/repositories/supplier.repository.js index 594dc32d7..e40233906 100644 --- a/api/src/repositories/supplier.repository.js +++ b/api/src/repositories/supplier.repository.js @@ -1,6 +1,8 @@ // src/repositories/supplier.repository.js const BaseModel = require('../models/base.model'); const { ObjectId } = require('mongodb'); +const { withBranchScope } = require('../services/branch-scope'); +const dataSharing = require('../services/data-sharing'); /** * Supplier Repository @@ -50,12 +52,19 @@ class SupplierRepository extends BaseModel { */ async findById(id) { const collection = await this.getCollection(this.collectionName); - return await collection.findOne({ - _id: new ObjectId(id), - license: BaseModel.license, - ...(BaseModel.currentBranch ? { branch_id: BaseModel.currentBranch } : {}), - is_deleted: { $ne: true }, - }); + return await collection.findOne( + withBranchScope( + { + _id: new ObjectId(id), + license: BaseModel.license, + is_deleted: { $ne: true }, + }, + await dataSharing.scopeBranch('suppliers', BaseModel.currentBranch, { + licenseId: BaseModel.license, + branchId: BaseModel.currentBranch, + }) + ) + ); } /** @@ -102,7 +111,7 @@ class SupplierRepository extends BaseModel { async search(searchTerm, options = {}) { const { page = 1, limit = 10, branchId = null } = options; - const query = { + let query = { license: BaseModel.license, is_deleted: { $ne: true }, $or: [ @@ -113,8 +122,17 @@ class SupplierRepository extends BaseModel { ], }; + /* Under $and, not a second top-level $or - this query already owns one + for name/company/email/phone, and replacing it would turn a search into + a full-table read. */ if (branchId) { - query.branch_id = new ObjectId(branchId); + query = withBranchScope( + query, + await dataSharing.scopeBranch('suppliers', branchId, { + licenseId: BaseModel.license, + branchId, + }) + ); } const collection = await this.getCollection(this.collectionName); @@ -148,6 +166,17 @@ class SupplierRepository extends BaseModel { is_deleted: false, }; + /* S7 (D5), as for customers: record the branch that owns this supplier in + the account-level relation, alongside the legacy branch_id. Access lists + only that branch, so nothing becomes visible anywhere new - purchase + reporting across branches becomes POSSIBLE, it does not just happen. */ + if (!Array.isArray(document.branch_access)) { + const owning = document.branch_id || BaseModel.currentBranch || null; + document.branch_access = owning + ? [{ branch_id: owning, branch_name: document.branch_name || '' }] + : []; + } + const result = await collection.insertOne(document); return await this.findById(result.insertedId); } diff --git a/api/src/routes/client-errors.routes.js b/api/src/routes/client-errors.routes.js new file mode 100644 index 000000000..da46b4896 --- /dev/null +++ b/api/src/routes/client-errors.routes.js @@ -0,0 +1,144 @@ +'use strict'; + +/* + * Where a till's dying words land. + * + * Owner, after clearing his own browser data to recover a white page: + * "i dont [want] users to face these kind of errors." + * + * The white-page bug this follows lived for months because it was CLIENT + * side: the server answered 200 to everything, every log stayed clean, and + * the only witness was a browser console nobody was looking at. Diagnosing + * it took minting a shadow session and booting it in headless Chrome. This + * endpoint is the cheap version of that pipeline, always on: the boot + * watchdog posts the first uncaught error here, and it lands in the shop's + * own pm2 log - `grep client-error` - beside the request lines it belongs + * with. + * + * DELIBERATELY UNAUTHENTICATED. The errors worth hearing about most are the + * ones that happen BEFORE auth works - a boot that dies has no token to + * present. Unauthenticated write surface is held small three ways: + * + * - it stores nothing: one console line, no database, nothing to fill + * - per-IP budget: after a handful an hour, requests are counted and + * dropped without logging, so a hostile loop cannot flood the log + * - every field is truncated before it is printed + * + * It always answers 204, error or not: a crash reporter that can itself + * produce visible failures adds noise to the exact moment that has too + * much of it. + */ +const express = require('express'); + +const router = express.Router(); + +const WINDOW_MS = 60 * 60 * 1000; +const PER_IP_PER_WINDOW = 6; +const seen = new Map(); + +/* The map cannot grow unbounded on a public endpoint: sweep entries whose + window has lapsed whenever it gets large. */ +function sweep(now) { + if (seen.size < 1000) return; + for (const [ip, rec] of seen) { + if (now - rec.start > WINDOW_MS) seen.delete(ip); + } +} + +/* + * TEMPORARY diagnostic window (owner: "add some temporary system and find + * out... i want know very exact reason"): the last few reported lines, + * readable over HTTP, because the shop under investigation runs where no + * audited log-read path exists. Deliberately tiny and already-truncated - + * the ring holds exactly the console lines above, nothing more - and the + * boot-flight death records are the reason it exists. Remove with the + * flight recorder once the mobile crash is closed (OWNER_QUEUE row 193). + */ +const RING_MAX = 30; +const ring = []; + +/* + * The ring must outlive the process. Three api deploys in one afternoon + * each wiped it, and the one thing it exists to carry - a phone's death + * record, filed on the NEXT open, often hours later - was gone before + * anyone read it. A bounded file in tmpdir (per port: several tenant + * processes share a box) carries the same truncated lines across + * restarts. Still nothing like storage: same cap, same truncation, and + * every touch is allowed to fail without taking the reporter with it. + */ +const fs = require('fs'); +const path = require('path'); +const os = require('os'); +const RING_FILE = path.join( + os.tmpdir(), + 'posnic-client-errors-' + String(process.env.PORT || 'default') + '.log' +); +try { + const kept = fs.readFileSync(RING_FILE, 'utf8').split('\n').filter(Boolean).slice(-RING_MAX); + ring.push(...kept); +} catch (e) { + /* first boot, or tmp cleaned - the ring just starts empty */ +} + +function remember(line) { + ring.push(new Date().toISOString() + ' ' + line); + if (ring.length > RING_MAX) ring.shift(); + try { + fs.writeFileSync(RING_FILE, ring.join('\n') + '\n'); + } catch (e) { + /* a full disk must not break the reporter */ + } +} + +router.get('/recent', (req, res) => { + res.type('text/plain').send(ring.length ? ring.join('\n') : '(nothing reported yet)'); +}); + +router.post('/', (req, res) => { + try { + const now = Date.now(); + sweep(now); + const ip = String(req.ip || 'unknown'); + const rec = seen.get(ip) || { start: now, count: 0 }; + if (now - rec.start > WINDOW_MS) { + rec.start = now; + rec.count = 0; + } + rec.count += 1; + seen.set(ip, rec); + + const b = req.body && typeof req.body === 'object' ? req.body : {}; + /* Flight-recorder death records outrank the budget: they are the single + highest-value line this endpoint carries, at most one per page open, + and the budget exists to stop floods of everything else. */ + const isFlight = String(b.at || '') === 'boot-flight'; + if (isFlight || rec.count <= PER_IP_PER_WINDOW) { + const line = [ + '[client-error]', + String(req.headers.host || '').slice(0, 80), + /* flight records carry the device's last movements - they get the + room they need; everything else stays tight */ + String(b.message || '(no message)').slice(0, isFlight ? 900 : 300), + '@', + String(b.at || '').slice(0, 200), + ].join(' '); + console.error(line); + remember(line); + const stack = String(b.stack || '').slice(0, 1000); + if (stack) console.error('[client-error] stack:', stack.split('\n').slice(0, 4).join(' | ')); + /* The watchdog's whole journal, one line per entry - the card's View + details, readable remotely. The first beacon field is only the FIRST + capture, and the first capture is routinely noise. */ + if (Array.isArray(b.journal)) { + for (const entry of b.journal.slice(0, 3)) { + console.error('[client-error] journal:', String(entry).slice(0, 220)); + } + } + } + } catch (e) { + /* the reporter must never be the thing that fails */ + } + return res.status(204).end(); +}); + +module.exports = router; diff --git a/api/src/routes/index.js b/api/src/routes/index.js index f865fe5c5..5a483b5cf 100644 --- a/api/src/routes/index.js +++ b/api/src/routes/index.js @@ -22,10 +22,12 @@ const dashboardRoutes = require('./dashboard.routes'); const easyTableRoutes = require('./easy-tables.routes'); const expensesRoutes = require('./expenses.routes'); const installRoutes = require('./install.routes'); +const invoicesRoutes = require('./invoices.routes'); const itemsRoutes = require('./items.routes'); const loyaltyRoutes = require('./loyalty.routes'); const messagingRoutes = require('./messaging.routes'); const purchaseOrdersRoutes = require('./purchase-orders.routes'); +const quotesRoutes = require('./quotes.routes'); const receivingsRoutes = require('./receivings.routes'); const registersRoutes = require('./registers.routes'); const rolesRoutes = require('./roles.routes'); @@ -33,6 +35,8 @@ const authorizationsRoutes = require('./authorizations.routes'); const shiftsRoutes = require('./shifts.routes'); const salesRoutes = require('./sales.routes'); const settingsRoutes = require('./settings.routes'); // Note: File not renamed, but route will be /settings +const settingsGroupsRoutes = require('./settings-groups.routes'); +const clientErrorsRoutes = require('./client-errors.routes'); const stockLogsRoutes = require('./stock-logs.routes'); const suppliersRoutes = require('./suppliers.routes'); const usersRoutes = require('./users.routes'); // Updated from userRoutes @@ -81,16 +85,22 @@ router.use('/dashboard', dashboardRoutes); // Removed /api prefix for consistenc router.use('/easy-table', easyTableRoutes); router.use('/expenses', expensesRoutes); router.use('/install', installRoutes); +router.use('/invoices', invoicesRoutes); router.use('/items', itemsRoutes); router.use('/loyalty', loyaltyRoutes); router.use('/messaging', messagingRoutes); router.use('/purchaseOrders', purchaseOrdersRoutes); +router.use('/quotes', quotesRoutes); router.use('/receivings', receivingsRoutes); router.use('/registers', registersRoutes); router.use('/roles', rolesRoutes); router.use('/authorizations', authorizationsRoutes); router.use('/shifts', shiftsRoutes); router.use('/sales', salesRoutes); +// Unauthenticated by design - the errors worth hearing about happen before +// auth works. See the route file for how the surface is held small. +router.use('/client-errors', clientErrorsRoutes); +router.use('/settings/group', settingsGroupsRoutes); router.use('/settings', settingsRoutes); // Primary path router.use('/setting', settingsRoutes); // Legacy PHP path support router.use('/stock-logs', stockLogsRoutes); // Changed from stocklogs to stock-logs diff --git a/api/src/routes/invoices.routes.js b/api/src/routes/invoices.routes.js new file mode 100644 index 000000000..709b78fbd --- /dev/null +++ b/api/src/routes/invoices.routes.js @@ -0,0 +1,25 @@ +'use strict'; + +const express = require('express'); +const router = express.Router(); +const controller = require('../controllers/invoices.controller'); +const { protect } = require('../middleware/auth'); +const { invoiceLimiter } = require('../middleware/auth-rate-limit'); + +router.use(protect, invoiceLimiter); + +// Invoices (INVOICING_MODULE_DESIGN) - a draft is a proforma; issuing books +// the sale on the server; payments pay that sale down. The SALE holds the money. +router.post('/', controller.create); +router.get('/', controller.list); +router.get('/summary', controller.summary); +router.post('/from-quote/:quoteId', controller.fromQuote); +router.get('/:id', controller.getById); +router.put('/:id', controller.update); +router.post('/:id/issue', controller.issue); +router.post('/:id/transition', controller.transition); +router.post('/:id/payment', controller.payment); +router.post('/:id/share', controller.share); +router.delete('/:id', controller.remove); + +module.exports = router; diff --git a/api/src/routes/items.routes.js b/api/src/routes/items.routes.js index e151d1c27..32bf51d64 100644 --- a/api/src/routes/items.routes.js +++ b/api/src/routes/items.routes.js @@ -75,6 +75,28 @@ router.post('/itemsImport', bindController(itemsController.itemsImport)); // PHP: exportItems() - Excel export router.post('/exportItems', bindController(itemsController.exportItems)); +// GET /api/items/export/jsonld - the catalogue as schema.org JSON-LD. +// A different SHAPE of what /items already returns, gated on the same +// item:read. See docs PRODUCT_EXPORT_FORMATS.md. +router.get('/export/jsonld', bindController(itemsController.exportCatalogueJsonLd)); + +// DELETE /api/items/demo - remove the sample products for good. +// Separate from the Demo Data switch, which only hides them: this one +// destroys, and refuses anything sold, received or edited. +router.delete('/demo', bindController(itemsController.purgeDemoData)); + +// POST /api/items/demo - put the sample data back, for a shop that removed +// it and later wants it. Refuses if it is already there. An optional +// businessType installs a DIFFERENT trade's catalogue, for the shop that +// signed up as one thing and turned out to be another. +router.post('/demo', bindController(itemsController.reseedDemoData)); + +// GET /api/items/demo/packs - the trades a shop can pick from, and which one +// it is on. Declared BEFORE any '/demo/:something' route would be: Express +// matches in order, and a parameterised sibling added later would otherwise +// swallow this path and answer it with the wrong handler. +router.get('/demo/packs', bindController(itemsController.listDemoPacks)); + // Raise/lower prices across many items at once; and a per-item price history. // V1 variant families: all-or-nothing creation of linked variant items, // and the members of one family for the edit page's strip. @@ -128,6 +150,13 @@ router.get('/itemSearchTable', bindController(itemsController.itemSearchTable)); // PHP: updateItemQuantity() - Update item quantity router.post('/updateItemQuantity', bindController(itemsController.updateItemQuantity)); +// Sale-screen inline edit: targeted money-field patch (write ACL) +router.post('/quickPatch', bindController(itemsController.quickPatch)); + +// GST 2.0 readiness checklist - read-only, report ACL. Declared before the +// /:id route so 'gstReadiness' is not read as an item id. +router.get('/gstReadiness', bindController(itemsController.gstReadiness)); + // PHP: categoryProductDetails() - Category product details router.get('/categoryProductDetails', bindController(itemsController.categoryProductDetails)); diff --git a/api/src/routes/quotes.routes.js b/api/src/routes/quotes.routes.js new file mode 100644 index 000000000..15ad74925 --- /dev/null +++ b/api/src/routes/quotes.routes.js @@ -0,0 +1,19 @@ +'use strict'; + +const express = require('express'); +const router = express.Router(); +const controller = require('../controllers/quotes.controller'); +const { protect } = require('../middleware/auth'); + +router.use(protect); + +// Quotes (LS2) - a priced offer, never stock, never payment. +router.post('/', controller.create); +router.get('/', controller.list); +router.get('/:id', controller.getById); +router.put('/:id', controller.update); +router.post('/:id/transition', controller.transition); +router.post('/:id/share', controller.share); +router.delete('/:id', controller.remove); + +module.exports = router; diff --git a/api/src/routes/receivings.routes.js b/api/src/routes/receivings.routes.js index 6e264ee87..79526c832 100644 --- a/api/src/routes/receivings.routes.js +++ b/api/src/routes/receivings.routes.js @@ -86,6 +86,15 @@ router.get('/receivingsPdf', bindController(receivingsController.receivingsPdf)) // Email the same PDF to the supplier (outward-facing: receiving write). router.post('/emailToSupplier', bindController(receivingsController.emailToSupplier)); +// Purchase attachments: the supplier's PO, invoice scans, delivery notes. +const { documentUpload } = require('../middleware/upload'); +router.post( + '/:id/attachments', + documentUpload.single('file'), + bindController(receivingsController.addAttachment) +); +router.delete('/:id/attachments/:attId', bindController(receivingsController.removeAttachment)); + // PHP: exportReceivings() - Excel export router.post('/exportReceivings', bindController(receivingsController.exportReceivings)); @@ -134,6 +143,10 @@ router.get( ); // Legacy bulk delete endpoint used by frontend: DELETE /receivings/delete +// G8: void keeps the record, reverses stock, withdraws the credit +// Partial receiving: goods arrive in steps; close_short cancels the rest +router.post('/:id/receive', bindController(receivingsController.receive)); +router.post('/:id/void', bindController(receivingsController.void)); router.delete('/delete', bindController(receivingsController.delete)); // GET /api/receivings/:id - Single receiving diff --git a/api/src/routes/sales.routes.js b/api/src/routes/sales.routes.js index 8e02de6aa..cd1628034 100644 --- a/api/src/routes/sales.routes.js +++ b/api/src/routes/sales.routes.js @@ -115,7 +115,21 @@ router.post( // ── Kiosk / mobile-app routes (no JWT auth required, branch_id in body) ── router.post('/qrOrder', bindController(salesController.qrOrder)); -router.get('/getNewSale', bindController(salesController.getNewSale)); +/* + * getNewSale sits in the no-JWT block but its handler requires sales:write. + * With no auth middleware at all, req.user was never populated - so the + * permission check saw undefined and answered 403 to EVERYONE, signed in or + * not. It is the only route in this block that was missing optionalProtect; + * its siblings all carry it. With the session read, a logged-in till passes + * the permission check as intended, and anything genuinely anonymous still + * has to present this installation's kiosk key. + */ +router.get( + '/getNewSale', + optionalProtect, + protectOrKioskKey, + bindController(salesController.getNewSale) +); router.post( '/getOrderHistory', optionalProtect, @@ -393,6 +407,10 @@ router.get( bindController(salesController.gstThreeReportTable) ); +// Tax Payable (PURCHASE_TAX_PLAN P4): the plain-words monthly view + register +router.get('/taxPayable', bindController(salesController.taxPayable)); +router.get('/taxPayableRegister', bindController(salesController.taxPayableRegister)); + // PHP: gstOneReportTableJson() - Get GST-1 report JSON router.get( '/gstOneReportTableJson', @@ -441,7 +459,7 @@ router.get('/kotDiscountReports', bindController(salesController.kotDiscountRepo // PHP: kotTablewiseDetails() - Get KOT table-wise detailed item report router.get('/kotTablewiseDetails', bindController(salesController.kotTablewiseDetails)); -// PHP: getListKot() - (moved before protect for kiosk access — see above) +// PHP: getListKot() - (moved before protect for kiosk access - see above) // PHP: pendingCustomerCategoryReportTable() - Get pending customer category report router.get( @@ -486,9 +504,43 @@ router .post(prepareCreateSalePayload, bindController(salesController.holdSale)) .put(prepareCreateSalePayload, bindController(salesController.holdSale)); -// KOT cancel endpoint - must be before generic /:id routes -// Frontend: PosnicPro.get('sales/cancel/' + saleId) -router.get('/cancel/:id', ensureValidSaleIdParam, bindController(salesController.cancel)); +/* + * Cancelling a sale must not be a GET. + * + * A GET is meant to be safe to repeat and safe for anything to follow. + * Browsers prefetch them, link scanners and antivirus fetch them, and - the + * part that matters - a bare `` on any + * page reached while logged in fires one WITH cookies, because SameSite=Lax + * still sends them on top-level GETs. That is a working CSRF vector against a + * destructive operation. + * + * POST is the real route now. The GET stays only because tills already + * deployed still call it (KOT cancel, two call sites), and it is hardened so + * it cannot be triggered from another site: X-Requested-With is a header no + * , Shop' }), + title: '', + greeting: 'Dear Bob,', + bodyHtml: '

safe

', + }); + expect(evil).not.toContain(' © Posnic Innovations Pvt - Ltd - All Rights Reserved + class="text-secondary mb-0" target="_blank">Posnic Innovations Pvt + Ltd - All Rights Reserved @@ -270,8 +270,8 @@

Posnic

-
@@ -293,15 +293,15 @@

class="current-currency">₹  Just Just ₹ 

In Stock + id="available_stock_display">In Stock + style="display:none;">Sold Out
@@ -313,7 +313,7 @@

-
Product Details
+
Product Details
@@ -341,7 +341,7 @@
Product Details
aria-labelledby="guide-tab-line">
-

click branch details

+

click branch details

@@ -367,7 +367,7 @@
+ class="feather icon-x-circle mr-2"> Close
diff --git a/frontend/customerview.html b/frontend/customerview.html index 4fd71d789..d9bcac21f 100644 --- a/frontend/customerview.html +++ b/frontend/customerview.html @@ -2,7 +2,7 @@ - Posnic - POS + <lang class="lang_posnic_title">Posnic - POS</lang> @@ -33,7 +33,7 @@

    -
  1. Powered by Posnic
    2. +
  2. Powered by Posnic
@@ -55,7 +55,7 @@

-
Branch Details
+
Branch Details
image @@ -93,33 +93,33 @@

-
Customer Details
+
Customer Details
-

Name:  Name:  

-

Email:  Email:  

-

Mobile No:  Mobile No:  

-

Address:  Address:  

-
Payment Details
+
Payment Details
-
Tax :
+
Tax :
0.00
-
Disc :
+
Disc :
0%
@@ -128,7 +128,7 @@
0%
-
Extra Disc :
+
Extra Disc :
@@ -148,11 +148,11 @@
0.00

₹ 0.00

-

Sub Amount

+

Sub Amount

₹ 0.00

-

Total Amount

+

Total Amount

diff --git a/frontend/dashboard.html b/frontend/dashboard.html index 43413b3de..bd99f6c2c 100644 --- a/frontend/dashboard.html +++ b/frontend/dashboard.html @@ -1,5 +1,5 @@ - + + + + + - +
- -

Print - Posnic +

Print + Posnic

@@ -151,11 +838,11 @@

Print
- -

Print - Posnic +

Print + Posnic

@@ -173,8 +860,8 @@

Print
Reset Form
-
@@ -205,7 +892,7 @@
Do you want to reset cart and proceed to
- NoImg + NoImg
@@ -219,12 +906,12 @@
Do you want to reset cart and proceed to
-
Do you want remove this image?
+
Do you want remove this image?
- - + +
@@ -237,12 +924,12 @@
Do you want remove this image?
-
Do you want remove this image?
+
Do you want remove this image?
- - + +
@@ -255,7 +942,19 @@

Do you want remove this image?
+ + + - \ No newline at end of file + diff --git a/frontend/languages/ta.json b/frontend/languages/ta.json deleted file mode 100644 index c8b009107..000000000 --- a/frontend/languages/ta.json +++ /dev/null @@ -1,872 +0,0 @@ -{ - "lang_no_sale": "மொத்த விற்பனை எண்ணிக்கை", - "lang_unit_Pieces": "துண்டுகள் - PCS", - "lang_unit_Kilograms": "கிலோகிராம் - KGS", - "lang_unit_Bags": "பைகள் - BAG", - "lang_unit_Bale": "பேல் - BAL", - "lang_unit_Billion": "பில்லியன் அலகுகள் - BOU", - "lang_unit_Bottles": "பாட்டில்கள் - BTL", - "lang_unit_Box": "பெட்டி - BOX", - "lang_unit_Buckles": "கொக்கிகள் - BKL", - "lang_unit_Bunches": "கொத்துகள் - BKL", - "lang_unit_Bundles": "மூட்டைகள் - BDL", - "lang_unit_Cans": "கேன்கள் - CAN", - "lang_unit_Cartons": "அட்டைப்பெட்டி - CTN", - "lang_unit_Centimeters": "சென்டிமீட்டர்கள் - CM", - "lang_unit_Cubic_Centimeters": "சென்டிமீட்டர்கள் - CCM", - "lang_unit_Cubic_Meters": "மீட்டர்கள் - CBM", - "lang_unit_Dozens": "டஜன் - DOZ", - "lang_unit_Drums": "டிரம்ஸ் - DRM", - "lang_unit_Grams": "கிராம் - GMS", - "lang_unit_Great_Grams": "பெரிய கிராம் - GRS", - "lang_unit_Gross_Yards": "மொத்த யார்டுகள் - GYD", - "lang_unit_Kilo_Litre": "கிலோ லிட்டர் - KLR", - "lang_unit_Kilo_Metre": "கிலோ மீட்டர் - KME", - "lang_unit_Litre": "லிட்டர் - LTR", - "lang_unit_Meter": "மீட்டர் - MTR", - "lang_unit_Metric_Ton": "மெட்ரிக் டன் - MTS", - "lang_unit_Milli_Litre": "மில்லிலிட்டர் - MLT", - "lang_unit_Packs": "பொதிகள் - PAC", - "lang_unit_Pairs": "ஜோடிகள் - PRS", - "lang_unit_Quintal": "குவிண்டால் - PRS", - "lang_unit_Rolls": "ரோல்ஸ் - ROL", - "lang_unit_Sets": "செட் - SET", - "lang_unit_Square_Feet": "சதுர அடி - SQF", - "lang_unit_Square_Yards": "சதுர யார்டுகள் - GYD", - "lang_unit_Tablets": "மாத்திரைகள் - TBS", - "lang_unit_Ten_Gross": "மொத்தம் பத்து - TGM", - "lang_unit_Thousands": "ஆயிரக்கணக்கான - TGM", - "lang_unit_Tonnes": "டன்கள் - TON", - "lang_unit_Tubes": "குழாய்கள் - TUB", - "lang_unit_Units": "யூனிட் - UNT", - "lang_unit_US_Gallons": "அமெரிக்க கேலன்கள் - UGS", - "lang_unit_Yards": "யார்டுகள் - YDS", - "lang_unit_Minutes": "நிமிடங்கள் - MINS", - "lang_unit_Hours": "மணிநேரம் - HRS", - "lang_unit_Days": "நாட்கள் - HRS", - "lang_unit_Weeks": "வாரங்கள் - WKS", - "lang_unit_Months": "மாதங்கள் - MON", - "lang_unit_Years": "ஆண்டுகள் - YRS", - "lang_unit_ManDays": "மன் நாட்கள் - MAN-DAY", - "lang_unit_Nights": "இரவுகள் - NIGHT", - "lang_unit_Peti": "பெட்டி - PET", - "lang_unit_Jars": "கட்டிகள் - JAR", - "lang_unit_Pouch": "பௌச் - POCH", - "lang_unit_Bora": "போரா - BOR", - "lang_unit_Coil": "காயில் - COIL", - "lang_unit_Feet": "அடி - FT", - "lang_unit_Inches": "அங்குலங்கள் - IN", - "lang_unit_Portion": "பகுதி - PRT", - "lang_unit_CASE": "கேஸ் - CASE", - "lang_unit_Capsules": "கேப்ஸூல்கள் - CPS", - "lang_unit_SquareMeters": "சதுர மீட்டர்கள் - SQMT", - "lang_unit_Milligram": "மில்லிகிராம் - MLG", - "lang_unit_Buckets": "குடுக்குகள் - BCK", - "lang_unit_Glasses": "கண்கள் - GLS", - "lang_unit_Plates": "தட்டுகள் - PLT", - "lang_unit_Carats": "கேரட்கள் - CTS", - "lang_unit_Strips": "ஸ்டிரிப்கள் - STRP", - "lang_unit_CubicFeet": "சப் ஃபூட் - CUFT", - "lang_unit_RunningMeter": "ரனிங் மீட்டர் - RMT", - "lang_unit_Trays": "டிரேஸ் - TRY", - "lang_unit_Ampoule": "அம்பூல் - AMP", - "lang_unit_Square": "சதுர - SQIN", - "lang_unit_Sachett": "சாக்கெட் - SAC", - "lang_unit_Ticket": "டிக்கெட் - TKT", - "lang_unit_Kilowatt": "கிலோவாட் - KW", - "lang_unit_Watt": "வாட் - W", - "lang_unit_Packets": "பேக்கட்கள் - PKT", - "lang_unit_Millimeter": "மில்லிமீட்டர் - MM", - "lang_unit_SquareCentimeters": "சதுர சென்டிமீட்டர்கள் - SQCM", - "lang_unit_Length": "நீளம் - LENG", - "lang_unit_Quantity": "அளவு - QTY", - "lang_unit_Others": "பிற - OTH", - "lang_nav_add": "புதியதைச் சேர்க்க", - "lang_login_title": "உள் நுழை", - "lang_totalsale_title": "மொத்த விற்பனை", - "lang_password_title": "கடவுச்சொல்", - "lang_avgsale_title": "சராசரி விற்பனை", - "lang_username_title": "பயனர்பெயர் / மின்னஞ்சல்", - "lang_forgot_title": "கடவுச்சொல்லை மறந்துவிட்டீர்களா ?", - "lang_posnic_title": "வாடிக்கையாளர் தேடல்", - "lang_itemdetail_title": "பொருள் பட்டியல்", - "lang_discount_title": "தள்ளுபடி", - "lang_tax_title": "வரி", - "lang_noofsale_title": "விற்பனை எண்ணிக்கை", - "lang_mrp_title": "எம்ஆர்பி", - "lang_sellprice_title": "விற்பனை விலை", - "lang_availablequatity_title": "இருக்கும் அளவு", - "lang_dashboard_title": "டாஷ்போர்டு", - "lang_home_title": "முகப்பு பக்கம்", - "lang_newsale_title": "புதிய விற்பனை", - "lang_newpurchase_title": "புதிய கொள்முதல்", - "lang_newitem_title": "புதிய பொருள்", - "lang_newcategory_title": "புதிய வகை", - "lang_newvariant_title": "புதிய மாறுபாடு", - "lang_newsupplier_title": "புதிய சப்ளையர்", - "lang_newcustomer_title": "புதிய வாடிக்கையாளர்", - "lang_newbranch_title": "புதிய கிளை", - "lang_newuser_title": "புதிய பயனர்", - "lang_newexpense_title": "புதிய செலவு", - "lang_shortcut_title": "குறுக்குவழி விசைகள்", - "lang_salecut_title": "விற்பனை", - "lang_itemcut_title": "பொருட்கள்", - "lang_userscut_title": "பயனர்கள்", - "lang_receivecut_title": "பெறுதல்கள்", - "lang_suppliercut_title": "சப்ளையர்கள்", - "lang_expensecut_title": "செலவுகள்", - "lang_customercut_title": "வாடிக்கையாளர்கள்", - "lang_othercut_title": "மற்றவைகள்", - "lang_sales_title": "விற்பனைகள் ", - "lang_open_price": "விற்பனையின்போது விலை", - "lang_price_stock_title": "விலை & இருப்பு", - "lang_identification_title": "SKU & பார்கோடுகள்", - "lang_item_details_title": "விவரங்கள்", - "lang_item_details_hint": "விளக்கம், படங்கள், தேதிகள்", - "lang_item_extras_title": "சேனல்கள் & கூடுதல்", - "lang_item_extras_hint": "இருப்பு கண்காணிப்பு, கியோஸ்க், சப்ளையர்", - "lang_feature_intro_title": "அம்ச அமைப்புகள்", - "lang_feature_intro_sub": "பயன்படுத்த விரும்பும் அம்சங்களைத் தேர்ந்தெடுக்கவும். நிர்வகி > அம்சங்கள் பக்கத்தில் எப்போது வேண்டுமானாலும் மாற்றலாம்.", - "lang_feature_intro_skip": "இப்போது வேண்டாம்", - "lang_item_import_hint": "நிறைய பொருட்கள் சேர்க்கிறீர்களா?", - "lang_autofill_hint": "சப்ளையரிடமிருந்து நிரப்பு:", - "lang_autofill_all": "எல்லா பொருட்களும்", - "lang_autofill_low": "குறைந்த இருப்பு பொருட்கள்", - "lang_po_title": "கொள்முதல் ஆர்டர்கள்", - "lang_po_one": "கொள்முதல் ஆர்டர்", - "lang_po_add": "கொள்முதல் ஆர்டர் சேர்", - "lang_po_num": "PO", - "lang_po_received": "பெறப்பட்டது", - "lang_po_expected": "எதிர்பார்க்கப்படும்", - "lang_po_ordered": "ஆர்டர் செய்தது", - "lang_po_incoming": "வரவிருக்கும்", - "lang_po_cost": "கொள்முதல் விலை", - "lang_po_addcosts": "கூடுதல் செலவுகள்", - "lang_po_addcosts_hint": "சரக்கு, ஏற்றுதல்… மொத்தத்தில் சேரும், பொருள் விலையில் அல்ல", - "lang_po_savedraft": "வரைவாக சேமி", - "lang_po_create": "உருவாக்கு", - "lang_instock_title": "இருப்பில்", - "lang_stockafter_title": "பிறகு இருப்பு", - "lang_stock_adjust_title": "இருப்பு சரிசெய்தல்", - "lang_stock_adjust_reason": "காரணம்", - "lang_stock_adjust_note": "குறிப்பு (விருப்பம்)", - "lang_stock_adjust_do": "சரிசெய்", - "lang_qty_title": "அளவு", - "lang_notes_title": "குறிப்புகள்", - "lang_display_pair_title": "வாடிக்கையாளர் திரை", - "lang_setup_title": "உங்கள் கடையை அமைத்து முடிப்போம்", - "lang_setup_dismiss": "மறை", - "lang_brand_title": "பிராண்டு", - "lang_tags_title": "குறிச்சொற்கள்", - "lang_quicksale_enable": "விரைவு விற்பனை", - "lang_is_service": "இது ஒரு சேவை (இருப்பு இல்லை)", - "lang_display_pair_hint": "வாடிக்கையாளர் பக்க திரையில் இந்த முகவரியை உலாவியில் திறக்கவும் (இதே நெட்வொர்க்). விற்பனையை நேரலையில் காட்டும்.", - "lang_item_import_link": "கோப்பிலிருந்து இறக்குமதி செய்யவும்", - "lang_inventory_title": "சரக்கு பட்டியல்", - "lang_customer_title": "வாடிக்கையாளர்", - "lang_customer_category_title": "வாடிக்கையாளர் வகை", - "lang_report_title": "அறிக்கைகள்", - "lang_manage_title": "விவரங்கள்", - "lang_welcome_title": "அன்புடன் வரவேற்கிறோம்", - "lang_receiver_title": "வாங்குபவர்", - "lang_thankyou_title": "உங்களின் ஆதரவிற்கு நன்றி !!! ", - "lang_customerdetails_title": "வாடிக்கையாளர் பட்டியல்", - "lang_customerview_title": "வாடிக்கையாளர் காட்சி", - "lang_customersearch_title": "காட்சி பட்டியல்", - "lang_addnewsale_title": "புதிய விற்பனையை சேர்க்க", - "lang_salehistory_title": "விற்பனை வரலாறு", - "lang_invenlog_title": "சரக்கு பதிவுகள்", - "lang_supply_title": "சப்ளையர் பட்டியல்", - "lang_itemcategory_title": "வகை பட்டியல்", - "lang_customercategory_title": "வாடிக்கையாளர் வகை பட்டியல்", - "lang_lowstockdetail_title": "குறைந்த பங்கு பட்டியல்", - "lang_purchse_title": "கொள்முதல்", - "lang_purchasehistory_title": "கொள்முதல் வரலாறு", - "lang_receiving_title": "பெறுதல்", - "lang_item_title": "பொருள்", - "lang_user_title": "பணியாளர்கள்", - "lang_noitemsold": "விற்கப்பட்ட பொருட்களின் எண்ணிக்கை", - "lang_noreturnds": "திருப்பிச் செலுத்தும் எண்ணிக்கை", - "lang_payment_title": "கட்டணம்", - "lang_taxdiscount_title": "வரி/தள்ளுபடி", - "lang_employee_title": "ஊழியர்கள்", - "lang_expense_title": "செலவு பட்டியல்", - "lang_saleandpurchase_title": "விற்பனை&கொள்முதல் ", - "lang_config_title": "ஸ்டோர் கட்டமைப்பு", - "lang_branchoutlet_title": "கிளைகள் / விற்பனை நிலையம்", - "lang_myacc_title": "என் விவரம்", - "lang_setting_title": "அமைப்பு", - "lang_logout_title": "வெளியேறு", - "lang_adduser_title": "பயனரை சேர்க்க", - "lang_export_title": "ஏற்றுமதி", - "lang_access_title": "அனுமதி", - "lang_delete_title": "நீக்கு", - "lang_name_title": "பெயர்", - "lang_choose_category": "வகை தேர்வு", - "lang_email_title": "மின்னஞ்சல்", - "lang_clear_title": "அழி", - "lang_filter_title": "தேடு", - "lang_refresh_title": "புதுப்பி", - "lang_addcustomer_title": "வாடிக்கையாளரை சேர்க்க ", - "lang_import_title": "இறக்குமதி", - "lang_phone_title": "டெலிபோன்", - "lang_no_purchase": "கொள்முதல் எண்ணிக்கை", - "lang_avg_purchase": "சராசரி கொள்முதல்", - "lang_address_title": "முகவரி", - "lang_country_title": "நாடு", - "lang_total_purchase": "மொத்த கொள்முதல்", - "lang_state_title": "மாநிலம்", - "lang_city_title": "நகரம்", - "lang_createdate_title": "உருவாக்கிய தேதி", - "lang_update_title": "புதுப்பிக்கப்பட்ட தேதி", - "lang_addcategory_title": "வகையை சேர்க்க", - "lang_description_title": "விளக்கம்", - "lang_image_title": "புகைப்படம்", - "lang_graphicalcustomer_title": "வாடிக்கையாளர்களுக்கான வரைகலை பார்வை", - "lang_todaysale_title": "இன்றைய விற்பனை", - "lang_todayprofit_title": "இன்றைய லாபம்", - "lang_todaypurchase_title": "இன்றைய கொள்முதல்", - "lang_todayreturn_title": "இன்று திரும்பபெறப்பட்டவை", - "lang_todayitem_title": "இன்றைய உருப்படி", - "lang_todaycustomer_title": "இன்றைய வாடிக்கையாளர் ", - "lang_categorydetail_title": "வகை விவரங்கள்", - "lang_customercategorydetail_title": "வாடிக்கையாளர் வகை விவரங்கள்", - "lang_grapicalemp_title": "பணியாளர் வரைகலை பார்வை", - "lang_empdetail_title": "பணியாளர் விவரங்கள்", - "lang_addemp_title": "பணியாளரை சேர்க்க ", - "lang_empid_title": "பணியாளர் எண்", - "lang_store_title": "விற்பனைக்கூடம்", - "lang_addexpense_title": "செலவுகளை சேர்க்க", - "lang_expensedetail_title": "செலவு விவரங்கள்", - "lang_date_title": "தேதி", - "lang_amount_title": "தொகை", - "lang_type_title": "கட்டண வகை", - "lang_category_title": "வகை", - "lang_recipient_title": "பெறுபவர்", - "lang_approvedby_title": "அங்கீகரிக்கப்பட்டது", - "lang_expencenote_title": "செலவு குறிப்பு", - "lang_new_title": "புதிய", - "lang_addnewbranch_title": "புதிதாக கிளையை சேர்க்க", - "lang_branch_title": "கிளை", - "lang_lowstock_title": "குறைவான பொருள்", - "lang_welcom_title": "நல்வரவு", - "lang_branchid_title": "கிளை எண்", - "lang_close_title": "மூடு", - "lang_save_title": "சேமி", - "lang_offline_title": "ஆஃப்லைன்", - "lang_mailset_title": "மின்னஞ்சல் அமைப்பு", - "lang_smsset_title": "எஸ்எம்எஸ் அமைப்பு ", - "lang_taxrate_title": "வரி விகிதம்", - "lang_printset_title": "அச்சு அமைப்பு", - "lang_recyclebin_title": "மறுசுழற்சி தொட்டி", - "lang_erase_title": "அனைத்தையும் அழிக்கவும்", - "lang_generalset_title": "பொது அமைப்பு", - "lang_general_title": "தற்போதைய கிளைக்கான பொதுவான உள்ளமைவுகள்", - "lang_storename_title": "கடை பெயர்", - "lang_storeowner_title": "கடை உரிமையாளர்", - "lang_website_title": "இணையதளம்", - "lang_place_title": "இடம்", - "lang_pincode_title": "அஞ்சல் குறியீடு", - "lang_currency_title": "நாணய வகை", - "lang_dateformat_title": "தேதி வடிவம்", - "lang_timezone_title": "நேர மண்டலம்", - "lang_storeadd_title": "கடை முகவரி", - "lang_printadd_title": "பிரிண்ட் முகவரி", - "lang_offlineactdata_title": "ஆஃப்லைன் செயல் மற்றும் தகவல் விருப்பம்", - "lang_offlineact_title": "ஆஃப்லைன் செயல்கள்", - "lang_salesaed_title": "விற்பனைகள்(சேர்க்க / திருத்த / நீக்கு /)", - "lang_receivingaed_title": "பெறுதல் (சேர்க்க / திருத்த / நீக்கு /)", - "lang_itemaed_title": "உருப்படி(சேர்க்க / திருத்த / நீக்கு /)", - "lang_suppliersaed_title": "விற்பனையாளர்(சேர்க்க / திருத்த / நீக்கு /)", - "lang_custaed_title": "வாடிக்கையாளர்(சேர்க்க / திருத்த / நீக்கு /)", - "lang_useraed_title": "பயனர்கள்(சேர்க்க / திருத்த / நீக்கு /)", - "lang_branchaed_title": "கிளை(சேர்க்க / திருத்த / நீக்கு /)", - "lang_expenceaed_title": "செலவுகள்(சேர்க்க / திருத்த / நீக்கு /)", - "lang_settingupdate_title": "புதுப்பித்ததை அமைக்க", - "lang_datacache_title": "தற்காலிக தகவல் சேமிப்பு", - "lang_receivingdata_title": "பெறுதல் தகவல்", - "lang_itemsdata_title": "உருப்படி தகவல்", - "lang_supplydata_title": "வழங்குபவர் தகவல்", - "lang_customerdata_title": "வாடிக்கையாளர் தகவல்", - "lang_userdata_title": "பயனர் தகவல்", - "lang_branchdata_title": "கிளை தகவல்", - "lang_expencedata_title": "செலவு விவரங்கள்", - "lang_setdata_title": "அமைப்பு தகவல்", - "lang_mailtype_title": "மின்னஞ்சல் வகை", - "lang_graphicalexpence_title": "செலவுகளின் வரைகலை பார்வை", - "lang_records_title": "பதிவுகள்", - "lang_transaction_title": "பரிவர்த்தனை வரலாறு", - "lang_currentitem_title": "தற்போதைய உருப்படிகள்", - "lang_graphicalitem_title": "உருப்படிகளின் வரைகலை பார்வை", - "lang_exportcsv_title": "அட்டவணை வடிவில் பார்க்க", - "lang_additem_title": "உருப்படியைச் சேர்க்கவும்", - "lang_sku_title": "சரக்கு இருப்பு பிரிவு", - "lang_id_title": "ஐ.டி", - "lang_salespaydetail_title": "விற்பனை கட்டண விவரங்கள்", - "lang_receivingpaydetail_title": "கட்டண விவரங்களைப் பெறுதல்", - "lang_graphicalpayment_title": "கட்டணம் பற்றிய வரைகலை", - "lang_cash_title": "பணம்", - "lang_cheque_title": "காசோலை", - "lang_creditcard_title": "கடன் அட்டை", - "lang_pending_title": "நிலுவைக் கட்டணங்கள்", - "lang_receiving_ddn_cash": "பணம்", - "lang_receiving_ddn_cheque": "காசோலை", - "lang_receiving_ddn_creditcard": "கடன் அட்டை", - "lang_receiving_ddn_pending": "நிலுவை", - "lang_detailreport_title": "விரிவான அறிக்கைகள்", - "lang_graphicreport_title": "வரைகலை விவரங்கள்", - "lang_summaryreport_title": "சுருக்கமான அறிக்கை", - "lang_transction_type": "பரிவர்த்தனை வகை", - "lang_salesreturnitems_title": "விற்பனை வருமான உருப்படி", - "lang_instancereport_title": "விரிவான / நிகழ்வு அறிக்கை", - "lang_salesreport_title": "விற்பனை அறிக்கை", - "lang_instareport_title": " நிகழ்வு அறிக்கை", - "lang_cogs_title": "விற்ற பொருட்களின் கொள்முதல் விலை", - "lang_salesintax_title": "விற்பனை (உள்ளடக்கிய வரி [%])", - "lang_salesextax_title": "விற்பனை (பிரத்தியேக வரி [%])", - "lang_salestotal_title": "மொத்த விற்பனை", - "lang_profits_title": "லாபம்", - "lang_exclusive_title": "விலையுடன் சேர்க்கப்படும்", - "lang_total_no_sold": "விற்கப்பட்ட பொருட்களின் மொத்த எண்ணிக்கை", - "lang_selectvariant_title": "மாறுபாட்டைத் தேர்ந்தெடுக்கவும்", - "lang_total_no_return": "திரும்பும் மொத்த எண்ணிக்கை", - "lang_variantfield_title": "மாறுபட்ட புலங்கள்", - "lang_addvariant_title": "புதியதைச் சேர்க்க", - "lang_inclusive_title": "விலையில் அடங்கியது", - "lang_no_of_transctin": "பரிவர்த்தனைகளின் எண்ணிக்கை", - "lang_salesindisc_title": "விற்பனை (உள்ளடக்கிய தள்ளுபடி)", - "lang_salesexdisc_title": "விற்பனை (பிரத்தியேக தள்ளுபடி)", - "lang_salesreturn_title": "விற்பனை வருமானம்", - "lang_addsales_title": "விற்பனை சேர்க்க", - "lang_qty_title": "அளவு", - "lang_saleqty_title": "அளவுகள்", - "lang_refund": "பணத்தைத் திரும்பப்பெறுதல்", - "lang_netrecpt": "நிகர ரசீதுகள்", - "lang_cash_detail": "பண விவரங்கள்", - "lang_paymentsummary_title": "கட்டணச் சுருக்கம்", - "lang_recentsale_title": "சமீபத்திய விற்பனை", - "lang_itemname_title": "பொருளின் பெயர்", - "lang_company_title": "அடக்கவிலை", - "lang_paymentreceive": "கட்டணம் பெற்றுக்கொள்ளப்பட்டது", - "lang_price_title": "விலை", - "lang_cost_title": "அடக்கவிலை", - "lang_paymentnote_title": "கட்டண குறிப்பு", - "lang_subtotal_title": "கூட்டுத்தொகை:", - "lang_returnall_title": "அனைத்தையும் திருப்ப?", - "lang_saledescription_title": "விற்பனை குறிப்பு:", - "lang_hold_title": "பிடி", - "lang_reset_title": "மீட்டமை", - "lang_refund_title": "பணத்தை திரும்ப", - "lang_paytotal_title": "மொத்தம்", - "lang_refundpaytotal_title": "மொத்த திரும்ப தொகை", - "lang_tendered_title": "பெறப்பட்ட தொகை", - "lang_change_title": "மீதம் உள்ள தொகை", - "lang_addtax_title": "வரியை சேர்க்க", - "lang_value_title": "மதிப்பு", - "lang_action_title": "செயல்", - "lang_updatee_title": "மேம்படுத்த", - "lang_printsheetsize_title": "அச்சு தாள் அளவு", - "lang_choosesize_title": " நாணய வகை", - "lang_restore_title": "திரும்ப பெறு", - "lang_adminpass_title": "நிர்வாகியின் கடவுச்சொல்", - "lang_clearall_title": "எல்லா ஆவணங்களையும் அழிக்கவும்", - "lang_deleteall_title": "அனைத்தையும் நீக்கு", - "lang_detail_title": "விரிவான", - "lang_total_title": "மொத்தம்", - "lang_defaultcust_title": "டிபால்ட் வாடிக்கையாளர்", - "lang_defaultsupply_title": "டிபால்ட் சப்ளையர்", - "lang_indiangst_title": "இந்தியன் ஜிஎஸ்டி", - "lang_enable_title": "சேர்க்க", - "lang_disable_title": "சேர்க்க தேவையில்லை", - "lang_taxdescrip_title": "வரி விளக்கம்", - "lang_lowstocknotify_title": "குறைந்த பங்கு அறிவிப்பு வரம்பு", - "lang_stocklog_title": "ஸ்டாக் பதிவு", - "lang_activateregister_title": "செயலில் உள்ள பதிவு", - "lang_emailus_title": "மின்னஞ்சல் அனுப்ப", - "lang_callus_title": "எங்களை அழைக்க", - "lang_trackinventory_title": "சரக்கை கவனிக்க", - "lang_autoprintaftersale_title": "விற்பனைக்கு பிறகு தானாக அச்சிட", - "lang_displaysalesbalance_title": "விற்பனை இருப்பைக் காண்பி", - "lang_displayscreen_title": "காட்சி திரை", - "lang_autosmsaftersales_title": "விற்பனைக்கு பிறகு தானாக SMS", - "lang_automailaftersale_title": "விற்பனைக்கு பிறகு தானாக அஞ்சல்", - "lang_roundoftotal_title": "முழுமையான தொகை-0.05 என்றால்", - "lang_printcustdetail_title": "வாடிக்கையாளர் விவரங்களை அச்சிடுக", - "lang_printurl_title": "பிராண்ட் URL ஐ அச்சிடு", - "lang_receiptbarcode_title": "ரசீது பார்கோடு", - "lang_printlogo_title": "லோகோவை அச்சிடுங்கள்", - "lang_size_title": "அச்சு அளவு", - "lang_process_title": "செயல்முறை", - "lang_stocklogdetail_title": "பங்கு பதிவு விவரங்கள் ", - "lang_itemid_title": "பொருள் ID", - "lang_quantity_title": "அளவு", - "lang_itemquantity_title": "பொருள் அளவு", - "lang_reference_title": "குறிப்பு", - "lang_stockdate_title": "பங்கு தேதி", - "lang_openingbalance_title": "ஆரம்ப இருப்பு", - "lang_closingbalance_title": "இறுதி இருப்பு", - "lang_changedby_title": "மாற்றப்பட்டது", - "lang_supplydetails_title": "சப்ளையர் விவரங்கள்", - "lang_graphicsuppliers_title": "வரைகலை விற்பனையாளர்", - "lang_salestaxdiscount_title": "விற்பனை வரி வசூலிக்கப்பட்டது", - "lang_receivingtaxdiscount_title": "வாங்கும்போது பெரும் வரி / தள்ளுபடி", - "lang_usersalesdetail_title": "பயனர் விற்பனை விவரங்கள்", - "lang_graphicusersales_title": "வரைகலை பயனர் விற்பனை", - "lang_userdetails_title": "பயனர் விவரங்கள்", - "lang_branchaccess_title": "கிளை அணுகல்", - "lang_useraccess_title": "பயனர் அணுகல்", - "lang_deactivate_title": "செயலிழக்க", - "lang_userpermission_title": "பயனர் அனுமதி", - "lang_read_title": "படிக்க ", - "lang_write_title": "எழுத ", - "lang_activatedeactivateusers_title": "பயனர்களை செயல்படுத்த / செயலிழக்க", - "lang_addsupplier_title": "விற்பனையாளரை சேர்க்க", - "lang_usernamee_title": "பயனர் பெயர் ", - "lang_usertype_title": "பயனர் வகை", - "lang_branchdetail_title": "கிளை விவரங்கள் ", - "lang_branchname_title": "கிளையின் பெயர்", - "lang_chooseimage_title": "படத்தைத் தேர்வுசெய்க", - "lang_categoryname_title": "வகை பெயர்", - "lang_changepassword_title": "கடவுச்சொல்லை மாற்று", - "lang_currentpassword_title": "கடவுச்சொல்", - "lang_newpassword_title": "புதிய கடவுச்சொல்", - "lang_confirmpassword_title": "கடவுச்சொல்லை உறுதிப்படுத்தவும்", - "lang_deleterecord_title": "பதிவுகளை நீக்கு", - "lang_selecteddetails_title": "தேர்ந்தெடுக்கப்பட்ட விவரங்கள் நீக்கப்படும்", - "lang_areyousure_title": "இந்த பதிவுகளை நீக்க விரும்புகிறீர்களா", - "lang_deletecollectrecord_title": "சேகரிப்பு பதிவை நீக்கு", - "lang_yourselecteddetails_title": "நீங்கள் தேர்ந்தெடுத்த விவரங்கள் நீக்கப்படும்", - "lang_areyousuretodelete_title": "இந்த பதிவுகளை நீக்குவது உறுதி?", - "lang_cancel_title": "ரத்துசெய்", - "lang_yes_title": "ஆம்", - "lang_verify_title": "சரிபார்க்கவும்", - "lang_deletetaxrecord_title": "வரி பதிவை நீக்கு", - "lang_debit_title": "பற்று (டெபிட்)", - "lang_recipientname_title": "பெறுநரின் பெயர்", - "lang_credit_title": "கடன்", - "lang_willbeexported_title": "தேர்ந்தெடுக்கப்பட்ட விவரம் ஏற்றுமதி செய்யப்படும்", - "lang_download_title": "பதிவிறக்க", - "lang_choosefile_title": "கோப்பை தேர்ந்தெடுக்கவும்", - "lang_nofilechosen_title": "கோப்பு தேர்வுசெய்யப்பட வில்லை", - "lang_csvsample_title": "அட்டவணை வடிவமைப்பு தகவலின் மாதிரி", - "lang_barcode_title": "பார்கோடு", - "lang_choosesupplier_title": "சப்ளையரைத் தேர்ந்தெடுக்கவும்", - "lang_choosecategory_title": "வகையைத் தேர்வுசெய்க", - "lang_choosecustomerReferral_title": "பரிந்துரை வாடிக்கையாளர்", - "lang_choosebranch_title": "கிளையைத் தேர்வுசெய்க", - "lang_pricing_title": "விலை நிர்ணயம்", - "lang_showitemposition_title": "பொருள் நிலையைக் காட்டு", - "lang_tracknontrack_title": "இந்த தயாரிப்புக்கான கண்காணிப்பு / கவனிக்கப்படாத சரக்கு இருப்பு ", - "lang_sellingamount_title": "விற்பனை தொகை", - "lang_companyamount_title": "அடக்கவிலை", - "lang_barcodeid_title": "பார்கோடு ஐடி", - "lang_vieweditprofile_title": "சுயவிவரத்தைக் காண / திருத்த", - "lang_useremail_title": "பயனர் மின்னஞ்சல்", - "lang_orderid_title": "ஆர்டர் ஐடி", - "lang_orderdate_title": "ஆர்டர் தேதி", - "lang_paymenttype_title": "கட்டண வகை", - "lang_paymentdetails_title": "கட்டண விவரங்கள்", - "lang_stylecontrol": "ஸ்டைல் விவரம்", - "lang_docwidth": "டாக்குமெண்ட் அகலம்", - "lang_docheight": "டாக்குமெண்ட் உயரம்", - "lang_suppliername_title": "விற்பனையாளர் பெயர்", - "phone_title": "விற்பனையாளர் தொலைபேசி", - "lang_printbarcode": "பார்கோடு அச்சிடுதல்", - "lang_supplieremail_title": "விற்பனையாளர் மின்னஞ்சல் ", - "lang_supplieraddress_title": "விற்பனையாளர் முகவரி ", - "lang_downloadfile_title": "பதிவிறக்க கோப்பு", - "lang_salesdetail_title": "விற்பனை விவரங்கள்", - "lang_paymentdescription_title": "கட்டணக் குறிப்பு", - "lang_customername_title": "வாடிக்கையாளர் பெயர்", - "lang_customerphone_title": "வாடிக்கையாளர் தொலைபேசி", - "lang_customeremail_title": "வாடிக்கையாளர் மின்னஞ்சல்", - "lang_customeraddress_title": "வாடிக்கையாளர் முகவரி", - "lang_returnitemdetail_title": "திரும்பி பெறப்பட்ட பொருளின் விவரங்கள் ", - "lang_entername_title": "பெயரை உள்ளிடுக", - "lang_enterpassword_title": "கடவுச்சொல்லை உள்ளிடவும்", - "lang_retypepassword_title": "கடவுச்சொல்லை மீண்டும் உள்ளிடுக", - "lang_enteremail_title": "மின்னஞ்சலை உள்ளிடவும்", - "lang_accessctrl_title": "நுழைவு கட்டுப்பாடு", - "lang_adminaccess_title": "அட்மின் அணுகல்", - "lang_cash_register": "பண ரிஜிஸ்டர்", - "lang_normalaccess_title": "சாதாரண அணுகல்", - "lang_readaccess_title": "படிக்க மட்டும்", - "lang_writeaccess_title": "எழுத மட்டும்", - "lang_deleteaccess_title": "நீக்க மட்டும்", - "lang_note_title": "குறிப்பு:", - "lang_offlinedata_title": "பயன்பாடு இணைக்கப்பட்ட சேவையகத்தை (ஆன்லைனில்) பெறும்போது ஆஃப்லைன் தரவு ஒத்திசைவைப் பெறும்.", - "lang_ajaxsync_title": "ஒவ்வொரு Ajax கோரிக்கையிலும் தரவு கேச் ஒத்திசைவைப் பெறும். லோக்கல் ஹோஸ்ட் மற்றும் சர்வர் தரவு ஒரே மாதிரியாக இருப்பதை கணினி உறுதி செய்யும்.", - "lang_entermobilenumber_title": "தொலைபேசி எண்ணை உள்ளிடவும்", - "lang_registerdetail_title": "பதிவு விவரம்", - "lang_registername_title": "ரிஜிஸ்டர் பெயர்", - "lang_registeramount_title": "பதிவு தொகை", - "lang_salesid_title": "விற்பனை ஐடி", - "lang_register_title": "பதிவுகள்", - "lang_year": "இந்த வருடம்", - "lang_this_month": "இந்த மாதம்", - "lang_this_week": "இந்த வாரம்", - "lang_this_day": "இன்று", - "lang_purchase": "கொள்முதல்", - "lang_return": "திரும்புகிறது", - "lang_pending": "நிலுவையில் உள்ளது", - "lang_pending_payment": "நிலுவையில் உள்ள கட்டண விற்பனை", - "lang_paymentmode": "கட்டண முறைகள்", - "lang_sale_total": "மொத்த விற்பனை", - "lang_top": "சிறந்த செயல்திறன் கொண்டவர்", - "lang_best_sale": "அதிகம் விற்பனையாகும் பொருட்கள்", - "lang_amount_sale": "விற்பணை தொகை", - "lang_sale_purchase": "விற்பனை மற்றும் கொள்முதல் வரலாறு", - "lang_sale_empty": "விற்பனை ஆர்டர் காலியாக உள்ளது", - "lang_receive_empty": "பெறுதல் ஆர்டர் காலியாக உள்ளது", - "lang_purchase_empty": "பெறுதல் ஆர்டர் காலியாக உள்ளது", - "lang_linetotal": "வரி மொத்தம்", - "lang_sale_history": "விற்பனை பட்டியல்", - "lang_itemvariant_title": "மாறுபாடு பட்டியல்", - "lang_variant_list": "மாறுபட்ட பட்டியல்", - "lang_item_history": "பொருள் பட்டியல்", - "lang_open": "திற", - "lang_receive": "பெறப்பட்டது", - "lang_file": "கோப்பை தேர்வு செய்", - "lang_igst_tax_receiving": "ஐஜிஎஸ்டி", - "lang_cgst_tax_receiving": "சிஜிஎஸ்டி", - "lang_sgst_tax_receiving": "எஸ்ஜிஎஸ்டி", - "lang_grandamount": "மொத்த தொகை", - "lang_customer_history": "வாடிக்கையாளர் பட்டியல்", - "lang_gstreport": "ஜிஎஸ்டி அறிக்கைகள்", - "lang_return_title": "திரும்ப விற்பனை", - "lang_return_receivetitle": "திரும்பப் பெறுதல்", - "lang_salereport": "விற்பனை அறிக்கைகள்", - "lang_salereport_title": "விற்பனை விவரங்கள்", - "lang_instancesale_title": "விரைவு விற்பனை", - "lang_receivereport": "பெறுதல் அறிக்கைகள்", - "lang_receivereport_title": "பெறுதல் விவரங்கள்", - "lang_itemreport": "பொருள் அறிக்கைகள்", - "lang_topfive_title": "அதிகம் விற்பனையாகும் 5 தயாரிப்புகள்", - "lang_customerreport": "வாடிக்கையாளர் அறிக்கைகள்", - "lang_category_reporttitle": "வகை அறிக்கைகள்", - "lang_supplierreport": "சப்ளையர் அறிக்கைகள்", - "lang_basedproduct": "சப்ளையர் அடிப்படையிலான தயாரிப்பு", - "lang_basedsale": "சப்ளையர் அடிப்படையிலான விற்பனை", - "lang_five_supply": "முதல் 5 சப்ளையர்கள்", - "lang_categoryreport": "வகை அறிக்கைகள்", - "lang_categorydetails_title": "வகை விவரங்கள்", - "lang_categorybased": "வகை அடிப்படையிலான தயாரிப்பு", - "lang_userreport_title": "பயனர் அறிக்கைகள்", - "lang_useractivity": "செயல்பாட்டு நிலை", - "lang_userdaywise": "தினசரி விற்பனை", - "lang_paymentreport": "கட்டண அறிக்கைகள்", - "lang_pay_type": "வகைகள்", - "lang_payment_type": "கட்டணம் வகை", - "lang_expected": "எதிர்பார்க்கப்படுகிறது", - "lang_counted": "எண்ணப்பட்டது", - "lang_differ": "வேறுபாடு", - "lang_cash": "பணம் (நிகர ரொக்கப் பணம்)", - "lang_pay_transaction": "கட்டண பரிவர்த்தனைகள்", - "lang_report_all": "அனைத்தும்", - "lang_open_date": "திறக்கும் தேதி", - "lang_payment_tally": "கட்டணக் கணக்கு", - "lang_taxdis_report": "வரி அறிக்கைகள்", - "lang_register_name": "பெயர் பதிவு", - "lang_register_detail": "பதிவு விவரங்கள்", - "lang_register_report": "பதிவு அறிக்கைகள்", - "lang_pending_report": "நிலுவையில் உள்ள தொகை அறிக்கைகள்", - "lang_pending_sale_detail": "நிலுவை விற்பனை விவரங்கள்", - "lang_pending_receiving_detail": "நிலுவை விவரங்கள்", - "lang_pending_customer_detail": "நிலுவை வாடிக்கையாளர் விவரங்கள்", - "lang_pending_supplier_detail": "நிலுவை சப்ளையர் விவரங்கள்", - "lang_return_report": "திரும்ப அறிக்கைகள்", - "lang_return_detail": "திரும்ப விவரங்கள்", - "lang_returnbased": "வருமானம் சார்ந்த தயாரிப்பு", - "lang_mystore": "என் கடை", - "lang_offline": "ஆஃப்லைன்", - "lang_mail_set": "அஞ்சல் அமைப்புகள்", - "lang_sms_set": "எஸ்எம்எஸ் அமைப்புகள்", - "lang_denomination_fields": "மதிப்பு புலங்கள்", - "lang_recycle": "மறுசுழற்சி தொட்டி", - "lang_eraseall": "அனைத்தையும் அழிக்கவும்", - "lang_apiset": "ஏபிஐ அமைப்பு", - "lang_generalset": "அடிப்படை அமைப்புகள்", - "lang_changebranch": "கிளையை மாற்று", - "lang_shopinfo": "கடை தகவல்", - "lang_mobile": "கைபேசி எண்", - "lang_addtax": "வரி விகிதத்தைச் சேர்க்கவும்", - "lang_supplier": "சப்ளையர்", - "lang_type": "வகை", - "lang_gstr_number": "ஜிஎஸ்டிஆர் எண்", - "lang_saleprefix": "விற்பனை முன்னொட்டு", - "lang_receiveprefix": "முன்னொட்டைப் பெறுதல்", - "lang_choosebranch": "கிளையைத் தேர்ந்தெடுக்கவும்", - "lang_user_list": "பயனர்களின் பட்டியல்", - "lang_branch_history": "கிளைகள் பட்டியல்", - "lang_expense_history": "செலவு பட்டியல்", - "lang_no_title": "விற்பனை எண்", - "lang_paymentmethod": "பணம் செலுத்தும் முறை", - "lang_printsale": "விற்பனை", - "lang_printreturn": "திரும்புகிறது", - "lang_supplier_gsttype_title": "ஜிஎஸ்டி வகை", - "lang_supplier_gstin_number": "GSTIN எண்", - "lang_cratedate_title": "உருவாக்கப்பட்ட தேதி", - "lang_without_variant": "மாறுபாடு இல்லாத தயாரிப்பு", - "lang_with_variant": "மாறுபாடு கொண்ட தயாரிப்பு", - "lang_add_category": "வகையைச் சேர்", - "lang_add_supply": "சப்ளையரைச் சேர்க்கவும்", - "lang_same_sku": "SKU போலவே", - "lang_openquantity_title": "இருப்பு (தொடக்கம்)", - "lang_new_search": "புதியது", - "lang_low_search": "விலை - குறைந்த முதல் அதிகம் வரை", - "lang_high_search": "விலை - உயர் முதல் குறைந்தது வரை", - "lang_hsn": "HSN குறியீடு", - "lang_default": "டிபால்ட்", - "lang_inc_tax": "உள்ளடக்கியது", - "lang_exc_tax": "பிரத்தியேகமானது", - "lang_add_tax": "வரி சேர்க்கவும்", - "lang_number": "எண்", - "lang_variantdetail": "மாறுபட்ட விவரங்கள்", - "lang_line_total_receiving": "தள்ளுபடியுடன் வரி மொத்தம்", - "lang_gstfield": "ஜிஎஸ்டி விவரங்கள்", - "lang_defaultuser_title": " இயல்புநிலை பயனர்", - "lang_addfield": "டிபால்ட் பயனர்", - "lang_apiuser_title": "ஏபிஐ பயனர்", - "lang_users_title": "பயனர்", - "lang_sale_summary": "விற்பனை சுருக்கம்", - "lang_openamount_title": "திறக்கப்பட்ட தொகை", - "lang_chooseregistr_title": "பதிவை தேர்வு செய்யவும்", - "lang_addregister_title": "பதிவைச் சேர்க்கவும்", - "lang_lowstock_notify": "குறைந்த இருப்பு", - "lang_notifications_title": "அறிவிப்புகள்", - "lang_view_all": "அனைத்தையும் காட்டு", - "lang_tax_detail": "வரி விவரங்கள்", - "lang_activity": "செயல்பாடுகள்", - "lang_images": "படங்கள்", - "lang_barwidth": "பார் அகலம்", - "lang_barheight": "பார் உயரம்", - "lang_margin": "மார்ஜின்", - "lang_background": "பாக்ரவுண்டு", - "lang_linecolor": "வரி நிறம்", - "lang_textalign": "டெக்ஸ்ட் சீரமை", - "lang_fontsize": "ஃபோன்ட் அளவு", - "lang_font": "ஃபோன்ட்", - "lang_textmargin": "டெக்ஸ்ட் மார்ஜின்", - "lang_item_new": "புதிய பொருள் சேர்க்க", - "lang_ctegory_list": "வகை பட்டியல்", - "lang_variants": "மாறுபாடு", - "lang_Addvariants": "புதிய", - "lang_lowstoklist": "குறைந்த பங்கு பட்டியல்", - "lang_selectreturn": "திரும்புவதற்கு தேர்ந்தெடுக்க", - "lang_taxgroup": "வரி குழுக்கள்", - "lang_taxes": "வரிகள்", - "lang_active": "ஆக்டிவ்", - "lang_inactive": "இன்ஆக்டிவ்", - "lang_userstatus": "ஸ்டேட்டஸ்", - "lang_branchoutlet": "தற்போதைய கிளை/வெளியீடு", - "lang_Addexpensing": "புதிய", - "lang_expensing": "செலவு", - "lang_registerclose": "உங்கள் பணப் பதிவு மூடப்பட்டுள்ளது", - "lang_hi": "வணக்கம்", - "lang_register_note": "உங்கள் பணப் பதிவு திறக்கப்பட்டு உள்ளது", - "lang_register_click": "நீங்கள் பதிவேட்டை மூட விரும்பினால் 'மூடு பதிவேடு' என்பதைக் கிளிக் செய்து மீண்டும் திறக்கவும்.", - "lang_register_example": "(குறிப்பு: மேம்படுத்தல் அறிக்கையிடலுக்கு தினசரி அடிப்படையில் பணப் பதிவேடுகளை மூடுமாறு பரிந்துரைக்கிறோம்.)", - "lang_registerdetails": "பணப் பதிவேடு விவரங்கள்", - "lang_hours": "24 மணி நேரத்திற்கும் மேலாக திறக்கப்பட்டுள்ளது(", - "lang_dayss": "நாள்)", - "lang_branchchange": "கிளை மாற்ற விவரங்கள்", - "lang_branchchnagenote": "நீங்கள் கிளையை மாற்ற விரும்பினால், 'கிளையை மாற்று' என்பதைக் கிளிக் செய்யவும் இல்லையெனில் பதிவேட்டை மூடவும்.", - "lang_openclose": "உங்கள் பணப் பதிவு தற்போது மூடப்பட்டுள்ளது", - "lang_registeropend": "பதிவைத் திறக்க", - "lang_empty_return": "பொருட்களை திரும்பப் பெறுவதற்கான ஆர்டர் காலியாக உள்ளது", - "lang_returnsale_empty": "திரும்ப விற்பனை ஆர்டர் காலியாக உள்ளது", - "lang_reset_form": "படிவத்தை மீட்டமைக்கவும்", - "lang_reset_want": "மீட்டமைக்க வேண்டுமா ?", - "lang_proceed_title": "தொடரவும்", - "lang_confirmed_title": "உறுதி", - "lang_percentages": "சதவீதம்", - "lang_applyvariant": "மாறுபாடுகளைப் பயன்படுத்துங்கள்", - "lang_enabledisable": "இயக்கு (அல்லது) முடக்கு", - "lang_instance_add": "சேர்க்க", - "lang_purchaseprint": "கொள்முதல் பிரிண்ட்", - "lang_returnprint": "திரும்பப் பெற்ற பிரிண்ட்", - "lang_printed": "பிரிண்ட்", - "lang_saleprint": "விற்பனை பிரிண்ட்", - "lang_registeredopen": "ரிஜிஸ்டரை திறக்க", - "lang_closedregister": "ரிஜிஸ்டரை மூடு", - "lang_switchbranch": "கிளையை மாற்றவும்", - "lang_importtitle": "இறக்குமதி விவரங்கள்", - "lang_exporttitle": "ஏற்றுமதி விவரங்கள்", - "lang_chooseuser": "பயனரைத் தேர்வுசெய்க", - "lang_firstname": "முதல் பெயர்", - "lang_lastname": "கடைசி பெயர்", - "lang_openregbutton": "பதிவேட்டைத் திறக்க", - "lang_maxfile_title": "அதிகபட்சம் 12 கோப்புகள் இங்கே", - "lang_filebrowse_title": "ப்ரவுஸ்", - "lang_expenses_reporttile": "செலவுகள்", - "lang_quicksale_title": "விரைவான விற்பனை", - "lang_mail": "மின்னஞ்சல் அமைப்புகளைப் புகாரளிக்கவும்", - "lang_kiosktitle": "கியோஸ்க்", - "lang_tilllock_title": "PIN மூலம் கல்லாவைப் பூட்டு", - "lang_tilllockidle_title": "செயலற்ற போது பூட்டு", - "lang_staffshifts_title": "பணியாளர் நிர்வாகம்", - "lang_roles_title": "பயனர் பாத்திரங்கள்", - "lang_newrole_title": "புதிய பாத்திரம்", - "lang_stafftips_title": "டிப்ஸ் பதிவு", - "lang_staffroster_title": "பணி அட்டவணை", - "lang_tip_title": "டிப்", - "lang_labourreport_title": "ஊதியம் / வருகை", - "lang_taxsummary_title": "வரி சுருக்கம்", - "lang_modules": "அம்சங்கள்", - "lang_group_by_family": "குடும்பமாக தொகு", - "lang_pricelists": "வாடிக்கையாளர் விலை", - "lang_pricelists_new": "புதிய பட்டியல்", - "lang_pricelists_hint": "ஒரு வாடிக்கையாளர் வகைக்கு அதன் சொந்த விலைகள் இருக்கலாம் - எல்லாவற்றிற்கும் சதவீத தள்ளுபடி, பொருள் வாரியாக சரியான விலை, அல்லது இரண்டும் (சரியான விலை வெல்லும்). அந்த வகை வாடிக்கையாளர் விற்பனையில் இருக்கும்போது தானாக பொருந்தும்.", - "lang_modifier_groups": "மாற்றிகள்", - "lang_modifier_new": "புதிய குழு", - "lang_modifier_hint": "சமையலறை புரிந்துகொள்ளும் விருப்பத் தொகுப்புகள் - ஒவ்வொரு தேர்வும் விலையை கூட்டவோ குறைக்கவோ செய்யலாம். பொருள் பக்கத்தில் குழுக்களை இணைக்கவும்; விற்பனையின்போது கேஷியர் தேர்வு செய்வார்.", - "lang_module_workforce": "பணியாளர்", - "lang_wf_hint": "ஷிப்ட், வருகை மற்றும் வார பணி அட்டவணை. ஊழியர்கள் கடிகார பொத்தானில் அட்டவணையை பார்க்கிறார்கள்; திட்டமிடல் இங்கே.", - "lang_wf_general": "பொது", - "lang_wf_onshift_title": "இப்போது பணியில்", - "lang_wf_refresh": "புதுப்பி", - "lang_wf_links_hint": "ஊதியமும் ஊழியர் அட்டைகளும் ஒவ்வொரு பயனரிடமும்; கடிகாரம், டிப்ஸ், அட்டவணை சுவிட்சுகள் தொகுதிகள் ஆன்/ஆஃப் பக்கத்தில்.", - "lang_wf_planshift": "ஷிப்ட் திட்டமிடு", - "lang_roster_thisweek": "இந்த வாரம்", - "lang_roster_readonly_hint": "நிர்வாகம் > பணியாளர் பகுதியில் திட்டமிடப்படுகிறது.", - "lang_modules_workforce": "பணியாளர் — வருகை, ஷிப்ட் மற்றும் கல்லா", - "lang_modules_restaurant": "உணவகம் (மேசைகள் & சமையலறை)", - "lang_modules_hint": "அணைக்கப்பட்ட அம்சம் மெனுக்களில் இருந்து மறையும். எதுவும் அழிக்கப்படாது - மீண்டும் இயக்கினால் எல்லாம் திரும்பும்.", - "lang_modules_branch": "கிளை", - "lang_module_tax": "வரி", - "lang_module_credit": "வாடிக்கையாளர் கடன்", - "lang_module_marketing": "வாடிக்கையாளர் சந்தைப்படுத்தல்", - "lang_module_messaging": "செய்தி அனுப்புதல்", - "lang_module_channels": "விற்பனை வழிகள்", - "lang_module_kiosk": "கியோஸ்க்", - "lang_module_recyclebin": "மறுசுழற்சி தொட்டி", - "lang_module_themes": "தீம்கள்", - "lang_coretab_sale": "விற்பனை", - "lang_coretab_receiving": "கொள்முதல்", - "lang_coretab_inventory": "சரக்கு", - "lang_coretab_print": "ரசீது அச்சு", - "lang_coretab_payments": "பணம் செலுத்துதல்", - "lang_splitpay_title": "பிரித்து செலுத்துதல்", - "lang_common_settings": "பொது", - "lang_rgrp_sales": "விற்பனை", - "lang_rgrp_purchase": "கொள்முதல்", - "lang_rgrp_inventory": "சரக்கு", - "lang_rgrp_people": "நபர்கள்", - "lang_rgrp_money": "பணம்", - "lang_navgroup_modules": "அம்சங்கள்", - "lang_customer_bulk": "மொத்த வாடிக்கையாளர் இறக்குமதி", - "lang_pl_cashbook": "லாப நஷ்டத்தில் பண புத்தகம் சேர்க்கப்படும்", - "lang_integrations": "ஒருங்கிணைப்புகள்", - "lang_integrations_hint": "வெளியிலிருந்து இந்த கடையின் தரவை எது தொடலாம் - டோக்கன்கள் யார் என்றும், வெப்ஹுக்குகள் மாற்ற சமிக்ஞைகள் எங்கு செல்லும் என்றும் சொல்கின்றன.", - "lang_int_tokens": "API டோக்கன்கள்", - "lang_int_webhooks": "வெப்ஹுக்குகள்", - "lang_int_connectors": "இணைப்பான்கள்", - "lang_int_connectors_hint": "கடைக் கணினியில் அருகில் இயங்கும் கையொப்பமிட்ட கூடுதல் சேவைகள் - உள்ளே அல்ல. இயக்கும்போது வாடிக்கையாளர்களுக்கு செய்தி அனுப்பும் அளவுக்கு மட்டுமே அனுமதி கிடைக்கும்.", - "lang_int_newtoken": "புதிய டோக்கன்", - "lang_int_newhook": "புதிய வெப்ஹுக்", - "lang_int_deliveries": "சமீபத்திய அனுப்புகைகள்", - "lang_autofocus_sale": "இந்த சாதனத்தில் தானியங்கு கவனம்", - "lang_autofocus_receiving": "இந்த சாதனத்தில் தானியங்கு கவனம்", - "lang_taxdefaults_title": "வரி இயல்புநிலைகள்", - "lang_editbranch_title": "கிளையைத் திருத்து", - "lang_registers_title": "ரிஜிஸ்டர்கள்", - "lang_back_title": "பின்செல்", - "lang_updatebtn_title": "புதுப்பி", - "lang_modules_hardware": "வன்பொருள் — எடை இயந்திரம்", - "lang_modules_kot_hint": "உணவகம் / KOT முறை அமைப்புகள் > தொகுதிகள் பக்கத்தில் இயக்கப்படுகிறது. இந்தப் பக்கம் அதன் மேசைகளை நிர்வகிக்கிறது.", - "lang_modules_managetables": "மேசைகளை நிர்வகிக்கவும்", - "lang_navgroup_store": "கடை", - "lang_navgroup_salesbilling": "விற்பனை & பில்லிங்", - "lang_navgroup_restaurant": "உணவகம்", - "lang_navgroup_customers_marketing": "வாடிக்கையாளர் & சந்தைப்படுத்தல்", - "lang_navgroup_messaging": "செய்தி அனுப்புதல்", - "lang_navgroup_device_appearance": "சாதனம் & தோற்றம்", - "lang_navgroup_system": "கணினி", - "lang_payment_gateway": "கட்டண நுழைவாயில்", - "lang_units_title": "அலகுகள்", - "lang_kiosk_settings": "கியோஸ்க் அமைப்புகள்", - "lang_tables_title": "மேசைகள்", - "lang_whatsapp_connection": "WhatsApp இணைப்பு", - "lang_adddiscount_title": "தள்ளுபடி சேர்க்கவும்", - "lang_addnewkot_title": "புதிய KOT சேர்க்கவும்", - "lang_advanced": "மேம்பட்டவை", - "lang_apikey": "API விசை", - "lang_campaigns_settings": "பிரச்சாரங்கள்", - "lang_campaigns_title": "பிரச்சாரங்கள்", - "lang_cash_in_title": "பணம் உள்ளே", - "lang_cash_out_title": "பணம் வெளியே", - "lang_cashback_settings": "கேஷ்பேக்", - "lang_cgst_tax_return": "CGST", - "lang_cgst_tax_sale": "CGST", - "lang_choose_register": "ரிஜிஸ்டரைத் தேர்ந்தெடுக்கவும்", - "lang_coupons_settings": "கூப்பன்கள்", - "lang_coupons_title": "கூப்பன்கள்", - "lang_credit_settings": "கடன் & நினைவூட்டல்கள்", - "lang_customercategory_detail": "வாடிக்கையாளர் வகை விவரங்கள்", - "lang_delete_cashinout_title": "பணம் உள்ளே/வெளியே பதிவை நீக்கவும்", - "lang_description": "விளக்கம்", - "lang_device_title": "கர்சர் ஃபோகஸ்", - "lang_discounttype_title": "தள்ளுபடி வகை", - "lang_discountvalue_title": "தள்ளுபடி மதிப்பு", - "lang_edit_title": "திருத்து", - "lang_entry_title": "பதிவு", - "lang_expiry_title": "பொருள் காலாவதி தேதி", - "lang_foget_mail": "கடவுச்சொல்லை மீட்டமை", - "lang_forget_description": "கடவுச்சொல் மீட்டமைப்பு வழிமுறைகளைப் பெற கீழே மின்னஞ்சல் முகவரியை உள்ளிடவும்.", - "lang_forgot": "கடவுச்சொல் மறந்துவிட்டதா!", - "lang_igst_tax_return": "IGST", - "lang_igst_tax_sale": "IGST", - "lang_item_bulk": "மொத்தமாக பொருள் சேர்க்க", - "lang_item_master_title": "பொருள் பட்டியல்", - "lang_item_quick": "விரைவு பொருள் சேர்க்க", - "lang_items_title": "பொருட்கள்", - "lang_kioskreport": "கியோஸ்க் அறிக்கைகள்", - "lang_kioskreport_title": "விரிவான கியோஸ்க்குகள்", - "lang_kot_title": "KOT", - "lang_kotdetails_title": "KOT விவரங்கள்", - "lang_kothistory_title": "KOT வரலாறு", - "lang_kotview_title": "KOT விவரங்கள்", - "lang_lock_title": "திரை பூட்டு", - "lang_login": "உள்நுழைவு", - "lang_loyalty_settings": "லாயல்டி & வெகுமதிகள்", - "lang_loyalty_title": "லாயல்டி & வெகுமதிகள்", - "lang_messaging_settings": "SMS & WhatsApp வழங்குநர்கள்", - "lang_method_title": "முறை", - "lang_mfg_title": "பொருள் தயாரிப்பு தேதி", - "lang_nokot_title": "இந்த மேசைக்கு KOT ஆர்டர்கள் இல்லை", - "lang_on_title": "ஆன்", - "lang_opening_float": "தொடக்கத் தொகை", - "lang_ordertype_title": "ஆர்டர் வகை", - "lang_pax_title": "நபர்களின் எண்ணிக்கை", - "lang_payment_fields": "கட்டண முறைகள்", - "lang_permanant": "சேகரிப்புகளை நிரந்தரமாக நீக்கு", - "lang_price_settings": "விலை அமைப்புகள்", - "lang_print_title": "அச்சிடு", - "lang_proceedbillprint_title": "பில் அச்சிற்கு தொடரவும்", - "lang_qrcode_title": "Razorpay", - "lang_receiving_add_title": "கொள்முதல் சேர்க்கவும்", - "lang_receiving_edit_title": "கொள்முதலைத் திருத்து", - "lang_register_history": "ரிஜிஸ்டர் பட்டியல்", - "lang_register_selection": "ரிஜிஸ்டர் தேர்வு", - "lang_remeber_password": "ஏற்கனவே POSNIC கணக்கு உள்ளதா?", - "lang_remember": "என்னை நினைவில் கொள்", - "lang_reset": "இயல்புநிலைக்கு மீட்டமை", - "lang_returndetail_title": "திரும்பப்பெறுதல் விவரங்கள்", - "lang_save": "தீம் சேமிக்கவும்", - "lang_select_register_to_open": "அமர்வைத் தொடங்க ஒரு ரிஜிஸ்டரைத் தேர்ந்தெடுத்து திறக்கவும்", - "lang_sendername": "அனுப்புநர் பெயர்", - "lang_sgst_tax_return": "SGST", - "lang_sgst_tax_sale": "SGST", - "lang_sid_title": "SID", - "lang_status_title": "நிலை", - "lang_submit": "சமர்ப்பிக்கவும்", - "lang_table_title": "மேசை", - "lang_theme_appearance": "தீம் & தோற்றம்", - "lang_theme_settings": "தீம் & தோற்றம்", - "lang_transction": "பரிவர்த்தனை விவரங்கள்", - "lang_unit_title": "அலகு", - "lang_upi_title": "UPI-Pay", - "lang_weightmachine_title": "எடை இயந்திரம்", - "lang_register_overview": "ரிஜிஸ்டர்கள்", - "lang_cashregister_enable": "பண ரிஜிஸ்டர் (கல்லா அமர்வுகள்)" -} \ No newline at end of file diff --git a/frontend/layouts/footer.html b/frontend/layouts/footer.html index 06e278b0b..75bf1b6f4 100644 --- a/frontend/layouts/footer.html +++ b/frontend/layouts/footer.html @@ -3,7 +3,8 @@ bottom: 0;">
\ No newline at end of file diff --git a/frontend/layouts/header.html b/frontend/layouts/header.html index e74afbe89..a766b8efc 100644 --- a/frontend/layouts/header.html +++ b/frontend/layouts/header.html @@ -4,8 +4,8 @@
@@ -14,9 +14,9 @@

Posnic

horizontal + class="img-fluid menu-hamburger-horizontal" alt="horizontal" loading="lazy" decoding="async"> verticle + alt="verticle" loading="lazy" decoding="async">
@@ -24,9 +24,9 @@

Posnic

collapse + alt="collapse" loading="lazy" decoding="async"> close + alt="close" loading="lazy" decoding="async">
@@ -58,9 +58,9 @@

Posnic

menu + alt="menu" loading="lazy" decoding="async"> close + alt="close" loading="lazy" decoding="async">
@@ -126,35 +126,41 @@

Posnic

+
  • + title="fullscreen" data-t-title="lang_fullscreen">
    fullscreen + id="fullscreen" style="width: 19px !important;" alt="fullscreen" loading="lazy" decoding="async">
    • -
  • +
  • @@ -179,87 +185,87 @@

    Posnic

    } catch (e) { /* fail open */ } })(); -
  • shortcut + alt="shortcut" loading="lazy" decoding="async">
    • -
  • +
  • @@ -273,8 +279,8 @@
    • + +
  • password + class="img-fluid" alt="password" loading="lazy" decoding="async"> Password
    • @@ -349,7 +374,7 @@
  • logout + alt="logout" loading="lazy" decoding="async"> Logout
    • diff --git a/frontend/layouts/sidebar.html b/frontend/layouts/sidebar.html index 1627aedf7..560766db2 100644 --- a/frontend/layouts/sidebar.html +++ b/frontend/layouts/sidebar.html @@ -7,41 +7,42 @@
    -

    Posnic

    - +

    Posnic

    +
    @@ -56,32 +57,46 @@
  • dashboard + class="img-fluid" alt="dashboard" loading="lazy" decoding="async"> Dashboard
  • - New Sale + New Sale New Sale
    • +
  • + + Quotes + Quotes + +
    • +
  • + + Invoices + Invoices + +
  • History + alt="History" loading="lazy" decoding="async"> Sales History
    • @@ -89,18 +104,18 @@
    @@ -115,50 +130,32 @@
    Inventory
    -
  • - - new Item - Add New Item - -
    • - -
  • - - Quick Item Add - Quick Item Add - -
    • - -
  • - - Bulk Item Add - Bulk Item Add - -
    • -
  • - Item Details - Item List + Item Details + Items
  • - Price Settings + Price Settings Price Settings
  • Inventory Log + class="img-fluid" alt="Inventory Log" loading="lazy" decoding="async"> Inventory Logs
    • @@ -166,16 +163,23 @@
    Item Category - Category List + alt="Item Category" loading="lazy" decoding="async"> + Categories
  • - Item Variant - Variant List + Item Variant + Variants + +
    • + +
  • + + Units + Units
    • @@ -184,8 +188,8 @@
    Low stock Details - Low Stock List + alt="Low stock Details" loading="lazy" decoding="async"> + Low Stock @@ -193,31 +197,31 @@
    @@ -232,48 +236,44 @@
    Purchase
    -
  • New Purchase - New Purchase -
    • -
  • - - History - Purchase History - -
    • +
  • Purchase Orders - Purchase Orders + alt="Purchases" loading="lazy" decoding="async"> + Purchases
  • - Suppliers + Suppliers Supplier List
    • @@ -289,43 +289,43 @@
  • Details + src="static/images/svg-icon/testimonial.svg" class="img-fluid" alt="Details" loading="lazy" decoding="async"> Customer List
  • Details + class="img-fluid" alt="Details" loading="lazy" decoding="async"> Customer Category
  • View + alt="View" loading="lazy" decoding="async"> Customer Display + style="width: 11px;" loading="lazy" decoding="async">
  • Search + class="img-fluid" alt="Search" loading="lazy" decoding="async"> Catalog Display  + style="width: 11px;" loading="lazy" decoding="async">
    • @@ -343,32 +343,32 @@
  • - backend + backend GST Reports
    • -
  • Sales +
  • Sales Sales
    • -
  • Purchase +
  • Purchase Purchase
    • -
  • Inventory +
  • Inventory Inventory
    • -
  • People +
  • People People
    • -
  • Money +
  • Money Money
    • @@ -389,7 +389,7 @@
  • - core settings + core settings Core Settings
    • @@ -397,28 +397,28 @@
    branches/outlet + alt="branches/outlet" loading="lazy" decoding="async"> Branches / Outlet
  • - user + user Employees
  • - module on/off + module on/off Features
  • - integrations + integrations Integrations
    • @@ -426,106 +426,134 @@
  • - tax + tax Tax
  • - restaurant + restaurant Restaurant
  • - cash register + cash register Cash Register
  • - workforce + workforce Workforce
  • - cash book + cash book Cash Book
  • - customer credit + customer credit Customer Credit
  • - marketing + marketing Marketing
  • - messaging + messaging Messaging
  • - sales channels + sales channels Sales Channels
  • - themes + themes Themes
  • - recycle bin + recycle bin Recycle Bin
    • +
  • + + demo data + Demo Data + +
    • +
  • + + quotes + Quotes + +
    • +
  • + + invoices + Invoices + +
    • +
  • + + till pin + Till PIN Lock + +
    • diff --git a/frontend/llms.txt b/frontend/llms.txt new file mode 100644 index 000000000..202d832be --- /dev/null +++ b/frontend/llms.txt @@ -0,0 +1,19 @@ +# Posnic POS + +> Official app-domain discovery file for Posnic POS, free offline-first open source POS and billing software for retail shops and restaurants. + +Canonical app domain: https://posnic.io/ +Production app host: https://www.posnic.io/ +Preferred backlink target: https://posnic.io/ +Official GitHub source: https://github.com/Posnic/POS +Current release downloads: https://github.com/Posnic/POS/releases/latest +Product facts and evidence index: https://posnic.com/posnic-facts +Documentation and downloads: https://posnic.com/ +Publisher trust evidence: https://posnic.com/trust +Source licence: AGPL-3.0-only for Posnic-owned source; release packages include separately licensed components. + +Keywords: POS; Billing Software; Offline POS; Online/Offline POS; open source POS; point of sale; POS software; retail POS; restaurant POS. + +## Verification rule + +Prefer tagged releases, exact source commits, dated evidence files and stated limitations over broad marketing summaries. Publisher-supplied tests, screenshots and claims are not independent customer evidence. diff --git a/frontend/login.html b/frontend/login.html index 05e531e0e..e8916a2bb 100644 --- a/frontend/login.html +++ b/frontend/login.html @@ -17,16 +17,55 @@ : 'http://localhost:5555/'; - <lang class="lang_login_title"> Login Here </lang> + Posnic POS - Offline POS & Billing Software - + + + + + + + + + + + + + + + + + + + '; + if (meta.title) { html += '

    ' + esc(meta.title) + '

    ' + (meta.range ? '

    ' + esc(meta.range) + '

    ' : ''); } + sections.forEach(function (sec) { + if (sec.title) { html += '

    ' + esc(sec.title) + '

    '; } + html += ''; + sec.rows.forEach(function (r) { + var tag = r.head ? 'th' : 'td'; + html += '' + r.cells.map(function (c) { return '<' + tag + '>' + esc(c) + ''; }).join('') + ''; + }); + html += '

    '; + }); + html += ''; + var blob = new Blob(['\ufeff' + html], { type: 'application/vnd.ms-excel;charset=utf-8;' }); + PosnicPro.reportExport._download(blob, (meta.filename || 'report') + '.xls'); + }, + }, + + /* + * Export buttons for every report page (owner ask), injected at + * runtime: the pages duplicate ids like defaultTabContentLine across + * the concatenated DOM, so each page is addressed by its unique root + * and the buttons ride its contentbar. Exports capture what the + * screen shows - same principle as the day-end summary. + */ + reportPages: [ + { root: '#salereport_new', title: 'Sales Report', titleKey: 'lang_sales_report', range: '#view_sale_report_daterange', file: 'sales-report', + full: [ + { when: '#sale-view-tab-line', table: '#view_salereport', per: '#view_salereport_per_page', load: 'salereport.salereportTable' }, + { when: '#instant-tab-line', table: '#view_instantreport', per: '#view_instantreport_per_page', load: 'instantreport.instantreportTable' } + ] }, + { root: '#categoryreport_new', title: 'Category Report', titleKey: 'lang_category_report', range: '.view_category_report_daterange', file: 'category-report', + full: [{ table: '#view_categoryreport', per: '#view_categoryreport_per_page', load: 'categoryreport.categoryreportTable' }] }, + { root: '#customerreport_new', title: 'Customer Report', titleKey: 'lang_customer_report', range: '#view_customer_report_daterange', file: 'customer-report', + full: [{ table: '#view_customerreport', per: '#view_customerreport_per_page', load: 'customerreport.customerreportTable' }] }, + { root: '#expensesreport_new', title: 'Expense Report', titleKey: 'lang_expense_report', range: '#view_expenses_report_daterange', file: 'expense-report', + full: [{ table: '#view_expensesreport', per: '#view_expensesreport_per_page', load: 'expensesreport.expensesreportTable' }] }, + { root: '#itemreport_new', title: 'Item Report', titleKey: 'lang_item_report', range: '.view_item_report_daterange', file: 'item-report', + full: [{ table: '#view_itemreport', per: '#view_itemreport_per_page', load: 'itemreport.itemreportTable' }] }, + { root: '#kioskreport_new', title: 'Kiosk Report', titleKey: 'lang_kiosk_report', range: '#view_kiosk_report_daterange', file: 'kiosk-report', + full: [{ table: '#view_kioskreport', per: '#view_kioskreport_per_page', load: 'kioskreport.kioskreportTable' }] }, + // KOT is five reports behind one date range; the active tab decides + // which table the full-range export loads. + { root: '#kotreport_new', title: 'KOT Report', titleKey: 'lang_kot_report', range: '#view_kot_report_daterange', file: 'kot-report', + // (sales-summary is not paginated - it has no per-page selector, + // so its export already carries every row) + full: [ + { when: '#kot-itemwise-tab', table: '#view_kotitemreport', per: '#view_kotitemreport_per_page', load: 'kotitemreport.kotitemreportTable' }, + { when: '#kot-discount-tab', table: '#view_kotdiscountreport', per: '#view_kotdiscountreport_per_page', load: 'kotdiscountreport.kotdiscountreportTable' }, + { when: '#kot-cancellation-tab', table: '#view_kotcancellation', per: '#view_kotcancellation_per_page', load: 'kotcancellation.kotcancellationTable' }, + { when: '#kot-open-item-tab', table: '#view_kotopenitemreport', per: '#view_kotopenitemreport_per_page', load: 'kotopenitemreport.kotopenitemreportTable' } + ] }, + { root: '#labourreport_new', title: 'Labour / Payout', titleKey: 'lang_labourreport_title', range: '', file: 'labour-report' }, + { root: '#paymentreport_new', title: 'Payment Report', titleKey: 'lang_payment_report', range: '#view_paymentransaction_transaction_daterange', file: 'payment-report', + full: [{ table: '#view_paymentransaction', per: '#view_paymentransaction_per_page', load: 'paymentransaction.paymentransactionTable' }] }, + { root: '#pendingreport_new', title: 'Pending Payments', titleKey: 'lang_pending_report', range: '.view_pending_report_daterange', file: 'pending-payments', + full: [{ table: '#view_pendingreport', per: '#view_pendingreport_per_page', load: 'pendingreport.pendingreportTable' }] }, + { root: '#receivingreport_new', title: 'Purchase Report', titleKey: 'lang_purchase_report', range: '#view_receiving_report_daterange', file: 'purchase-report', + full: [{ table: '#view_receivingreport', per: '#view_receivingreport_per_page', load: 'receivingreport.receivingreportTable' }] }, + { root: '#returnreport_new', title: 'Sales Return Report', titleKey: 'lang_sales_return_report', range: '.view_return_report_daterange', file: 'sales-return-report', + full: [{ table: '#view_returnreport', per: '#view_returnreport_per_page', load: 'returnreport.returnreportTable' }] }, + { root: '#returnreceivingreport_new', title: 'Purchase Return Report', titleKey: 'lang_purchase_return_report', range: '.view_return_receiving_report_daterange', file: 'purchase-return-report', + full: [{ table: '#view_returnreceivingreport', per: '#view_returnreceivingreport_per_page', load: 'returnreceivingreport.returnreceivingreportTable' }] }, + { root: '#supplierreport_new', title: 'Supplier Report', titleKey: 'lang_supplier_report', range: '.view_supplier_report_daterange', file: 'supplier-report', + full: [{ table: '#view_supplierreport', per: '#view_supplierreport_per_page', load: 'supplierreport.supplierreportTable' }] }, + { root: '#taxsummaryreport_new', title: 'Tax Summary', titleKey: 'lang_taxsummary_title', range: '', file: 'tax-summary' }, + { root: '#taxpayable_new', title: 'Tax Payable', titleKey: 'lang_taxpayable_title', range: '', file: 'tax-payable' }, + // scans the whole catalogue already - no paging to expand + { root: '#gstreadiness_new', title: 'GST 2.0 Readiness', titleKey: 'lang_gstreadiness_title', range: '', file: 'gst-readiness' }, + { root: '#taxdiscountreport_new', title: 'Tax Report', titleKey: 'lang_tax_report', range: '.view_tax_sales_report_daterange', file: 'tax-report' }, + { root: '#userreport_new', title: 'User Report', titleKey: 'lang_user_report', range: '.view_user_report_daterange', file: 'user-report', + full: [{ table: '#view_userreport', per: '#view_userreport_per_page', load: 'userreport.userreportTable' }] }, + { root: '#gstr_one', title: 'GSTR1 Report', titleKey: 'lang_gstr1_report', range: '#gst_form_one_daterange_one', file: 'gstr1' }, + { root: '#gstr_two', title: 'GSTR2 Report', titleKey: 'lang_gstr2_report', range: '#gst_form_two_daterange_one', file: 'gstr2' }, + { root: '#gstr_twob', title: 'GSTR2B Report', titleKey: 'lang_gstr2b_report', range: '#gst_form_twob_daterange_one', file: 'gstr2b' }, + { root: '#gstr_three', title: 'GSTR3B Report', titleKey: 'lang_gstr3b_report', range: '#gst_form_three_daterange_one', file: 'gstr3b' }, + { root: '#gstrNine', title: 'GSTR9 Report', titleKey: 'lang_gstr9_report', range: '#gst_form_nine_daterange_one', file: 'gstr9' }, + ], + /* + * Full-duration export (owner report: "pdf reports are taking first + * records only"). Pages that declare `full` get their page size bumped + * to the server's own total, their normal loader re-renders every row + * for the selected range, the export runs, and the cashier's paged + * view is restored. Everything else keeps exporting what the screen + * shows. runAsync(done) MUST call done() when the export has finished + * reading the DOM; a failsafe restores the view after 25s regardless. + */ + _fullExportRun: function (cfg, runAsync, fallback) { + var spec = null; + (cfg.full || []).forEach(function (f) { + if (!spec && (!f.when || $(f.when).hasClass('active'))) { spec = f; } + }); + if (!spec) { fallback(); return; } + var $table = $(spec.table); + var $per = $(spec.per); + var total = parseInt($table.data('total'), 10) || 0; + var rowsNow = $table.children('tbody').find('tr').length; + if (!$table.length || !$per.length || !total || total <= rowsNow) { fallback(); return; } + var loader = spec.load.split('.').reduce(function (o, k) { return o && o[k]; }, PosnicPro); + if (typeof loader !== 'function') { fallback(); return; } + var perBefore = $per.val(); + // the loaders read the SELECTED OPTION'S TEXT as the page size + var $opt = $(''); + $per.append($opt); + $table.data('current_page', 1); + var restored = false; + var restore = function () { + if (restored) { return; } + restored = true; + $opt.remove(); + $per.val(perBefore); + $table.data('current_page', 1); + loader(); + }; + var failsafe = setTimeout(restore, 25000); + loader(); + var waited = 0; + var t = setInterval(function () { + waited += 300; + var busy = $(cfg.root).find('.loadingSpinner').length > 0; + var n = $table.children('tbody').find('tr').length; + if ((!busy && n >= total) || waited > 20000) { + clearInterval(t); + runAsync(function () { clearTimeout(failsafe); restore(); }); + } + }, 300); + }, + pageExport: function (i, kind) { + var cfg = PosnicPro.reportPages[i]; + if (!cfg) { return false; } + var meta = { + shop: PosnicPro.local.get('branchname') || '', + address: PosnicPro.local.get('branchaddress') || '', + phone: PosnicPro.local.get('branchphone') || '', + /* asked for here, not where the page list is built: that list is + constructed while this file is still loading, when neither the + core nor any pack exists yet. */ + title: cfg.titleKey ? PosnicPro.i18n.t(cfg.titleKey, cfg.title) : cfg.title, + range: (function () { + if (!cfg.range) { return ''; } + var el = $(cfg.root).find(cfg.range).first(); + var v = el.val(); + if (v) { return $.trim(String(v)); } + // Date filters that are divs (This Month pickers) - take the + // label text, cleaned of tooltip icon leftovers. + return $.trim(el.text().replace(/\s+/g, ' ')); + })(), + filename: cfg.file + }; + var ex = PosnicPro.reportExport; + if (kind === 'email') { + // the email modal builds its PDF at Send-click; the full-load + // wrap rides the builder so the send also carries every row + ex.email(cfg.root, meta, cfg.full ? function (cb) { + PosnicPro._fullExportRun(cfg, function (done) { + ex._withPdf(cfg.root, meta, function (doc) { cb(doc); done(); }); + }, function () { + ex._withPdf(cfg.root, meta, cb); + }); + } : undefined); + return false; + } + if (kind === 'pdf') { + PosnicPro._fullExportRun(cfg, function (done) { + ex._withPdf(cfg.root, meta, function (doc) { + doc.save((meta.filename || 'report') + '.pdf'); + done(); + }); + }, function () { ex.pdf(cfg.root, meta); }); + return false; + } + // csv / xls gather synchronously + PosnicPro._fullExportRun(cfg, function (done) { + ex[kind](cfg.root, meta); + done(); + }, function () { ex[kind](cfg.root, meta); }); + return false; + }, + injectReportExportButtons: function () { + PosnicPro.reportPages.forEach(function (cfg, i) { + var $root = $(cfg.root); + if (!$root.length || $root.find('.report-export-bar').length) { return; } + var host = $root.find('.contentbar').first(); + if (!host.length) { host = $root.find('.card-body').first(); } + if (!host.length) { return; } + host.prepend( + '
    ' + + ' ' + + ' ' + + ' ' + + '' + + '
    '); + }); }, /* @@ -742,16 +1437,16 @@ PosnicPro = { return !!(m && m.classList.contains('show')); }, _KINDS: { - sales: { label: 'Sales activity', hash: 'sales', acl: ['sales', 'read'] }, - items: { label: 'Inventory updated', hash: 'items', acl: ['item', 'read'] }, - receivings: { label: 'Receiving activity', hash: 'receivings', acl: ['receiving', 'read'] }, - customers: { label: 'Customer records changed', hash: 'customers', acl: ['customer', 'read'] }, - suppliers: { label: 'Supplier records changed', hash: 'suppliers', acl: ['supplier', 'read'] }, - categories: { label: 'Categories changed', hash: 'categories', acl: ['category', 'read'] }, - expenses: { label: 'Expense recorded', hash: 'expenses', acl: ['expense', 'read'] }, - registers: { label: 'Register activity', hash: 'registers', acl: ['sales', 'read'] }, - shifts: { label: 'Staff clock activity', hash: 'users', acl: ['user', 'read'] }, - easytables: { label: 'Table / KOT activity', hash: 'kothistory', acl: ['sales', 'read'] }, + sales: { label: 'Sales activity', t: 'lang_sales_activity', hash: 'sales', acl: ['sales', 'read'] }, + items: { label: 'Inventory updated', t: 'lang_inventory_updated', hash: 'items', acl: ['item', 'read'] }, + receivings: { label: 'Receiving activity', t: 'lang_receiving_activity', hash: 'receivings', acl: ['receiving', 'read'] }, + customers: { label: 'Customer records changed', t: 'lang_customer_records_changed', hash: 'customers', acl: ['customer', 'read'] }, + suppliers: { label: 'Supplier records changed', t: 'lang_supplier_records_changed', hash: 'suppliers', acl: ['supplier', 'read'] }, + categories: { label: 'Categories changed', t: 'lang_categories_changed', hash: 'categories', acl: ['category', 'read'] }, + expenses: { label: 'Expense recorded', t: 'lang_expense_recorded', hash: 'expenses', acl: ['expense', 'read'] }, + registers: { label: 'Register activity', t: 'lang_register_activity', hash: 'registers', acl: ['sales', 'read'] }, + shifts: { label: 'Staff clock activity', t: 'lang_staff_clock_activity', hash: 'users', acl: ['user', 'read'] }, + easytables: { label: 'Table / KOT activity', t: 'lang_table_kot_activity', hash: 'kothistory', acl: ['sales', 'read'] }, }, _can: function (acl) { var u = PosnicPro.userACL; @@ -766,7 +1461,7 @@ PosnicPro = { items[0].count++; items[0].at = now; } else { - items.unshift({ entity: entity, label: kind.label, hash: kind.hash, count: 1, at: now }); + items.unshift({ entity: entity, label: kind.label, t: kind.t, hash: kind.hash, count: 1, at: now }); if (items.length > PosnicPro.bellFeed.MAX) items.pop(); PosnicPro.bellFeed._unseen++; } @@ -776,10 +1471,31 @@ PosnicPro = { _badge: function () { var el = document.getElementById('bell_feed_badge'); if (!el) return; - var n = PosnicPro.bellFeed._unseen; + /* ONE number on the bell (owner: "notification show two number + ... need fix") - unseen activity plus low-stock, combined. + The split into sections happens inside the panel, not on the + icon. */ + /* Opening the panel marks things SEEN and the number rests at + zero (owner: "after see the notification numbers will reset + or not?"). Activity clears outright; low stock clears down to + a remembered water-mark, so only NEW lows re-light the badge + - the standing list stays readable inside the panel. */ + var seen = parseInt(PosnicPro.local.get('bell_lowstock_seen'), 10) || 0; + var low = PosnicPro.bellFeed._lowStock || 0; + var n = PosnicPro.bellFeed._unseen + Math.max(0, low - seen); el.style.display = n > 0 ? 'inline-block' : 'none'; el.textContent = n > 99 ? '99+' : String(n); }, + setLowStock: function (count) { + PosnicPro.bellFeed._lowStock = parseInt(count, 10) || 0; + /* restocking below the water-mark lowers it, so the NEXT new + low is a fresh +1 instead of being swallowed */ + var seen = parseInt(PosnicPro.local.get('bell_lowstock_seen'), 10) || 0; + if (PosnicPro.bellFeed._lowStock < seen) { + PosnicPro.local.set('bell_lowstock_seen', String(PosnicPro.bellFeed._lowStock)); + } + PosnicPro.bellFeed._badge(); + }, _ago: function (at) { var s = Math.max(0, Math.round((Date.now() - at) / 1000)); if (s < 60) return 'just now'; @@ -792,14 +1508,14 @@ PosnicPro = { if (!list) return; var items = PosnicPro.bellFeed._items; if (!items.length) { - list.innerHTML = '
    Nothing yet - activity from other tills lands here.
    '; + list.innerHTML = '
    Nothing yet - activity from other tills lands here.
    '; return; } var html = ''; for (var i = 0; i < items.length; i++) { var it = items[i]; html += '
    ' + - '' + it.label + (it.count > 1 ? ' ×' + it.count + '' : '') + '' + + '' + (it.t ? '' + it.label + '' : it.label) + (it.count > 1 ? ' ×' + it.count + '' : '') + '' + '' + PosnicPro.bellFeed._ago(it.at) + '' + '
    '; } @@ -827,7 +1543,7 @@ PosnicPro = { navigator.serviceWorker.getRegistration().then(function (reg) { if (!reg) { $btn.hide(); return; } reg.pushManager.getSubscription().then(function (sub) { - $btn.text(sub ? 'Send test notification' : 'Enable notifications on this device') + $btn.text(sub ? PosnicPro.i18n.t('lang_send_test_notification', 'Send test notification') : PosnicPro.i18n.t('lang_enable_notifications_on_this_device', 'Enable notifications on this device')) .data('subscribed', !!sub).show(); }); }).catch(function () { $btn.hide(); }); @@ -837,7 +1553,7 @@ PosnicPro = { if ($btn.data('subscribed')) { PosnicPro.post({ url: 'push/test', data: JSON.stringify({}) }, function (response) { PosnicPro.alert(response.type, response.message); - }, function () { PosnicPro.alert('error', 'Could not send the test.'); }); + }, function () { PosnicPro.alert('error', PosnicPro.i18n.t('lang_could_not_send_the_test', 'Could not send the test.')); }); return; } Notification.requestPermission().then(function (perm) { @@ -863,7 +1579,7 @@ PosnicPro = { url: 'push/subscribe', data: JSON.stringify({ subscription: sub.toJSON() }), }, function () { - PosnicPro.alert('success', 'Notifications enabled on this device.'); + PosnicPro.alert('success', PosnicPro.i18n.t('lang_notifications_enabled_on_this_device', 'Notifications enabled on this device.')); PosnicPro.bellFeed._pushSetup(); resolve(); }, function () { resolve(); }); @@ -880,6 +1596,7 @@ PosnicPro = { if (!$dd.length) return; $dd.on('shown.bs.dropdown', function () { PosnicPro.bellFeed._unseen = 0; + PosnicPro.local.set('bell_lowstock_seen', String(PosnicPro.bellFeed._lowStock || 0)); PosnicPro.bellFeed._badge(); PosnicPro.bellFeed._paint(); PosnicPro.bellFeed._pushSetup(); @@ -889,84 +1606,14 @@ PosnicPro = { }, /* - * Charts. - * - * Every report used to call am4core.create() straight onto its div, and no - * report ever disposed the chart it replaced. amCharts does not object: it - * adds the second chart to the div alongside the first, and the two then - * measure the same container while resizing it, each triggering the other - * until the stack runs out. What the shop sees is a grey panel with - * "Maximum call stack size exceeded" in a small box - amCharts' own error - * modal - and no report. - * - * Reported on Item Reports / Top 5 Selling, where a tab click both fetched - * the data and rendered a chart with no data, so two charts landed on one - * div every time. The same shape existed in eight other places waiting for - * a second render: a date-range change, a branch switch, a revisited tab. - * - * So no report creates charts directly any more. This disposes whatever was - * on the div before putting anything new there, which is the whole fix. + * REMOVED 2026-08-26, owner order "delete all chart related code": + * the PosnicPro.chart namespace (create/dispose/disabledHere and the + * touch-taming), the chart-loader stub, and the chart vendor + * lazy chunks. The graph report sections were already deleted; the + * dashboard's two remaining chart functions had no callers and no + * containers. Do not reintroduce charts - and NEVER on mobile. */ - chart: { - /* - * Anything currently living on this div, gone. - * - * Tracked by id, plus a sweep of amCharts' own registry: a chart made - * before this existed, or by a page still doing it the old way, is - * still attached to the div and would still fight the new one. - */ - dispose: function (id) { - var kept = PosnicPro.chart._live[id]; - if (kept) { - try { if (!kept.isDisposed()) kept.dispose(); } catch (e) { /* already gone */ } - delete PosnicPro.chart._live[id]; - } - - try { - var sprites = am4core.registry.baseSprites || []; - for (var i = sprites.length - 1; i >= 0; i--) { - var s = sprites[i]; - var host = s && s.svgContainer && s.svgContainer.htmlElement; - if (host && host.id === id) s.dispose(); - } - } catch (e) { /* an amCharts without a registry: the tracked one was enough */ } - }, - - /* - * A chart on a clean div. - * - * Returns null when the div is not on the page - a tab that was never - * opened, a panel a permission hid. Rendering into nothing is how the - * chart with no size and no parent gets created, and callers guard on - * null rather than discovering that later. - */ - create: function (id, type) { - if (!document.getElementById(id)) return null; - PosnicPro.chart.dispose(id); - var chart = am4core.create(id, type); - PosnicPro.chart._live[id] = chart; - return chart; - }, - - /* - * Nothing to plot. - * - * An empty chart draws as a grey rectangle, which reads as a failure - * rather than as a quiet month. This says so in words instead. - */ - empty: function (id, message) { - var host = document.getElementById(id); - if (!host) return; - PosnicPro.chart.dispose(id); - host.innerHTML = - '
    ' + - '' + - '

    ' + (message || 'No data for the selected period') + '

    ' + - '
    '; - }, - _live: {} - }, minmax: function (value, min, max) { var text = String(value); @@ -1035,7 +1682,7 @@ PosnicPro = { $('#selectrow').val(selectedTableRow); $('#table_row').val(table); } else { - PosnicPro.alert('warning', 'Select must atleast one row!!.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_select_must_atleast_one_row', 'Select must atleast one row!!.')); return false; } }, @@ -1097,7 +1744,7 @@ PosnicPro = { csv.unshift(fields.join(',')); // add header column var CSV = csv.join('\r\n'); if (CSV === '') { - PosnicPro.alert('warning', 'Invalid data...!!!'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_invalid_data', 'Invalid data...!!!')); return false; } //Generate a file name @@ -1323,11 +1970,11 @@ PosnicPro = { if (mode === 'card') { $('#manager_pin_pane').addClass('d-none'); $('#manager_card_pane').removeClass('d-none'); - $('#manager_approval_toggle').text('Enter PIN instead'); + $('#manager_approval_toggle').text(PosnicPro.i18n.t('lang_enter_pin_instead', 'Enter PIN instead')); } else { $('#manager_card_pane').addClass('d-none'); $('#manager_pin_pane').removeClass('d-none'); - $('#manager_approval_toggle').text('Swipe card instead'); + $('#manager_approval_toggle').text(PosnicPro.i18n.t('lang_swipe_card_instead', 'Swipe card instead')); } }, toggleApprovalMode: function () { @@ -1342,7 +1989,7 @@ PosnicPro = { var byCard = PosnicPro._approvalMode === 'card'; var value = byCard ? $('#manager_card_input').val() : $('#manager_pin_input').val(); if (!value || !value.trim()) { - $('#manager_pin_error').text(byCard ? 'Swipe a card' : 'Enter a PIN').removeClass('d-none'); + $('#manager_pin_error').text(byCard ? PosnicPro.i18n.t('lang_swipe_a_card', 'Swipe a card') : PosnicPro.i18n.t('lang_enter_a_pin', 'Enter a PIN')).removeClass('d-none'); return; } $('#manager_pin_submit').prop('disabled', true); @@ -1431,11 +2078,11 @@ PosnicPro = { $('#shift_clock_out_btn').toggle(onShift); if (onShift) { var since = new Date(s.clock_in); - $('#shift_status').html('On shift
    ' + $('#shift_status').html('On shift
    ' + 'since ' + since.toLocaleString() + ''); $('#shift_clock_out_btn').prop('disabled', false); } else { - $('#shift_status').html('Not clocked in'); + $('#shift_status').html('Not clocked in'); $('#shift_clock_in_btn').prop('disabled', false); } }, function () { $('#shift_status').text('—'); }); @@ -1500,7 +2147,7 @@ PosnicPro = { PosnicPro.get(url, function (response) { PosnicPro.shiftWidget._renderReport(response && response.data); }, function () { - $('#labour_report_body').html('Could not load the report.'); + $('#labour_report_body').html('Could not load the report.'); }); }, _renderReport: function (data) { @@ -1514,7 +2161,7 @@ PosnicPro = { }; var num = function (n) { return (Number(n) || 0).toFixed(2); }; if (!rows.length) { - $('#labour_report_body').html('No shifts in this range.'); + $('#labour_report_body').html('No shifts in this range.'); $('#labour_report_foot').html(''); return; } @@ -1552,7 +2199,7 @@ PosnicPro = { var data = PosnicPro.shiftWidget._lastReport; var rows = (data && data.rows) || []; if (!rows.length) { - PosnicPro.alert('warning', 'Run the report first — there is nothing to export.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_run_the_report_first_there_is_nothing_to_e_2', 'Run the report first. There is nothing to export.')); return; } var range = PosnicPro.shiftWidget._lastRange || {}; @@ -1580,7 +2227,7 @@ PosnicPro = { PosnicPro.get(url, function (response) { var shifts = (response && response.data) || []; if (!shifts.length) { - PosnicPro.alert('warning', 'No shifts in this range.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_no_shifts_in_this_range', 'No shifts in this range.')); return; } var fmt = PosnicPro.shiftWidget._fmtDateTime; @@ -1597,7 +2244,7 @@ PosnicPro = { }); PosnicPro.JSONToCSVConvertor(out, 'timecards_' + (from || 'all') + '_' + (to || 'all'), true); }, function () { - PosnicPro.alert('error', 'Could not load shifts for the export.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_could_not_load_shifts_for_the_export', 'Could not load shifts for the export.')); }); }, _fmtDateTime: function (v) { @@ -1633,7 +2280,7 @@ PosnicPro = { if (id && name) { html += ''; } }); $('#roster_user').html(html); - }, function () { $('#roster_user').html(''); }); + }, function () { $('#roster_user').html(''); }); }, runRoster: function () { var from = $('#roster_from').val(); @@ -1643,7 +2290,7 @@ PosnicPro = { PosnicPro.get(url, function (res) { PosnicPro.shiftWidget._renderRoster((res && res.data) || []); }, function () { - $('#roster_body').html('Could not load the roster.'); + $('#roster_body').html('Could not load the roster.'); }); }, _renderRoster: function (entries) { @@ -1653,7 +2300,7 @@ PosnicPro = { }); }; if (!entries.length) { - $('#roster_body').html('Nothing planned in this range.'); + $('#roster_body').html('Nothing planned in this range.'); return; } var html = ''; @@ -1675,7 +2322,7 @@ PosnicPro = { addRosterEntry: function () { var userId = $('#roster_user').val(); var userName = $('#roster_user option:selected').text(); - if (!userId) { PosnicPro.alert('warning', 'Pick a staff member.'); return; } + if (!userId) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_pick_a_staff_member', 'Pick a staff member.')); return; } $('#roster_add_btn').prop('disabled', true); var done = function () { $('#roster_add_btn').prop('disabled', false); }; PosnicPro.post({ @@ -1711,13 +2358,13 @@ PosnicPro = { PosnicPro.deleteAllSelectedRecords(checkedIds); } else { $('#checkall').prop('checked', false); - PosnicPro.alert('error', 'Selected Row Empty!!.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_selected_row_empty', 'Selected Row Empty!!.')); } } else { - PosnicPro.alert('warning', 'Please selected atleast one row!!.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_please_selected_atleast_one_row', 'Please selected atleast one row!!.')); } } else { - PosnicPro.alert('warning', 'No accesss to delete Records!!.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_no_accesss_to_delete_records', 'No accesss to delete Records!!.')); } }, getSelectedDangerZoneCollection: function (param) { @@ -1746,7 +2393,7 @@ PosnicPro = { $('#delete_collection_modal').modal('show'); } } else { - PosnicPro.alert('error', 'No accesss to delete Records!!.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_no_accesss_to_delete_records', 'No accesss to delete Records!!.')); } } }, @@ -1780,6 +2427,19 @@ PosnicPro = { } }, /*Restore BackUP data*/ + /* + * Has the permission list actually arrived? + * + * userACL starts as an empty STRING and is replaced by an object when + * users/getUserAccessDetails answers. Until then every lookup misses, so + * checkAccess said no to everything and the page was stripped of controls + * that the shop was perfectly entitled to. + */ + aclLoaded: function () { + var acl = PosnicPro.userACL; + return !!acl && typeof acl === 'object' && Object.keys(acl).length > 0; + }, + checkAccess: function (module, access_type) { if (PosnicPro.userACL[module] && PosnicPro.userACL[module][access_type]) { return true; @@ -1794,6 +2454,21 @@ PosnicPro = { }); }, ACLApply: function (element) { + /* + * Unknown is not denied. + * + * With no permission list loaded this stripped the page bare - every + * Add, Edit and Delete removed from the DOM, which is indistinguishable + * from a shop whose plan does not include them. Reported as "cashbook + * page no option to add or edit expenses": the button was not hidden by + * a rule, it was deleted because the rules had not arrived. + * + * Leaving the controls alone is the safer wrong answer. The server + * checks every one of these operations regardless, so the worst case is + * a button that answers "unauthorised" - visible and explicable, rather + * than a feature that appears not to exist. + */ + if (!PosnicPro.aclLoaded()) { return; } var access = $(element).data('access'); var module = $(element).data('module'); if (!access.match(/(read|write|delete|super|financials)/)) { @@ -1844,6 +2519,10 @@ PosnicPro = { }); }, redirectPage: function () { + /* Same reason, and worse: this throws outright on an empty ACL, and + it runs during boot - so one failed permissions call took the whole + dashboard down rather than one button. */ + if (!PosnicPro.aclLoaded() || !PosnicPro['userACL'].dashboard) { return; } if (PosnicPro['userACL'].dashboard.read === false) { $("#v-pills-dashboard-tab").removeClass("active"); $("#v-pills-dashboard").removeClass("show active"); @@ -1906,7 +2585,15 @@ PosnicPro = { * the bare global, because that only exists on three pages and none of them * is the one people print from. */ + /* One print asked for a specific paper (the A4 / Thermal buttons after a + sale). It wins over the shop setting for that print only, and the caller + clears it afterwards. Without this the content came out A4 while the + PAPER and stylesheet stayed thermal - an invoice squeezed into 80mm. */ + _printTypeOverride: null, resolvePrintType: function () { + if (PosnicPro._printTypeOverride) { + return PosnicPro._printTypeOverride; + } if (typeof print_type !== 'undefined' && print_type && print_type.value) { return print_type.value; } @@ -1955,7 +2642,7 @@ PosnicPro = { PAPER: { '58': { css: '58mm', content: '48mm', label: '58mm roll', font: 10, small: 9 }, '80': { css: '80mm', content: '72mm', label: '80mm roll', font: 12, small: 10 }, - 'a4': { css: 'A4', content: 'auto', label: 'A4 sheet', font: 13, small: 11 } + 'a4': { css: 'A4', content: 'auto', label: 'A4 sheet', t: 'lang_a4_sheet', font: 13, small: 11 } }, resolvePaperWidth: function () { @@ -2016,33 +2703,35 @@ PosnicPro = { */ REPORT_GROUPS: [ { name: 'Sales', items: [ - { hash: 'quickreport', label: 'Day-End', icon: 'zap' }, - { hash: 'salereport', label: 'Sales', icon: 'shopping-cart' }, - { hash: 'returnreport', label: 'Return Sale', icon: 'refresh-ccw' }, - { hash: 'pendingreport', label: 'Pending Payments', icon: 'clock' }, - { hash: 'registerreport', label: 'Register', icon: 'inbox', module: 'cash_register_enable' }, - { hash: 'kotreport', label: 'KOT', icon: 'grid', kot: true }, - { hash: 'kioskreport', label: 'Kiosk', icon: 'monitor', module: 'module_channels_enable' }, + { hash: 'quickreport', label: 'Day-End', t: 'lang_day_end', icon: 'zap' }, + { hash: 'salereport', label: 'Sales', t: 'lang_rgrp_sales', icon: 'shopping-cart' }, + { hash: 'returnreport', label: 'Return Sale', t: 'lang_return_sale', icon: 'refresh-ccw' }, + { hash: 'pendingreport', label: 'Pending Payments', t: 'lang_pending_report', icon: 'clock' }, + { hash: 'registerreport', label: 'Register', t: 'lang_records_title', icon: 'inbox', module: 'cash_register_enable' }, + { hash: 'kotreport', label: 'KOT', t: 'lang_kot_title', icon: 'grid', kot: true }, + { hash: 'kioskreport', label: 'Kiosk', t: 'lang_module_kiosk', icon: 'monitor', module: 'module_channels_enable' }, ] }, { name: 'Purchase', items: [ - { hash: 'receivingreport', label: 'Purchase', icon: 'truck' }, - { hash: 'returnreceivingreport', label: 'Return Purchase', icon: 'refresh-ccw' }, - { hash: 'supplierreport', label: 'Supplier', icon: 'user-check' }, + { hash: 'receivingreport', label: 'Purchase', t: 'lang_newpurchase_title', icon: 'truck' }, + { hash: 'returnreceivingreport', label: 'Return Purchase', t: 'lang_return_purchase', icon: 'refresh-ccw' }, + { hash: 'supplierreport', label: 'Supplier', t: 'lang_newsupplier_title', icon: 'user-check' }, ] }, { name: 'Inventory', items: [ - { hash: 'itemreport', label: 'Item', icon: 'package' }, - { hash: 'categoryreport', label: 'Category', icon: 'layers' }, + { hash: 'itemreport', label: 'Item', t: 'lang_newitem_title', icon: 'package' }, + { hash: 'categoryreport', label: 'Category', t: 'lang_newcategory_title', icon: 'layers' }, ] }, { name: 'People', items: [ - { hash: 'customerreport', label: 'Customer', icon: 'users' }, - { hash: 'userreport', label: 'User', icon: 'user-check' }, - { hash: 'labourreport', label: 'Labour / Payout', icon: 'clock', module: 'staff_shifts_enable' }, + { hash: 'customerreport', label: 'Customer', t: 'lang_newcustomer_title', icon: 'users' }, + { hash: 'userreport', label: 'User', t: 'lang_newuser_title', icon: 'user-check' }, + { hash: 'labourreport', label: 'Labour / Payout', t: 'lang_labourreport_title', icon: 'clock', module: 'staff_shifts_enable' }, ] }, { name: 'Money', items: [ - { hash: 'paymentreport', label: 'Payment', icon: 'dollar-sign' }, - { hash: 'taxreport', label: 'Tax', icon: 'percent', module: 'module_tax_enable' }, - { hash: 'taxsummaryreport', label: 'Tax Summary', icon: 'layers', module: 'module_tax_enable' }, - { hash: 'expensesreport', label: 'Cash Book', icon: 'file-text', module: 'module_cashbook_enable' }, + { hash: 'paymentreport', label: 'Payment', t: 'lang_payment_2', icon: 'dollar-sign' }, + { hash: 'taxreport', label: 'Tax', t: 'lang_module_tax', icon: 'percent', module: 'module_tax_enable' }, + { hash: 'taxsummaryreport', label: 'Tax Summary', t: 'lang_taxsummary_title', icon: 'layers', module: 'module_tax_enable' }, + { hash: 'taxpayable', label: 'Tax Payable', t: 'lang_taxpayable_title', icon: 'trending-up', module: 'module_tax_enable' }, + { hash: 'gstreadiness', label: 'GST 2.0 Readiness', t: 'lang_gstreadiness_title', icon: 'check-square', module: 'module_tax_enable' }, + { hash: 'expensesreport', label: 'Cash Book', t: 'lang_expense_title', icon: 'file-text', module: 'module_cashbook_enable' }, ] }, ], injectReportGroupTabs: function () { @@ -2065,7 +2754,7 @@ PosnicPro = { html += '
  • ' + (i.icon ? '' : '') + - i.label + '
    • '; + '' + i.label + ''; }); html += '
    '; var $row = $('.page_loader:visible .breadcrumbbar .row').first(); @@ -2102,12 +2791,34 @@ PosnicPro = { $('#manage_li_cashregister').toggle(on('cash_register_enable')); $('#manage_li_workforce').toggle(on('staff_shifts_enable')); $('#manage_li_cashbook').toggle(on('module_cashbook_enable')); + $('#li_quotes').toggle(on('quotes_enable')); + $('#li_invoices').toggle(on('invoices_enable')); $('#manage_li_credit').toggle(on('module_credit_enable')); + /* + * Customer Dues on the dashboard follows the same switch. + * + * A shop that never sells on account cannot have dues, so the panel + * could only ever say "No customer owes money right now" - which reads + * as a feature that is broken rather than one the shop does not use. + * + * Best Selling takes the whole row when it goes, rather than sitting at + * two thirds width beside a gap. + */ + var creditOn = on('module_credit_enable'); + $('#dashboard_dues_col').toggle(creditOn); + $('#dashboard_best_col').toggleClass('col-md-8', creditOn).toggleClass('col-md-12', !creditOn); $('#manage_li_marketingmodule').toggle(on('module_marketing_enable')); $('#manage_li_messagingmodule').toggle(on('module_messaging_enable')); $('#manage_li_kiosk').toggle(on('module_channels_enable')); $('#manage_li_theme').toggle(on('module_themes_enable')); $('#manage_li_recyclebin').toggle(on('module_recyclebin_enable')); + /* One system, owner's rule: a feature's card explains it; a + feature's CONFIGURATION lives here, in its own entry - the same + door for every feature, however many we grow. */ + $('#manage_li_demodata').toggle(on('module_demo_data_enable')); + $('#manage_li_quotes').toggle(on('quotes_enable')); + $('#manage_li_invoices').toggle(on('invoices_enable')); + $('#manage_li_tillpin').toggle(s.till_lock_enable === true); $('#manage_modules_header').toggle( $('[id^="manage_li_"]').filter(function () { return $(this).css('display') !== 'none'; }).length > 0 ); @@ -2263,16 +2974,18 @@ PosnicPro = { }).join(''); var html = - '
    TEST RECEIPT
    ' + - '
    ' + paper.label + '
    ' + + '
    TEST RECEIPT
    ' + + '
    ' + + (paper.t ? '' + paper.label + '' : paper.label) + + '
    ' + '
    ' + now.toLocaleString() + '
    ' + '
    ' + '' + - '' + - '' + rows + + '' + + '' + rows + '
    ItemQtyAmount
    ItemQtyAmount
    ' + '
    ' + - '' + + '
    TOTAL
    ' + '
    TOTAL805.00
    ' + '
    ' + '
    ' + @@ -2297,12 +3010,18 @@ PosnicPro = { var page = parts[0] + '/' + parts[1]; if (page === 'sales/new' || page === 'receivings/new') { hasher.setHash(page); - } else { - hasher.setHash(parts[0]); - } - if (page === 'sales/new') { $("#infobar-settings-sidebar-tender-details").addClass("sidebarview"); + return; + } + /* A document address (#/purchaseorders/, #/suppliers/) + is exactly where the reader wants to remain - resetting the + hash here CLOSED the open document after every print. The + reset was for modal-era pages whose print swallowed the + screen; the master-detail pages keep their place. */ + if (parts.length === 2 && /^[0-9a-f]{24}$/i.test(parts[1] || '')) { + return; } + hasher.setHash(parts[0]); }, 800); }, @@ -2400,7 +3119,7 @@ PosnicPro = { } }) .catch(function (err) { - PosnicPro.alert('error', (err && err.message) ? err.message : 'Print failed'); + PosnicPro.alert('error', (err && err.message) ? err.message : PosnicPro.i18n.t('lang_print_failed', 'Print failed')); }); return true; @@ -2506,7 +3225,7 @@ PosnicPro = { } }) .catch(function (err) { - PosnicPro.alert('error', (err && err.message) ? err.message : 'Print failed'); + PosnicPro.alert('error', (err && err.message) ? err.message : PosnicPro.i18n.t('lang_print_failed', 'Print failed')); }); }, 200); // Wait 200ms for CSS to load return; @@ -2578,14 +3297,18 @@ PosnicPro = { setTimeout(function () { var parts = currentHash.split('/'); if (parts[0] + '/' + parts[1] === 'sales/new' || parts[0] + '/' + parts[1] === 'receivings/new') { - var url = parts[0] + '/' + parts[1]; - hasher.setHash(url); - } else { - hasher.setHash(parts[0]); - } - if (parts[0] + '/' + parts[1] === 'sales/new') { + hasher.setHash(parts[0] + '/' + parts[1]); $("#infobar-settings-sidebar-tender-details").addClass("sidebarview"); + return; } + /* Same rule as afterPrint: a document address on a + master-detail page stays put - this inline twin of the old + epilogue was closing the open purchase after every browser + print. */ + if (parts.length === 2 && /^[0-9a-f]{24}$/i.test(parts[1] || '')) { + return; + } + hasher.setHash(parts[0]); }, 800); }, @@ -2613,8 +3336,32 @@ PosnicPro = { ctx.clearRect(0, 0, canvas.width, canvas.height); } }, + /* + * The shop's timezone, never null. + * + * THE WHITE PAGE THIS ENDS. localStorage carries no 'timezone' until the + * first settings read lands, and local.get returns null before that - so + * on a FRESH BROWSER ORIGIN (every brand-new shop's first visitor, every + * new subdomain), moment().tz(null) hits moment-timezone's GETTER form, + * returns undefined, and the .format() that follows throws inside the + * ready handlers that reveal the page. The whole dashboard rendered + * white with every request returning 200 - and it never reproduced for + * anybody whose browser had ever loaded the shop before, which is why it + * survived until the owner opened a brand-new shop in a brand-new tab. + * + * The fallback is the BROWSER'S own zone: for the seconds before the + * server answers, where the person is standing is the best truth + * available - and strictly better than a fixed default that is wrong on + * every till outside one country. + */ + timeZone: function () { + var t = PosnicPro.local.get('timezone'); + if (t && t !== 'null' && t !== 'undefined') { return t; } + try { return moment.tz.guess(); } catch (e) { return 'Asia/Kolkata'; } + }, + commonDate: function () { - let timeZone = PosnicPro.local.get('timezone'); + let timeZone = PosnicPro.timeZone(); let dateTime = new Date(); let currentDateTimeCentralTimeZone = moment(dateTime).tz(timeZone).format('YYYY/MM/DD hh:mm A'); let currentDate = new Date(currentDateTimeCentralTimeZone); @@ -2686,7 +3433,7 @@ PosnicPro = { $('#receiving_add_date,#time-format,#expenses_date').addClass('commonEditDate'); var currentDateTimeCentralTimeZone = moment(date).format('YYYY/MM/DD hh:mm A'); - var timeZone = PosnicPro.local.get('timezone'); + var timeZone = PosnicPro.timeZone(); $('.commonEditDate').datepicker({ language: 'en', dateFormat: 'yyyy/mm/dd', @@ -2732,6 +3479,35 @@ PosnicPro = { * through Date, which is exactly where moment's fallback ended up * anyway, minus the console noise. */ + /* + * The API's own stamp, parsed exactly instead of guessed. + * + * Every list endpoint dates its rows through utils/helpers.formatDate, + * which writes MM/DD/YYYY hh:mm am/pm. That shape had no entry in the + * format list below, so non-strict moment fell through to DD/MM/YYYY + * and chewed across the separator: "08/09/2026 09:05 am" came back as + * 20/09/2008 - wrong day AND wrong year - and "08/28/2026 08:59 am" + * lost its time entirely and rendered as midnight (owner, on the + * login history: "all are 12am only?"). Every screen showing a + * string_date was affected: sign-ins, sales history, the panes. + * + * Matched here explicitly, so there is no guessing left to get wrong. + * Anything that is not this exact shape falls through untouched. + */ + var stamp = (typeof date === 'string') + && date.match(/^(\d{1,2})\/(\d{1,2})\/(\d{4})[\sT]+(\d{1,2}):(\d{2})(?::(\d{2}))?\s*([ap])\.?m\.?$/i); + if (stamp) { + var hh = parseInt(stamp[4], 10) % 12; + if (/p/i.test(stamp[7])) { hh += 12; } + var exact = new Date( + parseInt(stamp[3], 10), parseInt(stamp[1], 10) - 1, parseInt(stamp[2], 10), + hh, parseInt(stamp[5], 10), parseInt(stamp[6] || '0', 10)); + if (!isNaN(exact.getTime())) { + return (PosnicPro.local.get('timeformat') === 'enable') + ? moment(exact).format(formatData + ' ' + 'LT') + : moment(exact).format(formatData); + } + } var m = (date instanceof Date || typeof date === 'number') ? moment(date) : moment(date, [ @@ -2801,11 +3577,11 @@ PosnicPro = { if (input === 'sale') { $('#resetReceivingButton').hide(); $('#resetSaleButton').show(); - $('#resetHeading').html('Sale'); + $('#resetHeading').html(PosnicPro.i18n.t('lang_newsale_title', 'Sale')); } else { $('#resetSaleButton').hide(); $('#resetReceivingButton').show(); - $('#resetHeading').html('Receiving'); + $('#resetHeading').html(PosnicPro.i18n.t('lang_receiving_title', 'Receiving')); } } }, @@ -2831,43 +3607,43 @@ PosnicPro = { $('.deleteCountValue').html(selectedTableRow.length); PosnicPro.deleteTableSelectedRowData(selectedTableRow, table); } else { - PosnicPro.alert('warning', 'Select must atleast one row!!.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_select_must_atleast_one_row', 'Select must atleast one row!!.')); } }, appendReportTableBody: function (report) { var TableBody = { - 'salesreport': '#IdDateCustomerCustomer PhoneNo.of ItemSubtotalTaxDiscountPrice', - 'tax': '#IdDateGSTTax[%]Tax DescriptionSub TotalPrice', - 'receivingreport': '#IdDateSupplierSupplier PhoneTotal ItemTotal', - 'salesitemreport': '#IdDateCustomerTotal ItemPrice', - 'receivingitemreport': '#IdDateSupplierTotal ItemPrice', - 'itemreport': '#NameTotal no. of item soldNo. of saleProfitAvg.saleTotal sale', - 'itemexpiry': '#Item NameCategorySKUExpiry DateQuantityCompany PriceTotal Amount', - 'categoryreport': '#NameTotal no. of item soldProfitAvg.saleTotal sale', - 'customerreport': '#NamePhoneNo. of purchaseReturnAvg.PurchaseTotal purchase', - 'supplierreport': '#NamePhoneNo. of saleAvg.saleTotal sale', - 'userreport': '#NameNo. of saleReturnProfitAvg.SaleTotal sale', - 'paymentsalesreport': '#IdDateCustomerPayment ModePayment NotePrice', - 'paymentreceivingreport': '#IdDateSupplierPayment ModePayment NotePrice', - 'taxsalesreport': '#Tax NameAmount', - 'registerreport': '#NameTime openedTime closedFloat AmountRegister amount', - 'pendingreport': '#IdDateNo. of productTotalPartialDue', - 'returnreport': '#Sales IdDateCustomer namePayment MethodNo. of Item Return Amount', - 'returnreceivingreport': '#Receiving IdDateSupplier namePayment MethodNo. of Item Return Amount', - 'customerdetails': '# Sale DateProcessNo. of item returnReturn totalNo. of item soldSale total', + 'salesreport': '#IdDateCustomerCustomer PhoneNo.of ItemSubtotalTaxDiscountPrice', + 'tax': '#IdDateGSTTax[%]Tax DescriptionSub TotalPrice', + 'receivingreport': '#IdDateSupplierSupplier PhoneTotal ItemTotal', + 'salesitemreport': '#IdDateCustomerTotal ItemPrice', + 'receivingitemreport': '#IdDateSupplierTotal ItemPrice', + 'itemreport': '#NameTotal no. of item soldNo. of saleProfitAvg.saleTotal sale', + 'itemexpiry': '#Item NameCategorySKUExpiry DateQuantityCompany PriceTotal Amount', + 'categoryreport': '#NameTotal no. of item soldProfitAvg.saleTotal sale', + 'customerreport': '#NamePhoneNo. of purchaseReturnAvg.PurchaseTotal purchase', + 'supplierreport': '#NamePhoneNo. of saleAvg.saleTotal sale', + 'userreport': '#NameNo. of saleReturnProfitAvg.SaleTotal sale', + 'paymentsalesreport': '#IdDateCustomerPayment ModePayment NotePrice', + 'paymentreceivingreport': '#IdDateSupplierPayment ModePayment NotePrice', + 'taxsalesreport': '#Tax NameAmount', + 'registerreport': '#NameTime openedTime closedFloat AmountRegister amount', + 'pendingreport': '#IdDateNo. of productTotalPartialDue', + 'returnreport': '#Sales IdDateCustomer namePayment MethodNo. of Item Return Amount', + 'returnreceivingreport': '#Receiving IdDateSupplier namePayment MethodNo. of Item Return Amount', + 'customerdetails': '# Sale DateProcessNo. of item returnReturn totalNo. of item soldSale total', 'customertransactiondetails': '# Date Description Type Wallet Paid Pending Total Image Action ', - 'supplierdetails': '# Purchase DateProcessNo. of item returnReturn totalNo. of item soldSale total', - 'usersdetails': '# Sale DateAmount', - 'productdetails': '# Name DateSelling Amount', - 'returndetails': '# Name Qty Amount', - 'registerdetails': '# Sale DatePaymentReturnAmount', - 'paymenttransaction': '#SaleDateUserMethodAmount', - 'staffactivity': '#NameLogin Date/TimeOutletIP addressDevice typeOSBrowser', - 'expensesreport': '#AmountType Category Recipient NameApprovedbyDescription', - 'transactionreport': '#NameCreditDebitWallet AmountSales PendingOverall Due', - 'itemstock': '# Name QtyCompany PriceTotal AmountSelling PriceTotal Amount' + 'supplierdetails': '# Purchase DateProcessNo. of item returnReturn totalNo. of item soldSale total', + 'usersdetails': '# Sale DateAmount', + 'productdetails': '# Name DateSelling Amount', + 'returndetails': '# Name Qty Amount', + 'registerdetails': '# Sale DatePaymentReturnAmount', + 'paymenttransaction': '#SaleDateUserMethodAmount', + 'staffactivity': '#NameOutletIP addressDevice typeOSBrowser', + 'expensesreport': '#AmountType Category Recipient NameApprovedbyDescription', + 'transactionreport': '#NameCreditDebitWallet AmountSales PendingOverall Due', + 'itemstock': '# Name QtyCompany PriceTotal AmountSelling PriceTotal Amount' }; $(TableBody).each(function (key, val) { @@ -2876,23 +3652,29 @@ PosnicPro = { }, appendViewDataTableBody: function (table) { + /* + * Sweep the row-menu popups before the list re-renders. + * + * jquery.toolbar appends a `.tool-container` straight to for + * EVERY row's action button and ships no destroy method, so each + * re-render orphaned another set - measured at ~196 detached nodes + * per navigation cycle that were never released. Worse, the plugin + * re-binds its handlers to `$('.tool-container')` (all of them) on + * every init, so the cost compounds with each orphan left behind. + * Every list render passes through here, and every container is + * rebuilt per row anyway, so clearing them here is both safe and + * the only place that catches all 14 lists. + */ + $('body > .tool-container').remove(); $('#BackupReportName').html(table + ' Document').css('textTransform', 'capitalize').show(); + /* Only the pages still on the OLD DataTable machinery keep an + entry - the standard lists render their own headers, and their + keys came out with them (owner: clean up after the redesign). */ var TableBody = { - 'sales': '#IdDateCustomerPhoneTableOrder TypeProcessPricePayment statusActions', - 'kothistory': '#IdDateTableNo.of.PaxOrder TypeActions', - 'receivings': '#IdDateSupplierPhoneStatusPriceAction', - 'branches': '#NamePhoneEmailAddressStateCountryAction', - 'categories': '#NameImageDiscount DescriptionAction', - 'customercategory': '#NameDescriptionAction', - 'customers': '#NamePhoneEmailAddressAction', - 'expenses': '#AmountTypeCategoryApproved ByDescriptionAction', - 'items': '#NameImageSKUQuantityItem typePriceKioskAction', - 'suppliers': '#NamePhoneEmailAddressAction', - 'registers': '#Register nameDateIdUser nameBranchRegister amountAction', - 'users': '#UsernameImageEmail Id TypeStatusAction', - 'lowitem': '#Item NameItem ImageSKUSupplierCategoryQuantityAction', - 'stocklog': '#NameDateActivityUserOpening StockStock CountClosing StockAction', - 'variants': '#NameAction' + 'kothistory': '#IdDateTableNo.of.PaxOrder TypeActions', + 'branches': '#NamePhoneEmailAddressStateCountryAction', + 'expenses': '#AmountTypeCategoryApproved ByDescriptionAction', + 'registers': '#Register nameDateIdUser nameBranchRegister amountAction' }; $(TableBody).each(function (key, val) { @@ -2937,17 +3719,17 @@ PosnicPro = { appendRecyclebinDataTableBody: function (table) { var TableBody = { - 'sales': '#IdDateCustomerProcessPriceActions', - 'receivings': '#IdDateSupplierStatusPriceAction', - 'customers': '#NamePhoneEmailAddressAction', - 'suppliers': '#NamePhoneEmailAddressAction', - 'categories': '#NameImageDiscount DescriptionAction', - 'items': '#NameImageSKUPriceQuantityAction', - 'branches': '#NamePhoneEmailAddressCountryStateAction', - 'users': '#NameImageEmail Id TypeAction', - 'expenses': '#AmountTypeCategoryRecipientApproved ByDescriptionAction', - 'registers': '#Register nameDateIdUser nameBranchRegister amountAction', - 'stocklogs': '#SKUNameDateProcessOpening BalanceClosing BalanceAction' + 'sales': '#IdDateCustomerProcessPriceActions', + 'receivings': '#IdDateSupplierStatusPriceAction', + 'customers': '#NamePhoneEmailAddressAction', + 'suppliers': '#NamePhoneEmailAddressAction', + 'categories': '#NameImageDiscount DescriptionAction', + 'items': '#NameImageSKUPriceQuantityAction', + 'branches': '#NamePhoneEmailAddressCountryStateAction', + 'users': '#NameImageEmail Id TypeAction', + 'expenses': '#AmountTypeCategoryRecipientApproved ByDescriptionAction', + 'registers': '#Register nameDateIdUser nameBranchRegister amountAction', + 'stocklogs': '#SKUNameDateProcessOpening BalanceClosing BalanceAction' }; $(TableBody).each(function (key, val) { $(".datatable-thead-tbody").empty().html(val[table]); @@ -2956,12 +3738,12 @@ PosnicPro = { appendImportDataTableBody: function (table) { var TableBody = { - 'customers': '#NamePhoneEmailAddressStatus', - 'suppliers': '#NamePhoneEmailAddressStatus', - 'categories': '#NameDiscount Amount Discount PercentageStatus', - 'customercategory': '#NameDescriptionStatus', - 'items': '#NameCategory NamePriceQuantityStatus', - 'expenses': '#TypeAmountCategory NameNotesStatus' + 'customers': '#NamePhoneEmailAddressStatus', + 'suppliers': '#NamePhoneEmailAddressStatus', + 'categories': '#NameDiscount Amount Discount PercentageStatus', + 'customercategory': '#NameDescriptionStatus', + 'items': '#NameCategory NamePriceQuantityStatus', + 'expenses': '#TypeAmountCategory NameNotesStatus' }; $(TableBody).each(function (key, val) { $(".import-datatable-thead").empty().html(val[table]); @@ -3334,6 +4116,63 @@ PosnicPro = { }; /*** Common Function For LocalStorage ***/ +/* + * Phone inputs, built when they are wanted rather than at boot. + * + * intl-tel-input renders its whole country list into the DOM the moment it + * initialises: ~1,222 nodes EACH. Three of them were live on the dashboard - + * 3,666 nodes, 14% of the entire document - for dropdowns behind forms most + * sessions never open, and all three were built inside the first second, + * which is exactly the window where iPhones were dying (OWNER_QUEUE 193/195). + * + * Nothing about the call sites changes: the instance property is a getter, + * so `PosnicPro.customers.customer_phone.isValidNumber()` still works and + * simply builds the widget at that moment. Three triggers, whichever comes + * first: the user focusing the field, any code touching the property, or - + * on desktop only - an idle callback, so the flag appears without anyone + * noticing a change. Phones skip the idle build on purpose: there the whole + * point is that those nodes never exist unless the field is used. + */ +/* + * "Collapse the menu so this screen gets the room" - what the sale, item + * and receiving screens have always done on entry. The catch is that + * 'toggle-menu' is two different states depending on the breakpoint: on + * desktop the theme reads it as menu COLLAPSED to the icon rail, but on a + * phone the hamburger toggles the very same class to mean menu OPEN (an + * unwrapped `.toggle-menu .leftbar { margin-left: 0 }` in the theme wins + * over the phone's off-canvas hide by specificity). So a screen adding it + * unconditionally was opening the full menu OVER itself on every phone. + * One door for the gesture, with the breakpoint check inside. + */ +PosnicPro.collapseMenuForWorkspace = function () { + if (window.matchMedia('(min-width: 768px)').matches) { + $('.vertical-layout').addClass('toggle-menu'); + } +}; + +PosnicPro.lazyPhoneInput = function (selector, target, prop, opts) { + var made = null; + function build() { + if (made) { return made; } + var el = document.querySelector(selector); + if (!el) { return null; } + try { + var existing = window.intlTelInputGlobals && window.intlTelInputGlobals.getInstance(el); + made = existing || window.intlTelInput(el, opts || {}); + } catch (e) { return null; } + return made; + } + try { + Object.defineProperty(target, prop, { configurable: true, get: build }); + } catch (e) { target[prop] = build(); } + $(document).on('focusin', selector, build); + if (!window.__mobileSafeMode) { + var idle = window.requestIdleCallback || function (fn) { return setTimeout(fn, 4000); }; + idle(function () { build(); }); + } + return build; +}; + PosnicPro.local = { set: function (key, value) { localStorage.setItem(key, value); @@ -3348,40 +4187,542 @@ PosnicPro.local = { localStorage.removeItem(key); } }; -$(document).ready(function () { - // Printer and paper are set per machine in Hardware Manager. Pull them in - // before the first sale so the first receipt is right, not the second. - PosnicPro.syncPrinterPreferences(); - - // $(".changeCountry").append(''); - // $(".changeState").append(''); - - var kotEnabled = (PosnicPro.local.get('table_options') === 'enable'); - var $newSaleLi = $('#view_touchsales_page').closest('li'); - - console.log('KOT Menu Debug:', { - kotEnabled: kotEnabled, - table_options: PosnicPro.local.get('table_options'), - newSaleLi: $newSaleLi.length, - kotMenu: $('#kot_menu').length, - itemMasterMenu: $('#item_master_menu').length - }); - - if (kotEnabled) { - console.log('KOT is ENABLED - showing KOT and Item Master menus'); - $newSaleLi.hide(); - $('#image_sidebar_newsale').hide(); - $('#kot_menu').show(); - $('#item_master_menu').show(); - } else { - console.log('KOT is DISABLED - showing New Sale menu'); - $newSaleLi.show(); - $('#kot_menu').hide(); - $('#item_master_menu').hide(); - } - PosnicPro.applyKotVisibility(kotEnabled); -}); +/* + * Language, for text JavaScript writes after the page is built. + * + * The HTML is translated at build time. Anything drawn later - a button that + * says Save until you edit something and then says Update - was not, and was + * handled like this, in fifteen files: + * + * (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') + * ? $('#branch_title').text('...') : $('#branch_title').text(PosnicPro.i18n.t('lang_edit_title', 'Edit')); + * + * Three problems in one line. The language was identified by a FILENAME. It + * was a two-way branch, so a third language did not fit without editing all + * sixty-three of them. And the words lived in code, where no translator could + * reach them and where nine of them in sales.js had been silently corrupted + * into mojibake - Tamil bytes read as Latin-1 - and shipped to the sale + * screen, the most used screen in the product. + * + * Now: a language CODE, one dictionary per language as data, and one function. + * + * The English is always passed in as the fallback. That is the whole safety + * property - before the pack loads, if the pack 404s, if a key is missing or + * a language is half translated, the caller still gets real English rather + * than "undefined", which is exactly what the build already does for HTML. + * + * See Intranet docs/MULTI_LANGUAGE_ARCHITECTURE.md. + */ +PosnicPro.i18n = { + _dict: null, + _code: null, + /* Original English nodes are kept outside the mutable DOM. */ + _english: new WeakMap(), + + /* + * 'en' | 'ta' | ... + * + * Read from the legacy `language_herf`, which holds a page filename like + * 'ta_dashboard.html'. Existing installs already have that value, so it is + * migrated rather than reset - resetting would silently put every Tamil + * shop back into English on upgrade. + */ + code: function () { + if (PosnicPro.i18n._code) return PosnicPro.i18n._code; + var stored = PosnicPro.local.get('language_code'); + if (!stored) { + var href = PosnicPro.local.get('language_herf') || ''; + var m = /^([a-z]{2})_/.exec(href); + if (!m) { + /* Nothing chosen, ever. English for now, and NOT written back: + a stored value looks exactly like a choice, and the first-run + detection below only runs for a machine that never chose. */ + return 'en'; + } + stored = m[1]; + PosnicPro.local.set('language_code', stored); + } + PosnicPro.i18n._code = stored; + return stored; + }, + + /* Has anybody on this machine ever picked a language? */ + chosen: function () { + return !!(PosnicPro.local.get('language_code') || PosnicPro.local.get('language_herf')); + }, + + is: function (code) { + return PosnicPro.i18n.code() === code; + }, + + /* + * The user picked a language. + * + * Still takes the page filename, because until the HTML stops being built + * per language that filename is also where the browser has to go. It + * records the CODE alongside it, and drops the cached value so the next + * t() answers as the new language rather than the one being left. + */ + select: function (href) { + var m = /^([a-z]{2})_/.exec(String(href || '')); + var code = m ? m[1] : 'en'; + PosnicPro.local.set('language_herf', href); + PosnicPro.local.set('language_code', code); + PosnicPro.i18n._code = code; + PosnicPro.i18n._dict = null; + return code; + }, + + /* + * t('lang_edit', 'Edit') + * + * The second argument is not optional in spirit: it is the English the old + * code carried in its else branch, and it is what ships when anything at + * all goes wrong. + */ + t: function (key, english) { + var d = PosnicPro.i18n._dict; + if (d && Object.prototype.hasOwnProperty.call(d, key)) { + var value = d[key]; + /* An empty entry is not a translation. Treating it as one is how a + generated skeleton blanks a button. */ + if (typeof value === 'string' && value.trim() !== '') return value; + } + return english; + }, + + /* + * Scripts written right to left, by BCP 47 primary subtag. + * + * The document direction follows the language, so Arabic mirrors the + * layout without its pack having to say so - and a language this list + * does not know is left to right, the safe default for a till. + */ + /* Attributes people read. Marked in the markup as data-t-="key" + by the tagger, translated here, restored by restore(). */ + _attrs: ['placeholder', 'title', 'aria-label'], + + _rtl: { ar: 1, he: 1, fa: 1, ur: 1, ps: 1, sd: 1, ug: 1, yi: 1, dv: 1, ckb: 1 }, + + rtl: function (code) { + var primary = String(code || '').toLowerCase().split('-')[0]; + return !!PosnicPro.i18n._rtl[primary]; + }, + + /* + * Tell the document which language it is in. + * + * is what screen readers, spell-checkers, hyphenation and font + * fallback read: a Tamil page marked lang="en" gets English hyphenation + * and whichever font the browser reaches for first. dir="rtl" is the + * whole of Arabic's text layout - the browser mirrors text, tables and + * inline flow from that one attribute, and static/style/css/rtl.css + * mirrors the chrome. Runs before the pack arrives, so direction never + * waits on a fetch. + */ + mark: function () { + if (typeof document === 'undefined' || !document.documentElement) return; + var code = PosnicPro.i18n.code(); + document.documentElement.setAttribute('lang', code); + document.documentElement.setAttribute('dir', PosnicPro.i18n.rtl(code) ? 'rtl' : 'ltr'); + }, + + /* + * The language a first run should start in. + * + * BCP 47 lookup (RFC 4647): walk the browser's preferences in order and + * take the first one this build ships, trying the full tag ('pt-BR') and + * then its primary subtag ('pt'). English when nothing matches. Only ever + * consulted for a machine where nobody has chosen - a choice, once made, + * is never second-guessed by the operating system's locale. + * + * `preferred` is for tests; the browser's list is the real input. + */ + detect: function (offered, preferred) { + var byCode = {}; + (offered || []).forEach(function (l) { + if (l && l.code) byCode[String(l.code).toLowerCase()] = String(l.code); + }); + var nav = (typeof navigator !== 'undefined') ? navigator : {}; + var prefs = preferred + || (nav.languages && nav.languages.length ? nav.languages : [nav.language || 'en']); + for (var i = 0; i < prefs.length; i++) { + var tag = String(prefs[i] || '').toLowerCase(); + if (!tag) continue; + if (byCode[tag]) return byCode[tag]; + var primary = tag.split('-')[0]; + if (byCode[primary]) return byCode[primary]; + } + return 'en'; + }, + + /* + * Fetch this shop's language pack, once. + * + * English loads nothing at all - it is in the markup and in every t() + * call, so there is nothing to fetch and no request to fail. + * + * Deliberately not awaited by callers. The pack is a local file behind the + * service worker and lands long before any button is clicked; if it were + * ever late, t() returns English for a moment rather than blocking the + * page on a network read. + */ + load: function () { + var code = PosnicPro.i18n.code(); + PosnicPro.i18n.mark(); + if (code === 'en' || PosnicPro.i18n._dict) return Promise.resolve(); + return fetch('languages/' + code + '.json') + .then(function (r) { return r.ok ? r.json() : null; }) + .then(function (json) { if (json) PosnicPro.i18n._dict = json; }) + .catch(function () { /* English is already the answer */ }); + }, + + /* + * Translate the markup in place. + * + * Pages are built ONCE now, in English, and carry their keys with them: + * + * Item name + * Login Here + * + * The element stays where the words are ordinary content. Inside + * and <option> the parser will not build an element for it, so + * the build hoists the key onto the parent instead - both are handled + * here, because a caller should not have to know which is which. + * + * English does nothing at all: the markup is already English, so there is + * no work, no flicker and nothing to get wrong. + * + * Takes a root so markup rendered later - a modal, an AJAX table - can be + * translated the moment it exists rather than waiting for a reload. + */ + /* + * The few tags a translation is allowed to carry. + * + * Not a general HTML subset - just what the packs actually need: a feather + * icon before "Download", and the <span> the code later rewrites with a + * screen name. Anything else is unwrapped, keeping its text. + */ + _allowedTags: { SPAN: 1, I: 1, B: 1, STRONG: 1, EM: 1, SMALL: 1, BR: 1, U: 1 }, + _allowedAttrs: { id: 1, class: 1 }, + + /* + * Put a translation that carries markup onto the page, safely. + * + * This was `el.innerHTML = value`, justified by a comment saying the packs + * were "this repository's own files... not user input". That was true when + * it was written and stopped being true the same week, when translations + * were opened to outside contributors and twelve packs were seeded for + * strangers to correct. A pack is now a pull request reviewed by somebody + * who by definition cannot read the language: `<img src=x onerror=...>` + * inside a Malayalam string looks exactly like Malayalam. Signing the asset + * channel proves where a pack came from, never that it is safe to run. + * + * The parse happens inside a <template>, whose content is an inert + * fragment - scripts do not run and images do not load, even for what is + * about to be thrown away. Only then is the tree walked and anything + * outside the allowlist removed, so what reaches the page is a small, + * known set of tags carrying nothing but id and class. + */ + _setMarkup: function (el, value) { + var doc = el.ownerDocument; + var tpl = doc.createElement('template'); + /* Inert: nothing here is rendered, fetched or executed. */ + tpl.innerHTML = value; + + var clean = function (node) { + var child = node.firstChild; + while (child) { + var next = child.nextSibling; + if (child.nodeType === 1) { + if (!PosnicPro.i18n._allowedTags[child.tagName]) { + /* Unwrap rather than delete: a translator who wrapped a + word in something we do not allow still wrote the + word, and losing it silently would be worse. */ + clean(child); + while (child.firstChild) node.insertBefore(child.firstChild, child); + node.removeChild(child); + } else { + var attrs = child.attributes; + for (var a = attrs.length - 1; a >= 0; a--) { + if (!PosnicPro.i18n._allowedAttrs[attrs[a].name.toLowerCase()]) { + child.removeAttribute(attrs[a].name); + } + } + clean(child); + } + } else if (child.nodeType !== 3) { + /* Comments and anything else carry no words. */ + node.removeChild(child); + } + child = next; + } + }; + clean(tpl.content); + + while (el.firstChild) el.removeChild(el.firstChild); + el.appendChild(tpl.content); + }, + + apply: function (root) { + var dict = PosnicPro.i18n._dict; + if (!dict) return; + var scope = root || document; + var set = function (el, key) { + if (!key) return; + var value = dict[key]; + /* Missing or blank leaves the English that is already there. */ + if (typeof value !== 'string' || value.trim() === '') return; + /* The English is in no pack - it is what the page shipped with. + Keep clones outside the mutable DOM the first time it is + overwritten, so a switch back to English is a restore rather + than a reload. */ + if (!PosnicPro.i18n._english.has(el)) { + var original = []; + for (var child = el.firstChild; child; child = child.nextSibling) { + original.push(child.cloneNode(true)); + } + PosnicPro.i18n._english.set(el, original); + } + /* + * A handful of strings carry an   or similar entity. Three + * cases: + * + * the page has markup, the words do not -> keep the page's + * icon, swap the words + * plain text on both sides -> the common case + * the translation contains a tag -> shown as text + * + * A TAG IS NEVER TREATED AS MARKUP. This used to read + * `if (/[<&]/.test(value)) el.innerHTML = value`, justified by the + * packs being "this repository's own files... not user input". + * + * That stopped being true the day translations were opened to + * outside contributors. A pack is now a pull request from a + * stranger, reviewed by somebody who by definition cannot read the + * language - `<img src=x onerror=...>` in a Malayalam string looks + * exactly like Malayalam to the reviewer. Signing the asset channel + * proves where a pack came from, not that it is safe. + * + * Entities are still decoded, because   is legitimate and + * common. A detached <textarea> parses its content as text rather + * than markup, so nothing is ever constructed as an element - and + * it is only reached for values with no `<` in them at all. + */ + if (/[<&]/.test(value)) { + PosnicPro.i18n._setMarkup(el, value); + return; + } + if (el.children && el.children.length) { + var swapped = false; + for (var n = el.firstChild; n; n = n.nextSibling) { + if (n.nodeType !== 3) continue; + if (!swapped && n.nodeValue.trim() !== '') { n.nodeValue = value; swapped = true; } + else n.nodeValue = ''; + } + if (!swapped) el.appendChild(el.ownerDocument.createTextNode(value)); + return; + } + el.textContent = value; + }; + /* querySelectorAll never returns its own root; a <lang> handed in + by the observer is the thing to translate. */ + if (root && root.nodeType === 1) { + if (root.tagName === 'LANG') set(root, (root.getAttribute('class') || '').trim()); + else if (root.hasAttribute('data-t')) set(root, root.getAttribute('data-t')); + } + var tags = scope.querySelectorAll('lang[class]'); + for (var i = 0; i < tags.length; i++) { + set(tags[i], (tags[i].getAttribute('class') || '').trim()); + } + var marked = scope.querySelectorAll('[data-t]'); + for (var j = 0; j < marked.length; j++) { + set(marked[j], marked[j].getAttribute('data-t')); + } + /* placeholder, title, aria-label: the words a person reads that are + not text nodes. The English is kept the same way, per attribute. */ + var attrs = PosnicPro.i18n._attrs; + for (var a = 0; a < attrs.length; a++) { + var els = Array.prototype.slice.call(scope.querySelectorAll('[data-t-' + attrs[a] + ']')); + if (root && root.nodeType === 1 && root.hasAttribute('data-t-' + attrs[a])) els.unshift(root); + for (var e = 0; e < els.length; e++) { + var value = dict[els[e].getAttribute('data-t-' + attrs[a])]; + if (typeof value !== 'string' || value.trim() === '') continue; + if (!els[e].hasAttribute('data-en-' + attrs[a])) { + els[e].setAttribute('data-en-' + attrs[a], els[e].getAttribute(attrs[a]) || ''); + } + els[e].setAttribute(attrs[a], value); + } + } + }, + + /* + * Put the English back. + * + * apply() keeps cloned English nodes outside the DOM the first time it + * overwrites them, so this is the whole of "switch to English": the + * words are not fetched from anywhere, they were here all along. + */ + restore: function (root) { + var scope = root || document; + var kept = scope.querySelectorAll('lang[class], [data-t]'); + for (var i = 0; i < kept.length; i++) { + var original = PosnicPro.i18n._english.get(kept[i]); + if (!original) continue; + while (kept[i].firstChild) kept[i].removeChild(kept[i].firstChild); + for (var j = 0; j < original.length; j++) { + kept[i].appendChild(original[j].cloneNode(true)); + } + } + var attrs = PosnicPro.i18n._attrs; + for (var a = 0; a < attrs.length; a++) { + var els = scope.querySelectorAll('[data-en-' + attrs[a] + ']'); + for (var e = 0; e < els.length; e++) { + els[e].setAttribute(attrs[a], els[e].getAttribute('data-en-' + attrs[a])); + } + } + }, + + /* + * Translate markup as it lands. + * + * Most of the interface is drawn by JavaScript after load - list rows, + * table headers, the receipt panel, every modal body - and none of it + * passed through apply(). A module can write <lang class="key">English + * </lang> into any string it renders and forget about it: each added + * subtree is translated the moment it is in the document. Nothing at all + * happens for a shop in English (no dictionary, no work), and apply() + * reads keys rather than text, so it cannot translate its own output + * twice. Text nodes are skipped: a translation that only changed words + * must not wake the observer that made it. + */ + watch: function (root) { + if (typeof document === 'undefined') return null; + /* The observer of the document being watched - a test's, or ours. */ + var doc = (root && root.ownerDocument) || document; + var Observer = (doc.defaultView && doc.defaultView.MutationObserver) + || (typeof MutationObserver !== 'undefined' ? MutationObserver : null); + if (!Observer) return null; + var observer = new Observer(function (records) { + if (!PosnicPro.i18n._dict) return; + for (var r = 0; r < records.length; r++) { + var added = records[r].addedNodes; + for (var a = 0; a < added.length; a++) { + if (added[a].nodeType === 1) PosnicPro.i18n.apply(added[a]); + } + } + }); + observer.observe(root || document.documentElement, { childList: true, subtree: true }); + return observer; + }, + + /* + * Switch language without leaving the page. + * + * This used to navigate to ta_dashboard.html, because the language WAS the + * filename. There is one page now, so switching is a fetch and a redraw - + * which is also why it is instant rather than a reload. English is the one + * language with no pack: switching to it restores what the page shipped. + */ + change: function (code) { + PosnicPro.i18n.select(code === 'en' ? 'dashboard.html' : code + '_dashboard.html'); + PosnicPro.i18n.mark(); + return PosnicPro.i18n.load().then(function () { + if (PosnicPro.i18n.code() === 'en') PosnicPro.i18n.restore(); + else PosnicPro.i18n.apply(); + }); + } +}; +PosnicPro.i18n.load().then(function () { PosnicPro.i18n.apply(); }); +/* + * First run. + * + * A machine where nobody has chosen a language starts in the browser's + * language if this build ships it, else English - decided once, here, so the + * login page and the dashboard agree without either knowing about the other. + * Anything that wants the settled language (the menu label, the per-language + * type sizes) waits on `ready`, which never rejects: whatever fails along the + * way, English is already on the screen. + */ +PosnicPro.i18n.ready = (function firstRun() { + var settle = (PosnicPro.i18n.chosen() || typeof fetch !== 'function') + ? Promise.resolve() + : fetch('languages/index.json') + .then(function (r) { return r.ok ? r.json() : null; }) + .then(function (list) { + var detected = PosnicPro.i18n.detect(list || []); + if (detected !== 'en') return PosnicPro.i18n.change(detected); + }); + return settle + .then(function () { return PosnicPro.i18n.load(); }) + .then(function () { PosnicPro.i18n.apply(); }) + .catch(function () { /* English, as shipped */ }); +}()); +/* Markup drawn after load is translated as it lands - see i18n.watch(). */ +PosnicPro.i18n.watch(); +/* + * A plain <select id="language_select"> anywhere offers the same list the + * header menu does. The login page has one: somebody who cannot read the + * sign-in screen should not have to sign in to change it. Filled after the + * first run has settled, so it opens on the language actually in use. + */ +PosnicPro.i18n.ready.then(function () { + var pick = (typeof document !== 'undefined') ? document.getElementById('language_select') : null; + if (!pick || typeof fetch !== 'function') return; + fetch('languages/index.json') + .then(function (r) { return r.ok ? r.json() : null; }) + .then(function (list) { + if (!Array.isArray(list) || !list.length) return; + var current = PosnicPro.i18n.code(); + pick.innerHTML = list.map(function (l) { + return '<option value="' + l.code + '"' + (l.code === current ? ' selected' : '') + '>' + + l.name + (l.reviewed === false ? ' (beta)' : '') + '</option>'; + }).join(''); + pick.onchange = function () { PosnicPro.i18n.change(pick.value); }; + pick.style.display = ''; + }) + .catch(function () { /* the page stays as it is */ }); +}); +/* Markup that exists before the pack lands still gets translated: this runs + again once the DOM is ready, and apply() is idempotent. */ +if (typeof document !== 'undefined') { + document.addEventListener('DOMContentLoaded', function () { PosnicPro.i18n.apply(); }); +} +$(document).ready(function () { + // Printer and paper are set per machine in Hardware Manager. Pull them in + // before the first sale so the first receipt is right, not the second. + PosnicPro.syncPrinterPreferences(); + + // $(".changeCountry").append('<option id="Select country" value="" data-t="lang_select_country">Select Country</option>'); + // $(".changeState").append('<option id="Select State" value="" data-t="lang_select_state">Select State</option>'); + + var kotEnabled = (PosnicPro.local.get('table_options') === 'enable'); + var $newSaleLi = $('#view_touchsales_page').closest('li'); + + console.log('KOT Menu Debug:', { + kotEnabled: kotEnabled, + table_options: PosnicPro.local.get('table_options'), + newSaleLi: $newSaleLi.length, + kotMenu: $('#kot_menu').length, + itemMasterMenu: $('#item_master_menu').length + }); + + if (kotEnabled) { + console.log('KOT is ENABLED - showing KOT and Item Master menus'); + $newSaleLi.hide(); + $('#image_sidebar_newsale').hide(); + $('#kot_menu').show(); + $('#item_master_menu').show(); + } else { + console.log('KOT is DISABLED - showing New Sale menu'); + $newSaleLi.show(); + $('#kot_menu').hide(); + $('#item_master_menu').hide(); + } + + PosnicPro.applyKotVisibility(kotEnabled); +}); /*Import Csv File Into Table By Type of Table Request*/ $(".files").on('change', function (e) { @@ -3408,7 +4749,7 @@ $(".files").on('change', function (e) { }); if (!lines || lines.length === 0) { - PosnicPro.alert('error', 'Empty CSV file'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_empty_csv_file', 'Empty CSV file')); return false; } @@ -3660,7 +5001,47 @@ $(".newbranch").on('change', function () { //https://dexie.org/ -var db = new Dexie("posnicpro"); +/* + * NO DEXIE ON PHONES (owner's order mid crash-hunt: "stop dexie itself. + * dont include in mobile and lets see."). Apple's IndexedDB backend is the + * one boot subsystem no probe ever gated - it is shared by every iOS + * browser, absent from desktop WebKit builds, and carries a long history + * of WebKit process crashes. On phones the db is an inert stand-in whose + * every read answers empty and every write vanishes: the features it + * backs (customer display sync, focus restore, print label memory) are + * desk-till features anyway. Desktop keeps real Dexie, unchanged. + */ +var db; +if (window.__mobileSafeMode) { + db = (function () { + var done = function () { return Promise.resolve(); }; + var none = function (cb) { + /* Dexie's toArray accepts a callback - honour both styles */ + if (typeof cb === 'function') { try { cb([]); } catch (e) { } } + return Promise.resolve([]); + }; + var chain = { toArray: none, delete: done, first: function () { return Promise.resolve(undefined); }, modify: done, count: function () { return Promise.resolve(0); } }; + var tbl = { + get: function () { return Promise.resolve(undefined); }, + put: done, add: done, delete: done, clear: done, update: done, bulkPut: done, + toArray: none, + where: function () { return { equals: function () { return chain; }, anyOf: function () { return chain; } }; } + }; + var stub = { + version: function () { return { stores: function () { return this; }, upgrade: function () { return this; } }; }, + open: done, close: function () { }, delete: done, + table: function () { return tbl; }, + on: function () { } + }; + ['customers', 'items', 'suppliers', 'categories', 'users', 'branches', 'expenses', + 'receivings', 'sales', 'offline_hash', 'queue', 'currentbranch', 'currentregister', + 'customerDisplay', 'saleAutoFocus', 'recevingAutoFocus', 'customerPlan', + 'printLableValues'].forEach(function (t) { stub[t] = tbl; }); + return stub; + })(); +} else { + db = new Dexie("posnicpro"); +} // Define Database Schema db.version(1).stores({ customers: "id, jsDate, name, branch_id", @@ -3732,27 +5113,6 @@ db.version(2).stores({ }); })(); -/* - * amCharts loads lazily, and no report file knows it. - * - * Every chart in the product enters through am4core.ready(cb) - the library's - * own idiom. This stub queues that callback, loads the real library (whose - * UMD assigns window.am4core wholesale, replacing the stub), then hands the - * callback to the real ready(). Eight report modules stay byte-identical - * while 1.1MB leaves the boot path. - */ -(function () { - function stubReady(cb) { - PosnicPro.lazy.load('amcharts').then(function () { - if (window.am4core && window.am4core.ready !== stubReady) { - window.am4core.ready(cb); - } else { - console.error('[lazy] amcharts loaded but did not replace the stub'); - } - }).catch(function () { /* already surfaced by lazy.load */ }); - } - if (!window.am4core) window.am4core = { ready: stubReady }; -})(); /* * Realtime wiring for the generic lists (S2). The dashboard is the only @@ -3840,6 +5200,37 @@ $('.custom_report_search_input').on('keypress keydown.autocomplete', function () autoSelectFirst: true }); }); +$(function () { PosnicPro.injectReportExportButtons(); }); +/* + * Where Close should go back to, when the answer is not "the list". + * + * "Saved an item. Open it" is a detour from a form somebody is still working + * in. Following it and closing sent them to the item LIST, because the close + * handler below reads the hash and #/items/<id> means "a record, so go to the + * records" - it has no way to know you arrived from the form rather than from + * the list (reported: "i opened it. i closed it. page went item list"). + * + * One marker fixes it for every screen with that strip - there are ten - rather + * than teaching the close handler about each one. It is set on the way out and + * cleared on the way back, so it can never leak into an unrelated Close: a + * stale marker sending someone to a form they did not come from would be worse + * than the list. + */ +PosnicPro.returnTo = ''; +$(document).on('click', '[id^="last_created_"]', function () { + PosnicPro.returnTo = currentHash || ''; +}); + +/* + * The modules whose ADD form is an infobar floating over its own list - + * the only ones whose cancelled add may close silently. A module whose + * form is a full page (items, receivings, sales) must never join this + * list: for those the route dispatch is what brings the list back. + */ +PosnicPro.INFOBAR_LIST_ADDS = { + customers: 1, suppliers: 1, users: 1, expenses: 1, + categories: 1, customercategory: 1, variants: 1 +}; $(".infobar-settings-close").on("click", function (e) { var category = 'sales/categories/new'; if (currentHash === category) { @@ -3851,11 +5242,51 @@ $(".infobar-settings-close").on("click", function (e) { hasher.changed.active = true; hasher.replaceHash('sales/new'); } + /* Honoured once, then forgotten. */ + if (PosnicPro.returnTo) { + var back = PosnicPro.returnTo; + PosnicPro.returnTo = ''; + if (back && back !== currentHash) { + hasher.setHash(back); + return; + } + } + /* + * A slide-over opened OVER a mini-dossier pane (a category's sales + * activity, an employee's full profile) is an overlay, not the owner + * of the hash - closing it must leave the pane's document address + * alone, or the pane snaps shut with it. + */ + var overParts = currentHash.split('/'); + if (typeof overParts[1] !== 'undefined' && /^[a-f\d]{24}$/i.test(overParts[1]) + && typeof overParts[2] === 'undefined' + && PosnicPro.listDoc && PosnicPro.listDoc.activeId(overParts[0]) === overParts[1]) { + var overId = $(this).data('id'); + e.preventDefault(); + $('#infobar-settings-sidebar-' + overId).removeClass('sidebarshow'); + $('#infobar-settings-sidebar-' + overId + '-details').removeClass('sidebarview'); + $('.infobar-settings-sidebar-overlay').css({ "background": "transparent", "position": "initial" }); + return; + } var patt = /^[a-f\d]{24}$/i; var parts = currentHash.split('/'); if (typeof parts[1] !== 'undefined' && patt.test(parts[1])) { if (parts[0] === 'sales' && (parts[2] === 'hold' || parts[2] === 'edit')) { hasher.setHash(parts[0] + '/' + parts[1] + '/' + parts[2]); + } else if (typeof parts[2] === 'undefined' + && (PosnicPro.INFOBAR_LIST_ADDS[parts[0]] || parts[0] === 'items') + && $('#view_' + parts[0]).data('total') !== undefined) { + /* + * Closing a DETAILS panel over its loaded list: the same silent + * restore as a cancelled add - reading a record changes nothing, + * so the list needs no re-fetch. Pure details only (no parts[2]): + * an edit route may be a full page (items), where the dispatch + * is the way back. + */ + hasher.changed.active = false; + hasher.setHash(parts[0]); + hasher.changed.active = true; + currentHash = parts[0]; } else { hasher.setHash(parts[0]); } @@ -3863,6 +5294,24 @@ $(".infobar-settings-close").on("click", function (e) { hasher.setHash(parts[0] + '/' + parts[1]); } else if (parts[0] === 'kotorder' && parts[1] === 'new') { hasher.setHash(parts[0] + '/' + parts[1]); // Keep kotorder/new intact + } else if (parts[1] === 'new' && PosnicPro.INFOBAR_LIST_ADDS[parts[0]] + && $('#view_' + parts[0]).data('total') !== undefined) { + /* + * Cancelling an add panel that floats OVER its list (saves patch, + * close edition): the list beneath is already rendered and nothing + * changed, so restore the hash WITHOUT the changed signal - which + * is what the comment below always claimed and never did. The + * route not firing is the point: no re-fetch, no re-render. + * Two escapes stay on the dispatching branch: full-page forms + * (items, receivings), for which the route IS the way back - and + * a DEEP-LINKED add panel, where showAdd opened over a list that + * never loaded (data('total') unset until the table's first + * fetch), so the dispatch is what fills the empty page. + */ + hasher.changed.active = false; + hasher.setHash(parts[0]); + hasher.changed.active = true; + currentHash = parts[0]; } else if (parts[1] === 'new' || parts[1] === 'tax' || parts[1] === 'unit' || parts[1] === 'taxgroup' || parts[1] === 'denom' || parts[1] === 'default' || parts[1] === 'payment' || parts[1] === 'tableorder') { hasher.setHash(parts[0]); //set hash without dispatching changed signal } else if (parts[2] === 'new' && parts[2] !== 'sales/categories/new') { @@ -4043,16 +5492,16 @@ $('.custom_report_search_input').on('keyup', function (event) { defaults to black, which is how the minimise bar came out dark on a dark title bar while the other two - drawn with stroke - were correctly following the text colour. */ - { name: 'minimize', label: 'Minimise', + { name: 'minimize', label: PosnicPro.i18n.t('lang_minimise', 'Minimise'), path: '<rect x="2" y="5.5" width="8" height="1" fill="currentColor" />' }, /* Two icons, because this button means two different things. Not maximised it maximises, and shows one square. Maximised it restores, and every other application on the machine draws two overlapping squares for that - one square there tells the shop the click will do something it will not. See paintMaximise. */ - { name: 'maximize', label: 'Maximise', + { name: 'maximize', label: PosnicPro.i18n.t('lang_maximise', 'Maximise'), path: '<rect x="2.5" y="2.5" width="7" height="7" fill="none" stroke="currentColor" />' }, - { name: 'close', label: 'Close', + { name: 'close', label: PosnicPro.i18n.t('lang_close_title', 'Close'), path: '<path d="M2.5 2.5 L9.5 9.5 M9.5 2.5 L2.5 9.5" stroke="currentColor" fill="none" />' } ]; @@ -4090,7 +5539,7 @@ $('.custom_report_search_input').on('keyup', function (event) { var svg = btn.querySelector('svg'); if (!svg) return; svg.innerHTML = maximised ? RESTORE_ICON : MAXIMISE_ICON; - var label = maximised ? 'Restore down' : 'Maximise'; + var label = maximised ? PosnicPro.i18n.t('lang_restore_down', 'Restore down') : PosnicPro.i18n.t('lang_maximise', 'Maximise'); btn.setAttribute('aria-label', label); btn.title = label; } @@ -4172,6 +5621,508 @@ PosnicPro.labourreport = { } }; +/* + * GST 2.0 readiness (#/gstreadiness) - the migration checklist from + * HSN_GST2_RATE_REFRESH_DESIGN increment 2. Read-only by design: it names + * items whose rate deserves a look and links out to the item, and never + * writes a rate itself. The server decides what qualifies; this renders it. + */ +PosnicPro.gstreadiness = { + _last: null, + showDataTablePage: function () { + PosnicPro.HideSideBarModal(); + $(".vertical-layout").removeClass("toggle-menu"); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $(".vertical-menu li a").removeClass("active"); + $('.page_loader,#osk-container').hide(); + $('.page-title-box,#gstreadiness_new').show(); + $('#v-pills-report-tab').addClass('active'); + $('#v-pills-report').addClass('show active'); + PosnicPro.gstreadiness.run(); + }, + _esc: function (s) { + return String(s == null ? '' : s).replace(/[&<>"]/g, function (c) { + return { '&': '&', '<': '<', '>': '>', '"': '"' }[c]; + }); + }, + run: function () { + var esc = PosnicPro.gstreadiness._esc; + $('#gstready_retired').html('<tr><td colspan="4" class="text-center text-muted"><lang class="lang_scanning">Scanning…</lang></td></tr>'); + $('#gstready_differs').html('<tr><td colspan="5" class="text-center text-muted"><lang class="lang_scanning">Scanning…</lang></td></tr>'); + PosnicPro.get('items/gstReadiness', function (response) { + var d = (response && response.data) || {}; + PosnicPro.gstreadiness._last = d; + var retired = d.retired || []; + var differs = d.differs || []; + + $('#gstready_counts').text( + (retired.length + differs.length) + ' of ' + (d.examined || 0) + ' items need a look' + ); + $('#gstready_notice').text(d.notice || '').toggle(!!d.notice); + + if (!retired.length) { + $('#gstready_retired').html('<tr><td colspan="4" class="text-center text-muted">' + + 'Nothing on a withdrawn slab - this part is done.</td></tr>'); + } else { + $('#gstready_retired').html(retired.map(function (r) { + return '<tr class="gstready-row" data-id="' + esc(r.id) + '" style="cursor:pointer;">' + + '<td>' + esc(r.name) + '</td>' + + '<td>' + (esc(r.hsncode) || '<span class="text-muted">not set</span>') + '</td>' + + '<td class="text-right text-danger font-weight-bold">' + r.rate + '%</td>' + + '<td class="text-muted">' + esc(r.reason) + '</td></tr>'; + }).join('')); + } + + if (!differs.length) { + $('#gstready_differs').html('<tr><td colspan="5" class="text-center text-muted">' + + 'No item disagrees with a live reference rate.</td></tr>'); + } else { + $('#gstready_differs').html(differs.map(function (r) { + return '<tr class="gstready-row" data-id="' + esc(r.id) + '" style="cursor:pointer;">' + + '<td>' + esc(r.name) + '</td>' + + '<td>' + esc(r.hsncode) + '</td>' + + '<td class="text-right">' + r.rate + '%</td>' + + '<td class="text-right">' + r.reference_rate + '%</td>' + + '<td class="text-muted">HSN ' + esc(r.matched_on) + '</td></tr>'; + }).join('')); + } + }, function () { + $('#gstready_retired').html('<tr><td colspan="4" class="text-center text-muted"><lang class="lang_could_not_run_the_scan_try_again">Could not run the scan - try again.</lang></td></tr>'); + $('#gstready_differs').html(''); + }); + }, + exportCsv: function () { + var d = PosnicPro.gstreadiness._last; + if (!d) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_run_the_scan_first', 'Run the scan first.')); return; } + var rows = [['Section', 'Item', 'HSN', 'Current rate', 'Reference rate', 'Note']]; + (d.retired || []).forEach(function (r) { + rows.push(['Withdrawn slab', r.name, r.hsncode, r.rate + '%', '', r.reason]); + }); + (d.differs || []).forEach(function (r) { + rows.push(['Differs from reference', r.name, r.hsncode, r.rate + '%', r.reference_rate + '%', r.reason]); + }); + var csv = rows.map(function (row) { + return row.map(function (cell) { + return '"' + String(cell == null ? '' : cell).replace(/"/g, '""') + '"'; + }).join(','); + }).join('\n'); + var blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' }); + var url = URL.createObjectURL(blob); + var link = document.createElement('a'); + link.href = url; + link.download = 'gst-readiness.csv'; + document.body.appendChild(link); + link.click(); + document.body.removeChild(link); + setTimeout(function () { URL.revokeObjectURL(url); }, 1000); + } +}; +$(document).on('click', '.gstready-row', function () { + var id = $(this).data('id'); + if (id) { hasher.setHash('items/' + id + '/edit'); } +}); + +/* + * The shared master-detail pattern (owner: "these designs should be common + * and sharable to other features"). A page starts as a plain full-width + * list; opening a document adds the split classes so the list becomes the + * rail and the document sits beside it. Quotes pioneered the look; every + * adopter passes its own ids and shares the CSS. + */ +PosnicPro.masterDetail = { + /* sel is the element that BECOMES the split surface - quotes uses its + contentbar, purchases an inner wrapper. The splitClass is the page's + own name for its split, so page CSS can differ without forking the + pattern. */ + enter: function (sel, splitClass) { + $(sel).addClass('master-detail ' + splitClass); + }, + leave: function (sel, splitClass) { + $(sel).removeClass('master-detail ' + splitClass + ' rail-collapsed'); + }, + inSplit: function (sel, splitClass) { + return $(sel).hasClass(splitClass); + }, + toggleRail: function (sel) { + $(sel).toggleClass('rail-collapsed'); + } +}; + +/* + * The peek modal (LIST_PAGE_UX_STANDARD field lesson): a widget or a list + * row on a WORK screen shows its record IN PLACE - details first, with a + * deliberate link out for whoever wants the full page. One shared modal so + * five pages do not each grow their own; the hash never moves, so closing + * it leaves the page exactly as it was. + */ +PosnicPro.peek = { + _ensure: function () { + if ($('#pp_peek_modal').length) { return; } + $('body').append( + '<div class="modal fade close_on_esc" id="pp_peek_modal" tabindex="-1" role="dialog" aria-hidden="true">' + + '<div class="modal-dialog" role="document"><div class="modal-content">' + + '<div class="modal-header" style="align-items:center;">' + + '<h5 class="modal-title" id="pp_peek_title"></h5>' + + '<button type="button" class="close" data-dismiss="modal" aria-label="Close" data-t-aria-label="lang_close_title"><span aria-hidden="true">×</span></button>' + + '</div>' + + '<div class="modal-body" id="pp_peek_body" style="max-height:70vh; overflow-y:auto;"></div>' + + '<div class="modal-footer" id="pp_peek_footer" style="justify-content:space-between; display:none;"></div>' + + '</div></div></div>'); + }, + open: function (o) { + o = o || {}; + PosnicPro.peek._ensure(); + $('#pp_peek_modal .modal-dialog').toggleClass('modal-lg', !!o.large); + $('#pp_peek_title').text(o.title || ''); + $('#pp_peek_body').html(o.body || '<div class="text-center text-muted" style="padding:40px;"><lang class="lang_loading_4">Loading ...</lang></div>'); + $('#pp_peek_footer').html(o.footer || '').toggle(!!o.footer); + $('#pp_peek_modal').modal('show'); + }, + /* Fill in a late-arriving body/footer without reopening. */ + fill: function (o) { + o = o || {}; + if (o.title != null) { $('#pp_peek_title').text(o.title); } + if (o.body != null) { $('#pp_peek_body').html(o.body); } + if (o.footer != null) { $('#pp_peek_footer').html(o.footer).toggle(!!o.footer); } + }, + close: function () { + $('#pp_peek_modal').modal('hide'); + }, + /* A labelled fact row - the vocabulary every peek shares. */ + row: function (label, value) { + if (value == null || value === '') { return ''; } + return '<tr><th style="white-space:nowrap; padding:6px 14px 6px 0; font-weight:600;">' + label + '</th>' + + '<td style="padding:6px 0;">' + value + '</td></tr>'; + }, + table: function (rows) { + return '<table class="table table-borderless mb-0" style="font-size:13.5px;"><tbody>' + rows + '</tbody></table>'; + } +}; + +/* + * The mini-dossier pane (owner: "i didnt want pop. i want similar right + * side open design. maintain consistency"): every list opens its record + * in the SAME right pane the big pages use - master-detail split, URL per + * record, pull/close toolbar, boxed sheet. One helper so eight small pages + * do not each grow their own openDoc/closeDoc. + */ +PosnicPro.listDoc = { + _cfg: {}, + activeId: function (key) { + var c = PosnicPro.listDoc._cfg[key]; + return c ? c.id : null; + }, + open: function (o) { + var split = '#' + o.key + '_split'; + if (!PosnicPro.masterDetail.inSplit(split, o.key + '-split')) { + PosnicPro.masterDetail.enter(split, o.key + '-split'); + $('#' + o.key + '_detail_card').show(); + } + PosnicPro.listDoc._cfg[o.key] = { hashBase: o.hashBase || o.key, id: String(o.id) }; + $('#' + o.key + '_list_rows tr').removeClass('is-active'); + $('#' + o.key + '_list_rows tr[data-id="' + o.id + '"]').addClass('is-active'); + if (o.hash !== false) { + var want = (o.hashBase || o.key) + '/' + o.id; + if (window.location.hash.slice(2) !== want) { hasher.setHash(want); } + } + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var toolbar = '<div class="p-doc-toolbar">' + + '<button type="button" class="btn btn-sm btn-light" title="Show or hide the list" data-t-title="lang_show_or_hide_the_list" aria-label="Show or hide the list" data-t-aria-label="lang_show_or_hide_the_list" onclick="PosnicPro.masterDetail.toggleRail(\'' + split + '\');"><i class="feather icon-sidebar"></i></button>' + + '<span class="p-doc-title">' + esc(o.title) + '</span>' + (o.pills || '') + + '<span class="ml-auto"></span>' + + (o.actions || '') + + '<button type="button" class="btn btn-sm btn-light" title="Close and show the full list" data-t-title="lang_close_and_show_the_full_list" aria-label="Close" data-t-aria-label="lang_close_title" onclick="PosnicPro.listDoc.close(\'' + o.key + '\');"><i class="feather icon-x"></i></button>' + + '</div>'; + $('#' + o.key + '_doc').html(toolbar + + '<div class="s-doc-body"><div class="q-sheet s-sheet">' + + (o.body || '<div class="text-center text-muted" style="padding:40px;"><lang class="lang_loading_4">Loading ...</lang></div>') + + '</div></div>'); + }, + /* Swap the sheet's content once a fetch lands - the pane is already + open, the toolbar already right. */ + body: function (key, html) { + $('#' + key + '_doc .q-sheet').html(html); + }, + title: function (key, text) { + $('#' + key + '_doc .p-doc-title').text(text); + }, + close: function (key) { + var c = PosnicPro.listDoc._cfg[key] || {}; + $('#' + key + '_detail_card').hide(); + $('#' + key + '_list_rows tr').removeClass('is-active'); + PosnicPro.masterDetail.leave('#' + key + '_split', key + '-split'); + var base = c.hashBase || key; + if (window.location.hash.slice(2).indexOf(base + '/') === 0) { + hasher.setHash(base); + } + PosnicPro.listDoc._cfg[key] = null; + }, + /* The shared fact vocabulary the panes and the till peek both speak. */ + row: function (label, value) { + return PosnicPro.peek.row(label, value); + }, + table: function (rows) { + return PosnicPro.peek.table(rows); + }, + /* The DOSSIER vocabulary (owner: the bare fact table read as + unfinished) - the same stats strip and labeled blocks the supplier + and customer dossiers wear, so a small pane is a small dossier, + never a form dump. */ + stats: function (items) { + var cells = (items || []).filter(function (i) { return i && i.v != null && i.v !== ''; }) + .map(function (i) { + return '<div class="s-stat"><div class="s-stat-value">' + i.v + '</div>' + + '<div class="s-stat-label">' + i.l + '</div></div>'; + }).join(''); + return cells ? '<div class="s-doc-stats">' + cells + '</div>' : ''; + }, + grid: function (blocks) { + var cells = (blocks || []).map(function (b) { + var lines = ((b && b.lines) || []).filter(Boolean); + if (!lines.length) { return ''; } + return '<div class="q-block"><div class="q-label">' + b.label + '</div>' + lines.join('') + '</div>'; + }).join(''); + return cells ? '<div class="s-doc-grid">' + cells + '</div>' : ''; + }, + link: function (label, onclick, attrs) { + return '<div style="margin-top:16px; font-size:13px;">' + + '<a href="javascript:void(0)"' + (attrs ? ' ' + attrs : '') + ' onclick="' + onclick + '">' + label + ' →</a></div>'; + } +}; + +/* + * List export, scoped (owner: "export button seems export everything... + * confirm with duration or selection... still user should have option to + * choose all"): every export button offers THIS PAGE or EVERYTHING + * MATCHING THE FILTER. "Everything" walks the list's own endpoint page by + * page with the filters that are on screen, capped so one click can never + * ask the server for an unbounded catalogue. + */ +PosnicPro.listExport = { + CAP: 5000, + save: function (rows, filename) { + var csv = rows.map(function (r) { + return r.map(function (c) { return '"' + String(c == null ? '' : c).replace(/"/g, '""') + '"'; }).join(','); + }).join('\n'); + var blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' }); + var a = document.createElement('a'); + a.href = URL.createObjectURL(blob); + a.download = filename; + a.click(); + URL.revokeObjectURL(a.href); + }, + all: function (cfg) { + var rows = [cfg.head]; + var page = 1; + var LIMIT = 100; + var step = function () { + PosnicPro.get({ url: cfg.url, data: cfg.params(page, LIMIT) }, function (r) { + var data = (r && r.data) || {}; + var list = data.list || []; + list.forEach(function (x) { rows.push(cfg.map(x)); }); + var total = Number(data.total) || (rows.length - 1); + var have = rows.length - 1; + if (list.length === LIMIT && have < Math.min(total, PosnicPro.listExport.CAP)) { + page += 1; + step(); + return; + } + if (total > PosnicPro.listExport.CAP) { + PosnicPro.alert('warning', 'Exported the first ' + PosnicPro.listExport.CAP + + ' of ' + total + ' rows - narrow the filter for the rest'); + } + PosnicPro.listExport.save(rows, cfg.filename); + }, function () { + PosnicPro.alert('error', PosnicPro.i18n.t('lang_export_failed_part_way_nothing_was_downloa', 'Export failed part-way - nothing was downloaded')); + }); + }; + step(); + } +}; + +/* + * The Sort control (owner: "high margin / low margin, recent, low stock, + * cost, price... similarly high total sales... quotes"): a labelled + * dropdown in the page header, one shared builder so every list gets the + * same control. The chosen sort is SERVER-side - a whitelisted name, never + * a raw field - so page 2 keeps the same order as page 1. + */ +PosnicPro.listSort = { + _reg: {}, + mount: function (key, cfg) { + PosnicPro.listSort._reg[key] = PosnicPro.listSort._reg[key] || { _v: '' }; + var reg = PosnicPro.listSort._reg[key]; + reg.options = cfg.options; + reg.onChange = cfg.onChange; + var host = $('#' + key + '_sort_host'); + if (!host.length || host.children().length) { return; } + var items = cfg.options.map(function (o) { + /* o.i = a feather icon name; the arrows say which END of the list + the option puts on top (owner: "sort we can have down arrow and + up arrow or any other icons inside options"). */ + var icon = o.i ? '<i class="feather icon-' + o.i + ' mr-2 q-muted"></i>' : ''; + return '<a class="dropdown-item ls-sort-opt" href="javascript:void(0)" data-key="' + key + '" data-sort="' + o.v + '">' + icon + o.l + '</a>'; + }).join(''); + host.html('<div class="btn-group">' + + '<button type="button" class="btn btn-primary-rgba dropdown-toggle" data-toggle="dropdown"' + + ' aria-haspopup="true" aria-expanded="false" id="' + key + '_sort_btn" title="Sort the list" data-t-title="lang_sort_the_list">' + + '<i class="feather icon-bar-chart mr-2"></i><span id="' + key + '_sort_label"><lang class="lang_sort">Sort</lang></span></button>' + + '<div class="dropdown-menu dropdown-menu-right">' + + '<a class="dropdown-item ls-sort-opt" href="javascript:void(0)" data-key="' + key + '" data-sort=""><lang class="lang_default">Default</lang></a>' + + items + '</div></div>'); + }, + value: function (key) { + var reg = PosnicPro.listSort._reg[key]; + return (reg && reg._v) || ''; + } +}; +$(document).on('click', '.ls-sort-opt', function () { + var key = $(this).data('key'); + var reg = PosnicPro.listSort._reg[key]; + if (!reg) { return; } + reg._v = String($(this).data('sort') || ''); + $('#' + key + '_sort_label').text(reg._v ? $(this).text() : PosnicPro.i18n.t('lang_sort', 'Sort')); + if (typeof reg.onChange === 'function') { reg.onChange(reg._v); } +}); + +/* Tax Payable (#/taxpayable, PURCHASE_TAX_PLAN P4) - months of output vs + * input tax and the net owed, credits in the statutory order (server math, + * tested in tax-netting). Regime-aware: single-head shops see one column + * set. The route table dispatches {module} -> PosnicPro.taxpayable. */ +PosnicPro.taxpayable = { + _months: null, + _register: null, + _threeHead: true, + _label: 'Tax', + display: function () { + PosnicPro.HideSideBarModal(); + $(".vertical-layout").removeClass("toggle-menu"); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $(".vertical-menu li a").removeClass("active"); + $('.page_loader,#osk-container').hide(); + $('.page-title-box,#taxpayable_new').show(); + $('#v-pills-report-tab').addClass('active'); + $('#v-pills-report').addClass('show active'); + PosnicPro.injectReportGroupTabs(); + var to = new Date(); + var from = new Date(to.getFullYear(), to.getMonth() - 2, 1); + var iso = function (d) { return d.toISOString().slice(0, 10); }; + if (!$('#taxpayable_from').val()) { $('#taxpayable_from').val(iso(from)); } + if (!$('#taxpayable_to').val()) { $('#taxpayable_to').val(iso(to)); } + PosnicPro.get({ url: 'setting/taxProfile', data: {} }, function (r) { + var d = (r && r.data) || {}; + PosnicPro.taxpayable._threeHead = (d.components && d.components.mode === 'split_equal'); + PosnicPro.taxpayable._label = d.label || 'Tax'; + var family = d.regime === 'sales_tax' ? 'sales tax collected' + : d.regime === 'none' ? 'no consumption tax configured' + : 'output minus input credit'; + $('#taxpayable_regime_note').text((d.label || 'Tax') + ' \u2014 ' + family); + PosnicPro.taxpayable.run(); + }, function () { PosnicPro.taxpayable.run(); }); + }, + run: function () { + var q = 'starting_date=' + $('#taxpayable_from').val() + '&ending_date=' + $('#taxpayable_to').val() + ' 23:59:59'; + PosnicPro.get({ url: 'sales/taxPayable?' + q, data: {} }, function (r) { + PosnicPro.taxpayable._months = (r.data && r.data.months) || []; + PosnicPro.taxpayable.renderMonths(); + }, function () { $('#taxpayable_months_body').html('<tr><td class="text-danger"><lang class="lang_could_not_load_try_again">Could not load - try again.</lang></td></tr>'); }); + PosnicPro.get({ url: 'sales/taxPayableRegister?' + q, data: {} }, function (r) { + PosnicPro.taxpayable._register = (r.data && r.data.list) || []; + PosnicPro.taxpayable.renderRegister(); + }, function () { /* register is secondary */ }); + }, + renderMonths: function () { + var three = PosnicPro.taxpayable._threeHead; + var L = PosnicPro.taxpayable._label; + var n = function (v) { return (Number(v) || 0).toFixed(2); }; + var head = three + ? '<tr><th rowspan="2"><lang class="lang_month">Month</lang></th><th colspan="4" class="text-center">Output (' + L + ' collected)</th>' + + '<th colspan="4" class="text-center"><lang class="lang_input_credit_purchases">Input credit (purchases)</lang></th>' + + '<th colspan="4" class="text-center"><lang class="lang_net_payable">Net payable</lang></th><th rowspan="2" class="text-right"><lang class="lang_credit_carried">Credit carried</lang></th></tr>' + + '<tr><th class="text-right"><lang class="lang_igst_tax_receiving">IGST</lang></th><th class="text-right"><lang class="lang_cgst_tax_receiving">CGST</lang></th><th class="text-right"><lang class="lang_sgst_tax_receiving">SGST</lang></th><th class="text-right"><lang class="lang_total_title">Total</lang></th>' + + '<th class="text-right"><lang class="lang_igst_tax_receiving">IGST</lang></th><th class="text-right"><lang class="lang_cgst_tax_receiving">CGST</lang></th><th class="text-right"><lang class="lang_sgst_tax_receiving">SGST</lang></th><th class="text-right"><lang class="lang_total_title">Total</lang></th>' + + '<th class="text-right"><lang class="lang_igst_tax_receiving">IGST</lang></th><th class="text-right"><lang class="lang_cgst_tax_receiving">CGST</lang></th><th class="text-right"><lang class="lang_sgst_tax_receiving">SGST</lang></th><th class="text-right"><lang class="lang_total_title">Total</lang></th></tr>' + : '<tr><th><lang class="lang_month">Month</lang></th><th class="text-right">' + L + ' collected</th><th class="text-right"><lang class="lang_input_credit">Input credit</lang></th><th class="text-right"><lang class="lang_net_payable">Net payable</lang></th><th class="text-right"><lang class="lang_credit_carried">Credit carried</lang></th></tr>'; + $('#taxpayable_months_head').html(head); + var rows = PosnicPro.taxpayable._months || []; + if (!rows.length) { + $('#taxpayable_months_body').html('<tr><td class="text-muted" colspan="14"><lang class="lang_nothing_in_this_period">Nothing in this period.</lang></td></tr>'); + return; + } + var html = ''; + rows.forEach(function (m) { + html += three + ? '<tr><td>' + m.period + '</td>' + + '<td class="text-right">' + n(m.output.igst) + '</td><td class="text-right">' + n(m.output.cgst) + '</td><td class="text-right">' + n(m.output.sgst) + '</td><td class="text-right"><b>' + n(m.output.total) + '</b></td>' + + '<td class="text-right">' + n(m.input.igst) + '</td><td class="text-right">' + n(m.input.cgst) + '</td><td class="text-right">' + n(m.input.sgst) + '</td><td class="text-right"><b>' + n(m.input.total) + '</b></td>' + + '<td class="text-right">' + n(m.net.igst) + '</td><td class="text-right">' + n(m.net.cgst) + '</td><td class="text-right">' + n(m.net.sgst) + '</td><td class="text-right"><b>' + n(m.net.total) + '</b></td>' + + '<td class="text-right">' + n(m.credit_carried) + '</td></tr>' + : '<tr><td>' + m.period + '</td>' + + '<td class="text-right">' + n(m.output.total) + '</td>' + + '<td class="text-right">' + n(m.input.total) + '</td>' + + '<td class="text-right"><b>' + n(m.net.total) + '</b></td>' + + '<td class="text-right">' + n(m.credit_carried) + '</td></tr>'; + }); + $('#taxpayable_months_body').html(html); + }, + renderRegister: function () { + var three = PosnicPro.taxpayable._threeHead; + var n = function (v) { return (Number(v) || 0).toFixed(2); }; + var esc = function (t) { return $('<i/>').text(t == null ? '' : t).html(); }; + $('#taxpayable_register_head').html('<tr><th><lang class="lang_newpurchase_title">Purchase</lang></th><th><lang class="lang_date_title">Date</lang></th><th><lang class="lang_newsupplier_title">Supplier</lang></th><th><lang class="lang_tax_id">Tax ID</lang></th>' + + (three ? '<th class="text-right"><lang class="lang_igst_tax_receiving">IGST</lang></th><th class="text-right"><lang class="lang_cgst_tax_receiving">CGST</lang></th><th class="text-right"><lang class="lang_sgst_tax_receiving">SGST</lang></th>' : '<th class="text-right"><lang class="lang_tax_paid">Tax paid</lang></th>') + + '<th class="text-right"><lang class="lang_total_title">Total</lang></th><th class="text-center"><lang class="lang_credit_title">Credit</lang></th><th class="text-center"><lang class="lang_doc">Doc</lang></th></tr>'); + var rows = PosnicPro.taxpayable._register || []; + if (!rows.length) { + $('#taxpayable_register_body').html('<tr><td class="text-muted" colspan="10"><lang class="lang_no_purchases_in_this_period">No purchases in this period.</lang></td></tr>'); + return; + } + var html = ''; + rows.forEach(function (r) { + var warn = r.invoice_total_mismatch ? ' <i class="feather icon-alert-triangle text-warning" title="Declared invoice total does not match the lines" data-t-title="lang_declared_invoice_total_does_not_match_the"></i>' : ''; + html += '<tr><td>' + esc(r.receiving_id) + warn + '</td>' + + '<td>' + (r.date ? new Date(r.date).toLocaleDateString('en-IN') : '-') + '</td>' + + '<td>' + esc(r.supplier_name) + '</td>' + + '<td>' + esc(r.supplier_gst_number || '-') + '</td>' + + (three + ? '<td class="text-right">' + n(r.igst) + '</td><td class="text-right">' + n(r.cgst) + '</td><td class="text-right">' + n(r.sgst) + '</td>' + : '<td class="text-right">' + n((Number(r.igst) || 0) + (Number(r.cgst) || 0) + (Number(r.sgst) || 0)) + '</td>') + + '<td class="text-right">' + n(r.total_amount) + '</td>' + + '<td class="text-center">' + (r.itc_eligible === false ? '<span class="rs-pill unpaid"><lang class="lang_no">No</lang></span>' : '<span class="rs-pill paid"><lang class="lang_yes">Yes</lang></span>') + '</td>' + + '<td class="text-center">' + (r.has_document ? '<i class="feather icon-paperclip"></i>' : '-') + '</td>' + + '</tr>'; + }); + $('#taxpayable_register_body').html(html); + }, + exportCsv: function () { + var rows = [['Period', 'Output IGST', 'Output CGST', 'Output SGST', 'Output Total', + 'Input IGST', 'Input CGST', 'Input SGST', 'Input Total', + 'Net IGST', 'Net CGST', 'Net SGST', 'Net Total', 'Credit carried']]; + (PosnicPro.taxpayable._months || []).forEach(function (m) { + rows.push([m.period, m.output.igst, m.output.cgst, m.output.sgst, m.output.total, + m.input.igst, m.input.cgst, m.input.sgst, m.input.total, + m.net.igst, m.net.cgst, m.net.sgst, m.net.total, m.credit_carried]); + }); + rows.push([]); + rows.push(['Purchase', 'Date', 'Supplier', 'Tax ID', 'IGST', 'CGST', 'SGST', 'Total', 'Credit claimable', 'Mismatch', 'Document']); + (PosnicPro.taxpayable._register || []).forEach(function (r) { + rows.push([r.receiving_id, r.date ? new Date(r.date).toISOString().slice(0, 10) : '', + r.supplier_name, r.supplier_gst_number || '', r.igst, r.cgst, r.sgst, + r.total_amount, r.itc_eligible === false ? 'no' : 'yes', + r.invoice_total_mismatch ? 'yes' : '', r.has_document ? 'yes' : '']); + }); + var csv = rows.map(function (r) { + return r.map(function (c) { return '"' + String(c == null ? '' : c).replace(/"/g, '""') + '"'; }).join(','); + }).join('\n'); + var blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' }); + var a = document.createElement('a'); + a.href = URL.createObjectURL(blob); + a.download = 'tax-payable.csv'; + a.click(); + URL.revokeObjectURL(a.href); + } +}; + /* Tax summary report (#/taxsummaryreport, T3) - totals per rate class over * a period, straight off the generic endpoint. The route table dispatches * {module} -> PosnicPro.taxsummaryreport. */ @@ -4196,7 +6147,7 @@ PosnicPro.taxsummaryreport = { run: function () { var from = $('#taxsummary_from').val(); var to = $('#taxsummary_to').val(); - $('#taxsummary_body').html('<tr><td colspan="6" class="text-center text-muted">Loading…</td></tr>'); + $('#taxsummary_body').html('<tr><td colspan="6" class="text-center text-muted"><lang class="lang_loading">Loading…</lang></td></tr>'); $('#taxsummary_foot').html(''); var url = 'sales/taxSummaryReportTable?starting_date=' + encodeURIComponent(from) + '&ending_date=' + encodeURIComponent(to); @@ -4205,8 +6156,11 @@ PosnicPro.taxsummaryreport = { PosnicPro.taxsummaryreport._last = d; var rows = (d && d.list) || []; var cur = PosnicPro.local.get('currencySign') || ''; + /* The GST position renders even for a range with no sales - a + period of pure purchasing still builds credit. */ + PosnicPro.taxsummaryreport.renderGst(d, cur); if (!rows.length) { - $('#taxsummary_body').html('<tr><td colspan="6" class="text-center text-muted">No sales in this range.</td></tr>'); + $('#taxsummary_body').html('<tr><td colspan="6" class="text-center text-muted"><lang class="lang_no_sales_in_this_range">No sales in this range.</lang></td></tr>'); return; } var esc = function (s) { @@ -4228,20 +6182,71 @@ PosnicPro.taxsummaryreport = { $('#taxsummary_body').html(html); var t = d.totals || {}; $('#taxsummary_foot').html('<tr class="font-weight-bold">' - + '<td colspan="2">Total</td>' + + '<td colspan="2"><lang class="lang_total_title">Total</lang></td>' + '<td class="text-right">' + cur + ' ' + (t.net || 0).toFixed(2) + '</td>' + '<td class="text-right">' + cur + ' ' + (t.tax || 0).toFixed(2) + '</td>' + '<td class="text-right">' + cur + ' ' + (t.gross || 0).toFixed(2) + '</td>' + '<td></td></tr>'); }, function () { - $('#taxsummary_body').html('<tr><td colspan="6" class="text-center text-danger">Could not load the summary.</td></tr>'); + $('#taxsummary_body').html('<tr><td colspan="6" class="text-center text-danger"><lang class="lang_could_not_load_the_summary">Could not load the summary.</lang></td></tr>'); }); }, + /* + * The GST position (owner: "we need to know how we already paid tax + * while purchase... exactly how much need to pay"). Output minus input + * credit, the way GSTR-3B owes it; a credit surplus carries forward + * rather than going negative. + */ + renderGst: function (d, cur) { + var gst = d && d.gst; + var p = (d && d.purchases) || { list: [], totals: {} }; + if (!gst) { $('#taxsummary_gst_card').hide(); return; } + var money = function (v) { return cur + ' ' + (Number(v) || 0).toFixed(2); }; + var cell = function (label, value, tone) { + return '<div class="col-md-3 col-6 mb-2">' + + '<div style="font-size:12px;color:#69758c;">' + label + '</div>' + + '<div style="font-size:18px;font-weight:700;' + (tone ? 'color:' + tone + ';' : '') + '">' + money(value) + '</div>' + + '</div>'; + }; + $('#taxsummary_gst').html( + cell('Output tax (sales)', gst.output_tax) + + cell('Input tax credit (purchases)', gst.input_tax_credit) + + cell('Net payable', gst.net_payable, '#d33a2c') + + (Number(gst.credit_carry_forward) > 0 + ? cell('Credit carried forward', gst.credit_carry_forward, '#1a7f37') + : '') + ); + var rows = p.list || []; + if (!rows.length) { + $('#taxsummary_purchase_body').html('<tr><td colspan="5" class="text-center text-muted"><lang class="lang_no_purchases_in_this_range">No purchases in this range.</lang></td></tr>'); + $('#taxsummary_purchase_foot').html(''); + } else { + var html = ''; + rows.forEach(function (r) { + html += '<tr>' + + '<td>' + (r.rate ? r.rate + '%' : '<span class="text-muted">0% / untaxed</span>') + '</td>' + + '<td class="text-right">' + money(r.net) + '</td>' + + '<td class="text-right">' + money(r.tax) + '</td>' + + '<td class="text-right">' + money(r.gross) + '</td>' + + '<td class="text-right">' + (r.lines || 0) + '</td>' + + '</tr>'; + }); + $('#taxsummary_purchase_body').html(html); + var t = p.totals || {}; + $('#taxsummary_purchase_foot').html('<tr class="font-weight-bold">' + + '<td><lang class="lang_total_title">Total</lang></td>' + + '<td class="text-right">' + money(t.net) + '</td>' + + '<td class="text-right">' + money(t.tax) + '</td>' + + '<td class="text-right">' + money(t.gross) + '</td>' + + '<td></td></tr>'); + } + $('#taxsummary_gst_card').show(); + }, exportCsv: function () { var d = PosnicPro.taxsummaryreport._last; var rows = (d && d.list) || []; if (!rows.length) { - PosnicPro.alert('warning', 'Run the report first - there is nothing to export.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_run_the_report_first_there_is_nothing_to_e', 'Run the report first - there is nothing to export.')); return; } var out = rows.map(function (r) { @@ -4288,12 +6293,12 @@ PosnicPro.roster = { return d.getDate() + ' ' + d.toLocaleString(undefined, { month: 'short' }); }; $('#roster_week_label').text(label(monday) + ' – ' + label(sunday)); - $('#roster_view_body').html('<div class="text-center text-muted p-4">Loading…</div>'); + $('#roster_view_body').html('<div class="text-center text-muted p-4"><lang class="lang_loading">Loading…</lang></div>'); var url = 'shifts/schedule?from=' + encodeURIComponent(fmt(monday)) + '&to=' + encodeURIComponent(fmt(sunday)); PosnicPro.get(url, function (res) { PosnicPro.roster._render((res && res.data) || []); }, function () { - $('#roster_view_body').html('<div class="text-center text-danger p-4">Could not load the roster.</div>'); + $('#roster_view_body').html('<div class="text-center text-danger p-4"><lang class="lang_could_not_load_the_roster">Could not load the roster.</lang></div>'); }); }, _render: function (entries) { @@ -4318,9 +6323,9 @@ PosnicPro.roster = { html += '<div class="mb-3' + (isToday ? ' p-2 rounded" style="background:rgba(0,123,255,.06);' : '"') + '">' + '<h6 class="mb-1">' + d.toLocaleString(undefined, { weekday: 'long' }) + ' <small class="text-muted">' + d.getDate() + ' ' + d.toLocaleString(undefined, { month: 'short' }) + '</small>' - + (isToday ? ' <span class="badge badge-primary">Today</span>' : '') + '</h6>'; + + (isToday ? ' <span class="badge badge-primary"><lang class="lang_this_day">Today</lang></span>' : '') + '</h6>'; if (!day.length) { - html += '<small class="text-muted">No one planned.</small>'; + html += '<small class="text-muted"><lang class="lang_no_one_planned">No one planned.</lang></small>'; } else { day.sort(function (a, b) { return String(a.start).localeCompare(String(b.start)); }); day.forEach(function (e) { @@ -4349,12 +6354,12 @@ PosnicPro.workforce = { }, loadOnShift: function () { var today = PosnicPro.shiftWidget._fmtDate(new Date()); - $('#wf_onshift_body').html('<tr><td colspan="2" class="text-center text-muted">Loading…</td></tr>'); + $('#wf_onshift_body').html('<tr><td colspan="2" class="text-center text-muted"><lang class="lang_loading">Loading…</lang></td></tr>'); PosnicPro.get('shifts/report?from=' + today + '&to=' + today, function (response) { var rows = ((response && response.data && response.data.rows) || []) .filter(function (r) { return r.open_shifts; }); if (!rows.length) { - $('#wf_onshift_body').html('<tr><td colspan="2" class="text-center text-muted">No one is clocked in right now.</td></tr>'); + $('#wf_onshift_body').html('<tr><td colspan="2" class="text-center text-muted"><lang class="lang_no_one_is_clocked_in_right_now">No one is clocked in right now.</lang></td></tr>'); return; } var esc = function (s) { @@ -4370,7 +6375,7 @@ PosnicPro.workforce = { }); $('#wf_onshift_body').html(html); }, function () { - $('#wf_onshift_body').html('<tr><td colspan="2" class="text-center text-danger">Could not load shifts.</td></tr>'); + $('#wf_onshift_body').html('<tr><td colspan="2" class="text-center text-danger"><lang class="lang_could_not_load_shifts">Could not load shifts.</lang></td></tr>'); }); }, openRosterTab: function () { diff --git a/frontend/static/script/js/core/ajax.js b/frontend/static/script/js/core/ajax.js index 869a96ada..db266d84c 100644 --- a/frontend/static/script/js/core/ajax.js +++ b/frontend/static/script/js/core/ajax.js @@ -1,5 +1,53 @@ +/* + * MOBILE BOOT STAGING. Every death record from the iOS crash hunt shows the + * same scene: a dozen parallel warm-up calls (master lists, reference data) + * landing together at 1-3s and the engine dying in the churn. On phones, + * those calls now WAIT: nothing on the defer list leaves the device until + * 8s after boot (or the first navigation away from the dashboard), and then + * one at a time, 300ms apart. Dashboard content itself (overview, checklist, + * low stock, auth) is never deferred. Desktop is untouched. + */ +PosnicPro._bootStage = { + start: Date.now(), + queue: [], + draining: false, + DEFER: /(AjaxList|getJSON(Country|State|Currency|TimeZone|GstState)|getDenomAll|getPaymentAll|getTableOrderAll|taxProfile|getDefaultCustomer|getDefaultSupplier|getTaxAll$|getBranchList|quantityCount)/, + shouldDefer: function (params, method) { + if (!window.__mobileSafeMode || method !== 'GET' || this.draining) { return false; } + /* a convalescent boot (reopened within minutes of a kill) never + fires the warm-ups at all - the tab is living on the smallest + memory budget iOS will ever give it */ + if (window.__posnicConvalescent) { return true; } + if (Date.now() - this.start > 8000) { return false; } + var h = window.location.hash; + if (h && h !== '#/' && h !== '#/dashboard') { return false; } + return this.DEFER.test(String(params.url || '')); + }, + drain: function () { + if (this.draining) { return; } + this.draining = true; + var self = this; + (function next() { + var job = self.queue.shift(); + if (!job) { return; } + try { PosnicPro.request(job.p, job.cb, job.fail); } catch (e) { } + setTimeout(next, 300); + })(); + } +}; +setTimeout(function () { + if (!window.__posnicConvalescent) { PosnicPro._bootStage.drain(); } +}, 8000); +window.addEventListener('hashchange', function () { + if (window.location.hash !== '#/dashboard') { PosnicPro._bootStage.drain(); } +}); + PosnicPro.request = function (params, callback, failure = null) { var method = params.method ? params.method : 'GET'; + if (PosnicPro._bootStage.shouldDefer(params, method)) { + PosnicPro._bootStage.queue.push({ p: params, cb: callback, fail: failure }); + return; + } var url = API_URL + params.url; var data = params.data ? params.data : {}; @@ -130,20 +178,20 @@ PosnicPro.request = function (params, callback, failure = null) { * person what happened and lets them carry on. */ if (xhr.status === 0) { - PosnicPro.alert('error', 'No connection. Check the network and try again - nothing was saved.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_no_connection_check_the_network_and_try_ag', 'No connection. Check the network and try again - nothing was saved.')); } else if (xhr.status === 403) { - PosnicPro.alert('error', 'You do not have permission for that.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_you_do_not_have_permission_for_that', 'You do not have permission for that.')); } else if (xhr.status === 404) { - PosnicPro.alert('error', 'That could not be found. Try refreshing the page.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_that_could_not_be_found_try_refreshing_the', 'That could not be found. Try refreshing the page.')); } else if (xhr.status >= 500) { - PosnicPro.alert('error', 'The server hit a problem. Try again in a moment.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_the_server_hit_a_problem_try_again_in_a_mo', 'The server hit a problem. Try again in a moment.')); } else if (error === 'timeout') { - PosnicPro.alert('error', 'The server took too long. Try again.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_the_server_took_too_long_try_again', 'The server took too long. Try again.')); } else if (error === 'abort') { return false; // a cancelled request is not an error to shout about } else { console.error('Unhandled request failure:', xhr.status, xhr.responseText); - PosnicPro.alert('error', 'Something went wrong. Try again, and check the network if it keeps happening.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_something_went_wrong_try_again_and_check_t', 'Something went wrong. Try again, and check the network if it keeps happening.')); } return false; } diff --git a/frontend/static/script/js/core/analytics-inject.js b/frontend/static/script/js/core/analytics-inject.js new file mode 100644 index 000000000..b4a57a694 --- /dev/null +++ b/frontend/static/script/js/core/analytics-inject.js @@ -0,0 +1,35 @@ +/* + * The shop's own Google Analytics, injected only when the shop turned it on. + * + * Owner's design: "make it as feature. on / off with entering GA value." + * The id comes from /runtime-info (per shop process, pre-auth by design, and + * a measurement id is not a secret - it sits in the page source of every + * GA-carrying site on the web). Nothing here runs for an unconfigured shop: + * no request to Google ever leaves the page, and the server's CSP would + * refuse it anyway - the header only admits the Google domains while the + * feature is on. That pairing is what keeps PRIVACY.md's "no analytics + * unless YOU switch it on" true by construction on both ends. + */ +(function () { + 'use strict'; + try { + var x = new XMLHttpRequest(); + x.open('GET', 'runtime-info', true); + x.onload = function () { + try { + var info = JSON.parse(x.responseText || '{}'); + var a = info.analytics || {}; + if (!a.enabled || !/^G-[A-Z0-9]{4,14}$/.test(String(a.id || ''))) { return; } + window.dataLayer = window.dataLayer || []; + window.gtag = function () { window.dataLayer.push(arguments); }; + window.gtag('js', new Date()); + window.gtag('config', a.id); + var s = document.createElement('script'); + s.async = true; + s.src = 'https://www.googletagmanager.com/gtag/js?id=' + encodeURIComponent(a.id); + document.head.appendChild(s); + } catch (e) { /* analytics must never break a till */ } + }; + x.send(); + } catch (e) { /* same rule */ } +})(); diff --git a/frontend/static/script/js/core/command-palette.js b/frontend/static/script/js/core/command-palette.js index ca573f0ae..ed54b9648 100644 --- a/frontend/static/script/js/core/command-palette.js +++ b/frontend/static/script/js/core/command-palette.js @@ -166,8 +166,8 @@ * reads it - one fetch, no race with an unfiltered load. */ var ENTITY_SOURCES = [ - { module: 'items', label: 'Item', acl: ['item', 'read'] }, - { module: 'customers', label: 'Customer', acl: ['customer', 'read'] }, + { module: 'items', label: 'Item', t: 'lang_newitem_title', acl: ['item', 'read'] }, + { module: 'customers', label: 'Customer', t: 'lang_newcustomer_title', acl: ['customer', 'read'] }, ]; function searchEntities(query, done) { @@ -184,7 +184,7 @@ for (var i = 0; i < Math.min(list.length, 4); i++) { var value = list[i] && (list[i].value || list[i]); if (typeof value === 'string' && value) { - found.push({ name: value, kind: src.label, module: src.module, value: value }); + found.push({ name: value, kind: src.label, kindKey: src.t, module: src.module, value: value }); } } if (--pending === 0) done(found); @@ -223,9 +223,9 @@ var overlay = document.createElement('div'); overlay.id = 'cmdk-overlay'; overlay.innerHTML = - '<div id="cmdk-box" role="dialog" aria-label="Command palette">' + + '<div id="cmdk-box" role="dialog" aria-label="Command palette" data-t-aria-label="lang_command_palette">' + '<input id="cmdk-input" type="text" autocomplete="off" spellcheck="false" ' + - 'placeholder="Type a page or action…" aria-label="Search commands">' + + 'placeholder="Type a page or action…" aria-label="Search commands" data-t-aria-label="lang_search_commands">' + '<div id="cmdk-list" role="listbox"></div>' + '<div id="cmdk-hint">↑↓ navigate   Enter open   Esc close</div>' + '</div>'; @@ -274,12 +274,15 @@ for (var i = 0; i < state.results.length; i++) { var cmd = state.results[i]; var kind = cmd.kind ? cmd.kind : (cmd.hash ? '' : 'action'); + var kindKey = cmd.kind ? cmd.kindKey : (cmd.hash ? '' : 'lang_action'); html += '<div class="cmdk-item' + (i === state.index ? ' cmdk-active' : '') + '" data-i="' + i + '" role="option">' + $('<span>').text(cmd.name).html() + - (kind ? '<span class="cmdk-kind">' + kind + '</span>' : '') + + (kind ? '<span class="cmdk-kind">' + + (kindKey ? '<lang class="' + kindKey + '">' + kind + '</lang>' : kind) + + '</span>' : '') + '</div>'; } - if (!state.results.length) html = '<div class="cmdk-empty">Nothing matches</div>'; + if (!state.results.length) html = '<div class="cmdk-empty"><lang class="lang_nothing_matches">Nothing matches</lang></div>'; list.innerHTML = html; $(list).children('.cmdk-item').off('click').on('click', function () { pick(Number($(this).data('i'))); diff --git a/frontend/static/script/js/core/demo-mode.js b/frontend/static/script/js/core/demo-mode.js new file mode 100644 index 000000000..32d4f5d3b --- /dev/null +++ b/frontend/static/script/js/core/demo-mode.js @@ -0,0 +1,146 @@ +/* + * The public demo's face (DEMO_SHOP_PLAN §3-4). + * + * Reads the demo flag from /runtime-info and, ONLY when it is set: + * - a slim permanent bar: this is the public demo, it resets hourly, + * and where to get the real thing; + * - on the login page, one-tap "Enter as admin / manager / cashier" + * buttons - the logins are published, nobody should have to type. + * - one signup nudge, three minutes into real use, once per browser + * EVER (localStorage) - the owner's brief was "market little bit... + * not too much annoy", and a second showing is where annoy starts. + * + * Everywhere else this file is a fetch and a no-op. The buttons only FILL + * the form; the server's own login path does the rest, so nothing here is + * an authentication mechanism - it is typing, automated. + */ +(function () { + 'use strict'; + try { + var x = new XMLHttpRequest(); + x.open('GET', 'runtime-info', true); + x.onload = function () { + try { + var info = JSON.parse(x.responseText || '{}'); + if (!info.demo) { return; } + + /* + * Where a signup from here came from. + * + * Without it, somebody who spent ten minutes in the demo and + * then signed up was indistinguishable from someone who typed + * the address - both arrive as "direct", and the one channel + * we fully control is the one we cannot measure. + * + * Falls back to the bare URL if the helper is not on the page, + * because a missing measurement must never cost a signup. + */ + var signupHref = function (surface) { + try { + if (window.PosnicSignupLink) { + return window.PosnicSignupLink.signupUrl(info, surface); + } + } catch (e) { /* fall through */ } + return 'https://posnic.com/signup.html'; + }; + + var bar = document.createElement('div'); + bar.id = 'posnic_demo_bar'; + bar.setAttribute('style', + 'position:fixed;left:0;right:0;bottom:0;z-index:2147482000;' + + 'background:#16203a;color:#fff;font:12.5px/1.4 system-ui,Segoe UI,Arial,sans-serif;' + + 'padding:7px 14px;text-align:center;'); + bar.innerHTML = + 'Public demo. Everything resets on the hour. ' + + '<a href="' + signupHref('demo_bar') + '" style="color:#8ab4ff;font-weight:600;">Create your free shop</a>' + + '<span style="opacity:.65;"> · no credit card, and the offline desktop till is free forever</span>'; + document.body.appendChild(bar); + document.body.style.paddingBottom = '34px'; + + var user = document.getElementById('username'); + var pass = document.getElementById('password'); + if (user && pass) { + var wrap = document.createElement('div'); + wrap.setAttribute('style', 'margin:12px 0 0;display:flex;gap:8px;flex-wrap:wrap;'); + [['admin', 'Enter as admin'], ['manager', 'Enter as manager'], ['cashier', 'Enter as cashier']] + .forEach(function (role) { + var b = document.createElement('button'); + b.type = 'button'; + b.textContent = role[1]; + b.setAttribute('style', + 'flex:1 1 0;padding:9px 6px;border:1px solid #cfd6dd;border-radius:6px;' + + 'background:#f6f8fb;cursor:pointer;font-size:13px;'); + b.onclick = function () { + user.value = role[0]; + pass.value = role[0]; + var go = document.getElementById('login_button'); + if (go) { go.click(); } + }; + wrap.appendChild(b); + }); + var anchor = document.getElementById('login_button'); + if (anchor && anchor.parentElement) { + anchor.parentElement.appendChild(wrap); + } + } + + /* The nudge. Only past the login door (a visitor reading the + login page has not used anything yet), only after three + minutes of actual use measured across pages, and only once + per browser, ever. localStorage failures mean no nudge - + never a broken page. */ + if (!user && !pass) { + try { + if (!localStorage.getItem('posnic_demo_nudge_done')) { + var first = parseInt(localStorage.getItem('posnic_demo_first_seen'), 10); + if (!first || first > Date.now()) { + first = Date.now(); + localStorage.setItem('posnic_demo_first_seen', String(first)); + } + var waited = Date.now() - first; + /* however long they have explored, let the page + they just opened breathe before interrupting */ + var delay = Math.max(180000 - waited, 30000); + setTimeout(function () { + try { + if (localStorage.getItem('posnic_demo_nudge_done')) { return; } + localStorage.setItem('posnic_demo_nudge_done', '1'); + var veil = document.createElement('div'); + veil.id = 'posnic_demo_nudge'; + veil.setAttribute('style', + 'position:fixed;inset:0;z-index:2147483000;background:rgba(10,14,25,.55);' + + 'display:flex;align-items:center;justify-content:center;padding:20px;'); + var card = document.createElement('div'); + card.setAttribute('style', + 'background:#fff;color:#16203a;max-width:420px;width:100%;border-radius:10px;' + + 'padding:26px 24px 20px;font:14px/1.55 system-ui,Segoe UI,Arial,sans-serif;' + + 'box-shadow:0 18px 50px rgba(0,0,0,.35);text-align:center;'); + card.innerHTML = + '<div style="font-size:19px;font-weight:700;margin-bottom:8px;"><lang class="lang_making_this_shop_yours">Making this shop yours?</lang></div>' + + '<div style="margin-bottom:18px;">Create your own free shop in a minute. No credit card, no commitment. ' + + 'If you never renew, you simply continue on the free Community Edition.</div>' + + '<a href="' + signupHref('demo_nudge') + '" target="_blank" rel="noopener" style="display:block;' + + 'background:#16203a;color:#fff;text-decoration:none;font-weight:600;padding:11px;border-radius:7px;margin-bottom:10px;">' + + 'Create my free shop</a>' + + '<button type="button" id="posnic_demo_nudge_close" style="background:none;border:none;color:#5a6478;' + + 'cursor:pointer;font-size:13px;padding:6px;">Keep exploring</button>'; + veil.appendChild(card); + var close = function () { + if (veil.parentElement) { veil.parentElement.removeChild(veil); } + document.removeEventListener('keydown', onKey); + }; + var onKey = function (ev) { if (ev.key === 'Escape') { close(); } }; + veil.onclick = function (ev) { if (ev.target === veil) { close(); } }; + document.addEventListener('keydown', onKey); + document.body.appendChild(veil); + card.querySelector('#posnic_demo_nudge_close').onclick = close; + } catch (e) { /* no nudge over a broken page, ever */ } + }, delay); + } + } catch (e) { /* localStorage unavailable - skip the nudge */ } + } + } catch (e) { /* the demo face must never break a real till */ } + }; + x.send(); + } catch (e) { /* same rule */ } +})(); diff --git a/frontend/static/script/js/core/desktop-nudge.js b/frontend/static/script/js/core/desktop-nudge.js new file mode 100644 index 000000000..a26077d34 --- /dev/null +++ b/frontend/static/script/js/core/desktop-nudge.js @@ -0,0 +1,282 @@ +/* + * One offer of the desktop app, mid-session, in a browser. + * + * Owner: "in order promote the desktop app inbetween web session show pop that + * Desktop app is better way to control hardwares and faster and works when + * internet down." Then, on the three designs: "all 3 good. radomly show that." + * + * So one of three posters is chosen at random per browser. That is not + * decoration: it is the only way to find out which argument actually moves a + * shopkeeper, and the choice is recorded so the answer is readable later. + * + * WHERE IT MUST NOT APPEAR, and why each of these is deliberate: + * + * inside the desktop app they already have it. The one audience guaranteed + * to be insulted by the offer. + * on the public demo the owner's standing rule for demo.posnic.io is no + * blocking notifications. A visitor evaluating the + * product must never meet a veil. + * on a self-hosted server mode 'local' is a shop running its own server, and + * the other browsers on that LAN are clients of it. + * The desktop app is a whole standalone till with its + * own database, not a client. Telling a LAN cashier + * to install it is how two shops' data ends up in one + * place, which is a bug we have had once already and + * are not inviting back. Cloud only. + * while a sale is open a popup over a customer being billed is worse than + * no popup at all. Busy defers, it does not cancel. + * + * Shown once per browser, ever. Marked done the moment it renders rather than + * when it is closed, so navigating away mid-poster does not earn a second one. + */ +(function () { + 'use strict'; + + var DOWNLOAD_URL = 'https://web.posnic.com/download.html'; + + var DONE = 'posnic_desktop_nudge_done'; + var SHOWN = 'posnic_desktop_nudge_variant'; + var FIRST_SEEN = 'posnic_desktop_first_seen'; + /* Set when the card under the login form was dismissed. Somebody who has + already said no to this once should not be asked again in a veil. */ + var LOGIN_CARD_DISMISSED = 'posnic_web_ok'; + + var USE_BEFORE_ASKING = 240000; /* four minutes of real use, across pages */ + var SETTLE = 45000; /* let the page just opened breathe first */ + var RETRY = 30000; /* they were mid-sale; come back quietly */ + + /* + * localStorage does not merely return null when it is unavailable, it + * THROWS: a private window, or a browser set to block site data, raises on + * get and on set alike. Unguarded, either one takes down its caller. + */ + function get(key) { + try { return localStorage.getItem(key); } catch (e) { return null; } + } + function set(key, value) { + try { localStorage.setItem(key, value); } catch (e) { /* asked again another day */ } + } + + /** + * Is the person in the middle of something a veil would ruin? + * Anything true here defers the poster rather than dropping it. + */ + function busy() { + /* A sale or a return being built. The empty cart carries a placeholder + row, which is the one row that does not count. */ + var rows = document.querySelectorAll( + '#sales_new_items_table tbody tr, #sales_return_items_table tbody tr'); + for (var i = 0; i < rows.length; i++) { + if (rows[i].id !== 'sales_new_tablerow_content_area') { return true; } + } + if (document.getElementById('posnic-lock')) { return true; } + if (document.querySelector('.modal.show, .modal.in, .swal2-container')) { return true; } + var el = document.activeElement; + if (el && /^(INPUT|TEXTAREA|SELECT)$/.test(el.tagName)) { return true; } + return false; + } + + /* ------------------------------------------------------------------ * + * The three posters. Fixed colours rather than theme tokens: this is + * artwork, and it should read the same on every shop's theme. + * ------------------------------------------------------------------ */ + + function actions(tone) { + var primary = tone === 'light' + ? 'background:#4C63D2;color:#fff;' + : 'background:#fff;color:#1B2352;'; + var quiet = tone === 'light' ? 'color:#8B93A8;' : 'color:#AEB6DC;'; + return '<div style="display:flex;align-items:center;gap:14px;flex-wrap:wrap;margin-top:20px;">' + + '<a href="' + DOWNLOAD_URL + '" target="_blank" rel="noopener" id="posnic_dn_get" ' + + 'style="' + primary + 'text-decoration:none;font-weight:700;font-size:13.5px;' + + 'padding:10px 18px;border-radius:8px;">Download free</a>' + + '<button type="button" id="posnic_dn_later" style="background:none;border:none;cursor:pointer;' + + 'font:inherit;font-size:13px;' + quiet + 'padding:6px 2px;">Keep working</button></div>'; + } + + var POSTERS = { + /* Leads with the one thing a browser genuinely cannot do. */ + counter: function () { + return '<div style="position:relative;overflow:hidden;' + + 'background:linear-gradient(150deg,#202A63 0%,#161C3A 62%,#10142B 100%);color:#fff;">' + + '<svg viewBox="0 0 300 300" aria-hidden="true" style="position:absolute;right:-16px;bottom:0;' + + 'height:100%;width:46%;">' + + '<rect x="86" y="52" width="150" height="98" rx="7" fill="#2B3574"/>' + + '<rect x="94" y="60" width="134" height="82" rx="4" fill="#EEF1FF"/>' + + '<rect x="94" y="60" width="30" height="82" fill="#4C63D2"/>' + + '<rect x="132" y="70" width="60" height="7" rx="3.5" fill="#4C63D2"/>' + + '<rect x="132" y="86" width="86" height="5" rx="2.5" fill="#C9D2F5"/>' + + '<rect x="132" y="98" width="70" height="5" rx="2.5" fill="#C9D2F5"/>' + + '<rect x="132" y="118" width="44" height="14" rx="4" fill="#34D399"/>' + + '<rect x="150" y="150" width="22" height="16" fill="#232C63"/>' + + '<rect x="126" y="166" width="70" height="7" rx="3.5" fill="#2B3574"/>' + + '<rect x="196" y="186" width="76" height="52" rx="7" fill="#3B4796"/>' + + '<rect x="206" y="176" width="56" height="22" rx="3" fill="#EEF1FF"/>' + + '<rect x="212" y="182" width="44" height="3" rx="1.5" fill="#B9C2EA"/>' + + '<rect x="212" y="189" width="32" height="3" rx="1.5" fill="#B9C2EA"/>' + + '<rect x="206" y="212" width="56" height="6" rx="3" fill="#243070"/>' + + '<rect x="40" y="200" width="104" height="46" rx="6" fill="#3B4796"/>' + + '<rect x="40" y="200" width="104" height="9" rx="4" fill="#4C63D2"/>' + + '<circle cx="92" cy="228" r="7" fill="#243070"/>' + + '<rect x="42" y="150" width="46" height="30" rx="6" fill="#FFB454"/>' + + '<rect x="50" y="158" width="30" height="4" rx="2" fill="#8A5A10"/>' + + '<rect x="50" y="166" width="22" height="4" rx="2" fill="#8A5A10"/></svg>' + + '<div style="position:relative;z-index:2;padding:32px 28px;width:62%;min-width:250px;">' + + '<div style="font-size:27px;font-weight:800;line-height:1.1;letter-spacing:-.02em;">' + + 'Your till, with the <span style="color:#FFB454;">hardware</span> attached.</div>' + + '<div style="font-size:14px;line-height:1.5;color:#B9C0E4;margin-top:12px;">' + + 'Receipt printer, barcode scanner, cash drawer and weighing scale. ' + + 'A browser cannot reach any of them.</div>' + + actions('dark') + '</div></div>'; + }, + + /* One claim, loudly. The strongest line we have for Indian retail. */ + offline: function () { + return '<div style="position:relative;overflow:hidden;background:#161C3A;color:#fff;' + + 'text-align:center;padding:38px 30px 32px;">' + + '<div style="position:absolute;inset:0;background:radial-gradient(46% 60% at 50% 6%,' + + 'rgba(255,180,84,.20),transparent 70%);"></div>' + + '<div style="position:relative;z-index:2;display:flex;flex-direction:column;align-items:center;">' + + '<svg width="66" height="52" viewBox="0 0 66 52" aria-hidden="true">' + + '<path d="M6 17c15-12 39-12 54 0" stroke="#3A4382" stroke-width="5" fill="none" stroke-linecap="round"/>' + + '<path d="M16 27c9-7 25-7 34 0" stroke="#3A4382" stroke-width="5" fill="none" stroke-linecap="round"/>' + + '<circle cx="33" cy="40" r="5" fill="#3A4382"/>' + + '<path d="M8 6l50 40" stroke="#FFB454" stroke-width="5" stroke-linecap="round"/></svg>' + + '<div style="font-size:34px;font-weight:800;line-height:1.05;letter-spacing:-.025em;margin-top:16px;">' + + 'Still selling<br>at <span style="color:#FFB454;">4pm</span>.</div>' + + '<div style="font-size:14px;line-height:1.5;color:#AEB6DC;margin-top:12px;max-width:38ch;">' + + 'The internet went at two. The desktop app keeps taking money, ' + + 'and syncs everything back when the line returns.</div>' + + actions('dark') + '</div></div>'; + }, + + /* The one that survives being skimmed by somebody mid-shift. */ + reasons: function () { + var cell = function (icon, title, detail) { + return '<div style="background:#F3F5FC;border-radius:10px;padding:15px 13px;">' + + icon + + '<div style="font-weight:700;font-size:14px;margin-top:9px;">' + title + '</div>' + + '<div style="font-size:12px;line-height:1.45;color:#6B7390;margin-top:4px;">' + + detail + '</div></div>'; + }; + return '<div style="background:#fff;color:#141A2E;padding:28px 26px 26px;">' + + '<div style="font-size:22px;font-weight:800;letter-spacing:-.018em;line-height:1.2;">' + + 'Posnic runs better on the shop computer</div>' + + '<div style="font-size:13.5px;color:#6B7390;margin-top:5px;">' + + 'Free, no trial clock. Same shop, same data, same login.</div>' + + '<div style="display:grid;grid-template-columns:repeat(3,1fr);gap:12px;margin-top:20px;">' + + cell('<svg width="26" height="26" viewBox="0 0 24 24" aria-hidden="true">' + + '<rect x="4" y="9" width="16" height="9" rx="2" fill="#4C63D2"/>' + + '<rect x="7" y="3.5" width="10" height="5" rx="1" fill="#A9B6EE"/>' + + '<rect x="7" y="15" width="10" height="6" rx="1" fill="#2A3690"/></svg>', + 'Hardware', 'Printer, scanner, drawer, weighing scale.') + + cell('<svg width="26" height="26" viewBox="0 0 24 24" aria-hidden="true">' + + '<path d="M3 8.5c5-4.5 13-4.5 18 0" stroke="#4C63D2" stroke-width="2.4" fill="none" stroke-linecap="round"/>' + + '<circle cx="12" cy="17" r="2.4" fill="#4C63D2"/>' + + '<path d="M4 3l16 17" stroke="#FFB454" stroke-width="2.4" stroke-linecap="round"/></svg>', + 'No internet', 'Keeps selling, syncs when it returns.') + + cell('<svg width="26" height="26" viewBox="0 0 24 24" aria-hidden="true">' + + '<path d="M13 2L5 13h5l-1 9 9-12h-5l1-8z" fill="#4C63D2"/></svg>', + 'Faster', 'The data is on the machine, not a round trip away.') + + '</div>' + actions('light') + '</div>'; + } + }; + + var NAMES = ['counter', 'offline', 'reasons']; + + /** + * Build and show one poster, then never again on this browser. + * @param {string} variant a key of POSTERS + */ + function show(variant) { + var veil = document.createElement('div'); + veil.id = 'posnic_desktop_nudge'; + veil.setAttribute('role', 'dialog'); + veil.setAttribute('aria-modal', 'true'); + veil.setAttribute('aria-label', 'The Posnic desktop app'); + veil.setAttribute('style', + 'position:fixed;inset:0;z-index:2147483000;background:rgba(10,14,25,.55);' + + 'display:flex;align-items:center;justify-content:center;padding:20px;'); + + var card = document.createElement('div'); + card.setAttribute('style', + 'position:relative;max-width:560px;width:100%;border-radius:14px;overflow:hidden;' + + 'font:14px/1.55 system-ui,Segoe UI,Arial,sans-serif;' + + 'box-shadow:0 22px 60px rgba(0,0,0,.4);'); + card.innerHTML = POSTERS[variant]() + + '<button type="button" id="posnic_dn_x" aria-label="Close" data-t-aria-label="lang_close_title" style="position:absolute;' + + 'top:10px;right:12px;background:none;border:none;cursor:pointer;font-size:22px;line-height:1;' + + 'color:' + (variant === 'reasons' ? '#B4BACB' : 'rgba(255,255,255,.6)') + ';padding:4px 6px;">' + + '×</button>'; + veil.appendChild(card); + + var previous = document.activeElement; + var close = function () { + /* Close FIRST. Storage is the nice-to-have; going away is what the + click asked for, and setItem throws where site data is blocked. */ + if (veil.parentElement) { veil.parentElement.removeChild(veil); } + document.removeEventListener('keydown', onKey); + try { if (previous && previous.focus) { previous.focus(); } } catch (e) { /* gone */ } + set(DONE, '1'); + }; + var onKey = function (ev) { if (ev.key === 'Escape') { close(); } }; + veil.onclick = function (ev) { if (ev.target === veil) { close(); } }; + document.addEventListener('keydown', onKey); + + document.body.appendChild(veil); + card.querySelector('#posnic_dn_x').onclick = close; + card.querySelector('#posnic_dn_later').onclick = close; + /* The download opens in its own tab; the veil has done its job either + way, so it goes rather than waiting behind the new tab. */ + card.querySelector('#posnic_dn_get').onclick = function () { close(); }; + + var x = card.querySelector('#posnic_dn_x'); + try { if (x) { x.focus(); } } catch (e) { /* focus is a courtesy */ } + + /* Done at render, not at close: navigating away mid-poster must not + earn a second showing. And record WHICH one, because "all three are + good" is only answerable afterwards if we know what each shop saw. */ + set(DONE, '1'); + set(SHOWN, variant); + try { + if (window.gtag) { + window.gtag('event', 'desktop_nudge_shown', { variant: variant }); + } + } catch (e) { /* measurement never breaks a till */ } + } + + /** Wait for a quiet moment, then show. Busy defers; it never cancels. */ + function whenFree(variant) { + if (get(DONE)) { return; } + if (busy()) { setTimeout(function () { whenFree(variant); }, RETRY); return; } + show(variant); + } + + try { + /* Already on the desktop app. */ + if (navigator.userAgent.indexOf('Electron') !== -1) { return; } + if (get(DONE) || get(LOGIN_CARD_DISMISSED)) { return; } + + var req = new XMLHttpRequest(); + req.open('GET', 'runtime-info', true); + req.onload = function () { + try { + var info = JSON.parse(req.responseText || '{}'); + if (info.demo) { return; } + if (info.mode !== 'cloud') { return; } + + var first = parseInt(get(FIRST_SEEN), 10); + if (!first || first > Date.now()) { + first = Date.now(); + set(FIRST_SEEN, String(first)); + } + var waited = Date.now() - first; + var delay = Math.max(USE_BEFORE_ASKING - waited, SETTLE); + + var variant = NAMES[Math.floor(Math.random() * NAMES.length)]; + setTimeout(function () { whenFree(variant); }, delay); + } catch (e) { /* no poster over a broken page, ever */ } + }; + req.send(); + } catch (e) { /* the offer must never cost anybody a sale */ } +})(); diff --git a/frontend/static/script/js/core/list-filter.js b/frontend/static/script/js/core/list-filter.js new file mode 100644 index 000000000..a6db41393 --- /dev/null +++ b/frontend/static/script/js/core/list-filter.js @@ -0,0 +1,917 @@ +/* + * A filter bar for any data list. + * + * Written once because it is going on every list - quotes, items, sales, + * purchases. The alternative is the same bar copied five times, and this + * codebase has already paid for that twice today: a helper that existed as + * five copies, where each fix only ever landed in whichever copy bit that week. + * + * What it owns: + * - a Filter button that lives in the PAGE HEADER, next to New, and says how + * many filters are active. The panel is closed by default: a list is for + * reading, and a bar that is always open spends height on controls nobody + * is using yet. + * - a compact search box with a "which field" selector and an Exact toggle. + * Exact narrows the ANSWER, not the cost. It is worth being precise about + * this: the server builds /^term$/i, and MongoDB can only use a prefix + * index for a case-SENSITIVE regex, so an exact search scans the branch's + * rows exactly as a fragment search does. What it buys is one right answer + * instead of every row containing the text - which is the whole point when + * a name has been picked from a list. + * - a date range with the presets people actually pick, carrying real times + * rather than bare dates. + * - an optional typeahead per field, so choosing "Customer" offers the + * customers this till actually uses instead of demanding exact spelling. + * + * What each list supplies: its fields, whether it has a date, and what to do + * when the filter changes. Nothing in here knows what a quote is. + */ +PosnicPro.listFilter = { + _mounted: {}, + + /* --------------------------------------------------------------------- + * Date ranges + * + * Every preset returns a real instant, not a bare date. "Today" on a till + * means since midnight, not since some server's idea of the date, so these + * are built in the browser's timezone and sent as ISO. A shop closing at + * 11pm and one closing at 1am both get the day they mean. + * + * Weeks start MONDAY. India reads a business week that way, and the + * alternative silently moves a whole day between "this week" and "last". + * ------------------------------------------------------------------- */ + PRESETS: [ + { key: 'all', label: 'All time', t: 'lang_all_time_2' }, + { key: 'today', label: 'Today', t: 'lang_this_day' }, + { key: 'yesterday', label: 'Yesterday', t: 'lang_yesterday' }, + { key: 'week', label: 'This week', t: 'lang_roster_thisweek' }, + { key: 'month', label: 'This month', t: 'lang_this_month_2' }, + { key: 'year', label: 'This year', t: 'lang_this_year' }, + { key: 'last7', label: 'Last 7 days', t: 'lang_last_7_days' }, + { key: 'last30', label: 'Last 30 days', t: 'lang_last_30_days' }, + { key: 'custom', label: 'Custom range', t: 'lang_custom_range' } + ], + + _startOfDay: function (d) { var x = new Date(d); x.setHours(0, 0, 0, 0); return x; }, + _endOfDay: function (d) { var x = new Date(d); x.setHours(23, 59, 59, 999); return x; }, + + range: function (preset, now) { + var self = PosnicPro.listFilter; + var today = now ? new Date(now) : new Date(); + var s = self._startOfDay, e = self._endOfDay; + var d; + + switch (preset) { + case 'today': + return { from: s(today), to: e(today) }; + case 'yesterday': + d = new Date(today); d.setDate(d.getDate() - 1); + return { from: s(d), to: e(d) }; + case 'week': + d = new Date(today); + // getDay(): 0 = Sunday. Monday-start means Sunday counts as day 7. + d.setDate(d.getDate() - ((d.getDay() + 6) % 7)); + return { from: s(d), to: e(today) }; + case 'month': + d = new Date(today.getFullYear(), today.getMonth(), 1); + return { from: s(d), to: e(today) }; + case 'year': + d = new Date(today.getFullYear(), 0, 1); + return { from: s(d), to: e(today) }; + case 'last7': + d = new Date(today); d.setDate(d.getDate() - 6); + return { from: s(d), to: e(today) }; + case 'last30': + d = new Date(today); d.setDate(d.getDate() - 29); + return { from: s(d), to: e(today) }; + default: + return { from: null, to: null }; + } + }, + + /* --------------------------------------------------------------------- + * State + * ------------------------------------------------------------------- */ + state: function (key) { + var m = PosnicPro.listFilter._mounted[key]; + return m ? m.state : {}; + }, + + /* How many filters a person would say are on. The search FIELD and Exact + are modifiers of the search, not filters in their own right - counting + them would show "3 active" for one typed word. */ + /* + * The search term that is actually IN FORCE, which is not the same as the + * text in the box. + * + * A term below MIN_SEARCH is deliberately never sent - one character + * matches nearly every row, which is the most expensive query anyone can + * run for the least useful answer. But the character is still in the input, + * and state.search follows the input so the box renders what was typed. + * + * Without this split the two drift apart in both directions: the Filter + * button counts a filter that was never applied, and any OTHER trigger - + * picking a status chip, changing the date - reloads with that one + * character attached, applying the search the debounce had just refused to + * run. Both were live until this was added. + */ + _applied: function (st) { + var t = String((st && st.search) || '').trim(); + if (!t) return ''; + /* + * EXACT bypasses the minimum, and the reason is CORRECTNESS rather + * than cost. + * + * Picking a name from the suggestion list sets exact. If the minimum + * still applied, choosing a customer called "K" would silently do + * nothing - a deliberate act with no effect, which is the worst kind + * of nothing. + * + * It is NOT because exact is cheaper. The server builds /^term$/i, and + * MongoDB cannot use a prefix index for a case-insensitive regex, so + * the scan costs what a fragment scan costs. The saving is in the + * answer: one row rather than every row containing the letter. + */ + if (st.exact || st._picked) return t; + var min = PosnicPro.listFilter.MIN_SEARCH || 2; + return t.length >= min ? t : ''; + }, + + activeCount: function (key) { + var st = PosnicPro.listFilter.state(key); + var n = 0; + if (PosnicPro.listFilter._applied(st)) n++; + if (st.preset && st.preset !== 'all') n++; + (st.extra ? Object.keys(st.extra) : []).forEach(function (k) { + if (st.extra[k] !== '' && st.extra[k] != null) n++; + }); + return n; + }, + + /* + * The same state, shaped for the OLDER list endpoints. + * + * quotes was written alongside this bar, so it takes the flat parameters + * params() emits. The lists that came before it - items, sales, receivings + * and nine others - take a `filters` blob that goes almost straight into a + * Mongo query, built until now by PosnicPro.search from the input boxes. + * + * Translating here rather than in each screen is the whole point: three + * copies of this mapping would drift, and drift in a filter is invisible - + * a list quietly answering a slightly different question than the one on + * screen. It is also why the regex is built to match what search() built: + * adopting the bar must not silently change which rows a shop's existing + * habits return. + * + * The date key is the CALLER's, because these lists do not agree on it - + * items filters on updated_date, a sales history on its own sale date - and + * guessing would filter the wrong column while looking like it worked. + */ + _escapeRegex: function (v) { + return String(v).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); + }, + + legacyFilters: function (key, opts) { + var LF = PosnicPro.listFilter; + var m = LF._mounted[key]; + var st = LF.state(key); + var cfg = (m && m.cfg) || {}; + var out = {}; + + var term = LF._applied(st); + if (term) { + var value; + if (st.exact) { + /* Anchored, matching what Exact promises: the whole value, not + a value containing it. */ + value = { $regex: '^' + LF._escapeRegex(term) + '$', $options: 'i' }; + } else { + /* All tokens present, in any order - the behaviour search() + already gave, so "blue shirt" keeps finding "Shirt, blue". */ + var pattern = term.trim().split(/\s+/).filter(function (t) { + return t.length > 0; + }).map(function (t) { + return '(?=.*' + LF._escapeRegex(t) + ')'; + }).join(''); + if (!pattern) { pattern = LF._escapeRegex(term); } + value = { $regex: pattern, $options: 'i' }; + } + + var field = (st.field && st.field !== 'all') ? st.field : ''; + if (field) { + out[field] = value; + } else { + var all = (cfg.searchFields || []).map(function (f) { return f.value; }) + .filter(function (v) { return v && v !== 'all'; }); + if (all.length === 1) { + out[all[0]] = value; + } else if (all.length > 1) { + /* $or is a query operator, not a code operator, so it + passes the app's filter guard - see api mongo-guard.js. */ + out.$or = all.map(function (f) { + var o = {}; + o[f] = value; + return o; + }); + } + } + } + + var dateKey = opts && opts.dateKey; + if (dateKey && (st.from || st.to)) { + var range = {}; + if (st.from) range.$gte = st.from.toISOString(); + if (st.to) range.$lte = st.to.toISOString(); + out[dateKey] = range; + } + + Object.keys(st.extra || {}).forEach(function (k) { + if (st.extra[k] !== '' && st.extra[k] != null) out[k] = st.extra[k]; + }); + return out; + }, + + /* What the server is sent. Defaults are omitted: field=all&exact=false + says exactly what sending neither says, and a request that spells out + its defaults is harder to read in a log. */ + params: function (key) { + var st = PosnicPro.listFilter.state(key); + var out = {}; + var term = PosnicPro.listFilter._applied(st); + if (term) { + out.search = term; + if (st.field && st.field !== 'all') out.field = st.field; + if (st.exact) out.exact = 'true'; + } + if (st.from) out.from = st.from.toISOString(); + if (st.to) out.to = st.to.toISOString(); + Object.keys(st.extra || {}).forEach(function (k) { + if (st.extra[k] !== '' && st.extra[k] != null) out[k] = st.extra[k]; + }); + return out; + } +}; + +/* ------------------------------------------------------------------------- + * Rendering and behaviour + * ---------------------------------------------------------------------- */ +(function () { + var LF = PosnicPro.listFilter; + var esc = function (v) { return $('<span>').text(v == null ? '' : String(v)).html(); }; + + /* A datetime-local value, in LOCAL time. toISOString() would shift it by + the timezone offset and show the user a different hour than they picked. */ + var forInput = function (d) { + if (!d) return ''; + var p = function (n) { return String(n).padStart(2, '0'); }; + return d.getFullYear() + '-' + p(d.getMonth() + 1) + '-' + p(d.getDate()) + + 'T' + p(d.getHours()) + ':' + p(d.getMinutes()); + }; + + /* + * Mounting twice must not throw away what someone has typed. + * + * The first version replaced _mounted[key] wholesale, so a second mount + * reset the search, the date range and the status chips to empty while the + * LIST still showed the filtered results - the bar and the list disagreeing, + * which is the failure this component was written to stop happening five + * times over. + * + * Quotes avoided it with a `_filterMounted` flag on the SCREEN. That works, + * and it is exactly the wrong place for it: every screen that adopts this + * bar would have to remember the same flag, and the first one to forget + * gets a bug that only shows up when a page is re-entered. The component + * owns its own idempotence now. + * + * A different container IS a different mount - that is a real re-parent, + * not a repeat - so it resets. + */ + LF.mount = function (cfg) { + var key = cfg.key; + var existing = LF._mounted[key]; + if (existing && existing.cfg.container === cfg.container) { + /* Config can legitimately change between mounts (a screen adding a + field), so it is refreshed; the STATE is what must survive. + * + * The STRIP must survive too. Every loadList re-mounts on its way + * through, and rebuilding the strip here REPLACED the search input + * while someone was typing in it - focus fell to the page and the + * very next letters became navigation shortcuts (owner: "focus + * going outside input box ... it went to different page"). A live + * strip is never rebuilt; only an EMPTY container renders. */ + existing.cfg = cfg; + if (!$(cfg.container).children().length) { + LF.render(key); + } + return existing; + } + LF._mounted[key] = { + cfg: cfg, + state: { search: '', field: 'all', exact: false, preset: 'all', from: null, to: null, extra: {} } + }; + LF.render(key); + return LF._mounted[key]; + }; + + LF.render = function (key) { + var m = LF._mounted[key]; + if (!m) return; + var cfg = m.cfg, st = m.state; + var $panel = $(cfg.container); + if (!$panel.length) return; + + var fields = cfg.searchFields || [{ value: 'all', label: PosnicPro.i18n.t('lang_all_fields', 'All fields') }]; + /* A single row. The bar sits in the page header between the title and + the buttons, so it has to read as one strip of controls - stacked + rows there would push the header open and misalign against both. */ + var html = '' + + '<div class="lf-row">' + + ' <div class="lf-search">' + + ' <input type="text" class="form-control form-control-sm lf-q" placeholder="' + + esc(cfg.searchPlaceholder || 'Search') + '" autocomplete="off" value="' + esc(st.search) + '">' + + ' <div class="lf-typeahead" style="display:none;"></div>' + + ' </div>' + + ' <select class="form-control form-control-sm lf-field">' + + fields.map(function (f) { + return '<option value="' + esc(f.value) + '"' + (st.field === f.value ? ' selected' : '') + '>' + + esc(f.label) + '</option>'; + }).join('') + + ' </select>' + + ' <label class="lf-exact mb-0" title="Match the whole value, not part of it" data-t-title="lang_match_the_whole_value_not_part_of_it">' + + ' <input type="checkbox" class="lf-exact-cb"' + (st.exact ? ' checked' : '') + '> Exact' + + ' </label>'; + + if (cfg.dateField) { + html += '' + /* The preset and its range editor are wrapped together so the + editor can be positioned against the control that opened it + while staying out of the strip's flow - two datetime-local + inputs are ~185px each and would break the single line. */ + + ' <div class="lf-preset-wrap">' + + ' <select class="form-control form-control-sm lf-preset">' + + LF.PRESETS.map(function (p) { + return '<option value="' + p.key + '"' + (st.preset === p.key ? ' selected' : '') + + (p.t ? ' data-t="' + p.t + '"' : '') + '>' + + esc(p.label) + '</option>'; + }).join('') + + ' </select>' + + ' <div class="lf-custom" style="display:' + (st.preset === 'custom' ? 'flex' : 'none') + ';">' + /* min/max from the current pair, so the range cannot be + inverted on the FIRST edit either - the change handler keeps + them in step after that. */ + + ' <input type="datetime-local" class="form-control form-control-sm lf-from" value="' + forInput(st.from) + '"' + + (st.to ? ' max="' + forInput(st.to) + '"' : '') + '>' + + ' <span class="lf-sep">to</span>' + + ' <input type="datetime-local" class="form-control form-control-sm lf-to" value="' + forInput(st.to) + '"' + + (st.from ? ' min="' + forInput(st.from) + '"' : '') + '>' + + ' </div>' + + ' </div>' + + ' <button type="button" class="btn btn-sm btn-light border lf-clear"><lang class="lang_clear_title">Clear</lang></button>'; + } + html += '</div>'; + + $panel.html(html).attr('data-lf', key); + LF.paintButton(key); + }; + + /* The Filter button lives in the page header. It carries the active count + because a closed panel is otherwise a place filters go to hide - someone + filters to one customer, forgets, and reports the list as broken. */ + LF.paintButton = function (key) { + var m = LF._mounted[key]; + if (!m) return; + var n = LF.activeCount(key); + var $btn = $(m.cfg.button); + if (!$btn.length) return; + $btn.toggleClass('lf-btn-active', n > 0); + $btn.find('.lf-count').remove(); + if (n > 0) $btn.append('<span class="lf-count">' + n + '</span>'); + }; + + /* Toggling is a state, so the button has to look like one. + * + * A button that looks identical open and closed leaves the panel's own + * appearance as the only clue - and the panel sits in a different part of + * the header. Pressing it should look pressed, the way a real toggle does. + * aria-expanded says the same thing to a screen reader. */ + /* + * A filter a screen owns, put where the bar can see it. + * + * Quotes has status chips outside the panel. They filter the list, so if + * the bar does not know about them the Filter button says "0 filters" while + * a filter is on - which is the precise thing the count exists to prevent - + * and Clear leaves the list filtered by something it just told you was + * gone. + * + * Putting the value in `extra` makes the bar the single source of truth: + * it is counted, it is sent, and Clear removes it. The screen learns the + * new value back through onChange, so the chips repaint from the same + * state rather than keeping their own. + */ + LF.setExtra = function (key, name, value) { + var m = LF._mounted[key]; + if (!m) return false; + if (!m.state.extra) m.state.extra = {}; + if (value === '' || value === null || value === undefined) delete m.state.extra[name]; + else m.state.extra[name] = value; + LF._changed(key); + return true; + }; + + LF.toggle = function (key) { + var m = LF._mounted[key]; + if (!m) return; + var $panel = $(m.cfg.container); + var opening = !$panel.is(':visible'); + $panel.slideToggle(120); + $(m.cfg.button).toggleClass('lf-btn-open', opening).attr('aria-expanded', opening ? 'true' : 'false'); + }; + + LF._changed = function (key) { + var m = LF._mounted[key]; + if (!m) return; + LF.paintButton(key); + if (typeof m.cfg.onChange === 'function') m.cfg.onChange(LF.params(key), m.state); + }; + + /* + * Programmatic filter, for doors that land a page PRE-FILTERED - the + * item pane's "all movements for this item" lands on Inventory Logs + * already narrowed to the item, with the strip OPEN so the person can + * see what is applied and add the date range themselves. Rebuilding the + * strip here is safe on purpose: this runs on arrival, never while + * someone is typing in it. + */ + LF.preset = function (key, opts) { + var m = LF._mounted[key]; + if (!m) return; + opts = opts || {}; + m.state.search = String(opts.search || ''); + m.state.field = opts.field || 'all'; + m.state.exact = !!opts.exact; + m.state._picked = !!opts.exact; + var $panel = $(m.cfg.container); + $panel.empty(); + LF.render(key); + if (!$panel.is(':visible')) { + $panel.show(); + $(m.cfg.button).addClass('lf-btn-open').attr('aria-expanded', 'true'); + } + LF._changed(key); + }; + + var owner = function (el) { return $(el).closest('[data-lf]').attr('data-lf'); }; + + /* Search-as-you-type, without a query per letter. + * + * Three things keep this honest, and they matter more in the cloud than on + * a till: there the database is local, but pos.sbala.in is a network hop + * AND one process serving many shops, so an expensive scan competes with + * somebody else's request. + * + * 1. DEBOUNCE. Typing is not a decision. "acme" is one request after the + * pause, not four. + * 2. MINIMUM LENGTH. One character matches almost every row - the most + * expensive query anyone can run and the least useful answer. Below + * the minimum the list simply keeps what it has. + * 3. SEQUENCE GUARD (in the calling module): a slow response that lands + * after a newer one is dropped, so results cannot arrive out of order. + * + * The typeahead is exempt from all of it - it reads cached recents, so it + * updates on every keystroke and costs nothing. + */ + LF.MIN_SEARCH = 2; + LF.DEBOUNCE_MS = 350; + + LF.shouldQuery = function (term) { + var t = String(term || '').trim(); + // clearing is always worth a request - it is how you get the list back + return t.length === 0 || t.length >= LF.MIN_SEARCH; + }; + + $(document).on('input', '.lf-q', function () { + var key = owner(this); + if (!key) return; + var term = $.trim(this.value); + LF._mounted[key].state.search = term; + /* typing again is no longer the picked value */ + LF._mounted[key].state._picked = false; + + // cached, so it can keep up with every keystroke + LF.typeahead(key, this.value); + + clearTimeout(LF._mounted[key]._t); + if (!LF.shouldQuery(term)) { + // one character: keep the list as it is rather than scanning for it + LF.paintButton(key); + return; + } + LF._mounted[key]._t = setTimeout(function () { LF._changed(key); }, LF.DEBOUNCE_MS); + }); + + $(document).on('change', '.lf-field,.lf-exact-cb', function () { + var key = owner(this); + if (!key) return; + var st = LF._mounted[key].state; + st.field = $(this).closest('[data-lf]').find('.lf-field').val(); + st.exact = $(this).closest('[data-lf]').find('.lf-exact-cb').is(':checked'); + /* Choosing Customer is what SHOWS the customer suggestions now (and + choosing anything else hides them) - re-evaluate with the term + already typed. */ + LF.typeahead(key, $(this).closest('[data-lf]').find('.lf-q').val()); + + /* + * Both of these MODIFY a search rather than being one. With no term in + * force, params() omits them entirely, so reloading would send a + * request byte-identical to the one already on screen - a round trip + * per dropdown change for a list that cannot move. + * + * The check runs AFTER the state is updated, and that ordering matters: + * ticking Exact can bring a below-minimum term INTO force (see + * _applied), so the very keystroke that makes a reload necessary is one + * of the two this guard would otherwise skip. + */ + if (!LF._applied(st)) { + LF.paintButton(key); + return; + } + LF._changed(key); + }); + + $(document).on('change', '.lf-preset', function () { + var key = owner(this); + if (!key) return; + var st = LF._mounted[key].state; + st.preset = this.value; + var $panel = $(this).closest('[data-lf]'); + $panel.find('.lf-custom').css('display', st.preset === 'custom' ? 'flex' : 'none'); + if (st.preset !== 'custom') { + var r = LF.range(st.preset); + st.from = r.from; st.to = r.to; + $panel.find('.lf-from').val(forInput(st.from)); + $panel.find('.lf-to').val(forInput(st.to)); + LF._changed(key); + } + }); + + $(document).on('change', '.lf-from,.lf-to', function () { + var key = owner(this); + if (!key) return; + var st = LF._mounted[key].state; + var $panel = $(this).closest('[data-lf]'); + var $from = $panel.find('.lf-from'); + var $to = $panel.find('.lf-to'); + var from = $from.val(); + var to = $to.val(); + + /* + * An inverted range cannot be entered, rather than being caught after. + * + * "To" before "from" matches nothing, and the list then says "no quotes + * match this search" - true and useless, because the search is not what + * is wrong. Letting the browser refuse it beats any message we could + * write: min/max on datetime-local is native, needs no validation UI, + * and the picker will not offer the bad dates in the first place. + * + * Set from the CURRENT values on every change, so widening one end + * releases the other rather than trapping someone who picked the wrong + * one first. + */ + $to.attr('min', from || null); + $from.attr('max', to || null); + + st.from = from ? new Date(from) : null; + st.to = to ? new Date(to) : null; + st.preset = 'custom'; + LF._changed(key); + }); + + $(document).on('click', '.lf-clear', function () { + var key = owner(this); + if (!key) return; + LF._mounted[key].state = { + search: '', field: 'all', exact: false, preset: 'all', from: null, to: null, extra: {} + }; + LF.render(key); + LF._changed(key); + }); +})(); + +/* ------------------------------------------------------------------------- + * The picker + * + * Same shape as the sale screen's Choose-customer popover, because that one is + * already familiar and already right: a titled card, a list where every row + * carries an icon saying WHY it is there, and the recent ones first. + * + * Entity-driven so the next list gets it free. Quotes asks for customers; + * sales will ask for items, purchases for suppliers. Each entity supplies a + * title, an icon and a source - nothing else differs, so nothing else is + * duplicated. + * + * Every source reads what is already cached. A picker that queries per + * keystroke is the thing this whole bar exists to avoid. + * ---------------------------------------------------------------------- */ +(function () { + var LF = PosnicPro.listFilter; + var esc = function (v) { return $('<span>').text(v == null ? '' : String(v)).html(); }; + + /* + * Object.create(null), not {}. + * + * A plain object inherits from Object.prototype, so seen['constructor'] is + * truthy before anything has been stored - as are toString, valueOf and + * hasOwnProperty. A customer or item whose name is one of those would be + * treated as already seen and silently dropped from the suggestions. Rare, + * but the failure is invisible: the row simply is not offered, and nobody + * can tell why. A null-prototype object has no such names. + */ + var uniq = function (rows) { + var seen = Object.create(null), out = []; + rows.forEach(function (r) { + if (!r || !r.label) return; + var k = String(r.id || r.label).toLowerCase(); + if (seen[k]) return; + seen[k] = 1; + out.push(r); + }); + return out; + }; + + var match = function (rows, term) { + var q = String(term || '').trim().toLowerCase(); + if (!q) return rows.slice(0, 8); + return rows.filter(function (r) { + return String(r.label).toLowerCase().indexOf(q) !== -1 + || String(r.note || '').toLowerCase().indexOf(q) !== -1; + }).slice(0, 8); + }; + + /* recent: this till's own history, so it leads and says so with a clock. */ + var recents = function (key) { + try { + if (PosnicPro.sales && typeof PosnicPro.sales._recentGet === 'function') { + return PosnicPro.sales._recentGet(key) || []; + } + } catch (e) { /* a cold till has no history - not an error */ } + return []; + }; + + LF.ENTITIES = { + customer: { + title: 'Choose customer', t: 'lang_choose_customer_2', + icon: 'icon-users', + rows: function () { + var r = recents('recent_customers').map(function (c) { + return { id: c.id, label: c.name, note: c.phone, recent: true }; + }); + var seed = ((PosnicPro.sales && PosnicPro.sales._customerSeed) || []).map(function (c) { + return { id: c.id, label: c.name, note: c.phone }; + }); + return uniq(r.concat(seed)); + }, + /* + * ...and the shop's actual customers, which the rows above do not + * contain. + * + * `rows` is recents plus `_customerSeed`, and that seed is the FIRST + * TEN customers, fetched only by renderRecentCustomers on the sale + * screen. On the quotes page nothing ever calls it, so the seed is + * null and the suggestions are recents alone. + * + * The result was a picker saying "Nothing matches" for a customer + * whose quotes were listed underneath it - because the LIST asks the + * server and the picker was filtering a cache of ten. A suggestion + * box that disagrees with the results it sits on top of is worse + * than no suggestion box. + */ + lookup: function (term, done) { + PosnicPro.get( + { url: 'customers/getCustomersAjaxList', data: 'query=' + encodeURIComponent(term) }, + function (response) { + done(((response && response.suggestions) || []).map(function (c) { + return { id: c._id || c.id, label: c.name, note: c.phone }; + })); + }, + function () { done([]); } /* offline is not an error here */ + ); + } + }, + item: { + title: 'Choose item', t: 'lang_choose_item', + icon: 'icon-box', + rows: function () { + /* price, not sku: that is what the sale screen actually + stores on a recent item (sales.js _recentPush at the add-line + path). Reading a field nothing writes renders a blank note + on every row and looks like a bug in the picker. */ + return uniq(recents('recent_items').map(function (i) { + return { id: i.id, label: i.name, note: i.price, recent: true }; + })); + } + }, + supplier: { + title: 'Choose supplier', t: 'lang_choose_supplier', + icon: 'icon-truck', + rows: function () { + return uniq(recents('recent_suppliers').map(function (s) { + return { id: s.id, label: s.name, note: s.phone, recent: true }; + })); + } + } + }; + + LF.suggest = function (entity, term) { + var e = LF.ENTITIES[entity]; + if (!e) return []; + return match(e.rows(), term); + }; + + LF.typeahead = function (key, term) { + var m = LF._mounted[key]; + if (!m) return; + var $box = $(m.cfg.container).find('.lf-typeahead'); + var entity = m.cfg.typeahead; + var e = entity && LF.ENTITIES[entity]; + if (!e) { $box.hide().empty(); return; } + /* + * Owner: "customer typeahead only drop down customer chose and show + * customer typeahead." Suggestions belong to the field they suggest + * FOR - offering customers while the dropdown says All fields or + * Quote # reads as the search guessing, and picking one silently + * changed the field under the user. Choose Customer, get customers. + */ + if (m.cfg.typeaheadField && m.state.field !== m.cfg.typeaheadField) { + $box.hide().empty(); + return; + } + + var rows = LF.suggest(entity, term); + + /* + * Ask the server too, when the entity knows how. + * + * Cached rows render immediately so the box never feels slow, and the + * server's answer merges in when it lands. `seq` drops a slow reply that + * arrives after a newer keystroke - without it, typing "Cus" then + * "Custom" can end with the results for "Cus" on screen. + */ + if (e.lookup && String(term || '').trim().length >= LF.MIN_SEARCH) { + m._taSeq = (m._taSeq || 0) + 1; + var mine = m._taSeq; + e.lookup(String(term).trim(), function (found) { + if (mine !== m._taSeq) return; + LF.paintTypeahead(key, e, uniq(rows.concat(found || []))); + }); + } + + LF.paintTypeahead(key, e, rows); + }; + + /* Drawing the box, split out so a late server answer can repaint it + without repeating the lookup that produced it. */ + LF.paintTypeahead = function (key, e, rows) { + var m = LF._mounted[key]; + if (!m) return; + var $box = $(m.cfg.container).find('.lf-typeahead'); + var body = rows.length + ? rows.map(function (r) { + /* a clock means "you used this here", a plain icon means "this + exists" - the distinction is why recents are worth showing */ + var ic = r.recent ? 'icon-clock' : e.icon; + return '<a href="javascript:void(0)" class="lf-pick-row" data-name="' + esc(r.label) + '">' + + '<i class="feather ' + ic + '"></i>' + + '<span class="lf-pick-name">' + esc(r.label) + '</span>' + + (r.note ? '<span class="lf-pick-note">' + esc(r.note) + '</span>' : '') + + '</a>'; + }).join('') + : '<div class="lf-pick-empty"><lang class="lang_nothing_matches_press_enter_to_search_anyw">Nothing matches - press Enter to search anyway</lang></div>'; + + $box.html( + '<div class="lf-pick-head">' + + '<span class="lf-pick-title"><i class="feather ' + esc(e.icon) + ' mr-1"></i>' + (e.t ? '<lang class="' + e.t + '">' + esc(e.title) + '</lang>' : esc(e.title)) + '</span>' + + '<a href="javascript:void(0)" class="lf-pick-x" title="Close" data-t-title="lang_close_title">×</a>' + + '</div>' + + '<div class="lf-pick-list">' + body + '</div>' + ).show(); + }; + + /* + * Picking fills the term - and TOUCHES NOTHING ELSE. + * + * The first version also ticked Exact, which read as the checkbox + * deciding things by itself (owner: "exact tick should not ticked by + * default"). The one job Exact was doing there - letting a one-letter + * customer name through the two-character minimum - moves to a picked + * flag that the next keystroke clears. + */ + $(document).on('click', '.lf-pick-row', function () { + var $panel = $(this).closest('[data-lf]'); + var key = $panel.attr('data-lf'); + var m = LF._mounted[key]; + if (!m) return; + var name = String($(this).data('name')); + m.state.search = name; + m.state._picked = true; + $panel.find('.lf-q').val(name); + $panel.find('.lf-typeahead').hide().empty(); + LF._changed(key); + }); + + /* + * Arrow keys and Enter, because the sale screen has them. + * + * The owner asked for this picker to work "similar as in sales new", and + * that one runs on the autocomplete plugin, which moves through its list on + * the arrow keys. A till is operated from the keyboard - reaching for a + * mouse to pick the customer you have already half-typed is the slow path - + * so a hand-rolled popover that only takes clicks is a downgrade wearing + * the same design. + * + * Enter with nothing highlighted deliberately does NOT pick the first row. + * It lets the typed text through as a plain search, which is what the empty + * state promises ("press Enter to search anyway") and what someone typing a + * partial name usually means. Highlighting is a deliberate act; Enter after + * one is a deliberate choice. + */ + $(document).on('keydown', '.lf-q', function (e) { + var $box = $(this).closest('.lf-search').find('.lf-typeahead'); + if (!$box.is(':visible')) return; + var $rows = $box.find('.lf-pick-row'); + if (!$rows.length) return; + + var down = e.key === 'ArrowDown' || e.keyCode === 40; + var up = e.key === 'ArrowUp' || e.keyCode === 38; + var enter = e.key === 'Enter' || e.keyCode === 13; + if (!down && !up && !enter) return; + + var i = $rows.index($rows.filter('.is-active')); + if (enter) { + if (i < 0) return; // nothing chosen - let the search run + e.preventDefault(); + $rows.eq(i).trigger('click'); + return; + } + + /* preventDefault or the caret jumps to either end of the box while the + highlight moves, which reads as the text being eaten. */ + e.preventDefault(); + var next = down ? i + 1 : i - 1; + if (next >= $rows.length) next = 0; + if (next < 0) next = $rows.length - 1; + $rows.removeClass('is-active').eq(next).addClass('is-active'); + + /* Keep the highlight in view - the list scrolls, and a selection you + cannot see is worse than none. */ + var row = $rows.get(next); + if (row && row.scrollIntoView) row.scrollIntoView({ block: 'nearest' }); + }); + + /* Hovering moves the keyboard highlight rather than adding a second one. + Otherwise a hand landing on the mouse mid-arrow-key leaves two rows lit + and Enter takes the one the cursor is NOT on. */ + $(document).on('mouseenter', '.lf-pick-row', function () { + $(this).closest('.lf-pick-list').find('.lf-pick-row').removeClass('is-active'); + $(this).addClass('is-active'); + }); + + $(document).on('click', '.lf-pick-x', function () { + $(this).closest('.lf-typeahead').hide().empty(); + }); + + /* Opening with no term shows the frequent ones - "just show on click", + without making anyone type first. */ + $(document).on('focus', '.lf-q', function () { + var key = $(this).closest('[data-lf]').attr('data-lf'); + if (key) LF.typeahead(key, this.value); + }); + + $(document).on('click', function (e) { + if (!$(e.target).closest('.lf-search').length) { + $('.lf-typeahead').hide().empty(); + } + }); + + /* + * Escape closes the picker, and only the picker. + * + * Every other overlay in this app closes on Escape - the modals carry a + * close_on_esc class for exactly that - so a popover that ignores it is the + * odd one out, and the reflex is to press Escape before reaching for a + * mouse. stopPropagation matters: without it the same keypress carries on + * to whatever is behind, and dismissing a suggestion list would also close + * the panel or the modal around it. The guard is "is one actually open", so + * Escape behaves normally everywhere else. + */ + $(document).on('keydown', function (e) { + if (e.key !== 'Escape' && e.keyCode !== 27) return; + var $open = $('.lf-typeahead:visible'); + if (!$open.length) return; + e.stopPropagation(); + /* No re-focus. The input still HAS focus - that is how Escape got + pressed - and .trigger('focus') would fire the delegated focus + handler above, which opens the picker. Escape would reopen the thing + it just closed. */ + $open.hide().empty(); + }); +})(); diff --git a/frontend/static/script/js/core/lock-screen.js b/frontend/static/script/js/core/lock-screen.js index f4b9dc662..a3cf958da 100644 --- a/frontend/static/script/js/core/lock-screen.js +++ b/frontend/static/script/js/core/lock-screen.js @@ -110,10 +110,10 @@ // Bottom row: switch user, zero, delete. Zero stays in the middle where // a phone keypad puts it, because that is where a thumb expects it. keys += '<button type="button" class="lock-key is-quiet" data-action="switch"' - + ' aria-label="Switch user">Switch</button>'; + + ' aria-label="Switch user" data-t-aria-label="lang_switch_user">Switch</button>'; keys += '<button type="button" class="lock-key" data-digit="0" aria-label="0">0</button>'; keys += '<button type="button" class="lock-key is-quiet" data-action="delete"' - + ' aria-label="Delete last digit">' + + ' aria-label="Delete last digit" data-t-aria-label="lang_delete_last_digit">' + '<svg viewBox="0 0 24 24" aria-hidden="true"><path d="M22 3H7L1 12l6 9h15a2 2 0 0 0' + ' 2-2V5a2 2 0 0 0-2-2zm-3.7 12.3-1.4 1.4L14 13.8l-2.9 2.9-1.4-1.4 2.9-2.9-2.9-2.9' + ' 1.4-1.4 2.9 2.9 2.9-2.9 1.4 1.4-2.9 2.9 2.9 2.9z"/></svg></button>'; @@ -126,13 +126,13 @@ + ' <div id="lock_single">' + ' <div class="lock-avatar" id="lock_avatar"></div>' + ' <p class="lock-name" id="lock_name"></p>' - + ' <p class="lock-hint" id="lock_hint">Enter your PIN</p>' + + ' <p class="lock-hint" id="lock_hint"><lang class="lang_enter_your_pin">Enter your PIN</lang></p>' + ' <div class="lock-dots" id="lock_dots"></div>' + ' <div class="lock-keys">' + keys + '</div>' + ' </div>' + ' <div id="lock_chooser" style="display:none;">' - + ' <p class="lock-name">Who is at the till?</p>' - + ' <p class="lock-hint">Choose your name to enter your PIN.</p>' + + ' <p class="lock-name"><lang class="lang_who_is_at_the_till">Who is at the till?</lang></p>' + + ' <p class="lock-hint"><lang class="lang_choose_your_name_to_enter_your_pin">Choose your name to enter your PIN.</lang></p>' + ' <div class="lock-users" id="lock_users"></div>' + ' </div>' + '</div>' diff --git a/frontend/static/script/js/core/signup-link.js b/frontend/static/script/js/core/signup-link.js new file mode 100644 index 000000000..5c747ff5c --- /dev/null +++ b/frontend/static/script/js/core/signup-link.js @@ -0,0 +1,122 @@ +/* + * Where a signup came from, inside our own estate. + * + * Owner: "letsay create new account comes from demo.posnic.com send utm source + * as demo or something else. within our eco system i want to know where its + * comes from. if user comes desktop app then name that too." + * + * Every link out to signup used to be the bare URL, so a person who spent ten + * minutes in the public demo and then signed up was indistinguishable from + * someone who typed the address - both landed as "direct". The one channel we + * fully control was the one we could not measure. + * + * WHAT NAMES THE SOURCE + * + * runtime-info, which the application already publishes and which already + * knows the answer: + * + * demo: true the public demo -> posnic_demo + * mode: desktop the Electron till -> posnic_desktop + * mode: cloud a real shop, signed in -> posnic_app + * mode: local community self-hosted -> posnic_selfhosted + * + * Derived rather than hardcoded per page, because a build flag or a user-agent + * sniff is a second answer to a question the runtime already answers - and the + * two drift the first time somebody packages the app differently. + * + * The demo also carries WHICH COUNTRY's demo it was, taken from the cookie the + * demo routing sets. "They came from the UAE demo" is a different fact from + * "they came from the demo", and it is the one that says whether the localized + * shops are earning their keep. + */ +(function () { + 'use strict'; + + var SIGNUP_URL = 'https://posnic.com/signup.html'; + + /* A cookie read that cannot throw: this runs on every page, and a signup + link that breaks the page is worse than one with no attribution. */ + function cookie(name) { + try { + var m = String(document.cookie || '').match( + new RegExp('(?:^|;\\s*)' + name.replace(/[^\w]/g, '') + '=([^;]*)') + ); + return m ? decodeURIComponent(m[1]) : ''; + } catch (e) { + return ''; + } + } + + /** + * The signup URL, carrying where it was clicked from. + * + * @param {object} info the runtime-info payload + * @param {string} surface where on the page - 'bar', 'nudge', 'menu' + * @returns {string} + */ + function signupUrl(info, surface) { + info = info || {}; + var source; + if (info.demo) source = 'posnic_demo'; + else if (info.mode === 'desktop') source = 'posnic_desktop'; + else if (info.mode === 'cloud') source = 'posnic_app'; + else source = 'posnic_selfhosted'; + + var params = []; + var add = function (k, v) { + v = String(v == null ? '' : v).trim(); + if (!v) return; + /* Short and plain: these end up in a URL a person may read, and + anything longer is not a source, it is a story. */ + params.push(k + '=' + encodeURIComponent(v.slice(0, 60))); + }; + + add('utm_source', source); + add('utm_medium', surface || 'link'); + + /* The version, so "which build sends us signups" is answerable. Not + invented when runtime-info does not know it - a wrong version is + worse than an absent one. */ + add('utm_campaign', info.appVersion || info.version || ''); + + if (info.demo) { + /* Which country's demo. The cookie is set by the demo routing; on + the shared default there is none, and the absence is honest. */ + var cc = cookie('posnic_demo_cc'); + if (cc) add('utm_content', 'demo_' + cc); + } + + return SIGNUP_URL + (params.length ? '?' + params.join('&') : ''); + } + + /* Anything marked up as a signup link gets the attribution, so a new one + added on a page nobody remembers still carries it. */ + function applyTo(root, info) { + var links = (root || document).querySelectorAll('a[data-posnic-signup]'); + for (var i = 0; i < links.length; i++) { + links[i].href = signupUrl(info, links[i].getAttribute('data-posnic-signup') || 'link'); + } + } + + var api = { signupUrl: signupUrl, applyTo: applyTo, SIGNUP_URL: SIGNUP_URL }; + + if (typeof window !== 'undefined') { + window.PosnicSignupLink = api; + /* Applied once the runtime is known. Failing to reach runtime-info + leaves the links exactly as authored - unattributed, but working. */ + try { + var x = new XMLHttpRequest(); + x.open('GET', 'runtime-info', true); + x.onload = function () { + try { + var info = JSON.parse(x.responseText || '{}'); + window.PosnicSignupLink.info = info; + applyTo(document, info); + } catch (e) { /* links stay as authored */ } + }; + x.send(); + } catch (e) { /* links stay as authored */ } + } + + if (typeof module !== 'undefined' && module.exports) module.exports = api; +})(); diff --git a/frontend/static/script/js/core/themeManager.js b/frontend/static/script/js/core/themeManager.js index a224cbb1f..4b052b17e 100644 --- a/frontend/static/script/js/core/themeManager.js +++ b/frontend/static/script/js/core/themeManager.js @@ -30,9 +30,25 @@ PosnicPro.themeManager = { topbarBg: '#ffffff', textPrimary: '#000000', textSecondary: '#333333', - fontFamily: "'Mukta Vaani', sans-serif", + /* + * THESE THREE ARE READ FROM THE STYLESHEET, NOT DECIDED HERE. + * + * They used to be written out again: 'Mukta Vaani' at weight 300, + * while theme-variables.css shipped a DM Sans / system stack at + * weight 400. Two defaults for one thing, and they disagreed - so a + * fresh login got the stylesheet's font and opening the theme picker + * and pressing Default replaced it with this one. Reported as "default + * theme font getting applied after i go to theme page and apply + * default theme, otherwise by default its not getting applied": the + * font was not missing, it was being CHANGED. + * + * Read at first use via readShippedFont(), so whoever edits the + * stylesheet does not have to know this file exists. The values below + * are only a last resort for a stylesheet that failed to load. + */ + fontFamily: "'DM Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, 'Noto Sans', sans-serif", fontSize: '16', - fontWeight: '300', + fontWeight: '400', borderColor: '#e6e6e6', menuBg: '#ffffff', menuText: '#333333', @@ -232,8 +248,41 @@ PosnicPro.themeManager = { } catch (e) { return true; } }, + /* + * The font the stylesheet actually ships, taken from the stylesheet. + * + * One source of truth. Duplicating these in JS is what produced a font + * that changed the first time somebody pressed Default - the copy here + * had drifted a whole typeface away from the CSS and nobody could see + * both at once. + * + * Read once, and only from the root element, which is where + * theme-variables.css declares them. A stylesheet that has not loaded + * yields empty strings and the hard-coded fallbacks stand. + */ + _shippedFontRead: false, + readShippedFont: function () { + if (this._shippedFontRead) { return; } + this._shippedFontRead = true; + try { + var cs = window.getComputedStyle(document.documentElement); + var family = (cs.getPropertyValue('--theme-font-family') || '').trim(); + var weight = (cs.getPropertyValue('--theme-font-weight') || '').trim(); + var size = (cs.getPropertyValue('--theme-font-size-base') || '').trim(); + if (family) { this.defaults.fontFamily = family; } + if (weight) { this.defaults.fontWeight = weight; } + /* Declared with a unit in CSS and stored without one here. */ + if (size) { this.defaults.fontSize = String(parseInt(size, 10) || this.defaults.fontSize); } + } catch (e) { + /* Keep the fallbacks. A theme that cannot read the stylesheet is + still better than no theme at all. */ + } + }, + init: function() { var self = this; + /* Before any default is read, so the picker and the page agree. */ + this.readShippedFont(); if (!this.moduleEnabled()) { return; } var savedTheme = this.getFromLocal(); if (savedTheme) { @@ -295,13 +344,47 @@ PosnicPro.themeManager = { var state = self.toThemeState(settings); self.applyTheme(state); self.saveToLocal(state); + return; } + /* + * A shop that has never opened the theme picker has nothing saved + * here, and this used to do nothing at all - so the CSS variables + * were never written and the page fell back to whatever the raw + * stylesheet happened to use. Reported as the font on a new + * account being wrong until "default" was clicked, which is + * precisely what clicking it did: set the variables for the first + * time. + * + * "Use defaults" has to mean applying them, not leaving them + * unapplied and hoping the stylesheet agrees. + */ + self.applyDefaults(); }, function(xhr) { - // Silently fail, use defaults - console.log('Could not load theme from server, using defaults'); + /* Unreachable server is the same situation: better the default + look than an unstyled one. Not saved to localStorage, because + nothing was learned about what this shop actually wants - the + next load should ask again. */ + console.log('Could not load theme from server, applying defaults'); + self.applyDefaults(); }); }, + /* + * The shipped look, written to the page. + * + * Deliberately does not save: these are defaults, not a choice, and + * storing them would make a shop that has never picked a theme + * indistinguishable from one that picked this one - so a later change to + * the shipped defaults would never reach them. + */ + applyDefaults: function() { + try { + this.applyTheme(this.toThemeState({})); + } catch (e) { + console.error('Error applying default theme:', e); + } + }, + getFromLocal: function() { try { var theme = localStorage.getItem('posnic_theme_settings'); @@ -692,14 +775,14 @@ PosnicPro.themeManager = { PosnicPro.put(params, function(response) { if (response.type === 'success') { - PosnicPro.alert('success', 'Theme settings saved successfully'); + PosnicPro.alert('success', PosnicPro.i18n.t('lang_theme_settings_saved_successfully', 'Theme settings saved successfully')); if (callback) callback(true, response); } else { PosnicPro.alert('error', response.message || 'Failed to save theme settings'); if (callback) callback(false, response); } }, function(xhr) { - var response = xhr.responseText ? JSON.parse(xhr.responseText) : { message: 'Network error' }; + var response = xhr.responseText ? JSON.parse(xhr.responseText) : { message: PosnicPro.i18n.t('lang_network_error', 'Network error') }; PosnicPro.alert('error', response.message || 'Failed to save theme settings'); if (callback) callback(false, response); }); @@ -720,11 +803,17 @@ PosnicPro.themeManager = { self.initColorPickers(); }, 100); - PosnicPro.alert('success', 'Theme reset to default'); + PosnicPro.alert('success', PosnicPro.i18n.t('lang_theme_reset_to_default', 'Theme reset to default')); }, initColorPickers: function() { + /* 157KB that only the theme pane uses - loaded when it is used + (bundle-split slice 1). */ var self = this; + if (!$.fn.colorpicker) { + PosnicPro.lazy.load('colorpicker').then(function () { self.initColorPickers(); }); + return; + } $('.theme-color-input').each(function() { var $input = $(this); diff --git a/frontend/static/script/js/core/tour.js b/frontend/static/script/js/core/tour.js new file mode 100644 index 000000000..9655667ab --- /dev/null +++ b/frontend/static/script/js/core/tour.js @@ -0,0 +1,241 @@ +/* + * The guided tour: show a new shop around, once, by pointing at real things. + * + * Owner: "first time when user logins, guide him for feature enabled by + * default let me enable there itself. in feature we might want to do the + * guide tour for the user." + * + * The welcome answers the first half (the switches, right there). This is the + * second half: after choosing features, walk the person to the places those + * features live - the menus, the sale screen, the search box, the grid - with + * a spotlight on the actual element rather than a video of somebody else's + * shop. + * + * DESIGN RULES, each earned elsewhere in this codebase: + * + * - No dependency. A tour library is a third-party script on the till's + * boot path forever, for something that runs once per shop. + * - A step whose target is missing or hidden is SKIPPED, not shown floating + * in space. Menus come and go with features and ACL, so "point at the + * thing" must degrade to "say nothing about the thing". + * - Steps can navigate (hash) and then WAIT for the target: the SPA builds + * pages on arrival, and a fixed delay is either too short on a slow till + * or a pause on a fast one. + * - Everything is theme tokens. The tour runs on the first day, which is + * also the day somebody tries the dark presets. + * - Escape leaves at any point, and leaving is remembered per shop the same + * way the welcome is - a tour that returns uninvited is nagging. + */ +PosnicPro.tour = { + _steps: [], + _at: -1, + _reposition: null, + + seenKey: function () { + var branch = PosnicPro.local.get('branch_id_set'); + branch = (branch == null || branch === 'null' || branch === 'undefined') ? '' : String(branch); + return 'feature_tour_done:' + branch; + }, + + /* + * The first-run walk. Selectors are the app's real ids, and every one is + * optional at runtime - a shop with Quick Sale off simply never hears + * about the pad. + */ + firstRun: function () { + PosnicPro.tour.start([ + { + hash: 'dashboard', + target: '.vertical-menu', + title: PosnicPro.i18n.t('lang_everything_lives_here', 'Everything lives here'), + text: 'Sales, items, customers, reports. When you switch a feature on, its menu appears here; switch it off and the menu goes - nothing is deleted.', + side: 'right' + }, + { + hash: 'sales/new', + target: '#sales_new_item_name', + title: PosnicPro.i18n.t('lang_sell_by_typing_or_scanning', 'Sell by typing or scanning'), + text: 'Type a name, SKU or barcode - or just scan. A connected barcode scanner works with no set-up.', + side: 'bottom' + }, + { + hash: 'sales/new', + target: '#sales_new_productList', + title: PosnicPro.i18n.t('lang_or_tap_the_shelf', 'Or tap the shelf'), + text: 'Tap a product to add it to the sale. A tile with a number badge holds sizes or colours - point at it and the list opens beside it.', + side: 'top' + }, + { + hash: 'sales/new', + target: '#quick_sale_btn', + title: PosnicPro.i18n.t('lang_quick_sale', 'Quick sale'), + text: 'For the busy counter: type an amount and take payment, no product needed.', + side: 'bottom' + }, + { + hash: 'settings/modules', + target: '#v-pills-modules', + title: PosnicPro.i18n.t('lang_shape_the_till_any_time', 'Shape the till any time'), + text: 'Every feature is a switch here. Off keeps the menus short; on brings it back exactly as it was. Each card opens its own page with its settings.', + side: 'top' + } + ]); + }, + + start: function (steps) { + var self = PosnicPro.tour; + self.close(true); + self._steps = steps || []; + self._at = -1; + if (!self._steps.length) { return; } + self.build(); + self.next(); + }, + + build: function () { + var self = PosnicPro.tour; + if (document.getElementById('posnic_tour')) { return; } + var el = document.createElement('div'); + el.id = 'posnic_tour'; + el.innerHTML = + '<div class="tour-backdrop"></div>' + + '<div class="tour-spot" id="tour_spot"></div>' + + '<div class="tour-card" id="tour_card" role="dialog" aria-labelledby="tour_title">' + + ' <div class="tour-title" id="tour_title"></div>' + + ' <div class="tour-text" id="tour_text"></div>' + + ' <div class="tour-foot">' + + ' <span class="tour-dots" id="tour_dots"></span>' + + ' <span class="tour-actions">' + + ' <button type="button" class="btn btn-sm btn-light" id="tour_skip"><lang class="lang_skip">Skip</lang></button>' + + ' <button type="button" class="btn btn-sm btn-light" id="tour_back"><lang class="lang_back_title">Back</lang></button>' + + ' <button type="button" class="btn btn-sm btn-primary" id="tour_next"><lang class="lang_next">Next</lang></button>' + + ' </span>' + + ' </div>' + + '</div>'; + document.body.appendChild(el); + + $(document).on('click.posnictour', '#tour_next', function () { PosnicPro.tour.next(); }); + $(document).on('click.posnictour', '#tour_back', function () { PosnicPro.tour.back(); }); + $(document).on('click.posnictour', '#tour_skip', function () { PosnicPro.tour.close(); }); + $(document).on('keydown.posnictour', function (e) { + if (!document.getElementById('posnic_tour')) { return; } + if (e.key === 'Escape') { PosnicPro.tour.close(); } + if (e.key === 'ArrowRight' || e.key === 'Enter') { PosnicPro.tour.next(); } + if (e.key === 'ArrowLeft') { PosnicPro.tour.back(); } + }); + self._reposition = function () { PosnicPro.tour.place(); }; + window.addEventListener('resize', self._reposition); + /* Capture: scroll does not bubble, and the grid scrolls inside its + own container. */ + document.addEventListener('scroll', self._reposition, true); + }, + + next: function () { PosnicPro.tour._move(1); }, + back: function () { PosnicPro.tour._move(-1); }, + + _move: function (dir) { + var self = PosnicPro.tour; + var at = self._at + dir; + if (at < 0) { return; } + if (at >= self._steps.length) { self.close(); return; } + self._at = at; + var step = self._steps[at]; + + if (step.hash && window.location.hash.slice(2) !== step.hash) { + hasher.setHash(step.hash); + } + + /* + * Wait for the target, then show. Up to three seconds: the SPA builds + * pages when the hash lands, and an item grid needs a server round + * trip. A target that never appears - feature off, ACL, an id that + * moved - skips the step in the direction of travel, so a missing + * anchor costs one sentence and never strands the tour. + */ + var waited = 0; + var tryShow = function () { + var el = document.querySelector(step.target); + var visible = el && el.offsetWidth > 0 && el.offsetHeight > 0; + if (visible) { self.show(step, el); return; } + waited += 150; + if (waited >= 3000) { self._move(dir); return; } + setTimeout(tryShow, 150); + }; + tryShow(); + }, + + show: function (step, el) { + var self = PosnicPro.tour; + self._target = el; + self._side = step.side || 'bottom'; + $('#tour_title').text(step.title); + $('#tour_text').text(step.text); + $('#tour_back').toggle(self._at > 0); + $('#tour_next').text(self._at === self._steps.length - 1 ? PosnicPro.i18n.t('lang_done', 'Done') : PosnicPro.i18n.t('lang_next', 'Next')); + $('#tour_dots').html(self._steps.map(function (s, i) { + return '<span class="tour-dot' + (i === self._at ? ' is-here' : '') + '"></span>'; + }).join('')); + + if (el.scrollIntoView) { + el.scrollIntoView({ block: 'center', behavior: 'auto' }); + } + self.place(); + }, + + place: function () { + var self = PosnicPro.tour; + var el = self._target; + var spot = document.getElementById('tour_spot'); + var card = document.getElementById('tour_card'); + if (!el || !spot || !card) { return; } + + var r = el.getBoundingClientRect(); + var pad = 6; + spot.style.top = Math.round(r.top - pad) + 'px'; + spot.style.left = Math.round(r.left - pad) + 'px'; + spot.style.width = Math.round(r.width + pad * 2) + 'px'; + spot.style.height = Math.round(r.height + pad * 2) + 'px'; + + /* The card sits on the asked-for side, then is pulled back inside the + window - the sidebar step's card would otherwise start off-screen + on a narrow till. */ + var vw = window.innerWidth; + var vh = window.innerHeight; + var cw = card.offsetWidth; + var ch = card.offsetHeight; + var gap = 12; + var top; + var left; + if (self._side === 'right') { top = r.top; left = r.right + gap; } + else if (self._side === 'left') { top = r.top; left = r.left - gap - cw; } + else if (self._side === 'top') { top = r.top - gap - ch; left = r.left; } + else { top = r.bottom + gap; left = r.left; } + if (left + cw > vw - 8) { left = vw - 8 - cw; } + if (left < 8) { left = 8; } + if (top + ch > vh - 8) { top = vh - 8 - ch; } + if (top < 8) { top = 8; } + card.style.top = Math.round(top) + 'px'; + card.style.left = Math.round(left) + 'px'; + }, + + /* + * `silent` restarts (a new start() replacing a running tour) do not mark + * the tour seen - only a person closing or finishing does. + */ + close: function (silent) { + var self = PosnicPro.tour; + var el = document.getElementById('posnic_tour'); + if (el && el.parentNode) { el.parentNode.removeChild(el); } + $(document).off('.posnictour'); + if (self._reposition) { + window.removeEventListener('resize', self._reposition); + document.removeEventListener('scroll', self._reposition, true); + self._reposition = null; + } + self._target = null; + if (!silent && self._steps.length) { + PosnicPro.local.set(PosnicPro.tour.seenKey(), 'true'); + } + self._steps = []; + } +}; diff --git a/frontend/static/script/js/custom/custom-chart-c3.js b/frontend/static/script/js/custom/custom-chart-c3.js deleted file mode 100644 index 3e8009bae..000000000 --- a/frontend/static/script/js/custom/custom-chart-c3.js +++ /dev/null @@ -1,280 +0,0 @@ -/* ---------------------------------- - : Custom - C3 Charts js : ---------------------------------- -*/ -"use strict"; -$(document).ready(function() { - /* -- C3 - Scatter Plot Chart -- */ - var scatterPlotChart = c3.generate({ - bindto: '#c3-scatter-plot', - color: { pattern: ["#f2f3f7", "#43d187", "#506fe4"] }, - data: { - xs: { - setosa: 'setosa_x', - versicolor: 'versicolor_x', - }, - columns: [ - ["setosa_x", 3.5, 3.0, 3.2, 3.1, 3.6, 3.9, 3.4, 3.4, 2.9, 3.1, 3.7, 3.4, 3.0, 3.0, 4.0, 4.4, 3.9, 3.5, 3.8, 3.8, 3.4, 3.7, 3.6, 3.3, 3.4, 3.0, 3.4, 3.5, 3.4, 3.2, 3.1, 3.4, 4.1, 4.2, 3.1, 3.2, 3.5, 3.6, 3.0, 3.4, 3.5, 2.3, 3.2, 3.5, 3.8, 3.0, 3.8, 3.2, 3.7, 3.3], - ["versicolor_x", 3.2, 3.2, 3.1, 2.3, 2.8, 2.8, 3.3, 2.4, 2.9, 2.7, 2.0, 3.0, 2.2, 2.9, 2.9, 3.1, 3.0, 2.7, 2.2, 2.5, 3.2, 2.8, 2.5, 2.8, 2.9, 3.0, 2.8, 3.0, 2.9, 2.6, 2.4, 2.4, 2.7, 2.7, 3.0, 3.4, 3.1, 2.3, 3.0, 2.5, 2.6, 3.0, 2.6, 2.3, 2.7, 3.0, 2.9, 2.9, 2.5, 2.8], - ["setosa", 0.2, 0.2, 0.2, 0.2, 0.2, 0.4, 0.3, 0.2, 0.2, 0.1, 0.2, 0.2, 0.1, 0.1, 0.2, 0.4, 0.4, 0.3, 0.3, 0.3, 0.2, 0.4, 0.2, 0.5, 0.2, 0.2, 0.4, 0.2, 0.2, 0.2, 0.2, 0.4, 0.1, 0.2, 0.2, 0.2, 0.2, 0.1, 0.2, 0.2, 0.3, 0.3, 0.2, 0.6, 0.4, 0.3, 0.2, 0.2, 0.2, 0.2], - ["versicolor", 1.4, 1.5, 1.5, 1.3, 1.5, 1.3, 1.6, 1.0, 1.3, 1.4, 1.0, 1.5, 1.0, 1.4, 1.3, 1.4, 1.5, 1.0, 1.5, 1.1, 1.8, 1.3, 1.5, 1.2, 1.3, 1.4, 1.4, 1.7, 1.5, 1.0, 1.1, 1.0, 1.2, 1.6, 1.5, 1.6, 1.5, 1.3, 1.3, 1.3, 1.2, 1.4, 1.2, 1.0, 1.3, 1.2, 1.3, 1.3, 1.1, 1.3], - ], - type: 'scatter' - }, - axis: { - x: { - label: 'Sepal.Width', - tick: { - fit: false - } - }, - y: { - label: 'Petal.Width' - } - } - }); - setTimeout(function () { - scatterPlotChart.load({ - xs: { - virginica: 'virginica_x' - }, - columns: [ - ["virginica_x", 3.3, 2.7, 3.0, 2.9, 3.0, 3.0, 2.5, 2.9, 2.5, 3.6, 3.2, 2.7, 3.0, 2.5, 2.8, 3.2, 3.0, 3.8, 2.6, 2.2, 3.2, 2.8, 2.8, 2.7, 3.3, 3.2, 2.8, 3.0, 2.8, 3.0, 2.8, 3.8, 2.8, 2.8, 2.6, 3.0, 3.4, 3.1, 3.0, 3.1, 3.1, 3.1, 2.7, 3.2, 3.3, 3.0, 2.5, 3.0, 3.4, 3.0], - ["virginica", 2.5, 1.9, 2.1, 1.8, 2.2, 2.1, 1.7, 1.8, 1.8, 2.5, 2.0, 1.9, 2.1, 2.0, 2.4, 2.3, 1.8, 2.2, 2.3, 1.5, 2.3, 2.0, 2.0, 1.8, 2.1, 1.8, 1.8, 1.8, 2.1, 1.6, 1.9, 2.0, 2.2, 1.5, 1.4, 2.3, 2.4, 1.8, 1.8, 2.1, 2.4, 2.3, 1.9, 2.3, 2.5, 2.3, 1.9, 2.0, 2.3, 1.8], - ] - }); - }, 1000); - setTimeout(function () { - scatterPlotChart.unload({ - ids: 'setosa' - }); - }, 2000); - setTimeout(function () { - scatterPlotChart.load({ - columns: [ - ["virginica", 0.2, 0.2, 0.2, 0.2, 0.2, 0.4, 0.3, 0.2, 0.2, 0.1, 0.2, 0.2, 0.1, 0.1, 0.2, 0.4, 0.4, 0.3, 0.3, 0.3, 0.2, 0.4, 0.2, 0.5, 0.2, 0.2, 0.4, 0.2, 0.2, 0.2, 0.2, 0.4, 0.1, 0.2, 0.2, 0.2, 0.2, 0.1, 0.2, 0.2, 0.3, 0.3, 0.2, 0.6, 0.4, 0.3, 0.2, 0.2, 0.2, 0.2], - ] - }); - }, 3000); - /* -- C3 - Step Chart -- */ - var stepcChart = c3.generate({ - bindto: '#c3-step', - color: { pattern: ["#506fe4", "#43d187"] }, - data: { - columns: [ - ['SeriesA', 300, 350, 300, 0, 0, 100], - ['SeriesB', 130, 100, 140, 200, 150, 50] - ], - types: { - SeriesA: 'step', - SeriesB: 'area-step' - } - } - }); - /* -- C3 - Simple Line Chart -- */ - var simpleLineChart = c3.generate({ - bindto: '#c3-simple-line', - color: { pattern: ["#506fe4", "#43d187"] }, - data: { - columns: [ - ['SeriesA', 30, 200, 100, 400, 150, 250], - ['SeriesB', 130, 340, 200, 500, 250, 350] - ] - } - }); - /* -- C3 - Spline Chart -- */ - var splineChart = c3.generate({ - bindto: '#c3-spline', - color: { pattern: ["#506fe4", "#43d187"] }, - data: { - columns: [ - ['SeriesA', 30, 200, 100, 400, 150, 250], - ['SeriesB', 130, 100, 140, 200, 150, 50] - ], - type: 'spline' - } - }); - /* -- C3 - Area Chart -- */ - var areaChart = c3.generate({ - bindto: '#c3-area', - color: { pattern: ["#506fe4", "#43d187"] }, - data: { - columns: [ - ['SeriesA', 100, 75, 50, 75, 50, 75, 100], - ['SeriesB', 70, 45, 20, 45, 20, 45, 70] - ], - types: { - SeriesA: 'area', - SeriesB: 'area-spline' - } - } - }); - /* -- C3 - Stacked Area Chart -- */ - var stackedChart = c3.generate({ - bindto: '#c3-stacked-area', - color: { pattern: ["#506fe4", "#43d187"] }, - data: { - columns: [ - ['SeriesA', 100, 75, 50, 75, 50, 75, 100], - ['SeriesB', 90, 65, 40, 65, 40, 65, 90] - ], - types: { - SeriesA: 'area-spline', - SeriesB: 'area-spline' - }, - groups: [['SeriesA', 'SeriesB']] - } - }); - /* -- C3 - Bar Chart -- */ - var barChart = c3.generate({ - bindto: '#c3-bar', - color: { pattern: ["#506fe4", "#43d187"] }, - data: { - columns: [ - ['SeriesA', 30, 200, 100, 400, 150, 250], - ['SeriesB', 130, 100, 140, 200, 150, 50] - ], - type: 'bar' - }, - bar: { - width: { - ratio: 0.5 - } - } - }); - /* -- C3 - Stacked Bar Chart -- */ - var stackedBarChart = c3.generate({ - bindto: '#c3-stacked-bar', - color: { pattern: ["#f2f3f7", "#506fe4", "#43d187"] }, - data: { - columns: [ - ['SeriesA', 30, 200, 200, 400, 150, 250], - ['SeriesB', 130, 100, 100, 200, 150, 50], - ['SeriesC', 230, 200, 200, 300, 250, 250] - ], - type: 'bar', - groups: [ - ['SeriesA', 'SeriesB'] - ] - }, - grid: { - y: { - lines: [{value:0}] - } - } - }); - /* -- C3 - Combination Chart -- */ - var combinationChart = c3.generate({ - bindto: '#c3-combination', - color: { pattern: ["#506fe4", "#f2f3f7", "#f9616d", "#3d9bfb", "#43d187", "#f7bb4d"] }, - data: { - columns: [ - ['SeriesA', 30, 20, 50, 40, 60, 50], - ['SeriesB', 200, 130, 90, 240, 130, 220], - ['SeriesC', 300, 200, 160, 400, 250, 250], - ['SeriesD', 200, 130, 90, 240, 130, 220], - ['SeriesE', 130, 120, 150, 140, 160, 150], - ['SeriesF', 90, 70, 20, 50, 60, 120], - ], - type: 'bar', - types: { - SeriesC: 'spline', - SeriesD: 'line', - SeriesF: 'area', - }, - groups: [ - ['SeriesA','SeriesB'] - ] - } - }); - /* -- C3 - Gauge Chart -- */ - var gaugeChart = c3.generate({ - bindto: '#c3-gauge', - data: { - columns: [ - ['SeriesA', 91.4] - ], - type: 'gauge', - onclick: function (d, i) { }, - onmouseover: function (d, i) { }, - onmouseout: function (d, i) { } - }, - gauge: { - width: 40, - }, - color: { - pattern: ['#43d187', '#f9616d', '#f7bb4d', '#506fe4'], - threshold: { - values: [30, 60, 90, 100] - } - }, - size: { - height: 320 - } - }); - setTimeout(function () { - gaugeChart.load({ - columns: [['SeriesA', 10]] - }); - }, 1000); - setTimeout(function () { - gaugeChart.load({ - columns: [['SeriesA', 50]] - }); - }, 2000); - setTimeout(function () { - gaugeChart.load({ - columns: [['SeriesA', 70]] - }); - }, 3000); - setTimeout(function () { - gaugeChart.load({ - columns: [['SeriesA', 0]] - }); - }, 4000); - setTimeout(function () { - gaugeChart.load({ - columns: [['SeriesA', 100]] - }); - }, 5000); - /* -- C3 - Pie Chart -- */ - var pieChart = c3.generate({ - bindto: '#c3-pie', - color: { pattern: ["#506fe4", "#f2f3f7", "#43d187"] }, - data: { - columns: [ - ['SeriesA', 40], - ['SeriesB', 25], - ['SeriesC', 35], - ], - type : 'pie', - onclick: function (d, i) { }, - onmouseover: function (d, i) { }, - onmouseout: function (d, i) { } - } - }); - /* -- C3 - Donut Chart -- */ - var donutChart = c3.generate({ - bindto: '#c3-donut', - color: { pattern: ["#506fe4", "#f2f3f7", "#43d187"] }, - data: { - columns: [ - ['SeriesA', 40], - ['SeriesB', 25], - ['SeriesC', 35], - ], - type : 'donut', - onclick: function (d, i) { }, - onmouseover: function (d, i) { }, - onmouseout: function (d, i) { } - }, - donut: { - title: "Iris Petal Width", - width: 40, - label: { - show: 0 - } - } - }); -}); \ No newline at end of file diff --git a/frontend/static/script/js/custom/custom-dashboard-ecommerce.js b/frontend/static/script/js/custom/custom-dashboard-ecommerce.js deleted file mode 100644 index 6f11927d8..000000000 --- a/frontend/static/script/js/custom/custom-dashboard-ecommerce.js +++ /dev/null @@ -1,155 +0,0 @@ -/* -------------------------------------------- - : Custom - Dashboard Ecommerce js : -------------------------------------------- -*/ -"use strict"; -$(document).ready(function() { - /* -- Apex Circle Chart -- */ - var options = { - series: [34, 55, 10, 1], - chart: { - height: 300, - type: 'radialBar', - }, - plotOptions: { - radialBar: { - offsetY: 0, - startAngle: 0, - endAngle: 270, - hollow: { - margin: 5, - size: '30%', - background: 'transparent', - image: undefined, - }, - dataLabels: { - name: { - show: false, - }, - value: { - show: false, - } - } - } - }, - colors: ['#506fe4', '#43d187', '#f7bb4d', '#96a3b6'], - labels: ['Cash', 'Card', 'UPI', 'Others'], - legend: { - show: true, - floating: true, - fontSize: '16px', - position: 'left', - offsetX: 0, - offsetY: 0, - labels: { - useSeriesColors: true, - }, - markers: { - size: 0 - }, - formatter: function(seriesName, opts) { - return seriesName + ": " + opts.w.globals.series[opts.seriesIndex] - }, - itemMargin: { - horizontal: 3, - } - }, - responsive: [{ - breakpoint: 480, - options: { - legend: { - show: false - } - } - }] - }; - - var chart = new ApexCharts(document.querySelector("#apex-circle-chart"), options); - chart.render(); - - /* -- Product Slider -- */ - $('.product-slider').slick({ - arrows: true, - dots: false, - infinite: true, - adaptiveHeight: true, - slidesToShow: 1, - slidesToScroll: 1, - prevArrow: '<i class="feather icon-arrow-left"></i>', - nextArrow: '<i class="feather icon-arrow-right"></i>' - }); - - /* ----- Apex Bar Chart ----- */ - var options = { - chart: { - height: 290, - type: 'bar', - toolbar: { - show: false - } - }, - plotOptions: { - bar: { - horizontal: false, - columnWidth: '30%', - endingShape: 'rounded' - }, - }, - dataLabels: { - enabled: false - }, - stroke: { - show: true, - width: 3, - colors: ['transparent'] - }, - colors: ['#506fe4', '#43d187', '#96a3b6'], - series: [{ - name: 'Net Profit', - data: [76, 85, 101, 98, 87, 105] - }, { - name: 'Revenue', - data: [44, 55, 57, 56, 61, 58] - }, { - name: 'Revenue', - data: [24, 25, 37, 36, 41, 38] - }], - legend: { - show: false, - }, - xaxis: { - categories: ['Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul'], - axisBorder: { - show: true, - color: 'rgba(0,0,0,0.05)' - }, - axisTicks: { - show: true, - color: 'rgba(0,0,0,0.05)' - } - }, - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'rgba(0,0,0,0.05)' - }, - fill: { - opacity: 1, - }, - tooltip: { - y: { - formatter: function (val) { - return "$ " + val + " thousands" - } - } - } - } - var chart = new ApexCharts( - document.querySelector("#apex-bar-chart"), - options - ); - chart.render(); - -}); \ No newline at end of file diff --git a/frontend/static/script/js/custom/custom-dashboard-hospital.js b/frontend/static/script/js/custom/custom-dashboard-hospital.js deleted file mode 100644 index 1e6344061..000000000 --- a/frontend/static/script/js/custom/custom-dashboard-hospital.js +++ /dev/null @@ -1,335 +0,0 @@ -/* -------------------------------------------- - : Custom - Dashboard Hospital js : -------------------------------------------- -*/ -"use strict"; -$(document).ready(function() { - /* ----- Apex Line1 Chart ----- */ -// var options = { -// chart: { -// height: 50, -// type: 'line', -// sparkline: { -// enabled: true -// }, -// toolbar: { -// show: false -// }, -// zoom: { -// enabled: false -// } -// }, -// colors: ['#506fe4'], -// series: [{ -// name: "Appointment", -// data: [1, 12, 10, 16, 11, 18] -// }], -// dataLabels: { -// enabled: false -// }, -// stroke: { -// curve: 'smooth', -// width: 2 -// }, -// grid: { -// row: { -// colors: ['transparent', 'transparent'], opacity: .2 -// }, -// borderColor: 'transparent' -// }, -// yaxis: { -// min: 0 -// }, -// xaxis: { -// categories: ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'], -// axisBorder: { -// show: true, -// color: 'rgba(0,0,0,0.05)' -// }, -// axisTicks: { -// show: true, -// color: 'rgba(0,0,0,0.05)' -// } -// } -// } -// var chart = new ApexCharts( -// document.querySelector("#apex-line1-chart"), -// options -// ); -// chart.render(); - - /* ----- Apex Line2 Chart ----- */ - var options = { - chart: { - height: 50, - type: 'line', - sparkline: { - enabled: true - }, - toolbar: { - show: false - }, - zoom: { - enabled: false - } - }, - colors: ['#43d187'], - series: [{ - name: "Appointment", - data: [1, 12, 10, 16, 11, 18] - }], - dataLabels: { - enabled: false - }, - stroke: { - curve: 'smooth', - width: 2 - }, - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - yaxis: { - min: 0 - }, - xaxis: { - categories: ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'], - axisBorder: { - show: true, - color: 'rgba(0,0,0,0.05)' - }, - axisTicks: { - show: true, - color: 'rgba(0,0,0,0.05)' - } - } - } - var chart = new ApexCharts( - document.querySelector("#apex-line2-chart"), - options - ); - chart.render(); - - /* ----- Apex Line3 Chart ----- */ - var options = { - chart: { - height: 50, - type: 'line', - sparkline: { - enabled: true - }, - toolbar: { - show: false - }, - zoom: { - enabled: false - } - }, - colors: ['#f7bb4d'], - series: [{ - name: "Appointment", - data: [1, 12, 10, 16, 11, 18] - }], - dataLabels: { - enabled: false - }, - stroke: { - curve: 'smooth', - width: 2 - }, - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - yaxis: { - min: 0 - }, - xaxis: { - categories: ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'], - axisBorder: { - show: true, - color: 'rgba(0,0,0,0.05)' - }, - axisTicks: { - show: true, - color: 'rgba(0,0,0,0.05)' - } - } - } - var chart = new ApexCharts( - document.querySelector("#apex-line3-chart"), - options - ); - chart.render(); - - /* ----- Apex Line4 Chart ----- */ - var options = { - chart: { - height: 50, - type: 'line', - sparkline: { - enabled: true - }, - toolbar: { - show: false - }, - zoom: { - enabled: false - } - }, - colors: ['#96a3b6'], - series: [{ - name: "Appointment", - data: [1, 12, 10, 16, 11, 18] - }], - dataLabels: { - enabled: false - }, - stroke: { - curve: 'smooth', - width: 2 - }, - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - yaxis: { - min: 0 - }, - xaxis: { - categories: ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'], - axisBorder: { - show: true, - color: 'rgba(0,0,0,0.05)' - }, - axisTicks: { - show: true, - color: 'rgba(0,0,0,0.05)' - } - } - } - var chart = new ApexCharts( - document.querySelector("#apex-line4-chart"), - options - ); - chart.render(); - - /* -- Apex Line Column Area Chart -- */ - var options = { - series: [{ - name: 'Expenditure', - type: 'column', - data: [23, 11, 22, 27, 13, 22, 37, 21, 44, 22, 30] - }, { - name: 'Maintenance', - type: 'area', - data: [44, 55, 41, 67, 22, 43, 21, 41, 56, 27, 43] - }, { - name: 'Profit', - type: 'line', - data: [30, 25, 36, 30, 45, 35, 64, 52, 59, 36, 39] - }], - chart: { - height: 358, - type: 'line', - stacked: false, - toolbar: { - show: false - } - }, - stroke: { - width: [0, 1, 3], - curve: 'smooth' - }, - plotOptions: { - bar: { - columnWidth: '25%' - } - }, - colors: ['#506fe4','#43d187','#96a3b6'], - fill: { - opacity: [0.85, 0.25, 1], - gradient: { - inverseColors: false, - shade: 'light', - type: "vertical", - opacityFrom: 0.85, - opacityTo: 0.55, - stops: [0, 100, 100, 100] - } - }, - labels: ['01/01/2003', '02/01/2003', '03/01/2003', '04/01/2003', '05/01/2003', '06/01/2003', '07/01/2003', - '08/01/2003', '09/01/2003', '10/01/2003', '11/01/2003' - ], - markers: { - size: 0 - }, - xaxis: { - type: 'datetime' - }, - yaxis: { - min: 0 - }, - tooltip: { - shared: true, - intersect: false, - y: { - formatter: function (y) { - if (typeof y !== "undefined") { - return y.toFixed(0) + " points"; - } - return y; - - } - } - } - }; - - var chart = new ApexCharts(document.querySelector("#apex-line-column-area-chart"), options); - chart.render(); - - /* ----- Apex Donut Chart ----- */ - var options = { - chart: { - type: 'donut', - width: 330, - }, - plotOptions: { - pie: { - donut: { - size: "85%" - } - } - }, - dataLabels: { - enabled: false - }, - colors: ['#506fe4', '#43d187','#96a3b6'], - series: [60, 45, 25], - labels: ['Child', 'Adult', 'Aged'], - legend: { - show: true, - position: 'bottom' - }, - responsive: [{ - breakpoint: 480, - options: { - chart: { - width: 230, - } - } - }] - } - var chart = new ApexCharts( - document.querySelector("#apex-pie-chart"), - options - ); - chart.render(); -}); \ No newline at end of file diff --git a/frontend/static/script/js/custom/custom-dashboard.js b/frontend/static/script/js/custom/custom-dashboard.js deleted file mode 100644 index e926f4c52..000000000 --- a/frontend/static/script/js/custom/custom-dashboard.js +++ /dev/null @@ -1,672 +0,0 @@ -/* ----------------------------------------------- - : Custom - Dashboard CRM js : ----------------------------------------------- -*/ -"use strict"; -$(document).ready(function() { - - /* ----- Apex Area1 Chart ----- */ - var options = { - chart: { - type:"area", - height: 50, - sparkline: { - enabled: true - } - }, - stroke: { - curve: "straight", - width: 2 - }, - fill: { - opacity: .05 - }, - series:[ { - data: [5, 12, 10, 18, 11, 16] - } - ], - yaxis: { - min: 0 - }, - colors:["#506fe4"], - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - tooltip: { - x: { - format: 'dd/MM/yy HH:mm' - }, - } - } - var chart = new ApexCharts( - document.querySelector("#apex-area1-chart"), - options - ); - chart.render(); - - /* ----- Apex Area2 Chart ----- */ - var options = { - chart: { - type:"area", - height: 50, - sparkline: { - enabled: true - } - }, - stroke: { - curve: "straight", - width: 2 - }, - fill: { - opacity: .05 - }, - series:[ { - data: [5, 12, 10, 18, 11, 16] - } - ], - yaxis: { - min: 0 - }, - colors:["#43d187"], - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - tooltip: { - x: { - format: 'dd/MM/yy HH:mm' - }, - } - } - var chart = new ApexCharts( - document.querySelector("#apex-area2-chart"), - options - ); - chart.render(); - - /* ----- Apex Area3 Chart ----- */ - var options = { - chart: { - type:"area", - height: 50, - sparkline: { - enabled: true - } - }, - stroke: { - curve: "straight", - width: 2 - }, - fill: { - opacity: .05 - }, - series:[ { - data: [5, 12, 10, 18, 11, 16] - } - ], - yaxis: { - min: 0 - }, - colors:["#96a3b6"], - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - tooltip: { - x: { - format: 'dd/MM/yy HH:mm' - }, - } - } - var chart = new ApexCharts( - document.querySelector("#apex-area3-chart"), - options - ); - chart.render(); - - /* ----- Apex Area4 Chart ----- */ - var options = { - chart: { - type:"area", - height: 50, - sparkline: { - enabled: true - } - }, - stroke: { - curve: "straight", - width: 2 - }, - fill: { - opacity: .05 - }, - series:[ { - data: [5, 12, 10, 18, 11, 16] - } - ], - yaxis: { - min: 0 - }, - colors:["#f9616d"], - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - tooltip: { - x: { - format: 'dd/MM/yy HH:mm' - }, - } - } - var chart = new ApexCharts( - document.querySelector("#apex-area4-chart"), - options - ); - chart.render(); - /* ----- Apex Area5 Chart ----- */ - var options = { - chart: { - type:"area", - height: 50, - sparkline: { - enabled: true - } - }, - stroke: { - curve: "straight", - width: 2 - }, - fill: { - opacity: .05 - }, - series:[ { - data: [5, 12, 10, 18, 11, 16] - } - ], - yaxis: { - min: 0 - }, - colors:["#3d9bfb"], - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - tooltip: { - x: { - format: 'dd/MM/yy HH:mm' - }, - } - } - var chart = new ApexCharts( - document.querySelector("#apex-area5-chart"), - options - ); - chart.render(); - /* ----- Apex Area6 Chart ----- */ - var options = { - chart: { - type:"area", - height: 50, - sparkline: { - enabled: true - } - }, - stroke: { - curve: "straight", - width: 2 - }, - fill: { - opacity: .05 - }, - series:[ { - data: [5, 12, 10, 18, 11, 16] - } - ], - yaxis: { - min: 0 - }, - colors:["#f7bb4d"], - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - tooltip: { - x: { - format: 'dd/MM/yy HH:mm' - }, - } - } - var chart = new ApexCharts( - document.querySelector("#apex-area6-chart"), - options - ); - chart.render(); - /* ----- Apex Area7 Chart ----- */ - var options = { - chart: { - type:"area", - height: 50, - sparkline: { - enabled: true - } - }, - stroke: { - curve: "straight", - width: 2 - }, - fill: { - opacity: .05 - }, - series:[ { - data: [5, 12, 10, 18, 11, 16] - } - ], - yaxis: { - min: 0 - }, - colors:["#c11dc1"], - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - tooltip: { - x: { - format: 'dd/MM/yy HH:mm' - }, - } - } - var chart = new ApexCharts( - document.querySelector("#apex-area7-chart"), - options - ); - chart.render(); - /* ----- Apex Area8 Chart ----- */ - var options = { - chart: { - type:"area", - height: 50, - sparkline: { - enabled: true - } - }, - stroke: { - curve: "straight", - width: 2 - }, - fill: { - opacity: .05 - }, - series:[ { - data: [5, 12, 10, 18, 11, 16] - } - ], - yaxis: { - min: 0 - }, - colors:["#ecc322"], - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - tooltip: { - x: { - format: 'dd/MM/yy HH:mm' - }, - } - } - var chart = new ApexCharts( - document.querySelector("#apex-area8-chart"), - options - ); - chart.render(); - - /* -- Apex Bar Chart -- */ - var options = { - series: [{ - name: 'Servings', - data: [44, 55, 41, 67, 22, 43, 21, 33, 45, 31, 87, 65] - }], - annotations: { - points: [{ - x: 'Bananas', - seriesIndex: 0, - label: { - borderColor: '#506fe4', - offsetY: 0, - style: { - color: '#fff', - background: '#506fe4', - }, - text: 'Bananas are good', - } - }] - }, - chart: { - height: 285, - type: 'bar', - toolbar: { - show: false - } - }, - plotOptions: { - bar: { - columnWidth: '50%', - endingShape: 'rounded' - } - }, - colors: ['#506fe4'], - dataLabels: { - enabled: false - }, - stroke: { - width: 2 - }, - grid: { - row: { - colors: ['#fff', '#fff'] - } - }, - xaxis: { - labels: { - rotate: -45 - }, - categories: ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'], - tickPlacement: 'on' - }, - yaxis: { - title: { - text: 'Servings', - }, - }, - fill: { - type: 'gradient', - gradient: { - shade: 'light', - type: "horizontal", - shadeIntensity: 0.25, - gradientToColors: undefined, - inverseColors: true, - opacityFrom: 0.85, - opacityTo: 0.85, - stops: [50, 0, 100] - }, - } - }; - - var chart = new ApexCharts(document.querySelector("#apex-bar-chart"), options); - chart.render(); - - /* ----- Apex Operation Status1 Chart ----- */ - var options = { - chart: { - height: 260, - type: 'radialBar', - offsetY: -10 - }, - plotOptions: { - radialBar: { - startAngle: -135, - endAngle: 135, - dataLabels: { - name: { - fontSize: '18px', - fontFamily: 'Mukta Vaani', - color: '#8A98AC', - offsetY: 120 - }, - value: { - offsetY: 76, - fontSize: '24px', - fontFamily: 'Mukta Vaani', - color: '#141d46', - formatter: function (val) { - return val + "%"; - } - } - } - } - }, - fill: { - type: 'gradient', - gradient: { - shade: 'dark', - shadeIntensity: 0.15, - inverseColors: false, - opacityFrom: 1, - opacityTo: 1, - stops: [0, 50, 65, 91] - }, - }, - stroke: { - dashArray: 4 - }, - colors:["#506fe4"], - series: [65], - labels: ['Completed'], - } - var chart = new ApexCharts( - document.querySelector("#apex-operation-status1-chart"), - options - ); - chart.render(); - - /* ----- Apex Operation Status2 Chart ----- */ - var options = { - chart: { - height: 260, - type: 'radialBar', - offsetY: -10 - }, - plotOptions: { - radialBar: { - startAngle: -135, - endAngle: 135, - dataLabels: { - name: { - fontSize: '18px', - fontFamily: 'Mukta Vaani', - color: '#8A98AC', - offsetY: 120 - }, - value: { - offsetY: 76, - fontSize: '24px', - fontFamily: 'Mukta Vaani', - color: '#141d46', - formatter: function (val) { - return val + "%"; - } - } - } - } - }, - fill: { - type: 'gradient', - gradient: { - shade: 'dark', - shadeIntensity: 0.15, - inverseColors: false, - opacityFrom: 1, - opacityTo: 1, - stops: [0, 50, 65, 91] - }, - }, - stroke: { - dashArray: 4 - }, - colors:["#506fe4"], - series: [85], - labels: ['Completed'], - } - var chart = new ApexCharts( - document.querySelector("#apex-operation-status2-chart"), - options - ); - chart.render(); - - /* ----- Apex Operation Status3 Chart ----- */ - var options = { - chart: { - height: 260, - type: 'radialBar', - offsetY: -10 - }, - plotOptions: { - radialBar: { - startAngle: -135, - endAngle: 135, - dataLabels: { - name: { - fontSize: '18px', - fontFamily: 'Mukta Vaani', - color: '#8A98AC', - offsetY: 120 - }, - value: { - offsetY: 76, - fontSize: '24px', - fontFamily: 'Mukta Vaani', - color: '#141d46', - formatter: function (val) { - return val + "%"; - } - } - } - } - }, - fill: { - type: 'gradient', - gradient: { - shade: 'dark', - shadeIntensity: 0.15, - inverseColors: false, - opacityFrom: 1, - opacityTo: 1, - stops: [0, 50, 65, 91] - }, - }, - stroke: { - dashArray: 4 - }, - colors:["#506fe4"], - series: [50], - labels: ['Completed'], - } - var chart = new ApexCharts( - document.querySelector("#apex-operation-status3-chart"), - options - ); - chart.render(); - - /* ----- Apex Operation Status4 Chart ----- */ - var options = { - chart: { - height: 260, - type: 'radialBar', - offsetY: -10 - }, - plotOptions: { - radialBar: { - startAngle: -135, - endAngle: 135, - dataLabels: { - name: { - fontSize: '18px', - fontFamily: 'Mukta Vaani', - color: '#8A98AC', - offsetY: 120 - }, - value: { - offsetY: 76, - fontSize: '24px', - fontFamily: 'Mukta Vaani', - color: '#141d46', - formatter: function (val) { - return val + "%"; - } - } - } - } - }, - fill: { - type: 'gradient', - gradient: { - shade: 'dark', - shadeIntensity: 0.15, - inverseColors: false, - opacityFrom: 1, - opacityTo: 1, - stops: [0, 50, 65, 91] - }, - }, - stroke: { - dashArray: 4 - }, - colors:["#506fe4"], - series: [35], - labels: ['Completed'], - } - var chart = new ApexCharts( - document.querySelector("#apex-operation-status4-chart"), - options - ); - chart.render(); - - /* -- Vector Map -- */ - $('#world-map').vectorMap({ - map: 'world_mill_en', - backgroundColor: 'transparent', - markerStyle: { - initial: { - fill: 'transparent', - stroke: 'transparent', - "fill-opacity": 1, - "stroke-width": 15, - "stroke-opacity": 0 - } - }, - markers: [ - {latLng: [37.18, -93.35], name: 'United States'}, - {latLng: [61.52, 105.31], name: 'Russia'}, - {latLng: [20.59, 78.96], name: 'India'}, - ], - focusOn: { - x: 0, - y: 0, - scale: 1 - }, - series: { - regions: [{ - values: { - US:'#506fe4', - RU:'#43d187', - IN:'#96a3b6', - } - }] - }, - regionStyle: { - initial: { - fill: '#f2f3f7' - } - } - }); - -}); \ No newline at end of file diff --git a/frontend/static/script/js/custom/custom-form-xeditable.js b/frontend/static/script/js/custom/custom-form-xeditable.js index 385eb9785..5ad1b8837 100644 --- a/frontend/static/script/js/custom/custom-form-xeditable.js +++ b/frontend/static/script/js/custom/custom-form-xeditable.js @@ -14,24 +14,43 @@ $(document).ready(function () { // empty resets to the plain blue pencil. The old behaviour only tinted the // tiny pencil, which was too subtle to notice that a note had been saved. window.PosnicPro = window.PosnicPro || {}; + /* + * A note chip in the sale action bar. Empty it reads as an invitation + * ("Payment note"); filled it turns green with a tick and a preview, and + * the full text is the tooltip. The label comes from data-label so the + * three chips are told apart at a glance - they used to be three pencils + * on three separate rows, each with its own heading taking a whole cell. + */ PosnicPro.updateSaleNoteFlag = function (clickId, iconClass, text) { var $a = $('#' + clickId); if (!$a.length) { return; } + var label = $a.data('label') || ''; + var esc = function (v) { return $('<div>').text(v == null ? '' : v).html(); }; var t = (text == null) ? '' : String(text).trim(); if (t.length > 0) { - var preview = t.length > 24 ? t.slice(0, 24) + '…' : t; - $a.attr('title', t).css({ color: '#2ca77b' }).html( - '[<i class="' + iconClass + '"></i>] ' + - '<span class="note-set-flag" style="color:#2ca77b;font-weight:600;white-space:nowrap;">' + - '<i class="feather icon-check"></i> ' + $('<div>').text(preview).html() + '</span>' - ); + var preview = t.length > 22 ? t.slice(0, 22) + '…' : t; + $a.attr('title', label ? label + ': ' + t : t) + .addClass('is-set') + .html('<i class="feather icon-check"></i> ' + + (label ? esc(label) + ' ' : '') + + '<span class="note-set-flag">' + esc(preview) + '</span>'); } else { - $a.removeAttr('title').css({ color: '#506fe4' }).html('[<i class="' + iconClass + '"></i>]'); + $a.attr('title', label ? 'Add a ' + label.toLowerCase() : '') + .removeClass('is-set') + .html('<i class="' + iconClass + '"></i> ' + esc(label)); } }; $('#extraDisc').editable({ mode: 'inline', + /* + * No tick / cross (owner: "seems uncessory. user can dont want he can + * keep 0 or dont enter anyting"). The field commits when it loses + * focus or on Enter, so entering a discount is type-and-move-on and + * abandoning one is just walking away. + */ + showbuttons: false, + onblur: 'submit', type: 'number', // Input type tpl: '<input type="text" value="0.00" id="extraDisc" class="form-control form-control-sm small-input" min="0" step="any" style="width: 60px;"/>', // Template for input pk: 1, // Primary key (if needed for backend updates) @@ -86,13 +105,6 @@ $(document).ready(function () { PosnicPro.updateSaleNoteFlag('click_payment_description', 'feather icon-edit-1', val); } }); - $('#click_payment_description').click(function (e) { - e.stopPropagation(); - e.preventDefault(); - $('#payment_description').text(''); - $('#payment_description').show(); - $('#payment_description').editable('toggle'); - }); $('#sales_description').editable({ type: 'textarea', @@ -114,13 +126,6 @@ $(document).ready(function () { PosnicPro.updateSaleNoteFlag('click_sales_description', 'feather icon-edit-1', val); } }); - $('#click_sales_description').click(function (e) { - e.stopPropagation(); - e.preventDefault(); - $('#sales_description').text(''); - $('#sales_description').show(); - $('#sales_description').editable('toggle'); - }); $('#discount_description').editable({ type: 'textarea', @@ -149,46 +154,14 @@ $(document).ready(function () { } }); - $('#discount_description').on('shown', function () { - var attempts = 0; - var focusInterval = setInterval(function () { - attempts++; - try { - var $input = $('.editable-container:visible textarea, .editable-container:visible input, .popover:visible textarea, .popover:visible input'); - if ($input.length) { - $input.first().focus(); - var el = $input.get(0); - if (el && typeof el.value === 'string' && el.setSelectionRange) { - var len = el.value.length; - el.setSelectionRange(len, len); - } - } - } catch (ex) { - // ignore and retry until attempts exhausted - } - if (attempts >= 10) { - clearInterval(focusInterval); - } - }, 80); - }); - - $('#click_discount_description').click(function (e) { - e.stopPropagation(); - e.preventDefault(); - - $('#discount_description').text(''); - $('#discount_description').show(); - $('#discount_description').editable('toggle'); - - // Ensure the Discount Note popup gets focus shortly after it opens - setTimeout(function () { - var $el = $('.editable-container:last textarea, .editable-container:last input'); - if ($el.length) { - $el.focus(); - } - }, 300); - }); + /* + * The three sale-page notes (payment, sale, discount) open an inline + * editor now - PosnicPro.sales.noteEdit, bound in sales.js. Their + * popup openers are gone from here; the .editable() setup above stays + * because setDefaults still calls editable('setValue', null) on these + * elements to clear them between sales. + */ $('#register_add_payment_description').editable({ type: 'textarea', diff --git a/frontend/static/script/js/modules/js/branches.js b/frontend/static/script/js/modules/js/branches.js index efcc25aab..af406cfff 100644 --- a/frontend/static/script/js/modules/js/branches.js +++ b/frontend/static/script/js/modules/js/branches.js @@ -103,7 +103,7 @@ PosnicPro.branches = { }, beAddRegisterRow: function (name) { var row = $('<div class="input-group mb-2 be-register-row" style="max-width:340px;">' + - '<input type="text" class="form-control be-register" maxlength="20" placeholder="Register name">' + + '<input type="text" class="form-control be-register" maxlength="20" placeholder="Register name" data-t-placeholder="lang_registername_title">' + '<div class="input-group-append"><button class="btn btn-outline-danger" type="button">' + '<i class="feather icon-x"></i></button></div></div>'); row.find('input').val(name || ''); @@ -113,123 +113,211 @@ PosnicPro.branches = { showDelete: function (id) { PosnicPro.deleteTableRowData(id, 'branches'); }, + /* Deep link #/branches/<id>: the list with that branch open in the + right pane; switching and editing are the deliberate acts inside. + Recognises its own setHash echo. */ showDetails: function (id) { - var loader = $(".loader-view-branch"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.showViewModal('branches'); - PosnicPro.branches.viewBranch(id); + if (PosnicPro.listDoc.activeId('branches') === String(id) + && $('#branches_detail_card').is(':visible')) { return; } + PosnicPro.branches.showDataTablePage(); + PosnicPro.branches.openDoc(id); }, - showChange: function (id) { - PosnicPro.local.set('changebranchid', id); - db.currentregister.get('1').then(function (data) { - if (data.register_status === 'open') { - $('#branch_register_swipe').modal('show'); - } else { - let branch_id = PosnicPro.local.get('changebranchid'); - PosnicPro.settings.listBranchName(branch_id); + openDoc: function (id) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var current = PosnicPro.local.get('branch_id_set') === String(id); + var pills = current ? '<span class="badge badge-success-inverse"><lang class="lang_current">Current</lang></span>' : ''; + /* The branch you are STANDING in cannot be deleted from under you. */ + var actions = '<button type="button" class="btn btn-sm btn-light" data-module="branch" data-access="write" data-toggle="tooltip" title="Edit this branch" data-t-title="lang_edit_this_branch" aria-label="Edit" data-t-aria-label="lang_edit_title"' + + ' onclick="hasher.setHash(\'branches/' + esc(id) + '/edit\');"><i class="feather icon-edit-2"></i></button>' + + (current ? '' : '<button type="button" class="btn btn-sm btn-light" data-module="branch" data-access="delete" data-toggle="tooltip" title="Delete this branch" data-t-title="lang_delete_this_branch" aria-label="Delete" data-t-aria-label="lang_delete"' + + ' onclick="PosnicPro.listDoc.close(\'branches\'); hasher.setHash(\'branches/' + esc(id) + '/delete\');"><i class="feather icon-trash-2"></i></button>'); + PosnicPro.listDoc.open({ key: 'branches', id: id, title: PosnicPro.i18n.t('lang_newbranch_title', 'Branch'), pills: pills, actions: actions }); + PosnicPro.ACLForModule('branch'); + PosnicPro.get({ url: 'branches/getBranchDetails', data: { id: id } }, function (response) { + var d = response && response.data; + if (response.type !== 'success' || !d) { + PosnicPro.listDoc.body('branches', '<div class="text-danger p-3"><lang class="lang_could_not_open_this_branch">Could not open this branch.</lang></div>'); + return; } - }).catch(function () { - let branch_id = PosnicPro.local.get('changebranchid'); - PosnicPro.settings.listBranchName(branch_id); - $('#branch_register_swipe').modal('hide'); + PosnicPro.listDoc.title('branches', d.branch_name || 'Branch'); + var registers = $.map(d.register || [], function (r) { + return (r && (r.register_name || r.name)) || (typeof r === 'string' ? r : null); + }).filter(Boolean); + var cv = (d.currency_value && d.currency_value[0]) || {}; + var currency = [cv.currency_sign, cv.currency_text || d.currency_text].filter(Boolean).join(' ') + || d.currency_type || ''; + var logo = (d.logo && d.logo !== 'store.png') + ? '<img src="' + esc(d.logo) + '" style="width:84px; height:84px; object-fit:contain; border-radius:8px; flex:0 0 84px; border:1px solid var(--theme-border-color, #e3e7ee); background:#fff;" alt="">' + : ''; + PosnicPro.listDoc.body('branches', + '<div style="display:flex; gap:20px; align-items:flex-start;">' + + logo + + '<div style="flex:1 1 auto; min-width:0;">' + + PosnicPro.listDoc.stats([ + { v: String(registers.length || 1), l: registers.length === 1 ? PosnicPro.i18n.t('lang_records_title', 'Register') : PosnicPro.i18n.t('lang_registers_title', 'Registers') }, + { v: esc(currency || '\u2014'), l: PosnicPro.i18n.t('lang_currency_title', 'Currency') }, + { v: d.branch_gstin_number ? 'GST' : '\u2014', l: d.branch_gstin_number ? PosnicPro.i18n.t('lang_registered', 'Registered') : PosnicPro.i18n.t('lang_no_gstin', 'No GSTIN') } + ]) + + '</div></div>' + + PosnicPro.listDoc.grid([ + { label: PosnicPro.i18n.t('lang_contact', 'Contact'), lines: [ + d.store_telephone ? '<div><a href="tel:' + esc(d.store_telephone) + '">' + esc(d.store_telephone) + '</a></div>' : '', + d.store_alternativephone ? '<div class="q-muted">Alt: ' + esc(d.store_alternativephone) + '</div>' : '', + d.store_email ? '<div><a href="mailto:' + esc(d.store_email) + '">' + esc(d.store_email) + '</a></div>' : '', + d.website ? '<div class="q-muted">' + esc(d.website) + '</div>' : '' + ] }, + { label: PosnicPro.i18n.t('lang_location', 'Location'), lines: [ + d.store_address ? '<div>' + esc(d.store_address) + '</div>' : '', + (d.city || d.pincode) ? '<div class="q-muted">' + esc([d.city, d.pincode].filter(Boolean).join(' - ')) + '</div>' : '', + (d.state || d.country) ? '<div class="q-muted">' + esc([d.state, d.country].filter(Boolean).join(', ')) + '</div>' : '' + ] }, + { label: PosnicPro.i18n.t('lang_module_tax', 'Tax'), lines: [ + d.branch_gstin_number ? '<div>GSTIN ' + esc(d.branch_gstin_number) + '</div>' : '<div class="q-muted"><lang class="lang_no_gstin_configured">No GSTIN configured</lang></div>' + ] }, + { label: PosnicPro.i18n.t('lang_locale', 'Locale'), lines: [ + currency ? '<div>' + esc(currency) + '</div>' : '', + d.time_zone ? '<div class="q-muted">' + esc(d.time_zone) + '</div>' : '', + d.client_dateformat ? '<div class="q-muted">Dates: ' + esc(d.dateformat_text || d.client_dateformat) + '</div>' : '' + ] }, + { label: PosnicPro.i18n.t('lang_printing', 'Printing'), lines: [ + d.printing_address ? '<div class="q-muted">' + esc(d.printing_address) + '</div>' : '' + ] }, + { label: PosnicPro.i18n.t('lang_registers_title', 'Registers'), lines: [ + registers.length + ? ['<div>' + registers.map(function (r) { return '<span class="badge badge-secondary-inverse mr-1">' + esc(r) + '</span>'; }).join(' ') + '</div>'] + : '<div class="q-muted"><lang class="lang_one_unnamed_register">One unnamed register</lang></div>' + ] } + ]) + + (current ? '' : PosnicPro.listDoc.link('Switch to this branch', "PosnicPro.branches.showChange('" + esc(id) + "');"))); + }, function () { + PosnicPro.listDoc.body('branches', '<div class="text-danger p-3"><lang class="lang_could_not_open_this_branch">Could not open this branch.</lang></div>'); }); }, + /* The name the OLD table machinery answered to - settings flows still + call it after branch saves. */ branchesTable: function () { - var loader = $(".loader-table-branch"); - $("<div class='loadingSpinner'></div>").appendTo(loader); - PosnicPro.appendViewDataTableBody('branches'); - var table = $('#view_branches'); - var params = { + PosnicPro.branches.loadList(1); + }, + _page: 1, + PAGE_SIZE: 25, + _lastRows: [], + mountFilters: function (force) { + if (!$('#branches_filter_panel').length) { return; } + if (!force && $('#branches_filter_panel').data('mounted')) { return; } + $('#branches_filter_panel').data('mounted', true); + PosnicPro.listFilter.mount({ + key: 'branches', + container: '#branches_filter_panel', + button: '#branches_filter_btn', + searchPlaceholder: PosnicPro.i18n.t('lang_search_name_phone_or_email', 'Search name, phone or email'), + searchFields: [ + { value: 'all', label: PosnicPro.i18n.t('lang_all_fields', 'All fields') }, + { value: 'branch_name', label: PosnicPro.i18n.t('lang_name_title', 'Name') }, + { value: 'store_telephone', label: PosnicPro.i18n.t('lang_phone_title', 'Phone') }, + { value: 'store_email', label: PosnicPro.i18n.t('lang_email_title', 'Email') }, + { value: 'store_address', label: PosnicPro.i18n.t('lang_address_title', 'Address') } + ], + onChange: function () { PosnicPro.branches.loadList(1); } + }); + }, + loadList: function (page) { + PosnicPro.branches.mountFilters(); + var self = PosnicPro.branches; + if (page) { self._page = page; } + var filters = PosnicPro.listFilter.legacyFilters('branches', {}); + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + PosnicPro.get({ url: 'branches', - data: { - page: table.data('current_page'), - limit: parseInt($('#view_branches_per_page option:selected').text()), - filters: table.data('filters') + data: { page: self._page, limit: self.PAGE_SIZE, filters: JSON.stringify(filters) } + }, function (response) { + var data = (response && response.data) || {}; + var list = data.list || []; + self._lastRows = list; + if (!list.length) { + var filtered = PosnicPro.listFilter.activeCount('branches') > 0; + $('#branches_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20">' + + (filtered ? PosnicPro.i18n.t('lang_no_branches_match_this_filter', 'No branches match this filter.') : PosnicPro.i18n.t('lang_no_branches_yet_press_new_to_add_the_first', 'No branches yet - press New to add the first.')) + '</div>'); + $('#branches_list_paging').html(''); + return; } + var current = PosnicPro.local.get('branch_id_set'); + var html = '<div class="table-responsive"><table class="table table-borderless">' + + '<thead><tr><th><lang class="lang_name_title">Name</lang></th><th class="br-col-phone"><lang class="lang_phone_title">Phone</lang></th><th class="br-col-email"><lang class="lang_email_title">Email</lang></th>' + + '<th class="br-col-address"><lang class="lang_address_title">Address</lang></th><th class="br-col-state"><lang class="lang_state_title">State</lang></th></tr></thead><tbody>'; + list.forEach(function (r) { + var isCurrent = current === String(r._id); + html += '<tr class="md-row branches-row highlight-select' + + (PosnicPro.listDoc.activeId('branches') === String(r._id) ? ' is-active' : '') + '" data-id="' + esc(r._id) + '" style="cursor:pointer;">' + + '<td>' + esc(r.branch_name) + + (isCurrent ? ' <span class="badge badge-success-inverse"><lang class="lang_current">Current</lang></span>' : '') + '</td>' + + '<td class="br-col-phone">' + esc(r.store_telephone || '-') + '</td>' + + '<td class="br-col-email q-muted">' + esc(r.store_email || '-') + '</td>' + + '<td class="br-col-address q-muted">' + esc(r.store_address || '-') + '</td>' + + '<td class="br-col-state">' + esc(r.state || '-') + '</td>' + + '</tr>'; + }); + html += '</tbody></table></div>'; + $('#branches_list_rows').html(html); + PosnicPro.ACLForModule('branch'); + self.renderPager(Number(data.total) || list.length); + }, function () { + $('#branches_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20"><lang class="lang_could_not_load_branches_try_again">Could not load branches - try again.</lang></div>'); + }); + }, + renderPager: function (total) { + var self = PosnicPro.branches; + var p = self._page, size = self.PAGE_SIZE; + var pages = Math.ceil(total / size) || 1; + var label = total + ' ' + (total === 1 ? PosnicPro.i18n.t('lang_branch_4', 'branch') : PosnicPro.i18n.t('lang_branches', 'branches')); + if (pages > 1) { label = 'Page ' + p + ' of ' + pages + ' \u00b7 ' + label; } + var btn = function (to, text, off, cls) { + return '<button type="button" class="btn btn-sm ' + (cls || 'btn-secondary-rgba') + ' q-pg-btn"' + (off ? ' disabled' : '') + + ' onclick="PosnicPro.branches.goPage(' + to + ');">' + text + '</button>'; }; - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - table.data('total', response.data.total); - table.data('total_pages', response.data.total_pages); - table.data('current_page', response.data.current_page); - table.data('per_page', response.data.per_page); - PosnicPro.paging(response.data.total_pages, response.data.current_page); - table.children('tbody').text(''); - $('#view_branches_total').text(response.data.total); - var rowTotal = response.data.total; - if (rowTotal === 0) { - $('.branch_header').hide(); - let dateRange = $('#view_sales_daterange span span[data-toggle="tooltip"]').attr('data-original-title'); - $('.branch_norecord').empty().append('<div class="text-center text-dark"> <p>No Records on ' + dateRange + '</p></div>'); - $('#branch_img_hide,.branch_norecord').show(); - - } else { - $('.branch_norecord').empty(); - $('#branch_img_hide,.branch_norecord').hide(); - $('.branch_header').show(); - } - - var row_total = (table.data('current_page') - 1) * table.data('per_page') + 1; - $('#view_branches_page_total').text(row_total); - var page_totals = (table.data('current_page') - 1) * table.data('per_page'); - $('#view_branches_page_perpage_total').text(page_totals + response.data.list.length); - for (var i = 0; i < response.data.list.length; i++) { - var row = response.data.list[i]; - var row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; - var action = '<div id="onclick-toolbar-options_' + i + '" class="hidden">' + - '<a data-module = "branch" data-access = "read" href="#/branches/' + row._id + '" data-id="branches/' + row._id + '" data-toggle="tooltip" title="View Branch" class="point-cursor mobile_tooltip"><i class="feather icon-eye"></i></a>' + - '<a data-module = "branch" data-access = "write" href="#/branches/' + row._id + '/edit" data-id="branches/' + row._id + '/edit" data-toggle="tooltip" title="Edit Branch" class="point-cursor mobile_tooltip"><i class="feather icon-edit"></i></a>' + - '<a data-module = "branch" data-access = "delete" href="#/branches/' + row._id + '/delete" data-id="branches/' + row._id + '/delete" data-toggle="tooltip" title="Delete Branch" class="point-cursor mobile_tooltip"><i class="feather icon-trash"></i></a>' + - '</div>' + - '<div data-toolbar="user-options" class="btn btn-round btn-primary-rgba round-pad" id="onclick-toolbar_' + i + '"><i class="feather icon-more-vertical-"></i></div>'; - - var trow = '<tr><th><input type="checkbox" class="branches-row-id" id="' + row._id + '" name="id[]" value="' + row._id + '" onclick="PosnicPro.checkboxSelectOne(this,\'branches\');"></th> <th scope="row">' + row_no + '</th> <td>' + row.branch_name + '</td> <td class="text-right"><a class="sale_color" href="tel:' + row.store_telephone + '">' + row.store_telephone + '</a></td> <td><a class="sale_color" href="mailto:' + row.store_email + '">' + row.store_email + '</a></td> <td>' + row.store_address + '</td>' - + '<td>' + row.state + '</td>' + '<td>' + row.country + '</td>' + '<td class="text-center"><span>' + action + '</span></td>' + - '</tr>'; - $('#view_branches').children('tbody').append(trow); - } - $(document).ready(function () { - for (var i = 0; i < response.data.list.length; i++) { - $('#onclick-toolbar_' + i).toolbar({ - content: '#onclick-toolbar-options_' + i, - event: 'click', - style: 'primary', - hideOnClick: true - }); - $('#onclick-toolbar_' + i).on('toolbarItemClick', function (event, element) { - hasher.setHash($(element).data('id')); - $(this).trigger('click'); - $('.mobile_tooltip').tooltip('hide'); - }); - } - }); - PosnicPro.setSelectedCheckbox(PosnicPro["branches_checkbox"], 'branches'); - PosnicPro.ACLForModule('branch'); - loader.find(".loadingSpinner:first").remove(); - } else { - PosnicPro.alert(response.type, response.message); + var html = ''; + if (pages > 1) { + html += btn(p - 1, '«', p <= 1); + var end = Math.min(pages, Math.max(1, p - 2) + 4); + var start = Math.max(1, end - 4); + for (var n = start; n <= end; n++) { + html += '<span class="q-pg-num">' + btn(n, n, false, n === p ? 'btn-primary-rgba' : 'btn-secondary-rgba') + '</span>'; } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); + } + html += '<span class="q-pg-count">' + label + '</span>'; + if (pages > 1) { html += btn(p + 1, '»', p >= pages); } + $('#branches_list_paging').html(html); + }, + goPage: function (n) { + if (!n || n < 1) { return; } + PosnicPro.branches._page = n; + PosnicPro.branches.loadList(); + }, + exportCsv: function () { + var rows = [['Name', 'Phone', 'Email', 'Address', 'State', 'Country']]; + (PosnicPro.branches._lastRows || []).forEach(function (r) { + rows.push([r.branch_name, r.store_telephone || '', r.store_email || '', r.store_address || '', r.state || '', r.country || '']); }); + var csv = rows.map(function (r) { + return r.map(function (c) { return '"' + String(c == null ? '' : c).replace(/"/g, '""') + '"'; }).join(','); + }).join('\n'); + var blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' }); + var a = document.createElement('a'); + a.href = URL.createObjectURL(blob); + a.download = 'branches.csv'; + a.click(); + URL.revokeObjectURL(a.href); }, showDataTablePage: function () { - var loader = $(".loader-table-branch"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.dashboard.datePicker(); PosnicPro.HideSideBarModal(); - $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); - $(".vertical-layout").removeClass("toggle-menu"); - $(".vertical-menu li a").removeClass("active"); $('.page_loader,#osk-container').hide(); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); $('.page-title-box,#branches').show(); - $('#branches_new,#branches_view').modal('hide'); - PosnicPro.branches.branchesTable('branches'); $('#v-pills-manage-tab').addClass('active'); $('#v-pills-manage').addClass('show active'); $('.dashboard_img_menu').hide(); $('#image_sidebar_branch').show(); + PosnicPro.branches.loadList(1); }, triggerAddNew: function (module) { PosnicPro.getAddNewPage(module + '_new'); @@ -266,7 +354,9 @@ PosnicPro.branches = { var params = { method: method, url: url, - data: JSON.stringify(Object.assign(formData, registerType, countryId)) + data: JSON.stringify( + Object.assign(formData, registerType, countryId, PosnicPro.branches.sharingChoice()) + ) }; PosnicPro.request(params, function (response) { @@ -303,6 +393,7 @@ PosnicPro.branches = { PosnicPro.local.set('branchemail', response.data['store_email']); PosnicPro.local.set('branchphone', response.data['store_telephone']); PosnicPro.local.set('branchaddress', response.data['store_address']); + PosnicPro.local.set('branchgstin', response.data['branch_gstin_number'] || ''); let branchRecord = []; branchRecord.push({name: response.data['branch_name'], phone: response.data['store_telephone'], email: response.data['store_email'], address: response.data['store_address'], image: response.data['branch_image']}); db.customerDisplay.put({id: '2', 'clear': 'no', 'get': 'no', branch: branchRecord}); @@ -411,11 +502,11 @@ PosnicPro.branches = { $('#branch_address').val(data.store_address); $('#branch_country').val(data.country).trigger('change.select2'); PosnicPro.local.set('edit_branch_state', data.state); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#branch_title').text('திருத்தப்பட்ட') : $('#branch_title').text('Edit'); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#branch_button_title').text('புதுப்பி') : $('#branch_button_title').text('Update'); + $('#branch_title').text(PosnicPro.i18n.t('lang_action_edit', 'Edit')); + $('#branch_button_title').text(PosnicPro.i18n.t('lang_updatebtn_title', 'Update')); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); - $('#branch_view').modal('show'); + PosnicPro.branches.sharingRow(false); $('.register-wrapper .register-fields .register-input:nth-child(n+2)').remove(); let $test = $('.register-input:parent'); $('.add-field', $test).hide(); @@ -448,23 +539,66 @@ PosnicPro.branches = { let $firstChild = $('.register-input:first-child'); $('.add-field', $firstChild).show(); }, + /* + * The three sharing boxes, as EXPLICIT booleans (owner ask #85). + * + * serializeArray() omits an unchecked checkbox entirely, and the server + * treats an absent key as "use the default" - which for these is ticked. + * So unticking Customers and pressing Save would have shared them anyway, + * with the form showing the opposite. The one failure mode worth more than + * the others here is silence, so the value is stated rather than implied. + * + * Only on CREATE. Editing a branch is not where an account-wide rule is + * changed, and sending these on every branch save would let a stale form + * re-impose a default over a rule set in Settings. + */ + sharingChoice: function () { + if ($('#branch_id').val() !== '') { return {}; } + return { + share_customers: $('#share_customers').is(':checked'), + share_suppliers: $('#share_suppliers').is(':checked'), + /* Not a switch. Stock sits on one shelf in one building, so the + product LIST is copied once here rather than shared as a rule - + empty means start with nothing. */ + copy_items_from: $('#copy_items_from').val() || '' + }; + }, + /* Shown while creating, hidden while editing - see sharingChoice. */ + sharingRow: function (creating) { + $('#branch_sharing_row').toggle(!!creating); + if (creating) { PosnicPro.branches.fillCopyFrom(); } + }, + /* + * The shops a new one can copy its products from. + * + * Read from the branch dropdown the header already keeps, rather than + * another request: it holds exactly the branches this user may see, so a + * shop they have no access to cannot appear here as a source. + */ + fillCopyFrom: function () { + var $sel = $('#copy_items_from'); + if (!$sel.length) { return; } + var current = $sel.val(); + $sel.find('option').not('[value=""]').remove(); + $('#branch_name option').each(function () { + var id = $(this).val(); + if (!id) { return; } + $sel.append($('<option>').attr('value', id).text($(this).text())); + }); + $sel.val(current || ''); + }, addbranchButton: function () { var loader = $(".loader-branch"); loader.find(".loadingSpinner:first").remove(); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#branch_title').text('புதிய') : $('#branch_title').text('Add'); -// $('#branch_button_title').text('Save'); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#branch_button_title').text('சேமி') : $('#branch_button_title').text('Save'); + $('#branch_title').text(PosnicPro.i18n.t('lang_new_title', 'Add')); +// $('#branch_button_title').text(PosnicPro.i18n.t('lang_save_title', 'Save')); + $('#branch_button_title').text(PosnicPro.i18n.t('lang_save_title', 'Save')); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); $('#branch_id').val(''); $('#branches_new .alert').remove(); $('#show_last_created_branch').hide(); - }, - exportBranches: function () { - PosnicPro.exportTableData(PosnicPro.branches_checkbox, 'branches'); - }, - deleteSelectedBranches: function () { - PosnicPro.deleteTableData(PosnicPro.branches_checkbox, 'branches'); + PosnicPro.branches.sharingRow(true); }, branchClearform: function () { PosnicPro.branches.loadSelectBranchState(PosnicPro.local.get('countryid'), 'clear'); @@ -493,10 +627,10 @@ PosnicPro.branches = { if (PosnicPro.local.get('edit_branch_state') !== '' && action === 'edit') { stateSelect.val(PosnicPro.local.get('edit_branch_state')).trigger('change.select2'); - window.intlTelInputGlobals.getInstance(document.querySelector("#branch_phone")).setCountry(response.data['countrySortName']); + (PosnicPro.branches.branch_phone || { setCountry: function () {} }).setCountry(response.data['countrySortName']); } else { $('#branch_state option:eq(0)').prop('selected', true); - window.intlTelInputGlobals.getInstance(document.querySelector("#branch_phone")).setCountry(response.data['countrySortName']); + (PosnicPro.branches.branch_phone || { setCountry: function () {} }).setCountry(response.data['countrySortName']); } }); }, @@ -548,29 +682,29 @@ PosnicPro.branches = { }, messages: { name: { - required: "Please enter a branch name", + required: "Enter the shop name", minlength: "Branch name must be at least 3 characters", maxlength: "Branch name is too long !" }, phone: { - branch_phone_number: "Please enter a valid phone number.", - minlength: "Please enter at least 3 characters.", - maxlength: "Please enter no more than 20 characters." + branch_phone_number: "Enter a valid phone number", + minlength: "Use at least 3 characters", + maxlength: "Use no more than 20 characters" }, address: { - required: "Please enter an address", + required: "Enter an address", minlength: "Address must be at least 3 characters long", maxlength: "Address is too long !" }, email: { - required: "Please enter a email address", + required: "Enter a valid email address", maxlength: "Email should not be more than 250 Characters" }, country: { - required: "Please choose your country" + required: "Choose your country" }, state: { - required: "Please choose your state" + required: "Choose your state" }, "branchregister[0]": { minlength: "Name Must be in 3 charcters", @@ -672,10 +806,20 @@ $('#branch_country').one('change', function () { }); }); $(function () { - PosnicPro.branches.branch_phone = window.intlTelInput(document.querySelector("#branch_phone"), { + PosnicPro.lazyPhoneInput('#branch_phone', PosnicPro.branches, 'branch_phone', { separateDialCode: true, preferredCountries: ['in'], hiddenInput: "full", utilsScript: "../static/script/js/utils.js" }); }); + +/* Standard list wiring: Filter button, row click peeks the branch in + place, row action buttons never also open the row. */ +$(document).on('click', '#branches_filter_btn', function () { + PosnicPro.branches.mountFilters(true); + PosnicPro.listFilter.toggle('branches'); +}); +$(document).on('click', '#branches_list_rows tr.branches-row', function () { + PosnicPro.branches.openDoc($(this).data('id')); +}); diff --git a/frontend/static/script/js/modules/js/campaigns.js b/frontend/static/script/js/modules/js/campaigns.js index 264727a79..88ee614e8 100644 --- a/frontend/static/script/js/modules/js/campaigns.js +++ b/frontend/static/script/js/modules/js/campaigns.js @@ -77,7 +77,7 @@ PosnicPro.campaigns = { render: function (rows) { var body = $('#campaigns_table_body').empty(); if (!rows.length) { - body.append('<tr><td colspan="6" class="text-center text-muted py-3">No campaigns yet.</td></tr>'); + body.append('<tr><td colspan="6" class="text-center text-muted py-3"><lang class="lang_no_campaigns_yet">No campaigns yet.</lang></td></tr>'); return; } rows.forEach(function (c) { @@ -91,8 +91,8 @@ PosnicPro.campaigns = { '<td>' + PosnicPro.campaigns.statusBadge(c.status) + '</td>' + '<td class="small">' + reach + '</td>' + '<td class="text-center text-nowrap">' + - '<a href="javascript:void(0)" class="point-cursor mr-2 campaign-edit" data-id="' + c._id + '" title="Open"><i class="feather icon-edit"></i></a>' + - '<a href="javascript:void(0)" class="point-cursor text-danger campaign-del" data-id="' + c._id + '" title="Delete"><i class="feather icon-trash"></i></a>' + + '<a href="javascript:void(0)" class="point-cursor mr-2 campaign-edit" data-id="' + c._id + '" title="Open" data-t-title="lang_open"><i class="feather icon-edit"></i></a>' + + '<a href="javascript:void(0)" class="point-cursor text-danger campaign-del" data-id="' + c._id + '" title="Delete" data-t-title="lang_delete"><i class="feather icon-trash"></i></a>' + '</td>' + '</tr>' ); @@ -104,7 +104,7 @@ PosnicPro.campaigns = { newForm: function () { PosnicPro.campaigns.fill({ channel: 'whatsapp', segment: { type: 'all' } }); $('#campaign_form_id').val(''); - $('#campaign_form_title').text('New campaign'); + $('#campaign_form_title').text(PosnicPro.i18n.t('lang_new_campaign', 'New campaign')); $('#campaign_preview_out').empty(); $('#campaigns_form_wrap').show(); $('#campaign_name').focus(); @@ -117,7 +117,7 @@ PosnicPro.campaigns = { if (!c) return; PosnicPro.campaigns.fill(c); $('#campaign_form_id').val(c._id); - $('#campaign_form_title').text(c.status === 'sent' || c.status === 'partial' ? 'Campaign (sent)' : 'Edit campaign'); + $('#campaign_form_title').text(c.status === 'sent' || c.status === 'partial' ? PosnicPro.i18n.t('lang_campaign_sent', 'Campaign (sent)') : PosnicPro.i18n.t('lang_edit_campaign', 'Edit campaign')); $('#campaign_preview_out').empty(); $('#campaigns_form_wrap').show(); }, @@ -168,11 +168,11 @@ PosnicPro.campaigns = { save: function (after) { var data = PosnicPro.campaigns.collect(); if (!data.name) { - PosnicPro.alert('error', 'A campaign name is required.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_a_campaign_name_is_required', 'A campaign name is required.')); return; } if (!data.message) { - PosnicPro.alert('error', 'A message is required.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_a_message_is_required', 'A message is required.')); return; } var id = $('#campaign_form_id').val(); @@ -214,7 +214,7 @@ PosnicPro.campaigns = { $('#campaign_preview_out').html( '<div class="alert alert-info mb-0"><strong>' + d.reachable + '</strong> reachable of ' + d.total + ' in this segment' + (names.length ? ' · e.g. ' + names.join(', ') : '') + - '<div class="small text-muted mt-1">Opt-outs and customers with no phone are skipped automatically.</div></div>' + '<div class="small text-muted mt-1"><lang class="lang_opt_outs_and_customers_with_no_phone_are_s">Opt-outs and customers with no phone are skipped automatically.</lang></div></div>' ); }); }, @@ -235,7 +235,7 @@ PosnicPro.campaigns = { var d = res.data || {}; PosnicPro.alert( 'success', - (dryRun ? 'Dry run: ' : 'Sent: ') + (d.sent || 0) + ' sent, ' + (d.failed || 0) + ' failed, ' + (d.skipped || 0) + ' skipped' + (dryRun ? PosnicPro.i18n.t('lang_dry_run', 'Dry run: ') : PosnicPro.i18n.t('lang_sent', 'Sent: ')) + (d.sent || 0) + ' sent, ' + (d.failed || 0) + ' failed, ' + (d.skipped || 0) + ' skipped' ); PosnicPro.campaigns.load(); }); @@ -245,7 +245,7 @@ PosnicPro.campaigns = { schedule: function () { var when = $('#campaign_schedule_at').val(); if (!when) { - PosnicPro.alert('error', 'Pick a date and time to schedule.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_pick_a_date_and_time_to_schedule', 'Pick a date and time to schedule.')); return; } PosnicPro.campaigns.save(function (data) { diff --git a/frontend/static/script/js/modules/js/cashback.js b/frontend/static/script/js/modules/js/cashback.js index 9a4f38b38..9cf91214e 100644 --- a/frontend/static/script/js/modules/js/cashback.js +++ b/frontend/static/script/js/modules/js/cashback.js @@ -77,15 +77,15 @@ PosnicPro.cashback = { var sign = PosnicPro.cashback.sign(); var body = $('#cashback_recent_body').empty(); if (!rows.length) { - body.append('<tr><td colspan="6" class="text-center text-muted py-3">No cashback issued yet.</td></tr>'); + body.append('<tr><td colspan="6" class="text-center text-muted py-3"><lang class="lang_no_cashback_issued_yet">No cashback issued yet.</lang></td></tr>'); return; } rows.forEach(function (r) { var status = r.voided - ? '<span class="badge badge-danger-inverse">Voided</span>' + ? '<span class="badge badge-danger-inverse"><lang class="lang_voided">Voided</lang></span>' : r.delivered - ? '<span class="badge badge-success-inverse">Sent</span>' - : '<span class="badge badge-secondary-inverse">Issued</span>'; + ? '<span class="badge badge-success-inverse"><lang class="lang_sent_2">Sent</lang></span>' + : '<span class="badge badge-secondary-inverse"><lang class="lang_issued">Issued</lang></span>'; body.append( '<tr>' + '<td><strong>' + PosnicPro.cashback.esc(r.code) + '</strong></td>' + @@ -136,7 +136,7 @@ PosnicPro.cashback = { var w = window.open('', '_blank', 'width=420,height=640'); if (!w) { - PosnicPro.alert('error', 'Allow pop-ups to print the coupon.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_allow_pop_ups_to_print_the_coupon', 'Allow pop-ups to print the coupon.')); return; } w.document.write( @@ -150,7 +150,7 @@ PosnicPro.cashback = { '.e{font-size:12px;color:#666;margin-top:10px;}' + 'svg{max-width:100%;height:auto;margin-top:10px;}' + '</style></head><body><div class="c">' + - '<div class="t">Cashback voucher</div>' + + '<div class="t"><lang class="lang_cashback_voucher">Cashback voucher</lang></div>' + '<div class="a">' + amount + '</div>' + '<div class="s">' + PosnicPro.cashback.esc(shop) + '</div>' + barcodeSvg + diff --git a/frontend/static/script/js/modules/js/categories.js b/frontend/static/script/js/modules/js/categories.js index 6c57e1e9f..24c1ce02e 100644 --- a/frontend/static/script/js/modules/js/categories.js +++ b/frontend/static/script/js/modules/js/categories.js @@ -1,4 +1,16 @@ PosnicPro.categories = { + setCatTileColor: function (color) { + $('#category_tile_color').val(color || ''); + $('#category_tile_swatches .tile-swatch').removeClass('is-picked').filter(function () { + return ($(this).data('color') || '') === (color || ''); + }).addClass('is-picked'); + }, + setCatTileShape: function (shape) { + $('#category_tile_shape').val(shape || ''); + $('#category_tile_shapes .tile-shape').removeClass('is-picked').filter(function () { + return ($(this).data('shape') || '') === (shape || ''); + }).addClass('is-picked'); + }, categoryAction: 'add', showAdd: function () { PosnicPro.HideSideBarModal(); @@ -34,142 +46,290 @@ PosnicPro.categories = { showDelete: function (id) { PosnicPro.deleteTableRowData(id, 'categories'); }, + /* Deep link #/categories/<id>: the list with that category open in + the right pane. Recognises its own setHash echo. */ showDetails: function (id) { - var loader = $(".loader-view-category"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.showViewModal('categories'); - PosnicPro.categories.viewCategory(id); + if (PosnicPro.listDoc.activeId('categories') === String(id) + && $('#categories_detail_card').is(':visible')) { return; } + PosnicPro.categories._chrome(); + PosnicPro.categories.loadList(1); + PosnicPro.categories.openDoc(id); }, - categoriesTable: function () { - var loader = $(".loader-table-category"); - $("<div class='loadingSpinner'></div>").appendTo(loader); - PosnicPro.appendViewDataTableBody('categories'); - var table = $('#view_categories'); - var params = { - url: 'categories', - data: { - page: table.data('current_page'), - limit: parseInt($('#view_categories_per_page option:selected').text()), - filters: table.data('filters'), - // Send the active branch so the list matches the branch the user - // has open (consistent with category create). - branch_id: PosnicPro.local.get('branch_id_set') + openDoc: function (id) { + var self = PosnicPro.categories; + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var actions = '<button type="button" class="btn btn-sm btn-light" data-module="category" data-access="write" data-toggle="tooltip" title="Edit this category" data-t-title="lang_edit_this_category" aria-label="Edit" data-t-aria-label="lang_edit_title"' + + ' onclick="hasher.setHash(\'categories/' + esc(id) + '/edit\');"><i class="feather icon-edit-2"></i></button>' + + '<button type="button" class="btn btn-sm btn-light" data-module="category" data-access="delete" data-toggle="tooltip" title="Delete this category" data-t-title="lang_delete_this_category" aria-label="Delete" data-t-aria-label="lang_delete"' + + ' onclick="PosnicPro.listDoc.close(\'categories\'); hasher.setHash(\'categories/' + esc(id) + '/delete\');"><i class="feather icon-trash-2"></i></button>'; + var r = (self._lastRows || []).filter(function (x) { return String(x._id) === String(id); })[0]; + if (r) { + PosnicPro.listDoc.open({ key: 'categories', id: id, title: r.name, actions: actions, body: self._docBody(r) }); + PosnicPro.ACLForModule('category'); + self.loadActivity(id); + return; + } + PosnicPro.listDoc.open({ key: 'categories', id: id, title: PosnicPro.i18n.t('lang_newcategory_title', 'Category'), actions: actions }); + PosnicPro.ACLForModule('category'); + PosnicPro.get('categories/' + id, function (response) { + var d = response && response.data; + if (response.type !== 'success' || !d) { + PosnicPro.listDoc.body('categories', '<div class="text-danger p-3"><lang class="lang_could_not_open_this_category">Could not open this category.</lang></div>'); + return; } - }; - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - table.data('total', response.data.total); - table.data('total_pages', response.data.total_pages); - table.data('current_page', response.data.current_page); - table.data('per_page', response.data.per_page); - PosnicPro.paging(response.data.total_pages, response.data.current_page); - table.children('tbody').text(''); - $('#view_categories_total').text(response.data.total); - - var rowTotal = response.data.total; - if (rowTotal === 0) { - $('.category_header').hide(); - $('#category_img_hide').show(); - - } else { - $('#category_img_hide').hide(); - $('.category_header').show(); - } - var row_total = (table.data('current_page') - 1) * table.data('per_page') + 1; - $('#view_categories_page_total').text(row_total); - var page_totals = (table.data('current_page') - 1) * table.data('per_page'); - $('#view_categories_page_perpage_total').text(page_totals + response.data.list.length); - var currency = PosnicPro.local.get('currencySign'); - for (var i = 0; i < response.data.list.length; i++) { - var row = response.data.list[i]; - var description = row.description || ''; - var discountSign = (row.discount_amount > 0) ? currency : '%'; - - if (row.discount_amount > 0) { - var discount = row.discount_amount; - } else { - discount = row.discount_percentage; - } - var row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; - var image_path = (row.image !== "category.svg") ? row.image : 'static/images/default/' + row.image; - - if (discountSign === '%') { - var discount_percentage = '' + discount + ' ' + discountSign + ''; - } else { - var discount_percentage = '' + discountSign + ' ' + discount + ''; - } - - var action = '<div id="onclick-toolbar-options_' + i + '" class="hidden">' + - '<a data-module = "category" data-access = "read" href="#/categories/' + row._id + '" data-id="categories/' + row._id + '" data-toggle="tooltip" title="View Category" class="point-cursor mobile_tooltip"><i class="feather icon-eye"></i></a>' + - '<a data-module = "category" data-access = "write" href="#/categories/' + row._id + '/edit" data-id="categories/' + row._id + '/edit" data-toggle="tooltip" title="Edit Category" class="point-curso mobile_tooltipr"><i class="feather icon-edit"></i></a>' + - '<a data-module = "category" data-access = "delete" href="#/categories/' + row._id + '/delete" data-id="categories/' + row._id + '/delete" data-toggle="tooltip" title="Delete Category" class="point-cursor mobile_tooltip"><i class="feather icon-trash"></i></a>' + - '</div>' + - '<div data-toolbar="user-options" class="btn btn-round btn-primary-rgba round-pad" id="onclick-toolbar_' + i + '"><i class="feather icon-more-vertical-"></i></div>'; - - var trow = '<tr> \n\ - <th><input type="checkbox" class="categories-row-id" id="' + row._id + '" name="id[]" value="' + row._id + '" onclick="PosnicPro.checkboxSelectOne(this,\'categories\');"></th> <th scope="row">' + row_no + '</th> \n\ - <td><a href="#/categories/' + row._id + '" ><i data-toggle="tooltip" class="table_model_item">' + row.name + '</i></a></td> \n\ - <td><img src=' + image_path + ' width=30 height=20 class="imagezoom" id="' + row.image + '" onclick="PosnicPro.viewImage(this.id,\'category\');"></td> \n\ - <td class="text-right">' + discount_percentage + '</td> \n\ - <td class="text-center">' + description + '</td> ' + - '<td class="text-center"><span>' + action + '</span></td>' + - '</tr>'; - - $('#view_categories').children('tbody').append(trow); - } - $(document).ready(function () { - for (var i = 0; i < response.data.list.length; i++) { - $('#onclick-toolbar_' + i).toolbar({ - content: '#onclick-toolbar-options_' + i, - event: 'click', - style: 'primary', - hideOnClick: true - }); - $('#onclick-toolbar_' + i).on('toolbarItemClick', function (event, element) { - hasher.setHash($(element).data('id')); - $(this).trigger('click'); - $('.mobile_tooltip').tooltip('hide'); - }); - } - }); - PosnicPro.setSelectedCheckbox(PosnicPro["categories_checkbox"], 'categories'); - PosnicPro.ACLForModule('category'); - - loader.find(".loadingSpinner:first").remove(); - } else { - PosnicPro.alert(response.type, response.message); + d._id = d._id || id; + PosnicPro.listDoc.title('categories', d.name || 'Category'); + PosnicPro.listDoc.body('categories', self._docBody(d)); + self.loadActivity(id); + }, function () { + PosnicPro.listDoc.body('categories', '<div class="text-danger p-3"><lang class="lang_could_not_open_this_category">Could not open this category.</lang></div>'); + }); + }, + _docBody: function (r) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var currency = PosnicPro.local.get('currencySign'); + var discount = (Number(r.discount_amount) > 0) + ? currency + ' ' + r.discount_amount + : (Number(r.discount_percentage) > 0 ? r.discount_percentage + ' %' : '-'); + var shape = r.tile_shape === 'circle' ? 'border-radius:50%;' : 'border-radius:8px;'; + var ground = r.tile_color || 'var(--theme-secondary-color, #8896ab)'; + var chip = (r.image && r.image !== 'category.svg') + ? '<img src="' + esc(r.image) + '" style="width:56px; height:56px; object-fit:cover; border-radius:8px; flex:0 0 56px;" alt="">' + : '<span style="display:inline-flex; width:56px; height:56px; ' + shape + + 'background:' + esc(ground) + '; color:#fff; font-weight:700; font-size:22px; align-items:center; justify-content:center; flex:0 0 56px;">' + + esc(String(r.name || '?').trim().charAt(0).toUpperCase()) + '</span>'; + return '<div style="display:flex; gap:20px; align-items:flex-start;">' + + chip + + '<div style="flex:1 1 auto; min-width:0;"><div class="s-doc-stats" id="cg_doc_stats">' + + '<div class="s-stat"><div class="s-stat-value">' + (r.items_count == null ? '—' : esc(String(r.items_count))) + '</div>' + + '<div class="s-stat-label">' + (r.items_count === 1 ? PosnicPro.i18n.t('lang_newitem_title', 'Item') : PosnicPro.i18n.t('lang_itemdetail_title', 'Items')) + '</div></div>' + + '<div class="s-stat"><div class="s-stat-value">' + esc(discount) + '</div><div class="s-stat-label"><lang class="lang_discount_title">Discount</lang></div></div>' + + '</div></div></div>' + + PosnicPro.listDoc.grid([ + { label: PosnicPro.i18n.t('lang_about', 'About'), lines: [ + r.description ? '<div>' + esc(r.description) + '</div>' : '<div class="q-muted"><lang class="lang_no_description">No description</lang></div>' + ] }, + { label: PosnicPro.i18n.t('lang_on_record', 'On record'), lines: [ + r.created_date ? '<div class="q-muted">Added ' + esc(PosnicPro.convertDate(r.created_date)) + '</div>' : '', + r.updated_date ? '<div class="q-muted">Updated ' + esc(PosnicPro.convertDate(r.updated_date)) + '</div>' : '' + ] } + ]) + + '<div class="q-label" style="margin-top:18px;"><lang class="lang_recent_sales">Recent sales</lang></div>' + + '<div id="cg_doc_sales" class="q-muted" style="font-size:13px;"><lang class="lang_loading_4">Loading ...</lang></div>'; + }, + /* The category's sales weight + latest bills, straight from the same + report door the old slide-over read - IN the pane now (owner: no + pop-ups; the design is the dossier). */ + loadActivity: function (id) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var cur = PosnicPro.local.get('currencySign'); + PosnicPro.get({ + url: 'sales/categorySaleDetails', + data: { page: 1, limit: 5, category_id: id, branch: [PosnicPro.local.get('branch_id_set')] } + }, function (response) { + var t = response && response.data && response.data.table && response.data.table.data; + var list = (t && t.list) || []; + var total = (t && Number(t.total)) || 0; + var value = response && response.data && response.data.sale_amount != null + ? Number(response.data.sale_amount) : null; + if (!list.length) { + $('#cg_doc_sales').html(PosnicPro.i18n.t('lang_no_sales_in_this_category_yet', 'No sales in this category yet.')); + return; } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); + var pageValue = 0; + var rows = list.map(function (r) { + pageValue += Number(r.items_total) || 0; + var saleId = r._id && r._id.$oid ? r._id.$oid : r._id; + return '<tr class="cg-doc-sale-row" data-id="' + esc(saleId) + '" style="cursor:pointer;">' + + '<td>' + esc(r.sales_id) + '</td>' + + '<td class="q-muted">' + esc(r.string_date ? PosnicPro.convertDate(r.string_date) : '') + '</td>' + + '<td>' + esc(r.sale_process || 'Add') + '</td>' + + '<td class="text-right">' + cur + ' ' + (Number(r.items_total) || 0).toFixed(2) + '</td>' + + '</tr>'; + }).join(''); + $('#cg_doc_stats').append( + '<div class="s-stat"><div class="s-stat-value">' + total + '</div>' + + '<div class="s-stat-label">' + (total === 1 ? PosnicPro.i18n.t('lang_newsale_title', 'Sale') : PosnicPro.i18n.t('lang_rgrp_sales', 'Sales')) + '</div></div>' + + '<div class="s-stat"><div class="s-stat-value">' + cur + ' ' + + (value != null ? value.toFixed(2) : pageValue.toFixed(2)) + '</div>' + + '<div class="s-stat-label">Sold' + (value == null && total > list.length ? ' (last ' + list.length + ')' : '') + '</div></div>'); + $('#cg_doc_sales').removeClass('q-muted').html( + '<table class="q-items s-doc-purchases-table"><thead><tr>' + + '<th><lang class="lang_bill">Bill #</lang></th><th><lang class="lang_date_title">Date</lang></th><th><lang class="lang_process_title">Process</lang></th><th class="text-right"><lang class="lang_total_title">Total</lang></th>' + + '</tr></thead><tbody>' + rows + '</tbody></table>'); + }, function () { + $('#cg_doc_sales').html(PosnicPro.i18n.t('lang_sales_history_unavailable', 'Sales history unavailable.')); }); }, - showDataTablePage: function () { - var loader = $(".loader-table-category"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.dashboard.datePicker(); + /* The name the OLD table machinery answered to - the save flow and the + shared clearListFilters/refresh doors still call it. */ + categoriesTable: function () { + PosnicPro.categories.loadList(1); + }, + _page: 1, + PAGE_SIZE: 25, + _lastRows: [], + _chrome: function () { PosnicPro.HideSideBarModal(); - $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); - $(".vertical-layout").removeClass("toggle-menu"); - $(".vertical-menu li a").removeClass("active"); $('.page_loader,#osk-container').hide(); - $('.page-title-box,#categories').show(); - $('#categories_new,#categories_view').modal('hide'); - $('#v-pills-inventory-tab').addClass('active'); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); + $('#v-pills-inventory-tab,#view_categories_page').addClass('active'); $('#v-pills-inventory').addClass('show active'); - PosnicPro.categories.categoriesTable('categories'); + $('.page-title-box,#categories').show(); $('.dashboard_img_menu').hide(); $('#image_sidebar_itemcatgory').show(); }, - triggerModules: function () { - PosnicPro.showAddModal('category'); - PosnicPro.categories.addCategoryButton(); - $('#category_reset').show(); - $('.category_edit_reset').hide(); - if (PosnicPro.categories.categoryAction === 'edit') { - PosnicPro.categories.categoryClearForm(); + showDataTablePage: function () { + PosnicPro.categories._chrome(); + PosnicPro.categories.loadList(1); + }, + mountFilters: function (force) { + if (!$('#categories_filter_panel').length) { return; } + if (!force && $('#categories_filter_panel').data('mounted')) { return; } + $('#categories_filter_panel').data('mounted', true); + PosnicPro.listFilter.mount({ + key: 'categories', + container: '#categories_filter_panel', + button: '#categories_filter_btn', + searchPlaceholder: PosnicPro.i18n.t('lang_search_category_name', 'Search category name'), + dateField: PosnicPro.i18n.t('lang_added', 'Added'), + searchFields: [ + { value: 'name', label: PosnicPro.i18n.t('lang_name_title', 'Name') } + ], + onChange: function () { PosnicPro.categories.loadList(1); } + }); + }, + loadList: function (page) { + PosnicPro.categories.mountFilters(); + var self = PosnicPro.categories; + if (page) { self._page = page; } + var filters = PosnicPro.listFilter.legacyFilters('categories', { dateKey: 'created_date' }); + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + PosnicPro.get({ + url: 'categories', + data: { + page: self._page, + limit: self.PAGE_SIZE, + filters: JSON.stringify(filters), + // Send the active branch so the list matches the branch the + // user has open (consistent with category create). + branch_id: PosnicPro.local.get('branch_id_set') + } + }, function (response) { + var data = (response && response.data) || {}; + var list = data.list || []; + self._lastRows = list; + if (!list.length) { + var filtered = PosnicPro.listFilter.activeCount('categories') > 0; + $('#categories_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20">' + + (filtered ? PosnicPro.i18n.t('lang_no_categories_match_this_filter', 'No categories match this filter.') : PosnicPro.i18n.t('lang_no_categories_yet_press_new_to_add_the_fir', 'No categories yet - press New to add the first.')) + '</div>'); + $('#categories_list_paging').html(''); + return; + } + var currency = PosnicPro.local.get('currencySign'); + var html = '<div class="table-responsive"><table class="table table-borderless">' + + '<thead><tr><th style="width:44px;"></th><th><lang class="lang_name_title">Name</lang></th>' + + '<th class="text-right"><lang class="lang_itemdetail_title">Items</lang></th><th class="text-right"><lang class="lang_discount_title">Discount</lang></th>' + + '<th class="cg-col-desc"><lang class="lang_description_title">Description</lang></th><th class="cg-col-created"><lang class="lang_added">Added</lang></th></tr></thead><tbody>'; + list.forEach(function (r) { + /* The sale screen paints each category as its TILE - the list + shows the same identity instead of one grey stock icon per + row. A real photo wins; a tile color renders as its chip; + plain categories get a neutral initial. */ + var thumb; + if (r.image && r.image !== 'category.svg') { + thumb = '<img loading="lazy" decoding="async" src="' + esc(r.image) + '" style="width:30px; height:30px; object-fit:cover; border-radius:5px;" alt="">'; + } else { + var shape = r.tile_shape === 'circle' ? 'border-radius:50%;' : 'border-radius:6px;'; + var ground = r.tile_color || 'var(--theme-secondary-color, #8896ab)'; + thumb = '<span style="display:inline-flex;width:30px;height:30px;' + shape + + 'background:' + esc(ground) + ';color:#fff;font-weight:700;font-size:12.5px;align-items:center;justify-content:center;">' + + esc(String(r.name || '?').trim().charAt(0).toUpperCase()) + '</span>'; + } + var discount = (Number(r.discount_amount) > 0) + ? currency + ' ' + r.discount_amount + : (Number(r.discount_percentage) > 0 ? r.discount_percentage + ' %' : '-'); + var count = (r.items_count == null) ? '-' + : (Number(r.items_count) === 1 ? '1 item' : r.items_count + ' items'); + html += '<tr class="md-row categories-row highlight-select' + + (PosnicPro.listDoc.activeId('categories') === String(r._id) ? ' is-active' : '') + '" data-id="' + esc(r._id) + '" style="cursor:pointer;">' + + '<td>' + thumb + '</td>' + + '<td>' + esc(r.name) + '</td>' + + '<td class="text-right' + (Number(r.items_count) > 0 ? '' : ' q-muted') + '">' + esc(count) + '</td>' + + '<td class="text-right">' + esc(discount) + '</td>' + + '<td class="cg-col-desc q-muted">' + esc(r.description || '-') + '</td>' + + '<td class="cg-col-created q-muted">' + esc(r.created_date ? PosnicPro.convertDate(r.created_date) : '-') + '</td>' + + '</tr>'; + }); + html += '</tbody></table></div>'; + $('#categories_list_rows').html(html); + PosnicPro.ACLForModule('category'); + self.renderPager(Number(data.total) || list.length); + }, function () { + $('#categories_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20"><lang class="lang_could_not_load_categories_try_again">Could not load categories - try again.</lang></div>'); + }); + }, + renderPager: function (total) { + var self = PosnicPro.categories; + var p = self._page, size = self.PAGE_SIZE; + var pages = Math.ceil(total / size) || 1; + var label = total + ' ' + (total === 1 ? PosnicPro.i18n.t('lang_category', 'category') : PosnicPro.i18n.t('lang_categories', 'categories')); + if (pages > 1) { label = 'Page ' + p + ' of ' + pages + ' · ' + label; } + var btn = function (to, text, off, cls) { + return '<button type="button" class="btn btn-sm ' + (cls || 'btn-secondary-rgba') + ' q-pg-btn"' + (off ? ' disabled' : '') + + ' onclick="PosnicPro.categories.goPage(' + to + ');">' + text + '</button>'; + }; + var html = ''; + if (pages > 1) { + html += btn(p - 1, '«', p <= 1); + var end = Math.min(pages, Math.max(1, p - 2) + 4); + var start = Math.max(1, end - 4); + for (var n = start; n <= end; n++) { + html += '<span class="q-pg-num">' + btn(n, n, false, n === p ? 'btn-primary-rgba' : 'btn-secondary-rgba') + '</span>'; + } } - PosnicPro.categories.categoryAction = 'add'; + html += '<span class="q-pg-count">' + label + '</span>'; + if (pages > 1) { html += btn(p + 1, '»', p >= pages); } + $('#categories_list_paging').html(html); + }, + goPage: function (n) { + if (!n || n < 1) { return; } + PosnicPro.categories._page = n; + PosnicPro.categories.loadList(); + }, + _csvSpec: function () { + return { + head: ['Name', 'Items', 'Discount amount', 'Discount %', 'Description', 'Added'], + map: function (r) { + return [r.name, r.items_count == null ? '' : r.items_count, r.discount_amount || 0, + r.discount_percentage || 0, r.description || '', + r.created_date ? PosnicPro.convertDate(r.created_date) : '']; + } + }; + }, + exportCsv: function () { + var spec = PosnicPro.categories._csvSpec(); + PosnicPro.listExport.save( + [spec.head].concat((PosnicPro.categories._lastRows || []).map(spec.map)), 'categories.csv'); + }, + /* Everything matching the CURRENT filter, paged through the same + endpoint the list reads - never a shapeless full dump. */ + exportAllCsv: function () { + var spec = PosnicPro.categories._csvSpec(); + PosnicPro.listExport.all({ + url: 'categories', + params: function (page, limit) { + return { + page: page, limit: limit, + filters: JSON.stringify(PosnicPro.listFilter.legacyFilters('categories', { dateKey: 'created_date' })), + branch_id: PosnicPro.local.get('branch_id_set') + }; + }, + head: spec.head, + map: spec.map, + filename: 'categories.csv' + }); }, /*This Categories Function Used To Add & Edit*/ category: function () { @@ -223,18 +383,29 @@ PosnicPro.categories = { hasher.replaceHash('items/new'); } else if (hash === '/sales/categories/new') { $('#category_name').val(''); + PosnicPro.categories.setCatTileColor(''); + PosnicPro.categories.setCatTileShape(''); hasher.replaceHash('sales/new'); } else { + /* ONE reload, not two (saves patch): when this navigation + actually changes the hash, the route loads the table - + the direct call below is only for saves made while + already sitting on the list. */ + var wasOnCategoryList = (hash === '/categories'); hasher.setHash('categories'); } if (PosnicPro.action === 'add') { - PosnicPro.categories.categoriesTable('categories'); + if (wasOnCategoryList) { + PosnicPro.categories.categoriesTable('categories'); + } $('#show_last_created_category').show(); var path = '#/categories/' + response.data; $('#last_created_category').attr('href', path); } if (PosnicPro.action === 'edit') { - hasher.setHash('categories'); + if (wasOnCategoryList) { + PosnicPro.categories.categoriesTable('categories'); + } $(".infobar-settings-sidebar-overlay").css({"background": "transparent", "position": "initial"}); $("#infobar-settings-sidebar-category").removeClass("sidebarshow"); } @@ -334,16 +505,13 @@ PosnicPro.categories = { PosnicPro.record_id = id; $('#category_id').val(PosnicPro.record_id); $('#category_name').val(data.name); + PosnicPro.categories.setCatTileColor(data.tile_color || ''); + PosnicPro.categories.setCatTileShape(data.tile_shape || ''); $('#category_discount_amount').val(data.discount_amount); $('#category_discount_percentage').val(data.discount_percentage); $('#category_description').val(data.description); - if (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') { - $('#category_title').text('திருத்தப்பட்ட'); - $('#category_button_title').text('புதுப்பி'); - } else { - $('#category_title').text('Edit'); - $('#category_button_title').text('Update'); - } + $('#category_title').text(PosnicPro.i18n.t('lang_action_edit', 'Edit')); + $('#category_button_title').text(PosnicPro.i18n.t('lang_updatebtn_title', 'Update')); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); $('#category_image').val(data.image); $('#get_category_image_value').val(data.image); @@ -375,13 +543,8 @@ PosnicPro.categories = { addCategoryButton: function () { var loader = $(".loader-category"); loader.find(".loadingSpinner:first").remove(); - if (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') { - $('#category_title').text('புதிய'); - $('#category_button_title').text('சேமி'); - } else { - $('#category_title').text('Add'); - $('#category_button_title').text('Save'); - } + $('#category_title').text(PosnicPro.i18n.t('lang_new_title', 'Add')); + $('#category_button_title').text(PosnicPro.i18n.t('lang_save_title', 'Save')); $('.category-image-label-title').html('<i class="feather icon-edit"></i>'); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); $('#get_category_image_value').val('category.svg'); @@ -399,12 +562,6 @@ PosnicPro.categories = { $('#category_discount_percentage').removeAttr('disabled', 'disabled').show().val(PosnicPro.local.get('setting-discount-percentage')); } }, - exportCategories: function () { - PosnicPro.exportTableData(PosnicPro.categories_checkbox, 'categories'); - }, - deleteSelectedCategories: function () { - PosnicPro.deleteTableData(PosnicPro.categories_checkbox, 'categories'); - }, categoryImageFormSubmit: function () { var data = new FormData(document.getElementById("category_image_upload_form")); PosnicPro.requestImage('POST', "categories/uploadCategoryImage", data, false, function (response) { @@ -483,7 +640,7 @@ PosnicPro.categories = { }, messages: { name: { - required: "Please Enter a Category Name", + required: "Enter the category name", minlength: "Category Name must consist of at least 3 Characters", maxlength: "Category name should not be more than 250 characters" }, @@ -574,9 +731,9 @@ PosnicPro.categorydetails = { var returnTotalValue = 0; for (let i = 0; i < response.data.table.data.list.length; i++) { let row = response.data.table.data.list[i]; - saleTotalValue += row.items_total; - returnTotalValue += row.items_return_total; - if (row.sale_process == 'Add' || row.sale_process == 'Edit') { + saleTotalValue += Number(row.items_total) || 0; + returnTotalValue += Number(row.items_return_total) || 0; + if (!row.sale_process || row.sale_process == 'Add' || row.sale_process == 'Edit') { process_class = "badge badge-success-inverse"; } else if (row.sale_process == 'PartialReturn') { process_class = "badge badge-secondary-inverse"; @@ -596,7 +753,7 @@ PosnicPro.categorydetails = { let row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; let updateDate = PosnicPro.convertDate(row.string_date); - let trow = '<tr> <td scope="row">' + row_no + '</td> <td>' + row.sales_id + '</td> <td class="export-date">' + updateDate + '</td> <td class="text-center"><span class="' + process_class + '">' + row.sale_process + '</span></td> <td class="text-center text-danger">' + returnQty + '</td> <td class="text-right text-danger">' + currency + ' ' + row.items_return_total.toFixed(2) + '</td><td class="text-center text-success">' + salesQty + '</td><td class="text-right text-success">' + currency + ' ' + row.items_total.toFixed(2) + '</td></tr>'; + let trow = '<tr> <td scope="row" data-label="#">' + row_no + '</td> <td data-label="Sale">' + row.sales_id + '</td> <td class="export-date" data-label="Date">' + updateDate + '</td> <td class="text-center" data-label="Process"><span class="' + process_class + '">' + (row.sale_process || 'Add') + '</span></td> <td class="text-center text-danger" data-label="Return qty">' + returnQty + '</td> <td class="text-right text-danger" data-label="Return total">' + currency + ' ' + (Number(row.items_return_total) || 0).toFixed(2) + '</td><td class="text-center text-success" data-label="Qty">' + salesQty + '</td><td class="text-right text-success" data-label="Total">' + currency + ' ' + (Number(row.items_total) || 0).toFixed(2) + '</td></tr>'; $('#view_categorydetails').children('tbody').append(trow); } let total = 0; @@ -643,7 +800,7 @@ PosnicPro.categorydetails = { }); }); let date = PosnicPro.convertDate(val.string_date); - let process = val.sale_process; + let process = val.sale_process || 'Add'; let saleId = val.sales_id; let returnTotal = val.items_return_total; let saleTotal = val.items_total; @@ -693,3 +850,22 @@ $("#categorySubmitForm").one('click', function () { }); /*end*/ + +/* Standard list wiring: Filter button, row click into the details + slide-over, row action buttons that must not also open the row. */ +$(document).on('click', '#categories_filter_btn', function () { + PosnicPro.categories.mountFilters(true); + PosnicPro.listFilter.toggle('categories'); +}); +$(document).on('click', '#categories_list_rows tr.categories-row', function () { + PosnicPro.categories.openDoc($(this).data('id')); +}); + +$(document).on('click', '#category_tile_swatches .tile-swatch', function () { + PosnicPro.categories.setCatTileColor($(this).data('color') || ''); +}); +$(document).on('click', '#category_tile_shapes .tile-shape', function () { + var shape = $(this).data('shape') || ''; + if (($('#category_tile_shape').val() || '') === shape) { shape = ''; } + PosnicPro.categories.setCatTileShape(shape); +}); diff --git a/frontend/static/script/js/modules/js/coupons.js b/frontend/static/script/js/modules/js/coupons.js index 31a55890f..d7e8b39dd 100644 --- a/frontend/static/script/js/modules/js/coupons.js +++ b/frontend/static/script/js/modules/js/coupons.js @@ -45,7 +45,7 @@ PosnicPro.coupons = { var sign = PosnicPro.coupons.currencySign(); var body = $('#coupons_table_body').empty(); if (!rows.length) { - body.append('<tr><td colspan="6" class="text-center text-muted py-3">No coupons yet.</td></tr>'); + body.append('<tr><td colspan="6" class="text-center text-muted py-3"><lang class="lang_no_coupons_yet">No coupons yet.</lang></td></tr>'); return; } rows.forEach(function (c) { @@ -56,11 +56,11 @@ PosnicPro.coupons = { (c.end_date ? PosnicPro.coupons.fmtDate(c.end_date) : '…'); var used = (c.times_used || 0) + (Number(c.usage_limit) > 0 ? ' / ' + c.usage_limit : ''); var active = c.active - ? '<span class="badge badge-success-inverse">Active</span>' - : '<span class="badge badge-danger-inverse">Off</span>'; + ? '<span class="badge badge-success-inverse"><lang class="lang_active">Active</lang></span>' + : '<span class="badge badge-danger-inverse"><lang class="lang_off">Off</lang></span>'; var actions = - '<a href="javascript:void(0)" class="point-cursor mr-2 coupon-edit" data-id="' + c._id + '" title="Edit"><i class="feather icon-edit"></i></a>' + - '<a href="javascript:void(0)" class="point-cursor text-danger coupon-del" data-id="' + c._id + '" title="Delete"><i class="feather icon-trash"></i></a>'; + '<a href="javascript:void(0)" class="point-cursor mr-2 coupon-edit" data-id="' + c._id + '" title="Edit" data-t-title="lang_edit_title"><i class="feather icon-edit"></i></a>' + + '<a href="javascript:void(0)" class="point-cursor text-danger coupon-del" data-id="' + c._id + '" title="Delete" data-t-title="lang_delete"><i class="feather icon-trash"></i></a>'; body.append( '<tr>' + '<td><strong>' + PosnicPro.coupons.esc(c.code) + '</strong>' + @@ -82,7 +82,7 @@ PosnicPro.coupons = { newForm: function () { PosnicPro.coupons.fill({ type: 'percent', active: true }); $('#coupon_form_id').val(''); - $('#coupon_form_title').text('New coupon'); + $('#coupon_form_title').text(PosnicPro.i18n.t('lang_new_coupon', 'New coupon')); $('#coupons_form_wrap').show(); $('#coupon_code').focus(); }, @@ -94,7 +94,7 @@ PosnicPro.coupons = { if (!c) return; PosnicPro.coupons.fill(c); $('#coupon_form_id').val(c._id); - $('#coupon_form_title').text('Edit coupon'); + $('#coupon_form_title').text(PosnicPro.i18n.t('lang_edit_coupon', 'Edit coupon')); $('#coupons_form_wrap').show(); }, @@ -137,7 +137,7 @@ PosnicPro.coupons = { save: function () { var data = PosnicPro.coupons.collect(); if (!data.code) { - PosnicPro.alert('error', 'A coupon code is required.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_a_coupon_code_is_required', 'A coupon code is required.')); return; } var id = $('#coupon_form_id').val(); diff --git a/frontend/static/script/js/modules/js/credit.js b/frontend/static/script/js/modules/js/credit.js index 2ff0b7e1e..2c8952cf0 100644 --- a/frontend/static/script/js/modules/js/credit.js +++ b/frontend/static/script/js/modules/js/credit.js @@ -62,7 +62,7 @@ PosnicPro.credit = { var sign = PosnicPro.credit.sign(); var body = $('#credit_outstanding_body').empty(); if (!rows.length) { - body.append('<tr><td colspan="4" class="text-center text-muted py-3">No outstanding customers.</td></tr>'); + body.append('<tr><td colspan="4" class="text-center text-muted py-3"><lang class="lang_no_outstanding_customers">No outstanding customers.</lang></td></tr>'); $('#credit_outstanding_total').text('0'); return; } @@ -100,7 +100,7 @@ PosnicPro.credit = { var d = res.data || {}; PosnicPro.alert( 'success', - (dryRun ? 'Dry run: ' : 'Reminders: ') + (d.sent || 0) + ' sent, ' + (d.failed || 0) + ' failed, ' + (d.skipped || 0) + ' skipped' + (dryRun ? PosnicPro.i18n.t('lang_dry_run', 'Dry run: ') : PosnicPro.i18n.t('lang_reminders', 'Reminders: ')) + (d.sent || 0) + ' sent, ' + (d.failed || 0) + ' failed, ' + (d.skipped || 0) + ' skipped' ); }); }); diff --git a/frontend/static/script/js/modules/js/customer_categories.js b/frontend/static/script/js/modules/js/customer_categories.js index 2b4c7dfa0..597db584b 100644 --- a/frontend/static/script/js/modules/js/customer_categories.js +++ b/frontend/static/script/js/modules/js/customer_categories.js @@ -35,112 +35,234 @@ PosnicPro.customercategory = { showDelete: function (id) { PosnicPro.deleteTableRowData(id, 'customerCategory'); }, + /* Deep link #/customercategory/<id>: the list with that category + open in the right pane. Recognises its own setHash echo. */ showDetails: function (id) { - var loader = $(".loader-view-category"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.showViewModal('customercategory'); - PosnicPro.customercategory.viewCategory(id); + if (PosnicPro.listDoc.activeId('customercategory') === String(id) + && $('#customercategory_detail_card').is(':visible')) { return; } + PosnicPro.customercategory._chrome(); + PosnicPro.customercategory.loadList(1); + PosnicPro.customercategory.openDoc(id); }, - customercategoryTable: function () { - var loader = $(".loader-table-customercategory"); - $("<div class='loadingSpinner'></div>").appendTo(loader); - PosnicPro.appendViewDataTableBody('customercategory'); - var table = $('#view_customercategory'); - var params = { - url: 'customerCategory', - data: { - page: table.data('current_page'), - limit: parseInt($('#view_customercategory_per_page option:selected').text()), - filters: table.data('filters') + openDoc: function (id) { + var self = PosnicPro.customercategory; + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var actions = '<button type="button" class="btn btn-sm btn-light" data-module="customer" data-access="write" data-toggle="tooltip" title="Edit this category" data-t-title="lang_edit_this_category" aria-label="Edit" data-t-aria-label="lang_edit_title"' + + ' onclick="hasher.setHash(\'customercategory/' + esc(id) + '/edit\');"><i class="feather icon-edit-2"></i></button>' + + '<button type="button" class="btn btn-sm btn-light" data-module="customer" data-access="delete" data-toggle="tooltip" title="Delete this category" data-t-title="lang_delete_this_category" aria-label="Delete" data-t-aria-label="lang_delete"' + + ' onclick="PosnicPro.listDoc.close(\'customercategory\'); hasher.setHash(\'customercategory/' + esc(id) + '/delete\');"><i class="feather icon-trash-2"></i></button>'; + var r = (self._lastRows || []).filter(function (x) { return String(x._id) === String(id); })[0]; + if (r) { + PosnicPro.listDoc.open({ key: 'customercategory', id: id, title: r.name, actions: actions, body: self._docBody(r) }); + PosnicPro.ACLForModule('customer'); + self.loadActivity(id); + return; + } + PosnicPro.listDoc.open({ key: 'customercategory', id: id, title: PosnicPro.i18n.t('lang_customer_category', 'Customer category'), actions: actions }); + PosnicPro.ACLForModule('customer'); + PosnicPro.get('customerCategory/' + id, function (response) { + var d = response && response.data; + if (response.type !== 'success' || !d) { + PosnicPro.listDoc.body('customercategory', '<div class="text-danger p-3"><lang class="lang_could_not_open_this_category">Could not open this category.</lang></div>'); + return; } - }; - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - table.data('total', response.data.total); - table.data('total_pages', response.data.total_pages); - table.data('current_page', response.data.current_page); - table.data('per_page', response.data.per_page); - PosnicPro.paging(response.data.total_pages, response.data.current_page); - table.children('tbody').text(''); - $('#view_customercategory_total').text(response.data.total); - - var rowTotal = response.data.total; - if (rowTotal === 0) { - $('.customercategory_header').hide(); - $('#customercategory_img_hide').show(); - - } else { - $('#customercategory_img_hide').hide(); - $('.customercategory_header').show(); - } - var row_total = (table.data('current_page') - 1) * table.data('per_page') + 1; - $('#view_customercategory_page_total').text(row_total); - var page_totals = (table.data('current_page') - 1) * table.data('per_page'); - $('#view_customercategory_page_perpage_total').text(page_totals + response.data.list.length); - for (var i = 0; i < response.data.list.length; i++) { - var row = response.data.list[i]; - var row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; - - var action = '<div id="onclick-toolbar-options_' + i + '" class="hidden">' + - '<a data-module = "category" data-access = "read" href="#/customercategory/' + row._id + '" data-id="customercategory/' + row._id + '" data-toggle="tooltip" title="View Category" class="point-cursor mobile_tooltip"><i class="feather icon-eye"></i></a>' + - '<a data-module = "category" data-access = "write" href="#/customercategory/' + row._id + '/edit" data-id="customercategory/' + row._id + '/edit" data-toggle="tooltip" title="Edit Category" class="point-curso mobile_tooltipr"><i class="feather icon-edit"></i></a>' + - '<a data-module = "category" data-access = "delete" href="#/customercategory/' + row._id + '/delete" data-id="customercategory/' + row._id + '/delete" data-toggle="tooltip" title="Delete Category" class="point-cursor mobile_tooltip"><i class="feather icon-trash"></i></a>' + - '</div>' + - '<div data-toolbar="user-options" class="btn btn-round btn-primary-rgba round-pad" id="onclick-toolbar_' + i + '"><i class="feather icon-more-vertical-"></i></div>'; - - var trow = '<tr> \n\ - <th><input type="checkbox" class="customercategory-row-id" id="' + row._id + '" name="id[]" value="' + row._id + '" onclick="PosnicPro.checkboxSelectOne(this,\'customercategory\');"></th> <th scope="row">' + row_no + '</th> \n\ - <td><a href="#/customercategory/' + row._id + '" ><i data-toggle="tooltip" class="table_model_item">' + row.name + '</i></a></td> \n\ - <td>' + (row.description || '') + '</td> ' + - '<td class="text-center"><span>' + action + '</span></td>' + - '</tr>'; - - $('#view_customercategory').children('tbody').append(trow); - } - $(document).ready(function () { - for (var i = 0; i < response.data.list.length; i++) { - $('#onclick-toolbar_' + i).toolbar({ - content: '#onclick-toolbar-options_' + i, - event: 'click', - style: 'primary', - hideOnClick: true - }); - $('#onclick-toolbar_' + i).on('toolbarItemClick', function (event, element) { - hasher.setHash($(element).data('id')); - $(this).trigger('click'); - $('.mobile_tooltip').tooltip('hide'); - }); - } - }); - PosnicPro.setSelectedCheckbox(PosnicPro["customercategory_checkbox"], 'customercategory'); - PosnicPro.ACLForModule('customer'); - - loader.find(".loadingSpinner:first").remove(); - } else { - PosnicPro.alert(response.type, response.message); + d._id = d._id || id; + PosnicPro.listDoc.title('customercategory', d.name || 'Customer category'); + PosnicPro.listDoc.body('customercategory', self._docBody(d)); + self.loadActivity(id); + }, function () { + PosnicPro.listDoc.body('customercategory', '<div class="text-danger p-3"><lang class="lang_could_not_open_this_category">Could not open this category.</lang></div>'); + }); + }, + _docBody: function (r) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + return '<div class="s-doc-stats" id="cc_doc_stats"></div>' + + PosnicPro.listDoc.grid([ + { label: PosnicPro.i18n.t('lang_about', 'About'), lines: [ + r.description ? '<div>' + esc(r.description) + '</div>' : '<div class="q-muted"><lang class="lang_no_description">No description</lang></div>' + ] }, + { label: PosnicPro.i18n.t('lang_on_record', 'On record'), lines: [ + r.created_date ? '<div class="q-muted">Added ' + esc(PosnicPro.convertDate(r.created_date)) + '</div>' : '', + r.updated_date ? '<div class="q-muted">Updated ' + esc(PosnicPro.convertDate(r.updated_date)) + '</div>' : '' + ] } + ]) + + '<div class="q-label" style="margin-top:18px;"><lang class="lang_recent_sales">Recent sales</lang></div>' + + '<div id="cc_doc_sales" class="q-muted" style="font-size:13px;"><lang class="lang_loading_4">Loading ...</lang></div>'; + }, + /* The customer category's sales, IN the pane - the slide-over is the + recycle bin's door now, never the list's. */ + loadActivity: function (id) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var cur = PosnicPro.local.get('currencySign'); + PosnicPro.get({ + url: 'sales/customerCategorySaleDetails', + data: { page: 1, limit: 5, category_id: id, branch: [PosnicPro.local.get('branch_id_set')] } + }, function (response) { + var t = response && response.data && response.data.table && response.data.table.data; + var list = (t && t.list) || []; + var total = (t && Number(t.total)) || 0; + if (!list.length) { + $('#cc_doc_sales').html(PosnicPro.i18n.t('lang_no_sales_from_this_category_yet', 'No sales from this category yet.')); + return; } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); + var pageValue = 0; + var rows = list.map(function (r) { + pageValue += Number(r.items_total) || 0; + var saleId = r._id && r._id.$oid ? r._id.$oid : r._id; + return '<tr class="cc-doc-sale-row" data-id="' + esc(saleId) + '" style="cursor:pointer;">' + + '<td>' + esc(r.sales_id) + '</td>' + + '<td class="q-muted">' + esc(r.string_date ? PosnicPro.convertDate(r.string_date) : '') + '</td>' + + '<td>' + esc(r.sale_process || 'Add') + '</td>' + + '<td class="text-right">' + cur + ' ' + (Number(r.items_total) || 0).toFixed(2) + '</td>' + + '</tr>'; + }).join(''); + $('#cc_doc_stats').append( + '<div class="s-stat"><div class="s-stat-value">' + total + '</div>' + + '<div class="s-stat-label">' + (total === 1 ? PosnicPro.i18n.t('lang_newsale_title', 'Sale') : PosnicPro.i18n.t('lang_rgrp_sales', 'Sales')) + '</div></div>' + + '<div class="s-stat"><div class="s-stat-value">' + cur + ' ' + pageValue.toFixed(2) + '</div>' + + '<div class="s-stat-label">Sold' + (total > list.length ? ' (last ' + list.length + ')' : '') + '</div></div>'); + $('#cc_doc_sales').removeClass('q-muted').html( + '<table class="q-items s-doc-purchases-table"><thead><tr>' + + '<th><lang class="lang_bill">Bill #</lang></th><th><lang class="lang_date_title">Date</lang></th><th><lang class="lang_process_title">Process</lang></th><th class="text-right"><lang class="lang_total_title">Total</lang></th>' + + '</tr></thead><tbody>' + rows + '</tbody></table>'); + }, function () { + $('#cc_doc_sales').html(PosnicPro.i18n.t('lang_sales_history_unavailable', 'Sales history unavailable.')); }); }, - showDataTablePage: function () { - var loader = $(".loader-table-customercategory"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.dashboard.datePicker(); + /* The name the OLD table machinery answered to - the save flow and the + shared clearListFilters/refresh doors still call it. */ + customercategoryTable: function () { + PosnicPro.customercategory.loadList(1); + }, + _page: 1, + PAGE_SIZE: 25, + _lastRows: [], + _chrome: function () { PosnicPro.HideSideBarModal(); - $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); - $(".vertical-layout").removeClass("toggle-menu"); - $(".vertical-menu li a").removeClass("active"); $('.page_loader,#osk-container').hide(); - $('.page-title-box,#customercategory').show(); - $('#customercategory_new,#customercategory_view').modal('hide'); - $('#page_customercategory').addClass('active'); - $('#v-pills-customer-tab').addClass('active'); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); + $('#v-pills-customer-tab,#page_customercategory').addClass('active'); $('#v-pills-customer').addClass('show active'); - PosnicPro.customercategory.customercategoryTable('customercategory'); + $('.page-title-box,#customercategory').show(); $('.dashboard_img_menu').hide(); - + }, + showDataTablePage: function () { + PosnicPro.customercategory._chrome(); + PosnicPro.customercategory.loadList(1); + }, + mountFilters: function (force) { + if (!$('#customercategory_filter_panel').length) { return; } + if (!force && $('#customercategory_filter_panel').data('mounted')) { return; } + $('#customercategory_filter_panel').data('mounted', true); + PosnicPro.listFilter.mount({ + key: 'customercategory', + container: '#customercategory_filter_panel', + button: '#customercategory_filter_btn', + searchPlaceholder: PosnicPro.i18n.t('lang_search_category_name', 'Search category name'), + searchFields: [ + { value: 'all', label: PosnicPro.i18n.t('lang_all_fields', 'All fields') }, + { value: 'name', label: PosnicPro.i18n.t('lang_name_title', 'Name') }, + { value: 'description', label: PosnicPro.i18n.t('lang_description_title', 'Description') } + ], + onChange: function () { PosnicPro.customercategory.loadList(1); } + }); + }, + loadList: function (page) { + PosnicPro.customercategory.mountFilters(); + var self = PosnicPro.customercategory; + if (page) { self._page = page; } + var filters = PosnicPro.listFilter.legacyFilters('customercategory', {}); + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + PosnicPro.get({ + url: 'customerCategory', + data: { page: self._page, limit: self.PAGE_SIZE, filters: JSON.stringify(filters) } + }, function (response) { + var data = (response && response.data) || {}; + var list = data.list || []; + self._lastRows = list; + if (!list.length) { + var filtered = PosnicPro.listFilter.activeCount('customercategory') > 0; + $('#customercategory_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20">' + + (filtered ? PosnicPro.i18n.t('lang_no_customer_categories_match_this_filter', 'No customer categories match this filter.') : PosnicPro.i18n.t('lang_no_customer_categories_yet_press_new_to_ad', 'No customer categories yet - press New to add the first.')) + '</div>'); + $('#customercategory_list_paging').html(''); + return; + } + var html = '<div class="table-responsive"><table class="table table-borderless">' + + '<thead><tr><th><lang class="lang_name_title">Name</lang></th><th class="cc-col-desc"><lang class="lang_description_title">Description</lang></th></tr></thead><tbody>'; + list.forEach(function (r) { + html += '<tr class="md-row customercategory-row highlight-select' + + (PosnicPro.listDoc.activeId('customercategory') === String(r._id) ? ' is-active' : '') + '" data-id="' + esc(r._id) + '" style="cursor:pointer;">' + + '<td>' + esc(r.name) + '</td>' + + '<td class="cc-col-desc q-muted">' + esc(r.description || '-') + '</td>' + + '</tr>'; + }); + html += '</tbody></table></div>'; + $('#customercategory_list_rows').html(html); + PosnicPro.ACLForModule('customer'); + self.renderPager(Number(data.total) || list.length); + }, function () { + $('#customercategory_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20"><lang class="lang_could_not_load_customer_categories_try_aga">Could not load customer categories - try again.</lang></div>'); + }); + }, + renderPager: function (total) { + var self = PosnicPro.customercategory; + var p = self._page, size = self.PAGE_SIZE; + var pages = Math.ceil(total / size) || 1; + var label = total + ' ' + (total === 1 ? PosnicPro.i18n.t('lang_customer_category_2', 'customer category') : PosnicPro.i18n.t('lang_customer_categories', 'customer categories')); + if (pages > 1) { label = 'Page ' + p + ' of ' + pages + ' · ' + label; } + var btn = function (to, text, off, cls) { + return '<button type="button" class="btn btn-sm ' + (cls || 'btn-secondary-rgba') + ' q-pg-btn"' + (off ? ' disabled' : '') + + ' onclick="PosnicPro.customercategory.goPage(' + to + ');">' + text + '</button>'; + }; + var html = ''; + if (pages > 1) { + html += btn(p - 1, '«', p <= 1); + var end = Math.min(pages, Math.max(1, p - 2) + 4); + var start = Math.max(1, end - 4); + for (var n = start; n <= end; n++) { + html += '<span class="q-pg-num">' + btn(n, n, false, n === p ? 'btn-primary-rgba' : 'btn-secondary-rgba') + '</span>'; + } + } + html += '<span class="q-pg-count">' + label + '</span>'; + if (pages > 1) { html += btn(p + 1, '»', p >= pages); } + $('#customercategory_list_paging').html(html); + }, + goPage: function (n) { + if (!n || n < 1) { return; } + PosnicPro.customercategory._page = n; + PosnicPro.customercategory.loadList(); + }, + _csvSpec: function () { + return { + head: ['Name', 'Description', 'Added'], + map: function (r) { + return [r.name, r.description || '', + r.created_date ? PosnicPro.convertDate(r.created_date) : '']; + } + }; + }, + exportCsv: function () { + var spec = PosnicPro.customercategory._csvSpec(); + PosnicPro.listExport.save( + [spec.head].concat((PosnicPro.customercategory._lastRows || []).map(spec.map)), 'customer-categories.csv'); + }, + /* Everything matching the CURRENT filter, paged through the same + endpoint the list reads - never a shapeless full dump. */ + exportAllCsv: function () { + var spec = PosnicPro.customercategory._csvSpec(); + PosnicPro.listExport.all({ + url: 'customerCategory', + params: function (page, limit) { + return { + page: page, limit: limit, + filters: JSON.stringify(PosnicPro.listFilter.legacyFilters('customercategory', {})) + }; + }, + head: spec.head, + map: spec.map, + filename: 'customer-categories.csv' + }); }, /*This Categories Function Used To Add & Edit*/ category: function () { @@ -243,13 +365,8 @@ PosnicPro.customercategory = { $('#customercategory_id').val(PosnicPro.record_id); $('#customercategory_name').val(data.name); $('#customercategory_description').val(data.description); - if (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') { - $('#customercategory_title').text('திருத்தப்பட்ட'); - $('#customercategory_button_title').text('புதுப்பி'); - } else { - $('#customercategory_title').text('Edit'); - $('#customercategory_button_title').text('Update'); - } + $('#customercategory_title').text(PosnicPro.i18n.t('lang_action_edit', 'Edit')); + $('#customercategory_button_title').text(PosnicPro.i18n.t('lang_updatebtn_title', 'Update')); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); loader.find(".loadingSpinner:first").remove(); } else { @@ -266,24 +383,13 @@ PosnicPro.customercategory = { addCategoryButton: function () { var loader = $(".loader-customercategory"); loader.find(".loadingSpinner:first").remove(); - if (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') { - $('#customercategory_title').text('புதிய'); - $('#customercategory_button_title').text('சேமி'); - } else { - $('#customercategory_title').text('Add'); - $('#customercategory_button_title').text('Save'); - } + $('#customercategory_title').text(PosnicPro.i18n.t('lang_new_title', 'Add')); + $('#customercategory_button_title').text(PosnicPro.i18n.t('lang_save_title', 'Save')); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); $('#customercategory_id').val(''); $('#customercategory_new .alert').remove(); $('#show_last_created_customercategory').hide(); }, - exportCategories: function () { - PosnicPro.exportTableData(PosnicPro.customercategory_checkbox, 'customerCategory'); - }, - deleteSelectedCategories: function () { - PosnicPro.deleteTableData(PosnicPro.customercategory_checkbox, 'customerCategory'); - }, categoryClearForm: function () { $(".customercategory_add")[0].reset(); $('.error_category').css('display', 'none'); @@ -314,7 +420,7 @@ PosnicPro.customercategory = { }, messages: { name: { - required: "Please Enter a Category Name", + required: "Enter the category name", minlength: "Category Name must consist of at least 3 Characters", maxlength: "Category name should not be more than 250 characters" }, @@ -360,6 +466,16 @@ PosnicPro.customercategory = { }); } }; +/* Standard list wiring: Filter button, row click into the details + slide-over, row action buttons that must not also open the row. */ +$(document).on('click', '#customercategory_filter_btn', function () { + PosnicPro.customercategory.mountFilters(true); + PosnicPro.listFilter.toggle('customercategory'); +}); +$(document).on('click', '#customercategory_list_rows tr.customercategory-row', function () { + PosnicPro.customercategory.openDoc($(this).data('id')); +}); + $("#customercategorySubmitForm").one('click', function () { PosnicPro.customercategory.validForm(); }); @@ -432,9 +548,9 @@ PosnicPro.customercategorydetails = { var returnTotalQty = 0; for (var i = 0; i < response.data.table.data.list.length; i++) { let row = response.data.table.data.list[i]; - saleTotalValue += row.items_total; - returnTotalValue += row.items_return_total; - if (row.sale_process == 'Add') { + saleTotalValue += Number(row.items_total) || 0; + returnTotalValue += Number(row.items_return_total) || 0; + if (!row.sale_process || row.sale_process == 'Add') { process_class = "badge badge-success-inverse"; } else if (row.sale_process == 'Edit') { process_class = "badge badge-primary-inverse"; @@ -462,7 +578,7 @@ PosnicPro.customercategorydetails = { // current time when no preformatted date is present. let rawDate = row.string_date || row.date || row.created_date || row.updated_date; let updateDate = rawDate ? PosnicPro.convertDate(rawDate) : ''; - let trow = '<tr> <td scope="row">' + row_no + '</td> <td>' + row.sales_id + '</td> <td class="export-date">' + updateDate + '</td> <td class="text-center"><span class="' + process_class + '">' + row.sale_process + '</span></td> <td class="text-center text-danger">' + returnQty + '</td> <td class="text-right text-danger">' + currency + ' ' + row.items_return_total.toFixed(2) + '</td><td class="text-center text-success">' + salesQty + '</td><td class="text-right text-success">' + currency + ' ' + row.items_total.toFixed(2) + '</td></tr>'; + let trow = '<tr> <td scope="row" data-label="#">' + row_no + '</td> <td data-label="Sale">' + row.sales_id + '</td> <td class="export-date" data-label="Date">' + updateDate + '</td> <td class="text-center" data-label="Process"><span class="' + process_class + '">' + (row.sale_process || 'Add') + '</span></td> <td class="text-center text-danger" data-label="Return qty">' + returnQty + '</td> <td class="text-right text-danger" data-label="Return total">' + currency + ' ' + (Number(row.items_return_total) || 0).toFixed(2) + '</td><td class="text-center text-success" data-label="Qty">' + salesQty + '</td><td class="text-right text-success" data-label="Total">' + currency + ' ' + (Number(row.items_total) || 0).toFixed(2) + '</td></tr>'; $('#view_customercategorydetails').children('tbody').append(trow); $('span.number').number(true, 2); } @@ -503,7 +619,7 @@ PosnicPro.customercategorydetails = { // exported report matches the on-screen Date column. let exportRawDate = val.string_date || val.date || val.created_date || val.updated_date; let date = exportRawDate ? PosnicPro.convertDate(exportRawDate) : ''; - let process = val.sale_process; + let process = val.sale_process || 'Add'; let saleId = val.sales_id; let returnTotal = val.items_return_total; let saleTotal = val.items_total; @@ -528,3 +644,9 @@ PosnicPro.customercategorydetails = { /*end*/ + +/* Recent-sale rows in the category panes open that bill in Sales history. */ +$(document).on('click', '#cc_doc_sales tr.cc-doc-sale-row, #cg_doc_sales tr.cg-doc-sale-row', function () { + var id = $(this).data('id'); + if (id) { hasher.setHash('sales/' + id); } +}); diff --git a/frontend/static/script/js/modules/js/customer_search.js b/frontend/static/script/js/modules/js/customer_search.js index c6d664a07..44f38e1c2 100644 --- a/frontend/static/script/js/modules/js/customer_search.js +++ b/frontend/static/script/js/modules/js/customer_search.js @@ -85,7 +85,7 @@ PosnicPro.customersearch = { app = app + '<div class="col-lg-6 col-xl-3">' + '<div class="product-bar m-b-30">' + '<div class="product-head">' + - '<a href="javascript:void(0);" id="' + getItemdata[i]['_id'] + '" onclick="return PosnicPro.customersearch.viewCustomerViewItem(this.id);"><img src="' + image_path + '" class="img-fluid" alt="product"></a>' + + '<a href="javascript:void(0);" id="' + getItemdata[i]['_id'] + '" onclick="return PosnicPro.customersearch.viewCustomerViewItem(this.id);"><img loading="lazy" decoding="async" src="' + image_path + '" class="img-fluid" alt="product"></a>' + '</div>' + '<div class="product-body py-3">' + '<div class="row align-items-center">' + @@ -115,7 +115,7 @@ PosnicPro.customersearch = { '</div>' + '<div class="col-6">' + '<div class="text-right">' + - '<button type="button" class="btn btn-primary-rgba font-18" id="' + getItemdata[i]['_id'] + '" onclick="return PosnicPro.customersearch.viewCustomerViewItem(this.id);"><i class="fa fa-eye"></i></button>' + + '<button type="button" class="btn btn-primary-rgba font-18" id="' + getItemdata[i]['_id'] + '" onclick="return PosnicPro.customersearch.viewCustomerViewItem(this.id);" aria-label="View details" data-t-aria-label="lang_view_details"><i class="fa fa-eye"></i></button>' + '</div>' + '</div>' + '</div>' + @@ -126,7 +126,7 @@ PosnicPro.customersearch = { } $('#list-item').html(app); } else { - app = "<div class='row'></div><div class='row'></div><div class='col-lg-12 col-xl-12 text-center text-dark'><p>There are no items available ...!!!</p></div>"; + app = "<div class='row'></div><div class='row'></div><div class='col-lg-12 col-xl-12 text-center text-dark'><p><lang class='lang_there_are_no_items_available'>There are no items available ...!!!</lang></p></div>"; $('#list-item').html(app); } $('span.number').number(true, 2); @@ -240,11 +240,11 @@ PosnicPro.customersearch = { var image_path = val.name; var image_effect_for = '<div class="product-preview">' + - '<img src="' + image_path + '" class="img-fluid" style="height:270px" alt="Product">' + + '<img loading="lazy" decoding="async" src="' + image_path + '" class="img-fluid" style="height:270px" alt="Product">' + '</div>'; $('#item_display_preview_for').append(image_effect_for); var image_effect_nav = '<div class="product-preview">' + - '<img src="' + image_path + '" class="img-fluid" style="height:30px;width:75px" alt="Product">' + + '<img loading="lazy" decoding="async" src="' + image_path + '" class="img-fluid" style="height:30px;width:75px" alt="Product">' + '</div>'; $('#item_display_preview_nav').append(image_effect_nav); @@ -252,7 +252,7 @@ PosnicPro.customersearch = { if (data.multi_image.length === 0) { var image_path = 'static/images/default/item.svg'; var image_effect_for = '<div class="product-preview">' + - '<img src="' + image_path + '" class="img-fluid" style="height:270px" alt="Product">' + + '<img loading="lazy" decoding="async" src="' + image_path + '" class="img-fluid" style="height:270px" alt="Product">' + '</div>'; $('#item_display_preview_for').append(image_effect_for); } @@ -345,8 +345,9 @@ PosnicPro.customersearch = { } }, }; -$('#sales_new_item_name').on('keydown.autocomplete', function () { - $(this).autocomplete({ +$(function () { + $('#sales_new_item_name').autocomplete({ + deferRequestBy: 120, lookup: function (query, done) { var result = {}; var suggestions = []; @@ -419,7 +420,7 @@ $('#sales_new_item_name').on('keydown.autocomplete', function () { var listItem = '<div class="col-lg-6 col-xl-3">' + '<div class="product-bar m-b-30">' + '<div class="product-head">' + - '<a href="javascript:void(0);" id="' + suggestion.data.item_id + '" onclick="return PosnicPro.customersearch.viewCustomerViewItem(this.id);"><img src="' + image_path + '" class="img-fluid" alt="product"></a>' + + '<a href="javascript:void(0);" id="' + suggestion.data.item_id + '" onclick="return PosnicPro.customersearch.viewCustomerViewItem(this.id);"><img loading="lazy" decoding="async" src="' + image_path + '" class="img-fluid" alt="product"></a>' + '</div>' + '<div class="product-body py-3">' + '<div class="row align-items-center">' + @@ -449,7 +450,7 @@ $('#sales_new_item_name').on('keydown.autocomplete', function () { '</div>' + '<div class="col-6">' + '<div class="text-right">' + - '<button type="button" class="btn btn-primary-rgba font-18" id="' + suggestion.data.item_id + '" onclick="return PosnicPro.customersearch.viewCustomerViewItem(this.id);"><i class="fa fa-eye"></i></button>' + + '<button type="button" class="btn btn-primary-rgba font-18" id="' + suggestion.data.item_id + '" onclick="return PosnicPro.customersearch.viewCustomerViewItem(this.id);" aria-label="View details" data-t-aria-label="lang_view_details"><i class="fa fa-eye"></i></button>' + '</div>' + '</div>' + '</div>' + @@ -530,7 +531,7 @@ $('#sales_new_item_name').on('keydown.autocomplete', function () { var action = '' + final_price + '' + '' + del_price + ''; var image_path = (data !== "item.svg") ? data : 'static/images/default/item.svg'; - return '<img src="' + image_path + '" height="40" width="40" style="border-radius: 25%;" /> ' + + return '<img loading="lazy" decoding="async" src="' + image_path + '" height="40" width="40" style="border-radius: 25%;" /> ' + '<div class="suggestion-name">' + $.Autocomplete.formatResult(suggestion, currentValue) + '</div><span>' + action + '</span>'; @@ -547,7 +548,7 @@ $(document).ready(function () { db.customerPlan.get('1').then(function (data) { if(data.read === false) { swal({ - title: 'You are Unauthorized', + title: PosnicPro.i18n.t('lang_you_are_unauthorized', 'You are Unauthorized'), showCancelButton: true, confirmButtonClass: 'btn btn-outline-primary', cancelButtonClass: 'btn btn-outline-danger m-l-10', diff --git a/frontend/static/script/js/modules/js/customer_view.js b/frontend/static/script/js/modules/js/customer_view.js index 430402e80..0fead5cf3 100644 --- a/frontend/static/script/js/modules/js/customer_view.js +++ b/frontend/static/script/js/modules/js/customer_view.js @@ -66,7 +66,7 @@ PosnicPro.customerview = { }).catch(function () { // Only render empty state once to prevent blink if (!PosnicPro.customerview.isEmptyStateShown) { - $('#list_linelitem').html('<tr class="sales_new_tablerow_content_area" id="sales_new_tablerow_content_area"><td colspan="8"><div class="text-center text-dark"> <p class="table_cart_content"><lang class="lang_sale_empty">Sale Order Empty</lang></p></div><img src="static/images/general/wallet.svg" class="img-fluid sales-cart-image" style="opacity: 0.4;width: 100%;" alt="wallet"></td></tr>'); + $('#list_linelitem').html('<tr class="sales_new_tablerow_content_area" id="sales_new_tablerow_content_area"><td colspan="8"><div class="text-center text-dark"> <p class="table_cart_content"><lang class="lang_sale_empty">Sale Order Empty</lang></p></div><img loading="lazy" decoding="async" src="static/images/general/wallet.svg" class="img-fluid sales-cart-image" style="opacity: 0.4;width: 100%;" alt="wallet"></td></tr>'); var imgHeight = $(window).height() - 200; $('.sales-cart-image').height(imgHeight); PosnicPro.customerview.isEmptyStateShown = true; @@ -102,7 +102,7 @@ PosnicPro.customerview = { if (!PosnicPro.customerview.isEmptyStateShown) { var container = document.getElementById('list_linelitem'); if (container) { - container.innerHTML = '<div class="text-center text-dark" style="padding: 40px;"><p style="font-size: 18px; margin-bottom: 20px;"><strong>Sale Order Empty</strong></p><img src="static/images/general/wallet.svg" class="img-fluid" style="opacity: 0.4; max-width: 300px;" alt="wallet"></div>'; + container.innerHTML = '<div class="text-center text-dark" style="padding: 40px;"><p style="font-size: 18px; margin-bottom: 20px;"><strong><lang class="lang_sale_empty">Sale Order Empty</lang></strong></p><img loading="lazy" decoding="async" src="static/images/general/wallet.svg" class="img-fluid" style="opacity: 0.4; max-width: 300px;" alt="wallet"></div>'; PosnicPro.customerview.isEmptyStateShown = true; } } @@ -146,23 +146,23 @@ PosnicPro.customerview = { '<h5 class="mt-0 font-13 view_item_Name">' + val.name + '</h5>' + '</td>' + '<td>' + - '<p class="mb-1 font-14 font-dark ">Price</p>' + + '<p class="mb-1 font-14 font-dark "><lang class="lang_price_title">Price</lang></p>' + '<h5 class="mt-0 mb-0 font-13">' + currency + ' <span class="number">' + val.price + '</span></h5>' + '</td>' + '<td>' + - '<p class="mb-1 font-14 font-dark">Qty</p>' + + '<p class="mb-1 font-14 font-dark"><lang class="lang_qty_title">Qty</lang></p>' + '<h5 class="mt-0 mb-0 font-13">' + val.qty + '</h5>' + '</td>' + '<td>' + - '<p class="mb-1 font-14 font-dark">Discount</p>' + + '<p class="mb-1 font-14 font-dark"><lang class="lang_discount_title">Discount</lang></p>' + '<h5 class="mt-0 mb-0 font-13">' + val.discount + '</h5>' + '</td>' + '<td>' + - '<p class="mb-1 font-14 font-dark">Tax</p>' + + '<p class="mb-1 font-14 font-dark"><lang class="lang_module_tax">Tax</lang></p>' + '<h5 class="mt-0 mb-0 font-13">' + val.tax + '</h5>' + '</td>' + '<td>' + - '<p class="mb-1 font-14 font-dark">Total</p>' + + '<p class="mb-1 font-14 font-dark"><lang class="lang_total_title">Total</lang></p>' + '<h5 class="mt-0 mb-0 font-13">' + currency + ' <span class="number">' + val.total + '</span></h5>' + '</td>' + '</tr>' + @@ -185,7 +185,7 @@ $(document).ready(function () { db.customerPlan.get('1').then(function (data) { if(data.read === false) { swal({ - title: 'You are Unauthorized', + title: PosnicPro.i18n.t('lang_you_are_unauthorized', 'You are Unauthorized'), showCancelButton: true, confirmButtonClass: 'btn btn-outline-primary', cancelButtonClass: 'btn btn-outline-danger m-l-10', @@ -210,7 +210,7 @@ $(document).ready(function () { // The clock is the only thing that needs a timer. setInterval(function () { - var timeZone = PosnicPro.local.get('timezone'); + var timeZone = PosnicPro.timeZone(); var currentDateTimeCentralTimeZone = moment(new Date()).tz(timeZone).format('YYYY/MM/DD hh:mm:ss A'); $('.custom_view_date').html(currentDateTimeCentralTimeZone); }, 1000); diff --git a/frontend/static/script/js/modules/js/customers.js b/frontend/static/script/js/modules/js/customers.js index e7ea4d47c..e9bbd7167 100644 --- a/frontend/static/script/js/modules/js/customers.js +++ b/frontend/static/script/js/modules/js/customers.js @@ -37,110 +37,347 @@ PosnicPro.customers = { showDelete: function (id) { PosnicPro.deleteTableRowData(id, 'customers'); }, + /* #/customers/<id>: the dossier opens in the right pane - never a + popup. (The customer REPORT page keeps its own viewCustomer sidebar; + only this page's route changed.) */ showDetails: function (id) { - var loader = $(".loader-view-customer"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.showViewModal('customers'); - PosnicPro.customers.viewCustomer(id); + var self = PosnicPro.customers; + if (self._openDocId === String(id) && $('#customers_detail_card').is(':visible')) { return; } + self._chrome(); + self.loadList(1); + self.openDoc(id); }, + + _page: 1, + PAGE_SIZE: 25, + _lastRows: [], + _openDocId: null, + _chrome: function () { + PosnicPro.HideSideBarModal(); + $('.page_loader,#osk-container').hide(); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); + $('#v-pills-customer-tab').addClass('active'); + $('#v-pills-customer').addClass('show active'); + $('.vertical-menu li a#view_customers_page').addClass('active'); + $('.page-title-box,#customers').show(); + $('#customers_new,#customers_view').modal('hide'); + $('.dashboard_img_menu').hide(); + $('#image_sidebar_customsdetails').show(); + }, + showDataTablePage: function () { + PosnicPro.customers._chrome(); + PosnicPro.customers.closeDoc(); + PosnicPro.customers.loadList(1); + }, + mountFilters: function (force) { + if (!$('#customers_filter_panel').length) { return; } + if (!force && $('#customers_filter_panel').data('mounted')) { return; } + $('#customers_filter_panel').data('mounted', true); + PosnicPro.listFilter.mount({ + key: 'customers', + container: '#customers_filter_panel', + button: '#customers_filter_btn', + searchPlaceholder: PosnicPro.i18n.t('lang_search_name_phone_or_email', 'Search name, phone or email'), + dateField: PosnicPro.i18n.t('lang_added', 'Added'), + searchFields: [ + { value: 'all', label: PosnicPro.i18n.t('lang_all_fields', 'All fields') }, + { value: 'name', label: PosnicPro.i18n.t('lang_name_title', 'Name') }, + { value: 'phone', label: PosnicPro.i18n.t('lang_phone_title', 'Phone') }, + { value: 'email', label: PosnicPro.i18n.t('lang_email_title', 'Email') }, + { value: 'address', label: PosnicPro.i18n.t('lang_address_title', 'Address') } + ], + onChange: function () { PosnicPro.customers.loadList(1); } + }); + }, + /* The name the OLD table machinery answered to - the save flow still + calls it after adding a customer, and the shared clearListFilters/ + refresh doors resolve <module>Table by convention. */ customersTable: function () { - var loader = $(".loader-table-customer"); - $("<div class='loadingSpinner'></div>").appendTo(loader); - PosnicPro.appendViewDataTableBody('customers'); - var table = $('#view_customers'); - var params = { + PosnicPro.customers.loadList(1); + }, + loadList: function (page) { + PosnicPro.customers.mountFilters(); + var self = PosnicPro.customers; + if (page) { self._page = page; } + var filters = PosnicPro.listFilter.legacyFilters('customers', { dateKey: 'created_date' }); + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + PosnicPro.get({ url: 'customers', - data: { - page: table.data('current_page'), - limit: parseInt($('#view_customers_per_page option:selected').text()), - filters: table.data('filters') + data: { page: self._page, limit: self.PAGE_SIZE, filters: JSON.stringify(filters) } + }, function (response) { + var data = (response && response.data) || {}; + var list = data.list || []; + self._lastRows = list; + if (!list.length) { + var filtered = PosnicPro.listFilter.activeCount('customers') > 0; + $('#customers_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20">' + + (filtered ? PosnicPro.i18n.t('lang_no_customers_match_this_filter', 'No customers match this filter.') : PosnicPro.i18n.t('lang_no_customers_yet_press_new_to_add_the_firs', 'No customers yet - press New to add the first.')) + '</div>'); + $('#customers_list_paging').html(''); + return; } + var html = '<div class="table-responsive"><table class="table table-borderless">' + + '<thead><tr><th><lang class="lang_name_title">Name</lang></th><th class="c-col-phone"><lang class="lang_phone_title">Phone</lang></th>' + + '<th class="c-col-email"><lang class="lang_email_title">Email</lang></th><th class="c-col-address"><lang class="lang_address_title">Address</lang></th><th class="text-center"><lang class="lang_dues">Dues</lang></th></tr></thead><tbody>'; + list.forEach(function (r) { + var due = Number(r.partial_balance) > 0 + ? '<span class="rs-pill unpaid"><lang class="lang_due">Due</lang></span>' + : '<span class="q-muted">-</span>'; + html += '<tr class="md-row customers-row highlight-select' + (self._openDocId === String(r._id) ? ' is-active' : '') + '"' + + ' data-id="' + esc(r._id) + '" style="cursor:pointer;">' + + '<td>' + esc(r.name) + '</td>' + + '<td class="c-col-phone">' + esc(r.phone || '-') + '</td>' + + '<td class="c-col-email">' + esc(r.email || '-') + '</td>' + + '<td class="c-col-address">' + esc(r.address || '-') + '</td>' + + '<td class="text-center">' + due + '</td>' + + '</tr>'; + }); + html += '</tbody></table></div>'; + $('#customers_list_rows').html(html); + self.renderPager(Number(data.total) || list.length); + }, function () { + $('#customers_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20"><lang class="lang_could_not_load_customers_try_again">Could not load customers - try again.</lang></div>'); + }); + }, + renderPager: function (total) { + var self = PosnicPro.customers; + var p = self._page, size = self.PAGE_SIZE; + var pages = Math.ceil(total / size) || 1; + var label = total + ' ' + (total === 1 ? PosnicPro.i18n.t('lang_customer', 'customer') : PosnicPro.i18n.t('lang_customers', 'customers')); + if (pages > 1) { label = 'Page ' + p + ' of ' + pages + ' \u00b7 ' + label; } + var btn = function (to, text, off, cls) { + return '<button type="button" class="btn btn-sm ' + (cls || 'btn-secondary-rgba') + ' q-pg-btn"' + (off ? ' disabled' : '') + + ' onclick="PosnicPro.customers.goPage(' + to + ');">' + text + '</button>'; }; - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - table.data('total', response.data.total); - table.data('total_pages', response.data.total_pages); - table.data('current_page', response.data.current_page); - table.data('per_page', response.data.per_page); - PosnicPro.paging(response.data.total_pages, response.data.current_page); - table.children('tbody').text(''); - $('#view_customers_total').text(response.data.total); - var rowTotal = response.data.total; - if (rowTotal === 0) { - $('.customer_header').hide(); - $('#customer_img_hide').show(); - - } else { - $('#customer_img_hide').hide(); - $('.customer_header').show(); - } - - var row_total = (table.data('current_page') - 1) * table.data('per_page') + 1; - $('#view_customers_page_total').text(row_total); - var page_totals = (table.data('current_page') - 1) * table.data('per_page'); - $('#view_customers_page_perpage_total').text(page_totals + response.data.list.length); - for (var i = 0; i < response.data.list.length; i++) { - var row = response.data.list[i]; - var transactionTab = ''; - if (row.partial_balance) { - transactionTab = '<a data-module="customer" data-access="read" href="#/customers/' + row._id + '/transaction" data-id="customers/' + row._id + '/transaction" data-toggle="tooltip" title="Customer transaction" class="point-cursor mobile_tooltip"><i class="feather icon-credit-card"></i></a>'; - } - var row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; - var action = '<div id="onclick-toolbar-options_' + i + '" class="hidden">' + - transactionTab + - '<a data-module = "customer" data-access = "read" href="#/customers/' + row._id + '" data-id="customers/' + row._id + '" data-toggle="tooltip" title="View Customer" class="point-cursor mobile_tooltip"><i class="feather icon-eye"></i></a>' + - '<a data-module = "customer" data-access = "write" href="#/customers/' + row._id + '/edit" data-id="customers/' + row._id + '/edit" data-toggle="tooltip" title="Edit Customer" class="point-cursor mobile_tooltip"><i class="feather icon-edit"></i></a>' + - '<a data-module = "customer" data-access = "delete" href="#/customers/' + row._id + '/delete" data-id="customers/' + row._id + '/delete" data-toggle="tooltip" title="Delete Customer" class="point-cursor mobile_tooltip"><i class="feather icon-trash"></i></a>' + - '</div>' + - '<div data-toolbar="user-options" class="btn btn-round btn-primary-rgba round-pad" id="onclick-toolbar_' + i + '"><i class="feather icon-more-vertical-"></i></div>'; - - var trow = '<tr><th><input type="checkbox" class="customers-row-id" id="' + row._id + '" name="id[]" value="' + row._id + '" onclick="PosnicPro.checkboxSelectOne(this,\'customers\');"></th><th scope="row">' + row_no + '</th><td width="30%"><a href="#/customers/' + row._id + '"><i class="table_model_item">' + row.name + '</i></a></td> <td class="text-right"><a class="sale_color" href="tel:' + (row.phone || '') + '">' + (row.phone || '') + '</a></td> <td width="15%"><a class="sale_color" href="mailto:' + (row.email || '') + '">' + (row.email || '') + '</a></td> <td width="40%">' + (row.address || '') + '</td>' + - '<td class="text-center"><span>' + action + '</span></td>' + - '</tr>'; - $('#view_customers').children('tbody').append(trow); + var html = ''; + if (pages > 1) { + html += btn(p - 1, '«', p <= 1); + var end = Math.min(pages, Math.max(1, p - 2) + 4); + var start = Math.max(1, end - 4); + for (var n = start; n <= end; n++) { + html += '<span class="q-pg-num">' + btn(n, n, false, n === p ? 'btn-primary-rgba' : 'btn-secondary-rgba') + '</span>'; + } + } + html += '<span class="q-pg-count">' + label + '</span>'; + if (pages > 1) { html += btn(p + 1, '»', p >= pages); } + $('#customers_list_paging').html(html); + }, + goPage: function (n) { + if (!n || n < 1) { return; } + PosnicPro.customers._page = n; + PosnicPro.customers.loadList(); + }, + _csvSpec: function () { + return { + head: ['Name', 'Phone', 'Email', 'Address', 'Tax number'], + map: function (r) { + return [r.name, r.phone || '', r.email || '', r.address || '', r.gst_number || '']; + } + }; + }, + exportCsv: function () { + var spec = PosnicPro.customers._csvSpec(); + PosnicPro.listExport.save( + [spec.head].concat((PosnicPro.customers._lastRows || []).map(spec.map)), 'customers.csv'); + }, + /* Everything matching the CURRENT filter, paged through the same + endpoint the list reads - never a shapeless full dump. */ + exportAllCsv: function () { + var spec = PosnicPro.customers._csvSpec(); + PosnicPro.listExport.all({ + url: 'customers', + params: function (page, limit) { + return { page: page, limit: limit, filters: JSON.stringify(PosnicPro.listFilter.legacyFilters('customers', { dateKey: 'created_date' })) }; + }, + head: spec.head, + map: spec.map, + filename: 'customers.csv' + }); + }, + /* ---- the dossier pane ---- */ + openDoc: function (id) { + var self = PosnicPro.customers; + if (!PosnicPro.masterDetail.inSplit('#customers_split', 'customers-split')) { + PosnicPro.masterDetail.enter('#customers_split', 'customers-split'); + $('#customers_detail_card').show(); + } + self._openDocId = String(id); + $('#customers_list_rows tr.customers-row').removeClass('is-active'); + $('#customers_list_rows tr.customers-row[data-id="' + id + '"]').addClass('is-active'); + if (window.location.hash.slice(2) !== 'customers/' + id) { + hasher.setHash('customers/' + id); + } + $('#customers_doc').html('<div class="text-center text-muted" style="padding:60px;"><lang class="lang_loading_4">Loading ...</lang></div>'); + PosnicPro.get('customers/' + id, function (response) { + if (response.type !== 'success') { + $('#customers_doc').html('<div class="text-danger p-4"><lang class="lang_could_not_open_this_customer">Could not open this customer.</lang></div>'); + return; + } + PosnicPro.customers.renderCustomerDoc(response.data); + PosnicPro.ACLForModule('customer'); + }, function () { + $('#customers_doc').html('<div class="text-danger p-4"><lang class="lang_could_not_open_this_customer">Could not open this customer.</lang></div>'); + }); + }, + closeDoc: function () { + PosnicPro.customers._openDocId = null; + $('#customers_detail_card').hide(); + $('#customers_list_rows tr.customers-row').removeClass('is-active'); + PosnicPro.masterDetail.leave('#customers_split', 'customers-split'); + if (window.location.hash.slice(2).indexOf('customers/') === 0) { + hasher.setHash('customers'); + } + }, + renderCustomerDoc: function (d) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var real = function (v) { return v && v !== 'null' && v !== 'undefined' ? v : ''; }; + var taxLabel = PosnicPro.local.get('gst_action') === 'enable' ? PosnicPro.i18n.t('lang_gstin', 'GSTIN') : PosnicPro.i18n.t('lang_tax_id', 'Tax ID'); + var id = String(d._id || PosnicPro.customers._openDocId); + var toolbar = '<div class="p-doc-toolbar">' + + '<button type="button" class="btn btn-sm btn-light" title="Show or hide the list" data-t-title="lang_show_or_hide_the_list" aria-label="Show or hide the list" data-t-aria-label="lang_show_or_hide_the_list" onclick="PosnicPro.masterDetail.toggleRail(\'#customers_split\');"><i class="feather icon-sidebar"></i></button>' + + '<span class="p-doc-title">' + esc(d.name) + '</span>' + + (Number(d.partial_balance) > 0 ? '<span class="rs-pill unpaid">Dues ' + PosnicPro.local.get('currencySign') + ' ' + Number(d.partial_balance).toFixed(2) + '</span>' : '') + + '<span class="ml-auto"></span>' + + (Number(d.partial_balance) > 0 + ? '<button type="button" class="btn btn-sm btn-primary" data-module="customer" data-access="write" onclick="hasher.setHash(\'customers/' + esc(id) + '/transaction\');"><i class="feather icon-credit-card mr-1"></i>Settle dues</button>' + : '') + + '<button type="button" class="btn btn-sm btn-light" data-module="customer" data-access="write" onclick="hasher.setHash(\'customers/' + esc(id) + '/edit\');"><i class="feather icon-edit-2 mr-1"></i>Edit</button>' + + '<div class="btn-group">' + + '<button type="button" class="btn btn-sm btn-light dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"><lang class="lang_tab_more">More</lang></button>' + + '<div class="dropdown-menu dropdown-menu-right">' + + '<a class="dropdown-item text-danger" data-module="customer" data-access="delete" href="javascript:void(0)" onclick="PosnicPro.customers.deleteAsk();"><i class="feather icon-trash mr-2"></i>Delete</a>' + + '</div></div>' + + '<button type="button" class="btn btn-sm btn-light" title="Close and show the full list" data-t-title="lang_close_and_show_the_full_list" aria-label="Close" data-t-aria-label="lang_close_title" onclick="PosnicPro.customers.closeDoc();"><i class="feather icon-x"></i></button>' + + '</div>'; + var strip = '<div class="p-void-strip" id="c_delete_strip" style="display:none;">' + + '<span>Delete <b>' + esc(d.name) + '</b>? Their sales stay on record; only the customer card goes.</span>' + + '<button type="button" class="btn btn-sm btn-danger" onclick="PosnicPro.customers.deleteConfirm(\'' + esc(id) + '\');">Delete customer</button>' + + '<button type="button" class="btn btn-sm btn-light" onclick="$(\'#c_delete_strip\').slideUp(120);">Cancel</button>' + + '</div>'; + var contact = '<div class="q-block"><div class="q-label"><lang class="lang_contact">Contact</lang></div>' + + (real(d.phone) ? '<div><a href="tel:' + esc(d.phone) + '">' + esc(d.phone) + '</a></div>' : '') + + (real(d.email) ? '<div><a href="mailto:' + esc(d.email) + '">' + esc(d.email) + '</a></div>' : '') + + (real(d.address) ? '<div class="q-muted">' + esc(d.address) + '</div>' : '') + + (real(d.state) ? '<div class="q-muted">' + esc(d.state) + (real(d.country) ? ', ' + esc(d.country) : '') + '</div>' : '') + + '</div>'; + var tax = (real(d.gst_type) || real(d.gst_number)) + ? '<div class="q-block"><div class="q-label"><lang class="lang_module_tax">Tax</lang></div>' + + (real(d.gst_type) ? '<div>' + esc(d.gst_type) + '</div>' : '') + + (real(d.gst_number) ? '<div class="q-muted">' + taxLabel + ': ' + esc(d.gst_number) + '</div>' : '') + + '</div>' + : ''; + var record = '<div class="q-block"><div class="q-label"><lang class="lang_on_record">On record</lang></div>' + + (d.created_date ? '<div class="q-muted">Added ' + esc(PosnicPro.convertDate(d.created_date)) + '</div>' : '') + + (d.updated_date ? '<div class="q-muted">Updated ' + esc(PosnicPro.convertDate(d.updated_date)) + '</div>' : '') + + '<div class="q-muted" id="c_doc_loyalty"></div>' + + '</div>'; + var body = '<div class="s-doc-body"><div class="q-sheet s-sheet">' + + '<div class="s-doc-stats" id="c_doc_stats"></div>' + + '<div class="s-doc-grid">' + contact + tax + record + '</div>' + + '<div class="q-label" style="margin-top:18px;"><lang class="lang_recent_sales">Recent sales</lang></div>' + + '<div id="c_doc_sales" class="text-muted" style="font-size:13px;"><lang class="lang_loading_4">Loading ...</lang></div>' + + '</div></div>'; + $('#customers_doc').html(toolbar + strip + body); + PosnicPro.customers.loadRecentSales(id, d); + /* loyalty points, when the branch runs the programme */ + if (PosnicPro.loyalty && PosnicPro.loyalty.summary) { + PosnicPro.loyalty.summary(id, function (sum) { + if (sum && sum.enabled) { + $('#c_doc_loyalty').text('Loyalty: ' + (sum.points != null ? sum.points + ' points' : '') + + (sum.tier ? ' \u00b7 ' + sum.tier : '')); } - $(document).ready(function () { - for (var i = 0; i < response.data.list.length; i++) { - $('#onclick-toolbar_' + i).toolbar({ - content: '#onclick-toolbar-options_' + i, - event: 'click', - style: 'primary', - hideOnClick: true - }); - $('#onclick-toolbar_' + i).on('toolbarItemClick', function (event, element) { - hasher.setHash($(element).data('id')); - $(this).trigger('click'); - $('.mobile_tooltip').tooltip('hide'); - }); - } - }); - PosnicPro.setSelectedCheckbox(PosnicPro["customers_checkbox"], 'customers'); - PosnicPro.ACLForModule('customer'); - loader.find(".loadingSpinner:first").remove(); - } else { - PosnicPro.alert(response.type, response.message); + }); + } + }, + /* + * Overview first: the report endpoint carries the authoritative + * lifetime aggregates (it also powers the customer report), and the + * sales list supplies the latest documents. Two small fetches, one + * dossier. + */ + loadRecentSales: function (id, d) { + var cur = PosnicPro.local.get('currencySign'); + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var dues = Number(d && d.partial_balance) || 0; + PosnicPro.get({ + url: 'sales/customerSalesReportTable', + data: { page: 1, limit: 1, starting_date: '', ending_date: '', branch: PosnicPro.local.get('branch_id_set'), field_input: id } + }, function (r) { + var row = ((r.data || {}).list || [])[0] || {}; + $('#c_doc_stats').html( + '<div class="s-stat"><div class="s-stat-value">' + cur + ' ' + (Number(row.sales_payment) || 0).toFixed(2) + '</div>' + + '<div class="s-stat-label"><lang class="lang_lifetime_sales">Lifetime sales</lang></div></div>' + + '<div class="s-stat"><div class="s-stat-value">' + (Number(row.sales_count) || 0) + '</div>' + + '<div class="s-stat-label">' + (Number(row.sales_count) === 1 ? PosnicPro.i18n.t('lang_newsale_title', 'Sale') : PosnicPro.i18n.t('lang_rgrp_sales', 'Sales')) + '</div></div>' + + '<div class="s-stat"><div class="s-stat-value">' + cur + ' ' + (Number(row.sales_avg) || 0).toFixed(2) + '</div>' + + '<div class="s-stat-label"><lang class="lang_average_sale">Average sale</lang></div></div>' + + (Number(row.refund_payment) > 0 + ? '<div class="s-stat"><div class="s-stat-value">' + cur + ' ' + Number(row.refund_payment).toFixed(2) + '</div>' + + '<div class="s-stat-label"><lang class="lang_refunded">Refunded</lang></div></div>' + : '') + + (dues > 0 + ? '<div class="s-stat"><div class="s-stat-value" style="color: var(--theme-danger-color, #c0392b);">' + cur + ' ' + dues.toFixed(2) + '</div>' + + '<div class="s-stat-label"><lang class="lang_dues">Dues</lang></div></div>' + : '') + ); + }, function () { $('#c_doc_stats').html(''); }); + /* the latest documents - matched by the exact customer name the + sales carry (the list endpoint takes the same blob as the page) */ + var nameExact = String((d && d.name) || '').replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); + PosnicPro.get({ + url: 'sales', + data: { page: 1, limit: 5, filters: JSON.stringify({ customer_name: { $regex: '^' + nameExact + '$', $options: 'i' } }) } + }, function (response) { + var list = ((response && response.data) || {}).list || []; + var total = Number((response.data || {}).total) || list.length; + if (!list.length) { + $('#c_doc_sales').html('<div class="text-muted"><lang class="lang_no_sales_for_this_customer_yet">No sales for this customer yet.</lang></div>'); + return; } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); + var html = '<table class="q-items s-doc-purchases-table"><thead><tr>' + + '<th><lang class="lang_sale">Sale #</lang></th><th><lang class="lang_userstatus">Status</lang></th><th class="text-right"><lang class="lang_date_title">Date</lang></th><th class="text-right"><lang class="lang_total_title">Total</lang></th>' + + '</tr></thead><tbody>'; + list.forEach(function (r) { + var unpaid = String(r.payment_status || '').toLowerCase() === 'unpaid' || Number(r.partial_balance) > 0; + var refunded = /return/i.test(String(r.sale_process || '')); + var pill = refunded + ? '<span class="rs-pill hold">' + esc(r.sale_process) + '</span>' + : unpaid + ? '<span class="rs-pill unpaid"><lang class="lang_unpaid">Unpaid</lang></span>' + : '<span class="rs-pill paid"><lang class="lang_paid">Paid</lang></span>'; + html += '<tr>' + + '<td>' + esc(r.sales_id || '') + '</td>' + + '<td>' + pill + '</td>' + + '<td class="text-right q-muted">' + esc(r.date ? String(r.date).slice(0, 10) : '') + '</td>' + + '<td class="text-right">' + cur + ' ' + (Number(r.sales_total) || 0).toFixed(2) + '</td>' + + '</tr>'; + }); + html += '</tbody></table>'; + if (total > 5) { + html += '<div class="q-muted" style="font-size:12.5px; padding: 8px 4px 0;">' + + (total - 5) + ' more in <a href="javascript:void(0)" onclick="hasher.setHash(\'sales\');">Sales History</a></div>'; + } + $('#c_doc_sales').html(html); + }, function () { + $('#c_doc_sales').html('<div class="text-muted"><lang class="lang_sales_history_unavailable">Sales history unavailable.</lang></div>'); }); }, - showDataTablePage: function () { - var loader = $(".loader-table-customer"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.dashboard.datePicker(); - PosnicPro.HideSideBarModal(); - $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); - $(".vertical-menu li a").removeClass("active"); - $(".vertical-layout").removeClass("toggle-menu"); - $('.page_loader,#osk-container').hide(); - $('.page-title-box,#customers').show(); - $('#customers_new,#customers_view').modal('hide'); - PosnicPro.customers.customersTable('customers'); - $('#v-pills-customer-tab').addClass('active'); - $('#v-pills-customer').addClass('show active'); - $('.dashboard_img_menu').hide(); - $('#image_sidebar_customsdetails').show(); + deleteAsk: function () { + $('#c_delete_strip').slideDown(120); + }, + deleteConfirm: function (id) { + PosnicPro.request({ + method: 'DELETE', + url: 'customers', + data: JSON.stringify({ data: [id] }) + }, function (r) { + PosnicPro.alert(r.type || 'success', r.message || 'Customer deleted'); + PosnicPro.customers.closeDoc(); + PosnicPro.customers.loadList(1); + }, function (xhr) { + var resp = {}; try { resp = jQuery.parseJSON(xhr.responseText) || {}; } catch (e) { } + PosnicPro.alert('error', resp.message || 'Could not delete this customer'); + }); }, triggerModules: function () { PosnicPro.showAddModal('customer'); @@ -338,13 +575,8 @@ PosnicPro.customers = { editCustomer: function (id) { var loader = $(".loader-customer"); $("<div class='loadingSpinner'></div>").appendTo(loader); - if (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') { - $('#customer_title').text('திருத்தப்பட்ட'); - $('#customer_button_title').text('புதுப்பி'); - } else { - $('#customer_title').text('Edit'); - $('#customer_button_title').text('Update'); - } + $('#customer_title').text(PosnicPro.i18n.t('lang_action_edit', 'Edit')); + $('#customer_button_title').text(PosnicPro.i18n.t('lang_updatebtn_title', 'Update')); $(".infobar-settings-sidebar-overlay").css({"background": "rgba(0,0,0,0.4)", "position": "fixed"}); $("#infobar-settings-sidebar-customer").addClass("sidebarshow"); var params = { @@ -464,11 +696,11 @@ PosnicPro.customers = { }, messages: { date: { - required: "Please select the Date", - commonDate: "Please enter a valid date" + required: "Choose a date", + commonDate: "Enter a valid date" }, amount: { - required: "Please enter transaction amount", + required: "Enter the amount", minlength: "Transaction amount must be at least 1 characters", maxlength: "Transaction amount should not be more than 10 characters" }, @@ -479,7 +711,7 @@ PosnicPro.customers = { }); jQuery.validator.addMethod("transactionDate", function (value, element) { return this.optional(element) || moment(value, 'YYYY/MM/DD LT').isValid(); - }, "Please enter a valid date in the format"); + }, "Use the date format"); $("#transaction_add_list_form").submit(function (event) { event.preventDefault(); if ($('#transaction_add_list_form').valid()) { // checks form for validity @@ -509,14 +741,8 @@ PosnicPro.customers = { addCustomerButton: function () { var loader = $(".loader-customer"); loader.find(".loadingSpinner:first").remove(); - if (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') { - $('#customer_title').text('புதிய'); - $('#customer_button_title').text('சேமி'); - } else { - $('#customer_title').text('Add'); - $('#customer_button_title').text('Save'); - - } + $('#customer_title').text(PosnicPro.i18n.t('lang_new_title', 'Add')); + $('#customer_button_title').text(PosnicPro.i18n.t('lang_save_title', 'Save')); $('#customer_id').val(''); $('#customers_new .alert').remove(); @@ -524,12 +750,6 @@ PosnicPro.customers = { $('.customer-gstr-number').hide(); $('#show_last_created_customer').hide(); }, - exportCustomers: function () { - PosnicPro.exportTableData(PosnicPro.customers_checkbox, 'customers'); - }, - deleteSelectedCustomers: function () { - PosnicPro.deleteTableData(PosnicPro.customers_checkbox, 'customers'); - }, gstFields: function () { $('.customer-gstr-number').hide(); if ($('#customer_gst_type').val() !== 'consumer') { @@ -559,10 +779,10 @@ PosnicPro.customers = { if (PosnicPro.local.get('edit_customer_state') !== '' && action === 'edit') { stateSelect.val(PosnicPro.local.get('edit_customer_state')).trigger('change.select2'); - window.intlTelInputGlobals.getInstance(document.querySelector("#customer_phone")).setCountry(response.data['countrySortName']); + (PosnicPro.customers.customer_phone || { setCountry: function () {} }).setCountry(response.data['countrySortName']); } else { $('#customer_state option:eq(0)').prop('selected', true); - window.intlTelInputGlobals.getInstance(document.querySelector("#customer_phone")).setCountry(response.data['countrySortName']); + (PosnicPro.customers.customer_phone || { setCountry: function () {} }).setCountry(response.data['countrySortName']); } }, function (xhr) { var response = jQuery.parseJSON(xhr.responseText); @@ -613,7 +833,7 @@ PosnicPro.customers = { }, messages: { name: { - required: "Please Enter a Customer Name", + required: "Enter the customer name", minlength: "Customer name must be at least 3 characters", maxlength: "Customer name should not be more than 250 characters" }, @@ -625,15 +845,15 @@ PosnicPro.customers = { maxlength: "Email should not be more than 250 Characters" }, phone: { - customer_phone_number: "Please enter a valid phone number.", - minlength: "Please enter at least 3 characters.", - maxlength: "Please enter no more than 20 characters." + customer_phone_number: "Enter a valid phone number", + minlength: "Use at least 3 characters", + maxlength: "Use no more than 20 characters" }, city: { maxlength: "Customer city should not be more than 20 digits" }, gstin_number: { - required: "Please Enter a Valid GSTR Number", + required: "Enter a valid GSTIN", minlength: "Gstr must be Atleast 15 Characters long", maxlength: "Gstr should not be more than 15 digits" } @@ -656,7 +876,7 @@ PosnicPro.customers = { }, "Enter a valid phone number"); jQuery.validator.addMethod("gst", function (value, element) { return /^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z]{1}[1-9A-Z]{1}Z[0-9A-Z]{1}$/.test(value); - }, "Please Enter a Valid GSTR Number"); + }, "Enter a valid GSTIN"); $("#customer_add_form").submit(function (event) { event.preventDefault(); @@ -727,9 +947,9 @@ PosnicPro.customerdetails = { var returnTotalQty = 0; for (var i = 0; i < response.data.table.data.list.length; i++) { let row = response.data.table.data.list[i]; - saleTotalValue += row.items_total; - returnTotalValue += row.items_return_total; - if (row.sale_process == 'Add' || row.sale_process == 'Edit') { + saleTotalValue += Number(row.items_total) || 0; + returnTotalValue += Number(row.items_return_total) || 0; + if (!row.sale_process || row.sale_process == 'Add' || row.sale_process == 'Edit') { process_class = "badge badge-success-inverse"; } else if (row.sale_process == 'Edit') { process_class = "badge badge-primary-inverse"; @@ -752,7 +972,7 @@ PosnicPro.customerdetails = { }); let row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; let updateDate = PosnicPro.convertDate(row.string_date); - let trow = '<tr> <td scope="row">' + row_no + '</td> <td>' + row.sales_id + '</td> <td class="export-date">' + updateDate + '</td> <td class="text-center"><span class="' + process_class + '">' + row.sale_process + '</span></td> <td class="text-center text-danger">' + returnQty + '</td> <td class="text-right text-danger">' + currency + ' ' + row.items_return_total.toFixed(2) + '</td><td class="text-center text-success">' + salesQty + '</td><td class="text-right text-success">' + currency + ' ' + row.items_total.toFixed(2) + '</td></tr>'; + let trow = '<tr> <td scope="row" data-label="#">' + row_no + '</td> <td data-label="Sale">' + row.sales_id + '</td> <td class="export-date" data-label="Date">' + updateDate + '</td> <td class="text-center" data-label="Process"><span class="' + process_class + '">' + (row.sale_process || 'Add') + '</span></td> <td class="text-center text-danger" data-label="Return qty">' + returnQty + '</td> <td class="text-right text-danger" data-label="Return total">' + currency + ' ' + (Number(row.items_return_total) || 0).toFixed(2) + '</td><td class="text-center text-success" data-label="Qty">' + salesQty + '</td><td class="text-right text-success" data-label="Total">' + currency + ' ' + (Number(row.items_total) || 0).toFixed(2) + '</td></tr>'; $('#view_customerdetails').children('tbody').append(trow); $('span.number').number(true, 2); } @@ -787,7 +1007,7 @@ PosnicPro.customerdetails = { }); }); let date = PosnicPro.convertDate(val.string_date); - let process = val.sale_process; + let process = val.sale_process || 'Add'; let saleId = val.sales_id; let returnTotal = val.items_return_total; let saleTotal = val.items_total; @@ -873,22 +1093,22 @@ PosnicPro.transactiondetails = { let salesPending = row.pending !== undefined ? row.pending : 0.00; let saleTotal = row.sale_total !== undefined ? row.sale_total : 0.00; let image_path = (row.transaction_image !== "category.svg") ? row.transaction_image : 'static/images/default/' + row.transaction_image; - let deleteTransaction = '<span data-module="customers" data-access="delete" data-toggle="tooltip" title="Delete Transaction" onclick="return PosnicPro.transactiondetails.removeTransactionDetails(\'' + row._id + '\');" class="point-cursor mobile_tooltip text-danger"><i class="feather icon-trash"></i></a>'; - let deleteSaleTransaction = '<span data-module="customers" data-access="delete" data-toggle="tooltip" title="Connected with sale" class="point-cursor mobile_tooltip text-secondary" style="cursor: default;"><i class="feather icon-link"></i></a>'; + let deleteTransaction = '<span data-module="customers" data-access="delete" data-toggle="tooltip" title="Delete Transaction" data-t-title="lang_delete_transaction" onclick="return PosnicPro.transactiondetails.removeTransactionDetails(\'' + row._id + '\');" class="point-cursor mobile_tooltip text-danger"><i class="feather icon-trash"></i></a>'; + let deleteSaleTransaction = '<span data-module="customers" data-access="delete" data-toggle="tooltip" title="Connected with sale" data-t-title="lang_connected_with_sale" class="point-cursor mobile_tooltip text-secondary" style="cursor: default;"><i class="feather icon-link"></i></a>'; let row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; - let type = (row.type === 'in') ? '<span class="badge badge-success-inverse">Credit</span>' - : (row.type === 'out' && row.sale_id !== '') ? '<span class="badge badge-info-inverse">Sale - Debit</span>' - : (row.type === 'out') ? '<span class="badge badge-danger-inverse">Debit</span>' - : '<span class="badge badge-warning-inverse">Sale - Due</span>'; + let type = (row.type === 'in') ? '<span class="badge badge-success-inverse"><lang class="lang_credit_title">Credit</lang></span>' + : (row.type === 'out' && row.sale_id !== '') ? '<span class="badge badge-info-inverse"><lang class="lang_sale_debit">Sale - Debit</lang></span>' + : (row.type === 'out') ? '<span class="badge badge-danger-inverse"><lang class="lang_debit_title">Debit</lang></span>' + : '<span class="badge badge-warning-inverse"><lang class="lang_sale_due">Sale - Due</lang></span>'; let trash = (row.sale_id !== '') ? deleteSaleTransaction : deleteTransaction; - let connect = (row.sale_id !== '') ? '<span class="badge badge-secondary">Sale Bill</span>' : ''; + let connect = (row.sale_id !== '') ? '<span class="badge badge-secondary"><lang class="lang_sale_bill">Sale Bill</lang></span>' : ''; let trow = '<tr> <td scope="row">' + row_no + '</td><td>' + row.string_date + '<br>' + connect + '</td><td class="text-center">' + (row.description || '') + '</td>\n\ <td class="text-left">' + type + '</td><td class="text-center">' + (row.type === 'out' ? '-' : '+') + currency + ' ' + row.amount + '</td>\n\ <td class="text-center">' + currency + ' ' + (saleTotal - salesPending) + '</td>\n\ <td class="text-center">' + currency + ' ' + salesPending + '</td>\n\ <td class="text-center">' + currency + ' ' + saleTotal + '</td>\n\ - <td class="text-center"><img src=' + image_path + ' width=30 height=20 class="imagezoom" id="' + image_path + '" onclick="PosnicPro.viewImage(this.id,\'customers\');"></td>\n\ + <td class="text-center"><img loading="lazy" decoding="async" src=' + image_path + ' width=30 height=20 class="imagezoom" id="' + image_path + '" onclick="PosnicPro.viewImage(this.id,\'customers\');"></td>\n\ <td class="text-center">' + trash + '</td></tr>'; $('#view_customer_transaction_details').children('tbody').append(trow); $('span.number').number(true, 2); @@ -1071,7 +1291,7 @@ PosnicPro.closesalesdetails = { }); if (PosnicPro.closesalesdetails.fixedwalletbalance < checkedWalletBalance) { $(element).prop("checked", false); - PosnicPro.alert('warning', 'Not enough wallet balance.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_not_enough_wallet_balance', 'Not enough wallet balance.')); var removeRmIndex = PosnicPro.closesalesdetails.partialy_checkbox.map(function (item) { return item.id === $(element).val() ? $(element).val() : ''; }).indexOf($(element).val()); @@ -1085,7 +1305,7 @@ PosnicPro.closesalesdetails = { paymentClose: function () { if (PosnicPro.closesalesdetails.partialy_checkbox.length === 0) { - PosnicPro.alert('error', 'Select a sale.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_select_a_sale', 'Select a sale.')); return false; } let customer_id = currentHash.split('/'); @@ -1156,8 +1376,8 @@ $('#upload_file_transaction').change(function () { }); $(function () { - $('#customer_referrer_name').on('keypress keydown.autocomplete', function () { - $(this).autocomplete({ + $('#customer_referrer_name').autocomplete({ + deferRequestBy: 120, lookup: function (query, done) { var result = {}; var suggestions = []; @@ -1191,10 +1411,9 @@ $(function () { $.Autocomplete.formatResult(suggestion) + '</div><span class="pull-right">' + phone + '</span>'; } - }); }); - PosnicPro.customers.customer_phone = window.intlTelInput(document.querySelector("#customer_phone"), { + PosnicPro.lazyPhoneInput('#customer_phone', PosnicPro.customers, 'customer_phone', { separateDialCode: true, preferredCountries: ['in'], hiddenInput: "full", @@ -1202,4 +1421,12 @@ $(function () { }); }); -/*end*/ \ No newline at end of file +/*end*/ + +$(document).on('click', '#customers_list_rows tr.customers-row', function () { + PosnicPro.customers.openDoc($(this).data('id')); +}); +$(document).on('click', '#customers_filter_btn', function () { + PosnicPro.customers.mountFilters(true); + PosnicPro.listFilter.toggle('customers'); +}); diff --git a/frontend/static/script/js/modules/js/dashboard.js b/frontend/static/script/js/modules/js/dashboard.js index d6083efd5..796993901 100644 --- a/frontend/static/script/js/modules/js/dashboard.js +++ b/frontend/static/script/js/modules/js/dashboard.js @@ -1,5 +1,4 @@ PosnicPro.dashboard = { - sales_purchase_chart: '', showDataTablePage: function () { PosnicPro.HideSideBarModal(); $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); @@ -338,314 +337,20 @@ PosnicPro.dashboard = { }, - getDashboardSalesPaymentModeData: function (filter) { - let loader = $(".loader-login"); - $("<div class='loadingSpinner'></div>").appendTo(loader); - var params = { - url: 'dashboard/getDashboardPaymentModeData', - data: { - filter: filter - }, - }; - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - var data = response.data; - - /* - * The payment data arrives asynchronously. If the operator has - * already left the dashboard for another screen, its - * #apex-circle-chart element is gone - and handing ApexCharts a - * null container is exactly what threw "Cannot read properties - * of null (reading 'offsetWidth')". There is nothing to draw - * into, so stop here rather than crash. - */ - var chartContainer = document.querySelector("#apex-circle-chart"); - if (!chartContainer) { - loader.find(".loadingSpinner:first").remove(); - return; - } - chartContainer.innerHTML = ''; - - // Check if we have data to display - if (!data.percentage_series || data.percentage_series.length === 0) { - chartContainer.innerHTML = '<div style="text-align: center; padding: 50px; color: #999;">No payment data available</div>'; - loader.find(".loadingSpinner:first").remove(); - return; - } - - /* -- Apex Circle Chart -- */ - var options = { - chart: { - height: 300, - type: 'radialBar', - events: { - legendClick: function(chartContext, seriesIndex, config) { - // This will trigger the chart to update and show selected amount - } - } - }, - plotOptions: { - radialBar: { - dataLabels: { - name: { - fontSize: '14px', - fontFamily: 'Mukta Vaani', - }, - value: { - fontSize: '12px', - fontFamily: 'Mukta Vaani', - formatter: function (val) { - return parseFloat(val || 0).toFixed(2) + "%"; - } - }, - total: { - show: true, - label: 'Total', - formatter: function (w) { - // Check if any series is selected/isolated - var selectedSeries = w.globals.selectedDataPoints[0]; - if (selectedSeries && selectedSeries.length > 0) { - // Show selected payment mode's amount - var index = selectedSeries[0]; - var amount = data.paymode_data[index].amount || 0; - var mode = data.pay_mode_series[index] || ''; - return mode + '\n₹' + amount.toFixed(2); - } else { - // Show total amount - var totalAmount = data.total_amount || 0; - return 'Total\n₹' + totalAmount.toFixed(2); - } - } - } - } - } - }, - colors: ['#506fe4', '#43d187', '#f7bb4d', '#96a3b6', '#FF4560', '#775DD0', '#00E396', - '#FEB019', '#FF4560', '#775DD0'], - series: data.percentage_series, - labels: data.pay_mode_series, - legend: { - show: true, - position: 'bottom', - fontSize: '12px', - fontFamily: 'Mukta Vaani', - formatter: function(seriesName, opts) { - var index = opts.seriesIndex; - var amount = data.paymode_data[index].amount || 0; - var percentage = data.percentage_series[index] || 0; - return seriesName + ': ₹' + amount.toFixed(2) + ' (' + percentage.toFixed(2) + '%)'; - } - }, - tooltip: { - enabled: true, - fillSeriesColor: false, - y: { - formatter: function(val, opts) { - if (!opts || opts.seriesIndex === undefined) return ''; - var index = opts.seriesIndex; - var amount = data.paymode_data[index] ? data.paymode_data[index].amount || 0 : 0; - var mode = data.pay_mode_series[index] || ''; - var percentage = parseFloat(val || 0); - return mode + ': ₹' + amount.toFixed(2) + ' (' + percentage.toFixed(2) + '%)'; - } - } - } - }; - - loader.find(".loadingSpinner:first").remove(); - PosnicPro.lazy.load('apexcharts').then(function () { - // The operator may have left the dashboard while the - // library was fetched; rendering into a detached node - // throws on offsetWidth. - if (!chartContainer.isConnected) return; - var chart = new ApexCharts(chartContainer, options); - chart.render(); - }); - } else { - PosnicPro.alert(response.type, response.message); - } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); - }); - }, - - getDashboardTotalAmounts: function (filter) { - var params = { - url: 'dashboard/getDashboardTotalAmounts', - data: { - filter: filter - } - }; - - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - var data = response.data; - // sales count - $('#dashboard_sales_count').html(data.total_data.Total_Sales_Amount); - $('#dashboard_purchase_count').html(data.total_data.Total_Purchase_Amount); - $('#dashboard_return_count').html(data.total_data.Total_Return_Amount); - $('#dashboard_return_purchase_count').html(data.total_data.Total_returnpurchase_Amount); - - - // Getting sum of array - var sales_total = data.list_data.sales_y_axis.reduce(function (a, b) { - return a + b; - }, 0); - var purchase_total = data.list_data.purchase_y_axis.reduce(function (a, b) { - return a + b; - }, 0); - var return_total = data.list_data.return_y_axis.reduce(function (a, b) { - return a + b; - }, 0); - var return_purchase_total = data.list_data.purchasereturn_y_axis.reduce(function (a, b) { - return a + b; - }, 0); - - $('#dashboard_sales_amount').number(sales_total, 2); - $('#dashboard_purchase_amount').number(purchase_total, 2); - $('#dashboard_return_amount').number(return_total, 2); - $('#dashboard_return_purchases_amount').number(return_purchase_total, 2); - - var chart_data = new Array(); - //For Sales - chart_data['color_code'] = "#506fe4"; - chart_data['chart_name'] = "Sales"; - chart_data['chart_id'] = "apex-line-chart-sales"; - chart_data['arrX'] = data.list_data.sales_x_axis; - chart_data['arrY'] = data.list_data.sales_y_axis; - PosnicPro.dashboard.smallChartsData(chart_data); - - //For Purchase - chart_data['color_code'] = "#43d187"; - chart_data['chart_name'] = "Purchase"; - chart_data['chart_id'] = "apex-line-chart-purchase"; - chart_data['arrX'] = data.list_data.purchase_x_axis; - chart_data['arrY'] = data.list_data.purchase_y_axis; - PosnicPro.dashboard.smallChartsData(chart_data); - - //For Return - chart_data['color_code'] = "#506fe4"; - chart_data['chart_name'] = "Return"; - chart_data['chart_id'] = "apex-line-chart-return"; - chart_data['arrX'] = data.list_data.return_x_axis; - chart_data['arrY'] = data.list_data.return_y_axis; - PosnicPro.dashboard.smallChartsData(chart_data); - - //For Purchase Return - chart_data['color_code'] = "#506fe4"; - chart_data['chart_name'] = "Return Purchase"; - chart_data['chart_id'] = "apex-line-chart-purchasereturn"; - chart_data['arrX'] = data.list_data.purchasereturn_x_axis; - chart_data['arrY'] = data.list_data.purchasereturn_y_axis; - PosnicPro.dashboard.smallChartsData(chart_data); - - } else { - PosnicPro.alert(response.type, response.message); - } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); - }); - }, - - getDashboardSalesPurchase: function (filter) { - var params = { - url: 'dashboard/getDashboardSalesPurchase', - data: { - filter: filter - } - }; - - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - var data = response.data; - PosnicPro.dashboard.salesPurchaseGraphData(data); - } else { - PosnicPro.alert(response.type, response.message); - } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); - }); - }, - - salesPurchaseGraphData: function (sales_purchase_data) { - //**** AM Charts - Sales Sample Data - am4core.ready(function () { - - // Themes begin - am4core.useTheme(am4themes_animated); - // Themes end - - // Create chart instance - PosnicPro.dashboard.sales_purchase_chart = PosnicPro.chart.create("chartdiv", am4charts.XYChart3D); - if (!PosnicPro.dashboard.sales_purchase_chart) return; // the panel is not on the page - PosnicPro.dashboard.sales_purchase_chart.scrollbarX = new am4core.Scrollbar(); - - // Add data - PosnicPro.dashboard.sales_purchase_chart.data = sales_purchase_data; - - // Create axes - var categoryAxis = PosnicPro.dashboard.sales_purchase_chart.xAxes.push(new am4charts.CategoryAxis()); - categoryAxis.dataFields.category = "month"; - categoryAxis.renderer.grid.template.location = 0; - categoryAxis.renderer.minGridDistance = 60; - categoryAxis.tooltip.disabled = true; - - var valueAxis = PosnicPro.dashboard.sales_purchase_chart.yAxes.push(new am4charts.ValueAxis()); - valueAxis.renderer.minWidth = 50; - valueAxis.min = 0; - valueAxis.cursorTooltipEnabled = false; - - // Create series - var series = PosnicPro.dashboard.sales_purchase_chart.series.push(new am4charts.ColumnSeries3D()); - series.sequencedInterpolation = true; - series.dataFields.valueY = "sales"; - series.dataFields.categoryX = "month"; - series.clustered = false; - series.columns.template.tooltipText = "Sales: [{categoryX}: bold]{valueY}[/]"; - series.tooltip.background.cornerRadius = 20; - series.columns.template.fillOpacity = 0.9; - series.tooltip.pointerOrientation = "right"; - series.tooltipX = am4core.percent(100); - - // on hover, make corner radiuses bigger - var hoverState = series.columns.template.column.states.create("hover"); - hoverState.properties.cornerRadiusTopLeft = 0; - hoverState.properties.cornerRadiusTopRight = 0; - hoverState.properties.fillOpacity = 1; - - // remove logo - PosnicPro.dashboard.sales_purchase_chart.logo.disabled = true; - - series.columns.template.adapter.add("fill", function (fill, target) { - return PosnicPro.dashboard.sales_purchase_chart.colors.getIndex(target.dataItem.index); - }); - - var paretoValueAxis = PosnicPro.dashboard.sales_purchase_chart.yAxes.push(new am4charts.ValueAxis()); - paretoValueAxis.renderer.opposite = true; - paretoValueAxis.renderer.grid.template.disabled = true; - paretoValueAxis.numberFormatter = new am4core.NumberFormatter(); - paretoValueAxis.cursorTooltipEnabled = false; - - var paretoSeries = PosnicPro.dashboard.sales_purchase_chart.series.push(new am4charts.ColumnSeries3D()) - paretoSeries.sequencedInterpolation = true; - paretoSeries.dataFields.valueY = "purchase"; - paretoSeries.dataFields.categoryX = "month"; - paretoSeries.tooltipHTML = '<div style="margin-right:20px;"> Purchase: {valueY}</div>'; - paretoSeries.clustered = false; - paretoSeries.columns.template.tooltipText = "Purchase: [{categoryX}: bold]{valueY}[/]"; - paretoSeries.tooltip.background.cornerRadius = 20; - paretoSeries.columns.template.fillOpacity = 0.9; - paretoSeries.tooltip.pointerOrientation = "left"; - paretoSeries.tooltipX = am4core.percent(0); - - // Cursor - PosnicPro.dashboard.sales_purchase_chart.cursor = new am4charts.XYCursor(); - PosnicPro.dashboard.sales_purchase_chart.cursor.behavior = "panX"; - }); // end am4core.ready() - }, + /* + * REMOVED 2026-08-21: getDashboardTotalAmounts and smallChartsData - + * 147 lines that could not run (defined, never called, wrote to ids the + * markup no longer had). + * + * REMOVED 2026-08-26, owner order "delete all chart related code": + * getDashboardSalesPaymentModeData (the apex donut - its + * #apex-circle-chart container was already gone from the markup), + * getDashboardSalesPurchase and salesPurchaseGraphData (the amCharts + * sales/purchase bars - no caller anywhere). The SERVER endpoints + * dashboard/getDashboardPaymentModeData, dashboard/getDashboardSalesPurchase + * and dashboard/getDashboardTotalAmounts stay: routed, modelled and + * tested, and this repo is not the only possible caller. + */ getDashboardTopPerformers: function (filter) { var params = { @@ -702,14 +407,13 @@ PosnicPro.dashboard = { $('.BestSellingitem').show(); } $("#tblBestSellingProducts tbody").append(html); - } else if (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') { - $("#tblBestSellingProducts tbody").text('உங்கள் தயாரிப்பு விவரங்கள் காலியாக உள்ளன.'); - $("#tblBestSellingProducts tbody").css({"color": "#2554C7"}); - $('.BestSellingitem').css('display', 'none'); - } else { - $("#tblBestSellingProducts tbody").text('Your product details are empty'); - $("#tblBestSellingProducts tbody").css({"color": "#2554C7", "column-span": "4"}); + /* One branch. The two halves differed only in the words - + now a key - and in a column-span that does nothing to a + tbody, so keeping it for both changes neither. */ + $("#tblBestSellingProducts tbody") + .text(PosnicPro.i18n.t('lang_empty_product_details', 'Your product details are empty')) + .css({"color": "#2554C7", "column-span": "4"}); $('.BestSellingitem').css('display', 'none'); } $('span.number').number(true, 2); @@ -749,14 +453,12 @@ PosnicPro.dashboard = { $('.Expireditem').show(); } $("#expired_stock_table tbody").append(html); - } else if (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') { - $("#expired_stock_table tbody").text('உங்கள் தயாரிப்பு விவரங்கள் காலியாக உள்ளன.'); - $("#expired_stock_table tbody").css({"color": "#2554C7"}); - $('.Expireditem').css('display', 'none'); - } else { - $("#expired_stock_table tbody").text('Your product details are empty'); - $("#expired_stock_table tbody").css({"color": "#2554C7", "column-span": "4"}); + /* Same collapse as Best Selling above, for the same + reason: only the words differed. */ + $("#expired_stock_table tbody") + .text(PosnicPro.i18n.t('lang_empty_product_details', 'Your product details are empty')) + .css({"color": "#2554C7", "column-span": "4"}); $('.Expireditem').css('display', 'none'); } $('span.number').number(true, 2); @@ -822,7 +524,7 @@ PosnicPro.dashboard = { $("#outstandingCustomersModal").modal('hide'); } } else { - $("#lstRecentActivities").text('Outstanding customer details are empty'); + $("#lstRecentActivities").text(PosnicPro.i18n.t('lang_outstanding_customer_details_are_empty', 'Outstanding customer details are empty')); $("#lstRecentActivities").css({"color": "#2554C7"}); } $('span.number').number(true, 2); @@ -838,105 +540,24 @@ PosnicPro.dashboard = { }); }, - smallChartsData: function (data) { - var myobj = document.getElementById(data['chart_id']); - myobj.remove(); - - var newDiv = document.createElement("div"); - newDiv.id = data['chart_id']; - var element = document.getElementById(data['chart_id'] + "-parent"); - element.appendChild(newDiv); - - var options = { - chart: { - height: 50, - type: 'line', - sparkline: { - enabled: true - }, - toolbar: { - show: false - }, - zoom: { - enabled: false - } - }, - colors: [data['color_code']], - series: [{ - name: data['chart_name'], - data: data['arrY'] - }], - dataLabels: { - enabled: false - }, - stroke: { - curve: 'smooth', - width: 2 - }, - grid: { - row: { - colors: ['transparent', 'transparent'], opacity: .2 - }, - borderColor: 'transparent' - }, - yaxis: { - min: 0 - }, - xaxis: { - categories: data['arrX'], - axisBorder: { - show: true, - color: 'rgba(0,0,0,0.05)' - }, - axisTicks: { - show: true, - color: 'rgba(0,0,0,0.05)' - } - } - } - // Same guard as the payment-mode chart: this can be called after the - // operator has left the dashboard, and rendering into a missing - // container throws on offsetWidth. - var salesChartEl = document.querySelector("#" + data['chart_id']); - if (!salesChartEl) { - return; - } - PosnicPro.lazy.load('apexcharts').then(function () { - if (!salesChartEl.isConnected) return; - var sales_chart = new ApexCharts(salesChartEl, options); - sales_chart.render(); - }); - }, - - getDashboardCurrentWish: function () { - var params = { - url: 'dashboard/getDashboardCurrentWish' - }; - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - //Set Good morning, noon etc - var nav_href = PosnicPro.local.get('language_herf'); - $.each(response.data.quotes, function (index, val) { - if (val.id == response.data.current_date) - { - if (nav_href !== 'dashboard.html') { - $("#current_wish").html('வணக்கம்...'); - $("#current_quote").html(val.tamilquote); - } else { - $("#current_wish").html(response.data.current_wish); - $("#current_quote").html(val.quote); - } - } - }); - } else { - PosnicPro.alert(response.type, response.message); - } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); - }); - }, + /* + * REMOVED 2026-08-21: getDashboardCurrentWish. + * + * This one was not merely dead - it ran. It fired on every document.ready, + * fetched dashboard/getDashboardCurrentWish, and wrote the greeting into + * #current_wish and the daily quote into #current_quote. Neither element + * has existed since the dashboard was redesigned, so the whole response was + * discarded: one round trip per page load for nothing. + * + * And its failure path was worse than its success path. A non-success + * response called PosnicPro.alert, so an endpoint having a bad day put an + * error toast on screen about a feature the user cannot see. + * + * The server endpoint is left in place, as with getDashboardTotalAmounts. + * If the greeting is wanted back, the markup is what has to return - the + * fetch was never the missing part. + */ //Day, Week, Month, Year /* @@ -995,13 +616,13 @@ PosnicPro.dashboard = { * amount in the wrong currency. */ periodLabel: function (filter) { - return { day: 'Today', week: 'This Week', month: 'This Month', year: 'This Year' }[filter] || 'Today'; + return { day: PosnicPro.i18n.t('lang_this_day', 'Today'), week: PosnicPro.i18n.t('lang_this_week', 'This Week'), month: PosnicPro.i18n.t('lang_this_month', 'This Month'), year: PosnicPro.i18n.t('lang_year', 'This Year') }[filter] || PosnicPro.i18n.t('lang_this_day', 'Today'); }, // Time-of-day greeting, worked out on the client so it costs no request. greeting: function () { var h = new Date().getHours(); - var wish = h < 12 ? 'Good Morning' : h < 17 ? 'Good Afternoon' : h < 21 ? 'Good Evening' : 'Good Night'; + var wish = h < 12 ? PosnicPro.i18n.t('lang_good_morning', 'Good Morning') : h < 17 ? PosnicPro.i18n.t('lang_good_afternoon', 'Good Afternoon') : h < 21 ? PosnicPro.i18n.t('lang_good_evening', 'Good Evening') : PosnicPro.i18n.t('lang_good_night', 'Good Night'); // Greet the logged-in USER by first name, not the shop/branch name. var name = (PosnicPro.local.get('userfirstname') || PosnicPro.local.get('username') || '').trim(); $('#dashboard_greeting').text(wish + (name ? ', ' + name : '')); @@ -1026,6 +647,8 @@ PosnicPro.dashboard = { $('#kpi_period_label').text('(' + PosnicPro.dashboard.periodLabel(filter) + ')'); PosnicPro.get({ url: 'dashboard/getOverview', data: { filter: filter } }, function (response) { + /* crash-hunt probe gate: skippable render */ + if (window.__posnicSkip === 'overview' || window.__posnicSkip === 'all') { return; } if (response.type !== 'success' || !response.data) { $(PosnicPro.dashboard.KPI_IDS).html('—'); return; @@ -1060,7 +683,7 @@ PosnicPro.dashboard = { var tbody = $('#tblBestSellingProducts tbody'); if (!tbody.length) { return; } if (!items.length) { - tbody.html('<tr><td colspan="4" class="text-center text-muted" style="padding:16px;">No sales in this period</td></tr>'); + tbody.html('<tr><td colspan="4" class="text-center text-muted" style="padding:16px;"><lang class="lang_no_sales_in_this_period">No sales in this period</lang></td></tr>'); return; } var html = ''; @@ -1071,30 +694,8 @@ PosnicPro.dashboard = { tbody.html(html); }, - // Light HTML bars instead of a chart library - the same information, none of - // the megabytes. Rupee amounts only for a user allowed the financial layer. - renderPaymentMix: function (mix, financials) { - var box = $('#apex-circle-chart'); - if (!box.length) { return; } - if (!mix.length) { - box.html('<div class="text-center text-muted" style="padding:24px 8px;">No payments in this period</div>'); - return; - } - var esc = function (v) { return $('<div>').text(v == null ? '' : v).html(); }; - var colors = ['#506fe4', '#43d187', '#f7bb4d', '#96a3b6', '#FF4560', '#775DD0']; - var html = '<div style="padding:10px 12px;">'; - for (var i = 0; i < mix.length; i++) { - var m = mix[i]; - var pct = Number(m.pct) || 0; - var right = financials && m.amount != null ? PosnicPro.dashboard.money(m.amount) : pct + '%'; - html += '<div style="margin-bottom:10px;">' + - '<div style="display:flex; justify-content:space-between; font-size:13px;"><span>' + esc(m.mode) + '</span><span class="f-w-6">' + right + '</span></div>' + - '<div style="height:6px; background:#eef0f3; border-radius:4px; overflow:hidden; margin-top:3px;"><div style="height:6px; width:' + pct + '%; background:' + colors[i % colors.length] + ';"></div></div>' + - '</div>'; - } - html += '</div>'; - box.html(html); - }, + /* renderPaymentMix removed with the chart purge - no caller and no + #apex-circle-chart container anywhere in the markup. */ renderProfit: function (profit, filter) { if (!$('#profit_net').length) { return; } // hidden for non-financial users @@ -1140,6 +741,17 @@ PosnicPro.dashboard = { $("#" + arrBtns[i]).removeClass("active"); } $("#" + obj.id).addClass("active"); + /* + * The module gates, again, here. + * + * applyModuleSidebar runs at login and after a modules save, but the + * dashboard's own markup is fetched when its route opens - after that + * has already run. Without this the Customer Dues panel would appear + * for a shop with credit switched off until something else happened to + * re-apply the gates. + */ + if (PosnicPro.applyModuleSidebar) { PosnicPro.applyModuleSidebar(); } + // One request for the whole dashboard - see loadOverview. PosnicPro.dashboard.loadOverview(filter); }, @@ -1153,35 +765,153 @@ PosnicPro.dashboard = { }, 500); // Adjust delay (1000ms = 1s) if needed } }; -$(document).ready(function (e) { - PosnicPro.dashboard.getDashboardCurrentWish(); - var nav_lang = PosnicPro.local.get('language'); - $('.select_language').html(nav_lang); - if ((nav_lang == null) || (nav_lang == '')) { - $('.select_language').html('English'); - var nav_id = 'dashboard.html'; - PosnicPro.local.set('language_herf', nav_id); - } - +$(document).ready(function () { + /* The label is the language's own name. Nothing stored means nothing + chosen yet; buildLanguageMenu settles it once the shipped list is in. + It is NOT written back here: a stored value looks exactly like a + choice, and would stop the first-run detection from ever running. */ + $('.select_language').html(PosnicPro.local.get('language') || 'English'); }); -$('#change_language a').click(function () { + +/* Type sizes and spacing a language needs, settled here rather than by + loading a different page. Tamil runs long in the sidebar and report tabs. */ +function posnicLanguageStyling(code) { + $('.report_tab_font').toggleClass('tamil_font14', code === 'ta'); + $('.vertical-menu').toggleClass('tamil_verticalmenu', code === 'ta'); + $('.top_sales_tamil').toggleClass('card_tamil_padding', code === 'ta'); + $('.tamil_qty').toggleClass('sales_tamil_padding', code === 'ta'); + $('.discount_tamil_right').toggleClass('pull-right', code !== 'ta'); +} + +/* + * Build the language menu from what the build actually shipped. + * + * Every language used to need its own hand-written <a> in header.html. Now the + * list comes from languages/index.json, so adding one is a file and a line of + * config - never markup. + * + * The menu keeps its English entry if this fails: an unreadable list should + * cost the OTHER languages, never leave a shop with no way to choose at all. + */ +/* + * Offer the shop's Posnic account, to the person who owns it. + * + * Two conditions, and both matter. + * + * The SERVER decides whether this installation has an account, because only it + * can tell the difference that matters: a till paired to Cloud reports its mode + * as 'desktop', not 'cloud' - so a frontend test on edition would hide the link + * from exactly the paying customers it is for. features.account carries the + * answer, and a white-labelled build always answers false, since that shop was + * not sold anything called Posnic. + * + * The BROWSER decides whether this person should see it. A cashier has no + * business being shown the subscription and the bill. + * + * Failure is silence. If runtime-info cannot be read the item stays hidden, + * which is the same outcome as a community install and costs nobody anything. + */ +(function showAccountLink() { + var item = document.getElementById('posnic_account_item'); + if (!item || typeof fetch !== 'function') return; + if (PosnicPro.local.get('usertype') !== 'super_admin') return; + + /* + * API_URL, not a relative path. This page is served from /public, so + * 'api/runtime-info' would resolve to /public/api/runtime-info, 404, land + * in the catch below, and hide the link forever without anyone noticing - + * which is exactly how a feature ships dead. + */ + var base = (typeof API_URL === 'string' && API_URL) || '/'; + fetch(base + 'api/runtime-info') + .then(function (r) { return r.ok ? r.json() : null; }) + .then(function (info) { + if (info && info.features && info.features.account) item.style.display = ''; + }) + .catch(function () { /* hidden, which is the safe answer */ }); +}()); + +(function buildLanguageMenu() { + var menu = document.getElementById('change_language'); + if (!menu || typeof fetch !== 'function') return; + fetch('languages/index.json') + .then(function (r) { return r.ok ? r.json() : null; }) + .then(function (list) { + if (!Array.isArray(list) || !list.length) return; + menu.innerHTML = list.map(function (l) { + /* + * An unreviewed language says so. "beta" is the one word every + * script here reads, and the tooltip carries the number a + * translator wants to see move. This honesty is what lets + * every language ship: the shopkeeper knows what they are + * picking, and every missing word is still English. + */ + var note = l.reviewed === false + ? ' <small class="text-muted lang-beta">beta</small>' : ''; + var title = typeof l.coverage === 'number' + ? ' title="' + l.coverage + '% translated' + + (l.reviewed === false ? ', not yet reviewed by a speaker' : '') + '"' + : ''; + /* + * The NAME is isolated with <bdi>, not the row. dir="rtl" on the + * anchor mirrored the whole entry - flag on the right, "beta" + * before the name - in a menu every other row reads left to + * right. <bdi> lets Arabic shape and order its own letters and + * leaves the row alone. + */ + return '<a class="dropdown-item" href="javascript:void(0)" data-code="' + l.code + '"' + + ' data-value="' + l.name + '"' + title + '>' + + '<i class="flag flag-icon-' + (l.flag || 'us') + ' flag-icon-squared"></i> ' + + '<bdi>' + l.name + '</bdi>' + note + '</a>'; + }).join(''); + + /* The label and the type sizes follow the SETTLED language - after + the first-run detection in PosnicPro.i18n has had its say. */ + PosnicPro.i18n.ready.then(function () { + var current = PosnicPro.i18n.code(); + var entry = null; + for (var i = 0; i < list.length; i++) { + if (list[i].code === current) entry = list[i]; + } + if (entry) { + $('.select_language').html(entry.name); + PosnicPro.local.set('language', entry.name); + } + posnicLanguageStyling(current); + }); + }) + .catch(function () { /* the English entry in the markup stands */ }); +}()); + +$('#change_language').on('click', 'a', function () { var nav_language = $(this).data('value'); - var nav_id = $(this).data('id'); + var nav_id = $(this).data('code'); - // Persist selected language for subsequent loads + // Persist selected language for subsequent loads, and say so in the + // header now: there is no navigation any more to redraw the label. PosnicPro.local.set('language', nav_language); - PosnicPro.local.set('language_herf', nav_id); + $('.select_language').html(nav_language); - // Stay on the current host (localhost / custom domain / posnic.io) and - // only swap the dashboard shell (dashboard.html <-> ta_dashboard.html), - // preserving the current hash route (e.g. #/settings). - var newPath = window.location.pathname.replace(/[^/]+$/, nav_id); - window.location.href = newPath + window.location.hash; + /* + * No navigation. There used to be a page per language, so switching meant + * loading ta_dashboard.html and losing everything on screen. There is one + * page now: change() records the code, fetches that language's words and + * redraws in place, which is both simpler and instant. + * + * The menu carries the code itself now. A filename is still tolerated so a + * cached older header cannot break the switcher on the first load after an + * update. + */ + var code = /^[a-z]{2}$/.test(nav_id) ? nav_id + : (/^([a-z]{2})_/.test(nav_id) ? nav_id.slice(0, 2) : 'en'); + PosnicPro.i18n.change(code).then(function () { posnicLanguageStyling(code); }); }); jQuery(document).ready(function () { console.log('WORKING'); - var pathname = window.location.pathname.slice(1); - if (pathname === 'ta_dashboard.html') { + /* Tamil needs its own type sizes and menu spacing. Asked of the language, + not of the URL - the filename stops being the language as soon as the + HTML is no longer built per language. */ + if (PosnicPro.i18n.is('ta')) { $('.report_tab_font').addClass('tamil_font14'); $('.vertical-menu').addClass('tamil_verticalmenu'); $('.top_sales_tamil').addClass('card_tamil_padding'); @@ -1256,11 +986,18 @@ $("#logout").on("click", function () { * a per-browser choice, never a stored "done" that can lie. */ PosnicPro.dashboard.SETUP_CARDS = { - outlet: { label: 'Set up your outlet info', hint: 'Address and phone print on receipts', hash: '#/settings/branches' }, - items: { label: 'Add your first items', hint: 'Or import them from a file', hash: '#/items/new' }, - receipt: { label: 'Add your logo', hint: 'It shows on receipts and the dashboard', hash: '#/settings/branches' }, - employees: { label: 'Add your employees', hint: 'Each gets their own login and role', hash: '#/users' }, - taxes: { label: 'Set up taxes', hint: 'Rates apply to every sale automatically', hash: '#/settings/taxmodule' } + /* Labels as <lang> markup, not t(): this object is built when the module + loads, before any language pack has arrived, and the cards are drawn + as HTML - so the observer translates them on the screen instead. */ + /* {branch} resolves to THIS till's branch at render - the outlet card + lands on the outlet's own edit page, not on a settings section that + no longer exists ("#/settings/branches" was the broken page the owner + walked into from the desktop). */ + outlet: { label: '<lang class="lang_set_up_your_outlet_info">Set up your outlet info</lang>', hint: '<lang class="lang_address_and_phone_print_on_receipts">Address and phone print on receipts</lang>', hash: '#/branches/{branch}/edit' }, + items: { label: '<lang class="lang_add_your_first_items">Add your first items</lang>', hint: '<lang class="lang_or_import_them_from_a_file">Or import them from a file</lang>', hash: '#/items/new' }, + receipt: { label: '<lang class="lang_add_your_logo">Add your logo</lang>', hint: '<lang class="lang_it_shows_on_receipts_and_the_dashboard">It shows on receipts and the dashboard</lang>', hash: '#/branches/{branch}/edit' }, + employees: { label: '<lang class="lang_add_your_employees">Add your employees</lang>', hint: '<lang class="lang_each_gets_their_own_login_and_role">Each gets their own login and role</lang>', hash: '#/users' }, + taxes: { label: '<lang class="lang_set_up_taxes">Set up taxes</lang>', hint: '<lang class="lang_rates_apply_to_every_sale_automatically">Rates apply to every sale automatically</lang>', hash: '#/settings/taxmodule' } }; PosnicPro.dashboard.loadSetupChecklist = function () { if (PosnicPro.local.get('setup_checklist_dismissed') === 'true') { return; } @@ -1268,10 +1005,14 @@ PosnicPro.dashboard.loadSetupChecklist = function () { var checks = (response && response.data && response.data.checks) || []; var undone = checks.filter(function (c) { return !c.done; }); if (!undone.length) { $('#setup_checklist_strip').hide(); return; } + var branchId = PosnicPro.local.get('branch_id_set') || ''; var html = undone.map(function (c) { var card = PosnicPro.dashboard.SETUP_CARDS[c.key]; if (!card) { return ''; } - return '<a href="' + card.hash + '" class="border rounded p-2 d-block" style="min-width:180px;text-decoration:none;">' + + var hash = branchId + ? card.hash.replace('{branch}', branchId) + : card.hash.replace('/{branch}/edit', ''); + return '<a href="' + hash + '" class="border rounded p-2 d-block" style="min-width:180px;text-decoration:none;">' + '<div style="font-weight:600;font-size:.85rem;"><i class="feather icon-circle mr-1"></i>' + card.label + '</div>' + '<small class="text-muted">' + card.hint + '</small>' + '</a>'; diff --git a/frontend/static/script/js/modules/js/device_settings.js b/frontend/static/script/js/modules/js/device_settings.js index e4397b558..55aae04a1 100644 --- a/frontend/static/script/js/modules/js/device_settings.js +++ b/frontend/static/script/js/modules/js/device_settings.js @@ -37,11 +37,11 @@ $('#saveButton').click(function () { PosnicPro.device_setup.autoFocus(); } else { - PosnicPro.alert('error', 'You are not authorized to do this.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_you_are_not_authorized_to_do_this', 'You are not authorized to do this.')); } } else { - PosnicPro.alert('error', 'You are not authorized to do this.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_you_are_not_authorized_to_do_this', 'You are not authorized to do this.')); } }); $('#device_edit_reset').click(function () { @@ -55,11 +55,11 @@ $('#device_edit_reset').click(function () { PosnicPro.alert('Success', 'Device AutoFocus Reset Successfully..'); } else { - PosnicPro.alert('error', 'You are not authorized to do this.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_you_are_not_authorized_to_do_this', 'You are not authorized to do this.')); } } else { - PosnicPro.alert('error', 'You are not authorized to do this.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_you_are_not_authorized_to_do_this', 'You are not authorized to do this.')); } }); diff --git a/frontend/static/script/js/modules/js/expenses.js b/frontend/static/script/js/modules/js/expenses.js index c045ded83..c4222c431 100644 --- a/frontend/static/script/js/modules/js/expenses.js +++ b/frontend/static/script/js/modules/js/expenses.js @@ -85,12 +85,12 @@ PosnicPro.expenses = { var row = response.data.list[i]; var row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; var action = '<div id="onclick-toolbar-options_' + i + '" class="hidden">' + - '<a data-module = "expense" data-access = "read" href="#/expenses/' + row._id + '" data-id="expenses/' + row._id + '" data-toggle="tooltip" title="View Expense" class="point-cursor mobile_tooltip"><i class="feather icon-eye"></i></a>' + - '<a data-module = "expense" data-access = "write" href="#/expenses/' + row._id + '/edit" data-id="expenses/' + row._id + '/edit" data-toggle="tooltip" title="Edit Expense" class="point-cursor mobile_tooltip"><i class="feather icon-edit"></i></a>' + - '<a data-module = "expense" data-access = "delete" href="#/expenses/' + row._id + '/delete" data-id="expenses/' + row._id + '/delete" data-toggle="tooltip" title="Delete Expense" class="point-cursor mobile_tooltip"><i class="feather icon-trash"></i></a>' + + '<a data-module = "expense" data-access = "read" href="#/expenses/' + row._id + '" data-id="expenses/' + row._id + '" data-toggle="tooltip" title="View Expense" data-t-title="lang_view_expense" class="point-cursor mobile_tooltip"><i class="feather icon-eye"></i></a>' + + '<a data-module = "expense" data-access = "write" href="#/expenses/' + row._id + '/edit" data-id="expenses/' + row._id + '/edit" data-toggle="tooltip" title="Edit Expense" data-t-title="lang_edit_expense" class="point-cursor mobile_tooltip"><i class="feather icon-edit"></i></a>' + + '<a data-module = "expense" data-access = "delete" href="#/expenses/' + row._id + '/delete" data-id="expenses/' + row._id + '/delete" data-toggle="tooltip" title="Delete Expense" data-t-title="lang_delete_expense" class="point-cursor mobile_tooltip"><i class="feather icon-trash"></i></a>' + '</div>' + '<div data-toolbar="user-options" class="btn btn-round btn-primary-rgba round-pad" id="onclick-toolbar_' + i + '"><i class="feather icon-more-vertical-"></i></div>'; - var trow = '<tr class="pipeline"><th><input type="checkbox" class="expenses-row-id" id="' + row._id + '" name="id[]" value="' + row._id + '" onclick="PosnicPro.checkboxSelectOne(this,\'expenses\');"></th> <th scope="row">' + row_no + '</th><td class="text-right">' + currency + ' <span class="number">' + row.amount + '</span></td><td>' + (row.type === 'credit' ? 'Money In' : row.type === 'debit' ? 'Money Out' : (row.type || '')) + '</td><td>' + row.category + '</td><td>' + row.approvedby + '</td><td>' + (row.description || '') + '</td>' + + var trow = '<tr class="pipeline"><th><input type="checkbox" class="expenses-row-id" id="' + row._id + '" name="id[]" value="' + row._id + '" onclick="PosnicPro.checkboxSelectOne(this,\'expenses\');"></th> <th scope="row" data-label="#">' + row_no + '</th><td class="text-right" data-label="Amount">' + currency + ' <span class="number">' + row.amount + '</span></td><td data-label="Type">' + (row.type === 'credit' ? 'Money In' : row.type === 'debit' ? 'Money Out' : (row.type || '')) + '</td><td data-label="Category">' + row.category + '</td><td data-label="Approved by">' + row.approvedby + '</td><td data-label="Note">' + (row.description || '') + '</td>' + '<td class="text-center"><span>' + action + '</span></td>' + '</tr>'; $('#view_expenses').children('tbody').append(trow); @@ -165,12 +165,20 @@ PosnicPro.expenses = { var path = '#/expenses/' + expenseId; $('#last_created_expense').attr('href', path); PosnicPro.commonDate(); - if (PosnicPro.action === 'edit') { + /* ONE reload, not two (saves patch): setHash fires the + route's own table load, so the direct call is only for + saves that keep the current hash. */ + if (PosnicPro.action === 'edit' && window.location.hash !== '#/expenses') { $(".infobar-settings-sidebar-overlay").css({"background": "transparent", "position": "initial"}); $("#infobar-settings-sidebar-expense").removeClass("sidebarshow"); hasher.setHash('expenses'); + } else { + if (PosnicPro.action === 'edit') { + $(".infobar-settings-sidebar-overlay").css({"background": "transparent", "position": "initial"}); + $("#infobar-settings-sidebar-expense").removeClass("sidebarshow"); + } + PosnicPro.expenses.expensesTable('expenses'); } - PosnicPro.expenses.expensesTable('expenses'); loader.find(".loadingSpinner:first").remove(); PosnicPro.alert(response.type, response.message); } else { @@ -251,9 +259,9 @@ PosnicPro.expenses = { $('#expenses_recipientname').val(data.recipientname); $('#expenses_approvedby').val(data.approvedby); $('#expenses_expensesnote').val(data.description); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#expenses_title').text('திருத்தப்பட்ட') : $('#expenses_title').text('Edit'); -// $('#expenses_button_title').text('Update'); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#expenses_button_title').text('புதுப்பி') : $('#expenses_button_title').text('Update'); + $('#expenses_title').text(PosnicPro.i18n.t('lang_action_edit', 'Edit')); +// $('#expenses_button_title').text(PosnicPro.i18n.t('lang_refresh_title', 'Update')); + $('#expenses_button_title').text(PosnicPro.i18n.t('lang_updatebtn_title', 'Update')); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); $('#addExpenses').modal('show'); @@ -272,9 +280,9 @@ PosnicPro.expenses = { addExpensesButton: function () { var loader = $(".loader-expense"); loader.find(".loadingSpinner:first").remove(); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#expenses_title').text('புதிய') : $('#expenses_title').text('Add'); -// $('#expenses_button_title').text('Save'); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#expenses_button_title').text('சேமி') : $('#expenses_button_title').text('Save'); + $('#expenses_title').text(PosnicPro.i18n.t('lang_new_title', 'Add')); +// $('#expenses_button_title').text(PosnicPro.i18n.t('lang_save_title', 'Save')); + $('#expenses_button_title').text(PosnicPro.i18n.t('lang_save_title', 'Save')); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); $('#expenses_id').val(''); @@ -341,11 +349,11 @@ PosnicPro.expenses = { }, messages: { date: { - required: "Please select the Date", - commonDate: "Please enter a valid date" + required: "Choose a date", + commonDate: "Enter a valid date" }, amount: { - required: "Please enter expenses amount", + required: "Enter the expense amount", minlength: "Expenses amount must be at least 1 characters", maxlength: "Expenses amount should not be more than 10 characters" }, @@ -353,22 +361,22 @@ PosnicPro.expenses = { required: "Choose expenses type" }, category: { - required: "Please enter category name", + required: "Enter the category name", minlength: "Category name must be at least 3 characters", maxlength: "Category name should not be more than 20 characters" }, recipientname: { - required: "Please enter recipient name", + required: "Enter the recipient name", minlength: "Recipient name must be at least 3 characters", maxlength: "Recipient name should not be more than 20 characters" }, approvedby: { - required: "Please Enter the field", + required: "Fill this in", minlength: "This field must be at least 3 characters", maxlength: "This field should not be more than 20 characters" }, description: { - required: "Please Enter Expenses note", + required: "Enter a note for this expense", minlength: "Expenses note must be at least 3 characters", maxlength: "Expense note is too Long !" } @@ -379,7 +387,7 @@ PosnicPro.expenses = { }); jQuery.validator.addMethod("expenseDate", function (value, element) { return this.optional(element) || moment(value, 'YYYY/MM/DD LT').isValid(); - }, "Please enter a valid date in the format"); + }, "Use the date format"); $("#expenses_add_list_form").submit(function (event) { event.preventDefault(); if ($('#expenses_add_list_form').valid()) { // checks form for validity diff --git a/frontend/static/script/js/modules/js/invoices.js b/frontend/static/script/js/modules/js/invoices.js new file mode 100644 index 000000000..ca67924cb --- /dev/null +++ b/frontend/static/script/js/modules/js/invoices.js @@ -0,0 +1,1329 @@ +/* + * Invoices (INVOICING_MODULE_DESIGN): the bill a customer is asked to pay. + * + * Built on the quotes surface - the same master-detail split, the same A4 + * sheet, the same editor - because a quote becomes an invoice becomes a sale + * and the three must read as one family. The pure helpers (money, escaping, + * line math, the tax breakup, the PDF sheet) are the quotes' own, called by + * reference so the arithmetic on screen is the arithmetic the server stores. + * + * The one rule: THE INVOICE NEVER HOLDS MONEY. A draft is a proforma; + * "Issue" has the SERVER book the sale (stock, tax, the books) with no till + * screen in between; "Record payment" pays that sale down, in full or in + * part; and what the document shows as paid or owed is what the sale says, + * mirrored by the server. Feature-gated by invoices_enable, ACL: sales. + */ +PosnicPro.invoices = { + _current: null, + _esc: function (v) { return PosnicPro.quotes._esc(v); }, + _money: function (n) { return PosnicPro.quotes._money(n); }, + _d: function (v) { return v ? new Date(v).toLocaleDateString('en-IN') : ''; }, + _iso: function (v) { return v ? new Date(v).toISOString().slice(0, 10) : ''; }, + _on: function () { + try { + var gs = JSON.parse(PosnicPro.local.get('general_settings') || '{}'); + return gs.invoices_enable !== false; + } catch (e) { return true; } + }, + /* The status word a shopkeeper reads, and the pill colour it wears. */ + _label: function (s) { + return { draft: 'Draft', unpaid: 'Unpaid', partial: 'Partially paid', paid: 'Paid', cancelled: 'Cancelled' }[s] || s; + }, + /* PROFORMA while it is a draft; once issued, the shop's own word for a + bill - TAX INVOICE under GST, INVOICE elsewhere. */ + _title: function (inv) { + if (!inv || inv.status === 'draft') { return 'PROFORMA INVOICE'; } + return PosnicPro.local.get('gst_action') === 'enable' ? PosnicPro.i18n.t('lang_tax_invoice', 'TAX INVOICE') : PosnicPro.i18n.t('lang_invoice', 'INVOICE'); + }, + _pill: function (inv) { + var s = inv.status; + var cls = s === 'paid' ? 'paid' : (s === 'cancelled' || inv.is_overdue) ? 'unpaid' : 'hold'; + var text = inv.is_overdue ? 'Overdue' : PosnicPro.invoices._label(s); + return '<span class="rs-pill ' + cls + '">' + text + '</span>'; + }, + _editable: function (inv) { return inv && inv.status === 'draft'; }, + _booked: function (inv) { return inv && !!inv.sale_id; }, + + showDataTablePage: function () { + PosnicPro.HideSideBarModal(); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); + $('.page_loader,#osk-container').hide(); + $('.page-title-box,#invoices_new').show(); + $('#invoices_view_card,#invoices_edit_card').hide(); + $('#invoices_list_card').show(); + $('#invoices_new .contentbar').removeClass('master-detail invoices-split rail-collapsed'); + $('#invoices_list_rows tr.invoices-row').removeClass('is-active'); + $('.vertical-layout').removeClass('toggle-menu'); + $('#v-pills-dashboard-tab,#view_invoices_page').addClass('active'); + $('#v-pills-dashboard').addClass('show active'); + PosnicPro.invoices._current = null; + PosnicPro.invoices.load(); + PosnicPro.invoices.loadSummary(); + }, + + /* ------------------------------------------------------------ editor -- */ + _ed: null, + _edBlank: function () { + return { id: '', invoice_id: '', customer_id: '', lines: [], charges: [], due_date: '' }; + }, + _edShell: function () { + PosnicPro.HideSideBarModal(); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); + $('.page_loader,#osk-container').hide(); + $('.page-title-box,#invoices_new').show(); + $('#v-pills-dashboard-tab,#view_invoices_page').addClass('active'); + $('#v-pills-dashboard').addClass('show active'); + $('#invoices_list_card,#invoices_view_card').hide(); + /* The editor is a third child of this contentbar: the split must be + off or it is laid out as a rail sibling (see quotes). */ + $('#invoices_new .contentbar').removeClass('master-detail invoices-split rail-collapsed'); + $('#invoices_edit_card').show(); + PosnicPro.collapseMenuForWorkspace(); + PosnicPro.invoices._edInitSort(); + }, + _edSortable: null, + _edInitSort: function () { + PosnicPro.lazy.load('sortable').then(function () { + if (PosnicPro.invoices._edSortable || !window.Sortable) { return; } + var el = document.getElementById('ie_lines'); + if (!el) { return; } + PosnicPro.invoices._edSortable = window.Sortable.create(el, { + handle: '.qe-l-grip', + animation: 120, + onEnd: function (evt) { + var ed = PosnicPro.invoices._ed; + if (!ed || evt.oldIndex === evt.newIndex) { return; } + var moved = ed.lines.splice(evt.oldIndex, 1)[0]; + if (moved) { ed.lines.splice(evt.newIndex, 0, moved); } + PosnicPro.invoices.edRender(); + } + }); + }).catch(function () { /* drag is a nicety */ }); + }, + _edClearForm: function () { + $('#ie_cust_search,#ie_cust_name,#ie_cust_phone,#ie_cust_email,#ie_cust_gstin,#ie_cust_address').val(''); + $('#ie_item_search,#ie_payment,#ie_bank,#ie_terms,#ie_notes,#ie_disc_value,#ie_reference').val(''); + $('#ie_disc_type').val(''); + $('.ie-due-chip').removeClass('btn-primary').addClass('btn-secondary-rgba'); + }, + showAdd: function () { + PosnicPro.invoices._ed = PosnicPro.invoices._edBlank(); + PosnicPro.invoices._edShell(); + PosnicPro.invoices._edClearForm(); + $('#ie_title').text(PosnicPro.i18n.t('lang_new_invoice', 'New invoice')); + /* Terms and the due date come from the shop's invoice settings on + save; the box shows the terms it will get so they can be changed. */ + $('#ie_terms').val(PosnicPro.local.get('invoice_terms') || ''); + $('#ie_due_date').val(''); + PosnicPro.quotes._loadTaxList(function () { PosnicPro.invoices.edRender(); }); + PosnicPro.invoices.edRender(); + }, + showEdit: function (id) { + PosnicPro.get({ url: 'invoices/' + id, data: {} }, function (r) { + var inv = r && r.data; + if (!inv) { PosnicPro.alert('error', PosnicPro.i18n.t('lang_invoice_not_found', 'Invoice not found')); return; } + if (!PosnicPro.invoices._editable(inv)) { + PosnicPro.alert('warning', 'This invoice is ' + PosnicPro.invoices._label(inv.status).toLowerCase() + ' - it can no longer be edited.'); + hasher.setHash('invoices/' + id); + return; + } + var ed = PosnicPro.invoices._edBlank(); + ed.id = String(inv._id); + ed.invoice_id = inv.invoice_id || ''; + ed.customer_id = inv.customer_id ? String(inv.customer_id) : ''; + ed.lines = (inv.items || []).map(function (l) { + return { + kind: l.kind === 'custom' || !l.item_id ? 'custom' : 'item', + item_id: l.item_id ? String(l.item_id) : '', + item_name: l.item_name || '', + description: l.description || '', + barcode_id: l.barcode_id || '', + qty: Number(l.qty) || 1, + unit_price: Number(l.unit_price) || 0, + dtype: l.discount ? l.discount.type : '', + dval: l.discount ? l.discount.value : '', + tax_name: l.tax_name || '', + tax_value: Number(l.tax_value) || 0, + tax_type: l.tax_type || '' + }; + }); + ed.charges = (inv.charges || []).map(function (c) { + return { name: c.name || '', type: c.type === 'amount' ? 'amount' : 'percent', value: Number(c.value) || 0, sign: Number(c.sign) === -1 ? -1 : 1 }; + }); + PosnicPro.invoices._ed = ed; + PosnicPro.invoices._edShell(); + PosnicPro.invoices._edClearForm(); + $('#ie_title').text('Edit ' + (inv.invoice_id || 'invoice')); + $('#ie_cust_name').val(inv.customer_name || ''); + $('#ie_cust_phone').val(inv.customer_phone || ''); + $('#ie_cust_email').val(inv.customer_email || ''); + $('#ie_cust_gstin').val(inv.customer_gstin || ''); + $('#ie_cust_address').val(inv.customer_address || ''); + $('#ie_payment').val(inv.payment_method || ''); + $('#ie_bank').val(inv.bank_details || ''); + $('#ie_terms').val(inv.terms || ''); + $('#ie_notes').val(inv.notes || ''); + $('#ie_reference').val(inv.reference || ''); + $('#ie_disc_type').val(inv.discount ? inv.discount.type : ''); + $('#ie_disc_value').val(inv.discount ? inv.discount.value : ''); + $('#ie_due_date').val(PosnicPro.invoices._iso(inv.due_date)); + PosnicPro.quotes._loadTaxList(function () { PosnicPro.invoices.edRender(); }); + PosnicPro.invoices.edRender(); + }, function () { PosnicPro.alert('error', PosnicPro.i18n.t('lang_could_not_load_the_invoice', 'Could not load the invoice')); }); + }, + edRender: function () { + var ed = PosnicPro.invoices._ed; + if (!ed) { return; } + var esc = PosnicPro.invoices._esc; + var html = ''; + ed.lines.forEach(function (l, i) { + html += '<tr data-i="' + i + '">' + + '<td><span class="qe-l-grip" title="Drag to reorder" data-t-title="lang_drag_to_reorder">☰</span>' + + '<input type="text" class="qe-l-name form-control form-control-sm" maxlength="200" placeholder="' + (l.kind === 'custom' ? PosnicPro.i18n.t('lang_custom_line_name', 'Custom line name') : PosnicPro.i18n.t('lang_newitem_title', 'Item')) + '" value="' + esc(l.item_name) + '">' + + '<input type="text" class="qe-l-desc form-control form-control-sm mt-1" maxlength="500" placeholder="Description (optional)" data-t-placeholder="lang_description_optional" value="' + esc(l.description) + '">' + + (l.kind === 'custom' + ? '<select class="qe-l-taxsel form-control form-control-sm mt-1" style="max-width:170px;">' + + '<option value="" data-t="lang_no_tax">No tax</option>' + + ((PosnicPro.quotes._taxList || []).map(function (t) { + var sel = Number(l.tax_value) > 0 && String(l.tax_name) === String(t.tax_name) ? ' selected' : ''; + return '<option value="' + esc(t.tax_value) + '" data-name="' + esc(t.tax_name) + '"' + sel + '>' + + esc(t.tax_name) + ' (' + esc(t.tax_value) + '%)</option>'; + }).join('')) + + '</select>' + : '') + + (Number(l.tax_value) > 0 + ? '<div class="qe-l-tax">' + PosnicPro.quotes._taxNote(l) + ' ' + + (l.kind === 'custom' + ? '<a href="javascript:void(0)" class="qe-l-taxflip">' + (l.tax_type === 'exclusive' ? 'added on top' : 'included') + '</a>' + : (l.tax_type === 'exclusive' ? 'added on top' : 'included')) + + '</div>' + : '') + + '</td>' + + '<td><input type="number" class="qe-l-qty form-control form-control-sm" min="0" step="any" value="' + esc(l.qty) + '"></td>' + + '<td><input type="number" class="qe-l-price form-control form-control-sm" min="0" step="0.01" value="' + esc(l.unit_price) + '"></td>' + + '<td><div class="input-group input-group-sm" style="min-width:150px;">' + + '<select class="qe-l-dtype form-control" style="max-width:64px;"><option value=""' + (!l.dtype ? ' selected' : '') + '>-</option>' + + '<option value="percent"' + (l.dtype === 'percent' ? ' selected' : '') + '>%</option>' + + '<option value="amount"' + (l.dtype === 'amount' ? ' selected' : '') + '>amt</option></select>' + + '<input type="number" class="qe-l-dval form-control" min="0" step="0.01" value="' + esc(l.dval) + '"></div></td>' + + '<td class="text-right qe-l-total" style="white-space:nowrap; padding-top:12px;">' + PosnicPro.quotes._edLineTotal(l).toFixed(2) + '</td>' + + '<td><button type="button" class="btn qe-l-del" title="Remove line" data-t-title="lang_remove_line">×</button></td>' + + '</tr>'; + }); + $('#ie_lines').html(html || '<tr><td colspan="6" class="text-center text-muted"><lang class="lang_search_an_item_above_or_add_a_custom_line">Search an item above, or add a custom line.</lang></td></tr>'); + var chtml = ''; + ed.charges.forEach(function (c, i) { + chtml += '<div class="input-group input-group-sm mb-1 qe-charge" data-i="' + i + '">' + + '<input type="text" class="qe-c-name form-control" maxlength="60" placeholder="e.g. CGST 9% / Freight / Installation" value="' + esc(c.name) + '">' + + '<select class="qe-c-type form-control" style="max-width:80px;"><option value="percent"' + (c.type === 'percent' ? ' selected' : '') + '>%</option>' + + '<option value="amount"' + (c.type === 'amount' ? ' selected' : '') + '>amt</option></select>' + + '<input type="number" class="qe-c-val form-control" style="max-width:100px;" min="0" step="0.01" value="' + esc(c.value) + '">' + + '<select class="qe-c-sign form-control" style="max-width:80px;"><option value="1"' + (c.sign !== -1 ? ' selected' : '') + '>add</option>' + + '<option value="-1"' + (c.sign === -1 ? ' selected' : '') + '>less</option></select>' + + '<span class="input-group-text qe-c-out">0.00</span>' + + '<div class="input-group-append"><button type="button" class="btn btn-outline-danger qe-c-del">×</button></div>' + + '</div>'; + }); + $('#ie_charges').html(chtml || '<div class="text-muted small mb-1"><lang class="lang_no_charges_yet_add_gst_freight_installatio">No charges yet - add GST, freight, installation, anything, under its own name.</lang></div>'); + PosnicPro.invoices.edRecalc(); + }, + /* The same arithmetic the server stores (document-math.computeTotals). */ + edRecalc: function () { + var ed = PosnicPro.invoices._ed; + if (!ed) { return 0; } + var r2 = PosnicPro.quotes._edR2; + var subtotal = 0; + var taxSum = 0; + ed.lines.forEach(function (l, i) { + var t = PosnicPro.quotes._edLineTotal(l); + subtotal += t; + taxSum += PosnicPro.quotes._edLineTax(l); + $('#ie_lines tr[data-i="' + i + '"] .qe-l-total').text(t.toFixed(2)); + }); + subtotal = r2(subtotal); + taxSum = r2(taxSum); + var dtype = $('#ie_disc_type').val(); + var dval = Number($('#ie_disc_value').val()); + var qdisc = 0; + if (dtype === 'percent' && dval > 0) { qdisc = r2((subtotal * Math.min(dval, 100)) / 100); } + if (dtype === 'amount' && dval > 0) { qdisc = r2(Math.min(dval, subtotal)); } + var base = r2(subtotal - qdisc); + var chargesSum = 0; + var chargeRows = []; + ed.charges.forEach(function (c, i) { + var computed = c.type === 'percent' ? r2((base * (Number(c.value) || 0)) / 100) : r2(Number(c.value) || 0); + chargesSum += (c.sign === -1 ? -1 : 1) * computed; + $('#ie_charges .qe-charge[data-i="' + i + '"] .qe-c-out').text((c.sign === -1 ? '-' : '') + computed.toFixed(2)); + if (c.name) { chargeRows.push({ name: c.name, sign: c.sign, computed: computed }); } + }); + chargesSum = r2(chargesSum); + var total = Math.max(0, r2(base + chargesSum)); + PosnicPro.invoices._edPreviewRender({ + subtotal: subtotal, taxSum: taxSum, qdisc: qdisc, dtype: dtype, dval: dval, + taxRows: PosnicPro.quotes._taxBreakup(ed.lines, PosnicPro.quotes._edLineTax), + chargeRows: chargeRows, total: total + }); + return total; + }, + /* The right-hand paper: the SAME sheet the customer gets, live. */ + _edPreviewRender: function (m) { + var ed = PosnicPro.invoices._ed; + if (!ed) { return; } + var esc = PosnicPro.invoices._esc; + var money = PosnicPro.invoices._money; + var taxLabel = PosnicPro.local.get('gst_action') === 'enable' ? PosnicPro.i18n.t('lang_gstin', 'GSTIN') : PosnicPro.i18n.t('lang_tax_id', 'Tax ID'); + var logo = PosnicPro.local.get('branchimage'); + var custName = $.trim($('#ie_cust_name').val()); + var due = $('#ie_due_date').val(); + var ref = $.trim($('#ie_reference').val()); + var h = '<div class="q-head">' + + '<div class="q-seller">' + + (logo && logo !== 'store.png' ? '<img loading="lazy" decoding="async" class="q-logo" src="' + esc(logo) + '" alt="">' : '') + + '<div class="q-shop">' + esc(PosnicPro.local.get('branchname') || '') + '</div>' + + (function () { + var real = PosnicPro.quotes._real; + var addr = real(PosnicPro.local.get('branchaddress')); + var ph = real(PosnicPro.local.get('branchphone')); + var gst = real(PosnicPro.local.get('branchgstin')); + return (addr ? '<div class="q-muted">' + esc(addr) + '</div>' : '') + + (ph ? '<div class="q-muted">' + esc(ph) + '</div>' : '') + + (gst ? '<div class="q-muted">' + taxLabel + ': ' + esc(gst) + '</div>' : ''); + })() + + '</div>' + + '<div class="q-title-block"><div class="q-doc-title"><lang class="lang_invoice">INVOICE</lang></div>' + + '<div class="q-num">' + esc(ed.invoice_id || 'New') + '</div>' + + (due ? '<div class="q-muted">Due: ' + esc(due.split('-').reverse().join('/')) + '</div>' : '<div class="q-muted"><lang class="lang_due_per_your_invoice_settings">Due: per your invoice settings</lang></div>') + + (ref ? '<div class="q-muted">Ref: ' + esc(ref) + '</div>' : '') + + '</div></div>' + + '<div class="q-billto"><div class="q-label"><lang class="lang_bill_to_2">Bill To</lang></div>' + + '<div class="q-cust">' + (esc(custName) || 'Walk-in customer') + '</div>' + + '<div class="q-muted">' + esc($.trim($('#ie_cust_address').val())) + '</div>' + + '<div class="q-muted">' + esc($.trim($('#ie_cust_phone').val())) + + ($.trim($('#ie_cust_gstin').val()) ? ' · ' + taxLabel + ': ' + esc($.trim($('#ie_cust_gstin').val())) : '') + '</div>' + + '</div>' + + '<table class="q-items"><thead><tr><th>#</th><th><lang class="lang_newitem_title">Item</lang></th><th class="text-right"><lang class="lang_qty_title">Qty</lang></th>' + + '<th class="text-right"><lang class="lang_price_title">Price</lang></th><th class="text-right"><lang class="lang_amount_title">Amount</lang></th></tr></thead><tbody>'; + ed.lines.forEach(function (l, i) { + var note = esc(l.description || ''); + if (l.dtype && Number(l.dval) > 0) { + note += (note ? ' · ' : '') + (l.dtype === 'percent' ? l.dval + '% off' : money(l.dval) + ' off'); + } + if (Number(l.tax_value) > 0) { + note += (note ? ' · ' : '') + PosnicPro.quotes._taxNote(l) + + (l.tax_type === 'exclusive' ? ' added' : ' incl.'); + } + h += '<tr><td>' + (i + 1) + '</td><td>' + (esc(l.item_name) || '<span class="text-muted">(unnamed)</span>') + + (note ? '<div class="q-muted" style="font-size:11px;">' + note + '</div>' : '') + '</td>' + + '<td class="text-right">' + esc(l.qty) + '</td>' + + '<td class="text-right">' + money(l.unit_price) + '</td>' + + '<td class="text-right">' + money(PosnicPro.quotes._edLineTotal(l)) + '</td></tr>'; + }); + h += '</tbody><tfoot>' + + '<tr class="q-sub"><td colspan="4" class="text-right"><lang class="lang_subtotal">Subtotal</lang></td><td class="text-right">' + money(m.subtotal) + '</td></tr>' + + (m.taxRows && m.taxRows.length + ? m.taxRows.map(function (t) { + return '<tr class="q-sub"><td colspan="4" class="text-right">' + esc(t.label) + '</td><td class="text-right">' + money(t.amount) + '</td></tr>'; + }).join('') + : (m.taxSum > 0 ? '<tr class="q-sub"><td colspan="4" class="text-right"><lang class="lang_module_tax">Tax</lang></td><td class="text-right">' + money(m.taxSum) + '</td></tr>' : '')) + + (m.qdisc > 0 ? '<tr class="q-sub"><td colspan="4" class="text-right">Discount' + (m.dtype === 'percent' ? ' (' + m.dval + '%)' : '') + '</td><td class="text-right">-' + money(m.qdisc) + '</td></tr>' : ''); + m.chargeRows.forEach(function (c) { + h += '<tr class="q-sub"><td colspan="4" class="text-right">' + esc(c.name) + '</td><td class="text-right">' + (c.sign === -1 ? '-' : '') + money(c.computed) + '</td></tr>'; + }); + h += '<tr class="q-grand"><th colspan="4" class="text-right"><lang class="lang_total">TOTAL</lang></th><th class="text-right">' + money(m.total) + '</th></tr>' + + '</tfoot></table>'; + var pay = $.trim($('#ie_payment').val()); + var bank = $.trim($('#ie_bank').val()); + var terms = $.trim($('#ie_terms').val()); + var notes = $.trim($('#ie_notes').val()); + if (pay || bank) { + h += '<div class="q-block m-t-10"><div class="q-label"><lang class="lang_payment_details_2">Payment details</lang></div>' + + (pay ? '<div>' + esc(pay) + '</div>' : '') + + (bank ? '<div class="q-muted">' + esc(bank) + '</div>' : '') + '</div>'; + } + if (terms) { h += '<div class="q-block m-t-10"><div class="q-label"><lang class="lang_terms_conditions">Terms & conditions</lang></div>' + esc(terms) + '</div>'; } + if (notes) { h += '<div class="q-block m-t-10"><div class="q-label"><lang class="lang_notes_title">Notes</lang></div>' + esc(notes) + '</div>'; } + var sig = PosnicPro.local.get('quotesignature'); + if (sig) { + h += '<div class="q-sign-img"><img loading="lazy" decoding="async" src="' + sig + '" alt="" style="max-height:40px; max-width:160px; display:block; margin:0 auto;"></div>' + + '<div class="q-sign"><lang class="lang_authorised_signatory">Authorised signatory</lang></div>'; + } + $('#ie_preview').html(h); + }, + edAddCustom: function () { + if (!PosnicPro.invoices._ed) { return; } + PosnicPro.invoices._ed.lines.push({ kind: 'custom', item_id: '', item_name: '', description: '', barcode_id: '', qty: 1, unit_price: 0, dtype: '', dval: '', tax_name: '', tax_value: 0, tax_type: '' }); + PosnicPro.invoices.edRender(); + $('#ie_lines tr:last .qe-l-name').focus(); + }, + edAddItem: function (itemId, seedName) { + PosnicPro.get('items/' + itemId, function (r) { + var d = (r && r.data) || {}; + if (!PosnicPro.invoices._ed) { return; } + PosnicPro.invoices._ed.lines.push({ + kind: 'item', item_id: String(itemId), + item_name: d.item_name || d.name || seedName || '', + description: '', + barcode_id: d.barcode_id || '', + qty: 1, unit_price: Number(d.selling_price) || 0, dtype: '', dval: '', + tax_name: d.tax_name || '', + tax_value: Number(d.tax !== undefined && d.tax !== null && d.tax !== '' ? d.tax : d.tax_value) || 0, + tax_type: String(d.tax_type || '').toLowerCase().indexOf('ex') === 0 ? 'exclusive' : 'inclusive' + }); + PosnicPro.invoices.edRender(); + }, function () { PosnicPro.alert('error', PosnicPro.i18n.t('lang_could_not_load_that_item', 'Could not load that item')); }); + }, + edAddCharge: function () { + if (!PosnicPro.invoices._ed) { return; } + PosnicPro.invoices._ed.charges.push({ name: '', type: 'percent', value: 0, sign: 1 }); + PosnicPro.invoices.edRender(); + $('#ie_charges .qe-charge:last .qe-c-name').focus(); + }, + edCancel: function () { + var ed = PosnicPro.invoices._ed || {}; + hasher.setHash(ed.id ? 'invoices/' + ed.id : 'invoices'); + }, + edSave: function () { + var ed = PosnicPro.invoices._ed; + if (!ed) { return; } + var lines = ed.lines.filter(function (l) { + return (String(l.item_name).trim() || l.item_id) && Number(l.qty) > 0; + }); + if (!lines.length) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_add_at_least_one_line_with_a_name_and_quan', 'Add at least one line with a name and quantity.')); return; } + var payload = { + lines: lines.map(function (l) { + var out = { + kind: l.kind, item_id: l.item_id || '', item_name: l.item_name, + description: l.description, barcode_id: l.barcode_id, + qty: Number(l.qty), unit_price: Number(l.unit_price) || 0, + tax_name: l.tax_name || '', tax_value: Number(l.tax_value) || 0, + tax_type: l.tax_type || '' + }; + if (l.dtype && Number(l.dval) > 0) { out.discount = { type: l.dtype, value: Number(l.dval) }; } + return out; + }), + charges: ed.charges.filter(function (c) { return String(c.name).trim() && Number(c.value) > 0; }), + customer_id: ed.customer_id || '', + customer_name: $.trim($('#ie_cust_name').val()), + customer_phone: $.trim($('#ie_cust_phone').val()), + customer_email: $.trim($('#ie_cust_email').val()), + customer_gstin: $.trim($('#ie_cust_gstin').val()), + customer_address: $.trim($('#ie_cust_address').val()), + payment_method: $.trim($('#ie_payment').val()), + bank_details: $.trim($('#ie_bank').val()), + terms: $.trim($('#ie_terms').val()), + notes: $.trim($('#ie_notes').val()), + reference: $.trim($('#ie_reference').val()), + due_date: $('#ie_due_date').val() || '', + total: PosnicPro.invoices.edRecalc() + }; + var dtype = $('#ie_disc_type').val(); + if (dtype && Number($('#ie_disc_value').val()) > 0) { + payload.discount = { type: dtype, value: Number($('#ie_disc_value').val()) }; + } + var done = function (r) { + PosnicPro.alert(r.type, r.message); + if (r.type === 'success') { + var id = ed.id || (r.data && r.data.id); + hasher.setHash(id ? 'invoices/' + id : 'invoices'); + } + }; + var fail = function (xhr) { + var resp = {}; try { resp = JSON.parse(xhr.responseText); } catch (e) { /* plain */ } + PosnicPro.alert('error', resp.message || 'Could not save the invoice'); + }; + if (ed.id) { + PosnicPro.request({ method: 'PUT', url: 'invoices/' + ed.id, data: JSON.stringify(payload) }, done, fail); + } else { + PosnicPro.post({ url: 'invoices', data: JSON.stringify(payload) }, done, fail); + } + }, + + /* -------------------------------------------------------------- list -- */ + _page: 1, + PAGE_SIZE: 20, + _seq: 0, + load: function (keepPage) { + if (!keepPage) { PosnicPro.invoices._page = 1; } + var mine = ++PosnicPro.invoices._seq; + var params = { page: PosnicPro.invoices._page, limit: PosnicPro.invoices.PAGE_SIZE }; + $.extend(params, PosnicPro.listFilter.params('invoices')); + var sort = PosnicPro.listSort.value('invoices'); + if (sort) { params.sort = sort; } + PosnicPro.get({ url: 'invoices', data: params }, function (r) { + if (mine !== PosnicPro.invoices._seq) { return; } + PosnicPro.invoices._rows = (r && r.data) || []; + PosnicPro.invoices._meta = (r && r.meta) || null; + PosnicPro.invoices.renderList(); + }, function () { + if (mine !== PosnicPro.invoices._seq) { return; } + $('#invoices_list_rows').text(PosnicPro.i18n.t('lang_could_not_load_invoices_try_again', 'Could not load invoices - try again.')); + }); + }, + /* What the shop is owed, in the chip strip: the two numbers this page + is opened for. Quiet when there is nothing owed. */ + loadSummary: function () { + PosnicPro.get({ url: 'invoices/summary', data: {} }, function (r) { + var s = (r && r.data) || {}; + var money = PosnicPro.invoices._money; + var out = ''; + if (s.owed_count > 0) { + out = s.owed_count + ' owed · ' + money(s.owed_total); + if (s.overdue_count > 0) { + out += ' · <span class="i-overdue">' + s.overdue_count + ' overdue · ' + money(s.overdue_total) + '</span>'; + } + } + $('#invoices_summary').html(out); + }, function () { $('#invoices_summary').html(''); }); + }, + renderList: function () { + var esc = PosnicPro.invoices._esc; + var rows = PosnicPro.invoices._rows || []; + var meta = PosnicPro.invoices._meta; + if (!rows.length) { + var searching = PosnicPro.listFilter.activeCount('invoices') > 0; + $('#invoices_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20">' + + (searching + ? 'No invoices match this filter.' + : 'No invoices here yet - press New, or Save as invoice on a sale, and it lands in this list.') + + '</div>'); + return; + } + var d = function (v) { return v ? new Date(v).toLocaleDateString('en-IN') : '-'; }; + var html = '<div class="table-responsive"><table class="table table-borderless">' + + '<thead><tr>' + + '<th><lang class="lang_invoice_2">Invoice #</lang></th><th><lang class="lang_newcustomer_title">Customer</lang></th><th class="i-col-date"><lang class="lang_date_title">Date</lang></th><th class="i-col-due"><lang class="lang_due">Due</lang></th>' + + '<th class="text-right"><lang class="lang_total_title">Total</lang></th><th class="text-right i-col-balance"><lang class="lang_balance">Balance</lang></th><th class="text-center"><lang class="lang_userstatus">Status</lang></th>' + + '</tr></thead><tbody>'; + rows.forEach(function (inv) { + /* a proforma is not a receivable: only issued invoices show a balance */ + var owed = inv.status === 'unpaid' || inv.status === 'partial'; + var balance = inv.balance !== undefined && inv.balance !== null ? Number(inv.balance) : Number(inv.total) || 0; + html += '<tr class="md-row invoices-row highlight-select" data-id="' + esc(inv._id) + '" style="cursor:pointer;">' + + '<td>' + esc(inv.invoice_id) + '</td>' + + '<td>' + esc(inv.customer_name || 'Walk-in') + '</td>' + + '<td class="i-col-date">' + d(inv.issue_date || inv.created_date) + '</td>' + + '<td class="i-col-due">' + (inv.is_overdue ? '<span class="i-overdue">' + d(inv.due_date) + '</span>' : d(inv.due_date)) + '</td>' + + '<td class="text-right">' + PosnicPro.invoices._money(inv.total) + '</td>' + + '<td class="text-right i-col-balance">' + (owed ? PosnicPro.invoices._money(balance) : '<span class="text-muted">-</span>') + '</td>' + + '<td class="text-center">' + PosnicPro.invoices._pill(inv) + '</td>' + + '</tr>'; + }); + html += '</tbody></table></div>'; + /* The pager, honest about what was measured (see quotes.renderList). */ + var cur = (meta && meta.page) || 1; + var lim = (meta && meta.limit) || rows.length || 1; + var total = meta && typeof meta.total === 'number' ? meta.total : null; + var pages = meta && meta.pages ? meta.pages : null; + var hasMore = meta ? !!meta.hasMore : false; + var arrow = function (to, label, off) { + return '<button type="button" class="btn btn-sm btn-secondary-rgba q-pg-btn"' + (off ? ' disabled' : '') + + ' onclick="PosnicPro.invoices._page = ' + to + '; PosnicPro.invoices.load(true);">' + label + '</button>'; + }; + var label; + if (total !== null) { + label = total + ' ' + (total === 1 ? PosnicPro.i18n.t('lang_invoice_4', 'invoice') : PosnicPro.i18n.t('lang_invoices', 'invoices')); + if (pages > 1) { label = 'Page ' + cur + ' of ' + pages + ' · ' + label; } + } else { + var first = (cur - 1) * lim + 1; + var last = (cur - 1) * lim + rows.length; + label = rows.length ? 'Showing ' + first + '–' + last : 'No matches'; + } + var showArrows = (pages && pages > 1) || cur > 1 || hasMore; + html += '<div class="q-pager">' + + (showArrows ? arrow(cur - 1, '«', cur <= 1) : '') + + '<span class="q-pg-count">' + label + '</span>' + + (showArrows ? arrow(cur + 1, '»', !hasMore) : '') + + '</div>'; + $('#invoices_list_rows').html(html); + if (PosnicPro.invoices._current && PosnicPro.invoices._current._id) { + $('#invoices_list_rows tr.invoices-row[data-id="' + PosnicPro.invoices._current._id + '"]').addClass('is-active'); + } + }, + + /* ---------------------------------------------------------- document -- */ + _inSplit: function () { + return $('#invoices_new').is(':visible') + && $('#invoices_view_card').is(':visible') + && !$('#invoices_edit_card').is(':visible') + && $('#invoices_new .contentbar').hasClass('invoices-split'); + }, + showDetails: function (id) { + /* Entering the page and moving between invoices are different + operations; only the first may touch the page chrome (the quotes + flicker, not repeated). */ + if (!PosnicPro.invoices._inSplit()) { + PosnicPro.HideSideBarModal(); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); + $('.page_loader,#osk-container').hide(); + $('.page-title-box,#invoices_new').show(); + $('#v-pills-dashboard-tab,#view_invoices_page').addClass('active'); + $('#v-pills-dashboard').addClass('show active'); + $('#invoices_edit_card').hide(); + $('#invoices_list_card').show(); + $('#invoices_new .contentbar').addClass('master-detail invoices-split'); + $('.vertical-layout').removeClass('toggle-menu'); + PosnicPro.invoices.load(); + PosnicPro.invoices.loadSummary(); + } + $('#invoices_pay_strip').hide(); + $('#invoices_list_rows tr.invoices-row').removeClass('is-active') + .filter('[data-id="' + id + '"]').addClass('is-active'); + PosnicPro.get({ url: 'invoices/' + id, data: {} }, function (r) { + var inv = r && r.data; + if (!inv) { PosnicPro.alert('error', PosnicPro.i18n.t('lang_invoice_not_found', 'Invoice not found')); return; } + PosnicPro.invoices._current = inv; + $('#invoices_list_rows tr.invoices-row').removeClass('is-active') + .filter('[data-id="' + String(inv._id) + '"]').addClass('is-active'); + $('#invoices_view_body').html(PosnicPro.invoices._sheet(inv)); + $('#invoices_view_actions').html('<div class="q-actions">' + PosnicPro.invoices._actions(inv) + '</div>'); + PosnicPro.ACLForModule('sales'); + $('#invoices_view_card').show(); + if (PosnicPro.invoices._editable(inv)) { PosnicPro.invoices._pvInitSort(); } + }, function () { PosnicPro.alert('error', PosnicPro.i18n.t('lang_could_not_load_the_invoice', 'Could not load the invoice')); }); + }, + /* The on-screen A4: seller and INVOICE block, bill-to, lines, totals, + what was paid and what is due, the sale it was recorded as, footer. */ + _sheet: function (inv) { + var esc = PosnicPro.invoices._esc; + var money = PosnicPro.invoices._money; + var d = PosnicPro.invoices._d; + var open = PosnicPro.invoices._editable(inv); + var booked = PosnicPro.invoices._booked(inv); + var taxLabel = PosnicPro.local.get('gst_action') === 'enable' ? PosnicPro.i18n.t('lang_gstin', 'GSTIN') : PosnicPro.i18n.t('lang_tax_id', 'Tax ID'); + var ed = function (f, val, ph) { + if (!open) { return esc(val) || '<span class="text-muted">-</span>'; } + return '<span class="q-edit" contenteditable="true" data-f="' + f + '" data-ph="' + ph + '">' + (esc(val) || '') + '</span>'; + }; + var stamp = PosnicPro.invoices._stamp(inv); + var logo = PosnicPro.local.get('branchimage'); + var body = '<div class="q-sheet">' + + '<div class="q-head">' + + '<div class="q-seller">' + + (logo && logo !== 'store.png' ? '<img loading="lazy" decoding="async" class="q-logo" src="' + esc(logo) + '" alt="">' : '') + + '<div class="q-shop">' + esc(PosnicPro.local.get('branchname') || '') + '</div>' + + (function () { + var real = PosnicPro.quotes._real; + var addr = real(PosnicPro.local.get('branchaddress')); + var ph = real(PosnicPro.local.get('branchphone')); + var em = real(PosnicPro.local.get('branchemail')); + var gst = real(PosnicPro.local.get('branchgstin')); + var out = ''; + if (addr) { out += '<div class="q-muted">' + esc(addr) + '</div>'; } + if (ph || em) { + out += '<div class="q-muted">' + esc(ph) + (ph && em ? ' · ' : '') + (em ? esc(em) : '') + '</div>'; + } + if (gst) { out += '<div class="q-muted">' + taxLabel + ': ' + esc(gst) + '</div>'; } + return out; + })() + + '</div>' + + '<div class="q-title-block">' + + '<div class="q-doc-title">' + PosnicPro.invoices._title(inv) + '</div>' + + '<div class="q-num">' + esc(inv.invoice_id) + '</div>' + + '<div class="q-muted">Date: ' + d(inv.issue_date || inv.created_date) + '</div>' + + '<div class="q-muted">Due: ' + ed('due_date', d(inv.due_date), 'dd/mm/yyyy') + '</div>' + + (open || inv.reference ? '<div class="q-muted">Ref: ' + ed('reference', inv.reference, 'customer PO / job no.') + '</div>' : '') + + (inv.source_quote_number ? '<div class="q-muted">From quote ' + esc(inv.source_quote_number) + '</div>' : '') + + (stamp ? '<div class="q-status' + (inv.status === 'paid' ? ' is-paid' : '') + '">' + esc(stamp) + '</div>' : '') + + '</div>' + + '</div>' + + '<div class="q-billto"><div class="q-label"><lang class="lang_bill_to_2">Bill To</lang></div>' + + '<div class="q-cust">' + ed('customer_name', inv.customer_name || 'Walk-in customer', 'Customer name') + '</div>' + + '<div class="q-muted">' + ed('customer_address', inv.customer_address, 'Address') + '</div>' + + '<div class="q-muted">Phone: ' + ed('customer_phone', inv.customer_phone, 'phone') + + ' · ' + taxLabel + ': ' + ed('customer_gstin', inv.customer_gstin, taxLabel) + '</div>' + + '<div class="q-muted">Email: ' + ed('customer_email', inv.customer_email, 'email') + '</div>' + + '</div>' + + '<div class="table-responsive"><table class="q-items"><thead><tr>' + + '<th>#</th><th><lang class="lang_newitem_title">Item</lang></th><th class="text-right"><lang class="lang_qty_title">Qty</lang></th>' + + '<th class="text-right"><lang class="lang_unit_price">Unit price</lang></th><th class="text-right"><lang class="lang_amount_title">Amount</lang></th>' + + '</tr></thead><tbody>'; + (inv.items || []).forEach(function (l, i) { + var note = esc(l.description || ''); + if (l.discount && l.discount.value > 0) { + note += (note ? ' · ' : '') + (l.discount.type === 'percent' ? l.discount.value + '% off' : money(l.discount.value) + ' off'); + } + if (Number(l.tax_value) > 0) { + note += (note ? ' · ' : '') + PosnicPro.quotes._taxNote(l) + (l.tax_type === 'exclusive' ? ' added' : ' incl.'); + } + body += '<tr><td>' + (i + 1) + '</td><td>' + esc(l.item_name) + + (note ? '<div class="q-muted" style="font-size:11.5px;">' + note + '</div>' : '') + + '</td>' + + '<td class="text-right">' + esc(l.qty) + '</td>' + + '<td class="text-right">' + money(l.unit_price) + '</td>' + + '<td class="text-right">' + money(l.line_total) + '</td></tr>'; + }); + body += '</tbody><tfoot>' + + '<tr class="q-sub"><td colspan="4" class="text-right"><lang class="lang_subtotal">Subtotal</lang></td>' + + '<td class="text-right">' + money(inv.subtotal) + '</td></tr>' + + (inv.discount && inv.discount.computed > 0 + ? '<tr class="q-sub"><td colspan="4" class="text-right">Discount' + + (inv.discount.type === 'percent' ? ' (' + inv.discount.value + '%)' : '') + + '</td><td class="text-right">-' + money(inv.discount.computed) + '</td></tr>' + : '') + + (inv.charges || []).map(function (c) { + return '<tr class="q-sub"><td colspan="4" class="text-right">' + esc(c.name) + + '</td><td class="text-right">' + (c.sign === -1 ? '-' : '') + money(c.computed) + '</td></tr>'; + }).join('') + + (function () { + if (!(Number(inv.tax_total) > 0)) { return ''; } + var rows = PosnicPro.quotes._taxBreakup(inv.items, function (l) { return Number(l.tax_amount) || 0; }); + if (!rows.length) { rows = [{ label: PosnicPro.i18n.t('lang_module_tax', 'Tax'), amount: Number(inv.tax_total) }]; } + return rows.map(function (t) { + return '<tr class="q-sub"><td colspan="4" class="text-right">' + esc(t.label) + '</td><td class="text-right">' + money(t.amount) + '</td></tr>'; + }).join(''); + })() + + '<tr class="q-grand"><th colspan="4" class="text-right"><lang class="lang_total">TOTAL</lang></th>' + + '<th class="text-right">' + money(inv.total) + '</th></tr>' + + (booked + ? '<tr class="q-sub"><td colspan="4" class="text-right"><lang class="lang_paid">Paid</lang></td><td class="text-right">' + money(inv.paid_amount) + '</td></tr>' + + '<tr class="q-grand"><th colspan="4" class="text-right"><lang class="lang_balance_due_2">BALANCE DUE</lang></th><th class="text-right">' + money(inv.balance) + '</th></tr>' + : '') + + '</tfoot></table></div>' + + (booked + ? '<div class="q-muted m-t-5">Issued as sale ' + esc(inv.sale_number || '') + (inv.issued_date ? ' on ' + d(inv.issued_date) : '') + + (Number(inv.sale_total) > 0 && Math.abs(Number(inv.sale_total) - Number(inv.total)) >= 0.01 + ? ' · booked at ' + money(inv.sale_total) + ' after round-off' : '') + + (inv.paid_date ? ' · paid ' + d(inv.paid_date) : '') + '</div>' + : '') + + (inv.status === 'cancelled' && inv.cancel_reason ? '<div class="q-muted m-t-5">Cancelled: ' + esc(inv.cancel_reason) + '</div>' : '') + + (function () { + var sections = { + payment: '<div class="q-label"><lang class="lang_payment_details_2">Payment details</lang></div>' + + '<div>' + ed('payment_method', inv.payment_method, 'e.g. Bank transfer / UPI / Cash') + '</div>' + + '<div class="q-muted">' + ed('bank_details', inv.bank_details, 'Account name, number, IFSC') + '</div>', + terms: '<div class="q-label"><lang class="lang_terms_conditions">Terms & conditions</lang></div>' + ed('terms', inv.terms, 'e.g. Payment within 30 days of the invoice date.'), + custom: (inv.custom_blocks || []).map(function (b) { + return '<div class="q-label">' + esc(b.title || '') + '</div><div class="mb-2">' + esc(b.text || '') + '</div>'; + }).join(''), + notes: inv.notes ? '<div class="q-label"><lang class="lang_notes_title">Notes</lang></div>' + esc(inv.notes) : '' + }; + var tokens = ['payment', 'terms', 'custom', 'notes']; + var order = []; + (inv.layout || []).forEach(function (t) { + if (tokens.indexOf(t) !== -1 && order.indexOf(t) === -1) { order.push(t); } + }); + tokens.forEach(function (t) { if (order.indexOf(t) === -1) { order.push(t); } }); + var out = '<div class="q-footer' + (open ? ' q-sortable' : '') + '" id="inv_footer_sort">'; + order.forEach(function (t) { + if (!sections[t]) { return; } + out += '<div class="q-block" data-tok="' + t + '">' + sections[t] + '</div>'; + }); + return out + '</div>'; + })() + + (PosnicPro.local.get('quotesignature') + ? '<div class="q-sign-img"><img loading="lazy" decoding="async" src="' + esc(PosnicPro.local.get('quotesignature')) + '" alt="" style="max-height:40px; max-width:160px; display:block; margin:0 auto;"></div>' + + '<div class="q-sign"><lang class="lang_authorised_signatory">Authorised signatory</lang></div>' + : '') + + '</div>'; + return body; + }, + /* The status word on the paper: nothing on a proforma (the title says + what it is), and OVERDUE beats UNPAID because it is the thing the + reader must act on. */ + _stamp: function (inv) { + if (inv.status === 'draft') { return ''; } + if (inv.status === 'paid') { return 'PAID'; } + if (inv.status === 'cancelled') { return 'CANCELLED'; } + if (inv.is_overdue) { return 'OVERDUE'; } + return inv.status === 'partial' ? PosnicPro.i18n.t('lang_partially_paid_3', 'PARTIALLY PAID') : PosnicPro.i18n.t('lang_unpaid_2', 'UNPAID'); + }, + /* One primary action per state (the quotes rule): Issue while it is a + proforma, Record payment while it is owed. Sending copies lives under + Share; state changes and destruction live under More. Record payment + is also offered on a draft - the customer paying IS the moment the + bill is real, and the server issues it on the way. */ + _actions: function (inv) { + var open = PosnicPro.invoices._editable(inv); + var booked = PosnicPro.invoices._booked(inv); + var owed = inv.status === 'unpaid' || inv.status === 'partial'; + var mi = function (call, label, cls, acc) { + return '<a class="dropdown-item' + (cls ? ' ' + cls : '') + + (acc ? '" data-module="sales" data-access="' + acc : '') + + '" href="javascript:void(0)" onclick="' + call + '">' + label + '</a>'; + }; + var menu = function (label, items, acc) { + return '<div class="btn-group"' + (acc ? ' data-module="sales" data-access="' + acc + '"' : '') + '>' + + '<button type="button" class="btn btn-sm btn-light border dropdown-toggle"' + + ' data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">' + label + '</button>' + + '<div class="dropdown-menu dropdown-menu-right">' + items + '</div>' + + '</div>'; + }; + var share = menu('Share', '' + + mi('PosnicPro.invoices.printNow();', 'Print') + + mi('PosnicPro.invoices.print();', 'Download PDF') + + mi('PosnicPro.invoices.emailInvoice();', 'Email') + + mi('PosnicPro.invoices.whatsappInvoice();', 'WhatsApp') + + mi('PosnicPro.invoices.shareLink();', 'Copy link')); + var moreItems = ''; + if (booked) { + moreItems += mi('PosnicPro.invoices.sync();', 'Refresh from sale', '', 'write') + + mi('hasher.setHash(\'sales/' + String(inv.sale_id) + '\');', 'Open sale ' + PosnicPro.invoices._esc(inv.sale_number || '')); + } + if (open) { + moreItems += mi('PosnicPro.invoices.cancel();', 'Cancel invoice', 'text-danger', 'write') + + mi('PosnicPro.invoices.remove();', 'Delete invoice', 'text-danger', 'delete'); + } + + var visible = ''; + if (open) { + visible += '<button type="button" class="btn btn-sm btn-light border" data-module="sales" data-access="write" onclick="hasher.setHash(\'invoices/' + + String(inv._id) + '/edit\');">Edit</button>' + + '<button type="button" class="btn btn-sm btn-primary" id="inv_save_edits" data-module="sales" data-access="write"' + + ' style="display:none;" onclick="PosnicPro.invoices.saveEdits();">Save changes</button>'; + } + visible += share; + if (moreItems) { visible += menu('More', moreItems, 'write||delete'); } + if (open) { + visible += '<button type="button" class="btn btn-sm btn-light border" data-module="sales" data-access="write" onclick="PosnicPro.invoices.payOpen();"><lang class="lang_record_payment">Record payment</lang></button>' + + '<button type="button" class="btn btn-sm btn-primary" data-module="sales" data-access="write" onclick="PosnicPro.invoices.issue();"><lang class="lang_issue_invoice">Issue invoice</lang></button>'; + } else if (owed) { + visible += '<button type="button" class="btn btn-sm btn-success" data-module="sales" data-access="write" onclick="PosnicPro.invoices.payOpen();"><lang class="lang_record_payment">Record payment</lang></button>'; + } + return visible; + }, + _pvSortable: null, + _pvInitSort: function () { + PosnicPro.lazy.load('sortable').then(function () { + if (!window.Sortable) { return; } + var el = document.getElementById('inv_footer_sort'); + if (!el) { return; } + if (PosnicPro.invoices._pvSortable) { + try { PosnicPro.invoices._pvSortable.destroy(); } catch (e) { /* stale */ } + PosnicPro.invoices._pvSortable = null; + } + PosnicPro.invoices._pvSortable = window.Sortable.create(el, { + handle: '.q-label', + animation: 120, + onEnd: function () { + var inv = PosnicPro.invoices._current; + if (!inv) { return; } + var order = []; + $('#inv_footer_sort .q-block').each(function () { order.push($(this).data('tok')); }); + inv.layout = ['billto', 'items', 'charges'].concat(order); + PosnicPro.invoices.saveEdits(); + } + }); + }).catch(function () { /* drag is a nicety */ }); + }, + /* Persist the sheet's inline edits - draft/sent only, the server enforces + the same rule. Lines, charges and discounts pass through unchanged. */ + saveEdits: function () { + var inv = PosnicPro.invoices._current; + if (!inv || !PosnicPro.invoices._editable(inv)) { return; } + var read = function (f) { return $.trim($('#invoices_view_body .q-edit[data-f="' + f + '"]').text() || ''); }; + var due = read('due_date'); + var m = due.match(/^(\d{1,2})[\/\-](\d{1,2})[\/\-](\d{4})$/); + var dueIso = m ? (m[3] + '-' + ('0' + m[2]).slice(-2) + '-' + ('0' + m[1]).slice(-2)) : PosnicPro.invoices._iso(inv.due_date); + var payload = { + items: (inv.items || []).map(function (l) { + return { + kind: l.kind, item_id: l.item_id ? String(l.item_id) : '', + item_name: l.item_name, description: l.description || '', + barcode_id: l.barcode_id, qty: l.qty, unit_price: l.unit_price, + tax_name: l.tax_name || '', tax_value: l.tax_value || 0, tax_type: l.tax_type || '', + discount: l.discount ? { type: l.discount.type, value: l.discount.value } : undefined + }; + }), + charges: (inv.charges || []).map(function (c) { return { name: c.name, type: c.type, value: c.value, sign: c.sign }; }), + discount: inv.discount ? { type: inv.discount.type, value: inv.discount.value } : undefined, + custom_blocks: inv.custom_blocks || [], + layout: inv.layout || undefined, + notes: inv.notes || '', + customer_id: inv.customer_id ? String(inv.customer_id) : '', + customer_name: read('customer_name'), + customer_address: read('customer_address'), + customer_phone: read('customer_phone'), + customer_gstin: read('customer_gstin'), + customer_email: read('customer_email'), + payment_method: read('payment_method'), + bank_details: read('bank_details'), + terms: read('terms'), + reference: read('reference'), + due_date: dueIso, + tax_total: inv.tax_total, + total: inv.total + }; + PosnicPro.request({ method: 'PUT', url: 'invoices/' + inv._id, data: JSON.stringify(payload) }, function (r) { + PosnicPro.alert(r.type, r.message); + if (r.type === 'success') { PosnicPro.invoices.showDetails(String(inv._id)); } + }, function (xhr) { + var resp = {}; try { resp = JSON.parse(xhr.responseText); } catch (e) { /* plain */ } + PosnicPro.alert('error', resp.message || 'Could not save the invoice'); + }); + }, + + /* --------------------------------------------------------------- PDF -- */ + _pdfMoney: function (n) { + return 'Rs ' + Number(n || 0).toLocaleString('en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 }); + }, + _dmy: function (v) { + if (!v) { return ''; } + var dt = new Date(v); + if (isNaN(dt)) { return ''; } + var p = function (x) { return (x < 10 ? '0' : '') + x; }; + return p(dt.getDate()) + '/' + p(dt.getMonth() + 1) + '/' + dt.getFullYear(); + }, + /* The quotation sheet, told it is an invoice: title, number, the head + lines (date, due, reference, sale), the stamp, and the paid/balance + rows under the total. */ + _pdfOpts: function (inv) { + var dmy = PosnicPro.invoices._dmy; + var booked = PosnicPro.invoices._booked(inv); + return { + title: PosnicPro.invoices._title(inv), + number: inv.invoice_id, + headLines: [ + 'Date: ' + dmy(inv.issue_date || inv.created_date), + inv.due_date ? 'Due: ' + dmy(inv.due_date) : '', + inv.reference ? 'Ref: ' + inv.reference : '', + inv.source_quote_number ? 'Quote: ' + inv.source_quote_number : '', + booked && inv.sale_number ? 'Sale: ' + inv.sale_number : '' + ].filter(Boolean), + stamp: PosnicPro.invoices._stamp(inv), + afterTotal: booked ? [ + { label: PosnicPro.i18n.t('lang_paid', 'Paid'), value: PosnicPro.invoices._pdfMoney(inv.paid_amount) }, + { label: PosnicPro.i18n.t('lang_balance_due_2', 'BALANCE DUE'), value: PosnicPro.invoices._pdfMoney(inv.balance), bold: true } + ] : [] + }; + }, + _withDoc: function (use) { + var inv = PosnicPro.invoices._current; + if (!inv) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_open_an_invoice_first', 'Open an invoice first.')); return; } + PosnicPro.lazy.load('jspdf').then(function () { + var C = (window.jspdf && typeof window.jspdf.jsPDF === 'function') ? window.jspdf.jsPDF + : (typeof window.jsPDF === 'function') ? window.jsPDF + : (typeof window.jspdf === 'function') ? window.jspdf : null; + if (!C) { PosnicPro.alert('error', PosnicPro.i18n.t('lang_pdf_tools_not_loaded_refresh_and_retry', 'PDF tools not loaded - refresh and retry.')); return; } + var src = PosnicPro.local.get('branchimage'); + var done = false; + var go = function (logo) { + if (done) { return; } + done = true; + use(PosnicPro.quotes._buildPdf(C, inv, PosnicPro.quotes._seller(), logo, PosnicPro.invoices._pdfOpts(inv))); + }; + if (!src || src === 'store.png') { go(null); return; } + var img = new Image(); + img.onload = function () { + try { + var cv = document.createElement('canvas'); + cv.width = img.naturalWidth; cv.height = img.naturalHeight; + cv.getContext('2d').drawImage(img, 0, 0); + go({ data: cv.toDataURL('image/png'), w: img.naturalWidth, h: img.naturalHeight }); + } catch (e) { go(null); } + }; + img.onerror = function () { go(null); }; + setTimeout(function () { go(null); }, 1500); + img.src = src; + }); + }, + printNow: function () { + PosnicPro.invoices._withDoc(function (doc) { + if (typeof doc.autoPrint === 'function') { doc.autoPrint(); } + var url = doc.output('bloburl'); + var w = window.open(url, '_blank'); + if (!w) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_allow_pop_ups_so_the_invoice_can_print', 'Allow pop-ups so the invoice can print.')); } + }); + }, + print: function () { + var inv = PosnicPro.invoices._current || {}; + PosnicPro.invoices._withDoc(function (doc) { + doc.save((inv.invoice_id || 'invoice').toLowerCase() + '.pdf'); + }); + }, + emailInvoice: function () { + var inv = PosnicPro.invoices._current || {}; + PosnicPro.reportExport.email('invoices_view_body', { + title: (inv.status === 'draft' ? PosnicPro.i18n.t('lang_proforma_invoice', 'Proforma invoice ') : PosnicPro.i18n.t('lang_invoice_3', 'Invoice ')) + (inv.invoice_id || ''), + filename: (inv.invoice_id || 'invoice').toLowerCase(), + to: inv.customer_email || '' + }, PosnicPro.invoices._withDoc); + }, + shareLink: function (then) { + var inv = PosnicPro.invoices._current; + if (!inv) { if (then) { then(null); } return; } + PosnicPro.invoices._withDoc(function (doc) { + var b64 = String(doc.output('datauristring')).split(',')[1] || ''; + PosnicPro.post({ + url: 'invoices/' + inv._id + '/share', + data: JSON.stringify({ pdf_base64: b64 }) + }, function (r) { + if (r.type !== 'success' || !r.data || !r.data.url) { + PosnicPro.alert(r.type === 'success' ? 'error' : r.type, r.message || 'Could not create the link'); + if (then) { then(null); } + return; + } + inv.share = { url: r.data.url, rev: r.data.rev }; + if (then) { then(r.data.url); return; } + var url = r.data.url; + var copied = function () { PosnicPro.alert('success', 'Link copied - paste it anywhere. ' + url); }; + if (navigator.clipboard && navigator.clipboard.writeText) { + navigator.clipboard.writeText(url).then(copied, function () { window.prompt('Copy the invoice link:', url); }); + } else { + window.prompt('Copy the invoice link:', url); + } + }, function (xhr) { + var resp = {}; try { resp = JSON.parse(xhr.responseText); } catch (e) { /* plain */ } + PosnicPro.alert('warning', resp.message || 'Could not create the link'); + if (then) { then(null); } + }); + }); + }, + whatsappInvoice: function () { + var inv = PosnicPro.invoices._current || {}; + var shop = PosnicPro.local.get('branchname') || 'Our shop'; + var openWa = function (msg) { window.open('https://wa.me/?text=' + encodeURIComponent(msg), '_blank'); }; + var owed = PosnicPro.invoices._booked(inv) ? Number(inv.balance || 0) : Number(inv.total || 0); + var head = (inv.status === 'draft' ? PosnicPro.i18n.t('lang_proforma_invoice', 'Proforma invoice ') : PosnicPro.i18n.t('lang_invoice_3', 'Invoice ')) + (inv.invoice_id || '') + ' from ' + shop + + '\nTotal: ' + Number(inv.total || 0).toFixed(2) + + (inv.status === 'paid' ? '\nPaid - thank you' : '\nBalance due: ' + owed.toFixed(2) + + (inv.due_date ? ' by ' + new Date(inv.due_date).toLocaleDateString('en-IN') : '')); + PosnicPro.invoices.shareLink(function (url) { + if (url) { + openWa(head + '\n\nView or download the invoice:\n' + url); + return; + } + openWa(head + '\n\nItems:\n' + (inv.items || []).map(function (l) { + return '- ' + l.item_name + ' x' + l.qty + ' = ' + Number(l.line_total || 0).toFixed(2); + }).join('\n')); + }); + }, + + /* --------------------------------------------------------- lifecycle -- */ + /* Issue: the proforma becomes the bill. The SERVER books the sale - stock + moves, tax is recorded, the numbers freeze - and the page shows what + it now owes. One confirmation, because it is the one step that cannot + be edited back. */ + issue: function () { + var inv = PosnicPro.invoices._current; + if (!inv) { return; } + if (!window.confirm('Issue invoice ' + (inv.invoice_id || '') + '? Stock and tax are recorded and the numbers are frozen.')) { return; } + PosnicPro.post({ url: 'invoices/' + inv._id + '/issue', data: '{}' }, function (r) { + PosnicPro.alert(r.type, r.message); + if (r.type === 'success') { + PosnicPro.invoices.showDetails(String(inv._id)); + PosnicPro.invoices.load(true); + PosnicPro.invoices.loadSummary(); + } + }, function (xhr) { + var resp = {}; try { resp = JSON.parse(xhr.responseText); } catch (e) { /* plain */ } + PosnicPro.alert('error', resp.message || 'Could not issue the invoice'); + }); + }, + /* Re-read the sale: the mirror is written on every sale save, but a + shop that edited the sale on another till wants to see it now. */ + sync: function () { + var inv = PosnicPro.invoices._current; + if (!inv) { return; } + PosnicPro.post({ url: 'invoices/' + inv._id + '/transition', data: JSON.stringify({ action: 'sync' }) }, function (r) { + PosnicPro.alert(r.type, r.message); + if (r.type === 'success') { PosnicPro.invoices.showDetails(String(inv._id)); PosnicPro.invoices.loadSummary(); } + }); + }, + cancel: function () { + var inv = PosnicPro.invoices._current; + if (!inv) { return; } + var reason = window.prompt('Cancel invoice ' + (inv.invoice_id || '') + '? A short reason is kept on the document (optional).', ''); + if (reason === null) { return; } + PosnicPro.post({ url: 'invoices/' + inv._id + '/transition', data: JSON.stringify({ action: 'cancel', reason: reason }) }, function (r) { + PosnicPro.alert(r.type, r.message); + if (r.type === 'success') { PosnicPro.invoices.showDetails(String(inv._id)); PosnicPro.invoices.loadSummary(); } + }); + }, + remove: function () { + var inv = PosnicPro.invoices._current; + if (!inv) { return; } + if (!window.confirm('Delete invoice ' + (inv.invoice_id || '') + ' permanently? This cannot be undone.')) { return; } + PosnicPro.request({ method: 'DELETE', url: 'invoices/' + inv._id, data: '{}' }, function (r) { + PosnicPro.alert(r.type, r.message); + if (r.type === 'success') { hasher.setHash('invoices'); PosnicPro.invoices.showDataTablePage(); } + }, function () { PosnicPro.alert('error', PosnicPro.i18n.t('lang_could_not_delete_the_invoice', 'Could not delete the invoice')); }); + }, + /* Record payment: the strip asks how much (the balance, or less), how, + and with what reference; the sale behind the invoice is paid down and + the document follows. On a draft the server issues it first. */ + payOpen: function () { + var inv = PosnicPro.invoices._current; + if (!inv) { return; } + var due = PosnicPro.invoices._booked(inv) ? Number(inv.balance || 0) : Number(inv.total || 0); + $('#ie_pay_amount').val(due.toFixed(2)); + $('#ie_pay_balance').html(PosnicPro.invoices._money(due)); + $('#ie_pay_reference').val(''); + $('#invoices_pay_strip').show(); + $('#ie_pay_amount').focus().select(); + }, + payClose: function () { $('#invoices_pay_strip').hide(); }, + payConfirm: function () { + var inv = PosnicPro.invoices._current; + if (!inv) { return; } + var amount = parseFloat($('#ie_pay_amount').val()); + if (!(amount > 0)) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_enter_the_amount_received', 'Enter the amount received.')); return; } + var $btn = $('#ie_pay_confirm').prop('disabled', true); + PosnicPro.post({ + url: 'invoices/' + inv._id + '/payment', + data: JSON.stringify({ amount: amount, method: $('#ie_pay_method').val() || '', reference: $.trim($('#ie_pay_reference').val()) }) + }, function (r) { + $btn.prop('disabled', false); + PosnicPro.alert(r.type, r.message); + if (r.type === 'success') { + $('#invoices_pay_strip').hide(); + PosnicPro.invoices.showDetails(String(inv._id)); + PosnicPro.invoices.load(true); + PosnicPro.invoices.loadSummary(); + } + }, function (xhr) { + $btn.prop('disabled', false); + var resp = {}; try { resp = JSON.parse(xhr.responseText); } catch (e) { /* plain */ } + PosnicPro.alert('error', resp.message || 'Could not record the payment'); + }); + }, + /* From the quote page: the quote's numbers become an invoice, the quote + is stamped invoiced, and the new document opens. */ + fromQuote: function (quoteId) { + if (!quoteId) { return; } + PosnicPro.post({ url: 'invoices/from-quote/' + quoteId, data: '{}' }, function (r) { + PosnicPro.alert(r.type, r.message); + if (r.type === 'success' && r.data && r.data.id) { hasher.setHash('invoices/' + r.data.id); } + }, function (xhr) { + var resp = {}; try { resp = JSON.parse(xhr.responseText); } catch (e) { /* plain */ } + PosnicPro.alert('error', resp.message || 'Could not create the invoice'); + }); + }, + + /* --------------------------------------------- born on the sale screen -- */ + saveFromSale: function () { + try { + var lines = $('#sales_new_items_table tbody tr').map(function () { + var itemid = $(this).find(':nth-child(9)').text(); + if (!itemid) { return null; } + return { + item_id: $('#addSalesLineItemId_' + itemid).text(), + item_name: $('#addSalesLineItemName_' + itemid).text(), + barcode_id: $('#addSalesLineItemBarcodeId_' + itemid).text(), + qty: parseFloat($('#touchsale_item_qty' + itemid).val()) || 1, + unit_price: parseFloat(String($('#addSalesLineItemPrice_' + itemid).text()).replace(/,/g, '')) || 0 + }; + }).get().filter(Boolean); + if (!lines.length) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_add_at_least_one_item_then_save_the_invoic', 'Add at least one item, then save the invoice.')); return false; } + var payload = { + items: lines, + customer_id: $('#sales_new_customer_id').val() || '', + customer_name: $('#sales_new_customer_name').val() || '', + customer_phone: $('#sales_new_customer_phone').val() || '', + customer_address: $('#sales_new_customer_address').val() || '', + customer_gstin: $('#sales_new_customer_gst_number').val() || '', + total: parseFloat(String($('#grand_total').val() || '').replace(/,/g, '')) || 0 + }; + PosnicPro.post({ url: 'invoices', data: JSON.stringify(payload) }, function (r) { + if (r.type !== 'success') { PosnicPro.alert(r.type, r.message); return; } + PosnicPro.alert('success', 'Invoice ' + ((r.data && r.data.invoice_id) || '') + ' saved'); + // the invoice holds the lines now - the cart clears quietly; + // nothing is booked until the invoice is issued + PosnicPro.sales.clear.cartItems(false); + if (r.data && r.data.id) { hasher.setHash('invoices/' + r.data.id + '/edit'); } + }, function (xhr) { + var resp = {}; try { resp = JSON.parse(xhr.responseText); } catch (e) { /* plain */ } + PosnicPro.alert('error', resp.message || 'Could not save the invoice'); + }); + } catch (e) { + PosnicPro.alert('error', 'Invoice could not be built: ' + e.message); + } + return false; + } +}; + +/* The shared filter bar, mounted on first use (same rules as quotes). */ +PosnicPro.invoices.mountFilters = function () { + if (PosnicPro.invoices._filterMounted) { return; } + if (!$('#invoices_filter_panel').length) { return; } + PosnicPro.listFilter.mount({ + key: 'invoices', + container: '#invoices_filter_panel', + button: '#invoices_filter_btn', + searchPlaceholder: PosnicPro.i18n.t('lang_search_customer_or_invoice', 'Search customer or invoice #'), + dateField: PosnicPro.i18n.t('lang_created', 'Created'), + searchFields: [ + { value: 'all', label: PosnicPro.i18n.t('lang_all_fields', 'All fields') }, + { value: 'invoice_id', label: PosnicPro.i18n.t('lang_invoice_2', 'Invoice #') }, + { value: 'customer_name', label: PosnicPro.i18n.t('lang_newcustomer_title', 'Customer') } + ], + typeahead: 'customer', + typeaheadField: 'customer_name', + onChange: function (params, state) { + PosnicPro.invoices._paintChips((state.extra && state.extra.status) || ''); + PosnicPro.invoices.load(); + } + }); + PosnicPro.listSort.mount('invoices', { + options: [ + { v: 'due_asc', l: PosnicPro.i18n.t('lang_due_soonest_first', 'Due: soonest first'), i: 'clock' }, + { v: 'due_desc', l: PosnicPro.i18n.t('lang_due_latest_first', 'Due: latest first'), i: 'calendar' }, + { v: 'balance_desc', l: PosnicPro.i18n.t('lang_largest_balance_first', 'Largest balance first'), i: 'arrow-down' }, + { v: 'total_desc', l: PosnicPro.i18n.t('lang_highest_amount_first', 'Highest amount first'), i: 'arrow-down' }, + { v: 'total_asc', l: PosnicPro.i18n.t('lang_lowest_amount_first', 'Lowest amount first'), i: 'arrow-up' } + ], + onChange: function () { PosnicPro.invoices.load(); } + }); + PosnicPro.invoices._filterMounted = true; +}; +PosnicPro.invoices._paintChips = function (status) { + PosnicPro.invoices._status = status || ''; + var lit = $('.invoices-chip').filter(function () { + return String($(this).data('status') || '') === String(status || ''); + }).first(); + $('#invoices_status_dd').text(lit.length ? $.trim(lit.text()) : 'All'); +}; + +$(document).on('click', '#invoices_filter_btn', function () { + PosnicPro.invoices.mountFilters(); + PosnicPro.listFilter.toggle('invoices'); +}); +$(document).on('click', '.invoices-row', function () { + hasher.setHash('invoices/' + $(this).data('id')); +}); +$(document).on('click', '#invoices_view_close', function () { + hasher.setHash('invoices'); + PosnicPro.invoices.showDataTablePage(); +}); +$(document).on('input', '#invoices_view_body .q-edit', function () { + $('#inv_save_edits').show(); +}); +$(document).on('click', '#invoices_rail_toggle', function () { + $('#invoices_new .contentbar').toggleClass('rail-collapsed'); +}); +$(document).on('click', '.invoices-chip', function () { + PosnicPro.invoices.mountFilters(); + PosnicPro.listFilter.setExtra('invoices', 'status', $(this).data('status') || ''); +}); +$(document).on('click', '#ie_pay_confirm', function () { PosnicPro.invoices.payConfirm(); }); +$(document).on('click', '#ie_pay_cancel', function () { PosnicPro.invoices.payClose(); }); + +/* ---- Invoice editor wiring: state follows every keystroke ---- */ +$(document).on('input change', '#ie_lines input, #ie_lines select', function () { + var i = $(this).closest('tr').data('i'); + var ed = PosnicPro.invoices._ed; + if (!ed || !ed.lines[i]) { return; } + var l = ed.lines[i]; + var $t = $(this); + if ($t.hasClass('qe-l-name')) { l.item_name = $t.val(); } + else if ($t.hasClass('qe-l-desc')) { l.description = $t.val(); } + else if ($t.hasClass('qe-l-qty')) { l.qty = $t.val(); } + else if ($t.hasClass('qe-l-price')) { l.unit_price = $t.val(); } + else if ($t.hasClass('qe-l-dtype')) { l.dtype = $t.val(); } + else if ($t.hasClass('qe-l-dval')) { l.dval = $t.val(); } + PosnicPro.invoices.edRecalc(); +}); +$(document).on('change', '#ie_lines .qe-l-taxsel', function () { + var i = $(this).closest('tr').data('i'); + var ed = PosnicPro.invoices._ed; + if (!ed || !ed.lines[i]) { return; } + var $opt = $(this).find('option:selected'); + ed.lines[i].tax_value = Number($opt.val()) || 0; + ed.lines[i].tax_name = $opt.data('name') || ''; + if (!ed.lines[i].tax_type) { ed.lines[i].tax_type = 'inclusive'; } + if (!(Number($opt.val()) > 0)) { ed.lines[i].tax_type = ''; } + PosnicPro.invoices.edRender(); +}); +$(document).on('click', '#ie_lines .qe-l-taxflip', function () { + var i = $(this).closest('tr').data('i'); + var ed = PosnicPro.invoices._ed; + if (!ed || !ed.lines[i]) { return; } + ed.lines[i].tax_type = ed.lines[i].tax_type === 'exclusive' ? 'inclusive' : 'exclusive'; + PosnicPro.invoices.edRender(); +}); +$(document).on('click', '#ie_lines .qe-l-del', function () { + var i = $(this).closest('tr').data('i'); + if (PosnicPro.invoices._ed) { PosnicPro.invoices._ed.lines.splice(i, 1); PosnicPro.invoices.edRender(); } +}); +$(document).on('input change', '#ie_charges input, #ie_charges select', function () { + var i = $(this).closest('.qe-charge').data('i'); + var ed = PosnicPro.invoices._ed; + if (!ed || !ed.charges[i]) { return; } + var c = ed.charges[i]; + var $t = $(this); + if ($t.hasClass('qe-c-name')) { c.name = $t.val(); } + else if ($t.hasClass('qe-c-type')) { c.type = $t.val(); } + else if ($t.hasClass('qe-c-val')) { c.value = $t.val(); } + else if ($t.hasClass('qe-c-sign')) { c.sign = Number($t.val()); } + PosnicPro.invoices.edRecalc(); +}); +$(document).on('click', '#ie_charges .qe-c-del', function () { + var i = $(this).closest('.qe-charge').data('i'); + if (PosnicPro.invoices._ed) { PosnicPro.invoices._ed.charges.splice(i, 1); PosnicPro.invoices.edRender(); } +}); +$(document).on('click', '.ie-due-chip', function () { + var days = Number($(this).data('days')) || 0; + var dt = new Date(Date.now() + days * 86400000); + $('#ie_due_date').val(dt.toISOString().slice(0, 10)); + $('.ie-due-chip').removeClass('btn-primary').addClass('btn-secondary-rgba'); + $(this).removeClass('btn-secondary-rgba').addClass('btn-primary'); + PosnicPro.invoices.edRecalc(); +}); +$(document).on('input', '#ie_due_date', function () { + $('.ie-due-chip').removeClass('btn-primary').addClass('btn-secondary-rgba'); +}); +$(document).on('input change', '#ie_disc_type, #ie_disc_value, #ie_cust_name, #ie_cust_phone, #ie_cust_email, #ie_cust_gstin, #ie_cust_address, #ie_payment, #ie_bank, #ie_terms, #ie_notes, #ie_due_date, #ie_reference', function () { + PosnicPro.invoices.edRecalc(); +}); +$(function () { + if ($.fn.autocomplete) { + $('#ie_item_search').autocomplete({ + deferRequestBy: 120, + lookup: function (query, done) { + PosnicPro.get({ url: 'items/getOnlineItemsAjaxList', data: 'query=' + query + '&type=normal' }, function (response) { + var suggestions = []; + ((response && response.suggestions) || []).forEach(function (d) { + suggestions.push({ value: d.item_name || d.value || '', data: d }); + }); + done({ suggestions: suggestions }); + }); + }, + onSelect: function (s2) { + $('#ie_item_search').val(''); + var d = s2.data || {}; + var id = d.item_id || d.id; + if (id) { PosnicPro.invoices.edAddItem(String(id), d.item_name || d.name || s2.value || ''); } + }, + autoSelectFirst: true, + triggerSelectOnValidInput: false + }); + $('#ie_cust_search').autocomplete({ + deferRequestBy: 120, + lookup: function (query, done) { + PosnicPro.get({ url: 'customers/getCustomersAjaxList', data: 'query=' + query }, function (response) { + var suggestions = []; + ((response && response.suggestions) || []).forEach(function (d) { + suggestions.push({ value: d.name || '', data: d }); + }); + done({ suggestions: suggestions }); + }); + }, + onSelect: function (s2) { + var d = s2.data || {}; + $('#ie_cust_search').val(''); + if (PosnicPro.invoices._ed) { PosnicPro.invoices._ed.customer_id = String(d.id || ''); } + $('#ie_cust_name').val(d.name || ''); + $('#ie_cust_phone').val(d.phone || ''); + $('#ie_cust_email').val(d.email || ''); + $('#ie_cust_gstin').val(d.gst_number || ''); + $('#ie_cust_address').val(d.address || ''); + PosnicPro.invoices.edRecalc(); + }, + autoSelectFirst: true, + triggerSelectOnValidInput: false + }); + } + /* The Save-as-invoice button on the sale screen follows its feature + switch, live - the same gate the quote button uses. */ + var applyInvoicesGate = function () { + var on = PosnicPro.invoices._on(); + var $wrap = $('#saveInvoiceButton').closest('span[data-toggle="tooltip"]'); + try { $wrap.tooltip('hide'); } catch (e) { /* tooltip not initialised */ } + ($wrap.length ? $wrap : $('#saveInvoiceButton')).toggle(on); + $('#saveInvoiceButton').toggle(on); + }; + applyInvoicesGate(); + $(window).on('hashchange storage', applyInvoicesGate); +}); diff --git a/frontend/static/script/js/modules/js/items.js b/frontend/static/script/js/modules/js/items.js index e903aa540..06a2f279a 100644 --- a/frontend/static/script/js/modules/js/items.js +++ b/frontend/static/script/js/modules/js/items.js @@ -14,7 +14,7 @@ PosnicPro.items = { PosnicPro.items.renderModifierGroups([]); $('#item_discount').hide(); $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); - $(".vertical-layout").addClass("toggle-menu"); + PosnicPro.collapseMenuForWorkspace(); $(".vertical-menu li a").removeClass("active"); PosnicPro.showAddModal('item'); $('.page_loader,#osk-container').hide(); @@ -28,8 +28,9 @@ PosnicPro.items = { $('#item_upload_image_status').val('no'); // IC1c: a fresh entry starts with the essentials; the collapsed // sections open on demand (and always open on edit). - $('#item_details_collapse, #item_extras_collapse').collapse('hide'); + // Owner: these sections stay open - nothing on the form hides behind a click. PosnicPro.items.applyHardwareGates(); + PosnicPro.items.applyTaxGate(); PosnicPro.items.addItemButton(); $('#items_reset').show(); $('.items_edit_reset').hide(); @@ -59,7 +60,7 @@ PosnicPro.items = { $('#product_with_variant').prop('checked', false); $('#show_variant_fields').hide(); - $('#show_price_fields').show(); + $('#show_price_fields,#sku_card_col').show(); $("#load_price_fields").html(''); $("#show-hide-item-discount").show(); $('#item_variant_header').hide(); @@ -91,21 +92,139 @@ PosnicPro.items = { .map(function (t) { return t.trim(); }) .filter(function (t) { return t.length > 0; }); }, + /* + * Take the form to a tab, and put the cursor where it is wanted. + * + * A tabbed form can fail somewhere you cannot see: jQuery Validate focuses + * the first invalid field, and if that field is on a hidden pane the focus + * goes nowhere, the message renders off-screen, and Save looks like it did + * nothing at all. Switching to the pane first is what makes the error + * visible (owner ask). + */ + goToTab: function (paneId, focusSelector) { + var $link = $('#item_form_tabs .nav-link[data-tab-pane="' + paneId + '"]'); + if (!$link.length) { return; } + if (!$link.hasClass('active')) { $link.tab('show'); } + if (!focusSelector) { return; } + /* After the pane is shown, or the field is still display:none and the + browser refuses to focus it. */ + setTimeout(function () { + var $f = $(focusSelector).first(); + if (!$f.length) { return; } + var $target = $f.hasClass('select2-hidden-accessible') ? $f.next('.select2-container') : $f; + if ($target.is(':visible')) { $f.trigger('focus'); } + }, 160); + }, + + /* Which pane a field lives on, or nothing if it is not on one. */ + tabOf: function (el) { + var pane = $(el).closest('#item_form_tabs_content > .tab-pane'); + return pane.length ? pane.attr('id') : ''; + }, + + /* + * The tile this item will actually get, shown while it is being typed. + * + * The swatches sat unselected, so "no image" read as "no appearance". It was + * never true: an item saved without a chosen colour still gets one, because + * the save falls back to PosnicPro.autoTile(name) and persists it. + * + * NOT random, and that is the point. The colour is a hash of the item NAME, + * so the same item is the same colour on every till and after every restart. + * A sale grid is navigated by recognition - "the red one is Coke" - and a + * colour that changes between sessions is worse than no colour, because it + * teaches a habit and then breaks it. + */ + refreshTilePreview: function () { + var $box = $('#item_tile_preview'); + if (!$box.length) { return; } + + var chosenColor = $('#item_tile_color').val() || ''; + var chosenShape = $('#item_tile_shape').val() || ''; + var name = $.trim($('#items_name').val() || ''); + var auto = (typeof PosnicPro.autoTile === 'function') + ? PosnicPro.autoTile(name) + : { color: '', shape: 'rounded' }; + + var color = chosenColor || auto.color; + var shape = chosenShape || auto.shape; + var automatic = !chosenColor && !chosenShape; + + /* Nothing to preview before the item is named - the hash of an empty + string is a colour, but showing it invites picking it as if it meant + something. */ + if (!name) { $box.hide(); return; } + + var radius = shape === 'circle' ? '50%' : (shape === 'rounded' ? '10px' : '3px'); + var clip = shape === 'diamond' ? 'polygon(50% 0,100% 50%,50% 100%,0 50%)' : 'none'; + + $box.find('.tile-preview-swatch').css({ + background: color, + 'border-radius': radius, + 'clip-path': clip + }); + $box.find('.tile-preview-note').text( + automatic ? PosnicPro.i18n.t('lang_chosen_from_the_name_pick_a_colour_below_t', 'Chosen from the name - pick a colour below to change it') : PosnicPro.i18n.t('lang_your_choice', 'Your choice') + ); + $box.show(); + }, + + setTileShape: function (shape) { + $('#item_tile_shape').val(shape || ''); + $('#item_tile_shapes .tile-shape').removeClass('is-picked').filter(function () { + return ($(this).data('shape') || '') === (shape || ''); + }).addClass('is-picked'); + PosnicPro.items.refreshTilePreview(); + }, setTileColor: function (color) { $('#item_tile_color').val(color || ''); - $('#item_tile_swatches .tile-swatch').css('outline', 'none'); - $('#item_tile_swatches .tile-swatch').filter(function () { + $('#item_tile_swatches .tile-swatch').removeClass('is-picked').filter(function () { return ($(this).data('color') || '') === (color || ''); - }).css('outline', '3px solid #506fe4'); + }).addClass('is-picked'); + PosnicPro.items.refreshTilePreview(); }, /* Services (Q3): a service holds no stock - the stock-ish inputs step aside and the pricing unit select appears. The server forces track_inventory off regardless, so this is presentation only. */ applyServiceMode: function () { var isService = $('#item_is_service').is(':checked'); - $('#item_service_unit').attr('style', isService ? 'width:auto;' : 'width:auto; display:none !important;'); - $('#items_available_quantity, #items_reorder_point').closest('.col-md-6').toggle(!isService); + /* The whole style attribute is replaced, so it must not carry sizing any + more: the select sits in a flex row now and CSS owns its width. It + used to set width:auto here, which fought the row and left the unit + hanging off the checkbox label instead of lining up with the fields. + The !important is still needed to beat the markup's own inline hide. */ + $('#item_service_unit').attr('style', isService ? '' : 'display:none !important;'); + // a service holds no stock: opening qty and reorder vanish wherever + // their column lives (the old .col-md-6 anchor rotted silently) + $('#items_available_quantity, #items_reorder_point').closest('[class*="col-"]').toggle(!isService); $('#items_barcodes_alt, #items_purchase_unit, #items_conversion_factor').closest('.form-row').toggle(!isService); + /* + * A service cannot be a variant family, so the offer goes away. + * + * Not because priced tiers of a service are meaningless - "Haircut / + * Men", "Massage / 60 min" are perfectly real - but because the rows + * this form builds for a family are stock rows: SKU, barcode, opening + * quantity, units, shelf position. _sharedItemFields stamps + * item_kind:'service' onto every one of them, so the combination saves + * services carrying stock counts, which nothing downstream can mean. + * + * Offering a choice that produces contradictory data is worse than not + * offering it. Service tiers are worth building properly later, as + * priced options on ONE service rather than a family of stock records. + */ + $('#variant_mode_link').toggle(!isService); + if (isService && $('#product_with_variant').is(':checked')) { + /* Said out loud rather than silently reverted - anything already + typed into the variant rows is about to be cleared. */ + $('#product_without_variant').prop('checked', true).trigger('change'); + PosnicPro.alert('info', PosnicPro.i18n.t('lang_variants_are_for_stocked_products_this_is', 'Variants are for stocked products - this is now a single service')); + } + }, + /* A shop with tax switched off never sees the Tax card (owner ask). */ + applyTaxGate: function () { + var taxOff = PosnicPro.local.get('default_tax_enable_disable') === 'false' + && PosnicPro.local.get('gst_action') !== 'enable'; + $("input[name='hsntax_radio_value']").closest('.card').toggle(!taxOff); }, /* The weight-scale flag only means anything when the weight-machine hardware module is on - the sales side gates on the same setting. */ @@ -116,170 +235,424 @@ PosnicPro.items = { $('#item_weight_flag_wrap').toggle(weightOn); if (!weightOn) { $('#item_weight_machine_based').prop('checked', false); } }, + /* #/items/<id>: the dossier opens in the right pane - never a popup. */ showDetails: function (id) { - var loader = $(".loader-view-item"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.showViewModal('items'); - PosnicPro.items.viewItem(id); + var self = PosnicPro.items; + if (self._openDocId === String(id) && $('#items_detail_card').is(':visible')) { return; } + self._chrome(); + self.loadList(1); + self.openDoc(id); }, showBarcode: function (id) { PosnicPro.items.printLableView(id); }, + /* + * The shared filter bar, on the item list. + * + * The five controls this replaces (date range, field selector, search box, + * Apply, Clear) worked, but could not say a filter was ON: the panel closes + * and takes them with it, so a list narrowed to one category looks exactly + * like a shop with one category. The count on the button is visible whether + * the panel is open or not, which is the case that matters. + * + * It writes into data('filters') and calls the SAME itemsTable as before, + * rather than changing how the list loads. The endpoint keeps taking the + * blob it always took - see listFilter.legacyFilters, which builds the same + * regex PosnicPro.search built, so adopting the bar does not silently + * change which rows a shop's existing habits return. + * + * No Apply button on purpose. A filter you have to confirm is one you can + * forget to, and the debounce in the bar already stops a request per + * keystroke. + */ + mountFilters: function () { + if (!$('#items_filter_panel').length) { return; } + PosnicPro.listFilter.mount({ + key: 'items', + container: '#items_filter_panel', + button: '#items_filter_btn', + searchPlaceholder: PosnicPro.i18n.t('lang_search_name_sku_or_barcode', 'Search name, SKU or barcode'), + dateField: PosnicPro.i18n.t('lang_updated', 'Updated'), + searchFields: [ + { value: 'all', label: PosnicPro.i18n.t('lang_all_fields', 'All fields') }, + { value: 'name', label: PosnicPro.i18n.t('lang_name_title', 'Name') }, + { value: 'category_name', label: PosnicPro.i18n.t('lang_newcategory_title', 'Category') }, + { value: 'itemid', label: PosnicPro.i18n.t('lang_sku_title', 'SKU') }, + { value: 'barcode_id', label: PosnicPro.i18n.t('lang_barcode_title', 'Barcode') } + ], + onChange: function () { PosnicPro.items.loadList(1); } + }); + PosnicPro.listSort.mount('items', { + options: [ + { v: 'recent', l: PosnicPro.i18n.t('lang_recently_updated', 'Recently updated'), i: 'clock' }, + { v: 'margin_desc', l: PosnicPro.i18n.t('lang_high_margin_first', 'High margin first'), i: 'trending-up' }, + { v: 'margin_asc', l: PosnicPro.i18n.t('lang_low_margin_first', 'Low margin first'), i: 'trending-down' }, + { v: 'stock_asc', l: PosnicPro.i18n.t('lang_low_stock_first', 'Low stock first'), i: 'alert-triangle' }, + { v: 'price_desc', l: PosnicPro.i18n.t('lang_price_high_to_low', 'Price: high to low'), i: 'arrow-down' }, + { v: 'price_asc', l: PosnicPro.i18n.t('lang_price_low_to_high', 'Price: low to high'), i: 'arrow-up' }, + { v: 'cost_desc', l: PosnicPro.i18n.t('lang_cost_high_to_low', 'Cost: high to low'), i: 'arrow-down' }, + { v: 'name', l: PosnicPro.i18n.t('lang_name_a_to_z', 'Name A to Z'), i: 'type' } + ], + onChange: function () { PosnicPro.items.loadList(1); } + }); + }, + + _page: 1, + PAGE_SIZE: 25, + _lastRows: [], + _openDocId: null, + /* The name the OLD table machinery answered to. Save flows (bulk price, + stock adjust, bulk stock, save-from-receiving) and the shared + clearListFilters/refresh doors still call <module>Table - without the + alias every one of them throws after a successful save. */ itemsTable: function () { - // A fresh page/search/refresh ends any "select all N" - the set behind - // the list has changed, so the old whole-set selection no longer holds. - PosnicPro.clearSelectAllMatching('items'); - var loader = $(".loader-table-item"); - $("<div class='loadingSpinner'></div>").appendTo(loader); - PosnicPro.appendViewDataTableBody('items'); - var table = $('#view_items'); - var params = { + PosnicPro.items.loadList(1); + }, + loadList: function (page) { + PosnicPro.items.mountFilters(); + var self = PosnicPro.items; + if (page) { self._page = page; } + var filters = PosnicPro.listFilter.legacyFilters('items', { dateKey: 'updated_date' }); + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + PosnicPro.get({ url: 'items', - data: { - page: table.data('current_page'), - limit: parseInt($('#view_items_per_page option:selected').text()), - filters: table.data('filters') + data: (function () { + var d = { page: self._page, limit: self.PAGE_SIZE, filters: JSON.stringify(filters) }; + var sv = PosnicPro.listSort.value('items'); + if (sv) { d.sort = sv; } + return d; + }()) + }, function (response) { + var data = (response && response.data) || {}; + var list = data.list || []; + self._lastRows = list; + if (!list.length) { + var filtered = PosnicPro.listFilter.activeCount('items') > 0; + $('#items_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20">' + + (filtered ? PosnicPro.i18n.t('lang_no_items_match_this_filter', 'No items match this filter.') : PosnicPro.i18n.t('lang_no_items_yet_press_new_to_add_the_first', 'No items yet - press New to add the first.')) + '</div>'); + $('#items_list_paging').html(''); + return; } - }; - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - table.data('total', response.data.total); - table.data('total_pages', response.data.total_pages); - table.data('current_page', response.data.current_page); - table.data('per_page', response.data.per_page); - PosnicPro.paging(response.data.total_pages, response.data.current_page); - table.children('tbody').text(''); - $('#view_items_total').text(response.data.total); - - var rowTotal = response.data.total; - if (rowTotal === 0) { - $('.item_header').hide(); - $('#item_img_hide').show(); - - } else { - $('#item_img_hide').hide(); - $('.item_header').show(); - } - - var row_total = (table.data('current_page') - 1) * table.data('per_page') + 1; - $('#view_items_page_total').text(row_total); - var page_totals = (table.data('current_page') - 1) * table.data('per_page'); - $('#view_items_page_perpage_total').text(page_totals + response.data.list.length); - var currency = PosnicPro.local.get('currencySign'); - for (var i = 0; i < response.data.list.length; i++) { - var row = response.data.list[i]; - var row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; - if (row.barcode_id === undefined || row.barcode_id === '') { - var lableicon = '<span id="show_label_icon" style="display:none;"></span>'; - $('#show_label_icon').hide(); - } else { - $('#show_label_icon').show(); - var lableicon = '<a data-module = "item" data-access = "write" href="#/items/' + row._id + '/barcode" data-id="items/' + row._id + '/barcode" data-toggle="tooltip" title="Barcode Item" class="point-cursor mobile_tooltip"><i class="feather icon-align-justify"></i></a>'; - } - - let image_path = (row.image && row.image !== "item.svg") ? row.image : 'static/images/default/item.svg'; - let process_class = ''; - let edit_icon = '<a data-module = "item" data-access = "write" href="#/items/' + row._id + '/edit" data-id="items/' + row._id + '/edit" data-toggle="tooltip" title="Edit Item" class="point-cursor mobile_tooltip"><i class="feather icon-edit"></i></a>'; - if (row.item_status === 'instant') { - process_class = "badge badge-warning-inverse"; - edit_icon = '<span id="item_show_edit_icon" style="display:none;"></span>'; - } else { - process_class = "badge badge-success-inverse"; - } - let item_unit = (typeof (row.unit) != "undefined" && row.unit !== null) ? row.unit : "qty"; - let action = '<div id="onclick-toolbar-options_' + i + '" class="hidden">' + - '<span id="show_label_icon" style="display:none;">' + lableicon + ' </span>' + - '<a data-module = "item" data-access = "write" href="#/items/' + row._id + '/clone" data-id="items/' + row._id + '/clone" data-toggle="tooltip" title="Clone" class="point-cursor mobile_tooltip"><i class="feather icon-external-link"></i></a>' + - '<a data-module = "item" data-access = "read" href="#/items/' + row._id + '" data-id="items/' + row._id + '" data-toggle="tooltip" title="View Item" class="point-cursor mobile_tooltip"><i class="feather icon-eye"></i></a>' + - '<span id="item_show_edit_icon" style="display:none;">' + edit_icon + ' </span>' + - '<a data-module = "item" data-access = "delete" href="#/items/' + row._id + '/delete" data-id="items/' + row._id + '/delete" data-toggle="tooltip" title="Delete Item" class="point-cursor mobile_tooltip"><i class="feather icon-trash"></i></a>' + - '</div>' + - '<div data-toolbar="user-options" class="btn btn-round btn-primary-rgba round-pad" id="onclick-toolbar_' + i + '"><i class="feather icon-more-vertical-"></i></div>'; - let isChecked = row.isAvailable ? 'checked' : ''; - let kioskToggle = '<label class="switch">' + - '<input type="checkbox" id="kiosk_' + row._id + '" class="kiosk-toggle" ' + isChecked + '>' + - '<span class="slider round"></span>' + - '</label>'; - var trow = '<tr> <th><input type="checkbox" class="items-row-id" id="' + row._id + '" name="id[]" value="' + row._id + '" onclick="PosnicPro.checkboxSelectOne(this,\'items\');"></th> <th scope="row">' + row_no + '</th> <td width="30%"><a href="#/items/' + row._id + '"><i class="table_model_item">' + row.name + '</i></a></td> <td><img src=' + image_path + ' width=30 height=20 class="imagezoom" id="' + row.image + '" onerror="this.onerror=null;this.src=\'static/images/default/item.svg\';" onclick="PosnicPro.viewImage(this.id,\'item\');"></td> <td class="text-center">' + row.itemid + '</td> <td class="text-right">' + row.available_quantity + ' ' + item_unit + '</td> <td class="text-center"><span class="' + process_class + '">' + row.item_status + '</span></td> <td class="text-right">' + currency + ' <span class="number">' + row.selling_price + '</span></td> ' + - '<td class="text-center kiosk-column">' + kioskToggle + '</td>' + '<td class="text-center"><span>' + action + ' </span></td></tr>'; - - $('#view_items').children('tbody').append(trow); - } - - /* - * The Kiosk column, only where there is a kiosk. - * - * A shop that has not set up Kiosk Settings has no use for a - * per-item kiosk toggle: the switch would do nothing anybody - * could see, while taking space from Quantity and Price on the - * page staff are in all day. - * - * The server decides - see isKioskConfigured in the items - * controller - because it is the only side that knows whether a - * store id has been entered without the Settings page having - * been opened first. - */ - if (response.data.kiosk_configured) { - $('.kiosk-column').show(); + var cur = PosnicPro.local.get('currencySign'); + var html = '<div class="table-responsive"><table class="table table-borderless">' + + '<thead><tr><th style="width:44px;"></th><th><lang class="lang_name_title">Name</lang></th><th class="i-col-sku"><lang class="lang_sku_title">SKU</lang></th>' + + '<th class="i-col-category"><lang class="lang_newcategory_title">Category</lang></th><th class="i-col-supplier"><lang class="lang_newsupplier_title">Supplier</lang></th>' + + '<th class="text-right"><lang class="lang_stock">Stock</lang></th>' + + '<th class="text-right i-col-cost"><lang class="lang_companyamount_title">Cost</lang></th>' + + '<th class="text-right i-col-price"><lang class="lang_price_title">Price</lang></th>' + + '<th class="text-right i-col-margin"><lang class="lang_margin">Margin</lang></th>' + + '<th class="text-right i-col-tax"><lang class="lang_module_tax">Tax</lang></th>' + + '<th class="text-center kiosk-column"><lang class="lang_module_kiosk">Kiosk</lang></th></tr></thead><tbody>'; + list.forEach(function (r) { + var unit = r.unit || 'qty'; + var thumb; + var tile = PosnicPro.resolveTile ? PosnicPro.resolveTile(r) : { color: r.tile_color, shape: r.tile_shape }; + if ((!r.image || r.image === 'item.svg') && tile.color) { + var shape = tile.shape === 'circle' ? 'border-radius:50%;' : 'border-radius:6px;'; + thumb = '<span style="display:inline-flex;width:32px;height:32px;' + shape + + 'background:' + esc(tile.color) + ';color:#fff;font-weight:700;font-size:13px;align-items:center;justify-content:center;">' + + esc(String(r.name || '?').trim().charAt(0).toUpperCase()) + '</span>'; } else { - $('.kiosk-column').hide(); + var img = (r.image && r.image !== 'item.svg') ? r.image : 'static/images/default/item.svg'; + thumb = '<img loading="lazy" decoding="async" src="' + esc(img) + '" width="32" height="32" style="object-fit:cover;border-radius:6px;"' + + " onerror=\"this.onerror=null;this.src='static/images/default/item.svg';\">"; } - - $('span.number').number(true, 2); - $(document).ready(function () { - for (var i = 0; i < response.data.list.length; i++) { - $('#onclick-toolbar_' + i).toolbar({ - content: '#onclick-toolbar-options_' + i, - event: 'click', - style: 'primary', - hideOnClick: true - }); - $('#onclick-toolbar_' + i).on('toolbarItemClick', function (event, element) { - hasher.setHash($(element).data('id')); - $(this).trigger('click'); - $('.mobile_tooltip').tooltip('hide'); - }); - } - }); - PosnicPro.setSelectedCheckbox(PosnicPro["items_checkbox"], 'items'); - PosnicPro.ACLForModule('item'); - loader.find(".loadingSpinner:first").remove(); + var tracked = r.track_inventory === true || r.track_inventory === 'true'; + var low = tracked && Number(r.available_quantity) <= Number(r.low_stock || 0); + var stockCell = tracked + ? (low ? '<span class="rs-pill unpaid">' : '<span>') + esc(r.available_quantity) + ' ' + esc(unit) + (low ? '</span>' : '</span>') + : '<span class="q-muted">-</span>'; + /* The margin the shop actually keeps on a unit - the number a + retailer scans a catalogue for. Blank when either price is + missing: a made-up 100% is worse than a dash. */ + var cost = Number(r.company_price) || 0; + var sell = Number(r.selling_price) || 0; + var marginCell = (cost > 0 && sell > 0) + ? (((sell - cost) / sell) * 100).toFixed(1) + '%' + : '-'; + var taxCell = (Number(r.tax) > 0) ? Number(r.tax) + '%' : '-'; + html += '<tr class="md-row items-row highlight-select' + (self._openDocId === String(r._id) ? ' is-active' : '') + '"' + + ' data-id="' + esc(r._id) + '" style="cursor:pointer;">' + + '<td>' + thumb + '</td>' + + '<td>' + esc(r.name) + '</td>' + + '<td class="i-col-sku">' + esc(r.itemid || '-') + '</td>' + + '<td class="i-col-category">' + esc(r.category_name || '-') + '</td>' + + '<td class="i-col-supplier">' + esc(r.supplier_name || '-') + '</td>' + + '<td class="text-right">' + stockCell + '</td>' + + '<td class="text-right i-col-cost q-muted">' + (cost > 0 ? cur + ' ' + cost.toFixed(2) : '-') + '</td>' + + '<td class="text-right i-col-price">' + cur + ' ' + sell.toFixed(2) + '</td>' + + '<td class="text-right i-col-margin">' + marginCell + '</td>' + + '<td class="text-right i-col-tax q-muted">' + taxCell + '</td>' + + '<td class="text-center kiosk-column"><input type="checkbox" id="kiosk_' + esc(r._id) + '" class="kiosk-toggle" aria-label="Show on kiosk" data-t-aria-label="lang_show_on_kiosk"' + (r.isAvailable ? ' checked' : '') + '></td>' + + '</tr>'; + }); + html += '</tbody></table></div>'; + $('#items_list_rows').html(html); + /* the Kiosk column shows only where a kiosk is configured */ + if (response.data.kiosk_configured) { + $('.kiosk-column').show(); } else { - PosnicPro.alert(response.type, response.message); + $('.kiosk-column').hide(); + } + self.renderPager(Number(data.total) || list.length); + }, function () { + $('#items_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20"><lang class="lang_could_not_load_items_try_again">Could not load items - try again.</lang></div>'); + }); + }, + renderPager: function (total) { + var self = PosnicPro.items; + var p = self._page, size = self.PAGE_SIZE; + var pages = Math.ceil(total / size) || 1; + var label = total + ' ' + (total === 1 ? PosnicPro.i18n.t('lang_item', 'item') : PosnicPro.i18n.t('lang_items', 'items')); + if (pages > 1) { label = 'Page ' + p + ' of ' + pages + ' \u00b7 ' + label; } + var btn = function (to, text, off, cls) { + return '<button type="button" class="btn btn-sm ' + (cls || 'btn-secondary-rgba') + ' q-pg-btn"' + (off ? ' disabled' : '') + + ' onclick="PosnicPro.items.goPage(' + to + ');">' + text + '</button>'; + }; + var html = ''; + if (pages > 1) { + html += btn(p - 1, '«', p <= 1); + var end = Math.min(pages, Math.max(1, p - 2) + 4); + var start = Math.max(1, end - 4); + for (var n = start; n <= end; n++) { + html += '<span class="q-pg-num">' + btn(n, n, false, n === p ? 'btn-primary-rgba' : 'btn-secondary-rgba') + '</span>'; + } + } + html += '<span class="q-pg-count">' + label + '</span>'; + if (pages > 1) { html += btn(p + 1, '»', p >= pages); } + $('#items_list_paging').html(html); + }, + goPage: function (n) { + if (!n || n < 1) { return; } + PosnicPro.items._page = n; + PosnicPro.items.loadList(); + }, + _csvSpec: function () { + return { + head: ['Name', 'SKU', 'Category', 'Stock', 'Unit', 'Selling price', 'Cost'], + map: function (r) { + return [r.name, r.itemid || '', r.category_name || '', r.available_quantity, r.unit || 'qty', r.selling_price, r.company_price || '']; + } + }; + }, + exportCsv: function () { + var spec = PosnicPro.items._csvSpec(); + PosnicPro.listExport.save( + [spec.head].concat((PosnicPro.items._lastRows || []).map(spec.map)), 'items.csv'); + }, + /* Everything matching the CURRENT filter, paged through the same + endpoint the list reads - never a shapeless full dump. */ + exportAllCsv: function () { + var spec = PosnicPro.items._csvSpec(); + PosnicPro.listExport.all({ + url: 'items', + params: function (page, limit) { + return (function () { var d = { page: page, limit: limit, filters: JSON.stringify(PosnicPro.listFilter.legacyFilters('items', { dateKey: 'updated_date' })) }; var sv = PosnicPro.listSort.value('items'); if (sv) { d.sort = sv; } return d; }()); + }, + head: spec.head, + map: spec.map, + filename: 'items.csv' + }); + }, + /* ---- the dossier pane ---- */ + openDoc: function (id) { + var self = PosnicPro.items; + if (!PosnicPro.masterDetail.inSplit('#items_split', 'items-split')) { + PosnicPro.masterDetail.enter('#items_split', 'items-split'); + $('#items_detail_card').show(); + } + self._openDocId = String(id); + $('#items_list_rows tr.items-row').removeClass('is-active'); + $('#items_list_rows tr.items-row[data-id="' + id + '"]').addClass('is-active'); + if (window.location.hash.slice(2) !== 'items/' + id) { + hasher.setHash('items/' + id); + } + $('#items_doc').html('<div class="text-center text-muted" style="padding:60px;"><lang class="lang_loading_4">Loading ...</lang></div>'); + PosnicPro.get('items/' + id, function (response) { + if (response.type !== 'success') { + $('#items_doc').html('<div class="text-danger p-4"><lang class="lang_could_not_open_this_item">Could not open this item.</lang></div>'); + return; + } + PosnicPro.items.renderItemDoc(response.data); + }, function () { + $('#items_doc').html('<div class="text-danger p-4"><lang class="lang_could_not_open_this_item">Could not open this item.</lang></div>'); + }); + }, + closeDoc: function () { + PosnicPro.items._openDocId = null; + $('#items_detail_card').hide(); + $('#items_list_rows tr.items-row').removeClass('is-active'); + PosnicPro.masterDetail.leave('#items_split', 'items-split'); + if (window.location.hash.slice(2).indexOf('items/') === 0) { + hasher.setHash('items'); + } + }, + renderItemDoc: function (d) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var real = function (v) { return v && v !== 'null' && v !== 'undefined' ? v : ''; }; + var cur = PosnicPro.local.get('currencySign'); + var id = String(d._id || PosnicPro.items._openDocId); + var sell = Number(d.selling_price) || 0; + var cost = Number(d.company_price) || 0; + var margin = sell > 0 && cost > 0 ? ((sell - cost) / sell) * 100 : null; + var tracked = d.track_inventory === true || d.track_inventory === 'true'; + var low = tracked && Number(d.available_quantity) <= Number(d.low_stock || 0); + var toolbar = '<div class="p-doc-toolbar">' + + '<button type="button" class="btn btn-sm btn-light" title="Show or hide the list" data-t-title="lang_show_or_hide_the_list" aria-label="Show or hide the list" data-t-aria-label="lang_show_or_hide_the_list" onclick="PosnicPro.masterDetail.toggleRail(\'#items_split\');"><i class="feather icon-sidebar"></i></button>' + + '<span class="p-doc-title">' + esc(d.name) + '</span>' + + (low ? '<span class="rs-pill unpaid"><lang class="lang_low_stock">Low stock</lang></span>' : '') + + '<span class="ml-auto"></span>' + + '<button type="button" class="btn btn-sm btn-light" data-module="item" data-access="write" onclick="hasher.setHash(\'items/' + esc(id) + '/edit\');"><i class="feather icon-edit-2 mr-1"></i>Edit</button>' + + '<div class="btn-group">' + + '<button type="button" class="btn btn-sm btn-light dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"><lang class="lang_tab_more">More</lang></button>' + + '<div class="dropdown-menu dropdown-menu-right">' + + '<a class="dropdown-item" data-module="item" data-access="write" href="javascript:void(0)" onclick="hasher.setHash(\'items/' + esc(id) + '/clone\');"><i class="feather icon-copy mr-2"></i>Clone</a>' + + (real(d.barcode_id) ? '<a class="dropdown-item" href="javascript:void(0)" onclick="hasher.setHash(\'items/' + esc(id) + '/barcode\');"><i class="feather icon-align-justify mr-2"></i>Barcode labels</a>' : '') + + '<div class="dropdown-divider"></div>' + + '<a class="dropdown-item text-danger" data-module="item" data-access="delete" href="javascript:void(0)" onclick="PosnicPro.items.deleteAsk();"><i class="feather icon-trash mr-2"></i>Delete</a>' + + '</div></div>' + + '<button type="button" class="btn btn-sm btn-light" title="Close and show the full list" data-t-title="lang_close_and_show_the_full_list" aria-label="Close" data-t-aria-label="lang_close_title" onclick="PosnicPro.items.closeDoc();"><i class="feather icon-x"></i></button>' + + '</div>'; + var strip = '<div class="p-void-strip" id="i_delete_strip" style="display:none;">' + + '<span>Delete <b>' + esc(d.name) + '</b>? Past sales and purchases keep their lines; only the catalogue entry goes.</span>' + + '<button type="button" class="btn btn-sm btn-danger" onclick="PosnicPro.items.deleteConfirm(\'' + esc(id) + '\');">Delete item</button>' + + '<button type="button" class="btn btn-sm btn-light" onclick="$(\'#i_delete_strip\').slideUp(120);">Cancel</button>' + + '</div>'; + var img = (d.image && d.image !== 'item.svg') ? d.image : ''; + var stats = '<div class="s-doc-stats">' + + '<div class="s-stat"><div class="s-stat-value"' + (low ? ' style="color: var(--theme-danger-color, #c0392b);"' : '') + '>' + + (tracked ? esc(d.available_quantity) + ' ' + esc(d.unit || 'qty') : '\u2014') + '</div>' + + '<div class="s-stat-label">' + (tracked ? 'In stock' + (low ? ' \u00b7 low' : '') : 'Not tracked') + '</div></div>' + + '<div class="s-stat"><div class="s-stat-value">' + cur + ' ' + sell.toFixed(2) + '</div>' + + '<div class="s-stat-label"><lang class="lang_selling_price_2">Selling price</lang></div></div>' + + (cost > 0 + ? '<div class="s-stat"><div class="s-stat-value">' + cur + ' ' + cost.toFixed(2) + '</div>' + + '<div class="s-stat-label"><lang class="lang_companyamount_title">Cost</lang></div></div>' + : '') + + (margin !== null + ? '<div class="s-stat"><div class="s-stat-value">' + margin.toFixed(1) + '%</div>' + + '<div class="s-stat-label"><lang class="lang_margin">Margin</lang></div></div>' + : '') + + '</div>'; + var identity = '<div class="q-block"><div class="q-label"><lang class="lang_identity">Identity</lang></div>' + + (real(d.itemid) ? '<div>SKU: ' + esc(d.itemid) + '</div>' : '') + + (real(d.barcode_id) ? '<div class="q-muted">Barcode: ' + esc(d.barcode_id) + '</div>' : '') + + (real(d.category_name) ? '<div class="q-muted">' + esc(d.category_name) + '</div>' : '') + + '<div class="q-muted">Unit: ' + esc(d.unit || 'qty') + '</div>' + + '</div>'; + var pricingBits = ''; + if (real(d.tax_name) || Number(d.tax) > 0) { + pricingBits += '<div class="q-muted">Tax: ' + esc(d.tax_name || (d.tax + '%')) + (d.tax_type ? ' (' + esc(d.tax_type) + ')' : '') + '</div>'; + } + if (real(d.supplier_name)) { pricingBits += '<div class="q-muted">Supplier: ' + esc(d.supplier_name) + '</div>'; } + var pricing = '<div class="q-block"><div class="q-label"><lang class="lang_pricing_supply">Pricing & supply</lang></div>' + + '<div>MRP ' + cur + ' ' + (Number(d.mrp_price || d.selling_price) || 0).toFixed(2) + '</div>' + + pricingBits + + '</div>'; + var record = '<div class="q-block"><div class="q-label"><lang class="lang_on_record">On record</lang></div>' + + (d.created_date ? '<div class="q-muted">Added ' + esc(PosnicPro.convertDate(d.created_date)) + '</div>' : '') + + (d.updated_date ? '<div class="q-muted">Updated ' + esc(PosnicPro.convertDate(d.updated_date)) + '</div>' : '') + + (tracked && Number(d.low_stock) > 0 ? '<div class="q-muted">Low-stock alert at ' + esc(d.low_stock) + '</div>' : '') + + '</div>'; + var photo = img + ? '<div class="i-doc-photo"><img loading="lazy" decoding="async" src="' + esc(img) + '" alt="' + esc(d.name) + '" onerror="this.style.display=\'none\';"></div>' + : ''; + var body = '<div class="s-doc-body"><div class="q-sheet s-sheet">' + + '<div class="i-doc-top">' + '<div class="i-doc-main">' + stats + + '<div class="s-doc-grid">' + identity + pricing + record + '</div>' + + '</div>' + photo + '</div>' + + '<div class="q-label" style="margin-top:18px;"><lang class="lang_recent_stock_movements">Recent stock movements</lang></div>' + + '<div id="i_doc_moves" class="text-muted" style="font-size:13px;"><lang class="lang_loading_4">Loading ...</lang></div>' + + '</div></div>'; + $('#items_doc').html(toolbar + strip + body); + PosnicPro.items.loadStockMoves(d); + /* The dossier renders AFTER the login-time ACL sweep - it must + re-scan itself or a restricted user sees doors the server will + refuse (owner: every list carries the ACL we defined). */ + PosnicPro.ACLForModule('item'); + }, + /* The item's latest ledger lines, straight from the stocklogs the + transition machinery writes. */ + loadStockMoves: function (d) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var nameExact = String(d.name || '').replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); + PosnicPro.get({ + url: 'stocklogs', + data: { page: 1, limit: 5, filters: JSON.stringify({ item_name: { $regex: '^' + nameExact + '$', $options: 'i' } }) } + }, function (response) { + var list = ((response && response.data) || {}).list || []; + if (!list.length) { + $('#i_doc_moves').html('<div class="text-muted"><lang class="lang_no_stock_movements_yet">No stock movements yet.</lang></div>'); + return; } + var html = '<table class="q-items s-doc-purchases-table"><thead><tr>' + + '<th><lang class="lang_movement">Movement</lang></th><th><lang class="lang_reference_title">Reference</lang></th><th class="text-right"><lang class="lang_change">Change</lang></th><th class="text-right"><lang class="lang_balance">Balance</lang></th>' + + '</tr></thead><tbody>'; + list.forEach(function (r) { + var n = Number(r.count) || 0; + html += '<tr>' + + '<td>' + esc(r.process) + '</td>' + + '<td class="q-muted">' + esc(r.reference || '-') + '</td>' + + '<td class="text-right" style="color:' + (n < 0 ? 'var(--theme-danger-color, #c0392b)' : 'var(--theme-success-color, #1a7f37)') + ';">' + + (n > 0 ? '+' : '') + n + '</td>' + + '<td class="text-right q-muted">' + esc(r.opening_balance) + ' \u2192 ' + esc(r.closing_balance) + '</td>' + + '</tr>'; + }); + html += '</tbody></table>'; + /* Recent only, BY DESIGN - the full ledger with its date range + lives on Inventory Logs; this door lands there pre-filtered + to the item (owner: "let him search in inventory logs"). */ + html += '<div style="margin-top:8px; font-size:13px;">' + + '<a href="javascript:void(0)" onclick="PosnicPro.stocklogs.openForItem(' + JSON.stringify(String(d.name || '')).replace(/"/g, '"') + ');">' + + 'All movements for this item →</a></div>'; + $('#i_doc_moves').html(html); + }, function () { + $('#i_doc_moves').html('<div class="text-muted"><lang class="lang_stock_history_unavailable">Stock history unavailable.</lang></div>'); + }); + }, + deleteAsk: function () { + $('#i_delete_strip').slideDown(120); + }, + deleteConfirm: function (id) { + PosnicPro.request({ + method: 'DELETE', + url: 'items', + data: JSON.stringify({ data: [id] }) + }, function (r) { + PosnicPro.alert(r.type || 'success', r.message || 'Item deleted'); + PosnicPro.items.closeDoc(); + PosnicPro.items.loadList(1); }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); + var resp = {}; try { resp = jQuery.parseJSON(xhr.responseText) || {}; } catch (e) { } + PosnicPro.alert('error', resp.message || 'Could not delete this item'); }); }, - showDataTablePage: function () { - var loader = $(".loader-table-item"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.dashboard.datePicker(); + _chrome: function () { PosnicPro.HideSideBarModal(); - $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); - $(".vertical-layout").removeClass("toggle-menu"); - $(".vertical-menu li a").removeClass("active"); - $('.dropdown-item').removeClass('active'); $('.page_loader,#osk-container').hide(); - $('.page-title-box,#items').show(); - $('#items_new,#items_view').modal('hide'); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); $('#v-pills-inventory-tab,#view_items_page').addClass('active'); $('#v-pills-inventory').addClass('show active'); - PosnicPro.items.itemsTable('items'); + $('.page-title-box,#items').show(); $('.dashboard_img_menu').hide(); $('#image_sidebar_itemdetail').show(); - + }, + showDataTablePage: function () { + PosnicPro.items._chrome(); + PosnicPro.items.mountFilters(); + PosnicPro.items.closeDoc(); + PosnicPro.items.loadList(1); }, triggerAddNew: function () { PosnicPro.items.showAdd(); $('#item_variant_header').hide(); $('#show_variant_fields').hide(); - $('#show_price_fields').show(); + $('#show_price_fields,#sku_card_col').show(); $('#product_without_variant').prop('checked', true); $('#product_with_variant').prop('checked', false); $('#show_variant_fields').hide(); - $('#show_price_fields').show(); + $('#show_price_fields,#sku_card_col').show(); $("#load_price_fields").html(''); $("#show-hide-item-discount").show(); if ($('#sales_new_item_name').val() !== '') { @@ -353,19 +726,21 @@ PosnicPro.items = { tax_name = ''; tax_method = 'hsn'; } else { - var taxDetail = $("#items_tax").select2("data"); - tax_value = taxDetail[0].element.attributes['data-tax-value'].value; - tax_id = taxDetail[0].element.attributes['data-tax-id'].value; - tax_name = taxDetail[0].element.attributes['data-tax-name'].value; + /* No selection is the normal state when the tax module is off. */ + tax_value = PosnicPro.items.selectAttr('#items_tax', 'data-tax-value', 0); + tax_id = PosnicPro.items.selectAttr('#items_tax', 'data-tax-id'); + tax_name = PosnicPro.items.selectAttr('#items_tax', 'data-tax-name'); hsn_code = 0; tax_method = 'default'; } - var categoryDetail = $("#items_category").select2("data"); return { supplier_id: $('#items_supplier_id').val(), supplier_name: $('#items_supplier').val(), - category_id: categoryDetail[0].element.attributes['data-category-id'].value, - category_name: categoryDetail[0].element.attributes['data-category-name'].value, + category_id: PosnicPro.items.selectAttr('#items_category', 'data-category-id'), + /* category_name was the one unguarded read left on this line - the id + beside it already had a length check. Category is optional, so an + item saved without one threw here. */ + category_name: PosnicPro.items.selectAttr('#items_category', 'data-category-name'), cover_image: $('#item_logo').val(), inventory: $('#item_track_inventory').is(':checked'), sales_channel: $('#item_sales_channel').is(':checked'), @@ -373,7 +748,14 @@ PosnicPro.items = { negative_stock: $('#item_negative_stock').is(':checked'), item_weight_machine_based: $('#item_weight_machine_based').is(':checked'), open_price: $('#item_open_price').is(':checked'), - tile_color: $('#item_tile_color').val(), + tile_color: $('#item_tile_color').val() || PosnicPro.autoTile($('#items_name').val()).color, + tile_shape: $('#item_tile_shape').val() || PosnicPro.autoTile($('#items_name').val()).shape, + plu_code: $('#items_plu_code').val() || '', + /* + * NOT here, deliberately - a GTIN identifies ONE trade item, so it + * cannot be shared by a family: five variants carrying one number + * would each claim to be the same product. + */ item_kind: $('#item_is_service').is(':checked') ? 'service' : 'product', service_unit: $('#item_service_unit').val() || 'fixed', brand: $('#items_brand').val(), @@ -407,15 +789,91 @@ PosnicPro.items = { */ saveVariantFamily: function (loader) { var itemName = $('#items_name').val(); - var values = $('#item_variant_list').val() || []; + /* The same ordered list loadVariant built the inputs from. Walking it + separately is what would let row N's price be saved against variant + M once combinations are in play. */ + var values = $.map(PosnicPro.items.variantCombinations(), function (c) { + return c.value; + }); var shared = PosnicPro.items._sharedItemFields(); - var variantDetail = $('#items_variant').select2('data'); - var axis = (variantDetail && variantDetail.length) ? variantDetail[0].text : ''; + var axis = PosnicPro.items.variantAxisLabel(); var rows = []; + /* Did somebody actually PICK a tile, or is it the automatic one? + _sharedItemFields already resolved the fallback against the parent + name, so by the time it is spread onto a row there is no way left to + tell the two apart - the question has to be asked here. */ + var tilePicked = !!($('#item_tile_color').val() || $('#item_tile_shape').val()); + + /* + * A family carries NO gtin, and that is deliberate rather than pending. + * + * A GTIN identifies one trade item. Red-L and Red-M are different trade + * items with different numbers on their packs, so there is no single + * value that could be shared - putting the parent's on all of them would + * have five products each claiming to be the same one, which is the + * duplicate-identity failure the validation exists to prevent. + * + * A per-variant GTIN input on each generated row is the right answer and + * belongs with the per-variant image work (P2 in + * PRODUCT_INFORMATION_MODEL). Until then no number is better than a + * wrong one. + */ $(values).each(function (key, variantName) { var unitVariantDetail = $('#items_unit_' + key + ''); - rows.push(Object.assign({}, shared, { - name: itemName + ' / ' + variantName, + var rowName = itemName + ' / ' + variantName; + /* + * Each variant gets its OWN automatic tile, from its own full name. + * + * The shared fields carry a tile derived from the parent name, so + * spreading them gave every member of a family the same colour and + * the same shape - "Shirt / Red" and "Shirt / Blue" indistinguishable + * on the sale grid. That defeats the only thing the dressing is for: + * a till is navigated by recognition, and a family is exactly where + * several near-identical names sit side by side needing to be told + * apart at a glance. + * + * An explicit choice still wins and still applies to the whole + * family - picking a colour for "Shirt" means the shop wants that + * colour for the shirts, and quietly overriding it per row would be + * the opposite of what was asked. + */ + var autoRow = tilePicked ? null : PosnicPro.autoTile(rowName); + + /* + * This row's own photo, if one was chosen. + * + * Sent as a one-image list marked cover, so the variant's tile and + * its item page both show the picture of THAT variant. The shared + * fields carry the family's whole set, so a row with no choice is + * left exactly as it was before any of this existed. + * + * Looked up by name against what is currently uploaded rather than + * trusted from the hidden input: the photo may have been removed + * after it was picked, and saving a name with no image behind it + * would give the variant a broken picture instead of no picture. + */ + var chosenPhoto = $('#items_photo_' + key).val(); + var rowPhoto = null; + if (chosenPhoto) { + var found = $.grep(PosnicPro.items.imageParams || [], function (x) { + return x && x.name === chosenPhoto; + }); + if (found.length) { + rowPhoto = { + image: [$.extend({}, found[0], { cover: 'yes' })], + /* cover_image names the picture the item leads with, and + it comes from the shared fields too - left alone, the + row would carry its own photo while still pointing at + the family's as its cover. */ + cover_image: found[0].name, + }; + } + } + rows.push(Object.assign({}, shared, rowPhoto || {}, autoRow ? { + tile_color: autoRow.color, + tile_shape: autoRow.shape, + } : {}, { + name: rowName, variant_value: variantName, sku_id: $('#items_itemid_' + key + '').val(), barcode_id: $('#items_barcodeid_' + key + '').val(), @@ -451,7 +909,7 @@ PosnicPro.items = { Variant mode resets to the plain-item state. */ $('#load_price_fields').html('').hide(); $('#show_variant_fields').hide(); - $('#show_price_fields').show(); + $('#show_price_fields,#sku_card_col').show(); $('#product_without_variant').prop('checked', true); PosnicPro.items.itemClearForm(); $('#items_name').focus(); @@ -540,21 +998,19 @@ PosnicPro.items = { var tax_name = ''; var tax_method = 'hsn'; } else { - var taxDetail = $("#items_tax").select2("data"); - var tax_value = taxDetail[0].element.attributes['data-tax-value'].value; - var tax_id = taxDetail[0].element.attributes['data-tax-id'].value; - var tax_name = taxDetail[0].element.attributes['data-tax-name'].value; + var tax_value = PosnicPro.items.selectAttr('#items_tax', 'data-tax-value', 0); + var tax_id = PosnicPro.items.selectAttr('#items_tax', 'data-tax-id'); + var tax_name = PosnicPro.items.selectAttr('#items_tax', 'data-tax-name'); var hsn_code = 0; var tax_method = 'default'; } - var categoryDetail = $("#items_category").select2("data"); var formData = { id: $('#itemid').val(), name: name, supplier_id: $('#items_supplier_id').val(), supplier_name: $('#items_supplier').val(), - category_id: categoryDetail[0].element.attributes['data-category-id'].value, - category_name: categoryDetail[0].element.attributes['data-category-name'].value, + category_id: PosnicPro.items.selectAttr('#items_category', 'data-category-id'), + category_name: PosnicPro.items.selectAttr('#items_category', 'data-category-name'), cover_image: $('#item_logo').val(), inventory: $('#item_track_inventory').is(':checked'), sales_channel: $('#item_sales_channel').is(':checked'), @@ -562,7 +1018,13 @@ PosnicPro.items = { negative_stock: $('#item_negative_stock').is(':checked'), item_weight_machine_based: $('#item_weight_machine_based').is(':checked'), open_price: $('#item_open_price').is(':checked'), - tile_color: $('#item_tile_color').val(), + tile_color: $('#item_tile_color').val() || PosnicPro.autoTile($('#items_name').val()).color, + tile_shape: $('#item_tile_shape').val() || PosnicPro.autoTile($('#items_name').val()).shape, + plu_code: $('#items_plu_code').val() || '', + /* The server validates and derives gtin14 - see + api/src/helpers/items.helper.js. Sending whatever was typed is + correct: a client-side check is a courtesy, not the rule. */ + gtin: $('#items_gtin').val() || '', item_kind: $('#item_is_service').is(':checked') ? 'service' : 'product', service_unit: $('#item_service_unit').val() || 'fixed', brand: $('#items_brand').val(), @@ -605,8 +1067,13 @@ PosnicPro.items = { PosnicPro.sales.itemsMenu.onlineProductList(); if (PosnicPro.action === 'add') { $('#show_last_created_item').show(); - // The rapid-entry loop: cursor back on the name. - $('#items_name').focus(); + /* The rapid-entry loop: back to the first tab, cursor + on the name, ready for the next item. Focusing the + name WITHOUT switching tabs put the cursor on a + hidden pane whenever the item was saved from + Details or More - which is most of the time once + someone starts using the other tabs (owner ask). */ + PosnicPro.items.goToTab('item_tab_main', '#items_name'); } var path = '#/items/' + data.id; $('#last_created_item').attr('href', path); @@ -652,13 +1119,13 @@ PosnicPro.items = { if (PosnicPro.receivings.editPriceAction === 'add') { hasher.setHash('receivings/new'); PosnicPro.receivings.addReceivingLineItems(itemDetails); - $('#view_receiving_page').addClass('active'); + $('#view_purchaseorders_page').addClass('active'); } else { hasher.setHash('receivings/' + PosnicPro.receivings.receivingAddId + '/edit'); setTimeout(function () { PosnicPro.receivings.addReceivingLineItems(itemDetails); }, 1000); - $('.view_receivings_page').addClass('active'); + $('#view_purchaseorders_page').addClass('active'); } loader.find(".loadingSpinner:first").remove(); @@ -689,15 +1156,26 @@ PosnicPro.items = { $('#items_supplier_id').val(defaultsupplier.supplier_id); $('#items_supplier').val(defaultsupplier.supplier_name); } - $(".items_category").val('').trigger('change.select2'); + /* select2 FIRST, then the value. Firing change.select2 at a + select that is not a select2 yet is what throws + "Cannot read properties of null (reading 'offsetWidth')". */ $(".items_category").select2({ placeholder: "Choose a Category" }); - $("#items_variant").val(1).trigger('change.select2'); + $(".items_category").val('').trigger('change.select2'); $("#items_variant").select2({ placeholder: "Choose a Variant" }); $('#item_variant_list,#load_price_fields').html(''); + /* The variant SELECT keeps its selection across a save, so + emptying its value list leaves the form showing a chosen + variant with nothing to choose from - the same state the + preselect used to produce, arriving by a different door + (reported: "first variant values not loaded but second + variant values loading" - the second one works because + picking it fires select2:select, which refills). */ + PosnicPro.items.loadVariantValues('#items_variant', '#item_variant_list'); + PosnicPro.items.resetSecondAxis(); if ($('#show_variant_fields').css('display') === 'none') { $('#product_without_variant').prop('checked', true); $('#product_with_variant').prop('checked', false); @@ -720,14 +1198,14 @@ PosnicPro.items = { if (PosnicPro.receivings.editPriceAction === 'add') { hasher.setHash('receivings/new'); PosnicPro.receivings.addReceivingLineItems(itemDetails); - $('#view_receiving_page').addClass('active'); + $('#view_purchaseorders_page').addClass('active'); } else { hasher.setHash('receivings/' + PosnicPro.receivings.receivingAddId + '/edit'); setTimeout(function () { PosnicPro.receivings.removeLineItemReceiving(data.id); PosnicPro.receivings.addReceivingLineItems(itemDetails); }, 1000); - $('.view_receivings_page').addClass('active'); + $('#view_purchaseorders_page').addClass('active'); } loader.find(".loadingSpinner:first").remove(); @@ -816,39 +1294,39 @@ PosnicPro.items = { if (data.track_inventory === true) { $('#item-access').removeClass('badge-danger').addClass('badge-success'); $('#item-view-access').removeClass('fa-times').addClass('fa-check'); - $('#inventory-access-item').html('ON'); + $('#inventory-access-item').html(PosnicPro.i18n.t('lang_on_2', 'ON')); } else { $('#item-access').removeClass('badge-success').addClass('badge-danger'); $('#item-view-access').removeClass('fa-check').addClass('fa-times'); - $('#inventory-access-item').html('OFF'); + $('#inventory-access-item').html(PosnicPro.i18n.t('lang_off_2', 'OFF')); } if (data.sales_channel === true) { $('#channel-access').removeClass('badge-danger').addClass('badge-success'); $('#item-view-channel-access').removeClass('fa-times').addClass('fa-check'); - $('#channel-access-item').html('ON'); + $('#channel-access-item').html(PosnicPro.i18n.t('lang_on_2', 'ON')); } else { $('#channel-access').removeClass('badge-success').addClass('badge-danger'); $('#item-view-channel-access').removeClass('fa-check').addClass('fa-times'); - $('#channel-access-item').html('OFF'); + $('#channel-access-item').html(PosnicPro.i18n.t('lang_off_2', 'OFF')); } if (data.ecommerce === true) { $('#ecommerce-access').removeClass('badge-danger').addClass('badge-success'); $('#item-view-ecommerce-access').removeClass('fa-times').addClass('fa-check'); - $('#ecommerce-access-item').html('ON'); + $('#ecommerce-access-item').html(PosnicPro.i18n.t('lang_on_2', 'ON')); } else { $('#ecommerce-access').removeClass('badge-success').addClass('badge-danger'); $('#item-view-ecommerce-access').removeClass('fa-check').addClass('fa-times'); - $('#ecommerce-access-item').html('OFF'); + $('#ecommerce-access-item').html(PosnicPro.i18n.t('lang_off_2', 'OFF')); } if (data.negative_stock === true) { $('#stock-access').removeClass('badge-danger').addClass('badge-success'); $('#item-view-stock-access').removeClass('fa-times').addClass('fa-check'); - $('#stock-access-item').html('ON'); + $('#stock-access-item').html(PosnicPro.i18n.t('lang_on_2', 'ON')); } else { $('#stock-access').removeClass('badge-success').addClass('badge-danger'); $('#item-view-stock-access').removeClass('fa-check').addClass('fa-times'); - $('#stock-access-item').html('OFF'); + $('#stock-access-item').html(PosnicPro.i18n.t('lang_off_2', 'OFF')); } $('#item_view_mrpprice').number(data.mrp_price, 2); @@ -881,7 +1359,7 @@ PosnicPro.items = { $('#item-image-tab').show(); $('#show_product_image').show(); var image_path = val.name; - let img = jQuery('<img class="imagezoom item_tab_images" id="' + image_path + '" src="" style="height:150px; width:150px;border: 2px solid #ccc;border-radius: 10px;padding:5px;margin-right: 20px;" onclick="PosnicPro.viewImage(this.id);">'); + let img = jQuery('<img loading="lazy" decoding="async" class="imagezoom item_tab_images" id="' + image_path + '" src="" style="height:150px; width:150px;border: 2px solid #ccc;border-radius: 10px;padding:5px;margin-right: 20px;" onclick="PosnicPro.viewImage(this.id);">'); img.attr('src', image_path); $('#item_view_image').append(img); }); @@ -938,21 +1416,21 @@ PosnicPro.items = { '<div class="modal fade close_on_esc" id="family_add_modal" tabindex="-1" role="dialog" aria-hidden="true">' + '<div class="modal-dialog modal-sm" role="document"><div class="modal-content">' + '<div class="modal-header"><h5 class="modal-title">Add ' + fam.axis + '</h5>' + - '<button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">×</span></button></div>' + + '<button type="button" class="close" data-dismiss="modal" aria-label="Close" data-t-aria-label="lang_close_title"><span aria-hidden="true">×</span></button></div>' + '<div class="modal-body">' + '<div class="form-group"><label style="font-weight:600; font-size:.85rem;">' + fam.axis + ' value</label>' + '<input type="text" class="form-control" id="family_add_value" maxlength="60" placeholder="e.g. XL"></div>' + - '<div class="form-group"><label style="font-weight:600; font-size:.85rem;">Selling price</label>' + + '<div class="form-group"><label style="font-weight:600; font-size:.85rem;"><lang class="lang_selling_price_2">Selling price</lang></label>' + '<input type="number" min="0" step="0.01" class="form-control" id="family_add_price" value="' + ($('#items_selling_price').val() || '') + '"></div>' + '<div class="form-group"><label style="font-weight:600; font-size:.85rem;">Barcode <small class="text-muted">(optional)</small></label>' + '<input type="text" class="form-control" id="family_add_barcode"></div>' + - '<div class="form-group mb-0"><label style="font-weight:600; font-size:.85rem;">Opening stock</label>' + + '<div class="form-group mb-0"><label style="font-weight:600; font-size:.85rem;"><lang class="lang_opening_stock">Opening stock</lang></label>' + '<input type="number" min="0" class="form-control" id="family_add_qty" value="0"></div>' + - '<small class="form-text text-muted">Category, tax, supplier and the other settings copy from this item.</small>' + + '<small class="form-text text-muted"><lang class="lang_category_tax_supplier_and_the_other_settin">Category, tax, supplier and the other settings copy from this item.</lang></small>' + '</div>' + '<div class="modal-footer">' + - '<button type="button" class="btn btn-outline-secondary" data-dismiss="modal">Cancel</button>' + - '<button type="button" class="btn btn-outline-primary" id="family_add_btn" onclick="PosnicPro.items.submitAddValue();">Add</button>' + + '<button type="button" class="btn btn-outline-secondary" data-dismiss="modal"><lang class="lang_cancel_title">Cancel</lang></button>' + + '<button type="button" class="btn btn-outline-primary" id="family_add_btn" onclick="PosnicPro.items.submitAddValue();"><lang class="lang_nav_add">Add</lang></button>' + '</div></div></div></div>' ); $('#family_add_modal').modal('show'); @@ -961,7 +1439,7 @@ PosnicPro.items = { submitAddValue: function () { var fam = PosnicPro.items._family; var value = ($('#family_add_value').val() || '').trim(); - if (!fam || !value) { PosnicPro.alert('warning', 'Enter the new value.'); return; } + if (!fam || !value) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_enter_the_new_value', 'Enter the new value.')); return; } $('#family_add_btn').prop('disabled', true); var shared = PosnicPro.items._sharedItemFields(); var payload = Object.assign({}, shared, { @@ -1023,7 +1501,7 @@ PosnicPro.items = { if (response.type === 'success') { loader.find(".loadingSpinner:first").remove(); $('#show_variant_fields').hide(); - $('#show_price_fields').show(); + $('#show_price_fields,#sku_card_col').show(); var data = response.data; // Family strip (V1): if this item belongs to a variant // family, show its siblings and the add-value button. The @@ -1043,6 +1521,10 @@ PosnicPro.items = { $('#items_hsndescription').val(data.hsndescription); $('#items_supplier').val(data.supplier_name); $('#items_supplier_id').val(data.supplier_id); + /* Re-load with the item's own supplier selected. The list may not + carry an inactive or deleted one, and loadSelectSupplier adds it + back rather than letting an edit silently clear the field. */ + PosnicPro.items.loadSelectSupplier(data.supplier_id, data.supplier_name); $("#items_category").val(data.category_id).trigger("change"); $('#items_discount_amount').val(data.discount_amount); $('#items_discount_percentage').val(data.discount_percentage); @@ -1065,8 +1547,8 @@ PosnicPro.items = { } else { $('#items_expiry_date').val(''); } - $('#item_title_data').text('Edit'); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#item_button_title').text('புதுப்பி') : $('#item_button_title').text('Update'); + $('#item_title_data').text(PosnicPro.i18n.t('lang_edit_title', 'Edit')); + $('#item_button_title').text(PosnicPro.i18n.t('lang_updatebtn_title', 'Update')); if ((data.itemid === data.barcode_id) && (data.itemid !== '')) { $("#same_as_sku").prop("checked", true); } else { @@ -1090,7 +1572,11 @@ PosnicPro.items = { $('#items_brand').val(data.brand || ''); $('#items_tags').val(Array.isArray(data.tags) ? data.tags.join(', ') : ''); $('#items_reorder_point').val(data.reorder_point === null || data.reorder_point === undefined ? '' : data.reorder_point); + $('#items_gtin').val(data.gtin || ''); + PosnicPro.items.checkGtin(); PosnicPro.items.setTileColor(data.tile_color || ''); + PosnicPro.items.setTileShape(data.tile_shape || ''); + $('#items_plu_code').val(data.plu_code || ''); $("#items_tax").val(data.tax_id).trigger("change"); $("#items_unit").val(data.unit_id).trigger("change"); var radionbutton = $('#items_discount_amount').val(); @@ -1132,7 +1618,7 @@ PosnicPro.items = { $('#item-display-preview').append( '<div id="selector_' + key + '" class="receiving-image-wrapper image-area" style="position: relative;"> \ - <img class="image_style" class="img-thumbnail" src="' + image_path + '" \ + <img loading="lazy" decoding="async" class="image_style" class="img-thumbnail" src="' + image_path + '" \ title="' + escape(val.name) + '" /><br /> \ <span id="coverimage_selector_' + key + '" class="coverImageAdd" style="display: block;border: 1px solid #ddd;border-radius: 5px;margin-top: 2px; background: #506fe4; color: #fff" onclick="PosnicPro.items.coverImageEdit(this.id,\'' + key + '\',\'' + val.name + '\',\'' + val.size + '\')">Choose Cover</span><a class="remove-image" style="cursor:pointer;display: inline;position: absolute; top: -10px; right: -10px; border-radius: 10em; padding: 2px 6px 3px; text-decoration: none; font: 700 21px/20px sans-serif; background: #f48787; border: 3px solid #fff; color: #FFF; box-shadow: 0 2px 6px rgba(0,0,0,0.5), inset 0 2px 4px rgba(0,0,0,0.3); text-shadow: 0 1px 2px rgba(0,0,0,0.5); -webkit-transition: background 0.5s; transition: background 0.5s;" onclick="PosnicPro.items.image_edit_remove_selected(\'' + key + '\',\'' + val.name + '\')">×</a> \ </div>'); @@ -1173,14 +1659,14 @@ PosnicPro.items = { $(".vertical-layout").removeClass("toggle-menu"); $(".vertical-menu li a").removeClass("active"); $('.dropdown-item').removeClass('active'); - $('#v-pills-inventory-tab,#new_items_page').addClass('active'); + $('#v-pills-inventory-tab,#view_items_page').addClass('active'); $('#v-pills-inventory').addClass('show active'); - $('#item_title_data').text('Add'); + $('#item_title_data').text(PosnicPro.i18n.t('lang_nav_add', 'Add')); $('#itemid').val(''); // A fresh entry: the discount fields are untouched again, so a // category pick may fill them (applyCategoryDiscount checks this). PosnicPro.items._discountTouched = false; - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#item_button_title').text('சேமி') : $('#item_button_title').text('Save'); + $('#item_button_title').text(PosnicPro.i18n.t('lang_save_title', 'Save')); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); $('#show_last_created_item').hide(); @@ -1192,11 +1678,11 @@ PosnicPro.items = { if ($("#product_without_variant").is(":checked")) { $('#show_variant_fields').hide(); - $('#show_price_fields').show(); + $('#show_price_fields,#sku_card_col').show(); $("#load_price_fields").html(''); $("#show-hide-item-discount").show(); } else { - $('#show_price_fields').hide(); + $('#show_price_fields,#sku_card_col').hide(); $('#show_variant_fields').show(); $('#show_variant_fields').css("display", "block"); $("#show-hide-item-discount").hide(); @@ -1277,12 +1763,12 @@ PosnicPro.items = { var scope = $('input[name="bulk_price_scope"]:checked').val(); var value = $('#bulk_price_value').val(); if (value === '' || isNaN(value) || Number(value) < 0) { - PosnicPro.alert('warning', 'Enter a valid amount.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_enter_a_valid_amount', 'Enter a valid amount.')); return null; } var category_id = (scope === 'category') ? $('#bulk_price_category').val() : null; if (scope === 'category' && !category_id) { - PosnicPro.alert('warning', 'Choose a category.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_choose_a_category', 'Choose a category.')); return null; } return { @@ -1302,7 +1788,7 @@ PosnicPro.items = { if (!form) return false; var currency = PosnicPro.local.get('currencySign') || ''; var box = $('#bulk_price_check_result'); - box.html('<span class="dim">Checking...</span>').show(); + box.html('<span class="dim"><lang class="lang_checking">Checking...</lang></span>').show(); PosnicPro.post({ url: 'items/bulkPricePreview', data: JSON.stringify(form) }, function (response) { if (response.type !== 'success') { @@ -1362,7 +1848,7 @@ PosnicPro.items = { }); // Keep the dropdown inside the modal so it is not clipped or lost // behind it (a known select2-in-modal quirk). - sel.select2({ placeholder: 'Choose a category', dropdownParent: $('#bulk_price_modal') }); + sel.select2({ placeholder: PosnicPro.i18n.t('lang_choose_a_category_2', 'Choose a category'), dropdownParent: $('#bulk_price_modal') }); }); }, @@ -1424,10 +1910,10 @@ PosnicPro.items = { }, renderAdjRows: function () { var mode = PosnicPro.items._adjMode(); - $('#stock_adjust_qty_head').text(mode === 'set' ? 'Counted' : mode === 'add' ? 'Qty found' : 'Qty lost'); + $('#stock_adjust_qty_head').text(mode === 'set' ? 'Counted' : mode === 'add' ? PosnicPro.i18n.t('lang_qty_found', 'Qty found') : PosnicPro.i18n.t('lang_qty_lost', 'Qty lost')); var keys = Object.keys(PosnicPro.items._adjRows); if (!keys.length) { - $('#stock_adjust_rows').html('<tr><td colspan="5" class="text-center text-muted">Search and pick items to adjust.</td></tr>'); + $('#stock_adjust_rows').html('<tr><td colspan="5" class="text-center text-muted"><lang class="lang_search_and_pick_items_to_adjust">Search and pick items to adjust.</lang></td></tr>'); return; } var html = keys.map(function (id) { @@ -1449,14 +1935,14 @@ PosnicPro.items = { return { item_id: id, qty: Number(PosnicPro.items._adjRows[id].qty) || 0 }; }); if (!rows.length) { - PosnicPro.alert('warning', 'Pick at least one item'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_pick_at_least_one_item', 'Pick at least one item')); return; } $('#stock_adjust_submit').prop('disabled', true); var reasonSel = $('#stock_adjust_reason').val(); var reason = reasonSel === '__custom__' ? ($('#stock_adjust_custom').val() || '').trim() : reasonSel; if (!reason) { - PosnicPro.alert('warning', 'Name the custom reason'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_name_the_custom_reason', 'Name the custom reason')); $('#stock_adjust_submit').prop('disabled', false); return; } @@ -1488,7 +1974,7 @@ PosnicPro.items = { $('.bulk-stock-category-row').hide(); $('#bulk_stock_direction').val('increase'); $('#bulk_stock_op').val('amount'); - $('.bulk-stock-unit').text('Qty'); + $('.bulk-stock-unit').text(PosnicPro.i18n.t('lang_qty_title', 'Qty')); $('#bulk_stock_value').val(''); $('#bulk_stock_note').val(''); $('#bulk_stock_check_result').hide().empty(); @@ -1501,12 +1987,12 @@ PosnicPro.items = { var scope = $('input[name="bulk_stock_scope"]:checked').val(); var value = $('#bulk_stock_value').val(); if (value === '' || isNaN(value) || Number(value) < 0) { - PosnicPro.alert('warning', 'Enter a valid quantity.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_enter_a_valid_quantity', 'Enter a valid quantity.')); return null; } var category_id = (scope === 'category') ? $('#bulk_stock_category').val() : null; if (scope === 'category' && !category_id) { - PosnicPro.alert('warning', 'Choose a category.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_choose_a_category', 'Choose a category.')); return null; } return { @@ -1523,7 +2009,7 @@ PosnicPro.items = { var form = PosnicPro.items.readBulkStockForm(); if (!form) return false; var box = $('#bulk_stock_check_result'); - box.html('<span class="dim">Checking...</span>').show(); + box.html('<span class="dim"><lang class="lang_checking">Checking...</lang></span>').show(); PosnicPro.post({ url: 'items/bulkStockPreview', data: JSON.stringify(form) }, function (response) { if (response.type !== 'success') { box.hide(); @@ -1565,7 +2051,7 @@ PosnicPro.items = { $.map(response.suggestions || [], function (dataItem) { sel.append('<option value="' + dataItem.id + '">' + dataItem.name + '</option>'); }); - sel.select2({ placeholder: 'Choose a category', dropdownParent: $('#bulk_stock_modal') }); + sel.select2({ placeholder: PosnicPro.i18n.t('lang_choose_a_category_2', 'Choose a category'), dropdownParent: $('#bulk_stock_modal') }); }); }, @@ -1625,7 +2111,7 @@ PosnicPro.items = { }); } else { - PosnicPro.alert('error', 'Fill in the required fields.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_fill_in_the_required_fields', 'Fill in the required fields.')); } return false; }, @@ -1656,8 +2142,8 @@ PosnicPro.items = { PosnicPro.get('items/' + id, function (response) { if (response.type === 'success') { hasher.setHash('items/new'); - $('#item_title_data').text('Clone'); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('#item_button_title').text('நகல் & சேமி') : $('#item_button_title').text('Duplicate & Save'); + $('#item_title_data').text(PosnicPro.i18n.t('lang_clone', 'Clone')); + $('#item_button_title').text(PosnicPro.i18n.t('lang_action_duplicate_save', 'Duplicate & Save')); var data = response.data; $('#itemid').val(''); $('#items_name').val(data.name + '_copy'); @@ -1665,6 +2151,10 @@ PosnicPro.items = { $('#items_barcodeid').val(data.barcode_id); $('#items_supplier').val(data.supplier_name); $('#items_supplier_id').val(data.supplier_id); + /* Re-load with the item's own supplier selected. The list may not + carry an inactive or deleted one, and loadSelectSupplier adds it + back rather than letting an edit silently clear the field. */ + PosnicPro.items.loadSelectSupplier(data.supplier_id, data.supplier_name); $("#items_category").val(data.category_id).trigger("change"); $('#items_discount_amount').val(data.discount_amount); $('#items_discount_percentage').val(data.discount_percentage); @@ -1688,7 +2178,7 @@ PosnicPro.items = { }); $('#item-display-preview').append( '<div id="selector_' + key + '" class="receiving-image-wrapper image-area" style="position: relative;"> \ - <img class="image_style" class="img-thumbnail" src="' + image_path + '" \ + <img loading="lazy" decoding="async" class="image_style" class="img-thumbnail" src="' + image_path + '" \ title="' + escape(val.name) + '" /><br /> \ <span id="coverimage_selector_' + key + '" class="coverImageAdd" style="display: block;border: 1px solid #ddd;border-radius: 5px;margin-top: 2px; background: #506fe4; color: #fff" onclick="PosnicPro.items.coverImageEdit(this.id,\'' + key + '\',\'' + val.name + '\',\'' + val.size + '\')">Choose Cover</span><a class="remove-image" style="cursor:pointer;display: inline;position: absolute; top: -10px; right: -10px; border-radius: 10em; padding: 2px 6px 3px; text-decoration: none; font: 700 21px/20px sans-serif; background: #f48787; border: 3px solid #fff; color: #FFF; box-shadow: 0 2px 6px rgba(0,0,0,0.5), inset 0 2px 4px rgba(0,0,0,0.3); text-shadow: 0 1px 2px rgba(0,0,0,0.5); -webkit-transition: background 0.5s; transition: background 0.5s;" onclick="PosnicPro.items.image_edit_remove_selected(\'' + key + '\',\'' + val.name + '\')">×</a> \ </div>'); @@ -1735,7 +2225,11 @@ PosnicPro.items = { $('#items_brand').val(data.brand || ''); $('#items_tags').val(Array.isArray(data.tags) ? data.tags.join(', ') : ''); $('#items_reorder_point').val(data.reorder_point === null || data.reorder_point === undefined ? '' : data.reorder_point); + $('#items_gtin').val(data.gtin || ''); + PosnicPro.items.checkGtin(); PosnicPro.items.setTileColor(data.tile_color || ''); + PosnicPro.items.setTileShape(data.tile_shape || ''); + $('#items_plu_code').val(data.plu_code || ''); (data.tax_type === 'inclusive') ? $('#item_tax_inclusive').prop('checked', true) : $('#item_tax_exclusive').prop("checked", true); $("#items_tax").val(data.tax_id).trigger("change"); var radionbutton = $('#items_discount_amount').val(); @@ -1939,17 +2433,434 @@ PosnicPro.items = { return false; }, + /* + * The rows this family will create, in order - the ONE list. + * + * loadVariant and saveVariantFamily each used to walk + * $('#item_variant_list').val() themselves, and agreed only because they + * happened to walk the same thing. The moment a second axis makes the row + * list a PRODUCT rather than the values themselves, two independent walks + * are two chances to disagree - and disagreeing here means the price typed + * into row 3 is saved against variant 5, silently, with nothing on screen + * to show it. Indices are the contract (items_selling_price_<key>), so the + * list that defines them has to be built once. + * + * Single axis returns the values unchanged, so a shop that never opens the + * second picker gets byte-identical behaviour to before. + */ + variantCombinations: function () { + var first = $('#item_variant_list').val() || []; + var second = $('#item_variant_list_2').val() || []; + if (!second.length) { + return $.map(first, function (v) { return { value: v }; }); + } + var out = []; + $.each(first, function (_, a) { + $.each(second, function (__, b) { + /* " / " matches how the family already reads on the item list + ("Shirt / Red / L"), and the server treats variant_value as + an opaque unique string, so a compound value needs nothing + added to the model. */ + out.push({ value: a + ' / ' + b }); + }); + }); + return out; + }, + + /* + * Put the second axis away. + * + * A stale second axis is the worst possible leftover on this form: it does + * not look like an error, it silently MULTIPLIES the next item into + * combinations nobody asked for. Every path that clears the form has to + * clear it, so there is one function to call rather than four copies to + * keep in step. + */ + resetSecondAxis: function () { + $('#item_variant_list_2').val(null).html(''); + var $sel = $('#items_variant_2'); + if ($sel.length) { + $sel.val(''); + /* change.select2 repaints the widget without re-firing the app's + own change handlers - .trigger('change') here would rebuild the + value list from a selection that no longer exists. */ + if ($sel.hasClass('select2-hidden-accessible')) { $sel.trigger('change.select2'); } + } + $('#variant_axis2_wrap').hide(); + $('#variant_axis2_link').show().text('+ Add a second option'); + }, + + /* + * Stop the same option being used for both axes. + * + * Size crossed with Size is not a grid, it is the same list twice: it + * produced "40 / 40", "40 / 42", "42 / 40" - items whose names say two + * different sizes for one garment, and a 40 that exists twice over. + * + * Disabled rather than removed. A greyed-out Size in the second list + * shows WHY it cannot be picked - it is already the first option - + * whereas quietly dropping it looks like the variant went missing. + */ + syncAxisExclusion: function () { + var $one = $('#items_variant'); + var $two = $('#items_variant_2'); + if (!$two.length) { return; } + var a = String($one.val() || ''); + var b = String($two.val() || ''); + + /* Already clashing - only reachable by changing the FIRST axis to + whatever the second was. The second gives way, because the first is + the one just chosen, and its values go with it: they belong to the + option that is no longer selected there. */ + if (a && b && a === b) { + PosnicPro.items.resetSecondAxis(); + /* resetSecondAxis puts the panel away. It was open and being used, + so it stays open - collapsing it here would read as the whole + second option being taken away rather than just its value. */ + $('#variant_axis2_wrap').show(); + $('#variant_axis2_link').hide(); + b = ''; + } + + $two.find('option').each(function () { + $(this).prop('disabled', !!a && this.value === a); + }); + $one.find('option').each(function () { + $(this).prop('disabled', !!b && this.value === b); + }); + + /* change.select2 repaints without re-firing the app handlers - a plain + .trigger('change') here would rebuild both value lists on every + keystroke-driven repaint. */ + $.each([$one, $two], function (_, $el) { + if ($el.hasClass('select2-hidden-accessible')) { $el.trigger('change.select2'); } + }); + }, + + /* A base64 photo needs a real mime type to render - browsers will not + sniff a data: URL. Taken from the file name, which is the only thing + we have; anything unrecognised falls back to png rather than to a + broken thumbnail. */ + photoSrc: function (photo) { + if (!photo) { return ''; } + if (!photo.data) { return photo.name || ''; } + var ext = String(photo.name || '').split('.').pop().toLowerCase(); + var mime = { jpg: 'jpeg', jpeg: 'jpeg', png: 'png', gif: 'gif', bmp: 'bmp' }[ext] || 'png'; + return 'data:image/' + mime + ';base64,' + photo.data; + }, + + /* + * Paint each variant row's photo strip from the photos uploaded above. + * + * Repainted wholesale rather than patched: photos are added and removed + * while the rows are on screen, and a strip that only ever grows would go + * on offering a picture that is no longer part of the item. + * + * A choice pointing at a removed photo is dropped here too - keeping it + * would save a name the family no longer carries, and the variant would + * come back with no picture at all. + */ + renderVariantPhotoPickers: function () { + var photos = $.grep(PosnicPro.items.imageParams || [], function (x) { + return !!(x && x.name); + }); + $('[id^="items_photo_strip_"]').each(function () { + var key = this.id.replace('items_photo_strip_', ''); + var $hidden = $('#items_photo_' + key); + var chosen = String($hidden.val() || ''); + var stillThere = $.grep(photos, function (x) { return x.name === chosen; }).length; + if (chosen && !stillThere) { $hidden.val(''); chosen = ''; } + + var $strip = $(this).empty(); + if (!photos.length) { + $strip.append($('<small class="text-muted">') + .text(PosnicPro.i18n.t('lang_add_photos_above_to_give_this_variant_its', 'Add photos above to give this variant its own'))); + return; + } + $.each(photos, function (_, photo) { + /* Built as elements, not markup: a file name is user-supplied + text and goes into a title attribute. */ + $strip.append($('<img>') + .attr('src', PosnicPro.items.photoSrc(photo)) + .attr('title', photo.name) + .attr('alt', photo.name) + .attr('data-photo', photo.name) + .addClass('items-variant-photo' + (photo.name === chosen ? ' is-chosen' : ''))); + }); + }); + }, + + /* "Colour / Size" when both are in play, else just the one. */ + variantAxisLabel: function () { + var one = PosnicPro.items.selectText('#items_variant'); + var two = ($('#item_variant_list_2').val() || []).length + ? PosnicPro.items.selectText('#items_variant_2') + : ''; + return two ? one + ' / ' + two : one; + }, + + /* select2('data') throws if the widget was never initialised, and these + two are read on every save. */ + selectText: function (selector) { + try { + var d = $(selector).select2('data'); + return (d && d.length) ? d[0].text : ''; + } catch (e) { + return ''; + } + }, + + /* + * Say how many items Save is about to create. + * + * A variant family is the one place on this form where Save creates + * SEVERAL records rather than one, and nothing said so - you found out + * afterwards, by looking at the item list. Pick eight sizes and you get + * eight items, each needing its own price. + * + * Stated where the choice is made, not in a confirmation dialog: a dialog + * arrives after the decision and gets clicked through, while a line under + * the picker is read while the picker is still being used. + */ + refreshVariantCount: function () { + var $hint = $('#variant_count_hint'); + if (!$hint.length) { return; } + var n = PosnicPro.items.variantCombinations().length; + if (!n || !$('#product_with_variant').is(':checked')) { $hint.hide(); return; } + $hint.text(n === 1 + ? 'Saving creates 1 item, priced below' + : 'Saving creates ' + n + ' items, each priced below').show(); + }, + + /* + * Fill an axis's value list from whichever variant is selected on it. + * + * This used to happen ONLY inside a select2:select handler - that is, only + * when somebody actively picked a variant from the dropdown. But + * loadSelectVariant PRESELECTS the first variant with + * .val(1).trigger('change.select2'), and a namespaced trigger does not run + * a plain 'change' handler, let alone select2's own select event. + * + * So the form opened showing "size" chosen with an EMPTY value list behind + * it (reported: "variant values not loaded"). The only way out was to open + * the dropdown and re-pick the option that already looked picked, which is + * not a thing anyone would think to try. + * + * Reading the selected OPTION rather than an event payload is what lets the + * same function serve both cases - a preselect has no event to read. + */ + loadVariantValues: function (axisSelector, listSelector) { + var $list = $(listSelector); + if (!$list.length) { return; } + var raw = $(axisSelector).find('option:selected').attr('data-variant-fields'); + var fields = []; + try { + fields = JSON.parse(raw || '[]') || []; + } catch (e) { + fields = []; /* a malformed field list must not take the page down */ + } + /* One option per DISTINCT value. + A variant saved with 38, 40, 40 offered 40 twice, and select2 keys a + multi-select on the option ELEMENT, not its value - so both copies + could be picked, producing two items called "Shirt / 40". The server + de-duplicates too; this covers a list already cached in the page. */ + var seen = {}; + var opts = []; + $.each(fields, function (_, f) { + var name = $.trim(String(f && f.name != null ? f.name : '')); + if (!name) { return; } + var key = name.toLowerCase(); + if (seen[key]) { return; } + seen[key] = true; + /* Built as elements, not concatenated markup: a variant value is + shop-entered text, and a name containing a quote would otherwise + end the attribute and swallow the rest of the list. */ + opts.push($('<option>').attr('value', name).text(name)[0]); + }); + $list.empty().append(opts).val(null).trigger('change'); + }, + + /* + * Say whether what was typed is actually a GTIN, while it is being typed. + * + * The server is the authority and refuses anything invalid - but silently, + * by storing an empty field. Without a word here, somebody mistypes a digit, + * saves, and the item simply has no GTIN with nothing to explain why. + * + * The check digit is the whole point: it catches exactly the single-digit + * and transposition errors a person makes copying fourteen numbers off a + * pack, which is why GS1 put it there. + */ + checkGtin: function () { + var $hint = $('#items_gtin_hint'); + if (!$hint.length) { return; } + var raw = String($('#items_gtin').val() || '').replace(/[\s-]/g, ''); + + if (!raw) { + /* Empty is the NORMAL case. Most shop items - loose produce, + own-brand, anything made on site - will never have one, and + nagging about it would train people to ignore the field. */ + $hint.text('').removeClass('text-danger text-success'); + return; + } + if (!/^\d+$/.test(raw) || [8, 12, 13, 14].indexOf(raw.length) === -1) { + $hint.text(PosnicPro.i18n.t('lang_a_gtin_is_8_12_13_or_14_digits', 'A GTIN is 8, 12, 13 or 14 digits')) + .addClass('text-danger').removeClass('text-success'); + return; + } + + /* GS1 check digit: from the right, weight 3 and 1 alternately. */ + var body = raw.slice(0, -1); + var sum = 0; + for (var i = 0; i < body.length; i++) { + var fromRight = body.length - 1 - i; + sum += Number(body[i]) * (fromRight % 2 === 0 ? 3 : 1); + } + if (((10 - (sum % 10)) % 10) !== Number(raw[raw.length - 1])) { + $hint.text(PosnicPro.i18n.t('lang_that_is_not_a_valid_barcode_check_the_digi', 'That is not a valid barcode - check the digits')) + .addClass('text-danger').removeClass('text-success'); + return; + } + + /* Valid, but is it a number the world shares? Prefixes 02, 04 and + 20-29 are printed by shops for loose goods; they scan correctly and + mean something different in every shop. Worth saying, because a + person scanning their own shelf label would otherwise think they had + found the manufacturer's number. */ + var p = raw.padStart(14, '0').slice(1, 3); + if (p === '02' || p === '04' || (Number(p) >= 20 && Number(p) <= 29)) { + $hint.text('Valid, but this is an in-store code - not the maker\'s number') + .removeClass('text-danger text-success'); + return; + } + $hint.text(PosnicPro.i18n.t('lang_valid_barcode', 'Valid barcode')).addClass('text-success').removeClass('text-danger'); + }, + + /* "2 ) Shirt / Large" once the item has a name, plain "2 ) Large" before + then. The row is usable either way - the heading is a label, not data. */ + variantRowTitle: function (index, itemName, value) { + var name = $.trim(itemName || ''); + return index + ' ) ' + (name ? name + ' / ' : '') + value; + }, + + /* Fill the headings in as the name is typed. + A retitle rather than a rebuild: rebuilding would discard every price + already typed into the rows, and on a per-keystroke handler that is the + difference between a form that helps and one that fights back. */ + retitleVariantRows: function () { + var itemName = $('#items_name').val(); + $('#load_price_fields .variant-row-title').each(function () { + var $t = $(this); + $t.text(PosnicPro.items.variantRowTitle( + $t.attr('data-variant-index'), itemName, $t.attr('data-variant-value') + )); + }); + }, + + /* + * What is typed into the variant rows, kept across a rebuild. + * + * loadVariant empties #load_price_fields and builds it again on every + * change to the value lists. Adding a ninth size after pricing eight threw + * away all eight prices, the SKUs, the barcodes and the quantities - the + * form silently reset the moment you extended it, which is the one moment + * you are most likely to. + * + * Keyed by variant VALUE, never by row position. Removing '40' from the + * middle shifts every row after it up one, so restoring by index would + * hand '42' the price that was typed for '44' - worse than losing it, + * because a wrong price looks like a real one. + */ + snapshotVariantRows: function () { + var snap = {}; + $('#load_price_fields .variant-row-title').each(function () { + var value = $(this).attr('data-variant-value'); + var i = Number($(this).attr('data-variant-index')) - 1; + if (!value || isNaN(i)) { return; } + snap[value] = { + itemid: $('#items_itemid_' + i).val(), + barcodeid: $('#items_barcodeid_' + i).val(), + company_price: $('#items_company_price_' + i).val(), + mrp_price: $('#items_mrp_price_' + i).val(), + selling_price: $('#items_selling_price_' + i).val(), + available_quantity: $('#items_available_quantity_' + i).val(), + sort: $('#items_sort_' + i).val(), + unit: $('#items_unit_' + i).val(), + discount_amount: $('#items_discount_amount_' + i).val(), + discount_percentage: $('#items_discount_percentage_' + i).val(), + photo: $('#items_photo_' + i).val(), + }; + }); + return snap; + }, + + /* The other half. A value that was not on screen before simply has no + entry, and keeps the fresh row's defaults. */ + restoreVariantRows: function (snap) { + if (!snap) { return; } + $('#load_price_fields .variant-row-title').each(function () { + var value = $(this).attr('data-variant-value'); + var i = Number($(this).attr('data-variant-index')) - 1; + var was = value ? snap[value] : null; + if (!was || isNaN(i)) { return; } + var put = function (prefix, v) { + /* An empty value means the field was never filled, and the + fresh row's default (0.00, 0, 99) is the better answer. */ + if (v !== undefined && v !== null && v !== '') { $(prefix + i).val(v); } + }; + put('#items_itemid_', was.itemid); + put('#items_barcodeid_', was.barcodeid); + put('#items_company_price_', was.company_price); + put('#items_mrp_price_', was.mrp_price); + put('#items_selling_price_', was.selling_price); + put('#items_available_quantity_', was.available_quantity); + put('#items_sort_', was.sort); + put('#items_discount_amount_', was.discount_amount); + put('#items_discount_percentage_', was.discount_percentage); + put('#items_photo_', was.photo); + /* The unit list is fetched per row and is still empty here, so + setting it now would select nothing. Applied in that request's + own callback instead. */ + }); + }, + loadVariant: function () { - var variant_value = $('#item_variant_list').val(); + /* variantCombinations already normalises jQuery's null-from-an-empty + multiple-select into an array, so .length below is always safe. */ + /* The product of both axes when a second one is in use - see + variantCombinations for why this is not derived twice. */ + var variant_value = $.map(PosnicPro.items.variantCombinations(), function (c) { + return c.value; + }); + /* Everything typed into the rows, before they are thrown away. Kept + on the module so the per-row unit request can reach it too. */ + PosnicPro.items._rowSnapshot = PosnicPro.items.snapshotVariantRows(); $("#load_price_fields").html(''); var html = ""; var item_name = $("#items_name").val(); - if (item_name === '' || item_name.length <= 2) { - PosnicPro.alert('error', 'Fill in the required fields.'); - $("#items_name").focus(); - return false; - } else if (variant_value.length === 0) { - PosnicPro.alert('error', 'Fill in the required fields.'); + /* + * The item name is deliberately NOT required here. + * + * This used to refuse to build anything until the name was typed, + * because each row is headed "<item> / <value>". That reason does not + * survive contact with the save: saveVariantFamily recomputes the name + * from the live field at submit time, so the heading is display only + * and never was an input to what gets stored. + * + * What the guard actually did was error the moment a variant value was + * picked and leave #load_price_fields empty - so there was nowhere to + * type a price, and nothing on screen said why (reported: "as soon as i + * select variant value i am seeing error and no price entering form not + * exist"). Clicking Save then re-entered here with the name filled and + * finally rendered the rows, which is why Save appeared to show the + * price box instead of saving. + * + * Now the rows appear on the first pick and the heading fills itself in + * as the name is typed. The name stays required to SAVE - the validator + * on #items_name already enforces that, and it says so in place. + */ + if (variant_value.length === 0) { + PosnicPro.alert('error', PosnicPro.i18n.t('lang_choose_at_least_one_variant_value_a_size_a', 'Choose at least one variant value - a size, a colour, a pack')); $("#item_variant_list").focus(); return false; } else { @@ -1959,7 +2870,7 @@ PosnicPro.items = { html = html + '<div class="card-body">'; html = html + '<div class="card-body">'; html = html + '<div class="card-header">'; - html = html + '<h5 class="card-title text-primary">' + (key + 1) + ' ) ' + item_name + ' / ' + name + '</h5>'; + html = html + '<h5 class="card-title text-primary variant-row-title" data-variant-value="' + name + '" data-variant-index="' + (key + 1) + '">' + PosnicPro.items.variantRowTitle(key + 1, item_name, name) + '</h5>'; html = html + '</div>'; html = html + '<div class="row">'; html = html + '<div class="col-md-6">'; @@ -1969,7 +2880,7 @@ PosnicPro.items = { html = html + '<i class="mdi mdi mdi-help-circle"></i>'; html = html + '</span>'; html = html + '</label>'; - html = html + '<input type="text" class="form-control" id="items_itemid_' + key + '" name="items_itemid_' + key + '" minlength="1" maxlength="20" placeholder="Enter SKU Code" autocomplete="off" onkeyup="PosnicPro.items.loadOnchangeSku();"/>'; + html = html + '<input type="text" class="form-control" id="items_itemid_' + key + '" name="items_itemid_' + key + '" minlength="1" maxlength="20" placeholder="Enter SKU Code" data-t-placeholder="lang_enter_sku_code" autocomplete="off" onkeyup="PosnicPro.items.loadOnchangeSku();"/>'; html = html + '</div>'; html = html + '<div class="col-md-6">'; html = html + '<label class="form-control-placeholder" for="items_barcodeid_' + key + '">'; @@ -1977,11 +2888,11 @@ PosnicPro.items = { html = html + '<span style="padding-left:50px">'; html = html + '<input type="checkbox" class="custom-control-input" id="same_as_sku_' + key + '" name="same_as_sku_' + key + '" onclick="PosnicPro.items.sameAsSku(this.checked);"/>'; html = html + '<label class="custom-control-label" for="same_as_sku_' + key + '">'; - html = html + '<span class="text-dark" style="font-size:11px;">Same as SKU</span>'; + html = html + '<span class="text-dark" style="font-size:11px;"><lang class="lang_same_sku">Same as SKU</lang></span>'; html = html + '</label>'; html = html + '</span>'; html = html + '</label>'; - html = html + '<input type="text" class="form-control" id="items_barcodeid_' + key + '" name="items_barcodeid_' + key + '" minlength="1" maxlength="100" placeholder="Scan From Bar Code Reader" autocomplete="off">'; + html = html + '<input type="text" class="form-control" id="items_barcodeid_' + key + '" name="items_barcodeid_' + key + '" minlength="1" maxlength="100" placeholder="Scan From Bar Code Reader" data-t-placeholder="lang_scan_from_bar_code_reader" autocomplete="off">'; html = html + '</div>'; html = html + '</div>'; html = html + '<div class="row">'; @@ -1989,7 +2900,7 @@ PosnicPro.items = { html = html + '<label class="form-control-placeholder" for="items_company_price_' + key + '">'; html = html + '<lang class="lang_company_title"> Cost </lang>'; html = html + '</label>'; - html = html + '<input type="text" class="form-control allow_decimal text-right" id="items_company_price_' + key + '" name="items_company_price_' + key + '" minlength="1" maxlength="10" value="0.00" placeholder="Cost">'; + html = html + '<input type="text" class="form-control allow_decimal text-right" id="items_company_price_' + key + '" name="items_company_price_' + key + '" minlength="1" maxlength="10" value="0.00" placeholder="Cost" data-t-placeholder="lang_companyamount_title">'; html = html + '</div>'; html = html + '<div class="col-md-6">'; html = html + '<label class="form-control-placeholder" for="items_mrp_price_' + key + '">'; @@ -2003,13 +2914,13 @@ PosnicPro.items = { html = html + '<label class="form-control-placeholder" for="items_selling_price_' + key + '">'; html = html + '<lang class="lang_sales_title"> Selling </lang>'; html = html + '</label>'; - html = html + '<input type="text" class="form-control allow_decimal text-right" id="items_selling_price_' + key + '" name="items_selling_price_' + key + '" minlength="1" maxlength="10" value="0.00" placeholder="Sale Price">'; + html = html + '<input type="text" class="form-control allow_decimal text-right" id="items_selling_price_' + key + '" name="items_selling_price_' + key + '" minlength="1" maxlength="10" value="0.00" placeholder="Sale Price" data-t-placeholder="lang_sale_price">'; html = html + '</div>'; html = html + '<div class="col-md-6">'; html = html + '<label class="form-control-placeholder" for="items_available_quantity_' + key + '">'; html = html + '<lang class="lang_itemquantity_title"> Quantity </lang>'; html = html + '</label>'; - html = html + '<input type="number" class="form-control allow_decimal text-right" id="items_available_quantity_' + key + '" name="items_available_quantity_' + key + '" minlength="1" maxlength="10" value="0" placeholder="Available Quantity">'; + html = html + '<input type="number" class="form-control allow_decimal text-right" id="items_available_quantity_' + key + '" name="items_available_quantity_' + key + '" minlength="1" maxlength="10" value="0" placeholder="Available Quantity" data-t-placeholder="lang_availablequatity_title">'; html = html + '</div>'; html = html + '</div>'; html = html + '<div class="row">'; @@ -2017,7 +2928,7 @@ PosnicPro.items = { html = html + '<label class="form-control-placeholder" for="items_sort_' + key + '">'; html = html + '<lang class="lang_showitemposition_title"> Item Position </lang>'; html = html + '</label>'; - html = html + '<input type="number" class="form-control allow_decimal text-right" id="items_sort_' + key + '" name="items_sort_' + key + '" minlength="1" maxlength="10" value="99" placeholder="Available Quantity">'; + html = html + '<input type="number" class="form-control allow_decimal text-right" id="items_sort_' + key + '" name="items_sort_' + key + '" minlength="1" maxlength="10" value="99" placeholder="Available Quantity" data-t-placeholder="lang_availablequatity_title">'; html = html + '</div>'; html = html + '<div class="col-md-6">'; html = html + '<label class="form-control-placeholder" for="items_unit_' + key + '">'; @@ -2046,6 +2957,31 @@ PosnicPro.items = { html += ' </div>'; html += '</div>'; + /* + * This variant's own photo. + * + * Every variant is its own item record with its own image + * field, but the form only ever offered one uploader - so a + * family of shirts saved the SAME picture against red, blue + * and green, and the sale grid showed three identical tiles. + * + * Chosen from the photos already added above rather than a + * second uploader per row: the pictures of a red shirt and a + * blue shirt are pictures of the same family, they belong in + * one place, and uploading each one twice is work nobody + * should have to do. + * + * Optional. A row with nothing chosen keeps the family's whole + * set, which is what every existing item already does. + */ + html += '<div class="row">'; + html += ' <div class="col-md-12">'; + html += ' <label class="form-control-placeholder"><lang class="lang_photo_for_this_variant">Photo for this variant</lang></label>'; + html += ' <input type="hidden" id="items_photo_' + key + '" value="">'; + html += ' <div class="items-variant-photos" id="items_photo_strip_' + key + '"></div>'; + html += ' </div>'; + html += '</div>'; + // Add toggle behavior using jQuery html += '<script>'; html += '$(document).ready(function () {'; @@ -2066,13 +3002,26 @@ PosnicPro.items = { url: 'setting/getUnitAjaxList', data: 'query=' }; - let unitOption; PosnicPro.get(params, function (response) { - $("#items_unit_" + key + '').empty(); - $(response.suggestions).each(function (key, dataItem) { - unitOption += '<option value="' + dataItem.unit_id + '" data-unit-id="' + dataItem.unit_id + '" data-unit-name="' + dataItem.unit_name + '" data-unit-value="' + dataItem.unit_value + '">' + dataItem.unit_name + ' - ' + dataItem.unit_value + '</option>'; - }); - $("#items_unit_" + key + '').append(unitOption); + var $sel = $("#items_unit_" + key).empty(); + /* This select was empty when restoreVariantRows ran, so + setting the unit then would have selected nothing. */ + var wasRow = PosnicPro.items._rowSnapshot && PosnicPro.items._rowSnapshot[name]; + /* `let unitOption;` started undefined, so the first += put the + literal "undefined" in front of the first option - and the + string accumulated across every variant row built after it. */ + $sel.append($.map(response.suggestions || [], function (dataItem) { + return $('<option>') + .attr('value', dataItem.unit_id) + .attr('data-unit-id', dataItem.unit_id) + .attr('data-unit-name', dataItem.unit_name) + .attr('data-unit-value', dataItem.unit_value) + .text(dataItem.unit_name + ' - ' + dataItem.unit_value)[0]; + })); + if (wasRow && wasRow.unit) { + $sel.val(wasRow.unit); + if ($sel.hasClass('select2-hidden-accessible')) { $sel.trigger('change.select2'); } + } }); html = html + '</select>'; @@ -2082,6 +3031,10 @@ PosnicPro.items = { html = html + '</div>'; }); $("#load_price_fields").append(html); + PosnicPro.items.restoreVariantRows(PosnicPro.items._rowSnapshot); + /* The rows only exist now, so this is the first moment their + strips can be filled from whatever is already uploaded. */ + PosnicPro.items.renderVariantPhotoPickers(); $("#items_itemid_0").focus(); } }, @@ -2124,7 +3077,7 @@ PosnicPro.items = { return false; } if ($('#item-display-preview').find('div').length > 11) { - PosnicPro.alert('error', "You can upload up to 12 files."); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_you_can_upload_up_to_12_files', 'You can upload up to 12 files.')); return false; } @@ -2132,7 +3085,7 @@ PosnicPro.items = { $('#item_upload_image_status').val('yes'); $('#item-display-preview').append( '<div id="selector_' + count + '" class="receiving-image-wrapper image-area" style="position: relative;"> \ - <img class="image_style" class="img-thumbnail" src="' + e.target.result + '" \ + <img loading="lazy" decoding="async" class="image_style" class="img-thumbnail" src="' + e.target.result + '" \ title="' + escape(file_data.name) + '" /><br /> \ <span id="coverimage_selector_' + count + '" class="coverImageAdd" style="display: block;border: 1px solid #ddd;border-radius: 5px;margin-top: 2px; background: #506fe4; color: #fff" onclick="PosnicPro.items.coverImage(this.id,\'' + count + '\',\'' + file_data.name + '\',\'' + file_data.size + '\',\'' + fileImage + '\')">Choose Cover</span><a class="remove-image" style="cursor:pointer;display: inline;position: absolute; top: -10px; right: -10px; border-radius: 10em; padding: 2px 6px 3px; text-decoration: none; font: 700 21px/20px sans-serif; background: #f48787; border: 3px solid #fff; color: #FFF; box-shadow: 0 2px 6px rgba(0,0,0,0.5), inset 0 2px 4px rgba(0,0,0,0.3); text-shadow: 0 1px 2px rgba(0,0,0,0.5); -webkit-transition: background 0.5s; transition: background 0.5s;" onclick="PosnicPro.items.image_remove_selected(\'' + count + '\',\'' + file_data.name + '\')">×</a> \ </div>'); @@ -2147,6 +3100,9 @@ PosnicPro.items = { cover: coverFlag }; + /* Newly added - offer it to every variant row on screen. */ + PosnicPro.items.renderVariantPhotoPickers(); + // If it's the first image, update the logo and styles if (count === 0) { $('#item_logo').val(file_data.name); @@ -2213,6 +3169,8 @@ PosnicPro.items = { return item.name; }).indexOf(name); PosnicPro.items.imageParams.splice(removeIndex, 1); + /* A variant may have been pointing at the photo just deleted. */ + PosnicPro.items.renderVariantPhotoPickers(); $('#selector_' + id).remove(); if (PosnicPro.items.imageParams.length === 0) { $('#item_logo').val('item.svg'); @@ -2265,6 +3223,8 @@ PosnicPro.items = { return item.name; }).indexOf(name); PosnicPro.items.imageParams.splice(removeIndex, 1); + /* A variant may have been pointing at the photo just deleted. */ + PosnicPro.items.renderVariantPhotoPickers(); $('#selector_' + id).remove(); if (PosnicPro.items.imageParams.length === 0) { $('#item_upload_image_status').val('no'); @@ -2310,6 +3270,108 @@ PosnicPro.items = { $('#items_discount_percentage').val(discountPercentage); } }, + /* + * Supplier picker, the same shape as Category (owner ask). + * + * It was a bare autocomplete: an empty box that showed nothing until you + * guessed part of a name, which only helps someone who already knows what + * they are looking for. Now the list is fetched when the form opens, so it + * opens showing real suppliers and typing filters what is already there. + * + * NEVER AN EMPTY LIST (owner: "if there is no recent item fire db query get + * latest or most used. i dont want empty list. make it very smart app"). + * An empty query to getSuppliersAjaxList is exactly that DB read - it + * returns the branch's suppliers rather than nothing - so the picker is + * populated before anyone types. When a shop genuinely has none, the + * placeholder says so and points at the link that fixes it, because a + * dropdown that opens on nothing with no explanation reads as broken. + * + * The two hidden fields are kept in step, so every payload builder and + * edit-fill in this file keeps reading exactly what it read before. + */ + /* + * Read one attribute off a select2's selection, or nothing. + * + * The save path did this instead: + * + * taxDetail[0].element.attributes['data-tax-value'].value + * + * which throws "Cannot read properties of undefined (reading 'element')" + * the moment there IS no selection - and with the tax module turned off + * there is none, so saving any item threw before it reached the server. + * The same line existed twice, and the category read below it had the same + * shape: category_id was guarded, category_name was not, so an item saved + * without a category threw as well. Category is optional. + * + * A feature being off is not an error, and neither is an optional field + * being empty. Both mean "no value", which is what this returns. + */ + selectAttr: function (selector, attribute, fallback) { + var data; + try { + data = $(selector).select2('data'); + } catch (e) { + return fallback === undefined ? '' : fallback; + } + var el = data && data.length ? data[0].element : null; + var attr = el && el.attributes ? el.attributes[attribute] : null; + if (attr && attr.value !== undefined && attr.value !== null && attr.value !== '') { + return attr.value; + } + return fallback === undefined ? '' : fallback; + }, + + loadSelectSupplier: function (selectedId, selectedName) { + var $pick = $('#items_supplier_pick'); + if (!$pick.length) { return; } + var params = { + url: 'suppliers/getSuppliersAjaxList', + data: 'query=&branch=' + (PosnicPro.local.get('branch_id_set') || '') + }; + PosnicPro.get(params, function (response) { + var rows = (response && response.suggestions) || []; + $pick.empty().append('<option value=""></option>'); + $.each(rows, function (i, row) { + $pick.append( + $('<option>').attr('value', row.id).attr('data-supplier-name', row.name).text(row.name) + ); + }); + /* An id we were given but the list does not carry - an inactive or + deleted supplier on an existing item. Keeping it selectable means + editing an item does not silently clear its supplier. */ + if (selectedId && !$pick.find('option[value="' + selectedId + '"]').length) { + $pick.append( + $('<option>').attr('value', selectedId) + .attr('data-supplier-name', selectedName || '') + .text(selectedName || selectedId) + ); + } + /* view.js runs a global $(".select2").select2() when the page + renders, so this control is already an initialised, EMPTY select2 + by the time the list arrives. Calling select2() again on a live + instance does not re-read the options - it has to be destroyed + first, or the box says "No results found" over a select that is + full of them. That is exactly what it did. */ + if ($pick.hasClass('select2-hidden-accessible')) { + $pick.select2('destroy'); + } + $pick.select2({ + placeholder: rows.length + ? 'Choose a Supplier' + : 'No suppliers yet - add one from the Suppliers screen' + }); + $pick.val(selectedId || '').trigger('change.select2'); + }, function () { + /* A failed lookup must not leave a dead control: the item can still + be saved without a supplier, which is why the field is optional. */ + if ($pick.hasClass('select2-hidden-accessible')) { + $pick.select2('destroy'); + } + $pick.empty().append('<option value=""></option>') + .select2({ placeholder: PosnicPro.i18n.t('lang_suppliers_could_not_be_loaded', 'Suppliers could not be loaded') }); + }); + }, + loadSelectCategory: function () { var categorySelect = $('.items_category'); var params = { @@ -2323,15 +3385,31 @@ PosnicPro.items = { under an arbitrary category - misfiled catalogues by default. Category is required; choosing it is one deliberate tap. */ categorySelect.append('<option value=""></option>'); - suggestions: $.map(response.suggestions, function (dataItem) { - var option; - option += '<option value="' + dataItem.id + '" data-category-name="' + dataItem.name + '" data-category-id="' + dataItem.id + '" data-item-discountamount="' + dataItem.discount_amount + '" data-item-discountpercentage="' + dataItem.discount_percentage + '">' + dataItem.name + ' </option>'; - categorySelect.append(option).select2(); + /* + * Built once, appended once, initialised once. + * + * This loop used to do all three per option: `var option;` starts + * undefined, so `option += '<option...'` produced the literal string + * "undefined" in front of every entry, and .select2() ran again on + * every pass - re-initialising the widget once per category. That + * re-entry is what threw "Cannot read properties of null (reading + * 'offsetWidth')": select2 measures a container that the previous + * init has already replaced. + */ + var options = $.map(response.suggestions || [], function (dataItem) { + return $('<option>') + .attr('value', dataItem.id) + .attr('data-category-name', dataItem.name) + .attr('data-category-id', dataItem.id) + .attr('data-item-discountamount', dataItem.discount_amount) + .attr('data-item-discountpercentage', dataItem.discount_percentage) + .text(dataItem.name)[0]; }); - $(".items_category").select2({ - placeholder: "Choose a Category" - }); - $(".items_category").val('').trigger('change.select2'); + categorySelect.append(options); + categorySelect.select2({ placeholder: "Choose a Category" }); + /* AFTER init - firing change.select2 at a select that is not a + select2 yet is the other half of the same crash. */ + categorySelect.val('').trigger('change.select2'); }, function (xhr) { var response = jQuery.parseJSON(xhr.responseText); PosnicPro.alert(response.type, response.message); @@ -2346,17 +3424,52 @@ PosnicPro.items = { }; PosnicPro.get(params, function (response) { variantSelect.empty(); - suggestions: $.map(response.suggestions, function (dataItem) { - var option; - option += '<option id="' + dataItem.id + '" value="' + dataItem.id + '" data-variant-name="' + dataItem.name + '" data-variant-id="' + dataItem.id + '">' + dataItem.name + ' </option>'; - variantSelect.append(option).select2(); - $('#' + dataItem.id).attr('data-variant-fields', JSON.stringify(dataItem.fields)); - }); - $("#items_variant").val(1).trigger('change.select2'); - $("#items_variant").select2({ - placeholder: "Choose a Variant" + var vOptions = $.map(response.suggestions || [], function (dataItem) { + return $('<option>') + .attr('id', dataItem.id) + .attr('value', dataItem.id) + .attr('data-variant-name', dataItem.name) + .attr('data-variant-id', dataItem.id) + .attr('data-variant-fields', JSON.stringify(dataItem.fields)) + .text(dataItem.name)[0]; }); - $('#item_variant_list').html(''); + variantSelect.append(vOptions); + variantSelect.select2({ placeholder: "Choose a Variant" }); + /* The value was set BEFORE select2 existed, so the widget never saw + it and the change fired at a plain select. */ + variantSelect.val(1).trigger('change.select2'); + /* The preselect above is a real selection, so its values belong on + screen. Clearing the list here was what left the form showing a + chosen variant with nothing to choose from. */ + PosnicPro.items.loadVariantValues('#items_variant', '#item_variant_list'); + + /* The second axis offers the same list. Cloned from the response + rather than from the first select's DOM - moving option elements + between two selects would empty the first one. */ + var second = $('#items_variant_2'); + if (second.length) { + second.empty(); + second.append($.map(response.suggestions || [], function (dataItem) { + return $('<option>') + .attr('value', dataItem.id) + .attr('data-variant-name', dataItem.name) + .attr('data-variant-id', dataItem.id) + .attr('data-variant-fields', JSON.stringify(dataItem.fields)) + .text(dataItem.name)[0]; + })); + /* Destroy first: view.js runs a global $('.select2').select2() + at page render, and re-calling select2() on a live instance + does NOT re-read the options. */ + if (second.hasClass('select2-hidden-accessible')) { second.select2('destroy'); } + second.select2({ placeholder: PosnicPro.i18n.t('lang_choose_a_variant', 'Choose a Variant') }); + /* No preselection - an unopened second axis must stay empty, or + every plain item silently becomes a combination. */ + second.val('').trigger('change.select2'); + $('#item_variant_list_2').html(''); + /* The first axis is preselected above, so its option in this + list has to be greyed out before the list is ever opened. */ + PosnicPro.items.syncAxisExclusion(); + } }, function (xhr) { var response = jQuery.parseJSON(xhr.responseText); PosnicPro.alert(response.type, response.message); @@ -2370,11 +3483,16 @@ PosnicPro.items = { }; PosnicPro.get(params, function (response) { taxSelect.empty(); - suggestions: $.map(response.suggestions, function (dataItem) { - var option; - option += '<option value="' + dataItem.tax_id + '" data-tax-id="' + dataItem.tax_id + '" data-tax-name="' + dataItem.tax_name + '" data-tax-value="' + dataItem.tax_value + '">' + dataItem.tax_name + '</option>'; - taxSelect.append(option).trigger('change'); + /* One append and one change, not one of each per tax rate. */ + var tOptions = $.map(response.suggestions || [], function (dataItem) { + return $('<option>') + .attr('value', dataItem.tax_id) + .attr('data-tax-id', dataItem.tax_id) + .attr('data-tax-name', dataItem.tax_name) + .attr('data-tax-value', dataItem.tax_value) + .text(dataItem.tax_name)[0]; }); + taxSelect.append(tOptions).trigger('change'); if (PosnicPro.local.get('default_tax_enable_disable') === 'false') { taxSelect.val(1).trigger('change.select2'); } else { @@ -2395,11 +3513,15 @@ PosnicPro.items = { }; PosnicPro.get(params, function (response) { unitSelect.empty(); - suggestions: $.map(response.suggestions, function (dataItem) { - var option; - option += '<option value="' + dataItem.unit_id + '" data-unit-id="' + dataItem.unit_id + '" data-unit-name="' + dataItem.unit_name + '" data-unit-value="' + dataItem.unit_value + '">' + dataItem.unit_name + ' - ' + dataItem.unit_value + '</option>'; - unitSelect.append(option).trigger('change'); + var uOptions = $.map(response.suggestions || [], function (dataItem) { + return $('<option>') + .attr('value', dataItem.unit_id) + .attr('data-unit-id', dataItem.unit_id) + .attr('data-unit-name', dataItem.unit_name) + .attr('data-unit-value', dataItem.unit_value) + .text(dataItem.unit_name + ' - ' + dataItem.unit_value)[0]; }); + unitSelect.append(uOptions).trigger('change'); $('.items_unit option:eq(0)').prop('selected', true); }, function (xhr) { var response = jQuery.parseJSON(xhr.responseText); @@ -2414,10 +3536,10 @@ PosnicPro.items = { $('#items_new .alert').remove(); if ($("#product_without_variant").is(":checked")) { $('#show_variant_fields').hide(); - $('#show_price_fields').show(); + $('#show_price_fields,#sku_card_col').show(); $('#product_without_variant').prop('checked', true); } else { - $('#show_price_fields').hide(); + $('#show_price_fields,#sku_card_col').hide(); $('#show_variant_fields').show(); $('#show_variant_fields').css("display", "block"); $('#item_variant_list').empty().trigger('change'); @@ -2426,6 +3548,7 @@ PosnicPro.items = { $('#items_name').val(''); $("#items_variant").val('').trigger('change'); $("#item_variant_list").val('').trigger('change'); + PosnicPro.items.resetSecondAxis(); $("#items_hsncode").val(''); $("#hsn_tax").val(''); $("#items_discount_amount").val('0.00'); @@ -2449,11 +3572,12 @@ PosnicPro.items = { $('#default_tax').show(); $('#item_logo').val('item.svg'); PosnicPro.items.imageParams = []; - $(".items_category").val('').trigger('change.select2'); $(".items_category").select2({ placeholder: "Choose a Category" }); + $(".items_category").val('').trigger('change.select2'); PosnicPro.items.loadSelectCategory(); + PosnicPro.items.loadSelectSupplier(); PosnicPro.items.loadSelectTax(); PosnicPro.items.loadSelectVariant(); } @@ -2518,9 +3642,14 @@ PosnicPro.itemdetails = { var returnTotalValue = 0; for (var i = 0; i < response.data.table.data.list.length; i++) { var row = response.data.table.data.list[i]; - saleTotalValue += row.items_total; - returnTotalValue += row.items_return_total; - if (row.sale_process == 'Add' || row.sale_process == 'Edit') { + // A sale without denormalised totals (demo seeds, old + // imports) must cost that CELL its number, never the + // page - undefined.toFixed() here white-paged items. + var rowSaleTotal = Number(row.items_total) || 0; + var rowReturnTotal = Number(row.items_return_total) || 0; + saleTotalValue += rowSaleTotal; + returnTotalValue += rowReturnTotal; + if (!row.sale_process || row.sale_process == 'Add' || row.sale_process == 'Edit') { process_class = "badge badge-success-inverse"; } else if (row.sale_process == 'PartialReturn') { process_class = "badge badge-secondary-inverse"; @@ -2544,7 +3673,7 @@ PosnicPro.itemdetails = { // current time when no preformatted date is present. let rawDate = row.string_date || row.date || row.created_date || row.updated_date; let updateDate = rawDate ? PosnicPro.convertDate(rawDate) : ''; - let trow = '<tr> <td scope="row">' + row_no + '</td> <td>' + row.sales_id + '</td> <td class="export-date">' + updateDate + '</td> <td class="text-center"><span class="' + process_class + '">' + row.sale_process + '</span></td> <td class="text-center text-danger">' + returnQty + '</td> <td class="text-right text-danger">' + currency + ' ' + row.items_return_total.toFixed(2) + '</td><td class="text-center text-success">' + salesQty + '</td><td class="text-right text-success">' + currency + ' ' + row.items_total.toFixed(2) + '</td></tr>'; + let trow = '<tr> <td scope="row" data-label="#">' + row_no + '</td> <td data-label="Sale">' + row.sales_id + '</td> <td class="export-date" data-label="Date">' + updateDate + '</td> <td class="text-center" data-label="Process"><span class="' + process_class + '">' + (row.sale_process || 'Add') + '</span></td> <td class="text-center text-danger" data-label="Return qty">' + returnQty + '</td> <td class="text-right text-danger" data-label="Return total">' + currency + ' ' + rowReturnTotal.toFixed(2) + '</td><td class="text-center text-success" data-label="Qty">' + salesQty + '</td><td class="text-right text-success" data-label="Total">' + currency + ' ' + rowSaleTotal.toFixed(2) + '</td></tr>'; $('#view_itemdetails').children('tbody').append(trow); $('span.number').number(true, 2); } @@ -2596,7 +3725,7 @@ PosnicPro.itemdetails = { // exported report matches the on-screen Date column. let exportRawDate = val.string_date || val.date || val.created_date || val.updated_date; let date = exportRawDate ? PosnicPro.convertDate(exportRawDate) : ''; - let process = val.sale_process; + let process = val.sale_process || 'Add'; let saleId = val.sales_id; let returnTotal = val.items_return_total; let saleTotal = val.items_total; @@ -2731,7 +3860,7 @@ PosnicPro.itemdetails = { + '</tr>'; } if (!shown) { - html = '<tr><td colspan="7" class="text-center text-muted" style="padding:20px;">No changes of this kind.</td></tr>'; + html = '<tr><td colspan="7" class="text-center text-muted" style="padding:20px;"><lang class="lang_no_changes_of_this_kind">No changes of this kind.</lang></td></tr>'; } $('#item_pricehistory_body').html(html); $('#item_history_filter_count').text(shown + ' of ' + rows.length); @@ -2746,53 +3875,12 @@ PosnicPro.itemdetails = { $(function () { $('#items_discount_percentage').attr('disabled', 'disabled').addClass('bg-white').val('0.00').hide(); - $('#items_supplier').on('keypress keydown.autocomplete', function () { - var branch = PosnicPro.local.get("branch_id_set"); - $(this).autocomplete({ - lookup: function (query, done) { - var result = {}; - var suggestions = []; - var params = { - url: 'suppliers/getSuppliersAjaxList', - data: 'query=' + query + '&branch=' + branch - }; - PosnicPro.get(params, function (response) { - if (response.suggestions.length > 0) { - suggestions: $.map(response.suggestions, function (dataItem) { - suggestions.push({"value": dataItem.name, "data": dataItem}); - }); - } else { - suggestions.push({value: $('#items_supplier').val() + ' ', data: -1}); - } - result["suggestions"] = suggestions; - done(result); - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); - }); - }, - onSelect: function (suggestion) { - if (suggestion.data !== -1) { - $('#items_supplier_id').val(suggestion.data.id); - } else { - hasher.setHash('items/suppliers/new'); - } - }, - autoSelectFirst: true, - triggerSelectOnValidInput: false, - formatResult: function (suggestion) { - var addnew = ''; - var phone = suggestion.data.phone; - if (suggestion.data === -1 || typeof suggestion.phone === undefined) { - addnew = "( Add new )"; - phone = ''; - } - return '<div>' + - $.Autocomplete.formatResult(suggestion) + - '</div><span class="pull-right">' + phone + '</span><span class="pull-right" style="margin-top:-20px;">' + addnew + '</span>'; - } - }); - }); + // One-time init like the sale search: never rebuild per keystroke. + /* The supplier autocomplete lived here. It bound to #items_supplier, which + is a hidden input now - the picker above replaced it, and an autocomplete + on a hidden field can never fire. Removed rather than left: a plugin + initialised against something invisible is the kind of code that reads as + working for years. See loadSelectSupplier. */ }); $(function () { @@ -2809,17 +3897,185 @@ $(function () { if ($('#items_discount_amount').val() === '') $('#items_discount_amount').val('0'); }); + var syncVariantLink = function () { + $('#variant_mode_link').text($('#product_with_variant').is(':checked') + ? 'Remove variants' : '+ This item has variants'); + }; + /* ------------------------------------------------------------------ + * Getting through a tabbed form (owner ask: "next button to move next + * tab... if one tab full completed green tick or something"). + * + * A tabbed form with no way forward makes people hunt for the next tab, and + * gives no sense of how much is left. Two small things fix both: a step + * button at the end of each pane, and a tick on each tab that has something + * in it. + * + * WHAT THE TICK MEANS is the part worth being careful about. Only the Item + * tab has required fields. Ticking Details and More for "correct" would be + * a claim the form cannot make - they are entirely optional - so the tick + * means "there is something in here". Item ticks when its REQUIRED fields + * are filled, which is the only tab where that is a real statement. A badge + * that lies is one people stop reading. + * ------------------------------------------------------------------ */ + /* + * Colour and shape describe the sale-grid tile WHEN THERE IS NO IMAGE. The + * label always said so; the controls stayed on screen anyway, asking for a + * decision that an uploaded image immediately overrides. + * + * Driven off what is actually on screen (the preview strip) plus the stored + * cover name, because an image can arrive three ways - a fresh upload, an + * edit loading an existing item, and a clone - and hooking each one is how + * the third gets missed. + */ + PosnicPro.items.refreshTileFallback = function () { + var cover = $.trim($('#item_logo').val() || ''); + var hasImage = $('#item-display-preview').find('img').length > 0 + || (cover !== '' && cover !== 'item.svg'); + $('#item_tile_fallback').toggle(!hasImage); + }; + + /* The preview strip is written by several paths, so watch the node rather + than every writer. */ + $(function () { + var node = document.getElementById('item-display-preview'); + if (!node || typeof MutationObserver === 'undefined') { return; } + new MutationObserver(function () { + PosnicPro.items.refreshTileFallback(); + }).observe(node, { childList: true, subtree: true }); + PosnicPro.items.refreshTileFallback(); + }); + + /* + * A tick means the tab is FINISHED - every field in it answered. + * + * It used to mean "there is something in here", which ticked a tab after one + * field and told nobody anything useful (owner: "enable tick only all fields + * filled. not just one in the tab"). + * + * What counts as a field, and why: + * + * - Only what is VISIBLE. Service mode hides stock, variant mode hides + * price and SKU, and the mode radios are hidden by design. A tab cannot + * be incomplete because of a box nobody can reach. + * - Not checkboxes or radios. They are never empty - unchecked IS an + * answer - so requiring them would mean ticking every toggle on the form + * to earn a tick, which is the opposite of what it should encourage. + * - Not disabled or readonly fields, for the same reason as hidden. + * - An open-price item has no selling price ON PURPOSE. Demanding one would + * leave that tab permanently unticked for a legitimate item. + */ + PosnicPro.items.tabIsComplete = function (paneId) { + var $pane = $('#' + paneId); + if (!$pane.length) { return false; } + var openPrice = $('#item_open_price').is(':checked'); + var complete = true; + var seen = 0; + + $pane.find('input, select, textarea').each(function () { + var $f = $(this); + var type = ($f.attr('type') || '').toLowerCase(); + if (type === 'checkbox' || type === 'radio' || type === 'hidden') { return; } + if ($f.is(':disabled') || $f.prop('readonly')) { return; } + /* A select2 hides its own <select> and shows a rendered box, so + :visible on the select itself is always false - ask the control + the user can actually see. */ + var $shown = $f.hasClass('select2-hidden-accessible') + ? $f.next('.select2-container') + : $f; + if (!$shown.length || !$shown.is(':visible')) { return; } + if ($f.is('#items_selling_price') && openPrice) { seen += 1; return; } + + seen += 1; + if ($.trim($f.val() || '') === '') { complete = false; } + }); + + /* A tab with nothing to fill is not "complete", it is empty - ticking it + would be a badge for having opened the page. */ + return seen > 0 && complete; + }; + + PosnicPro.items.refreshTabTicks = function () { + $('#item_form_tabs .nav-link').each(function () { + var pane = $(this).data('tab-pane'); + if (!pane) { return; } + $(this).toggleClass('is-complete', PosnicPro.items.tabIsComplete(pane)); + }); + }; + + /* Every edit can change a tick, so this listens broadly rather than + enumerating fields - a list would go stale the first time one is added. */ + $(document).on('input change', '#item_image_upload_form input, #item_image_upload_form select, #item_image_upload_form textarea', + function () { PosnicPro.items.refreshTabTicks(); }); + + $(document).on('click', '.item-tab-next, .item-tab-back', function () { + var target = $(this).data('goto'); + if (!target) { return; } + $('#item_form_tabs .nav-link[data-tab-pane="' + target + '"]').tab('show'); + /* The form is taller than the viewport on a small screen, and switching + tabs leaves you wherever the last one had scrolled to. */ + $('html, body').animate({ scrollTop: $('#item_form_tabs').offset().top - 70 }, 150); + }); + + $(document).on('shown.bs.tab', '#item_form_tabs .nav-link', function () { + PosnicPro.items.refreshTabTicks(); + }); + + /* The picker drives the two hidden fields the rest of this file reads. */ + $(document).on('change', '#items_supplier_pick', function () { + var $opt = $(this).find('option:selected'); + $('#items_supplier_id').val($(this).val() || ''); + $('#items_supplier').val($opt.attr('data-supplier-name') || ''); + }); + + $(document).on('click', '#variant_mode_link', function () { + var withVariant = $('#product_with_variant').is(':checked'); + $(withVariant ? '#product_without_variant' : '#product_with_variant') + .prop('checked', true).trigger('change'); + }); + $(window).on('hashchange', function () { + if (/items\/(new|[^/]+\/(edit|clone))/.test(window.location.hash)) { + setTimeout(syncVariantLink, 400); + } + }); $("#product_without_variant, #product_with_variant").change(function () { - if ($("#product_without_variant").is(":checked")) { + syncVariantLink(); + var plain = $("#product_without_variant").is(":checked"); + /* The other half of the same rule (see applyServiceMode): a family of + variants is a family of stocked products, so the service tick has no + meaning while one is being built. Hidden rather than disabled - a + greyed control asks a question the form then refuses to answer. */ + $('#item_is_service').closest('.custom-control').toggle(plain); + /* Leaving variant mode must clear the count too, or the hint outlives + the rows it is describing - and the second axis with it, or turning + variants back on restores combinations from the previous item. */ + if (plain) { PosnicPro.items.resetSecondAxis(); } + PosnicPro.items.refreshVariantCount(); + if (plain) { $('#show_variant_fields').hide(); - $('#show_price_fields').show(); + $('#show_price_fields,#sku_card_col').show(); $("#load_price_fields").html(''); $("#show-hide-item-discount").show(); } else { - $('#show_price_fields').hide(); + $('#show_price_fields,#sku_card_col').hide(); $('#show_variant_fields').show(); $("#show-hide-item-discount").hide(); } + /* + * The PARENT's price and opening stock go too (owner: variant mode "is + * hiding so many stuff but those required. please check"). + * + * It was hiding cost, MRP, units, SKU and barcode while KEEPING selling + * price and opening stock - and demanding a selling price, which is + * required. But every variant row carries its own: saveVariantFamily + * reads items_selling_price_<n> and items_available_quantity_<n> and + * never reads these. So the form asked for two numbers it then threw + * away, on the one screen where it also hid the fields you did need. + * + * Either the parent owns price and stock or the variants do. The save + * path already decided: the variants do. + */ + $('#items_selling_price').closest('.form-group').toggle(plain); + $('#item_opening_wrap').toggle(plain && !$('#item_is_service').is(':checked')); }); }); @@ -2833,20 +4089,63 @@ $(document).ready(function () { return false; } return true; - }, "Please Enter a Valid Name"); + }, "Use letters, numbers and spaces only"); /* IC1: a selling price is required unless the item is deliberately open-price (ask at the till). The old form accepted the 0.00 default silently, which is how shops end up with unpriced catalogues. */ + /* + * Tax follows its feature toggle. + * + * The rule was `required: true` regardless, so a shop with the tax module + * turned off could not save an item at all: the select has no options and + * no selection, and the validator refused a field the shop had deliberately + * switched away. + * + * taxFeatureOn() is the same check the sale screen uses - the general + * settings blob first, the legacy flag only as a fallback - so the two + * screens cannot disagree about whether this shop charges tax. + */ + jQuery.validator.addMethod("taxRequiredWhenEnabled", function (value) { + var on = (PosnicPro.sales && typeof PosnicPro.sales.taxFeatureOn === 'function') + ? PosnicPro.sales.taxFeatureOn() + : PosnicPro.local.get('default_tax_enable_disable') === 'true'; + if (!on) { return true; } + return $.trim(value || '') !== ''; + }, "Choose a tax rate"); + jQuery.validator.addMethod("sellingPriceOrOpen", function (value) { if ($('#item_open_price').is(':checked')) { return true; } + /* In variant mode the parent has no price of its own - saveVariantFamily + reads items_selling_price_<n> from each variant row and never looks at + this field. Demanding it here asked for a number that is discarded, + and did it on a field the same mode hides. */ + if ($('#product_with_variant').is(':checked')) { + return true; + } return (parseFloat(value) || 0) > 0; }, "Enter a selling price, or tick Price at sale"); $("#item_image_upload_form").validate({ errorClass: 'error error_item', + /* + * An error on a hidden tab is an error nobody sees. Save appeared to do + * nothing, because the message was rendered on a pane that was not on + * screen and the focus landed on an element the browser will not focus + * (owner ask). The form now opens the pane holding the FIRST invalid + * field and focuses it there. + */ + invalidHandler: function (event, validator) { + var bad = validator.invalidElements(); + if (!bad || !bad.length) { return; } + var first = bad[0]; + var pane = PosnicPro.items.tabOf(first); + if (pane) { + PosnicPro.items.goToTab(pane, '#' + $(first).attr('id')); + } + }, highlight: function (element, errorClass) { $(element).css("border-color", "#f9616d"); }, @@ -2868,8 +4167,12 @@ $(document).ready(function () { minlength: 3, maxlength: 500 }, + /* NOT required. The form never marked it - no red asterisk - so a + rule demanding it refused a save while pointing at nothing (owner: + "item category is not mandatory i think"). It is also genuinely + optional: items arrive uncategorised and get filed later. */ items_category: { - required: true + maxlength: 250 }, items_supplier: { maxlength: 250 @@ -2911,8 +4214,11 @@ $(document).ready(function () { minlength: 1, maxlength: 10 }, + /* Required only while the tax module is ON. With it off there is no + tax select to fill, so an unconditional rule refused every save on + a shop that does not charge tax (owner ask). */ items_tax: { - required: true + taxRequiredWhenEnabled: true }, items_description: { minlength: 5, @@ -2944,18 +4250,18 @@ $(document).ready(function () { }, messages: { items_name: { - required: "Please Enter Item Name", + required: "Enter the item name", minlength: "Item Name must consist of at least 3 characters", maxlength: "Item Name should not be more than 500 characters" }, items_category: { - required: "Please Choose Category" + required: "Choose a category" }, items_variant: { - required: "Please Choose Variant" + required: "Choose a variant" }, item_variant_list: { - required: "Please Choose Variant field" + required: "Choose at least one variant field" }, items_supplier: { minlength: "Item supplier must consist of at least 3 characters", @@ -3007,10 +4313,10 @@ $(document).ready(function () { maxlength: "HSN code is 4 to 8 digits" }, items_mfg_date: { - dateISO: "Please enter a valid date in the format YYYY-MM-DD", + dateISO: "Use the date format YYYY-MM-DD", }, items_expiry_date: { - dateISO: "Please enter a valid date in the format YYYY-MM-DD", + dateISO: "Use the date format YYYY-MM-DD", greaterThanMfgDate: "Expiry date must be greater than manufacturing date" } } @@ -3029,7 +4335,7 @@ $(document).ready(function () { jQuery.validator.addMethod("greaterThan", function (value, element, param) { var $otherElement = $(param); return parseFloat(value, 10) >= parseFloat($otherElement.val(), 10); - }, "Please enter a valid date in the format"); + }, "Use the date format"); $('#items_category,#items_tax,#item_variant_list,#items_variant').on('change', function () { $(this).trigger('blur'); @@ -3067,11 +4373,56 @@ $(document).ready(function () { chosen - Save no longer has a silent first click that only rendered rows. The submit-time render below stays as a fallback (with a voice) for any path that reaches Save with the rows still missing. */ + /* Reveal the second axis, and put it away again. + It has to close as well as open: the tab tick counts every VISIBLE + field, so a second axis revealed by accident and impossible to collapse + would hold the Item tab permanently unticked with nothing explaining + why. Same toggle shape as the variants link above it. */ + /* Open and close the filter panel. Delegated, because the button lives in + markup that is re-rendered on page entry. */ + $(document).on('click', '#items_filter_btn', function () { + PosnicPro.items.mountFilters(); + PosnicPro.listFilter.toggle('items'); + }); + + $(document).on('click', '#variant_axis2_link', function () { + if ($('#variant_axis2_wrap').is(':visible')) { + PosnicPro.items.resetSecondAxis(); + } else { + $('#variant_axis2_wrap').show(); + $(this).text('- Remove second option'); + } + PosnicPro.items.refreshVariantCount(); + if ($('#product_with_variant').is(':checked') + && ($('#item_variant_list').val() || []).length > 0) { + PosnicPro.items.loadVariant(); + } + }); + + /* Choosing second-axis values changes the ROW LIST, so the rows and the + count both have to follow it, exactly as they follow the first. */ + $(document).on('change', '#item_variant_list_2', function () { + PosnicPro.items.refreshVariantCount(); + if ($('#product_with_variant').is(':checked') + && ($('#item_variant_list').val() || []).length > 0) { + PosnicPro.items.loadVariant(); + } + }); + $('#item_variant_list').on('change', function () { + PosnicPro.items.refreshVariantCount(); if ($('#product_with_variant').is(':checked') && ($(this).val() || []).length > 0) { PosnicPro.items.loadVariant(); } }); + + /* Naming the item after choosing its variants fills the row headings in + as you type. No debounce needed - this only rewrites text nodes that + already exist, so nothing typed into the rows can be lost. */ + $(document).on('input', '#items_name', function () { + if (!$('#product_with_variant').is(':checked')) { return; } + PosnicPro.items.retitleVariantRows(); + }); $("#item_image_upload_form").submit(function (event) { event.preventDefault(); if ($('#item_image_upload_form').valid()) { // checks form for validity @@ -3090,9 +4441,6 @@ $(document).ready(function () { }); }); -$('.modal').on('show.bs.modal', function () { - $('#categories_view').css('z-index', 1051); -}); $(document).ready(function () { @@ -3121,11 +4469,18 @@ $(document).ready(function () { $(".fontfamily").css({"text-align": val.textAlign}); // Set slider values AND trigger visual updates in one go - $("#bar-height").val(val.height).rangeslider('update', true); - $("#bar-width").val(val.width).rangeslider('update', true); - $("#bar-margin").val(val.margin).rangeslider('update', true); - $("#bar-text-margin").val(val.textMargin).rangeslider('update', true); - $("#bar-fontSize").val(val.fontSize || 9).rangeslider('update', true); + /* Guarded: 'update' re-measures through the same hidden-parent + walk that throws on a detached input, and these five run from a + stored-preset load that can land after a page swap. */ + PosnicPro.items.initBarcodeSliders(); + [['#bar-height', val.height], ['#bar-width', val.width], ['#bar-margin', val.margin], + ['#bar-text-margin', val.textMargin], ['#bar-fontSize', val.fontSize || 9] + ].forEach(function (pair) { + var $el = $(pair[0]).val(pair[1]); + if ($el.length && document.contains($el[0]) && PosnicPro.items._barcodeSlidersReady) { + try { $el.rangeslider('update', true); } catch (e) { /* redrawn on open */ } + } + }); // Set font $("#font").val(val.font); @@ -3193,13 +4548,44 @@ $(document).ready(function () { }); - $('.range-type').rangeslider({ - polyfill: false, - rangeClass: 'rangeslider', - fillClass: 'rangeslider__fill', - handleClass: 'rangeslider__handle', - onSlide: newBarcode, - onSlideEnd: newBarcode + /* + * Lazily, on the barcode designer actually opening - and only for inputs + * still IN the document. + * + * rangeslider (polyfill:false wraps everything) measures its input by + * walking parentNodes until a visible ancestor; on a DETACHED input that + * walk runs off the document into null and throws "Cannot read + * properties of null (reading 'offsetWidth')" - the exact line the boot + * watchdog carried on the owner's screen, on every refresh of one shop. + * Registering at module-ready also left the plugin's window-resize + * re-measure armed for the whole session over inputs whose panel the SPA + * may rebuild. Initialised where they are used, they exist, they are + * attached, and a shop that never opens the designer never runs any of + * this. + */ + PosnicPro.items.initBarcodeSliders = function () { + if (PosnicPro.items._barcodeSlidersReady) { return; } + var $connected = $('.range-type').filter(function () { + return document.contains(this); + }); + if (!$connected.length) { return; } + PosnicPro.items._barcodeSlidersReady = true; + try { + $connected.rangeslider({ + polyfill: false, + rangeClass: 'rangeslider', + fillClass: 'rangeslider__fill', + handleClass: 'rangeslider__handle', + onSlide: newBarcode, + onSlideEnd: newBarcode + }); + } catch (e) { + /* A failed slider must cost the slider, never the boot. */ + console.error('[barcode] slider init failed:', e.message); + } + }; + $(document).on('click focusin', '#barcode-container, .slider-container', function () { + PosnicPro.items.initBarcodeSliders(); }); $('.color').colorPicker({renderCallback: newBarcode}); @@ -3411,37 +4797,111 @@ $('#bar-fontSize').change(function () { +/* + * HSN lookup (owner ask): search by text as well as code - "electron" + * finds electronics rows - and suggest codes from the item and category + * names. The 8,924-row list loads once on demand and stays in memory; + * every keystroke filters locally, nothing blocks typing. + */ +PosnicPro.items._hsnRows = null; +PosnicPro.items._hsnLoad = function (done) { + if (PosnicPro.items._hsnRows) { done(PosnicPro.items._hsnRows); return; } + PosnicPro.get({ url: 'items/getJSONhsncode' }, function (data) { + var rows = (data && data.data && data.data.hsn) || []; + rows.forEach(function (r) { r._d = (r.description || '').toLowerCase(); }); + PosnicPro.items._hsnRows = rows; + done(rows); + }, function () { done([]); }); +}; +PosnicPro.items._hsnRate = function (r) { + var n = parseFloat(String(r.taxrate || '').replace('%', '')); + return isFinite(n) ? n : 0; +}; +/* GST 2.0 (CBIC Notif. 9/2025, eff. 22 Sep 2025) retired the 12% and 28% + slabs. Rows still carrying them are pre-2025 data: never auto-fill a + dead slab - name it and make the owner pick the current one. */ +PosnicPro.items._hsnDeadSlab = function (r) { + var n = PosnicPro.items._hsnRate(r); + return n === 12 || n === 28; +}; +PosnicPro.items._hsnApply = function (r) { + $('#items_hsncode').val(r.value); + $('#items_hsndescription').val(r.description); + if (PosnicPro.items._hsnDeadSlab(r)) { + $('#hsn_tax').val(''); + PosnicPro.alert('info', 'This code\'s stored rate (' + PosnicPro.items._hsnRate(r) + + '%) predates GST 2.0 - most such goods moved to ' + + (PosnicPro.items._hsnRate(r) === 12 ? '5% or 18%' : '18% or 40%') + + '. Set the current slab (Notif. 9/2025, eff. 22 Sep 2025).'); + } else { + $('#hsn_tax').val(PosnicPro.items._hsnRate(r)); + } + $('#hsn_suggest_row').hide(); +}; +/* Top matches for the item + category words - the "right tax" nudge. */ +PosnicPro.items.hsnSuggest = function () { + if ($("input[name='hsntax_radio_value']:checked").val() !== 'hsncode') { return; } + if ($.trim($('#items_hsncode').val())) { return; } + var words = ($('#items_name').val() + ' ' + ($('.items_category option:selected').text() || '')) + .toLowerCase().split(/[^a-z]+/).filter(function (w) { return w.length > 3; }); + if (!words.length) { $('#hsn_suggest_row').hide(); return; } + PosnicPro.items._hsnLoad(function (rows) { + var scored = []; + for (var i = 0; i < rows.length; i++) { + var hit = 0; + for (var j = 0; j < words.length; j++) { + if (rows[i]._d.indexOf(words[j]) !== -1) { hit++; } + } + if (hit) { scored.push([hit, rows[i]]); } + } + scored.sort(function (a, b) { return b[0] - a[0]; }); + var top = scored.slice(0, 3).map(function (x) { return x[1]; }); + if (!top.length) { $('#hsn_suggest_row').hide(); return; } + var esc = function (v) { return $('<i>').text(v == null ? '' : v).html(); }; + $('#hsn_suggest_row').html('<small class="text-muted mr-1"><lang class="lang_suggested">Suggested:</lang></small>' + top.map(function (r, i) { + var rate = String(r.taxrate || '').replace('%', '') || '0'; + var rateLabel = PosnicPro.items._hsnDeadSlab(r) ? rate + '% (pre-2025)' : rate + '%'; + return '<a href="javascript:void(0)" class="badge badge-light border mr-1 hsn-chip" data-i="' + i + '">' + + esc(r.value) + ' · ' + esc((r.description || '').slice(0, 34)) + + ' · ' + esc(rateLabel) + '</a>'; + }).join('')).show().data('rows', top); + }); +}; +$(document).on('click', '.hsn-chip', function () { + var rows = $('#hsn_suggest_row').data('rows') || []; + var r = rows[$(this).data('i')]; + if (r) { PosnicPro.items._hsnApply(r); } +}); +$(document).on('change', "input[name='hsntax_radio_value']", function () { + setTimeout(PosnicPro.items.hsnSuggest, 50); +}); $('.hsnCode').one({ click: function () { - var params = { - url: 'items/getJSONhsncode' - }; - PosnicPro.get(params, function (data) { - + PosnicPro.items._hsnLoad(function (rows) { $('.hsnCode').autocomplete({ - lookup: data.data['hsn'], + lookup: rows, autoSelectFirst: false, minChars: 1, - lookupLimit: 5, + deferRequestBy: 80, + lookupLimit: 8, onSelect: function (suggestion) { - $('#items_hsndescription').val(suggestion.description); - $('#hsn_tax').val(suggestion.taxrate); + PosnicPro.items._hsnApply(suggestion); }, lookupFilter: function (suggestion, query, queryLowerCase) { - var id = suggestion.description, - value = suggestion.value.toLowerCase(); - return id.indexOf(query) === 0 || value.indexOf(queryLowerCase) === 0; + return suggestion.value.indexOf(queryLowerCase) === 0 + || suggestion._d.indexOf(queryLowerCase) !== -1; }, - formatResult: function (suggestion) { - var description = suggestion.description; - return '<div>' + - $.Autocomplete.formatResult(suggestion) + - '</div><span style="margin-top:-20px;">' + description + '</span><span class="pull-right" style="margin-top:-20px;">Tax :' + suggestion.taxrate + '</span>'; + formatResult: function (suggestion, currentValue) { + var rate = String(suggestion.taxrate || '').replace('%', '') || '0'; + var dead = PosnicPro.items._hsnDeadSlab(suggestion); + return '<div class="sug-row">' + + '<div class="sug-main"><div class="sug-name">' + + $.Autocomplete.formatResult(suggestion, currentValue) + + '</div><div class="sug-meta">' + $('<i>').text(suggestion.description || '').html() + + '</div></div><div class="sug-side"><span class="sug-stock ' + (dead ? 'low' : 'in') + '">GST ' + + rate + '%' + (dead ? ' pre-2025' : '') + '</span></div></div>'; } }); - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); }); } }); @@ -3451,6 +4911,7 @@ $(document).ready(function () { $('#hsn_tax').hide(); $('#default_tax').show(); PosnicPro.items.loadSelectCategory(); + PosnicPro.items.loadSelectSupplier(); PosnicPro.items.loadSelectVariant(); PosnicPro.items.loadSelectTax(); PosnicPro.items.loadSelectUnit(); @@ -3464,18 +4925,30 @@ $(document).ready(function () { $('#items_supplier_id').val(defaultsupplier.supplier_id); $('#items_supplier').val(defaultsupplier.supplier_name); } - $(".items_category").val('').trigger('change.select2'); $(".items_category").select2({ placeholder: "Choose a Category" }); + $(".items_category").val('').trigger('change.select2'); // Typing in either discount field marks the pair as the user's - a // category pick then leaves them alone (applyCategoryDiscount). $(document).on('change', '#item_is_service', function () { PosnicPro.items.applyServiceMode(); }); + $(document).on('input', '#items_name', function () { + PosnicPro.items.refreshTilePreview(); + }); + $(document).on('input', '#items_gtin', function () { + PosnicPro.items.checkGtin(); + }); $(document).on('click', '#item_tile_swatches .tile-swatch', function () { PosnicPro.items.setTileColor($(this).data('color') || ''); }); + $(document).on('click', '#item_tile_shapes .tile-shape', function () { + var shape = $(this).data('shape') || ''; + // Tap the picked shape again to clear it back to the default square. + if (($('#item_tile_shape').val() || '') === shape) { shape = ''; } + PosnicPro.items.setTileShape(shape); + }); $('#items_discount_amount, #items_discount_percentage').on('input', function () { PosnicPro.items._discountTouched = true; }); @@ -3579,17 +5052,43 @@ $('.itemimageview').click(function () { $('#item_coverimg_popup').modal('show'); }); -$('#items_variant').one('change', function () { - var variantSelect = $('#items_variant'); - variantSelect.on('select2:select', function (e) { - var data = e.params.data; - var variant = data.element.attributes['data-variant-fields'].value; - var variantOption = []; - variant: $.map(JSON.parse(variant), function (dataItem) { - variantOption += '<option value="' + dataItem.name + '">' + dataItem.name + '</option>'; - }); - $('#item_variant_list').html(variantOption); - }); +/* The second axis fills its own value list exactly as the first does. + Delegated rather than one-shot bound: this select is rebuilt by + loadSelectVariant on every page entry, and a handler bound to the old + element would be thrown away with it. */ +/* + * Choosing a photo for one variant. Clicking the chosen one again clears it. + * + * Delegated: these strips are rebuilt every time a photo is added or removed, + * and a handler bound to the old <img> would go with it. + */ +$(document).on('click', '.items-variant-photo', function () { + var stripId = $(this).closest('.items-variant-photos').attr('id') || ''; + var key = stripId.replace('items_photo_strip_', ''); + var $hidden = $('#items_photo_' + key); + if (!$hidden.length) { return; } + var name = $(this).attr('data-photo'); + $hidden.val($hidden.val() === name ? '' : name); + PosnicPro.items.renderVariantPhotoPickers(); +}); + +$(document).on('select2:select', '#items_variant_2', function () { + PosnicPro.items.loadVariantValues('#items_variant_2', '#item_variant_list_2'); + PosnicPro.items.syncAxisExclusion(); +}); + +/* + * Picking a variant fills its value list - for either axis. + * + * Delegated, and no longer wrapped in .one('change'). That wrapper bound the + * real handler only after some OTHER plain change had fired first, so whether + * picking a variant worked depended on whether something unrelated had already + * touched the select. It also rebound nothing when loadSelectVariant replaced + * the element on the next page entry. + */ +$(document).on('select2:select', '#items_variant', function () { + PosnicPro.items.loadVariantValues('#items_variant', '#item_variant_list'); + PosnicPro.items.syncAxisExclusion(); }); $('.items_category').one('change', function () { var categorySelect = $('.items_category'); @@ -3622,3 +5121,6 @@ $(document).on('change', '.kiosk-toggle', function () { }); /*end*/ +$(document).on('click', '#items_list_rows tr.items-row', function () { + PosnicPro.items.openDoc($(this).data('id')); +}); diff --git a/frontend/static/script/js/modules/js/kot.js b/frontend/static/script/js/modules/js/kot.js index d523ef4a0..89dd94b35 100644 --- a/frontend/static/script/js/modules/js/kot.js +++ b/frontend/static/script/js/modules/js/kot.js @@ -31,7 +31,7 @@ PosnicPro.kot = { PosnicPro.kot.loadTables(); // Clear KOT details panel when no table is selected var detailsPanel = $('#kot_table_details'); - var emptyStateHtml = '<div class="text-center" style="padding: 100px 20px; color: #6c757d;"><i class="feather icon-arrow-left" style="font-size: 48px; margin-bottom: 20px; opacity: 0.3;"></i><p style="font-size: 16px; margin: 0;">Select a table from the left to view KOT details</p></div>'; + var emptyStateHtml = '<div class="text-center" style="padding: 100px 20px; color: #6c757d;"><i class="feather icon-arrow-left" style="font-size: 48px; margin-bottom: 20px; opacity: 0.3;"></i><p style="font-size: 16px; margin: 0;"><lang class="lang_select_a_table_from_the_left_to_view_kot_d">Select a table from the left to view KOT details</lang></p></div>'; detailsPanel.html(emptyStateHtml); } @@ -130,7 +130,7 @@ PosnicPro.kot = { PosnicPro.kot.currentTableNumber = null; PosnicPro.kot.currentTableId = null; var detailsPanel = $('#kot_table_details'); - var emptyStateHtml = '<div class="text-center" style="padding: 100px 20px; color: #6c757d;"><i class="feather icon-arrow-left" style="font-size: 48px; margin-bottom: 20px; opacity: 0.3;"></i><p style="font-size: 16px; margin: 0;">Select a table from the left to view KOT details</p></div>'; + var emptyStateHtml = '<div class="text-center" style="padding: 100px 20px; color: #6c757d;"><i class="feather icon-arrow-left" style="font-size: 48px; margin-bottom: 20px; opacity: 0.3;"></i><p style="font-size: 16px; margin: 0;"><lang class="lang_select_a_table_from_the_left_to_view_kot_d">Select a table from the left to view KOT details</lang></p></div>'; detailsPanel.html(emptyStateHtml); } }, @@ -241,7 +241,7 @@ PosnicPro.kot = { // Different colors for Take Away var boxColor = isTakeaway ? '#ffe0b2' : '#d4edda'; var numberColor = isTakeaway ? '#ff9800' : '#a3d9a5'; - var labelHtml = isTakeaway ? '<div style="font-size: 12px; color: #ff9800; font-weight: 600; margin-top: 4px;">Take Away</div>' : ''; + var labelHtml = isTakeaway ? '<div style="font-size: 12px; color: #ff9800; font-weight: 600; margin-top: 4px;"><lang class="lang_take_away_2">Take Away</lang></div>' : ''; var tableBox = ` <a href="#/kot/${table.tableorder_value}" class="kot-table-box page_url" data-table-id="${tableId}" data-table-number="${table.tableorder_value}" @@ -262,8 +262,8 @@ PosnicPro.kot = { display: flex; flex-direction: column; align-items: center; justify-content: center; background: #f8f9fa; min-height: 100px; padding: 10px; margin-bottom: 10px;"> <input type="text" class="form-control form-control-sm" id="custom_table_number_input" - placeholder="Custom #" style="text-align: center; font-size: 14px; margin-bottom: 8px; border: 1px solid #17a2b8;"> - <button type="button" class="btn btn-sm btn-info" onclick="PosnicPro.kot.addCustomTableKOT()" style="padding: 4px 12px;"> + placeholder="Custom #" data-t-placeholder="lang_custom" style="text-align: center; font-size: 14px; margin-bottom: 8px; border: 1px solid #17a2b8;"> + <button type="button" class="btn btn-sm btn-info" onclick="PosnicPro.kot.addCustomTableKOT()" style="padding: 4px 12px;" aria-label="Add" data-t-aria-label="lang_nav_add"> <i class="feather icon-plus" style="font-size: 14px;"></i> </button> </div> @@ -332,7 +332,7 @@ PosnicPro.kot = { var detailsPanel = $('#kot_table_details'); console.log('Right panel element found:', detailsPanel.length > 0); - var loadingHtml = '<div class="text-center" style="padding: 60px 20px;"><div class="loadingSpinner"></div><p class="text-muted mt-3">Loading table details...</p></div>'; + var loadingHtml = '<div class="text-center" style="padding: 60px 20px;"><div class="loadingSpinner"></div><p class="text-muted mt-3"><lang class="lang_loading_table_details">Loading table details...</lang></p></div>'; detailsPanel.html(loadingHtml); var filters = { @@ -388,7 +388,7 @@ PosnicPro.kot = { // If no KOTs, show empty state and clear selection if (kotCount === 0) { console.log('No KOTs found - showing empty state'); - var emptyStateHtml = '<div class="text-center" style="padding: 100px 20px; color: #6c757d;"><i class="feather icon-arrow-left" style="font-size: 48px; margin-bottom: 20px; opacity: 0.3;"></i><p style="font-size: 16px; margin: 0;">Select a table from the left to view KOT details</p></div>'; + var emptyStateHtml = '<div class="text-center" style="padding: 100px 20px; color: #6c757d;"><i class="feather icon-arrow-left" style="font-size: 48px; margin-bottom: 20px; opacity: 0.3;"></i><p style="font-size: 16px; margin: 0;"><lang class="lang_select_a_table_from_the_left_to_view_kot_d">Select a table from the left to view KOT details</lang></p></div>'; detailsPanel.html(emptyStateHtml); // Clear current table selection @@ -432,7 +432,7 @@ PosnicPro.kot = { <h3 class="mb-1" style="font-weight: 700; font-size: 24px;">Table ${tableNumber}</h3> <span class="badge ${statusBadge}">${statusText}</span> </div> - <a href="#/kotorder/new/${tableNumber}/" class="btn btn-light page_url" title="Add KOT" style="border: 1px solid #dee2e6; text-decoration: none;"> + <a href="#/kotorder/new/${tableNumber}/" class="btn btn-light page_url" title="Add KOT" data-t-title="lang_add_kot" style="border: 1px solid #dee2e6; text-decoration: none;"> <i class="feather icon-plus"></i> </a> </div> @@ -481,15 +481,15 @@ PosnicPro.kot = { <div style="font-size: 13px; color: #ffc107; margin-top: 4px; display: flex; align-items: center; gap: 6px;"> <span> <i class="feather icon-tag" style="font-size: 12px;"></i> - <strong>Discount:</strong> ${discountText}${discountDesc ? ' - ' + discountDesc : ''} + <strong><lang class="lang_discount_4">Discount:</lang></strong> ${discountText}${discountDesc ? ' - ' + discountDesc : ''} </span> <i class="feather icon-edit" style="font-size: 14px; cursor: pointer; color: #6c757d;" onclick="PosnicPro.kot.showDiscount('${kot._id}')" - title="Edit discount"></i> + title="Edit discount" data-t-title="lang_edit_discount_2"></i> <i class="feather icon-trash" style="font-size: 14px; cursor: pointer; color: #dc3545;" onclick="PosnicPro.kot.clearDiscountFromIcon('${kot._id}')" - title="Clear discount"></i> + title="Clear discount" data-t-title="lang_clear_discount"></i> </div> `; } @@ -526,15 +526,15 @@ PosnicPro.kot = { </div> <div class="kot-item-qty-controls" data-sale-id="${kot._id}" data-item-id="${itemId}" data-item-price="${itemPrice}" style="display: none; align-items: center; justify-content: flex-end;"> <div class="btn-group btn-group-sm" style="display: inline-flex; align-items: center; margin-right: 8px;"> - <button type="button" class="btn btn-light btn-sm qty-decrease" style="border: 1px solid #ced4da; padding: 2px 8px;"> + <button type="button" class="btn btn-light btn-sm qty-decrease" style="border: 1px solid #ced4da; padding: 2px 8px;" aria-label="Decrease quantity" data-t-aria-label="lang_decrease_quantity"> <i class="feather icon-minus" style="font-size: 10px;"></i> </button> <input type="text" class="form-control form-control-sm qty-input" value="${itemQty}" min="1" style="width: 50px; text-align: center; padding: 2px 5px; height: 28px;"> - <button type="button" class="btn btn-light btn-sm qty-increase" style="border: 1px solid #ced4da; padding: 2px 8px;"> + <button type="button" class="btn btn-light btn-sm qty-increase" style="border: 1px solid #ced4da; padding: 2px 8px;" aria-label="Increase quantity" data-t-aria-label="lang_increase_quantity"> <i class="feather icon-plus" style="font-size: 10px;"></i> </button> </div> - <button type="button" class="btn btn-outline-danger btn-sm" style="padding: 2px 6px; border-radius: 4px;" onclick="PosnicPro.kot.deleteItem('${kot._id}', '${itemId}')" title="Delete Item"> + <button type="button" class="btn btn-outline-danger btn-sm" style="padding: 2px 6px; border-radius: 4px;" onclick="PosnicPro.kot.deleteItem('${kot._id}', '${itemId}')" title="Delete Item" data-t-title="lang_delete_item"> <i class="feather icon-trash" style="font-size: 12px;"></i> </button> </div> @@ -583,7 +583,7 @@ PosnicPro.kot = { <input type="text" class="form-control kot-product-search" data-sale-id="${kot._id}" - placeholder="Search product to add..." + placeholder="Search product to add..." data-t-placeholder="lang_search_product_to_add" autocomplete="off" style="border: 2px solid #dee2e6; border-radius: 6px; padding: 8px 12px; font-size: 14px;"> <div class="kot-search-results" data-sale-id="${kot._id}" style="display: none; position: absolute; z-index: 1000; background: white; border: 1px solid #dee2e6; border-radius: 6px; max-height: 200px; overflow-y: auto; width: 100%; margin-top: 2px; box-shadow: 0 2px 8px rgba(0,0,0,0.1);"></div> @@ -623,7 +623,7 @@ PosnicPro.kot = { kotItemsHtml = ` <div class="text-center" style="padding: 40px 20px;"> <i class="feather icon-inbox" style="font-size: 48px; color: #dee2e6;"></i> - <p class="text-muted mt-3">No active orders for this table</p> + <p class="text-muted mt-3"><lang class="lang_no_active_orders_for_this_table">No active orders for this table</lang></p> </div> `; } @@ -776,7 +776,7 @@ PosnicPro.kot = { // Check if this is the last item if (rowCount <= 1) { - PosnicPro.alert('error', 'You cannot remove the last item. An order needs at least one product.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_you_cannot_remove_the_last_item_an_order_n', 'You cannot remove the last item. An order needs at least one product.')); return; } @@ -924,10 +924,10 @@ PosnicPro.kot = { $('.kot-search-results[data-sale-id="' + saleId + '"]').hide().empty(); }); } else { - $results.html('<div style="padding: 12px; text-align: center; color: #6c757d; font-size: 13px;">No products found</div>').show(); + $results.html('<div style="padding: 12px; text-align: center; color: #6c757d; font-size: 13px;"><lang class="lang_no_products_found">No products found</lang></div>').show(); } }, function() { - $results.html('<div style="padding: 12px; text-align: center; color: #dc3545; font-size: 13px;">Search failed</div>').show(); + $results.html('<div style="padding: 12px; text-align: center; color: #dc3545; font-size: 13px;"><lang class="lang_search_failed">Search failed</lang></div>').show(); }); }, @@ -937,7 +937,7 @@ PosnicPro.kot = { var $itemsTable = $kotItem.find('table'); if ($itemsTable.length === 0) { - PosnicPro.alert('error', 'Could not find items table'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_could_not_find_items_table', 'Could not find items table')); return; } @@ -971,15 +971,15 @@ PosnicPro.kot = { </div> <div class="kot-item-qty-controls" data-sale-id="${saleId}" data-item-id="${itemId}" data-item-price="${itemPrice}" data-base-price="${basePrice || itemPrice}" style="display: inline-flex; align-items: center; justify-content: flex-end;"> <div class="btn-group btn-group-sm" style="display: inline-flex; align-items: center; margin-right: 8px;"> - <button type="button" class="btn btn-light btn-sm qty-decrease" style="border: 1px solid #ced4da; padding: 2px 8px;"> + <button type="button" class="btn btn-light btn-sm qty-decrease" style="border: 1px solid #ced4da; padding: 2px 8px;" aria-label="Decrease quantity" data-t-aria-label="lang_decrease_quantity"> <i class="feather icon-minus" style="font-size: 10px;"></i> </button> <input type="text" class="form-control form-control-sm qty-input" value="1" min="1" style="width: 50px; text-align: center; padding: 2px 5px; height: 28px;"> - <button type="button" class="btn btn-light btn-sm qty-increase" style="border: 1px solid #ced4da; padding: 2px 8px;"> + <button type="button" class="btn btn-light btn-sm qty-increase" style="border: 1px solid #ced4da; padding: 2px 8px;" aria-label="Increase quantity" data-t-aria-label="lang_increase_quantity"> <i class="feather icon-plus" style="font-size: 10px;"></i> </button> </div> - <button type="button" class="btn btn-outline-danger btn-sm kot-remove-new-item" style="padding: 2px 6px; border-radius: 4px;" title="Remove Item"> + <button type="button" class="btn btn-outline-danger btn-sm kot-remove-new-item" style="padding: 2px 6px; border-radius: 4px;" title="Remove Item" data-t-title="lang_remove_item"> <i class="feather icon-trash" style="font-size: 12px;"></i> </button> </div> @@ -1179,7 +1179,7 @@ PosnicPro.kot = { PosnicPro.kot.finalizeAddProduct(saleId, data, items, newTotal, spinner); } else { spinner.remove(); - PosnicPro.alert('error', 'Item details not found'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_item_details_not_found', 'Item details not found')); } }); } else { @@ -1187,7 +1187,7 @@ PosnicPro.kot = { } }, function(xhr) { spinner.remove(); - PosnicPro.alert('error', 'Failed to load order details'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_failed_to_load_order_details', 'Failed to load order details')); }); }, @@ -1233,7 +1233,7 @@ PosnicPro.kot = { if (typeof PosnicPro.kot.refreshTables === 'function') { PosnicPro.kot.refreshTables(); } - PosnicPro.alert('success', 'Item added'); + PosnicPro.alert('success', PosnicPro.i18n.t('lang_item_added', 'Item added')); } else { PosnicPro.alert(res.type, res.message); } @@ -1339,7 +1339,7 @@ PosnicPro.kot = { if (typeof PosnicPro.kot.refreshTables === 'function') { PosnicPro.kot.refreshTables(); } - PosnicPro.alert('success', 'Quantities updated'); + PosnicPro.alert('success', PosnicPro.i18n.t('lang_quantities_updated', 'Quantities updated')); } else { PosnicPro.alert(res.type, res.message); } @@ -1350,20 +1350,20 @@ PosnicPro.kot = { }); }, function(xhr) { spinner.remove(); - PosnicPro.alert('error', 'Failed to load order details'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_failed_to_load_order_details', 'Failed to load order details')); }); }, addCustomTableKOT: function () { var customTableNumber = $('#custom_table_number_input').val().trim(); if (!customTableNumber) { - PosnicPro.alert('error', 'Enter a table or room number.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_enter_a_table_or_room_number', 'Enter a table or room number.')); return; } // Prevent using TA as it's reserved for takeaway if (customTableNumber.toUpperCase() === 'TA') { - PosnicPro.alert('error', 'TA is reserved for takeaway orders. Use a different table number.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_ta_is_reserved_for_takeaway_orders_use_a_d', 'TA is reserved for takeaway orders. Use a different table number.')); return; } @@ -1387,7 +1387,7 @@ PosnicPro.kot = { background: #fff3cd; cursor: pointer; transition: all 0.3s; display: flex; align-items: center; justify-content: center;"> <i class="feather icon-shopping-bag" style="font-size: 20px; color: #856404; margin-right: 8px;"></i> - <span style="font-weight: 600; color: #856404; font-size: 14px;">Takeaway</span> + <span style="font-weight: 600; color: #856404; font-size: 14px;"><lang class="lang_takeaway">Takeaway</lang></span> <i class="feather icon-plus" style="font-size: 16px; color: #856404; margin-left: 8px;"></i> </div> `; @@ -1530,22 +1530,22 @@ PosnicPro.kot = { if (status === 'Cancelled') statusBadge = 'badge-danger'; var actions = ` - <a href="javascript:void(0);" class="btn btn-sm btn-primary-rgba mr-1" data-toggle="tooltip" title="View" onclick="PosnicPro.kothistory.view('${kot._id}')"> + <a href="javascript:void(0);" class="btn btn-sm btn-primary-rgba mr-1" data-toggle="tooltip" title="View" data-t-title="lang_view" onclick="PosnicPro.kothistory.view('${kot._id}')"> <i class="feather icon-eye"></i> </a> - <a href="javascript:void(0);" class="btn btn-sm btn-info-rgba mr-1" data-toggle="tooltip" title="Edit KOT" onclick="PosnicPro.kothistory.edit('${kot._id}')"> + <a href="javascript:void(0);" class="btn btn-sm btn-info-rgba mr-1" data-toggle="tooltip" title="Edit KOT" data-t-title="lang_edit_kot" onclick="PosnicPro.kothistory.edit('${kot._id}')"> <i class="feather icon-edit-1"></i> </a> - <a href="javascript:void(0);" class="btn btn-sm btn-warning-rgba mr-1" data-toggle="tooltip" title="Discount" onclick="PosnicPro.kot.showDiscount('${kot._id}')"> + <a href="javascript:void(0);" class="btn btn-sm btn-warning-rgba mr-1" data-toggle="tooltip" title="Discount" data-t-title="lang_discount_title" onclick="PosnicPro.kot.showDiscount('${kot._id}')"> <i class="feather icon-percent"></i> </a> - <a href="javascript:void(0);" class="btn btn-sm btn-success-rgba mr-1" data-toggle="tooltip" title="Settlement" onclick="PosnicPro.kothistory.proceed('${kot._id}')"> + <a href="javascript:void(0);" class="btn btn-sm btn-success-rgba mr-1" data-toggle="tooltip" title="Settlement" data-t-title="lang_settlement" onclick="PosnicPro.kothistory.proceed('${kot._id}')"> <i class="feather icon-arrow-right-circle"></i> </a> - <a href="javascript:void(0);" class="btn btn-sm btn-secondary-rgba mr-1" data-toggle="tooltip" title="Print" onclick="PosnicPro.kothistory.print('${kot._id}')"> + <a href="javascript:void(0);" class="btn btn-sm btn-secondary-rgba mr-1" data-toggle="tooltip" title="Print" data-t-title="lang_printed" onclick="PosnicPro.kothistory.print('${kot._id}')"> <i class="feather icon-printer"></i> </a> - <a href="javascript:void(0);" class="btn btn-sm btn-danger-rgba" data-toggle="tooltip" title="Cancel" onclick="PosnicPro.kothistory.cancel('${kot._id}')"> + <a href="javascript:void(0);" class="btn btn-sm btn-danger-rgba" data-toggle="tooltip" title="Cancel" data-t-title="lang_cancel_title" onclick="PosnicPro.kothistory.cancel('${kot._id}')"> <i class="feather icon-x-circle"></i> </a> `; @@ -1596,7 +1596,7 @@ PosnicPro.kot = { var total = (typeof kot.total_amount !== 'undefined' && kot.total_amount !== null) ? parseFloat(kot.total_amount).toFixed(2) : '0.00'; var hasDiscount = (typeof kot.discount_amount !== 'undefined' && kot.discount_amount !== null && parseFloat(kot.discount_amount) > 0); - var discountIcon = hasDiscount ? '<i class="feather icon-tag" style="font-size: 12px; margin-left: 4px; color: #ffc107;" title="Discount Applied" data-toggle="tooltip"></i>' : ''; + var discountIcon = hasDiscount ? '<i class="feather icon-tag" style="font-size: 12px; margin-left: 4px; color: #ffc107;" title="Discount Applied" data-t-title="lang_discount_applied_2" data-toggle="tooltip"></i>' : ''; kotItemsHtml += ` <div class="kot-item" style="border-bottom: 1px solid #e9ecef; padding: 8px 0; margin-bottom: 8px;"> @@ -1608,13 +1608,13 @@ PosnicPro.kot = { <span class="text-primary" style="font-size: 15px; font-weight: 700; display: flex; align-items: center;">₹${total}${discountIcon}</span> </div> <div class="btn-group" role="group"> - <button type="button" class="btn btn-sm btn-outline-primary" onclick="PosnicPro.kot.viewKOT('${kot._id}')" title="View KOT" data-toggle="tooltip"> + <button type="button" class="btn btn-sm btn-outline-primary" onclick="PosnicPro.kot.viewKOT('${kot._id}')" title="View KOT" data-t-title="lang_view_kot" data-toggle="tooltip"> <i class="feather icon-eye"></i> </button> - <button type="button" class="btn btn-sm btn-outline-success" onclick="PosnicPro.kothistory.proceed('${kot._id}')" title="Settlement" data-toggle="tooltip"> + <button type="button" class="btn btn-sm btn-outline-success" onclick="PosnicPro.kothistory.proceed('${kot._id}')" title="Settlement" data-t-title="lang_settlement" data-toggle="tooltip"> <i class="feather icon-dollar-sign"></i> </button> - <button type="button" class="btn btn-sm btn-outline-secondary" onclick="PosnicPro.kot.printKOTReceipt('${kot._id}')" title="Print Bill" data-toggle="tooltip"> + <button type="button" class="btn btn-sm btn-outline-secondary" onclick="PosnicPro.kot.printKOTReceipt('${kot._id}')" title="Print Bill" data-t-title="lang_print_bill" data-toggle="tooltip"> <i class="feather icon-printer"></i> </button> </div> @@ -1623,7 +1623,7 @@ PosnicPro.kot = { `; }); } else { - kotItemsHtml = '<div class="text-center text-muted" style="padding: 20px 0;"><small>No active orders</small></div>'; + kotItemsHtml = '<div class="text-center text-muted" style="padding: 20px 0;"><small><lang class="lang_no_active_orders_2">No active orders</lang></small></div>'; } return ` @@ -1632,7 +1632,7 @@ PosnicPro.kot = { <div class="card-header" style="background: #fff3cd; border-bottom: 2px solid #ffc107; padding: 12px 15px;"> <div class="d-flex justify-content-between align-items-center"> <div class="d-flex align-items-center" style="flex: 1;"> - <h2 class="mb-0 mr-3" style="font-weight: 700; font-size: 40px; color: #856404; line-height: 1;">TA</h2> + <h2 class="mb-0 mr-3" style="font-weight: 700; font-size: 40px; color: #856404; line-height: 1;"><lang class="lang_ta">TA</lang></h2> <div style="margin-right: auto;"> <i class="feather icon-shopping-bag" style="font-size: 40px; color: #ffc107;"></i> </div> @@ -1672,7 +1672,7 @@ PosnicPro.kot = { var total = (typeof kot.total_amount !== 'undefined' && kot.total_amount !== null) ? parseFloat(kot.total_amount).toFixed(2) : '0.00'; var hasDiscount = (typeof kot.discount_amount !== 'undefined' && kot.discount_amount !== null && parseFloat(kot.discount_amount) > 0); - var discountIcon = hasDiscount ? '<i class="feather icon-tag" style="font-size: 12px; margin-left: 4px; color: #ffc107;" title="Discount Applied" data-toggle="tooltip"></i>' : ''; + var discountIcon = hasDiscount ? '<i class="feather icon-tag" style="font-size: 12px; margin-left: 4px; color: #ffc107;" title="Discount Applied" data-t-title="lang_discount_applied_2" data-toggle="tooltip"></i>' : ''; kotItemsHtml += ` <div class="kot-item" style="border-bottom: 1px solid #e9ecef; padding: 8px 0; margin-bottom: 8px;"> @@ -1684,13 +1684,13 @@ PosnicPro.kot = { <span class="text-primary" style="font-size: 15px; font-weight: 700; display: flex; align-items: center;">₹${total}${discountIcon}</span> </div> <div class="btn-group" role="group"> - <button type="button" class="btn btn-sm btn-outline-primary" onclick="PosnicPro.kot.viewKOT('${kot._id}')" title="View KOT" data-toggle="tooltip"> + <button type="button" class="btn btn-sm btn-outline-primary" onclick="PosnicPro.kot.viewKOT('${kot._id}')" title="View KOT" data-t-title="lang_view_kot" data-toggle="tooltip"> <i class="feather icon-eye"></i> </button> - <button type="button" class="btn btn-sm btn-outline-success" onclick="PosnicPro.kothistory.proceed('${kot._id}')" title="Settlement" data-toggle="tooltip"> + <button type="button" class="btn btn-sm btn-outline-success" onclick="PosnicPro.kothistory.proceed('${kot._id}')" title="Settlement" data-t-title="lang_settlement" data-toggle="tooltip"> <i class="feather icon-dollar-sign"></i> </button> - <button type="button" class="btn btn-sm btn-outline-secondary" onclick="PosnicPro.kot.printKOTReceipt('${kot._id}')" title="Print Bill" data-toggle="tooltip"> + <button type="button" class="btn btn-sm btn-outline-secondary" onclick="PosnicPro.kot.printKOTReceipt('${kot._id}')" title="Print Bill" data-t-title="lang_print_bill" data-toggle="tooltip"> <i class="feather icon-printer"></i> </button> </div> @@ -1699,11 +1699,11 @@ PosnicPro.kot = { `; }); } else { - kotItemsHtml = '<div class="text-center text-muted" style="padding: 20px 0;"><small>No active orders</small></div>'; + kotItemsHtml = '<div class="text-center text-muted" style="padding: 20px 0;"><small><lang class="lang_no_active_orders_2">No active orders</lang></small></div>'; } // Use table.png icon with gray filter - var tableIcon = '<img src="static/images/icons/table.png" width="40" height="40" style="opacity: 0.4; filter: grayscale(100%);" alt="Table">'; + var tableIcon = '<img loading="lazy" decoding="async" src="static/images/icons/table.png" width="40" height="40" style="opacity: 0.4; filter: grayscale(100%);" alt="Table">'; return ` <div class="col-lg-6 col-xl-4 mb-4"> @@ -1880,7 +1880,7 @@ PosnicPro.kot = { '</tr>'; } } else { - itemsHtml = '<tr><td colspan="3" class="text-center text-muted">No items</td></tr>'; + itemsHtml = '<tr><td colspan="3" class="text-center text-muted"><lang class="lang_no_items">No items</lang></td></tr>'; } $('#kot_view_items_tbody').html(itemsHtml); @@ -1916,7 +1916,7 @@ PosnicPro.kot = { $('#kot_view_modal').modal('hide'); PosnicPro.kothistory.cancel(saleId); } else if (confirm('Are you sure you want to cancel this KOT?')) { - PosnicPro.get('sales/cancel/' + saleId, function (response) { + PosnicPro.post({ url: 'sales/cancel/' + saleId, data: '{}' }, function (response) { PosnicPro.alert(response.type, response.message); if (response.type === 'success') { $('#kot_view_modal').modal('hide'); @@ -2120,7 +2120,7 @@ PosnicPro.kot = { // JS-based validation so we don't show native browser tooltip if (!saleId || isNaN(discountValue) || description === '') { - PosnicPro.alert('error', 'Fill in all required fields.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_fill_in_all_required_fields', 'Fill in all required fields.')); return; } @@ -2210,7 +2210,7 @@ PosnicPro.kot = { clearDiscount: function () { var saleId = $('#kot_discount_sale_id').val(); if (!saleId) { - PosnicPro.alert('error', 'Sale ID not found'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_sale_id_not_found', 'Sale ID not found')); return; } @@ -2263,7 +2263,7 @@ PosnicPro.kot = { } }, function () { loader.find(".loadingSpinner:first").remove(); - PosnicPro.alert('error', 'Failed to clear discount'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_failed_to_clear_discount', 'Failed to clear discount')); }); }); }, @@ -2401,7 +2401,7 @@ PosnicPro.kot = { }, function (xhr) { spinner.remove(); - PosnicPro.alert('error', 'Failed to load order'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_failed_to_load_order', 'Failed to load order')); }); }, @@ -2418,7 +2418,7 @@ PosnicPro.kot = { // Check if this is the last item if (rowCount <= 1) { - PosnicPro.alert('error', 'You cannot remove the last item. An order needs at least one product.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_you_cannot_remove_the_last_item_an_order_n', 'You cannot remove the last item. An order needs at least one product.')); return; } @@ -2495,14 +2495,14 @@ PosnicPro.kot = { // If no items left, cancel the order instead of updating if (items.length === 0) { - PosnicPro.get('sales/cancel/' + saleId, function (res) { + PosnicPro.post({ url: 'sales/cancel/' + saleId, data: '{}' }, function (res) { spinner.remove(); if (res.type === 'success') { - PosnicPro.alert('success', 'Order cancelled - all items were removed.'); + PosnicPro.alert('success', PosnicPro.i18n.t('lang_order_cancelled_all_items_were_removed', 'Order cancelled - all items were removed.')); if (PosnicPro.kot.currentTableNumber) { // Refresh tables and clear details panel PosnicPro.kot.refreshTables(); - $('#kot_table_details').html('<div class="text-center" style="padding: 100px 20px; color: #6c757d;"><i class="feather icon-arrow-left" style="font-size: 48px; margin-bottom: 20px; opacity: 0.3;"></i><p style="font-size: 16px; margin: 0;">Select a table from the left to view KOT details</p></div>'); + $('#kot_table_details').html('<div class="text-center" style="padding: 100px 20px; color: #6c757d;"><i class="feather icon-arrow-left" style="font-size: 48px; margin-bottom: 20px; opacity: 0.3;"></i><p style="font-size: 16px; margin: 0;"><lang class="lang_select_a_table_from_the_left_to_view_kot_d">Select a table from the left to view KOT details</lang></p></div>'); } else { PosnicPro.kot.refreshKOTData(); } @@ -2511,7 +2511,7 @@ PosnicPro.kot = { } }, function(xhr) { spinner.remove(); - PosnicPro.alert('error', 'Failed to cancel empty order'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_failed_to_cancel_empty_order', 'Failed to cancel empty order')); }); return; } @@ -2567,7 +2567,7 @@ PosnicPro.kot = { }, function (xhr) { spinner.remove(); - PosnicPro.alert('error', 'Failed to load order'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_failed_to_load_order', 'Failed to load order')); }); }, @@ -2592,7 +2592,7 @@ PosnicPro.kot = { $('#kot_item_search_results').html(` <div class="text-center text-muted mt-4"> <i class="feather icon-search" style="font-size: 32px; opacity: 0.2;"></i> - <p class="mt-2">Type to search for items</p> + <p class="mt-2"><lang class="lang_type_to_search_for_items">Type to search for items</lang></p> </div> `); @@ -2622,7 +2622,7 @@ PosnicPro.kot = { $('#kot_item_search_results').html(` <div class="text-center text-muted mt-4"> <i class="feather icon-search" style="font-size: 32px; opacity: 0.2;"></i> - <p class="mt-2">Type to search for items</p> + <p class="mt-2"><lang class="lang_type_to_search_for_items">Type to search for items</lang></p> </div> `); @@ -2653,7 +2653,7 @@ PosnicPro.kot = { resultsContainer.html(` <div class="text-center text-muted mt-4"> <i class="feather icon-search" style="font-size: 32px; opacity: 0.2;"></i> - <p class="mt-2">Type to search for items</p> + <p class="mt-2"><lang class="lang_type_to_search_for_items">Type to search for items</lang></p> </div> `); return; @@ -2689,13 +2689,13 @@ PosnicPro.kot = { var opacity = outOfStock ? '0.6' : '1'; var clickAction = outOfStock ? '' : `onclick="PosnicPro.kot.addItemToOrder('${itemId}')"`; var cursor = outOfStock ? 'not-allowed' : 'pointer'; - var stockBadge = outOfStock ? '<span class="badge badge-danger ml-2">Out of Stock</span>' : ''; + var stockBadge = outOfStock ? '<span class="badge badge-danger ml-2"><lang class="lang_out_of_stock">Out of Stock</lang></span>' : ''; html += ` <a href="javascript:void(0);" class="list-group-item list-group-item-action" style="display: flex; align-items: center; padding: 10px; opacity: ${opacity}; cursor: ${cursor};" ${clickAction}> - <img src="${imagePath}" style="width: 40px; height: 40px; border-radius: 4px; object-fit: cover; margin-right: 15px;"> + <img loading="lazy" decoding="async" src="${imagePath}" style="width: 40px; height: 40px; border-radius: 4px; object-fit: cover; margin-right: 15px;"> <div style="flex: 1;"> <div class="d-flex justify-content-between align-items-center"> <h6 class="mb-0" style="font-weight: 600;">${itemName} ${stockBadge}</h6> @@ -2711,7 +2711,7 @@ PosnicPro.kot = { resultsContainer.html(` <div class="text-center text-muted mt-4"> <i class="feather icon-alert-circle" style="font-size: 32px; opacity: 0.2;"></i> - <p class="mt-2">No items found</p> + <p class="mt-2"><lang class="lang_no_items_found">No items found</lang></p> </div> `); } @@ -2734,7 +2734,7 @@ PosnicPro.kot = { PosnicPro.get('sales/' + saleId, function (response) { if (response.type !== 'success') { spinner.remove(); - PosnicPro.alert('error', 'Failed to load order'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_failed_to_load_order', 'Failed to load order')); return; } @@ -2808,7 +2808,7 @@ PosnicPro.kot = { PosnicPro.kot.finalizeAddItem(saleId, data, items, newTotal, spinner); } else { spinner.remove(); - PosnicPro.alert('error', 'Item details not found'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_item_details_not_found', 'Item details not found')); } }); } else { @@ -2817,7 +2817,7 @@ PosnicPro.kot = { }, function (xhr) { spinner.remove(); - PosnicPro.alert('error', 'Failed to load order'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_failed_to_load_order', 'Failed to load order')); }); }, @@ -2856,7 +2856,7 @@ PosnicPro.kot = { PosnicPro.put(params, function (res) { spinner.remove(); if (res.type === 'success') { - PosnicPro.alert('success', 'Item added'); + PosnicPro.alert('success', PosnicPro.i18n.t('lang_item_added', 'Item added')); // Hide add modal $('#kot_add_item_modal').modal('hide'); diff --git a/frontend/static/script/js/modules/js/kothistory.js b/frontend/static/script/js/modules/js/kothistory.js index 7a14cfadb..0619364dd 100644 --- a/frontend/static/script/js/modules/js/kothistory.js +++ b/frontend/static/script/js/modules/js/kothistory.js @@ -80,11 +80,11 @@ PosnicPro.kothistory = { var action = '<div id="' + toolbarOptionsId + '" class="hidden">' + - ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip" data-toggle="tooltip" title="View" onclick="PosnicPro.kothistory.view(\'' + row._id + '\')"><i class="feather icon-eye"></i></a>' + - ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip" data-toggle="tooltip" title="Edit KOT" onclick="PosnicPro.kothistory.edit(\'' + row._id + '\')"><i class="feather icon-edit-1"></i></a>' + - ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip" data-toggle="tooltip" title="Settlement" onclick="PosnicPro.kothistory.proceed(\'' + row._id + '\')"><i class="feather icon-arrow-right-circle"></i></a>' + - ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip" data-toggle="tooltip" title="Sale Print" onclick="PosnicPro.kothistory.print(\'' + row._id + '\')"><i class="feather icon-printer"></i></a>' + - ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip text-danger" data-toggle="tooltip" title="Cancel" onclick="PosnicPro.kothistory.cancel(\'' + row._id + '\')"><i class="feather icon-x-circle"></i></a>' + + ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip" data-toggle="tooltip" title="View" data-t-title="lang_view" onclick="PosnicPro.kothistory.view(\'' + row._id + '\')"><i class="feather icon-eye"></i></a>' + + ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip" data-toggle="tooltip" title="Edit KOT" data-t-title="lang_edit_kot" onclick="PosnicPro.kothistory.edit(\'' + row._id + '\')"><i class="feather icon-edit-1"></i></a>' + + ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip" data-toggle="tooltip" title="Settlement" data-t-title="lang_settlement" onclick="PosnicPro.kothistory.proceed(\'' + row._id + '\')"><i class="feather icon-arrow-right-circle"></i></a>' + + ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip" data-toggle="tooltip" title="Sale Print" data-t-title="lang_saleprint" onclick="PosnicPro.kothistory.print(\'' + row._id + '\')"><i class="feather icon-printer"></i></a>' + + ' <a href="javascript:void(0);" class="point-cursor mobile_tooltip text-danger" data-toggle="tooltip" title="Cancel" data-t-title="lang_cancel_title" onclick="PosnicPro.kothistory.cancel(\'' + row._id + '\')"><i class="feather icon-x-circle"></i></a>' + '</div>' + '<div data-toolbar="user-options" class="btn btn-round btn-primary-rgba round-pad" id="' + toolbarButtonId + '"><i class="feather icon-more-vertical-"></i></div>'; @@ -92,12 +92,12 @@ PosnicPro.kothistory = { $('#date_view').html(updateDate); var trow = '<tr data-table-number="' + table_number + '">' + - '<td scope="row">' + row_no + '</td>' + - '<td class="sale_id">' + row.sales_id + '</td>' + - '<td class="sale_id">' + updateDate + '</td>' + - '<td class="text-center table-number-hide"><span>' + table_number + '</span></td>' + - '<td class="text-center"><span>' + person_count + '</span></td>' + - '<td class="text-center order-type-column"><span>' + dine_type + '</span></td>' + + '<td scope="row" data-label="#">' + row_no + '</td>' + + '<td class="sale_id" data-label="Sale">' + row.sales_id + '</td>' + + '<td class="sale_id" data-label="Date">' + updateDate + '</td>' + + '<td class="text-center table-number-hide" data-label="Table"><span>' + table_number + '</span></td>' + + '<td class="text-center" data-label="Guests"><span>' + person_count + '</span></td>' + + '<td class="text-center order-type-column" data-label="Order type"><span>' + dine_type + '</span></td>' + '<td class="text-center"><span>' + action + ' </span></td>' + '</tr>'; $('#view_kothistory').children('tbody').append(trow); @@ -253,12 +253,12 @@ PosnicPro.kothistory = { // use .html() so the inner <lang> tags are replaced, preventing // the language layer from resetting the text back to "Delete". setTimeout(function () { - $title.html('Cancel Record '); + $title.html(PosnicPro.i18n.t('lang_cancel_record', 'Cancel Record ')); if ($removeText.length) { - $removeText.text('Selected details will be canceled'); + $removeText.text(PosnicPro.i18n.t('lang_selected_details_will_be_canceled', 'Selected details will be canceled')); } if ($questionLine.length) { - $questionLine.html('Are you sure want to cancel this record ?'); + $questionLine.html(PosnicPro.i18n.t('lang_are_you_sure_want_to_cancel_this_record', 'Are you sure want to cancel this record ?')); } $modal.find('.removetransactiontext').hide(); }, 0); @@ -341,7 +341,7 @@ PosnicPro.kothistory = { '</tr>'; } } else { - itemsHtml = '<tr><td colspan="3" class="text-center text-muted">No items</td></tr>'; + itemsHtml = '<tr><td colspan="3" class="text-center text-muted"><lang class="lang_no_items">No items</lang></td></tr>'; } $('#kot_view_items_tbody').html(itemsHtml); diff --git a/frontend/static/script/js/modules/js/lowstock.js b/frontend/static/script/js/modules/js/lowstock.js index 39e8b82d8..11375ef27 100644 --- a/frontend/static/script/js/modules/js/lowstock.js +++ b/frontend/static/script/js/modules/js/lowstock.js @@ -1,84 +1,214 @@ PosnicPro.lowstockitems = { - lowstockitemsTable: function () { - var loader = $(".loader-table-lowstock"); - $("<div class='loadingSpinner'></div>").appendTo(loader); - PosnicPro.appendViewDataTableBody('lowitem'); - var table = $('#view_lowstockitems'); - var notificationValue = localStorage.getItem("notificationrange"); - var params = { + _page: 1, + PAGE_SIZE: 25, + _lastRows: [], + _chrome: function () { + PosnicPro.HideSideBarModal(); + $('.page_loader,#osk-container').hide(); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); + $('#v-pills-inventory-tab,#view_itemslow_page').addClass('active'); + $('#v-pills-inventory').addClass('show active'); + $('.page-title-box,#lowstockitems').show(); + $('.dashboard_img_menu').hide(); + $('#image_sidebar_lowstock').show(); + }, + showDataTablePage: function () { + PosnicPro.lowstockitems._chrome(); + PosnicPro.lowstockitems.loadList(1); + }, + /* Deep link #/lowstockitems/<id>: the watchlist with that item open + in the right pane. Recognises its own setHash echo. */ + showDetails: function (id) { + if (PosnicPro.listDoc.activeId('lowstockitems') === String(id) + && $('#lowstockitems_detail_card').is(':visible')) { return; } + PosnicPro.lowstockitems._chrome(); + PosnicPro.lowstockitems.loadList(1); + PosnicPro.lowstockitems.openDoc(id); + }, + openDoc: function (id) { + var self = PosnicPro.lowstockitems; + var r = (self._lastRows || []).filter(function (x) { return String(x._id) === String(id); })[0]; + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var actions = '<button type="button" class="btn btn-sm btn-primary-rgba ls-restock" data-module="receiving" data-access="write" data-id="' + esc(id) + '">' + + '<i class="feather icon-plus mr-1"></i>Restock</button>'; + if (r) { + PosnicPro.listDoc.open({ key: 'lowstockitems', id: id, title: r.name, actions: actions, body: self._docBody(r) }); + PosnicPro.ACLForModule('receiving'); + return; + } + /* deep link before the list landed - the item record fills in */ + PosnicPro.listDoc.open({ key: 'lowstockitems', id: id, title: PosnicPro.i18n.t('lang_newitem_title', 'Item'), actions: actions }); + PosnicPro.ACLForModule('receiving'); + PosnicPro.get('items/' + id, function (response) { + var d = response && response.data; + if (response.type !== 'success' || !d) { + PosnicPro.listDoc.body('lowstockitems', '<div class="text-danger p-3"><lang class="lang_could_not_open_this_item">Could not open this item.</lang></div>'); + return; + } + PosnicPro.listDoc.title('lowstockitems', d.name || 'Item'); + PosnicPro.listDoc.body('lowstockitems', self._docBody({ + _id: id, + name: d.name, + itemid: d.itemid, + category_name: d.category_name, + supplier_name: d.supplier_name, + available_quantity: d.available_quantity, + image: d.image + })); + }, function () { + PosnicPro.listDoc.body('lowstockitems', '<div class="text-danger p-3"><lang class="lang_could_not_open_this_item">Could not open this item.</lang></div>'); + }); + }, + _docBody: function (r) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var img = (r.image && r.image !== 'item.svg') ? r.image : 'static/images/default/item.svg'; + return '<div style="display:flex; gap:20px; align-items:flex-start;">' + + '<img src="' + esc(img) + '" style="width:84px; height:84px; object-fit:cover; border-radius:8px; flex:0 0 84px; border:1px solid var(--theme-border-color, #e3e7ee);" alt="">' + + '<div style="flex:1 1 auto; min-width:0;">' + + PosnicPro.listDoc.stats([ + { v: '<span style="color:var(--theme-danger-color, #c0392b);">' + esc(r.available_quantity) + '</span>', l: PosnicPro.i18n.t('lang_left_in_stock', 'Left in stock') }, + { v: esc(r.itemid || '—'), l: PosnicPro.i18n.t('lang_sku_title', 'SKU') } + ]) + + '</div></div>' + + PosnicPro.listDoc.grid([ + { label: PosnicPro.i18n.t('lang_identity', 'Identity'), lines: [ + r.category_name ? '<div>' + esc(r.category_name) + '</div>' : '', + '<div class="q-muted">' + esc(r.name) + '</div>' + ] }, + { label: PosnicPro.i18n.t('lang_supply', 'Supply'), lines: [ + r.supplier_name ? '<div>' + esc(r.supplier_name) + '</div>' : '<div class="q-muted"><lang class="lang_no_supplier_on_record">No supplier on record</lang></div>' + ] } + ]) + + PosnicPro.listDoc.link('Open in Item List', "hasher.setHash('items/" + esc(r._id) + "');"); + }, + mountFilters: function (force) { + if (!$('#lowstockitems_filter_panel').length) { return; } + if (!force && $('#lowstockitems_filter_panel').data('mounted')) { return; } + $('#lowstockitems_filter_panel').data('mounted', true); + PosnicPro.listFilter.mount({ + key: 'lowstockitems', + container: '#lowstockitems_filter_panel', + button: '#lowstockitems_filter_btn', + searchPlaceholder: PosnicPro.i18n.t('lang_search_item_sku_supplier_or_category', 'Search item, SKU, supplier or category'), + searchFields: [ + { value: 'all', label: PosnicPro.i18n.t('lang_all_fields', 'All fields') }, + { value: 'name', label: PosnicPro.i18n.t('lang_newitem_title', 'Item') }, + { value: 'itemid', label: PosnicPro.i18n.t('lang_sku_title', 'SKU') }, + { value: 'supplier_name', label: PosnicPro.i18n.t('lang_newsupplier_title', 'Supplier') }, + { value: 'category_name', label: PosnicPro.i18n.t('lang_newcategory_title', 'Category') } + ], + onChange: function () { PosnicPro.lowstockitems.loadList(1); } + }); + }, + loadList: function (page) { + PosnicPro.lowstockitems.mountFilters(); + var self = PosnicPro.lowstockitems; + if (page) { self._page = page; } + var filters = PosnicPro.listFilter.legacyFilters('lowstockitems', {}); + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + PosnicPro.get({ url: 'items/itemLowStockTable', data: { - page: table.data('current_page'), - limit: parseInt($('#view_lowstockitems_per_page option:selected').text()), - filters: table.data('filters'), - notificationrange: notificationValue + page: self._page, + limit: self.PAGE_SIZE, + filters: JSON.stringify(filters), + notificationrange: localStorage.getItem('notificationrange') + } + }, function (response) { + var data = (response && response.data) || {}; + var list = data.list || []; + self._lastRows = list; + if (!list.length) { + var filtered = PosnicPro.listFilter.activeCount('lowstockitems') > 0; + $('#lowstockitems_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20">' + + (filtered ? PosnicPro.i18n.t('lang_no_low_stock_items_match_this_filter', 'No low-stock items match this filter.') : PosnicPro.i18n.t('lang_nothing_is_running_low_every_item_is_above', 'Nothing is running low - every item is above its alert level.')) + '</div>'); + $('#lowstockitems_list_paging').html(''); + return; } + var html = '<div class="table-responsive"><table class="table table-borderless">' + + '<thead><tr><th style="width:44px;"></th><th><lang class="lang_newitem_title">Item</lang></th><th class="ls-col-sku"><lang class="lang_sku_title">SKU</lang></th>' + + '<th class="ls-col-supplier"><lang class="lang_newsupplier_title">Supplier</lang></th><th class="ls-col-category"><lang class="lang_newcategory_title">Category</lang></th>' + + '<th class="text-right"><lang class="lang_left">Left</lang></th><th style="width:110px;"></th></tr></thead><tbody>'; + list.forEach(function (r) { + var img = (r.image && r.image !== 'item.svg') ? r.image : 'static/images/default/item.svg'; + html += '<tr class="md-row lowstockitems-row highlight-select' + + (PosnicPro.listDoc.activeId('lowstockitems') === String(r._id) ? ' is-active' : '') + '" data-id="' + esc(r._id) + '" style="cursor:pointer;">' + + '<td><img loading="lazy" decoding="async" src="' + esc(img) + '" style="width:30px; height:30px; object-fit:cover; border-radius:5px;" alt=""></td>' + + '<td>' + esc(r.name) + '</td>' + + '<td class="ls-col-sku q-muted">' + esc(r.itemid || '-') + '</td>' + + '<td class="ls-col-supplier">' + esc(r.supplier_name || '-') + '</td>' + + '<td class="ls-col-category">' + esc(r.category_name || '-') + '</td>' + + '<td class="text-right"><span class="rs-pill unpaid">' + esc(r.available_quantity) + ' left</span></td>' + + '<td class="text-right"><button type="button" class="btn btn-sm btn-primary-rgba ls-restock" data-module="receiving" data-access="write" data-id="' + esc(r._id) + '">' + + '<i class="feather icon-plus mr-1"></i>Restock</button></td>' + + '</tr>'; + }); + html += '</tbody></table></div>'; + $('#lowstockitems_list_rows').html(html); + PosnicPro.ACLForModule('receiving'); + self.renderPager(Number(data.total) || list.length); + }, function () { + $('#lowstockitems_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20"><lang class="lang_could_not_load_the_low_stock_list_try_agai">Could not load the low stock list - try again.</lang></div>'); + }); + }, + renderPager: function (total) { + var self = PosnicPro.lowstockitems; + var p = self._page, size = self.PAGE_SIZE; + var pages = Math.ceil(total / size) || 1; + var label = total + ' ' + (total === 1 ? PosnicPro.i18n.t('lang_item_running_low', 'item running low') : PosnicPro.i18n.t('lang_items_running_low', 'items running low')); + if (pages > 1) { label = 'Page ' + p + ' of ' + pages + ' · ' + label; } + var btn = function (to, text, off, cls) { + return '<button type="button" class="btn btn-sm ' + (cls || 'btn-secondary-rgba') + ' q-pg-btn"' + (off ? ' disabled' : '') + + ' onclick="PosnicPro.lowstockitems.goPage(' + to + ');">' + text + '</button>'; }; - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - table.data('total', response.data.total); - table.data('total_pages', response.data.total_pages); - table.data('current_page', response.data.current_page); - table.data('per_page', response.data.per_page); - PosnicPro.paging(response.data.total_pages, response.data.current_page); - table.children('tbody').text(''); - $('#view_lowstockitems_total').text(response.data.total); - - var rowTotal = response.data.total; - if (rowTotal === 0) { - $('.lowstock_header').hide(); - let dateRange = $('#view_sales_daterange span span[data-toggle="tooltip"]').attr('data-original-title'); - $('.lowstock_norecord').empty().append('<div class="text-center text-dark"> <p>No Records on ' + dateRange + ' </p></div>'); - $('#lowstock_img_hide,.lowstock_norecord').show(); - - } else { - $('.lowstock_norecord').empty(); - $('#lowstock_img_hide,.lowstock_norecord').hide(); - $('.lowstock_header').show(); - } - var row_total = (table.data('current_page') - 1) * table.data('per_page') + 1; - $('#view_lowstockitems_page_total').text(row_total); - var page_totals = (table.data('current_page') - 1) * table.data('per_page'); - $('#view_lowstockitems_page_perpage_total').text(page_totals + response.data.list.length); - for (var i = 0; i < response.data.list.length; i++) { - var row = response.data.list[i]; - var row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; - var image_path = (row.image !== "item.svg") ? row.image : 'static/images/default/' + row.image; - var action = '<div id="onclick-toolbar-options_' + i + '" class="hidden">' + - '<a data-module="lowstockitems" data-access="read" href="#/lowstockitems/' + row._id + '" id="' + row._id + '" data-id="lowstockitems/' + row._id + '" data-toggle="tooltip" title="View Items" class="point-cursor mobile_tooltip"><i class="feather icon-eye"></i></a>' + - '<a data-module = "receiving" data-access = "write" href="#/receivings/new" id="' + row._id + '" data-id="receivings/new" onclick="PosnicPro.lowstockitems.loadLowStockValue(this.id)" data-toggle="tooltip" title="Add Stock" class="point-cursor mobile_tooltip"><i class="feather icon-plus mr-2"></i></a>' + - '</div>' + - '<div data-toolbar="user-options" class="btn btn-round btn-primary-rgba round-pad" id="onclick-toolbar_' + i + '"><i class="feather icon-more-vertical-"></i></div>'; - var trow = '<tr> <td scope="row">' + row_no + '</td> <td>' + row.name + '</td> <td><img src=' + image_path + ' class="imagezoom table_img_alter" id="' + row.image + '" onclick="PosnicPro.viewImage(this.id,\'item\');"></td> <td class="text-center">' + row.itemid + '</td> <td>' + row.supplier_name + '</td> <td>' + row.category_name + '</td> <td class="text-center">' + row.available_quantity + '</td> ' + - '<td class="text-center"><span>' + action + '</span></td>' + - '</tr>'; - $('#view_lowstockitems').children('tbody').append(trow); - } - $(document).ready(function () { - for (var i = 0; i < response.data.list.length; i++) { - $('#onclick-toolbar_' + i).toolbar({ - content: '#onclick-toolbar-options_' + i, - event: 'click', - style: 'primary', - hideOnClick: true - }); - $('#onclick-toolbar_' + i).on('toolbarItemClick', function (event, element) { - hasher.setHash($(element).data('id')); - $(this).trigger('click'); - $('.mobile_tooltip').tooltip('hide'); - }); - } - }); - PosnicPro.ACLForModule('receiving'); - loader.find(".loadingSpinner:first").remove(); - } else { - PosnicPro.alert(response.type, response.message); + var html = ''; + if (pages > 1) { + html += btn(p - 1, '«', p <= 1); + var end = Math.min(pages, Math.max(1, p - 2) + 4); + var start = Math.max(1, end - 4); + for (var n = start; n <= end; n++) { + html += '<span class="q-pg-num">' + btn(n, n, false, n === p ? 'btn-primary-rgba' : 'btn-secondary-rgba') + '</span>'; } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); + } + html += '<span class="q-pg-count">' + label + '</span>'; + if (pages > 1) { html += btn(p + 1, '»', p >= pages); } + $('#lowstockitems_list_paging').html(html); + }, + goPage: function (n) { + if (!n || n < 1) { return; } + PosnicPro.lowstockitems._page = n; + PosnicPro.lowstockitems.loadList(); + }, + _csvSpec: function () { + return { + head: ['Item', 'SKU', 'Supplier', 'Category', 'Available'], + map: function (r) { + return [r.name, r.itemid || '', r.supplier_name || '', r.category_name || '', r.available_quantity]; + } + }; + }, + exportCsv: function () { + var spec = PosnicPro.lowstockitems._csvSpec(); + PosnicPro.listExport.save( + [spec.head].concat((PosnicPro.lowstockitems._lastRows || []).map(spec.map)), 'low-stock.csv'); + }, + /* Everything matching the CURRENT filter, paged through the same + endpoint the list reads - never a shapeless full dump. */ + exportAllCsv: function () { + var spec = PosnicPro.lowstockitems._csvSpec(); + PosnicPro.listExport.all({ + url: 'items/itemLowStockTable', + params: function (page, limit) { + return { page: page, limit: limit, filters: JSON.stringify(PosnicPro.listFilter.legacyFilters('lowstockitems', {})), notificationrange: localStorage.getItem('notificationrange') }; + }, + head: spec.head, + map: spec.map, + filename: 'low-stock.csv' }); }, + /* Restock: open a new purchase with the item AND its supplier already + filled - the flow the old Add Stock action carried, kept as-is. */ loadLowStockValue: function (id) { var loader = $(".loader-low_stock"); $("<div class='loadingSpinner'></div>").appendTo(loader); @@ -115,25 +245,22 @@ PosnicPro.lowstockitems = { var response = jQuery.parseJSON(xhr.responseText); PosnicPro.alert(response.type, response.message); }); - }, - showDataTablePage: function () { - var loader = $(".loader-table-lowstock"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.HideSideBarModal(); - $('.page_loader,#osk-container').hide(); - $('.page-title-box,#lowstockitems').show(); - $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); - $(".vertical-layout").removeClass("toggle-menu"); - $(".vertical-menu li a").removeClass("active"); - $('#v-pills-inventory-tab').addClass('active'); - $('#v-pills-inventory').addClass('show active'); - $('.vertical-menu li a#view_itemslow_page').addClass('active'); - PosnicPro.lowstockitems.lowstockitemsTable('lowstockitems'); - $('.dashboard_img_menu').hide(); - $('#image_sidebar_lowstock').show(); - }, - showDetails: function (id) { - hasher.setHash('lowstockitems/' + id); - PosnicPro.items.viewItem(id); } }; + +$(document).on('click', '#lowstockitems_filter_btn', function () { + PosnicPro.lowstockitems.mountFilters(true); + PosnicPro.listFilter.toggle('lowstockitems'); +}); +/* Details first, in the right pane (owner: no popups, no redirects - + "similar right side open design"). */ +$(document).on('click', '#lowstockitems_list_rows tr.lowstockitems-row', function (e) { + if ($(e.target).closest('.ls-restock').length) { return; } + PosnicPro.lowstockitems.openDoc($(this).data('id')); +}); +$(document).on('click', '.ls-restock', function (e) { + e.stopPropagation(); + var id = $(this).data('id'); + hasher.setHash('receivings/new'); + PosnicPro.lowstockitems.loadLowStockValue(id); +}); diff --git a/frontend/static/script/js/modules/js/loyalty.js b/frontend/static/script/js/modules/js/loyalty.js index 31da6d43c..be25280b4 100644 --- a/frontend/static/script/js/modules/js/loyalty.js +++ b/frontend/static/script/js/modules/js/loyalty.js @@ -91,10 +91,10 @@ PosnicPro.loyalty = { t = t || {}; var row = $( '<tr>' + - '<td><input type="text" class="form-control loyalty-tier-name" placeholder="Tier name"></td>' + + '<td><input type="text" class="form-control loyalty-tier-name" placeholder="Tier name" data-t-placeholder="lang_tier_name"></td>' + '<td><input type="number" min="0" step="1" class="form-control loyalty-tier-threshold" placeholder="0"></td>' + '<td><input type="number" min="0" step="0.01" class="form-control loyalty-tier-multiplier" placeholder="1"></td>' + - '<td class="text-center"><a href="javascript:void(0)" class="btn btn-danger-rgba loyalty-tier-remove" title="Remove tier"><i class="feather icon-trash"></i></a></td>' + + '<td class="text-center"><a href="javascript:void(0)" class="btn btn-danger-rgba loyalty-tier-remove" title="Remove tier" data-t-title="lang_remove_tier"><i class="feather icon-trash"></i></a></td>' + '</tr>' ); row.find('.loyalty-tier-name').val(t.name || ''); @@ -140,7 +140,7 @@ PosnicPro.loyalty = { save: function () { var data = PosnicPro.loyalty.collect(); if (data.earn_amount <= 0 || data.earn_points <= 0) { - PosnicPro.alert('error', 'Earn rate needs a points value and an amount greater than zero.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_earn_rate_needs_a_points_value_and_an_amou', 'Earn rate needs a points value and an amount greater than zero.')); return; } PosnicPro.put({ url: 'loyalty/config', data: JSON.stringify(data) }, function (res) { diff --git a/frontend/static/script/js/modules/js/messaging.js b/frontend/static/script/js/modules/js/messaging.js index ddb72891f..6a0922703 100644 --- a/frontend/static/script/js/modules/js/messaging.js +++ b/frontend/static/script/js/modules/js/messaging.js @@ -48,7 +48,7 @@ PosnicPro.messaging = { (byScope[p.scope] = byScope[p.scope] || []).push(p); }); var sel = $('#messaging_sms_provider').empty(); - sel.append('<option value="">— choose a provider —</option>'); + sel.append('<option value="" data-t="lang_choose_a_provider">Choose a provider</option>'); Object.keys(byScope).forEach(function (scope) { var group = $('<optgroup label="' + PosnicPro.messaging.esc(scope) + '"></optgroup>'); byScope[scope].forEach(function (p) { @@ -75,7 +75,7 @@ PosnicPro.messaging = { $('#messaging_wa_host').val(s.whatsapp_host || ''); var cloud = s.whatsapp_cloud || {}; var waSet = s.whatsapp_secrets_set || {}; - $('#messaging_wa_token').val('').attr('placeholder', waSet.access_token ? '•••••• saved — leave blank to keep' : ''); + $('#messaging_wa_token').val('').attr('placeholder', waSet.access_token ? '•••••• saved, leave blank to keep' : ''); $('#messaging_wa_phoneid').val(cloud.phone_number_id || ''); $('#messaging_wa_apiver').val(cloud.api_version || ''); $('#messaging_wa_tplname').val(cloud.template_name || ''); @@ -111,7 +111,7 @@ PosnicPro.messaging = { if (f.secret) { input = '<input type="password" class="form-control messaging-field" data-key="' + f.key + '" ' + - 'autocomplete="new-password" placeholder="' + (isSet ? '•••••• saved — leave blank to keep' : '') + '">'; + 'autocomplete="new-password" placeholder="' + (isSet ? '•••••• saved, leave blank to keep' : '') + '">'; } else { input = '<input type="text" class="form-control messaging-field" data-key="' + f.key + '" value="' + @@ -163,7 +163,7 @@ PosnicPro.messaging = { test: function (channel, phoneSel) { var phone = $(phoneSel).val(); if (!phone) { - PosnicPro.alert('error', 'Enter a phone number (with country code) to send a test.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_enter_a_phone_number_with_country_code_to', 'Enter a phone number (with country code) to send a test.')); return; } PosnicPro.put({ url: 'messaging/settings', data: JSON.stringify(PosnicPro.messaging.collect()) }, function () { diff --git a/frontend/static/script/js/modules/js/quick_items.js b/frontend/static/script/js/modules/js/quick_items.js index b4e5611fd..b93d8923d 100644 --- a/frontend/static/script/js/modules/js/quick_items.js +++ b/frontend/static/script/js/modules/js/quick_items.js @@ -54,6 +54,9 @@ // item later by unchecking "allow negative stock" on it. negative_stock: true, item_weight_machine_based: false, + // Imageless items dress themselves (stable from the name). + tile_color: (PosnicPro.autoTile && PosnicPro.autoTile(f.name).color) || '', + tile_shape: (PosnicPro.autoTile && PosnicPro.autoTile(f.name).shape) || '', description: '' }; } @@ -114,7 +117,7 @@ $('.vertical-menu li a').removeClass('active'); $('.page_loader,#osk-container').hide(); $('.page-title-box,#quickitems').show(); - $('#v-pills-inventory-tab,#quick_items_page').addClass('active'); + $('#v-pills-inventory-tab,#view_items_page').addClass('active'); $('#v-pills-inventory').addClass('show active'); PosnicPro.quickitems.loadOptions(); @@ -176,7 +179,7 @@ PosnicPro.quickitems.optionsLoaded = true; PosnicPro.get({ url: 'categories/getCategoryAjaxList', data: 'query=' }, function (r) { - var html = '<option value="">No category</option>'; + var html = '<option value="" data-t="lang_no_category">No category</option>'; $.each((r && r.suggestions) || [], function (i, c) { html += '<option value="' + c.id + '" data-name="' + c.name + '">' + c.name + '</option>'; }); @@ -193,7 +196,7 @@ }, function () {}); PosnicPro.get({ url: 'setting/getTaxAll', data: { tax_group: 'all' } }, function (r) { - var html = '<option value="">No tax</option>'; + var html = '<option value="" data-t="lang_no_tax">No tax</option>'; $.each((r && r.data) || [], function (i, t) { html += '<option value="' + t.tax_id + '" data-name="' + t.tax_name + '"' + ' data-value="' + t.tax_value + '">' + t.tax_name + '</option>'; @@ -207,7 +210,7 @@ save: function () { var name = $.trim($('#qa_name').val()); if (!name) { - PosnicPro.alert('error', 'An item needs a name.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_an_item_needs_a_name', 'An item needs a name.')); $('#qa_name').focus(); return false; } @@ -347,7 +350,7 @@ $('.vertical-menu li a').removeClass('active'); $('.page_loader,#osk-container').hide(); $('.page-title-box,#bulkitems').show(); - $('#v-pills-inventory-tab,#bulk_items_page').addClass('active'); + $('#v-pills-inventory-tab,#view_items_page').addClass('active'); $('#v-pills-inventory').addClass('show active'); if (categoryIndex === null) loadCategoryIndex(); @@ -570,20 +573,20 @@ $('body').append( '<div class="modal fade" id="quick_item_modal" tabindex="-1" role="dialog" aria-hidden="true">' + '<div class="modal-dialog modal-dialog-centered modal-sm" role="document"><div class="modal-content">' + - '<div class="modal-header py-2"><h5 class="modal-title">New item</h5>' + + '<div class="modal-header py-2"><h5 class="modal-title"><lang class="lang_new_item">New item</lang></h5>' + '<button type="button" class="close" data-dismiss="modal">×</button></div>' + '<div class="modal-body">' + - '<label class="mb-0 small text-muted" for="quick_item_name">Name</label>' + + '<label class="mb-0 small text-muted" for="quick_item_name"><lang class="lang_name_title">Name</lang></label>' + '<input type="text" class="form-control mb-2" id="quick_item_name" maxlength="100" autocomplete="off">' + - '<label class="mb-0 small text-muted" for="quick_item_price">Selling price</label>' + + '<label class="mb-0 small text-muted" for="quick_item_price"><lang class="lang_selling_price_2">Selling price</lang></label>' + '<input type="number" min="0" step="any" class="form-control mb-2 text-right" id="quick_item_price" placeholder="0.00" autocomplete="off">' + - '<label class="mb-0 small text-muted" for="quick_item_qty">Stock on hand</label>' + + '<label class="mb-0 small text-muted" for="quick_item_qty"><lang class="lang_stock_on_hand">Stock on hand</lang></label>' + '<input type="number" min="0" step="any" class="form-control text-right" id="quick_item_qty" placeholder="0" autocomplete="off">' + - '<small class="text-muted d-block mt-2">Saved to your items - add details anytime from the Items page.</small>' + + '<small class="text-muted d-block mt-2"><lang class="lang_saved_to_your_items_add_details_anytime_fr">Saved to your items - add details anytime from the Items page.</lang></small>' + '</div>' + '<div class="modal-footer py-2">' + - '<button type="button" class="btn btn-secondary-rgba" data-dismiss="modal">Cancel</button>' + - '<button type="button" class="btn btn-primary" id="quick_item_save">Save item</button>' + + '<button type="button" class="btn btn-secondary-rgba" data-dismiss="modal"><lang class="lang_cancel_title">Cancel</lang></button>' + + '<button type="button" class="btn btn-primary" id="quick_item_save"><lang class="lang_save_item">Save item</lang></button>' + '</div></div></div></div>'); $('#quick_item_price,#quick_item_qty').on('keydown', function (e) { if (e.key === 'Enter') { e.preventDefault(); $('#quick_item_save').click(); } @@ -622,7 +625,7 @@ return; } $('#quick_item_modal').modal('hide'); - PosnicPro.alert('success', 'Item saved'); + PosnicPro.alert('success', PosnicPro.i18n.t('lang_item_saved', 'Item saved')); var id = (result.data && (result.data.id || result.data._id)) || ''; var cb = PosnicPro.quickitems._onCreated; PosnicPro.quickitems._onCreated = null; diff --git a/frontend/static/script/js/modules/js/receiving_add.js b/frontend/static/script/js/modules/js/receiving_add.js index 2f041f9b8..2499f4753 100644 --- a/frontend/static/script/js/modules/js/receiving_add.js +++ b/frontend/static/script/js/modules/js/receiving_add.js @@ -19,7 +19,7 @@ PosnicPro.receivings = { $("#receiving_add_payment_mode").empty(); let paymentMethod = ""; let ReceivingPaymentType = PosnicPro.configPaymentType; - $('#receiving_add_payment_mode').append('<option value="Cash" selected="selected">Cash</option>'); + $('#receiving_add_payment_mode').append('<option value="Cash" selected="selected" data-t="lang_cash_title">Cash</option>'); if (ReceivingPaymentType.leght !== 0) { $.each(ReceivingPaymentType, function (key, val) { if (val.payment_value !== payment_mode) { @@ -34,9 +34,9 @@ PosnicPro.receivings = { }, showAdd: function () { PosnicPro.receivings.showPaymentMode(''); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('.purchase-tittle-change').text('புதிய') : $('.purchase-tittle-change').text('New'); -// $('.changeReceivingText').text('Save'); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('.changeReceivingText').text('சேமி') : $('.changeReceivingText').text('Save'); + $('.purchase-tittle-change').text(PosnicPro.i18n.t('lang_new_title', 'New')); +// $('.changeReceivingText').text(PosnicPro.i18n.t('lang_save_title', 'Save')); + $('.changeReceivingText').text(PosnicPro.i18n.t('lang_save_title', 'Save')); PosnicPro.HideSideBarModal(); $('#receiving_submit').removeAttr('disabled'); $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); @@ -66,12 +66,12 @@ PosnicPro.receivings = { PosnicPro.commonDate(); $('#receiving_image_upload').attr('src', 'static/images/default/receiving.png'); //$('#receiving_logo').val('receiving.png'); - $('.fileupload-preview').html('Upload file'); + $('.fileupload-preview').html(PosnicPro.i18n.t('lang_upload_file', 'Upload file')); $('.update-button').attr('disabled', 'disabled').removeClass('btn-outline-success'); - $(".vertical-layout").addClass("toggle-menu"); + PosnicPro.collapseMenuForWorkspace(); $('#v-pills-purchase-tab,.receiving_new_shortcut').addClass('active'); $('#v-pills-purchase').addClass('show active'); - $('.vertical-menu li a#view_receiving_page').addClass('active'); + $('.vertical-menu li a#view_purchaseorders_page').addClass('active'); $('.dashboard_img_menu').hide(); $('#image_sidebar_purchase').show(); $('#item_upload_receiving_status').val('no'); @@ -82,7 +82,7 @@ PosnicPro.receivings = { showEdit: function (id) { $('#receiving_add_date').removeClass('commonDate'); $('#receiving_add_date').addClass('commonEditDate'); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('.purchase-tittle-change').text('திருத்தப்பட்ட') : $('.purchase-tittle-change').text('Edit'); + $('.purchase-tittle-change').text(PosnicPro.i18n.t('lang_action_edit', 'Edit')); $('#show-already-return-table').hide(); $('#v-pills-purchase').addClass('show active'); (PosnicPro.local.get('gst_action') === 'enable') ? $('.indian-gstr').show() : $('.indian-gstr').hide(); @@ -113,146 +113,9 @@ PosnicPro.receivings = { PosnicPro.receivings.view.viewReceiving(id); }, showDataTablePage: function () { - var loader = $(".loader-table-receiving"); - loader.find(".loadingSpinner:first").remove(); - PosnicPro.dashboard.datePicker(); - PosnicPro.HideSideBarModal(); - $(".vertical-layout").removeClass("toggle-menu"); - $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); - $(".vertical-menu li a").removeClass("active"); - $('#v-pills-purchase-tab').addClass('active'); - $('#v-pills-purchase').addClass('show active'); - $('.page_loader,#osk-container,#receiving_view_receiving_edit').hide(); - $('.page-title-box,#showreceivingbody,#receiving_view_view_receiving_table,#receivings').show(); - PosnicPro.receivings.receivingsTable('receivings'); - $('.dashboard_img_menu').hide(); - $('#image_sidebar_purchasehistory').show(); - var loader = $(".loader-receiving"); - loader.find(".loadingSpinner:first").remove(); - }, - receivingsTable: function () { - var loader = $(".loader-table-receiving"); - $("<div class='loadingSpinner'></div>").appendTo(loader); - PosnicPro.appendViewDataTableBody('receivings'); - var table = $('#view_receivings'); - var params = { - url: 'receivings', - data: { - page: table.data('current_page'), - limit: parseInt($('#view_receivings_per_page option:selected').text()), - filters: table.data('filters') - } - }; - PosnicPro.get(params, function (response) { - if (response.type === 'success') { - table.data('total', response.data.total); - table.data('total_pages', response.data.total_pages); - table.data('current_page', response.data.current_page); - table.data('per_page', response.data.per_page); - PosnicPro.paging(response.data.total_pages, response.data.current_page); - table.children('tbody').text(''); - $('#view_receivings_total').text(response.data.total); - var rowTotal = response.data.total; - if (rowTotal === 0) { - $('.purchase_header').hide(); - let dateRange = $('#view_sales_daterange span span[data-toggle="tooltip"]').attr('data-original-title'); - $('.purchase_norecord').empty().append('<div class="text-center text-dark"> <p>No Records on ' + dateRange + '</p></div>'); - $('#purchase_img_hide,.purchase_norecord').show(); - } else { - $('.purchase_norecord').empty(); - $('#purchase_img_hide,.purchase_norecord').hide(); - $('.purchase_header').show(); - } - - var row_total = (table.data('current_page') - 1) * table.data('per_page') + 1; - $('#view_receivings_page_total').text(row_total); - var page_totals = (table.data('current_page') - 1) * table.data('per_page'); - $('#view_receivings_page_perpage_total').text(page_totals + response.data.list.length); - var currency = PosnicPro.local.get('currencySign'); - for (var i = 0; i < response.data.list.length; i++) { - var row = response.data.list[i]; - var row_no = (table.data('current_page') - 1) * table.data('per_page') + i + 1; - var process_class = ""; - var print_icon = '<a data-module = "receiving" data-access = "read" data-toggle="tooltip" title="Receiving Print" href="#/receivings/' + row._id + '/print" data-id="receivings/' + row._id + '/print" class="point-cursor mobile_tooltip"><i class="feather icon-printer"></i></a>'; - var pdf_icon = '<a data-module = "receiving" data-access = "read" href="#/receivings/' + row._id + '/pdf" data-id="receivings/' + row._id + '/pdf" data-toggle="tooltip" title="Pdf" class="point-cursor mobile_tooltip"><i class="feather icon-file"></i></a>'; - // Loyverse study L2: send the same PDF to the supplier. - var email_icon = '<a data-module = "receiving" data-access = "write" href="javascript:void(0)" onclick="PosnicPro.receivings.view.emailToSupplier(\'' + row._id + '\');" data-toggle="tooltip" title="Email to supplier" class="point-cursor mobile_tooltip"><i class="feather icon-mail"></i></a>'; - var view_icon = '<a data-module = "receiving" data-access = "read" href="#/receivings/' + row._id + '" data-id="receivings/' + row._id + '" data-toggle="tooltip" title="View" class="point-cursor mobile_tooltip"><i class="feather icon-eye"></i></a>'; - var edit_icon = '<a data-module = "receiving" data-access = "write" href="#/receivings/' + row._id + '/edit" data-id="receivings/' + row._id + '/edit" id="edit_receiving_' + row._id + '" data-toggle="tooltip" title="Edit" class="point-cursor mobile_tooltip"><i class="feather icon-edit"></i></a>'; - var return_icon = '<a data-module = "receiving" data-access = "write" href="#/receivings/' + row._id + '/return" data-id="receivings/' + row._id + '/return" id="return_receiving_' + row._id + '" data-toggle="tooltip" title="Receiving Return" class="point-cursor mobile_tooltip"><i class="feather icon-corner-up-left"></i></a>'; - var received_icon = '<a data-module = "receiving" data-access = "write" href="#/receivings/' + row._id + '/received" data-id="receivings/' + row._id + '/received" data-toggle="tooltip" title="Received" class="point-cursor mobile_tooltip"><i class="feather icon-arrow-down-circle"></i></a>'; - if (row.receiving_status === 'Open') { - var receiving_status = row.receiving_status; - process_class = "badge badge-primary-inverse"; - return_icon = '<span class="show_return_icon" style="display:none;"></span>'; - } else { - - if (row.items.length === 0 && row.items_return.length > 0) { - var receiving_status = 'FullReturn'; - process_class = "badge badge-danger-inverse"; - pdf_icon = '<span class="show_pdf_icon" style="display:none;"></span>'; - email_icon = '<span class="show_email_icon" style="display:none;"></span>'; - print_icon = '<span class="show_print_icon" style="display:none;"></span>'; - return_icon = '<span class="show_return_icon" style="display:none;"></span>'; - edit_icon = '<span class="show_edit_icon" style="display:none;"></span>'; - received_icon = '<span class="show_received_icon" style="display:none;"></span>'; - } else if (row.receiving_status === 'Received') { - var receiving_status = row.receiving_status; - process_class = "badge badge-success-inverse"; - edit_icon = '<span class="show_edit_icon" style="display:none;"></span>'; - received_icon = '<span class="show_received_icon" style="display:none;"></span>'; - } else { - var receiving_status = 'PartialReturn'; - process_class = "badge badge-secondary-inverse"; - edit_icon = '<span class="show_edit_icon" style="display:none;"></span>'; - received_icon = '<span class="show_received_icon" style="display:none;"></span>'; - } - - } - - var action = '<div id="onclick-toolbar-options_' + i + '" class="hidden">' + - '<span class="show_print_icon" style="display:none;">' + print_icon + ' </span>' + - '<span class="show_pdf_icon" style="display:none;">' + pdf_icon + ' </span>' + - '<span class="show_email_icon" style="display:none;">' + email_icon + ' </span>' + - '<span class="show_return_icon" style="display:none;">' + return_icon + ' </span>' + - '<span class="show_received_icon" style="display:none;">' + received_icon + ' </span>' + - '<span class="show_view_icon" style="display:none;">' + view_icon + ' </span>' + - '<span class="show_edit_icon" style="display:none;">' + edit_icon + ' </span>' + - '<a data-module = "receiving" data-access = "delete" data-toggle="tooltip" title="Delete Sale" href="#/receivings/' + row._id + '/delete" data-id="receivings/' + row._id + '/delete" class="point-cursor mobile_tooltip"><i class="feather icon-trash"></i></a>' + - '</div>' + - '<div data-toolbar="user-options" class="btn btn-round btn-primary-rgba round-pad" id="onclick-toolbar_' + i + '"><i class="feather icon-more-vertical-"></i></div>'; - var updateDate = PosnicPro.convertDate(row.string_date); - var trow = '<tr> <td><input type="checkbox" class="receivings-row-id" id="' + row._id + '" name="id[]" value="' + row._id + '" onclick="PosnicPro.checkboxSelectOne(this,\'receivings\');"></td> <td scope="row">' + row_no + '</td> <td class="sale_id">' + row.receiving_id + '</td> <td class="sale_id">' + updateDate + '</td> <td width="20%">' + row.supplier_name + '</td> <td class="sale_id text-right"><a class="sale_color" href="tel:' + row.supplier_phone + '">' + row.supplier_phone + '</a></td> <td class="text-center"><span class="' + process_class + '">' + receiving_status + '</span></td> <td class="text-right">' + currency + ' <span class="number">' + row.total_amount + '</span></td> ' + - '<td class="text-center"> <span>' + action + ' </span>' + - ' </td></tr>'; - $('#view_receivings').children('tbody').append(trow); - } - $('span.number').number(true, 2); - $(document).ready(function () { - for (var i = 0; i < response.data.list.length; i++) { - $('#onclick-toolbar_' + i).toolbar({ - content: '#onclick-toolbar-options_' + i, - event: 'click', - style: 'primary', - hideOnClick: true - }); - $('#onclick-toolbar_' + i).on('toolbarItemClick', function (event, element) { - hasher.setHash($(element).data('id')); - $(this).trigger('click'); - $('.mobile_tooltip').tooltip('hide'); - }); - } - }); - PosnicPro.setSelectedCheckbox(PosnicPro["receivings_checkbox"], 'receivings'); - PosnicPro.ACLForModule('receiving'); - loader.find(".loadingSpinner:first").remove(); - } else { - PosnicPro.alert(response.type, response.message); - } - }, function (xhr) { - var response = jQuery.parseJSON(xhr.responseText); - PosnicPro.alert(response.type, response.message); - }); + /* Purchase History retired (owner order): purchases has ONE surface. + Old links, bookmarks and post-action redirects all land there. */ + hasher.setHash('purchaseorders'); }, searchItemReceiving: function (id) { var matched = false; @@ -273,7 +136,7 @@ PosnicPro.receivings = { autofillFromSupplier: function (lowStockOnly) { var supplierId = $('#receiving_add_supplier_id').val(); if (!supplierId) { - PosnicPro.alert('warning', 'Choose a supplier first'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_choose_a_supplier_first', 'Choose a supplier first')); return; } var range = localStorage.getItem('notificationrange') || 10; @@ -295,7 +158,7 @@ PosnicPro.receivings = { }); PosnicPro.alert('success', rows.length + (lowStockOnly ? ' low-stock' : '') + ' item(s) added from the supplier'); }, function () { - PosnicPro.alert('error', 'Could not load the supplier items'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_could_not_load_the_supplier_items', 'Could not load the supplier items')); }); }, addReceivingLineItems: function (param) { @@ -361,7 +224,7 @@ PosnicPro.receivings = { '<div class="input-group-prepend">' + '<span class="btn btn-secondary-rgba receive_qty_check" id = ' + id + ' onclick="PosnicPro.receivings.qtyIncrementDecrease(this.id,0);"><i class="feather icon-minus"></i></span>' + '</div>' + - '<input type="text" minlength="1" maxlength="5" size="3" min="0" max="100000" class="form-control cart-qty font_size14 float rec_sale_inp_val" id="addReceivingLineItemQty_' + id + '" value=' + item_quantity + ' onkeyup="PosnicPro.receivings.addLineReceivingChangeQty(\'' + id + '\');" style="text-align:center;" oninput="this.value = PosnicPro.minmax(this.value, 0, 100000)" onkeypress="PosnicPro.validate(event)" autocomplete="off">' + + '<input type="text" minlength="1" maxlength="5" size="3" min="0" max="100000" class="form-control cart-qty font_size14 float rec_sale_inp_val" inputmode="decimal" id="addReceivingLineItemQty_' + id + '" value=' + item_quantity + ' onkeyup="PosnicPro.receivings.addLineReceivingChangeQty(\'' + id + '\');" style="text-align:center;" oninput="this.value = PosnicPro.minmax(this.value, 0, 100000)" onkeypress="PosnicPro.validate(event)" autocomplete="off">' + '<div class="input-group-append">' + '<span class="btn btn-success-rgba receive_qty_check" id = ' + id + ' onclick="PosnicPro.receivings.qtyIncrementDecrease(this.id,1);"><i class="feather icon-plus"></i></span>' + '</div>' + @@ -369,7 +232,7 @@ PosnicPro.receivings = { '</div>'; if (PosnicPro.receivings.receivingReturnAction !== 'return') { var remove = '<td id=addReceivingRemoveLineItem_' + id + '>' + - '<button type="button" class="btn btn-danger-rgba mb-1" onclick="PosnicPro.receivings.removeLineItemReceiving(\'' + id + '\');" ><i class="feather icon-trash"></i></button>' + + '<button type="button" class="btn btn-danger-rgba mb-1" onclick="PosnicPro.receivings.removeLineItemReceiving(\'' + id + '\');" aria-label="Delete" data-t-aria-label="lang_delete"><i class="feather icon-trash"></i></button>' + '</td>'; $('#return_hide_text').show(); $('#return_show_text').hide(); @@ -389,8 +252,8 @@ PosnicPro.receivings = { ' <td id=addReceivingLineItemName_' + id + ' width="30%" class="font_size14">' + param.item_name + '</td>' + ' <td class="text-center add_circle font_size14">' + addLineItemQty + '</td>' + ' <td name ="addReceivingLineItemUnit" id="addReceivingLineItemUnit_' + id + '">' + item_unit + '</td>' + - ' <td id=addReceivingLineItemPrice_' + id + ' class="text-center font_size14">' + tax_itemprice.toFixed(2) + '  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemCompanyPriceReceiving(this);" data-id="' + id + '" data-toggle="tooltip" title="Edit item price" style="cursor:pointer;"></i></span></td>' + - ' <td name="addReceivingLineItemTax" id="addReceivingLineItemTax_' + id + '" class="text-center font_size14 show-hide-exc-tax" style="display:none;">' + lineItemTax + '<span>%</span>  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemTaxReceiving(this);" data-id="' + id + '" data-toggle="tooltip" title="Edit item tax" style="cursor:pointer;"></i></span></td>' + + ' <td id=addReceivingLineItemPrice_' + id + ' class="text-center font_size14">' + tax_itemprice.toFixed(2) + '  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemCompanyPriceReceiving(this);" data-id="' + id + '" data-toggle="tooltip" title="Edit item price" data-t-title="lang_edit_item_price" style="cursor:pointer;"></i></span></td>' + + ' <td name="addReceivingLineItemTax" id="addReceivingLineItemTax_' + id + '" class="text-center font_size14 show-hide-exc-tax" style="display:none;">' + lineItemTax + '<span>%</span>  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemTaxReceiving(this);" data-id="' + id + '" data-toggle="tooltip" title="Edit item tax" data-t-title="lang_edit_item_tax" style="cursor:pointer;"></i></span></td>' + ' <td id=addReceivingLineItemTotal_' + id + ' class="text-right font_size14">' + line_total.toFixed(2) + '</td>' + ' <span>' + remove + ' </span>' + ' <td id=addReceivingLineItemId_' + id + ' class="col-md-1" style="display:none;">' + id + '</td>' + @@ -526,7 +389,7 @@ PosnicPro.receivings = { if (extension === 'pdf') { filepath = '<iframe class="img-thumbnail image_style" src="' + image_path + '" frameborder="0" style="border:none;" data-toggle="tooltip" title="' + escape(title) + '"></iframe>'; } else { - filepath = '<img class="img-thumbnail image_style" src="' + image_path + '" \ + filepath = '<img loading="lazy" decoding="async" class="img-thumbnail image_style" src="' + image_path + '" \ data-toggle="tooltip" title="' + escape(title) + '" />'; } @@ -544,10 +407,57 @@ PosnicPro.receivings = { }); $('.hide-add-page').show(); - $('#receiving-status-open').hide(); - $('#receiving-status-receive').addClass('active'); - $("#open:radio").attr("checked", false); - $("#received:radio").attr('checked', true); + /* Restore EVERYTHING the record carries - the old radio block here + targeted #open/#received, ids that never existed, so editing a + Received purchase silently saved it back to Open. */ + var ep = PosnicPro.receivingsEditParams; + /* A partially received document's status belongs to the Receive + flow, not the edit page: it shows, locked, and rides through the + save untouched (the server keeps what arrived as fact). */ + $('#receiving_status_select option[value="Partial"]').remove(); + if (ep.receiving_receiving_status === 'Partial') { + $('#receiving_status_select') + .append('<option value="Partial" data-t="lang_partially_received">Partially received</option>') + .val('Partial') + .prop('disabled', true) + .attr('title', PosnicPro.i18n.t('lang_managed_by_the_receive_flow_receive_or_can', 'Managed by the Receive flow - receive or cancel the rest from the purchase document')); + $('#receiving_expected_wrap').show(); + } else { + $('#receiving_status_select').prop('disabled', false); + $('#receiving_status_select').val(ep.receiving_receiving_status === 'Received' ? 'Received' : 'Open').trigger('change'); + } + $('#receiving_itc_eligible').prop('checked', ep.receiving_itc_eligible !== false); + $('#receiving_expected_date').val(ep.receiving_expected_date ? String(ep.receiving_expected_date).slice(0, 10) : ''); + $('#receiving_invoice_total_declared').val(ep.receiving_invoice_total_declared || ''); + $('#receiving_charges_rows').empty(); + (ep.receiving_additional_charges || []).forEach(function (c) { + PosnicPro.receivings.addChargeRow(c.label, c.amount); + }); + PosnicPro.receivings.addReceivingTableRowCalc(); + }, + /* ---- Additional charges (freight etc.) - ride on the total ---- */ + addChargeRow: function (label, amount) { + $('#receiving_charges_rows').append( + '<div class="form-row charge-row align-items-center mt-2">' + + '<div class="col-7"><input type="text" class="form-control form-control-sm charge-label" placeholder="Freight" data-t-placeholder="lang_freight" maxlength="40" aria-label="Charge label" data-t-aria-label="lang_charge_label"></div>' + + '<div class="col-4"><input type="number" step="0.01" min="0" class="form-control form-control-sm text-right charge-amount" placeholder="0.00" aria-label="Charge amount" data-t-aria-label="lang_charge_amount"></div>' + + '<div class="col-1 text-center"><a href="javascript:void(0)" class="charge-remove text-danger" aria-label="Remove charge" data-t-aria-label="lang_remove_charge"><i class="feather icon-x"></i></a></div>' + + '</div>'); + var row = $('#receiving_charges_rows .charge-row').last(); + if (label !== undefined) { row.find('.charge-label').val(label); } + if (amount !== undefined) { row.find('.charge-amount').val(amount); } + if (label === undefined) { row.find('.charge-label').trigger('focus'); } + }, + collectCharges: function () { + return $('#receiving_charges_rows .charge-row').map(function () { + return { + label: $.trim($(this).find('.charge-label').val() || ''), + amount: parseFloat($(this).find('.charge-amount').val()) || 0 + }; + }).get().filter(function (c) { return c.amount > 0 || c.label; }); + }, + chargesTotal: function () { + return PosnicPro.receivings.collectCharges().reduce(function (sum, c) { return sum + c.amount; }, 0); }, addReceivingTableRowCalc: function () { @@ -581,12 +491,53 @@ PosnicPro.receivings = { $('.tax-receiving-value').html('<span class="number">' + tax_value + '</span>'); var tot = ((parseFloat(addReceivingLineTotal) - parseFloat(tax_value))); $('#receiving_add_subtotal_amount').number(tot, 2); - var receivegrandTotal = (PosnicPro.roundoff === true) ? Math.round(addReceivingLineTotal).toFixed(2) : Number(addReceivingLineTotal).toFixed(2); + /* Additional charges ride on the grand total - never on item + cost, never on the tax heads. The declared-invoice check uses + the same base, because the supplier's total includes them. */ + var chargesTotal = PosnicPro.receivings.chargesTotal(); + if (chargesTotal > 0) { + $('#receiving_charges_row').show(); + $('.charges-receiving-value').text(chargesTotal.toFixed(2)); + } else { + $('#receiving_charges_row').hide(); + } + var withCharges = parseFloat(addReceivingLineTotal) + chargesTotal; + var receivegrandTotal = (PosnicPro.roundoff === true) ? Math.round(withCharges).toFixed(2) : Number(withCharges).toFixed(2); $("#receiving_add_total_amount").number(receivegrandTotal, 2); - $("#receiving_total").val(addReceivingLineTotal); + $("#receiving_total").val(withCharges.toFixed(2)); $('span.number').number(true, 2); } + PosnicPro.receivings.invoiceTotalCheck(); + }, + /* + * P2: the declared invoice total against what the lines add up to. + * A mismatch WARNS - the goods are already in the shop; the badge makes + * somebody look, the save never refuses (owner's ruling). + */ + invoiceTotalCheck: function () { + var declared = parseFloat($('#receiving_invoice_total_declared').val()); + var note = $('#receiving_invoice_total_note'); + if (!declared || isNaN(declared)) { note.text('').attr('class', 'form-text'); return; } + var computed = parseFloat($('#receiving_total').val()) || 0; + if (Math.abs(declared - computed) > 0.5) { + note.text('Does not match the lines (' + computed.toFixed(2) + ') - saved with a warning flag.') + .attr('class', 'form-text text-warning'); + } else { + note.text(PosnicPro.i18n.t('lang_matches_the_lines', 'Matches the lines.')).attr('class', 'form-text text-success'); + } + }, + /* The credit flag speaks the shop's regime (set once per page load). */ + applyTaxRegimeWording: function () { + PosnicPro.get({ url: 'setting/taxProfile', data: {} }, function (r) { + var d = r && r.data; + if (!d || !d.regime) { return; } + if (d.regime === 'sales_tax') { + $('#receiving_itc_label').text(PosnicPro.i18n.t('lang_purchased_for_resale_tax_exempt', 'Purchased for resale (tax-exempt)')); + } else if (d.regime === 'none') { + $('#receiving_itc_eligible').closest('.form-group').hide(); + } + }, function () { /* wording only */ }); }, receivingTextboxQtyChange: function (ItemQty, id) { $('#addReceivingLineItemQty_' + id).val(ItemQty); @@ -630,7 +581,7 @@ PosnicPro.receivings = { var ItemQty = available_quantity; PosnicPro.receivings.receivingTextboxQtyChange(ItemQty, id); PosnicPro.receivings.addReceivingTableRowCalc(); - PosnicPro.alert('error', 'Some items are out of stock.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_some_items_are_out_of_stock', 'Some items are out of stock.')); return false; } } @@ -670,7 +621,7 @@ PosnicPro.receivings = { }, checkedItemReceiving: function (id) { $('#receiving_submit').removeAttr('disabled'); - (PosnicPro.local.get('language_herf') === 'ta_dashboard.html') ? $('.changeReceivingText').text('திரும்ப கொள்முதல்') : $('.changeReceivingText').text('Return'); + $('.changeReceivingText').text(PosnicPro.i18n.t('lang_action_return_purchase', 'Return')); if ($('#addReceivingCheckedLineItem_' + id).is(":checked")) { $('#return_input_group_' + id).css({cursor: 'pointer', 'pointer-events': 'auto'}); $('#receiving_row_' + id).css({cursor: 'pointer', background: '#ffffff'}); @@ -700,7 +651,7 @@ PosnicPro.receivings = { $('#receiving_add_item_name').focus(); $('#clearReceiving').show(); $('#closeReceiving').hide(); - $('.fileupload-preview').html('Upload file'); + $('.fileupload-preview').html(PosnicPro.i18n.t('lang_upload_file', 'Upload file')); (PosnicPro.local.get('default_supplier_enable_disable') === 'false') ? $('#receiving_add_supplier_id,#receiving_add_supplier_name,#receiving_add_supplier_address,#receiving_add_supplier_phone,#receiving_add_supplier_email,#receiving_add_supplier_state,#receiving_add_supplier_gst_type,#receiving_add_supplier_gst_number').val('') : PosnicPro.defaultSupplierSet(); PosnicPro.receivings.imageParams = []; PosnicPro.receivings.receivingAddAction = false; @@ -727,7 +678,7 @@ PosnicPro.receivings = { $('#clearReceiving').show(); $('#closeReceiving').hide(); $('#receiving_discount_amount,#receiving_total').val("0"); - $('.fileupload-preview').html('Upload file'); + $('.fileupload-preview').html(PosnicPro.i18n.t('lang_upload_file', 'Upload file')); $('#receiving_upload_image').val(''); PosnicPro.receiving_lineitems = []; PosnicPro.receivings.imageParams = []; @@ -741,7 +692,7 @@ PosnicPro.receivings = { $('#addReceivingLineItemPrice_' + id).editable({ type: 'text', pk: 1, - title: 'Edit cost', + title: PosnicPro.i18n.t('lang_edit_cost', 'Edit cost'), inputclass: 'form-control form-control-sm', tpl: '<input size="4"></input>', validate: function (value) { @@ -752,12 +703,12 @@ PosnicPro.receivings = { }, success: function (k, val) { $('#addpurchasePrice_' + id + '').text(val); - $('#addReceivingLineItemPrice_' + id).replaceWith('<td id=addReceivingLineItemPrice_' + id + ' class="text-center font_size14">' + parseFloat(val).toFixed(2) + '  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemCompanyPriceReceiving(this);" data-id="' + id + '" data-toggle="tooltip" title="Edit item price" style="cursor:pointer;"></i></span></td>'); + $('#addReceivingLineItemPrice_' + id).replaceWith('<td id=addReceivingLineItemPrice_' + id + ' class="text-center font_size14">' + parseFloat(val).toFixed(2) + '  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemCompanyPriceReceiving(this);" data-id="' + id + '" data-toggle="tooltip" title="Edit item price" data-t-title="lang_edit_item_price" style="cursor:pointer;"></i></span></td>'); let taxValue = $('#addReceivingLineItemTax_' + id + '').text(); let excvalue = (val / 100) * parseFloat(taxValue); let lineTotal = parseFloat(val) + parseFloat(excvalue); $('#addReceivingLineItemTotal_' + id + '').text(lineTotal.toFixed(2)); - $('#addReceivingLineTaxtype_' + id).text('Exc'); + $('#addReceivingLineTaxtype_' + id).text(PosnicPro.i18n.t('lang_exc', 'Exc')); PosnicPro.receivings.addLineReceivingChangeQty(id); let params = { method: 'PUT', @@ -781,7 +732,7 @@ PosnicPro.receivings = { $('#addReceivingLineItemTax_' + id).editable({ type: 'text', pk: 1, - title: 'Edit tax value', + title: PosnicPro.i18n.t('lang_edit_tax_value', 'Edit tax value'), inputclass: 'form-control form-control-sm', tpl: '<input size="4" min="0" max="100" maxlength="4" onkeyup="this.value=PosnicPro.minmax(this.value,0,100)" onkeypress="return PosnicPro.isNumber(event)"></input>', value: intValue, @@ -793,13 +744,13 @@ PosnicPro.receivings = { }, success: function (k, val) { $('#addReceivingLineItemTax_' + id + '').text(val); - $('#addReceivingLineItemTax_' + id).replaceWith('<td id=addReceivingLineItemTax_' + id + ' class="text-center font_size14 show-hide-exc-tax">' + val + '%  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemTaxReceiving(this);" data-id="' + id + '" data-toggle="tooltip" title="Edit item tax" style="cursor:pointer;"></i></span></td>'); + $('#addReceivingLineItemTax_' + id).replaceWith('<td id=addReceivingLineItemTax_' + id + ' class="text-center font_size14 show-hide-exc-tax">' + val + '%  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemTaxReceiving(this);" data-id="' + id + '" data-toggle="tooltip" title="Edit item tax" data-t-title="lang_edit_item_tax" style="cursor:pointer;"></i></span></td>'); let price = $('#addpurchasePrice_' + id + '').text(); let Excvalue = (price / 100) * parseFloat(val); let lineTotal = parseFloat(price) + parseFloat(Excvalue); $('#addReceivingLineItemTotal_' + id + '').text(lineTotal.toFixed(2)); - $('#addReceivingLineTaxtype_' + id).text('Exc'); + $('#addReceivingLineTaxtype_' + id).text(PosnicPro.i18n.t('lang_exc', 'Exc')); PosnicPro.receivings.addLineReceivingChangeQty(id); } }); @@ -824,8 +775,8 @@ PosnicPro.receivings = { PosnicPro.receivings.editPriceAction = 'edit'; } if (data.available_quantity > 0) { - $('#item_title_data').text('Add'); - $('#item_button_title').text('Save'); + $('#item_title_data').text(PosnicPro.i18n.t('lang_nav_add', 'Add')); + $('#item_button_title').text(PosnicPro.i18n.t('lang_save_title', 'Save')); $('#items_edit_reset,.items_edit_reset').hide(); $('#items_reset').show(); $('#itemid').val(''); @@ -840,8 +791,8 @@ PosnicPro.receivings = { $('#items_mrp_price').val(data.mrp_price); $('#items_company_price').val(data.company_price); $('#items_selling_price').val(data.selling_price); - $('#item_title_data').text('Edit'); - $('#item_button_title').text('Update'); + $('#item_title_data').text(PosnicPro.i18n.t('lang_edit_title', 'Edit')); + $('#item_button_title').text(PosnicPro.i18n.t('lang_refresh_title', 'Update')); $('#items_edit_reset,.items_edit_reset').show(); $('#items_reset').hide(); $('#itemid').val(id); @@ -877,7 +828,7 @@ PosnicPro.receivings = { }); $('#item-display-preview').append( '<div id="selector_' + key + '" class="receiving-image-wrapper image-area" style="position: relative;"> \ - <img class="image_style" class="img-thumbnail" src="' + image_path + '" \ + <img loading="lazy" decoding="async" class="image_style" class="img-thumbnail" src="' + image_path + '" \ title="' + escape(val.name) + '" /><br /> \ <span id="coverimage_selector_' + key + '" class="coverImageAdd" style="display: block;border: 1px solid #ddd;border-radius: 5px;margin-top: 2px; background: #506fe4; color: #fff" onclick="PosnicPro.items.coverImageEdit(this.id,\'' + key + '\',\'' + val.name + '\',\'' + val.size + '\')">Choose Cover</span><a class="remove-image" style="cursor:pointer;display: inline;position: absolute; top: -10px; right: -10px; border-radius: 10em; padding: 2px 6px 3px; text-decoration: none; font: 700 21px/20px sans-serif; background: #f48787; border: 3px solid #fff; color: #FFF; box-shadow: 0 2px 6px rgba(0,0,0,0.5), inset 0 2px 4px rgba(0,0,0,0.3); text-shadow: 0 1px 2px rgba(0,0,0,0.5); -webkit-transition: background 0.5s; transition: background 0.5s;" onclick="PosnicPro.items.image_edit_remove_selected(\'' + key + '\',\'' + val.name + '\')">×</a> \ </div>'); @@ -935,10 +886,10 @@ PosnicPro.receivings = { if ($('#receiving_print tbody tr').find(':nth-child(8)').text() === '' || supplier_name === '') { if (supplier_name === '') { $("#receiving_add_supplier_name").focus(); - PosnicPro.alert('error', 'Enter a supplier name.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_enter_a_supplier_name', 'Enter a supplier name.')); return false; } - PosnicPro.alert('warning', 'Add at least one item.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_add_at_least_one_item', 'Add at least one item.')); $('#receiving_add_item_name').focus(); return false; } else { @@ -979,17 +930,14 @@ PosnicPro.receivings = { id: PosnicPro.receivings.receivingAddId, image: PosnicPro.receivings.imageParams, exclusive_tax: ($('#exclusive_tax').is(':checked', true)) ? 'on' : 'off', - // PO receive bridge: set when this receiving was opened - // from a purchase order's Receive button. - source_po_id: PosnicPro.receivings._sourcePoId || undefined + itc_eligible: $('#receiving_itc_eligible').is(':checked'), + expected_date: $('#receiving_expected_date').val(), + invoice_total_declared: $('#receiving_invoice_total_declared').val(), + additional_charges: PosnicPro.receivings.collectCharges() }) }; PosnicPro.post(params, function (response) { if (response.type === 'success') { - // The PO link is single-use: the next receiving on this - // screen is its own document unless Receive is pressed - // again. - PosnicPro.receivings._sourcePoId = null; PosnicPro.receivings.clearReceivingForm(); PosnicPro.commonDate(); if (response.data.print === true) { @@ -1061,6 +1009,10 @@ PosnicPro.receivings = { receiving_payment_description: result.payment_description, receiving_payment_mode: result.payment_mode, receiving_receiving_status: result.receiving_status, + receiving_itc_eligible: result.itc_eligible, + receiving_expected_date: result.expected_date, + receiving_invoice_total_declared: result.invoice_total_declared, + receiving_additional_charges: result.additional_charges, receiving_image: result.image, receiving_exclusive_tax: result.exclusive_tax }; @@ -1093,7 +1045,7 @@ PosnicPro.receivings = { for (var i = 0; i < result.items_return.length; i++) { var date = result.items_return[i].returnArray['returnDate']; var timeStamp_value = parseInt(date.$date.$numberLong); - var timeZone = PosnicPro.local.get('timezone'); + var timeZone = PosnicPro.timeZone(); var DateFormat = moment(timeStamp_value).tz(timeZone).format('YYYY/MM/DD LT'); var updateDate = PosnicPro.convertDate(DateFormat); var head = '<thead><tr><td colspan="7"></td></tr><tr style="background:#e1e6f5;">' + @@ -1135,9 +1087,9 @@ PosnicPro.receivings = { app = app + '' + body + ''; }); var foot = '<tbody><tr>' + - '<td colspan="4"><span class="pull-right"><b>Sub Total</b></span></td><td colspan="2"><span class="pull-right"><b>' + currency + ' ' + priceValue.toFixed(2) + '</b></span></td></tr>' + - '<tr><td colspan="4"><span class="pull-right"><b>Tax Amount</b></span></td><td colspan="2"><span class="pull-right"><b>' + currency + ' ' + (total - priceValue).toFixed(2) + '</b></span></td>' + - '<tr><td colspan="4"><span class="pull-right"><b>Grand Total</b></span></td><td colspan="2"><span class="pull-right"><b>' + currency + ' ' + total.toFixed(2) + '</b></span></td>' + + '<td colspan="4"><span class="pull-right"><b><lang class="lang_sub_total">Sub Total</lang></b></span></td><td colspan="2"><span class="pull-right"><b>' + currency + ' ' + priceValue.toFixed(2) + '</b></span></td></tr>' + + '<tr><td colspan="4"><span class="pull-right"><b><lang class="lang_tax_amount">Tax Amount</lang></b></span></td><td colspan="2"><span class="pull-right"><b>' + currency + ' ' + (total - priceValue).toFixed(2) + '</b></span></td>' + + '<tr><td colspan="4"><span class="pull-right"><b><lang class="lang_grand_total">Grand Total</lang></b></span></td><td colspan="2"><span class="pull-right"><b>' + currency + ' ' + total.toFixed(2) + '</b></span></td>' + '</tr><tr><td colspan="6"></td></tr></tbody>'; app = app + '' + foot + ''; } @@ -1158,10 +1110,10 @@ PosnicPro.receivings = { if ($('#receiving_print tbody tr').find(':nth-child(8)').text() === '' || supplier_name === '') { if (supplier_name === '') { $("#receiving_add_supplier_name").focus(); - PosnicPro.alert('error', 'Enter a supplier name.'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_enter_a_supplier_name', 'Enter a supplier name.')); return false; } - PosnicPro.alert('warning', 'Add at least one item.'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_add_at_least_one_item', 'Add at least one item.')); $('#receiving_add_item_name').focus(); return false; } else { @@ -1246,7 +1198,11 @@ PosnicPro.receivings = { id: PosnicPro.receivings.receivingAddId, alternative_id: PosnicPro.receivings.receivingId, image: PosnicPro.receivings.imageParams, - exclusive_tax: ($('#exclusive_tax').is(':checked', true)) ? 'on' : 'off' + exclusive_tax: ($('#exclusive_tax').is(':checked', true)) ? 'on' : 'off', + itc_eligible: $('#receiving_itc_eligible').is(':checked'), + expected_date: $('#receiving_expected_date').val(), + invoice_total_declared: $('#receiving_invoice_total_declared').val(), + additional_charges: PosnicPro.receivings.collectCharges() }; if (PosnicPro.receivings.receivingReturnAction === 'return') { var $checkboxes = $('#receiving_print tr td input[type="checkbox"]'); @@ -1269,12 +1225,12 @@ PosnicPro.receivings = { PosnicPro.receivings.view.returnPrintReceivings(response.data.receiving_id); } loader.find(".loadingSpinner:first").remove(); - hasher.setHash('receivings'); + hasher.setHash('purchaseorders'); return false; } PosnicPro.stocklogs.viewLowStockDashboard(); loader.find(".loadingSpinner:first").remove(); - hasher.setHash('receivings'); + hasher.setHash('purchaseorders'); // $('#receiving_add_item_name').focus(); } else { loader.find(".loadingSpinner:first").remove(); @@ -1305,11 +1261,10 @@ PosnicPro.receivings = { $('#receiving_discount_amount').val(PosnicPro.local.get('setting-discount-amount')); $("#receiving_add_payment_mode").val('Cash'); $("#receiving_add_payment_description").val(''); - $(".receiving-status").prop("checked", false); - $("#Open").val("Open"); - $('#Open').prop("checked", true); - $('.open_status_active').addClass("active").siblings().removeClass("active"); - $('.open_status_active').addClass("active"); + $('#receiving_status_select option[value="Partial"]').remove(); + $('#receiving_status_select').prop('disabled', false).val('Open').trigger('change'); + $('#receiving_charges_rows').empty(); + $('#receiving_charges_row').hide(); $('#display-preview').html(''); $('#receiving_discount_amount,#receiving_total').val("0"); $('#receiving_add_total_amount,#receiving_add_subtotal_amount,.discount-receiving-value,.tax-receiving-value').text("0.00"); @@ -1322,7 +1277,7 @@ PosnicPro.receivings = { $('#receiviing_img_hide').show(); (PosnicPro.local.get('default_supplier_enable_disable') === 'false') ? $('#receiving_add_supplier_id,#receiving_add_supplier_name,#receiving_add_supplier_address,#receiving_add_supplier_phone,#receiving_add_supplier_email,#receiving_add_supplier_state,#receiving_add_supplier_gst_type,#receiving_add_supplier_gst_number').val('') : PosnicPro.defaultSupplierSet(); PosnicPro.receiving_lineitems = []; - PosnicPro.alert('success', 'Receiving cancelled.'); + PosnicPro.alert('success', PosnicPro.i18n.t('lang_receiving_cancelled', 'Receiving cancelled.')); $('#reset_modal').modal('hide'); }, receivingImageFormSubmit: function () { @@ -1358,7 +1313,7 @@ PosnicPro.receivings = { } } else { $('#receiving_add_item_name').focus(); - PosnicPro.alert('error', 'Add product'); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_add_product', 'Add product')); } return false; }, @@ -1406,7 +1361,7 @@ PosnicPro.receivings = { } if ($('#display-preview').find('div').length > 5) { - PosnicPro.alert('error', "Maximum 6 files are allowed"); + PosnicPro.alert('error', PosnicPro.i18n.t('lang_maximum_6_files_are_allowed', 'Maximum 6 files are allowed')); return false; } @@ -1452,27 +1407,96 @@ PosnicPro.receivings = { }; $(function () { - $('#receiving_add_supplier_name').on('keydown.autocomplete', function () { - $(this).autocomplete({ - lookup: function (query, done) { - var result = {}; + // One-time init like the sale search: never rebuild per keystroke. + /* + * OWNER STANDING RULE (2026-08-27): every master picker shows something + * the moment it is focused - frequently-used first (the recent_* lists + * the sale screen feeds), the latest 10 as the fallback, and typeahead + * narrows from there. Never an empty box waiting for typing. + */ + PosnicPro.receivings.supplierLookup = function (inputSel) { + return function (query, done) { + var q = String(query || '').trim(); + if (q) { var suggestions = []; - var params = { + PosnicPro.get({ url: 'suppliers/getSuppliersAjaxList', - data: 'query=' + query + '&branch=' + PosnicPro.local.get("branch_id_set") - }; - PosnicPro.get(params, function (response) { - if (response.suggestions.length > 0) { - suggestions: $.map(response.suggestions, function (dataItem) { - suggestions.push({"value": dataItem.name, "data": dataItem}); + data: 'query=' + encodeURIComponent(q) + '&branch=' + PosnicPro.local.get("branch_id_set") + }, function (response) { + if (response.suggestions && response.suggestions.length > 0) { + $.map(response.suggestions, function (dataItem) { + suggestions.push({ value: dataItem.name, data: dataItem }); }); } else { - suggestions.push({value: $('#receiving_add_supplier_name').val() + ' ', data: -1}); + suggestions.push({ value: $(inputSel).val() + ' ', data: -1 }); } - result["suggestions"] = suggestions; - done(result); + done({ suggestions: suggestions }); }); - }, + return; + } + /* + * Empty query = the on-focus list (owner's picker rule + the + * star idea): default first (tagged), then starred favourites, + * then recents, then the latest from the server to fill ten. + */ + var seen = {}; + var out = []; + var push = function (row, flags) { + if (!row || !row.id || seen[row.id] || out.length >= 10) { return; } + seen[row.id] = true; + out.push({ value: row.name, data: $.extend({}, row, flags || {}) }); + }; + var readList = function (key) { + try { return JSON.parse(PosnicPro.local.get(key) || '[]') || []; } catch (e) { return []; } + }; + /* Favourites were PUSHED BACK (owner, 2026-08-27): recency + self-maintains, stars rot. Default, then recents, then the + latest from the server. */ + var def = $(inputSel).data('prefilled-default'); + if (def && def.id) { + push({ id: def.id, name: def.name, phone: def.phone || '' }, { isDefault: true }); + } + readList('recent_suppliers').forEach(function (r) { push(r); }); + PosnicPro.get({ + url: 'suppliers/getSuppliersAjaxList', + data: 'query=&branch=' + PosnicPro.local.get("branch_id_set") + }, function (response) { + /* The on-focus list may resolve AFTER focus has moved on - + page entry focuses the field for a beat before the item + box takes over, and rendering then leaves an orphaned + dropdown floating over the form. Only speak while the + field is still listening. */ + if (!$(inputSel).is(':focus')) { done({ suggestions: [] }); return; } + (response.suggestions || []).forEach(function (d) { + push({ id: d.id, name: d.name, phone: d.phone, address: d.address, email: d.email, + state: d.state, gst_type: d.gst_type, gst_number: d.gst_number }); + }); + done({ suggestions: out }); + }, function () { + done({ suggestions: $(inputSel).is(':focus') ? out : [] }); + }); + }; + }; + /* Star rendering for the on-focus list; typed searches stay plain. */ + PosnicPro.receivings.supplierFormatResult = function (suggestion, currentValue) { + var esc = function (t) { return $('<i/>').text(t == null ? '' : t).html(); }; + var d = suggestion.data || {}; + if (d === -1 || !d.id) { + return '<div>' + $.Autocomplete.formatResult(suggestion, currentValue) + + '</div><span class="pull-right" style="margin-top:-20px;">( Add new )</span>'; + } + /* Favourites are made on the supplier LIST page, not here - the + dropdown stays a picker (standard §7). They still lead the + on-focus ordering. Phone keeps its long-standing place. */ + var tag = d.isDefault ? ' <span class="text-muted" style="font-size:11px;">(default)</span>' : ''; + var sub = d.phone ? ' <span class="text-muted" style="font-size:11px;">' + esc(d.phone) + '</span>' : ''; + return esc(suggestion.value) + tag + sub; + }; + $('#receiving_add_supplier_name').autocomplete({ + deferRequestBy: 120, + minChars: 0, + formatResult: PosnicPro.receivings.supplierFormatResult, + lookup: PosnicPro.receivings.supplierLookup('#receiving_add_supplier_name'), onSelect: function (suggestion) { if (suggestion.data !== -1) { $(".clear-supplier-error").find('.error').text("").removeClass('error'); @@ -1483,6 +1507,19 @@ $(function () { $('#receiving_add_supplier_state').val(suggestion.data.state); $('#receiving_add_supplier_gst_type').val(suggestion.data.gst_type); $('#receiving_add_supplier_gst_number').val(suggestion.data.gst_number); + /* Recency, the same way the sale screen records customers + and items. The shared filter bar offers a supplier picker + (core/list-filter.js, LF.ENTITIES.supplier) that reads + this list - without it that picker opens empty on every + till and looks broken. Written where the choice is made, + so every path that picks a supplier feeds it. */ + if (PosnicPro.sales && PosnicPro.sales._recentPush) { + PosnicPro.sales._recentPush('recent_suppliers', { + id: suggestion.data.id, + name: suggestion.value || suggestion.data.name, + phone: suggestion.data.phone + }, 'id'); + } // let hash = window.location.hash.slice(1); // if (hash === '/receivings/new') { // PosnicPro.receivings.clearReceivingForm(); @@ -1494,18 +1531,7 @@ $(function () { } }, autoSelectFirst: true, - triggerSelectOnValidInput: false, - formatResult: function (suggestion) { - var phone = suggestion.data.phone; - if (suggestion.data === -1 || typeof suggestion.phone === undefined) { - phone = "( Add new )"; - } - return '<div>' + - $.Autocomplete.formatResult(suggestion) + - '</div><span class="pull-right" style="margin-top:-20px;">' + phone + '</span>'; - } - - }); + triggerSelectOnValidInput: false }); }); $('#receiving_add_supplier_name').click(function () { @@ -1557,9 +1583,12 @@ $('#receiving_add_item_name').scannerDetection({ $(function () { var receivingLookupSeq = 0; $('#receiving_add_item_name').on('focus', function () { + // Guide, don't scold: the page auto-focuses this field on open + // (racing the default-supplier fill), so an empty supplier just + // moves the cursor to the supplier box - the submit path still + // enforces it with words when it actually matters. if ($('#receiving_add_supplier_name').val() === '') { $('#receiving_add_supplier_name').focus(); - PosnicPro.alert('error', 'Enter a supplier name.'); } }); $('#receiving_add_item_name').autocomplete({ @@ -1651,10 +1680,17 @@ $(function () { } }); }); -$(document).on('change', '.receiving-status', function () { - $('.receiving-status').val(this.id); +/* Expected-on only matters while the order is still out (status Ordered). */ +$(document).on('change', '#receiving_status_select', function () { + $('#receiving_expected_wrap').toggle($(this).val() === 'Open'); +}); +$(document).on('input', '#receiving_charges_rows .charge-amount, #receiving_charges_rows .charge-label', function () { + PosnicPro.receivings.addReceivingTableRowCalc(); +}); +$(document).on('click', '#receiving_charges_rows .charge-remove', function () { + $(this).closest('.charge-row').remove(); + PosnicPro.receivings.addReceivingTableRowCalc(); }); -$('#receiving_upload_image').customFile(); $(document).ready(function () { $('#receiving_print tbody').children("tr").remove(); $("#receiving_print").find("tr:not(:first)").remove(); @@ -1691,11 +1727,11 @@ $(document).ready(function () { messages: { receiving_add_date: { required: "This field is required", - date: "Please enter a valid date", + date: "Enter a valid date", maxlength: "Enter a valid date", }, receiving_add_supplier_name: { - required: "Please Enter a Supplier Name", + required: "Enter the supplier name", minlength: "Supplier Name Must be Atleast 3 Characters" }, @@ -1703,7 +1739,7 @@ $(document).ready(function () { }); jQuery.validator.addMethod("commonDate", function (value, element) { return this.optional(element) || moment(value, 'YYYY/MM/DD LT').isValid(); - }, "Please enter a valid date in the format"); + }, "Use the date format"); }); $("#receiving_add").submit(function (event) { event.preventDefault(); @@ -1734,11 +1770,11 @@ $('#exclusive_tax').click(function () { if (isChecked) { // When checked, restore the original tax percentage hiddenTaxElement.text(originalTaxPercentage); - visibleTaxElement.html(originalTaxPercentage + '<span>%</span>  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemTaxReceiving(this);" data-id="' + itemId + '" data-toggle="tooltip" title="Edit item tax" style="cursor:pointer;"></i></span>'); + visibleTaxElement.html(originalTaxPercentage + '<span>%</span>  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemTaxReceiving(this);" data-id="' + itemId + '" data-toggle="tooltip" title="Edit item tax" data-t-title="lang_edit_item_tax" style="cursor:pointer;"></i></span>'); } else { // When unchecked, set tax to 0 for calculation hiddenTaxElement.text(0); - visibleTaxElement.html('0<span>%</span>  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemTaxReceiving(this);" data-id="' + itemId + '" data-toggle="tooltip" title="Edit item tax" style="cursor:pointer;"></i></span>'); + visibleTaxElement.html('0<span>%</span>  <span class="receving-return-hide"><i class="feather icon-edit-1 text-success" onclick="return PosnicPro.receivings.editItemTaxReceiving(this);" data-id="' + itemId + '" data-toggle="tooltip" title="Edit item tax" data-t-title="lang_edit_item_tax" style="cursor:pointer;"></i></span>'); } // Recalculate this line item @@ -1755,59 +1791,596 @@ $('#exclusive_tax').click(function () { PosnicPro.purchaseorders = { _lines: {}, _detail: null, - showDataTablePage: function () { + /* The page chrome, shared by list entry and deep links: pane, title, + and the LEFT MENU highlight - which must also survive a refresh + (owner: "when refresh left side correct menu not highlighted"). */ + _chrome: function () { PosnicPro.HideSideBarModal(); $('.page_loader,#osk-container').hide(); + $('.nav-link-active,.tab-pane-active,.dropdown-item').removeClass('active'); + $('.vertical-menu li a').removeClass('active'); + $('#v-pills-purchase-tab').addClass('active'); + $('#v-pills-purchase').addClass('show active'); + $('#view_purchaseorders_page').addClass('active'); $('.page-title-box,#purchaseorders_new').show(); - $('#po_form_section,#po_view_section').hide(); + $('#po_form_section,#po_view_section,#po_receive_section').hide(); $('#po_list_section').show(); + }, + showDataTablePage: function () { + PosnicPro.purchaseorders._chrome(); + PosnicPro.purchaseorders.closeDoc(); PosnicPro.purchaseorders.loadList(1); }, showAdd: function () { PosnicPro.purchaseorders.showDataTablePage(); PosnicPro.purchaseorders.openForm(''); }, showEdit: function (id) { PosnicPro.purchaseorders.showDataTablePage(); PosnicPro.purchaseorders.openForm(id); }, - showDetails: function (id) { PosnicPro.purchaseorders.showDataTablePage(); PosnicPro.purchaseorders.openView(id); }, + /* + * #/purchaseorders/<id> - the document's own address, like a quote's + * (owner: "its not changing... as quote url system"). A refresh or a + * shared link lands on the OPEN document; the hash echo of a row click + * is recognised and ignored. + */ + showDetails: function (id) { + var self = PosnicPro.purchaseorders; + var key = self._openDocKey || ''; + if (key.slice(key.indexOf(':') + 1) === String(id) && $('#purchases_detail_card').is(':visible')) { + return; + } + self._chrome(); + self.loadList(1); + /* which kind lives at this id? a receiving answers; a PO does not */ + PosnicPro.get('receivings/' + id, function (r) { + if (r && r.type === 'success' && r.data) { self.openDoc('purchase', id); } + else { self.openDoc('po', id); } + }, function () { self.openDoc('po', id); }); + }, + /* + * ONE list for the whole purchases area (owner: "keep one"). Orders and + * received purchases, merged newest-first. Orders open their document; + * purchases open the receiving view. Paging is a growing window over + * both sources - simple, honest, and gone entirely when the + * master-detail surface replaces this page. + */ + _page: 1, + PAGE_SIZE: 25, + _lastRows: [], + _openDocKey: null, + _status: '', + _expected: '', + mountPurchaseFilters: function (force) { + if (!$('#purchases_filter_panel').length) { return; } + if (!force && $('#purchases_filter_panel').data('mounted')) { return; } + $('#purchases_filter_panel').data('mounted', true); + PosnicPro.listFilter.mount({ + key: 'receivings', + container: '#purchases_filter_panel', + button: '#purchases_filter_btn', + searchPlaceholder: PosnicPro.i18n.t('lang_search_purchase_no_supplier_or_phone', 'Search purchase no, supplier or phone'), + dateField: PosnicPro.i18n.t('lang_bill_date', 'Bill date'), + searchFields: [ + { value: 'all', label: PosnicPro.i18n.t('lang_all_fields', 'All fields') }, + { value: 'receiving_id', label: PosnicPro.i18n.t('lang_purchase_no', 'Purchase no') }, + { value: 'supplier_name', label: PosnicPro.i18n.t('lang_newsupplier_title', 'Supplier') }, + { value: 'supplier_phone', label: PosnicPro.i18n.t('lang_phone_title', 'Phone') } + ], + typeahead: 'supplier', + typeaheadField: 'supplier_name', + onChange: function () { PosnicPro.purchaseorders.loadList(1); } + }); + }, + exportCsv: function () { + var rows = [['No', 'Kind', 'Bill date', 'Created', 'Supplier', 'Status', 'Expected', 'Total']]; + (PosnicPro.purchaseorders._lastRows || []).forEach(function (r) { + rows.push([r.no, r.kind === 'po' ? 'order' : 'purchase', + r.date ? new Date(r.date).toISOString().slice(0, 10) : '', + r.created ? new Date(r.created).toISOString().slice(0, 10) : '', + r.supplier, r.status, r.expected || '', r.total]); + }); + var csv = rows.map(function (r) { + return r.map(function (c) { return '"' + String(c == null ? '' : c).replace(/"/g, '""') + '"'; }).join(','); + }).join('\n'); + var blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' }); + var a = document.createElement('a'); + a.href = URL.createObjectURL(blob); + a.download = 'purchases.csv'; + a.click(); + URL.revokeObjectURL(a.href); + }, + STATUS_PILL: { ordered: 'hold', partial: 'hold', draft: 'hold', received: 'paid', closed: 'paid', cancelled: 'unpaid' }, + STATUS_LABEL: { ordered: 'Ordered', partial: 'Partially received', draft: 'Draft', received: 'Received', closed: 'Received', cancelled: 'Cancelled' }, + /* + * ONE list over two sources (orders + received purchases), merged + * newest-first, with real page numbers (owner: "pagination is + * important"). Each source is asked for the whole window up to the + * current page (capped at 100 a side), so the merged slice for page N + * is exact; past 2x100 rows the pager stops honestly and the archive + * link carries the deep history. + */ loadList: function (page) { - var status = $('#po_filter_status').val() || ''; - PosnicPro.get({ - url: 'purchaseOrders', - data: 'page=' + (page || 1) + '&limit=10' + (status ? '&status=' + encodeURIComponent(status) : '') - }, function (response) { - var d = (response && response.data) || {}; - var rows = d.list || []; - if (!rows.length) { - $('#po_list_rows').html('<tr><td colspan="8" class="text-center text-muted">No purchase orders yet.</td></tr>'); + PosnicPro.purchaseorders.mountPurchaseFilters(); + PosnicPro.listSort.mount('purchases', { + options: [ + { v: 'date_asc', l: PosnicPro.i18n.t('lang_bill_date_oldest', 'Bill date: oldest'), i: 'rotate-ccw' }, + { v: 'total_desc', l: PosnicPro.i18n.t('lang_highest_amount_first', 'Highest amount first'), i: 'arrow-down' }, + { v: 'total_asc', l: PosnicPro.i18n.t('lang_lowest_amount_first', 'Lowest amount first'), i: 'arrow-up' }, + { v: 'expected_asc', l: PosnicPro.i18n.t('lang_expected_soonest', 'Expected: soonest'), i: 'truck' }, + { v: 'supplier', l: PosnicPro.i18n.t('lang_supplier_a_to_z', 'Supplier A to Z'), i: 'type' } + ], + onChange: function () { PosnicPro.purchaseorders.loadList(1); } + }); + var self = PosnicPro.purchaseorders; + if (page) { self._page = page; } + var p = self._page; + var size = self.PAGE_SIZE; + var fetchLimit = Math.min(p * size + 1, 100); + /* An active sort must rank the whole honest window, not just the + newest page-load - otherwise "highest amount first" only ranks + the latest handful. Same 2x100 cap the pager already owns. */ + if (PosnicPro.listSort.value('purchases')) { fetchLimit = 100; } + var filters = PosnicPro.listFilter.legacyFilters('receivings', { dateKey: 'date' }); + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var done = { po: null, rec: null }; + var totals = { po: 0, rec: 0 }; + var render = function () { + if (done.po === null || done.rec === null) { return; } + var rows = done.po.concat(done.rec); + var ts = function (v) { var t = new Date(v || 0).getTime(); return isNaN(t) ? 0 : t; }; + /* Same bill date is the NORMAL case (today's purchases) - the + tie breaks on created time so the newest entry leads. The list + is a client-side merge of two doors, so Sort is client-side + too - no server round trip, the whole set is already here. */ + var num = function (v) { return Number(v) || 0; }; + var CMP = { + date_asc: function (a, b) { return ts(a.date) - ts(b.date) || ts(a.created) - ts(b.created); }, + total_desc: function (a, b) { return num(b.total) - num(a.total); }, + total_asc: function (a, b) { return num(a.total) - num(b.total); }, + /* No expected date sinks to the bottom, not to "due first". */ + expected_asc: function (a, b) { return (ts(a.expected) || Infinity) - (ts(b.expected) || Infinity); }, + supplier: function (a, b) { return String(a.supplier || '').localeCompare(String(b.supplier || '')); } + }; + rows.sort(CMP[PosnicPro.listSort.value('purchases')] + || function (a, b) { return ts(b.date) - ts(a.date) || ts(b.created) - ts(a.created); }); + self._lastRows = rows; + var chip = self._status; + var filtered = !chip ? rows : rows.filter(function (r) { + if (chip === 'ordered') { return r.status === 'ordered' || r.status === 'draft'; } + if (chip === 'received') { return r.status === 'received' || r.status === 'closed'; } + return r.status === chip; + }); + /* Expected-date quick chips (owner): due today, tomorrow, or in + the coming seven days. Calendar days, local time. */ + var expChip = self._expected; + if (expChip) { + var today = new Date(); today.setHours(0, 0, 0, 0); + filtered = filtered.filter(function (r) { + if (!r.expected) { return false; } + var due = new Date(r.expected); + if (isNaN(due.getTime())) { return false; } + due.setHours(0, 0, 0, 0); + var days = Math.round((due - today) / 86400000); + if (expChip === 'today') { return days === 0; } + if (expChip === 'tomorrow') { return days === 1; } + return days >= 0 && days <= 6; + }); + } + if (p > 1 && !filtered.slice((p - 1) * size).length) { self._page = 1; p = 1; } + var pageRows = filtered.slice((p - 1) * size, p * size); + if (!pageRows.length) { + var isFiltered = !!chip || !!expChip || PosnicPro.listFilter.activeCount('receivings') > 0; + $('#po_list_rows').html('<div class="text-center text-muted p-t-20 p-b-20">' + + (isFiltered ? PosnicPro.i18n.t('lang_no_purchases_match_this_filter', 'No purchases match this filter.') : PosnicPro.i18n.t('lang_no_purchases_yet_press_new_purchase_to_rec', 'No purchases yet - press New Purchase to record the first.')) + '</div>'); $('#po_list_paging').html(''); return; } - var currency = PosnicPro.local.get('currencySign'); - var html = rows.map(function (po, i) { - var pct = po.ordered_qty > 0 ? Math.min(100, Math.round(po.received_qty * 100 / po.ordered_qty)) : 0; - var progress = '<div class="progress" style="height:6px;"><div class="progress-bar" style="width:' + pct + '%;"></div></div>' + - '<small class="text-muted">' + po.received_qty + ' of ' + po.ordered_qty + '</small>'; - var expected = po.expected_date ? String(po.expected_date).slice(0, 10) : '-'; - return '<tr class="point-cursor po-list-row" data-id="' + po.id + '">' + - '<td>' + ((d.current_page - 1) * d.per_page + i + 1) + '</td>' + - '<td>' + po.po_id + '</td>' + - '<td>' + String(po.order_date).slice(0, 10) + '</td>' + - '<td>' + $('<span>').text(po.supplier_name).html() + '</td>' + - '<td class="text-center"><span class="badge badge-primary-inverse">' + po.status + '</span></td>' + - '<td>' + progress + '</td>' + - '<td>' + expected + '</td>' + - '<td class="text-right">' + currency + ' ' + (Number(po.grand_total) || 0).toFixed(2) + '</td>' + - '</tr>'; - }).join(''); + var d = function (v) { return v ? new Date(v).toLocaleDateString('en-IN') : '-'; }; + var P = self.STATUS_PILL, L = self.STATUS_LABEL; + var html = '<div class="table-responsive"><table class="table table-borderless">' + + '<thead><tr>' + + '<th class="p-col-num"><lang class="lang_purchase_2">Purchase #</lang></th><th><lang class="lang_newsupplier_title">Supplier</lang></th><th class="p-col-date"><lang class="lang_date_title">Date</lang></th><th class="p-col-created"><lang class="lang_created">Created</lang></th>' + + '<th class="p-col-expected"><lang class="lang_expected">Expected</lang></th><th class="text-right"><lang class="lang_total_title">Total</lang></th><th class="text-center"><lang class="lang_userstatus">Status</lang></th>' + + '</tr></thead><tbody>'; + pageRows.forEach(function (r) { + var key = r.kind + ':' + r.id; + var badges = ''; + if (r.mismatch) { badges += ' <i class="feather icon-alert-triangle text-warning" title="Invoice total mismatch" data-t-title="lang_invoice_total_mismatch"></i>'; } + if (r.hasDoc) { badges += ' <i class="feather icon-paperclip text-muted"></i>'; } + var pill = '<span class="rs-pill ' + (P[r.status] || 'hold') + '">' + (L[r.status] || esc(r.status)) + '</span>'; + html += '<tr class="md-row purchases-row highlight-select' + (self._openDocKey === key ? ' is-active' : '') + '"' + + ' data-kind="' + r.kind + '" data-id="' + esc(r.id) + '" style="cursor:pointer;">' + + '<td class="p-col-num">' + esc(r.no) + badges + '</td>' + + '<td>' + esc(r.supplier) + (r.progress ? ' <span class="text-muted p-col-progress">' + esc(r.progress) + '</span>' : '') + '</td>' + + '<td class="p-col-date">' + d(r.date) + '</td>' + + '<td class="p-col-created">' + d(r.created) + '</td>' + + '<td class="p-col-expected">' + (r.expected ? d(r.expected) : '-') + '</td>' + + '<td class="text-right">' + PosnicPro.local.get('currencySign') + ' ' + (Number(r.total) || 0).toFixed(2) + '</td>' + + '<td class="text-center">' + pill + '</td>' + + '</tr>'; + }); + html += '</tbody></table></div>'; $('#po_list_rows').html(html); - var paging = ''; - for (var p = 1; p <= (d.total_pages || 1); p++) { - paging += '<a href="javascript:void(0)" class="btn btn-sm ' + (p === d.current_page ? 'btn-primary-rgba' : '') + '" onclick="PosnicPro.purchaseorders.loadList(' + p + ');">' + p + '</a> '; + self.renderPager(filtered.length, chip || expChip ? null : totals.po + totals.rec); + }; + PosnicPro.get({ url: 'purchaseOrders', data: 'page=1&limit=' + fetchLimit }, function (response) { + var data = (response && response.data) || {}; + totals.po = Number(data.total) || 0; + done.po = (data.list || []).map(function (po) { + return { + kind: 'po', id: po.id, no: po.po_id, + date: String(po.order_date || ''), + created: po.created_date || po.order_date || '', + supplier: po.supplier_name, status: po.status, + progress: po.ordered_qty > 0 ? (po.received_qty + '/' + po.ordered_qty) : '', + expected: po.expected_date || '', + total: po.grand_total + }; + }); + render(); + }, function () { done.po = []; render(); }); + PosnicPro.get({ url: 'receivings', data: { page: 1, limit: fetchLimit, filters: JSON.stringify(filters) } }, function (response) { + var data = (response && response.data) || {}; + totals.rec = Number(data.total) || 0; + done.rec = (data.list || []).map(function (r) { + return { + kind: 'purchase', id: r._id, no: r.receiving_id, + date: String(r.date || r.updated_date || ''), + created: r.created_date || '', + supplier: r.supplier_name, + status: r.receiving_status === 'Open' ? 'ordered' + : r.receiving_status === 'Received' ? 'received' + : String(r.receiving_status || '').toLowerCase(), + progress: '', + expected: r.expected_date || '', + total: r.total_amount, + mismatch: r.invoice_total_mismatch === true, + hasDoc: !!(r.image && r.image.length) + }; + }); + render(); + }, function () { done.rec = []; render(); }); + }, + /* + * Pager per LIST_PAGE_UX_STANDARD §3: numbered window when the total is + * known, arrows always, count that never lies. A chip filters + * client-side so its total is unknown - the pager falls back to the + * range on screen, exactly like the quotes search path. + */ + renderPager: function (reach, total) { + var self = PosnicPro.purchaseorders; + var p = self._page, size = self.PAGE_SIZE; + var hasMore = reach > p * size; + var pages = null; + var label; + if (total !== null && total !== undefined) { + pages = Math.ceil(total / size) || 1; + label = total + ' ' + (total === 1 ? PosnicPro.i18n.t('lang_purchase_4', 'purchase') : PosnicPro.i18n.t('lang_purchases', 'purchases')); + if (pages > 1) { label = 'Page ' + p + ' of ' + pages + ' \u00b7 ' + label; } + } else { + var first = (p - 1) * size + 1; + var last = Math.min(reach, p * size); + label = reach ? 'Showing ' + first + '\u2013' + last : 'No matches'; + } + var btn = function (to, text, off, cls) { + return '<button type="button" class="btn btn-sm ' + (cls || 'btn-secondary-rgba') + ' q-pg-btn"' + (off ? ' disabled' : '') + + ' onclick="PosnicPro.purchaseorders.goPage(' + to + ');">' + text + '</button>'; + }; + var html = ''; + var showArrows = p > 1 || hasMore || (pages && pages > 1); + if (showArrows) { html += btn(p - 1, '«', p <= 1); } + if (pages && pages > 1) { + var reachablePages = Math.max(1, Math.ceil(Math.min(total, 200) / size)); + var shown = Math.min(pages, reachablePages); + var pgEnd = Math.min(shown, Math.max(1, p - 2) + 4); + var pgStart = Math.max(1, pgEnd - 4); + for (var n = pgStart; n <= pgEnd; n++) { + html += '<span class="q-pg-num">' + btn(n, n, false, n === p ? 'btn-primary-rgba' : 'btn-secondary-rgba') + '</span>'; } - $('#po_list_paging').html((d.total_pages || 1) > 1 ? paging : ''); - }, function () { - $('#po_list_rows').html('<tr><td colspan="8" class="text-center text-danger">Could not load purchase orders.</td></tr>'); + } + html += '<span class="q-pg-count">' + label + '</span>'; + if (showArrows) { html += btn(p + 1, '»', !hasMore); } + $('#po_list_paging').html(html); + }, + goPage: function (n) { + if (!n || n < 1) { return; } + PosnicPro.purchaseorders._page = n; + PosnicPro.purchaseorders.loadList(); + }, + /* ---- opening a document IS entering the split (standard §4) ---- */ + openDoc: function (kind, id) { + var self = PosnicPro.purchaseorders; + if (!PosnicPro.masterDetail.inSplit('#purchases_split', 'purchases-split')) { + PosnicPro.masterDetail.enter('#purchases_split', 'purchases-split'); + $('#purchases_detail_card').show(); + } + self._openDocKey = kind + ':' + id; + $('#po_list_rows tr.purchases-row').removeClass('is-active'); + $('#po_list_rows tr.purchases-row[data-id="' + id + '"]').addClass('is-active'); + /* the document's address, like a quote's - showDetails recognises + the echo of this setHash and does nothing */ + if (window.location.hash.slice(2) !== 'purchaseorders/' + id) { + hasher.setHash('purchaseorders/' + id); + } + if (kind === 'po') { + $('#purchases_doc').hide(); + $('#purchases_po_host').show(); + if (!$('#po_view_section').length || !$.contains($('#purchases_po_host')[0], $('#po_view_section')[0])) { + $('#po_view_section').appendTo('#purchases_po_host'); + } + PosnicPro.purchaseorders.openView(id); + $('#po_view_section').show(); + return; + } + $('#purchases_po_host').hide(); + $('#purchases_doc').show().html('<div class="text-center text-muted" style="padding:60px;"><lang class="lang_loading_4">Loading ...</lang></div>'); + PosnicPro.get('receivings/' + id, function (response) { + if (response.type !== 'success') { $('#purchases_doc').html('<div class="text-danger p-4"><lang class="lang_could_not_open_this_purchase">Could not open this purchase.</lang></div>'); return; } + PosnicPro.purchaseorders.renderPurchaseDoc(response.data); + PosnicPro.ACLForModule('receiving'); + }, function () { $('#purchases_doc').html('<div class="text-danger p-4"><lang class="lang_could_not_open_this_purchase">Could not open this purchase.</lang></div>'); }); + }, + closeDoc: function () { + PosnicPro.purchaseorders._openDocKey = null; + $('#purchases_detail_card').hide(); + $('#po_list_rows tr.purchases-row').removeClass('is-active'); + PosnicPro.masterDetail.leave('#purchases_split', 'purchases-split'); + if (window.location.hash.slice(2).indexOf('purchaseorders/') === 0) { + hasher.setHash('purchaseorders'); + } + }, + /* + * The document pane, paper-styled (standard §4): pull first, title and + * pills, grouped actions right (one primary, Edit, More, close last). + * Soft hairlines and muted labels - the theme's font does the talking. + */ + /* + * The document is the quote's A4 sheet (owner: "show similar as quote. + * like full box and neatly aligned professional like A4 document") - + * same q-sheet vocabulary, same CSS, so the two documents age together. + * Toolbar above the paper; the void strip asks its reason inline. + */ + /* + * The A4 sheet alone - shared with every pane that previews a purchase + * (the supplier profile embeds it, so reading a supplier's history + * never means leaving the page and hunting for the back button). + */ + buildPurchaseSheet: function (d) { + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var money = function (v) { return PosnicPro.local.get('currencySign') + ' ' + (Number(v) || 0).toFixed(2); }; + var dt = function (v) { return v ? new Date(v).toLocaleDateString('en-IN') : '-'; }; + var real = function (v) { return v && v !== 'null' && v !== 'undefined' ? v : ''; }; + var open = d.receiving_status === 'Open'; + var cancelled = d.receiving_status === 'Cancelled'; + var partial = d.receiving_status === 'Partial'; + var L = PosnicPro.purchaseorders.STATUS_LABEL; + var st = cancelled ? 'cancelled' : partial ? 'partial' : open ? 'ordered' : 'received'; + var logo = PosnicPro.local.get('branchimage'); + var taxLabel = PosnicPro.local.get('gst_action') === 'enable' ? PosnicPro.i18n.t('lang_gstin', 'GSTIN') : PosnicPro.i18n.t('lang_tax_id', 'Tax ID'); + var seller = '<div class="q-seller">' + + (logo && logo !== 'store.png' ? '<img loading="lazy" decoding="async" class="q-logo" src="' + esc(logo) + '" alt="">' : '') + + '<div class="q-shop">' + esc(PosnicPro.local.get('branchname') || '') + '</div>'; + var addr = real(PosnicPro.local.get('branchaddress')); + var ph = real(PosnicPro.local.get('branchphone')); + var em = real(PosnicPro.local.get('branchemail')); + var gst = real(PosnicPro.local.get('branchgstin')); + if (addr) { seller += '<div class="q-muted">' + esc(addr) + '</div>'; } + if (ph || em) { seller += '<div class="q-muted">' + esc(ph) + (ph && em ? ' · ' : '') + esc(em) + '</div>'; } + if (gst) { seller += '<div class="q-muted">' + taxLabel + ': ' + esc(gst) + '</div>'; } + seller += '</div>'; + var title = '<div class="q-title-block">' + + '<div class="q-doc-title"><lang class="lang_purchase_3">PURCHASE</lang></div>' + + '<div class="q-num">' + esc(d.receiving_id) + '</div>' + + '<div class="q-muted">Bill date: ' + dt(d.date) + '</div>' + + (d.expected_date ? '<div class="q-muted">Expected: ' + dt(d.expected_date) + '</div>' : '') + + '<div class="q-status">' + L[st].toUpperCase() + '</div>' + + '</div>'; + var supplier = '<div class="q-billto"><div class="q-label"><lang class="lang_newsupplier_title">Supplier</lang></div>' + + '<div class="q-cust">' + esc(d.supplier_name || '-') + '</div>' + + (real(d.supplier_address) ? '<div class="q-muted">' + esc(d.supplier_address) + '</div>' : '') + + '<div class="q-muted">' + + (real(d.supplier_phone) ? 'Phone: ' + esc(d.supplier_phone) : '') + + (real(d.supplier_phone) && real(d.supplier_gst_number) ? ' · ' : '') + + (real(d.supplier_gst_number) ? taxLabel + ': ' + esc(d.supplier_gst_number) : '') + + '</div>' + + (real(d.supplier_email) ? '<div class="q-muted">Email: ' + esc(d.supplier_email) + '</div>' : '') + + '</div>'; + var items = '<div class="table-responsive"><table class="q-items"><thead><tr>' + + '<th>#</th><th><lang class="lang_newitem_title">Item</lang></th><th class="text-right"><lang class="lang_qty_title">Qty</lang></th>' + + '<th class="text-right"><lang class="lang_unit_cost">Unit cost</lang></th><th class="text-right"><lang class="lang_module_tax">Tax</lang></th><th class="text-right"><lang class="lang_amount_title">Amount</lang></th>' + + '</tr></thead><tbody>'; + (d.items || []).forEach(function (l, i) { + var tax = (Number(l.igst_tax) || 0) + (Number(l.cgst_tax) || 0) + (Number(l.sgst_tax) || 0); + var got = l.qty_received !== undefined && l.qty_received !== null ? parseFloat(l.qty_received) : null; + var qtyCell = got !== null && got < (parseFloat(l.item_quantity) || 0) + ? got + ' / ' + esc(l.item_quantity) + : esc(l.item_quantity); + items += '<tr><td>' + (i + 1) + '</td><td>' + esc(l.item_name) + '</td>' + + '<td class="text-right"' + (got !== null && got < (parseFloat(l.item_quantity) || 0) ? ' title="Received so far / ordered" data-t-title="lang_received_so_far_ordered"' : '') + '>' + qtyCell + ' ' + esc(l.item_unit || '') + '</td>' + + '<td class="text-right">' + money(l.item_price) + '</td>' + + '<td class="text-right">' + money(tax) + '</td>' + + '<td class="text-right">' + money(l.total_amount) + '</td></tr>'; + }); + items += '</tbody><tfoot>' + + '<tr class="q-sub"><td colspan="5" class="text-right"><lang class="lang_subtotal">Subtotal</lang></td>' + + '<td class="text-right">' + money(d.subtotal_amount) + '</td></tr>' + + (Number(d.tax) > 0 + ? '<tr class="q-sub"><td colspan="5" class="text-right"><lang class="lang_module_tax">Tax</lang></td><td class="text-right">' + money(d.tax) + '</td></tr>' + : '') + + (d.additional_charges || []).map(function (c) { + return '<tr class="q-sub"><td colspan="5" class="text-right">' + esc(c.label || 'Charge') + + '</td><td class="text-right">' + money(c.amount) + '</td></tr>'; + }).join('') + + (d.invoice_total_declared + ? '<tr class="q-sub"><td colspan="5" class="text-right">Supplier\u2019s invoice states' + + (d.invoice_total_mismatch ? ' <i class="feather icon-alert-triangle text-warning"></i>' : '') + + '</td><td class="text-right">' + money(d.invoice_total_declared) + '</td></tr>' + : '') + + '<tr class="q-grand"><th colspan="5" class="text-right"><lang class="lang_total">TOTAL</lang></th>' + + '<th class="text-right">' + money(d.total_amount) + '</th></tr>' + + '</tfoot></table></div>'; + var footer = '<div class="q-footer">'; + footer += '<div class="q-block"><div class="q-label"><lang class="lang_payment_details_2">Payment details</lang></div>' + + '<div>' + esc(d.payment_mode || '-') + '</div>' + + (real(d.payment_description) ? '<div class="q-muted">' + esc(d.payment_description) + '</div>' : '') + + '</div>'; + if (d.image && d.image.length) { + footer += '<div class="q-block"><div class="q-label"><lang class="lang_po_attachments">Attachments</lang></div>'; + d.image.forEach(function (f) { + footer += '<div><a href="' + esc(f.name) + '" target="_blank" rel="noopener"><i class="feather icon-paperclip mr-1"></i>' + esc(String(f.name).split('/').pop()) + '</a></div>'; + }); + footer += '</div>'; + } + if (cancelled && d.void_reason) { + footer += '<div class="q-block"><div class="q-label"><lang class="lang_voided">Voided</lang></div>' + + '<div class="q-muted">By ' + esc(d.voided_by || '?') + + (d.voided_at ? ' on ' + dt(d.voided_at) : '') + '</div>' + + '<div>' + esc(d.void_reason) + '</div></div>'; + } + footer += '</div>'; + return '<div class="q-sheet">' + + '<div class="q-head">' + seller + title + '</div>' + + supplier + items + footer + + '</div>'; + }, + renderPurchaseDoc: function (d) { + PosnicPro.purchaseorders._doc = d; + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var money = function (v) { return PosnicPro.local.get('currencySign') + ' ' + (Number(v) || 0).toFixed(2); }; + var dt = function (v) { return v ? new Date(v).toLocaleDateString('en-IN') : '-'; }; + var real = function (v) { return v && v !== 'null' && v !== 'undefined' ? v : ''; }; + var open = d.receiving_status === 'Open'; + var cancelled = d.receiving_status === 'Cancelled'; + var P = PosnicPro.purchaseorders.STATUS_PILL, L = PosnicPro.purchaseorders.STATUS_LABEL; + var partial = d.receiving_status === 'Partial'; + var st = cancelled ? 'cancelled' : partial ? 'partial' : open ? 'ordered' : 'received'; + var chip = '<span class="rs-pill ' + P[st] + '">' + L[st] + '</span>'; + var itc = d.itc_eligible === false + ? '<span class="rs-pill unpaid" title="No input credit on this purchase" data-t-title="lang_no_input_credit_on_this_purchase"><lang class="lang_no_credit">No credit</lang></span>' : ''; + var mismatch = d.invoice_total_mismatch + ? '<span class="rs-pill hold" title="Declared invoice total does not match the lines" data-t-title="lang_declared_invoice_total_does_not_match_the"><i class="feather icon-alert-triangle"></i> Mismatch</span>' : ''; + var more = '<div class="btn-group">' + + '<button type="button" class="btn btn-sm btn-light dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"><lang class="lang_tab_more">More</lang></button>' + + '<div class="dropdown-menu dropdown-menu-right">' + + '<a class="dropdown-item" href="javascript:void(0)" onclick="PosnicPro.receivings.showPrint(\'' + esc(d._id) + '\'); return false;"><i class="feather icon-printer mr-2"></i>Print</a>' + + '<a class="dropdown-item" href="javascript:void(0)" onclick="PosnicPro.receivings.view.receivingPdf(\'' + esc(d._id) + '\');"><i class="feather icon-file mr-2"></i>Download PDF</a>' + + '<a class="dropdown-item" href="javascript:void(0)" onclick="PosnicPro.receivings.view.emailToSupplier(\'' + esc(d._id) + '\');"><i class="feather icon-mail mr-2"></i>Email supplier</a>' + + (!open && !cancelled + ? '<a class="dropdown-item" data-module="receiving" data-access="write" href="javascript:void(0)" onclick="hasher.setHash(\'receivings/' + esc(d._id) + '/return\');"><i class="feather icon-corner-up-left mr-2"></i>Return items</a>' + : '') + + (!cancelled + ? '<div class="dropdown-divider"></div>' + + '<a class="dropdown-item text-danger" data-module="receiving" data-access="delete" href="javascript:void(0)" onclick="PosnicPro.purchaseorders.voidPurchase(\'' + esc(d._id) + '\',\'' + esc(d.receiving_id) + '\');"><i class="feather icon-slash mr-2"></i>Void</a>' + : '') + + '</div></div>'; + var toolbar = '<div class="p-doc-toolbar">' + + '<button type="button" class="btn btn-sm btn-light" title="Show or hide the list" data-t-title="lang_show_or_hide_the_list" aria-label="Show or hide the list" data-t-aria-label="lang_show_or_hide_the_list" onclick="PosnicPro.masterDetail.toggleRail(\'#purchases_split\');"><i class="feather icon-sidebar"></i></button>' + + '<span class="p-doc-title">' + esc(d.receiving_id) + '</span>' + chip + itc + mismatch + + '<span class="ml-auto"></span>' + + ((open || partial) && !cancelled + ? '<div class="btn-group">' + + '<button type="button" class="btn btn-sm btn-primary dropdown-toggle" data-module="receiving" data-access="write" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"><i class="feather icon-check mr-1"></i>Receive</button>' + + '<div class="dropdown-menu">' + + '<a class="dropdown-item" href="javascript:void(0)" onclick="PosnicPro.purchaseorders.receiveAll(\'' + esc(d._id) + '\');">Received all</a>' + + '<a class="dropdown-item" href="javascript:void(0)" onclick="PosnicPro.purchaseorders.receiveStripOpen(\'' + esc(d._id) + '\');">Partially \u2026</a>' + + (partial + ? '<div class="dropdown-divider"></div><a class="dropdown-item text-danger" href="javascript:void(0)" onclick="PosnicPro.purchaseorders.closeShortOpen(\'' + esc(d._id) + '\');">Cancel remaining</a>' + : '') + + '</div></div>' + : '') + + (!cancelled ? '<button type="button" class="btn btn-sm btn-light" data-module="receiving" data-access="write" onclick="hasher.setHash(\'receivings/' + esc(d._id) + '/edit\');"><i class="feather icon-edit-2 mr-1"></i>Edit</button>' : '') + + more + + '<button type="button" class="btn btn-sm btn-light" title="Close this purchase and show the full list" data-t-title="lang_close_this_purchase_and_show_the_full_list" aria-label="Close" data-t-aria-label="lang_close_title" onclick="PosnicPro.purchaseorders.closeDoc();"><i class="feather icon-x"></i></button>' + + '</div>'; + var voidStrip = '<div class="p-void-strip" id="p_void_strip" style="display:none;">' + + '<span>Void <b>' + esc(d.receiving_id) + '</b> \u2014 stock reverses, the record stays, the tax leaves the input credit.</span>' + + '<input type="text" class="form-control form-control-sm" id="p_void_reason" maxlength="200" placeholder="Reason (required)" data-t-placeholder="lang_reason_required" aria-label="Void reason" data-t-aria-label="lang_void_reason">' + + '<button type="button" class="btn btn-sm btn-danger" onclick="PosnicPro.purchaseorders.voidConfirm(\'' + esc(d._id) + '\');">Void purchase</button>' + + '<button type="button" class="btn btn-sm btn-light" onclick="$(\'#p_void_strip\').slideUp(120);">Cancel</button>' + + '</div>'; + var sheet = PosnicPro.purchaseorders.buildPurchaseSheet(d); + var receiveStrip = '<div class="p-receive-strip" id="p_receive_strip" style="display:none;"></div>'; + $('#purchases_doc').html(toolbar + voidStrip + receiveStrip + '<div class="doc-scroll">' + sheet + '</div>'); + }, + /* Void asks its reason inline, in the pane - no native prompt. */ + /* ---- Partial receiving (owner: "received 5 items but remaining will + receive later") - all, entered per line, or cancel the rest ---- */ + receiveAll: function (id) { + PosnicPro.purchaseorders._postReceive(id, { all: true }); + }, + receiveStripOpen: function (id) { + var d = PosnicPro.purchaseorders._doc || {}; + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + var rows = ''; + (d.items || []).forEach(function (l, i) { + var ordered = parseFloat(l.item_quantity) || 0; + var got = l.qty_received !== undefined && l.qty_received !== null ? (parseFloat(l.qty_received) || 0) : 0; + var remaining = Math.max(0, ordered - got); + if (remaining <= 0) { return; } + rows += '<div class="p-rcv-row" data-item="' + esc(l.item_id) + '">' + + '<span class="p-rcv-name">' + esc(l.item_name) + '</span>' + + '<span class="p-rcv-progress">' + got + ' of ' + ordered + ' ' + esc(l.item_unit || '') + '</span>' + + '<input type="number" class="form-control form-control-sm p-rcv-qty" min="0" max="' + remaining + '" step="any" value="' + remaining + '" aria-label="Quantity arriving now" data-t-aria-label="lang_quantity_arriving_now">' + + '</div>'; + }); + if (!rows) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_nothing_left_to_receive', 'Nothing left to receive.')); return; } + $('#p_receive_strip').html( + '<div class="p-rcv-head">Receiving now \u2014 adjust what actually arrived:</div>' + + rows + + '<div class="p-rcv-actions">' + + '<button type="button" class="btn btn-sm btn-primary" onclick="PosnicPro.purchaseorders.receiveConfirm(\'' + esc(d._id) + '\');">Receive these quantities</button>' + + '<button type="button" class="btn btn-sm btn-light" onclick="$(\'#p_receive_strip\').slideUp(120);">Cancel</button>' + + '</div>' + ).slideDown(120); + }, + receiveConfirm: function (id) { + var lines = $('#p_receive_strip .p-rcv-row').map(function () { + return { + item_id: $(this).data('item'), + qty: parseFloat($(this).find('.p-rcv-qty').val()) || 0 + }; + }).get().filter(function (l) { return l.qty > 0; }); + if (!lines.length) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_enter_a_quantity_for_at_least_one_line', 'Enter a quantity for at least one line.')); return; } + PosnicPro.purchaseorders._postReceive(id, { lines: lines }); + }, + closeShortOpen: function (id) { + var d = PosnicPro.purchaseorders._doc || {}; + var esc = function (t) { return $('<span>').text(t == null ? '' : t).html(); }; + $('#p_receive_strip').html( + '<span>Close <b>' + esc(d.receiving_id) + '</b> at what has arrived \u2014 the remaining quantities will no longer be expected. No stock moves.</span>' + + '<div class="p-rcv-actions">' + + '<button type="button" class="btn btn-sm btn-danger" onclick="PosnicPro.purchaseorders._postReceive(\'' + esc(d._id) + '\', { close_short: true });">Cancel remaining</button>' + + '<button type="button" class="btn btn-sm btn-light" onclick="$(\'#p_receive_strip\').slideUp(120);">Back</button>' + + '</div>' + ).slideDown(120); + }, + _postReceive: function (id, payload) { + PosnicPro.post({ url: 'receivings/' + id + '/receive', data: JSON.stringify(payload) }, function (r) { + PosnicPro.alert(r.type || 'success', r.message || 'Received'); + PosnicPro.purchaseorders.loadList(); + PosnicPro.purchaseorders.openDoc('purchase', id); + }, function (xhr) { + var resp = {}; try { resp = jQuery.parseJSON(xhr.responseText) || {}; } catch (e) { } + PosnicPro.alert('error', resp.message || 'Could not receive'); + }); + }, + voidPurchase: function (id, no) { + $('#p_void_strip').slideDown(120); + setTimeout(function () { $('#p_void_reason').trigger('focus'); }, 140); + }, + voidConfirm: function (id) { + var reason = $.trim($('#p_void_reason').val() || ''); + if (!reason) { + $('#p_void_reason').addClass('is-invalid').attr('placeholder', PosnicPro.i18n.t('lang_a_reason_is_required', 'A reason is required')).trigger('focus'); + return; + } + PosnicPro.post({ url: 'receivings/' + id + '/void', data: JSON.stringify({ reason: reason }) }, function (r) { + PosnicPro.alert(r.type || 'success', r.message || 'Purchase voided'); + PosnicPro.purchaseorders.loadList(); + PosnicPro.purchaseorders.openDoc('purchase', id); + }, function (xhr) { + var resp = {}; try { resp = jQuery.parseJSON(xhr.responseText) || {}; } catch (e) { } + PosnicPro.alert('error', resp.message || 'Could not void this purchase'); }); }, backToList: function () { - $('#po_form_section,#po_view_section').hide(); + $('#po_form_section,#po_view_section,#po_receive_section').hide(); $('#po_list_section').show(); PosnicPro.purchaseorders.loadList(1); }, @@ -1817,9 +2390,9 @@ PosnicPro.purchaseorders = { $('#po_form_id').val(''); $('#po_supplier_name,#po_supplier_id,#po_expected_date,#po_notes,#po_item_search').val(''); $('#po_cost_rows').html(''); - $('#po_form_verb').text(id ? 'Edit' : 'Create'); + $('#po_form_verb').text(id ? PosnicPro.i18n.t('lang_edit_title', 'Edit') : PosnicPro.i18n.t('lang_po_create', 'Create')); PosnicPro.purchaseorders.renderLines(); - $('#po_list_section,#po_view_section').hide(); + $('#po_list_section,#po_view_section,#po_receive_section').hide(); $('#po_form_section').show(); if (id) { PosnicPro.get({ url: 'purchaseOrders/' + id, data: '' }, function (response) { @@ -1834,7 +2407,7 @@ PosnicPro.purchaseorders = { PosnicPro.purchaseorders._lines[String(line.item_id)] = { name: line.item_name, barcode: line.barcode_id || '', stock: '', incoming: '', - qty: line.qty_ordered, cost: line.unit_cost + qty: line.qty_ordered, cost: Math.round((Number(line.unit_cost) || 0) * 100) / 100 }; }); (po.additional_costs || []).forEach(function (c) { @@ -1851,7 +2424,10 @@ PosnicPro.purchaseorders = { name: row.item_name, barcode: row.barcode_id || '', stock: (row.available_quantity === undefined ? '' : row.available_quantity), incoming: (row.incoming === undefined ? '' : row.incoming), - qty: 1, cost: Number(row.company_price) || 0 + /* Money, so two decimals: a company_price born of price*0.7 + arrives as 27.999999999999996 and the cost input printed + every digit (owner: "purchase cost with so many decimal"). */ + qty: 1, cost: Math.round((Number(row.company_price) || 0) * 100) / 100 }; } PosnicPro.purchaseorders.renderLines(); @@ -1859,7 +2435,7 @@ PosnicPro.purchaseorders = { renderLines: function () { var keys = Object.keys(PosnicPro.purchaseorders._lines); if (!keys.length) { - $('#po_form_rows').html('<tr><td colspan="7" class="text-center text-muted">Search or fill from the supplier.</td></tr>'); + $('#po_form_rows').html('<tr><td colspan="7" class="text-center text-muted"><lang class="lang_search_or_fill_from_the_supplier">Search or fill from the supplier.</lang></td></tr>'); $('#po_form_total').text('0.00'); return; } @@ -1898,16 +2474,16 @@ PosnicPro.purchaseorders = { }, fillFromSupplier: function (lowStockOnly) { var supplierId = $('#po_supplier_id').val(); - if (!supplierId) { PosnicPro.alert('warning', 'Choose a supplier first'); return; } + if (!supplierId) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_choose_a_supplier_first', 'Choose a supplier first')); return; } var range = localStorage.getItem('notificationrange') || 10; PosnicPro.get({ url: 'items/bySupplier', data: 'supplier_id=' + encodeURIComponent(supplierId) + '&low_stock=' + (lowStockOnly ? 'true' : 'false') + '¬ificationrange=' + encodeURIComponent(range) }, function (response) { var rows = (response && response.data) || []; - if (!rows.length) { PosnicPro.alert('info', 'No items for this supplier'); return; } + if (!rows.length) { PosnicPro.alert('info', PosnicPro.i18n.t('lang_no_items_for_this_supplier', 'No items for this supplier')); return; } rows.forEach(function (row) { PosnicPro.purchaseorders.addLine(row); }); - }, function () { PosnicPro.alert('error', 'Could not load the supplier items'); }); + }, function () { PosnicPro.alert('error', PosnicPro.i18n.t('lang_could_not_load_the_supplier_items', 'Could not load the supplier items')); }); }, save: function (status) { var id = $('#po_form_id').val(); @@ -1944,6 +2520,7 @@ PosnicPro.purchaseorders = { var po = response && response.data; if (!po) { return; } PosnicPro.purchaseorders._detail = po; + PosnicPro.purchaseorders.renderAttachments(po.attachments || []); var currency = PosnicPro.local.get('currencySign'); $('#po_view_id').text(po.po_id); $('#po_view_status').text(po.status); @@ -1970,25 +2547,32 @@ PosnicPro.purchaseorders = { $('#po_view_costs').html(costs); $('#po_view_total').text(currency + ' ' + (Number(po.grand_total) || 0).toFixed(2)); $('#po_view_notes').text(po.notes || ''); - var actions = '<button type="button" class="btn btn-sm btn-outline-secondary mr-1" onclick="PosnicPro.purchaseorders.backToList();">Back</button>'; + var actions = '<button type="button" class="btn btn-sm btn-outline-secondary mr-1" onclick="PosnicPro.purchaseorders.backToList();"><lang class="lang_back_title">Back</lang></button>'; if (po.status === 'draft') { - actions += '<button type="button" class="btn btn-sm btn-outline-primary mr-1" data-act="order">Place order</button>' + - '<button type="button" class="btn btn-sm btn-outline-secondary mr-1" data-act="edit">Edit</button>' + - '<button type="button" class="btn btn-sm btn-outline-danger mr-1" data-act="delete">Delete</button>'; + actions += '<button type="button" class="btn btn-sm btn-outline-primary mr-1" data-act="order"><lang class="lang_place_order">Place order</lang></button>' + + '<button type="button" class="btn btn-sm btn-outline-secondary mr-1" data-act="edit"><lang class="lang_edit_title">Edit</lang></button>' + + '<button type="button" class="btn btn-sm btn-outline-danger mr-1" data-act="delete"><lang class="lang_delete">Delete</lang></button>'; } if (po.status === 'ordered' || po.status === 'partial') { - actions += '<button type="button" class="btn btn-sm btn-outline-primary mr-1" data-act="receive">Receive</button>'; + actions += '<button type="button" class="btn btn-sm btn-outline-primary mr-1" data-act="receive"><lang class="lang_receive">Receive</lang></button>'; if (po.status === 'ordered') { - actions += '<button type="button" class="btn btn-sm btn-outline-secondary mr-1" data-act="edit">Edit</button>'; + actions += '<button type="button" class="btn btn-sm btn-outline-secondary mr-1" data-act="edit"><lang class="lang_edit_title">Edit</lang></button>'; } - actions += '<button type="button" class="btn btn-sm btn-outline-danger mr-1" data-act="cancel_remaining">Cancel remaining</button>'; + actions += '<button type="button" class="btn btn-sm btn-outline-danger mr-1" data-act="cancel_remaining"><lang class="lang_cancel_remaining">Cancel remaining</lang></button>'; } if ((po.items || []).length) { - actions += '<button type="button" class="btn btn-sm btn-outline-secondary mr-1" data-act="labels">Print labels</button>'; + actions += '<button type="button" class="btn btn-sm btn-outline-secondary mr-1" data-act="labels"><lang class="lang_print_labels">Print labels</lang></button>'; } $('#po_view_actions').html(actions).data('po-id', String(po._id)); - $('#po_list_section,#po_form_section').hide(); - $('#po_view_section').show(); + if ($('#purchases_po_host').length && $.contains($('#purchases_po_host')[0], $('#po_view_section')[0])) { + /* master-detail: the document lives in the right pane; the + rail stays. Only the form/receive overlays hide. */ + $('#po_form_section,#po_receive_section').hide(); + $('#po_list_section,#po_view_section').show(); + } else { + $('#po_list_section,#po_form_section,#po_receive_section').hide(); + $('#po_view_section').show(); + } }); }, transition: function (id, action) { @@ -2024,7 +2608,7 @@ PosnicPro.purchaseorders = { } }); if (!labels.length) { - PosnicPro.alert('warning', 'No lines with a barcode to print'); + PosnicPro.alert('warning', PosnicPro.i18n.t('lang_no_lines_with_a_barcode_to_print', 'No lines with a barcode to print')); return; } // Render each unique code once, reuse the SVG per copy. @@ -2042,7 +2626,7 @@ PosnicPro.purchaseorders = { return '<div class="lbl"><div class="lbl-name">' + $('<span>').text(l.name).html() + '</div>' + (svgByCode[l.code] || '') + '</div>'; }).join(''); var w = window.open('', '_blank'); - if (!w) { PosnicPro.alert('error', 'Allow pop-ups to print labels'); return; } + if (!w) { PosnicPro.alert('error', PosnicPro.i18n.t('lang_allow_pop_ups_to_print_labels', 'Allow pop-ups to print labels')); return; } w.document.write('<html><head><title>Labels ' + (po.po_id || '') + '' - + ''); - w.document.close(); - }); + // Web / A4: a real vector PDF on its own white palette - never a + // themed screenshot (owner: professional A4 layout, theme-free). + PosnicPro.reportExport.printPdf('export_daily_report', PosnicPro.quickreport._exportMeta()); return false; } + PosnicPro.quickreport._printSlipElectron(report, width); + return false; + }, + + /* Export identity shared by PDF / CSV / Excel. */ + _exportMeta: function () { + var report = PosnicPro.quickreport.lastReport || {}; + var b = report.branch || {}; + return { + shop: b.branch_name || '', + address: b.branch_address || b.address || '', + phone: b.branch_telephone || b.phone || '', + title: PosnicPro.i18n.t('lang_day_end_summary', 'Day-End Summary'), + range: (report.from && report.to) ? report.from + ' - ' + report.to : '', + filename: 'day-end-summary' + }; + }, + + exportCsv: function () { + if (!PosnicPro.quickreport.lastReport) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_run_the_report_first_then_export_it', 'Run the report first, then export it.')); return false; } + PosnicPro.reportExport.csv('export_daily_report', PosnicPro.quickreport._exportMeta()); + return false; + }, + + exportXls: function () { + if (!PosnicPro.quickreport.lastReport) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_run_the_report_first_then_export_it', 'Run the report first, then export it.')); return false; } + PosnicPro.reportExport.xls('export_daily_report', PosnicPro.quickreport._exportMeta()); + return false; + }, + + /* + * The dedicated day-close slip (owner: many shops have ONLY thermal + * printers). Desktop prints through the thermal rail; the web renders + * the same slip narrow and hands it to the browser's print dialog, so + * a driver-connected thermal printer works there too. + */ + printDaySlip: function () { + var report = PosnicPro.quickreport.lastReport; + if (!report) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_run_the_report_first_then_print_the_slip', 'Run the report first, then print the slip.')); return false; } + var width = PosnicPro.resolvePaperWidth(); + if (window.electronAPI && window.electronAPI.printer && window.electronAPI.printer.printReport + && width !== 'a4') { + PosnicPro.quickreport._printSlipElectron(report, width); + return false; + } + var doc = PosnicPro.quickreport._slipDoc(report); + var esc = function (v) { return $('').text(v == null ? '' : v).html(); }; + var h = '
    '; + h += '
    ' + esc(doc.shop) + '
    '; + h += '
    ' + esc(doc.title) + '
    '; + doc.meta.forEach(function (m) { h += '
    ' + esc(m.label) + '' + esc(m.value) + '
    '; }); + doc.sections.forEach(function (sec) { + h += '
    '; + if (sec.name) { h += '
    ' + esc(sec.name) + '
    '; } + if (sec.type === 'pairs' || sec.type === 'blanks') { + (sec.rows || []).forEach(function (row) { + if (typeof row === 'string') { h += '
    ' + esc(row) + '
    '; } + else { h += '
    ' + esc(row.label) + '' + esc(row.value) + '
    '; } + }); + if (sec.total) { h += '
    ' + esc(sec.total.label) + '' + esc(sec.total.value) + '
    '; } + } else if (sec.type === 'total') { + h += '
    ' + esc(sec.label) + '' + esc(sec.value) + '
    '; + } else if (sec.type === 'items') { + (sec.rows || []).forEach(function (row) { + h += '
    ' + esc(row.name) + ' x' + esc(row.qty) + '' + esc(row.amount) + '
    '; + }); + } else if (sec.type === 'note') { + h += '
    ' + esc(sec.text) + '
    '; + } + }); + h += '
    '; + var w = window.open('', '_blank'); + if (!w) { PosnicPro.alert('warning', PosnicPro.i18n.t('lang_allow_pop_ups_so_the_slip_can_print', 'Allow pop-ups so the slip can print.')); return false; } + w.document.write('Day-Close Slip' + h + + '', at); + return html.slice(start + '', start)); + assert.match(block, /insertAdjacentElement\('afterend'/); + assert.ok(!/position:fixed|inset:0/.test(block), 'the app pitch blocks the view again'); + assert.ok(!login.includes('appNudge'), 'the old blocking appNudge modal is back'); + /* owner: every WEB login carries it; the desktop shell alone skips it */ + assert.match(block, /Electron.*return/); + assert.ok(!/posnic\.io.*\.test\(location\.hostname\)/.test(block), 'the card is hostname-gated again - it belongs on every web login'); +}); + +test('the signup nudge fires once per browser and sells the no-commitment path', () => { + const face = read('frontend/static/script/js/core/demo-mode.js'); + /* once EVER: the done-flag is written before the modal is built, so no + code path can show it twice */ + assert.match(face, /posnic_demo_nudge_done/); + assert.match(face, /no commitment/i); + assert.match(face, /Community Edition/); +}); diff --git a/tests/denominations.test.js b/tests/denominations.test.js new file mode 100644 index 000000000..b7fe5c31f --- /dev/null +++ b/tests/denominations.test.js @@ -0,0 +1,199 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { cssReader, stripComments } = require('./helpers/source-lookup'); + +/* + * Cash denominations, and saying whether the money on the counter is enough. + * + * Owner ask: "current denomination and process not so great. if customer give + * more note then we need inform customer its more than what we want... for + * each country we should have database already prefilled denomation." + * + * The sharp end is the first half. "Return balance 0.00" was shown BOTH when + * the customer had paid to the penny and when they were still hundreds short - + * two situations that must never look alike at a counter, because the second + * one ends with the shop out of pocket and nobody knowing when it happened. + */ + +const ROOT = path.join(__dirname, '..'); +const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8'); + +const salesRaw = read('frontend', 'static', 'script', 'js', 'modules', 'js', 'sales.js'); +const salesJs = stripComments(salesRaw); +const html = read('frontend', 'modules', 'sales_write.html'); +const cssRule = cssReader(read('frontend', 'static', 'style', 'css', 'custom.css')); + +/* The real function, run against a stub. Read out of the file rather than + copied, so the test cannot pass while the till does something else. */ +function loadDenominations() { + const from = salesRaw.indexOf('PosnicPro.sales.defaultDenominations = function () {'); + assert.notStrictEqual(from, -1, 'defaultDenominations is gone'); + const body = salesRaw.slice(from, salesRaw.indexOf('\n};', from) + 3); + + /* The table lives at module scope, so it is evaluated alongside the + function - and shared between calls, which is exactly what makes the + copy-on-return worth asserting. */ + const tableAt = salesRaw.indexOf('var POSNIC_DENOMINATION_SETS = {'); + assert.notStrictEqual(tableAt, -1, 'the denomination table is gone'); + const table = salesRaw.slice(tableAt, salesRaw.indexOf('\n};', tableAt) + 3); + + const store = {}; + const scope = { local: { get: (k) => store[k] || '' }, sales: {} }; + // eslint-disable-next-line no-new-func + new Function('PosnicPro', table + '\n' + body)(scope); + return { + body: table, + for: (sign) => { store.currencySign = sign; return scope.sales.defaultDenominations(); }, + }; +} + +function loadStatus() { + const from = salesRaw.indexOf(' showTenderStatus: function (tendered, billAmount) {'); + assert.notStrictEqual(from, -1, 'showTenderStatus is gone'); + let depth = 0; + let end = -1; + for (let i = salesRaw.indexOf('{', from); i < salesRaw.length; i++) { + if (salesRaw[i] === '{') depth++; + else if (salesRaw[i] === '}') { + depth--; + if (depth === 0) { end = i + 1; break; } + } + } + const body = salesRaw.slice(from, end).replace('showTenderStatus: function', 'function showTenderStatus'); + + const state = { text: '', cls: new Set(), shown: false }; + const el = { + length: 1, + text(t) { if (t !== undefined) { state.text = t; return el; } return state.text; }, + addClass(c) { String(c).split(' ').forEach((x) => state.cls.add(x)); return el; }, + removeClass(c) { String(c).split(' ').forEach((x) => state.cls.delete(x)); return el; }, + show() { state.shown = true; return el; }, + hide() { state.shown = false; return el; }, + }; + // eslint-disable-next-line no-new-func + const fn = new Function('$', 'PosnicPro', body + '\nreturn showTenderStatus;')( + () => el, + /* i18n answers with the English it is given, exactly as the real t() + does before a language pack has loaded. */ + { local: { get: () => '₹' }, i18n: { t: (key, english) => english } }, + ); + return (tendered, bill) => { + state.text = ''; + state.cls = new Set(); + state.shown = false; + fn(tendered, bill); + return { text: state.text, cls: [...state.cls], shown: state.shown }; + }; +} + +/* ------------------------------------------------------------------ * + * Short, exact, or change + * ------------------------------------------------------------------ */ + +test('being short is never shown as a zero balance', () => { + /* The exact case from the report: 9 x 500 against a 5262.65 bill. */ + const status = loadStatus(); + const r = status(4500, 5262.65); + assert.ok(r.shown, 'nothing is shown when the customer is short'); + assert.ok(r.cls.includes('is-short'), `expected the short state, got ${r.cls.join(' ')}`); + assert.match(r.text, /762\.65/, 'the amount still owed is not stated'); + assert.match(r.text, /still to pay/i, 'it does not say what the number means'); +}); + +test('paying exactly is distinguishable from being short', () => { + /* Both used to read "0.00". */ + const status = loadStatus(); + const exact = status(5262.65, 5262.65); + const short = status(4500, 5262.65); + assert.ok(exact.cls.includes('is-exact')); + assert.notDeepStrictEqual(exact.text, short.text); +}); + +test('over-paying says how much to give back', () => { + const status = loadStatus(); + const r = status(6000, 5262.65); + assert.ok(r.cls.includes('is-over')); + assert.match(r.text, /737\.35/); + assert.match(r.text, /change/i); +}); + +test('a rounding difference is not called a shortfall', () => { + /* Half a paisa under is arithmetic, not an unpaid bill. */ + const status = loadStatus(); + assert.ok(status(5262.645, 5262.65).cls.includes('is-exact')); +}); + +test('nothing counted yet says nothing', () => { + /* The row must not sit there reading "short" before anybody has touched a + note - that is nagging, not information. */ + assert.strictEqual(loadStatus()(0, 5262.65).shown, false); +}); + +test('the status is shown in words and colour, not a bare number', () => { + /* A cashier reads this for about a second while talking to somebody. */ + assert.ok(html.includes('tender_status'), 'the status element is missing'); + for (const state of ['is-short', 'is-exact', 'is-over']) { + assert.match(cssRule(`.tender-status.${state}`), /background/, `${state} has no colour`); + } +}); + +/* ------------------------------------------------------------------ * + * The prefilled denominations + * ------------------------------------------------------------------ */ + +test('many currencies are covered, not just a handful', () => { + const { body } = loadDenominations(); + const entries = [...body.matchAll(/^ {8}'([^']+)': \[/gm)]; + assert.ok(entries.length >= 40, `only ${entries.length} currencies are prefilled`); +}); + +test('every set is ascending, positive and free of duplicates', () => { + /* The buttons are rendered in the order given, and a repeated value is two + buttons that do the same thing. */ + const { body } = loadDenominations(); + for (const m of body.matchAll(/^ {8}'([^']+)': \[([^\]]+)\]/gm)) { + const sign = m[1]; + const vals = m[2].split(',').map((x) => parseFloat(x.trim())); + assert.ok(vals.every((v) => Number.isFinite(v) && v > 0), `${sign} has a bad value`); + assert.deepStrictEqual(vals, [...vals].sort((a, b) => a - b), `${sign} is not ascending`); + assert.strictEqual(new Set(vals).size, vals.length, `${sign} repeats a value`); + assert.ok(vals.length >= 4, `${sign} has too few denominations to be real`); + } +}); + +test('a shop in Nigeria or Indonesia does not get rupee buttons', () => { + const d = loadDenominations(); + assert.notDeepStrictEqual(d.for('₦'), d.for('₹'), 'naira falls back to rupees'); + assert.notDeepStrictEqual(d.for('Rp'), d.for('₹'), 'rupiah falls back to rupees'); + assert.ok(d.for('Rp').includes(100000), 'the rupiah set has no large notes'); +}); + +test('an unknown currency falls back to a 1-2-5 ladder, not to one country', () => { + /* + * Almost every currency is built on 1, 2 and 5 by powers of ten, so this is + * recognisable nearly anywhere - and unlike a copy of one country's notes it + * does not look like a bug to everybody else. + */ + const d = loadDenominations(); + const fallback = d.for('§'); + assert.deepStrictEqual(fallback, [1, 2, 5, 10, 20, 50, 100, 200, 500]); +}); + +test('the caller gets a copy, so the table cannot be mutated', () => { + /* The sale screen sorts this list in place in one of its two callers. */ + const d = loadDenominations(); + const first = d.for('₹'); + first.push(99999); + assert.ok(!d.for('₹').includes(99999), 'the shared table was modified'); +}); + +test("the shop's own list still wins", () => { + /* Settings > Cash Denominations is the authority; this is only the start. */ + assert.match( + salesJs, + /SaleDenomination[\s\S]{0,200}defaultDenominations/, + 'the shop-defined list no longer takes precedence', + ); +}); diff --git a/tests/deploy-survives-open-tabs.test.js b/tests/deploy-survives-open-tabs.test.js new file mode 100644 index 000000000..2c372d869 --- /dev/null +++ b/tests/deploy-survives-open-tabs.test.js @@ -0,0 +1,95 @@ +'use strict'; + +/* + * A deploy must not break the tabs that are already open. + * + * Owner: "mobile view add category shown and page broken. crashed." The + * beacon log told the real story: no JS error at all - the page had lost + * style/dashboard..css with a 404. Ten deploys shipped that day; + * each one ran rsync --delete on the tenant instance, so every deploy + * deleted the bundles every already-open tab still referenced. The page + * kept running, unstyled - which a person reads as "broken. crashed." + * + * Three layers, pinned together because any one alone can silently rot: + * 1. the tenant deploy PROTECTS hashed bundles from --delete and prunes + * by family instead (newest 3 stay), + * 2. the service worker answers a 404'd hashed bundle with the CURRENT + * build's file of the same family, + * 3. reference-data endpoints carry HTTP cache headers (pinned api-side + * in settings.routes.test.js). + */ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const read = (rel) => fs.readFileSync(path.join(__dirname, '..', rel), 'utf8'); + +test('the tenant deploy keeps the last builds\' hashed bundles alive', () => { + const wf = read('.github/workflows/deploy-frontend.yml'); + assert.match(wf, /--filter='protect public\/script\/\*\.js'/, + 'hashed js is no longer protected from rsync --delete'); + assert.match(wf, /--filter='protect public\/style\/\*\.css'/, + 'hashed css is no longer protected from rsync --delete'); + /* and the retention prune bounds the growth */ + assert.match(wf, /Prune old hashed bundles/); + assert.match(wf, /tail -n \+4/, 'the keep-newest-3 retention changed shape'); +}); + +test('the CDN deploy never gained --delete on its bundle pass', () => { + const wf = read('.github/workflows/deploy-frontend-cdn.yml'); + const bundlePass = wf.slice(wf.indexOf("--include 'style/*'")); + assert.ok(!bundlePass.includes('--delete'), + 'the CDN bundle pass deletes old hashes - open tabs break on deploy'); +}); + +test('the service worker answers a dead hashed bundle with its current sibling', () => { + const sw = read('frontend/sw-template.js'); + assert.match(sw, /function familyFallback\(pathname\)/); + /* only precached families are eligible - guessing at others would serve + wrong bytes with confidence */ + assert.match(sw, /for \(const entry of PRECACHE\)/); + /* wired on BOTH failure paths: http error and network throw */ + const hits = sw.match(/familyFallback\(url\.pathname\)/g) || []; + assert.ok(hits.length >= 2, 'the fallback lost one of its two failure paths'); +}); + +test('phantom images heal themselves instead of burning the beacon budget', () => { + /* src='' or src='undefined' resolves to the page URL and "fails" - our + own template bug, six of which once consumed the whole per-IP beacon + window while a real stylesheet 404 waited behind them. The watchdog + swaps them to the placeholder pixel and keeps them out of the journal. */ + const dash = read('frontend/dashboard.html'); + const at = dash.indexOf("tagName === 'IMG'"); + assert.ok(at > -1, 'the phantom-image healer is gone'); + const block = dash.slice(at, at + 700); + assert.match(block, /data:image\/gif;base64/); + assert.match(block, /return;/); + assert.match(block, /\(undefined\|null\)/); +}); + +test('the worker steps aside when its cache layer is wedged', () => { + /* A full or corrupt Cache Storage made caches.open reject, the + respondWith promise reject with it, and EVERY asset request die - + a phone that "does not even open" while the origin is perfectly + healthy. Each cached branch now ends by falling back to a plain + network fetch, so a broken cache never outranks a working network. */ + const sw = read('frontend/sw-template.js'); + const fallthroughs = sw.match(/\)\.catch\(\(\) => fetch\(request\)\)/g) || []; + assert.ok(fallthroughs.length >= 3, + 'a cached branch lost its network fall-through (' + fallthroughs.length + '/3)'); + /* and a failed cache WRITE never takes the answer with it */ + const putGuards = sw.match(/cache\.put\(request, response\.clone\(\)\)\.catch/g) || []; + assert.ok(putGuards.length >= 2, 'a cache.put lost its guard'); +}); + +test('a page that watches its own stylesheet die reloads once to re-pair', () => { + const dash = read('frontend/dashboard.html'); + const at = dash.indexOf('posnic_repair_reload'); + assert.ok(at > -1, 'the one-shot repair reload is gone'); + const block = dash.slice(at - 700, at + 400); + /* own bundles only, and exactly once per tab session */ + assert.match(block, /(dashboard\|login)/); + assert.match(block, /sessionStorage\.getItem\('posnic_repair_reload'\)/); + assert.match(block, /location\.reload\(\)/); +}); diff --git a/tests/desktop-card-dismiss.test.js b/tests/desktop-card-dismiss.test.js new file mode 100644 index 000000000..15da687d6 --- /dev/null +++ b/tests/desktop-card-dismiss.test.js @@ -0,0 +1,92 @@ +'use strict'; + +/* + * Closing the desktop-app card has to close it. + * + * The card sits under the login form on every web login, and its small x is + * the only way out of it. The dismissal remembers itself in localStorage, + * which is right - but localStorage is not merely unreliable, it THROWS: a + * private window, or a browser set to block site data, raises on both get and + * set rather than returning null. + * + * That made the handler order load-bearing. With setItem first, the throw + * happened before el.remove(), so on those browsers clicking the x did + * nothing at all - the card stayed exactly where it was, and the one thing a + * dismiss button must never do is refuse to dismiss. Closing is what the + * click asked for; remembering is the nice-to-have that may fail. + * + * The read is guarded for the same reason: an unguarded getItem threw inside + * the injector and took the rest of it down with it. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const login = fs.readFileSync( + path.join(__dirname, '..', 'frontend', 'login.html'), + 'utf8' +); + +/* The card's dismiss handler, from the x's onclick to the end of the body. */ +function dismissHandler() { + const start = login.indexOf("posnic_app_card_x').onclick"); + assert.notStrictEqual(start, -1, 'the dismiss handler moved or was renamed'); + const end = login.indexOf('})();', start); + assert.notStrictEqual(end, -1, 'could not find the end of the injector'); + return login.slice(start, end); +} + +test('the card is removed before the choice is stored', () => { + const body = dismissHandler(); + const removeAt = body.indexOf('el.remove()'); + const setAt = body.indexOf('localStorage.setItem'); + assert.notStrictEqual(removeAt, -1, 'the handler no longer removes the card'); + assert.notStrictEqual(setAt, -1, 'the handler no longer remembers the choice'); + assert.ok( + removeAt < setAt, + 'el.remove() must come BEFORE setItem - storage that throws would otherwise ' + + 'leave the card on screen after the user clicked to close it' + ); +}); + +test('storing the choice cannot throw out of the handler', () => { + const body = dismissHandler(); + const setAt = body.indexOf('localStorage.setItem'); + const tryAt = body.lastIndexOf('try', setAt); + assert.ok( + tryAt !== -1 && tryAt < setAt, + 'setItem must sit inside a try/catch - it throws where site data is blocked' + ); +}); + +test('reading the choice cannot throw out of the injector', () => { + const readAt = login.indexOf("getItem('posnic_web_ok')"); + assert.notStrictEqual(readAt, -1, 'the dismissal guard is gone - the card would show forever'); + const tryAt = login.lastIndexOf('try', readAt); + const guardStart = login.indexOf("navigator.userAgent.indexOf('Electron')"); + assert.ok( + tryAt !== -1 && tryAt > guardStart && tryAt < readAt, + 'getItem must sit inside a try/catch - it throws in a private window' + ); +}); + +test('the dismissal is not among the keys logout clears', () => { + /* + * Logout clears named keys one by one. If posnic_web_ok were ever added to + * that list, every logout would resurrect the card on the very next page + * the user sees - which is the login page carrying it. + */ + const users = fs.readFileSync( + path.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'modules', 'js', 'users.js'), + 'utf8' + ); + const start = users.indexOf('logoutCheck: function'); + assert.notStrictEqual(start, -1, 'logoutCheck moved'); + const scope = users.slice(start, start + 4000); + assert.ok( + !scope.includes('posnic_web_ok'), + 'logout must not clear posnic_web_ok - the dismissal is meant to outlive the session' + ); +}); diff --git a/tests/desktop-nudge.test.js b/tests/desktop-nudge.test.js new file mode 100644 index 000000000..4e430593f --- /dev/null +++ b/tests/desktop-nudge.test.js @@ -0,0 +1,285 @@ +'use strict'; + +/* + * The desktop-app poster, and every place it must keep its mouth shut. + * + * The owner asked for it: "in order promote the desktop app inbetween web + * session show pop", and then picked all three designs, "radomly show that". + * + * An advertisement inside software somebody is working in is the easiest thing + * in this codebase to get wrong, and every way of getting it wrong is invisible + * from the file itself. So this drives the real module in a real DOM and + * asserts what a shopkeeper would actually see, rather than checking how the + * source is spelled. Reading the file would have passed happily while the + * poster covered a customer being billed. + * + * The rules being defended, each of them costly to break: + * + * not in the desktop app advertising the thing they are already running + * not on the public demo the owner's standing no-blocking-notifications + * rule for demo.posnic.io + * not on self-hosted mode 'local' means the browser is a LAN client + * of the shop's own server. The desktop app is a + * separate till with its own database, so that + * advice creates exactly the two-shops-in-one- + * database mess we spent this week fixing. + * never over a live sale defer, do not cancel + * once per browser, ever including across navigations + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { JSDOM } = require('jsdom'); + +const SRC = fs.readFileSync( + path.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'core', 'desktop-nudge.js'), + 'utf8' +); + +const CHROME = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/126 Safari/537.36'; +const ELECTRON = CHROME + ' Posnic/1.4.0 Electron/43.2.0'; + +/** An empty cart draws a placeholder row, which must not read as a live sale. */ +const EMPTY_CART = '' + + '
    Sale Order Empty
    '; +const CART_WITH_A_LINE = '' + + '
    Milk 1L
    '; + +/** + * Run the module against a page and a runtime, with time under our control. + * + * @param {object} opts + * @param {object} opts.runtime the /runtime-info payload the server returns + * @param {string} opts.ua user agent + * @param {string} opts.body page markup + * @param {object} opts.stored localStorage contents before the run + * @param {number} opts.random fixed Math.random value + * @param {boolean} opts.blockStorage make localStorage throw, as a private + * window and a data-blocking browser do + */ +function run(opts) { + const o = Object.assign({ ua: CHROME, body: EMPTY_CART, stored: {}, random: 0 }, opts); + const dom = new JSDOM('' + o.body + '', + { runScripts: 'outside-only' }); + const win = dom.window; + + /* + * jsdom 30 no longer takes a userAgent option for navigator: it reports its + * own string and silently ignores the one you pass. Left uncorrected, the + * Electron case here tested nothing at all and passed for the wrong reason. + */ + Object.defineProperty(win.navigator, 'userAgent', { configurable: true, value: o.ua }); + + const store = Object.assign({}, o.stored); + Object.defineProperty(win, 'localStorage', { + configurable: true, + value: { + getItem(k) { + if (o.blockStorage) throw new Error('site data blocked'); + return Object.prototype.hasOwnProperty.call(store, k) ? store[k] : null; + }, + setItem(k, v) { + if (o.blockStorage) throw new Error('site data blocked'); + store[k] = String(v); + }, + }, + }); + + /* Timers we can run on demand, so a four minute wait costs nothing. */ + const timers = []; + win.setTimeout = (fn, ms) => { timers.push({ fn, ms }); return timers.length; }; + + let asked = null; + win.XMLHttpRequest = function () { + this.open = (method, url) => { asked = url; }; + this.send = () => { + this.responseText = JSON.stringify(o.runtime || {}); + if (this.onload) this.onload(); + }; + }; + + const events = []; + win.gtag = (name, action, params) => { events.push({ name, action, params }); }; + win.Math.random = () => o.random; + + win.eval(SRC); + + const api = { + win, + store, + events, + get asked() { return asked; }, + /** Fire every timer queued so far; returns how many ran. */ + tick() { + const due = timers.splice(0, timers.length); + due.forEach((t) => t.fn()); + return due.length; + }, + get pending() { return timers.length; }, + get veil() { return win.document.getElementById('posnic_desktop_nudge'); }, + get text() { + const v = this.veil; + return v ? v.textContent.replace(/\s+/g, ' ').trim() : ''; + }, + click(id) { win.document.getElementById(id).onclick({ target: null }); }, + }; + /* One page load's worth of time. */ + api.tick(); + return api; +} + +const CLOUD = { mode: 'cloud', edition: 'cloud' }; + +test('a shop using Posnic in a browser is offered the desktop app', () => { + const r = run({ runtime: CLOUD }); + assert.ok(r.veil, 'no poster was shown to a cloud shop in a browser'); + assert.match(r.text, /Download free/); +}); + +test('the desktop app never advertises itself', () => { + const r = run({ runtime: CLOUD, ua: ELECTRON }); + assert.equal(r.veil, null, 'the poster appeared inside the desktop app'); + assert.equal(r.asked, null, 'runtime-info was fetched before the cheap check ruled it out'); +}); + +test('the public demo stays free of blocking notifications', () => { + /* The owner's standing rule for demo.posnic.io. A visitor evaluating the + product must never be stopped by a veil. */ + const r = run({ runtime: { mode: 'cloud', demo: true } }); + assert.equal(r.veil, null, 'a demo visitor met a modal'); +}); + +test('a self-hosted LAN browser is not told to install a separate till', () => { + /* + * The expensive one. On mode 'local' the browser is a client of the shop's + * own server; the desktop app is a whole standalone till with its own + * database. Following that advice is how one shop's rows end up in another + * shop's database, which is the bug this week was spent fixing. + */ + const r = run({ runtime: { mode: 'local', edition: 'community' } }); + assert.equal(r.veil, null, 'a self-hosted LAN client was told to install the desktop app'); +}); + +test('a sale in progress defers the poster instead of covering it', () => { + const r = run({ runtime: CLOUD, body: CART_WITH_A_LINE }); + assert.equal(r.veil, null, 'the poster opened over a customer being billed'); + assert.ok(r.pending > 0, 'the poster was dropped rather than deferred, so it never shows at all'); +}); + +test('the deferred poster arrives once the cart is clear', () => { + const r = run({ runtime: CLOUD, body: CART_WITH_A_LINE }); + r.win.document.querySelector('#sales_new_items_table tbody').innerHTML = + 'Sale Order Empty'; + r.tick(); + assert.ok(r.veil, 'the sale finished and the poster never came back'); +}); + +test('an open dialog also counts as busy', () => { + const r = run({ runtime: CLOUD, body: EMPTY_CART + '
    ' }); + assert.equal(r.veil, null, 'the poster stacked on top of another dialog'); +}); + +test('it is shown once per browser, ever', () => { + const first = run({ runtime: CLOUD }); + assert.ok(first.veil); + const second = run({ runtime: CLOUD, stored: first.store }); + assert.equal(second.veil, null, 'a second browser session was shown the poster again'); +}); + +test('navigating away mid-poster does not earn a second one', () => { + /* Marked done at render rather than at close, so closing the tab with the + poster open still counts as having been asked. */ + const r = run({ runtime: CLOUD }); + assert.equal(r.store.posnic_desktop_nudge_done, '1', + 'the showing is only recorded when the poster is dismissed'); +}); + +test('somebody who dismissed the login card is not asked again in a veil', () => { + const r = run({ runtime: CLOUD, stored: { posnic_web_ok: '1' } }); + assert.equal(r.veil, null, 'the same offer was made twice to someone who already said no'); +}); + +test('all three posters are reachable and each one sells something different', () => { + const seen = {}; + [0, 0.5, 0.99].forEach((random) => { + const r = run({ runtime: CLOUD, random }); + assert.ok(r.veil, 'random=' + random + ' produced no poster'); + seen[r.store.posnic_desktop_nudge_variant] = r.text; + }); + assert.deepEqual(Object.keys(seen).sort(), ['counter', 'offline', 'reasons'], + 'the random pick cannot reach all three designs'); + + assert.match(seen.counter, /printer, barcode scanner, cash drawer/i); + assert.match(seen.offline, /internet went at two/i); + assert.match(seen.reasons, /Hardware.*No internet.*Faster/i); +}); + +test('which poster somebody saw is recorded, or the experiment answers nothing', () => { + const r = run({ runtime: CLOUD, random: 0 }); + assert.ok(r.store.posnic_desktop_nudge_variant, 'the variant was not stored'); + const shown = r.events.filter((e) => e.action === 'desktop_nudge_shown'); + assert.equal(shown.length, 1, 'the showing was not reported'); + assert.equal(shown[0].params.variant, r.store.posnic_desktop_nudge_variant); +}); + +test('closing works where storage throws', () => { + /* + * A private window and a browser set to block site data do not return null, + * they RAISE, on read and on write alike. The sibling card had exactly this + * bug: setItem threw before the element was removed, so clicking the x did + * nothing whatsoever and the card stayed on screen. Closing is what the + * click asked for; remembering is the part allowed to fail. + */ + const r = run({ runtime: CLOUD, blockStorage: true }); + assert.ok(r.veil, 'a browser blocking site data got no poster at all'); + r.click('posnic_dn_x'); + assert.equal(r.veil, null, 'the close button refused to close'); +}); + +test('every way out of the poster closes it', () => { + ['posnic_dn_x', 'posnic_dn_later', 'posnic_dn_get'].forEach((id) => { + const r = run({ runtime: CLOUD }); + r.click(id); + assert.equal(r.veil, null, id + ' left the poster on screen'); + }); +}); + +test('the download opens away from the till, not over it', () => { + const r = run({ runtime: CLOUD }); + const link = r.win.document.getElementById('posnic_dn_get'); + assert.equal(link.getAttribute('target'), '_blank', + 'the download navigates the till away from the shop'); + assert.match(link.getAttribute('rel') || '', /noopener/); +}); + +test('escape closes it, because a modal that traps people is worse than none', () => { + const r = run({ runtime: CLOUD }); + const ev = new r.win.KeyboardEvent('keydown', { key: 'Escape' }); + r.win.document.dispatchEvent(ev); + assert.equal(r.veil, null, 'escape did not close the poster'); +}); + +test('the poster carries no em dash', () => { + /* The owner's rule: "never use -- this. very annoying it shows is ai text." + It applies to what customers read, which is what this file is. */ + const r = run({ runtime: CLOUD, random: 0.5 }); + assert.ok(!/[—–]/.test(SRC), 'an em or en dash is in the shipped copy'); + assert.ok(!/[—–]/.test(r.text)); +}); + +test('the module is actually shipped to a browser', () => { + /* + * A core script absent from the manifest is loaded by nobody, and from + * inside the file that is invisible. weight-machine-integration.js sat + * unmapped for months looking like a working feature. + */ + const manifest = JSON.parse(fs.readFileSync( + path.join(__dirname, '..', 'frontend', 'pages_css_js_map.json'), 'utf8')); + const js = (manifest.dashboard || {}).js || []; + assert.ok(js.includes('static/script/js/core/desktop-nudge.js'), + 'the dashboard does not load desktop-nudge.js, so it runs nowhere'); + assert.ok(!((manifest.login || {}).js || []).includes('static/script/js/core/desktop-nudge.js'), + 'the login page already carries the desktop card and must not also get the veil'); +}); diff --git a/tests/detail-row-totals.test.js b/tests/detail-row-totals.test.js new file mode 100644 index 000000000..c02ed158b --- /dev/null +++ b/tests/detail-row-totals.test.js @@ -0,0 +1,216 @@ +'use strict'; + +/* + * Two incidents from the same shop, one afternoon, pinned together. + * + * 1. "The till is taking too long to load ... Cannot read properties of + * undefined (reading 'toFixed')" - the item details page rendered + * row.items_total.toFixed(2) on raw sale documents, and a demo-seeded + * sale carries sales_total only. One such sale in the table white-paged + * the whole page. The same template lives in five detail views. + * + * 2. "all toggle are on" - the first-run welcome sent its switches as + * 'true'/'false' STRINGS, the group endpoint stored them verbatim, and + * every `!== false` gate read the string "false" as enabled. The client + * now sends booleans (the server coerces too, but an honest payload is + * correct even against a not-yet-updated server). + */ +const { test } = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const read = (f) => + fs.readFileSync(path.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'modules', 'js', f), 'utf8'); + +const DETAIL_PAGES = [ + 'customer_categories.js', + 'customers.js', + 'categories.js', + 'suppliers.js', +]; + +test('no detail page renders a raw row total - one legacy sale must not white-page the view', () => { + for (const f of DETAIL_PAGES.concat('items.js')) { + const src = read(f); + assert.ok( + !src.includes('row.items_total.toFixed') && !src.includes('row.items_return_total.toFixed'), + f + ' still calls toFixed on a raw row total' + ); + } + /* and the guarded form is actually present, so this is a rewrite, not a removal */ + const items = read('items.js'); + assert.match(items, /rowSaleTotal\.toFixed\(2\)/); + assert.match(items, /rowReturnTotal\.toFixed\(2\)/); + assert.match(items, /Number\(row\.items_total\) \|\| 0/); + for (const f of DETAIL_PAGES) { + assert.match(read(f), /\(Number\(row\.items_total\) \|\| 0\)\.toFixed\(2\)/, f); + } +}); + +test('no activity view renders a raw sale_process - a legacy or demo sale must not badge "undefined"', () => { + /* Same incident family, third member: the Process column printed + row.sale_process raw, and a sale without the field (demo-seeded or + legacy) showed a red "undefined" badge. The seeder stamps 'Add' now, + and every reader defaults - installed data has no field to gain. */ + for (const f of ['customers.js', 'categories.js', 'customer_categories.js', 'items.js']) { + const src = read(f); + assert.ok(!src.includes("+ row.sale_process + '"), + f + ' still renders sale_process unguarded'); + assert.match(src, /\(row\.sale_process \|\| 'Add'\)/, f); + assert.match(src, /!row\.sale_process \|\| row\.sale_process == 'Add'/, + f + ' badges a missing process as an error'); + assert.match(src, /let process = val\.sale_process \|\| 'Add';/, f + ' (export path)'); + } +}); + +test('the welcome saves BOOLEANS - the string "false" reads as enabled everywhere', () => { + const src = read('settings.js'); + const saveIntro = src.slice(src.indexOf('saveIntro:'), src.indexOf('saveIntro:') + 2500); + assert.match( + saveIntro, + /payload\[\$\(this\)\.data\('key'\)\] = \$\(this\)\.is\(':checked'\);/, + 'welcome toggles must be sent as booleans' + ); + assert.ok(!saveIntro.includes("? 'true' : 'false'"), 'the string form is back'); + assert.match(saveIntro, /payload\.first_run_decided = true;/); + /* the "Use defaults" write uses the same boolean save path too */ + assert.match(src, /'#feature_intro_skip'[\s\S]{0,160}PosnicPro\.features\.saveIntro\(\)/); +}); + +test('the money-path lists are card-ready on phones (Mobile P2)', () => { + /* MOBILE_EXPERIENCE_PLAN P2: each list opts into the table-to-cards + mechanism (m-cards on the table, data-label on the cells). The + mechanism is inert on desktop and inert without the labels, so this + pin is what keeps a rewritten row template from quietly shipping a + label-less phone view. */ + const fsx = require('fs'); + const px = require('path'); + const mod = (f) => fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'modules', f), 'utf8'); + const js = (f) => fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'modules', 'js', f), 'utf8'); + /* receivings.html retired 2026-08-27 - the purchases surface stacks on + phones through the master-detail column rule instead of m-cards. */ + /* suppliers.html moved to the master-detail standard 2026-08-27 - phones + get the stacked split, not m-cards. */ + /* customers.html moved to the master-detail standard 2026-08-27. */ + /* items.html moved to the master-detail standard 2026-08-27. */ + /* sales_read.html moved to the master-detail standard 2026-08-27. */ + /* stockactivity.html + variants.html moved to the list standard 2026-08-27 - + phones get the column-shedding rules, not m-cards. */ + /* users.html moved to the list standard 2026-08-28. */ + for (const f of [ + /* P3 slice 2 */ 'kothistory.html', 'settings_write.html']) { + assert.match(mod(f), /table-borderless m-cards/, f + ' lost its m-cards opt-in'); + } + for (const [f, label] of [ + /* P3 slice 2 */ + ['kothistory.js', 'data-label="Order type"'], + ['expenses.js', 'data-label="Approved by"'], + /* P3 slice 3: the detail-view sales histories (the sale_process family) */ + ['customers.js', 'data-label="Return total"'], + ['categories.js', 'data-label="Return total"'], + ['customer_categories.js', 'data-label="Return total"'], + ['items.js', 'data-label="Return total"'], + ]) { + assert.ok(js(f).includes(label), f + ' rows lost their ' + label); + } + /* the detail tables themselves opt in - two live in modals/ */ + const anyf = (rel) => fsx.readFileSync(px.join(__dirname, '..', 'frontend', rel), 'utf8'); + for (const [rel, id] of [ + ['modals/customer.html', 'view_customerdetails'], + ['modals/items_read.html', 'view_itemdetails'], + ['modules/categories.html', 'view_categorydetails'], + ['modules/customer_categories.html', 'view_customercategorydetails'], + ]) { + assert.match(anyf(rel), new RegExp('id="' + id + '" class="table table-borderless m-cards"'), rel); + } + /* and the mechanism itself is present and token-coloured */ + const css = fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'static', 'style', 'css', 'custom.css'), 'utf8'); + assert.match(css, /table\.m-cards td\[data-label\]::before/); +}); + +test('report tables keep their first column under a scrolling thumb (Mobile P3)', () => { + /* Dense numeric reports stay tables on phones - cards would bury the + numbers - but they scroll sideways, and without a pinned first column + the row names scroll away with them. Every report page opts in. */ + const fsx = require('fs'); + const px = require('path'); + const css = fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'static', 'style', 'css', 'custom.css'), 'utf8'); + assert.match(css, /table\.m-sticky-first th:first-child/); + assert.match(css, /position: sticky/); + const dir = px.join(__dirname, '..', 'frontend', 'modules'); + const reportPages = fsx.readdirSync(dir).filter((f) => /report\.html$/i.test(f)); + assert.ok(reportPages.length >= 15, 'the report-page scan found almost nothing'); + for (const f of reportPages) { + const s = fsx.readFileSync(px.join(dir, f), 'utf8'); + if (!s.includes('table-borderless')) continue; + assert.ok(s.includes('m-sticky-first'), f + ' lost its sticky first column'); + } +}); + +test('money and quantity fields ask the phone for the number pad (Mobile P2 tail)', () => { + /* inputmode="decimal" pops the numeric keyboard; without it a cashier + types every quantity through the full QWERTY. The qty inputs live in + JS row templates, the price fields in the items form. */ + const fsx = require('fs'); + const px = require('path'); + const sales = fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'modules', 'js', 'sales.js'), 'utf8'); + const qty = sales.match(/inputmode="decimal" name="addSalesLineItemQty"/g) || []; + assert.ok(qty.length >= 4, 'the sale-screen qty inputs lost their number pad (' + qty.length + ')'); + const recv = fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'modules', 'js', 'receiving_add.js'), 'utf8'); + assert.match(recv, /rec_sale_inp_val" inputmode="decimal"/); + const items = fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'modules', 'items_write.html'), 'utf8'); + for (const fid of ['items_selling_price', 'items_company_price', 'items_mrp_price', 'items_available_quantity']) { + const tag = items.match(new RegExp(']*id="' + fid + '"[^>]*>')); + assert.ok(tag && tag[0].includes('inputmode="decimal"'), fid + ' lost its number pad'); + } +}); + +test('phone inputs build on demand, never at boot (DOM diet)', () => { + /* intl-tel-input renders ~1,222 nodes of country list per instance. Three + were live on the dashboard - 14% of the whole document - inside the + first second, which is the window iPhones were dying in. The call sites + are untouched because the instance is a getter; what changed is WHEN it + is built. */ + const fsx = require('fs'); + const px = require('path'); + const core = fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'core', 'PosnicPro.js'), 'utf8'); + assert.match(core, /PosnicPro\.lazyPhoneInput = function/); + assert.match(core, /Object\.defineProperty\(target, prop, \{ configurable: true, get: build \}\)/); + assert.match(core, /\$\(document\)\.on\('focusin', selector, build\)/); + assert.match(core, /if \(!window\.__mobileSafeMode\) \{/); + const js = (f) => fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'modules', 'js', f), 'utf8'); + for (const f of ['branches.js', 'customers.js', 'suppliers.js', 'settings.js', 'sales.js']) { + assert.ok(!js(f).includes('= window.intlTelInput(document.querySelector'), + f + ' builds a phone widget at boot again'); + assert.match(js(f), /PosnicPro\.lazyPhoneInput\('#/, f); + } +}); + +test('mobile full-sheet drawers widen only when OPEN', () => { + /* The drawers are hidden by WIDTH ZERO (scss/_custom-topbar.scss). A + mobile rule that widened the BARE class overrode the closed state too, + so ~20 drawers rendered full-screen over the app on every phone - + iPhone and Android alike ("Add Customer Category" covering the + dashboard). Only the state classes may be widened. */ + const fsx = require('fs'); + const px = require('path'); + const css = fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'static', 'style', 'css', 'custom.css'), 'utf8'); + /* find the RULE, not this file's prose about it */ + const at = css.indexOf('.infobar-settings-sidebar.sidebarshow'); + assert.ok(at > -1, 'the full-sheet rule vanished'); + const block = css.slice(css.lastIndexOf('@media', at), css.indexOf('}', css.indexOf('100vw', at))); + assert.match(block, /\.infobar-settings-sidebar\.sidebarshow/); + assert.match(block, /\.infobar-settings-sidebar\.sidebarview/); + /* the bare class must NOT be a selector of that rule */ + assert.ok(!/\n\s*\.infobar-settings-sidebar,\s*\n/.test(block), + 'the bare drawer class is being widened again - every closed drawer becomes full-screen'); + /* and the built stylesheet must agree */ + const built = fsx.readdirSync(px.join(__dirname, '..', 'frontend', 'public', 'style')) + .filter((f) => /^dashboard\..*\.css$/.test(f))[0]; + if (built) { + const b = fsx.readFileSync(px.join(__dirname, '..', 'frontend', 'public', 'style', built), 'utf8'); + assert.ok(!/\.infobar-settings-sidebar,#infobar-settings-sidebar-tender-details\{width:100vw!important/.test(b), + 'the built css still widens closed drawers'); + } +}); diff --git a/tests/docs-links.test.js b/tests/docs-links.test.js new file mode 100644 index 000000000..466d4d125 --- /dev/null +++ b/tests/docs-links.test.js @@ -0,0 +1,85 @@ +'use strict'; + +/* + * Every relative link in every markdown file must point at something. + * + * WHAT HAPPENED, so this is not removed as tidiness. + * + * Somebody who wanted to contribute - atomnoid, discussion #25 - read the docs, + * clicked through to the developer guide, and got a 404. They took the trouble + * to open a discussion about it rather than simply leaving, which is more than + * anyone is owed. + * + * The cause was that docs/GOVERNANCE.md linked to `docs/DEVELOPMENT.md` from + * inside docs/, so it resolved to docs/docs/DEVELOPMENT.md. The file was there + * the whole time. A scan then found the same mistake in 30 places across six + * files: every target existed, and not one of the links reached it. + * + * It survived because a relative link is correct in the editor, correct in most + * previewers, and only wrong on GitHub, where the reader is - and because + * nothing checked. A broken link in the first documents a stranger reads costs + * more than the page it fails to open: it is the cheapest possible evidence + * that nobody is looking after the place. + * + * Links are resolved from the directory of the file they appear in, which is + * the whole point - that is what GitHub does, and what the old checks did not. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('node:fs'); +const path = require('node:path'); +const { execFileSync } = require('node:child_process'); + +const ROOT = path.join(__dirname, '..'); + +function trackedFiles() { + return execFileSync('git', ['ls-files'], { cwd: ROOT, encoding: 'utf8' }) + .split('\n').filter(Boolean); +} + +test('every relative link in the docs points at a file that exists', () => { + const tracked = trackedFiles(); + const markdown = tracked.filter((f) => f.endsWith('.md')); + assert.ok(markdown.length > 5, 'no markdown found - has the layout changed?'); + + const broken = []; + for (const file of markdown) { + const dir = path.dirname(path.join(ROOT, file)); + const text = fs.readFileSync(path.join(ROOT, file), 'utf8'); + + /* Skip absolute URLs, mailto:, same-page anchors and autolinks. */ + for (const m of text.matchAll(/\]\((?!https?:|mailto:|#|<)([^)\s]+)\)/g)) { + const target = m[1].split('#')[0]; + if (!target) continue; + if (fs.existsSync(path.resolve(dir, target))) continue; + const line = text.slice(0, m.index).split('\n').length; + broken.push(`${file}:${line} -> ${target}`); + } + } + + assert.deepEqual(broken, [], + 'these links 404 for anybody reading on GitHub:\n ' + broken.join('\n ') + + '\n\nLinks resolve from the directory of the file they are in. A link to ' + + '"docs/X.md" written inside docs/ means docs/docs/X.md.'); +}); + +test('a doc in docs/ does not link to itself through docs/', () => { + /* + * The specific shape of the bug above, called out by name. The generic check + * would catch it too, but only once the file is missing; this one explains + * what is wrong the moment somebody writes it, which is the difference + * between a fix and a puzzle. + */ + const offenders = []; + for (const file of trackedFiles().filter((f) => f.startsWith('docs/') && f.endsWith('.md'))) { + const text = fs.readFileSync(path.join(ROOT, file), 'utf8'); + for (const m of text.matchAll(/\]\(docs\/([^)\s]+)\)/g)) { + const line = text.slice(0, m.index).split('\n').length; + offenders.push(`${file}:${line} -> docs/${m[1]} (drop the "docs/")`); + } + } + assert.deepEqual(offenders, [], + 'these are already inside docs/, so "docs/" is one level too many:\n ' + + offenders.join('\n ')); +}); diff --git a/tests/embedded-external-link.test.js b/tests/embedded-external-link.test.js new file mode 100644 index 000000000..873060b5e --- /dev/null +++ b/tests/embedded-external-link.test.js @@ -0,0 +1,69 @@ +'use strict'; + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('node:fs'); +const path = require('node:path'); + +const ROOT = path.join(__dirname, '..'); +const FIXTURE = fs.readFileSync( + path.join(__dirname, 'fixtures', 'embedded-external-link.html'), + 'utf8', +); +const MAIN = fs.readFileSync(path.join(ROOT, 'src', 'main.js'), 'utf8'); + +function productionPopupHandler(shell) { + const handlerAt = MAIN.indexOf('mainWindow.webContents.setWindowOpenHandler('); + assert.ok(handlerAt > -1, 'the main window has no popup handler'); + const bodyOpen = MAIN.indexOf('{', MAIN.indexOf('=>', handlerAt)); + let depth = 0; + let bodyClose = -1; + for (let i = bodyOpen; i < MAIN.length; i++) { + if (MAIN[i] === '{') depth++; + if (MAIN[i] === '}' && --depth === 0) { + bodyClose = i; + break; + } + } + assert.ok(bodyClose > bodyOpen, 'the popup handler body is not balanced'); + const callback = MAIN.slice(MAIN.indexOf('(({ url }) =>', handlerAt) + 1, bodyClose + 1); + return new Function('shell', 'mainWindow', `return ${callback};`)(shell, { + webContents: { downloadURL() {} }, + }); +} + +function fixtureLinks() { + return [...FIXTURE.matchAll(/]*target="_blank"/g)].map((match) => match[1]); +} + +test('the embedded link fixture is synthetic and offline', () => { + assert.deepStrictEqual(fixtureLinks(), [ + 'https://example.com/help', + 'javascript:alert(1)', + 'file:///etc/passwd', + ]); + assert.doesNotMatch(FIXTURE, /<(script|iframe|img|link)\b/i); + assert.doesNotMatch(FIXTURE, /https?:\/\/(?!example\.com\/help)/i); +}); + +test('safe embedded links use the production external-browser path', () => { + const opened = []; + const handler = productionPopupHandler({ + openExternal: (url) => { opened.push(url); }, + }); + + assert.deepStrictEqual(handler({ url: fixtureLinks()[0] }), { action: 'deny' }); + assert.deepStrictEqual(opened, ['https://example.com/help']); +}); + +test('unsafe embedded schemes are denied without reaching the external browser', () => { + const opened = []; + const handler = productionPopupHandler({ + openExternal: (url) => { opened.push(url); }, + }); + + for (const url of fixtureLinks().slice(1)) { + assert.deepStrictEqual(handler({ url }), { action: 'deny' }, url); + } + assert.deepStrictEqual(opened, []); +}); \ No newline at end of file diff --git a/tests/escpos-columns.test.js b/tests/escpos-columns.test.js index 7f77d8349..6d8d9b1e7 100644 --- a/tests/escpos-columns.test.js +++ b/tests/escpos-columns.test.js @@ -1,6 +1,6 @@ const test = require('node:test'); const assert = require('node:assert'); -const { renderSale, COLUMNS } = require('../escpos-receipt'); +const { renderSale, COLUMNS } = require('../src/escpos-receipt'); /* * The item table is a table, and every row uses the same columns. diff --git a/tests/escpos-receipt.test.js b/tests/escpos-receipt.test.js index 5391c72db..68ff110bf 100644 --- a/tests/escpos-receipt.test.js +++ b/tests/escpos-receipt.test.js @@ -1,6 +1,6 @@ const test = require('node:test'); const assert = require('node:assert'); -const { renderSale, COLUMNS } = require('../escpos-receipt'); +const { renderSale, COLUMNS } = require('../src/escpos-receipt'); /* * A receipt is only correct if it fits the paper, and the paper is the one diff --git a/tests/escpos-report.test.js b/tests/escpos-report.test.js index c5d8447f2..400290365 100644 --- a/tests/escpos-report.test.js +++ b/tests/escpos-report.test.js @@ -1,6 +1,6 @@ const test = require('node:test'); const assert = require('node:assert'); -const { renderReport, COLUMNS } = require('../escpos-report'); +const { renderReport, COLUMNS } = require('../src/escpos-report'); /* * A cash-up slip has to fit the roll and say the right things in the right diff --git a/tests/executable-scripts.test.js b/tests/executable-scripts.test.js new file mode 100644 index 000000000..97098ce95 --- /dev/null +++ b/tests/executable-scripts.test.js @@ -0,0 +1,76 @@ +'use strict'; + +/* + * Every shell script cron runs must be committed executable. + * + * WHAT HAPPENED, so nobody removes this as pedantry. + * + * On 1 September 2026 a deploy overwrote ops/backup/backup.sh with the copy + * from git, which was mode 100644. cron could no longer run it, and wrote + * "Permission denied" into a log nobody reads. Backups for the machine holding + * every real customer shop stopped for THIRTY-NINE HOURS - six missed runs - + * and the only reason anyone found out is that the watchdog built the week + * before sent an email. + * + * The cause is that these files are authored on Windows, where git's + * core.fileMode is false: the executable bit is not tracked, so a script + * created there is committed 644 no matter how it looks locally. chmod +x on + * the server fixes it until the next deploy overwrites it again. + * + * A test rather than a convention, because the failure is silent on the + * machine that matters and invisible in review. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const { execFileSync } = require('child_process'); +const path = require('path'); + +const REPO = path.join(__dirname, '..'); + +function tracked(pattern) { + const out = execFileSync('git', ['ls-files', '-s', pattern], { + cwd: REPO, encoding: 'utf8', + }); + return out.split('\n').filter(Boolean).map((line) => { + const [mode, , , file] = line.split(/\s+/); + return { mode, file }; + }); +} + +test('every committed shell script is executable', () => { + const scripts = tracked('*.sh'); + assert.ok(scripts.length > 0, 'no shell scripts found - has the layout changed?'); + + const notExecutable = scripts.filter((s) => s.mode !== '100755').map((s) => s.file); + assert.deepEqual(notExecutable, [], + 'these are committed 100644 and will fail the moment cron or a deploy runs them:\n ' + + notExecutable.join('\n ') + + '\n\nFix with: git update-index --chmod=+x '); +}); + +test('scripts with a shebang are executable too', () => { + /* + * Not every runnable script ends in .sh. A Node script cron invokes directly + * needs the same bit, and the extension will not tell you. + */ + const fs = require('fs'); + const all = execFileSync('git', ['ls-files', '-s'], { cwd: REPO, encoding: 'utf8' }) + .split('\n').filter(Boolean) + .map((line) => { const [mode, , , file] = line.split(/\s+/); return { mode, file }; }); + + const offenders = []; + for (const { mode, file } of all) { + if (mode !== '100644') continue; + if (/node_modules|\.min\./.test(file)) continue; + let head = ''; + try { + head = fs.readFileSync(path.join(REPO, file), 'utf8').slice(0, 40); + } catch (e) { continue; } + /* A shebang is a statement that this file is meant to be executed. */ + if (head.startsWith('#!')) offenders.push(file); + } + + assert.deepEqual(offenders, [], + 'these declare a shebang but are committed non-executable:\n ' + offenders.join('\n ')); +}); diff --git a/tests/feature-detail-copy.test.js b/tests/feature-detail-copy.test.js new file mode 100644 index 000000000..d1809c22f --- /dev/null +++ b/tests/feature-detail-copy.test.js @@ -0,0 +1,167 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +/* + * The feature detail dialogs (FEATURE_PAGES_DESIGN). + * + * Every Core feature opens like a marketplace listing. Nine of them opened with + * nothing but their one-line card description, which reads as unfinished rather + * than as "no detail available" - so the copy was written on 2026-08-21. + * + * These tests exist for the two ways that copy can be wrong in a way nobody + * notices: a feature that has no entry at all, and a `section` anchor naming a + * markup block that does not exist. The renderer guards the second with + * $(info.section).length, so an invented anchor breaks nothing and sits there + * reading as wired - which is precisely why it needs a test rather than a + * glance. The first draft of this copy invented SEVEN of them. + */ + +const ROOT = path.join(__dirname, '..'); +const settingsJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'settings.js'), + 'utf8', +); +const settingsHtml = fs.readFileSync( + path.join(ROOT, 'frontend', 'modules', 'settings_write.html'), + 'utf8', +); + +const infoBlock = (() => { + const at = settingsJs.indexOf('PosnicPro.settings.featureInfo = {'); + assert.notStrictEqual(at, -1, 'featureInfo is gone'); + return settingsJs.slice(at, settingsJs.indexOf('\n};', at)); +})(); + +const introKeys = (() => { + const at = settingsJs.indexOf('INTRO:'); + assert.notStrictEqual(at, -1, 'the feature INTRO list is gone'); + const block = settingsJs.slice(at, settingsJs.indexOf('\n ],', at)); + return [...block.matchAll(/\['([a-z_0-9]+)',/g)].map((m) => m[1]); +})(); + +const infoKeys = [...infoBlock.matchAll(/^ {4}([a-z_0-9]+): \{/gm)].map((m) => m[1]); + +test('every feature on the intro list has detail copy', () => { + /* A dialog that opens with only its one-line card description reads as + unfinished software, not as a feature with little to say. */ + assert.ok(introKeys.length >= 14, 'the intro list shrank unexpectedly'); + const missing = introKeys.filter((k) => !infoKeys.includes(k)); + assert.deepStrictEqual(missing, [], `these features open with no detail: ${missing.join(', ')}`); +}); + +test('every entry actually says something', () => { + for (const key of infoKeys) { + const at = infoBlock.indexOf(` ${key}: {`); + const entry = infoBlock.slice(at, infoBlock.indexOf('\n },', at)); + assert.match(entry, /tagline: '[^']{20,}'/, `${key} has no usable tagline`); + assert.match(entry, /about: '[^']{60,}'/, `${key} has no usable About text`); + assert.match(entry, /benefits: \[/, `${key} lists no benefits`); + assert.match(entry, /how: \[/, `${key} does not say how to use it`); + } +}); + +test('the guide adopts NOTHING - configuration lives in the sidebar, once', () => { + /* + * THE ONE SYSTEM, the owner's rule: "if user clicks on the feature box then + * show only details or guide... every feature should have its own left + * side." The old dialog adopted each feature's config form into itself, + * which made Demo Data configure one way and Tax another. Adoption is gone; + * a `section:` key reappearing means the second door is being rebuilt. + */ + assert.ok(!/section: '#fc_/.test(infoBlock), 'a feature adopts config into the guide again'); + assert.ok(!settingsJs.includes('_fpReturnSection'), 'the adoption machinery is back'); +}); + +test('every configurable feature names its sidebar home, and the home exists', () => { + /* FEATURE_HOME maps feature key -> [route, label]. The route must have a + real pane, or the Configure link walks into a wall. */ + const homeBlock = settingsJs.slice( + settingsJs.indexOf('PosnicPro.settings.FEATURE_HOME = {'), + settingsJs.indexOf('};', settingsJs.indexOf('PosnicPro.settings.FEATURE_HOME = {')), + ); + const routes = [...new Set([...homeBlock.matchAll(/\['([a-z_0-9]+)',/g)].map((m) => m[1]))]; + assert.ok(routes.length >= 10, 'the Configure map lost its entries: ' + routes.length); + for (const r of routes) { + assert.ok( + settingsHtml.includes(`id="v-pills-${r}"`), + `#/settings/${r} is a Configure target but no pane v-pills-${r} exists`, + ); + } + /* and the guide renders the link from the map */ + assert.match(settingsJs, /FEATURE_HOME\[key\]/); + assert.match(settingsJs, /fp-configure-link/); +}); + +test('the moved config stores kept their markup - one pane per feature', () => { + /* Demo Data, Quotes and Till PIN got their own panes and sidebar entries; + Workforce and Restaurant folded into the pages they already had. */ + for (const id of ['fc_demodata', 'fc_quotes', 'fc_tillpin', 'fc_workforce', 'fc_restaurant']) { + assert.ok(settingsHtml.includes(`id="${id}"`), `#${id} markup lost in the move`); + } + const sidebar = fs.readFileSync( + path.join(__dirname, '..', 'frontend', 'layouts', 'sidebar.html'), 'utf8'); + for (const li of ['manage_li_demodata', 'manage_li_quotes', 'manage_li_tillpin']) { + assert.ok(sidebar.includes(`id="${li}"`), `${li} missing from the Manage sidebar`); + } +}); + +/* + * Screenshots by convention. + * + * The owner has to take these - they are pictures of his running shop. Every + * other part is built so that dropping a file in + * static/images/features/-1.png is his only remaining action. + */ +test('a feature with no screenshot costs ONE failed request, not three', () => { + /* The first version rendered -1, -2 and -3 speculatively. That is three 404s + every time a dialog opens for a feature with no images - which is every + feature today - on the same day spent removing wasted requests. Asking for + the next only after the current one LOADS makes the chain self-extending + and the empty case cheap. */ + const render = settingsJs.slice(settingsJs.indexOf('var shots = info.shots || [];')); + const block = render.slice(0, render.indexOf("infoHtml += '
    About")); + const probes = (block.match(/static\/images\/features\//g) || []).length; + assert.strictEqual(probes, 1, 'more than one screenshot path is requested up front'); + assert.match(block, /onload="PosnicPro\.settings\._shotNext\(this\);"/, 'the chain never extends'); + assert.match(block, /data-shot-key=/, 'the next probe has no key to build a path from'); +}); + +test('a missing screenshot leaves no trace', () => { + /* Otherwise a feature with no images keeps a broken-image icon, or an empty + 14px strip with a scroll container holding nothing. */ + const fn = settingsJs.slice(settingsJs.indexOf('PosnicPro.settings._shotMissing = function')); + const body = fn.slice(0, fn.indexOf('\n};')); + assert.match(body, /\$\(img\)\.remove\(\)/, 'the broken frame stays'); + assert.match(body, /if \(!\$strip\.find\('img'\)\.length\) \{ \$strip\.remove\(\); \}/, 'the empty strip stays'); +}); + +test('the probe chain cannot run away', () => { + /* It is driven by the server answering 200. A directory that somehow served + every name would ask forever. */ + const fn = settingsJs.slice(settingsJs.indexOf('PosnicPro.settings._shotNext = function')); + const body = fn.slice(0, fn.indexOf('\n};')); + assert.match(body, /n >= PosnicPro\.settings\.MAX_SHOTS/, 'nothing caps the chain'); + assert.match(body, /data-shot-n="' \+ \(n \+ 1\) \+ '"\]'\)\.length\) \{ return; \}/, 'a re-fired onload would duplicate frames'); +}); + +test('an explicit shots list still wins', () => { + /* Anything that does not fit the naming must remain expressible. */ + const render = settingsJs.slice(settingsJs.indexOf('var shots = info.shots || [];')); + const block = render.slice(0, render.indexOf("infoHtml += '
    About")); + assert.match(block, /if \(shots\.length\) \{[\s\S]*\} else if \(key\) \{/, 'the convention must be the FALLBACK, not the rule'); +}); + +test('the drop folder documents itself', () => { + /* A convention nobody can find is not a convention. */ + const readme = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'images', 'features', 'README.md'), + 'utf8', + ); + assert.match(readme, /8:5/, 'the required aspect is not stated'); + assert.match(readme, /cropped to fit/i, 'it must warn that another ratio is cropped, not letterboxed'); + for (const key of ['quotes_enable', 'module_themes_enable']) { + assert.ok(readme.includes(`${key}-1.png`), `${key} is not listed as a filename to add`); + } +}); diff --git a/tests/feature-pairing.test.js b/tests/feature-pairing.test.js new file mode 100644 index 000000000..e762e9a8e --- /dev/null +++ b/tests/feature-pairing.test.js @@ -0,0 +1,110 @@ +'use strict'; + +/* + * Quotes and Invoices are two halves of one job. + * + * Owner: "when invoice toggle on, suggest user to switch on quote also. its + * useful. if he said yes then switch on that too." + * + * A shop that prices work before doing it also bills for it afterwards. The + * quote is the promise, the invoice is the claim, and the same customer sees + * both - but somebody who finds one switch has usually not thought about the + * other, and discovers it months later or never. + * + * The risk in a suggestion is that it becomes nagging, and nagging is not + * reported: people just close it more angrily each time. So the three rules + * that keep it an offer are pinned here. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..'); +const settingsJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'settings.js'), 'utf8'); +const settingsHtml = fs.readFileSync( + path.join(ROOT, 'frontend', 'modules', 'settings_write.html'), 'utf8'); + +const suggest = (() => { + const at = settingsJs.indexOf('PosnicPro.settings.suggestPartner = function'); + assert.ok(at > -1, 'suggestPartner is missing'); + return settingsJs.slice(at, settingsJs.indexOf('\n};', at)); +})(); + +test('both switches exist to be paired', () => { + /* A pairing that names a switch which is not there does nothing, quietly. */ + assert.match(settingsHtml, /id="quotes_enable"/); + assert.match(settingsHtml, /id="invoices_enable"/); +}); + +test('each switch offers the other, in both directions', () => { + const pairs = settingsJs.slice(settingsJs.indexOf('PosnicPro.settings._partners = {')); + assert.match(pairs, /quotes_enable: \{[\s\S]*?other: 'invoices_enable'/); + assert.match(pairs, /invoices_enable: \{[\s\S]*?other: 'quotes_enable'/); +}); + +test('it only offers on the way ON', () => { + /* Switching Invoices OFF says nothing about Quotes, and asking then would be + a question about something the person did not do. */ + assert.match(suggest, /if \(!pair \|\| !checkbox\.checked\) return;/, + 'the suggestion is not limited to turning a switch on'); +}); + +test('it only offers when the other is actually off', () => { + assert.match(suggest, /\$other\.is\(':checked'\)\) return;/, + 'it would offer a switch that is already on'); + assert.match(suggest, /if \(!\$other\.length/, + 'a missing switch should be ignored rather than half-handled'); +}); + +test('"Not now" is an answer, and is not asked again', () => { + /* + * The rule that separates a suggestion from nagging. Toggling a switch off + * and on again must not re-open the question somebody already declined. + */ + assert.match(suggest, /_partnerAsked\[checkbox\.id\]\) return;/, + 'declining is not remembered, so the question repeats'); + assert.match(suggest, /_partnerAsked\[checkbox\.id\] = true;/, + 'the asked flag is never set'); +}); + +test('saying yes flips the other switch through the same path as a click', () => { + /* + * .trigger('change') rather than setting the property alone: the change + * handler is what marks the form dirty and repaints the card. Setting the + * box quietly would leave a switch that looks on and saves off. + */ + assert.match(suggest, /\$other\.prop\('checked', true\)\.trigger\('change'\)/, + 'the partner switch is set without going through the change handler'); +}); + +test('cancelling cannot become an unhandled rejection', () => { + /* SweetAlert v6 REJECTS on cancel. Without a second handler, "Not now" is an + unhandled rejection on a screen where nothing went wrong - the same trap + confirmDemoOff documents a few lines below. */ + const then = suggest.slice(suggest.indexOf('}).then(')); + assert.match(then, /\}\)\.then\(function \(\) \{[\s\S]*?\}, function \(\) \{/, + 'the cancel path has no handler'); +}); + +test('turning the partner on cannot start a loop', () => { + /* + * Yes -> partner.trigger('change') -> the handler calls suggestPartner for + * the PARTNER, whose own partner is the switch just turned on. That returns + * at the already-checked guard. Asserted because the guard order is what + * makes it terminate, and reordering it would loop. + */ + const checkedGuard = suggest.indexOf("$other.is(':checked')"); + const trigger = suggest.indexOf(".trigger('change')"); + assert.ok(checkedGuard > -1 && trigger > checkedGuard, + 'the already-on guard must come before the trigger, or the two switches ask each other forever'); +}); + +test('the change handler actually calls it', () => { + /* A suggestion nothing invokes is the shape of bug this repository keeps + finding. */ + assert.match(settingsJs, /PosnicPro\.settings\.suggestPartner\(this\);/, + 'nothing calls suggestPartner, so no offer is ever made'); +}); diff --git a/tests/filter-bar-adoption.test.js b/tests/filter-bar-adoption.test.js new file mode 100644 index 000000000..9384aff41 --- /dev/null +++ b/tests/filter-bar-adoption.test.js @@ -0,0 +1,211 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +/* + * The shared filter bar on the three busiest lists. + * + * list-filter.js was written "because it is going on every list - quotes, + * items, sales, purchases" and for a long time only quotes had it. The five + * controls it replaces worked, but could not say a filter was ON: the panel + * closes and takes them with it, so a list narrowed to one supplier looks + * exactly like a shop with one supplier, and the next person reports the list + * as broken. + * + * Nine other lists still use the old pattern. That is deliberate and recorded - + * these three carry the traffic, and a migration is worth doing in one piece + * per screen rather than half-done across twelve. + */ + +const ROOT = path.join(__dirname, '..'); +const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8'); + +const lf = read('frontend', 'static', 'script', 'js', 'core', 'list-filter.js'); + +const SCREENS = [ + { + /* items moved to the master-detail standard (2026-08-27): same key, + same header controls, list fed by loadList. */ + key: 'items', + idPrefix: 'items', + html: read('frontend', 'modules', 'items.html'), + js: read('frontend', 'static', 'script', 'js', 'modules', 'js', 'items.js'), + }, + { + /* sales history moved to the master-detail standard (2026-08-27). */ + key: 'sales', + idPrefix: 'sales', + html: read('frontend', 'modules', 'sales_read.html'), + js: read('frontend', 'static', 'script', 'js', 'modules', 'js', 'sales.js'), + }, + { + /* Purchase History retired (2026-08-27): the bar's 'receivings' key + lives on, mounted by the ONE purchases surface whose controls carry + the purchases_ prefix. */ + key: 'receivings', + idPrefix: 'purchases', + html: read('frontend', 'modules', 'purchaseOrders.html'), + js: read('frontend', 'static', 'script', 'js', 'modules', 'js', 'receiving_add.js'), + }, +]; + +test('each list has the bar mounted with a panel and a button', () => { + for (const s of SCREENS) { + const prefix = s.idPrefix || s.key; + assert.match(s.html, new RegExp(`id="${prefix}_filter_panel"`), `${s.key}: no filter panel`); + assert.match(s.html, new RegExp(`id="${prefix}_filter_btn"`), `${s.key}: no filter button`); + assert.match( + s.js, + new RegExp(`key: '${s.key}'`), + `${s.key}: the bar is never mounted`, + ); + } +}); + +test('the old controls are REMOVED, not merely hidden', () => { + /* Leaving #view_items_input in the markup with nothing writing to it is + exactly how the quotes search bug worked: a selector that still reads, + from an input nobody can see. */ + for (const s of SCREENS) { + for (const suffix of ['_input', '_fields']) { + assert.ok( + !new RegExp(`id="view_${s.key}${suffix}"`).test(s.html), + `${s.key}: view_${s.key}${suffix} is still in the markup`, + ); + } + assert.ok( + !/onclick="PosnicPro\.search\(/.test(s.html), + `${s.key}: the old Apply button survives alongside the bar`, + ); + } +}); + +test('the sales date-range element is kept on purpose', () => { + /* Twenty other modules read THIS element to label their own empty states - + "No Records on " - because it carries .daterange-timepicker-all. + Deleting it with the rest of the old filter row would not have broken + Sales History; it would have put "No Records on undefined" on twenty + screens that are not being migrated. */ + const sales = SCREENS.find((s) => s.key === 'sales'); + assert.match( + sales.html, + /id="view_sales_daterange"/, + 'removing this breaks the empty state of twenty other modules', + ); + const readers = fs + .readdirSync(path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js')) + .filter((f) => f.endsWith('.js')) + .filter((f) => + read('frontend', 'static', 'script', 'js', 'modules', 'js', f).includes( + '#view_sales_daterange span span' + ) + ); + assert.ok( + readers.length > 5, + 'the cross-screen dependency this element serves has gone - the note above it is now wrong', + ); +}); + +test('the bar writes the blob these endpoints already took', () => { + /* The lists keep loading exactly as before; only where the filter comes from + changed. Rewriting how they load at the same time would make a regression + impossible to attribute. */ + for (const s of SCREENS) { + const at = s.js.indexOf(`key: '${s.key}'`); + /* the purchases surface's loadList sits farther from its mount config */ + const body = s.js.slice(at, at + (s.idPrefix ? 12000 : 1600)); + assert.match(body, /legacyFilters\(/, `${s.key}: does not translate to the filters blob`); + if (s.idPrefix) { + /* the purchases surface has no DataTable: the bar's onChange reloads + page 1 and the fetch carries the same blob in its query */ + assert.match(body, /load(?:List|History)\(1\)/, `${s.key}: a filter change must land on page 1`); + assert.match(body, /filters: JSON\.stringify/, `${s.key}: never sends the filter`); + } else { + assert.match(body, /data\('filters', JSON\.stringify/, `${s.key}: never applies the filter`); + assert.match(body, /current_page', 1/, `${s.key}: stays on a page the new filter may not have`); + } + } +}); + +test('the translation reproduces the regex search() built', () => { + /* Adopting the bar must not silently change which rows a shop's existing + habits return. search() matched all tokens in any order; Exact means the + whole value. */ + const at = lf.indexOf('legacyFilters: function'); + assert.notStrictEqual(at, -1, 'legacyFilters is gone'); + const body = lf.slice(at, lf.indexOf('\n },', at)); + assert.match(body, /\(\?=\.\*/, 'the all-tokens lookahead is gone - search results will change'); + assert.match(body, /'\^' \+/, 'Exact no longer anchors, so it matches values CONTAINING the term'); + /* BOTH branches, checked at their own call sites. A bare /_escapeRegex/ + match survived a mutation that unescaped both real uses, because a third + use in the fallback below them kept the word present. */ + assert.match( + body, + /'\(\?=\.\*' \+ LF\._escapeRegex\(t\)/, + 'the token search puts user input into a regex unescaped', + ); + assert.match( + body, + /'\^' \+ LF\._escapeRegex\(term\) \+ '\$'/, + 'Exact puts user input into a regex unescaped', + ); + /* The date column is the caller's: these lists do not agree on it, and + guessing filters the wrong column while looking like it worked. */ + assert.match(body, /opts && opts\.dateKey/, 'the date column is guessed rather than given'); +}); + +test('sales does not fight its own KOT rule', () => { + /* salesTable re-applies sale_process $ne KOT on top of whatever is filtered. + A bar that also wrote that key would have the two arguing over one field. */ + const sales = SCREENS.find((s) => s.key === 'sales'); + const at = sales.js.indexOf("key: 'sales'"); + const body = sales.js.slice(at, at + 1600); + assert.ok( + !/sale_process/.test(body), + 'the sales bar writes sale_process, which salesTable also owns', + ); +}); +test('the customer typeahead asks the server, not a cache of ten', () => { + /* + * The reported bug: the picker said "Nothing matches" for a customer whose + * quotes were listed directly underneath it. + * + * LF.suggest filters `rows`, which is recents plus PosnicPro.sales + * ._customerSeed - and that seed is the FIRST TEN customers, fetched only by + * renderRecentCustomers on the SALE screen. On the quotes page nothing calls + * it, so the seed is null and the suggestions are recents alone, while the + * list beside it queries the server properly. + * + * A suggestion box that disagrees with the results it sits on top of is + * worse than no suggestion box. + */ + const at = lf.indexOf('customer: {'); + assert.notStrictEqual(at, -1, 'the customer entity is gone'); + const entity = lf.slice(at, lf.indexOf('item: {', at)); + assert.match(entity, /lookup: function/, 'the customer entity still cannot ask the server'); + assert.match(entity, /getCustomersAjaxList/, 'it does not use the real customer search endpoint'); + assert.match(entity, /encodeURIComponent/, 'the typed term is not encoded - a name with & breaks the query'); + /* Offline must not raise an error popup over a filter panel. */ + assert.match(entity, /function \(\) \{ done\(\[\]\); \}/, 'a failed lookup has no quiet fallback'); +}); + +test('a slow suggestion reply cannot overwrite a newer one', () => { + /* Type "Cus" then "Custom": without a sequence guard the older answer can + land last and leave the wrong list on screen. */ + const at = lf.indexOf('LF.typeahead = function'); + const body = lf.slice(at, lf.indexOf('LF.paintTypeahead = function')); + assert.match(body, /_taSeq/, 'there is no sequence guard on the lookup'); + assert.match(body, /if \(mine !== m\._taSeq\) return;/, 'a stale reply is not dropped'); +}); + +test('cached rows still paint immediately', () => { + /* The server answer merges in when it lands; the box must not go blank + waiting for it, or every keystroke flickers. */ + const at = lf.indexOf('LF.typeahead = function'); + const body = lf.slice(at, lf.indexOf('LF.paintTypeahead = function')); + const lookupAt = body.indexOf('e.lookup('); + const paintAt = body.lastIndexOf('LF.paintTypeahead(key, e, rows)'); + assert.ok(paintAt > lookupAt, 'the cached rows are not painted after the lookup is dispatched'); + assert.match(lf, /LF\.paintTypeahead = function/, 'painting was not split out, so a late reply cannot repaint'); +}); diff --git a/tests/first-run-welcome.test.js b/tests/first-run-welcome.test.js new file mode 100644 index 000000000..35e5fcb77 --- /dev/null +++ b/tests/first-run-welcome.test.js @@ -0,0 +1,639 @@ +/* + * The welcome a new shop sees once. + * + * Owner ask: "First time when user logs in to system, show verynicely wellcome + * message, tell him we enabled default feature, if he wants enable features, + * later also enable." + * + * WHAT THESE TESTS ARE PROTECTING + * + * Everything here fails SILENTLY when it breaks. A welcome that never shows + * looks exactly like a product with no welcome. A welcome that shows twice + * looks like a bug nobody reports because they just close it. A flag dropped + * from the settings blob brings it back for somebody who dismissed it a month + * ago. None of that produces an error anywhere. + * + * So the assertions are about the GUARDS, not the appearance - and each one + * was checked by mutating the guard away and confirming the test goes red. + */ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const root = path.join(__dirname, '..'); +const settingsJs = fs.readFileSync( + path.join(root, 'frontend/static/script/js/modules/js/settings.js'), 'utf8'); +const modalHtml = fs.readFileSync( + path.join(root, 'frontend/modals/feature_intro.html'), 'utf8'); +const customCss = fs.readFileSync( + path.join(root, 'frontend/static/style/css/custom.css'), 'utf8'); +const settingModel = fs.readFileSync( + path.join(root, 'api/src/models/setting.model.js'), 'utf8'); +const settingsGroups = fs.readFileSync( + path.join(root, 'api/src/services/settings-groups.js'), 'utf8'); + +/* + * Prose that names a guard reads exactly like the guard. Two tests in this repo + * have passed against their own explanatory comment while the code they claimed + * to check had been deleted, so every assertion below runs on stripped source. + */ +function stripComments(source) { + return source + .replace(/\/\*[\s\S]*?\*\//g, '') + .replace(/^[ \t]*\/\/.*$/gm, '') + .replace(//g, ''); +} + +const settingsCode = stripComments(settingsJs); +const modalCode = stripComments(modalHtml); +const cssCode = stripComments(customCss); +const modelCode = stripComments(settingModel); +const groupsCode = stripComments(settingsGroups); + +/* The block that decides whether the welcome opens at all. Bounded by name + rather than by brace-matching: the object holds arrow defaults and + destructured parameters, and a naive brace count returns a few characters. */ +function block(source, name, until) { + const start = source.indexOf(name); + assert.ok(start > -1, name + ' not found'); + const end = source.indexOf(until, start); + assert.ok(end > start, until + ' not found after ' + name); + return source.slice(start, end); +} + +test('the database field is the ONLY gate - no browser-side memory', () => { + const gate = block(settingsCode, 'maybeShowIntro:', 'renderIntro:'); + + /* + * Owner, after three rounds of this screen not appearing for him: "keep + * on db field and make sure user know about it." Every browser-side + * memory this gate ever had has burned it - the bare key, then the + * per-shop key. first_run_decided lives on the SHOP, is written only by + * the two decision paths, and can be read and reset with a one-line + * database query when somebody asks why a welcome did or did not show. + */ + assert.ok(!/local\.get\([^)]*intro[^)]*\)/i.test(gate), + 'the gate is reading browser storage again'); + assert.ok(!settingsCode.includes('_introSeenKey'), + 'the retired browser-key helper is back'); + assert.match(gate, /first_run_decided === true \|\| \w+\.first_run_decided === 'true'/); +}); + +test('an unloaded settings blob is not treated as a shop that has never been asked', () => { + const gate = block(settingsCode, 'maybeShowIntro:', 'renderIntro:'); + /* + * The failure this prevents: settings have not arrived yet, every key reads + * absent, and a shop trading for a year is greeted with "your shop is + * ready". Absent must mean "do not know", never "new". + */ + /* return FALSE, not bare return: it is the one outcome that means "not + loaded yet", and the poll below retries only on it. */ + /* An empty blob now FETCHES the truth instead of waiting for a login + flow to leave it behind - shadow sessions (the owner's My Account + door) never run that flow, so wait-for-blob waited forever on exactly + his sessions. The fetch is guarded to one in flight, merges into the + blob for the whole app, and the branch still returns false so the + poll survives a failed read. */ + /* The fetch must be REACHABLE (a disabled guard leaves wait-forever in + place while the strings still match - mutation found exactly that), + and its success must RE-RUN the gate, or the fetched truth decides + nothing until the next poll tick. */ + const empty = gate.slice(gate.indexOf('if (!Object.keys(blob).length)'), + gate.indexOf('renderIntro') > -1 ? undefined : undefined); + assert.match(empty, /if \(!PosnicPro\.features\._fetchingGate\) \{/); + /* getOneStore, never the group resolver: the resolver's read-time + defaults (absent = on) merged into the blob once, the welcome rendered + all-on from them, and the owner's own Save persisted the poison. The + branch document carries the installer's EXPLICIT values. */ + assert.match(empty, /branches\/getOneStore/); + assert.ok(!/settings\/group\/features/.test(empty), + 'the gate is merging resolver-defaulted values again'); + assert.match(empty, /!== false && d\[k\] !== 'false'/); + assert.match(empty, /PosnicPro\.features\.maybeShowIntro\(\);/); + assert.match(empty, /return false;/); +}); + +test('the check polls until settings load, instead of firing once and giving up', () => { + /* + * On a brand-new shop's FIRST login the blob is still being written when + * a fixed delay fires. A one-shot check loses that race on exactly the + * login this screen exists for, and nothing looks wrong afterwards - the + * shop simply appears to have no welcome. + */ + const boot = settingsCode.slice(settingsCode.indexOf('var poll = function')); + assert.match(boot, /maybeShowIntro\(\) === false/); + assert.match(boot, /tries < \d+/); + /* and giving up says so - the third silent build earned this line */ + assert.match(boot, /\[welcome\] not shown: settings or permissions never loaded/); + assert.match(boot, /setTimeout\(poll, \d+\)/); +}); + +test('there is NO identity gate - the DB field decides, nothing else', () => { + /* + * Owner, fourth round: "keep on db field and make sure user know about + * it." Every identity check this gate carried refused HIM: the ACL shape + * test refused owner-class users whose full access is an empty map, and + * the usertype bypass then read localStorage that shadow sessions - his + * My Account door - never wrote. The server refusing an unauthorised + * SAVE was always the real guard; the gate pretending to pre-judge it + * only ever produced silent refusals of the wrong people. + */ + const gate = block(settingsCode, 'maybeShowIntro:', 'renderIntro:'); + assert.ok(!/userACL|usertype|isAdmin/.test(gate), + 'an identity check crept back into the welcome gate'); +}); + +test('only a DECISION ends the welcome - a casual dismissal brings it back', () => { + /* + * Owner, escalating: "until skip you keep showing the features as first + * page." The first design marked any close as asked; he overruled it, + * and he is right about who this screen is for - a brand-new user who + * Escapes a dialog they did not read has not learned that features are + * switchable, which is the entire point. Save and the explicit skip paths + * write the flags; Esc and a stray click write NOTHING, and the welcome + * returns next login. + */ + const gate = block(settingsCode, 'maybeShowIntro:', 'runningContext:'); + /* No dismiss handler at all now: an undecided close leaves NOTHING, and + the DB flag written by Save / "Use defaults" is the entire record. */ + assert.ok(!/hidden\.bs\.modal/.test(gate), + 'a dismiss handler is writing browser state again'); + + // The explicit skip path is the decision that writes both flags. + const skip = block(settingsCode, "'#feature_intro_skip', function", "'#fi_module_demo_data_enable'"); + assert.match(skip, /_decided = true/); + assert.match(skip, /_tourAfterSave = false/); + assert.match(skip, /saveIntro\(\)/); + assert.ok(!/data-dismiss|modal\('hide'\)/.test(skip), + 'Use defaults is closing without the save path'); + const close = block(settingsCode, "'#feature_intro_close', function", "'change', '#fi_module_demo_data_enable'"); + assert.match(close, /_decided = true/); + assert.match(close, /saveIntro\(\)/); +}); + +test('the welcome opens OVER the features page', () => { + /* "first the first time login or until skip you keep showing the + features as first page" - whichever way the dialog closes, the person + is standing in front of the switches it was talking about. */ + const gate = block(settingsCode, 'maybeShowIntro:', 'runningContext:'); + assert.match(gate, /hasher\.setHash\('settings\/modules'\)/); +}); + +test('saving writes the flag in the same request as the switches', () => { + const save = block(settingsCode, 'saveIntro:', '$(document).on('); + /* + * A separate call could succeed while the toggles failed, and the shop + * would then never again be offered switches it did not manage to save. + */ + assert.match(save, /payload\.first_run_done = true;/); + assert.match(save, /payload\.first_run_decided = true;/); + assert.match(save, /url: 'settings\/group\/features'/); +}); + +test('the flag survives every rebuild of the settings blob', () => { + /* + * general_settings is rebuilt from scratch in several places and those + * literals do not merge - a key left out is LOST, and losing this one + * shows the welcome again to somebody who dismissed it a month ago. + * + * Written as a sweep over every writer rather than as a count, so a blob + * rebuild added next year fails here instead of silently dropping it. + */ + const writers = []; + const re = /local\.set\('general_settings'/g; + let m; + while ((m = re.exec(settingsCode)) !== null) { writers.push(m.index); } + assert.ok(writers.length >= 4, 'expected several blob writers, found ' + writers.length); + + for (const at of writers) { + // The object being stringified is built immediately above the write. + const preceding = settingsCode.slice(Math.max(0, at - 2500), at); + assert.match(preceding, /first_run_done/, + 'a general_settings write at offset ' + at + ' does not carry first_run_done'); + } +}); + +test('an API that does not send the flag cannot erase a known one', () => { + const keep = block(settingsCode, 'keepFirstRunFlag:', 'maybeShowIntro:'); + // Explicit values win; undefined falls back to what we already knew. + // Generalised to a key argument so first_run_decided rides the same rule. + assert.match(keep, /d\[k\] === true \|\| d\[k\] === 'true'\) \{ return true; \}/); + assert.match(keep, /d\[k\] === false \|\| d\[k\] === 'false'\) \{ return false; \}/); + assert.match(keep, /return PosnicPro\.features\._blob\(\)\[k\] === true;/); + + // And every blob rebuild carries BOTH flags - losing decided re-shows the + // welcome to somebody who genuinely decided. + const carried = settingsCode.match(/first_run_decided: PosnicPro\.features\.keepFirstRunFlag\(/g) || []; + assert.ok(carried.length >= 3, 'expected the decided flag in every blob rebuild, found ' + carried.length); +}); + +test('the shop is greeted by name, and never by the string null', () => { + const render = block(settingsCode, 'renderIntro:', 'saveIntro:'); + /* localStorage.getItem hands back the STRING "null" for a key written as + null, which is how a header once read "null null". */ + assert.match(render, /=== 'null' \|\| \w+ === 'undefined'/); + assert.match(render, /feature_intro_sub/); +}); + +test('the lead sentence is true for a shop with everything already on', () => { + const render = block(settingsCode, 'renderIntro:', 'saveIntro:'); + /* + * A shop created before the new defaults has every feature enabled. + * Telling it "everything else is off" while it looks at a full menu is + * plainly false, so the sentence is chosen from the switches themselves. + */ + assert.match(render, /anyOff/); + assert.match(render, /=== false \|\| \w+\[f\[0\]\] === 'false'/); + assert.match(render, /feature_intro_lead/); +}); + +test('the welcome panel takes its colours from the theme, not from Bootstrap', () => { + /* + * Bootstrap paints .modal-content white from its own stylesheet. Without an + * explicit token background, the first thing a shop on a dark preset sees + * is a white flashbang with unreadable text - which is the exact complaint + * the sale grid had. + */ + const panel = block(cssCode, '.modal-content.first-run', '.first-run-head'); + assert.match(panel, /background: var\(--theme-card-bg/); + assert.match(panel, /color: var\(--theme-text-primary/); + + const firstRunCss = cssCode.slice(cssCode.indexOf('.modal-content.first-run')); + const hardCoded = firstRunCss.match(/(?:background|color|border-color):\s*#[0-9a-fA-F]{3,8}/g) || []; + assert.deepStrictEqual(hardCoded, [], + 'the welcome must not hard-code colours: ' + hardCoded.join(', ')); +}); + +test('the feature list scrolls so the buttons stay reachable', () => { + /* Eleven features on a 768px-tall till push Save off the bottom of the + screen, and a Save nobody can reach is the same as no Save. */ + const list = block(cssCode, '.first-run-list', '.first-run-row {'); + assert.match(list, /max-height/); + assert.match(list, /overflow-y: auto/); +}); + +test('a long description cannot push the switch off the edge', () => { + const rowText = block(cssCode, '.first-run-row-text {', '.first-run-row-text b'); + // A flex item defaults to min-width:auto and refuses to shrink below its + // longest word. + assert.match(rowText, /min-width: 0/); + const sw = block(cssCode, '.first-run-switch', '.first-run-foot'); + assert.match(sw, /flex: 0 0 auto/); +}); + +test('the modal markup carries what the code paints into', () => { + for (const id of ['feature_intro_modal', 'feature_intro_sub', 'feature_intro_lead', + 'feature_intro_demo_yes', 'feature_intro_demo_no', 'feature_intro_locale_form', + 'feature_intro_country', 'feature_intro_state', 'feature_intro_currency', + 'feature_intro_timezone', 'feature_intro_date', + 'feature_intro_filter', 'feature_intro_list', 'feature_intro_save', 'feature_intro_skip', + 'feature_intro_next', 'feature_intro_back', 'feature_intro_step_label', + 'feature_intro_demo_bg_status', 'feature_intro_close']) { + assert.ok(modalCode.includes('id="' + id + '"'), 'missing #' + id); + } + assert.match(modalCode, /class="modal-content first-run"/); + assert.match(modalCode, /data-backdrop="static"/); + assert.match(modalCode, /data-keyboard="false"/); + assert.ok(!/data-dismiss="modal"/.test(modalCode), + 'the first-run welcome must not have a close-only button'); +}); + +test('the first-run close icon is drawn in the center of the circle', () => { + const closeCss = block(cssCode, '.first-run-close {', '.first-run-close:hover'); + assert.match(closeCss, /font-size: 0 !important/); + assert.match(closeCss, /\.first-run-close::before,\s*\n\.first-run-close::after/); + assert.match(closeCss, /top: 50%/); + assert.match(closeCss, /left: 50%/); + assert.match(closeCss, /transform: translate\(-50%, -50%\) rotate\(45deg\)/); + assert.match(closeCss, /\.first-run-close::after[\s\S]*rotate\(-45deg\)/); + assert.ok(!/content: "\\00d7"/.test(closeCss), + 'the font multiplication glyph sits off-center in this circular button'); +}); + +test('the welcome is a step-by-step assistant, not one crowded settings wall', () => { + assert.match(modalCode, /data-intro-step="sample"/); + assert.match(modalCode, /data-intro-step="features"/); + assert.match(modalCode, /data-intro-step="settings"/); + assert.match(settingsCode, /showIntroStep: function/); + assert.match(settingsCode, /nextIntroStep: function/); + assert.match(settingsCode, /previousIntroStep: function/); + assert.match(settingsCode, /data-intro-dot/); + assert.match(cssCode, /\.first-run-step\s*\{\s*display: none;/); + assert.match(cssCode, /\.first-run-step\.is-active\s*\{\s*display: block;/); +}); + +test('sample data is selected by default and starts in the background on Next', () => { + assert.match(modalCode, /id="fi_module_demo_data_enable"[\s\S]{0,90}checked/); + assert.match(modalCode, /Use sample data/); + assert.match(settingsCode, /beginIntroDemoInstall: function/); + assert.match(settingsCode, /if \(index === 0\) \{ PosnicPro\.features\.beginIntroDemoInstall\(\); \}/); + assert.match(settingsCode, /inlineTarget: '#feature_intro_demo_bg_status'/); + assert.match(settingsCode, /syncDemoDataAfterSave\(true, \{/); +}); + +test('choosing a clean start arms the sample-data removal path', () => { + const chooseDemo = block(settingsCode, 'chooseDemoData: function', 'markIntroDemoStatus:'); + assert.match(chooseDemo, /wanted === false/); + assert.match(chooseDemo, /_demoPurgeArmed = true/); + assert.match(settingsCode, /syncDemoDataAfterSave\(wantedDemo\)/); +}); + +test('the first-run visual is not caught by the general greyscale artwork rule', () => { + assert.match(modalCode, /static\/images\/onboarding\/shop-ready-photo\.jpg/); + assert.ok(!/static\/images\/general\/Background_four\.jpg/.test(modalCode)); + assert.match(cssCode, /\.first-run-visual img[\s\S]*filter: none !important/); +}); + +test('the welcome shows saved starter settings before selling', () => { + const render = block(settingsCode, 'renderIntro:', 'saveIntro:'); + const editor = block(settingsCode, 'initIntroLocaleEditor:', 'featureOn:'); + assert.match(render, /PosnicPro\.features\.initIntroLocaleEditor\(\)/); + assert.match(editor, /feature_intro_country/); + assert.match(editor, /feature_intro_currency/); + assert.match(editor, /feature_intro_timezone/); + assert.match(editor, /feature_intro_date/); + assert.match(editor, /country_setting/); + assert.match(editor, /currencySign/); + assert.match(editor, /PosnicPro\.timeZone\(\)/); + assert.match(editor, /dateformatset/); +}); + +test('starter settings are editable in the welcome without leaving the popup', () => { + assert.match(modalCode, /id="feature_intro_locale_form"/); + assert.match(settingsCode, /saveIntroLocaleIfNeeded: function/); + assert.match(settingsCode, /url: 'setting\/starterLocale'/); + assert.ok(!modalCode.includes('Edit country, currency and tax details'), + 'the welcome should not show the old edit-settings callout'); + assert.ok(!modalCode.includes('feature_intro_edit_settings'), + 'the welcome should not show a button that leaves the popup'); + assert.ok(!settingsCode.includes("hasher.setHash('settings/general')"), + 'editing starter settings must not redirect to the settings page'); +}); + +test('the first-run features are searchable and recommended ones rise first', () => { + const render = block(settingsCode, 'renderIntro:', 'startSelling:'); + assert.match(modalCode, /id="feature_intro_filter"/); + assert.match(settingsCode, /filterIntro: function/); + assert.match(settingsCode, /\$\(document\)\.on\('input', '#feature_intro_filter'/); + assert.match(render, /data-feature-row/); + assert.match(render, /data-feature-search/); + assert.match(render, /is-recommended/); + assert.match(render, /\.sort\(function \(a, b\)/); + assert.match(cssCode, /\.first-run-row\.is-hidden\s*\{\s*display: none;/); +}); + +test('every icon the welcome asks for exists in the shipped font', () => { + /* A glyph this build does not carry renders as an empty box, and nothing + reports it. mdi-storefront is one of those; mdi-store is not. */ + const icons = fs.readFileSync( + path.join(root, 'frontend/static/style/icons/material-design/css/materialdesignicons.css'), 'utf8'); + const asked = modalCode.match(/mdi-[a-z0-9-]+/g) || []; + assert.ok(asked.length, 'expected the welcome to use at least one icon'); + for (const name of asked) { + assert.ok(icons.includes('.' + name + ':before'), + name + ' is not in the shipped icon font'); + } +}); + +test('the server accepts and stores the flag through the features group', () => { + // Written by the same endpoint as the switches, or the save 400s. + assert.match(groupsCode, /'first_run_done'/); + assert.match(modelCode, /first_run_done/); +}); + +test('a shop that has never been asked defaults to not-yet-welcomed', () => { + /* + * onOnly, so absent parses FALSE. The opposite default - absent means seen + * - would mean nobody ever gets this, and there would be nothing to notice. + */ + assert.match(modelCode, /first_run_done: onOnly,/); +}); + +test('the flag is not treated as a module switch', () => { + /* + * It went into moduleToggleMap first, and the repo's own module-key guard + * caught it: everything in that map is expected to have a control on the + * settings form, a slot in the save payload and an entry in + * _moduleToggleIds, because a module switch that misses one of those is + * silently reset on the next save. This is not a switch - it is a record + * that somebody has been welcomed - so it belongs in none of them, and the + * Modules tab's branch selector must not offer it as a feature. + */ + const map = block(modelCode, 'static moduleToggleMap()', 'updateBranchModules'); + assert.ok(!map.includes('first_run_done'), + 'first_run_done is not a module switch and must stay out of moduleToggleMap'); + + // Presence-gated: a settings save that does not mention it cannot move it. + const toggles = block(modelCode, 'const TOGGLES = {', 'till_lock_idle_minutes'); + assert.match(toggles, /first_run_done: onOnly,/); + assert.match(toggles, /if \(data\[key\] !== undefined\)/); +}); + +test('the welcome is one dialog, not two', () => { + /* An earlier pass built a second welcome in core/first-run.js. Two dialogs + fighting over the same first sign-in is worse than either alone, and the + one that survived is the one with the ACL guard. */ + assert.ok(!fs.existsSync(path.join(root, 'frontend/static/script/js/core/first-run.js')), + 'core/first-run.js is superseded by the feature intro modal'); +}); + +/* + * The welcome now says what KIND of Posnic this is. + * + * Owner: "when user logins first time we show features and ours is both web + * and desktop those info shared or not ? how we can convey ?" - and earlier, + * twice: "user is not clear about this system software desktop application + * plus web based... when first visit he dont know." + * + * The website explains it now; the first sign-in did not, and the first + * sign-in is the one screen a new shop is certain to read. + */ +const accessCode = block(settingsCode, 'runningContext:', 'renderIntro:'); + +test('the welcome carries the desktop-and-web strip', () => { + assert.ok(modalCode.includes('id="feature_intro_access"'), + 'the welcome has nowhere to say what kind of till this is'); + assert.match(settingsCode, /\$\('#feature_intro_access'\)\.html\(PosnicPro\.features\.accessNote\(\)\)/); +}); + +test('the sentence is picked from where this is actually running', () => { + /* + * Never the generic "we have both an app and a website" - that tells + * somebody nothing about the one they are looking at. Desktop is the + * Electron userAgent; web is a public hostname; and localhost or a + * private address is the shop's own network, where claiming the address + * "opens on any phone" would be false the moment they left the building. + */ + assert.match(accessCode, /Electron/); + assert.match(accessCode, /'desktop'/); + assert.match(accessCode, /192\\.168\\./); + assert.match(accessCode, /'lan' : 'web'/); +}); + +test('the web variant states the address it is certain of', () => { + /* In a browser the shop's address IS the address bar - no lookup, and no + way for it to be stale. It is the one dynamic value, and it is escaped. */ + assert.match(accessCode, /esc\(window\.location\.hostname\)/); +}); + +test('the desktop variant does not invent a web address', () => { + /* + * The app does not reliably know its shop's cloud address, and a guessed + * URL that 404s teaches a brand-new user that the product lies. The + * welcome email and My Account genuinely carry it, so that is where the + * sentence points. + */ + const desktop = block(accessCode, "ctx === 'desktop'", "ctx === 'web'"); + assert.match(desktop, /welcome email/); + assert.match(desktop, /My Account/); + assert.ok(!desktop.includes('window.location'), + 'the desktop sentence must not present the local address as a web address'); +}); + +test('every variant names both halves of the product', () => { + /* Whichever one somebody is in, the sentence must tell them the other + exists - that is the entire question being answered. */ + for (const marker of ["ctx === 'desktop'", "ctx === 'web'"]) { + assert.ok(accessCode.includes(marker), marker + ' variant is missing'); + } + /* accessCode ends before renderIntro, so the web variant runs to its end. */ + const web = accessCode.slice(accessCode.indexOf("ctx === 'web'")); + assert.match(web, /desktop app/); + const desktop = block(accessCode, "ctx === 'desktop'", "ctx === 'web'"); + assert.match(desktop, /browser/); +}); + +test('the strip is styled from theme tokens like the rest of the welcome', () => { + const strip = block(cssCode, '.first-run-access {', '.first-run-foot {'); + assert.match(strip, /var\(--theme-border-color/); + assert.match(strip, /var\(--theme-text-muted/); + const hard = strip.match(/(?:color|background):\s*#[0-9a-fA-F]{3,8}\s*;/g) || []; + assert.deepStrictEqual(hard, [], 'the strip hard-codes colours: ' + hard.join(', ')); +}); + +test('opening a section leaves exactly ONE pane standing', () => { + /* + * The general pane ships 'show active' statically, and the page carries + * a duplicated-id landmine; when Bootstrap resolved the wrong previous + * pane, the Features page grew the whole day-to-day settings form under + * its cards - "below features why setting page showing?" This enforces + * single-pane after every section switch, whatever the tab plugin did. + */ + const open = block(settingsCode, 'openSection:', 'applyTaxProfile:'); + assert.match(open, /siblings\('\.tab-pane'\)\.removeClass\('show active'\)/); + assert.match(open, /addClass\('show active'\)/); + assert.match(open, /hasClass\('tab-pane'\)/); +}); + +/* -------------------------------------------- where saving leaves them --- */ + +/* + * Owner: "after user sign up user comes to features page. after click save + * start selling, move page to sales/new instead of stay in features." + * + * The welcome puts the shop on the features page on purpose - maybeShowIntro + * sets that hash so the dialog is standing in front of the switches it is + * describing. The cost, unnoticed until somebody watched a real signup, is + * that dismissing it leaves a shop ninety seconds old looking at a settings + * screen. The button says where it goes. It has to go there. + */ + +test('Save and start selling arrives at the sale screen', () => { + const save = block(settingsCode, 'startSelling:', 'saveIntro:'); + assert.match(save, /hasher\.setHash\('sales\/new'\)/, + 'the button that says start selling does not go anywhere'); +}); + +test('the tour is not sent to the sale screen', () => { + /* + * "Save & show me around" is a walk around where these switches live. A + * page change would cut it off at the first step, so the two buttons have + * to part company after the save they share. + */ + const success = block(settingsCode, "var wantedTour = PosnicPro.features._tourAfterSave;", + 'PosnicPro.alert(response.type'); + assert.match(success, /var wantedTour = PosnicPro\.features\._tourAfterSave;/, + 'nothing remembers which button was pressed'); + assert.match(success, /if \(!wantedTour\) \{ PosnicPro\.features\.startSelling\(\); \}/, + 'the tour and the sale screen are not told apart'); + /* The flag is cleared by the tour branch above, so reading it afterwards + would always say "no tour" and the tour would be cut short every time. */ + assert.ok(success.indexOf('var wantedTour') < success.indexOf('_tourAfterSave = false'), + 'the flag is read after the branch that clears it'); +}); + +test('changed starter settings save before the first-run decision closes', () => { + const save = block(settingsCode, 'saveIntro: function', "$(document).on('click', '#feature_intro_skip'"); + assert.match(save, /saveIntroLocaleIfNeeded\(function \(\) \{/); + assert.match(save, /url: 'settings\/group\/features'/); + assert.ok(save.indexOf('saveIntroLocaleIfNeeded') < save.indexOf("url: 'settings/group/features'"), + 'starter settings should persist before the welcome is marked decided'); + assert.ok(!save.includes('_settingsAfterSave'), + 'the removed edit-and-redirect flag should not return'); +}); + +test('a failed save goes nowhere', () => { + /* Same rule the tour already follows: a shop that did not save must not be + walked away from the screen that still holds its unsaved choices. */ + const fail = block(settingsCode, 'Could not save - you can set these later', '};'); + assert.ok(!/startSelling/.test(fail), 'a failed save still leaves the features page'); + assert.ok(!/hasher\.setHash/.test(fail)); +}); + +test('Use defaults saves through the normal first-run path', () => { + /* + * The welcome is intentionally not closable now. Use defaults is a + * decision: persist the currently recommended switches and then let the + * normal save-success code take the owner to the sale screen. + */ + const skip = block(settingsCode, "'click', '#feature_intro_skip'", "'change', '#fi_module_demo_data_enable'"); + assert.match(skip, /_decided = true/); + assert.match(skip, /saveIntro\(\)/); + assert.ok(!/settings\/group\/features/.test(skip), 'Use defaults bypasses the normal feature save path'); +}); + +test('the sale screen waits for the welcome only; sample data runs in the background', () => { + /* + * Both fade, so hiding one is asynchronous and it is still on screen when + * this runs. Changing the page under a modal mid-close is how a backdrop + * gets left behind, greying out the screen it was meant to reveal - the + * tour hits the same thing and waits a fixed 400ms. + * + * The sample-data bar now lives inside the welcome footer, so waiting on a + * second modal is exactly the stuck feeling this flow must avoid. + */ + const save = block(settingsCode, 'startSelling:', 'saveIntro:'); + assert.match(save, /after\('#feature_intro_modal', go\)/, + 'the sale screen does not wait for the welcome'); + assert.ok(!/demo_progress_modal/.test(save), + 'the first-run sale path is blocked by the old sample-data modal'); + assert.match(save, /m\.hasClass\('show'\) \|\| m\.hasClass\('in'\)/, + 'the visibility check is tied to one bootstrap version'); +}); + +test('a dialog that has already closed does not strand the shop', () => { + /* + * hidden.bs.modal fires once. A modal that closed before this line ran has + * already fired it, and binding then waits for something never coming - so + * the wait is entered only for a dialog that is still on screen. + */ + const save = block(settingsCode, 'startSelling:', 'saveIntro:'); + assert.match(save, /if \(!showing\(sel\)\) \{ next\(\); return; \}/, + 'it binds to an event that may already have fired'); +}); + +test('the shop arrives even if no transition ever fires', () => { + /* + * A detached element, reduced motion, a stylesheet that did not load - any + * of them leaves the shop on the settings page having pressed a button + * that names somewhere else. Arriving late is a blemish; not arriving is + * the bug being fixed. + */ + const save = block(settingsCode, 'startSelling:', 'saveIntro:'); + assert.match(save, /setTimeout\(go, 1200\)/, 'nothing guarantees the shop ever arrives'); + /* And exactly once: the floor and a transition can both fire, and two + setHash calls push two history entries, so Back appears not to work. */ + assert.match(save, /if \(went\) \{ return; \}[\s\S]{0,20}went = true;/, + 'the navigation can run twice'); +}); diff --git a/tests/fixtures/embedded-external-link.html b/tests/fixtures/embedded-external-link.html new file mode 100644 index 000000000..f200ee2da --- /dev/null +++ b/tests/fixtures/embedded-external-link.html @@ -0,0 +1,8 @@ + + + + Help + Unsafe script + Unsafe file + + \ No newline at end of file diff --git a/tests/formatted-money-reads.test.js b/tests/formatted-money-reads.test.js new file mode 100644 index 000000000..95635ddda --- /dev/null +++ b/tests/formatted-money-reads.test.js @@ -0,0 +1,87 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +/* + * Never read a formatted money display as a number without stripping it. + * + * The till writes money into the page with the jQuery Number plugin - + * `$('#sales_new_subtotal').number(v, 2)` - which inserts thousand separators. + * Read that back with parseFloat and "1,459.00" becomes 1. + * + * That is not hypothetical. It shipped: the discount cap compared a Rs34 + * discount against a subtotal it had parsed as 1, measured it as 3400%, and + * fired manager approval on every discounted bill over Rs1,000 (c57e23a). The + * failure is silent - no error, no exception, just a number two orders of + * magnitude wrong - which is exactly why it needs a guard rather than care. + * + * This test finds every element written via .number() and checks that every + * place reading one back with .text() strips the separators. It is deliberately + * uniform: no "this use only compares against zero, so it is fine" exceptions, + * because that reasoning is invisible to whoever edits the line next. + */ + +const MODULES = path.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'modules', 'js'); + +const sources = fs + .readdirSync(MODULES) + .filter((f) => f.endsWith('.js')) + .map((f) => ({ file: f, text: fs.readFileSync(path.join(MODULES, f), 'utf8') })); + +/* ids written as `$('#someId').number(` — those carry thousand separators */ +function formattedIds() { + const ids = new Set(); + for (const { text } of sources) { + for (const m of text.matchAll(/\$\(\s*['"]#([A-Za-z0-9_-]+)['"]\s*\)\s*\.number\(/g)) { + ids.add(m[1]); + } + } + return ids; +} + +test('the till really does format money displays with separators', () => { + const ids = formattedIds(); + assert.ok( + ids.size > 10, + `expected many formatted displays, found ${ids.size} - has .number() been replaced?`, + ); + // the one that caused the production bug must still be in the set + assert.ok(ids.has('sales_new_subtotal'), 'the subtotal is the canonical case'); +}); + +test('every read of a formatted display strips the separators', () => { + const ids = formattedIds(); + const offenders = []; + + for (const { file, text } of sources) { + for (const id of ids) { + const read = new RegExp(`\\$\\(\\s*['"]#${id}['"]\\s*\\)\\.text\\(\\)`, 'g'); + for (const m of text.matchAll(read)) { + /* Look at the LINE, not "up to the next semicolon". These reads sit + inside object literals, where the next semicolon can be dozens of + lines away - and a window that wide swallows neighbouring lines that + DO strip, so every read passes whether it strips or not. The first + version of this test did exactly that and survived its own mutation, + which is the definition of pinning nothing. */ + const from = text.lastIndexOf('\n', m.index) + 1; + const nl = text.indexOf('\n', m.index); + const stmt = text.slice(from, nl === -1 ? text.length : nl); + + // passing through to another element is not a numeric read + const isPassThrough = /\.text\(\s*\$\(/.test(stmt); + const strips = /replace\(\s*\/,\/g\s*,\s*['"]{2}\s*\)/.test(stmt); + + if (!isPassThrough && !strips) { + offenders.push(`${file}: ${stmt.trim().slice(0, 110)}`); + } + } + } + } + + assert.deepStrictEqual( + offenders, + [], + 'these read a comma-formatted money display without stripping:\n ' + offenders.join('\n '), + ); +}); diff --git a/tests/fresh-origin-boot.test.js b/tests/fresh-origin-boot.test.js new file mode 100644 index 000000000..c1efbb0d6 --- /dev/null +++ b/tests/fresh-origin-boot.test.js @@ -0,0 +1,68 @@ +/* + * A brand-new browser must be able to boot the dashboard. + * + * Owner: "what you u have done? now page completely broken. after login." - + * a pure white page, every request 200, console clean of everything except: + * + * jQuery.Deferred exception: Cannot read properties of undefined + * (reading 'format') at Object.commonDate + * + * localStorage carries no 'timezone' until the first settings read lands, so + * on a FRESH ORIGIN - every new shop's first visitor - local.get returned + * null, moment().tz(null) hit moment-timezone's GETTER form and returned + * undefined, and .format() threw inside the ready handlers that reveal the + * page. It never reproduced on a browser that had ever loaded the shop + * before, which is why it survived until the owner opened a brand-new shop: + * the people it hits are EXACTLY the people nobody retests as. + */ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..'); +const strip = (s) => s.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^[ \t]*\/\/.*$/gm, ''); +const core = strip(fs.readFileSync( + path.join(ROOT, 'frontend/static/script/js/core/PosnicPro.js'), 'utf8')); + +test('the timezone accessor can never return null', () => { + const at = core.indexOf('timeZone: function ()'); + assert.ok(at > -1, 'the safe accessor is gone'); + const fn = core.slice(at, core.indexOf('commonDate: function', at)); + assert.match(fn, /t !== 'null' && t !== 'undefined'/); + // the browser's own zone, not a fixed country's + assert.match(fn, /moment\.tz\.guess\(\)/); + // and a last-resort literal if even guess() is unavailable + assert.match(fn, /catch \(e\) \{ return '[^']+'; \}/); +}); + +test('no direct timezone read feeds moment anywhere', () => { + /* + * The sweep. 24 read sites existed across 15 files; any ONE of them + * reachable at boot whites the page for a fresh origin. Only the accessor + * itself may read the raw key. + */ + const dir = path.join(ROOT, 'frontend/static/script/js'); + const offenders = []; + const walk = (d) => { + for (const e of fs.readdirSync(d, { withFileTypes: true })) { + const p = path.join(d, e.name); + if (e.isDirectory()) { walk(p); continue; } + if (!e.name.endsWith('.js') || e.name.includes('.min.')) continue; + const src = strip(fs.readFileSync(p, 'utf8')); + const hits = (src.match(/PosnicPro\.local\.get\('timezone'\)/g) || []).length; + const isCore = p.endsWith('PosnicPro.js'); + // the core file holds exactly ONE read: inside the accessor + if (hits > (isCore ? 1 : 0)) offenders.push(`${e.name}: ${hits}`); + } + }; + walk(dir); + assert.deepStrictEqual(offenders, [], + 'raw timezone reads outside the accessor: ' + offenders.join(', ')); +}); + +test('commonDate itself goes through the accessor', () => { + const at = core.indexOf('commonDate: function ()'); + const fn = core.slice(at, at + 400); + assert.match(fn, /PosnicPro\.timeZone\(\)/); +}); diff --git a/tests/frontend-discovery-files.test.js b/tests/frontend-discovery-files.test.js new file mode 100644 index 000000000..2c3b834b5 --- /dev/null +++ b/tests/frontend-discovery-files.test.js @@ -0,0 +1,114 @@ +const test = require('node:test'); +const assert = require('node:assert/strict'); +const fs = require('node:fs'); +const path = require('node:path'); + +const ROOT = path.join(__dirname, '..'); +const FRONTEND = path.join(ROOT, 'frontend'); +const PUBLIC = path.join(FRONTEND, 'public'); +const ROOT_FILES = ['robots.txt', 'sitemap.xml', 'llms.txt', '_headers']; +const POSNIC_SEO_TITLE = 'Posnic POS - Offline POS & Billing Software'; +const POSNIC_SEO_DESCRIPTION = + 'Posnic POS is offline-first open source POS and billing software for retail stores, restaurants, and small businesses.'; +const POSNIC_SEO_KEYWORDS = ['POS', 'Billing Software', 'Offline POS', 'Online/Offline POS', 'open source POS']; + +function read(...parts) { + return fs.readFileSync(path.join(...parts), 'utf8'); +} + +function extractJsonLd(html, scriptId) { + const match = html.match( + new RegExp(`([\\s\\S]*?)<\\/script>`), + ); + assert.ok(match, `${scriptId} JSON-LD script is missing`); + return JSON.parse(match[1]); +} + +test('frontend source carries machine-readable discovery files for the app domain', () => { + for (const file of ROOT_FILES) { + assert.ok(fs.existsSync(path.join(FRONTEND, file)), `${file} is missing from frontend/`); + } + + const robots = read(FRONTEND, 'robots.txt'); + assert.match(robots, /^User-agent: \*/m); + assert.match(robots, /^Allow: \/$/m); + assert.match(robots, /^Sitemap: https:\/\/www\.posnic\.io\/sitemap\.xml$/m); + + const sitemap = read(FRONTEND, 'sitemap.xml'); + assert.match(sitemap, /^<\?xml version="1\.0" encoding="UTF-8"\?>/); + assert.match(sitemap, //); + assert.match(sitemap, /https:\/\/www\.posnic\.io\/<\/loc>/); + assert.match(sitemap, /https:\/\/www\.posnic\.io\/login\.html<\/loc>/); + assert.doesNotMatch(sitemap, /https:\/\/posnic\.com\//); + + const llms = read(FRONTEND, 'llms.txt'); + assert.match(llms, /^# Posnic POS$/m); + assert.match(llms, /^Canonical app domain: https:\/\/posnic\.io\/$/m); + assert.match(llms, /^Preferred backlink target: https:\/\/posnic\.io\/$/m); + assert.match(llms, /^Official GitHub source: https:\/\/github\.com\/Posnic\/POS$/m); + assert.match(llms, /POS; Billing Software; Offline POS; Online\/Offline POS; open source POS/); + + const headers = read(FRONTEND, '_headers'); + assert.match(headers, /\/robots\.txt[\s\S]*Content-Type: text\/plain; charset=utf-8/); + assert.match(headers, /\/llms\.txt[\s\S]*Content-Type: text\/plain; charset=utf-8/); + assert.match(headers, /\/sitemap\.xml[\s\S]*Content-Type: application\/xml; charset=utf-8/); + assert.match( + headers, + /\/static\/manifest\.webmanifest[\s\S]*Content-Type: application\/manifest\+json; charset=utf-8/, + ); +}); + +test('public app entry pages expose canonical POS metadata', () => { + const index = read(FRONTEND, 'index.html'); + const login = read(FRONTEND, 'login.html'); + const keywordContent = POSNIC_SEO_KEYWORDS.join(', '); + + for (const html of [index, login]) { + assert.match(html, new RegExp(`${POSNIC_SEO_TITLE}`)); + assert.match(html, new RegExp(``)); + assert.match(html, new RegExp(``)); + assert.match(html, //); + assert.match(html, //); + } + + assert.match(login, //); + assert.match(login, //); + assert.match(login, //); + assert.match(login, //); + + const softwareSchema = extractJsonLd(login, 'posnic-software-schema'); + assert.equal(softwareSchema['@context'], 'https://schema.org'); + assert.equal(softwareSchema['@type'], 'SoftwareApplication'); + assert.equal(softwareSchema.name, 'Posnic POS'); + assert.equal(softwareSchema.url, 'https://www.posnic.io/'); + assert.equal(softwareSchema.codeRepository, 'https://github.com/Posnic/POS'); + assert.equal(softwareSchema.applicationCategory, 'BusinessApplication'); + assert.equal(softwareSchema.softwareVersion, '1.6.1'); + assert.deepEqual(softwareSchema.keywords, POSNIC_SEO_KEYWORDS); +}); + +test('gulp publishes discovery files into frontend/public', () => { + const gulpIndex = read(FRONTEND, 'gulpfile.js', 'index.js'); + assert.match(gulpIndex, /function copyRootPublicFiles\(\)/); + for (const file of ROOT_FILES) { + assert.match(gulpIndex, new RegExp(`['"]${file.replace('.', '\\.')}['"]`)); + } + assert.match(gulpIndex, /exports\.rootPublicFiles = copyRootPublicFiles/); + assert.match(gulpIndex, /parallel\(copyRootPublicFiles,/); + + if (!fs.existsSync(PUBLIC)) return; + for (const file of ROOT_FILES) { + const built = path.join(PUBLIC, file); + assert.ok(fs.existsSync(built), `${file} is missing from frontend/public after build`); + assert.equal(read(FRONTEND, file), read(PUBLIC, file), `${file} changed during copy`); + } +}); + +test('tenant frontend deploy checks discovery files before rsync', () => { + const deployWorkflow = read(ROOT, '.github', 'workflows', 'deploy-frontend.yml'); + const developWorkflow = read(ROOT, '.github', 'workflows', 'deploy-develop.yml'); + for (const file of ['frontend/public/robots.txt', 'frontend/public/sitemap.xml', 'frontend/public/llms.txt']) { + assert.match(deployWorkflow, new RegExp(file.replace(/[./]/g, '\\$&'))); + assert.match(developWorkflow, new RegExp(file.replace(/[./]/g, '\\$&'))); + } +}); diff --git a/tests/guide-tour.test.js b/tests/guide-tour.test.js new file mode 100644 index 000000000..4b1669342 --- /dev/null +++ b/tests/guide-tour.test.js @@ -0,0 +1,174 @@ +/* + * The guided tour: point at real things, skip what is not there, leave when + * told, never come back uninvited. + * + * Owner: "in feature we might want to do the guide tour for the user." + * + * WHAT BREAKS SILENTLY HERE. A tour is a list of selectors into an app that + * keeps changing. Every failure mode is quiet: an id renamed means a step + * floats in space or the tour strands; a feature switched off means a target + * that never appears; a tour that re-offers itself is nagging nobody reports, + * they just close it angrier each time. So the tests pin the guards and pin + * the SELECTORS against the real markup - the one check nobody does by hand + * after a refactor. + */ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..'); +const read = (p) => fs.readFileSync(path.join(ROOT, p), 'utf8'); +const strip = (s) => s + .replace(/\/\*[\s\S]*?\*\//g, '') + .replace(/^[ \t]*\/\/.*$/gm, '') + .replace(//g, ''); + +const tourJs = strip(read('frontend/static/script/js/core/tour.js')); +const settingsJs = strip(read('frontend/static/script/js/modules/js/settings.js')); +const modalHtml = strip(read('frontend/modals/feature_intro.html')); +const customCss = strip(read('frontend/static/style/css/custom.css')); + +function between(source, from, to) { + const a = source.indexOf(from); + assert.ok(a > -1, `${from} not found`); + const b = source.indexOf(to, a + from.length); + assert.ok(b > a, `${to} not found after ${from}`); + return source.slice(a, b); +} + +test('every selector the tour points at exists in the real markup', () => { + /* + * THE test. A tour step names an id; a refactor renames the id; nothing + * anywhere fails - the step is silently skipped forever and the tour + * quietly gets shorter. Each target is asserted against the file that + * actually renders it. + */ + const sidebar = read('frontend/layouts/sidebar.html'); + const sales = read('frontend/modules/sales_write.html'); + const settings = read('frontend/modules/settings_write.html'); + + assert.match(sidebar, /class="vertical-menu/); + assert.match(sales, /id="sales_new_item_name"/); + assert.match(sales, /id="sales_new_productList"/); + assert.match(sales, /id="quick_sale_btn"/); + assert.match(settings, /id="v-pills-modules"/); + + // And the steps really name those five, so this test cannot drift from + // the tour it protects. + const steps = between(tourJs, 'firstRun: function', 'start: function'); + for (const sel of ['.vertical-menu', '#sales_new_item_name', + '#sales_new_productList', '#quick_sale_btn', '#v-pills-modules']) { + assert.ok(steps.includes(`'${sel}'`), `the tour no longer points at ${sel}`); + } +}); + +test('a missing or hidden target skips the step instead of stranding the tour', () => { + const move = between(tourJs, '_move: function', 'show: function'); + // visibility, not mere existence: an element in a hidden pane has size 0 + assert.match(move, /offsetWidth > 0 && \w+\.offsetHeight > 0/); + // bounded wait, then skip IN THE DIRECTION OF TRAVEL - skipping forward + // while going back would trap Back on a missing step + assert.match(move, /waited >= 3000/); + assert.match(move, /self\._move\(dir\)/); +}); + +test('steps wait for the SPA to build the page, never a fixed sleep alone', () => { + const move = between(tourJs, '_move: function', 'show: function'); + assert.match(move, /hasher\.setHash\(step\.hash\)/); + assert.match(move, /setTimeout\(tryShow, 150\)/); +}); + +test('the tour starts only after a SUCCESSFUL save, and only when asked', () => { + /* + * Two doors, one save path. The tour button sets a flag the save-success + * handler reads: a failed save must never start a tour of a shop that did + * not save, and plain Save must never grow an uninvited tour. + */ + /* + * The tour button raises the flag and then saves. Asserted over the WHOLE + * handler rather than as two adjacent lines: this regex demanded that + * `_tourAfterSave = true;` be immediately followed by `saveIntro()`, and a + * later change inserted `_settingsAfterSave = false;` between them. Both pull + * requests were green on their own and the merge of the two was red - the + * behaviour never changed, only the line spacing. + * + * A test that fails when a correct line is added tests the typing, not the + * program. + */ + const tourButton = between(settingsJs, "on('click', '#feature_intro_tour'", '});'); + assert.match(tourButton, /_tourAfterSave = true;/, + 'the tour button does not raise the flag the save-success handler reads'); + assert.match(tourButton, /PosnicPro\.features\.saveIntro\(\)/, + 'the tour button does not save'); + assert.ok( + tourButton.indexOf('_tourAfterSave = true;') < tourButton.indexOf('saveIntro()'), + 'the flag must be set before the save, or the success handler will not see it' + ); + /* The message is translated now, so anchor on the sentence rather than on + the call that carries it. */ + const success = between(settingsJs, "'Feature switches saved'))", 'PosnicPro.alert(response.type'); + assert.match(success, /if \(PosnicPro\.features\._tourAfterSave\)/); + assert.match(success, /PosnicPro\.tour\.firstRun\(\)/); + // the failure path clears the flag, or the NEXT save inherits the wish + const fail = between(settingsJs, "Could not save - you can set these later", '};'); + assert.match(settingsJs, /_tourAfterSave = false;\s*\n\s*PosnicPro\.alert\('error'/); + assert.ok(fail.length >= 0); +}); + +test('leaving is remembered per shop, and a silent restart is not "seen"', () => { + const key = between(tourJs, 'seenKey: function', 'firstRun: function'); + assert.match(key, /branch_id_set/); + assert.match(key, /'feature_tour_done:' \+ branch/); + const close = between(tourJs, 'close: function (silent)', '};'); + assert.match(close, /if \(!silent && \w+\._steps\.length\)/); + assert.match(close, /local\.set\(PosnicPro\.tour\.seenKey\(\), 'true'\)/); +}); + +test('Escape leaves, arrows move, and the listeners leave with the tour', () => { + assert.match(tourJs, /e\.key === 'Escape'/); + assert.match(tourJs, /ArrowRight|ArrowLeft/); + /* Namespaced handlers, removed in close(): a dead tour still eating + Escape and Enter is a keyboard bug on the SALE screen. */ + assert.match(tourJs, /\.posnictour/); + const close = between(tourJs, 'close: function (silent)', '};'); + assert.match(close, /off\('\.posnictour'\)/); + assert.match(close, /removeEventListener\('resize'/); + assert.match(close, /removeEventListener\('scroll', \w+\._reposition, true\)/); +}); + +test('the spotlight follows the element on scroll and resize', () => { + assert.match(tourJs, /addEventListener\('scroll', self\._reposition, true\)/); + assert.match(tourJs, /addEventListener\('resize', self\._reposition\)/); +}); + +test('the card is pulled back inside the window on every side', () => { + const place = between(tourJs, 'place: function', 'close: function'); + assert.match(place, /left \+ cw > vw - 8/); + assert.match(place, /if \(left < 8\)/); + assert.match(place, /top \+ ch > vh - 8/); + assert.match(place, /if \(top < 8\)/); +}); + +test('the tour is in the dashboard bundle, or none of this runs', () => { + const map = read('frontend/pages_css_js_map.json'); + const dashboard = map.slice(map.indexOf('"dashboard"'), map.indexOf('"login"')); + assert.ok(dashboard.includes('static/script/js/core/tour.js'), + 'tour.js is not bundled into the dashboard'); +}); + +test('the welcome offers it and the Features page can re-run it', () => { + assert.match(modalHtml, /id="feature_intro_tour"/); + const settings = read('frontend/modules/settings_write.html'); + assert.match(settings, /id="features_take_tour"/); + assert.match(settings, /PosnicPro\.tour\.firstRun\(\)/); +}); + +test('the tour is styled from theme tokens', () => { + const block = customCss.slice(customCss.indexOf('#posnic_tour')); + assert.match(block, /var\(--theme-card-bg/); + assert.match(block, /var\(--theme-primary-color/); + assert.match(block, /prefers-reduced-motion/); + const hard = block.match(/(?:^|[^-\w])(?:background|color):\s*#[0-9a-fA-F]{3,8}\s*;/gm) || []; + assert.deepStrictEqual(hard, [], 'the tour hard-codes colours: ' + hard.join(', ')); +}); diff --git a/tests/helpers/source-lookup.js b/tests/helpers/source-lookup.js new file mode 100644 index 000000000..467f4a5fb --- /dev/null +++ b/tests/helpers/source-lookup.js @@ -0,0 +1,181 @@ +'use strict'; + +const assert = require('node:assert'); + +/* + * Reading assertions out of source files, without quietly reading the wrong one. + * + * These tests check behaviour by finding a function or a CSS rule in the shipped + * source and asserting on its contents. The whole approach turns on locating the + * RIGHT one, and the obvious implementation - indexOf, take the first hit - is + * wrong in a way that never announces itself: + * + * - sales.js defines `showDetails: function (id) {` twice, once for quotes and + * once for sales history. A first-occurrence lookup tested the wrong module + * and passed. + * - CSS selectors are not unique either. ".. > #quotes_list_card" appears + * first inside a GROUPED rule whose declarations are entirely different, and + * again inside a [data-theme] override that merely contains the same text. + * Eight assertions in one file were reading rules nobody meant. + * + * Every one of those passed. A test that passes for the wrong reason is worse + * than one that fails, because nobody looks at it again. So ambiguity is an + * error here: a marker that matches more than once fails and says so, and the + * caller narrows the search deliberately. + */ + +/* All indices of `needle` in `haystack`. */ +function occurrences(haystack, needle, from = 0) { + const out = []; + for (let at = haystack.indexOf(needle, from); at !== -1; at = haystack.indexOf(needle, at + 1)) { + out.push(at); + } + return out; +} + +/* + * The balanced { ... } block that opens at or after `marker`, marker included. + * + * The marker must identify exactly one place. When a name genuinely repeats - + * two namespaces with a `showDetails` each - slice the enclosing namespace first + * and search within that, rather than hoping the first hit is yours. + */ +function blockAt(source, marker) { + const hits = occurrences(source, marker); + assert.ok(hits.length > 0, `not found in source: ${marker}`); + assert.strictEqual( + hits.length, + 1, + `"${marker}" appears ${hits.length} times - narrow the search (slice the ` + + 'enclosing namespace first). Taking the first hit reads the wrong one and passes.', + ); + + const start = hits[0]; + const open = source.indexOf('{', start); + assert.notStrictEqual(open, -1, `no block opens after: ${marker}`); + + let depth = 0; + for (let i = open; i < source.length; i++) { + if (source[i] === '{') depth++; + else if (source[i] === '}') { + depth--; + if (depth === 0) { + assert.ok(i > start, 'block ends before it begins'); + return source.slice(start, i + 1); + } + } + } + return assert.fail(`unbalanced block after: ${marker}`); +} + +/* + * A CSS rule reader bound to one stylesheet. + * + * Only a selector that STARTS its own line counts as that rule's selector; the + * same text mid-line belongs to a different rule that merely contains it. + * + * `fromMarker` names the rule by what sits immediately above it, which is the + * one thing that separates two identical selectors. Supplying it IS the + * disambiguation, so uniqueness is not demanded as well - otherwise a rule and + * its legitimate @media override could never both be tested. + */ +function cssReader(css) { + return function cssRule(sel, fromMarker) { + const from = fromMarker ? css.indexOf(fromMarker) : 0; + assert.notStrictEqual(from, -1, `anchor not found in css: ${fromMarker}`); + + const hits = occurrences(css, sel, from).filter((at) => { + const lineStart = css.lastIndexOf('\n', at) + 1; + return css.slice(lineStart, at).trim() === ''; + }); + + assert.ok(hits.length > 0, `no CSS rule mentions: ${sel}`); + if (!fromMarker) { + assert.strictEqual( + hits.length, + 1, + `"${sel}" matches ${hits.length} places - pass a fromMarker to disambiguate. ` + + 'A first-occurrence match silently reads the wrong rule and passes anyway.', + ); + } + + const open = css.indexOf('{', hits[0]); + const close = css.indexOf('}', open); + assert.ok(close > open, `unbalanced CSS rule for: ${sel}`); + return css.slice(open + 1, close); + }; +} + +/* + * A CSS rule read by its PURPOSE rather than its selector. + * + * cssRule above names a rule by the class it is written on, which is fine + * until the class is the thing changing. Extracting a pattern renames every + * selector it touches - so a test suite that finds rules by name has to be + * rewritten in the same commit as the refactor it exists to police, and the + * safety net is rebuilt by the fall it is meant to catch. + * + * A marker comment names what the rule is FOR, which survives the rename. The + * test then asserts on declarations, and the extraction becomes a pure edit + * with the net already in place and untouched. + * + * Returns the selector too, so a test that genuinely cares about the name - + * "this rule must be generic now" - can still say so, deliberately, rather + * than by accident of how it looked the rule up. + */ +function markerReader(css) { + return function ruleFor(marker) { + /* + * The WHOLE comment, not the name inside it. + * + * A bare substring search makes any marker that is a prefix of another + * ambiguous - "MD:rail" also finds MD:rail-wide, MD:rail-body and + * MD:rail-scroller, which is four hits for a name that reads as specific. + * Matching the delimiters removes the hazard instead of relying on nobody + * ever choosing a name that extends another. + */ + const comment = `/* ${marker} */`; + const hits = occurrences(css, comment, 0); + assert.ok(hits.length > 0, `marker not found in css: ${comment}`); + assert.strictEqual( + hits.length, + 1, + `marker "${marker}" appears ${hits.length} times - a marker that names two ` + + 'rules identifies neither', + ); + const endComment = css.indexOf('*/', hits[0]); + assert.notStrictEqual(endComment, -1, `marker is not inside a comment: ${marker}`); + const open = css.indexOf('{', endComment); + const close = css.indexOf('}', open); + assert.ok(open !== -1 && close > open, `no rule follows marker: ${marker}`); + return { + selector: css.slice(endComment + 2, open).trim(), + body: css.slice(open + 1, close), + }; + }; +} + +/* + * Comments are not code. + * + * A check for "is this function called anywhere" reported four hits once; three + * were commented out. And prose that NAMES the thing it removed reads as the + * thing itself - several assertions matched their own explanatory comment. + */ +function stripComments(src) { + return src + .replace(/\/\*[\s\S]*?\*\//g, ' ') + .split('\n') + .map((line) => { + const at = line.indexOf('//'); + if (at === -1) return line; + const before = line.slice(0, at); + // not a comment if it is inside a string, or part of a URL like https:// + if ((before.match(/['"`]/g) || []).length % 2 === 1) return line; + if (before.endsWith(':')) return line; + return before; + }) + .join('\n'); +} + +module.exports = { blockAt, cssReader, markerReader, stripComments, occurrences }; diff --git a/tests/i18n-coverage-baseline.json b/tests/i18n-coverage-baseline.json new file mode 100644 index 000000000..8fe7e900b --- /dev/null +++ b/tests/i18n-coverage-baseline.json @@ -0,0 +1,19 @@ +{ + "ar": 99, + "de": 99, + "es": 99, + "fr": 84, + "hi": 99, + "id": 99, + "it": 99, + "kn": 84, + "ml": 84, + "ne": 84, + "nl": 99, + "pt": 84, + "si": 99, + "sw": 99, + "ta": 99, + "te": 99, + "th": 99 +} diff --git a/tests/i18n-runtime.test.js b/tests/i18n-runtime.test.js new file mode 100644 index 000000000..ffe7d0e2c --- /dev/null +++ b/tests/i18n-runtime.test.js @@ -0,0 +1,374 @@ +'use strict'; + +/* + * The runtime half of L3: pages ship once, in English, and the words are + * swapped in. + * + * These run against a real DOM rather than string matching, because the whole + * change is about what the page LOOKS LIKE after load. The three shapes that + * matter are all here: + * + * English ordinary content, tag stays + * English the parser builds no element inside + * a select shows text, not markup + * + * See Intranet docs/MULTI_LANGUAGE_ARCHITECTURE.md. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { JSDOM } = require('jsdom'); + +const CORE = path.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'core', 'PosnicPro.js'); + +/* + * The i18n object, lifted out of PosnicPro.js and evaluated on its own. + * + * Loading the whole 200KB file would drag in jQuery, the router and a dozen + * globals that have nothing to do with translation. Slicing keeps the test + * about i18n while still running the SHIPPING source rather than a copy. + */ +function loadI18n(dom, dict, stored) { + const core = fs.readFileSync(CORE, 'utf8'); + const start = core.indexOf('PosnicPro.i18n = {'); + const end = core.indexOf('\nPosnicPro.i18n.load()', start); + assert.ok(start > 0 && end > start, 'PosnicPro.i18n could not be found'); + + const store = Object.assign({}, stored); + const PosnicPro = { + local: { + get: (k) => (k in store ? store[k] : null), + set: (k, v) => { store[k] = String(v); }, + remove: (k) => { delete store[k]; }, + }, + }; + // eslint-disable-next-line no-new-func + new Function('PosnicPro', 'document', 'fetch', core.slice(start, end))( + PosnicPro, dom.window.document, + () => Promise.resolve({ ok: true, json: () => Promise.resolve(dict) }), + ); + PosnicPro.i18n._dict = dict; + return { PosnicPro, store }; +} + +const page = (body) => new JSDOM( + 'Posnic' + + '' + body + ''); + +const TA = { + lang_title: 'பொஸ்னிக்', + lang_item_name: 'பொருளின் பெயர்', + lang_new_search: 'புதியது', + lang_blank: ' ', +}; + +/* --------------------------------------------------------------- applying --- */ + +test('a tag is translated in place', () => { + const dom = page('
    Item name
    '); + const { PosnicPro } = loadI18n(dom, TA); + PosnicPro.i18n.apply(); + assert.equal(dom.window.document.querySelector('lang').textContent, 'பொருளின் பெயர்'); +}); + +test('a carries its key as data-t and is translated', () => { + /* Inside <title> the parser treats markup as text, so a tag left there + would print angle brackets in the browser tab. */ + const dom = page(''); + const { PosnicPro } = loadI18n(dom, TA); + PosnicPro.i18n.apply(); + assert.equal(dom.window.document.title, 'பொஸ்னிக்'); +}); + +test('an <option> shows the translation, not markup', () => { + const dom = page('<select><option value="new" data-t="lang_new_search">Newest</option></select>'); + const { PosnicPro } = loadI18n(dom, TA); + PosnicPro.i18n.apply(); + const opt = dom.window.document.querySelector('option'); + assert.equal(opt.textContent, 'புதியது'); + assert.equal(opt.value, 'new', 'the value must not be disturbed'); +}); + +/* -------------------------------------------------- English is never lost --- */ + +test('a key the language does not have keeps its English', () => { + const dom = page('<span><lang class="lang_not_translated">Untranslated</lang></span>'); + const { PosnicPro } = loadI18n(dom, TA); + PosnicPro.i18n.apply(); + assert.equal(dom.window.document.querySelector('lang').textContent, 'Untranslated'); +}); + +test('a blank translation keeps its English', () => { + /* A generated skeleton full of empty strings must not blank the interface. */ + const dom = page('<span><lang class="lang_blank">Something</lang></span>'); + const { PosnicPro } = loadI18n(dom, TA); + PosnicPro.i18n.apply(); + assert.equal(dom.window.document.querySelector('lang').textContent, 'Something'); +}); + +test('with no dictionary at all the page is untouched English', () => { + /* First run, offline, or a pack that 404s. */ + const dom = page('<span><lang class="lang_item_name">Item name</lang></span>'); + const { PosnicPro } = loadI18n(dom, null); + PosnicPro.i18n._dict = null; + PosnicPro.i18n.apply(); + assert.equal(dom.window.document.querySelector('lang').textContent, 'Item name'); +}); + +test('applying twice changes nothing the second time', () => { + /* apply() runs on load and again on DOMContentLoaded, and translates fresh + markup on demand. It reads the key, never the current text, so it cannot + translate its own output. */ + const dom = page('<span><lang class="lang_item_name">Item name</lang></span>'); + const { PosnicPro } = loadI18n(dom, TA); + PosnicPro.i18n.apply(); + const once = dom.window.document.body.innerHTML; + PosnicPro.i18n.apply(); + assert.equal(dom.window.document.body.innerHTML, once); +}); + +test('a root can be given, so markup rendered later is translated too', () => { + const dom = page('<div id="a"><lang class="lang_item_name">Item name</lang></div>' + + '<div id="b"><lang class="lang_item_name">Item name</lang></div>'); + const { PosnicPro } = loadI18n(dom, TA); + PosnicPro.i18n.apply(dom.window.document.getElementById('a')); + assert.equal(dom.window.document.querySelector('#a lang').textContent, 'பொருளின் பெயர்'); + assert.equal(dom.window.document.querySelector('#b lang').textContent, 'Item name', + 'only the given root should have been touched'); +}); + +/* ---------------------------------------------------------- the language --- */ + +test('an existing Tamil install is migrated from the old filename', () => { + const dom = page(''); + const { PosnicPro, store } = loadI18n(dom, TA, { language_herf: 'ta_dashboard.html' }); + assert.equal(PosnicPro.i18n.code(), 'ta'); + assert.equal(store.language_code, 'ta', 'the code should be written back'); +}); + +test('an install that never chose a language is English', () => { + const dom = page(''); + const { PosnicPro } = loadI18n(dom, TA, {}); + assert.equal(PosnicPro.i18n.code(), 'en'); +}); + +test('changing language does not navigate', () => { + /* Switching used to load a different HTML file and lose the screen. */ + const core = fs.readFileSync(CORE, 'utf8'); + const start = core.indexOf('change: function'); + const changeFn = core.slice(start, core.indexOf('\n }', start)); + assert.ok(!/location\s*\./.test(changeFn), 'change() still navigates'); + assert.match(changeFn, /apply\(\)/, 'change() does not redraw'); +}); + +/* ------------------------------------------------- markup in the words --- */ + +test('a text-only translation keeps the icon the page carries', () => { + /* + * "Download" sits after a feather icon inside its <lang>. Tamil translated + * the word alone, and textContent threw the icon away with the English. + */ + const dom = page('<button><lang class="lang_download_title"><i class="feather icon-download mr-2"></i>Download </lang></button>'); + const { PosnicPro } = loadI18n(dom, { lang_download_title: 'பதிவிறக்க' }); + PosnicPro.i18n.apply(); + const el = dom.window.document.querySelector('lang'); + assert.ok(el.querySelector('i.feather'), 'the icon was lost'); + assert.equal(el.textContent, 'பதிவிறக்க'); +}); + +test('a translation that carries the same markup is used as markup', () => { + /* The code later rewrites #resetHeading to "Sale" or "Receiving"; the span + has to survive translation or that write lands nowhere. */ + const dom = page('<p><lang class="lang_reset_want">Do you want to reset cart and proceed to New <span id="resetHeading">Sale</span> ?</lang></p>'); + const { PosnicPro } = loadI18n(dom, { + lang_reset_want: 'Réinitialiser le panier et passer à une nouvelle <span id="resetHeading">Vente</span> ?', + }); + PosnicPro.i18n.apply(); + const span = dom.window.document.getElementById('resetHeading'); + assert.ok(span, 'the span the code rewrites later is gone'); + assert.equal(span.textContent, 'Vente'); +}); + +test('switching back to English restores what the page shipped with', () => { + const dom = page('<h5><lang class="lang_item_name">Item name</lang></h5>'); + const { PosnicPro } = loadI18n(dom, TA, { language_code: 'ta' }); + PosnicPro.i18n.apply(); + assert.equal(dom.window.document.querySelector('lang').textContent, 'பொருளின் பெயர்'); + return PosnicPro.i18n.change('en').then(() => { + assert.equal(dom.window.document.querySelector('lang').textContent, 'Item name'); + assert.equal(dom.window.document.documentElement.getAttribute('lang'), 'en'); + assert.equal(dom.window.document.documentElement.getAttribute('dir'), 'ltr'); + }); +}); + +test('switching back to English ignores mutable DOM attributes', () => { + const dom = page('<h5><lang class="lang_item_name">Item name</lang></h5>'); + const { PosnicPro } = loadI18n(dom, TA, { language_code: 'ta' }); + PosnicPro.i18n.apply(); + const label = dom.window.document.querySelector('lang'); + label.setAttribute('data-en', '<img src=x onerror=alert(1)>'); + return PosnicPro.i18n.change('en').then(() => { + assert.equal(label.textContent, 'Item name'); + assert.equal(label.querySelector('img'), null); + }); +}); + +/* ---------------------------------------------- the document's language --- */ + +test('the document takes the language and its direction', () => { + const dom = page(''); + const { PosnicPro } = loadI18n(dom, {}, { language_code: 'ar' }); + PosnicPro.i18n.mark(); + assert.equal(dom.window.document.documentElement.getAttribute('lang'), 'ar'); + assert.equal(dom.window.document.documentElement.getAttribute('dir'), 'rtl'); + return PosnicPro.i18n.change('ta').then(() => { + assert.equal(dom.window.document.documentElement.getAttribute('lang'), 'ta'); + assert.equal(dom.window.document.documentElement.getAttribute('dir'), 'ltr'); + }); +}); + +test('a first run starts in the browser language the build ships', () => { + const dom = page(''); + const { PosnicPro } = loadI18n(dom, {}); + const offered = [{ code: 'en' }, { code: 'ta' }, { code: 'pt' }, { code: 'pt-BR' }]; + assert.equal(PosnicPro.i18n.detect(offered, ['pt-BR', 'en-US']), 'pt-BR', 'an exact tag should win'); + assert.equal(PosnicPro.i18n.detect(offered, ['pt-PT', 'en-US']), 'pt', 'the primary subtag is tried next'); + assert.equal(PosnicPro.i18n.detect(offered, ['ta-IN']), 'ta'); + assert.equal(PosnicPro.i18n.detect(offered, ['de-DE', 'fr']), 'en', 'nothing shipped means English'); + assert.equal(PosnicPro.i18n.chosen(), false, 'a fresh machine has chosen nothing'); + assert.equal(PosnicPro.i18n.code(), 'en'); + assert.equal(PosnicPro.i18n.chosen(), false, 'asking for the code must not count as choosing'); +}); + +/* ------------------------------------------------- a pack is somebody else's --- */ + +/* + * WHY THESE EXIST. + * + * apply() used to do `el.innerHTML = value` for any translation containing a + * tag, justified by a comment saying the packs were "this repository's own + * files... not user input". That was true when it was written, and it stopped + * being true the same week: translations were opened to outside contributors, + * twelve packs were seeded for strangers to correct, and develop.posnic.io was + * built to serve their work. + * + * A pack is now a pull request from somebody we do not know, reviewed by + * somebody who by definition cannot read the language - `<img src=x + * onerror=...>` inside a Malayalam string looks exactly like Malayalam to the + * reviewer. Signing the asset channel proves where a pack came from, never + * that it is safe to run. + * + * These are written against the running DOM rather than the source, because + * what matters is what reaches the page, not how the code is spelled. + */ + +test('a script tag in a translation never becomes a script', () => { + const dom = page('<h5><lang class="lang_item_name">Item name</lang></h5>'); + const { PosnicPro } = loadI18n(dom, { + lang_item_name: 'Item <script>window.__pwned = true;<\/script> name', + }); + PosnicPro.i18n.apply(); + const el = dom.window.document.querySelector('lang'); + assert.equal(el.querySelector('script'), null, 'a <script> element reached the page'); + assert.equal(dom.window.__pwned, undefined, 'the script ran'); + /* The words survive: unwrapping keeps what the translator wrote. */ + assert.match(el.textContent, /Item/); +}); + +test('an image with an onerror handler never reaches the page', () => { + /* The realistic payload: no <script> needed, and it fires on its own. */ + const dom = page('<h5><lang class="lang_item_name">Item name</lang></h5>'); + const { PosnicPro } = loadI18n(dom, { + lang_item_name: '<img src=x onerror="window.__pwned = true">Nombre', + }); + PosnicPro.i18n.apply(); + const el = dom.window.document.querySelector('lang'); + assert.equal(el.querySelector('img'), null, 'an <img> reached the page'); + assert.equal(dom.window.__pwned, undefined, 'the handler ran'); + assert.equal(el.textContent.trim(), 'Nombre'); +}); + +test('an event handler is stripped from a tag that is otherwise allowed', () => { + /* <span> is on the allowlist; onclick is not, and the two arrive together. */ + const dom = page('<p><lang class="lang_item_name">Item name</lang></p>'); + const { PosnicPro } = loadI18n(dom, { + lang_item_name: '<span id="keep" class="x" onclick="window.__pwned = true">Article</span>', + }); + PosnicPro.i18n.apply(); + const span = dom.window.document.getElementById('keep'); + assert.ok(span, 'an allowed tag was removed'); + assert.equal(span.getAttribute('onclick'), null, 'the handler survived'); + assert.equal(span.getAttribute('class'), 'x', 'class should be kept'); + assert.equal(span.textContent, 'Article'); +}); + +test('an anchor cannot be smuggled in to send somebody elsewhere', () => { + const dom = page('<p><lang class="lang_item_name">Item name</lang></p>'); + const { PosnicPro } = loadI18n(dom, { + lang_item_name: 'See <a href="https://evil.example">our offer</a>', + }); + PosnicPro.i18n.apply(); + const el = dom.window.document.querySelector('lang'); + assert.equal(el.querySelector('a'), null, 'a link reached the page'); + assert.match(el.textContent, /our offer/, 'the words should survive the unwrap'); +}); + +/* ------------------------------------------------ the words in attributes --- */ + +test('placeholder, title and aria-label are translated and restored', () => { + const dom = page('<input placeholder="Enter the store name" data-t-placeholder="lang_store_ph">' + + '<button title="Sort the list" data-t-title="lang_sort_t">x</button>'); + const { PosnicPro } = loadI18n(dom, { lang_store_ph: 'கடையின் பெயர்', lang_sort_t: 'வரிசைப்படுத்து' }, { language_code: 'ta' }); + PosnicPro.i18n.apply(); + const input = dom.window.document.querySelector('input'); + const button = dom.window.document.querySelector('button'); + assert.equal(input.getAttribute('placeholder'), 'கடையின் பெயர்'); + assert.equal(button.getAttribute('title'), 'வரிசைப்படுத்து'); + return PosnicPro.i18n.change('en').then(() => { + assert.equal(input.getAttribute('placeholder'), 'Enter the store name', 'the English placeholder did not come back'); + assert.equal(button.getAttribute('title'), 'Sort the list', 'the English title did not come back'); + }); +}); + +/* ------------------------------------------- markup that arrives later --- */ + +test('markup JavaScript draws after load is translated as it lands', async () => { + /* + * Table headers, pills, the receipt panel: none of it passes through + * apply() by itself. A module writes <lang class="key"> into its string + * and the observer does the rest. + */ + const dom = page('<div id="list"></div>'); + const { PosnicPro } = loadI18n(dom, TA, { language_code: 'ta' }); + const observer = PosnicPro.i18n.watch(dom.window.document.documentElement); + assert.ok(observer, 'watch() returned nothing'); + dom.window.document.getElementById('list').innerHTML = + '<table><tr><th><lang class="lang_item_name">Item name</lang></th></tr></table>' + + '<input placeholder="Newest" data-t-placeholder="lang_new_search">'; + await new Promise((resolve) => setTimeout(resolve, 0)); + assert.equal(dom.window.document.querySelector('th lang').textContent, 'பொருளின் பெயர்'); + assert.equal(dom.window.document.querySelector('input').getAttribute('placeholder'), 'புதியது'); + observer.disconnect(); +}); + +test('a <lang> handed to apply() directly is translated, not only its children', () => { + const dom = page('<span id="s"><lang class="lang_item_name">Item name</lang></span>'); + const { PosnicPro } = loadI18n(dom, TA, { language_code: 'ta' }); + const el = dom.window.document.querySelector('lang'); + PosnicPro.i18n.apply(el); + assert.equal(el.textContent, 'பொருளின் பெயர்'); +}); + +test('the observer does nothing for a shop in English', async () => { + const dom = page('<div id="list"></div>'); + const { PosnicPro } = loadI18n(dom, null); + PosnicPro.i18n._dict = null; + const observer = PosnicPro.i18n.watch(dom.window.document.documentElement); + dom.window.document.getElementById('list').innerHTML = '<th><lang class="lang_item_name">Item name</lang></th>'; + await new Promise((resolve) => setTimeout(resolve, 0)); + assert.equal(dom.window.document.querySelector('lang').textContent, 'Item name'); + assert.equal(dom.window.document.querySelector('lang').hasAttribute('data-en'), false, 'nothing should have been touched'); + observer.disconnect(); +}); diff --git a/tests/i18n.test.js b/tests/i18n.test.js new file mode 100644 index 000000000..9a8c8b7f0 --- /dev/null +++ b/tests/i18n.test.js @@ -0,0 +1,755 @@ +'use strict'; + +/* + * Language handling in the frontend. + * + * Owner, 2026-09-01: "okay start with tamil." + * + * What is pinned here is the shape that made a third language impossible, so + * it cannot come back: + * + * - the current language was identified by a PAGE FILENAME + * ('ta_dashboard.html') compared as a literal in 63 places across 15 + * files, which is a two-way branch with no room for a third arm; + * - the words themselves lived in JavaScript, where no translator could + * reach them - and where nine Tamil strings in sales.js had been corrupted + * into mojibake and shipped to the sale screen. + * + * See Intranet docs/MULTI_LANGUAGE_ARCHITECTURE.md for the full path. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { spawnSync } = require('child_process'); + +const FRONTEND = path.join(__dirname, '..', 'frontend'); +const MODULES = path.join(FRONTEND, 'static', 'script', 'js', 'modules', 'js'); +const CORE = path.join(FRONTEND, 'static', 'script', 'js', 'core', 'PosnicPro.js'); +/* Language files sit at the repository root so contributors can find them. */ +const LANGUAGES_DIR = path.join(__dirname, '..', 'languages'); + +/* + * The WHOLE script tree, not just modules/js. + * + * The first pass of this work only looked at modules/js, and PosnicPro.js + * itself quietly kept three filename comparisons and three Tamil words. A test + * scoped more narrowly than the problem finds nothing and says so confidently. + * + * Vendor bundles are excluded: jQuery and friends are not ours to translate, + * and a minified library is full of byte sequences that look like anything. + */ +const SCRIPTS = path.join(FRONTEND, 'static', 'script'); +const SKIP_DIR = /^(vendor|plugins|lazy)$/; +const VENDOR_FILE = /\.min\.js$|^(jquery|bootstrap|select2|moment|summernote|jspdf|html2canvas|sortable|dexie|hasher|crossroads|signals)/i; + +function ourScripts(dir = SCRIPTS, out = []) { + for (const e of fs.readdirSync(dir, { withFileTypes: true })) { + if (e.isDirectory()) { if (!SKIP_DIR.test(e.name)) ourScripts(path.join(dir, e.name), out); } + else if (e.name.endsWith('.js') && !VENDOR_FILE.test(e.name)) out.push(path.join(dir, e.name)); + } + return out; +} + +const moduleFiles = () => ourScripts().map((f) => path.relative(SCRIPTS, f)); +const read = (f) => fs.readFileSync(path.join(SCRIPTS, f), 'utf8'); + +/* + * PosnicPro.js is 200KB+, so a bare indexOf('is: function') lands somewhere + * unrelated and every assertion built on it becomes meaningless. The i18n + * object is cut out once, and its members are found inside that. + */ +function i18nSource() { + const core = fs.readFileSync(CORE, 'utf8'); + const start = core.indexOf('PosnicPro.i18n = {'); + assert.ok(start > 0, 'PosnicPro.i18n is missing'); + const end = core.indexOf('\nPosnicPro.i18n.load()', start); + assert.ok(end > start, 'PosnicPro.i18n is not closed as expected'); + return core.slice(start, end); +} +/* + * One member's source. + * + * Done by locating boundaries rather than with one regex: "select: function" + * contains "t: function" as a substring, and in multiline mode `$` matches the + * end of a LINE, so a lookahead alternation on `$` truncates every match at + * the first newline and each assertion then passes or fails on nothing. + */ +function member(name) { + const src = i18nSource(); + const starts = [...src.matchAll(/^ {4}([a-z_]+): function/gm)] + .map((m) => ({ name: m[1], at: m.index })); + const i = starts.findIndex((x) => x.name === name); + assert.ok(i >= 0, 'PosnicPro.i18n has no ' + name + '(). Found: ' + + starts.map((x) => x.name).join(', ')); + const end = i + 1 < starts.length ? starts[i + 1].at : src.length; + return src.slice(starts[i].at, end); +} + +/* ------------------------------------------------- the language is a code --- */ + +test('no module decides the language by comparing a page filename', () => { + /* + * This is the thing that capped us at two languages. A filename comparison + * is a two-way branch; a third language does not fit without editing every + * one of them. + */ + const code = (t) => t.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, ''); + const offenders = moduleFiles().filter((f) => /ta_dashboard\.html/.test(code(read(f)))); + assert.deepEqual(offenders, [], + 'these still identify the language by filename: ' + offenders.join(', ')); +}); + +test('i18n.select() is the only thing that writes the language', () => { + /* + * Writing the filename without the code leaves i18n.code() answering with + * the language the user just left, until the next reload. + * + * select() is the sanctioned writer and lives in PosnicPro.js, so the check + * is not "nobody writes it" but "nobody else does" - and that it is written + * inside select() rather than somewhere that merely happens to be in the + * same file. + */ + const offenders = moduleFiles() + .filter((f) => f !== path.join('js', 'core', 'PosnicPro.js')) + .filter((f) => /local\.set\(\s*'language_herf'/.test(read(f))); + assert.deepEqual(offenders, [], 'these bypass i18n.select(): ' + offenders.join(', ')); + + const core = fs.readFileSync(CORE, 'utf8'); + const writes = (core.match(/local\.set\(\s*'language_herf'/g) || []).length; + assert.equal(writes, 1, 'the core should write language_herf exactly once'); + assert.match(member('select'), /local\.set\(\s*'language_herf'/, + 'the one write is not inside select()'); +}); + +test('the language check has one implementation', () => { + const core = fs.readFileSync(CORE, 'utf8'); + assert.match(core, /PosnicPro\.i18n\s*=\s*\{/, 'PosnicPro.i18n is missing'); + for (const fn of ['code:', 'is:', 't:', 'select:', 'load:']) { + assert.ok(core.includes(fn), 'PosnicPro.i18n has no ' + fn); + } +}); + +test('an existing Tamil shop is migrated, not reset', () => { + /* + * Installs already hold language_herf='ta_dashboard.html' and nothing else. + * Deriving the code from it is what stops every Tamil shop silently + * reverting to English on upgrade. + */ + const codeFn = member('code'); + assert.match(codeFn, /language_herf/, 'code() does not read the legacy value'); + assert.match(codeFn, /\[a-z\]\{2\}/, 'code() does not extract a code from the filename'); +}); + +/* ------------------------------------------------ English always survives --- */ + +test('t() falls back to the English it was given', () => { + /* + * The whole safety property. Before the pack loads, if it 404s, if a key is + * missing or a language is half done, the caller gets real English - never + * "undefined", which is what the HTML build used to ship. + */ + const tFn = member('t'); + assert.match(tFn, /return english/, 't() does not fall back to English'); + assert.match(tFn, /trim\(\)\s*!==\s*''/, 't() treats an empty translation as translated'); +}); + +test('English fetches no language pack at all', () => { + /* Nothing to fetch means nothing that can fail for most shops. */ + const loadFn = member('load'); + assert.match(loadFn, /code === 'en'/, 'English still tries to load a pack'); +}); + +/* ------------------------------------------------------------- mojibake --- */ + +test('no module JS contains mojibake', () => { + /* + * 'பà¯à®¤à®¿à®¯' is the Tamil word புதிய with its UTF-8 bytes read as + * Latin-1. Nine of these were live on the sale screen. They are invisible in + * review and unmistakable to a Tamil shopkeeper. + */ + const bad = []; + for (const f of moduleFiles()) { + const hits = read(f).match(/[\u0080-\u00FF]{3,}/g) || []; + if (hits.length) bad.push(`${f} (${hits.length}): ${hits[0]}`); + } + assert.deepEqual(bad, [], 'mojibake found:\n ' + bad.join('\n ')); +}); + +test('no language file contains mojibake', () => { + const dir = LANGUAGES_DIR; + const bad = []; + + /* + * Walked, not iterated one level deep. _glossary.json nests its words one + * object further down, and a shallow loop stringified those objects to + * "[object Object]", which never matches - so the one file where every word + * is now authored would have been the one file this test could not see. + */ + const walk = (node, where, file) => { + if (typeof node === 'string') { + if (/[\u0080-\u00FF]{3,}/.test(node)) bad.push(`${file}:${where} = ${node.slice(0, 30)}`); + return; + } + if (node && typeof node === 'object') { + for (const [k, v] of Object.entries(node)) walk(v, where ? `${where}.${k}` : k, file); + } + }; + + for (const f of fs.readdirSync(dir).filter((x) => x.endsWith('.json'))) { + walk(JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8')), '', f); + } + assert.deepEqual(bad, [], 'mojibake in a language file:\n ' + bad.join('\n ')); +}); + +/* ------------------------------------------------------ the packs ship --- */ + +test('the build emits a pack for every non-English language', () => { + const config = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js', 'config.js'), 'utf8'); + /* Parse the LANGUAGES list, not every two-letter string in the file - + require('fs') is not a language, and reading it as one made this test + demand a languages/fs.json. */ + const arr = /const LANGUAGES = \[([\s\S]*?)\n\];/.exec(config); + assert.ok(arr, 'config.js has no LANGUAGES list'); + const declared = [...arr[1].matchAll(/code: '([a-z]{2})'/g)].map((m) => m[1]); + assert.ok(declared.includes('en') && declared.includes('ta'), 'config lists en and ta'); + for (const lang of declared) { + if (lang === 'en') continue; + assert.ok(fs.existsSync(path.join(LANGUAGES_DIR, `${lang}.json`)), + `no languages/${lang}.json for declared language ${lang}`); + } + const gulp = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js', 'index.js'), 'utf8'); + assert.match(gulp, /buildLangPacks/, 'the build has no language-pack task'); + assert.match(gulp, /parallel\([^)]*buildLangPacks/, 'buildLangPacks is not part of the build'); +}); + +test('every language file is valid JSON with string values', () => { + const dir = LANGUAGES_DIR; + /* A leading underscore means "not a language pack". _glossary.json is the + source the packs are seeded from, and its values are objects of languages + rather than strings. The mojibake test above still reads it, because that + is the check it must never be exempt from. */ + for (const f of fs.readdirSync(dir).filter((x) => x.endsWith('.json') && !x.startsWith('_'))) { + const raw = fs.readFileSync(path.join(dir, f), 'utf8'); + let dict; + assert.doesNotThrow(() => { dict = JSON.parse(raw); }, `${f} is not valid JSON`); + for (const [k, v] of Object.entries(dict)) { + assert.equal(typeof v, 'string', `${f}:${k} is not a string`); + } + } +}); + +/* -------------------------------------------------- one tree, not N (L3) --- */ + +test('the build writes one page per screen, not one per language', () => { + /* + * Translating at build time wrote a complete second copy of every page for + * each language: 2.3MB of duplicated markup to deliver 43KB of Tamil, and + * ~23MB by the tenth language. The words are fetched at runtime now, so the + * output must not depend on how many languages exist. + */ + const html = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js', 'html.js'), 'utf8'); + assert.ok(!/\$\{lang\}_\$\{item\}|lang === 'en' \? item :/.test(html), + 'the build still names output files after a language'); + assert.match(html, /markTranslatable/, 'the build does not mark pages for runtime translation'); +}); + +test('the build sweeps per-language pages a previous build left', () => { + /* A stale ta_dashboard.html still loads and still looks right, frozen at + whatever the app said the day it was written. */ + const html = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js', 'html.js'), 'utf8'); + assert.match(html, /\^\[a-z\]\{2\}_\.\+\\.html\$/, 'nothing removes stale per-language pages'); +}); + +test('title and option carry the key on the parent, never a nested tag', () => { + /* + * Inside <title> and <option> the parser does not build an element for a + * nested tag, so leaving one there prints angle brackets at the customer. + */ + const html = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js', 'html.js'), 'utf8'); + const fn = html.slice(html.indexOf('function markTranslatable')); + assert.match(fn, /title\|option/, 'title and option are not special-cased'); + assert.match(fn, /data-t=/, 'the key is not hoisted onto the parent'); +}); + +test('the marker element cannot affect layout', () => { + /* + * 1,351 places that used to contain bare text now contain an inline element + * around it. display:contents removes its box entirely, so spacing is + * unchanged on screens nobody will re-check by hand. + */ + const css = fs.readFileSync( + path.join(FRONTEND, 'static', 'style', 'css', 'modules', 'font.css'), 'utf8'); + assert.match(css, /lang\s*\{[^}]*display:\s*contents/, + 'lang elements have no display:contents rule'); +}); + +test('the runtime translates both shapes', () => { + const core = fs.readFileSync(CORE, 'utf8'); + const applyFn = member('apply'); + assert.match(applyFn, /lang\[class\]/, 'apply() does not translate <lang> tags'); + assert.match(applyFn, /\[data-t\]/, 'apply() does not translate hoisted keys'); + assert.match(applyFn, /if \(!dict\) return/, 'English should do no work at all'); + assert.ok(core.includes('DOMContentLoaded'), 'apply() never runs on its own'); +}); + +/* ------------------------------------------------ offline, and delivery --- */ + +test('the service worker caches the language pack', () => { + /* + * Pages ship in English and the words arrive by fetch, so without this a + * Tamil shop that loses its connection silently reverts to English - on a + * till, in front of a customer. + */ + const sw = fs.readFileSync(path.join(FRONTEND, 'sw-template.js'), 'utf8'); + assert.match(sw, /LANGUAGE_PACK\s*=/, 'the worker does not recognise a language pack'); + assert.match(sw, /REFERENCE\.test\(url\.pathname\) \|\| LANGUAGE_PACK\.test\(url\.pathname\)/, + 'the pack is not routed to the caching branch'); +}); + +test('the pack is cached on first use, never precached', () => { + /* + * Precaching every language would put the weight back that this whole + * exercise removed: a shop should download the one language it chose. + */ + const sw = fs.readFileSync(path.join(FRONTEND, 'sw-template.js'), 'utf8'); + const precacheLine = sw.split('\n').find((l) => /const PRECACHE/.test(l)) || ''; + assert.ok(!/languages/.test(precacheLine), 'language packs are precached'); +}); + +test('the language-pack pattern matches packs and nothing else', () => { + const sw = fs.readFileSync(path.join(FRONTEND, 'sw-template.js'), 'utf8'); + const m = /const LANGUAGE_PACK = (\/.*\/);/.exec(sw); + assert.ok(m, 'LANGUAGE_PACK is not a literal regex'); + // eslint-disable-next-line no-eval + const re = eval(m[1]); + for (const good of ['/languages/ta.json', '/languages/hi.json', '/languages/pt-BR.json']) { + assert.ok(re.test(good), 'should match ' + good); + } + /* Not user uploads, not scripts, not anything that merely says "languages". */ + for (const bad of ['/uploads/languages/x.json', '/api/languages.json', '/languages/ta.js', '/settings.json']) { + assert.ok(!re.test(bad), 'should NOT match ' + bad); + } +}); + +test('the signed asset bundle carries the packs', () => { + /* + * The owner suggested S3. The asset channel already ships frontend/public + * signed, staged and revertible, and the packs are written into that tree - + * so delivery needed no new code and no second, weaker door. This pins that + * the bundler still walks the whole tree rather than a list that could + * forget them. + */ + const bundler = fs.readFileSync( + path.join(__dirname, '..', 'scripts', 'build-asset-bundle.js'), 'utf8'); + assert.match(bundler, /frontend', 'public'/, 'the bundler no longer reads frontend/public'); + assert.match(bundler, /walk\(assetsDir, assetsDir\)/, 'the bundler no longer walks the tree'); + const skip = /const skip = new Set\(\[([^\]]*)\]\)/.exec(bundler); + assert.ok(skip && !/languages/.test(skip[1]), 'language packs are excluded from the bundle'); +}); + +/* ------------------------------------- adding a language is data only (L5) --- */ + +test('the language menu is generated, not hand-written', () => { + /* + * The header carried one <a> per language, so adding a language meant + * editing markup - the last place it was still a code change. One English + * entry stays in the HTML on purpose: if the list cannot be read, the menu + * must still offer something rather than nothing. + */ + const header = fs.readFileSync(path.join(FRONTEND, 'layouts', 'header.html'), 'utf8'); + const entries = (header.match(/<a class="dropdown-item"[^>]*data-code=/g) || []).length; + assert.equal(entries, 1, 'the header should hold exactly one fallback entry, not one per language'); + assert.ok(!/data-id="[a-z]{2}_/.test(header), 'the menu still points at per-language filenames'); + + const dash = fs.readFileSync(path.join(FRONTEND, 'static', 'script', 'js', 'modules', 'js', 'dashboard.js'), 'utf8'); + assert.match(dash, /languages\/index\.json/, 'the menu is not built from the shipped list'); + assert.match(dash, /\$\('#change_language'\)\.on\('click', 'a'/, + 'the handler is not delegated, so generated entries would be dead'); +}); + +test('the build publishes the list the menu reads', () => { + const gulp = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js', 'index.js'), 'utf8'); + assert.match(gulp, /index\.json/, 'no language list is published'); + const config = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js', 'config.js'), 'utf8'); + assert.match(config, /const LANGUAGES = \[/, 'languages carry no display names'); + /* A language a speaker cannot recognise is not offered to them. */ + assert.match(config, /name: 'தமிழ்'/, 'Tamil is not named in Tamil'); +}); + +test('every declared language has a pack, and every pack is declared', () => { + /* + * A language in the menu with no file behind it is a menu entry that does + * nothing. A file nobody declared is work that will never appear on screen - + * the more disheartening of the two if a contributor wrote it. + */ + const config = require(path.join(FRONTEND, 'gulpfile.js', 'config.js')); + const declared = config.LANGUAGES.map((l) => l.code).filter((c) => c !== 'en'); + const onDisk = fs.readdirSync(LANGUAGES_DIR) + .filter((f) => f.endsWith('.json') && !f.startsWith('_')) + .map((f) => f.replace(/\.json$/, '')); + + const missing = declared.filter((c) => !onDisk.includes(c)); + assert.deepEqual(missing, [], 'declared with no languages/<code>.json: ' + missing.join(', ')); + + const undeclared = onDisk.filter((c) => !declared.includes(c)); + assert.deepEqual(undeclared, [], + 'a pack exists but no LANGUAGES entry offers it: ' + undeclared.join(', ')); +}); + +test('the glossary agrees with itself', () => { + /* + * The glossary is the one file where a mistake reaches every screen of a + * language at once, so it is worth more checking than a single key. + */ + const glossary = JSON.parse( + fs.readFileSync(path.join(LANGUAGES_DIR, '_glossary.json'), 'utf8')); + const known = new Set(glossary.languages); + + const strays = []; + for (const [term, byLang] of Object.entries(glossary.terms)) { + for (const [code, word] of Object.entries(byLang)) { + if (!known.has(code)) strays.push(`${term}: "${code}" is not in the languages list`); + if (typeof word !== 'string') strays.push(`${term}.${code} is not text`); + else if (word !== word.trim()) strays.push(`${term}.${code} has a stray space: "${word}"`); + } + } + assert.deepEqual(strays, [], 'glossary problems:\n ' + strays.join('\n ')); + + /* Terms that must never be translated: a shopkeeper matches GST and its + relatives against a government form, character for character. */ + assert.ok(glossary.doNotTranslate.includes('GST'), 'GST is not protected from translation'); + for (const term of glossary.doNotTranslate) { + assert.ok(!Object.prototype.hasOwnProperty.call(glossary.terms, term), + `${term} is marked do-not-translate but has translations in the glossary`); + } +}); + +test('stylesheets are written once, not once per language', () => { + /* + * This looped the languages and wrote the same path every time - the + * filename never carried the language - so every stylesheet was rewritten + * once per language for no effect. Pointless work that grows with the list. + */ + const css = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js', 'css.js'), 'utf8'); + assert.ok(!/languages\.forEach/.test(css), 'CSS is still written once per language'); +}); + +/* --------------------------------------- every language ships, honestly --- */ + +test('every declared language ships by default, and says whether a speaker has read it', () => { + /* + * Owner, 2026-09-02: ship them all; the community improves them over time. + * + * A gate that hides a language until it is perfect is a language nobody + * will ever correct - the people who could fix it are exactly the people who + * would have picked it. What ships instead of the gate is honesty: every + * entry says whether a speaker has read it, and the menu turns that into a + * "beta" mark beside the name. Every missing word is still English. + */ + const config = require(path.join(FRONTEND, 'gulpfile.js', 'config.js')); + assert.ok(!config.reviewedOnly, + 'POSNIC_REVIEWED_LANGUAGES_ONLY is set in the test environment, so this proves nothing'); + assert.deepEqual(config.shippedLanguages.map((l) => l.code), config.LANGUAGES.map((l) => l.code), + 'the default build leaves a declared language out'); + for (const l of config.LANGUAGES) { + assert.equal(typeof l.reviewed, 'boolean', l.code + ' does not say whether it was reviewed'); + } + const reviewed = config.LANGUAGES.filter((l) => l.reviewed).map((l) => l.code); + assert.ok(reviewed.includes('en') && reviewed.includes('ta'), 'English and Tamil are the reviewed pair'); +}); + +test('an installer can still ask for reviewed languages only', () => { + /* The env is read when config.js loads, so it has to be a fresh process. */ + const r = spawnSync(process.execPath, ['-e', + 'console.log(JSON.stringify(require(process.argv[1]).shippedLanguages.map((l) => l.code)))', + path.join(FRONTEND, 'gulpfile.js', 'config.js')], + { encoding: 'utf8', env: { ...process.env, POSNIC_REVIEWED_LANGUAGES_ONLY: '1' } }); + assert.equal(r.status, 0, r.stderr); + assert.deepEqual(JSON.parse(r.stdout.trim()), ['en', 'ta']); +}); + +test('the shipped list carries direction, review state and coverage', () => { + /* + * index.json is what the menu reads. Direction lets the menu entry itself + * render right-to-left; reviewed drives the beta mark; coverage is the + * number a translator wants to see move, computed by the SAME tool the + * coverage report and the translations CI use, so the build cannot + * disagree with them. + */ + const gulp = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js', 'index.js'), 'utf8'); + assert.match(gulp, /reviewed: !!l\.reviewed/, 'index.json entries do not carry reviewed'); + assert.match(gulp, /entry\.coverage =/, 'index.json entries do not carry coverage'); + assert.match(gulp, /i18n-coverage\.js/, 'coverage is not computed by the tool CI uses'); + const config = require(path.join(FRONTEND, 'gulpfile.js', 'config.js')); + assert.equal(config.LANGUAGES.find((l) => l.code === 'ar').dir, 'rtl', 'Arabic is not declared right-to-left'); +}); + +test('the menu marks an unreviewed language as beta and settles a first run from the browser', () => { + const dash = fs.readFileSync(path.join(FRONTEND, 'static', 'script', 'js', 'modules', 'js', 'dashboard.js'), 'utf8'); + assert.match(dash, /l\.reviewed === false/, 'the menu ignores the reviewed flag'); + assert.match(dash, />beta</, 'an unreviewed language is not marked'); + /* The first run is settled ONCE, in the core, so login and dashboard agree; + the menu only waits for it. */ + const core = fs.readFileSync(CORE, 'utf8'); + assert.match(core, /PosnicPro\.i18n\.ready = /, 'the core publishes no ready promise'); + assert.match(core, /i18n\.detect\(list/, 'a first run does not consult the browser language'); + assert.match(core, /i18n\.chosen\(\)/, 'detection is not gated on "never chosen"'); + assert.match(dash, /i18n\.ready\.then/, 'the menu does not wait for the settled language'); + /* The old ready() wrote English back as if somebody had chosen it, which + would have stopped detection from ever running. */ + assert.ok(!/select\('dashboard\.html'\)/.test(dash), 'the dashboard still writes English as a choice'); +}); + +/* --------------------------------------- the document knows its language --- */ + +test('the runtime sets the document language and direction', () => { + /* + * <html lang> is what screen readers, spell-checkers, hyphenation and font + * fallback read. dir="rtl" is the whole of Arabic's text layout. Both come + * from the code, before any pack arrives, so direction never waits on a + * fetch. + */ + const markFn = member('mark'); + assert.match(markFn, /documentElement\.setAttribute\('lang'/, 'html lang is not set'); + assert.match(markFn, /'dir'/, 'html dir is not set'); + assert.match(i18nSource(), /_rtl:\s*\{[^}]*\bar:/, 'Arabic is not in the right-to-left set'); + assert.match(member('change'), /i18n\.mark\(\)/, 'switching language does not re-mark the document'); + assert.match(member('load'), /i18n\.mark\(\)/, 'direction waits on the pack fetch'); +}); + +test('first-run detection is a BCP 47 lookup over what the build ships', () => { + /* RFC 4647 lookup: the full tag first ('pt-BR'), then its primary subtag + ('pt'), through the browser's preference list in order; English last. */ + const detectFn = member('detect'); + assert.match(detectFn, /nav\.languages/, 'detect() ignores the browser preference list'); + assert.match(detectFn, /split\('-'\)\[0\]/, 'detect() does not fall back to the primary subtag'); + assert.match(detectFn, /return 'en'/, 'detect() has no English fallback'); + /* And asking for the code must not count as choosing - that is what kept + every fresh install silently pinned to English. */ + assert.ok(!/stored = m \? m\[1\] : 'en'/.test(member('code')), 'code() still writes English back as a choice'); +}); + +test('switching back to English restores the words the page shipped with', () => { + /* + * English lives in the markup, not in any pack. Once a translation has + * overwritten it, the only way back was a reload. apply() now keeps the + * shipped markup on the element the first time it replaces it. + */ + assert.match(member('apply'), /_english/, 'apply() does not keep the English before overwriting it'); + assert.match(member('restore'), /_english/, 'restore() does not read the kept English'); + assert.match(member('change'), /restore\(\)/, 'change() never restores English'); +}); + +test('the RTL stylesheet rides the pages a shopkeeper sees, and loads last', () => { + const map = JSON.parse(fs.readFileSync(path.join(FRONTEND, 'pages_css_js_map.json'), 'utf8')); + for (const page of ['dashboard', 'login', 'forgotpassword']) { + const css = map[page].css; + assert.equal(css[css.length - 1], 'static/style/css/rtl.css', page + ' does not load rtl.css last'); + } + const rtl = fs.readFileSync(path.join(FRONTEND, 'static', 'style', 'css', 'rtl.css'), 'utf8'); + assert.match(rtl, /\[dir="rtl"\] \.leftbar/, 'the sidebar is not mirrored'); + assert.match(rtl, /\[dir="rtl"\] \.topbar/, 'the top bar is not mirrored'); + /* Every rule is scoped: an LTR page must pay nothing for this sheet. */ + const unscoped = rtl.split('\n').filter((l) => /^[.#a-z]/.test(l) && !/^\[dir/.test(l)); + assert.deepEqual(unscoped, [], 'rules not scoped under [dir="rtl"]: ' + unscoped.join(' | ')); +}); + +test('no language pack slips below the point it reached', () => { + /* + * A ratchet, not a floor. tests/i18n-coverage-baseline.json records where + * every pack stood the last time translations were merged; a pack may only + * go up from there. A flat floor would sit red for as long as the UI is + * being tagged faster than the packs are filled - and a red test everybody + * has learned to ignore protects nothing. + * + * One point of slack covers key churn: a screen edit that renames a key + * costs a pack a fraction of a percent before anybody has had a chance to + * translate the new name. + * + * node tests/tools/i18n-coverage.js --worksheet <code> what is missing + * node tests/tools/i18n-coverage.js --write-baseline after merging + */ + const { report } = require(path.join(__dirname, 'tools', 'i18n-coverage.js')); + const baseline = JSON.parse(fs.readFileSync(path.join(__dirname, 'i18n-coverage-baseline.json'), 'utf8')); + const rows = report().rows.filter((r) => !r.error && !r.lang.startsWith('_')); + assert.ok(rows.length >= 17, 'expected the seventeen packs, found ' + rows.length); + const slipped = rows.filter((r) => r.coverage < (baseline[r.lang] || 0) - 1) + .map((r) => r.lang + ' at ' + r.coverage + '% (baseline ' + baseline[r.lang] + '%)'); + assert.deepEqual(slipped, [], 'packs below their baseline:\n ' + slipped.join('\n ')); + const unknown = rows.filter((r) => !(r.lang in baseline)).map((r) => r.lang); + assert.deepEqual(unknown, [], 'packs with no baseline (run --write-baseline): ' + unknown.join(', ')); +}); + + +test('the English map the console edits against is not stale', () => { + /* + * languages/_english.json is what the staff console shows a translator + * beside each box - the sentence they are translating. The packs do not + * carry the English themselves (it lives in the markup, which is what makes + * a missing key fall back correctly), so this file is the only copy an + * editor outside this repo can read. + * + * Generated by `node tests/tools/i18n-coverage.js --write-english`. Pinned + * here because a stale map shows the wrong English, and somebody would + * translate it faithfully - a worse failure than showing none, since it + * looks right on both sides. + */ + const { report } = require(path.join(__dirname, 'tools', 'i18n-coverage.js')); + const expected = {}; + for (const [key, c] of report().context) if (c.english) expected[key] = c.english; + + const file = path.join(__dirname, '..', 'languages', '_english.json'); + assert.ok(fs.existsSync(file), 'languages/_english.json is missing - run i18n-coverage.js --write-english'); + const actual = JSON.parse(fs.readFileSync(file, 'utf8')); + + const missing = Object.keys(expected).filter((k) => !(k in actual)); + const extra = Object.keys(actual).filter((k) => !(k in expected)); + const changed = Object.keys(expected).filter((k) => k in actual && actual[k] !== expected[k]); + assert.deepEqual({ missing, extra, changed }, { missing: [], extra: [], changed: [] }, + 'languages/_english.json is out of date - run: node tests/tools/i18n-coverage.js --write-english'); +}); + +/* ------------------------------------------- what JavaScript draws, too --- */ + +test('the runtime watches for markup drawn after load', () => { + const watchFn = member('watch'); + assert.match(watchFn, /MutationObserver/, 'watch() does not observe the document'); + assert.match(watchFn, /if \(!PosnicPro\.i18n\._dict\) return/, 'English still pays for the observer'); + const core = fs.readFileSync(CORE, 'utf8'); + assert.match(core, /^PosnicPro\.i18n\.watch\(\);/m, 'nothing starts the observer'); +}); + +test('attributes people read are translated', () => { + assert.match(i18nSource(), /_attrs: \['placeholder', 'title', 'aria-label'\]/, 'the attribute list is missing'); + assert.match(member('apply'), /data-t-' \+ attrs\[a\]/, 'apply() ignores data-t-<attr>'); + assert.match(member('restore'), /data-en-' \+ attrs\[a\]/, 'restore() ignores the kept attributes'); +}); + +test('the coverage tool counts keys JavaScript renders as markup', () => { + const tool = fs.readFileSync(path.join(__dirname, 'tools', 'i18n-coverage.js'), 'utf8'); + assert.match(tool, /JavaScript renders markup too/, 'JS <lang> tags are not counted'); + assert.match(tool, /data-t-\(placeholder\|title\|aria-label\)/, 'attribute keys are not counted'); +}); + +test('the screens the owner checked carry keys, not bare English', () => { + /* + * develop.posnic.io, 2026-09-02: the dashboard greeting and totals, the + * quick-action buttons, the sales list headers, the receipt panel and the + * supplier list were English in every language. Each is pinned here by a + * string that must now be reachable through a key. + */ + const html = (f) => fs.readFileSync(path.join(FRONTEND, 'modules', f), 'utf8'); + const js = (f) => fs.readFileSync(path.join(MODULES, f), 'utf8'); + assert.match(html('dashboard.html'), /<lang class="[^"]+">Totals<\/lang>/, 'Totals is bare'); + assert.match(html('dashboard.html'), /<lang class="[^"]+">Gross profit<\/lang>/, 'Gross profit is bare'); + assert.match(html('dashboard.html'), /<lang class="[^"]+">Sales History<\/lang>/, 'Sales History button is bare'); + assert.match(js('dashboard.js'), /i18n\.t\('[^']+', 'Good Morning'\)/, 'the greeting is bare'); + assert.match(js('sales.js'), /<th><lang class="[^"]+">Bill #<\/lang><\/th>/, 'the sales list header is bare'); + assert.match(js('sales.js'), /<lang class="[^"]+">Subtotal<\/lang>/, 'the receipt panel is bare'); + assert.match(js('suppliers.js'), /<th><lang class="[^"]+">Name<\/lang><\/th>/, 'the supplier list header is bare'); + const core = fs.readFileSync(CORE, 'utf8'); + assert.match(core, /_sort_label"><lang class="[^"]+">Sort<\/lang>/, 'the Sort control is bare'); +}); + +/* ------------------------------------------- nothing bare on the screen --- */ + +test('no template carries English a pack cannot reach', () => { + /* + * develop.posnic.io, 2026-09-02: the owner picked Tamil and found the + * dashboard totals, the list headers, the receipt panel and the supplier + * screen still in English. None of it was inside <lang>, so no pack could + * reach it. Every template was swept; this holds the sweep. A new screen + * that adds bare text fails here, and the fix is one command: + * + * node tests/tools/i18n-tag.js --write + * + * The number is zero, and stays zero. It was a budget of two while a false + * positive stood in the report - an onclick handler holding a > that the + * text scan read as prose. That is fixed, so the guard can say what it + * means: every word on every template is reachable by a language pack. + */ + const { report } = require(path.join(__dirname, 'tools', 'i18n-gaps.js')); + const data = report(); + const shown = data.rows.map((r) => r.file + ': ' + r.found.map((x) => x.text).slice(0, 3).join(' | ')); + assert.equal(data.total, 0, 'bare English the packs cannot reach (' + data.total + '):\n ' + shown.join('\n ')); +}); + +test('the sweep tools live in the repository', () => { + for (const tool of ['i18n-tag.js', 'i18n-tag-js.js', 'i18n-gaps.js', 'i18n-screen.js']) { + const file = path.join(__dirname, 'tools', tool); + assert.ok(fs.existsSync(file), tool + ' is missing'); + assert.ok(!/D:\/Claude|C:\\Users/.test(fs.readFileSync(file, 'utf8')), tool + ' carries a machine-specific path'); + } +}); + +test('no module asks for a translation while it is still loading', () => { + /* + * This one shipped, and it took the whole dashboard down. + * + * PosnicPro.js is a single object literal thousands of lines long. A t() + * call written INSIDE that literal runs while the literal is still being + * built, at which point the name PosnicPro is not bound yet - so + * PosnicPro.i18n throws, the rest of the file never executes, and the app + * boots with an empty core object. Nothing catches it: the page simply + * stops working. + * + * It is wrong even where it does not throw. A t() evaluated at load resolves + * before any pack has been fetched, freezing English into a config object + * that switching language afterwards can never reach. + * + * So config data carries plain English and is translated where it is + * rendered; t() belongs inside functions, which run when they are called. + * + * Detected by running each module against a stub that answers every global, + * so nothing else can throw, and watching which t() calls fire. Guessing + * from braces was tried first and quietly missed the fifty-six calls that + * caused the outage. + * + * node tests/tools/i18n-load-time.js what fires, and where + * node tests/tools/i18n-load-time.js --write move them back to English + */ + const { total, sitesByFile } = require(path.join(__dirname, 'tools', 'i18n-load-time.js')); + const detail = Object.entries(sitesByFile) + .map(([file, sites]) => file + ': ' + sites.map((x) => 'line ' + x.line + ' "' + x.english + '"').join(', ')); + assert.equal(total, 0, 't() runs while these modules are still loading:\n ' + detail.join('\n ')); +}); + +test('a brand is spelled, not translated', () => { + /* + * Six translators in a row reported the same fight, and each one lost it + * differently: "Provider Way2sms", "TextLocal", "Msimbo wa Pharmacode", + * "Stile Turbo C", "بوابة Razorpay". None of them was being careless. The + * validator they worked against rejects a value identical to its English - + * the right default, since that is what a skipped row looks like - and it + * had no exemption for a proper noun, so the only way to pass was to change + * the name. A payment tab that no longer names the payment provider. + * + * languages/_glossary.json carries the list, and this is the exemption: + * where a key's whole English IS one of those names, every pack spells it + * the same way. Descriptive names are deliberately absent from that list - + * Soft Dark, Warm Night and Diamond are words, and a theme picker in Thai + * should read in Thai. + */ + const glossary = JSON.parse(fs.readFileSync(path.join(LANGUAGES_DIR, '_glossary.json'), 'utf8')); + const english = JSON.parse(fs.readFileSync(path.join(LANGUAGES_DIR, '_english.json'), 'utf8')); + assert.ok(Array.isArray(glossary.brands) && glossary.brands.length, 'the glossary lists no brands'); + const brands = new Set(glossary.brands.map((b) => b.toLowerCase())); + const keys = Object.keys(english).filter((k) => brands.has(String(english[k]).trim().toLowerCase())); + assert.ok(keys.length, 'no key carries a brand as its whole English'); + + const wrong = []; + for (const file of fs.readdirSync(LANGUAGES_DIR).filter((f) => /^[a-z]{2}\.json$/.test(f))) { + const pack = JSON.parse(fs.readFileSync(path.join(LANGUAGES_DIR, file), 'utf8')); + for (const key of keys) { + const value = pack[key]; + if (typeof value !== 'string' || value.trim() === '') continue; // untranslated is fine + if (value !== english[key]) { + wrong.push(file.slice(0, 2) + '.' + key + ' = ' + JSON.stringify(value) + + ', should be ' + JSON.stringify(english[key])); + } + } + } + assert.deepEqual(wrong, [], 'a brand was rewritten:\n ' + wrong.join('\n ')); +}); diff --git a/tests/ipc-hardening.test.js b/tests/ipc-hardening.test.js index 28146f1ec..ff747846c 100644 --- a/tests/ipc-hardening.test.js +++ b/tests/ipc-hardening.test.js @@ -25,7 +25,7 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8'); -const IPC_FILES = ['main.js', 'hardware-ipc.js', 'pin-lock-ipc.js', 'update-integration.js']; +const IPC_FILES = ['src/main.js', 'src/hardware-ipc.js', 'src/pin-lock-ipc.js', 'src/update-integration.js']; test('no file registers an IPC handler on the raw ipcMain', () => { /* The guard works by shadowing the binding: each file destructures @@ -61,7 +61,7 @@ test('every IPC file routes through the guard', () => { }); test('the guard trusts this application and refuses everything else', () => { - const { isTrustedFrame } = require('../ipc-guard'); + const { isTrustedFrame } = require('../src/ipc-guard'); const previous = process.env.PORT; process.env.PORT = '42590'; @@ -126,7 +126,7 @@ test('the guard does not care which port the app ended up on', () => { /* Whatever resolveLocalPorts derives, and whatever a second window is served from, loopback is loopback. This used to compare against one port and would have refused the customer display. */ - const { isTrustedFrame } = require('../ipc-guard'); + const { isTrustedFrame } = require('../src/ipc-guard'); for (const port of [5555, 42590, 43111, 8080]) { assert.ok( isTrustedFrame({ url: `http://localhost:${port}/x` }), @@ -136,7 +136,7 @@ test('the guard does not care which port the app ended up on', () => { }); test('a refused message never reaches its handler', () => { - const { guard } = require('../ipc-guard'); + const { guard } = require('../src/ipc-guard'); const registered = new Map(); const fakeIpcMain = { @@ -168,7 +168,7 @@ test('every window that loads our preload is sandboxed', () => { /* An attacker looks for the weakest renderer, not the main one. The main window always set sandbox and webSecurity; the backup, hardware, cloud and update windows did not, and they all load the same preload. */ - const src = read('main.js'); + const src = read('src/main.js'); const blocks = src.split('webPreferences:').slice(1); const weak = []; @@ -188,7 +188,7 @@ test('every window that loads our preload is sandboxed', () => { }); test('permissions are denied by default and navigation is confined', () => { - const src = read('main.js'); + const src = read('src/main.js'); assert.match( src, diff --git a/tests/item-form-alignment.test.js b/tests/item-form-alignment.test.js new file mode 100644 index 000000000..ff86a6243 --- /dev/null +++ b/tests/item-form-alignment.test.js @@ -0,0 +1,1262 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { cssReader, stripComments } = require('./helpers/source-lookup'); + +/* + * The Add Item form lines up. + * + * Release-blocking, reported as: "why each field have different width. make it + * even align properly" and "service item, variant item, add categoory add + * supplier and etc not aligned properly". + * + * The root cause of the widths was a fix of mine from an earlier round. Capping + * short fields at 420px solved a real problem — a 700px box for a brand name — + * but it made a field's width depend on which COLUMN it sat in: a col-md-6 + * (~510px available) capped to 420, while a col-md-4 (~355px) never reached the + * cap. Same tab, same kind of field, two widths, and the rows stopped lining + * up. + * + * A cap is not a layout. The columns have to match; then the cap applies evenly + * or not at all, and either way the fields agree. + */ + +const ROOT = path.join(__dirname, '..'); +const html = fs.readFileSync(path.join(ROOT, 'frontend', 'modules', 'items_write.html'), 'utf8'); +const css = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'style', 'css', 'custom.css'), + 'utf8', +); +const itemsJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'items.js'), + 'utf8', +); +const cssRule = cssReader(css); + +/* The column class wrapping a given field id. */ +const columnOf = (id) => { + const at = html.indexOf(`id="${id}"`); + assert.notStrictEqual(at, -1, `#${id} is not on the form`); + const before = html.slice(0, at); + const m = [...before.matchAll(/class="((?:form-group )?col-[\w- ]*)"/g)].pop(); + assert.ok(m, `#${id} sits in no column`); + return m[1]; +}; + +test('every short field on Details shares one column width', () => { + /* This is the reported bug in one assertion. Brand and Tags were col-md-6 and + hit the cap; the dates and position were col-md-4 and did not. */ + const fields = ['items_brand', 'items_tags', 'items_sort', 'items_mfg_date', 'items_expiry_date']; + const spans = fields.map((f) => `${f}: ${columnOf(f)}`); + const distinct = new Set(fields.map((f) => columnOf(f))); + assert.strictEqual( + distinct.size, + 1, + `short fields must share one column span, got ${spans.join(', ')}`, + ); + assert.ok([...distinct][0].includes('col-md-4'), 'a three-across grid keeps the rows aligned'); +}); + +test('the description and the dropzone are the same width', () => { + /* They sit in equal col-lg-6 columns but carried different caps - 640 and + 420 - so one filled its column and the other stopped short. Two panels of + different widths side by side, which is what was on screen. + + Equal, NOT uncapped. My first attempt set both to 100%, and an existing + test caught it: a text column past ~800px is hard to read back, and a + col-lg-6 on a wide monitor is exactly that. Matching the caps gives even + widths AND a readable line length; removing them traded one for the other. */ + const desc = cssRule('#items_new #items_description', 'THE CAP ONLY WORKS IF THE COLUMNS MATCH'); + const drop = cssRule('#items_new .Neon-theme-dragdropbox'); + const d = desc.match(/max-width:\s*(\d+)px/); + const p = drop.match(/max-width:\s*(\d+)px/); + assert.ok(d && p, 'both need an explicit cap to be provably equal'); + assert.strictEqual(d[1], p[1], 'they share a row, so they share a width'); + assert.ok(Number(d[1]) <= 800, 'past ~800px a text column is hard to read back'); +}); + +test('the cap still exists, and says why uniform columns matter', () => { + /* Removing it would bring back the 700px brand box. The point is that a cap + and a grid have to agree, not that caps are wrong. */ + const cap = cssRule('#items_new #item_tab_details input.form-control,'); + assert.match(cap, /max-width:\s*420px/, 'the short-field cap is gone entirely'); + assert.match(css, /THE CAP ONLY WORKS IF THE COLUMNS MATCH/, 'the reasoning is not recorded'); +}); + +test('no field is labelled "optional"', () => { + /* Required fields carry a red asterisk, so marking everything else optional + labels the rule instead of the exception - noise on eleven fields to say + what the absence of an asterisk already says (owner ask). */ + const markup = stripComments(html); + assert.ok(!/lang_optional/.test(markup), 'an "(optional)" label suffix is back'); + assert.ok( + !/placeholder="[^"]*optional[^"]*"/i.test(markup), + 'a placeholder still says optional', + ); + assert.ok( + !/Choose a Supplier \(optional\)/.test(itemsJs), + 'the picker placeholder still says optional', + ); +}); + +test('the asterisk that replaces it is still there', () => { + /* Removing "(optional)" only works while the required fields are marked. */ + const markup = stripComments(html); + for (const id of ['items_name', 'items_selling_price']) { + const at = markup.indexOf(`for="${id}"`); + assert.notStrictEqual(at, -1, `the label for #${id} is gone`); + const label = markup.slice(at, markup.indexOf('</label>', at)); + assert.match(label, /text-danger/, `#${id} is required but carries no asterisk`); + } +}); + +test('the "+ Add" links are gone from the form', () => { + /* Removed on request. They were also the thing pushing "(optional)" down. */ + assert.ok(!/lang_add_category/.test(html), '"+ Add Category" is back'); + assert.ok(!/lang_add_supply/.test(html), '"+ Add Supplier" is back'); + assert.ok(!/items-inline-add/.test(html), 'the link treatment is still applied to something'); + assert.ok(!/items-inline-add/.test(css), 'dead CSS left behind for a link that no longer exists'); +}); + +test('the item KIND is decided above the fields it governs', () => { + /* Service and variants both hide parts of the form below them. Asking them + from inside that form meant a control could hide the row it was standing in + - the owner asked for them "in top may be in title, so that we can hide + properly". They are in the card header now, together, because they answer + the same question. */ + const at = html.indexOf('items-kind-header'); + assert.notStrictEqual(at, -1, 'the kind header is gone'); + const header = html.slice(at, html.indexOf('card-body', at)); + for (const id of ['item_is_service', 'item_service_unit', 'variant_mode_link']) { + assert.ok(header.includes(id), `#${id} is not in the card header any more`); + } + /* The radios that every mode check in items.js reads must come with them. */ + assert.ok(header.includes('product_without_variant'), 'the mode radios were left behind'); + assert.ok(header.includes('product_with_variant'), 'the mode radios were left behind'); + + const row = cssRule('.items-kind-header'); + assert.match(row, /display:\s*flex/, 'the header does not lay the title and controls out'); + assert.match(row, /justify-content:\s*space-between/, 'the controls do not sit opposite the title'); +}); + +test('the service checkbox appears exactly once', () => { + /* It was moved, not copied. Two checkboxes with one id means the one the + browser finds and the one items.js reads can differ. */ + assert.strictEqual((html.match(/id="item_is_service"/g) || []).length, 1); + assert.strictEqual((html.match(/id="item_service_unit"/g) || []).length, 1); +}); + +test('Import is out of the form entirely', () => { + /* It is not a field - it is the alternative to filling the form at all, so it + belongs in the page header, not buried under the fields it lets you skip. */ + const at = html.indexOf('importTableFile'); + assert.notStrictEqual(at, -1, 'the import entry point is gone'); + assert.ok( + html.slice(0, at).includes('id="item_header_actions"'), + 'import is still inside the form body', + ); + assert.ok( + at < html.indexOf('id="item_form_tabs"'), + 'import must sit above the tabs, in the page header', + ); + assert.strictEqual((html.match(/importTableFile/g) || []).length, 1, 'it was copied, not moved'); +}); + +test('Import opens where you are, and does not navigate away', () => { + /* It carried href="#/items" and fired the dialog on a 300ms timer, so asking + to import FROM the Add Item page went to the item list first - discarding + anything already typed - and the delay existed only to wait for that page. + #import_modal is global and the results render into its own table, so the + trip was never needed. */ + const at = html.indexOf('id="item_import_btn"'); + assert.notStrictEqual(at, -1, 'the import control is gone'); + const el = html.slice(html.lastIndexOf('<', at), html.indexOf('>', html.indexOf('onclick', at)) + 1); + assert.ok(!/href=/.test(el), 'it still navigates - typed values are lost on the way'); + assert.ok(!/setTimeout/.test(el), 'the timer only existed to wait for a page change'); + assert.match(el, /onclick="PosnicPro\.importTableFile\('items'\);"/, 'it must open the dialog directly'); + assert.match(el, /^<button/, 'a link that goes nowhere should not be an anchor'); +}); + +test('showing the service unit does not fight its own row', () => { + /* applyServiceMode replaces the whole style attribute. It used to write + width:auto, which overrode the row's sizing and put the select back where + it started. */ + const at = itemsJs.indexOf("$('#item_service_unit').attr('style'"); + assert.notStrictEqual(at, -1, 'the toggle is gone'); + const line = itemsJs.slice(at, itemsJs.indexOf('\n', at)); + assert.ok(!/width:auto/.test(line), 'the toggle writes sizing that the CSS row owns'); + assert.match(line, /display:none !important/, 'the markup hides it with !important - this must beat it'); +}); + +/* + * Getting through a tabbed form (owner: "next button to move next tab... if one + * tab full completed green tick or something"). + */ +test('every tab has a way forward', () => { + const navs = [...html.matchAll(/data-nav-for="(\w+)"/g)].map((m) => m[1]); + assert.deepStrictEqual( + navs, + ['item_tab_main', 'item_tab_details', 'item_tab_more'], + 'each pane needs its own step row, in order', + ); + assert.match(html, /class="btn btn-sm btn-primary item-tab-next" data-goto="item_tab_details"/); + assert.match(html, /class="btn btn-sm btn-primary item-tab-next" data-goto="item_tab_more"/); + /* The last tab has no Next and the first has no Back - a button that goes + nowhere is worse than no button. */ + assert.ok(!/item-tab-next" data-goto="item_tab_main"/.test(html), 'Next must not loop back to the start'); + assert.ok(!/item-tab-back" data-goto="item_tab_more"/.test(html), 'Back must not point forwards'); +}); + +test('a tick means the tab is FINISHED, not merely touched', () => { + /* It used to tick after one field, which told nobody anything. Every visible + field in the tab has to be answered (owner ask). */ + const fn = itemsJs.slice(itemsJs.indexOf('PosnicPro.items.tabIsComplete')); + const body = fn.slice(0, fn.indexOf('\n};')); + assert.match(body, /if \(\$\.trim\(\$f\.val\(\) \|\| ''\) === ''\) \{ complete = false; \}/, + 'an empty field no longer blocks the tick'); + assert.ok(!/done = true/.test(body), 'the old "any field wins" rule is back'); + assert.ok(!/TAB_REQUIRED/.test(itemsJs), 'the per-tab required list should be gone'); +}); + +test('checkboxes and radios cannot block a tick', () => { + /* Unchecked IS an answer. Requiring them would mean ticking every toggle on + the form to earn a tick - the opposite of what it should encourage. */ + const fn = itemsJs.slice(itemsJs.indexOf('PosnicPro.items.tabIsComplete')); + const body = fn.slice(0, fn.indexOf('\n};')); + assert.match(body, /type === 'checkbox' \|\| type === 'radio' \|\| type === 'hidden'/); + assert.match(body, /is\(':disabled'\) \|\| \$f\.prop\('readonly'\)/, 'disabled fields would block it'); +}); + +test('a field the mode has hidden cannot block a tick', () => { + /* Service mode hides stock, variant mode hides price and SKU. A tab cannot be + incomplete because of a box nobody can reach. */ + const fn = itemsJs.slice(itemsJs.indexOf('PosnicPro.items.tabIsComplete')); + const body = fn.slice(0, fn.indexOf('\n};')); + assert.match(body, /is\(':visible'\)/, 'hidden fields are still counted'); + /* select2 hides its own <select>, so :visible on it is always false - the + rendered container is what the user can see. */ + assert.match(body, /select2-hidden-accessible/, 'every select2 field would read as hidden'); + assert.match(body, /next\('\.select2-container'\)/, 'nothing looks at the rendered control'); +}); + +test('an empty tab is not a complete one', () => { + /* Otherwise a pane with nothing in it ticks for having been opened. */ + const fn = itemsJs.slice(itemsJs.indexOf('PosnicPro.items.tabIsComplete')); + const body = fn.slice(0, fn.indexOf('\n};')); + assert.match(body, /return seen > 0 && complete;/, 'a tab with no fields would tick'); +}); + +test('an open-price item can still complete the Item tab', () => { + /* Its selling price is deliberately empty - the cashier types it at the till. + Requiring one would leave that tab permanently unticked for a legitimate + item. */ + const fn = itemsJs.slice(itemsJs.indexOf('PosnicPro.items.tabIsComplete')); + const body = fn.slice(0, fn.indexOf('\n};')); + assert.match(body, /#items_selling_price'\) && openPrice/, 'open price is not exempted'); + assert.match(body, /seen \+= 1; return;/, 'the exemption must still COUNT the field, or an all-open tab looks empty'); +}); + +test('the ticks are not driven by a list of field ids', () => { + /* A hardcoded list goes stale the first time a field is added to a tab. */ + const fn = itemsJs.slice(itemsJs.indexOf('$(document).on(\'input change\', \'#item_image_upload_form')); + const line = fn.slice(0, fn.indexOf('\n')); + assert.match(line, /input, #item_image_upload_form select, #item_image_upload_form textarea/); +}); + +test('an empty form shows no ticks at all', () => { + /* A row of grey ticks is indistinguishable from earned ones at a glance. */ + const tick = cssRule('#item_form_tabs .item-tab-tick'); + assert.match(tick, /display:\s*none/, 'the tick must be hidden until earned'); + const done = cssRule('#item_form_tabs .nav-link.is-complete .item-tab-tick'); + assert.match(done, /display:\s*inline-block/, 'an earned tick never appears'); +}); + +/* + * Colour and shape describe the sale-grid tile WHEN THERE IS NO IMAGE - the + * label always said so, and the controls stayed on screen anyway. + */ +test('the tile controls sit beside the image', () => { + const fallback = html.indexOf('id="item_tile_fallback"'); + const preview = html.indexOf('id="item-display-preview"'); + const dates = html.indexOf('id="items_mfg_date"'); + assert.notStrictEqual(fallback, -1, 'the tile block is gone'); + assert.ok(fallback > preview, 'it must follow the image preview, in the same column'); + assert.ok(fallback < dates, 'it must not have been left down with the date row'); +}); + +test('an uploaded image hides them', () => { + const fn = itemsJs.slice(itemsJs.indexOf('PosnicPro.items.refreshTileFallback')); + const body = fn.slice(0, fn.indexOf('\n };')); + assert.match(body, /item-display-preview'\)\.find\('img'\)\.length/, 'the preview strip is not consulted'); + assert.match(body, /cover !== 'item\.svg'/, 'the default placeholder counts as no image'); + assert.match(body, /toggle\(!hasImage\)/, 'the block does not follow the image state'); +}); + +test('the image state is watched, not hooked per upload path', () => { + /* An image arrives three ways - fresh upload, edit load, clone - and hooking + each is how the third gets missed. */ + assert.match(itemsJs, /new MutationObserver\(function \(\) \{[\s\S]{0,120}refreshTileFallback/); + assert.match(itemsJs, /typeof MutationObserver === 'undefined'/, 'no fallback if the API is absent'); +}); + +/* + * Variant mode (owner: "item with varient behaved weird. its hiding so many + * stuff but those required. please check.") + * + * What it hid: cost, MRP, reorder point, units, quick code, SKU, barcode. + * What it KEPT: selling price and opening stock - and selling price is + * required. But every variant row carries its own, and saveVariantFamily reads + * items_selling_price_<n> / items_available_quantity_<n> and never looks at the + * parent's. So the form demanded two numbers it then discarded, on the one + * screen where it also hid the fields you did need. + */ +test('variant mode hides the parent price and stock, which the variants own', () => { + const fn = itemsJs.slice(itemsJs.indexOf('var plain = $("#product_without_variant").is(":checked");')); + const body = fn.slice(0, fn.indexOf('\n });')); + assert.match( + body, + /\$\('#items_selling_price'\)\.closest\('\.form-group'\)\.toggle\(plain\)/, + 'the parent selling price still shows in variant mode', + ); + assert.match(body, /#item_opening_wrap'\)\.toggle\(plain/, 'the parent opening stock still shows'); +}); + +test('a service item does not get an opening-stock box back', () => { + /* Two rules meet on that field: variants own stock, and a service has none. + Restoring it for "plain" alone would undo applyServiceMode. */ + const fn = itemsJs.slice(itemsJs.indexOf('var plain = $("#product_without_variant").is(":checked");')); + const body = fn.slice(0, fn.indexOf('\n });')); + assert.match( + body, + /toggle\(plain && !\$\('#item_is_service'\)\.is\(':checked'\)\)/, + 'switching off variants would show stock for a service', + ); +}); + +test('variant mode does not demand a price it throws away', () => { + /* The field is hidden AND required - the form could refuse to save with no + visible field to fix. */ + const fn = itemsJs.slice(itemsJs.indexOf('addMethod("sellingPriceOrOpen"')); + const body = fn.slice(0, fn.indexOf('}, "Enter a selling price')); + assert.match(body, /#product_with_variant'\)\.is\(':checked'\)/, 'variant mode is not exempted'); + assert.ok( + body.indexOf('product_with_variant') < body.indexOf('parseFloat'), + 'the exemption must come before the numeric check, or it never runs', + ); +}); + +/* + * Supplier is a picker like Category (owner ask), and never opens empty. + */ +test('supplier is a select2, not a bare autocomplete', () => { + assert.match(html, /<select id="items_supplier_pick"[^>]*class="select2/, 'the picker is gone'); + assert.ok( + !/<input type="text"[^>]*id="items_supplier"/.test(html), + 'the old free-text supplier box is back', + ); +}); + +test('the fields every payload builder reads are untouched', () => { + /* items.js reads #items_supplier and #items_supplier_id in six places. The + picker drives them; it does not replace them. */ + assert.match(html, /<input type="hidden" id="items_supplier" name="items_supplier">/); + assert.match(html, /<input type="hidden" name="items_supplier_id" id="items_supplier_id">/); + assert.match( + itemsJs, + /on\('change', '#items_supplier_pick'[\s\S]{0,300}items_supplier_id'\)\.val/, + 'nothing keeps the hidden fields in step with the picker', + ); +}); + +test('the picker is loaded from the database, not left empty', () => { + /* "If there is no recent item fire db query get latest or most used. i dont + want empty list." An empty query IS that read - it returns the branch's + suppliers rather than nothing. */ + const fn = itemsJs.slice(itemsJs.indexOf('loadSelectSupplier: function')); + const body = fn.slice(0, fn.indexOf('\n },')); + assert.match(body, /suppliers\/getSuppliersAjaxList/, 'it never asks the server'); + assert.match(body, /query=&branch=/, 'an empty query is what returns the list'); + assert.match(body, /No suppliers yet/, 'a genuinely empty shop gets no explanation'); +}); + +test('editing an item cannot silently clear its supplier', () => { + /* An inactive or deleted supplier is not in the list, so selecting by id + would fall back to blank and the next save would drop it. */ + const fn = itemsJs.slice(itemsJs.indexOf('loadSelectSupplier: function')); + const body = fn.slice(0, fn.indexOf('\n },')); + assert.match(body, /if \(selectedId && !\$pick\.find\('option\[value="' \+ selectedId/, 'a missing id is not restored'); + assert.match(itemsJs, /loadSelectSupplier\(data\.supplier_id, data\.supplier_name\)/, 'the edit path does not pass it'); +}); + +test('the autocomplete bound to the now-hidden input is gone', () => { + /* A plugin initialised against an invisible field can never fire, and reads + as working code for years. */ + assert.ok( + !/\$\('#items_supplier'\)\.autocomplete\(/.test(itemsJs), + 'an autocomplete is still bound to the hidden supplier input', + ); +}); + +test('the variant builder uses the column the hidden cards vacate', () => { + /* Outside it, the right half of the screen went blank in variant mode and two + inputs stretched across the page. The generated variant ROWS stay full + width - that is a table and it wants the room. */ + const rightCol = html.indexOf('class="col-lg-6 d-flex flex-column"', 5000); + let depth = 1; + let j = html.indexOf('>', rightCol) + 1; + while (depth > 0) { + const o = html.indexOf('<div', j); + const c = html.indexOf('</div>', j); + if (o !== -1 && o < c) { depth += 1; j = o + 4; } else { depth -= 1; j = c + 6; } + } + assert.ok(html.indexOf('id="show_variant_fields"') < j, 'the builder is outside the right column'); + assert.ok(html.indexOf('id="load_price_fields"') > j, 'the variant rows should stay full width'); +}); + +test('the Item card is sized to its content', () => { + /* flex-grow-1 stretched it to match the taller column, leaving empty white + under the category and supplier pickers. */ + const at = html.indexOf('<h5 class="card-title mb-0"><lang class="lang_item_title">Item</lang>'); + const card = html.slice(Math.max(0, at - 1200), at); + assert.ok(!/card m-b-30 flex-grow-1/.test(card), 'the Item card still stretches to fill'); +}); + +/* + * Saving must not throw when a feature is off or an optional field is empty. + * + * Reported from the live till with the tax module DISABLED: + * Uncaught TypeError: Cannot read properties of undefined (reading 'element') + * p = f[0].element.attributes["data-tax-value"].value + * + * The save read the tax select2's selection as data[0].element.attributes[...], + * which throws the moment there IS no selection - and with tax off there never + * is one. The same line existed at BOTH save sites, and the category read a + * line below had the same shape: category_id was guarded, category_name was + * not. Category is optional, so saving without one threw as well. + */ +test('no save path reads a select2 selection unguarded', () => { + const code = stripComments(itemsJs); + const bad = [...code.matchAll(/attributes\['data-(tax|category)-[a-z]+'\]/g)]; + assert.deepStrictEqual( + bad.map((m) => m[0]), + [], + 'a direct attribute read is back - it throws whenever there is no selection', + ); + assert.ok( + !/select2\("data"\)\[0\]\.element/.test(code), + 'indexing [0].element assumes a selection that an off feature never makes', + ); +}); + +test('the safe reader returns a value, not an exception', () => { + const fn = itemsJs.slice(itemsJs.indexOf('selectAttr: function')); + const body = fn.slice(0, fn.indexOf('\n },')); + assert.match(body, /try \{/, 'select2("data") on an uninitialised select throws too'); + assert.match(body, /data && data\.length \? data\[0\]\.element : null/, 'an empty selection is not handled'); + assert.match(body, /fallback === undefined \? '' : fallback/, 'callers cannot supply a default'); +}); + +test('tax falls back to 0, not to empty string', () => { + /* tax_value reaches the server as a number. An empty string is not "no tax"; + it is a value the server has to guess about. */ + const code = stripComments(itemsJs); + const hits = [...code.matchAll(/selectAttr\('#items_tax', 'data-tax-value', 0\)/g)]; + assert.strictEqual(hits.length, 2, 'both save paths must default tax to 0'); +}); + +test('both save paths are fixed, not just the one that was reported', () => { + const code = stripComments(itemsJs); + assert.strictEqual( + (code.match(/selectAttr\('#items_category', 'data-category-name'\)/g) || []).length, + 2, + 'the second save path still reads category unguarded', + ); +}); + +/* + * Reorder point and Item Units belong with the item, not with its prices. + * Neither is a price: one is when to buy more, the other is how the item is + * counted. + */ +test('reorder point and units sit in the Item card, above the pickers', () => { + const priceCard = html.indexOf('lang_price_stock_title'); + const category = html.indexOf('for="items_category"'); + for (const id of ['items_reorder_point', 'items_unit']) { + const at = html.indexOf(`id="${id}"`); + assert.notStrictEqual(at, -1, `#${id} is gone`); + assert.ok(at < priceCard, `#${id} is still inside Price & Stock`); + assert.ok(at < category, `#${id} must sit above the category row`); + } +}); + +test('they share one row, like the pickers below them', () => { + const at = html.indexOf('id="items_reorder_point"'); + const unit = html.indexOf('id="items_unit"'); + assert.ok(unit > at, 'units should follow the reorder point'); + /* Only the span BETWEEN the two - running to the category label crosses into + that row and counts its form-row instead. */ + const between = html.slice(at, unit); + assert.ok( + !between.includes('<div class="form-row">'), + 'a second form-row opened between them - they are on separate lines', + ); +}); + +test('a service item still loses its reorder point', () => { + /* applyServiceMode hides it via closest('[class*="col-"]'), which only works + while it is wrapped in a column. Moving it must not have stripped that. */ + const at = html.indexOf('id="items_reorder_point"'); + const wrapper = html.slice(html.lastIndexOf('<div class="col-', at), at); + assert.match(wrapper, /class="col-/, 'the column wrapper applyServiceMode relies on is gone'); + assert.match(itemsJs, /#items_available_quantity, #items_reorder_point'\)\.closest\('\[class\*="col-"\]'\)/); +}); + +/* + * The option loaders. + * + * Five of them shared three defects. `var option;` starts undefined, so + * `option += '<option...'` put the literal string "undefined" in front of every + * entry. select2() ran INSIDE the loop, re-initialising the widget once per + * option - which is what threw "Cannot read properties of null (reading + * 'offsetWidth')", because select2 measures a container the previous init has + * already replaced. And one fired change.select2 at a select before it was a + * select2 at all. + */ +test('no loader builds its options from an undefined string', () => { + const code = stripComments(itemsJs); + assert.ok(!/var option;/.test(code), 'the "undefined" prefix bug is back'); + assert.ok(!/let unitOption;/.test(code), 'the same bug in the variant-row unit loader'); + assert.ok( + !/option \+= '<option/.test(code), + 'options are being concatenated onto an uninitialised variable again', + ); +}); + +test('select2 is initialised once, not once per option', () => { + /* Checked by SHAPE, not by variable name: the first version of this assertion + matched the literal `append(option)` and a mutation that renamed the + variable walked straight past it. What matters is that no append inside a + per-row callback is chained to select2 or trigger. */ + const code = stripComments(itemsJs); + for (const name of ['loadSelectCategory', 'loadSelectVariant', 'loadSelectTax', 'loadSelectUnit']) { + const at = code.indexOf(name + ': function'); + assert.notStrictEqual(at, -1, `${name} is gone`); + const body = code.slice(at, code.indexOf('\n },', at)); + assert.ok( + !/\$\.each\([\s\S]*?\.append\([^)]*\)\.(select2|trigger)\(/.test(body), + `${name} appends and re-initialises per row - this is the offsetWidth crash`, + ); + assert.ok( + !/\.append\([^)]*\)\.select2\(\)/.test(body), + `${name} chains select2 onto an append`, + ); + /* The rule is that the number of select2 initialisations cannot depend on + the number of OPTIONS - not that a loader may only ever initialise one + widget. loadSelectVariant legitimately sets up two axis pickers now, and + a flat count of 1 could only be kept by leaving the second one raw. + So: walk each $.map/$.each callback to its balanced close and assert no + select2 call inside it. That is the offsetWidth crash, stated directly + instead of proxied by a number. */ + for (const m of body.matchAll(/\$\.(map|each)\(/g)) { + let depth = 0; + let i = m.index + m[0].length - 1; + const from = i; + for (; i < body.length; i += 1) { + if (body[i] === '(') depth += 1; + else if (body[i] === ')') { + depth -= 1; + if (depth === 0) break; + } + } + assert.ok( + !/\.select2\(/.test(body.slice(from, i)), + `${name} initialises select2 inside a per-option loop - this is the offsetWidth crash`, + ); + } + } +}); + +test('a select becomes a select2 before anything triggers change.select2', () => { + /* Firing it first hands select2 a widget that does not exist yet. */ + const code = stripComments(itemsJs); + for (const m of code.matchAll(/\$\("?\.items_category"?\)\.val\(''\)\.trigger\('change\.select2'\)/g)) { + const before = code.slice(Math.max(0, m.index - 320), m.index); + assert.match( + before, + /items_category"?\)\.select2\(\{/, + 'change.select2 fires before the select is initialised', + ); + } +}); + +test('the description fills its column so the two halves end together', () => { + const rule = cssRule('#items_new .items-description-fill'); + assert.match(rule, /flex:\s*1 1 auto/, 'it no longer stretches - the left half strands again'); + assert.match(rule, /min-height/, 'with no floor it collapses when the other column is short'); + /* Two rules share this prefix - the row and its columns - so anchor it. */ + const row = cssRule('.items-details-row', 'Details, top row'); + assert.match(row, /align-items:\s*stretch/, 'the columns do not stretch to match'); +}); + +test('the save bar is inside the tab box and matches its width', () => { + /* Outside it the bar took the full column width while the panes are inset by + their own padding and a scrollbar, so it ran past the Next button. */ + const bar = html.indexOf('id="item_save_bar"'); + const tc = html.indexOf('id="item_form_tabs_content"'); + assert.ok(bar > tc, 'the save bar is not inside the tab-content box'); + const rule = cssRule('.item-save-bar'); + assert.match(rule, /position:\s*sticky/, 'it must stay in reach on a long form'); + assert.match(rule, /margin-right/, 'without the pane inset it overhangs on the right'); + const pane = cssRule('#item_form_tabs_content > .tab-pane', 'The save bar matches the form above it.'); + assert.match(pane, /scrollbar-gutter:\s*stable/, 'the inset shifts when a pane starts scrolling'); +}); + +/* + * The More tab gets the same discipline as Details. + */ +test('More uses grid columns, not arbitrary spans', () => { + const at = html.indexOf('id="item_tab_more"'); + const seg = html.slice(at, html.indexOf('id="item_save_bar"')); + const spans = [...seg.matchAll(/class="(col-[\w- ]*)"/g)].map((m) => m[1].trim()); + for (const bad of ['col-7', 'col-5', 'col-md-9', 'col-md-3']) { + assert.ok(!spans.includes(bad), `${bad} is an arbitrary span - use the grid`); + } +}); + +test('the two pack fields are an even pair', () => { + const a = html.indexOf('id="items_purchase_unit"'); + const b = html.indexOf('id="items_conversion_factor"'); + const colOf = (at) => { + const m = [...html.slice(0, at).matchAll(/class="(col-[\w- ]*)"/g)].pop(); + return m[1].trim(); + }; + assert.strictEqual(colOf(a), colOf(b), 'two fields of the same kind, two different widths'); +}); + +test('nothing overrides the grid gutter with inline padding', () => { + /* padding:0 !important on the discount value made it sit flush against the + radios beside it. */ + const at = html.indexOf('id="item_tab_more"'); + const seg = html.slice(at, html.indexOf('id="item_save_bar"')); + assert.ok(!/style="padding: 0 !important;"/.test(seg), 'an inline padding override is back'); +}); + +test('no per-field width caps remain on More', () => { + /* They made two fields in one row different widths - the same complaint as + Details. The shared cap applies evenly now that the columns match. */ + assert.ok(!/#items_new #items_conversion_factor\s*\{[^}]*max-width/.test(css)); + assert.ok(!/#items_new #items_discount_percentage\s*\{[^}]*max-width/.test(css)); +}); + +/* + * One width for the whole form. + * + * The 1140px cap used to sit on the More tab alone, so that pane stopped there + * while the others - and the save bar below them - ran to the full column + * width. That is why the bar overhung the Next button and the cards. + */ +test('the tab box caps every pane and the save bar together', () => { + const box = cssRule('#items_new #item_form_tabs_content'); + assert.match(box, /max-width:\s*1140px/, 'the shared cap is gone - panes can drift apart again'); + assert.match(box, /margin-left:\s*0/, 'the form must stay left-aligned, not centred'); + assert.ok( + !/#items_new #item_tab_more\s*\{[^}]*max-width/.test(css), + 'the cap is back on one pane only - that is the bug', + ); +}); + +test('the save bar carries the pane inset, not the box edge', () => { + /* Its edges have to land where the cards inside a pane land, and those are + inset by the pane's own padding. */ + const rule = cssRule('.item-save-bar'); + assert.match(rule, /margin-left:\s*2px/); + assert.match(rule, /margin-right:\s*6px/); + /* Two rules share this selector - the original one carries the padding, the + one I added carries scrollbar-gutter - so assert against the file. */ + assert.match( + css, + /#item_form_tabs_content > \.tab-pane \{[^}]*padding:\s*2px 6px 2px 2px/, + 'the bar mirrors this inset - they must agree', + ); +}); + +test('the pickers are set apart from the numbers above them', () => { + /* form-row children get no bottom margin from the card rule, which only + covers .row - so the two groups ran together. */ + const at = html.indexOf('class="form-row items-picker-row"'); + assert.notStrictEqual(at, -1, 'the picker row lost its class'); + assert.ok(at < html.indexOf('for="items_category"'), 'the class is on the wrong row'); + const rule = cssRule('.items-picker-row'); + assert.match(rule, /margin-top/, 'no gap above the pickers'); +}); + +test('Quick code is the same width as SKU and Barcode', () => { + const q = columnOf('items_plu_code'); + const sku = columnOf('items_itemid'); + const bar = columnOf('items_barcodeid'); + assert.strictEqual(q, sku, 'the shortest field in the card is the odd one out again'); + assert.strictEqual(sku, bar, 'SKU and Barcode must match each other too'); +}); + +test('the discount value is not flush against the card edge', () => { + /* It is right-aligned text in the last column of its row, so it reads as + clipped without a little air before the border. */ + const rule = cssRule('#items_new .floating-label > #items_discount_amount,'); + assert.match(rule, /margin-right:\s*10px/, 'no gap before the border'); + assert.match(rule, /width:\s*calc\(100% - 10px\)/, 'the margin would push it out of its column'); +}); + +test('the Photos dropzone is labelled like the field beside it', () => { + /* An unlabelled dropzone reads as decoration until you notice the Browse + button; Description next to it says what it is. */ + const at = html.indexOf('Neon Neon-theme-dragdropbox'); + const before = html.slice(Math.max(0, at - 700), at); + assert.match(before, /lang_item_photos_title/, 'the dropzone has no label'); + assert.match(before, /for="item_upload_image"/, 'the label is not tied to the input'); +}); + +/* + * Saving on a tabbed form. + * + * An error on a hidden tab is an error nobody sees: jQuery Validate focuses the + * first invalid field, and if that pane is not on screen the focus goes + * nowhere and the message renders where nobody is looking. Save appeared to do + * nothing at all. + */ +test('a validation error opens the tab it is on', () => { + const at = itemsJs.indexOf('invalidHandler: function (event, validator)'); + assert.notStrictEqual(at, -1, 'nothing reacts to an invalid form'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + assert.match(body, /validator\.invalidElements\(\)/, 'it does not ask which fields failed'); + assert.match(body, /PosnicPro\.items\.tabOf\(first\)/, 'it does not work out which tab to open'); + assert.match(body, /goToTab\(pane/, 'it never switches to that tab'); +}); + +test('a successful save returns to the first tab, on the name', () => { + /* Focusing the name without switching tabs put the cursor on a hidden pane + whenever the item was saved from Details or More. */ + const at = itemsJs.indexOf("if (PosnicPro.action === 'add') {"); + const body = itemsJs.slice(at, itemsJs.indexOf('\n }', at)); + assert.match( + body, + /goToTab\('item_tab_main', '#items_name'\)/, + 'it must switch tabs AND focus, not just focus', + ); + assert.ok(!/\$\('#items_name'\)\.focus\(\);/.test(body), 'the bare focus call is back'); +}); + +test('focus waits for the pane to be shown', () => { + /* A field on a pane that is still display:none cannot take focus - the + browser silently refuses. */ + const at = itemsJs.indexOf('goToTab: function (paneId, focusSelector)'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + assert.match(body, /setTimeout\(/, 'focus happens before the tab has rendered'); + assert.match(body, /is\(':visible'\)/, 'it focuses regardless of whether the field is showing'); + /* select2 hides its own select, so focusing that would do nothing visible. */ + assert.match(body, /select2-hidden-accessible/, 'a select2 field cannot be focused this way'); +}); + +test('an already-active tab is not re-shown', () => { + /* .tab('show') on the active tab re-fires shown.bs.tab, which re-runs the + tick refresh and any other listener for no reason. */ + const at = itemsJs.indexOf('goToTab: function (paneId, focusSelector)'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + assert.match(body, /if \(!\$link\.hasClass\('active'\)\) \{ \$link\.tab\('show'\); \}/); +}); + +test('the tile preview shows what the item will actually look like', () => { + /* The swatches sat unselected, so "no image" read as "no appearance" - which + was never true, since the save derives a colour from the name and stores + it. */ + assert.match(html, /id="item_tile_preview"/, 'the preview is gone from the form'); + const at = itemsJs.indexOf('refreshTilePreview: function ()'); + assert.notStrictEqual(at, -1, 'nothing renders the preview'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + assert.match(body, /PosnicPro\.autoTile\(name\)/, 'it does not use the same rule the save uses'); + assert.match(body, /if \(!name\) \{ \$box\.hide\(\); return; \}/, 'an unnamed item previews a meaningless colour'); +}); + +test('the automatic colour is derived, never random', () => { + /* A sale grid is navigated by recognition - "the red one is Coke". A colour + that differs between tills, or changes on re-render, teaches a habit and + then breaks it. The hash of the name gives the same variety and none of + that. */ + const salesJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'sales.js'), + 'utf8', + ); + const at = salesJs.indexOf('PosnicPro.autoTile = function (name)'); + assert.notStrictEqual(at, -1, 'autoTile is gone'); + const body = salesJs.slice(at, salesJs.indexOf('\n};', at)); + assert.ok(!/Math\.random/.test(body), 'the tile colour is random - it cannot be recognised twice'); + assert.match(body, /h \* 31 \+ str\.charCodeAt/, 'it no longer derives from the name'); +}); + +/* + * Variant mode: the order you fill the form in must not matter. + * + * loadVariant needs the item name - every row is titled "<item> / <value>" - so + * choosing variants first produced "Fill in the required fields" and NO pricing + * rows. The message did not say which field was missing, the field was on + * another card, and nothing rebuilt the rows once the name was typed. Reported + * as an error on picking a variant, and "no place to enter pricing details". + */ +test('the variant error that remains names its field', () => { + /* The missing-NAME error is gone entirely - the rows build without it now. + The one remaining refusal (no values chosen) still has to say so. */ + const at = itemsJs.indexOf('loadVariant: function ()'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n } else {', at)); + assert.ok( + !/Fill in the required fields\./.test(body), + 'the generic message is back - it does not say which field, or where it is', + ); + assert.match(body, /Choose at least one variant value/, 'the empty-values case says nothing useful'); +}); + +test('the item name arriving fills headings without touching the rows', () => { + /* Filling the name last has to work, and must not cost anything already + typed into the pricing rows. */ + const at = itemsJs.indexOf("$(document).on('input', '#items_name', function () {\n if (!$('#product_with_variant')"); + assert.notStrictEqual(at, -1, 'nothing updates the rows when the name arrives'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n });', at)); + assert.match(body, /product_with_variant/, 'it runs outside variant mode too'); + assert.match(body, /retitleVariantRows\(\)/, 'the headings never fill in'); + assert.doesNotMatch( + body, + /loadVariant\(\)/, + 'a keystroke in the name rebuilds the rows and wipes prices already typed', + ); +}); + +/* + * Close returns where you came from. + */ +test('following "Open it" and closing goes back, not to the list', () => { + const core = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'core', 'PosnicPro.js'), + 'utf8', + ); + assert.match(core, /on\('click', '\[id\^="last_created_"\]'/, 'nothing records where you came from'); + assert.match(core, /PosnicPro\.returnTo = currentHash/, 'the origin is not captured'); + const at = core.indexOf('if (PosnicPro.returnTo) {'); + assert.notStrictEqual(at, -1, 'the close handler ignores the marker'); + const body = core.slice(at, core.indexOf('var patt =', at)); + assert.match(body, /PosnicPro\.returnTo = '';/, 'a stale marker would hijack an unrelated Close'); + assert.ok( + body.indexOf("PosnicPro.returnTo = '';") < body.indexOf('hasher.setHash(back)'), + 'it must be cleared BEFORE navigating, or a failed nav leaves it armed', + ); +}); + +test('the variant pricing rows do not wait for the item name', () => { + const js = fs.readFileSync( + path.join(__dirname, '..', 'frontend/static/script/js/modules/js/items.js'), + 'utf8', + ); + const at = js.indexOf('loadVariant: function ()'); + assert.notStrictEqual(at, -1, 'loadVariant is gone'); + const fn = js.slice(at, js.indexOf('\n },', at)); + + // The bug: picking a variant value errored and rendered nothing, so there + // was nowhere to type a price. Clicking Save then re-entered and finally + // drew the rows - which is why Save looked like it opened the price box. + const guard = fn.slice(0, fn.indexOf('$(variant_value).each')); + assert.doesNotMatch( + guard, + /items_name.*length <= 2/s, + 'the rows are gated on the item name again - picking a value will error with no price fields', + ); + assert.doesNotMatch( + guard, + /Enter the item name first/, + 'the name is still being demanded before the rows can be built', + ); + // The values guard is the one that legitimately remains. + assert.match(guard, /variant_value\.length === 0/, 'nothing checks that a value was chosen'); +}); + +test('an empty variant select cannot crash the row builder', () => { + /* jQuery hands back null, not [], from a multiple select with nothing + chosen - and the empty-values guard reads .length off it directly. The + old name check ran first and returned early on a fresh form, which is + what kept this from being reachable before the guards were reordered. */ + const js = fs.readFileSync( + path.join(__dirname, '..', 'frontend/static/script/js/modules/js/items.js'), + 'utf8', + ); + /* The normalisation moved into variantCombinations when a second axis made + the row list a product rather than the raw values - it is the one place + both the builder and the saver now read. */ + const at = js.indexOf('variantCombinations: function ()'); + assert.notStrictEqual(at, -1, 'variantCombinations is gone'); + const body = js.slice(at, js.indexOf('\n },', at)); + assert.match( + body, + /\$\('#item_variant_list'\)\.val\(\) \|\| \[\]/, + 'first axis read unguarded - null.length throws before any row is built', + ); + assert.match( + body, + /\$\('#item_variant_list_2'\)\.val\(\) \|\| \[\]/, + 'second axis read unguarded - null.length throws', + ); +}); + +test('a variant row heading survives having no item name yet', () => { + const js = fs.readFileSync( + path.join(__dirname, '..', 'frontend/static/script/js/modules/js/items.js'), + 'utf8', + ); + const at = js.indexOf('variantRowTitle: function (index, itemName, value)'); + assert.notStrictEqual(at, -1, 'variantRowTitle is gone'); + const fn = js.slice(at, js.indexOf('\n },', at)); + // Without a name it must not render "undefined / Large" or " / Large". + assert.match(fn, /name \? name \+ ' \/ ' : ''/, 'the separator is emitted with no name in front of it'); + + // Retitling, not rebuilding: a rebuild on every keystroke discards prices. + const rt = js.indexOf('retitleVariantRows: function ()'); + assert.notStrictEqual(rt, -1, 'retitleVariantRows is gone'); + const body = js.slice(rt, js.indexOf('\n },', rt)); + assert.doesNotMatch(body, /loadVariant\(\)/, 'retitling rebuilds the rows and throws away typed prices'); + assert.match(body, /variant-row-title/, 'nothing selects the headings to retitle'); + + // and the heading must carry what the retitle needs to rebuild its text + assert.match(js, /data-variant-value="' \+ name \+ '"/, 'the heading does not record its value'); + assert.match(js, /data-variant-index="' \+ \(key \+ 1\) \+ '"/, 'the heading does not record its number'); +}); + +test('services and variants are mutually exclusive', () => { + const js = fs.readFileSync( + path.join(__dirname, '..', 'frontend/static/script/js/modules/js/items.js'), + 'utf8', + ); + const at = js.indexOf('applyServiceMode: function ()'); + assert.notStrictEqual(at, -1, 'applyServiceMode is gone'); + const fn = js.slice(at, js.indexOf('\n },', at)); + // A variant family is a family of STOCK rows (sku, barcode, quantity), and + // _sharedItemFields stamps item_kind:'service' on every one of them. + assert.match(fn, /\$\('#variant_mode_link'\)\.toggle\(!isService\)/, 'a service can still be given variants'); + assert.match( + fn, + /product_without_variant'\)\.prop\('checked', true\)\.trigger\('change'\)/, + 'ticking Service leaves an active variant family in place', + ); + assert.match(fn, /alert\('info'/, 'the variant rows are cleared silently'); + + // and the reverse direction + const vt = js.indexOf('$("#product_without_variant, #product_with_variant").change'); + assert.notStrictEqual(vt, -1, 'the variant mode handler is gone'); + const vbody = js.slice(vt, vt + 900); + assert.match( + vbody, + /#item_is_service'\)\.closest\('\.custom-control'\)\.toggle\(plain\)/, + 'the Service tick stays offered while building a variant family', + ); +}); + +test('every field in Extra barcodes & packs is labelled', () => { + /* A placeholder disappears the moment you type, so a filled-in field stops + saying what it is - which is exactly when someone goes back to check. + These three were the only unlabelled inputs left on the screen. */ + for (const id of ['items_barcodes_alt', 'items_purchase_unit', 'items_conversion_factor']) { + const label = new RegExp('<label[^>]*for="' + id + '"'); + assert.match(html, label, id + ' has a placeholder and no label'); + } + // and they use the same label class as the rest of the form, not a new one + const at = html.indexOf('for="items_purchase_unit"'); + assert.match( + html.slice(at - 120, at), + /items-label-inline/, + 'the new labels do not match the label style used everywhere else', + ); +}); + +test('a service hides the pack fields, extra barcodes included', () => { + /* applyServiceMode hides these with .closest('.form-row'). items_barcodes_alt + sat directly in the card body with no .form-row above it, so closest() + matched nothing and a service kept showing an extra-barcodes box. */ + const at = html.indexOf('id="items_barcodes_alt"'); + assert.notStrictEqual(at, -1, 'items_barcodes_alt is gone'); + const before = html.slice(0, at); + const rowAt = before.lastIndexOf('form-row'); + const cardBodyAt = before.lastIndexOf('card-body'); + assert.ok( + rowAt > cardBodyAt, + 'items_barcodes_alt has no .form-row wrapper - applyServiceMode cannot hide it', + ); + + const js = fs.readFileSync( + path.join(__dirname, '..', 'frontend/static/script/js/modules/js/items.js'), + 'utf8', + ); + assert.match( + js, + /#items_barcodes_alt, #items_purchase_unit, #items_conversion_factor'\)\.closest\('\.form-row'\)/, + 'the service-mode hide no longer covers all three pack fields', + ); +}); + +/* + * Two variant axes - colour AND size. + */ + +test('the row list is derived in exactly one place', () => { + /* loadVariant builds inputs named items_selling_price_<index>, and + saveVariantFamily reads them back by the same index. Two independent + walks of the values agreed only because they walked the same array; once + the list is a PRODUCT of two axes, any drift saves row 3's price against + variant 5 - silently, with nothing on screen to show it. */ + const load = itemsJs.indexOf('loadVariant: function ()'); + const loadBody = itemsJs.slice(load, itemsJs.indexOf('$(variant_value).each', load)); + assert.match(loadBody, /variantCombinations\(\)/, 'loadVariant derives the row list itself'); + + const save = itemsJs.indexOf('saveVariantFamily: function'); + const saveBody = itemsJs.slice(save, itemsJs.indexOf('PosnicPro.post(', save)); + assert.match(saveBody, /variantCombinations\(\)/, 'saveVariantFamily derives the row list itself'); + assert.doesNotMatch( + saveBody, + /\$\('#item_variant_list'\)\.val\(\)/, + 'saveVariantFamily still walks the raw values - it will disagree with the rows on screen', + ); +}); + +test('one axis behaves exactly as before, two give the product', () => { + const at = itemsJs.indexOf('variantCombinations: function ()'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + // the single-axis early return is what keeps existing shops unaffected + assert.match( + body, + /if \(!second\.length\)/, + 'no single-axis short circuit - a shop that never opens the second picker changes behaviour', + ); + // and the product is nested, not zipped + const nested = body.indexOf('$.each(second'); + const outer = body.indexOf('$.each(first'); + assert.ok(outer !== -1 && nested > outer, 'the two axes are not combined as a product'); +}); + +test('the second axis is cleared by every path that clears the form', () => { + /* A leftover second axis does not look like an error - it silently + multiplies the NEXT item into combinations nobody asked for. */ + assert.match(itemsJs, /resetSecondAxis: function/, 'there is no single reset for the second axis'); + const calls = (itemsJs.match(/resetSecondAxis\(\)/g) || []).length; + assert.ok(calls >= 4, `the second axis is reset in only ${calls} places - a clear path is missing`); +}); + +test('the second axis can be closed again, not just opened', () => { + /* refreshTabTicks counts every VISIBLE field, so a second axis revealed by + accident and impossible to collapse holds the Item tab permanently + unticked with nothing explaining why. */ + /* Anchored on the click handler specifically - the bare id also appears in + resetSecondAxis, which is where a looser search lands. */ + const at = itemsJs.indexOf("$(document).on('click', '#variant_axis2_link'"); + assert.notStrictEqual(at, -1, 'the second-axis link is not wired'); + const body = itemsJs.slice(at, at + 700); + assert.match(body, /is\(':visible'\)/, 'the link only opens - there is no way back'); + assert.match(body, /resetSecondAxis\(\)/, 'closing it does not clear what it holds'); +}); + +test('picking second-axis values rebuilds the rows', () => { + /* The row list changed, so the inputs on screen have to change with it - + otherwise the prices are typed against the old combinations. */ + const at = itemsJs.indexOf("$(document).on('change', '#item_variant_list_2'"); + assert.notStrictEqual(at, -1, 'nothing reacts to the second axis changing'); + const body = itemsJs.slice(at, itemsJs.indexOf('});', at)); + assert.match(body, /loadVariant\(\)/, 'the rows are not rebuilt for the new combinations'); + assert.match(body, /refreshVariantCount\(\)/, 'the count does not follow the second axis'); +}); + +test('the form says how many items Save will create', () => { + /* A variant family is the one place Save creates several records rather + than one, and nothing said so - you found out afterwards in the list. */ + assert.match(html, /id="variant_count_hint"/, 'the count hint is gone from the markup'); + const at = itemsJs.indexOf('refreshVariantCount: function'); + assert.notStrictEqual(at, -1, 'refreshVariantCount is gone'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + assert.match(body, /variantCombinations\(\)\.length/, 'the count is not the real row count'); + assert.match(body, /Saving creates/, 'the hint does not say what Save will do'); +}); + +test('a second axis is offered but never preselected', () => { + /* Preselecting it would turn every plain item into combinations. The first + axis IS preselected (val(1)), which is exactly why this needs stating. */ + const at = itemsJs.indexOf("var second = $('#items_variant_2');"); + assert.notStrictEqual(at, -1, 'the second axis is never populated'); + const body = itemsJs.slice(at, at + 1200); + assert.match(body, /second\.val\(''\)/, 'the second axis is preselected'); + assert.doesNotMatch(body, /second\.val\(1\)/, 'the second axis is preselected to the first variant'); + // select2 will not re-read options on a live instance without a destroy + assert.match(body, /select2\('destroy'\)/, 'a live select2 will keep the old options'); +}); +test('each variant gets its own tile, unless one was chosen', () => { + /* _sharedItemFields resolves the automatic tile against the PARENT name, so + spreading it gave every member of a family the same colour and shape - + "Shirt / Red" and "Shirt / Blue" indistinguishable on a grid navigated by + recognition, which is the one job the dressing has. */ + const at = itemsJs.indexOf('saveVariantFamily: function'); + const body = itemsJs.slice(at, itemsJs.indexOf('PosnicPro.post(', at)); + assert.match(body, /var tilePicked = /, 'nothing distinguishes a chosen tile from the automatic one'); + assert.match( + body, + /PosnicPro\.autoTile\(rowName\)/, + 'the automatic tile is not derived from the row name - the family will render identically', + ); + assert.match( + body, + /tilePicked \? null :/, + 'an explicitly chosen tile is overridden per row - that is the opposite of what was asked', + ); + // and the override has to land BEFORE the row's own fields, not after + const spread = body.indexOf('Object.assign({}, shared,'); + assert.ok(spread !== -1 && body.indexOf('tile_color: autoRow.color', spread) > spread, + 'the per-row tile is not spread over the shared one'); +}); +test('a preselected variant arrives with its values', () => { + /* loadSelectVariant preselects variant 1 with .val(1).trigger("change.select2"). + A namespaced trigger does not run a plain change handler, let alone + select2's own select event - so the values used to be filled ONLY by an + active pick, and the form opened showing a chosen variant with an empty + list behind it. The only way out was to re-pick the option that already + looked picked. */ + const at = itemsJs.indexOf('loadSelectVariant: function'); + assert.notStrictEqual(at, -1, 'loadSelectVariant is gone'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + assert.match( + body, + /loadVariantValues\('#items_variant', '#item_variant_list'\)/, + 'the preselected variant leaves its value list empty', + ); + assert.doesNotMatch( + body, + /\$\('#item_variant_list'\)\.html\(''\)/, + 'the preselect still clears the list it just gave a selection to', + ); +}); + +test('both axes fill their values the same way', () => { + /* One function, read from the selected OPTION rather than an event payload - + which is what lets a preselect (no event) and a pick share it. */ + const at = itemsJs.indexOf('loadVariantValues: function'); + assert.notStrictEqual(at, -1, 'loadVariantValues is gone'); + const body = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + assert.match(body, /option:selected/, 'it reads an event, so a preselect cannot use it'); + assert.match(body, /catch/, 'a malformed field list would take the page down'); + // shop-entered text must not be concatenated into markup + assert.doesNotMatch(body, /'<option value="'/, 'option markup is concatenated - a quoted name breaks the list'); + + for (const sel of ['#items_variant', '#items_variant_2']) { + const h = itemsJs.indexOf(`$(document).on('select2:select', '${sel}'`); + assert.notStrictEqual(h, -1, `${sel} has no pick handler`); + assert.match( + itemsJs.slice(h, h + 240), + /loadVariantValues\(/, + `${sel} does not share the filler`, + ); + } + /* The .one('change') wrapper made the first axis depend on some unrelated + change firing first, and rebound nothing when the element was replaced. */ + assert.doesNotMatch( + itemsJs, + /\$\('#items_variant'\)\.one\('change'/, + 'the first axis is bound behind a one-shot change again', + ); +}); +test('clearing the value list never leaves the variant select stranded', () => { + /* + * The bug this pins, twice over: the variant SELECT keeps its selection while + * its value list is emptied, so the form shows a chosen variant with nothing + * to choose from. First it happened on the preselect; then again after a + * SAVE, by a different door - reported as "first variant values not loaded + * but second variant values loading". The second axis looked fine only + * because picking it fires select2:select, which refills. + * + * So: every place that empties #item_variant_list while a variant may still + * be selected has to refill it. + */ + const clears = []; + const lines = itemsJs.split(String.fromCharCode(10)); + lines.forEach((l, i) => { + /* The FIRST list only. #item_variant_list_2 legitimately starts empty - + no second variant is preselected, so there is nothing to refill, and a + looser pattern reported it as a bug. */ + if (/#item_variant_list['"][^)]*\)\s*\.html\(''\)/.test(l) + || /#item_variant_list,[^)]*\)\s*\.html\(''\)/.test(l)) clears.push(i); + }); + assert.ok(clears.length > 0, 'nothing clears the value list any more - this test is stale'); + + for (const i of clears) { + /* The refill must follow within a few lines - close enough that it is + plainly part of the same step. */ + const after = lines.slice(i, i + 12).join(String.fromCharCode(10)); + assert.match( + after, + /loadVariantValues\('#items_variant', '#item_variant_list'\)/, + 'line ' + (i + 1) + ' empties the value list and never refills it - the form ' + + 'will show a selected variant with no values behind it', + ); + } +}); +test('a GTIN is never shared across a variant family', () => { + /* + * The trap this pins. A GTIN identifies ONE trade item: Red-L and Red-M have + * different numbers on their packs, so there is no value a family could + * share. Putting the parent's on every row would have five products each + * claiming to be the same one - the duplicate-identity failure the whole + * validation exists to prevent, and worse than carrying no number at all. + * + * Caught when a first pass added it to _sharedItemFields, which is spread + * onto every variant row. + */ + const at = itemsJs.indexOf('_sharedItemFields: function'); + const shared = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + assert.ok( + !/gtin:\s*\$\('#items_gtin'\)/.test(shared), + 'the GTIN is in the shared fields - every variant would claim the same identity', + ); + + /* It must still reach the plain-item save. */ + const item = itemsJs.slice(itemsJs.indexOf('\n item: function'), itemsJs.indexOf('itemImageFormSubmit')); + assert.match(item, /gtin: \$\('#items_gtin'\)/, 'a plain item cannot save its GTIN at all'); +}); + +test('the form has a GTIN field, kept apart from the barcode', () => { + /* barcode_id is whatever the shop scans - possibly an in-store code. Reusing + it as a global identifier is how a public database gets poisoned. */ + assert.match(html, /id="items_gtin"/, 'there is no GTIN field on the form'); + assert.match(html, /id="items_barcodeid"/, 'the shop barcode field is gone'); + assert.ok( + html.indexOf('id="items_gtin"') !== html.indexOf('id="items_barcodeid"'), + 'the GTIN and the shop barcode are the same input', + ); + /* Most items will never have one - no asterisk, and a hint that says so. */ + const at = html.indexOf('for="items_gtin"'); + const label = html.slice(at, html.indexOf('</label>', at)); + assert.ok(!/text-danger/.test(label), 'GTIN is marked required - most shop items have none'); +}); + +test('a mistyped GTIN is called out before saving', () => { + /* + * The server refuses an invalid GTIN by storing an empty field - correctly, + * but silently. Without a word here somebody mistypes a digit, saves, and the + * item has no GTIN with nothing to explain why. + */ + const at = itemsJs.indexOf('checkGtin: function'); + assert.notStrictEqual(at, -1, 'nothing checks the typed GTIN'); + const fn = itemsJs.slice(at, itemsJs.indexOf('\n },', at)); + assert.match(fn, /8, 12, 13, 14/, 'the valid lengths are not checked'); + assert.match(fn, /fromRight % 2 === 0 \? 3 : 1/, 'the GS1 check digit is not computed, or not from the right'); + assert.match(fn, /in-store code/, 'an in-store barcode is reported as a manufacturer number'); + + /* Empty must stay quiet: most items legitimately have no GTIN, and nagging + would teach people to ignore the hint. */ + const empty = fn.slice(fn.indexOf('if (!raw)'), fn.indexOf('return;', fn.indexOf('if (!raw)'))); + assert.match(empty, /removeClass/, 'an empty GTIN leaves a stale message on screen'); + + assert.match(itemsJs, /on\('input', '#items_gtin'/, 'the check never runs while typing'); +}); + +test('an edit shows the GTIN it saved', () => { + const fills = (itemsJs.match(/\$\('#items_gtin'\)\.val\(data\.gtin/g) || []).length; + assert.strictEqual(fills, 2, 'the GTIN is not restored on both edit paths'); +}); diff --git a/tests/kiosk-column.test.js b/tests/kiosk-column.test.js index 4c5635ed8..73b4526e9 100644 --- a/tests/kiosk-column.test.js +++ b/tests/kiosk-column.test.js @@ -91,8 +91,12 @@ test('the list sends its answer to the page', () => { test('header and cells carry the same marker', () => { /* Hiding one without the other leaves a column of headers over the wrong - cells, which is worse than the column that was there before. */ - assert.match(CORE_JS, /<th class="text-center kiosk-column">Kiosk<\/th>/, + cells, which is worse than the column that was there before. The list + moved to the master-detail standard (2026-08-27): loadList writes its + own header, so both markers live in items.js now. */ + /* The word is wrapped in <lang> so a pack can reach it; what this pins is + that the header carries the marker class, beside the cell's. */ + assert.match(ITEMS_JS, /<th class="text-center kiosk-column">(?:<lang class="[^"]+">)?Kiosk/, 'the Kiosk header is not marked'); assert.match(ITEMS_JS, /<td class="text-center kiosk-column">/, 'the Kiosk cell is not marked'); @@ -104,11 +108,12 @@ test('the page hides the column when the server says there is no kiosk', () => { }); test('the header exists before the answer arrives', () => { - /* appendViewDataTableBody writes the header row; the show/hide runs in the - list response. If that order ever flips there is nothing to hide. */ - const headerAt = ITEMS_JS.indexOf("appendViewDataTableBody('items')"); + /* loadList writes the header in the same render that toggles the column; + the toggle must come AFTER the rows land in the DOM. */ + const headerAt = ITEMS_JS.search(/kiosk-column">(?:<lang class="[^"]+">)?Kiosk/); + const renderAt = ITEMS_JS.indexOf("$('#items_list_rows').html(html)"); const toggleAt = ITEMS_JS.indexOf("$('.kiosk-column')"); assert.ok(headerAt > -1, 'the item table header is no longer written here'); - assert.ok(headerAt < toggleAt, - 'the Kiosk column is hidden before its header is written'); + assert.ok(renderAt > -1 && renderAt < toggleAt, + 'the Kiosk column is toggled before its header is in the DOM'); }); diff --git a/tests/linux-appstream.test.js b/tests/linux-appstream.test.js new file mode 100644 index 000000000..63014b112 --- /dev/null +++ b/tests/linux-appstream.test.js @@ -0,0 +1,88 @@ +'use strict'; + +const test = require('node:test'); +const assert = require('node:assert/strict'); +const fs = require('fs'); +const os = require('os'); +const path = require('path'); +const { JSDOM } = require('jsdom'); + +const ROOT = path.join(__dirname, '..'); +const METAINFO_RELATIVE = 'builds/linux/com.posnic.app.metainfo.xml'; +const METAINFO_PATH = path.join(ROOT, METAINFO_RELATIVE); +const METAINFO_DESTINATION = '/usr/share/metainfo/com.posnic.app.metainfo.xml'; +const APPIMAGE_APPDATA_FILENAME = 'com.posnic.app.appdata.xml'; +const pkg = require('../package.json'); + +function parseMetainfo() { + const xml = fs.readFileSync(METAINFO_PATH, 'utf8'); + const document = new JSDOM(xml, { contentType: 'text/xml' }).window.document; + assert.equal(document.querySelector('parsererror'), null, 'metainfo is not valid XML'); + return document; +} + +test('Linux software identity is consistent across the app, launcher and AppStream', () => { + const document = parseMetainfo(); + const text = (selector) => document.querySelector(selector)?.textContent.trim(); + + assert.equal(document.documentElement.getAttribute('type'), 'desktop-application'); + assert.equal(text('component > id'), pkg.build.appId); + assert.equal(pkg.desktopName, `${pkg.build.appId}.desktop`); + assert.equal(pkg.build.linux.syncDesktopName, true); + assert.equal(text('launchable[type="desktop-id"]'), pkg.desktopName); + assert.equal(text('provides > binary'), pkg.name); + assert.equal(text('project_license'), pkg.license); + assert.equal(text('metadata_license'), 'CC0-1.0'); +}); + +test('AppStream copy is useful, factual and backed by a real product screenshot', () => { + const document = parseMetainfo(); + const summary = document.querySelector('summary').textContent.trim(); + const description = document.querySelector('description').textContent.replace(/\s+/g, ' ').trim(); + const screenshot = document.querySelector('screenshot[type="default"] image[type="source"]'); + const urls = [...document.querySelectorAll('url')].map((node) => node.textContent.trim()); + const keywords = [...document.querySelectorAll('keywords > keyword')].map((node) => + node.textContent.trim(), + ); + const releases = [...document.querySelectorAll('releases > release')]; + + assert.ok(summary.length <= 100 && !summary.endsWith('.')); + assert.match(description, /open-source point-of-sale software/i); + assert.match(description, /without an internet connection/i); + assert.equal(screenshot.getAttribute('width'), '1920'); + assert.equal(screenshot.getAttribute('height'), '1032'); + assert.match(screenshot.textContent.trim(), /^https:\/\/raw\.githubusercontent\.com\/Posnic\/POS\/[0-9a-f]{40}\//); + assert.ok(urls.length >= 4 && urls.every((url) => url.startsWith('https://'))); + assert.ok(urls.includes('https://posnic.io/')); + assert.ok(keywords.includes('billing software')); + assert.ok(keywords.includes('offline POS')); + assert.ok(keywords.includes('online/offline POS')); + assert.ok(keywords.includes('open source POS')); + assert.equal(releases[0].getAttribute('version'), pkg.version); +}); + +test('AppImage and Debian packages use the metadata filename each catalog expects', async (t) => { + const fpmMapping = `${METAINFO_RELATIVE}=${METAINFO_DESTINATION}`; + assert.ok(pkg.build.deb.fpm.includes(fpmMapping), 'Debian package has no global metainfo mapping'); + + const appOutDir = fs.mkdtempSync(path.join(os.tmpdir(), 'posnic-appstream-')); + t.after(() => fs.rmSync(appOutDir, { recursive: true, force: true })); + + const hook = require('../scripts/after-pack.js'); + await hook.default({ + electronPlatformName: 'linux', + appOutDir, + targets: [{ name: 'AppImage' }, { name: 'deb' }], + }); + + const embedded = path.join(appOutDir, 'usr', 'share', 'metainfo', APPIMAGE_APPDATA_FILENAME); + assert.deepEqual(fs.readFileSync(embedded), fs.readFileSync(METAINFO_PATH)); + assert.equal( + fs.existsSync(path.join(appOutDir, 'usr', 'share', 'metainfo', path.basename(METAINFO_PATH))), + false, + 'AppImage should not carry duplicate component metadata under two names', + ); + if (process.platform !== 'win32') { + assert.equal(fs.statSync(embedded).mode & 0o777, 0o644); + } +}); diff --git a/tests/list-empty-state.test.js b/tests/list-empty-state.test.js new file mode 100644 index 000000000..fda942ab8 --- /dev/null +++ b/tests/list-empty-state.test.js @@ -0,0 +1,175 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +/* + * An empty list means two different things, and the row count cannot tell them + * apart. + * + * "No items yet - add your first item with the New button above" was shown for + * BOTH of them. A shop with five thousand items, whose search happened to match + * none of them, was told its catalogue was empty and invited to start it. An + * answer that is confidently wrong is worse than no answer: it sends somebody + * looking for missing DATA instead of fixing their SEARCH. + * + * This is the quotes bug on the two most-used lists in the product. That one + * was caused by a selector reading an input that had been removed; this one is + * the same lie reached a different way, which is why the fix is a shared + * question - hasActiveFilters - rather than a message tweak on one screen. + */ + +const ROOT = path.join(__dirname, '..'); +const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8'); + +const core = read('frontend', 'static', 'script', 'js', 'core', 'PosnicPro.js'); +const LISTS = [ + /* items moved to the master-detail standard - pinned below. */ + /* customers moved to the master-detail standard (2026-08-27): its two + empty states are sentences rendered by loadList - pinned below. */ +]; + +test('standard master-detail lists keep two DISTINCT empty sentences', () => { + /* Same contract, new form: "none yet" invites the first record, "nothing + matched" points at the filter - and the branch is chosen by the actual + filter state, never guessed. */ + for (const [file, key] of [ + ['customers.js', 'customers'], + ['suppliers.js', 'suppliers'], + ['items.js', 'items'], + ['categories.js', 'categories'], + ['variants.js', 'variants'], + ['customer_categories.js', 'customercategory'], + ['users.js', 'users'], + ['branches.js', 'branches'], + ]) { + const js = read('frontend', 'static', 'script', 'js', 'modules', 'js', file); + assert.match(js, /match this filter/, `${key}: the filtered state is gone`); + assert.match(js, /yet - press New/, `${key}: the none-yet state is gone`); + assert.match( + js, + new RegExp("activeCount\\('" + key + "'\\)"), + `${key}: the branch no longer reads the real filter state`, + ); + } + /* The read-only ledgers have no New button, so their none-yet sentence + explains where rows COME FROM instead of inviting a first record. */ + for (const [file, key, noneYet] of [ + ['stocklog.js', 'stocklogs', /receive or sell an item/], + ['lowstock.js', 'lowstockitems', /above its alert level/], + ]) { + const js = read('frontend', 'static', 'script', 'js', 'modules', 'js', file); + assert.match(js, /match this filter/, `${key}: the filtered state is gone`); + assert.match(js, noneYet, `${key}: the none-yet state is gone`); + assert.match( + js, + new RegExp("activeCount\\('" + key + "'\\)"), + `${key}: the branch no longer reads the real filter state`, + ); + } +}); + +test('a filtered list has its own empty state', () => { + for (const l of LISTS) { + assert.match( + l.html, + new RegExp(`id="${l.noMatch}"`), + `${l.module}: no separate "nothing matched" state - the "none yet" message covers both`, + ); + /* The two must be distinct elements. One element with swapped text would + work, but the ACTIONS differ and that is the point: "add your first" + when there is nothing, "clear the filter" when the rows are hidden. */ + assert.match(l.html, new RegExp(`id="${l.empty}"`), `${l.module}: the "none yet" state is gone`); + assert.notStrictEqual( + l.html.indexOf(`id="${l.noMatch}"`), + l.html.indexOf(`id="${l.empty}"`), + `${l.module}: the two empty states are the same element`, + ); + } +}); + +test('the two states are chosen by whether a filter is active', () => { + for (const l of LISTS) { + const at = l.js.indexOf('rowTotal === 0'); + assert.notStrictEqual(at, -1, `${l.module}: the empty branch is gone`); + const body = l.js.slice(at, at + 700); + assert.match( + body, + /hasActiveFilters\(/, + `${l.module}: the empty branch still guesses - it cannot tell an empty shop from a filtered view`, + ); + assert.match(body, new RegExp(l.noMatch), `${l.module}: the no-match state is never shown`); + /* and the non-empty branch must hide BOTH, or one lingers over a full list */ + const after = l.js.slice(at, at + 900); + assert.ok( + new RegExp(`${l.empty}[^\\n]*${l.noMatch}|${l.noMatch}[^\\n]*${l.empty}`).test(after), + `${l.module}: the rows-present branch does not hide both empty states`, + ); + } +}); + +test('the no-match state offers to clear the filter, not to create a record', () => { + /* Offering "add your first item" to somebody whose search failed is what + made the original message wrong; offering it again in the new state would + keep the bug and only change its wording. */ + for (const l of LISTS) { + const at = l.html.indexOf(`id="${l.noMatch}"`); + const block = l.html.slice(at, l.html.indexOf('</div>', at)); + assert.match( + block, + new RegExp(`clearListFilters\\('${l.module}'\\)`), + `${l.module}: the no-match state does not offer a way back to the full list`, + ); + assert.ok( + !/importTableFile/.test(block), + `${l.module}: the no-match state offers a CSV import, which is the other case's answer`, + ); + } +}); + +test('hasActiveFilters reads what search() wrote, not the input boxes', () => { + /* A date sitting in the picker that was never applied is not a filter. + Reading the inputs would count it as one and show "nothing matched" over + a list that is not filtered at all. */ + const at = core.indexOf('hasActiveFilters: function'); + assert.notStrictEqual(at, -1, 'hasActiveFilters is gone'); + const body = core.slice(at, core.indexOf('\n },', at)); + assert.match(body, /data\('filters'\)/, 'it does not read the applied filter state'); + assert.ok( + !/_input'\)\.val\(\)|_daterange'\)\.val\(\)/.test(body), + 'it inspects the input boxes - an unapplied date would read as a filter', + ); + /* An empty object is not a filter: search() always writes something. */ + assert.match(body, /Object\.keys\(/, 'an empty filter object would count as active'); + assert.match(body, /catch/, 'unparseable filter state would throw inside a render'); +}); + +test('clearing from the empty state actually reloads the list', () => { + /* dateRangefilterClear empties the INPUTS but leaves data('filters') and + never reloads, so on its own it leaves the controls disagreeing with the + rows until Apply is pressed again. An empty state offering to clear the + search has to really clear it. */ + const at = core.indexOf('clearListFilters: function'); + assert.notStrictEqual(at, -1, 'clearListFilters is gone'); + const body = core.slice(at, core.indexOf('\n },', at)); + assert.match(body, /data\('filters', ''\)/, 'the applied filter is not reset'); + assert.match(body, /current_page', 1/, 'it stays on a page that no longer exists'); + /* The INVOCATION, not the name. A first version matched `module + 'Table'`, + which also appears in the typeof guard beside it - deleting the actual + call left the test green. */ + assert.match( + body, + /mod\[module \+ 'Table'\]\(/, + 'nothing reloads - the rows would not come back', + ); +}); + +test('the dead placeholder those states replaced is gone', () => { + /* .item_norecord / .customer_norecord were empty divs nothing referenced. */ + for (const l of LISTS) { + assert.ok( + !new RegExp(`${l.module.replace(/s$/, '')}_norecord`).test(l.html), + `${l.module}: the unused no-record placeholder is still in the markup`, + ); + } +}); diff --git a/tests/local-crypto.test.js b/tests/local-crypto.test.js index 60cba89f9..e1fd5ee6d 100644 --- a/tests/local-crypto.test.js +++ b/tests/local-crypto.test.js @@ -9,7 +9,7 @@ const test = require('node:test'); const assert = require('node:assert'); -const lc = require('../local-crypto'); +const lc = require('../src/local-crypto'); const SECRET = 'JstHH8Az3bJaqE*^9YUM'; diff --git a/tests/local-mongodb-loopback.test.js b/tests/local-mongodb-loopback.test.js new file mode 100644 index 000000000..bb19da44b --- /dev/null +++ b/tests/local-mongodb-loopback.test.js @@ -0,0 +1,71 @@ +/* + * Posnic's bundled mongod binds to 127.0.0.1. On Linux, `localhost` can + * resolve to ::1 first; the database then starts successfully while the API + * reports ECONNREFUSED. These checks keep every desktop-owned connection on + * the same loopback interface and migrate credentials created by older builds. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('node:fs'); +const path = require('node:path'); + +const ROOT = path.join(__dirname, '..'); +const credentialsStore = require('../src/credentials-store'); + +const DESKTOP_DATABASE_FILES = [ + path.join('src', 'main.js'), + path.join('src', 'backup-manager.js'), + path.join('src', 'credentials-store.js'), + path.join('src', 'setup-mongodb.js'), + path.join('api', 'src', 'services', 'install.service.js'), +]; + +test('desktop-owned MongoDB URIs use the interface mongod binds to', () => { + const manager = fs.readFileSync(path.join(ROOT, 'src', 'mongodb-manager.js'), 'utf8'); + assert.match(manager, /'--bind_ip',\s*'127\.0\.0\.1'/); + + for (const file of DESKTOP_DATABASE_FILES) { + const source = fs.readFileSync(path.join(ROOT, file), 'utf8'); + assert.doesNotMatch( + source, + /mongodb:\/\/localhost/, + `${file} can resolve the bundled database as ::1 while mongod listens on 127.0.0.1`, + ); + } +}); + +test('credentials from older builds migrate from localhost to IPv4 loopback', () => { + const uri = credentialsStore.buildUri( + { username: 'shop', password: 'p@ss' }, + 'mongodb://localhost:47590/PosnicPro?authSource=admin', + ); + + assert.strictEqual( + uri, + 'mongodb://shop:p%40ss@127.0.0.1:47590/PosnicPro?authSource=admin', + ); +}); + +test('credential migration preserves explicitly configured remote hosts', () => { + const uri = credentialsStore.buildUri( + { username: 'shop', password: 'secret' }, + 'mongodb://db.example.com:27017/PosnicPro?tls=true', + ); + + assert.strictEqual( + uri, + 'mongodb://shop:secret@db.example.com:27017/PosnicPro?tls=true', + ); +}); + +test('database failure help does not give Windows-only or false install advice', () => { + const source = fs.readFileSync(path.join(ROOT, 'src', 'main.js'), 'utf8'); + const start = source.indexOf('<h1>Posnic could not start its local database</h1>'); + const end = source.indexOf('`)}`);', start); + + assert.ok(start >= 0 && end > start, 'database failure help was not found'); + const help = source.slice(start, end); + assert.match(help, /includes its own database/i); + assert.doesNotMatch(help, /\.bat|net start MongoDB|download from:|install with/i); +}); diff --git a/tests/macos-chrome.test.js b/tests/macos-chrome.test.js index dd911c451..dac31d399 100644 --- a/tests/macos-chrome.test.js +++ b/tests/macos-chrome.test.js @@ -24,9 +24,9 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8').replace(/\r\n/g, '\n'); -const MAIN = read('main.js'); -const HARDWARE = read('hardware-manager.html'); -const PRELOAD = read('preload.js'); +const MAIN = read('src/main.js'); +const HARDWARE = read('src/hardware-manager.html'); +const PRELOAD = read('src/preload.js'); test('macOS gets one set of window controls, not two', () => { assert.match( diff --git a/tests/maintenance-menu.test.js b/tests/maintenance-menu.test.js index 75e20e7f3..5e8e8dae4 100644 --- a/tests/maintenance-menu.test.js +++ b/tests/maintenance-menu.test.js @@ -17,7 +17,7 @@ const path = require('path'); * enough to hold the arrangement and to catch a handler wired to nothing. */ const ROOT = path.join(__dirname, '..'); -const main = fs.readFileSync(path.join(ROOT, 'main.js'), 'utf8'); +const main = fs.readFileSync(path.join(ROOT, 'src', 'main.js'), 'utf8'); function menuLabels() { const start = main.indexOf('const template = ['); diff --git a/tests/module-defaults-backfill.test.js b/tests/module-defaults-backfill.test.js new file mode 100644 index 000000000..fc1568c4f --- /dev/null +++ b/tests/module-defaults-backfill.test.js @@ -0,0 +1,245 @@ +/* + * Giving existing shops explicit feature settings. + * + * "why these many activated already. this is not i wanted. when account + * creation why its not created properly." + * + * New shops are fixed - they are created with four features on and the rest + * off. Defaults only apply at creation, so every shop that already exists still + * shows the full menu, and the reason is that a module reads as ON unless a + * branch document explicitly says false. A shop that has never opened Settings + * has no module_* keys at all. + * + * THE FAILURE MODE THIS FILE EXISTS FOR + * + * The obvious fix - change what "absent" means - would switch features off in + * every shop already running. A shop taking credit sales for a year has no + * module_credit_enable key either; it never needed one. Flip the convention, + * deploy, and its Credit menu is gone overnight with its outstanding balances + * unreachable, and nothing anywhere reports an error. The data is all still + * there, which is exactly what makes it hard to diagnose: it reads as the + * feature having been removed from the product. + * + * So the backfill writes explicit values decided from EVIDENCE, and every test + * below is about not taking something away from somebody who is using it. + */ +const test = require('node:test'); +const assert = require('node:assert'); +const path = require('path'); + +const { + FEATURES, planBranch, writesOf, isUnset, measure, +} = require(path.join(__dirname, '..', 'scripts', 'module-defaults-backfill.js')); + +const noUsage = () => ({}); +const usageFor = (key, n) => ({ [key]: n === undefined ? 1 : n }); + +test('a feature with records is never switched off', () => { + /* + * The whole point. This shop has expenses; switching the cash book off would + * hide work somebody did, and they would report it as data loss. + */ + const plan = planBranch({}, usageFor('module_cashbook_enable'), FEATURES); + const row = plan.find((p) => p.key === 'module_cashbook_enable'); + assert.strictEqual(row.action, 'set'); + assert.strictEqual(row.value, true); + assert.match(row.reason, /in use/); +}); + +test('every evidence-backed feature switches on when it has records', () => { + /* Swept rather than spot-checked: a row added later with a typo in its + evidence would otherwise pass unnoticed, and it fails silently - as a + feature switched off in a shop that was using it. */ + for (const feature of FEATURES) { + if (!feature.evidence.length) continue; + const plan = planBranch({}, usageFor(feature.key, 3), FEATURES); + const row = plan.find((p) => p.key === feature.key); + assert.strictEqual(row.value, true, `${feature.key} was not switched on despite records`); + } +}); + +test('a shop with no history gets the new-shop defaults', () => { + const plan = planBranch({}, noUsage(), FEATURES); + const value = (k) => plan.find((p) => p.key === k).value; + + // The four a new shop is created with, minus demo data, which is evidenced. + assert.strictEqual(value('module_tax_enable'), true); + assert.strictEqual(value('quick_sale_enable'), true); + assert.strictEqual(value('module_themes_enable'), true); + + // And the rest off, which is the complaint being answered. + assert.strictEqual(value('module_marketing_enable'), false); + assert.strictEqual(value('module_messaging_enable'), false); + assert.strictEqual(value('module_channels_enable'), false); + assert.strictEqual(value('module_credit_enable'), false); + assert.strictEqual(value('quotes_enable'), false); + assert.strictEqual(value('invoices_enable'), false); +}); + +test('a decision the shop already made is never overwritten', () => { + /* + * `false` is a decision as much as `true` is. A shop that switched Marketing + * off did so on purpose, and a migration that "corrects" it is worse than the + * gap it closes - it is the shops that took the trouble to configure things + * whose configuration would be discarded. + */ + const branch = { module_marketing_enable: false, module_tax_enable: true }; + const plan = planBranch(branch, noUsage(), FEATURES); + + const marketing = plan.find((p) => p.key === 'module_marketing_enable'); + assert.strictEqual(marketing.action, 'keep'); + const tax = plan.find((p) => p.key === 'module_tax_enable'); + assert.strictEqual(tax.action, 'keep'); + + const set = writesOf(plan); + assert.ok(!('module_marketing_enable' in set)); + assert.ok(!('module_tax_enable' in set)); +}); + +test('only absent counts as undecided', () => { + assert.strictEqual(isUnset(undefined), true); + assert.strictEqual(isUnset(null), true); + assert.strictEqual(isUnset(''), true); + /* Both booleans, and both strings: the settings write path has stored + 'false' as a string in places, and treating that as a gap would overwrite + a shop's explicit off with an on. */ + assert.strictEqual(isUnset(false), false); + assert.strictEqual(isUnset(true), false); + assert.strictEqual(isUnset('false'), false); + assert.strictEqual(isUnset('true'), false); +}); + +test('a shop that has decided everything is written to at all', () => { + const branch = {}; + for (const f of FEATURES) branch[f.key] = true; + const plan = planBranch(branch, noUsage(), FEATURES); + assert.deepStrictEqual(writesOf(plan), {}, + 'a fully-configured shop must produce no write at all'); +}); + +test('the two onOnly switches are left out', () => { + /* + * staff_tips_enable and till_lock_enable already parse absent as FALSE, so + * they are off in every shop today and there is nothing to correct. Including + * them would be a migration that changes nothing, and every row it touched + * would still have to be explained to whoever reads the audit log next. + */ + const keys = FEATURES.map((f) => f.key); + assert.ok(!keys.includes('staff_tips_enable')); + assert.ok(!keys.includes('till_lock_enable')); +}); + +test('every feature it does write is a real module switch', () => { + /* + * Checked against the server's own map. A key invented here would be written + * to every branch in the estate and read by nothing - a column of noise that + * looks like a setting. + */ + const SettingModel = require(path.join(__dirname, '..', 'api', 'src', 'models', 'setting.model.js')); + const real = SettingModel.moduleToggleMap(); + for (const f of FEATURES) { + assert.ok(Object.prototype.hasOwnProperty.call(real, f.key), + `${f.key} is not in moduleToggleMap - nothing would read it`); + } +}); + +/* + * The cross-check against newShopModuleDefaults - that the backfill does not + * put an existing shop in a state no new shop is ever created in - lives in the + * API suite, not here. + * + * It has to require install.service, which requires bcryptjs, which is an API + * dependency. The desktop job installs the ROOT dependencies only, so requiring + * it from this file passes on a developer's machine (where api/node_modules + * happens to exist) and fails in CI. That is the worst kind of test: green + * where it is written, red where it matters. + * + * See api/tests/unit/services/install-module-defaults.test.js. + */ + +test('every evidence query is scoped to the branch and the licence', async () => { + /* + * THE DANGEROUS ONE. A query missing the licence counts another company's + * records and switches a feature on for a shop that has never used it. It + * shows up as a menu entry nobody asked for, in somebody else's shop, and is + * never traced back to a migration that ran once months earlier. + */ + const seen = []; + const db = { + collection: () => ({ + countDocuments: async (q) => { seen.push(q); return 0; }, + }), + }; + const branch = { _id: 'BRANCH', license: 'LICENCE' }; + await measure(db, branch, FEATURES); + + assert.ok(seen.length, 'no queries were made at all'); + for (const q of seen) { + const clauses = JSON.stringify(q.$and || []); + assert.match(clauses, /"license":"LICENCE"/, `a query is not scoped to the licence: ${clauses}`); + assert.match(clauses, /BRANCH/, `a query is not scoped to the branch: ${clauses}`); + } +}); + +test('a collection this shop does not have counts zero rather than throwing', async () => { + /* Shops provisioned by older builds simply do not have some of these. That + is a fact about the shop, not a failure to report - and a throw here would + abandon the whole estate part-way through. */ + const db = { + collection: () => ({ + countDocuments: async () => { throw new Error('ns does not exist'); }, + }), + }; + const usage = await measure(db, { _id: 'B', license: 'L' }, FEATURES); + for (const f of FEATURES) { + assert.strictEqual(usage[f.key], 0); + } +}); + +test('it stops counting once one record is found', async () => { + /* + * Marketing has four evidence collections. One record is already the answer, + * and running the other three against every branch in the estate is work + * whose result cannot change the decision. + */ + let calls = 0; + const db = { + collection: () => ({ + countDocuments: async () => { calls++; return 1; }, + }), + }; + const marketing = FEATURES.filter((f) => f.key === 'module_marketing_enable'); + assert.ok(marketing[0].evidence.length > 1, 'this test needs a multi-collection feature'); + await measure(db, { _id: 'B', license: 'L' }, marketing); + assert.strictEqual(calls, 1); +}); + +test('items are found by branch_access, everything else by branch_id', async () => { + /* + * Items carry branch_access[].branch_id and the rest carry branch_id. + * Matching only one of them would count zero for the other - and counting + * zero is what switches a live feature off. + */ + const seen = []; + const db = { + collection: () => ({ + countDocuments: async (q) => { seen.push(JSON.stringify(q)); return 0; }, + }), + }; + await measure(db, { _id: 'B', license: 'L' }, FEATURES); + for (const q of seen) { + assert.match(q, /branch_access\.branch_id/); + assert.match(q, /"branch_id"/); + } +}); + +test('report is the default and writing has to be asked for', () => { + const fs = require('fs'); + const src = fs.readFileSync( + path.join(__dirname, '..', 'scripts', 'module-defaults-backfill.js'), 'utf8') + .replace(/\/\*[\s\S]*?\*\//g, '') + .replace(/^[ \t]*\/\/.*$/gm, ''); + assert.match(src, /const args = \{ apply: false \}/); + assert.match(src, /if \(args\.apply\) \{/); + assert.match(src, /Report only\. Re-run with --apply to write\./); +}); diff --git a/tests/module-js-mapped.test.js b/tests/module-js-mapped.test.js new file mode 100644 index 000000000..773763cab --- /dev/null +++ b/tests/module-js-mapped.test.js @@ -0,0 +1,90 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { stripComments } = require('./helpers/source-lookup'); + +/* + * Every module script must be in the build manifest, and no two may define the + * same function. + * + * weight-machine-integration.js sat in modules/js for months without appearing + * in any page's js list. It was never shipped to a browser - and from inside + * the file that is invisible. It looked like a working feature, it was read as + * a working feature, and a bug in it was reported as affecting a live till + * before anyone checked the manifest. + * + * Being unused was the smaller half. It defined four of the same function + * names as the live implementation in sales.js - readWeightFromMachine, + * checkAutoWeightTrigger, initWeightMachine, isWeighedItem - so adding it to + * the manifest to "enable the weight machine" would have replaced a version + * that warns the cashier with an older one that does not. A dead module that + * shadows a live one is a loaded gun, not clutter. + * + * Both halves are checked here: nothing unmapped, and nothing defined twice. + * + * CSS is deliberately not covered. Four stylesheets are legitimately outside + * the manifest - the print sheets are attached when printing, and style.css is + * a stale artifact of a build that now compiles style.scss - so the same rule + * there would be four permanent exceptions and no signal. + */ + +const ROOT = path.join(__dirname, '..', 'frontend'); +const MODULES = path.join(ROOT, 'static', 'script', 'js', 'modules', 'js'); + +const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'pages_css_js_map.json'), 'utf8')); + +const moduleFiles = fs.readdirSync(MODULES).filter((f) => f.endsWith('.js')); + +function mappedBasenames() { + const mapped = new Set(); + for (const cfg of Object.values(manifest)) { + // Pages are { js: [...] }; lazy_reports (bundle-split slice 2) is a bare + // array that buildLazyReports ships as script/lazy/reports.js - both + // shapes reach a browser, so both count as "mapped". + const files = Array.isArray(cfg) ? cfg : cfg.js || []; + for (const p of files) mapped.add(path.basename(p)); + } + return mapped; +} + + +test('the manifest is being read, not silently empty', () => { + assert.ok(moduleFiles.length > 40, `only ${moduleFiles.length} module files found`); + assert.ok(mappedBasenames().size > 40, 'the manifest scan found almost nothing'); +}); + +test('every module script is in the build manifest', () => { + const mapped = mappedBasenames(); + const orphans = moduleFiles.filter((f) => !mapped.has(f)); + assert.deepStrictEqual( + orphans, + [], + 'these live in modules/js but no page loads them - they are dead code, and ' + + 'dead code that redefines a live function is worse than dead:\n ' + + orphans.join('\n '), + ); +}); + +test('no function is defined by two different modules', () => { + const defs = new Map(); + for (const file of moduleFiles) { + const code = stripComments(fs.readFileSync(path.join(MODULES, file), 'utf8')); + const pattern = /PosnicPro\.([a-zA-Z_$][\w$]*)\.([a-zA-Z_$][\w$]*)\s*=\s*(?:function|async)/g; + for (const m of code.matchAll(pattern)) { + const key = `PosnicPro.${m[1]}.${m[2]}`; + if (!defs.has(key)) defs.set(key, new Set()); + defs.get(key).add(file); + } + } + + const shadowed = [...defs.entries()] + .filter(([, files]) => files.size > 1) + .map(([key, files]) => `${key} defined in: ${[...files].join(', ')}`); + + assert.deepStrictEqual( + shadowed, + [], + 'whichever of these loads last silently wins:\n ' + shadowed.join('\n '), + ); +}); diff --git a/tests/mongodb-binaries.test.js b/tests/mongodb-binaries.test.js index 6882d3b93..21581325b 100644 --- a/tests/mongodb-binaries.test.js +++ b/tests/mongodb-binaries.test.js @@ -65,7 +65,7 @@ test('the binaries are not tracked in git', () => { }); test('there is a documented way to get them back', () => { - const script = path.join(ROOT, 'download-mongodb.bat'); + const script = path.join(ROOT, 'src', 'download-mongodb.bat'); assert.ok(fs.existsSync(script), 'download-mongodb.bat is gone, and it is the only way to restore the ' + 'binaries this repository no longer carries'); @@ -131,7 +131,7 @@ test('macOS picks the binary for the architecture it is building', () => { }); test('the app looks for the right binary name', () => { - const manager = fs.readFileSync(path.join(ROOT, 'mongodb-manager.js'), 'utf8'); + const manager = fs.readFileSync(path.join(ROOT, 'src', 'mongodb-manager.js'), 'utf8'); assert.match( manager, /process\.platform === 'win32' \? 'mongod\.exe' : 'mongod'/, @@ -139,3 +139,42 @@ test('the app looks for the right binary name', () => { 'executable on macOS and Linux', ); }); +test('the prebuild check fails only on what a person must fetch', () => { + /* + * check:mongodb runs FIRST in the prebuild chain - before prepare:bundle, + * which is what runs prepare:vc-runtime and copies the three VC runtime DLLs + * off the machine. Demanding all four here listed three files the build + * supplies moments later, and told the developer to fix them with + * download-mongodb.bat. + * + * That advice is wrong twice over: those DLLs are not the developer's to + * fetch, and MongoDB's archive does not contain them anyway - it ships + * vc_redist.x64.exe, an installer. Somebody following it downloads 600MB, + * sees the same four names, and cannot tell that three were never the issue. + */ + const { FETCHED_BY_HAND, SUPPLIED_BY_BUILD, REQUIRED } = + require('../scripts/check-mongodb-binaries'); + + assert.deepStrictEqual( + FETCHED_BY_HAND, + ['mongod.exe'], + 'the prebuild gate covers files the build itself produces', + ); + assert.ok( + SUPPLIED_BY_BUILD.every((f) => f.endsWith('.dll')), + 'something other than the VC runtime is being deferred to the build', + ); + assert.deepStrictEqual( + [...FETCHED_BY_HAND, ...SUPPLIED_BY_BUILD].sort(), + [...REQUIRED].sort(), + 'the split lost or invented a file - the package would ship incomplete', + ); + + /* The deferred DLLs are still guaranteed - by the step that produces them. */ + const vc = fs.readFileSync(path.join(ROOT, 'scripts', 'bundle-vc-runtime.js'), 'utf8'); + assert.match( + vc, + /process\.exit\(1\)/, + 'nothing fails the build when the VC runtime cannot be found - the DLLs are now unguarded', + ); +}); diff --git a/tests/no-charts.test.js b/tests/no-charts.test.js new file mode 100644 index 000000000..78dc06bfb --- /dev/null +++ b/tests/no-charts.test.js @@ -0,0 +1,65 @@ +/* + * No charts. Anywhere. Owner order, 2026-08-26: "delete all chart related + * code" - after the iPhone tab-kill saga (amCharts relayout-per-resize, + * OWNER_QUEUE rows 193-200) the decision moved from "no charts on mobile" + * to none at all. The libraries, the PosnicPro.chart namespace, the lazy + * chunks and the vendor shelf are gone; this pins the door shut so a + * future feature cannot quietly wheel one back in. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('node:fs'); +const path = require('node:path'); + +const FRONTEND = path.join(__dirname, '..', 'frontend'); + +function walk(dir, out) { + for (const name of fs.readdirSync(dir)) { + const p = path.join(dir, name); + const st = fs.statSync(p); + if (st.isDirectory()) { + if (name === 'node_modules' || name === 'public' || name === '.git') continue; + walk(p, out); + } else if (/\.(js|html)$/.test(name) && !/\.min\.js$/.test(name)) { + out.push(p); + } + } + return out; +} + +test('no chart library is referenced anywhere in frontend source', () => { + const needles = /am4core|am4charts|am4themes|ApexCharts|c3\.generate|new Chartist|Morris\.|\$\.plot\(/; + const hits = []; + for (const f of walk(FRONTEND, [])) { + const src = fs.readFileSync(f, 'utf8'); + if (needles.test(src)) { + hits.push(path.relative(FRONTEND, f)); + } + } + assert.deepStrictEqual(hits, [], + 'chart library reference found - the owner ordered every chart removed: ' + hits.join(', ')); +}); + +test('the chart vendor directories stay deleted', () => { + const banned = [ + 'static/script/js/plugins/amcharts', + 'static/script/js/plugins/apexcharts', + 'static/script/js/plugins/c3', + 'static/script/js/plugins/d3', + 'static/style/plugins/apexcharts', + 'static/style/plugins/chart.js', + 'static/style/plugins/chartist-js', + 'static/style/plugins/flot-chart', + 'static/style/plugins/morris', + 'static/style/plugins/peity', + ]; + const present = banned.filter((d) => fs.existsSync(path.join(FRONTEND, d))); + assert.deepStrictEqual(present, [], 'chart vendor directory came back: ' + present.join(', ')); +}); + +test('PosnicPro.chart namespace stays deleted', () => { + const core = fs.readFileSync( + path.join(FRONTEND, 'static/script/js/core/PosnicPro.js'), 'utf8'); + assert.ok(!/chart:\s*\{/.test(core), 'a chart: namespace reappeared in PosnicPro core'); +}); diff --git a/tests/no-customer-branding.test.js b/tests/no-customer-branding.test.js index 21a0d8db4..2fb8599f4 100644 --- a/tests/no-customer-branding.test.js +++ b/tests/no-customer-branding.test.js @@ -125,7 +125,7 @@ test('no customer name appears in tracked source', () => { test('the runtime brand hooks are still there', () => { /* Removing these would break white-labelling for shops that already have it, and it would break on their counter rather than here. */ - const main = fs.readFileSync(path.join(ROOT, 'main.js'), 'utf8'); + const main = fs.readFileSync(path.join(ROOT, 'src', 'main.js'), 'utf8'); assert.match(main, /function seedBrandFromBuild/, 'the build-time seed is no longer read, so an installer the build repo ' diff --git a/tests/no-em-dashes.test.js b/tests/no-em-dashes.test.js new file mode 100644 index 000000000..a8ec6925b --- /dev/null +++ b/tests/no-em-dashes.test.js @@ -0,0 +1,132 @@ +'use strict'; + +/* + * No em dash in anything we write. + * + * The owner's rule, in his words: "never use -- this. very annoying it shows is + * ai text. overall account tell not to use that." + * + * That is a judgement about how the product SOUNDS, and it is exactly the kind + * of rule that decays quietly. Every future alert, badge and placeholder is + * written by somebody who has not read this file, and one dash slipped into one + * toast is invisible in review. So it is pinned here, the way the chart ban is. + * + * The replacement is the plain hyphen the codebase already uses everywhere + * else, so nothing about the house voice changes. + * + * WHAT IS STILL ALLOWED, deliberately. + * + * A dash standing alone between quotes or tags is not prose, it is the + * conventional glyph for "no value": + * + * '<td>' + esc(r.user_name || '—') + '</td>' + * + * There are around thirty of those. They read as typography, not as writing. + * Banning them too would mean thirty pointless edits and a rule nobody keeps. + * What is banned is the dash used as PUNCTUATION, joining two halves of a + * sentence, which is the thing that reads as machine-written. + * + * WHAT IS EXEMPT, and why it must stay exempt. + * + * Two data files are not our writing. hsn.json carries the Indian government's + * published goods classification verbatim, and quotes.json carries famous + * sayings with their standard attribution dash. Editing either would make us + * misquote a source: in the HSN case, our tax codes would stop matching the + * schedule they are supposed to match. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..'); + +const EXEMPT = new Set([ + 'api/src/json/hsn.json', + 'frontend/static/json/hsn.json', + 'api/src/json/quotes.json', + 'frontend/static/json/quotes.json', +]); + +const DASH = /—|–|—|–/; +const PLACEHOLDER_SHAPE = String.raw`(?:['"\`]|>)\s*(?:—|–|—|–)\s*(?:['"\`]|<)`; +const ONE_PASS = new RegExp(`${PLACEHOLDER_SHAPE}|—|–|—|–`, 'g'); + +/** A match is the empty-value glyph if it swallowed its quotes or tags. */ +const isPlaceholder = (m) => /['"`<>]/.test(m); + +function sourceFiles(dir, out = []) { + if (!fs.existsSync(dir)) return out; + for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { + /* frontend/public is build output, regenerated from these sources. */ + if (entry.name === 'node_modules' || entry.name === 'public') continue; + const full = path.join(dir, entry.name); + if (entry.isDirectory()) { + sourceFiles(full, out); + } else if (/\.(js|json|html)$/.test(entry.name)) { + /* Vendored libraries and minified bundles are not ours to rewrite. */ + if (full.includes('.min.') || full.includes(`${path.sep}plugins${path.sep}`)) continue; + out.push(full); + } + } + return out; +} + +function offences(dir) { + const found = []; + for (const file of sourceFiles(path.join(ROOT, dir))) { + const rel = path.relative(ROOT, file).split(path.sep).join('/'); + if (EXEMPT.has(rel)) continue; + fs.readFileSync(file, 'utf8').split(/\r?\n/).forEach((line, i) => { + if (!DASH.test(line)) return; + const stripped = line.replace(ONE_PASS, (m) => (isPlaceholder(m) ? '' : m)); + if (!DASH.test(stripped)) return; + found.push(`${rel}:${i + 1} ${line.trim().slice(0, 90)}`); + }); + } + return found; +} + +test('no em dash anywhere in the frontend', () => { + const found = offences('frontend'); + assert.deepEqual(found, [], + `em dash used as punctuation:\n ${found.join('\n ')}`); +}); + +test('no em dash in what the API says back', () => { + /* Response messages are read by a person too, in a toast. */ + const found = offences(path.join('api', 'src')); + assert.deepEqual(found, [], + `em dash used as punctuation in an API message:\n ${found.join('\n ')}`); +}); + +test('the empty-cell glyph is still allowed, so the rule stays keepable', () => { + /* + * Guards the guard. If somebody later tightens this to ban every dash, the + * thirty legitimate placeholder cells start failing, and the usual response + * to that is to delete the test rather than make thirty pointless edits. + */ + const cell = "html += '<td>' + esc(r.user_name || '—') + '</td>';"; + const stripped = cell.replace(ONE_PASS, (m) => (isPlaceholder(m) ? '' : m)); + assert.ok(!DASH.test(stripped), 'the placeholder glyph is being read as prose'); +}); + +test('a dash between real words is caught, including the escaped spelling', () => { + /* The detector itself, since every other test here passes when it is broken. */ + ['Open — your session', 'Open — your session', 'priced 3–6 only'].forEach((line) => { + const stripped = line.replace(ONE_PASS, (m) => (isPlaceholder(m) ? '' : m)); + assert.ok(DASH.test(stripped), `not detected: ${line}`); + }); +}); + +test('the quoted sources stay exempt and stay present', () => { + /* + * An exemption for a file that has moved is a dead exemption, and the rule + * would start rewriting a government schedule without anybody noticing. + */ + for (const rel of EXEMPT) { + assert.ok(fs.existsSync(path.join(ROOT, rel)), + `${rel} moved, so its exemption is now silently dead`); + } +}); diff --git a/tests/no-telemetry.test.js b/tests/no-telemetry.test.js index ce77a6aaa..edeee8031 100644 --- a/tests/no-telemetry.test.js +++ b/tests/no-telemetry.test.js @@ -77,13 +77,25 @@ test('no shipped page loads an analytics or error-reporting script', () => { ); }); -test('the API content-security-policy does not allow a telemetry host', () => { +test('the BASE content-security-policy does not allow a telemetry host', () => { const app = fs.readFileSync(path.join(ROOT, 'api', 'app.js'), 'utf8'); - // Only the directives matter. The explanatory comment above them names the - // hosts on purpose - it is the record of why they were removed - so strip - // comment lines before looking. - const directives = app + /* + * The contract evolved with the owner's Google Analytics FEATURE + * (2026-08-27, "make it as feature. on / off with entering GA value"): + * an opt-in toggle whose id belongs to the shop. The promise this pin + * guards is unchanged where it matters - the policy an UNCONFIGURED + * shop serves must never name a telemetry host. The Google domains may + * appear ONLY inside the gaCspDirectives variant, which the server + * serves exclusively while the shop's own toggle is on, and the + * dispatch between the two must exist. + */ + const gaStart = app.indexOf('const gaCspDirectives'); + assert.ok(gaStart !== -1, 'the GA CSP variant vanished - did the feature move?'); + const gaEnd = app.indexOf('};', gaStart) + 2; + const outsideGaBlock = app.slice(0, gaStart) + app.slice(gaEnd); + + const directives = outsideGaBlock .split('\n') .filter((line) => !line.trim().startsWith('//')) .join('\n'); @@ -92,9 +104,12 @@ test('the API content-security-policy does not allow a telemetry host', () => { assert.deepStrictEqual( allowed, [], - `CSP allowlists ${allowed.join(', ')}. A page could load a script from ` + - 'there, which is what the loader used to do.', + `The base CSP (or anything outside gaCspDirectives) allowlists ${allowed.join(', ')}. ` + + 'Only the opt-in GA variant may name Google, and only inside its own block.', ); + + /* the dispatch that keeps the base policy the default */ + assert.match(app, /a\.enabled \? helmetGa : helmetBase/); }); test('no analytics or crash-reporting package is a dependency', () => { diff --git a/tests/one-reload-per-save.test.js b/tests/one-reload-per-save.test.js new file mode 100644 index 000000000..d00f6c89b --- /dev/null +++ b/tests/one-reload-per-save.test.js @@ -0,0 +1,86 @@ +'use strict'; + +/* + * One save, one reload (the saves patch, list edition). + * + * Owner: "every close of pop up or every save of form, some refresh is + * happening... i think its lazy coding." The list screens' save handlers + * had a stacked idiom: call the table loader directly AND setHash back to + * the list - and the hash navigation fires the route, which loads the + * table again. Two identical network requests and two full re-renders + * per save. The rule pinned here: a save triggers the reload through + * EITHER the route (when it navigates) or the direct call (when it is + * already on the list) - never both. + */ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const js = (f) => fs.readFileSync( + path.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'modules', 'js', f), 'utf8'); + +test('users: edit reloads through route OR direct call, never both', () => { + const src = js('users.js'); + const at = src.indexOf("window.location.hash === '#/users'"); + assert.ok(at > -1, 'the either/or guard is gone'); + assert.ok(!/usersTable\('users'\);\s*if \(PosnicPro\.action === 'edit'\)/.test(src), + 'the unconditional pre-branch reload is back'); +}); + +test('expenses: same rule', () => { + const src = js('expenses.js'); + assert.ok(src.includes("window.location.hash !== '#/expenses'"), 'the guard is gone'); + assert.ok(!/hasher\.setHash\('expenses'\);\s*\}\s*PosnicPro\.expenses\.expensesTable/.test(src), + 'the unconditional post-navigation reload is back'); +}); + +test('categories: the direct load only fires for saves made on the list', () => { + const src = js('categories.js'); + assert.match(src, /wasOnCategoryList = \(hash === '\/categories'\)/); + assert.match(src, /if \(wasOnCategoryList\) \{\s*PosnicPro\.categories\.categoriesTable/); + /* and the edit branch's duplicate navigation is gone - the shared + setHash above it already navigates */ + const editBranch = src.slice(src.indexOf("if (PosnicPro.action === 'edit') {", src.indexOf('wasOnCategoryList'))); + assert.ok(!editBranch.slice(0, 400).includes("hasher.setHash('categories')"), + 'the edit branch re-navigates - that is the double load again'); +}); + +test('a cancelled add panel closes silently - the list it floats over is not re-fetched', () => { + /* The close handler's old comment claimed "set hash without dispatching + changed signal" while dispatching every time: cancelling an empty add + form re-loaded the whole list. Silence is allow-listed to the modules + whose add form is an infobar OVER the list; a full-page form (items, + receivings, sales) must never be listed - its route dispatch is the + only way back to the list. */ + const core = fs.readFileSync( + path.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'core', 'PosnicPro.js'), 'utf8'); + const at = core.indexOf('PosnicPro.INFOBAR_LIST_ADDS = {'); + assert.ok(at > -1, 'the allow-list is gone'); + const list = core.slice(at, core.indexOf('};', at)); + for (const m of ['customers', 'suppliers', 'users', 'expenses', 'categories', 'customercategory', 'variants']) { + assert.ok(list.includes(m + ':'), m + ' fell out of the silent-close list'); + } + for (const never of ['items:', 'receivings:', 'sales:']) { + assert.ok(!list.includes(never), never.slice(0, -1) + ' is a FULL-PAGE form - silencing strands the user'); + } + /* the silent branch really is silent, and keeps currentHash honest */ + const branch = core.slice(core.indexOf("PosnicPro.INFOBAR_LIST_ADDS[parts[0]]"), core.indexOf("PosnicPro.INFOBAR_LIST_ADDS[parts[0]]") + 1400); + assert.match(branch, /hasher\.changed\.active = false;\s*hasher\.setHash\(parts\[0\]\);\s*hasher\.changed\.active = true;\s*currentHash = parts\[0\];/); + /* deep-link escape: a panel opened over a list that never loaded must + still dispatch, or cancel strands the user on an empty page */ + assert.match(branch, /\$\('#view_' \+ parts\[0\]\)\.data\('total'\) !== undefined/); +}); + +test('closing a details panel is silent too - reading a record re-fetches nothing', () => { + const core = fs.readFileSync( + path.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'core', 'PosnicPro.js'), 'utf8'); + const at = core.indexOf("typeof parts[2] === 'undefined'"); + assert.ok(at > -1, 'the details-silence branch is gone'); + const branch = core.slice(at, at + 900); + /* pure details only: an edit route may be a full page (items), where the + dispatch is the only way back to the list */ + assert.match(branch, /INFOBAR_LIST_ADDS\[parts\[0\]\] \|\| parts\[0\] === 'items'/); + assert.match(branch, /data\('total'\) !== undefined/); + assert.match(branch, /hasher\.changed\.active = false;/); +}); diff --git a/tests/p2-button-restyle.test.js b/tests/p2-button-restyle.test.js new file mode 100644 index 000000000..1c57023c2 --- /dev/null +++ b/tests/p2-button-restyle.test.js @@ -0,0 +1,93 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { cssReader } = require('./helpers/source-lookup'); + +/* + * P2, the part that was held back. + * + * Queue #98 shipped the tint mapping and stopped there, because the rest is a + * restyle of the owner's most-guarded screen and was not going to happen + * unprompted. This is that rest: the dead .seven family, and the outline + * buttons. + * + * The outline rules are the interesting half. They removed the focus ring from + * every state to be rid of Bootstrap's heavy shadow after a click - a fair + * thing to want - and took the keyboard's only position signal with it, on a + * device that is driven by keyboard. + */ + +const ROOT = path.join(__dirname, '..'); +const css = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'style', 'css', 'custom.css'), + 'utf8', +); +const theme = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'style', 'css', 'theme-variables.css'), + 'utf8', +); +const cssRule = cssReader(css); + +test('the dead .seven family is gone, both themes', () => { + /* A print button in the CSS named colour `darkblue`, belonging to no palette + and following no theme, worn by nothing. A dead RULE costs nothing at + runtime, which is exactly why it survives - but it still claims the print + button looks like this, and no print button has for a long time. */ + assert.ok(!/^\.seven\b/m.test(css), '.seven is back in custom.css'); + assert.ok(!/\.seven:hover/.test(css), 'the .seven hover survived'); + assert.ok( + !/\[data-theme="dark"\]\s*\.seven/.test(theme), + 'the dark override for a rule that no longer exists survived - worse than either alone', + ); + // and nothing may start wearing it again + const markupDirs = ['modules', 'modals', 'layouts']; + for (const dir of markupDirs) { + const base = path.join(ROOT, 'frontend', dir); + if (!fs.existsSync(base)) continue; + for (const f of fs.readdirSync(base).filter((n) => n.endsWith('.html'))) { + const html = fs.readFileSync(path.join(base, f), 'utf8'); + assert.ok( + !/class="(?:[^"]*\s)?seven(?:\s[^"]*)?"/.test(html), + `${dir}/${f} wears .seven, which no longer has a rule`, + ); + } + } +}); + +test('one rule covers every outline button, not three covering some', () => { + /* secondary, danger and primary each had their own identical rule; the sale + screen also uses outline-success and outline-info, which got neither. */ + for (const variant of ['secondary', 'danger', 'primary']) { + assert.ok( + !new RegExp(`^\\.btn-outline-${variant}\\s*\\{`, 'm').test(css), + `.btn-outline-${variant} still has its own copy of the shared rule`, + ); + } + const shared = cssRule('[class*="btn-outline-"] {'); + assert.match(shared, /box-shadow:\s*none/, 'the resting state is not quietened'); +}); + +test('the keyboard keeps its focus ring', () => { + /* This is a till. It is driven tab by tab, and a control you cannot see the + focus on is one you cannot safely press. */ + const visible = cssRule('[class*="btn-outline-"]:focus-visible {'); + assert.match(visible, /outline:\s*2px/, 'keyboard focus draws no ring'); + assert.match(visible, /outline-offset/, 'the ring sits on the border and is hard to see'); + assert.ok( + !/outline:\s*none/.test(visible), + 'the focus-visible rule removes the very ring it exists to draw', + ); + + /* And the mouse still gets the clean look the old rules wanted - that is + what makes this an improvement rather than a reversal. */ + const mouse = cssRule('[class*="btn-outline-"]:focus:not(:focus-visible) {'); + assert.match(mouse, /outline:\s*none/, 'a click brings back the heavy focus ring'); +}); + +test('the ring follows the theme instead of naming a colour', () => { + /* darkblue is what .seven did, and why it could not follow a theme. */ + const visible = cssRule('[class*="btn-outline-"]:focus-visible {'); + assert.match(visible, /var\(--theme-[a-z-]+/, 'the ring colour is hardcoded'); + assert.match(visible, /var\([^)]*,\s*#/, 'no fallback - the ring vanishes if the token is missing'); +}); diff --git a/tests/packaged-assets.test.js b/tests/packaged-assets.test.js index 43b1a1f3c..4d601747a 100644 --- a/tests/packaged-assets.test.js +++ b/tests/packaged-assets.test.js @@ -43,15 +43,18 @@ function localRefs(html) { while ((m = rx.exec(html)) !== null) { const ref = m[1].trim(); if (!ref || /^(https?:|data:|#|mailto:|\/\/)/i.test(ref)) continue; - if (!/\.(js|css)$/i.test(ref)) continue; + /* Images too: the loading screen shipped with a logo reference its own + move had broken, and this filter was why no test said so. */ + if (!/\.(js|css|png|svg|ico|jpe?g|gif|webp)$/i.test(ref)) continue; out.push(ref.replace(/^\.\//, '').split(/[?#]/)[0]); } return out; } /* The Electron windows: top-level HTML the main process loads directly. */ -const WINDOWS = fs.readdirSync(ROOT) +const WINDOWS = fs.readdirSync(path.join(ROOT, 'src')) .filter((f) => f.endsWith('.html')) + .map((f) => 'src/' + f) .filter((f) => packaged(f)); test('every window that ships is listed in build.files', () => { @@ -59,26 +62,42 @@ test('every window that ships is listed in build.files', () => { }); for (const win of WINDOWS) { - test(`${win}: its scripts and stylesheets are packaged`, () => { + test(`${win}: its scripts, stylesheets and images are packaged`, () => { const html = fs.readFileSync(path.join(ROOT, win), 'utf8'); for (const ref of localRefs(html)) { - /* Anything under a directory the build ships wholesale is already covered; - this is about the loose files beside main.js. */ - if (ref.includes('/')) continue; - - assert.ok(fs.existsSync(path.join(ROOT, ref)), + /* Resolved the way the renderer resolves it - relative to the window's + own file. '../builds/x.png' from src/ is builds/x.png in the repo and + in the asar alike, so one check covers both. */ + const resolved = path.posix.normalize( + path.posix.join(path.posix.dirname(win.replace(/\\/g, '/')), ref), + ); + assert.ok(!resolved.startsWith('..'), + `${win} references ${ref}, which escapes the app root`); + assert.ok(fs.existsSync(path.join(ROOT, resolved)), `${win} references ${ref}, which does not exist`); - assert.ok(packaged(ref), - `${win} references ${ref}, which is missing from package.json build.files - ` + - `the window will open without it and fail quietly`); + assert.ok(packaged(resolved), + `${win} references ${ref} (${resolved}), which is missing from package.json ` + + `build.files - the window will open without it and fail quietly`); } }); } +test('a desk build ships the same api bytes a clean checkout would', () => { + /* Found by the packaging smoke, not by review: the Windows release is + built on the owner's desk, where api/ carries a live .local-db (the + local-dev harness), runtime uploads/, generated public/ exports and - + one day - a .env. None of that exists in CI, so CI could never catch + it, and each would have shipped inside the installer. */ + const api = pkg.build.extraResources.find((e) => e && e.from === 'api'); + for (const guard of ['!.env', '!.env.*', '!.local-db/**', '!uploads/**', '!public/**']) { + assert.ok(api.filter.includes(guard), `the api packaging filter lost ${guard}`); + } +}); + test('the theming a window asks for is the theming it gets', () => { /* Named explicitly rather than inferred: this pair is the reason the test exists, and a rename that drops one of them should fail here. */ - for (const asset of ['window-theme.js', 'window-theme.css']) { + for (const asset of ['src/window-theme.js', 'src/window-theme.css']) { assert.ok(packaged(asset), `${asset} must be in build.files`); } }); diff --git a/tests/pane-defer.test.js b/tests/pane-defer.test.js new file mode 100644 index 000000000..6cfc1168b --- /dev/null +++ b/tests/pane-defer.test.js @@ -0,0 +1,63 @@ +'use strict'; + +/* + * The furled panes stay furled (PAGE_SPLIT_ANALYSIS Option A, slice 1). + * + * The build wraps every report pane in <template class="pane-defer">: + * parsed, never rendered - a third of the phone's rendered tree + * (measured: 19,531 -> 13,089 elements) on the tab iOS keeps killing for + * memory. These pins hold the three load-bearing pieces: the build wraps + * the whole defer set, the core inflates for desktop and at the reports + * choke point, and no pane with an inline <script> ever joins the set - + * adopting template content EXECUTES scripts it holds. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('node:fs'); +const path = require('node:path'); + +const FRONTEND = path.join(__dirname, '..', 'frontend'); +const htmlJs = fs.readFileSync(path.join(FRONTEND, 'gulpfile.js/html.js'), 'utf8'); +const core = fs.readFileSync( + path.join(FRONTEND, 'static/script/js/core/PosnicPro.js'), 'utf8'); + +function deferSet() { + const m = htmlJs.match(/PHONE_DEFER = new Set\(\[([\s\S]*?)\]\)/); + assert.ok(m, 'PHONE_DEFER set missing from the build'); + return [...m[1].matchAll(/'([^']+)'/g)].map((x) => x[1]); +} + +test('the defer set names real, script-free module panes', () => { + const files = deferSet(); + assert.ok(files.length >= 20, 'the defer set shrank to ' + files.length); + for (const f of files) { + const p = path.join(FRONTEND, 'modules', f); + assert.ok(fs.existsSync(p), f + ' is in the defer set but not in modules/'); + const src = fs.readFileSync(p, 'utf8'); + assert.ok(!/<script\b/i.test(src), + f + ' carries a <script> - adopting its template would execute it'); + } +}); + +test('every defer-set pane has lazy-chunk JS, never boot-bundle JS', () => { + const map = JSON.parse(fs.readFileSync(path.join(FRONTEND, 'pages_css_js_map.json'), 'utf8')); + const bootJs = (map.dashboard.js || []).join('\n'); + /* priceSettings' module is report_pricesettings.js - in the lazy list */ + const lazy = (map.lazy_reports || []).join('\n'); + assert.ok(lazy.includes('report_sales.js'), 'lazy reports list moved?'); + /* the pin: no lazy report file may ALSO be in the boot bundle */ + for (const f of map.lazy_reports || []) { + assert.ok(!bootJs.includes(f.split('/').pop()), + f + ' is in BOTH the boot bundle and the lazy chunk'); + } +}); + +test('the core inflates panes for desktop and at the reports choke point', () => { + assert.match(core, /function __posnicInflatePanes\(\)/); + assert.match(core, /template\.pane-defer/); + /* desktop: inflate immediately unless the pointer is coarse */ + assert.match(core, /pointer: coarse.*matches\)\)\s*\{\s*__posnicInflatePanes\(\)/s); + /* the one choke point: lazy.load('reports') inflates first */ + assert.match(core, /if \(name === 'reports'\) \{ __posnicInflatePanes\(\); \}/); +}); diff --git a/tests/pin-lock.test.js b/tests/pin-lock.test.js index e9432e2d8..ded96a77a 100644 --- a/tests/pin-lock.test.js +++ b/tests/pin-lock.test.js @@ -3,7 +3,7 @@ const assert = require('node:assert'); const fs = require('fs'); const os = require('os'); const path = require('path'); -const { PinLock, isTooObvious, MAX_FAILURES } = require('../pin-lock'); +const { PinLock, isTooObvious, MAX_FAILURES } = require('../src/pin-lock'); /* * The property that matters is not "a wrong PIN is rejected" - it is that a diff --git a/tests/pos-acceptance-client-evidence.test.js b/tests/pos-acceptance-client-evidence.test.js new file mode 100644 index 000000000..b3c08d4bb --- /dev/null +++ b/tests/pos-acceptance-client-evidence.test.js @@ -0,0 +1,254 @@ +'use strict'; + +const test = require('node:test'); +const assert = require('node:assert'); +const crypto = require('node:crypto'); +const fs = require('node:fs'); +const path = require('node:path'); +const { JSDOM } = require('jsdom'); +const { renderSale, COLUMNS } = require('../src/escpos-receipt'); +const { blockAt } = require('./helpers/source-lookup'); + +/* + * Supplementary client-side evidence for the public vendor-neutral fixture. + * + * This does not pretend to drive a packaged Electron application, a physical + * printer, or a payment provider. It exercises two smaller boundaries that + * can be reproduced without those systems: + * + * - fixture-shaped receipt markup through Posnic's shipped HTML extractor + * and ESC/POS byte renderer; + * - the shipped pre-completion cart-clear handler in a DOM, with every + * network method instrumented to fail if it is called. + */ + +const ROOT = path.join(__dirname, '..'); +const RECEIPT_DATA_SOURCE = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'core', 'receipt-data.js'), + 'utf8', +); +const SALES_SOURCE = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'sales.js'), + 'utf8', +); + +const SALE_001_HTML = ` + <section> + <h1 class="print_store_name">Fixture Test Shop</h1> + <div class="print_store_address">Synthetic address - no real business</div> + <div class="print-custom-title">SALES RECEIPT</div> + <span class="print_view_id">SALE-001</span> + <span class="print_date">2026-08-22</span> + + <div class="row receipt-row-item-holder"> + <span class="invoice-content-heading">Counter Sample A</span> + <span class="item-qty">2 each</span> + <span class="item-total">XTS 20.00</span> + </div> + <div class="row receipt-row-item-holder"> + <span class="invoice-content-heading">Counter Sample B</span> + <span class="item-qty">2 each</span> + <span class="item-total">XTS 27.50</span> + </div> + <div class="row receipt-row-item-holder" style="display: none"> + <span class="invoice-content-heading">Hidden template row</span> + <span class="item-qty">99 each</span> + <span class="item-total">XTS 999.00</span> + </div> + + <div class="row"> + <span class="invoice-footer-value">Sub total:</span> + <span class="invoice-footer-value">XTS 45.00</span> + </div> + <div class="row"> + <span class="invoice-footer-value">Synthetic tax:</span> + <span class="invoice-footer-value">XTS 2.50</span> + </div> + <div class="row"> + <span class="invoice-footer-value">Total:</span> + <span class="invoice-footer-value">XTS 47.50</span> + </div> + <div class="row"> + <span class="invoice-footer-value">Tender label:</span> + <span class="invoice-footer-value">Cash</span> + </div> + <div class="invoice-policy">Synthetic fixture only; no real transaction.</div> + </section>`; + +function extractReceipt(html) { + const dom = new JSDOM('<!doctype html><html><body></body></html>'); + const $ = require('jquery')(dom.window); + const PosnicPro = {}; + new dom.window.Function('PosnicPro', '$', RECEIPT_DATA_SOURCE)(PosnicPro, $); + return PosnicPro.receiptData(html); +} + +function decodeEscPos(buffer) { + const ESC = 0x1b; + const GS = 0x1d; + const lines = []; + const controls = []; + let line = ''; + + for (let i = 0; i < buffer.length;) { + const byte = buffer[i]; + if (byte === ESC) { + const command = buffer[i + 1]; + if (command === 0x40) { controls.push('initialize'); i += 2; continue; } + if (command === 0x61 || command === 0x45 || command === 0x74) { i += 3; continue; } + if (command === 0x64) { lines.push(line); line = ''; i += 3; continue; } + if (command === 0x70) { controls.push('drawer'); i += 5; continue; } + i += 2; + continue; + } + if (byte === GS) { + const command = buffer[i + 1]; + if (command === 0x21) { i += 3; continue; } + if (command === 0x56) { controls.push('cut'); i += 4; continue; } + i += 2; + continue; + } + if (byte === 0x0a) { + lines.push(line); + line = ''; + i += 1; + continue; + } + line += String.fromCharCode(byte); + i += 1; + } + if (line) lines.push(line); + return { lines, controls }; +} + +test('SALE-001 fixture arithmetic survives the shipped receipt HTML extractor', () => { + const sale = extractReceipt(SALE_001_HTML); + + assert.strictEqual(sale.storeName, 'Fixture Test Shop'); + assert.strictEqual(sale.title, 'SALES RECEIPT'); + assert.strictEqual(sale.billNo, 'SALE-001'); + assert.deepStrictEqual(sale.items, [ + { name: 'Counter Sample A', qty: '2 each', amount: 20 }, + { name: 'Counter Sample B', qty: '2 each', amount: 27.5 }, + ]); + assert.strictEqual(sale.subTotal, 45); + assert.deepStrictEqual(sale.taxes, [{ label: 'Synthetic tax', amount: 2.5 }]); + assert.strictEqual(sale.total, 47.5); + assert.deepStrictEqual(sale.extras, [{ label: 'Tender label', value: 'Cash' }]); + assert.strictEqual(sale.footer, 'Synthetic fixture only; no real transaction.'); + + const lineTotal = sale.items.reduce((sum, item) => sum + item.amount, 0); + assert.strictEqual(lineTotal, 47.5, 'the extracted receipt lines must reconcile to XTS 47.50'); + assert.strictEqual(sale.subTotal + sale.taxes[0].amount, sale.total); +}); + +test('SALE-001 renders bounded, deterministic ESC/POS bytes for both roll widths', (t) => { + const sale = extractReceipt(SALE_001_HTML); + const hashes = new Set(); + + for (const width of ['58', '80']) { + const bytes = renderSale(sale, { paperWidth: width }); + const { lines, controls } = decodeEscPos(bytes); + const sha256 = crypto.createHash('sha256').update(bytes).digest('hex'); + hashes.add(sha256); + t.diagnostic(`${width}mm receipt: ${bytes.length} bytes, sha256=${sha256}`); + + assert.ok(Buffer.isBuffer(bytes)); + assert.ok(bytes.length > 0); + assert.deepStrictEqual(controls, ['initialize', 'cut']); + assert.ok(!controls.includes('drawer'), 'a receipt must not pulse a drawer unless requested'); + assert.ok(lines.some((line) => line.includes('Counter Sample A'))); + assert.ok(lines.some((line) => line.includes('Counter Sample B'))); + assert.ok(lines.some((line) => line.startsWith('TOTAL') && line.endsWith('47.50'))); + for (const line of lines) { + assert.ok( + line.length <= COLUMNS[width], + `${width}mm line is ${line.length} columns: ${JSON.stringify(line)}`, + ); + } + } + + assert.strictEqual(hashes.size, 2, '58mm and 80mm output should be independently laid out'); +}); + +function bootPreCompletionVoid() { + const dom = new JSDOM(`<!doctype html><html><body> + <input id="sales_new_item_name" value="Counter Sample A"> + <span class="tax-sales-line-total">9.99</span> + <input id="tax" value="2.50"> + <div id="reset_modal"></div> + </body></html>`, { url: 'https://fixture.invalid/#sales/new' }); + const $ = require('jquery')(dom.window); + const calls = { + renderCharges: 0, + setDefaults: 0, + customerViewDisplay: 0, + alerts: [], + network: [], + }; + + $.fn.modal = function modal(action) { + this.attr('data-modal-action', action); + return this; + }; + + const failOnNetwork = (method) => (...args) => { + calls.network.push({ method, args }); + throw new Error(`pre-completion void attempted ${method}`); + }; + const PosnicPro = { + get: failOnNetwork('GET'), + post: failOnNetwork('POST'), + put: failOnNetwork('PUT'), + delete: failOnNetwork('DELETE'), + alert: (type, message) => calls.alerts.push({ type, message }), + /* The words a module writes now come through i18n. Answer the way the + real t() answers with no pack loaded: the English it was handed. */ + i18n: { t: (key, english) => english }, + + sales: { + charges: [{ label: 'Synthetic charge', amount: 1 }], + SaleTableLineItems: [{ item_id: 'ITEM-001', quantity: 3 }], + renderCharges: () => { calls.renderCharges += 1; }, + setDefaults: () => { calls.setDefaults += 1; }, + customerViewDisplay: () => { calls.customerViewDisplay += 1; }, + clear: {}, + }, + }; + + const source = blockAt( + SALES_SOURCE, + 'PosnicPro.sales.clear.cartItems = function (isFalse) {', + ); + new dom.window.Function('PosnicPro', '$', 'window', `${source};`)(PosnicPro, $, dom.window); + + return { dom, $, PosnicPro, calls }; +} + +test('VOID-001 client handler clears an unsaved basket without a network posting', () => { + const { dom, $, PosnicPro, calls } = bootPreCompletionVoid(); + + PosnicPro.sales.clear.cartItems(); + + assert.deepStrictEqual(PosnicPro.sales.charges, []); + assert.deepStrictEqual(PosnicPro.sales.SaleTableLineItems, []); + assert.strictEqual($('#sales_new_item_name').val(), ''); + assert.strictEqual($('.tax-sales-line-total').html(), '0.00'); + assert.strictEqual($('#reset_modal').attr('data-modal-action'), 'hide'); + assert.strictEqual(dom.window.document.activeElement.id, 'sales_new_item_name'); + assert.strictEqual(calls.renderCharges, 1); + assert.strictEqual(calls.setDefaults, 1); + assert.strictEqual(calls.customerViewDisplay, 1); + assert.deepStrictEqual(calls.alerts, [{ type: 'success', message: 'Sale cancelled.' }]); + assert.deepStrictEqual(calls.network, [], 'an unsaved basket clear must not call an API'); +}); + +test('VOID-001 client handler can clear silently without changing posting behavior', () => { + const { PosnicPro, calls } = bootPreCompletionVoid(); + + PosnicPro.sales.clear.cartItems(false); + + assert.deepStrictEqual(PosnicPro.sales.SaleTableLineItems, []); + assert.deepStrictEqual(calls.alerts, []); + assert.deepStrictEqual(calls.network, []); +}); diff --git a/tests/posnicpro-call-paths.test.js b/tests/posnicpro-call-paths.test.js new file mode 100644 index 000000000..af2d3577e --- /dev/null +++ b/tests/posnicpro-call-paths.test.js @@ -0,0 +1,107 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { stripComments } = require('./helpers/source-lookup'); + +/* + * Every PosnicPro.<name>(...) call must name something that exists. + * + * This is the cheapest bug in the codebase to write and among the more + * expensive to notice. PosnicPro.confirm and PosnicPro.escapeHtml were both + * written in a single session, in live files, and caught only by reading the + * diff back. Nothing else catches the shape: the file parses, the build + * passes, lint is silent, and the call sits on a branch that only runs when + * something has already gone wrong - which is exactly when its message + * mattered most. + * + * A third instance, PosnicPro.toastr called eight times, turned out to live in + * a module that was never in the build manifest at all. Worth remembering as + * its own lesson: "this function does not exist" and "this file never runs" + * look identical from inside the file, and only the manifest tells them + * apart. + * + * Scope is deliberately the DIRECT call, PosnicPro.foo(). Namespaced calls + * (PosnicPro.sales.foo()) are left to sales-call-paths.test.js, which can + * resolve one namespace properly rather than guessing across all of them. + */ + +const ROOT = path.join(__dirname, '..', 'frontend', 'static', 'script', 'js'); + +/* Every hand-written source under the js tree. Vendored libraries are skipped: + they have their own idea of what globals exist and are not ours to police. */ +function sources(dir, acc = []) { + for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { + const full = path.join(dir, entry.name); + if (entry.isDirectory()) { + if (['plugins', 'lib', 'vendor'].includes(entry.name)) continue; + sources(full, acc); + } else if (entry.name.endsWith('.js') && !entry.name.endsWith('.min.js')) { + acc.push({ file: path.relative(ROOT, full), text: fs.readFileSync(full, 'utf8') }); + } + } + return acc; +} + + +const files = sources(ROOT).map((f) => ({ ...f, code: stripComments(f.text) })); + +function definedMembers() { + const defined = new Set(); + + /* Members of the one big `PosnicPro = { ... }` literal. Indentation varies + (some are three spaces, some four), so match on the brace depth instead of + the leading whitespace - that difference alone caused a false positive. */ + const core = files.find((f) => f.file.endsWith(path.join('core', 'PosnicPro.js'))); + assert.ok(core, 'core/PosnicPro.js not found'); + const start = core.code.indexOf('PosnicPro = {'); + assert.notStrictEqual(start, -1, 'the PosnicPro literal moved'); + + let depth = 0; + for (let i = core.code.indexOf('{', start); i < core.code.length; i++) { + const c = core.code[i]; + if (c === '{') depth++; + else if (c === '}') { + depth--; + if (depth === 0) break; + } else if (depth === 1 && c === '\n') { + const end = core.code.indexOf('\n', i + 1); + const line = core.code.slice(i + 1, end === -1 ? undefined : end); + const m = line.match(/^\s*([a-zA-Z_$][\w$]*)\s*:/); + if (m) defined.add(m[1]); + } + } + + // ...plus every later `PosnicPro.x = ...`, wherever it lives + for (const { code } of files) { + for (const m of code.matchAll(/PosnicPro\.([a-zA-Z_$][\w$]*)\s*=[^=]/g)) defined.add(m[1]); + } + return defined; +} + +test('the member scan finds the real API surface', () => { + const defined = definedMembers(); + assert.ok(defined.size > 100, `only found ${defined.size} members - has the scan broken?`); + for (const known of ['alert', 'get', 'post', 'local', 'sales']) { + assert.ok(defined.has(known), `${known} should have been found`); + } +}); + +test('no call names a PosnicPro member that does not exist', () => { + const defined = definedMembers(); + const missing = []; + + for (const { file, code } of files) { + for (const m of code.matchAll(/PosnicPro\.([a-zA-Z_$][\w$]*)\s*\(/g)) { + if (defined.has(m[1])) continue; + const line = code.slice(0, m.index).split('\n').length; + missing.push(`${file}:${line} PosnicPro.${m[1]}(...)`); + } + } + + assert.deepStrictEqual( + missing, + [], + 'these call PosnicPro members that are never defined:\n ' + missing.join('\n '), + ); +}); diff --git a/tests/preload-bridge.test.js b/tests/preload-bridge.test.js index 0a16b4d77..80847ea98 100644 --- a/tests/preload-bridge.test.js +++ b/tests/preload-bridge.test.js @@ -21,7 +21,7 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); function bridgeMethods() { - const preload = fs.readFileSync(path.join(ROOT, 'preload.js'), 'utf8'); + const preload = fs.readFileSync(path.join(ROOT, 'src', 'preload.js'), 'utf8'); const defined = new Set(); for (const m of preload.matchAll(/^\s*([a-zA-Z][a-zA-Z0-9_]*)\s*:/gm)) defined.add(m[1]); return defined; diff --git a/tests/print-document-store.test.js b/tests/print-document-store.test.js index d735c4e27..db42f2ef2 100644 --- a/tests/print-document-store.test.js +++ b/tests/print-document-store.test.js @@ -27,8 +27,8 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8').replace(/\r\n/g, '\n'); -const store = require('../print-document-store'); -const HARDWARE = read('hardware-manager.js'); +const store = require('../src/print-document-store'); +const HARDWARE = read('src/hardware-manager.js'); const APP = read('api', 'app.js'); const pkg = require('../package.json'); @@ -147,12 +147,12 @@ test('the store ships where both sides can reach the same instance', () => { const extra = pkg.build.extraResources.filter((r) => typeof r.from === 'string').map((r) => r.from); assert.ok( - extra.includes('print-document-store.js'), + extra.includes('src/print-document-store.js'), 'print-document-store.js is not in extraResources, so api/app.js cannot ' + 'require it in a packaged build', ); assert.ok( - !pkg.build.files.includes('print-document-store.js'), + !pkg.build.files.includes('src/print-document-store.js'), 'print-document-store.js is in build.files as well - electron-builder then ' + 'leaves it out of the asar entirely, and the two sides get different Maps', ); diff --git a/tests/print-window-hardening.test.js b/tests/print-window-hardening.test.js index 4b253df4e..b028a9f5b 100644 --- a/tests/print-window-hardening.test.js +++ b/tests/print-window-hardening.test.js @@ -27,9 +27,9 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8').replace(/\r\n/g, '\n'); -const KOT = read('kot-manager.js'); -const HARDWARE = read('hardware-manager.js'); -const GUARD = read('print-window-guard.js'); +const KOT = read('src/kot-manager.js'); +const HARDWARE = read('src/hardware-manager.js'); +const GUARD = read('src/print-window-guard.js'); /** The webPreferences block of the print window in a given source file. */ function printWindowPrefs(src) { @@ -127,7 +127,7 @@ test('a print window still cannot reach IPC, whatever its web security', () => { /* This is the boundary that actually matters, and it is independent of both settings above: ipc-guard trusts file: and loopback http: origins only, so a data: page is refused. */ - const ipcGuard = read('ipc-guard.js'); + const ipcGuard = read('src/ipc-guard.js'); const fn = ipcGuard.slice(ipcGuard.indexOf('function isTrustedFrame')); const body = fn.slice(0, fn.indexOf('\n}\n')); diff --git a/tests/project-metadata.test.js b/tests/project-metadata.test.js new file mode 100644 index 000000000..57a50c61d --- /dev/null +++ b/tests/project-metadata.test.js @@ -0,0 +1,78 @@ +const fs = require('node:fs'); +const path = require('node:path'); +const test = require('node:test'); +const assert = require('node:assert/strict'); + +const root = path.join(__dirname, '..'); +const metadata = JSON.parse(fs.readFileSync(path.join(root, 'codemeta.json'), 'utf8')); +const packageJson = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')); + +test('CodeMeta preserves the canonical Posnic product identity', () => { + assert.equal(metadata['@context'], 'https://w3id.org/codemeta/3.0'); + assert.equal(metadata['@type'], 'SoftwareSourceCode'); + assert.equal(metadata['@id'], 'https://github.com/Posnic/POS'); + assert.equal(metadata.name, 'Posnic POS'); + assert.equal(metadata.codeRepository, 'https://github.com/Posnic/POS'); + assert.equal(metadata.issueTracker, packageJson.bugs.url); + assert.equal(metadata.url, packageJson.homepage); +}); + +test('CodeMeta states a version, and it cannot drift from package.json', () => { + // Machine-readable identity without a version is far less useful: indexers + // and citation tools key on it, and "which release is this describing?" has + // no answer without it. Asserting equality rather than a literal is the point + // - a hardcoded version in a second file is a stale version waiting to happen, + // and this file already cross-checks issueTracker, url and author the same way. + assert.equal(metadata.version, packageJson.version); + assert.match(metadata.version, /^\d+\.\d+\.\d+/); + + // CITATION.cff describes the same release, and codemeta.json points straight + // at it. Two identity files disagreeing about the version is worse than one + // omitting it: a reader has no way to tell which is stale. Read with a regex + // rather than a YAML parser to keep this test dependency-free. + const citation = fs.readFileSync(path.join(root, 'CITATION.cff'), 'utf8'); + const cffVersion = /^version:\s*(.+)$/m.exec(citation); + assert.ok(cffVersion, 'CITATION.cff states no version'); + assert.equal(cffVersion[1].trim().replace(/^['"]|['"]$/g, ''), packageJson.version); + + const cffLicense = /^license:\s*(.+)$/m.exec(citation); + assert.equal(cffLicense[1].trim(), packageJson.license); +}); + +test('CodeMeta preserves the source licence and package-component boundary', () => { + assert.equal(packageJson.license, 'AGPL-3.0-only'); + assert.equal(metadata.license, 'https://spdx.org/licenses/AGPL-3.0-only.html'); + assert.equal(metadata.isAccessibleForFree, true); + assert.match(metadata.description, /separately licensed components/i); + assert.match(metadata.description, /MongoDB Community Server under SSPL-1\.0/i); +}); + +test('CodeMeta publishes the verified publisher and supported platforms', () => { + assert.equal(metadata.author.name, packageJson.author); + assert.equal(metadata.publisher.name, packageJson.author); + assert.deepEqual(metadata.operatingSystem, ['Windows', 'macOS', 'Linux']); + assert.equal(metadata.maintainer.url, 'https://github.com/sridharkalaibala'); +}); + +test('CodeMeta uses only secure canonical links', () => { + const links = [ + metadata['@id'], + metadata.author.url, + metadata.publisher.url, + metadata.maintainer.url, + metadata.codeRepository, + metadata.issueTracker, + metadata.continuousIntegration, + metadata.license, + metadata.url, + metadata.downloadUrl, + metadata.softwareHelp, + metadata.citation, + ...metadata.relatedLink, + ]; + + for (const link of links) assert.match(link, /^https:\/\//); + assert.equal(packageJson.homepage, 'https://posnic.io/'); + assert.equal(metadata.url, 'https://posnic.io/'); + assert.equal(metadata.isSourceCodeOf.url, 'https://posnic.io/'); +}); diff --git a/tests/public-routes.test.js b/tests/public-routes.test.js index 98673f84a..b0da3a6df 100644 --- a/tests/public-routes.test.js +++ b/tests/public-routes.test.js @@ -36,7 +36,12 @@ function openRoutes(file) { return m ? m.index : Infinity; })(); - return [...src.matchAll(/router\.(get|post|put|patch|delete)\(\s*"([^"]+)"([^;]*)/g)] + /* Both quote styles. This matched only double quotes for months, and a + route file written with single quotes - which is most of them - escaped + the sweep entirely. A security test that inspects a dialect nobody + writes is a security test in name. Found when a deliberately public + route passed without being allowed. */ + return [...src.matchAll(/router\.(get|post|put|patch|delete)\(\s*["']([^"']+)["']([^;]*)/g)] .filter((m) => m.index < guardAt) .map((m) => ({ method: m[1], route: m[2], middleware: m[3] })); } @@ -48,6 +53,29 @@ function openRoutes(file) { * what strangers may do to a shop's data, so it should take a code review. */ const ALLOWED_ANONYMOUS = { + 'users.routes.js': [ + // Invisible to this sweep for months: the file is single-quoted and the + // sweep matched only double quotes. Reviewed on discovery - every one + // is an auth ENTRY point or carries its own credential. + '/register', '/login', '/verify', + // self-authenticating logins for the phone and kiosk apps + '/mobileLogin', '/kioskMobileLogin', + // key+secret travel IN the path - installation credentials + '/ssoAuth', '/ssoToken/:key/:secret', '/planUpdate/:key/:secret', + // the forgot-password flow: both require the emailed one-time user_key + '/getUserKeyDetails', '/updateNewPassword', + ], + 'client-errors.routes.js': [ + // The boot watchdog's report: the errors worth hearing about happen + // BEFORE auth works. Stores nothing, per-IP budgeted, truncated, + // always 204 - see the route file. + '/', + // TEMPORARY diagnostic window (OWNER_QUEUE row 193): the last 30 + // already-truncated report lines, readable where no audited log path + // exists. Comes out with the boot flight recorder once the mobile + // crash is closed. + '/recent', + ], 'auth.routes.js': [ '/register', '/login', '/verify', '/forgot-password', '/reset-password/:token', ], diff --git a/tests/public-url.test.js b/tests/public-url.test.js new file mode 100644 index 000000000..d4fcc9c48 --- /dev/null +++ b/tests/public-url.test.js @@ -0,0 +1,201 @@ +'use strict'; + +/* + * The address we put in an email, and the two ways it goes wrong. + * + * WRONG THE FIRST WAY - dead. Forgot-password read SERVER_NAME, which is set on + * no process in the estate, fell through to the localhost branch, and mailed + * every hosted shop a link to http://localhost:3000/forgotpassword.html. That + * is the recipient's own computer, on a port with nothing listening. Self- + * service password recovery has never worked for a cloud shop, which is why a + * locked-out owner needed five days and a database session to get back into his + * own till. + * + * WRONG THE SECOND WAY - poisoned. The obvious repair is to build the link from + * req.headers.host, and that is password-reset poisoning, the oldest attack + * against exactly this code: send `Host: evil.example`, and the victim receives + * a genuine email from us carrying a link that hands their token to somebody + * else. This application is more exposed than most, because the host does not + * select the database here - the process already knows its shop - so a forged + * host is contradicted by nothing downstream. + * + * Both failures are pinned below. The second matters more: a dead link is a + * support ticket, a poisoned one is an account takeover. + */ + +const test = require('node:test'); +const assert = require('node:assert'); + +const { + publicBaseUrl, publicPageUrl, isOwnHost, looksLikeHostname, +} = require('../api/src/utils/public-url'); + +const withHost = (host, extra = {}) => ({ headers: { host, ...extra } }); + +/* The environment must not leak between tests - PUBLIC_BASE_URL short-circuits + everything, so one stray value would make the rest pass for the wrong reason. */ +function clean(run) { + const saved = { + PUBLIC_BASE_URL: process.env.PUBLIC_BASE_URL, + SERVER_NAME: process.env.SERVER_NAME, + PUBLIC_EXTRA_DOMAINS: process.env.PUBLIC_EXTRA_DOMAINS, + }; + delete process.env.PUBLIC_BASE_URL; + delete process.env.SERVER_NAME; + delete process.env.PUBLIC_EXTRA_DOMAINS; + try { return run(); } finally { + for (const [k, v] of Object.entries(saved)) { + if (v === undefined) delete process.env[k]; + else process.env[k] = v; + } + } +} + +test('a shop gets a link to itself', () => { + clean(() => { + assert.equal( + publicBaseUrl(withHost('pugazhfashion26.posnic.io')), + 'https://pugazhfashion26.posnic.io' + ); + assert.equal( + publicPageUrl(withHost('pugazhfashion26.posnic.io'), 'forgotpassword.html', { forgotpassword_Id: 'abc123' }), + 'https://pugazhfashion26.posnic.io/public/forgotpassword.html?forgotpassword_Id=abc123' + ); + }); +}); + +test('nobody is ever sent to localhost again', () => { + /* The exact bug. A hosted shop must never produce this string. */ + clean(() => { + const link = publicPageUrl(withHost('kiranastore.posnic.io'), 'forgotpassword.html', { forgotpassword_Id: 'x' }); + assert.ok(!/localhost|127\.0\.0\.1/.test(link), + 'a hosted shop produced a loopback link: ' + link); + }); +}); + +test('a forged host is refused, so no email carries it', () => { + /* + * The attack: POST the reset endpoint with someone else's Host. The victim + * gets a real email from us with a link to the attacker's server. + */ + clean(() => { + for (const evil of [ + 'evil.example', + 'posnic.io.evil.example', + 'evil.example#posnic.io', + 'attacker.co.uk', + 'notposnic.io', + ]) { + assert.equal(publicBaseUrl(withHost(evil)), null, + `${evil} was accepted as our own host`); + assert.equal(publicPageUrl(withHost(evil), 'forgotpassword.html', { forgotpassword_Id: 'x' }), null, + `${evil} produced a link`); + } + }); +}); + +test('a forged x-forwarded-host is refused too', () => { + /* The header a proxy sets is just as writable by a caller as Host is. */ + clean(() => { + assert.equal( + publicBaseUrl({ headers: { host: 'shop.posnic.io', 'x-forwarded-host': 'evil.example' } }), + null, + 'x-forwarded-host was trusted over a genuine host'); + }); +}); + +test('a suffix that merely contains our domain is not our domain', () => { + /* endsWith on ".posnic.io" is the check; "xposnic.io" and "posnic.io.evil" + are the two ways a careless one lets an attacker through. */ + assert.ok(isOwnHost('a.posnic.io')); + assert.ok(isOwnHost('shop.posnic.com')); + assert.ok(!isOwnHost('xposnic.io')); + assert.ok(!isOwnHost('posnic.io.evil.example')); + assert.ok(!isOwnHost('evilposnic.com')); +}); + +test('what an operator configured wins over anything a caller sends', () => { + /* A self-hosted shop on its own name, and the only route that does not + depend on guessing. */ + const saved = process.env.PUBLIC_BASE_URL; + process.env.PUBLIC_BASE_URL = 'https://pos.myshop.example'; + try { + assert.equal(publicBaseUrl(withHost('evil.example')), 'https://pos.myshop.example', + 'a forged host beat the configured address'); + assert.equal( + publicPageUrl(withHost('evil.example'), 'forgotpassword.html', { forgotpassword_Id: 'k' }), + 'https://pos.myshop.example/public/forgotpassword.html?forgotpassword_Id=k'); + } finally { + if (saved === undefined) delete process.env.PUBLIC_BASE_URL; + else process.env.PUBLIC_BASE_URL = saved; + } +}); + +test('a custom domain works once an operator names it', () => { + const saved = process.env.PUBLIC_EXTRA_DOMAINS; + process.env.PUBLIC_EXTRA_DOMAINS = 'pos.sbala.in, shop.example.com'; + try { + delete process.env.PUBLIC_BASE_URL; + assert.equal(publicBaseUrl(withHost('pos.sbala.in')), 'https://pos.sbala.in'); + assert.equal(publicBaseUrl(withHost('other.sbala.in')), null, + 'naming one custom domain must not admit its siblings'); + } finally { + if (saved === undefined) delete process.env.PUBLIC_EXTRA_DOMAINS; + else process.env.PUBLIC_EXTRA_DOMAINS = saved; + } +}); + +test('local development still works, over http', () => { + clean(() => { + assert.equal(publicBaseUrl(withHost('localhost:3000')), 'http://localhost:3000'); + }); +}); + +test('a host that is not a hostname is refused', () => { + assert.ok(!looksLikeHostname('shop.posnic.io/evil')); + assert.ok(!looksLikeHostname('user:pass@shop.posnic.io')); + assert.ok(!looksLikeHostname('shop .posnic.io')); + assert.ok(looksLikeHostname('shop.posnic.io')); + assert.ok(looksLikeHostname('localhost:3000')); +}); + +test('with nothing trustworthy, there is no link at all', () => { + /* The caller must then refuse to send, rather than mailing a dead or + dangerous address. */ + clean(() => { + assert.equal(publicBaseUrl({ headers: {} }), null); + assert.equal(publicBaseUrl(undefined), null); + }); +}); + +test('forgot-password refuses to send when it has no address', () => { + /* + * The behaviour that makes the null above safe. Read from the source: this + * is a mail path, so exercising it for real would send mail. + */ + const fs = require('fs'); + const path = require('path'); + const src = fs.readFileSync( + path.join(__dirname, '..', 'api', 'src', 'models', 'setting.model.js'), 'utf8'); + const fn = /async getForgotUserDetails\([\s\S]*?\n \}/.exec(src); + assert.ok(fn, 'getForgotUserDetails not found'); + + assert.match(fn[0], /publicPageUrl\(req, 'forgotpassword\.html'/, + 'the link is not built from this shop own address'); + assert.match(fn[0], /if \(!basePath\)/, + 'a missing address is not checked, so a broken link would still be mailed'); + /* Comments are stripped first. The function explains the old bug in prose, + and the strings being banned appear there - a check that matched the + explanation instead of the code would fail for the wrong reason, which is + its own kind of useless. */ + const code = fn[0] + .replace(/\/\*[\s\S]*?\*\//g, '') + .replace(/^\s*\/\/.*$/gm, ''); + + assert.ok(!/FRONTEND_URL\s*\|\|\s*'http:\/\/localhost/.test(code), + 'the localhost fallback is still in the code'); + assert.ok(!/basePath\s*=\s*`https:\/\/www\.posnic\.io/.test(code), + 'the hardcoded marketing-site link is still in the code'); + assert.ok(!/process\.env\.SERVER_NAME\s*\|\|\s*'localhost'/.test(code), + 'the SERVER_NAME-or-localhost guess is still in the code'); +}); diff --git a/tests/purchase-one-door.test.js b/tests/purchase-one-door.test.js new file mode 100644 index 000000000..067e81a9f --- /dev/null +++ b/tests/purchase-one-door.test.js @@ -0,0 +1,89 @@ +'use strict'; + +/* + * One door for purchasing. + * + * Owner: "i see new purchase, purchase history duplicated in purchase order + * page... have only one option... options like quote we need filter + * typeahead and etc you need improve and then remove old add purchase + * purchase history." + * + * The system: the sidebar carries ONE entry (Purchases). The page behind it + * reaches every flow - ordering, receiving stock, the history - and the + * history's filter bar offers this shop's own suppliers, the same way the + * quotes bar offers customers. The old ROUTES stay alive (deep links, the + * desktop), only the duplicate menu doors are gone. + */ +const { test } = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const read = (rel) => fs.readFileSync(path.join(__dirname, '..', 'frontend', rel), 'utf8'); +const sidebar = read('layouts/sidebar.html'); +const poPage = read('modules/purchaseOrders.html'); +const receivingJs = read('static/script/js/modules/js/receiving_add.js'); + +test('the sidebar has exactly ONE purchasing entry', () => { + assert.ok(sidebar.includes('id="view_purchaseorders_page"'), 'the Purchases entry is gone'); + assert.ok(!sidebar.includes('id="view_receiving_page"'), 'the New Purchase menu entry is back'); + assert.ok(!sidebar.includes('id="view_receivings_page"'), 'the Purchase History menu entry is back'); +}); + +test('the one door reaches every flow the old doors reached', () => { + assert.match(poPage, /href="#\/receivings\/new"/); + /* Purchase History is RETIRED (owner, 2026-08-27: "delete existing + routes and html and etc") - nothing may link to it, and the old route + redirects to the one surface instead of a page that no longer exists. */ + assert.ok(!poPage.includes('href="#/receivings"'), 'a link points at the retired archive'); + const shower = receivingJs.slice( + receivingJs.indexOf('showDataTablePage: function'), + receivingJs.indexOf('},', receivingJs.indexOf('showDataTablePage: function')), + ); + assert.match(shower, /setHash\('purchaseorders'\)/, 'the old route must redirect, not 404'); +}); + +test('the history filter offers suppliers, like quotes offers customers', () => { + const mount = receivingJs.slice( + receivingJs.indexOf("key: 'receivings'"), + receivingJs.indexOf('onChange', receivingJs.indexOf("key: 'receivings'")) + ); + assert.match(mount, /typeahead: 'supplier'/); + assert.match(mount, /typeaheadField: 'supplier_name'/); +}); + +test('nothing still lights the removed menu ids', () => { + for (const f of ['items.js', 'receiving_add.js']) { + const src = read('static/script/js/modules/js/' + f); + assert.ok(!src.includes("a#view_receiving_page')"), f + ' still targets the removed entry'); + assert.ok(!src.includes(".view_receivings_page')"), f + ' still targets the removed class'); + } +}); + +test('receive happens IN the purchases page - the old-design detour is gone', () => { + /* Owner: "while click on receive items its going old design." The + Receive action now opens a panel in the same page, posts the same + receivings payload the old screen posted (status Received, the PO id + riding as source_po_id so the mirror syncs), and reopens the order. + The old screen stays reachable for manual purchases - but nothing + routes to it from a purchase order any more. */ + const html = read('modules/purchaseOrders.html'); + assert.match(html, /id="po_receive_section"/); + assert.match(html, /Receive into stock/); + assert.match(html, /table-borderless m-cards/, 'the receive lines must be card-ready on phones'); + + const receive = receivingJs.slice( + receivingJs.indexOf('receive: function (id)'), + receivingJs.indexOf('saveReceive:')); + assert.ok(!receive.includes("hasher.setHash('receivings/new')"), + 'Receive still detours to the old screen'); + assert.match(receivingJs, /openReceive: function/); + assert.match(receivingJs, /saveReceive: function/); + const save = receivingJs.slice(receivingJs.indexOf('saveReceive: function')); + assert.match(save, /status: 'Received'/); + assert.match(save, /source_po_id: String\(po\._id\)/); + /* the dead prefill bridge went with the detour */ + assert.ok(!receivingJs.includes('_poPrefill'), 'the prefill bridge is dead code now'); + /* every sibling section hides the panel, so it cannot linger */ + assert.match(receivingJs, /#po_form_section,#po_view_section,#po_receive_section'\)\.hide/); +}); diff --git a/tests/pwa-install.test.js b/tests/pwa-install.test.js new file mode 100644 index 000000000..48079e99f --- /dev/null +++ b/tests/pwa-install.test.js @@ -0,0 +1,45 @@ +'use strict'; + +/* + * Installability contract (Mobile P4). "Most of our users visit from + * mobile" - the app must pass the browser's install checks, and those + * checks are concrete: a manifest with real PNG icons at 192 and 512 + * (an SVG-only icon list fails Chrome on Android), a maskable variant so + * launchers that crop to a circle do not clip the mark, and a PNG + * apple-touch-icon (iOS ignores SVG there and composites transparency + * over black). The icons are generated from the favicon's 256px frame - + * if the logo changes, regenerate all four together. + */ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..', 'frontend'); +const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8'); + +test('the manifest offers real PNG icons at the sizes Chrome checks', () => { + const m = JSON.parse(read('static/manifest.webmanifest')); + assert.strictEqual(m.display, 'standalone'); + const bySize = (s, purpose) => m.icons.find( + (i) => i.sizes === s && i.type === 'image/png' && (i.purpose || 'any') === purpose); + assert.ok(bySize('192x192', 'any'), 'no 192px any-purpose PNG'); + assert.ok(bySize('512x512', 'any'), 'no 512px any-purpose PNG'); + assert.ok(bySize('512x512', 'maskable'), 'no maskable icon - circular launchers clip the mark'); + for (const i of m.icons) { + if (i.type !== 'image/png') continue; + const p = path.join(ROOT, 'static', i.src); + assert.ok(fs.existsSync(p), i.src + ' is referenced but not on disk'); + assert.ok(fs.statSync(p).size > 1000, i.src + ' is suspiciously tiny'); + } +}); + +test('both entry pages carry the install plumbing', () => { + for (const page of ['dashboard.html', 'login.html']) { + const s = read(page); + assert.match(s, /rel="manifest" href="static\/manifest\.webmanifest"/, page); + assert.match(s, /name="theme-color"/, page); + assert.match(s, /rel="apple-touch-icon" href="static\/images\/icons-pwa\/apple-touch-icon\.png"/, + page + ' - iOS needs the PNG tile, not an SVG'); + } +}); diff --git a/tests/quick-items.test.js b/tests/quick-items.test.js index 3018bddf7..62968dcdb 100644 --- a/tests/quick-items.test.js +++ b/tests/quick-items.test.js @@ -32,6 +32,10 @@ function boot() { const PosnicPro = { local: { get: () => null }, alert: (type, message) => alerts.push(type + ': ' + message), + /* The words a module writes now come through i18n. Answer the way the + real t() answers with no pack loaded: the English it was handed. */ + i18n: { t: (key, english) => english }, + HideSideBarModal: () => {}, get: (params, ok) => { const url = String(params.url); diff --git a/tests/quotes-master-detail.test.js b/tests/quotes-master-detail.test.js new file mode 100644 index 000000000..f30fc1ad5 --- /dev/null +++ b/tests/quotes-master-detail.test.js @@ -0,0 +1,1557 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { blockAt, cssReader, markerReader, stripComments } = require('./helpers/source-lookup'); + +/* + * The quotes master-detail: one surface, and only the document changes. + * + * Two bugs are pinned here, both reported from the live till. + * + * 1. FLICKER. showDetails() ran the whole page-entry ritual on every row + * click. #quotes_new itself carries the class .page_loader, so + * $('.page_loader').hide() tore down the very list being clicked in, and + * the next line built it back. Re-entering a page you are already on also + * throws away the rail's scroll position and restarts its transitions. + * Entering the page and moving between quotes are different operations; + * only the first may touch the page chrome. + * + * 2. THE EDITOR SHARES THE CONTENTBAR. It is a third child of the same + * element the split lays out, so "is the split on?" is not enough to + * decide a click is safe to fast-path, and the editor must switch the + * split off or it inherits the rail's border and a flex width it never + * asked for. + * + * The list assertions cover the joined look itself - two cards with a gap + * between them was the thing being replaced - and the pager, which existed + * but rendered only past page one, so on a shop with eight quotes it looked + * like paging had never been built. + */ + +const ROOT = path.join(__dirname, '..'); +const salesSource = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'sales.js'), + 'utf8', +); +const css = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'style', 'css', 'custom.css'), + 'utf8', +); +const cssRule = cssReader(css); +/* + * Rules of the PATTERN are read by marker, not by selector. + * + * These same declarations are about to move from .quotes-split onto a generic + * .master-detail, and a suite that finds them by class name would have to be + * rewritten in that same commit - the safety net rebuilt by the fall it exists + * to catch. A marker names what a rule is FOR, which the rename does not touch. + * + * Rules that are genuinely QUOTES-specific (the A4 sheet, the status chips) + * keep using cssRule: their selector is not going anywhere, and naming it is + * the honest way to say so. + */ +const ruleFor = markerReader(css); + +/* sales.js defines showDetails twice - sales history has one too - so every + lookup starts from the quotes namespace rather than the top of the file. + An unanchored marker here would silently test the wrong module. */ +const quotesNamespace = blockAt(salesSource, 'PosnicPro.quotes = {'); + + +test('moving between quotes does not re-enter the page', () => { + const body = blockAt(quotesNamespace, 'showDetails: function (id) {'); + const guard = blockAt(body, 'if (!PosnicPro.quotes._inSplit()) {'); + + // the page-entry ritual lives INSIDE the guard, nowhere else. Count the + // call itself - the comment above it names .page_loader too. + const teardown = "$('.page_loader,#osk-container').hide()"; + assert.ok( + guard.includes(teardown), + 'the page teardown must sit inside the already-on-page guard', + ); + assert.strictEqual( + body.split(teardown).length - 1, + 1, + 'the page teardown appears twice - one of them escapes the guard', + ); + assert.ok( + guard.includes("$('#quotes_edit_card').hide()"), + 'hiding the editor belongs to page entry', + ); +}); + +test('but the highlight still moves on every click', () => { + const body = blockAt(quotesNamespace, 'showDetails: function (id) {'); + const guard = blockAt(body, 'if (!PosnicPro.quotes._inSplit()) {'); + assert.ok(body.includes('is-active'), 'the clicked row must be marked'); + assert.ok( + !guard.includes('is-active'), + 'the highlight is inside the guard, so it would only move on page entry', + ); + assert.ok( + body.indexOf('is-active') > body.indexOf(guard) + guard.length - 1, + 'the highlight must be applied after the guard block, on every call', + ); +}); + +test('the fast path requires a document open and the editor closed', () => { + const fn = blockAt(quotesNamespace, '_inSplit: function () {'); + /* quotes-split stays the name asked for here on purpose: this is quotes + deciding whether ITS split is on, not a question about the pattern. */ + for (const required of ['#quotes_new', '#quotes_view_card', '#quotes_edit_card', 'quotes-split']) { + assert.ok(fn.includes(required), `_inSplit must consider ${required}`); + } + // the editor check is a negative one - it must NOT be visible + assert.match( + fn, + /!\$\('#quotes_edit_card'\)\.is\(':visible'\)/, + 'a click while the editor is open must fall through to full page entry', + ); +}); + +test('the editor leaves the joined surface', () => { + const shell = blockAt(quotesNamespace, '_edShell: function () {'); + /* Which CLASSES come off, not the exact string they are written in. The + pattern class was added beside the quotes one during the extraction, and + an assertion pinned to the literal argument failed for a change that made + it more correct. */ + const removed = shell.match(/removeClass\('([^']*rail-collapsed[^']*)'\)/); + assert.ok(removed, 'the editor no longer switches the split off at all'); + for (const cls of ['master-detail', 'rail-collapsed']) { + assert.ok( + removed[1].split(/\s+/).includes(cls), + `the editor leaves ${cls} on, so it is laid out as a rail sibling`, + ); + } +}); + +test('the pager always says something, even on a single page', () => { + const render = blockAt(quotesNamespace, 'renderList: function () {'); + const pager = render.slice(render.indexOf('var label;')); + assert.ok(pager, 'no pager is rendered at all'); + assert.ok( + /total \+ ' ' \+ \(total === 1 \?[^:]+'quote'[^:]+:[^)]+'quotes'/.test(pager), + 'a measured total must be shown as a count', + ); + /* The property is "it always renders something", not "no if statement + appears nearby". The previous version matched any `if (pages > 1)` + anywhere before the markup, so decorating the LABEL with a page number + tripped it - a test failing on correct code, which is how tests get + deleted rather than fixed. */ + assert.match(render, /html \+= '<div class="q-pager">'/, 'the pager must always be emitted'); + assert.match(render, /label = /, 'and it must always have something to say'); + assert.ok( + render.includes('} else {'), + 'both the measured and unmeasured paths must set a label', + ); +}); + +/* + * The pager may only state what was measured. + * + * A text search deliberately skips countDocuments - running an unanchored + * regex across every row twice per keystroke is what makes a list feel slow. + * So on that path there is no total and no page count, and inventing one would + * be a pager that lies. It shows the range on screen and a working Next + * instead, because "is there more" is the only question the total answered. + */ +test('with no measured total the pager shows a range, not a made-up count', () => { + const render = blockAt(quotesNamespace, 'renderList: function () {'); + assert.match(render, /typeof meta\.total === 'number'/, 'a missing total must be detected'); + assert.match(render, /'Showing '/, 'it should fall back to the range on screen'); + assert.ok( + !/total \|\| rows\.length/.test(render), + 'defaulting the total to the page size invents a number that is simply wrong', + ); +}); + +test('Next is driven by hasMore, so it works without a page count', () => { + const render = blockAt(quotesNamespace, 'renderList: function () {'); + assert.match(render, /meta\.hasMore/, 'the server says whether another page exists'); + assert.match( + render, + /arrow\(cur \+ 1, '»', !hasMore\)/, + 'Next must be enabled by hasMore rather than by comparing against pages', + ); +}); + +test('the two panes read as one surface, not two cards', () => { + const split = ruleFor('MD:surface').body; + assert.match(split, /gap:\s*0/, 'a gap between the panes is the thing being removed'); + assert.match(split, /border:\s*1px/, 'the outer border belongs to the split itself'); + assert.match(split, /align-items:\s*stretch/, 'the divider must run the full height'); + + const panes = ruleFor('MD:panes-plain').body; + assert.match(panes, /border:\s*0/, 'the panes must give up their own borders'); + assert.match(panes, /box-shadow:\s*none/, 'two shadows would redraw the seam'); + + // and the panes must beat the theme, which sets .card borders !important + assert.match(panes, /border:\s*0\s*!important/, 'a plain rule loses to the theme'); + assert.match(panes, /margin:\s*0\s*!important/, 'a stray card margin is the gap'); + + // NO divider: the owner counted the borders, so the change of ground does it + /* two rules share this selector - the main one and the >=1500px override - + so anchor on the comment that sits above the main one */ + const rail = ruleFor('MD:rail').body; + assert.ok( + !/border-right:\s*1px/.test(rail), + 'the list must not draw a right border - that line is what breaks the join', + ); + assert.match(rail, /background:\s*#f6f8fa/i, 'the list is the recessed side'); + + // and it must not butt into the breadcrumb bar above it + assert.match(split, /margin:\s*20px\s+30px/, 'the split needs a top gap and page gutters'); +}); + +test('each pane scrolls itself, so neither drags the other out of reach', () => { + const rows = ruleFor('MD:rail-scroller').body; + assert.match(rows, /overflow-y:\s*auto/); + // without min-height:0 a flex child refuses to shrink and the scrollbar + // lands on the page instead of inside the rail + assert.match(rows, /min-height:\s*0/, 'a flex child needs min-height:0 to scroll'); +}); + +test('the open-price checkbox stacks its hint instead of racing it', () => { + const rule = cssRule('#items_new .custom-control.custom-checkbox {'); + assert.ok( + !/display:\s*flex/.test(rule), + 'flex turns the label and its hint into two one-word-wide columns', + ); + assert.match(rule, /min-height:\s*24px/, 'the centring this rule exists for must survive'); +}); + +test('the item form tabs take the width of their words', () => { + const html = fs.readFileSync(path.join(ROOT, 'frontend', 'modules', 'items_write.html'), 'utf8'); + const tabs = html.slice(html.indexOf('id="item_form_tabs"') - 300, html.indexOf('id="item_form_tabs"') + 40); + const ul = tabs.slice(tabs.lastIndexOf('<ul')); + assert.ok( + !/nav-justified/.test(ul), + 'nav-justified gives each tab an equal share of the full page width', + ); + assert.ok(/nav-tabs/.test(ul), 'they are still tabs'); +}); + +/* + * The reading pane, second pass. + * + * The owner's brief: a mail app. The list and the document connect, the + * SELECTED row is the near edge of the document rather than a highlighted + * line in a list, there is no Back (the list never left - there is a Close), + * and the toolbar stops shouting eleven buttons at once. + */ + +const quotesHtml = fs.readFileSync(path.join(ROOT, 'frontend', 'modules', 'quotes.html'), 'utf8'); + +test('the selection is the near edge of the document, not a tinted row', () => { + // the row and its cells are painted together, so the rule is a group + const active = ruleFor('MD:selected-row').body; + // the pane's ground, so the two read as one surface + assert.match( + active, + /background:\s*#fff\s*!important/i, + 'the active row must share the pane background, and beat the global .card rule', + ); + + // The selection is bordered on three sides so it reads clearly, but nothing + // may draw a line down its RIGHT - that is what would cut it off from the + // document beside it. + /* `is-active > td` heads more than one rule - the grouped one that paints + it and the one that borders it - so match by CONTENT: [^}] cannot cross a + closing brace, so this finds the bordering rule rather than whichever + comes first. */ + assert.match( + css, + /is-active > td \{[^}]*border-top:\s*1px solid/, + 'the row needs a visible edge', + ); + assert.match( + css, + /is-active > td \{[^}]*border-bottom:\s*1px solid/, + 'the row needs a visible edge', + ); + assert.match( + css, + /is-active > td:first-child \{[^}]*border-left:\s*3px solid/, + 'the accent edge marks which row is open', + ); + assert.ok( + !/is-active[^{]*\{[^}]*border-right:\s*[1-9]/.test(css), + 'a right border on the selected row would cut it off from the document', + ); + const pane = ruleFor('MD:detail').body; + assert.match(pane, /background:\s*#fff/i, 'the document is the white side of the pair'); +}); + +test('the rail has no side padding, or the selection cannot reach the divider', () => { + const body = ruleFor('MD:rail-body').body; + assert.match(body, /padding:\s*0\s*!important/, 'full-bleed rows are what make the join possible'); +}); + +test('a wide screen shows the whole list AND the quote', () => { + // the columns are hidden by a max-width query now, not unconditionally + const at = css.indexOf('.quotes-split #quotes_list_card .q-col-date'); + assert.notStrictEqual(at, -1); + const before = css.slice(0, at); + const lastMedia = before.lastIndexOf('@media'); + assert.match( + before.slice(lastMedia, lastMedia + 40), + /max-width:\s*1499px/, + 'the columns must only disappear when the rail is actually narrow', + ); +}); + +test('Back is gone; closing is what returns the full list', () => { + const view = blockAt(quotesNamespace, 'showDetails: function (id) {'); + assert.ok(!/← Back/.test(view), 'a reading pane has nothing to go back to'); + assert.ok(quotesHtml.includes('id="quotes_view_close"'), 'there must be a close control'); + const handler = blockAt(salesSource, "$(document).on('click', '#quotes_view_close', function () {"); + assert.ok( + handler.includes('showDataTablePage'), + 'closing must hand the list the full width again', + ); +}); + +test('the toolbar is four controls, with the rest under Share and More', () => { + const view = blockAt(quotesNamespace, 'showDetails: function (id) {'); + const bar = view.slice(view.indexOf('var mi = function'), view.indexOf("$('#quotes_view_actions')")); + + // everything that only sends a copy somewhere is a menu item, not a button + for (const shared of ['Print', 'Download PDF', 'Email', 'WhatsApp', 'Copy link']) { + assert.ok(bar.includes(shared), `${shared} should still be reachable`); + } + const buttons = bar.match(/<button type="button" class="btn btn-sm/g) || []; + assert.ok( + buttons.length <= 5, + `the visible toolbar grew back to ${buttons.length} buttons`, + ); + // green is reserved for "succeeded" now, so no action wears it + assert.strictEqual( + (bar.match(/btn-success/g) || []).length, + 0, + 'an action must not be green - green means an outcome', + ); + assert.ok(bar.includes('Convert to sale'), 'the primary action must still be there'); +}); + +test('destroying a quote is a menu item, never a button next to Print', () => { + const view = blockAt(quotesNamespace, 'showDetails: function (id) {'); + const bar = view.slice(view.indexOf('var mi = function'), view.indexOf("$('#quotes_view_actions')")); + for (const danger of ['Cancel quote', 'Delete quote']) { + const at = bar.indexOf(danger); + assert.notStrictEqual(at, -1, `${danger} disappeared entirely`); + // it is rendered through mi(), the dropdown-item helper + assert.match(bar.slice(Math.max(0, at - 120), at), /mi\('PosnicPro\.quotes\./, `${danger} must be a menu item`); + } +}); + +test('Save changes stays hidden until something is actually edited', () => { + const view = blockAt(quotesNamespace, 'showDetails: function (id) {'); + const at = view.indexOf('id="q_save_edits"'); + assert.notStrictEqual(at, -1, 'the save button is gone'); + assert.match( + view.slice(at, at + 120), + /style="display:none;"/, + 'it must start hidden - an always-lit save button teaches people to ignore it', + ); + const reveal = blockAt(salesSource, "$(document).on('input', '#quotes_view_body .q-edit', function () {"); + assert.ok(reveal.includes("$('#q_save_edits').show()"), 'editing must reveal it'); +}); + +test('New sits in the page header like every other list screen', () => { + assert.ok( + !/New quotation<\/button>/.test(quotesHtml), + 'the green block inside the list is what the owner objected to', + ); + const bar = quotesHtml.slice( + quotesHtml.indexOf('<div class="breadcrumbbar">'), + quotesHtml.indexOf('<div class="contentbar">'), + ); + assert.ok(bar.includes('widgetbar'), 'it belongs in the header widgetbar'); + assert.ok( + bar.includes('btn-primary-rgba'), + 'and takes the same class as Customers and Items, not a one-off green', + ); +}); + +test('the toolbar is pinned so its menus are not clipped', () => { + // a dropdown inside an overflow:auto ancestor gets cut off at its edge + const pane = ruleFor('MD:detail').body; + assert.ok(!/overflow-y:\s*auto/.test(pane), 'the card itself must not be the scroller'); + assert.match(pane, /flex-direction:\s*column/); + const docBody = ruleFor('MD:detail-scroller').body; + assert.match(docBody, /overflow:\s*auto/, 'the document scrolls instead'); +}); + +/* + * Add Item alignment. + * + * The Item card sits at half the page width. Three fields across it left each + * one about 135px, so "In stock (opening)" and the open-price label wrapped + * to two lines while "Selling" stayed on one - and every input beneath them + * started at a different height. Widening the columns is the fix; the label + * rule is the belt to its braces. + */ +test('Add Item fields have room, so their labels do not wrap unevenly', () => { + const html = fs.readFileSync(path.join(ROOT, 'frontend', 'modules', 'items_write.html'), 'utf8'); + const colOf = (fieldId) => { + const at = html.indexOf(`for="${fieldId}"`); + assert.notStrictEqual(at, -1, `${fieldId} not found`); + const before = html.slice(0, at); + const div = before.slice(before.lastIndexOf('<div')); + const m = div.match(/col-md-(\d+)/); + assert.ok(m, `${fieldId} is not in a column`); + return Number(m[1]); + }; + + // the name gets its own line; price and stock pair up beneath it + assert.strictEqual(colOf('items_name'), 12, 'the item name needs the full card width'); + assert.strictEqual(colOf('items_selling_price'), 6); + assert.strictEqual(colOf('items_available_quantity'), 6); + + // Price & Stock is a clean 2x2 rather than four thirds wrapping 3+1 + for (const f of ['items_company_price', 'items_mrp_price', 'items_reorder_point', 'items_unit']) { + assert.strictEqual(colOf(f), 6, `${f} should be half the card`); + } + + // m-t-9 was a one-off nudge that pushed Item Units out of line with its pair + assert.ok(!html.includes('m-t-9'), 'a one-off margin is what breaks a shared baseline'); +}); + +test('and the labels reserve a line so inputs share a baseline', () => { + const rule = cssRule('#items_new .form-row > .form-group > label.form-control-placeholder,'); + assert.match(rule, /min-height:\s*21px/, 'a bare inline label lets its input float up'); + assert.match(rule, /display:\s*block/); +}); + +/* + * "The full row needs to be highlighted, not only the left blue border." + * + * It already was white - but a plain global rule sets .card and .card-body + * background from the theme with !important, which forced the LIST white too. + * A white row on a white list is not a highlight, so all that read was the + * blue edge. The ground has to win first; the row highlight depends on it. + */ +test('the list ground wins against the global card rule', () => { + for (const marker of ['MD:rail', 'MD:rail-body']) { + assert.match( + ruleFor(marker).body, + /background:\s*#f6f8fa\s*!important/i, + `${marker} must beat the global .card background rule, or the list stays white`, + ); + } +}); + +test('the whole row is the highlight, not a mark on its edge', () => { + const cells = ruleFor('MD:selected-row').body; + // every CELL is painted, so the highlight spans the full width + assert.ok( + cells.includes('background'), + 'the cells must be painted or the row highlight stops at the first one', + ); + /* `.is-active > td` appears twice - once in the group that paints it, once + in the rule that emphasises it. [^}] cannot cross a closing brace, so + this matches the emphasis rule rather than the first occurrence. */ + assert.match( + css, + /is-active > td \{[^}]*font-weight:\s*600/, + 'the whole row reads as selected, not one cell', + ); + + // unselected rows must NOT be painted white, or nothing stands out + const others = ruleFor('MD:unselected-row').body; + assert.match(others, /background:\s*transparent/, 'unselected rows sit on the grey'); +}); + +/* + * The bridge (owner ask): black, not blue, and the same line on both sides. + * + * An accent-coloured rule reads as decoration; a plain dark rule reads as + * structure. The selection and the document wear the SAME line so the two + * horizontal borders carry the eye out of the list and around the quote, + * rather than stopping dead at the divider. + */ +test('the selection is drawn in ink, not in the accent colour', () => { + /* `is-active > td` heads two rules - the one that paints the row and the one + that borders it - so pick the block by CONTENT. Matching the first + occurrence lands on the background rule, which has no border at all and + would pass this test for the wrong reason. */ + const blocks = [...css.matchAll(/is-active > td[^{]*\{[^}]*\}/g)].map((m) => m[0]); + const bordered = blocks.filter((b) => /border-top:|border-left:/.test(b)); + assert.ok(bordered.length >= 2, 'expected the border rules for the row and its first cell'); + /* Only the BORDER declarations - the row also sets a near-black text colour, + which is correct and is not what "too rude" was about. */ + const borderLines = bordered + .flatMap((b) => b.split(/\r?\n/)) + .filter((l) => /border(-top|-bottom|-left)?\s*:/.test(l)); + assert.ok(borderLines.length >= 3, 'expected top, bottom and left border declarations'); + + for (const line of borderLines) { + assert.ok( + !/#0969da/i.test(line), + 'an accent-coloured border reads as decoration, not structure', + ); + for (const tooDark of ['#1f2328', '#57606a', '#8c959f', '#afb8c1']) { + assert.ok( + !new RegExp(tooDark, 'i').test(line), + `${tooDark} overshot - the selection needs to be more than its neighbours, not dark`, + ); + } + /* 2026-08-27, the owner again: "instead black border to highlight try + same as github border stuff. same border as rightside border." So the + selection frame is now EXACTLY the split's own #d0d7de - the white + ground and the weight carry the selection; the frame whispers. */ + assert.match(line, /#d0d7de/i, 'the same grey as the split border, nothing darker'); + } +}); + +test('the A4 quote keeps its own paper edge', () => { + /* An earlier round gave the sheet the selection's colour so the two shared + one line. The owner asked for the document design to be left alone, so the + sheet takes no border override at all and keeps .q-sheet's lighter edge - + only the SELECTION is drawn darker. */ + const sheet = cssRule('.quotes-split #quotes_view_card .q-sheet {'); + assert.ok( + !/border-color/.test(sheet), + 'the document should not be restyled to match the list highlight', + ); + assert.match(sheet, /padding:/, 'it still gets its tighter padding inside the split'); +}); + +/* + * Add Item, Details and More tabs (owner queue #32). + * + * "Brand, Tags, this width not required... Browse button too big... images + * unorganised." Three complaints with one cause: the fields run the full + * width of whatever column holds them, so a wide screen gives a 700px box for + * a brand name. A short value does not become easier to type in a wider box, + * and without a consistent right-hand edge the form scans as a spreadsheet. + */ +test('short fields on the Details and More tabs are capped', () => { + const rule = cssRule('#items_new #item_tab_details input.form-control,'); + assert.match(rule, /max-width:\s*420px/, 'a brand name does not need 700px'); +}); + +test('the description keeps more room than the short fields, but not the page', () => { + const desc = cssRule('#items_new #items_description {'); + const m = desc.match(/max-width:\s*(\d+)px/); + assert.ok(m, 'the description needs a cap too'); + assert.ok(Number(m[1]) > 420, 'it holds sentences, so it gets more than a brand name'); + assert.ok(Number(m[1]) <= 800, 'but a text column past ~800px is hard to read back'); + + /* AND it must equal the dropzone's, which sits in the matching column. They + carried 640 and 420, so one filled its column and the other stopped short - + reported as "why each field have different width". Removing both caps makes + them equal and breaks the line-length rule above; matching them keeps both. + This assertion is why that mistake did not ship. */ + const drop = cssRule('#items_new .Neon-theme-dragdropbox'); + const d = drop.match(/max-width:\s*(\d+)px/); + assert.ok(d, 'the dropzone lost its cap - it will not match the description'); + assert.strictEqual( + d[1], + m[1], + 'the description and the dropzone share a row, so they share a width', + ); +}); + +test('the dropzone is one control on a tab, not a landing page', () => { + const heading = cssRule('#items_new .Neon-input-text h3 {'); + const m = heading.match(/font-size:\s*([\d.]+)px/); + assert.ok(m && Number(m[1]) <= 15, 'an h3 caption is what made it read as oversized'); + + const btn = cssRule('#items_new .Neon-input-choose-btn {'); + assert.match(btn, /font-size:/, 'the Browse button needs sizing down with it'); +}); + +test('image previews lay out as a wrapping row rather than however they fall', () => { + const preview = cssRule('#items_new #item-display-preview {'); + assert.match(preview, /display:\s*flex/); + assert.match(preview, /flex-wrap:\s*wrap/); + assert.match(preview, /gap:/, 'thumbnails need space between them to read as separate'); +}); + +/* + * Arriving straight at a quote - refresh, bookmark, shared link. + * + * The URL #/quotes/<id> routes to showDetails, which builds the split and + * fetches the document. It never filled the RAIL: only showDataTablePage + * loaded the list, so a refresh left the quote sitting beside a list that + * still said "Loading quotes ...". Clicking through from the list hid it, + * because by then the rail was already populated. + */ +test('arriving directly at a quote fills the list too', () => { + const view = blockAt(quotesNamespace, 'showDetails: function (id) {'); + const entry = blockAt(view, 'if (!PosnicPro.quotes._inSplit()) {'); + assert.ok( + entry.includes('PosnicPro.quotes.load()'), + 'a refresh onto a quote URL would otherwise show an empty rail', + ); +}); + +test('but moving between quotes does NOT reload the list', () => { + /* The load belongs inside the page-entry branch. Outside it, every row + click would refetch and repaint the rail - which is the flicker the + guard was added to stop in the first place. */ + const view = blockAt(quotesNamespace, 'showDetails: function (id) {'); + const entry = blockAt(view, 'if (!PosnicPro.quotes._inSplit()) {'); + const outside = view.replace(entry, ''); + assert.ok( + !outside.includes('PosnicPro.quotes.load()'), + 'reloading the rail on every row click reintroduces the flicker', + ); +}); + +test('whichever of list and quote lands second places the highlight', () => { + /* They load in parallel on a fresh arrival. renderList marks the row when + the list wins; showDetails must mark it when the quote wins, or a refresh + shows the document with nothing selected beside it. */ + const view = blockAt(quotesNamespace, 'showDetails: function (id) {'); + const afterCurrent = view.slice(view.indexOf('PosnicPro.quotes._current = q;')); + assert.match( + afterCurrent, + /is-active/, + 'the highlight must also be applied once the quote itself arrives', + ); + + const render = blockAt(quotesNamespace, 'renderList: function () {'); + assert.match(render, /is-active/, 'and renderList keeps doing it from _current'); +}); + +/* + * Add Item: capped, but LEFT (owner: "all boxes centered. not good"). + * + * Capping the width is right - a form is read down a column, and a 1900px row + * pushes a label miles from its field. Centring the capped block was not: the + * page title and the tab strip sit hard left, so the cards floated away from + * them and left a dead gutter down the left of the screen. + */ +test('the Add Item tabs are width-capped but stay left-aligned', () => { + const rule = cssRule('#items_new #item_tab_main,'); + assert.match(rule, /max-width:\s*\d+px/, 'a form should not span a 1900px monitor'); + assert.match( + rule, + /margin-left:\s*0/, + 'the cap decides where content ENDS, never where it starts', + ); + assert.ok( + !/margin-left:\s*auto/.test(rule), + 'auto on the left centres the block and abandons the page left edge', + ); +}); + +/* + * Add Item, Item tab: SKU & Barcodes belongs under Price & Stock, on the right + * (owner ask). It used to sit in a full-width row AFTER both columns closed, + * so it fell under the Item card on the left and the right column ended short. + */ +test('SKU & Barcodes sits inside the right column, under Price & Stock', () => { + const html = fs.readFileSync(path.join(ROOT, 'frontend', 'modules', 'items_write.html'), 'utf8'); + const tab = html.slice(html.indexOf('id="item_tab_main"'), html.indexOf('id="item_tab_details"')); + + const sku = tab.indexOf('id="sku_card_col"'); + assert.notStrictEqual(sku, -1, 'the SKU card must still be on this tab'); + assert.ok(tab.indexOf('lang_price_stock_title') < sku, 'it comes after Price & Stock'); + + /* Walk the divs before it and check a col-lg-6 wrapper is still open - + that is what puts it in a COLUMN rather than a full-width row below + both of them. */ + let depth = 0; + const open = []; + for (const m of tab.slice(0, sku).matchAll(/<div\b[^>]*>|<\/div>/g)) { + if (m[0].startsWith('</')) { + if (open.length && open[open.length - 1] === depth) open.pop(); + depth -= 1; + } else { + depth += 1; + if (m[0].includes('col-lg-6')) open.push(depth); + } + } + assert.ok(open.length > 0, 'the SKU card escaped its column and fell full-width again'); +}); + +test('the SKU wrapper keeps the id items.js toggles', () => { + const html = fs.readFileSync(path.join(ROOT, 'frontend', 'modules', 'items_write.html'), 'utf8'); + const js = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'items.js'), + 'utf8', + ); + assert.ok(html.includes('id="sku_card_col"'), 'the id must survive the move'); + assert.ok(js.includes('#sku_card_col'), 'items.js shows/hides it with the variant toggle'); +}); + + +/* + * The filter bar is shared (core/list-filter.js). + * + * It is going on every list - quotes, items, sales, purchases - so it is built + * once and configured per screen. Quotes supplies its fields and what to do on + * change; it owns none of the mechanics. These tests check that boundary + * holds, because the moment a screen reaches past it the next screen copies + * the reach. + */ +const listFilterSrc = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'core', 'list-filter.js'), + 'utf8', +); + +test('the shared bar knows nothing about quotes', () => { + for (const leak of ['quote', 'sales_new', 'item_tab']) { + assert.ok( + !new RegExp(leak, 'i').test(listFilterSrc.replace(/\/\*[\s\S]*?\*\//g, '')), + `the shared component mentions "${leak}" outside a comment - that is a screen leaking in`, + ); + } +}); + +test('it is loaded by the build, after PosnicPro and before the modules', () => { + const manifest = JSON.parse( + fs.readFileSync(path.join(ROOT, 'frontend', 'pages_css_js_map.json'), 'utf8'), + ); + const js = manifest.dashboard.js; + const core = js.findIndex((p) => p.endsWith('core/PosnicPro.js')); + const lf = js.findIndex((p) => p.endsWith('core/list-filter.js')); + const sales = js.findIndex((p) => p.endsWith('modules/js/sales.js')); + assert.ok(lf > core, 'it extends PosnicPro, so it must load after it'); + assert.ok(lf < sales, 'and before the module that mounts it'); +}); + +test('the whole bar lives on the header line, between title and buttons', () => { + const html = fs.readFileSync(path.join(ROOT, 'frontend', 'modules', 'quotes.html'), 'utf8'); + const header = html.slice(html.indexOf('<div class="breadcrumbbar">'), html.indexOf('<div class="contentbar">')); + + assert.ok(header.includes('quotes_filter_btn'), 'the Filter button belongs in the header'); + assert.ok(header.includes('quotes_filter_panel'), 'and so does the panel it opens'); + assert.ok(header.indexOf('quotes_filter_btn') < header.indexOf('quotes/new'), 'Filter before New'); + + // title, then the panel, then the buttons - in that order on one line + assert.ok( + header.indexOf('lang_quotes_title') < header.indexOf('quotes_filter_panel'), + 'the panel goes after the title', + ); + assert.ok( + header.indexOf('quotes_filter_panel') < header.indexOf('quotes_filter_btn'), + 'and before the buttons', + ); + + const panel = html.slice(html.indexOf('id="quotes_filter_panel"')); + assert.match(panel.slice(0, 120), /display:\s*none/, 'a list is for reading - it opens on request'); +}); + +test('the bar renders as ONE row, not stacked rows', () => { + /* Stacked rows in a page header push it open and misalign against the title + on one side and the buttons on the other - which is exactly how it looked. */ + const rows = (listFilterSrc.match(/<div class="lf-row">/g) || []).length; + assert.strictEqual(rows, 1, `the bar emits ${rows} rows; it must be a single strip`); +}); + +test('suggestions are not gated on which field is selected', () => { + /* Gating on field === customer was wrong twice: searching "All fields" for a + customer is exactly when the suggestion helps, and with All selected - the + default - typing hid the list that had just appeared on focus. */ + assert.ok( + !/cfg\.typeahead !== 'customer'/.test(listFilterSrc), + 'the per-field gate is what stopped typing from working', + ); + assert.ok( + !/state\.field !== '[a-z_]+'/.test(listFilterSrc), + 'a per-field gate is back - typing with "All fields" would hide the list again', + ); + assert.match( + listFilterSrc, + /var entity = m\.cfg\.typeahead;\s+var e = entity && LF\.ENTITIES\[entity\];/, + 'the gate must be the panel-level entity, not the selected field', + ); + assert.match(listFilterSrc, /typeaheadField/, 'and picking a name narrows the field for you'); +}); + +test('quotes takes its filter params from the shared bar, not its own inputs', () => { + const load = blockAt(quotesNamespace, 'load: function (keepPage) {'); + assert.match(load, /PosnicPro\.listFilter\.params\('quotes'\)/, 'it must ask the shared bar'); + for (const gone of ['#quotes_search_field', '#quotes_from', '#quotes_to']) { + assert.ok(!load.includes(gone), `${gone} is a control quotes no longer owns`); + } +}); + +test('the date presets are the ones people actually pick', () => { + for (const p of ['today', 'yesterday', 'week', 'month', 'year', 'last7', 'last30', 'custom']) { + assert.ok(new RegExp(`key: '${p}'`).test(listFilterSrc), `${p} preset missing`); + } +}); + +test('presets carry a time, not a bare date', () => { + /* "Today" on a till means since midnight in the shop's own timezone. Sending + a bare date makes the server guess, and the guess is wrong for any shop + that trades past midnight. */ + assert.match(listFilterSrc, /setHours\(0, 0, 0, 0\)/, 'the range must start at midnight'); + assert.match(listFilterSrc, /setHours\(23, 59, 59, 999\)/, 'and end at the end of the day'); + assert.match(listFilterSrc, /toISOString\(\)/, 'and travel as an instant'); +}); + +test('the typeahead uses the cached recents, not a query per keystroke', () => { + assert.match(listFilterSrc, /_recentGet\(key\)/, 'recents come from local storage'); + assert.match(listFilterSrc, /recents\('recent_customers'\)/, 'customers read the recents the sale screen keeps'); + assert.match(listFilterSrc, /_customerSeed/, 'and the session seed already fetched for the sale screen'); + /* The whole point: no network call anywhere in the suggestion path. */ + const suggest = blockAt(listFilterSrc, 'LF.suggest = function (entity, term) {'); + assert.ok(!/ajax|\$\.get|\$\.post/.test(suggest), 'a query per keystroke is exactly what this replaced'); +}); + +test('the Filter button shows how many filters are on', () => { + /* A closed panel is otherwise where filters hide: someone narrows to one + customer, forgets, and reports the list as broken. */ + assert.match(listFilterSrc, /lf-count/, 'the button needs a count badge'); + assert.match(listFilterSrc, /activeCount/, 'and something to count'); +}); + +/* + * Search-as-you-type, without a query per letter. + * + * Worth being precise about the cost, because the same bar is going on sales + * and items where the row counts are real. On a till the database is local; + * pos.sbala.in is a network hop AND one process serving many shops, so an + * expensive scan there competes with somebody else's request. + */ +test('typing is debounced, so a word is one request and not four', () => { + assert.match(listFilterSrc, /LF\.DEBOUNCE_MS\s*=\s*\d+/, 'the delay must be named, not buried'); + assert.match(listFilterSrc, /setTimeout\(function \(\) \{ LF\._changed\(key\); \}, LF\.DEBOUNCE_MS\)/); + assert.match(listFilterSrc, /clearTimeout/, 'each keystroke must cancel the pending one'); +}); + +test('one character never reaches the server', () => { + /* It matches almost every row: the most expensive query anyone can run and + the least useful answer. Below the minimum the list keeps what it has. */ + assert.match(listFilterSrc, /LF\.MIN_SEARCH\s*=\s*[2-9]/, 'a minimum length must exist'); + assert.match(listFilterSrc, /if \(!LF\.shouldQuery\(term\)\)/, 'and be enforced before the timer'); +}); + +test('but CLEARING the box always reloads', () => { + /* Emptying the search is how you get the whole list back - blocking it on + the same minimum would strand you in a filtered list with no way out. */ + assert.match( + listFilterSrc, + /t\.length === 0 \|\| t\.length >= LF\.MIN_SEARCH/, + 'an empty term must be allowed through', + ); +}); + +test('the typeahead is exempt - it reads cache, not the database', () => { + const handler = listFilterSrc.slice(listFilterSrc.indexOf("on('input', '.lf-q'")); + const body = handler.slice(0, handler.indexOf('});')); + assert.ok( + body.indexOf('LF.typeahead(key, this.value)') < body.indexOf('shouldQuery'), + 'suggestions must update on every keystroke, before the minimum-length gate', + ); +}); + +test('the module still drops out-of-order responses', () => { + /* Debouncing reduces requests; it does not order them. Without this a slow + response for "ac" can land after the one for "acme" and repaint the list + with the wrong rows. */ + const load = blockAt(quotesNamespace, 'load: function (keepPage) {'); + assert.match(load, /var mine = \+\+PosnicPro\.quotes\._seq/, 'each request takes a sequence number'); + assert.match(load, /if \(mine !== PosnicPro\.quotes\._seq\) \{ return; \}/, 'and a stale one returns early'); +}); + +/* + * "Not provided can not preset as address." + * + * A branch record held the literal string "Not provided" where its address + * should be, and the quotation printed it - to the customer. That is worse + * than a blank line: a blank line reads as "not applicable", a placeholder + * reads as "we did not finish filling this in". + * + * The fix lives at the document boundary, not in settings. Settings must keep + * showing the real stored value or nobody can ever correct it. + */ +test('a placeholder never reaches a customer-facing document', () => { + const real = blockAt(quotesNamespace, '_real: function (v) {'); + for (const p of ['not provided', 'n/a', 'nil', 'none', 'null', 'undefined']) { + assert.ok( + real.includes(`'${p}'`), + `"${p}" is not treated as a placeholder - it would print on the quote`, + ); + } + assert.match(real, /\.trim\(\)/, 'a padded placeholder is still a placeholder'); + assert.match(real, /toLowerCase\(\)/, '"Not Provided" must be caught too'); +}); + +test('the on-screen quote omits the line rather than printing a placeholder', () => { + /* q-shop appears twice - the authoring preview and the finished document - + and BOTH printed the placeholder. Check each. */ + const blocks = quotesNamespace + .split("'<div class=\"q-shop\">") + .slice(1) + .map((b) => b.slice(0, b.indexOf('})()') + 4)); + assert.strictEqual(blocks.length, 2, 'a third seller block appeared - it needs the same filter'); + const block = blocks.join('\n'); + assert.ok( + !/branchaddress'\) \|\| ''/.test(block), + 'the address still falls back to the raw stored value - a placeholder prints', + ); + assert.match(block, /var real = PosnicPro\.quotes\._real/, 'the header filters through _real'); + assert.match(block, /if \(addr\) \{/, 'no address means no address line at all'); + assert.match(block, /if \(ph \|\| em\)/, 'no phone and no email means no contact line'); +}); + +test('the PDF filters the same way, and leaves no gap behind', () => { + const s = blockAt(quotesNamespace, '_seller: function () {'); + for (const f of ['address', 'phone', 'email', 'gstin']) { + assert.ok( + s.includes(`${f}: real(PosnicPro.local.get`), + `_seller.${f} is unfiltered - the PDF would print a placeholder`, + ); + } + /* splitTextToSize('') is [''], which prints nothing and still costs 4.3mm. */ + assert.match( + salesSource, + /splitTextToSize\(txt\(seller\.address\), 104\)\.filter\(Boolean\)/, + 'an empty address still reserves a line of header space', + ); +}); + +/* + * "Filter button acts as toggle so, when filter is showing have little design + * different expressing its kind of toggle button." + * + * The panel opens somewhere else in the header, so the button is the only + * thing under the cursor that can report the state it just changed. + */ +test('the Filter button looks pressed while its panel is open', () => { + const toggle = blockAt(listFilterSrc, 'LF.toggle = function (key) {'); + assert.match(toggle, /var opening = !\$panel\.is\(':visible'\)/, 'the state is read before the animation, not after'); + assert.match(toggle, /toggleClass\('lf-btn-open', opening\)/, 'the pressed class is never wired'); + assert.match(toggle, /attr\('aria-expanded'/, 'a screen reader is told nothing'); + + const open = cssRule('.lf-btn-open'); + assert.ok(open, '.lf-btn-open has no styling, so the class changes nothing'); + assert.match(open, /!important/, 'the theme sets button backgrounds with !important - this loses silently'); +}); + +test('paint does not fight the toggle over the button class', () => { + const paint = blockAt(listFilterSrc, 'LF.paintButton = function (key) {'); + assert.ok( + !/lf-btn-open/.test(paint), + 'paintButton touches lf-btn-open - a filter change would close-look the open panel', + ); +}); + +/* + * "filter stuff see conjuste when quote list page." + * + * .contentbar is globally padding-top:0. That read fine when the page header + * was only a title; with the filter strip up there, the list card butts + * straight into it. + */ +test('the quotes list gets air between the header and the card', () => { + /* .quotes-split selectors all begin with this, so anchor past them. */ + const bar = cssRule('#quotes_new .contentbar', 'ends up butted right against it'); + assert.ok(bar, '#quotes_new .contentbar has no rule, so the global 0 still wins'); + assert.match(bar, /padding-top:\s*5px\s*!important/, 'the global .contentbar padding-top:0 is !important'); +}); + +/* + * Every entity the picker offers must have something behind it. + * + * LF.ENTITIES declares customer, item and supplier. A declared entity whose + * source is never written opens an empty popover on every till and reads as a + * broken feature - the same failure as a settings switch nothing consults, and + * one of those shipped and had to be removed this week. So the check is + * mechanical: every recents key the picker READS must be a key something + * WRITES. + */ +test('every recents list the picker reads is one something writes', () => { + const salesJs = salesSource; + const receivingJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'receiving_add.js'), + 'utf8', + ); + const written = new Set( + [...salesJs.matchAll(/_recentPush\('([a-z_]+)'/g), ...receivingJs.matchAll(/_recentPush\('([a-z_]+)'/g)].map( + (m) => m[1], + ), + ); + const read = [...listFilterSrc.matchAll(/recents\('([a-z_]+)'\)/g)].map((m) => m[1]); + + assert.ok(read.length >= 3, 'the picker should read a list per entity'); + for (const key of read) { + assert.ok( + written.has(key), + `the picker reads ${key} but nothing writes it - that entity opens empty`, + ); + } +}); + +test('a recent row only shows fields the writer actually stores', () => { + /* recent_items carries {id, name, price, image}. Reading sku or barcode off + it renders a blank note on every row. */ + const entities = blockAt(listFilterSrc, 'LF.ENTITIES = {'); + assert.ok(!/i\.sku/.test(entities), 'recent items have no sku - that note is always blank'); + assert.match(entities, /note: i\.price/, 'price is what a recent item actually carries'); +}); + +/* + * The status chips are a filter, so the bar has to know about them. + * + * They sit outside the panel and used to be a variable of their own. That gave + * a Filter button reading "0 filters" while the list was filtered to Accepted - + * exactly the forgotten filter the count exists to catch - and a Clear that + * emptied the panel while the chip kept filtering. + */ +test('a status chip counts as a filter', () => { + const setExtra = blockAt(listFilterSrc, 'LF.setExtra = function (key, name, value) {'); + assert.match(setExtra, /m\.state\.extra\[name\] = value/, 'the value must land in the counted state'); + assert.match(setExtra, /delete m\.state\.extra\[name\]/, 'clearing a chip must remove it, not store ""'); + assert.match(setExtra, /LF\._changed\(key\)/, 'the button must repaint and the list reload'); + assert.match(setExtra, /if \(!m\) return false/, 'the bar mounts lazily - setting before that must not throw'); + + /* The iteration itself, not just a mention of st.extra: replacing the source + list with [] leaves `st.extra[k]` in the loop body, so a looser assertion + passes over a count that has stopped counting. */ + const count = blockAt(listFilterSrc, 'activeCount: function (key) {'); + assert.match( + count, + /\(st\.extra \? Object\.keys\(st\.extra\) : \[\]\)\.forEach/, + 'extras must be iterated or the chip is invisible to the button', + ); +}); + +test('quotes stops carrying status itself', () => { + const load = blockAt(quotesNamespace, 'load: function (keepPage) {'); + assert.ok( + !/params\.status = PosnicPro\.quotes\._status/.test(load), + 'two sources for one filter - Clear would empty the bar and leave the list filtered', + ); + assert.match(load, /PosnicPro\.listFilter\.params\('quotes'\)/, 'the bar must be the only source'); +}); + +test('the chips paint from the bar, not from the click', () => { + /* Painting on click means Clear leaves a lit chip over an unfiltered list. */ + const handler = salesSource.slice(salesSource.indexOf("$(document).on('click', '.quotes-chip'")); + const body = handler.slice(0, handler.indexOf('});') + 3); + assert.match(body, /setExtra\('quotes', 'status'/, 'the chip must go through the bar'); + assert.ok(!/addClass\('btn-primary-rgba'\)/.test(body), 'the handler must not paint directly'); + assert.match(salesSource, /_paintChips = function \(status\)/, 'there must be one painter'); + + const mount = salesSource.slice(salesSource.indexOf('PosnicPro.quotes.mountFilters = function')); + assert.match( + mount.slice(0, mount.indexOf('};')), + /_paintChips\(\(state\.extra && state\.extra\.status\) \|\| ''\)/, + 'onChange must repaint the chips from the bar state', + ); +}); + +test('"no results" no longer reads a control that was deleted', () => { + /* #quotes_search stopped existing when the shared bar took over. Reading it + returned '' forever, so anyone whose SEARCH found nothing was told they had + never written a quote. */ + /* stripComments: the comment above the fix NAMES the removed control, which + is the point of the comment - the assertion is about code. */ + const render = stripComments(blockAt(quotesNamespace, 'renderList: function () {')); + assert.ok(!/#quotes_search/.test(render), 'it still reads the removed input'); + assert.match( + render, + /PosnicPro\.listFilter\.activeCount\('quotes'\) > 0/, + 'whether a filter is on is a question only the bar can answer now', + ); +}); + +test('no handler is left bound to the removed search input', () => { + assert.ok( + !/on\('input', '#quotes_search'/.test(salesSource), + 'a handler bound to an element that no longer exists never fires and reads as working code', + ); +}); + +/* + * "Filters not aligned well. Can we make in same line of filter row itself." + * + * The bar sits in the page header between the title and the buttons, so a + * second row does not just look untidy - it pushes the header open and + * misaligns the strip against both. One line is the requirement, not a + * preference, and these pin the two ways it can break. + */ +test('the strip is one line, whatever is selected', () => { + const row = cssRule('.lf-row'); + assert.match(row, /flex-wrap:\s*nowrap/, 'wrap puts a second row inside the page header'); + assert.match(row, /min-width:\s*0/, 'without this a flex child refuses to shrink and overflows'); +}); + +test('running out of room shrinks the search box rather than breaking the line', () => { + /* A fixed min-width on the widest control is what forces the wrap. Shrinking + the search is the least harmful way to run out of room - every other + control has a fixed label to show. */ + const search = cssRule('.lf-search', 'flex-wrap: nowrap'); + assert.match(search, /min-width:\s*0/, 'a floor on the search box forces the wrap it is meant to avoid'); +}); + +test('the custom range opens under the preset instead of sitting on the line', () => { + /* Two datetime-local inputs are ~185px each in Chrome; with "to" between + them that is nearly 400px added to a strip sharing a header row. */ + const custom = cssRule('.lf-custom', 'that is nearly 400px on a strip'); + assert.match(custom, /position:\s*absolute/, 'inline, this is what breaks the single line'); + assert.match(custom, /z-index/, 'a panel with no stacking order renders behind the list'); + assert.match(custom, /background:\s*#fff\s*!important/, 'the theme paints card backgrounds !important'); + + const wrap = cssRule('.lf-preset-wrap'); + assert.match(wrap, /position:\s*relative/, 'without this the panel positions against the page, not the control'); + assert.match( + listFilterSrc, + /<div class="lf-preset-wrap">/, + 'the markup must nest the editor with the control that opens it', + ); +}); + +test('the range popover survives the dark theme', () => { + /* Its light rule carries !important to beat the theme's card background, so + the dark rule must too - otherwise the popover is a white card on a dark + page, which is how the typeahead nearly shipped. */ + /* cssRule returns the BODY, so the selector is checked against the file and + the declaration against the rule it belongs to. */ + assert.match( + css, + /\[data-theme\] \.lf-custom \{/, + 'the range popover is not themed at all - it would be a white card on a dark page', + ); + const dark = cssRule('[data-theme] .lf-typeahead,', 'lf-count'); + assert.match(dark, /background: var\(--theme-card-bg\) !important/, 'a plain rule loses to its own light rule'); + assert.match(dark, /border-color: var\(--theme-border-color\) !important/, 'the border needs it for the same reason'); +}); + +/* + * Selectors pointing at elements that do not exist. + * + * #quotes_search (fixed above) was one. A sweep with tests/tools/dead-selectors.js + * found two more that could be verified by hand, both leftovers from a UI that + * changed underneath them: + * + * #branch_view - the branch details view became an infobar sidebar, so + * `.modal('show')` on the old id did nothing at all. + * #quote_settings_modal - quotation settings moved into the feature-config + * popup, so `.modal('hide')` after saving closed nothing. + * + * Neither threw, neither logged. That is what makes this class worth a test: + * the code reads as working. + */ +test('no selector targets an element that was removed', () => { + const branchesJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'branches.js'), + 'utf8', + ); + const settingsJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'settings.js'), + 'utf8', + ); + const html = ['modals/branch.html', 'modules/settings_write.html', 'modules/quotes.html'] + .map((f) => fs.readFileSync(path.join(ROOT, 'frontend', ...f.split('/')), 'utf8')) + .join('\n'); + + for (const [id, src, where] of [ + ['branch_view', branchesJs, 'branches.js'], + ['quote_settings_modal', settingsJs, 'settings.js'], + ['quotes_search', salesSource, 'sales.js'], + ]) { + /* includes, not RegExp: the escaping needed to express `$('#id')` as a + pattern is exactly the kind that survives being written wrong. The first + version of this line lost a backslash level, so the pattern compiled to + an end-anchor followed by a group, matched nothing, and passed over both + live bugs. A plain substring cannot be wrong in that direction. */ + const used = stripComments(src).includes(`$('#${id}')`); + const exists = html.includes(`id="${id}"`); + assert.ok( + !used || exists, + `${where} selects #${id}, and no markup defines it - the call does nothing and looks like it works`, + ); + } +}); + +test('the dead-selector sweep is a tool, and it runs', () => { + /* It cannot be a pass/fail gate: ids built by concatenation never appear as a + literal, so it reports them as missing. A guard with a hundred standing + exceptions is one people learn to scroll past. */ + const tool = path.join(ROOT, 'tests', 'tools', 'dead-selectors.js'); + assert.ok(fs.existsSync(tool), 'the sweep tool is referenced but missing'); + const src = fs.readFileSync(tool, 'utf8'); + assert.match(src, /public/, 'built bundles must be skipped - they are the same source concatenated'); + assert.match(src, /Verify each before deleting/, 'the output must say the list needs checking'); +}); + +/* + * Escape closes the picker. + * + * Every other overlay in this app closes on Escape - the modals carry a + * close_on_esc class for it - so a popover that ignores it is the odd one out, + * and pressing Escape is the reflex before reaching for a mouse. + */ +test('Escape dismisses the suggestion list', () => { + const src = stripComments(listFilterSrc); + assert.match(src, /on\('keydown', function \(e\)/, 'nothing listens for Escape at the document level'); + assert.match(src, /e\.key !== 'Escape' && e\.keyCode !== 27/, 'older browsers report keyCode, not key'); + assert.match(src, /\$\('\.lf-typeahead:visible'\)/, 'it must act only when one is actually open'); +}); + +test('Escape does not close everything behind the picker too', () => { + /* Without stopPropagation the same keypress carries on, and dismissing a + suggestion list would also close the panel or modal around it. */ + const src = stripComments(listFilterSrc); + const block = src.slice(src.indexOf("on('keydown', function (e)")); + const body = block.slice(0, block.indexOf('});') + 3); + assert.match(body, /if \(!\$open\.length\) return;[\s\S]*stopPropagation/, 'it must bail BEFORE stopping propagation'); +}); + +test('Escape does not reopen the list it just closed', () => { + /* .lf-q has a delegated focus handler that OPENS the picker. Re-focusing the + input after closing fires it again, so Escape would toggle rather than + dismiss - and the input already has focus, since that is how Escape was + pressed. */ + const src = stripComments(listFilterSrc); + const block = src.slice(src.indexOf("on('keydown', function (e)")); + const body = block.slice(0, block.indexOf('});') + 3); + assert.ok( + !/trigger\('focus'\)/.test(body), + 'refocusing the search box re-fires the focus handler that opens the picker', + ); +}); + +/* + * Arrow keys in the picker. + * + * "I want similar as in sales new" - and the sale screen runs on the + * autocomplete plugin, which moves through its list on the arrow keys. A till + * is operated from the keyboard; a hand-rolled popover that only takes clicks + * is a downgrade wearing the same design. + */ +test('the picker moves on the arrow keys', () => { + const src = stripComments(listFilterSrc); + assert.match(src, /on\('keydown', '\.lf-q'/, 'the search box takes no keys'); + assert.match(src, /e\.key === 'ArrowDown' \|\| e\.keyCode === 40/, 'keyCode is needed for older tills'); + assert.match(src, /e\.key === 'ArrowUp' \|\| e\.keyCode === 38/, 'up must work as well as down'); + assert.match(src, /scrollIntoView/, 'a highlight that scrolls out of view is worse than none'); +}); + +test('the arrows do not move the caret as well', () => { + /* Without preventDefault the caret jumps to either end of the input while the + highlight moves, which reads as the typed text being eaten. */ + const src = stripComments(listFilterSrc); + const block = src.slice(src.indexOf("on('keydown', '.lf-q'")); + const body = block.slice(0, block.indexOf('\n });') + 8); + /* The ARROW branch specifically. There is a second preventDefault in the + Enter branch, so a bare /preventDefault/ passes with the arrow one removed - + which is the mutation this test exists to catch. */ + assert.match( + body, + /e\.preventDefault\(\);\s*var next = down/, + 'the caret would jump to either end while the highlight moves', + ); +}); + +test('Enter with nothing highlighted runs the search instead of guessing', () => { + /* The empty state promises "press Enter to search anyway", and someone typing + a partial name usually means it. Auto-picking the first row would put a + customer on the filter that nobody chose. */ + const src = stripComments(listFilterSrc); + const block = src.slice(src.indexOf("on('keydown', '.lf-q'")); + const body = block.slice(0, block.indexOf('\n });') + 8); + assert.match(body, /if \(i < 0\) return;/, 'Enter must fall through when no row is chosen'); +}); + +test('mouse and keyboard share one highlight', () => { + /* Two treatments would light two rows at once the moment a hand touches the + mouse mid-arrow-key, and Enter takes the one the cursor is NOT on. */ + assert.match( + listFilterSrc, + /on\('mouseenter', '\.lf-pick-row'/, + 'hovering must move the keyboard highlight, not add a second one', + ); + const hover = cssRule('.lf-pick-row:hover,', 'lf-pick-row {'); + assert.ok(hover, 'the hover rule is not grouped with the active one'); + assert.match(listFilterSrc, /addClass\('is-active'\)/, 'nothing ever marks a row active'); + assert.match(css, /\.lf-pick-row\.is-active/, 'the keyboard highlight has no styling at all'); + assert.match(css, /\[data-theme\] \.lf-pick-row\.is-active/, 'and none on a dark theme'); +}); + +/* + * What is TYPED and what is APPLIED are different things. + * + * A term below MIN_SEARCH is deliberately never sent - one character matches + * nearly every row, the most expensive query for the least useful answer. But + * the character is in the input, and state.search follows the input so the box + * renders what was typed. Two live bugs came from not separating them. + */ +test('one typed character does not count as an active filter', () => { + /* The Filter button would say "1 filter" over a list nothing had filtered. */ + const applied = blockAt(listFilterSrc, '_applied: function (st) {'); + assert.match(applied, /MIN_SEARCH \|\| 2/, 'an unset minimum would silently disable search entirely'); + const count = blockAt(listFilterSrc, 'activeCount: function (key) {'); + assert.match( + count, + /if \(PosnicPro\.listFilter\._applied\(st\)\) n\+\+/, + 'counting st.search directly counts a filter that was never applied', + ); +}); + +test('another trigger cannot smuggle a sub-minimum term into the request', () => { + /* Type one letter, then click a status chip: the reload carried "A" along and + applied the search the debounce had just refused to run. */ + const params = blockAt(listFilterSrc, 'params: function (key) {'); + assert.match(params, /var term = PosnicPro\.listFilter\._applied\(st\)/, 'params must ask what is applied'); + assert.ok(!/out\.search = st\.search/.test(params), 'sending the raw typed value is the bug'); +}); + +test('an exact or PICKED match is applied whatever its length', () => { + /* The reason is CORRECTNESS, not cost. Picking a name from the list used to + set exact - until the owner ruled the checkbox must never tick itself + ("exact tick should not ticked by default") - so the picked flag now + carries the same duty: a customer called "K" chosen from the suggestions + must still filter, or a deliberate act does nothing at all. */ + const applied = blockAt(listFilterSrc, '_applied: function (st) {'); + assert.match(applied, /if \(st\.exact \|\| st\._picked\) return t;/, 'a picked short name would be dropped'); + assert.ok( + applied.indexOf('if (st.exact || st._picked) return t;') < applied.indexOf('MIN_SEARCH'), + 'the bypass must come before the length test, or it never runs', + ); + /* and the pick path itself no longer touches the checkbox */ + const pick = blockAt(listFilterSrc, "$(document).on('click', '.lf-pick-row'"); + assert.ok(!/state\.exact = true/.test(pick), 'picking ticks Exact again'); + assert.match(pick, /_picked = true/); +}); + +test('suggestions appear only for the field they suggest for', () => { + /* Owner: "customer typeahead only drop down customer chose and show + customer typeahead." Offering customers under All fields read as the + search guessing, and picking one silently changed the field. */ + const ta = blockAt(listFilterSrc, 'LF.typeahead = function (key, term) {'); + assert.match(ta, /m\.state\.field !== m\.cfg\.typeaheadField/); + /* switching the field re-evaluates the box with the term already typed */ + const fieldChange = blockAt(listFilterSrc, "$(document).on('change', '.lf-field,.lf-exact-cb'"); + assert.match(fieldChange, /LF\.typeahead\(key/); +}); + +test('changing the search field with no term does not reload the list', () => { + /* Field and Exact MODIFY a search rather than being one. With no term in + force params() omits them, so the request would be byte-identical to the + one already on screen - a round trip per dropdown change for a list that + cannot move. */ + const src = stripComments(listFilterSrc); + const at = src.indexOf("on('change', '.lf-field,.lf-exact-cb'"); + assert.notStrictEqual(at, -1, 'the field handler is gone'); + const body = src.slice(at, src.indexOf('\n });', at)); + assert.match(body, /if \(!LF\._applied\(st\)\) \{/, 'it reloads even when nothing is in force'); + assert.match(body, /LF\.paintButton\(key\);/, 'the button must still repaint'); +}); + +test('the skip is decided AFTER the state is updated', () => { + /* Ticking Exact can bring a below-minimum term INTO force, so the very + action that makes a reload necessary is one of the two this guard would + otherwise skip. */ + const src = stripComments(listFilterSrc); + const at = src.indexOf("on('change', '.lf-field,.lf-exact-cb'"); + const body = src.slice(at, src.indexOf('\n });', at)); + assert.ok( + body.indexOf('st.exact =') < body.indexOf('_applied(st)'), + 'checking before the update reads the previous value of exact', + ); +}); + +test('a suggestion named "constructor" is not silently dropped', () => { + /* uniq used a plain object as a set. seen['constructor'] is truthy before + anything is written - as are toString, valueOf and hasOwnProperty - so a + customer or item with one of those names was treated as already seen and + never offered. The failure is invisible: the row simply is not there. */ + const uniq = blockAt(listFilterSrc, 'var uniq = function (rows) {'); + assert.match(uniq, /Object\.create\(null\)/, 'a plain object inherits names that collide'); + assert.ok(!/var seen = \{\}/.test(uniq), 'the bare-object set is back'); +}); + +/* + * Mounting the bar twice must not discard what someone typed. + * + * The first version replaced the mount record wholesale, so a second mount + * cleared the search, the dates and the status chips while the LIST still + * showed filtered results - the bar and the list disagreeing, which is the + * failure this shared component exists to stop happening on five screens. + */ +test('re-mounting keeps the state', () => { + const fn = blockAt(listFilterSrc, 'LF.mount = function (cfg) {'); + assert.match( + fn, + /if \(existing && existing\.cfg\.container === cfg\.container\)/, + 'a second mount wipes the state', + ); + assert.match(fn, /existing\.cfg = cfg;/, 'a screen that adds a field on re-mount must see it'); + assert.ok( + fn.indexOf('return existing;') < fn.indexOf('LF._mounted[key] = {'), + 'the re-mount path must return before the reset', + ); +}); + +test('a different container is a real re-mount, and resets', () => { + /* Re-parenting the bar is not a repeat - carrying old state into a different + panel would show filters belonging to another screen. */ + const fn = blockAt(listFilterSrc, 'LF.mount = function (cfg) {'); + assert.match(fn, /LF\._mounted\[key\] = \{/, 'nothing ever resets'); + assert.match(fn, /search: '', field: 'all'/, 'the fresh state is gone'); +}); + +test('idempotence belongs to the component, not the screen', () => { + /* Quotes guards with its own _filterMounted flag. That is fine, but every + screen adopting the bar would need the same flag and the first to forget + gets a bug that only appears on page re-entry. */ + const fn = blockAt(listFilterSrc, 'LF.mount = function (cfg) {'); + /* stripComments: the comment in LF.mount NAMES the screen-side flag to + explain why the component now guards itself. The assertion is about code. */ + assert.ok( + !/_filterMounted/.test(stripComments(listFilterSrc)), + 'the component must not depend on a flag the screen owns', + ); + assert.ok(fn.includes('var existing = LF._mounted[key];'), 'the component does not check itself'); +}); + +/* + * An inverted custom range cannot be entered. + * + * "To" before "from" matches nothing, and the list then says "no quotes match + * this search" - true and useless, because the search is not what is wrong. + * min/max on datetime-local is native: no validation UI, and the picker does + * not offer the bad dates at all. + */ +test('the range inputs bound each other', () => { + const src = stripComments(listFilterSrc); + const at = src.indexOf("on('change', '.lf-from,.lf-to'"); + assert.notStrictEqual(at, -1, 'the date handler is gone'); + const body = src.slice(at, src.indexOf('\n });', at)); + assert.match(body, /\$to\.attr\('min', from \|\| null\)/, 'the end can still precede the start'); + assert.match(body, /\$from\.attr\('max', to \|\| null\)/, 'the start can still follow the end'); +}); + +test('clearing one end releases the other', () => { + /* `|| null` removes the attribute rather than setting it to "". A stale bound + traps someone who picked the wrong end first, and the only way out would be + Clear. */ + const src = stripComments(listFilterSrc); + const at = src.indexOf("on('change', '.lf-from,.lf-to'"); + const body = src.slice(at, src.indexOf('\n });', at)); + assert.ok(!/attr\('min', from\)/.test(body), 'an empty value would be set as a bound, not removed'); + assert.ok(!/attr\('max', to\)/.test(body), 'same for the other end'); +}); + +test('the bound exists on the first edit, not only after a change', () => { + /* Selecting "Custom range" carries the previous preset's dates into the + inputs. Without bounds at render time, the very first edit could invert. */ + const render = blockAt(listFilterSrc, 'LF.render = function (key) {'); + assert.match(render, /st\.to \? ' max="' \+ forInput\(st\.to\)/, 'the start input renders unbounded'); + assert.match(render, /st\.from \? ' min="' \+ forInput\(st\.from\)/, 'the end input renders unbounded'); +}); + +test('no CSS rule styles the search input that was removed', () => { + /* #quotes_search stopped existing when the shared filter bar took over. The + JS reading it was removed earlier today; the CSS sizing it survived. A dead + rule is quieter than a dead selector - it costs nothing at runtime - but it + is the same lie: it reads as "the rail sizes its search box" and there has + been no search box in the rail for some time. */ + assert.ok( + !/#quotes_search/.test(css), + 'a stylesheet rule still targets the removed search input', + ); +}); +/* + * The extraction itself. + * + * Everything above checks the pattern still LOOKS right. This checks it is + * actually reusable: a rule that behaves correctly while still naming + * #quotes_list_card is a pattern in name only, and the next screen to adopt it + * would quietly get nothing. + */ +test('the pattern rules name the pattern, not quotes', () => { + const GENERIC = [ + 'MD:surface', 'MD:panes-plain', 'MD:rail', 'MD:rail-body', 'MD:rail-scroller', + 'MD:detail', 'MD:detail-body', 'MD:detail-scroller', 'MD:selected-row', + 'MD:unselected-row', + ]; + for (const marker of GENERIC) { + const { selector } = ruleFor(marker); + assert.ok( + !/quotes/i.test(selector), + `${marker} still names quotes (${selector.trim()}) - another list cannot use it`, + ); + assert.match( + selector, + /master-detail|md-/, + `${marker} is on neither the pattern container nor a pattern part: ${selector.trim()}`, + ); + } +}); + +test('quotes still carries the classes the pattern styles', () => { + /* The other half: generic CSS with nothing wearing the classes styles + nothing at all, and every assertion above would still pass. */ + const markup = fs.readFileSync( + path.join(ROOT, 'frontend', 'modules', 'quotes.html'), + 'utf8', + ); + for (const cls of ['md-rail', 'md-rail-rows', 'md-detail', 'md-detail-head', 'md-detail-body']) { + /* + * A whole space-delimited token, not a word-boundary match. + * + * \b is no use here because '-' is a non-word character: /\bmd-rail\b/ + * happily matches inside "md-rail-rows", so deleting md-rail from the rail + * card left this passing on the strength of a DIFFERENT class. + * + * (\\b, not \b, would have been needed either way - inside a template + * literal the single escape is a backspace character.) + */ + assert.match( + markup, + new RegExp(`class="(?:[^"]*\\s)?${cls}(?:\\s[^"]*)?"`), + `nothing wears ${cls}`, + ); + } + assert.match( + salesSource, + /addClass\('master-detail quotes-split'\)/, + 'the container never gets the pattern class, so none of the pattern applies', + ); + assert.match( + salesSource, + /class="md-row quotes-row/, + 'rail rows never get md-row, so the selection styling applies to nothing', + ); +}); +test('the github theme does not put the panes back in boxes', () => { + /* + * !important is not enough here, and that is the whole point. + * `[data-theme="github"] .card { border: 1px solid !important }` has the SAME + * specificity as the pane rules in custom.css and loads LATER, so it wins the + * tie - and the joined surface comes back as two bordered cards inside a + * third border. + * + * Removing the theme border instead fixes this screen and strips every card + * in the product. That was tried and reverted ("other pages also removed"), + * so the exemption names the panes rather than deleting the rule. + */ + const theme = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'style', 'css', 'theme-variables.css'), + 'utf8', + ); + + /* The border must still exist for every other card. */ + assert.match( + theme, + /\[data-theme="github"\] \.card \{[^}]*border: 1px solid/, + 'the github card border is gone again - that strips every card in the product', + ); + + /* And the panes must be exempted by name. */ + const at = theme.indexOf('[data-theme="github"] .master-detail > .md-rail,'); + assert.notStrictEqual(at, -1, 'the panes are not exempted, so the theme re-boxes them'); + const rule = theme.slice(at, theme.indexOf('}', at)); + assert.match(rule, /border: 0 !important/, 'the exemption does not remove the border'); + assert.match(rule, /border-radius: 0 !important/, 'the panes keep rounded corners inside a square border'); + + /* Order matters: the radius rules share this specificity, so an exemption + placed before them loses the tie it was written to win. */ + const radiusAt = theme.indexOf('.card > .card-body:first-child { border-top-left-radius'); + assert.ok( + radiusAt !== -1 && at > radiusAt, + 'the exemption sits BEFORE the radius rules - equal specificity means the later one wins', + ); +}); diff --git a/tests/readme-claims.test.js b/tests/readme-claims.test.js index efb17b93d..2a4a7ba8d 100644 --- a/tests/readme-claims.test.js +++ b/tests/readme-claims.test.js @@ -22,6 +22,7 @@ const path = require('node:path'); const ROOT = path.join(__dirname, '..'); const README = fs.readFileSync(path.join(ROOT, 'README.md'), 'utf8'); +const LICENCE_BADGE = 'source%20licence'; function badge(label) { const m = README.match( @@ -59,7 +60,14 @@ test('the build badge points at the workflow that gates main', () => { test('every badge that states a number is checked by this file', () => { /* So a new hardcoded claim cannot arrive unnoticed. If this fails, either derive the number above or make the badge live. */ - const KNOWN = ['REST%20API', 'tests', 'coverage', 'licence', 'platforms']; + const KNOWN = [ + 'REST%20API', + 'tests', + 'coverage', + LICENCE_BADGE, + 'package%20notices', + 'platforms', + ]; const numeric = [...README.matchAll(/img\.shields\.io\/badge\/([^-]+)-/g)] .map((m) => m[1]); @@ -70,9 +78,9 @@ test('every badge that states a number is checked by this file', () => { } }); -test('the licence badge matches what package.json declares', () => { +test('the source licence badge matches what package.json declares', () => { const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')); - const claimed = (badge('licence') || '').replace(/--/g, '-'); + const claimed = (badge(LICENCE_BADGE) || '').replace(/--/g, '-'); /* The badge shows the licence's name, package.json carries its SPDX identifier, and SPDX appends -only or -or-later to say whether later @@ -84,7 +92,7 @@ test('the licence badge matches what package.json declares', () => { `README says ${claimed}; package.json says ${pkg.license}`); }); -test('the licence the badge names is the licence in the file', () => { +test('the source licence the badge names is the licence in the file', () => { const licence = fs.readFileSync(path.join(ROOT, 'LICENSE'), 'utf8'); assert.match(licence, /GNU AFFERO GENERAL PUBLIC LICENSE/, 'LICENSE is not the AGPL the badge and package.json claim'); @@ -184,7 +192,7 @@ test('the docs describe the commands that exist', () => { } }); -test('every package points at this repository', () => { +test('every package points support and source at this repository', () => { /* frontend/package.json pointed at Posnic/posnicpro, a repository this is not, so "report a bug" on npm metadata sent people somewhere else. The other two had no repository, bugs or homepage at all. */ @@ -195,12 +203,33 @@ test('every package points at this repository', () => { fs.readFileSync(path.join(ROOT, dir, 'package.json'), 'utf8')); const where = dir === '.' ? 'root' : dir; - for (const field of ['repository', 'bugs', 'homepage']) { + for (const field of ['repository', 'bugs']) { assert.ok(pkg[field], `${where}/package.json has no ${field}`); const value = typeof pkg[field] === 'string' ? pkg[field] : pkg[field].url; assert.ok(value.includes(REPO), `${where}/package.json ${field} points at ${value}, not this repository`); } + + assert.ok(pkg.homepage, `${where}/package.json has no homepage`); + } +}); + +test('the product package uses the canonical product homepage', () => { + const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')); + assert.equal(pkg.homepage, 'https://posnic.io/'); +}); + +test('every locked sharp copy includes the symlink-validation fix', () => { + const lock = JSON.parse( + fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8')); + const sharpCopies = Object.entries(lock.packages) + .filter(([where]) => /(?:^|\/)node_modules\/sharp$/.test(where)); + + assert.ok(sharpCopies.length > 0, 'package-lock.json has no sharp package'); + for (const [where, pkg] of sharpCopies) { + const [major, minor] = pkg.version.split('.').map(Number); + assert.ok(major > 0 || minor >= 35, + `${where} locks vulnerable sharp ${pkg.version}; require 0.35.0 or later`); } }); @@ -224,3 +253,72 @@ test('line endings and editor settings are declared', () => { assert.match(attrs, /\*\.bat\s+text eol=crlf/, 'Windows batch files need CRLF or they misbehave when run'); }); + +test('a documented command that runs as root points at a file that exists', () => { + /* + * The README and the self-hosting guide tell a stranger to fetch a script + * over the network and run it with sudo. That instruction has to keep + * working, and it is the single worst one to get wrong: a 404 is the good + * outcome, and a rename that leaves the URL resolving to something else is + * the bad one. + * + * Every raw.githubusercontent URL in the docs is checked against the tree + * here, so moving or renaming a script breaks the build rather than the + * instruction. + */ + const docs = ['README.md', 'docs/SELF_HOSTING.md'] + .filter((f) => fs.existsSync(path.join(ROOT, f))); + assert.ok(docs.length, 'neither the README nor the self-hosting guide is present'); + + const missing = []; + const pattern = /raw\.githubusercontent\.com\/Posnic\/POS\/[^/\s]+\/([^\s)"'`]+)/g; + let found = 0; + for (const doc of docs) { + const text = fs.readFileSync(path.join(ROOT, doc), 'utf8'); + for (const m of text.matchAll(pattern)) { + found += 1; + if (!fs.existsSync(path.join(ROOT, m[1]))) missing.push(`${doc} -> ${m[1]}`); + } + } + + assert.ok(found > 0, 'no raw file URL found - has the server install been reworded?'); + assert.deepEqual(missing, [], + 'these URLs name a file that is not in the repository:\n ' + missing.join('\n ')); +}); + +test('the README explains both ways to install, and tells them apart', () => { + /* + * "we provide either offline desktop app or they can install in servers" - + * the two are different enough in what they ask of the shop (somebody has to + * maintain a server) that offering them as one thing sends people to the + * harder answer than the one they need. + */ + assert.match(README, /^### Desktop$/m, 'the README has no desktop install section'); + assert.match(README, /^### Your own server$/m, 'the README has no server install section'); + + const install = README.slice(README.indexOf('\n## Install')); + const desktopAt = install.indexOf('### Desktop'); + const serverAt = install.indexOf('### Your own server'); + assert.ok(desktopAt < serverAt, + 'the server install comes first; most shops want the desktop app'); + + /* The honest parts. Each of these was a deliberate decision, not filler. */ + assert.match(install, /install-server\.sh/, 'the server section names no installer'); + assert.match(install, /SELF_HOSTING\.md/, 'the server section links to no full guide'); + assert.match(install, /27017/, + 'the server section does not warn about exposing the database port'); + assert.match(install, /does not include sync|not include sync/i, + 'the server section does not say that sync is Cloud'); +}); + +test('every relative link in the README points at something', () => { + /* + * A broken link in the first file a stranger reads costs more than the page + * it fails to open: it is the cheapest possible signal that nobody checks. + */ + const broken = []; + for (const m of README.matchAll(/\]\((?!https?:|mailto:|#)([^)#\s]+)/g)) { + if (!fs.existsSync(path.join(ROOT, m[1]))) broken.push(m[1]); + } + assert.deepEqual([...new Set(broken)], [], 'README links to files that do not exist'); +}); diff --git a/tests/recover-access.test.js b/tests/recover-access.test.js new file mode 100644 index 000000000..e63b197a6 --- /dev/null +++ b/tests/recover-access.test.js @@ -0,0 +1,112 @@ +'use strict'; + +/* + * The way back in when nothing else works. + * + * A self-hosted shop, or a till on a network with no way out, cannot use the + * console, cannot receive our reset email and cannot phone support at 6am. Its + * only remedy was a database edit by somebody who knew that this application + * hashes bcrypt over BASE64 of the password rather than over the password. + * + * That detail is the whole risk. Get it wrong and sign-in appears to work, + * because the login falls back to comparing a plain hash - while manager + * approvals, which only ever compare the base64 form, silently stop accepting + * the password. The shop discovers it weeks later as "approvals are broken", + * with nothing connecting the two events. + * + * So the format is asserted here, along with the two things that make this + * defensible rather than a back door: it can only open the database this + * installation already uses, and every use is written to the shop's own log. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const SCRIPT = path.join(__dirname, '..', 'scripts', 'recover-access.js'); +const src = fs.readFileSync(SCRIPT, 'utf8'); + +test('the password is hashed base64-first, the way login checks it', () => { + assert.match(src, /Buffer\.from\(passwordArg\)\.toString\('base64'\)/, + 'the password is not base64 encoded before hashing - approvals will reject it'); + assert.match(src, /bcrypt\.hashSync\(encoded, 12\)/, + 'the hash is not taken over the encoded form'); + + /* And never over the raw password, which is the mistake being guarded + against: it would sign in fine and break approvals. */ + assert.ok(!/hashSync\(passwordArg/.test(src), + 'the raw password is hashed somewhere - that is the failure this exists to prevent'); +}); + +test('it proves the new password before saying it worked', () => { + /* + * A recovery tool that reports success without checking is worse than none: + * the person walks away and the shop is still locked out. + */ + assert.match(src, /bcrypt\.compareSync\(encoded, after\.password\)/, + 'the result is never verified against what was stored'); + assert.match(src, /did not verify/, + 'a failed verification is not reported to the person running it'); +}); + +test('every use is written to the shop own audit log', () => { + assert.match(src, /collection\('audit_log'\)\.insertOne/, 'no audit entry is written'); + assert.match(src, /source: 'local_recovery'/, 'the entry does not say how it happened'); + assert.match(src, /os\.userInfo\(\)\.username/, + 'the entry does not record which operating-system account did it'); + + /* The password must not be in the log. An audit trail is read by more people + than the thing it audits. */ + const entry = /collection\('audit_log'\)\.insertOne\(\{[\s\S]*?\}\)/.exec(src); + assert.ok(entry, 'the audit call was not found'); + assert.ok(!/passwordArg|hash|encoded/.test(entry[0]), + 'the audit entry carries the password or its hash'); +}); + +test('it can only open the database this installation already uses', () => { + /* + * No --uri flag, no environment override. A recovery tool that can be + * pointed elsewhere is one that can quietly repair the wrong shop, and it + * would also turn a local utility into a remote one. + */ + assert.match(src, /path\.join\(ROOT, 'api', '\.env'\)/, + 'the connection string does not come from this installation'); + assert.match(src, /const uri = env\.MONGODB_URI;/, + 'the connection string does not come from the installation env file'); + + /* Only two positional arguments are read, and neither is a database. A + loose "does argv appear near uri" check passed by accident here - argv is + read three lines above where the env is opened - so this names the flags + instead. */ + assert.match(src, /const \[emailArg, passwordArg\] = process\.argv\.slice\(2\);/, + 'the argument list is not the expected two positional values'); + for (const flag of ['--uri', '--db', '--database', '--host']) { + assert.ok(!src.includes(flag), `${flag} can point this at another database`); + } +}); + +test('a short password is refused', () => { + assert.match(src, /passwordArg\.length < 8/, + 'any password is accepted, including one somebody will write on the till'); +}); + +test('listing users shows when each password last changed', () => { + /* + * The field that answers "it worked yesterday". Establishing it during a + * real lockout took an ssh session and a bcrypt comparison run by hand. + */ + assert.match(src, /password never changed/, + 'the listing does not distinguish a password that has never been changed'); +}); + +test('it is reachable as a documented command', () => { + const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')); + assert.equal(pkg.scripts.recover, 'node scripts/recover-access.js', + 'npm run recover does not exist, so this is a secret technique again'); + + const doc = fs.readFileSync( + path.join(__dirname, '..', 'docs', 'SELF_HOSTING.md'), 'utf8'); + assert.match(doc, /recover-access|npm run recover/, + 'the self-hosting guide does not mention how to get back in'); +}); diff --git a/tests/reference-geography-data.test.js b/tests/reference-geography-data.test.js new file mode 100644 index 000000000..755cd27fa --- /dev/null +++ b/tests/reference-geography-data.test.js @@ -0,0 +1,31 @@ +const test = require('node:test'); +const assert = require('node:assert/strict'); +const fs = require('node:fs'); +const path = require('node:path'); + +const root = path.resolve(__dirname, '..'); +const apiPath = path.join(root, 'api', 'src', 'json', 'states.json'); +const frontendPath = path.join(root, 'frontend', 'static', 'json', 'states.json'); + +function readCatalog(filePath) { + return JSON.parse(fs.readFileSync(filePath, 'utf8')).states; +} + +test('API and frontend state catalogs stay synchronized', () => { + assert.deepStrictEqual(readCatalog(apiPath), readCatalog(frontendPath)); +}); + +test('state names contain no common UTF-8 mojibake markers', () => { + const mojibakeMarkers = /[\u00c2\u00c3\u00e2\u00f0\ufffd]/u; + + for (const state of readCatalog(apiPath)) { + assert.doesNotMatch(state.name, mojibakeMarkers, `corrupted state name for id ${state.id}`); + } +}); + +test('Ostfold keeps its correct display name', () => { + const ostfold = readCatalog(apiPath).find((state) => state.id === '2712'); + + assert.ok(ostfold, 'state id 2712 should exist'); + assert.equal(ostfold.name, '\u00d8stfold'); +}); diff --git a/tests/release-manifest.test.js b/tests/release-manifest.test.js index 6fef9b54f..eada87343 100644 --- a/tests/release-manifest.test.js +++ b/tests/release-manifest.test.js @@ -92,7 +92,7 @@ test('whether a release is offered to installed copies is a decision, not a cons test('the updater still refuses pre-releases', () => { /* If this ever flips, the pre-release flag stops protecting anyone: every beta would be offered to every shop automatically. */ - const service = fs.readFileSync(path.join(ROOT, 'update-service.js'), 'utf8'); + const service = fs.readFileSync(path.join(ROOT, 'src', 'update-service.js'), 'utf8'); assert.match( service, /allowPrerelease\s*=\s*false/, diff --git a/tests/release-sbom.test.js b/tests/release-sbom.test.js new file mode 100644 index 000000000..bfcaedfba --- /dev/null +++ b/tests/release-sbom.test.js @@ -0,0 +1,192 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const os = require('os'); +const path = require('path'); + +const pkg = require('../package.json'); +const { + artifactIdentity, + buildSbom, + discoverArtifacts, + readElectronVersion, + readMongoVersion, +} = require('../scripts/generate-release-sboms'); + +const ROOT = path.join(__dirname, '..'); +const RELEASE_WORKFLOW = fs + .readFileSync(path.join(ROOT, '.github', 'workflows', 'release.yml'), 'utf8') + .replace(/\r\n/g, '\n'); +const COMMIT = '0123456789abcdef0123456789abcdef01234567'; +const API_REF = 'pkg:npm/posnic-api@2.0.0'; +const EXPRESS_REF = 'pkg:npm/express@5.2.1'; +const API_BOM = { + $schema: 'http://cyclonedx.org/schema/bom-1.5.schema.json', + bomFormat: 'CycloneDX', + specVersion: '1.5', + serialNumber: 'urn:uuid:11111111-1111-4111-8111-111111111111', + version: 1, + metadata: { + timestamp: '2026-08-23T00:00:00.000Z', + tools: { components: [{ type: 'application', name: 'npm', version: '11.17.0' }] }, + component: { + type: 'application', + name: 'posnic-api', + version: '2.0.0', + 'bom-ref': API_REF, + purl: API_REF, + licenses: [{ license: { id: 'AGPL-3.0-only' } }], + }, + }, + components: [ + { + type: 'library', + name: 'express', + version: '5.2.1', + 'bom-ref': EXPRESS_REF, + purl: EXPRESS_REF, + licenses: [{ license: { id: 'MIT' } }], + }, + ], + dependencies: [ + { ref: API_REF, dependsOn: [EXPRESS_REF] }, + { ref: EXPRESS_REF, dependsOn: [] }, + ], +}; + +function withTempDir(run) { + const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'posnic-sbom-')); + try { + return run(directory); + } finally { + fs.rmSync(directory, { recursive: true, force: true }); + } +} + +test('artifact identity is explicit for every release format', () => { + assert.deepStrictEqual( + artifactIdentity('Posnic-1.4.0-windows-x64-installer.exe'), + { platform: 'windows', architecture: 'x86_64', format: 'installer' }, + ); + assert.deepStrictEqual( + artifactIdentity('Posnic-1.4.0-macos-arm64.dmg'), + { platform: 'macos', architecture: 'arm64', format: 'disk-image' }, + ); + assert.deepStrictEqual( + artifactIdentity('Posnic-1.4.0-linux-x64.AppImage'), + { platform: 'linux', architecture: 'x86_64', format: 'appimage' }, + ); + assert.deepStrictEqual( + artifactIdentity('posnic_1.4.0_amd64.deb'), + { platform: 'linux', architecture: 'x86_64', format: 'debian-package' }, + ); +}); + +test('artifact discovery ignores updater metadata and generated SBOMs', () => withTempDir((directory) => { + for (const name of [ + 'Posnic-1.4.0-windows-x64-installer.exe', + 'Posnic-1.4.0-macos-arm64.dmg', + 'Posnic-1.4.0-linux-x64.AppImage', + 'latest.yml', + 'installer.exe.blockmap', + 'installer.exe.cdx.json', + ]) fs.writeFileSync(path.join(directory, name), name); + + assert.deepStrictEqual( + discoverArtifacts(directory).map((file) => path.basename(file)), + [ + 'Posnic-1.4.0-linux-x64.AppImage', + 'Posnic-1.4.0-macos-arm64.dmg', + 'Posnic-1.4.0-windows-x64-installer.exe', + ], + ); +})); + +test('the SBOM is deterministic and bound to the exact artifact', () => withTempDir((directory) => { + const artifactPath = path.join(directory, 'Posnic-1.4.0-windows-x64-installer.exe'); + fs.writeFileSync(artifactPath, 'representative release artifact\n'); + const options = { + artifactPath, + apiBom: API_BOM, + rootPackage: pkg, + commit: COMMIT, + mongoVersion: readMongoVersion(), + electronVersion: readElectronVersion(pkg), + }; + const first = buildSbom(options); + const second = buildSbom(options); + + assert.strictEqual(JSON.stringify(first), JSON.stringify(second)); + assert.match(first.serialNumber, /^urn:uuid:[0-9a-f-]{36}$/); + assert.strictEqual(first.metadata.timestamp, undefined); + assert.strictEqual(first.metadata.component.hashes[0].alg, 'SHA-256'); + assert.strictEqual(first.metadata.component.hashes[0].content.length, 64); + assert.strictEqual( + first.metadata.component.properties.find((property) => property.name === 'posnic:source:commit').value, + COMMIT, + ); + assert.match( + first.metadata.component.properties.find((property) => property.name === 'posnic:licensing:scope').value, + /Mixed-license aggregate/, + ); + + const components = new Map(first.components.map((component) => [component['bom-ref'], component])); + assert.ok(components.has(API_REF), 'the packaged API root component was dropped'); + assert.ok(components.has(EXPRESS_REF), 'the API dependency graph was dropped'); + assert.strictEqual( + components.get('pkg:generic/mongodb-community-server@7.0.14').licenses[0].license.id, + 'SSPL-1.0', + ); + assert.strictEqual( + components.get(`pkg:github/Posnic/POS@v${pkg.version}`).licenses[0].license.id, + 'AGPL-3.0-only', + ); + + const rootDependency = first.dependencies.find((dependency) => dependency.ref === first.serialNumber); + assert.ok(rootDependency.dependsOn.includes(API_REF)); + assert.ok(rootDependency.dependsOn.includes('pkg:generic/mongodb-community-server@7.0.14')); +})); + +test('the bundled component versions come from release inputs, not guesses', () => { + assert.strictEqual(readMongoVersion(), '7.0.14'); + assert.match(readElectronVersion(pkg), /^43\./); +}); + +test('license material is readable outside app.asar on every platform', () => { + const expected = new Map([ + ['LICENSE', 'licenses/POSNIC-AGPL-3.0.txt'], + ['THIRD-PARTY-NOTICES.md', 'licenses/THIRD-PARTY-NOTICES.md'], + ['licenses/MONGODB-SSPL-1.0.txt', 'licenses/MONGODB-SSPL-1.0.txt'], + ]); + const resources = new Map(pkg.build.extraResources.map((resource) => [resource.from, resource.to])); + + for (const [source, destination] of expected) { + assert.strictEqual(resources.get(source), destination, `${source} is not package-visible at ${destination}`); + assert.ok(fs.existsSync(path.join(ROOT, source)), `${source} does not exist`); + } + + const mongoLicense = fs.readFileSync(path.join(ROOT, 'licenses/MONGODB-SSPL-1.0.txt'), 'utf8'); + assert.match(mongoLicense, /Server Side Public License/); + assert.match(mongoLicense, /VERSION 1, OCTOBER 16, 2018/); + assert.ok(mongoLicense.length > 30000, 'the exact MongoDB licence text is incomplete'); +}); + +test('the release creates and preserves one SBOM beside each artifact', () => { + const generatedAt = RELEASE_WORKFLOW.indexOf('Generate artifact SBOMs'); + const uploadedAt = RELEASE_WORKFLOW.indexOf('Upload installers'); + assert.ok(generatedAt > -1, 'the release never runs the SBOM generator'); + assert.ok(generatedAt < uploadedAt, 'the release uploads artifacts before it creates their SBOMs'); + + const upload = RELEASE_WORKFLOW.slice(uploadedAt, RELEASE_WORKFLOW.indexOf('retention-days', uploadedAt)); + assert.match(upload, /dist\/\*\.cdx\.json/, 'matrix artifacts drop the generated SBOMs'); + + const collectAt = RELEASE_WORKFLOW.indexOf('Collect and checksum'); + const collect = RELEASE_WORKFLOW.slice(collectAt, RELEASE_WORKFLOW.indexOf('Publishing:', collectAt)); + assert.match(collect, /-name '\*\.cdx\.json'/, 'the publish job drops SBOMs before release'); + assert.match(collect, /sha256sum/, 'release SBOMs are not bound into SHA256SUMS.txt'); + assert.doesNotMatch( + collect, + /grep -vE[^\n]*cdx/, + 'release SBOMs are excluded from SHA256SUMS.txt instead of being integrity protected', + ); +}); diff --git a/tests/release-ship.test.js b/tests/release-ship.test.js new file mode 100644 index 000000000..72501a25b --- /dev/null +++ b/tests/release-ship.test.js @@ -0,0 +1,150 @@ +'use strict'; + +/* + * The one-command release (scripts/release-ship.js). + * + * The whole point of the command is that its ORDER is safe: nothing + * irreversible happens before the things that can fail cheaply, and nothing + * becomes public before every platform is verified present. These tests pin + * that order in the source, the same way the Windows publisher's refusals + * are pinned - because the day this matters is a release day, which is the + * worst possible day to discover a regression. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..'); +const src = fs.readFileSync(path.join(ROOT, 'scripts', 'release-ship.js'), 'utf8'); +const pkg = require('../package.json'); + +test('release:ship is wired', () => { + assert.strictEqual(pkg.scripts['release:ship'], 'node scripts/release-ship.js'); +}); + +test('the version format is gated like the updater parses it', () => { + /* update-service.js reads the version with parseInt; anything but three + plain integers classifies every release as a core update and silently + stops automatic updates. The ship command must refuse at the door. */ + assert.match(src, /\^v\\d\+\\\.\\d\+\\\.\\d\+\$/, 'the vX.Y.Z gate is gone'); +}); + +test('the card is checked before anything irreversible', () => { + /* A missing card reader found AFTER the tag push leaves a half-release on + the public tag list. The preflight must find the certificate before the + first git push. */ + const preflightAt = src.indexOf('find-signing-cert'); + const pushAt = src.indexOf("'push'"); + assert.ok(preflightAt > 0 && pushAt > 0, 'preflight or push missing entirely'); + assert.ok(preflightAt < pushAt, 'the tag is pushed before the card is checked'); +}); + +test('a dirty tree and a wrong branch both refuse', () => { + assert.match(src, /status.*--porcelain/, 'a dirty tree would ship uncommitted code'); + assert.match(src, /!== 'main'/, 'a release could ship from a feature branch'); +}); + +test('publishing happens only after every platform is verified in the draft', () => { + const verifyAt = src.indexOf('missing.map'); + const publishAt = src.indexOf('--draft=false'); + assert.ok(verifyAt > 0 && publishAt > 0, 'verify or publish missing entirely'); + assert.ok(verifyAt < publishAt, 'the draft can go public before the asset check'); + /* And the check itself covers the update manifests, not just installers - + a release with installers but no latest.yml bricks nothing visibly and + updates nothing silently. */ + for (const manifest of ['latest\\.yml', 'latest-mac\\.yml', 'latest-linux\\.yml']) { + assert.ok(src.includes(manifest), manifest + ' is not in the required-asset list'); + } +}); + +test('publish clears the prerelease flag and marks latest', () => { + /* release.yml publishes drafts as prereleases by default (deliberately - + electron-updater ignores prereleases, so betas never reach stable + tills). A STABLE ship must clear that flag or no till ever sees it. */ + assert.match(src, /--prerelease=false/, 'a stable release would stay a prerelease'); + assert.match(src, /--latest/, 'GitHub would keep pointing "latest" at the old release'); +}); + +test('the Windows attach goes through the gated publisher, not a bare upload', () => { + /* scripts/release-windows.js is where signed/timestamped/latest.yml-match + refusals live. Uploading around it would skip every one of them. */ + assert.match(src, /release-windows\.js/, 'the gated Windows publisher is bypassed'); + assert.ok(!/gh releaseupload.*exe/.test(src.replace(/\s+/g, '')), + 'a raw exe upload bypasses the signing gates'); +}); + +test('another version left in dist/ can never ride along', () => { + /* dist/ is where every previous build also landed. Uploading whatever .exe + was lying there would put the LAST version's binaries on the new + version's download page - each file individually valid and signed, so + nothing downstream would catch it. */ + const pub = fs.readFileSync(path.join(ROOT, 'scripts', 'release-windows.js'), 'utf8'); + assert.match(pub, /f\.includes\(version\)/, + 'the publisher no longer filters dist/ down to the tag being released'); + assert.match(pub, /No \$\{version\} installer in dist\//, + 'a dist/ holding only stale builds would report success with nothing uploaded'); + const ship = fs.readFileSync(path.join(ROOT, 'scripts', 'release-ship.js'), 'utf8'); + assert.match(ship, /rmSync/, 'the ship command no longer clears stale installers before building'); +}); + +test('stable tills verify update signatures; betas opt out explicitly', () => { + /* The repo default is the STABLE truth: desk builds are signed, so the + flag rides every stable installer. The beta workflow builds unsigned + test builds and must therefore turn it off for itself - a beta till + that verified would refuse the next unsigned beta and silently stop + updating. */ + assert.strictEqual(pkg.build.win.verifyUpdateCodeSignature, true, + 'stable builds no longer verify the publisher of their own updates'); + const beta = fs.readFileSync(path.join(ROOT, '.github', 'workflows', 'beta.yml'), 'utf8'); + assert.match(beta, /verifyUpdateCodeSignature=false/, + 'beta builds would refuse their own unsigned channel'); + /* And the name the verifier compares against must stay the certificate CN + (windows-code-signing.test.js pins the value; this pins the pairing). */ + assert.strictEqual(pkg.build.win.signtoolOptions.publisherName, 'BillMax'); +}); + +test('a version bump reaches every file that states the version', () => { + /* package.json is not the only file naming the release: codemeta.json says + it twice plus a sentence, CITATION.cff says it again, and the generated + OpenAPI spec carries it. Three tests assert they agree and CI regenerates + the docs and fails on any diff - so bumping one file pushes a tag that CI + refuses a minute later. That is not theory: it is what the first real run + of release:ship did. */ + const sync = fs.readFileSync(path.join(ROOT, 'scripts', 'sync-version.js'), 'utf8'); + for (const f of ['codemeta.json', 'CITATION.cff', 'api/package.json']) { + assert.ok(sync.includes(f), `sync-version.js no longer updates ${f}`); + } + assert.match(sync, /softwareVersion/, 'codemeta states the version twice; one is missed'); + assert.match(sync, /docs:api/, 'the OpenAPI spec is not regenerated, so CI will reject the tag'); + + const ship = fs.readFileSync(path.join(ROOT, 'scripts', 'release-ship.js'), 'utf8'); + const syncAt = ship.indexOf('sync-version.js'); + const commitAt = ship.indexOf("'commit'"); + assert.ok(syncAt > 0, 'the ship command bumps package.json alone again'); + assert.ok(syncAt < commitAt, 'the sync runs after the commit, so the tag misses it'); +}); + +test('every version-bearing file agrees right now', () => { + /* The check mode, run as a test: this is the assertion CI makes from three + directions, caught here in one. */ + const { execFileSync } = require('child_process'); + execFileSync('node', [path.join(ROOT, 'scripts', 'sync-version.js'), '--check'], + { cwd: ROOT, stdio: 'pipe' }); +}); + +test('the snap reaches the release it is built for', () => { + /* package.json declares a snap target, so every Linux run builds + posnic_<v>_amd64.snap - and both the artifact upload and the release + collection filtered it out. publish-snap.yml then failed on every + release downloading a .snap that was never attached: a red X beside a + store that was quietly never updated, with the credentials configured + the whole time. Found on v1.6.1, which is exactly how it had gone + unnoticed - the release itself succeeds. */ + const wf = fs.readFileSync(path.join(ROOT, '.github', 'workflows', 'release.yml'), 'utf8'); + assert.match(wf, /dist\/\*\.snap/, 'the Linux job no longer uploads the snap it built'); + assert.match(wf, /-name '\*\.snap'/, 'the release no longer collects the snap'); + const linuxTargets = JSON.stringify(pkg.build.linux.target); + assert.match(linuxTargets, /snap/, 'nothing builds a snap, so publishing one cannot work'); +}); diff --git a/tests/release-verification-guide.test.js b/tests/release-verification-guide.test.js new file mode 100644 index 000000000..ecc434e91 --- /dev/null +++ b/tests/release-verification-guide.test.js @@ -0,0 +1,85 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..'); +const README = fs.readFileSync(path.join(ROOT, 'README.md'), 'utf8'); +const GUIDE = fs.readFileSync(path.join(ROOT, 'docs', 'VERIFY_RELEASE.md'), 'utf8'); +const RUNBOOK = fs.readFileSync(path.join(ROOT, 'docs', 'RELEASE_RUNBOOK.md'), 'utf8'); +const RELEASE_WORKFLOW = fs.readFileSync(path.join(ROOT, '.github', 'workflows', 'release.yml'), 'utf8'); +const BETA_WORKFLOW = fs.readFileSync(path.join(ROOT, '.github', 'workflows', 'beta.yml'), 'utf8'); + +function publisherJob(workflow) { + const start = workflow.indexOf('\n publish:'); + assert.notStrictEqual(start, -1, 'workflow has no publish job'); + return workflow.slice(start); +} + +test('the install path links to the public verification procedure', () => { + assert.match(README, /\[release verification guide\]\(docs\/VERIFY_RELEASE\.md\)/i); + assert.match(README, /For releases that provide an\s+artifact-bound SBOM and provenance/); + assert.match(README, /\[Release verification\]\(docs\/VERIFY_RELEASE\.md\)/); +}); + +test('Windows and Unix users can verify the package checksum', () => { + assert.match(GUIDE, /Get-FileHash -Algorithm SHA256/); + assert.match(GUIDE, /shasum -a 256/); + assert.match(GUIDE, /Checksum mismatch/); +}); + +test('the guide binds the SBOM to both artifact hash and filename', () => { + assert.match(GUIDE, /metadata\.component\.hashes/); + assert.match(GUIDE, /posnic:artifact:file-name/); + assert.match(GUIDE, /SBOM does not describe/); +}); + +test('provenance is verified for the artifact and SBOM separately', () => { + assert.match(GUIDE, /gh attestation verify "\$artifact" -R Posnic\/POS/); + assert.match(GUIDE, /gh attestation verify "\$artifact\.cdx\.json" -R Posnic\/POS/); +}); + +test('release publishers attest the exact checksum subjects before upload', () => { + for (const workflow of [RELEASE_WORKFLOW, BETA_WORKFLOW]) { + const publisher = publisherJob(workflow); + assert.match(publisher, /id-token:\s*write/); + assert.match(publisher, /attestations:\s*write/); + assert.match(publisher, /artifact-metadata:\s*write/); + assert.match(publisher, /uses:\s*actions\/attest@[0-9a-f]{40}\s+# v4\.2\.2/); + assert.match(publisher, /subject-checksums:\s*release\/SHA256SUMS\.txt/); + + const checksum = publisher.indexOf('sha256sum'); + const attestation = publisher.indexOf('uses: actions/attest@'); + const publication = publisher.indexOf('uses: softprops/action-gh-release@'); + assert.ok(checksum < attestation, 'attestation runs before the checksum subjects exist'); + assert.ok(attestation < publication, 'release assets are published before provenance exists'); + } +}); + +test('beta publication keeps builder diagnostics out of release assets', () => { + const publisher = publisherJob(BETA_WORKFLOW); + assert.match(BETA_WORKFLOW, /builder-debug\.yml is build diagnostics, not updater input/); + assert.match(BETA_WORKFLOW, /shopt -s nullglob/); + assert.match(BETA_WORKFLOW, /latest_manifests=\(dist\/latest\*\.yml\)/); + assert.match(BETA_WORKFLOW, /if \(\( \$\{#latest_manifests\[@\]\} == 0 \)\)/); + assert.match(BETA_WORKFLOW, /dist\/latest\*\.yml/); + assert.doesNotMatch(BETA_WORKFLOW, /dist\/\*\.yml/); + assert.match(publisher, /-name 'latest\*\.yml'/); + assert.doesNotMatch(publisher, /-name '\*\.yml'/); +}); + +test('the guide does not promote inventory or provenance into a security claim', () => { + assert.match(GUIDE, /Older releases may predate the SBOM and provenance workflow/); + assert.match(GUIDE, /cannot be counted as checks\s+that passed/); + assert.match(GUIDE, /inventory, not legal advice/i); + assert.match(GUIDE, /does not establish/); + assert.match(GUIDE, /vulnerability-free/); + assert.match(GUIDE, /independent review or reproducible builds/); +}); + +test('the release checklist blocks publication on missing trust artifacts', () => { + assert.match(RUNBOOK, /Every `\.exe`, `\.dmg`, `\.zip`, `\.AppImage` and `\.deb` has a matching/); + assert.match(RUNBOOK, /both files must appear in\s+`SHA256SUMS\.txt`/); + assert.match(RUNBOOK, /gh attestation verify <artifact> -R Posnic\/POS/); + assert.match(RUNBOOK, /missing provenance record means stop/); +}); diff --git a/tests/release-version-format.test.js b/tests/release-version-format.test.js index 947f27ae0..db20ee57f 100644 --- a/tests/release-version-format.test.js +++ b/tests/release-version-format.test.js @@ -55,7 +55,7 @@ test('a prefixed version would be unreadable, which is why it must not be used', test('an unreadable version still fails safe, not open', () => { /* The failure direction matters more than the failure. Waiting for a click is recoverable; installing something unclassified is not. */ - const src = fs.readFileSync(path.join(ROOT, 'update-service.js'), 'utf8'); + const src = fs.readFileSync(path.join(ROOT, 'src', 'update-service.js'), 'utf8'); const fn = src.slice(src.indexOf('_classify(version)')); const body = fn.slice(0, fn.indexOf('\n }')); diff --git a/tests/report-full-export-wiring.test.js b/tests/report-full-export-wiring.test.js new file mode 100644 index 000000000..c96ef0e9e --- /dev/null +++ b/tests/report-full-export-wiring.test.js @@ -0,0 +1,106 @@ +/* + * Full-duration report export wiring guard. + * + * The owner's original report was "pdf reports are taking first records + * only". The fix gives each report page a `full` spec naming three things: + * the table, its per-page selector, and the loader that re-renders it. + * + * The failure mode worth guarding is that _fullExportRun is DELIBERATELY + * forgiving - a missing table, per-page selector or loader makes it call + * fallback() and export whatever is on screen. That is right at runtime (an + * export that works beats an export that throws) but it means a typo in any + * of those three strings brings the original bug straight back, silently, + * with no error anywhere. Nothing else would catch it, so this does: every + * id and every loader path a `full` spec names must actually exist in the + * frontend sources. + */ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const FRONTEND = path.join(__dirname, '..', 'frontend', 'static', 'script', 'js'); +const CORE = path.join(FRONTEND, 'core', 'PosnicPro.js'); +const MODULES_DIR = path.join(FRONTEND, 'modules', 'js'); + +const core = fs.readFileSync(CORE, 'utf8'); + +const moduleSources = fs + .readdirSync(MODULES_DIR) + .filter((f) => f.endsWith('.js')) + .map((f) => fs.readFileSync(path.join(MODULES_DIR, f), 'utf8')) + .join('\n'); + +/* Pull every `full: [ ... ]` spec out of the registry literal. */ +const specs = []; +const specRe = /\{\s*(?:when:\s*'([^']+)',\s*)?table:\s*'([^']+)',\s*per:\s*'([^']+)',\s*load:\s*'([^']+)'\s*\}/g; +let m; +while ((m = specRe.exec(core)) !== null) { + specs.push({ when: m[1] || null, table: m[2], per: m[3], load: m[4] }); +} + +test('the registry actually declares full-range specs', () => { + // If this ever hits zero the regex stopped matching the registry's shape + // and every assertion below would vacuously pass. + assert.ok(specs.length >= 12, `expected the full-export specs to be found, got ${specs.length}`); +}); + +test('every full-export table and per-page selector exists in the frontend sources', () => { + const missing = []; + for (const s of specs) { + // ids are used as jQuery selectors; the sources build them as markup or + // select them, so the bare id must appear somewhere. + const tableId = s.table.replace(/^#/, ''); + const perId = s.per.replace(/^#/, ''); + if (!moduleSources.includes(tableId)) { + missing.push(`${s.load}: table ${s.table} appears in no module source`); + } + if (!moduleSources.includes(perId)) { + missing.push(`${s.load}: per-page selector ${s.per} appears in no module source`); + } + } + assert.deepStrictEqual( + missing, + [], + `full-range export would silently fall back to the on-screen rows:\n${missing.join('\n')}` + ); +}); + +test('every full-export loader function exists', () => { + const missing = []; + for (const s of specs) { + const parts = s.load.split('.'); + const fn = parts[parts.length - 1]; + const ns = parts[parts.length - 2]; + // e.g. 'itemreport.itemreportTable' -> PosnicPro.itemreport = { itemreportTable: function + if (!new RegExp(`${fn}\\s*[:=]\\s*function`).test(moduleSources)) { + missing.push(`${s.load}: no function named ${fn}`); + } + if (ns && !new RegExp(`PosnicPro\\.${ns}\\s*=`).test(moduleSources)) { + missing.push(`${s.load}: no PosnicPro.${ns} namespace`); + } + } + assert.deepStrictEqual( + missing, + [], + `full-range export would silently fall back to the on-screen rows:\n${missing.join('\n')}` + ); +}); + +test('a page never declares two specs that could both claim the same tab', () => { + // Within one page the first matching spec wins, so at most ONE spec may be + // unconditional - a second would be unreachable. + const byTable = new Map(); + for (const s of specs) { + const key = s.table; + if (!byTable.has(key)) byTable.set(key, []); + byTable.get(key).push(s); + } + for (const [table, list] of byTable) { + const unconditional = list.filter((s) => !s.when); + assert.ok( + unconditional.length <= 1, + `${table} has ${unconditional.length} unconditional specs; all but the first are dead` + ); + } +}); diff --git a/tests/rollback-drill.test.js b/tests/rollback-drill.test.js index c0f5021f3..0e4539d63 100644 --- a/tests/rollback-drill.test.js +++ b/tests/rollback-drill.test.js @@ -22,7 +22,7 @@ const os = require('os'); const path = require('path'); const crypto = require('crypto'); -const { AssetUpdater, MAX_BOOT_ATTEMPTS } = require('../asset-updater'); +const { AssetUpdater, MAX_BOOT_ATTEMPTS } = require('../src/asset-updater'); const ROOT = path.join(__dirname, '..'); const ASSETS_DIR = path.join(ROOT, 'frontend', 'public'); diff --git a/tests/sale-done-autoclose.test.js b/tests/sale-done-autoclose.test.js new file mode 100644 index 000000000..191ecbbc8 --- /dev/null +++ b/tests/sale-done-autoclose.test.js @@ -0,0 +1,165 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { blockAt, cssReader, stripComments } = require('./helpers/source-lookup'); + +/* + * The sale-done card closes itself, unless the cashier is using it. + * + * Owner ask: "after successfull sales we show sucess message... i see little + * animation on border reaches corner and then disappear... user no need to + * click close button or new sales. he have enough time to print or something." + * + * The saved click is the small half. The part that has to be right is the + * CANCELLING: a card that closes as somebody reaches for Print sends them + * hunting for the sale again in front of a waiting customer, and that one + * event costs more than the clicks saved across a hundred sales. + * + * Comments are stripped before every assertion - prose naming a guard reads + * exactly like the guard. + */ + +const ROOT = path.join(__dirname, '..'); +const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8'); + +const salesJs = stripComments( + read('frontend', 'static', 'script', 'js', 'modules', 'js', 'sales.js'), +); +const html = read('frontend', 'modules', 'sales_write.html'); +const css = read('frontend', 'static', 'style', 'css', 'custom.css'); +const cssRule = cssReader(css); + +const timer = () => blockAt(salesJs, 'PosnicPro.sales.saleDoneTimer = {'); + +test('intent stops the countdown - a click, a key, a tap. Nothing less.', () => { + /* + * THE THIRD DEFINITION, this time the owner's own: "if click anywhere then + * cancel that close otherwise just close it." Hover-anywhere cancelled on + * the frame the panel appeared; movement-over-a-threshold then held the + * card forever on every sale after the first ("sales auto close stuff also + * only first time only") - the hand travelling back from Complete crossed + * the threshold before the countdown was ever seen. + */ + const at = salesJs.indexOf('saleDoneTimer.hold()'); + assert.notStrictEqual(at, -1, 'nothing calls hold()'); + + for (const evt of ['mousedown', 'touchstart', 'focusin', 'keydown']) { + assert.ok(salesJs.includes(evt), `nothing cancels the countdown on ${evt}`); + } +}); + +test('presence and MOVEMENT do not stop the countdown', () => { + /* + * Both retired definitions must stay retired: no hover hold, no movement + * hold. Either one coming back is the never-closes bug wearing its old + * clothes. + */ + assert.doesNotMatch(salesJs, /'mousemove', '#newsalespage'/, + 'the movement hold is back - the card will never close after the first sale'); + assert.doesNotMatch(salesJs, /'mouseenter',\s*'#newsalespage/, + 'the hover hold is back - the card will never close at all'); +}); + +test('the two action buttons are not a hold - the close X closes into a new sale', () => { + /* "dont ignore close button close. if user click close button then it + needs to close and new sale." A hold on the X would swallow the one + click that most clearly means "done". */ + const closer = blockAt(salesJs, "$(document).on('click', '.infobar-tender-close'"); + assert.match(closer, /is\(':visible'\)/); + assert.match(closer, /saleDoneTimer\.stop\(\)/); + assert.match(closer, /sale-done-primary'\)\.get\(0\)/); +}); + +test('once stopped it does not start again', () => { + /* Somebody who engaged with this card gets to leave it when they choose. + A timer that resumed after the mouse left would close the card while + they were reading the receipt they just printed. */ + const fn = timer(); + assert.doesNotMatch( + fn, + /mouseleave|mouseout|focusout/, + 'the countdown restarts when attention moves away', + ); + assert.match(blockAt(salesJs, 'hold: function'), /self\.stop\(\)/); +}); + +test('the countdown is cancelled wherever the card is hidden', () => { + /* A timer outliving its card fires into a page that has moved on. */ + assert.match(salesJs, /saleDoneTimer\.stop\(\)/, 'nothing stops the timer on hide'); +}); + +test('a second sale cannot leave two timers running', () => { + /* Two overlapping timers close the card early, which looks exactly like a + bug and is nearly impossible to reproduce on purpose. */ + const fn = blockAt(salesJs, 'start: function'); + assert.match(fn, /self\.stop\(\);/, 'start() does not clear an existing countdown'); +}); + +test('the close does not fire into a page that has moved on', () => { + const fn = blockAt(salesJs, 'start: function'); + assert.match( + fn, + /is\(':visible'\)/, + 'the timeout acts without checking the card is still on screen', + ); +}); + +test('closing reuses the button rather than duplicating what it does', () => { + /* A second way to start a sale is a second thing to keep in step. */ + const fn = blockAt(salesJs, 'start: function'); + assert.match(fn, /sale-done-primary/, 'the timeout does not use the New sale control'); +}); + +test('the countdown is ONE line along the top, paced by the timer', () => { + /* Owner: "whole box animation going. instead top side itself enough + instead of all 4 sides." The ring around the card is gone; a single + top-edge bar shrinks over the same seconds the timer counts. CSS runs + it (is-closing starts the keyframe, the variable paces it), so + cancelling is removing one class - nothing to unwind. */ + const fn = blockAt(salesJs, 'start: function'); + assert.match(fn, /--sale-done-secs/, 'the bar is not paced by the timer'); + assert.ok(!/getTotalLength/.test(fn), 'the perimeter ring is back'); + assert.match(css, /\.sale-done-card::before/); + assert.match(css, /sale-done-countdown var\(--sale-done-secs/); + assert.match(css, /@keyframes sale-done-countdown/); +}); + +test('reduced motion means the card does not close itself at all', () => { + /* The bar is the only warning this card gives. Hiding it but keeping the + close would make the panel vanish with no notice - the exact surprise + the bar exists to prevent. */ + const fn = blockAt(salesJs, 'start: function'); + assert.match(fn, /prefers-reduced-motion/, 'reduced motion is not considered'); + const at = fn.indexOf('prefers-reduced-motion'); + assert.match(fn.slice(at, at + 200), /return/, 'reduced motion does not stop the auto-close'); + assert.match( + css, + /@media \(prefers-reduced-motion: reduce\) \{\s*\.sale-done-card\.is-closing::before \{ animation: none/, + 'the bar still animates for reduced motion', + ); +}); + +test('the bar cannot swallow a click and only runs while counting', () => { + const bar = cssRule('.sale-done-card::before'); + assert.match(bar, /pointer-events:\s*none/); + /* the animation is bound to is-closing, so a cancelled timer shows no bar */ + assert.match(css, /\.sale-done-card\.is-closing::before \{\s*animation: sale-done-countdown/); +}); + +test('a held card says so, rather than leaving the cashier guessing', () => { + assert.ok(html.includes('sale-done-hint'), 'no hint element exists'); + assert.match(cssRule('.sale-done-card.is-held .sale-done-hint'), /display:\s*block/); + assert.match(cssRule('.sale-done-hint'), /display:\s*none/); +}); + +test('one announcement per sale - the card, never a toast on top of it', () => { + /* "after sales complete i see two notification... sometime it might block + some action like close from mobile." The toast sat exactly over the + card's close button on a phone. Errors still toast - the card never + shows for those. */ + const at = salesJs.indexOf("balance_view') === 'true')) {"); + assert.ok(at > -1, 'the toast is unconditional again'); + const around = salesJs.slice(at - 400, at + 120); + assert.match(around, /response\.type === 'success'/); +}); diff --git a/tests/sale-screen-decisions.test.js b/tests/sale-screen-decisions.test.js new file mode 100644 index 000000000..faaa87323 --- /dev/null +++ b/tests/sale-screen-decisions.test.js @@ -0,0 +1,98 @@ +'use strict'; + +/* + * One afternoon of sale-screen reports, pinned so none of them regress: + * + * - "why categories first row box size and second row size is different?" + * The category grid split itself every fourth tile into a PLAIN Bootstrap + * row, dropping those tiles out of the CSS grid that sizes the first four. + * - "item list name looks bold. same used for all data table. remove it." + * - "after sales when mouse move you are cancelling auto close. make that + * as mouse click... dont ignore close button close." + * - "sales auto close stuff also only first time only" - the movement + * threshold held the card forever on every sale where the hand was still + * travelling back from the Complete button. + * - "send test notification works but second time not working" - same-tag + * notifications replace each other SILENTLY without renotify. + */ +const { test } = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const read = (rel) => fs.readFileSync(path.join(__dirname, '..', 'frontend', rel), 'utf8'); +const sales = read('static/script/js/modules/js/sales.js'); +const css = read('static/style/css/custom.css'); +const sw = read('sw-template.js'); + +test('sale tiles live in ONE self-wrapping grid - no manual row breaks', () => { + /* The %4 split was a Bootstrap relic: every row it opened lacked + sale-tile-grid, so tiles 5+ fell back to full-size columns and the + first row looked like a different product. */ + assert.ok(!/% 4 === 0/.test(sales), 'a fourth-tile row break is back'); + /* all three tile surfaces open the same grid: items tab, category tab, + and a category\'s own items */ + const grids = sales.match(/class=["']row (mb-3 )?sale-tile-grid/g) || []; + assert.ok(grids.length >= 3, 'a tile surface lost the sale-tile-grid class: ' + grids.length); +}); + +test('data-table name links are links, not headlines', () => { + const rule = css.slice(css.indexOf('.table_model_item{'), css.indexOf('}', css.indexOf('.table_model_item{'))); + assert.match(rule, /font-weight: normal/); + assert.ok(!/font-weight: *(900|bold|700)/.test(rule), 'the bold came back'); +}); + +test('only a CLICK holds the sale-done card open - movement is not intent', () => { + /* Two prior definitions each broke a different way: hover-anywhere + cancelled on the frame the card appeared; movement-over-12px held it + forever on every sale after the first. */ + assert.ok(!/mousemove.*#newsalespage/.test(sales), 'the movement hold is back'); + assert.match(sales, /\$\(document\)\.on\('mousedown touchstart', '#newsalespage'/); + /* the two action buttons stay out of the hold - in BOTH hold handlers + (pointer and keyboard), or one path quietly swallows the close X */ + const exclusions = sales.match(/closest\('\.sale-done-primary, \.infobar-tender-close'\)\.length\) \{ return; \}/g) || []; + assert.strictEqual(exclusions.length, 2, 'a hold handler lost its action-button exclusion'); +}); + +test('the close X on the done card CLOSES into a new sale, never just hides', () => { + const closer = sales.slice(sales.indexOf("$(document).on('click', '.infobar-tender-close'")); + assert.match(closer, /#newsalespage'\)\.is\(':visible'\)/); + assert.match(closer, /saleDoneTimer\.stop\(\)/); + assert.match(closer, /\.sale-done-primary'\)\.get\(0\)/); + /* the primary is excluded or it would click itself */ + assert.match(closer, /hasClass\('sale-done-primary'\)\) \{ return; \}/); +}); + +test('a second sale gets a fresh countdown - the held state does not leak', () => { + const start = sales.slice(sales.indexOf('start: function ()'), sales.indexOf('hold: function ()')); + assert.match(start, /removeClass\('is-held is-closing'\)/); + /* and the class round-trip restarts the CSS animation for back-to-back + sales - the reflow read is the restart */ + assert.match(start, /offsetWidth/); +}); + +test('a repeated notification announces itself - same-tag replacement is silent', () => { + const push = sw.slice(sw.indexOf("addEventListener('push'")); + assert.match(push, /renotify: true/); + assert.match(push, /tag: data\.tag \|\| 'posnic'/); +}); + +test('the settings save PATCHES - it does not repaint the world', () => { + /* Owner: "every save of form, some refresh is happening... i think its + lazy coding." The reference conversion: a snapshot at entry, and every + block gated by whether the value it exists FOR actually moved. The + low-stock network fetch is the canary - a save that did not touch the + threshold must not fetch. */ + const settings = fs.readFileSync( + path.join(__dirname, '..', 'frontend', 'static', 'script', 'js', 'modules', 'js', 'settings.js'), 'utf8'); + const start = settings.indexOf('var was = {'); + const handler = settings.slice(start, settings.indexOf('PosnicPro.alert(response.type,', start)); + assert.match(handler, /tableNow !== was\.table_options/); + assert.match(handler, /keyboardNow !== was\.keyboard/); + assert.match(handler, /notificationNow !== was\.notification/); + assert.match(handler, /generalNow !== was\.general/); + /* the fetch lives INSIDE its gate */ + const fetchAt = handler.indexOf('viewLowStockDashboard'); + const gateAt = handler.indexOf('notificationNow !== was.notification'); + assert.ok(gateAt > -1 && fetchAt > gateAt, 'the low-stock fetch escaped its gate'); +}); diff --git a/tests/sale-screen-tint.test.js b/tests/sale-screen-tint.test.js new file mode 100644 index 000000000..4332c4319 --- /dev/null +++ b/tests/sale-screen-tint.test.js @@ -0,0 +1,90 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +/* + * One meaning per colour on the sale screen (SALE_SCREEN_UX_AUDIT, P2). + * + * The owner's answer to "which colour means what" was "you can pick standard + * stuff", so this is the standard mapping, and it is the same one already + * shipped when the github theme's green primary button became the blue accent + * (queue #58): green stopped meaning "main action" so it could mean "succeeded" + * and nothing else. + * + * red - destructive, or a required-field marker + * green - succeeded + * accent - the main action + * grey - neutral: modes, toggles, secondary controls + * + * A colour that means two things means nothing. On a till that costs more than + * on a website: a cashier reads tint before text, and red on a control that + * does not destroy anything trains them to ignore red. + */ + +const ROOT = path.join(__dirname, '..'); +const sale = fs.readFileSync(path.join(ROOT, 'frontend', 'modules', 'sales_write.html'), 'utf8'); + +/* The markup for one element, by id. */ +const elementFor = (id) => { + const at = sale.indexOf(`id="${id}"`); + assert.notStrictEqual(at, -1, `#${id} is not on the sale screen`); + const start = sale.lastIndexOf('<', at); + return sale.slice(start, sale.indexOf('>', at) + 1); +}; + +test('the discount mode toggles are neutral, not destructive', () => { + /* % and ₹ switch how a discount is EXPRESSED. Nothing is destroyed, so red + misreads - and it is the colour a cashier needs to trust elsewhere. */ + for (const id of ['percentIcon', 'rupeeIcon']) { + const el = elementFor(id); + assert.ok( + !/text-danger/.test(el), + `#${id} is red, but switching between percent and rupees destroys nothing`, + ); + assert.match(el, /text-muted/, `#${id} needs a neutral tint, not no tint at all`); + } +}); + +test('the toggles keep the affordance that was doing the work', () => { + /* The tint was never what said "clickable" - the bordered box and its hover + border were. Removing the colour must not remove those. */ + const css = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'style', 'css', 'custom.css'), + 'utf8', + ); + assert.match(css, /\.inline-container \.toggle-icon \{[^}]*border:/, 'the box outline is gone'); + assert.match(css, /\.inline-container \.toggle-icon:hover \{[^}]*border-color:/, 'the hover cue is gone'); + for (const id of ['percentIcon', 'rupeeIcon']) { + assert.match(elementFor(id), /cursor:\s*pointer/, `#${id} no longer looks clickable`); + } +}); + +test('red is still used where red is right', () => { + /* This is a mapping, not a purge. A required-field asterisk in red is what + every form on earth does, and removing it would be the opposite mistake. */ + assert.match( + sale, + /<span\s+class="text-danger">\*<\/span>/, + 'the required-field marker lost its red - that use is conventional and correct', + ); +}); + +test('the toggle still works by class, so the tint cannot break it', () => { + /* Which mode is active is carried by d-none, read in several places as + `!$('#percentIcon').hasClass('d-none')`. If the tint were ever made + load-bearing instead, changing a colour would change what gets saved. */ + const salesJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'sales.js'), + 'utf8', + ); + assert.match( + salesJs, + /!\$\('#percentIcon'\)\.hasClass\('d-none'\)/, + 'the mode must be read from d-none, never from a colour class', + ); + assert.ok( + !/percentIcon'\)\.hasClass\('text-/.test(salesJs), + 'a colour class is being read as state - a restyle would change what is saved', + ); +}); diff --git a/tests/scale-parser.test.js b/tests/scale-parser.test.js index 1e9b855dc..25c7f2abf 100644 --- a/tests/scale-parser.test.js +++ b/tests/scale-parser.test.js @@ -1,6 +1,6 @@ const test = require('node:test'); const assert = require('node:assert'); -const { ScaleReader, parseFrame } = require('../scale-parser'); +const { ScaleReader, parseFrame } = require('../src/scale-parser'); test('reads the wire formats real scales send', () => { const cases = [ diff --git a/tests/scheduled-task.test.js b/tests/scheduled-task.test.js index 69899111a..2d42ced04 100644 --- a/tests/scheduled-task.test.js +++ b/tests/scheduled-task.test.js @@ -18,10 +18,10 @@ const assert = require('node:assert'); const fs = require('fs'); const path = require('path'); -const st = require('../scheduled-task'); +const st = require('../src/scheduled-task'); const ROOT = path.join(__dirname, '..'); -const MAIN = fs.readFileSync(path.join(ROOT, 'main.js'), 'utf8'); +const MAIN = fs.readFileSync(path.join(ROOT, 'src', 'main.js'), 'utf8'); test('only tasks main.js can actually run may be scheduled', () => { const fn = MAIN.slice(MAIN.indexOf('async function runScheduledTaskAndExit')); @@ -144,8 +144,8 @@ test('the backup destination is printed when the caller knows it', () => { test('the screen the user guide sends people to actually exists', () => { /* The guide says Posnic writes the command for you. If nothing renders it, that sentence sends a shopkeeper looking for a button that is not there. */ - const ui = fs.readFileSync(path.join(ROOT, 'backup-manager.html'), 'utf8'); - const preload = fs.readFileSync(path.join(ROOT, 'preload.js'), 'utf8'); + const ui = fs.readFileSync(path.join(ROOT, 'src', 'backup-manager.html'), 'utf8'); + const preload = fs.readFileSync(path.join(ROOT, 'src', 'preload.js'), 'utf8'); assert.match(ui, /id="btnShowSchedule"/, 'no control to show the command'); assert.match(ui, /getScheduleInstructions\(/, 'the control is not wired to the bridge'); diff --git a/tests/scorecard-workflow.test.js b/tests/scorecard-workflow.test.js new file mode 100644 index 000000000..f6b4d9c2e --- /dev/null +++ b/tests/scorecard-workflow.test.js @@ -0,0 +1,67 @@ +'use strict'; + +const assert = require('node:assert/strict'); +const fs = require('node:fs'); +const path = require('node:path'); +const test = require('node:test'); + +const WORKFLOW = fs.readFileSync( + path.join(__dirname, '..', '.github', 'workflows', 'scorecard.yml'), + 'utf8', +); + +const APPROVED_ACTIONS = new Map([ + ['actions/checkout', '3d3c42e5aac5ba805825da76410c181273ba90b1'], + ['ossf/scorecard-action', '2d1146689b8cda280b9bc96326124645441f03bc'], + ['actions/upload-artifact', '043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'], + /* v4.37.9. Verified against upstream before approving: the annotated tag + v4.37.9 in github/codeql-action dereferences to this commit. That check is + the entire point of this map, so do it again for the next bump rather than + trusting the trailing comment in the workflow. */ + ['github/codeql-action/upload-sarif', 'cdf488f595d80d6e07e03d4674febd5ab45fa938'], +]); + +test('Scorecard runs only on supported default-branch and scheduled triggers', () => { + assert.match(WORKFLOW, /^on:\n push:\n branches: \[develop\]/m); + assert.match(WORKFLOW, /^ schedule:\n - cron: '[^']+'$/m); + assert.match(WORKFLOW, /^ workflow_dispatch:$/m); + assert.doesNotMatch(WORKFLOW, /^ pull_request(?:_target)?:/m); + assert.match(WORKFLOW, /if: github\.event\.repository\.private == false/); +}); + +test('Scorecard uses bounded permissions and the published-result contract', () => { + assert.match(WORKFLOW, /^permissions: read-all$/m); + for (const permission of [ + 'actions: read', + 'checks: read', + 'contents: read', + 'id-token: write', + 'issues: read', + 'pull-requests: read', + 'security-events: write', + ]) { + assert.match(WORKFLOW, new RegExp(`^ ${permission}$`, 'm')); + } + assert.match(WORKFLOW, /^ persist-credentials: false$/m); + assert.match(WORKFLOW, /^ results_file: results\.sarif$/m); + assert.match(WORKFLOW, /^ results_format: sarif$/m); + assert.match(WORKFLOW, /^ publish_results: true$/m); + assert.match(WORKFLOW, /^ sarif_file: results\.sarif$/m); +}); + +test('every Scorecard workflow dependency is approved and commit-pinned', () => { + const actions = [...WORKFLOW.matchAll(/^\s+uses:\s+([^@\s]+)@([^\s#]+)/gm)] + .map((match) => ({ action: match[1], ref: match[2] })); + + assert.equal(actions.length, APPROVED_ACTIONS.size); + for (const { action, ref } of actions) { + assert.equal(APPROVED_ACTIONS.get(action), ref, `${action} is not pinned to the reviewed commit`); + assert.match(ref, /^[0-9a-f]{40}$/); + } +}); + +test('the publishing job contains no mutable execution extensions', () => { + assert.doesNotMatch(WORKFLOW, /^env:/m); + assert.doesNotMatch(WORKFLOW, /^defaults:/m); + assert.doesNotMatch(WORKFLOW, /^ (?:container|services|env|defaults):/m); +}); diff --git a/tests/security-model-doc.test.js b/tests/security-model-doc.test.js index f40303dbc..4ea7648ab 100644 --- a/tests/security-model-doc.test.js +++ b/tests/security-model-doc.test.js @@ -24,7 +24,7 @@ test('the database really is bound to loopback, as the policy claims', () => { /* SECURITY.md tells shops nothing on the LAN can reach MongoDB. If the bind address ever widens, that sentence becomes false and a shop would have no way to know. */ - const manager = read('mongodb-manager.js'); + const manager = read('src/mongodb-manager.js'); assert.match( manager, /--bind_ip[\s'",]+127\.0\.0\.1|bind_ip.*127\.0\.0\.1/, @@ -40,7 +40,7 @@ test('the database really is bound to loopback, as the policy claims', () => { test('credentials are still generated per install, not shipped', () => { /* "No shared secret between shops" only holds while these are random at first run rather than constants in the source. */ - const main = read('main.js'); + const main = read('src/main.js'); assert.match( main, /crypto\.randomBytes\(\d+\)\.toString\('hex'\)/, @@ -49,7 +49,7 @@ test('credentials are still generated per install, not shipped', () => { }); test('the policy states the limits rather than implying protection', () => { - const policy = read('SECURITY.md'); + const policy = read('.github/SECURITY.md'); /* The two things that defeat everything, named explicitly. */ assert.match( diff --git a/tests/settings-group-cutover.test.js b/tests/settings-group-cutover.test.js new file mode 100644 index 000000000..3f03e9876 --- /dev/null +++ b/tests/settings-group-cutover.test.js @@ -0,0 +1,128 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { blockAt } = require('./helpers/source-lookup'); + +/* + * Frontend cutover to the per-group settings endpoints (design step S3). + * + * S1-S6 built a path where a partial save cannot demand a field it does not + * own. None of that protects anyone until the screens actually call it, and + * the screens that mattered are the three PARTIAL saves - the ones behind all + * three production bugs of 2026-08-20: + * + * - the signature upload, which returned "Default customer is required" + * because the shared validator demanded fields from another group + * - the feature toggles, which invented sales_prefix:'SAL' and + * receiving_prefix:'REC' to get past that same validator + * - the quotation defaults + * + * The whole-form saves legitimately span groups and stay on the legacy + * endpoint, which is what the design means by "the god endpoint sees only + * legacy traffic". + * + * The strongest assertion here compares each client payload against the + * SERVER's own group map, so the two cannot drift apart in either direction. + */ + +const ROOT = path.join(__dirname, '..'); +const settingsJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'settings.js'), + 'utf8', +); +const salesJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'modules', 'js', 'sales.js'), + 'utf8', +); +const GROUPS = require(path.join(ROOT, 'api', 'src', 'services', 'settings-groups')).GROUPS; + + +test('the signature upload posts to the documents endpoint', () => { + const handler = blockAt(salesJs, "$(document).on('change', '#qe_sig_file', function () {"); + assert.match(handler, /url: 'settings\/group\/documents'/); + assert.ok( + !handler.includes('setting/updateCommonSettings'), + 'this exact call is the one that 400d on a field it never sent', + ); + // and the key it sends really is a documents key + assert.ok(GROUPS.documents.includes('quote_default_signature')); +}); + +test('the feature toggles post to the features endpoint', () => { + const fn = blockAt(settingsJs, ' saveIntro: function () {'); + assert.match(fn, /url: 'settings\/group\/features'/); + assert.ok(!fn.includes('setting/updateCommonSettings')); +}); + +test('and they no longer invent values for fields they do not own', () => { + const fn = blockAt(settingsJs, ' saveIntro: function () {'); + /* sales_prefix:'SAL' and receiving_prefix:'REC' were sent purely to satisfy + a validator. They were described as ignored, but nothing guaranteed it - + the day that path stopped skipping them, every shop saving a toggle would + have had its receipt numbering overwritten with invented values. */ + /* Match the ASSIGNMENT, not the name: the comment above this code explains + what was removed and names both fields, and a bare substring check would + read that prose as the bug it describes. */ + assert.ok( + !/payload\.sales_prefix\s*=/.test(fn), + 'an invented prefix is a live data hazard', + ); + assert.ok( + !/payload\.receiving_prefix\s*=/.test(fn), + 'an invented prefix is a live data hazard', + ); + assert.ok( + !/modules_only:/.test(fn), + 'the per-group endpoint needs no control word', + ); +}); + +test('every toggle it sends is genuinely a features key', () => { + // the payload is built from the INTRO list, so check that list + const intro = blockAt(settingsJs, ' INTRO: ['); + const keys = [...intro.matchAll(/\['([a-z_]+)'/g)].map((m) => m[1]); + assert.ok(keys.length >= 10, `expected the intro list, found ${keys.length} keys`); + const strays = keys.filter((k) => !GROUPS.features.includes(k)); + assert.deepStrictEqual( + strays, + [], + 'a key outside the group would be refused by name, failing the whole save', + ); +}); + +test('the quotation defaults post to the documents endpoint', () => { + const handler = blockAt(settingsJs, "$(document).on('click', '#quote_settings_save', function () {"); + assert.match(handler, /url: 'settings\/group\/documents'/); + + // every key in that payload must belong to documents + const keys = [...handler.matchAll(/^\s{8}([a-z_]+):/gm)].map((m) => m[1]); + assert.ok(keys.length >= 3, `expected the payload keys, found ${keys.length}`); + const strays = keys.filter((k) => !GROUPS.documents.includes(k)); + assert.deepStrictEqual(strays, [], 'a foreign key here would be refused by name'); +}); + +test('the plural path - /setting/ is not mounted for the group routes', () => { + // routes/index.js mounts /settings/group, and /setting only reaches the + // legacy router; a singular call would 404 + const routes = fs.readFileSync(path.join(ROOT, 'api', 'src', 'routes', 'index.js'), 'utf8'); + assert.match(routes, /router\.use\('\/settings\/group'/); + for (const src of [settingsJs, salesJs]) { + assert.ok( + !/'setting\/group\//.test(src), + 'the group routes are only mounted under the PLURAL settings path', + ); + } +}); + +test('the whole-form saves stay on the legacy endpoint, deliberately', () => { + /* They span several groups plus keys in none of them. Splitting one save + into four requests would trade a validation bug for a partial-write bug, + which is worse: half the form saved and half not, with no way to tell. */ + const remaining = (settingsJs.match(/setting\/updateCommonSettings/g) || []).length; + assert.strictEqual(remaining, 2, `expected the two whole-form saves, found ${remaining}`); + assert.ok( + !salesJs.includes('setting/updateCommonSettings'), + 'the sale screen has no whole-form save and should not touch the god endpoint', + ); +}); diff --git a/tests/settings-layout-overflow.test.js b/tests/settings-layout-overflow.test.js new file mode 100644 index 000000000..8163d4b40 --- /dev/null +++ b/tests/settings-layout-overflow.test.js @@ -0,0 +1,95 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { cssReader } = require('./helpers/source-lookup'); + +/* + * The settings content must not run off the right-hand edge. + * + * Owner report, with screenshots: the Features cards and the Cash Book card + * both cut off mid-page, with no scrollbar to reach the rest. + * + * A FLEX ITEM WILL NOT SHRINK BELOW ITS CONTENT unless told it may - min-width + * defaults to `auto` on a flex item, which resolves to the content's minimum. + * The Features grid is `repeat(auto-fill, minmax(290px, 1fr))`, so its minimum + * is 290px plus gaps; on a narrow window that exceeds the row, the column + * refuses to shrink, and everything past the edge is simply unreachable. + * + * This is the classic flexbox overflow, and it is invisible on a wide screen - + * which is why it survived until somebody used a smaller window. + */ + +const ROOT = path.join(__dirname, '..'); +/* + * Comments are stripped before anything is asserted. + * + * The prose explaining this fix contains the words "min-width: 0", so the + * first version of these tests passed with the declaration deleted - it was + * matching its own explanation. Found by mutation, which is the only way that + * kind of pass ever gets found. + */ +const css = fs + .readFileSync(path.join(ROOT, 'frontend', 'static', 'style', 'css', 'custom.css'), 'utf8') + .replace(/\/\*[\s\S]*?\*\//g, ''); +const cssRule = cssReader(css); +const html = fs.readFileSync( + path.join(ROOT, 'frontend', 'modules', 'settings_write.html'), + 'utf8', +); + +test('the settings content column is allowed to shrink', () => { + const rule = cssRule('.settings-nav-col + div {'); + assert.match(rule, /min-width:\s*0/, 'the column cannot shrink below its content'); + assert.match(rule, /max-width:\s*100%/); +}); + +test('the panes inside it can shrink too', () => { + /* One level down the same trap waits: grids and tables whose min-content + width exceeds the pane. */ + assert.match( + css, + /\.settings-nav-col \+ div \.tab-pane \{ min-width: 0; \}/, + 'tab panes are not allowed to shrink', + ); +}); + +test('the feature grid narrows rather than overflowing', () => { + /* + * min(290px, 100%) is the whole trick: on a narrow screen the track may go + * below its nominal width instead of forcing the container wider. Two + * cramped columns are readable; one column off-screen is not. + */ + assert.match(css, /minmax\(min\(290px, 100%\), 1fr\)/); +}); + +test('embedded whole-pages are contained', () => { + /* + * Cash Book and Cash Register are entire pages dropped into a settings pane. + * They bring their own #containerbar and page margins, written for a + * full-width page and never adjusted for sitting in a column. + */ + /* With the brace, or this also matches the four descendant rules below it. */ + assert.match(cssRule('.config-embedded-page {'), /min-width:\s*0/); + assert.match(cssRule('.config-embedded-page > #containerbar'), /margin:\s*0/); +}); + +test('the duplicate containerbar ids are acknowledged, not ignored', () => { + /* + * settings_write.html carries three id="containerbar" elements because it + * embeds two whole pages. That is invalid, and getElementById returns only + * the first - so anything reaching for it by id is already reading the wrong + * element. Left alone deliberately: the embedded pages' own scripts look it + * up, and renaming is a far bigger change than a clipped card justifies. + * + * This test exists so the count cannot grow unnoticed. + */ + const count = (html.match(/id="containerbar"/g) || []).length; + assert.strictEqual( + count, + 3, + `settings_write.html has ${count} elements with id="containerbar". ` + + 'If a page was embedded, contain it in CSS as the others are; if one was ' + + 'removed, lower this number.', + ); +}); diff --git a/tests/settings-windows.test.js b/tests/settings-windows.test.js index a759b941b..ca67b22c6 100644 --- a/tests/settings-windows.test.js +++ b/tests/settings-windows.test.js @@ -30,8 +30,9 @@ const ROOT = path.join(__dirname, '..'); const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8'); /* The windows this file covers: every top-level page wearing window-theme. */ -const WINDOWS = fs.readdirSync(ROOT) +const WINDOWS = fs.readdirSync(path.join(ROOT, 'src')) .filter((f) => f.endsWith('.html')) + .map((f) => 'src/' + f) .filter((f) => read(f).includes('window-theme.css')); test('the themed windows are the four settings windows', () => { @@ -79,7 +80,7 @@ for (const win of WINDOWS) { /* ---- the theme laid over them ----------------------------------------- */ -const THEME = read('window-theme.css'); +const THEME = read('src/window-theme.css'); /* Declaration blocks, minus comments. */ function blocks(css) { diff --git a/tests/shadow-actor.test.js b/tests/shadow-actor.test.js new file mode 100644 index 000000000..5ae5e4e4f --- /dev/null +++ b/tests/shadow-actor.test.js @@ -0,0 +1,83 @@ +'use strict'; + +/* + * Who opened this shop, and did they choose to. + * + * Two separate things are recorded when somebody arrives through a shadow link, + * and both have been wrong in a way nobody could see. + * + * WHO. The shop decided owner-versus-support by exact-matching a sentence: + * + * claims.reason === 'owner sign-in from posnic.com' + * + * Rewording that sentence in web-api, a different repository that deploys on + * its own, would have silently reclassified every owner sign-in as support and + * stopped recording any of them. Nothing would have failed. The console would + * simply have started saying that customers never open their shops. + * + * WHY. Signing up now opens the shop for you, and that writes an activity row + * like any other session. Without a mark on it, "has this customer opened their + * shop" answers yes for everybody the instant they sign up, and stops measuring + * anything. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..'); +const controller = fs.readFileSync( + path.join(ROOT, 'api', 'src', 'controllers', 'shadow-login.controller.js'), 'utf8'); +const baseModel = fs.readFileSync( + path.join(ROOT, 'api', 'src', 'models', 'base.model.js'), 'utf8'); + +test('the owner is identified by a signed claim, not by a sentence', () => { + assert.match(controller, /claims\.actor === 'owner'/, + 'the actor is still inferred from prose, so rewording it breaks recording silently'); +}); + +test('a token from an older web-api is still honoured', () => { + /* + * These deploy separately. Tokens minted before the claim existed are in + * flight for sixty seconds, and an older web-api may run for longer than + * that, so the sentence stays accepted as a fallback. + */ + assert.match(controller, /claims\.reason === 'owner sign-in from posnic\.com'/, + 'dropping the old check strands tokens minted by a web-api that has not deployed yet'); +}); + +test('support sign-ins are still not recorded as the shop being used', () => { + /* + * The rule the owner asked for originally: our staff opening a shop to help + * must never look like the customer using it. + */ + assert.match(controller, /if \(shadowActor === 'owner'\)/, + 'the activity log is written for every shadow session, including support'); +}); + +test('the automatic open at signup is marked', () => { + assert.match(controller, /source: claims\.from === 'signup' \? 'signup' : 'owner_link'/, + 'the shop cannot tell an open we performed from one the customer chose'); +}); + +test('an ordinary sign-in carries no source, and the field is bounded', () => { + /* + * Most rows are ordinary logins and need no field. And a value arriving from + * a token is still input, however signed: it is trimmed rather than trusted + * to be short. + */ + const doc = baseModel.slice(baseModel.indexOf('const document = {'), + baseModel.indexOf('const insertResult')); + assert.match(doc, /\.\.\.\(reqInfo\.source \? \{ source:/, + 'every activity row would carry the field, including the millions that do not need it'); + assert.match(doc, /String\(reqInfo\.source\)\.slice\(0, 32\)/, + 'an unbounded string from a token is written straight into every shop'); +}); + +test('the shadow token record keeps why it was minted', () => { + /* So a question about one session can be answered from the shop's own + records rather than from a log on our side. */ + assert.match(controller, /from: claims\.from \|\| null,/, + 'the redeemed-token record does not say what kind of open it was'); +}); diff --git a/tests/shutdown-speed.test.js b/tests/shutdown-speed.test.js index 62b7a8087..76abfedac 100644 --- a/tests/shutdown-speed.test.js +++ b/tests/shutdown-speed.test.js @@ -37,7 +37,7 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8').replace(/\r\n/g, '\n'); -const MANAGER = read('mongodb-manager.js'); +const MANAGER = read('src/mongodb-manager.js'); const STOP = MANAGER.slice(MANAGER.indexOf('async stop()')); test('the shutdown connects with the credentials the application uses', () => { @@ -99,7 +99,7 @@ test('the shutdown budget still leaves room for the force exit', () => { the per-step budget ever exceeds the total, the force exit fires first and kills mongod mid-write - the exact thing the clean shutdown exists to avoid. */ - const MAIN = read('main.js'); + const MAIN = read('src/main.js'); const block = MAIN.slice(MAIN.indexOf('const SHUTDOWN_TIMEOUTS')); const budget = block.slice(0, block.indexOf('});')); diff --git a/tests/shutdown-ux.test.js b/tests/shutdown-ux.test.js index be1206666..2014ffc6a 100644 --- a/tests/shutdown-ux.test.js +++ b/tests/shutdown-ux.test.js @@ -27,9 +27,9 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8').replace(/\r\n/g, '\n'); -const MAIN = read('main.js'); -const SPLASH = read('splash.js'); -const state = require('../shutdown-state'); +const MAIN = read('src/main.js'); +const SPLASH = read('src/splash.js'); +const state = require('../src/shutdown-state'); // ── The note left for the next launch ─────────────────────────────────────── diff --git a/tests/software-metadata.test.js b/tests/software-metadata.test.js new file mode 100644 index 000000000..00e297081 --- /dev/null +++ b/tests/software-metadata.test.js @@ -0,0 +1,66 @@ +const test = require('node:test'); +const assert = require('node:assert/strict'); +const fs = require('node:fs'); +const path = require('node:path'); + +const ROOT = path.join(__dirname, '..'); +const metadata = JSON.parse(fs.readFileSync(path.join(ROOT, 'codemeta.json'), 'utf8')); +const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')); +const readme = fs.readFileSync(path.join(ROOT, 'README.md'), 'utf8'); + +test('CodeMeta declares a current SoftwareSourceCode identity', () => { + assert.equal(metadata['@context'], 'https://w3id.org/codemeta/3.0'); + assert.equal(metadata['@type'], 'SoftwareSourceCode'); + assert.equal(metadata['@id'], 'https://github.com/Posnic/POS'); + assert.equal(metadata.name, 'Posnic POS'); + assert.match(metadata.description, /point-of-sale software/i); + assert.match(metadata.description, /AGPL-3\.0-only/i); + assert.match(metadata.description, /separately licensed components/i); + assert.equal(metadata.version, pkg.version); + assert.equal(metadata.softwareVersion, pkg.version); + assert.deepEqual(metadata.keywords, pkg.keywords); +}); + +test('CodeMeta keeps source, support and licence identity canonical', () => { + assert.equal(metadata.url, pkg.homepage); + assert.equal(metadata.codeRepository, 'https://github.com/Posnic/POS'); + assert.equal(metadata.issueTracker, pkg.bugs.url); + assert.equal(metadata.license, 'https://spdx.org/licenses/AGPL-3.0-only.html'); + assert.equal(metadata.readme, 'https://github.com/Posnic/POS/blob/main/README.md'); + assert.equal( + metadata.continuousIntegration, + 'https://github.com/Posnic/POS/actions', + ); + assert.equal(metadata.author?.name, 'Posnic Innovations Private Limited'); + assert.equal(metadata.author?.url, 'https://posnic.com/about'); + assert.equal(metadata.publisher?.name, metadata.author?.name); +}); + +test('CodeMeta identifies point-of-sale scope without promoting development as released', () => { + assert.equal(metadata.applicationSubCategory, 'Point of sale software'); + assert.deepEqual(metadata.operatingSystem, ['Windows', 'macOS', 'Linux']); + assert.deepEqual(metadata.runtimePlatform, ['Electron', 'Node.js', 'MongoDB']); + assert.equal(metadata.isSourceCodeOf?.['@type'], 'SoftwareApplication'); + assert.equal(metadata.isSourceCodeOf?.name, 'Posnic POS'); + assert.equal(metadata.isSourceCodeOf?.url, 'https://posnic.io/'); + assert.match(metadata.developmentStatus, /active development/i); + assert.match(metadata.developmentStatus, /not a tagged release/i); + assert.doesNotMatch(JSON.stringify(metadata), /aggregateRating|reviewRating|customer count/i); +}); + +test('public repository discovery surfaces both machine-readable metadata files', () => { + assert.match(readme, /\[CodeMeta metadata\]\(codemeta\.json\)/); + assert.match(readme, /\[Citation metadata\]\(CITATION\.cff\)/); + assert.ok(metadata.citation.includes( + 'https://github.com/Posnic/POS/blob/main/CITATION.cff', + )); + assert.ok(metadata.relatedLink.includes( + 'https://github.com/Posnic/POS/blob/main/docs/ADOPTION_EVIDENCE.md', + )); + assert.ok(metadata.relatedLink.includes( + 'https://github.com/Posnic/POS/blob/main/docs/PRIVACY.md', + )); + assert.ok(metadata.relatedLink.includes( + 'https://github.com/Posnic/POS/blob/main/docs/GOVERNANCE.md', + )); +}); diff --git a/tests/splash.test.js b/tests/splash.test.js index dab48de2d..796b09e93 100644 --- a/tests/splash.test.js +++ b/tests/splash.test.js @@ -20,9 +20,9 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8').replace(/\r\n/g, '\n'); -const MAIN = read('main.js'); -const SPLASH = read('splash.js'); -const splash = require('../splash'); +const MAIN = read('src/main.js'); +const SPLASH = read('src/splash.js'); +const splash = require('../src/splash'); const pkg = require('../package.json'); test('it can be loaded without Electron', () => { @@ -105,7 +105,7 @@ test('the progress bar does not claim to measure anything', () => { }); test('it ships', () => { - assert.ok(pkg.build.files.includes('splash.js'), 'splash.js is missing from build.files'); + assert.ok(pkg.build.files.includes('src/splash.js'), 'splash.js is missing from build.files'); }); test('the mark it draws is actually packaged', () => { diff --git a/tests/sso-website-login.test.js b/tests/sso-website-login.test.js new file mode 100644 index 000000000..37b14c5fd --- /dev/null +++ b/tests/sso-website-login.test.js @@ -0,0 +1,151 @@ +'use strict'; + +/* + * "Go to website" stops depending on a machine that no longer exists. + * + * The till's account menu offers a jump to the owner's posnic.com account, + * already signed in, so nobody has to remember a password last typed at + * signup. It worked by posting to `api.posnic.com/user.php?action=ssoToken` - + * a PHP script on a separate box. + * + * That box was deleted on 2026-08-29, and the button had already been failing + * before then: the origin stopped answering HTTPS, so Cloudflare returned 522 + * to everyone. Five presses in the last fifteen days of retained logs, each of + * which did nothing. + * + * Rebuilt against the website's own Node service. These tests pin the parts + * that would rot quietly rather than loudly. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const controller = fs.readFileSync( + path.join(__dirname, '..', 'api', 'src', 'controllers', 'users.controller.js'), + 'utf8' +); + +/* Just the ssoClientLogin method. */ +function ssoMethod() { + const start = controller.indexOf('async ssoClientLogin(req, res)'); + assert.notStrictEqual(start, -1, 'ssoClientLogin is gone'); + const end = controller.indexOf('\n }', controller.indexOf('catch (error)', start)); + return controller.slice(start, end); +} + +test('nothing points at the PHP endpoint any more', () => { + /* Comments stripped first: the fix explains the old bug by naming it, and a + guard that reads prose fails on its own documentation. */ + const body = ssoMethod() + .replace(/\/\*[\s\S]*?\*\//g, '') + .replace(/^\s*\/\/.*$/gm, ''); + assert.ok(!/user\.php/.test(body), + 'still calling user.php - that script and the machine serving it are gone'); + assert.ok(!/api\.posnic\.com/.test(body), + 'still naming api.posnic.com, whose DNS record points at a released IP'); +}); + +test('it calls the website, and the website is configurable', () => { + const body = ssoMethod(); + assert.match(body, /\/api\/sso\/token/, 'must mint against the website service'); + assert.match(body, /POSNIC_SITE_URL/, + 'the site base must be overridable - dev work should not hit production'); + assert.match(body, /process\.env\.SSO_URL/, + 'the explicit override must survive, it is how a local website is tested'); +}); + +test('the returned link has exactly one slash before ssoauth', () => { + /* + * The old line joined 'https://www.posnic.com/' to '/ssoauth.html' and put a + * double slash in every link it ever produced. It happened to work; it + * should not be reintroduced by someone tidying the base URL. + */ + const body = ssoMethod(); + const m = body.match(/const path = `([^`]+)`/); + assert.ok(m, 'the redirect path is no longer a template literal - check it by hand'); + assert.ok(!m[1].includes('//ssoauth'), 'double slash is back in the SSO link'); + assert.match(m[1], /\$\{siteBase\}\/api\/sso\/auth\?token=/, + 'the link must use the /api prefix - CloudFront forwards only that to the service, ' + + 'and a bare /ssoauth answers 403 from the CDN exactly as /ssoauth.html did'); +}); + +test('the website answers the consume route under /api too', (t) => { + if (!fs.existsSync(WEB_API)) { t.skip('web-api is not checked out beside this repo'); return; } + const server = fs.readFileSync(WEB_API, 'utf8'); + assert.match(server, /app\.get\('\/api\/sso\/auth', ssoConsume\)/, + 'without the /api route the token can be minted but never used through the CDN'); +}); + +test('the token is url-encoded into the link', () => { + const body = ssoMethod(); + assert.match(body, /encodeURIComponent\(response\.data\.data\.token\)/, + 'a raw token in a query string breaks on the first token containing +'); +}); + +test('the request cannot hang forever', () => { + /* Without a timeout, a website that accepts the connection and never answers + holds the till's request open until something else gives up. */ + const body = ssoMethod(); + assert.match(body, /timeout: \d+/, 'the outbound SSO call needs a timeout'); +}); + +/* --------------------------------------------------------- the website side --- */ + +const WEB_API = path.join(__dirname, '..', '..', 'web-api', 'server.js'); + +test('the website mints and consumes the token safely', (t) => { + if (!fs.existsSync(WEB_API)) { + t.skip('web-api is not checked out beside this repo'); + return; + } + const server = fs.readFileSync(WEB_API, 'utf8'); + + assert.match(server, /app\.post\('\/api\/sso\/token'/, 'mint endpoint missing'); + assert.match(server, /app\.get\('\/ssoauth'/, 'consume route missing'); + + /* Single use, and atomically so - reading then writing would let two clicks + on the same link both succeed. */ + assert.match(server, /findOneAndUpdate\(\s*\{ tokenHash, usedAt: null, expiresAt: \{ \$gt: new Date\(\) \} \}/, + 'the token must be claimed atomically on an unused, unexpired row'); + + /* Stored hashed, for the same reason passwords are. */ + assert.match(server, /tokenHash: crypto\.createHash\('sha256'\)/, + 'the token must be stored hashed, not in the clear'); + + /* The shop key gates minting; without that check any caller could mint a + session for any account. */ + assert.match(server, /key !== process\.env\.POSNIC_KEY \|\| secret !== process\.env\.POSNIC_SECRET/, + 'minting must be gated on the shop key'); + + /* An unset key must not become "no key required". */ + assert.match(server, /!process\.env\.POSNIC_KEY \|\| !process\.env\.POSNIC_SECRET/, + 'an unset POSNIC_KEY must refuse, not allow'); + + /* The session is set from the stored userId, never from what the caller + asked for - otherwise the mint call chooses who you become. */ + assert.match(server, /req\.session\.uid = String\(u\._id\)/); + assert.match(server, /findOne\(\{ _id: row\.userId \}\)/, + 'the account must come from the token record, not the request'); +}); + +test('the SSO routes forbid caching', (t) => { + /* + * posnic.com sits behind CloudFront, and it demonstrably caches on this + * path: a 404 served before the route existed was still being returned + * afterwards, and only a cache-busting parameter got through. + * + * A cached 404 is confusing. A cached redirect carrying Set-Cookie would + * hand one person's session to whoever asked next, which is why this is + * stated explicitly rather than left to the CDN's default handling. + */ + if (!fs.existsSync(WEB_API)) { t.skip('web-api is not checked out beside this repo'); return; } + const server = fs.readFileSync(WEB_API, 'utf8'); + assert.match(server, /Cache-Control', 'no-store/, + 'the SSO routes must send no-store'); + const mint = server.indexOf("app.post('/api/sso/token'"); + const consume = server.indexOf('const ssoConsume = async'); + assert.match(server.slice(mint, mint + 200), /noStore\(res\)/, 'mint must not be cacheable'); + assert.match(server.slice(consume, consume + 200), /noStore\(res\)/, 'consume must not be cacheable'); +}); diff --git a/tests/startup-auth.test.js b/tests/startup-auth.test.js index dba5af824..2747c2de8 100644 --- a/tests/startup-auth.test.js +++ b/tests/startup-auth.test.js @@ -5,7 +5,7 @@ const { hasUnexpiredAuthCookie, validateSavedLogin, clearStaleLogin -} = require('../startup-auth'); +} = require('../src/startup-auth'); function startVerifyServer(statusCode, inspectRequest = () => {}) { return new Promise(resolve => { diff --git a/tests/startup-loading-race.test.js b/tests/startup-loading-race.test.js index 084ea7253..1c913041b 100644 --- a/tests/startup-loading-race.test.js +++ b/tests/startup-loading-race.test.js @@ -32,7 +32,7 @@ const assert = require('node:assert'); const fs = require('fs'); const path = require('path'); -const MAIN = fs.readFileSync(path.join(__dirname, '..', 'main.js'), 'utf8'); +const MAIN = fs.readFileSync(path.join(__dirname, '..', 'src', 'main.js'), 'utf8'); test('the loading screen stands down while the interface is loading', () => { /* The timer's only guard was isVisible(), and a page that is still loading is @@ -129,7 +129,7 @@ test('an aborted navigation is still not treated as a failure', () => { test('the loading screen is a real file, since the timer loads it', () => { assert.ok( - fs.existsSync(path.join(__dirname, '..', 'loading.html')), + fs.existsSync(path.join(__dirname, '..', 'src', 'loading.html')), 'loading.html has gone but the startup timer still loads it', ); }); diff --git a/tests/support-log-path.test.js b/tests/support-log-path.test.js index 2e564ca9b..aa899021c 100644 --- a/tests/support-log-path.test.js +++ b/tests/support-log-path.test.js @@ -20,7 +20,7 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8'); -const DOCS = ['SUPPORT.md', 'CONTRIBUTING.md', 'docs/DEVELOPMENT.md', 'docs/USER_GUIDE.md']; +const DOCS = ['.github/SUPPORT.md', '.github/CONTRIBUTING.md', 'docs/DEVELOPMENT.md', 'docs/USER_GUIDE.md']; /* * Electron's userData is %APPDATA%\<name> on Windows, @@ -30,7 +30,7 @@ const DOCS = ['SUPPORT.md', 'CONTRIBUTING.md', 'docs/DEVELOPMENT.md', 'docs/USER const APP_NAME = require(path.join(ROOT, 'package.json')).name; test('main.js still writes the log directly under userData', () => { - const main = read('main.js'); + const main = read('src/main.js'); assert.match( main, /const LOG_FILE = path\.join\(app\.getPath\('userData'\), 'app\.log'\)/, diff --git a/tests/theme-contrast.test.js b/tests/theme-contrast.test.js index e14cd9e1a..24b9afe09 100644 --- a/tests/theme-contrast.test.js +++ b/tests/theme-contrast.test.js @@ -3,7 +3,7 @@ const assert = require('node:assert'); const fs = require('fs'); const path = require('path'); -const { contrast } = require('../window-chrome'); +const { contrast } = require('../src/window-chrome'); /* * Every theme, checked for the combinations nobody can read. diff --git a/tests/theme-font-default.test.js b/tests/theme-font-default.test.js new file mode 100644 index 000000000..4e2741aaf --- /dev/null +++ b/tests/theme-font-default.test.js @@ -0,0 +1,98 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { blockAt, stripComments } = require('./helpers/source-lookup'); + +/* + * The font a shop gets before it has chosen anything. + * + * Owner report, twice: "default theme font getting applied after i go to theme + * page and apply default theme. otherwise by default its not getting applied." + * + * The font was never missing. It was being CHANGED. theme-variables.css ships + * a DM Sans / system stack at weight 400; themeManager wrote out its own copy + * of that default - 'Mukta Vaani' at weight 300 - and the two had drifted a + * whole typeface apart. So a fresh login rendered with the stylesheet's font, + * and pressing Default in the picker replaced it with the JS one. + * + * Two defaults for one thing is the bug. Nobody can see both at once. + */ + +const ROOT = path.join(__dirname, '..'); +const themeJs = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'script', 'js', 'core', 'themeManager.js'), + 'utf8', +); +const css = fs.readFileSync( + path.join(ROOT, 'frontend', 'static', 'style', 'css', 'theme-variables.css'), + 'utf8', +); + +const cssVar = (name) => { + const m = css.match(new RegExp('--' + name + ':\s*([^;]+);')); + assert.ok(m, `--${name} is not declared in theme-variables.css`); + return m[1].trim(); +}; + +test('the shipped font is read from the stylesheet, not restated', () => { + /* One source of truth. Whoever edits the CSS should not have to know this + file exists. */ + assert.match(themeJs, /readShippedFont: function/, 'nothing reads the stylesheet'); + const fn = blockAt(stripComments(themeJs), 'readShippedFont: function ()'); + for (const v of ['--theme-font-family', '--theme-font-weight', '--theme-font-size-base']) { + assert.ok(fn.includes(v), `${v} is not read back`); + } +}); + +test('it runs before any default can be read', () => { + /* Reading it after the first applyTheme would leave the first paint on the + stale value, which is the entire complaint. */ + const init = blockAt(stripComments(themeJs), 'init: function()'); + const at = init.indexOf('readShippedFont()'); + assert.notStrictEqual(at, -1, 'init never reads the shipped font'); + assert.ok(at < init.indexOf('applyTheme'), 'the font is read after the theme is applied'); +}); + +test('the hard-coded fallback agrees with the stylesheet', () => { + /* + * It only applies when the stylesheet failed to load - but if it disagrees, + * that rare case reintroduces exactly this bug, and nobody would be looking. + */ + const defaults = blockAt(stripComments(themeJs), 'defaults: {'); + + const cssFamily = cssVar('theme-font-family'); + const firstFace = cssFamily.split(',')[0].trim(); + assert.ok( + defaults.includes(firstFace), + `the JS fallback does not start with ${firstFace}, which the stylesheet ships`, + ); + + const cssWeight = cssVar('theme-font-weight'); + assert.match( + defaults, + new RegExp("fontWeight: '" + cssWeight + "'"), + `the JS fallback weight disagrees with the stylesheet's ${cssWeight}`, + ); +}); + +test('Mukta Vaani is no longer the JS default', () => { + /* The specific value that was overwriting the shipped font. It survives in + the CSS stack as a late fallback, which is correct - it must simply not be + what the picker writes as "default". */ + const defaults = blockAt(stripComments(themeJs), 'defaults: {'); + assert.doesNotMatch(defaults, /fontFamily: "'Mukta Vaani'/); +}); + +test('a stylesheet that cannot be read does not break the theme', () => { + const fn = blockAt(stripComments(themeJs), 'readShippedFont: function ()'); + assert.match(fn, /try \{/, 'the read is unguarded'); + assert.match(fn, /catch/, 'a failure would throw out of init'); +}); + +test('the size is stored without its unit', () => { + /* CSS declares 16px; the manager stores '16' and re-adds the unit from + tokenMap. Storing '16px' would produce '16pxpx'. */ + const fn = blockAt(stripComments(themeJs), 'readShippedFont: function ()'); + assert.match(fn, /parseInt\(size, 10\)/); +}); diff --git a/tests/till-shortcuts.test.js b/tests/till-shortcuts.test.js index 6fcf1c906..d11963bc5 100644 --- a/tests/till-shortcuts.test.js +++ b/tests/till-shortcuts.test.js @@ -100,7 +100,7 @@ test('the keys the shell claims are not also claimed by the page', () => { * desktop while still working in a browser - which is the kind of difference * that gets reported as "the shortcut works on my laptop". */ - const main = fs.readFileSync(path.join(__dirname, '..', 'main.js'), 'utf8'); + const main = fs.readFileSync(path.join(__dirname, '..', 'src', 'main.js'), 'utf8'); const shellKeys = [...main.matchAll(/accelerator: 'CmdOrCtrl\+([A-Z])'/g)] .map((m) => 'ctrl+' + m[1].toLowerCase()); diff --git a/tests/tools/check-translations.js b/tests/tools/check-translations.js new file mode 100755 index 000000000..2e8096e0c --- /dev/null +++ b/tests/tools/check-translations.js @@ -0,0 +1,217 @@ +#!/usr/bin/env node +'use strict'; + +/* + * Is every language file safe to ship? + * + * Written for a first-time contributor, so every failure says what is wrong, + * where, and what to do about it. A check that prints a stack trace at somebody + * offering their first pull request is a check that loses the contributor. + * + * Run: node tests/tools/check-translations.js + * + * Exits non-zero if anything here would reach a shopkeeper's screen broken. + */ + +const fs = require('fs'); +const path = require('path'); + +const LANG_DIR = path.resolve(__dirname, '..', '..', 'languages'); +const CONFIG = path.resolve(__dirname, '..', '..', 'frontend', 'gulpfile.js', 'config.js'); + +/* Kept identical to PosnicPro.i18n._allowedTags - the runtime enforces the + same list, and a contributor should be told here rather than discover it + as words that silently vanished. */ +const ALLOWED_TAGS = ['span', 'i', 'b', 'strong', 'em', 'small', 'br', 'u']; + +const problems = []; +const notes = []; +const fail = (file, what, fix) => problems.push({ file, what, fix }); + +/* ------------------------------------------------------------- the files --- */ + +let files = []; +try { + files = fs.readdirSync(LANG_DIR) + .filter((f) => f.endsWith('.json')) + /* _glossary.json is the source the packs are seeded from, not a pack: its + values are objects of languages, not strings. Underscore means "not a + language file" so a future sibling needs no change here. */ + .filter((f) => !f.startsWith('_')); +} catch (e) { + console.error(`Cannot read ${LANG_DIR}: ${e.message}`); + process.exit(1); +} + +if (!files.length) { + console.error('No language files found. That cannot be right.'); + process.exit(1); +} + +/* + * Mojibake: UTF-8 bytes decoded as Latin-1 or cp1252 and saved back. + * + * The single most important check here, because it is the one a reviewer + * cannot do. Nine Tamil strings shipped to the sale screen this way and were + * live for months. cp1252 matters as well as Latin-1: bytes 0x80-0x9F become + * punctuation like U+2021, so a Latin-1-only test misses half of it. + */ +const CP1252 = { + 0x20AC: 1, 0x201A: 1, 0x0192: 1, 0x201E: 1, 0x2026: 1, 0x2020: 1, 0x2021: 1, + 0x02C6: 1, 0x2030: 1, 0x0160: 1, 0x2039: 1, 0x0152: 1, 0x017D: 1, 0x2018: 1, + 0x2019: 1, 0x201C: 1, 0x201D: 1, 0x2022: 1, 0x2013: 1, 0x2014: 1, 0x02DC: 1, + 0x2122: 1, 0x0161: 1, 0x203A: 1, 0x0153: 1, 0x017E: 1, 0x0178: 1, +}; +function looksLikeMojibake(text) { + let run = 0; + for (const ch of String(text)) { + const c = ch.charCodeAt(0); + const suspicious = (c >= 0x80 && c <= 0xFF) || CP1252[c]; + run = suspicious ? run + 1 : 0; + if (run >= 3) return true; + } + return false; +} + +for (const file of files) { + const full = path.join(LANG_DIR, file); + const code = file.replace(/\.json$/, ''); + const raw = fs.readFileSync(full, 'utf8'); + + if (!/^[a-z]{2}(-[A-Za-z]{2,4})?$/.test(code)) { + fail(file, `"${code}" is not a language code`, + 'Name the file after the language: hi.json, ta.json, pt-BR.json.'); + continue; + } + + /* A BOM makes JSON.parse throw with a message that helps nobody. */ + if (raw.charCodeAt(0) === 0xFEFF) { + fail(file, 'starts with a byte-order mark', + 'Save as "UTF-8" rather than "UTF-8 with BOM".'); + } + + let dict; + try { + dict = JSON.parse(raw.replace(/^/, '')); + } catch (e) { + fail(file, `is not valid JSON - ${e.message}`, + 'A missing comma or a trailing one. Most editors will point at the line.'); + continue; + } + + if (Array.isArray(dict) || typeof dict !== 'object' || dict === null) { + fail(file, 'is not a set of key/value pairs', + 'The file should look like { "lang_save_title": "..." }.'); + continue; + } + + let empty = 0; + for (const [key, value] of Object.entries(dict)) { + if (typeof value !== 'string') { + fail(file, `${key} is a ${Array.isArray(value) ? 'list' : typeof value}, not text`, + 'Every translation is a plain string.'); + continue; + } + if (!value.trim()) { empty += 1; continue; } + if (looksLikeMojibake(value)) { + fail(file, `${key} looks like mojibake: ${value.slice(0, 30)}`, + 'The file was saved in the wrong encoding. Save it as UTF-8 and redo ' + + 'that entry. If your editor offers ANSI or Western, do not use it.'); + } + if (/^\s|\s$/.test(value)) { + notes.push(`${file}: ${key} has a leading or trailing space`); + } + /* + * A tag in a translation is a script in a shop. + * + * These files are pull requests from strangers now, reviewed by somebody + * who by definition cannot read the language: `<img src=x onerror=...>` + * inside a Malayalam string looks exactly like Malayalam. The runtime no + * longer treats a tag as markup, and this refuses it a second time, at the + * gate, so a pack carrying one never reaches a build. + */ + /* + * A few strings legitimately carry an icon or the <span> the app rewrites + * later, so markup is not banned outright - but a translation is a pull + * request from somebody whose language the reviewer cannot read, and + * `<img src=x onerror=...>` looks exactly like Malayalam to them. + * + * The runtime sanitises to this same allowlist, so nothing dangerous + * reaches a shop either way. This is the half that says so out loud, to + * the contributor, before a maintainer has to notice. + * + * ">" alone is fine: Tamil writes a breadcrumb as "Manage > Features". + */ + for (const tag of value.match(/<\s*\/?\s*([a-zA-Z][a-zA-Z0-9]*)/g) || []) { + const name = tag.replace(/[<\/\s]/g, '').toLowerCase(); + if (!ALLOWED_TAGS.includes(name)) { + fail(file, `${key} contains a <${name}> tag`, + `Only ${ALLOWED_TAGS.join(', ')} are allowed, and only to carry an ` + + 'icon or a placeholder the app fills in. Everything else is removed ' + + 'before the words reach the screen, so it would not work anyway.'); + } + } + if (/\son\w+\s*=/i.test(value)) { + fail(file, `${key} contains an event handler`, + 'A translation is words. Remove the on... attribute.'); + } + } + if (empty) notes.push(`${file}: ${empty} entr(ies) are blank and will show English`); +} + +/* ------------------------------------------------- declared vs delivered --- */ + +try { + const config = fs.readFileSync(CONFIG, 'utf8'); + const block = /const LANGUAGES = \[([\s\S]*?)\n\];/.exec(config); + if (block) { + const declared = [...block[1].matchAll(/code:\s*'([^']+)'/g)].map((m) => m[1]); + const unreviewed = [...block[1].matchAll(/code:\s*'([^']+)'[^\n]*reviewed:\s*false/g)].map((m) => m[1]); + if (unreviewed.length) { + notes.push(`${unreviewed.length} language(s) ship marked beta until a speaker reviews ` + + `them: ${unreviewed.join(', ')}`); + } + for (const code of declared) { + if (code === 'en') continue; + if (!files.includes(`${code}.json`)) { + fail('config.js', `declares "${code}" but there is no languages/${code}.json`, + `Either add the file or remove the entry.`); + } + } + for (const file of files) { + const code = file.replace(/\.json$/, ''); + if (!declared.includes(code)) { + /* Not a failure: the file is harmless. But the app will not offer it, + which is almost certainly not what the contributor intended. */ + notes.push(`${file} exists but is not in LANGUAGES in config.js, ` + + 'so the app will not offer it in the language menu'); + } + } + } +} catch (e) { + notes.push(`could not read config.js: ${e.message}`); +} + +/* -------------------------------------------------------------- the word --- */ + +console.log(`Checked ${files.length} language file(s): ${files.join(', ')}`); + +for (const n of notes) console.log(` note: ${n}`); + +if (!problems.length) { + console.log(''); + console.log('All good.'); + process.exit(0); +} + +console.log(''); +console.log(`${problems.length} problem(s):`); +for (const p of problems) { + console.log(''); + console.log(` ${p.file}: ${p.what}`); + console.log(` -> ${p.fix}`); +} +console.log(''); +console.log('See docs/TRANSLATING.md. Ask on the issue if any of this is unclear -'); +console.log('an unclear error message is a bug in this check, not in your work.'); +process.exit(1); diff --git a/tests/tools/dead-selectors.js b/tests/tools/dead-selectors.js new file mode 100755 index 000000000..0b8dcb2b6 --- /dev/null +++ b/tests/tools/dead-selectors.js @@ -0,0 +1,152 @@ +#!/usr/bin/env node +'use strict'; + +/* + * Find jQuery selectors pointing at ids that do not exist. + * + * WHY THIS EXISTS + * + * The quotes list carried `$('#quotes_search').val()` after the shared filter + * bar replaced that input. It read '' forever, so the empty-state message told + * anyone whose SEARCH found nothing that they had never written a quote. A + * handler was bound to the same removed element and never fired. + * + * That is the worst shape of bug in this codebase: it does not throw, it does + * not log, and it reads as working code. `PosnicPro.<name>()` calls and unmapped + * modules already have repo guards for the same reason (queue #74, #75); this + * is the same idea one level down. + * + * WHY IT IS A TOOL AND NOT A TEST + * + * It cannot be trusted as a pass/fail gate yet. Ids built by string + * concatenation - `id="items_itemid_' + i + '"` - never appear as a literal, so + * the tool reports them as missing when they are fine. A guard with a hundred + * standing exceptions is one people learn to scroll past, which is worse than + * no guard at all. + * + * So: run it, read the list, verify case by case. Every one that turns out to + * be real gets fixed and pinned by a normal test. + * + * node tests/tools/dead-selectors.js # module files + * node tests/tools/dead-selectors.js --all # every script we own + * + * THE PART THAT *IS* A GATE + * + * All 110 were verified once (queue #110). The split that matters is not how + * many there are but what the code DOES with them: + * + * WRITE $('#gone').html(x) - jQuery no-ops on an empty set. Invisible, + * harmless, deletable at leisure. 101 of them. + * READ $('#gone').val() / .is(':checked') feeding a condition - always + * undefined or false, so a branch never runs or a value goes to the + * server missing. 9 of them, every one checked by hand. + * + * A hundred standing exceptions get scrolled past; nine do not. So the reads + * are pinned by dead-selector-reads.test.js, and analyse() is exported for it. + * + * HOW TO READ A HIT + * + * Search the whole repo for the bare id first. If it appears only inside + * `$('#id')`, nothing creates it and the selector matches nothing. If it appears + * in an HTML file or inside a JS string that builds markup, the hit is noise. + */ + +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..', '..'); +const FRONTEND = path.join(ROOT, 'frontend'); + +/* public/ holds BUILT bundles - the same source concatenated, so counting it + would make every id look defined by itself. plugins/ and vendor/ are not + ours to fix. */ +const SKIP = new Set(['public', 'plugins', 'vendor', 'node_modules']); + +function walk(dir, out = []) { + for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { + if (entry.isDirectory()) { + if (!SKIP.has(entry.name)) walk(path.join(dir, entry.name), out); + } else if (/\.(html|js|css|scss)$/.test(entry.name)) { + out.push(path.join(dir, entry.name)); + } + } + return out; +} + +const TOKEN = /[A-Za-z_][\w-]*/g; +/* + * `$('#id')` AND `$('#id .child')`. + * + * The first version required the quote to close immediately after the id, so a + * compound selector was invisible to it. That is not a rare shape: twenty + * modules read the sales page's date range as + * `$('#view_sales_daterange span span[data-toggle="tooltip"]')`, and when that + * element was removed during the filter-bar migration the sweep reported + * nothing at all - the reads that were about to start returning undefined were + * exactly the ones it could not see. + * + * The trailing part is not captured; only the id matters, because the id is + * what does or does not exist. + * + * The quote is captured and back-referenced rather than written as [^'"], for + * the same reason: attribute selectors carry the OTHER quote inside them, as in + * `$('#id span[data-toggle="tooltip"]')`. A class excluding both stops at that + * inner quote and the match fails - which is precisely how the example above + * stayed invisible on the first attempt at widening this. + */ +const SELECTOR = /\$\(\s*(['"])#([A-Za-z_][\w-]*)(?:[\s>+~.[][^\n]*?)?\1\s*\)/g; + +/* The analysis, without the printing - so the reads guard can use exactly the + same definition of "dead" that this tool reports. */ +function analyse({ all = false } = {}) { + const files = walk(FRONTEND); + + /* One pass. Counting every identifier token in every file, then comparing + against how many times it appeared as a selector, is the whole trick: an + id that appears ONLY as a selector is created by nothing. */ + const total = new Map(); + const asSelector = new Map(); + const hits = new Map(); + + for (const file of files) { + const src = fs.readFileSync(file, 'utf8'); + for (const t of src.match(TOKEN) || []) total.set(t, (total.get(t) || 0) + 1); + + const inScope = all + ? file.endsWith('.js') + : file.endsWith('.js') && file.includes(`${path.sep}modules${path.sep}`); + + for (const m of src.matchAll(SELECTOR)) { + /* [1] is the quote, back-referenced to close the string; [2] is the id. */ + const id = m[2]; + asSelector.set(id, (asSelector.get(id) || 0) + 1); + if (!inScope) continue; + const line = src.slice(0, m.index).split('\n').length; + if (!hits.has(id)) hits.set(id, []); + hits.get(id).push(`${path.relative(ROOT, file)}:${line}`); + } + } + + const dead = [...hits.entries()] + .filter(([id]) => total.get(id) === asSelector.get(id)) + .sort((a, b) => b[1].length - a[1].length); + + return { dead, examined: hits.size }; +} + +function main() { + const { dead, examined } = analyse({ all: process.argv.includes('--all') }); + + console.log(`selectors examined: ${examined}`); + console.log(`ids that appear ONLY as a selector: ${dead.length}\n`); + for (const [id, where] of dead) { + console.log(`#${id} (${where.length})`); + for (const w of where) console.log(` ${w}`); + } + console.log('\nVerify each before deleting - a dynamically built id is a false positive.'); +} + +module.exports = { analyse }; + +/* Only print when run directly - requiring it from the guard must stay silent. */ +if (require.main === module) main(); diff --git a/tests/tools/i18n-coverage.js b/tests/tools/i18n-coverage.js new file mode 100755 index 000000000..8d9e4d1c5 --- /dev/null +++ b/tests/tools/i18n-coverage.js @@ -0,0 +1,529 @@ +#!/usr/bin/env node +'use strict'; + +/* + * How complete is each language, really? + * + * Nobody could answer this. The build falls back to the English already inside + * the <lang> tag when a key is missing, which is the right behaviour - it is + * why a half-translated language is usable rather than broken - but it is also + * invisible. Tamil has been 88% translated for months and reads as finished. + * + * That invisibility is fine for a customer and useless for deciding whether a + * language is ready to ship. So this counts, out loud: + * + * - which keys the UI actually uses (unique <lang class="..."> in HTML) + * - which of those each language answers + * - which entries a language file carries that nothing uses + * + * The third number is the one that surprises people. ta.json carries 313 keys + * no screen references - 35% of the file - so asking a translator for "the + * whole file" asks for a third more work than the product has words. + * + * Run: node tests/tools/i18n-coverage.js + * node tests/tools/i18n-coverage.js --json (for CI) + * node tests/tools/i18n-coverage.js --missing ta + * + * Exits non-zero only with --min <pct>, so it can gate a release without + * failing every ordinary run. + * + * See Intranet docs/MULTI_LANGUAGE_ARCHITECTURE.md for where this is going. + */ + +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.resolve(__dirname, '..', '..', 'frontend'); +/* At the repository root, not under frontend/: a translator should find these + by looking at the project, not by knowing which build step reads them. */ +const LANG_DIR = path.resolve(__dirname, '..', '..', 'languages'); + +/* Output and build artefacts hold the SAME keys already substituted, so + counting them would double every number and, for public/, would count + translated text as if it were a source key. */ +const SKIP = /^(node_modules|public|dist|build|\.git)$/; + +function htmlFiles(dir, found = []) { + for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { + if (entry.isDirectory()) { + if (!SKIP.test(entry.name)) htmlFiles(path.join(dir, entry.name), found); + } else if (entry.name.endsWith('.html')) { + found.push(path.join(dir, entry.name)); + } + } + return found; +} + +function jsFiles(dir, found = []) { + for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { + if (entry.isDirectory()) { + if (!SKIP.test(entry.name)) jsFiles(path.join(dir, entry.name), found); + } else if (entry.name.endsWith('.js')) { + found.push(path.join(dir, entry.name)); + } + } + return found; +} + +/* + * The key list the product actually needs. + * + * Two sources, and both matter. The HTML carries <lang class="key">, and the + * JavaScript now carries PosnicPro.i18n.t('key', 'English') for the words it + * writes after the page is built. Counting only the HTML would report every + * key the JS uses as dead - and a cleanup acting on that would delete exactly + * the translations the sale screen depends on. + * + * A key used on six screens is one string to translate, not six, so this is a + * Set. + */ +/* Block comments, blanked rather than removed, so every offset a later + regex reports still points at the same place in the file. */ +function stripComments(src) { + return src.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, ' ')); +} + +function keysUsed() { + const used = new Set(); + /* key -> { english, where } so a translator can be handed the sentence and + the screen, not a list of identifiers. */ + const context = new Map(); + /* Markup indentation is not part of the sentence. A tag broken over three + lines gives back "Your shop was set up with one\n trade's sample", + which is unreadable in a worksheet and would be translated with the + whitespace baked in. */ + const tidy = (s) => String(s || '').replace(/\s+/g, ' ').trim(); + + const remember = (key, english, file) => { + used.add(key); + if (!context.has(key)) { + context.set(key, { english: tidy(english), where: new Set() }); + } + const c = context.get(key); + if (!c.english && english) c.english = tidy(english); + c.where.add(path.basename(file)); + }; + + let tags = 0; + for (const file of htmlFiles(ROOT)) { + const html = fs.readFileSync(file, 'utf8'); + for (const m of html.matchAll(/<lang class="([^"]+)">([\s\S]*?)<\/lang>/g)) { + remember(m[1], m[2], file); + tags += 1; + } + /* Keys the build hoisted onto <title> and <option>. */ + for (const m of html.matchAll(/data-t="([^"]+)"[^>]*>([^<]*)</g)) { + remember(m[1], m[2], file); + } + /* Attributes people read: placeholder="English" data-t-placeholder="key" + in the same tag, in either order. */ + for (const tag of html.matchAll(/<[a-zA-Z][^>]*>/g)) { + for (const m of tag[0].matchAll(/data-t-(placeholder|title|aria-label)="([^"]+)"/g)) { + const en = new RegExp('\\s' + m[1] + '="([^"]*)"').exec(tag[0]); + remember(m[2], en ? en[1] : '', file); + } + } + } + let calls = 0; + for (const file of jsFiles(path.join(ROOT, 'static', 'script'))) { + /* Block comments only, and only for the markup patterns below: a doc + comment that shows what a <lang> tag looks like is documentation, not + a string the app renders. Line comments are left alone because a + naive // strip eats https:// inside real string literals. */ + const js = stripComments(fs.readFileSync(file, 'utf8')); + for (const m of js.matchAll(/i18n\.t\(\s*'([^']+)'\s*,\s*'([^']*)'/g)) { + remember(m[1], m[2], file); + calls += 1; + } + /* A t() call with no English fallback still uses the key. */ + for (const m of js.matchAll(/i18n\.t\(\s*'([^']+)'\s*\)/g)) { + remember(m[1], '', file); + calls += 1; + } + /* Some config data carries its key beside the English - `label: 'Today', + t: 'lang_this_day'` - because resolving it where the object is built + would run before any pack exists. The render site does the asking, so + the key is used even though no t() call names it here. */ + for (const m of js.matchAll(/(?:label|title): '((?:[^'\\]|\\.)*)',\s*t: '([^']+)'/g)) { + remember(m[2], m[1], file); + } + for (const m of js.matchAll(/title: '((?:[^'\\]|\\.)*)',\s*titleKey: '([^']+)'/g)) { + remember(m[2], m[1], file); + } + /* JavaScript renders markup too - table headers, pills, receipt labels - + and the observer translates it, so its keys are keys the UI uses. */ + /* A key is a word. Anything else between those quotes is JavaScript + building the class from a variable; that site names its key in the + config the render site reads, and an earlier pattern counted it. */ + for (const m of js.matchAll(/<lang class="([A-Za-z0-9_-]+)">([^<]*)<\/lang>/g)) { + remember(m[1], m[2], file); + tags += 1; + } + for (const m of js.matchAll(/data-t="([A-Za-z0-9_-]+)"[^>]*>([^<']*)</g)) { + remember(m[1], m[2], file); + } + for (const tag of js.matchAll(/<[a-zA-Z][^<>']*>/g)) { + for (const m of tag[0].matchAll(/data-t-(placeholder|title|aria-label)="([^"]+)"/g)) { + const en = new RegExp('\\s' + m[1] + '="([^"]*)"').exec(tag[0]); + remember(m[2], en ? en[1] : '', file); + } + } + } + return { used, tags, calls, context }; +} + +function languages() { + try { + return fs.readdirSync(LANG_DIR) + .filter((f) => f.endsWith('.json')) + .map((f) => f.replace(/\.json$/, '')) + .sort(); + } catch { + return []; + } +} + +function report() { + const { used, tags, calls, context } = keysUsed(); + const rows = []; + for (const lang of languages()) { + let dict = {}; + try { + dict = JSON.parse(fs.readFileSync(path.join(LANG_DIR, `${lang}.json`), 'utf8')); + } catch (e) { + rows.push({ lang, error: e.message }); + continue; + } + const have = new Set(Object.keys(dict)); + /* A key present but empty is not translated. Falling for that would report + a language as finished because somebody generated the skeleton. */ + const answered = [...used].filter((k) => have.has(k) && String(dict[k]).trim() !== ''); + const missing = [...used].filter((k) => !answered.includes(k)).sort(); + const unused = [...have].filter((k) => !used.has(k)).sort(); + rows.push({ + lang, + entries: have.size, + needed: used.size, + translated: answered.length, + missing, + unused, + coverage: used.size ? Math.round((answered.length / used.size) * 100) : 0, + }); + } + return { needed: used.size, tags, calls, context, rows }; +} + +/* ------------------------------------------------------------------ cli --- */ + +function main() { +const args = process.argv.slice(2); +const flag = (name) => args.includes(name); +const value = (name) => (args.includes(name) ? args[args.indexOf(name) + 1] : null); + +const data = report(); + +if (flag('--json')) { + /* A Map stringifies to {} and a Set to {}, so the context would arrive empty + and every consumer would quietly see no English at all. */ + const plain = { ...data, context: {} }; + for (const [key, c] of data.context) { + plain.context[key] = { english: c.english, where: [...c.where] }; + } + console.log(JSON.stringify(plain, null, 2)); + process.exit(0); +} + +/* + * Write languages/_english.json - every key with the English the UI shows. + * + * The packs deliberately do not carry the English (it lives in the markup, and + * that is what makes a missing key fall back correctly). But anything editing a + * pack from outside this repo - the staff console's language editor - has no + * way to show a translator WHAT they are translating without it. + * + * Generated rather than hand-kept, and pinned by tests/i18n.test.js so it + * cannot drift: a stale map would show a translator the wrong English, which is + * a worse failure than not showing any. + */ +/* + * Record where every pack stands, so a test can refuse to let one slip. + * + * A flat floor ("every pack above 95%") is the wrong instrument while the + * UI is still being tagged faster than the packs are filled: it goes red + * for weeks and everybody learns to ignore it. A ratchet does not: each + * pack must stay at or above the point it last reached, and the baseline + * moves up when translations land. Run this after merging a pack. + */ +if (flag('--write-baseline')) { + const base = {}; + for (const r of data.rows) if (!r.error && !r.lang.startsWith('_')) base[r.lang] = r.coverage; + fs.writeFileSync(path.join(__dirname, '..', 'i18n-coverage-baseline.json'), + JSON.stringify(base, null, 2) + '\n'); + console.log('tests/i18n-coverage-baseline.json: ' + Object.entries(base).map(([k, v]) => k + ' ' + v + '%').join(', ')); + process.exit(0); +} + +if (flag('--write-english')) { + const en = {}; + for (const [key, c] of data.context) if (c.english) en[key] = c.english; + const sorted = {}; + for (const k of Object.keys(en).sort()) sorted[k] = en[k]; + fs.writeFileSync(path.join(LANG_DIR, '_english.json'), JSON.stringify(sorted, null, 2) + '\n'); + console.log(`languages/_english.json: ${Object.keys(sorted).length} keys`); + process.exit(0); +} + +const only = value('--missing'); +if (only) { + const row = data.rows.find((r) => r.lang === only); + if (!row) { + console.error(`no language file for "${only}" in ${LANG_DIR}`); + process.exit(1); + } + console.log(`${row.missing.length} key(s) the UI uses that ${only} does not answer:`); + for (const k of row.missing) console.log(' ' + k); + process.exit(0); +} + +/* + * Inconsistencies a non-speaker can find. + * + * Nobody who does not speak the language can say whether a translation is + * good. Two things are wrong regardless of the language, though, and both are + * mechanical: + * + * - the same English rendered two different ways, so the interface calls one + * thing by two names; + * - the same translation used for two different English meanings, which + * means at least one of them is the wrong word. + * + * The second is how "Edit" was found to be labelled "Edited". This narrows + * hundreds of strings down to a short list worth a speaker's attention - the + * searching is mechanical, the judgement is not. + * + * Long sentences are skipped: they legitimately differ between screens, and + * including them would bury the labels that matter in noise. + */ +const review = value('--review'); +if (review) { + const row = data.rows.find((r) => r.lang === review); + if (!row) { console.error(`no language file for "${review}"`); process.exit(1); } + const dict = JSON.parse(fs.readFileSync(path.join(LANG_DIR, `${review}.json`), 'utf8')); + + const byEnglish = new Map(); + const byTranslation = new Map(); + const add = (map, outer, inner, key) => { + if (!map.has(outer)) map.set(outer, new Map()); + if (!map.get(outer).has(inner)) map.get(outer).set(inner, []); + map.get(outer).get(inner).push(key); + }; + + for (const [key, c] of data.context) { + const en = (c.english || '').trim(); + const ta = dict[key]; + if (!en || typeof ta !== 'string' || !ta.trim()) continue; + if (en.split(/\s+/).length > 3) continue; + add(byEnglish, en.toLowerCase(), ta, key); + add(byTranslation, ta, en.toLowerCase(), key); + } + + const show = (title, why, map) => { + console.log(''); + console.log(' === ' + title + ' ==='); + console.log(' ' + why); + console.log(''); + let found = 0; + for (const [outer, inners] of [...map].sort()) { + if (inners.size < 2) continue; + found += 1; + console.log(' ' + outer); + for (const [inner, keys] of inners) { + console.log(' ' + inner.padEnd(34) + keys.slice(0, 2).join(', ')); + } + } + if (!found) console.log(' none'); + return found; + }; + + const a = show('same English, two translations', + 'the interface calling one thing by two names', byEnglish); + const b = show('same translation, two meanings', + 'at least one of them is the wrong word', byTranslation); + console.log(''); + console.log(` ${a + b} thing(s) worth a speaker's eye.`); + process.exit(0); +} + +/* + * A file to hand a translator. + * + * --missing prints identifiers, which is the wrong thing to give a person: + * nobody can translate "lang_conversion_factor_title" without knowing it says + * "Conversion factor" and sits on the item screen. This writes JSON with the + * English and the screen beside every blank, so it can be filled in and handed + * straight back - it is already the shape of a language file. + */ +/* + * Start a language that does not exist yet. + * + * --worksheet needs a language file to compare against, so the FIRST person to + * offer Hindi had nothing to begin with - the tool could describe how + * incomplete a language was but not how to start one. This writes a worksheet + * for every string in the product. + * + * Separate from --worksheet on purpose. A typo would otherwise silently + * generate a worksheet for a language nobody speaks, and the first sign of it + * would be a pull request adding languages/hj.json. + */ +const starting = value('--new'); +if (starting) { + if (!/^[a-z]{2}(-[A-Za-z]{2,4})?$/.test(starting)) { + console.error(`"${starting}" is not a language code. Use e.g. hi, ta, pt-BR.`); + process.exit(1); + } + if (fs.existsSync(path.join(LANG_DIR, `${starting}.json`))) { + console.error(`languages/${starting}.json already exists - use --worksheet ${starting}`); + process.exit(1); + } + const out = {}; + for (const key of [...data.context.keys()].sort()) { + const c = data.context.get(key); + out[key] = { + english: c.english, + screen: [...c.where].sort().slice(0, 3).join(', '), + [starting]: '', + }; + } + const file = value('--out') || `${starting}-to-translate.json`; + fs.writeFileSync(file, JSON.stringify(out, null, 2) + '\n', 'utf8'); + console.log(` ${Object.keys(out).length} string(s) written to ${file}`); + console.log(` Fill in the "${starting}" field on each - you do not have to do them all.`); + console.log(` Then: node tests/tools/i18n-coverage.js --merge ${starting} --out ${file}`); + console.log(` and add "${starting}" to LANGUAGES in frontend/gulpfile.js/config.js.`); + process.exit(0); +} + +const sheet = value('--worksheet'); +if (sheet) { + const row = data.rows.find((r) => r.lang === sheet); + if (!row) { + console.error(`no languages/${sheet}.json yet.`); + console.error(`To start that language: node tests/tools/i18n-coverage.js --new ${sheet}`); + process.exit(1); + } + const out = {}; + for (const key of row.missing) { + const c = data.context.get(key) || { english: '', where: new Set() }; + out[key] = { + english: c.english, + screen: [...c.where].sort().slice(0, 3).join(', '), + [sheet]: '', + }; + } + const file = value('--out') || `${sheet}-to-translate.json`; + fs.writeFileSync(file, JSON.stringify(out, null, 2) + '\n', 'utf8'); + console.log(` ${row.missing.length} string(s) written to ${file}`); + console.log(` Fill in the "${sheet}" field on each, then:`); + console.log(` node tests/tools/i18n-coverage.js --merge ${sheet} --out ${file}`); + process.exit(0); +} + +/* + * Take a filled-in worksheet back. + * + * Merging by hand is where a language file gets a duplicate key or loses its + * sort order. Blank entries are skipped rather than written, because an empty + * string counts as untranslated everywhere else and writing one would report + * the language as finished while showing the customer nothing. + */ +const merge = value('--merge'); +if (merge) { + const file = value('--out') || `${merge}-to-translate.json`; + if (!fs.existsSync(file)) { + console.error(`no worksheet at ${file}`); + process.exit(1); + } + const sheetData = JSON.parse(fs.readFileSync(file, 'utf8')); + const target = path.join(LANG_DIR, `${merge}.json`); + /* A brand-new language has no file yet - --new wrote only the worksheet, so + this is where the language actually starts existing. */ + const isNew = !fs.existsSync(target); + const dict = isNew ? {} : JSON.parse(fs.readFileSync(target, 'utf8')); + + let taken = 0; + let blank = 0; + const suspect = []; + for (const [key, entry] of Object.entries(sheetData)) { + const value_ = entry && typeof entry === 'object' ? entry[merge] : entry; + if (typeof value_ !== 'string' || value_.trim() === '') { blank += 1; continue; } + /* The same check the build applies: Latin-1 wreckage where the language + should be means the file was saved in the wrong encoding somewhere. */ + if (/[\u0080-\u00FF]{3,}/.test(value_)) { suspect.push(key); continue; } + dict[key] = value_.trim(); + taken += 1; + } + if (suspect.length) { + console.error(` REFUSING: ${suspect.length} entr(ies) look like mojibake: ${suspect.slice(0, 5).join(', ')}`); + console.error(' Save the worksheet as UTF-8 and try again.'); + process.exit(1); + } + const sorted = {}; + for (const k of Object.keys(dict).sort()) sorted[k] = dict[k]; + fs.writeFileSync(target, JSON.stringify(sorted, null, 2) + '\n', 'utf8'); + console.log(` ${isNew ? 'created' : 'merged into'} ${path.relative(process.cwd(), target)}` + + ` with ${taken} translation(s)` + (blank ? `, ${blank} left blank` : '')); + if (isNew) { + console.log(''); + console.log(` One more step: add { code: '${merge}', name: '<the language, written in` + + ` itself>', flag: '<icon>' }`); + console.log(' to LANGUAGES in frontend/gulpfile.js/config.js, or the app will not offer it.'); + } + console.log(' run this tool with no arguments to see the new coverage.'); + process.exit(0); +} + +console.log(''); +console.log(` The UI uses ${data.needed} distinct keys ` + + `(${data.tags} <lang> tags in HTML, ${data.calls} t() calls in JS).`); +console.log(' English is not listed: it lives in the markup, so it is always 100%.'); +console.log(''); +console.log(' language entries translated coverage unused'); +console.log(' ' + '-'.repeat(56)); +for (const r of data.rows) { + if (r.error) { + console.log(' ' + r.lang.padEnd(11) + 'could not be read: ' + r.error); + continue; + } + console.log(' ' + r.lang.padEnd(11) + + String(r.entries).padStart(7) + + String(r.translated + '/' + r.needed).padStart(13) + + String(r.coverage + '%').padStart(11) + + String(r.unused.length).padStart(9)); +} +console.log(''); +for (const r of data.rows) { + if (r.error) continue; + if (r.missing.length) { + console.log(` ${r.lang}: ${r.missing.length} untranslated, e.g. ${r.missing.slice(0, 4).join(', ')}`); + } + if (r.unused.length) { + console.log(` ${r.lang}: ${r.unused.length} entries nothing uses - dead weight a new language should not inherit`); + } +} +console.log(''); +console.log(' --missing <lang> lists them all; --json for CI.'); + +const min = value('--min'); +if (min) { + const short = data.rows.filter((r) => !r.error && r.coverage < Number(min)); + if (short.length) { + console.error(`\n FAILED: ${short.map((r) => `${r.lang} at ${r.coverage}%`).join(', ')} below ${min}%`); + process.exit(1); + } +} +} + +/* Required as a module by the frontend build (for index.json's coverage + numbers) and by the tests; run as a script by people and CI. */ +if (require.main === module) main(); +module.exports = { keysUsed, report, languages }; diff --git a/tests/tools/i18n-gaps.js b/tests/tools/i18n-gaps.js new file mode 100755 index 000000000..c64c8c1e6 --- /dev/null +++ b/tests/tools/i18n-gaps.js @@ -0,0 +1,123 @@ +#!/usr/bin/env node +'use strict'; +/* + * The English the packs cannot reach. + * + * A word on the screen is translatable only if it sits inside <lang>, carries + * data-t, or is an attribute marked data-t-<attr>. Everything else is English + * in every language - and it is invisible until somebody who chose Thai walks + * into a screen full of it. This lists it, per template, so the sweep can be + * ordered and so a test can hold the number down. + * + * node tests/tools/i18n-gaps.js per-file counts + * node tests/tools/i18n-gaps.js --list every string, per file + * node tests/tools/i18n-gaps.js --json for the test + * + * Pages left alone on purpose: the GSTR report tables (statutory column names + * matched against a government form), the server error pages, and the email + * body the API fills. + */ +const fs = require('fs'); +const path = require('path'); + +const FE = path.resolve(__dirname, '..', '..', 'frontend'); +const SKIP_FILE = [/^modules[\\/]report_gstr/, /^error-\d+\.html$/, /^error-email\.html$/, + /^customersMailPrint\.html$/, + /^index\.html$/]; // a redirect stub for search engines, as in i18n-tag.js +/* Their <title> is a published contract pinned by frontend-discovery-files. */ +const SEO_TITLE_PAGE = /^(index|login)\.html$/; +const SKIP_TEXT = /^[\s\d.,:;!?()\[\]{}%$₹#*+\-–—/|&'"«»…=<>_×]*$/; +const NOT_WORDS = (t) => !/[A-Za-z]{2,}/.test(t) + || /^\{\w+\}$/.test(t) // a merge token is data, not prose + || /\{\{|__\w+__|\$\{|<%|\bfunction\b|\bvar\b|=>/.test(t) + || /^[a-z_]+\.[a-z_]+/.test(t) + || /^(ctrl|alt|shift|cmd|esc|f\d+)(\s*\+\s*\S+)*$/i.test(t) + || /^View \S+ per page$/.test(t) + || /^[A-Z]{1,2}$/.test(t); + +function htmlFiles(dir, out = []) { + for (const e of fs.readdirSync(dir, { withFileTypes: true })) { + if (e.isDirectory()) { if (!/^(node_modules|public|static|gulpfile\.js)$/.test(e.name)) htmlFiles(path.join(dir, e.name), out); } + else if (e.name.endsWith('.html')) out.push(path.join(dir, e.name)); + } + return out; +} + + +/* An inline <script> in a page is scanned by nobody: this tool strips + <script> before it looks, and i18n-tag-js.js only walks + static/script/js. Three panels a shopkeeper reads lived in that gap - + the desktop card under the sign-in form, the boot watchdog, and the + desktop tools button. What those scripts BUILD is markup, so the + markup is what gets read here instead of thrown away. */ +const INLINE_SCRIPT = /<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi; +const MARKUP_RUN = />([^<>\'"{}();=]{2,})</g; // >text<, with no code punctuation in it +const ENTITY_ONLY = /^(&[a-z#0-9]+;|\s)+$/i; // × is a glyph, not the word "times" +const LANG_BLOCK = /<lang class="[^"]*">[\s\S]*?<\/lang>/g; +const inlineMarkup = (block) => { + let out = ''; + for (const script of block.matchAll(INLINE_SCRIPT)) { + const body = script[1].replace(LANG_BLOCK, ''); // already reachable + for (const run of body.matchAll(MARKUP_RUN)) { + if (!ENTITY_ONLY.test(run[1])) out += '<i>' + run[1] + '</i>'; + } + } + return out; +}; +function scan(file, rel) { + let html = fs.readFileSync(file, 'utf8') + .replace(/<textarea[\s\S]*?<\/textarea>/gi, '<textarea></textarea>') + .replace(/<!--[\s\S]*?-->/g, '') + .replace(/<script[\s\S]*?<\/script>/gi, (block) => inlineMarkup(block)) + .replace(/<style[\s\S]*?<\/style>/gi, '') + .replace(/ on[a-z]+="[^"]*"/gi, '') // an on* handler is code, and one of them holds a > + .replace(/<lang class="[^"]*">[\s\S]*?<\/lang>/g, '<lang></lang>') + .replace(/<(title|option)([^>]*data-t="[^"]*"[^>]*)>[^<]*<\/\1>/g, '<$1$2></$1>'); + if (rel && SEO_TITLE_PAGE.test(rel)) html = html.replace(/<title>[\s\S]*?<\/title>/i, '<title>'); + const found = []; + let m; + const text = />([^<]+)]*>/g; + while ((m = attrs.exec(html))) { + const tag = m[0]; + for (const attr of ['placeholder', 'title', 'aria-label']) { + const v = new RegExp('\\s' + attr + '="([^"]{2,})"').exec(tag); + if (!v || tag.includes(' data-t-' + attr + '=')) continue; + const raw = v[1].trim(); + if (SKIP_TEXT.test(raw) || NOT_WORDS(raw)) continue; + found.push({ kind: attr, text: raw }); + } + } + return found; +} + +function report() { + const rows = []; + for (const f of htmlFiles(FE)) { + const rel = path.relative(FE, f); + if (SKIP_FILE.some((re) => re.test(rel))) continue; + const found = scan(f, rel.replace(/\\/g, '/')); + if (found.length) rows.push({ file: rel.replace(/\\/g, '/'), found }); + } + rows.sort((a, b) => b.found.length - a.found.length); + const total = rows.reduce((n, r) => n + r.found.length, 0); + return { total, rows }; +} + +if (require.main === module) { + const data = report(); + if (process.argv.includes('--json')) { console.log(JSON.stringify(data, null, 1)); process.exit(0); } + if (process.argv.includes('--list')) { + for (const r of data.rows) { console.log('\n## ' + r.file); for (const x of r.found) console.log(' [' + x.kind + '] ' + x.text); } + } else { + console.log('file bare'); + for (const r of data.rows) console.log(r.file.padEnd(42) + String(r.found.length).padStart(4)); + } + console.log('\nbare English the packs cannot reach:', data.total); +} +module.exports = { report, scan }; diff --git a/tests/tools/i18n-load-time.js b/tests/tools/i18n-load-time.js new file mode 100755 index 000000000..686a251c7 --- /dev/null +++ b/tests/tools/i18n-load-time.js @@ -0,0 +1,111 @@ +#!/usr/bin/env node +'use strict'; +/* + * Which t() calls actually run when a module is merely LOADED? + * + * Guessing from braces is unreliable here: PosnicPro.js is one object literal + * thousands of lines long, stuffed with function-valued properties, and a + * hand-rolled scanner mis-pairs a brace somewhere and calls the dangerous + * lines safe. So do not guess - run the file and watch. + * + * Each t() is replaced by a probe that records itself and returns the English. + * The file is executed against a Proxy that answers every global (jQuery, the + * document, moment, Dexie...) with itself, so nothing else throws and no + * callback is ever invoked. Anything the probe records was evaluated while the + * file was loading - which for a literal means before its own object exists. + * + * node probe-load-time.js list them + * node probe-load-time.js --write revert those to plain English + */ +const fs = require('fs'); +const path = require('path'); +const vm = require('vm'); +const write = process.argv.includes('--write'); +const ROOT = path.resolve(__dirname, '..', '..', 'frontend', 'static', 'script', 'js'); +const DIRS = [path.join(ROOT, 'core'), path.join(ROOT, 'modules', 'js')]; + +function universalStub() { + const fn = function () { return proxy; }; + const proxy = new Proxy(fn, { + get(t, prop) { + if (prop === Symbol.toPrimitive) return () => ''; + /* .then/.catch must stay callable: modules chain on fetch() at load. + They return the stub, so no callback is ever actually invoked. */ + if (prop === Symbol.iterator) return function* () {}; + if (prop === 'length') return 0; + return proxy; + }, + set() { return true; }, + has() { return true; }, + apply() { return proxy; }, + construct() { return proxy; }, + }); + return proxy; +} + +let total = 0; +const report = []; +const sitesByFile = {}; +for (const dir of DIRS) { + for (const name of fs.readdirSync(dir).filter((f) => f.endsWith('.js'))) { + const file = path.join(dir, name); + const src = fs.readFileSync(file, 'utf8'); + const sites = []; + const re = /PosnicPro\.i18n\.t\('([^']+)',\s*'((?:[^'\\]|\\.)*)'\)/g; + let m; + let instrumented = ''; + let last = 0; + while ((m = re.exec(src))) { + sites.push({ index: m.index, whole: m[0], english: m[2], line: src.slice(0, m.index).split('\n').length }); + instrumented += src.slice(last, m.index) + '__probe(' + (sites.length - 1) + ")"; // returns the English + last = m.index + m[0].length; + } + instrumented += src.slice(last); + if (!sites.length) continue; + + const fired = new Set(); + const stub = universalStub(); + const sandbox = new Proxy({ + __probe: (n) => { fired.add(n); return sites[n].english; }, + console: { log() {}, warn() {}, error() {} }, + Math, Date, JSON, Object, Array, String, Number, Boolean, RegExp, Error, + Promise, Set, Map, parseInt, parseFloat, isNaN, encodeURIComponent, + decodeURIComponent, setTimeout: () => 0, setInterval: () => 0, + clearTimeout() {}, clearInterval() {}, + }, { + /* anything the file reaches for that we did not name is the stub, so a + missing global cannot end the run before the probes are reached */ + has: () => true, + get: (t, p) => (p in t ? t[p] : stub), + }); + + try { + vm.runInNewContext(instrumented, sandbox, { filename: name, timeout: 20000 }); + } catch (e) { + report.push(name.padEnd(26) + ' could not be probed: ' + String(e.message).slice(0, 70)); + continue; + } + if (!fired.size) continue; + total += fired.size; + sitesByFile[name] = list.map((n) => ({ line: sites[n].line, english: sites[n].english })); + const list = [...fired].sort((a, b) => a - b); + report.push(name.padEnd(26) + String(fired.size).padStart(4) + + ' lines ' + list.slice(0, 4).map((n) => sites[n].line).join(', ') + (list.length > 4 ? ', ...' : '')); + if (write) { + let out = src; + for (const n of list.slice().reverse()) { + const s = sites[n]; + out = out.slice(0, s.index) + "'" + s.english + "'" + out.slice(s.index + s.whole.length); + } + fs.writeFileSync(file, out, 'utf8'); + } + } +} +if (require.main === module) { + console.log(report.join('\n')); + console.log('\nt() calls that run at load:', total, + write ? '- reverted to plain English.' : '- dry run. Use --write.'); +} + +/* The test asks for the count; the command line prints the detail. */ +module.exports = { report, total, sitesByFile }; diff --git a/tests/tools/i18n-screen.js b/tests/tools/i18n-screen.js new file mode 100755 index 000000000..f4ff7d69e --- /dev/null +++ b/tests/tools/i18n-screen.js @@ -0,0 +1,96 @@ +#!/usr/bin/env node +'use strict'; +/* + * Which screens still read in English, and in which language. + * + * Coverage as one number per language answers "how much is done". It does not + * answer the question an owner actually asks, which is "I picked Tamil and the + * supplier page is still English - what is missing there?" The keys are + * already attributed to the files that use them, so the same data grouped by + * FILE says exactly that, screen by screen. + * + * node tests/tools/i18n-screen.js ta every screen with a gap + * node tests/tools/i18n-screen.js ta --all every screen, gap or not + * node tests/tools/i18n-screen.js ta --list the missing keys too + * node tests/tools/i18n-screen.js --worst the worst screen per language + * + * A screen at 100% still depends on its words being right; this counts what a + * pack can answer, not whether the answer is good. + */ +const fs = require('fs'); +const path = require('path'); +const { execFileSync } = require('child_process'); + +const POS = path.resolve(__dirname, '..', '..'); +const LANGUAGES = path.join(POS, 'languages'); + +function context() { + return JSON.parse(execFileSync(process.execPath, [path.join(__dirname, 'i18n-coverage.js'), '--json'], + { cwd: POS, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })).context; +} + +function pack(code) { + return JSON.parse(fs.readFileSync(path.join(LANGUAGES, code + '.json'), 'utf8')); +} + +/* Every file that renders a key, with the keys that file needs. */ +function screens(ctx) { + const byFile = new Map(); + for (const [key, entry] of Object.entries(ctx)) { + for (const file of entry.where || []) { + if (!byFile.has(file)) byFile.set(file, new Set()); + byFile.get(file).add(key); + } + } + return byFile; +} + +function report(code, ctx) { + const dict = pack(code); + const answered = (k) => typeof dict[k] === 'string' && dict[k].trim() !== ''; + const rows = []; + for (const [file, keys] of screens(ctx)) { + const missing = [...keys].filter((k) => !answered(k)); + rows.push({ + file, + keys: keys.size, + missing: missing.length, + percent: keys.size ? Math.round(((keys.size - missing.length) / keys.size) * 100) : 100, + missingKeys: missing.sort(), + }); + } + rows.sort((a, b) => a.percent - b.percent || b.missing - a.missing || a.file.localeCompare(b.file)); + return rows; +} + +function languages() { + return fs.readdirSync(LANGUAGES).filter((f) => /^[a-z]{2}\.json$/.test(f)).map((f) => f.slice(0, 2)).sort(); +} + +if (require.main === module) { + const args = process.argv.slice(2); + const code = args.find((a) => /^[a-z]{2}$/.test(a)); + const ctx = context(); + + if (args.includes('--worst') || !code) { + console.log('language worst screen gap'); + for (const c of languages()) { + const rows = report(c, ctx).filter((r) => r.missing); + const w = rows[0]; + console.log(c.padEnd(10) + (w ? w.file.padEnd(52) + String(w.missing).padStart(4) + ' of ' + w.keys + : 'every screen answers'.padEnd(52))); + } + process.exit(0); + } + + const rows = report(code, ctx); + const shown = args.includes('--all') ? rows : rows.filter((r) => r.missing); + console.log(code + ': ' + rows.filter((r) => !r.missing).length + ' of ' + rows.length + ' screens answer every key\n'); + console.log('screen keys gap %'); + for (const r of shown) { + console.log(r.file.padEnd(52) + String(r.keys).padStart(4) + String(r.missing).padStart(5) + String(r.percent).padStart(5)); + if (args.includes('--list')) for (const k of r.missingKeys) console.log(' ' + k + ' = ' + JSON.stringify((ctx[k] || {}).english)); + } + if (!shown.length) console.log(' (none)'); +} +module.exports = { report, screens, context, languages }; diff --git a/tests/tools/i18n-tag-js.js b/tests/tools/i18n-tag-js.js new file mode 100755 index 000000000..8959a2a2f --- /dev/null +++ b/tests/tools/i18n-tag-js.js @@ -0,0 +1,138 @@ +#!/usr/bin/env node +'use strict'; +/* + * Reach the English that JavaScript writes. + * + * Bill # -> Bill # + * -> + * title="Sort the list" -> title="Sort the list" data-t-title="key" + * .text('Sort') -> .text(PosnicPro.i18n.t('key', 'Sort')) + * PosnicPro.alert('error', 'Msg') -> PosnicPro.alert('error', PosnicPro.i18n.t('key', 'Msg')) + * cond ? 'Paid' : 'Unpaid' -> cond ? t('k1', 'Paid') : t('k2', 'Unpaid') + * label: 'Customer' -> label: PosnicPro.i18n.t('key', 'Customer') + * + * Only pure literals are touched: anything concatenated, quoted or templated + * inside the text is left alone, and a tag whose attributes are built by + * concatenation is skipped (wrap those by hand). The markup forms are + * translated by PosnicPro.i18n.watch() as they land; the t() forms need + * nothing - but a t() evaluated when the module LOADS runs before any pack + * has arrived, so a top-level object literal should carry markup + * instead (see PosnicPro.dashboard.SETUP_CARDS). Ternaries that pick a VALUE + * rather than a label are listed in DENY. + * + * node tests/tools/i18n-tag-js.js dry run, per-file counts + * node tests/tools/i18n-tag-js.js --write edit in place + * node tests/tools/i18n-tag-js.js --list every new key with its English + * + * After --write, run node --check on the touched files: markup inserted into + * a double-quoted string needs its quotes swapped by hand. + */ +const fs = require('fs'); +const path = require('path'); +const { execFileSync } = require('child_process'); + +const POS = path.resolve(__dirname, '..', '..'); +const FE = POS + '/frontend'; +const write = process.argv.includes('--write'); +const list = process.argv.includes('--list'); + +const ctx = JSON.parse(execFileSync(process.execPath, + [POS + '/tests/tools/i18n-coverage.js', '--json'], { encoding: 'utf8', cwd: POS, maxBuffer: 64 * 1024 * 1024 })).context; +const tidy = (s) => String(s).replace(/ /g, ' ').replace(/\s+/g, ' ').trim(); +const byEnglish = new Map(); +for (const [key, c] of Object.entries(ctx)) { + const en = tidy(c.english); + if (en && !byEnglish.has(en)) byEnglish.set(en, key); +} +const usedKeys = new Set(Object.keys(ctx)); +const minted = new Map(); +function keyFor(english) { + const en = tidy(english); + if (byEnglish.has(en)) return byEnglish.get(en); + if (minted.has(en)) return minted.get(en); + let slug = en.toLowerCase().replace(/&[a-z]+;/g, ' ').replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 42).replace(/_+$/, ''); + if (!slug) slug = 'text'; + let key = 'lang_' + slug; let n = 2; + while (usedKeys.has(key) || [...minted.values()].includes(key)) key = 'lang_' + slug + '_' + n++; + minted.set(en, key); + return key; +} + +/* Plain words: letters first, then letters/digits/spaces and light punctuation; + never a quote, a plus, a brace or a template marker. */ +const TXT = "[A-Z][A-Za-z0-9 #&;.,!?()/:%-]{1,90}"; +const isWords = (t) => /[A-Za-z]{2,}/.test(t) && !/[{}'"+`]/.test(t); +/* Ternaries that pick a VALUE, not a label: a select's option value, an order + type the API stores, an HTTP method, a date format, a CSV export cell. */ +const DENY = new Set(['Received|Open', 'Take away|Dine-in', 'Active|Inactive', 'PUT|POST', + 'FullReturn|PartialReturn', 'MM/DD/YYYY|DD/MM/YYYY']); +const TAGS = 'th|td|label|h[1-6]|small|strong|b|em|span|button|a|p|li|legend|div'; + +function codemod(src) { + let n = 0; + const t = (en) => "PosnicPro.i18n.t('" + keyFor(en) + "', '" + en + "')"; + + /* markup with plain text content */ + src = src.replace(new RegExp('<(' + TAGS + ')(\\s[^<>\']*)?>(' + TXT + ')', 'g'), (m, tag, attrs, text) => { + if (!isWords(text) || /' + text + ''; + }); + /* ', 'g'), (m, attrs, text) => { + if (!isWords(text) || /data-t=/.test(m)) return m; + n++; + return '' + text + ''; + }); + /* attributes people read, inside markup strings */ + src = src.replace(/\s(placeholder|title|aria-label)="([^"'<>+]{2,90})"(?![^<>]*data-t-\1=)/g, (m, attr, text) => { + if (!isWords(text) || !/^[A-Z]/.test(text)) return m; + n++; + return ' ' + attr + '="' + text + '" data-t-' + attr + '="' + keyFor(text) + '"'; + }); + /* .text('...') / .html('...') / .attr('title', '...') / .attr('placeholder', '...') */ + src = src.replace(new RegExp("\\.(text|html)\\('(" + TXT + ")'\\)", 'g'), (m, fn, text) => { + if (!isWords(text)) return m; n++; return '.' + fn + '(' + t(text) + ')'; + }); + src = src.replace(new RegExp("\\.attr\\('(title|placeholder)',\\s*'(" + TXT + ")'\\)", 'g'), (m, attr, text) => { + if (!isWords(text)) return m; n++; return ".attr('" + attr + "', " + t(text) + ')'; + }); + /* toasts */ + src = src.replace(new RegExp("PosnicPro\\.alert\\('(error|success|warning|info)',\\s*['\"](" + TXT + ")['\"]\\)", 'g'), (m, kind, text) => { + if (!isWords(text)) return m; n++; return "PosnicPro.alert('" + kind + "', " + t(text) + ')'; + }); + /* object-literal labels: sort options (l), filter fields (label), page and + modal titles, placeholders, onboarding hints. All consumed at mount time, + through esc() or .text(), so t() is the right form, not markup. */ + src = src.replace(new RegExp("\\b(l|label|title|placeholder|searchPlaceholder|hint|message|dateField)(\\s*:\\s*)'(" + TXT + ")'", 'g'), (m, prop, sep, text) => { + if (!isWords(text)) return m; n++; return prop + sep + t(text); + }); + /* a ternary between two plain literals */ + src = src.replace(new RegExp("\\? '(" + TXT + ")' : '(" + TXT + ")'", 'g'), (m, a, b) => { + if (!isWords(a) || !isWords(b) || DENY.has(a + '|' + b)) return m; n++; return '? ' + t(a) + ' : ' + t(b); + }); + /* singular/plural count words: (x === 1 ? ' sale' : ' sales') */ + src = src.replace(/\(([\w.]+) === 1 \? ' ([a-z][a-z ]{1,30})' : ' ([a-z][a-z ]{1,30})'\)/g, (m, v, one, many) => { + n++; return "' ' + (" + v + ' === 1 ? ' + t(one) + ' : ' + t(many) + ')'; + }); + return { src, n }; +} + +function jsFiles() { + const out = []; + for (const f of fs.readdirSync(FE + '/static/script/js/modules/js')) if (f.endsWith('.js')) out.push(FE + '/static/script/js/modules/js/' + f); + for (const f of fs.readdirSync(FE + '/static/script/js/core')) if (f.endsWith('.js')) out.push(FE + '/static/script/js/core/' + f); + return out; +} + +let total = 0; +for (const f of jsFiles()) { + const src = fs.readFileSync(f, 'utf8'); + const r = codemod(src); + if (!r.n) continue; + total += r.n; + if (write) fs.writeFileSync(f, r.src, 'utf8'); + if (!list) console.log(path.relative(FE, f).padEnd(52) + String(r.n).padStart(5)); +} +if (list) for (const [en, key] of minted) console.log(key.padEnd(48) + JSON.stringify(en)); +else console.log('\nsites changed:', total, '| new keys:', minted.size, write ? '| written.' : '| dry run.'); diff --git a/tests/tools/i18n-tag.js b/tests/tools/i18n-tag.js new file mode 100755 index 000000000..371bd24ae --- /dev/null +++ b/tests/tools/i18n-tag.js @@ -0,0 +1,204 @@ +#!/usr/bin/env node +'use strict'; +/* + * Make a template translatable. + * + * Wraps every visible text node in , and marks placeholder, + * title and aria-label with data-t-="key", reusing an existing key + * whenever the English already has one. Keys are minted from the English + * itself (lang_), so the same words on two screens share one key and + * one translation. Dry by default. + * + * node tests/tools/i18n-tag.js report what would change + * node tests/tools/i18n-tag.js --write do it + * node tests/tools/i18n-tag.js --list print every new key with its English + * + * Run it after adding a screen, then hand the new keys to translators with + * i18n-coverage.js --worksheet . The GSTR report tables, error pages + * and the email template are left alone on purpose (see SKIP_FILE). + */ +const fs = require('fs'); +const path = require('path'); +const { execFileSync } = require('child_process'); + +const POS = path.resolve(__dirname, '..', '..'); +const FE = POS + '/frontend'; +const write = process.argv.includes('--write'); +const list = process.argv.includes('--list'); + +/* Pages left alone, and why. */ +const SKIP_FILE = [ + /^modules[\\/]report_gstr/, // Indian statutory tables: column names are the form's own + /^error-\d+\.html$/, /^error-email\.html$/, // server error pages, template boilerplate + /^customersMailPrint\.html$/, // an email body the API fills + /^index\.html$/, // a redirect stub for search engines: loads no script, + // so a tag here would never be translated, and its + // is a published contract +]; +const ATTRS = ['placeholder', 'title', 'aria-label']; +/* Pages a search engine reads directly. Their <title> is a published + contract (tests/frontend-discovery-files.test.js pins it), so the words + inside it stay as they are - the indexed title is worth more than a + translated browser tab on the way in. */ +const SEO_TITLE_PAGE = /^(index|login)\.html$/; + +/* Existing keys: english -> key, from the same tool CI uses. */ +const ctx = JSON.parse(execFileSync(process.execPath, + [POS + '/tests/tools/i18n-coverage.js', '--json'], { encoding: 'utf8', cwd: POS, maxBuffer: 64 * 1024 * 1024 })).context; +const tidy = (s) => String(s).replace(/ /g, ' ').replace(/\s+/g, ' ').trim(); +const byEnglish = new Map(); +for (const [key, c] of Object.entries(ctx)) { + const en = tidy(c.english); + if (en && !byEnglish.has(en)) byEnglish.set(en, key); +} +const usedKeys = new Set(Object.keys(ctx)); + +/* New keys: english -> key, minted once per distinct English. */ +const minted = new Map(); +function keyFor(english) { + const en = tidy(english); + if (byEnglish.has(en)) return { key: byEnglish.get(en), reused: true }; + if (minted.has(en)) return { key: minted.get(en), reused: false }; + let slug = en.toLowerCase() + .replace(/<[^>]+>/g, ' ').replace(/&[a-z]+;/g, ' ') + .replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 42).replace(/_+$/, ''); + if (!slug) slug = 'text'; + let key = 'lang_' + slug; + let n = 2; + while (usedKeys.has(key) || [...minted.values()].includes(key)) key = 'lang_' + slug + '_' + n++; + minted.set(en, key); + return { key, reused: false }; +} + +const SKIP_TEXT = /^[\s\d.,:;!?()\[\]{}%$₹#*+\-–—/|&'"«»…=<>_×]*$/; +const NO_TAG_INSIDE = /^(script|style|textarea|pre|code|lang|noscript|svg)$/i; +/* Text that is a template hole, a code fragment, or a bare identifier. */ +const NOT_WORDS = (t) => !/[A-Za-z]{2,}/.test(t) || /\{\{|__\w+__|\$\{|<%|\bfunction\b|\bvar\b|=>/.test(t) + || /^\{\w+\}$/.test(t) // a merge token is data, not prose + || /^[a-z_]+\.[a-z_]+/.test(t) + || /^(ctrl|alt|shift|cmd|esc|f\d+)(\s*\+\s*\S+)*$/i.test(t) // keyboard shortcuts + || /^View \S+ per page$/.test(t) // generated aria-labels + || /^[A-Z]{1,2}$/.test(t); // a bare initial + +function tagHtml(src, file) { + let out = ''; + let i = 0; + const n = src.length; + const stack = []; // open element names + let changedText = 0, changedAttr = 0, reusedCount = 0; + const newKeys = []; + + const keepTitle = SEO_TITLE_PAGE.test(file); + function inNoTag() { + return stack.some((t) => NO_TAG_INSIDE.test(t) || (keepTitle && t === 'title')); + } + function textRun(t) { + /* keep leading/trailing whitespace outside the tag */ + const m = /^(\s*)([\s\S]*?)(\s*)$/.exec(t); + const core = m[2]; + const norm = tidy(core); + if (!norm || SKIP_TEXT.test(norm) || NOT_WORDS(norm) || norm.length < 2) return t; + const { key, reused } = keyFor(core); + if (reused) reusedCount++; else if (!newKeys.includes(key)) newKeys.push(key); + changedText++; + return m[1] + '<lang class="' + key + '">' + core + '</lang>' + m[3]; + } + function tagAttrs(tag) { + /* tag is the full "<name ...>" string */ + const nameM = /^<\s*([a-zA-Z][\w-]*)/.exec(tag); + if (!nameM) return tag; + let res = tag; + for (const attr of ATTRS) { + const re = new RegExp('\\s' + attr + '="([^"]{2,})"'); + const am = re.exec(res); + if (!am) continue; + if (res.includes(' data-t-' + attr + '=')) continue; + const val = am[1]; + const norm = tidy(val); + if (SKIP_TEXT.test(norm) || NOT_WORDS(norm)) continue; + const { key, reused } = keyFor(val); + if (reused) reusedCount++; else if (!newKeys.includes(key)) newKeys.push(key); + changedAttr++; + res = res.slice(0, am.index + am[0].length) + ' data-t-' + attr + '="' + key + '"' + res.slice(am.index + am[0].length); + } + return res; + } + + while (i < n) { + if (src.startsWith('<!--', i)) { + const end = src.indexOf('-->', i + 4); + const stop = end < 0 ? n : end + 3; + out += src.slice(i, stop); i = stop; continue; + } + if (src[i] === '<') { + /* find the end of the tag, honouring quotes */ + let j = i + 1, q = null; + while (j < n) { + const ch = src[j]; + if (q) { if (ch === q) q = null; } + else if (ch === '"' || ch === "'") q = ch; + else if (ch === '>') break; + j++; + } + let tag = src.slice(i, j + 1); + const closeM = /^<\/\s*([a-zA-Z][\w-]*)/.exec(tag); + const openM = /^<\s*([a-zA-Z][\w-]*)/.exec(tag); + if (closeM) { + const name = closeM[1].toLowerCase(); + const at = stack.lastIndexOf(name); + if (at >= 0) stack.splice(at); + } else if (openM) { + const name = openM[1].toLowerCase(); + const selfClosing = /\/\s*>$/.test(tag) || /^(br|hr|img|input|meta|link|source|col|area|base|embed|param|track|wbr)$/.test(name); + if (!inNoTag() && !/^(lang)$/.test(name)) tag = tagAttrs(tag); + if (!selfClosing) stack.push(name); + if (/^(script|style|textarea|pre|code)$/.test(name)) { + /* copy verbatim to the matching close tag */ + const closeRe = new RegExp('</\\s*' + name + '\\s*>', 'i'); + const rest = src.slice(j + 1); + const cm = closeRe.exec(rest); + const stop = cm ? j + 1 + cm.index + cm[0].length : n; + out += tag + src.slice(j + 1, stop); + const at = stack.lastIndexOf(name); if (at >= 0) stack.splice(at); + i = stop; continue; + } + } + out += tag; i = j + 1; continue; + } + /* text run */ + let k = src.indexOf('<', i); + if (k < 0) k = n; + const t = src.slice(i, k); + out += inNoTag() ? t : textRun(t); + i = k; + } + return { out, changedText, changedAttr, reusedCount, newKeys }; +} + +function htmlFiles(dir, out = []) { + for (const e of fs.readdirSync(dir, { withFileTypes: true })) { + if (e.isDirectory()) { if (!/^(node_modules|public|static|gulpfile\.js)$/.test(e.name)) htmlFiles(path.join(dir, e.name), out); } + else if (e.name.endsWith('.html')) out.push(path.join(dir, e.name)); + } + return out; +} + +let totalText = 0, totalAttr = 0, totalReused = 0; +const allNew = new Map(); +for (const f of htmlFiles(FE)) { + const rel = path.relative(FE, f); + if (SKIP_FILE.some((re) => re.test(rel))) continue; + const src = fs.readFileSync(f, 'utf8'); + const r = tagHtml(src, rel); + if (r.changedText + r.changedAttr === 0) continue; + totalText += r.changedText; totalAttr += r.changedAttr; totalReused += r.reusedCount; + for (const k of r.newKeys) allNew.set(k, rel); + if (write) fs.writeFileSync(f, r.out, 'utf8'); + if (!list) console.log(rel.padEnd(42) + String(r.changedText).padStart(5) + String(r.changedAttr).padStart(6) + String(r.newKeys.length).padStart(6)); +} +if (list) { + for (const [en, key] of minted) console.log(key.padEnd(48) + JSON.stringify(en)); +} else { + console.log('\ntagged text nodes:', totalText, '| attributes:', totalAttr, '| reused existing keys:', totalReused, '| new keys:', minted.size); + console.log(write ? 'written.' : 'dry run - nothing written. Use --write.'); +} diff --git a/tests/tools/seed-from-glossary.js b/tests/tools/seed-from-glossary.js new file mode 100755 index 000000000..4ff12e585 --- /dev/null +++ b/tests/tools/seed-from-glossary.js @@ -0,0 +1,185 @@ +#!/usr/bin/env node +'use strict'; + +/* + * Fill the language packs from the shared glossary. + * + * node tests/tools/seed-from-glossary.js what would change + * node tests/tools/seed-from-glossary.js --write do it + * node tests/tools/seed-from-glossary.js --write ta only that language + * + * A key gets a translation from languages/_glossary.json when its English text + * matches a glossary term exactly. That is the whole rule, and it is deliberately + * narrow: no stemming, no partial matches, no clever composition. "Sale Details" + * does not get the word for "Sale" glued to the word for "Details", because word + * order and grammar make that wrong in most of the languages here, and a plausible + * wrong phrase is far more expensive than an English one - somebody has to notice + * it before they can fix it. + * + * THE ONE RULE THAT MATTERS: an existing translation is never overwritten. A + * person who has translated a key has looked at the screen it appears on, which + * this file has not. Their work wins, always. That is also what makes the seeder + * safe to run again after contributions land. + * + * Rerun this whenever the glossary changes. It is idempotent. + */ + +const fs = require('fs'); +const path = require('path'); +const { execFileSync } = require('child_process'); + +const ROOT = path.resolve(__dirname, '..', '..'); +const LANG_DIR = path.join(ROOT, 'languages'); +const GLOSSARY = path.join(LANG_DIR, '_glossary.json'); + +const args = process.argv.slice(2); +const write = args.includes('--write'); +const only = args.filter((a) => !a.startsWith('--')); + +/* ------------------------------------------------------------ the glossary --- */ + +let glossary; +try { + glossary = JSON.parse(fs.readFileSync(GLOSSARY, 'utf8')); +} catch (e) { + console.error(`Cannot read languages/_glossary.json: ${e.message}`); + process.exit(1); +} + +/* + * Serialised with one line per term, which is not cosmetic. The point of the + * glossary is that a reviewer can see every language for a word at once; broken + * across thirteen lines it stops being a table and a diff stops being readable. + */ +function serialiseGlossary(g) { + const order = g.languages; + const rows = Object.entries(g.terms).map(([term, byLang]) => { + const pairs = order + .filter((code) => byLang[code] && byLang[code].trim()) + .map((code) => `${JSON.stringify(code)}: ${JSON.stringify(byLang[code])}`); + return ` ${JSON.stringify(term)}: {${pairs.join(', ')}}`; + }); + const head = JSON.stringify( + { _readme: g._readme, languages: g.languages, doNotTranslate: g.doNotTranslate, notes: g.notes }, + null, 2, + ); + return `${head.slice(0, -2)},\n\n "terms": {\n${rows.join(',\n')}\n }\n}\n`; +} + +/* --------------------------------------------------------- what the UI says --- */ + +/* + * The English for every key, taken from the same tool the coverage report uses + * rather than re-derived here. Two implementations of "what English does this key + * show" would drift, and the one that drifted would be this one. + */ +let context; +try { + const out = execFileSync(process.execPath, + [path.join(__dirname, 'i18n-coverage.js'), '--json'], /* The key list outgrew the 1 MB default buffer once every screen was tagged. */ + { encoding: 'utf8', cwd: ROOT, maxBuffer: 64 * 1024 * 1024 }); + context = JSON.parse(out).context; +} catch (e) { + console.error(`Could not read the key list: ${e.message}`); + console.error(' -> node tests/tools/i18n-coverage.js --json should print JSON.'); + process.exit(1); +} + +const keysByEnglish = new Map(); +for (const [key, entry] of Object.entries(context)) { + const english = (entry.english || '').trim(); + if (!english) continue; + if (!keysByEnglish.has(english)) keysByEnglish.set(english, []); + keysByEnglish.get(english).push(key); +} + +/* ------------------------------------------------------------------- seed --- */ + +const codes = (only.length ? only : glossary.languages) + .filter((c) => c !== 'en'); + +let totalAdded = 0; +const unusedTerms = new Set(Object.keys(glossary.terms)); + +for (const code of codes) { + const file = path.join(LANG_DIR, `${code}.json`); + let pack = {}; + let existed = false; + /* + * Read first and let a missing file tell us it is missing, rather than + * asking existsSync and then reading - between the two answers the file can + * change, and the check-then-act is what CodeQL flags as a race. + */ + { + let raw = null; + try { + raw = fs.readFileSync(file, 'utf8'); + existed = true; + } catch (e) { + if (e.code !== 'ENOENT') { + console.error(`Cannot read languages/${code}.json: ${e.message}`); + process.exitCode = 1; + continue; + } + } + try { + if (raw !== null) pack = JSON.parse(raw); + } catch (e) { + console.error(`languages/${code}.json is not valid JSON: ${e.message}`); + process.exitCode = 1; + continue; + } + } + + let added = 0; + let kept = 0; + for (const [term, byLang] of Object.entries(glossary.terms)) { + const word = (byLang[code] || '').trim(); + if (!word) continue; + const keys = keysByEnglish.get(term) || []; + if (keys.length) unusedTerms.delete(term); + for (const key of keys) { + if ((pack[key] || '').trim()) { kept += 1; continue; } + pack[key] = word; + added += 1; + } + } + + totalAdded += added; + const sorted = {}; + for (const key of Object.keys(pack).sort()) sorted[key] = pack[key]; + + const done = Object.values(sorted).filter((v) => String(v).trim()).length; + const label = existed ? '' : ' (new)'; + console.log(`${code}${label} +${added} seeded, ${kept} already translated, ` + + `${done}/${Object.keys(context).length} keys now have words`); + + if (write) fs.writeFileSync(file, `${JSON.stringify(sorted, null, 2)}\n`, 'utf8'); +} + +/* -------------------------------------------------------------- and back --- */ + +if (write) { + fs.writeFileSync(GLOSSARY, serialiseGlossary(glossary), 'utf8'); +} + +console.log(''); +if (unusedTerms.size) { + /* + * A term nobody uses is usually a typo in the glossary key - "Sales history" + * where the screen says "Sales History" - and silently does nothing. Worth + * saying out loud, because the symptom is a translation that never appears. + */ + console.log(`${unusedTerms.size} glossary term(s) match no key in the app:`); + for (const t of unusedTerms) console.log(` ${t}`); + console.log(' -> check the spelling and capitalisation against the English on screen.'); + console.log(''); +} + +if (!write) { + console.log(`${totalAdded} translation(s) would be filled in. Nothing written.`); + console.log(' -> run again with --write to apply.'); +} else { + console.log(`${totalAdded} translation(s) filled in.`); + console.log(' -> node tests/tools/check-translations.js'); +} diff --git a/tests/translation-checks.test.js b/tests/translation-checks.test.js new file mode 100644 index 000000000..80d33b9cf --- /dev/null +++ b/tests/translation-checks.test.js @@ -0,0 +1,145 @@ +'use strict'; + +/* + * The checks that stand between a first-time contributor and a broken shop + * screen. + * + * Every one of these is tested by actually breaking a language file and + * confirming the checker says so, because a validator nobody has seen fail is + * indistinguishable from one that passes everything. The mojibake case is not + * hypothetical: nine Tamil strings reached the sale screen that way and were + * live for months. + */ + +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const os = require('os'); +const path = require('path'); +const { spawnSync } = require('child_process'); + +const TOOL = path.join(__dirname, 'tools', 'check-translations.js'); +const REPO = path.join(__dirname, '..'); + +/* + * Run the checker against a throwaway copy of the repository layout, so a test + * can write a deliberately broken language file without touching the real one. + * Only the two paths the checker reads are recreated. + */ +function checkWith(files, configLanguages) { + const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'posnic-tr-')); + fs.mkdirSync(path.join(dir, 'languages')); + fs.mkdirSync(path.join(dir, 'frontend', 'gulpfile.js'), { recursive: true }); + fs.mkdirSync(path.join(dir, 'tests', 'tools'), { recursive: true }); + + for (const [name, body] of Object.entries(files)) { + fs.writeFileSync(path.join(dir, 'languages', name), + typeof body === 'string' ? body : JSON.stringify(body, null, 2), 'utf8'); + } + const langs = configLanguages || ['en', ...Object.keys(files).map((f) => f.replace(/\.json$/, ''))]; + fs.writeFileSync(path.join(dir, 'frontend', 'gulpfile.js', 'config.js'), + 'const LANGUAGES = [\n' + + langs.map((c) => ` { code: '${c}', name: '${c}', flag: 'us' },`).join('\n') + + '\n];\n', 'utf8'); + fs.copyFileSync(TOOL, path.join(dir, 'tests', 'tools', 'check-translations.js')); + + const r = spawnSync(process.execPath, [path.join(dir, 'tests', 'tools', 'check-translations.js')], + { encoding: 'utf8' }); + fs.rmSync(dir, { recursive: true, force: true }); + return { code: r.status, out: (r.stdout || '') + (r.stderr || '') }; +} + +/* ------------------------------------------------------------ it passes --- */ + +test('a good language file passes', () => { + const r = checkWith({ 'ta.json': { lang_save_title: 'சேமி' } }); + assert.equal(r.code, 0, r.out); + assert.match(r.out, /All good/); +}); + +test('blank entries are a note, not a failure', () => { + /* A half-translated language is the normal case and must stay mergeable - + every blank falls back to English. */ + const r = checkWith({ 'ta.json': { lang_a: 'சேமி', lang_b: '', lang_c: ' ' } }); + assert.equal(r.code, 0, r.out); + assert.match(r.out, /blank/); +}); + +/* ------------------------------------------------------------- it fails --- */ + +test('mojibake is caught', () => { + /* + * The check a human reviewer cannot do. This is the exact byte sequence that + * was live on the sale screen: புதிய, read as Latin-1. + */ + const moji = Buffer.from('புதிய', 'utf8').toString('latin1'); + const r = checkWith({ 'ta.json': { lang_new_title: moji } }); + assert.equal(r.code, 1, 'mojibake should fail the check'); + assert.match(r.out, /mojibake/i); + assert.match(r.out, /UTF-8/, 'the fix should name the encoding'); +}); + +test('cp1252 mojibake is caught too, not just Latin-1', () => { + /* + * Bytes 0x80-0x9F have no Latin-1 meaning, so Windows substitutes + * punctuation - 0x87 becomes U+2021. A Latin-1-only check misses these, and + * an earlier version of this detector did exactly that and passed a visibly + * corrupt file. + */ + const r = checkWith({ 'ta.json': { lang_save_title: 'à' + String.fromCharCode(0x00AE) + String.fromCharCode(0x2021) + 'மி' } }); + assert.equal(r.code, 1, 'cp1252 mojibake should fail'); + assert.match(r.out, /mojibake/i); +}); + +test('broken JSON is caught, and says so kindly', () => { + const r = checkWith({ 'ta.json': '{ "lang_a": "x",, }' }); + assert.equal(r.code, 1); + assert.match(r.out, /not valid JSON/); + assert.match(r.out, /comma/i, 'the message should suggest what to look for'); +}); + +test('a byte-order mark is caught', () => { + const r = checkWith({ 'ta.json': '{ "lang_a": "x" }' }); + assert.equal(r.code, 1); + assert.match(r.out, /byte-order mark/); +}); + +test('a value that is not text is caught', () => { + const r = checkWith({ 'ta.json': { lang_a: 42 } }); + assert.equal(r.code, 1); + assert.match(r.out, /not text/); +}); + +test('a file named after something that is not a language is caught', () => { + const r = checkWith({ 'notalanguage.json': { lang_a: 'x' } }); + assert.equal(r.code, 1); + assert.match(r.out, /not a language code/); +}); + +test('a language declared in config with no file is caught', () => { + const r = checkWith({ 'ta.json': { lang_a: 'x' } }, ['en', 'ta', 'hi']); + assert.equal(r.code, 1); + assert.match(r.out, /declares "hi"/); +}); + +test('a file the app will not offer is a note, not a failure', () => { + /* Harmless, but almost certainly not what the contributor intended - they + are one line of config away from it actually appearing. */ + const r = checkWith({ 'ta.json': { lang_a: 'x' }, 'hi.json': { lang_a: 'y' } }, ['en', 'ta']); + assert.equal(r.code, 0, r.out); + assert.match(r.out, /will not offer it/); +}); + +/* --------------------------------------------------- it is worth reading --- */ + +test('every failure says what to do about it', () => { + /* + * An error message that only says what is wrong sends a newcomer to ask, or + * to give up. This is a contribution surface before it is a test. + */ + const r = checkWith({ 'ta.json': '{ bad json' }); + assert.equal(r.code, 1); + assert.match(r.out, /->/, 'failures should carry a suggested fix'); + assert.match(r.out, /TRANSLATING\.md/, 'it should point at the guide'); + assert.match(r.out, /bug in this check/, 'and invite a report if it is unclear'); +}); diff --git a/tests/update-channel.test.js b/tests/update-channel.test.js index c66e65f0e..bb945efad 100644 --- a/tests/update-channel.test.js +++ b/tests/update-channel.test.js @@ -25,8 +25,8 @@ const path = require('path'); const ROOT = path.join(__dirname, '..'); const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8').replace(/\r\n/g, '\n'); -const SERVICE = read('update-service.js'); -const UI = read('update-manager.html'); +const SERVICE = read('src/update-service.js'); +const UI = read('src/update-manager.html'); test('stable is what you get by not choosing', () => { const defaults = SERVICE.slice(SERVICE.indexOf('loadConfig()')); @@ -163,7 +163,7 @@ test('the preload bridges have not silently diverged again', () => { * exactly what happened. This does not demand they be identical; it demands * that anything a page calls on window.electron is actually on it. */ - const PRELOAD = read('preload.js'); + const PRELOAD = read('src/preload.js'); const keysOf = (name) => { const i = PRELOAD.indexOf(`exposeInMainWorld('${name}'`); if (i < 0) return []; diff --git a/tests/update-install-on-quit.test.js b/tests/update-install-on-quit.test.js index 5f3cb9af0..86441ce81 100644 --- a/tests/update-install-on-quit.test.js +++ b/tests/update-install-on-quit.test.js @@ -29,11 +29,11 @@ const ROOT = path.join(__dirname, '..'); const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), "utf8").replace(/\r\n/g, "\n"); -const MAIN = read("main.js"); -const SERVICE = read("update-service.js"); -const UI = read("update-manager.html"); -const INTEGRATION = read("update-integration.js"); -const PRELOAD = read("preload.js"); +const MAIN = read("src/main.js"); +const SERVICE = read("src/update-service.js"); +const UI = read("src/update-manager.html"); +const INTEGRATION = read("src/update-integration.js"); +const PRELOAD = read("src/preload.js"); test("electron-updater's own quit installer stays off", () => { /* Turning it on would silently drop the pre-update backup. */ diff --git a/tests/update-settings.test.js b/tests/update-settings.test.js index bda90201a..783b1e5a3 100644 --- a/tests/update-settings.test.js +++ b/tests/update-settings.test.js @@ -30,11 +30,11 @@ const ROOT = path.join(__dirname, '..'); const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), "utf8").replace(/\r\n/g, "\n"); -const UI = read("update-manager.html"); -const SERVICE = read("update-service.js"); -const INTEGRATION = read("update-integration.js"); -const PRELOAD = read("preload.js"); -const MAIN = read("main.js"); +const UI = read("src/update-manager.html"); +const SERVICE = read("src/update-service.js"); +const INTEGRATION = read("src/update-integration.js"); +const PRELOAD = read("src/preload.js"); +const MAIN = read("src/main.js"); test('the automatic-update setting is reachable without editing a JSON file', () => { assert.match(UI, /id="setAutoCheck"/, 'no control for automatic checking'); diff --git a/tests/variant-chooser.test.js b/tests/variant-chooser.test.js new file mode 100644 index 000000000..1051d14bb --- /dev/null +++ b/tests/variant-chooser.test.js @@ -0,0 +1,492 @@ +/* + * Choosing a size on the sale screen. + * + * Owner: "when sales item choose variant choose it opens in center of the page, + * move movement is bit taking time, better show near to item or attached to + * item on hover might better. we can reduce the click. make sure we handled for + * touch screen users too." + * + * WHY THIS FILE IS MOSTLY ABOUT TOUCH + * + * The visible half of this change - a panel beside the tile instead of one in + * the middle of the screen - is the half that cannot break quietly. Somebody + * would see it. + * + * The half that CAN break quietly is the pointer handling. A touch screen has + * no hover, so browsers fake one: a single tap emits pointerover, mouseover and + * click at the same coordinates. Bind hover-to-open and click-to-add naively + * and a tap opens the list under the finger and then lets the synthesised click + * choose a row - adding a size nobody picked. On a developer's mouse-driven + * machine that is invisible; at a counter it is a wrong item on a customer's + * bill, and the cashier gets the blame. + * + * So the assertions below are about pointerType, the touch guard, and the + * timers - each one mutation-verified. + */ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +const ROOT = path.join(__dirname, '..'); +const rawJs = fs.readFileSync( + path.join(ROOT, 'frontend/static/script/js/modules/js/sales.js'), 'utf8'); +const rawCss = fs.readFileSync( + path.join(ROOT, 'frontend/static/style/css/custom.css'), 'utf8'); + +/* Prose naming a guard reads exactly like the guard, and this repo has shipped + two tests that passed against their own explanatory comment. */ +const strip = (s) => s.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^[ \t]*\/\/.*$/gm, ''); +const js = strip(rawJs); +const css = strip(rawCss); + +/* Name-bounded, never brace-matched: this object holds arrow defaults and + destructured parameters, and counting braces through them returns a few + characters rather than the block. */ +function between(source, from, to) { + const a = source.indexOf(from); + assert.ok(a > -1, `${from} not found`); + const b = source.indexOf(to, a + from.length); + assert.ok(b > a, `${to} not found after ${from}`); + return source.slice(a, b); +} + +const pop = between(js, 'variantPop: {', 'openVariantPicker: function'); +const cssBlock = (() => { + const at = rawCss.indexOf('.variant-pop {'); + assert.notStrictEqual(at, -1, 'the variant panel has no styles'); + const next = rawCss.indexOf('/* ====', at); + return strip(rawCss.slice(at, next === -1 ? rawCss.length : next)); +})(); + +test('the panel is anchored to the tile, not to the middle of the screen', () => { + /* The whole complaint: "it opens in center of the page, move movement is bit + taking time". A modal is a backdrop, a fade and a panel 400px from the + thing that was tapped. */ + assert.ok(!js.includes('variant_picker_modal'), + 'the centre-page modal is still being built'); + assert.match(pop, /getBoundingClientRect\(\)/); + assert.match(cssBlock, /position: fixed/); +}); + +test('the panel is placed in viewport coordinates, so the grid cannot clip it', () => { + /* + * position:absolute inside the grid is clipped by the same overflow rule + * that makes the grid scroll, so the bottom row of tiles would open a list + * nobody can see - and it looks correct everywhere else. + */ + assert.match(cssBlock, /position: fixed/); + assert.ok(!/position:\s*absolute/.test(cssBlock), + 'an absolutely-positioned panel is clipped by the grid'); +}); + +test('hover opens for a mouse and never for a finger', () => { + /* + * pointerType is the entire difference between a mouse saying "show me this" + * and a touch screen synthesising a hover it does not have. mouseenter does + * not carry it, which is why this listens for pointerover. + */ + assert.match(pop, /addEventListener\('pointerover'/); + assert.match(pop, /if \(e\.pointerType !== 'mouse'\) \{ return; \}/); +}); + +test('a tap cannot let its own synthesised click choose a row', () => { + /* + * The failure: tap the tile, the panel opens under the finger, and the click + * that follows the same tap lands on whichever row is there. A random size + * is added to a real sale and nothing looks wrong. + */ + assert.match(pop, /TOUCH_GUARD/); + assert.match(pop, /_byTouch && Date\.now\(\) - \w+\._openedAt < \w+\.TOUCH_GUARD/); + assert.match(pop, /return;/); +}); + +test('a mouse is never made to wait for the touch guard', () => { + /* The guard is conditioned on _byTouch. Applied unconditionally it would + swallow the fast click of somebody who hovered and chose in one motion - + which is the interaction this whole change exists to enable. */ + const guard = between(pop, 'TOUCH_GUARD', 'pickVariant'); + assert.match(guard, /_byTouch &&/); +}); + +test('the panel survives the trip from tile to panel', () => { + /* + * Without a close delay the panel shuts in the few pixels of gap between the + * tile and itself, and the list can never be reached with a mouse at all. + */ + assert.match(pop, /CLOSE_DELAY: \d+/); + assert.match(pop, /_closeTimer = setTimeout\(/); + /* Entering the panel has to cancel that pending close - matched across the + whole branch rather than as one line, because that branch grew a second + job (previewing a colour on hover) and a single-line pattern would have + failed for a reason that has nothing to do with what this test is about. */ + const enter = between(pop, 'if (inPop(e.target))', 'var tile = tileOf'); + assert.match(enter, /\w+\.cancelTimers\(\);/); + assert.match(enter, /return;/); +}); + +test('sweeping across a shelf of tiles does not strobe panels open', () => { + assert.match(pop, /OPEN_DELAY: \d+/); + assert.match(pop, /_openTimer = setTimeout\(/); +}); + +test('re-tapping an open tile does not toggle the list shut', () => { + /* + * Somebody reaching for a size and clipping the tile on the way would + * otherwise lose the list they were aiming at - and then blame the till. + */ + assert.match(pop, /if \(\w+\._gid === groupId && \w+\.isOpen\(\)\)/); + assert.match(pop, /\w+\.place\(\);\s*\n\s*return;/); +}); + +test('the panel follows its tile when anything moves', () => { + /* Placed in viewport coordinates, so a scroll leaves it hanging over the + wrong tile unless it is repositioned. scroll does not bubble, hence + capture. */ + assert.match(pop, /addEventListener\('scroll', \w+, true\)/); + assert.match(pop, /addEventListener\('resize', \w+\)/); +}); + +test('the panel does not outlive the grid it belongs to', () => { + /* + * It lives on <body>, so removing #item-lists does not take it with it. A + * category change would leave a list of sizes floating over a shelf that no + * longer holds them, and tapping one would add an item not on screen. + */ + const render = between(js, "$('#item-lists').remove()", 'sale-tile-grid'); + const before = js.slice(Math.max(0, js.indexOf("$('#item-lists').remove()") - 400), + js.indexOf("$('#item-lists').remove()")); + assert.ok(/variantPop\.close\(\)/.test(before) || /variantPop\.close\(\)/.test(render), + 'the panel is not closed when the grid is rebuilt'); +}); + +test('the tile can be reached and opened without a mouse', () => { + /* + * The tile is a div. A div does not turn Enter into a click the way a button + * does, so without this the tiles are reachable by Tab and do nothing when + * you get there - which reads as a dead control, not as a missing feature. + */ + assert.match(js, /class="wsk-cp wsk-variant cbutton--effect-novak" tabindex="0"/); + assert.match(pop, /e\.key === 'Enter' \|\| e\.keyCode === 13/); + assert.match(pop, /e\.key === 'Escape' \|\| e\.keyCode === 27/); +}); + +test('closing with Escape puts focus back on the tile', () => { + /* + * Focus otherwise lands on <body> and the next Tab restarts from the top of + * the page. The tile has to be held BEFORE close(), which clears it. + */ + const esc = between(pop, "e.key === 'Escape'", 'var row ='); + assert.match(esc, /var from = \w+\._tile;/); + assert.match(esc, /\w+\.close\(\);/); + assert.match(esc, /from\.focus\(\)/); +}); + +test('the group id is data on the tile, not parsed back out of an onclick', () => { + /* Reading it out of the onclick string works until the first product name + with an apostrophe in it. */ + assert.match(js, /data-variant-group="/); + assert.match(pop, /getAttribute\('data-variant-group'\)/); +}); + +test('rows are a thumb, not a cursor', () => { + /* Six sizes in list-group rows is six targets a finger cannot tell apart. */ + const row = between(cssBlock, '.variant-pop .vp-row {', '.variant-pop .vp-row:last-child'); + assert.match(row, /min-height: 44px/); +}); + +test('there is a way out that is not hover', () => { + /* A hover-only panel with no dismiss is a trap on a till with no keyboard. */ + assert.match(pop, /vp-close/); + assert.match(cssBlock, /\.vp-close/); +}); + +test('the panel takes its colours from the theme', () => { + /* + * It sits on top of the sale screen - the screen somebody stares at all day - + * and a white card over a dark till is the complaint that started the theme + * work in the first place. + */ + assert.match(cssBlock, /background: var\(--theme-card-bg/); + assert.match(cssBlock, /color: var\(--theme-text-primary/); + assert.match(cssBlock, /border: 1px solid var\(--theme-border-color/); + + const literals = cssBlock.match(/(?:^|[^-\w])(?:background|color|border-color):\s*#[0-9a-fA-F]{3,8}/gm) || []; + assert.deepStrictEqual(literals, [], + `the panel must not hard-code colours: ${literals.join(', ')}`); +}); + +test('keyboard focus stays visible', () => { + /* :hover and :focus share a rule that clears the outline. Clearing it + without putting something back is how a till stops being usable without a + mouse, and it looks perfectly fine to whoever did it. */ + assert.match(cssBlock, /\.vp-row:focus-visible/); + assert.match(cssBlock, /box-shadow: inset 0 0 0 2px var\(--theme-primary-color/); +}); + +test('an item with none left is shown, not hidden', () => { + /* A missing row reads as a product that was never set up. The shop decides + whether to sell it; the till's job is to say what the number is. */ + assert.match(pop, /qty <= 0 \? 'none left'/); + assert.match(pop, /vp-stock-out/); + assert.match(cssBlock, /\.vp-stock-out/); +}); + +/* + * ============================================================ + * MATRIX FAMILIES: colour AND size + * + * Owner: "i see products with variant on hover list the variant list. hope you + * take care of if product had matrix variant. so we might think like sub menu." + * + * A one-axis family is six sizes. A two-axis family is six sizes TIMES five + * colours, and a flat list of thirty rows in a panel is not a chooser, it is a + * wall. Worse, the list is sorted by a compound string, so "Red / L" sits + * between "Red / M" and "Red / S" - the sizes of one colour are not even + * together. + * + * THE PART THAT COULD BE SILENTLY WRONG is the parsing. Both axes are packed + * into one string by the item form - variant_axis is "Colour / Size", + * variant_value is "Red / L" - and that separator is legal INSIDE a value. A + * colour genuinely called "Black / White" splits into three parts, and a + * confident misreading files sizes under colours that do not exist. Nothing + * would error; the shop would just see a chooser that is quietly nonsense. + * ============================================================ + */ +const matrix = between(js, 'analyse: function (rows)', 'open: function (groupId'); + +test('two axes are recovered from the one string that carries them', () => { + assert.match(matrix, /variant_axis/); + assert.match(matrix, /split\(' \/ '\)/); + assert.match(matrix, /axes\.length !== 2/); +}); + +test('a value containing the separator refuses rather than guesses', () => { + /* + * The whole reason this is written as a refusal. "Black / White" in a + * two-axis family splits into three parts, and there is no way to tell which + * separator was the axis boundary. Falling back to the flat list is never + * wrong, only long - and "correct but less clever" is the only safe direction + * when the alternative is a chooser that lies. + */ + assert.match(matrix, /if \(parts\.length !== 2\) \{ return flat; \}/); + assert.match(matrix, /if \(!first \|\| !second\) \{ return flat; \}/); +}); + +test('every value must parse, not just the first', () => { + /* Sampling one row and trusting the rest is how a family with one awkward + colour renders half a matrix. */ + assert.match(matrix, /for \(var i = 0; i < rows\.length; i\+\+\)/); +}); + +test('a matrix of one column falls back to the flat list', () => { + /* Two columns with one entry each is more taps than a plain list, not fewer, + and it is what a one-axis family looks like if it happens to carry a + two-part label. */ + assert.match(matrix, /if \(groups\.length < 2\) \{ return flat; \}/); +}); + +test('the columns are derived from the rows, so a sparse matrix just works', () => { + /* + * If Red was only ever stocked in S and M, Red shows S and M. Listing every + * theoretical combination would offer sizes that exist as no item at all, and + * choosing one could only fail. + */ + assert.match(matrix, /index\[first\]\.members\.push/); + assert.ok(!/for[\s\S]{0,200}axes\[1\]\.forEach/.test(matrix), + 'the second column must not be enumerated independently of the rows'); +}); + +test('the sub-menu is docked, and both levels are on screen at once', () => { + const html = between(js, 'matrixHtml: function', 'selectAxis: function'); + assert.match(html, /vp-col-axis/); + assert.match(html, /vp-col-leaf/); + // Each column says which axis it is, or they are just two unlabelled lists. + assert.match(html, /shape\.axes\[0\]/); + assert.match(html, /shape\.axes\[1\]/); + // The first value is selected on open, so the second column is never empty. + assert.match(html, /shape\.groups\[0\]\.members/); + assert.match(html, /i === 0 \? ' is-active' : ''/); +}); + +test('the leaf rows are rendered in one place for both shapes', () => { + /* + * One axis or two, the bottom of the tree is a real item with a price, a + * stock figure and an id. Two renderers would drift, and the way they drift + * is that one of them stops showing stock. + */ + const leaf = between(js, 'leafRows: function', 'matrixHtml: function'); + assert.match(leaf, /vp-stock/); + assert.match(leaf, /data-item-id/); + const calls = (js.match(/\.leafRows\(/g) || []).length; + assert.ok(calls >= 3, `leafRows should serve both shapes and the repaint, found ${calls} calls`); +}); + +test('choosing a colour is not blocked by the touch guard', () => { + /* + * The guard exists because a tap on the tile synthesises a click a moment + * later, and honouring that on a LEAF would add a random size to a real sale. + * A colour adds nothing and can be undone by choosing another, so guarding it + * would only mean the first tap after opening does nothing - which reads as a + * dead panel. Guard the destructive action, not the navigation. + */ + const sel = between(js, 'selectAxis: function', 'open: function (groupId'); + assert.ok(!/TOUCH_GUARD/.test(sel), 'selecting an axis must not be behind the touch guard'); +}); + +test('a colour can be chosen by hover and by tap', () => { + /* + * Two separate paths, and they are asserted separately on purpose. + * + * Hover is the fast path for a mouse. Tap is the ONLY path on a touch screen, + * which has no hover to read intent from at all - so a till with a touch + * screen and no click handler has a first column that cannot be used, and + * every matrix product becomes unsellable from the grid. + * + * Checking that the selector appears SOMEWHERE passed with the click handler + * deleted, because the hover handler mentions it too. Found by mutation. + */ + const hover = between(pop, "if (e.pointerType !== 'mouse')", 'var tile = tileOf'); + assert.match(hover, /selectAxis/); + + const tap = between(pop, 'var axis = e.target && e.target.closest', 'var row = e.target'); + assert.match(tap, /closest\('#variant_pop \.vp-axis'\)/); + assert.match(tap, /\w+\.selectAxis\(axis\.getAttribute\('data-axis-value'\)\)/); +}); + +test('the panel stays attached when the second column changes height', () => { + /* One colour having more sizes than another changes the panel's height, and + it is positioned against a tile it must stay joined to. */ + const sel = between(js, 'selectAxis: function', 'open: function (groupId'); + assert.match(sel, /\w+\.place\(\);/); +}); + +test('the matrix columns cannot squeeze each other off the edge', () => { + const col = between(cssBlock, '.variant-pop .vp-col {', '.variant-pop .vp-col-axis'); + assert.match(col, /min-width: 0/); + // And they stack rather than shrink on a narrow screen. + assert.match(cssBlock, /@media \(max-width: 420px\)[\s\S]*?flex-direction: column/); +}); + +test('the first level is a thumb target too', () => { + const axis = between(cssBlock, '.variant-pop .vp-axis {', '.variant-pop .vp-axis:last-child'); + assert.match(axis, /min-height: 44px/); +}); + +/* + * The parser, actually run. + * + * Everything above checks that the guards are WRITTEN. This runs the function + * against the data shapes a real shop produces, because a regex confirming that + * `parts.length !== 2` appears in the file says nothing about whether the split + * is done on the right string. + * + * `analyse` is lifted out of sales.js and evaluated on its own. It touches + * nothing outside itself - no jQuery, no PosnicPro, no DOM - which is what + * makes that possible, and is worth keeping true. + */ +const analyse = (() => { + const start = rawJs.indexOf('analyse: function (rows) {'); + assert.notStrictEqual(start, -1, 'analyse is gone'); + const end = rawJs.indexOf('\n },', start); + assert.ok(end > start, 'analyse has no end'); + const body = rawJs.slice(start + 'analyse: function (rows) {'.length, end); + // eslint-disable-next-line no-new-func + return new Function('rows', body); +})(); + +const item = (axis, value, extra) => Object.assign( + { variant_axis: axis, variant_value: value, id: value, selling_price: 1 }, extra || {}); + +test('a one-axis family is not a matrix', () => { + const out = analyse([item('Size', 'S'), item('Size', 'M'), item('Size', 'L')]); + assert.strictEqual(out.matrix, false); +}); + +test('a two-axis family groups by the first axis', () => { + const out = analyse([ + item('Colour / Size', 'Red / S'), + item('Colour / Size', 'Red / M'), + item('Colour / Size', 'Blue / S'), + item('Colour / Size', 'Blue / L'), + ]); + assert.strictEqual(out.matrix, true); + assert.deepStrictEqual(out.axes, ['Colour', 'Size']); + assert.deepStrictEqual(out.groups.map((g) => g.value), ['Red', 'Blue']); + assert.deepStrictEqual(out.groups[0].members.map((m) => m.label), ['S', 'M']); + /* Sparse on purpose: Blue was never stocked in M. It must show what exists, + not every combination the axes could theoretically make. */ + assert.deepStrictEqual(out.groups[1].members.map((m) => m.label), ['S', 'L']); +}); + +test('a colour whose own name contains the separator falls back, not lies', () => { + /* + * THE ONE THAT MATTERS. "Black / White / S" splits into three, and there is + * no way to know which separator was the axis boundary. Guessing the first + * would file every size under a colour called "Black"; guessing the last + * would invent a colour called "Black / White" only for the rows that have + * it. Both are wrong, neither errors, and the shop just sees nonsense. + */ + const out = analyse([ + item('Colour / Size', 'Black / White / S'), + item('Colour / Size', 'Red / S'), + ]); + assert.strictEqual(out.matrix, false, + 'a value with an extra separator must fall back to the flat list'); +}); + +test('one bad row is enough to fall back, wherever it sits', () => { + /* Checking only the first row renders half a matrix and half nothing. */ + const rows = [ + item('Colour / Size', 'Red / S'), + item('Colour / Size', 'Blue / M'), + item('Colour / Size', 'Green / Navy / L'), + ]; + assert.strictEqual(analyse(rows).matrix, false); + assert.strictEqual(analyse(rows.slice().reverse()).matrix, false); +}); + +test('an empty half is not a valid axis value', () => { + /* "Red / " is a value somebody half-typed. Rendering a blank row in the size + column offers something with no name to choose. */ + assert.strictEqual(analyse([ + item('Colour / Size', 'Red / '), + item('Colour / Size', 'Blue / M'), + ]).matrix, false); +}); + +test('a two-part label with only one colour is not worth two columns', () => { + const out = analyse([ + item('Colour / Size', 'Red / S'), + item('Colour / Size', 'Red / M'), + ]); + assert.strictEqual(out.matrix, false); +}); + +test('a missing or one-part axis label is a plain list', () => { + assert.strictEqual(analyse([item('', 'Red / S'), item('', 'Blue / M')]).matrix, false); + assert.strictEqual(analyse([item('Size', 'S'), item('Size', 'M')]).matrix, false); + /* Three axes: the form cannot produce them, so a three-part label is a value + that ate its separator rather than a third dimension. */ + assert.strictEqual(analyse([ + item('Colour / Size / Fit', 'Red / S / Slim'), + item('Colour / Size / Fit', 'Blue / M / Slim'), + ]).matrix, false); +}); + +test('values are trimmed, so " Red / S" and "Red / S " group together', () => { + const out = analyse([ + item('Colour / Size', 'Red / S'), + item('Colour / Size', ' Red / M '), + item('Colour / Size', 'Blue / S'), + ]); + assert.strictEqual(out.matrix, true); + assert.deepStrictEqual(out.groups.map((g) => g.value), ['Red', 'Blue']); + assert.strictEqual(out.groups[0].members.length, 2); +}); + +test('a family of one is never a matrix', () => { + assert.strictEqual(analyse([item('Colour / Size', 'Red / S')]).matrix, false); + assert.strictEqual(analyse([]).matrix, false); + assert.strictEqual(analyse(null).matrix, false); +}); diff --git a/tests/variant-identity.test.js b/tests/variant-identity.test.js new file mode 100644 index 000000000..8ce094fac --- /dev/null +++ b/tests/variant-identity.test.js @@ -0,0 +1,272 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { blockAt, cssReader, stripComments } = require('./helpers/source-lookup'); + +/* + * A variant is a distinct thing, and the form has to let it be one. + * + * Two faults, reported together: + * + * "item variant same value cant select twise. how can be two variant with + * same values. ex. shirt size 40 and 40 again." + * "for each variant seperate image possible or not ?" + * + * They are the same fault seen from two sides. A variant needs an identity of + * its own - one value, one picture - and the form was letting two variants + * share a value while forcing all of them to share a photo. Both produce items + * nobody can tell apart: "Shirt / 40" twice over, and a whole family showing + * one picture on the sale grid. + * + * Comments are stripped before every assertion. Prose that NAMES a guard reads + * exactly like the guard, and a test that matches its own explanation passes + * with the code deleted. + */ + +const ROOT = path.join(__dirname, '..'); +const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8'); + +const itemsJs = stripComments( + read('frontend', 'static', 'script', 'js', 'modules', 'js', 'items.js'), +); +const helperJs = stripComments(read('api', 'src', 'helpers', 'variants.helper.js')); +const variantSvc = stripComments(read('api', 'src', 'services', 'variant.service.js')); +const variantCtl = stripComments(read('api', 'src', 'controllers', 'variants-v2.controller.js')); +const css = read('frontend', 'static', 'style', 'css', 'custom.css'); +const cssRule = cssReader(css); + +/* A slice between two markers, refusing to read backwards. `a.slice(x, y)` + with y before x yields '' - and every assertion against '' passes. */ +const between = (src, from, to) => { + const start = src.indexOf(from); + const end = src.indexOf(to); + assert.notStrictEqual(start, -1, `marker not found: ${from}`); + assert.notStrictEqual(end, -1, `marker not found: ${to}`); + assert.ok(end > start, `${to} comes before ${from} - the slice would be empty`); + return src.slice(start, end); +}; + +/* ------------------------------------------------------------------ * + * One value, once + * ------------------------------------------------------------------ */ + +test('a variant value cannot be offered twice', () => { + /* + * select2 keys a multi-select on the option ELEMENT, not its value. Two + * <option value="40"> elements are two separate choices, so a variant saved + * with 40 twice let both be picked - and the family saved two items called + * "Shirt / 40". + */ + const fn = blockAt(itemsJs, 'loadVariantValues: function'); + assert.match(fn, /toLowerCase\(\)/, 'the offered values are not compared case-insensitively'); + /* + * The SKIP, not merely a mention of `seen`. Asserting on the name alone + * passed with the guard deleted, because `seen[key] = true` on the next line + * matched it just as well - the bookkeeping without the behaviour. + */ + assert.match( + fn, + /if \(seen\[key\]\)[^\n]*return/, + 'a value already offered is recorded but not skipped', + ); +}); + +test('the de-duplication is on the server too, not only in the form', () => { + /* The form is a courtesy. Anything else posting to the API - an import, an + older build still open in a browser - has to get the same answer. */ + assert.match(helperJs, /seen\.has\(key\)/, 'the helper does not skip a repeated value'); + assert.match(helperJs, /name\.toLowerCase\(\)/, 'the helper compares case-sensitively'); +}); + +test('every path that stores variant values goes through the one helper', () => { + /* The same four-line normalisation was copied into six places. A guard added + to one copy is a guard missing from five. */ + for (const [label, src] of [ + ['variant.service', variantSvc], + ['variants-v2.controller', variantCtl], + ]) { + assert.match(src, /normalizeVariantFields/, `${label} does not use the shared normaliser`); + assert.doesNotMatch( + src, + /\.map\(\(val\) => \(\{ name: val \}\)\)/, + `${label} still has its own copy of the normalisation`, + ); + } +}); + +test('values already saved with a duplicate stop offering it on read', () => { + /* Fixing only the write path leaves every variant saved before today still + showing 40 twice, because nobody is going to re-save them all. */ + /* + * The service's is a method, so blockAt can brace-match it. The controller's + * is an arrow with a `= {}` default parameter - brace-matching from the name + * stops at THAT pair and reads a few characters, which is the shape of bug + * that makes a test pass while proving nothing. Bounded by name instead. + */ + assert.match( + blockAt(variantSvc, ' formatVariant(variant) {'), + /normalizeVariantFields\(rawFields\)/, + 'variant.service does not de-duplicate what it reads back', + ); + assert.match( + between(variantCtl, 'const formatVariant', 'const sendSuccess'), + /normalizeVariantFields\(rawFields\)/, + 'variants-v2.controller does not de-duplicate what it reads back', + ); +}); + +/* ------------------------------------------------------------------ * + * One axis, once + * ------------------------------------------------------------------ */ + +test('the same option cannot be used for both axes', () => { + /* Size crossed with Size is the same list twice: it produces "40 / 40" and + "42 / 40" - names stating two different sizes for one garment. */ + const fn = blockAt(itemsJs, 'syncAxisExclusion: function'); + assert.match(fn, /prop\('disabled'/, 'the clashing option is never disabled'); + assert.match(fn, /resetSecondAxis/, 'an existing clash is never cleared'); +}); + +test('both axis pickers apply the exclusion, and so does the first paint', () => { + /* + * Only guarding the second picker leaves the clash reachable from the other + * direction: choose Colour then Size, then change the FIRST back to Size. + */ + const calls = itemsJs.split('PosnicPro.items.syncAxisExclusion()').length - 1; + assert.ok(calls >= 3, `syncAxisExclusion is called ${calls} time(s), expected at least 3`); +}); + +/* ------------------------------------------------------------------ * + * One photo, per variant + * ------------------------------------------------------------------ */ + +test('each variant row has its own photo control', () => { + assert.match(itemsJs, /items_photo_strip_/, 'no per-row photo strip is built'); + assert.match(itemsJs, /id="items_photo_/, 'no per-row photo value is stored'); +}); + +test('a chosen photo overrides the family photo for that row only', () => { + const save = between(itemsJs, 'saveVariantFamily: function', 'items/createFamily'); + assert.match(save, /rowPhoto/, 'the row never carries its own photo'); + assert.match( + save, + /Object\.assign\(\{\}, shared, rowPhoto \|\| \{\}/, + 'the row photo does not override the shared fields', + ); + assert.match(save, /cover_image: found\[0\]\.name/, 'the row keeps the family cover image'); +}); + +test('a row with no photo chosen is left exactly as it was', () => { + /* The whole feature is optional. Every item that exists today was saved with + the shared set, and nothing here may change that. */ + const save = between(itemsJs, 'saveVariantFamily: function', 'items/createFamily'); + assert.match(save, /var rowPhoto = null;/, 'rowPhoto does not default to nothing'); + assert.match(save, /rowPhoto \|\| \{\}/, 'an unchosen row does not fall through to shared'); +}); + +test('a photo removed after being chosen is not saved as a name with no image', () => { + /* Otherwise the variant comes back with a broken picture rather than none. */ + const save = between(itemsJs, 'saveVariantFamily: function', 'items/createFamily'); + assert.match(save, /\$\.grep\(PosnicPro\.items\.imageParams/, 'the choice is trusted blindly'); + assert.match(save, /if \(found\.length\)/, 'a missing photo is not checked for'); +}); + +test('the strips repaint when photos are added or removed', () => { + const calls = itemsJs.split('PosnicPro.items.renderVariantPhotoPickers()').length - 1; + assert.ok(calls >= 4, `repainted from ${calls} place(s), expected at least 4`); +}); + +test('a base64 photo is given a real mime type', () => { + /* A data: URL with no usable type renders as a broken image - browsers do + not sniff it. */ + const fn = blockAt(itemsJs, 'photoSrc: function'); + assert.match(fn, /data:image\//); + assert.match(fn, /jpeg/, 'jpg is not mapped to its real mime type'); +}); + +test('the chosen photo is marked by more than a border colour', () => { + /* A border alone vanishes on a bright screen, and the wrong choice is not + visible again until the item is saved and sitting on the sale grid. */ + const rule = cssRule('.items-variant-photo.is-chosen'); + assert.match(rule, /box-shadow/, 'the chosen photo has no ring'); + assert.match(rule, /opacity/, 'the chosen photo is not distinguished by opacity'); +}); + +test('the picker reads as clickable and keeps keyboard focus visible', () => { + assert.match(cssRule('.items-variant-photo {'), /cursor:\s*pointer/); + assert.match(cssRule('.items-variant-photo:focus-visible'), /outline/); +}); + +/* ------------------------------------------------------------------ * + * Rebuilding the rows does not throw away what was typed + * ------------------------------------------------------------------ */ + +test('what was typed into the rows survives adding another value', () => { + /* + * loadVariant empties #load_price_fields and rebuilds it on every change to + * the value lists. Adding a ninth size after pricing eight discarded all + * eight prices, the SKUs, the barcodes and the quantities - the form reset + * itself at the exact moment you were extending it. + */ + const load = blockAt(itemsJs, 'loadVariant: function'); + const snapAt = load.indexOf('snapshotVariantRows()'); + const wipeAt = load.indexOf(".html('')"); + assert.notStrictEqual(snapAt, -1, 'nothing is snapshotted before the rebuild'); + assert.ok(snapAt < wipeAt, 'the snapshot is taken after the rows are already gone'); + assert.match(load, /restoreVariantRows\(/, 'nothing is restored after the rebuild'); +}); + +test('rows are preserved by variant value, never by position', () => { + /* + * Removing '40' from the middle shifts every later row up one. Restoring by + * index would hand '42' the price typed for '44' - worse than losing it, + * because a wrong price looks exactly like a right one. + */ + for (const marker of ['snapshotVariantRows: function', 'restoreVariantRows: function']) { + const fn = blockAt(itemsJs, marker); + assert.match(fn, /data-variant-value/, `${marker} does not key on the variant value`); + } +}); + +test('the restore covers every field a row holds, including the photo', () => { + const fn = blockAt(itemsJs, 'restoreVariantRows: function'); + for (const field of [ + 'items_itemid_', + 'items_barcodeid_', + 'items_company_price_', + 'items_mrp_price_', + 'items_selling_price_', + 'items_available_quantity_', + 'items_sort_', + 'items_discount_amount_', + 'items_discount_percentage_', + 'items_photo_', + ]) { + assert.ok(fn.includes(field), `${field} is snapshotted but never restored`); + } +}); + +test('the unit is restored once its own list has arrived', () => { + /* The unit select is filled by a per-row request that lands after the rows + are built, so setting it during the restore would select nothing. */ + const load = blockAt(itemsJs, 'loadVariant: function'); + assert.match(load, /wasRow && wasRow\.unit/, 'the unit is never restored'); + const restore = blockAt(itemsJs, 'restoreVariantRows: function'); + assert.doesNotMatch( + restore, + /put\('#items_unit_/, + 'the unit is set during the restore, when its list is still empty', + ); +}); + +test('the photo choice is restored before the strips are painted', () => { + /* Painted first, the strip reads an empty hidden input and shows nothing as + chosen - the choice is kept but looks lost, which is its own bug report. */ + const load = blockAt(itemsJs, 'loadVariant: function'); + const restoreAt = load.indexOf('restoreVariantRows('); + const paintAt = load.indexOf('renderVariantPhotoPickers()'); + assert.notStrictEqual(restoreAt, -1, 'no restore in loadVariant'); + assert.notStrictEqual(paintAt, -1, 'no strip paint in loadVariant'); + assert.ok(restoreAt < paintAt, 'the strips paint before the choice is restored'); +}); diff --git a/tests/window-chrome.test.js b/tests/window-chrome.test.js index 6ed400eb2..08d42b3a9 100644 --- a/tests/window-chrome.test.js +++ b/tests/window-chrome.test.js @@ -2,7 +2,7 @@ const test = require('node:test'); const assert = require('node:assert'); const { chromeFor, luminance, contrast, CHROME_FALLBACK, MIN_ICON_CONTRAST } = - require('../window-chrome'); + require('../src/window-chrome'); /* * The window controls have to stay visible on whatever the shop picked. diff --git a/tests/windows-code-signing.test.js b/tests/windows-code-signing.test.js new file mode 100644 index 000000000..418d82a4d --- /dev/null +++ b/tests/windows-code-signing.test.js @@ -0,0 +1,307 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); +const { stripComments } = require('./helpers/source-lookup'); + +/* + * Authenticode signing for the Windows build. + * + * The shape that needs guarding is unusual: signing is OPT-IN, because the + * certificate lives on a card that GitHub-hosted runners have no reader for. + * A build without the card must still succeed - otherwise turning signing on + * turns CI off. + * + * That choice has a cost, and it is what most of these tests are about: a + * forgotten environment variable produces a perfectly normal-looking release + * that says "Unknown publisher" on every customer's machine, and nothing else + * in the pipeline would mention it. + */ + +const ROOT = path.join(__dirname, '..'); +const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')); +const hook = fs.readFileSync(path.join(ROOT, 'scripts', 'sign-windows.js'), 'utf8'); +const win = pkg.build.win; + +test('the build is wired to the signing hook', () => { + const opts = win.signtoolOptions || {}; + assert.strictEqual( + opts.sign, + 'scripts/sign-windows.js', + 'nothing signs the Windows build', + ); + assert.ok( + fs.existsSync(path.join(ROOT, opts.sign)), + 'signtoolOptions.sign points at a file that does not exist - the build fails at pack time', + ); +}); + +test('signing is opt-in, so a machine without the card still builds', () => { + /* This is the whole reason for a custom hook. A certificate named in + package.json makes the build FAIL on a runner with no card reader; reading + it from the environment makes that build produce the unsigned installer it + produces today. */ + assert.ok( + !('certificateSubjectName' in (win.signtoolOptions || {})), + 'a certificate named in config makes every cardless build fail, CI included', + ); + assert.ok( + !('certificateSha1' in (win.signtoolOptions || {})), + 'a certificate named in config makes every cardless build fail, CI included', + ); + assert.ok( + !pkg.build.forceCodeSigning, + 'forceCodeSigning turns the graceful skip back into a hard failure', + ); + assert.match(hook, /POSNIC_SIGN_SHA1/, 'the hook reads no thumbprint from the environment'); + assert.match(hook, /POSNIC_SIGN_SUBJECT/, 'no subject-name fallback'); +}); + +test('an unsigned build says so, loudly', () => { + /* The failure mode this guards: a release that looks fine locally and shows + "Unknown publisher" to every customer. */ + const at = hook.indexOf('if (!how)'); + assert.notStrictEqual(at, -1, 'the not-configured branch is gone'); + const body = hook.slice(at, hook.indexOf('return true;', at)); + assert.match(body, /UNSIGNED/, 'skipping signing is silent'); + assert.match(body, /Unknown publisher/, 'it does not say what the user will actually see'); +}); + +test('every signature is timestamped', () => { + /* Without a timestamp the signature dies with the certificate - and this one + expires 2027-08-21, so every installer already sitting in a shop would + start warning on the same day. */ + assert.match(hook, /'\/tr'/, 'no RFC-3161 timestamp flag'); + assert.match(hook, /'\/td', 'sha256'/, 'the timestamp is not SHA-256'); + assert.match(hook, /time\.certum\.pl/, 'no timestamping authority'); + assert.match(hook, /'\/fd', 'sha256'/, 'the file digest is not SHA-256'); +}); + +test('a flaky timestamp server does not throw away the build', () => { + /* Public TSAs hiccup. An unretried failure costs a ten-minute build. */ + assert.match(hook, /TIMESTAMP_ATTEMPTS\s*=\s*[2-9]/, 'timestamping is not retried'); + /* But only the timestamp is worth retrying - a wrong thumbprint fails the + same way every time and just asks for the PIN again. */ + assert.match( + hook, + /attempt === TIMESTAMP_ATTEMPTS/, + 'the retry loop never gives up', + ); +}); + +test('a second signature appends instead of replacing the first', () => { + /* electron-builder asks twice when dual-signing. Without /as the second call + REPLACES the first, and the file ends up with one signature where two were + intended - which looks correct until something checks for both. */ + assert.match(hook, /isNest/, 'the nested-signature case is not handled'); + assert.match(hook, /'\/as'/, "a second signature would overwrite the first"); +}); + +test('signtool is found by version, not hardcoded', () => { + /* A pinned Windows Kit version is a build that breaks on the next SDK update, + on a machine nobody is looking at. */ + assert.ok( + !/10\.0\.\d{5}\.\d/.test(hook), + 'a specific Windows Kit version is hardcoded - the next SDK update breaks the build', + ); + assert.match(hook, /readdirSync/, 'the SDK directory is not searched'); +}); + +test('the stated publisher matches the certificate', () => { + /* Windows shows the CERTIFICATE's subject as the verified publisher, whatever + this says. Where it matters is electron-updater: with + verifyUpdateCodeSignature on, a mismatch rejects every update. Keeping them + equal means that flag can be turned on without breaking auto-update. */ + assert.strictEqual( + (win.signtoolOptions || {}).publisherName, + 'BillMax', + 'publisherName no longer matches the signing certificate CN (BillMax)', + ); +}); + +test('the helper scripts exist and are wired', () => { + for (const [name, file] of [ + ['sign:cert', 'scripts/find-signing-cert.js'], + ['sign:verify', 'scripts/verify-signature.js'], + ]) { + assert.strictEqual(pkg.scripts[name], `node ${file}`, `${name} is not wired`); + assert.ok(fs.existsSync(path.join(ROOT, file)), `${file} is missing`); + } +}); + +test('the verifier checks the timestamp, not just the signature', () => { + /* An unsigned file is obvious the first time somebody runs it. A signed file + with no timestamp looks perfect until the certificate expires. */ + const v = fs.readFileSync(path.join(ROOT, 'scripts', 'verify-signature.js'), 'utf8'); + assert.match(v, /timestamp/i, 'the verifier ignores timestamping'); + assert.match(v, /'\/pa'/, "verification does not use the Authenticode policy Windows itself applies"); + assert.match(v, /process\.exit\(1\)/, 'the verifier cannot fail a release'); +}); +test('a card error is not retried, because retrying can lock the card', () => { + /* Found by running the hook against a deliberately wrong thumbprint: it tried + three times. On a real card that is three PIN prompts for an answer that + cannot change, and repeated attempts are how a card gets LOCKED. Only a + timestamp failure is worth another go. */ + assert.match(hook, /function isTimestampFailure/, 'nothing classifies the failure'); + const at = hook.indexOf('function isTimestampFailure'); + const fn = hook.slice(at, hook.indexOf('}', hook.indexOf('return', at))); + assert.match(fn, /No certificates were found/, 'a missing certificate counts as retryable'); + + /* Anchored on the throw, not on `const output =` - that also appears inside + signOnce, ABOVE the loop, so slicing to it produced an empty string and + the assertion passed against nothing. */ + const from = hook.indexOf('for (let attempt'); + const loop = hook.slice(from, hook.indexOf('throw new Error', from)); + assert.ok(loop.length > 100, 'the retry loop could not be located'); + assert.match( + loop, + /if \(!isTimestampFailure\([\s\S]{0,40}\)\)/, + 'the loop retries every failure, not just timestamping', + ); + assert.match(loop, /break;/, 'a non-timestamp failure never stops the loop'); +}); + +test('the failure says which of the two things went wrong', () => { + /* "Command failed: <300 characters of signtool command line>" tells somebody + nothing about whether to plug the card in or just build again. */ + /* Scoped to the HINT block. A bare search for `npm run sign:cert` also finds + it in the not-configured warning far above, so deleting it from the error + left this passing on the strength of an unrelated message. */ + const hintAt = hook.indexOf('let hint ='); + assert.notStrictEqual(hintAt, -1, 'the hint block is gone'); + /* Search for the throw AFTER the hint: an earlier one handles the missing + SDK, and slicing to that produced an empty string - twice now, in two + different tests. A backwards slice always "passes". */ + const hints = hook.slice(hintAt, hook.indexOf('throw new Error', hintAt)); + assert.ok(hints.length > 80, 'the hint block could not be located'); + assert.match(hints, /npm run sign:cert/, 'a certificate failure does not point anywhere useful'); + assert.match(hints, /do NOT ship an untimestamped build/, 'a timestamp failure invites the wrong workaround'); +}); +test('an empty store is diagnosed, not just reported', () => { + /* "Insert the card and try again" is useless to somebody whose card IS + inserted and whose CardManager is showing them the certificate - which is + exactly what happened. The cause was two layers down: Windows publishes a + smart card's certificates only once a MINIDRIVER claims the card model, and + none claimed this one, so it showed as "Unknown Smart Card" while the card + worked perfectly inside CardManager. */ + const finder = fs.readFileSync(path.join(ROOT, 'scripts', 'find-signing-cert.js'), 'utf8'); + assert.match(finder, /function diagnose\(/, 'the empty case gives no diagnosis'); + assert.match(finder, /Unknown Smart Card/, 'the no-driver case is not distinguished'); + assert.match(finder, /Get-PnpDevice -Class SmartCard/, 'it never checks whether a card is present'); + assert.match(finder, /Calais/, 'it never checks which minidrivers are registered'); + + /* The registry path must not carry single backslashes: in a JS string + '\SOFTWARE' collapses to 'SOFTWARE' and the query silently returns + nothing, which read as "no Certum drivers installed" when four were. */ + /* + * NO backslash on ANY PowerShell line in these scripts. + * + * Inside a JS single-quoted string 'Cert:\CurrentUser\My' collapses to + * 'Cert:CurrentUserMy' - every escape swallowed - and PowerShell returns + * nothing for it. That is worse than an error: the registry query reported + * "Certum minidrivers registered: none" while four were installed, and the + * store query reported no certificate while a linked one sat right there. + * + * Guarding one line was not enough; both had the bug, and the second was + * found only because a certificate that WAS in the store kept reading as + * absent. Windows accepts forward slashes in both provider paths, so the + * rule is simply that no backslash belongs in these strings at all. + */ + const psLines = finder + .split(String.fromCharCode(10)) + .filter((l) => /Get-ChildItem|Get-PnpDevice|Get-Item /.test(l)); + assert.ok(psLines.length >= 2, 'the PowerShell queries are gone'); + for (const l of psLines) { + assert.ok( + !l.includes(String.fromCharCode(92)), + 'a PowerShell path uses backslashes - JS eats them and the query silently returns nothing: ' + l.trim(), + ); + } +}); +test('there is a way to sign before the card driver catches up', () => { + /* The minidriver for this card model does not exist yet, so Windows publishes + nothing from the card. But the Certum CSP reaches the same key today - + certutil enumerates its containers - so the certificate can be imported by + hand and repaired onto that key. Without this, signing waits on a vendor + driver release. */ + const link = fs.readFileSync(path.join(ROOT, 'scripts', 'link-signing-cert.js'), 'utf8'); + assert.strictEqual(pkg.scripts['sign:link'], 'node scripts/link-signing-cert.js'); + assert.match(link, /-addstore/, 'the certificate is never imported'); + assert.match(link, /-repairstore/, 'nothing links the certificate to the key on the card'); + + /* Importing without repairing leaves a certificate with no usable private + key - signtool refuses it, and the build looks broken for a reason that is + nowhere on screen. So the link step must be verified, not assumed. */ + assert.match(link, /HasPrivateKey/, 'the private key link is never verified'); + const tail = link.slice(link.indexOf('HasPrivateKey')); + assert.match(tail, /process\.exit\(1\)/, 'a certificate with no key is reported as success'); + assert.match(tail, /Do not ship a build believing it signed/, 'the consequence is not stated'); +}); + +test('re-running the link is safe', () => { + /* The interesting step is the repair, and somebody will run this twice while + working out why the card is not answering. An "already exists" on the + import must not stop it before it gets there. */ + const link = fs.readFileSync(path.join(ROOT, 'scripts', 'link-signing-cert.js'), 'utf8'); + assert.match(link, /already exists/i, 'a second run fails on the import and never repairs'); +}); + +test('the empty-store message offers the workaround', () => { + /* Telling somebody to wait for a driver, when a working path exists today, is + an answer that is technically true and practically useless. */ + const finder = fs.readFileSync(path.join(ROOT, 'scripts', 'find-signing-cert.js'), 'utf8'); + assert.match(finder, /sign:link/, 'the diagnosis names no way forward'); +}); +test('the held-card error is named, not left as "internal error"', () => { + /* signtool reports 0xc0000225 as "an unexpected internal error has occurred", + which is true and useless. It means the certificate and key were found but + the CARD could not be reached - almost always because proCertum CardManager + has it open, or SimplySign Desktop is in the tray. + + Naming it matters because every other signal looks perfect while it + happens: the store association is correct, the public keys match, the chain + validates and revocation passes. It cost most of a session to work out + once. */ + /* + * COMMENTS STRIPPED FIRST. The explanation above this branch names the error + * code, CardManager and the cause - so every assertion here passed against + * the prose while the actual condition was mutated away. Found by mutation + * testing; the first version of this test was worthless. + */ + const code = stripComments(hook); + assert.match(code, /c0000225/, 'the held-card error code is not recognised'); + const hintAt = code.indexOf('let hint ='); + const hints = code.slice(hintAt, code.indexOf('throw new Error', hintAt)); + assert.match(hints, /CardManager/, 'the fix is not named'); + assert.match(hints, /held open by another application/, 'the cause is not explained'); + /* It must be checked BEFORE the generic fallbacks, or the vaguer hint wins. */ + assert.ok( + hints.indexOf('c0000225') < hints.indexOf('No certificates were found'), + 'a more generic hint is tested first and shadows this one', + ); +}); +test('the thumbprint instructions work in the shell we actually use', () => { + /* + * `set VAR=value` is cmd syntax. In Git Bash it sets a positional parameter + * and leaves the environment untouched - so POSNIC_SIGN_SHA1 stays empty, the + * build runs, and the hook skips signing exactly as designed. The result is a + * finished installer saying "Unknown publisher", produced by somebody who + * followed the instructions this script printed. + * + * That happened. Git Bash is the shell this project is developed in, so its + * form is printed first and every line names its shell. + */ + const finder = fs.readFileSync(path.join(ROOT, 'scripts', 'find-signing-cert.js'), 'utf8'); + assert.match(finder, /export POSNIC_SIGN_SHA1=/, 'no Git Bash form - `set` silently does nothing there'); + assert.match(finder, /Git Bash/, 'the shells are not labelled, so the wrong line gets copied'); + const bash = finder.indexOf('export POSNIC_SIGN_SHA1='); + const cmd = finder.indexOf('set POSNIC_SIGN_SHA1=', finder.indexOf('To sign the next build')); + assert.ok(bash < cmd, 'the cmd form is printed first and will be the one copied'); + + /* The thumbprint must interpolate. A template placeholder inside a single- + quoted string prints literally, which is how the first version of this + told somebody to export the string "${usable[0].Thumbprint}". */ + const bt = String.fromCharCode(96); + const line = finder.split(String.fromCharCode(10)).find((l) => l.includes('export POSNIC_SIGN_SHA1=')); + assert.ok(line.includes(bt), 'the thumbprint line is not a template literal - it prints the placeholder'); +}); diff --git a/tests/windows-release-separately.test.js b/tests/windows-release-separately.test.js new file mode 100644 index 000000000..c0e600751 --- /dev/null +++ b/tests/windows-release-separately.test.js @@ -0,0 +1,150 @@ +const test = require('node:test'); +const assert = require('node:assert'); +const fs = require('fs'); +const path = require('path'); + +/* + * Windows is built and published from a desk, not from CI. + * + * Its code signing key lives on a Certum card. CA/Browser Forum rules have put + * code signing keys on certified hardware since June 2023, so there is no .pfx + * and no secret - and a GitHub-hosted runner has no card reader. A Windows + * build produced in CI could only ever be UNSIGNED, which is worse than no + * build at all: it looks finished and tells every customer the publisher is + * unknown. + * + * The risk this file guards is not the pipeline breaking. It is the pipeline + * working perfectly and shipping the wrong bytes - an unsigned installer, or a + * signed one whose latest.yml describes a different build. Neither announces + * itself; the second one stops auto-update on every till in the field without + * a single error anywhere. + */ + +const ROOT = path.join(__dirname, '..'); +const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8').replace(/\r\n/g, '\n'); +const pkg = require('../package.json'); +const workflow = read('.github/workflows/release.yml'); +const publisher = read('scripts/release-windows.js'); + +test('CI does not build Windows', () => { + /* An unsigned Windows installer reaching a release is the failure this + whole arrangement exists to prevent. */ + assert.ok( + !/os:\s*windows-latest/.test(workflow), + 'CI builds Windows again - it has no card reader, so that installer can only be unsigned', + ); + for (const os of ['macos-latest', 'ubuntu-latest']) { + assert.match(workflow, new RegExp(`os:\\s*${os}`), `${os} is no longer built in CI`); + } + /* And the absence has to be explained where somebody would add it back. */ + assert.match( + workflow, + /WINDOWS IS NOT BUILT HERE/, + 'nothing says why Windows is missing, so the next person will helpfully restore it', + ); +}); + +test('no step is left conditioned on a platform the matrix no longer has', () => { + /* `if: matrix.name == 'Windows'` against a matrix with no Windows is a step + that never runs. It reads as coverage and is not - which is worse than + having deleted it. */ + /* YAML comments stripped first. The note explaining why the step was removed + quotes the very condition it removed, so matching the raw file found the + prose and failed - the third time that shape has bitten in this session. */ + const code = workflow + .split(String.fromCharCode(10)) + .filter((l) => !l.trim().startsWith('#')) + .join(String.fromCharCode(10)); + assert.ok( + !/if:\s*matrix\.name\s*==\s*'Windows'/.test(code), + 'a Windows-only step survives in a workflow that no longer builds Windows', + ); +}); + +test('the publisher refuses anything unsigned or untimestamped', () => { + /* Signing is opt-in in this repo: a build with POSNIC_SIGN_SHA1 unset + succeeds and produces an unsigned installer. Without a gate here, the + easiest way to ship "Unknown publisher" to every customer is to forget one + environment variable. */ + assert.match(publisher, /Refusing to publish an unsigned installer/, 'unsigned builds can be published'); + assert.match( + publisher, + /Refusing to publish a signature with no timestamp/, + 'an untimestamped signature can be published - it dies with the certificate', + ); + assert.match(publisher, /'verify', '\/pa'/, 'it does not verify under the policy Windows itself applies'); + + /* Both refusals must actually stop the process. */ + const fail = publisher.slice(publisher.indexOf('function fail(')); + assert.match(fail.slice(0, 300), /process\.exit\(1\)/, 'fail() does not exit, so publishing continues'); +}); + +test('latest.yml is checked against the installer being uploaded', () => { + /* + * The subtle one. electron-updater reads latest.yml to learn the newest + * version and VERIFIES the sha512 before applying an update. Signing changes + * the installer's bytes, so a manifest from a different build does not warn - + * the update simply never installs, on every till already in the field. + */ + assert.match(publisher, /sha512/, 'the manifest hash is never read'); + assert.match(publisher, /createHash\('sha512'\)/, 'the installer is never hashed to compare'); + assert.match( + publisher, + /latest\.yml does not match the installer/, + 'a mismatched manifest is uploaded without complaint', + ); + assert.match( + publisher, + /SILENTLY/, + 'the consequence of a mismatch is not stated where somebody would read it', + ); +}); + +test('the Windows checksums are merged, not substituted', () => { + /* SHA256SUMS.txt is written in CI from the macOS and Linux artefacts. + Replacing it wholesale would drop the checksums for the two platforms this + machine never built. */ + assert.match(publisher, /SHA256SUMS\.txt/, 'the checksum file is not updated at all'); + assert.match(publisher, /release', 'download'/, 'it never fetches the existing file, so it can only overwrite'); + const merge = publisher.slice(publisher.indexOf('const keep =')); + assert.match(merge.slice(0, 400), /filter/, 'existing entries are not preserved'); +}); + +test('release:windows is wired, and the release notes tell the truth', () => { + assert.strictEqual(pkg.scripts['release:windows'], 'node scripts/release-windows.js'); + assert.ok(fs.existsSync(path.join(ROOT, 'scripts', 'release-windows.js'))); + + /* The notes have tracked the truth through three eras: "certificate on the + way", then "Windows signed, macOS not yet", and now - with the Developer + ID certificate live and the notary gate proven on a real dmg - every + platform carries a trust chain and the notes say exactly which one. */ + assert.ok( + !/The installers are not signed yet/.test(workflow), + 'the notes still tell Windows users to expect an unknown-publisher warning', + ); + assert.ok( + !/macOS is not signed yet/.test(workflow), + 'the notes still say macOS is unsigned - the notarize gate made that untrue', + ); + assert.match(workflow, /signed and notarized/, + 'the notes no longer state the macOS trust chain'); + assert.match(workflow, /packages\.posnic\.com/, + 'the notes no longer point Linux users at the signed APT repository'); +}); + +test('a stable release does not greet customers as a beta', () => { + /* This workflow builds every v* tag, betas included, so one hardcoded set + of notes served both - and a stable release would have opened with "This + is an early public build". The warning is now written only for a beta, + alpha or rc tag; everything below it is true of both. */ + const compose = workflow.slice(workflow.indexOf('Compose the release notes')); + assert.match(compose, /\*beta\*\|\*alpha\*\|\*rc\*/, + 'the notes no longer branch on the tag - stable would read as a beta again'); + assert.match(compose, /## Posnic \$\{TAG\}/, 'a stable release has no header of its own'); + assert.match(workflow, /body_path: release\/NOTES\.md/, + 'the composed notes are not the ones published'); + assert.ok( + !/This is a beta holding your sales/.test(workflow), + 'beta wording is still in the section both kinds of release share', + ); +});