@goplusvn/core 0.1.43 → 0.1.45

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.1.44 — UnifiedProfileDialog: chi nhánh mặc định + ngày sinh DatePicker + fix Select loại người dùng
+
+**Ngày sinh dùng `DatePicker` (thay `<input type="date">`):** ô ngày sinh cũ khó
+nhập tay và không đồng bộ style; nay dùng `DatePicker` (gõ được `dd/MM/yyyy` +
+lịch popover). Cầu nối 2 chiều `ymdToDate`/`dateToYmd` giữ nguyên định dạng lưu
+`"yyyy-MM-dd"`, neo giờ 00:00 địa phương để tránh lệch ngày do timezone.
+
+**Chi nhánh mặc định (`UserBranch.isDefault`):**
+
+- Tab "Công việc" của dialog người dùng: mỗi chi nhánh đã chọn có nút "⭐ Đặt
+  mặc định"; chi nhánh mặc định hiện badge "Mặc định". Chọn chi nhánh đầu tiên
+  tự động thành mặc định; bỏ chọn chi nhánh đang là mặc định thì tự thăng chi
+  nhánh còn lại kế tiếp.
+- Payload gửi thêm `defaultBranchId` (đã lọc để luôn nằm trong `branchIds`, fallback
+  `branchIds[0]`). App đọc field này thay cho hard-code `isDefault: index === 0`.
+- Đọc lại `data.defaultBranchId` khi mở dialog ở chế độ sửa (fallback `branchIds[0]`).
+
+**Fix Select "Loại người dùng" icon + chữ rớt 2 dòng:** base `SelectTrigger` của
+core có `[&_span]:line-clamp-none` — selector này (`.trigger span`, độ ưu tiên
+`0,1,1`) biên dịch kèm `display:block`, THẮNG class `inline-flex` (`0,1,0`) trên
+span icon+chữ bên trong, nên (cộng với Preflight `svg{display:block}`) icon bị
+đẩy xuống dòng riêng. Nới chiều ngang KHÔNG chữa vì đây là lỗi xếp dọc. Fix:
+trigger dùng `[&_span]:!inline-flex [&_span]:!items-center [&_span]:!gap-2`
+(`!important` thắng tuyệt đối `line-clamp-none` bất kể thứ tự stylesheet) +
+`[&_svg]:shrink-0`, `whitespace-nowrap`, `style={{width:210}}`. Kiểm chứng bằng
+repro Radix+Tailwind: span trong đổi `display` từ `block` → `flex`.
+
 ## 0.1.34 — Tab navigation: gom nhóm module, tiêu đề tab chi tiết, nút làm tươi
 
 **PageTabs:**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@goplusvn/core",
   "description": "GoPlusVN Platform Kit - ERP kernel: layout, RBAC, CRUD, multi-tenant, system pages",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "private": false,
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -158,7 +158,7 @@
     "swr": "^2.3.6",
     "tailwind-merge": "2.5.2",
     "vaul": "1.1.2",
-    "xlsx": "0.18.5",
+    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "zod": "3.23.8"
   },
   "scripts": {

package/src/auth/proxy-gate.ts

@@ -11,7 +11,6 @@
 //   export const config = { matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\.[^/]+$).*)"] };
 
 import { NextResponse } from "next/server";
-import { getToken } from "next-auth/jwt";
 import type { NextRequest } from "next/server";
 
 export interface AuthProxyOptions {
@@ -35,7 +34,16 @@ export function createAuthProxy(options: AuthProxyOptions = {}) {
   const publicPages = options.publicPages ?? ["/sign-in"];
   const signInPath = options.signInPath ?? "/sign-in";
   const homePath = options.homePath ?? "/";
-  const readToken = options.getToken ?? ((req: NextRequest) => getToken({ req }));
+  // next-auth chỉ được LAZY-load khi app không truyền getToken riêng — app đã
+  // sang Better Auth (không cài next-auth) sẽ không dính module-not-found lúc
+  // import proxy-gate (trước đây import top-level, next-auth lại chỉ nằm ở
+  // devDependencies của core).
+  const readToken =
+    options.getToken ??
+    (async (req: NextRequest) => {
+      const { getToken } = await import("next-auth/jwt");
+      return getToken({ req });
+    });
 
   return async function proxy(request: NextRequest) {
     const { pathname, search } = request.nextUrl;

package/src/crud/crud-route-handlers.ts

@@ -22,11 +22,25 @@ type MaybePromise<T> = T | Promise<T>;
 export interface CrudHandlerDeps {
   getSession: () => MaybePromise<any | null>;
   getEntityConfig: (entity: string) => EntityConfig | undefined;
-  service: ServerCrudService;
+  /** Một service dùng chung, HOẶC resolver theo entity — app có service
+   *  chuyên biệt (auto-gen số phiếu, stock-count…) trả service riêng cho
+   *  entity đó thay vì viết factory if-chain ngoài core (seam 2026-07). */
+  service:
+    | ServerCrudService
+    | ((entity: string) => MaybePromise<ServerCrudService>);
   /** Optional error mapper (e.g. app's serverError). Defaults to a 500 JSON. */
   onError?: (error: unknown, req: Request) => Response | Promise<Response>;
 }
 
+function makeServiceResolver(
+  service: CrudHandlerDeps["service"],
+): (entity: string) => Promise<ServerCrudService> {
+  if (typeof service === "function") {
+    return async (entity) => await service(entity);
+  }
+  return async () => service;
+}
+
 const json = (data: unknown, status = 200) =>
   new Response(JSON.stringify(data), { status, headers: { "content-type": "application/json" } });
 
@@ -40,7 +54,8 @@ async function resolvePerms(session: any, config: EntityConfig, entity: string)
 
 // GET/POST for the collection route `/api/crud/[entity]`.
 export function createCrudCollectionHandlers(deps: CrudHandlerDeps) {
-  const { getSession, getEntityConfig, service, onError } = deps;
+  const { getSession, getEntityConfig, onError } = deps;
+  const resolveService = makeServiceResolver(deps.service);
   const fail = (e: unknown, req: Request) =>
     onError ? onError(e, req) : json({ error: "Internal error" }, 500);
 
@@ -64,6 +79,7 @@ export function createCrudCollectionHandlers(deps: CrudHandlerDeps) {
           : undefined,
         filters: sp.get("filters") ? JSON.parse(sp.get("filters")!) : undefined,
       };
+      const service = await resolveService(entity);
       const data = await service.list(entity, config, params as any);
       return json(data);
     } catch (e) {
@@ -82,6 +98,7 @@ export function createCrudCollectionHandlers(deps: CrudHandlerDeps) {
       if (!perms.create) return forbidden();
 
       const body = await req.json();
+      const service = await resolveService(entity);
       if (Array.isArray(body)) {
         const results = [];
         for (const item of body) results.push(await service.create(entity, item, config));
@@ -98,7 +115,8 @@ export function createCrudCollectionHandlers(deps: CrudHandlerDeps) {
 
 // GET/PUT/PATCH/DELETE for the item route `/api/crud/[entity]/[id]`.
 export function createCrudItemHandlers(deps: CrudHandlerDeps) {
-  const { getSession, getEntityConfig, service, onError } = deps;
+  const { getSession, getEntityConfig, onError } = deps;
+  const resolveService = makeServiceResolver(deps.service);
   const fail = (e: unknown, req: Request) =>
     onError ? onError(e, req) : json({ error: "Internal error" }, 500);
 
@@ -113,7 +131,9 @@ export function createCrudItemHandlers(deps: CrudHandlerDeps) {
       if (!config) return unknownEntity();
       const perms = await resolvePerms(session, config, entity);
       if (!perms.read) return forbidden();
-      const item = await service.getById(entity, id);
+      const service = await resolveService(entity);
+      // Truyền config để detail áp cùng include như list (label thay raw FK id).
+      const item = await service.getById(entity, id, config);
       if (!item) return json({ error: "Not found" }, 404);
       return json(item);
     } catch (e) {
@@ -131,6 +151,7 @@ export function createCrudItemHandlers(deps: CrudHandlerDeps) {
       const perms = await resolvePerms(session, config, entity);
       if (!perms.update) return forbidden();
       const body = await req.json();
+      const service = await resolveService(entity);
       return json(await service.update(entity, id, body, config));
     } catch (e) {
       return fail(e, req);
@@ -146,6 +167,7 @@ export function createCrudItemHandlers(deps: CrudHandlerDeps) {
       if (!config) return unknownEntity();
       const perms = await resolvePerms(session, config, entity);
       if (!perms.delete) return forbidden();
+      const service = await resolveService(entity);
       await service.delete(entity, id);
       return new Response(null, { status: 204 });
     } catch (e) {

package/src/crud/lib/permissions.ts

@@ -1,7 +1,10 @@
 import type { CrudPermissions, EntityConfig } from "../../types";
 import type { Session } from "../../types";
 
-import { getCrudPermissionsFromSession } from "../../rbac/permissions";
+// Nguồn permission DUY NHẤT đã harden (BYPASS_AUTH chỉ hiệu lực ngoài
+// production, admin-role check chạy trước empty-permissions guard) — bản
+// divergent rbac/permissions.ts cũ đã xóa 2026-07 vì thiếu guard NODE_ENV.
+import { getCrudPermissionsFromSession } from "../../auth";
 
 /**
  * Get CRUD permissions for a user based on their session

package/src/crud/server-service.ts

@@ -22,9 +22,12 @@ type PrismaLike = Record<string, any>;
 
 export interface ServerCrudService {
   list(entity: string, config: EntityConfig, params: CrudQueryParams): Promise<CrudResponse>;
-  getById(entity: string, id: string): Promise<any>;
-  create(entity: string, data: any, config?: EntityConfig): Promise<any>;
-  update(entity: string, id: string, data: any, config?: EntityConfig): Promise<any>;
+  /** `config` (tùy chọn) để áp cùng `include` như list — detail không hiện raw FK id. */
+  getById(entity: string, id: string, config?: EntityConfig): Promise<any>;
+  /** `tx` (tùy chọn) để app chạy create CÙNG transaction với sinh số phiếu
+   *  advisory-lock (document-number yêu cầu cùng tx với insert). */
+  create(entity: string, data: any, config?: EntityConfig, tx?: PrismaLike): Promise<any>;
+  update(entity: string, id: string, data: any, config?: EntityConfig, tx?: PrismaLike): Promise<any>;
   delete(entity: string, id: string): Promise<any>;
   deleteMany(entity: string, ids: string[]): Promise<any>;
 }
@@ -43,8 +46,35 @@ export interface ServerCrudDeps {
    *  {@link createAuditUserNameResolver} if your User model exposes a name field. */
   resolveAuditNames?: (records: any[]) => Promise<any[]>;
   logger?: ServerCrudLogger;
+
+  // ── Seams 2026-07: đủ điểm cắm để app KHÔNG phải fork nguyên engine ──
+
+  /** WHERE mặc định theo entity, AND vào mọi list/count — vd 2 entity chia
+   *  chung 1 model: stock-in → { type: "in" }, stock-out → { type: "out" }. */
+  scopeWhere?: (
+    entity: string,
+    config: EntityConfig,
+  ) => Record<string, unknown> | undefined;
+  /** Field hệ thống luôn cho qua filterValidFields dù không khai trong
+   *  config.fields. Default: id + bộ audit (createdAt/updatedAt/createdBy/
+   *  updatedBy). App có cột riêng (companyId…) thì truyền thêm. */
+  systemFields?: string[];
+  /** Set updatedAt = new Date() khi create nếu payload chưa có — cho model
+   *  thiếu `@updatedAt`/default trong schema. Default: false. */
+  touchUpdatedAtOnCreate?: boolean;
+  /** Các cột `*Id` KHÔNG phải FK — bỏ qua transform connect/disconnect
+   *  (scalar như số CCCD, mã tra cứu…). Gộp thêm vào skip-list mặc định. */
+  relationFieldSkip?: string[];
 }
 
+const DEFAULT_SYSTEM_FIELDS = [
+  "id",
+  "createdAt",
+  "updatedAt",
+  "createdBy",
+  "updatedBy",
+];
+
 const MAX_PAGE_SIZE = 200;
 
 // Default plural→model resolver: strip trailing "s", camelCase kebab. Apps with
@@ -96,16 +126,18 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
     error: (m, ...r) => console.error(m, ...r),
   };
 
-  const model = (entity: string) => {
+  const systemFields = deps.systemFields ?? DEFAULT_SYSTEM_FIELDS;
+
+  const model = (entity: string, client: PrismaLike = prisma) => {
     const name = resolveModel(entity);
-    const m = prisma[name];
+    const m = client[name];
     if (!m) throw new Error(`Prisma model not found for entity: ${entity} (${name})`);
     return m;
   };
 
   const filterValidFields = (data: any, config: EntityConfig) => {
     const valid = new Set(config.fields.filter((f) => !(f as any).isDisplayOnly).map((f) => f.name));
-    valid.add("id");
+    for (const f of systemFields) valid.add(f);
     const out: Record<string, unknown> = {};
     for (const [k, v] of Object.entries(data)) {
       if (valid.has(k)) out[k] = v;
@@ -143,7 +175,16 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
 
   const transformRelationFields = (data: any, mode: "create" | "update") => {
     const out = { ...data };
-    const skip = new Set(["id", "createdBy", "updatedBy", "citizenId", "targetId"]);
+    // citizenId/targetId là legacy-default từ consumer đầu tiên — app mới khai
+    // cột scalar *Id của mình qua deps.relationFieldSkip thay vì sửa core.
+    const skip = new Set([
+      "id",
+      "createdBy",
+      "updatedBy",
+      "citizenId",
+      "targetId",
+      ...(deps.relationFieldSkip ?? []),
+    ]);
     for (const key of Object.keys(out)) {
       if (skip.has(key)) continue;
       if (key.endsWith("Id") && key.length > 2) {
@@ -181,7 +222,7 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
         return allowedFields.has(name);
       };
 
-      const where: any = {};
+      const where: any = { ...(deps.scopeWhere?.(entity, config) ?? {}) };
       if (search && search.trim()) {
         const term = search.trim();
         const searchFields = config.fields.filter((f) => f.filterable && f.type === "text").map((f) => f.name);
@@ -253,21 +294,28 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
       }
     },
 
-    async getById(entity, id) {
+    async getById(entity, id, config) {
       const prismaModel = model(entity);
-      const result = await prismaModel.findUnique({ where: { id } });
+      // Áp cùng include như list — detail dialog hiện label relation thay raw FK id.
+      const include: any = {};
+      if (config?.include?.length) config.include.forEach((inc) => (include[inc] = true));
+      const includeOption = Object.keys(include).length ? { include } : {};
+      const result = await prismaModel.findUnique({ where: { id }, ...includeOption });
       if (!result) return null;
       const serialized = serializeDecimalFields(result);
       const [resolved] = await resolveAuditNames([serialized]);
       return resolved;
     },
 
-    async create(entity, data, config) {
-      const prismaModel = model(entity);
+    async create(entity, data, config, tx) {
+      const prismaModel = model(entity, tx ?? prisma);
       try {
         let filtered = config ? filterValidFields(data, config) : data;
         if (config) filtered = castFieldValues(filtered, config);
         if (!filtered.id) filtered.id = crypto.randomUUID();
+        if (deps.touchUpdatedAtOnCreate && !filtered.updatedAt) {
+          filtered.updatedAt = new Date();
+        }
         const prismaData = transformRelationFields(filtered, "create");
         return serializeDecimalFields(await prismaModel.create({ data: prismaData }));
       } catch (error) {
@@ -276,8 +324,8 @@ export function createServerCrudService(deps: ServerCrudDeps): ServerCrudService
       }
     },
 
-    async update(entity, id, data, config) {
-      const prismaModel = model(entity);
+    async update(entity, id, data, config, tx) {
+      const prismaModel = model(entity, tx ?? prisma);
       try {
         let filtered = config ? filterValidFields(data, config) : data;
         if (config) filtered = castFieldValues(filtered, config);

package/src/errors/error-handler.ts

@@ -17,11 +17,27 @@ import { AppError, toAppError } from "./app-error"
  */
 export async function withErrorHandler(
     handler: () => Promise<Response>,
-    options?: { operation?: string; req?: NextRequest | Request }
+    options?: {
+        operation?: string
+        req?: NextRequest | Request
+        /**
+         * Seam persist lỗi (2026-07): mặc định chỉ console.error — lỗi KHÔNG
+         * vào error_logs. App truyền `onError: (e, req) => serverError(e, req)`
+         * (buildServerError ở ./server-error) để lỗi được lưu bền + giữ nguyên
+         * shape response (cả hai cùng kết thúc bằng createErrorResponse).
+         */
+        onError?: (
+            error: unknown,
+            req?: NextRequest | Request
+        ) => Response | Promise<Response>
+    }
 ): Promise<Response> {
     try {
         return await handler()
     } catch (error) {
+        if (options?.onError) {
+            return options.onError(error, options.req)
+        }
         const appError = toAppError(error)
 
         const requestContext = options?.req

package/src/errors/server-error.ts

@@ -1,5 +1,4 @@
 import type { NextResponse } from "next/server"
-import { createHash } from "crypto"
 
 import { AppError, toAppError } from "./app-error"
 import { createErrorResponse } from "./error-handler"
@@ -68,7 +67,24 @@ function buildFingerprint(
     /* keep raw */
   }
   const raw = [message.slice(0, 200), code || "", moduleTag || "", path].join("|")
-  return createHash("sha256").update(raw).digest("hex").slice(0, 16)
+  return fingerprint16(raw)
+}
+
+/**
+ * Fingerprint 16 hex để GOM NHÓM lỗi — không phải mật mã học. FNV-1a thuần
+ * (không import "crypto" của Node) vì error path bị instrumentation/proxy kéo
+ * vào Edge bundle, nơi không có module crypto (2026-07: dev webpack vỡ vì
+ * import node:crypto ở file này).
+ */
+function fingerprint16(raw: string): string {
+  let h1 = 0x811c9dc5
+  let h2 = 0xcbf29ce4
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw.charCodeAt(i)
+    h1 = Math.imul(h1 ^ c, 0x01000193) >>> 0
+    h2 = Math.imul(h2 ^ ((c << 1) | 1), 0x01000193) >>> 0
+  }
+  return h1.toString(16).padStart(8, "0") + h2.toString(16).padStart(8, "0")
 }
 
 /**

package/src/system/services/settings-service.ts

@@ -1,8 +1,54 @@
-const db: any = { systemConfig: { findUnique: async () => null, upsert: async () => null } }; // Mocked for build
-
 import { cache } from "react";
 import { revalidateTag, unstable_cache } from "next/cache";
 
+/**
+ * DB được INJECT từ app (core không import prisma client cụ thể). Trước
+ * 2026-07 chỗ này là `const db: any = {...} // Mocked for build` — mọi
+ * getSettings âm thầm trả default và saveSettings ghi vào hư không (gốc của
+ * regression "settings admin chỉnh không ăn"). App gọi
+ * `configureSettingsService(db)` MỘT lần ở composition root (cạnh chỗ tạo
+ * prisma client).
+ */
+// Structural + schema-agnostic (giống PrismaLike ở crud/server-service): args
+// để lỏng vì generated types của Prisma mỗi app một khác — chỉ chốt shape trả
+// về mà service thật sự đọc.
+export interface SettingsDb {
+  systemConfig: {
+    findUnique(args: any): Promise<{ value: string | null } | null>;
+    upsert(args: any): Promise<unknown>;
+  };
+}
+
+let configuredDb: SettingsDb | null = null;
+let warnedMissingDb = false;
+
+export function configureSettingsService(db: SettingsDb): void {
+  configuredDb = db;
+}
+
+/** Đọc: thiếu db → cảnh báo TO (một lần) + trả default — không sập build/SSR. */
+function dbForRead(): SettingsDb | null {
+  if (configuredDb) return configuredDb;
+  if (!warnedMissingDb) {
+    warnedMissingDb = true;
+    console.warn(
+      "[SettingsService] Chưa configureSettingsService(db) — mọi getSettings " +
+        "đang trả DEFAULT (setting admin chỉnh sẽ không có hiệu lực). " +
+        "Gọi configureSettingsService(db) ở composition root của app.",
+    );
+  }
+  return null;
+}
+
+/** Ghi: thiếu db → THROW. Ghi-vào-hư-không tệ hơn lỗi ồn ào. */
+function dbForWrite(): SettingsDb {
+  if (configuredDb) return configuredDb;
+  throw new Error(
+    "[SettingsService] saveSettings cần configureSettingsService(db) — " +
+      "từ chối ghi vào hư không (trước đây mock db nuốt mất dữ liệu).",
+  );
+}
+
 export interface AuditSettings {
   retentionDays: number;
   enabledResources: string[];
@@ -52,6 +98,8 @@ const DEFAULT_SALES_RULES_SETTINGS: SalesRulesSettings = {
 export class SettingsService {
   /** Get all settings cached */
   static async getSettings<T>(key: string, defaultValue: T): Promise<T> {
+    const db = dbForRead();
+    if (!db) return defaultValue;
     return unstable_cache(
       async () => {
         const config = await db.systemConfig.findUnique({
@@ -88,6 +136,7 @@ export class SettingsService {
     value: T,
     category = "general",
   ): Promise<void> {
+    const db = dbForWrite();
     await db.systemConfig.upsert({
       where: { key },
       update: {

package/src/user/components/unified-profile-dialog.tsx

@@ -21,6 +21,7 @@ import {
   SelectTrigger,
   SelectValue,
   Switch,
+  DatePicker,
 } from "../../ui";
 import { toast } from "sonner";
 import { cn } from "../../utils";
@@ -38,6 +39,7 @@ import {
   Briefcase,
   ShieldCheck,
   KeyRound,
+  Star,
 } from "lucide-react";
 
 interface UnifiedProfileDialogProps {
@@ -59,6 +61,22 @@ const fetcher = async (url: string) => {
   return Array.isArray(data) ? data : data.items || data.data || [];
 };
 
+// birthday được lưu/gửi dưới dạng chuỗi "yyyy-MM-dd" (như input date cũ).
+// DatePicker làm việc với Date nên cần cầu nối 2 chiều, tránh lệch ngày do TZ
+// bằng cách neo giờ 00:00 địa phương và tự dựng chuỗi (không dùng toISOString).
+const ymdToDate = (s?: string): Date | undefined => {
+  if (!s) return undefined;
+  const d = new Date(`${s}T00:00:00`);
+  return isNaN(d.getTime()) ? undefined : d;
+};
+const dateToYmd = (d?: Date): string => {
+  if (!d) return "";
+  const y = d.getFullYear();
+  const m = String(d.getMonth() + 1).padStart(2, "0");
+  const day = String(d.getDate()).padStart(2, "0");
+  return `${y}-${m}-${day}`;
+};
+
 export function UnifiedProfileDialog({
   open,
   onOpenChange,
@@ -102,6 +120,7 @@ export function UnifiedProfileDialog({
   const [profileData, setProfileData] = useState<any>({});
   const [selectedRoles, setSelectedRoles] = useState<string[]>([]);
   const [selectedBranches, setSelectedBranches] = useState<string[]>([]);
+  const [defaultBranchId, setDefaultBranchId] = useState<string | null>(null);
   const [passwordData, setPasswordData] = useState({
     password: "",
     confirm: "",
@@ -173,6 +192,7 @@ export function UnifiedProfileDialog({
         });
         setSelectedRoles([]);
         setSelectedBranches([]);
+        setDefaultBranchId(null);
         setPasswordData({ password: "", confirm: "" });
         setEnableAccount(false);
       } else {
@@ -203,6 +223,9 @@ export function UnifiedProfileDialog({
         const roles = d.roleCodes || [];
         setSelectedRoles(roles);
         setSelectedBranches(d.branchIds || []);
+        setDefaultBranchId(
+          d.defaultBranchId || (d.branchIds && d.branchIds[0]) || null,
+        );
         setPasswordData({ password: "", confirm: "" });
         // Enable account if user has roles or if it's not a customer (employees always have accounts?)
         // For now, if roles exist, we assume account is enabled.
@@ -216,11 +239,39 @@ export function UnifiedProfileDialog({
       if (mode === "create" || (data?.branchIds?.length || 0) === 0) {
         if (selectedBranches.length === 0) {
           setSelectedBranches([branches[0].id]);
+          setDefaultBranchId(branches[0].id);
         }
       }
     }
   }, [open, branches, mode, data]);
 
+  // -- Branch selection helpers --
+  // Toggle a branch's membership while keeping a valid default branch.
+  const toggleBranch = (branchId: string) => {
+    if (selectedBranches.includes(branchId)) {
+      const next = selectedBranches.filter((id) => id !== branchId);
+      setSelectedBranches(next);
+      // Removing the current default → promote the first remaining branch.
+      if (defaultBranchId === branchId) {
+        setDefaultBranchId(next[0] ?? null);
+      }
+    } else {
+      setSelectedBranches([...selectedBranches, branchId]);
+      // First branch selected becomes the default automatically.
+      if (!defaultBranchId) {
+        setDefaultBranchId(branchId);
+      }
+    }
+  };
+
+  // Mark a (selected) branch as the default working branch.
+  const markDefaultBranch = (branchId: string) => {
+    if (!selectedBranches.includes(branchId)) {
+      setSelectedBranches((prev) => [...prev, branchId]);
+    }
+    setDefaultBranchId(branchId);
+  };
+
   // -- Helpers --
   const getInitials = (name: string | null) => {
     if (!name) return "U";
@@ -254,6 +305,10 @@ export function UnifiedProfileDialog({
         userType, // Add userType to payload
         roleCodes: selectedRoles,
         branchIds: selectedBranches,
+        defaultBranchId:
+          defaultBranchId && selectedBranches.includes(defaultBranchId)
+            ? defaultBranchId
+            : (selectedBranches[0] ?? null),
       };
 
       // Handle Password for Customer
@@ -394,25 +449,41 @@ export function UnifiedProfileDialog({
                     onValueChange={(val) => setUserType(val)}
                     disabled={mode === "view"}
                   >
-                    <SelectTrigger className="w-[140px] bg-white dark:bg-[#1e293b] border-[#e2e8f0] dark:border-[#334155] focus:ring-[#1641CE] focus:border-[#1641CE] h-9 rounded-md">
+                    <SelectTrigger
+                      style={{ width: 210 }}
+                      // Base SelectTrigger có `[&_span]:line-clamp-none` — selector này biên
+                      // dịch kèm `display:block` với độ ưu tiên (0,1,1) cao hơn `inline-flex`
+                      // (0,1,0) của span icon+chữ bên trong, nên icon (svg Preflight display:block)
+                      // bị đẩy xuống dòng riêng. `!inline-flex` (!important) thắng tuyệt đối.
+                      className="shrink-0 h-9 min-h-0 whitespace-nowrap [&_span]:!inline-flex [&_span]:!items-center [&_span]:!gap-2 [&_span]:overflow-hidden [&_svg]:shrink-0 bg-white dark:bg-[#1e293b] border-[#e2e8f0] dark:border-[#334155] focus:ring-[#1641CE] focus:border-[#1641CE] rounded-md"
+                    >
                       <SelectValue placeholder="Chọn loại" />
                     </SelectTrigger>
                     <SelectContent>
                       <SelectItem value="employee">
-                        <span className="flex items-center gap-2">
-                          <UserCog className="h-4 w-4 text-[#1641CE]" />
+                        <span
+                          className="inline-flex items-center gap-2"
+                          style={{ whiteSpace: "nowrap" }}
+                        >
+                          <UserCog className="h-4 w-4 text-[#1641CE] shrink-0" />
                           Nhân viên
                         </span>
                       </SelectItem>
                       <SelectItem value="customer">
-                        <span className="flex items-center gap-2">
-                          <User className="h-4 w-4 text-[#059669]" />
+                        <span
+                          className="inline-flex items-center gap-2"
+                          style={{ whiteSpace: "nowrap" }}
+                        >
+                          <User className="h-4 w-4 text-[#059669] shrink-0" />
                           Khách hàng
                         </span>
                       </SelectItem>
                       <SelectItem value="supplier">
-                        <span className="flex items-center gap-2">
-                          <Store className="h-4 w-4 text-[#EA580C]" />
+                        <span
+                          className="inline-flex items-center gap-2"
+                          style={{ whiteSpace: "nowrap" }}
+                        >
+                          <Store className="h-4 w-4 text-[#EA580C] shrink-0" />
                           Nhà cung cấp
                         </span>
                       </SelectItem>
@@ -587,16 +658,17 @@ export function UnifiedProfileDialog({
                       {/* Additional Info for All */}
                       <div className="space-y-1.5">
                         <Label className="text-[13px] font-medium text-[#334155] dark:text-[#cbd5e1]">Ngày sinh</Label>
-                        <Input
-                          type="date"
-                          value={profileData.birthday}
-                          onChange={(e) =>
+                        <DatePicker
+                          value={ymdToDate(profileData.birthday)}
+                          onValueChange={(d) =>
                             setProfileData({
                               ...profileData,
-                              birthday: e.target.value,
+                              birthday: dateToYmd(d),
                             })
                           }
-                          className="bg-white dark:bg-[#1e293b] border-[#e2e8f0] dark:border-[#334155] focus:ring-primary focus:border-primary rounded-md h-9 text-[13px]"
+                          formatStr="dd/MM/yyyy"
+                          placeholder="dd/mm/yyyy"
+                          buttonClassName="bg-white dark:bg-[#1e293b] border-[#e2e8f0] dark:border-[#334155] focus:ring-primary focus:border-primary rounded-md h-9 text-[13px]"
                         />
                       </div>
                       <div className="space-y-1.5">
@@ -816,34 +888,56 @@ export function UnifiedProfileDialog({
                         </Select>
                       </div>
                       <div className="col-span-2 space-y-3 pt-2">
-                        <Label className="text-[13px] font-medium text-[#41454d] dark:text-[#9297a0]">Chi nhánh làm việc</Label>
+                        <div className="flex items-center justify-between gap-3 flex-wrap">
+                          <Label className="text-[13px] font-medium text-[#41454d] dark:text-[#9297a0]">Chi nhánh làm việc</Label>
+                          <span className="inline-flex items-center gap-1 text-[12px] text-[#94a3b8]">
+                            <Star className="h-3 w-3" />
+                            Đánh dấu một chi nhánh mặc định
+                          </span>
+                        </div>
                         <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
                           {branches?.map((branch) => {
                             const isSelected = selectedBranches.includes(branch.id);
+                            const isDefault =
+                              isSelected && defaultBranchId === branch.id;
                             return (
                               <div
                                 key={branch.id}
                                 className={cn(
-                                  "flex items-center gap-3 p-3 rounded-md border cursor-pointer hover:bg-slate-50 transition-colors",
+                                  "flex items-center gap-3 p-3 rounded-md border cursor-pointer hover:bg-slate-50 dark:hover:bg-slate-800/40 transition-colors",
                                   isSelected
-                                    ? "border-blue-500 bg-blue-50/50"
+                                    ? "border-blue-500 bg-blue-50/50 dark:bg-blue-500/10"
                                     : "bg-background border-slate-200 dark:border-slate-800",
                                 )}
-                                onClick={() => {
-                                  setSelectedBranches((prev) =>
-                                    prev.includes(branch.id)
-                                      ? prev.filter((id) => id !== branch.id)
-                                      : [...prev, branch.id],
-                                  );
-                                }}
+                                onClick={() => toggleBranch(branch.id)}
                               >
                                 <Checkbox
                                   checked={isSelected}
                                   className="data-[state=checked]:bg-blue-600 data-[state=checked]:border-blue-600"
                                 />
-                                <span className="text-sm font-medium text-slate-900 dark:text-slate-100">
+                                <span className="flex-1 text-sm font-medium text-slate-900 dark:text-slate-100">
                                   {branch.name}
                                 </span>
+                                {isSelected &&
+                                  (isDefault ? (
+                                    <span className="inline-flex items-center gap-1 rounded-full bg-blue-600 px-2 py-0.5 text-[11px] font-semibold text-white shrink-0">
+                                      <Star className="h-3 w-3 fill-current" />
+                                      Mặc định
+                                    </span>
+                                  ) : (
+                                    <button
+                                      type="button"
+                                      onClick={(e) => {
+                                        e.stopPropagation();
+                                        markDefaultBranch(branch.id);
+                                      }}
+                                      title="Đặt làm chi nhánh mặc định"
+                                      className="inline-flex items-center gap-1 rounded-full border border-slate-200 dark:border-slate-700 px-2 py-0.5 text-[11px] font-medium text-slate-500 dark:text-slate-400 hover:border-blue-400 hover:text-blue-600 transition-colors shrink-0"
+                                    >
+                                      <Star className="h-3 w-3" />
+                                      Đặt mặc định
+                                    </button>
+                                  ))}
                               </div>
                             );
                           })}

package/src/rbac/permissions.ts

@@ -1,134 +0,0 @@
-// @goerp/core/rbac/permissions
-// Server-only permission utilities - no client/UI imports
-// Use this in Server Components and API routes to avoid bundling client code
-
-import type { Permission, Session } from "../types";
-
-// ============================================================================
-// Action Mapping
-// ============================================================================
-
-export const CRUD_ACTIONS = {
-  create: "create",
-  view: "view",
-  update: "update",
-  delete: "delete",
-  export: "export",
-  import: "import",
-  approve: "approve",
-  reject: "reject",
-} as const;
-
-export type CrudAction = keyof typeof CRUD_ACTIONS;
-
-export function getActionCode(operation: CrudAction): string {
-  return CRUD_ACTIONS[operation];
-}
-
-// ============================================================================
-// Permission Helpers
-// ============================================================================
-
-interface ExtendedUser {
-  id: string;
-  name?: string | null;
-  email?: string | null;
-  image?: string | null;
-  roles?: string[];
-  permissions?: Permission[];
-}
-
-const BYPASS_AUTH =
-  process.env.BYPASS_AUTH === "true" || process.env.BYPASS_AUTH === "1";
-
-const ADMIN_ROLE_CODES = ["admin", "SUPER_ADMIN"];
-
-export function getCrudPermissionsFromSession(
-  session: Session | null,
-  entity: string,
-): {
-  create: boolean;
-  view: boolean;
-  update: boolean;
-  delete: boolean;
-  export: boolean;
-  import: boolean;
-  approve: boolean;
-  reject: boolean;
-} {
-  if (BYPASS_AUTH) {
-    return {
-      create: true,
-      view: true,
-      update: true,
-      delete: true,
-      export: true,
-      import: true,
-      approve: true,
-      reject: true,
-    };
-  }
-
-  if (!session?.user) {
-    return {
-      create: false,
-      view: false,
-      update: false,
-      delete: false,
-      export: false,
-      import: false,
-      approve: false,
-      reject: false,
-    };
-  }
-
-  const user = session.user as ExtendedUser;
-
-  if (!user.id) {
-    return {
-      create: false,
-      view: false,
-      update: false,
-      delete: false,
-      export: false,
-      import: false,
-      approve: false,
-      reject: false,
-    };
-  }
-
-  const isAdmin = user.roles?.some((role) => ADMIN_ROLE_CODES.includes(role));
-  if (isAdmin) {
-    return {
-      create: true,
-      view: true,
-      update: true,
-      delete: true,
-      export: true,
-      import: true,
-      approve: true,
-      reject: true,
-    };
-  }
-
-  const permissions = user.permissions || [];
-  const permissionKeys = new Set(
-    permissions.map((p) => `${p.resourceCode}:${p.actionCode}`),
-  );
-
-  const hasPermission = (action: string) => {
-    const key = `${entity}:${action}`;
-    return permissionKeys.has(key);
-  };
-
-  return {
-    create: hasPermission(getActionCode("create")),
-    view: hasPermission(getActionCode("view")),
-    update: hasPermission(getActionCode("update")),
-    delete: hasPermission(getActionCode("delete")),
-    export: hasPermission(getActionCode("export")),
-    import: hasPermission(getActionCode("import")),
-    approve: hasPermission(getActionCode("approve")),
-    reject: hasPermission(getActionCode("reject")),
-  };
-}