@ozdao/martyrs 0.2.604 → 0.2.605

package/src/modules/orders/controllers/orders.controller.js

@@ -1,5 +1,6 @@
 import mailing from '@martyrs/src/modules/core/controllers/utils/mailing.js';
 import queryProcessorCore from '@martyrs/src/modules/core/controllers/utils/queryProcessor.js';
+import { calcRentTotalPrice } from '@martyrs/src/modules/orders/utils/rent-price.js';
 const { sendChatMessageTelegram } = mailing;
 function formatPositions(positions) {
   return positions.map(pos => `🔹 ${pos.name} - Price: $${pos.price}, Quantity: ${pos.quantity}`).join('\n');
@@ -33,16 +34,19 @@ const controllerFactory = db => {
   const Order = db.order;
   const Customer = db.customer;
   const Department = db.department;
+  const Organization = db.organization;
+  const Variant = db.variant;
 
   // Оптимизированная функция получения пользователей с доступом orders.confirm
+  // Если нет участников в отделах с доступом — фоллбэк на owner организации
   const getUsersWithOrdersConfirmAccess = async (organizationId) => {
     console.log('=== Getting users with orders.confirm access ===');
     console.log('Organization ID:', organizationId);
-    
+
     const pipeline = [
-      { $match: { 
+      { $match: {
         organization: new db.mongoose.Types.ObjectId(organizationId),
-        'accesses.orders.confirm': true 
+        'accesses.orders.confirm': true
       }},
       { $unwind: '$members' },
       { $group: {
@@ -50,19 +54,115 @@ const controllerFactory = db => {
       }},
       { $project: { userId: '$_id' }}
     ];
-    
+
     console.log('Pipeline:', JSON.stringify(pipeline, null, 2));
-    
+
     const result = await Department.aggregate(pipeline);
-    const userIds = result.map(item => item.userId);
-    
+    let userIds = result.map(item => item.userId);
+
     console.log('Found departments with access:', result.length);
     console.log('User IDs with access:', userIds);
+
+    // Фоллбэк: если нет участников в отделах — отправляем всем админам платформы
+    if (userIds.length === 0) {
+      console.log('No department members with access, falling back to platform admins');
+      const Role = db.mongoose.model('Role');
+      const User = db.mongoose.model('User');
+      const adminRole = await Role.findOne({ name: 'admin' }, { _id: 1 }).lean();
+      if (adminRole) {
+        const admins = await User.find({ roles: adminRole._id }, { _id: 1 }).lean();
+        userIds = admins.map(a => a._id);
+        console.log('Fallback to platform admins:', userIds);
+      }
+    }
+
     console.log('=== End getting users ===');
-    
+
     return userIds;
   };
 
+  // Escape HTML entities for Telegram HTML parse_mode (required: <, >, &)
+  const escHtml = (str) => String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+
+  // Форматирование Telegram-сообщения об ордере (HTML)
+  const formatOrderTelegram = async (order, type, extraData = {}) => {
+    // Получаем данные клиента
+    let customerName = '';
+    let customerPhone = '';
+    let customerEmail = '';
+    let customerTelegram = '';
+    try {
+      const customer = await db.mongoose.model('Customer').findById(order.customer?.target);
+      if (customer) {
+        customerName = customer.profile?.name || '';
+        customerPhone = customer.phone || '';
+        customerEmail = customer.email || '';
+        customerTelegram = customer.socials?.telegram || '';
+      }
+    } catch (e) {
+      console.error('[Telegram] Failed to fetch customer:', e.message);
+    }
+
+    const orderId = order._id.toString();
+    const baseUrl = process.env.API_URL || `https://${process.env.DOMAIN_URL}`;
+    const orderUrl = `${baseUrl}/backoffice/orders/${orderId}`;
+    const total = order.totalPrice || 0;
+
+    const fmtDate = (d) => new Date(d).toLocaleDateString('en-GB', { day: 'numeric', month: 'short', year: 'numeric' });
+    const fmtTime = (d) => { const dt = new Date(d); return `${String(dt.getHours()).padStart(2, '0')}:${String(dt.getMinutes()).padStart(2, '0')}`; };
+
+    // Позиции
+    const posLines = (order.positions || []).map(pos => {
+      let datePart = '';
+      if (pos.listing === 'rent' && pos.date?.start && pos.date?.end) {
+        const isShort = ['hour', '4hours', 'flat'].includes(pos.rentPeriod);
+        if (isShort) {
+          datePart = ` / ${fmtDate(pos.date.start)}, ${fmtTime(pos.date.start)}–${fmtTime(pos.date.end)}`;
+        } else {
+          datePart = ` / ${fmtDate(pos.date.start)} – ${fmtDate(pos.date.end)}`;
+        }
+      }
+      return `- ${escHtml(pos.name)}${datePart} / ${pos.quantity} x ฿${pos.price}`;
+    }).join('\n');
+
+    if (type === 'order_created') {
+      const lines = [];
+      lines.push(`🆕 <a href="${orderUrl}">New Order from ${escHtml(customerName) || 'Guest'}</a>`);
+      lines.push('');
+      if (customerPhone) lines.push(`Phone: ${escHtml(customerPhone)}`);
+      if (customerEmail) lines.push(`Email: ${escHtml(customerEmail)}`);
+      if (customerTelegram) lines.push(`Telegram: @${escHtml(customerTelegram.replace('@', ''))}`);
+      lines.push('');
+      if (order.payment?.type) lines.push(`Payment: ${escHtml(order.payment.type)}`);
+      lines.push('');
+      lines.push('📦 Positions:');
+      lines.push(posLines);
+      lines.push('');
+      lines.push(`In total: ฿${total}`);
+      if (order.delivery?.address) lines.push(`\nDelivery: ${escHtml(order.delivery.address)}`);
+      if (order.comment) lines.push(`\n💬 Comment: ${escHtml(order.comment)}`);
+      return {
+        text: lines.join('\n'),
+        reply_markup: {
+          inline_keyboard: [[
+            { text: '✅ Confirm', callback_data: `order_confirm:${orderId}` },
+            { text: '❌ Cancel', callback_data: `order_cancel:${orderId}` },
+          ]],
+        },
+      };
+    }
+
+    if (type === 'order_status') {
+      const lines = [];
+      lines.push(`📋 <a href="${orderUrl}">Order — ${escHtml(customerName) || 'Guest'}</a>`);
+      lines.push(`${escHtml(extraData.oldStatus)} → <b>${escHtml(extraData.newStatus)}</b>`);
+      lines.push(`In total: ฿${total}`);
+      return lines.join('\n');
+    }
+
+    return `📋 <a href="${orderUrl}">Order</a> updated`;
+  };
+
   // Отправка уведомлений о заказах - только данные
   const sendOrderNotifications = async (order, type, userIds, extraData = {}) => {
     console.log('=== Sending order notifications ===');
@@ -70,12 +170,21 @@ const controllerFactory = db => {
     console.log('Type:', type);
     console.log('User IDs:', userIds);
     console.log('Extra data:', extraData);
-    
+
     if (!userIds || userIds.length === 0) {
       console.log('No users to notify, skipping...');
       return;
     }
 
+    // Форматируем Telegram-сообщение один раз для всех юзеров
+    const telegramResult = await formatOrderTelegram(order, type, extraData);
+    // formatOrderTelegram returns either a string or { text, reply_markup }
+    const telegramBody = typeof telegramResult === 'string' ? telegramResult : telegramResult.text;
+    const telegramOptions = { parse_mode: 'HTML', disable_web_page_preview: true };
+    if (typeof telegramResult === 'object' && telegramResult.reply_markup) {
+      telegramOptions.reply_markup = telegramResult.reply_markup;
+    }
+
     const notifications = userIds.map(userId => ({
       title: getNotificationTitle(type, order, extraData),
       body: getNotificationBody(type, order, extraData),
@@ -84,6 +193,12 @@ const controllerFactory = db => {
         type: type,
         orderId: order._id,
         context: 'organization',
+        channels: {
+          telegram: {
+            body: telegramBody,
+            options: telegramOptions,
+          },
+        },
         ...extraData
       },
       userId: userId
@@ -160,6 +275,22 @@ const controllerFactory = db => {
     if (Object.keys(searchCriteria).length > 0) {
       customer = await Customer.findOne({ $or: [searchCriteria] });
     }
+    // Update existing customer with new info if provided
+    if (customer) {
+      const updates = {};
+      if (customerInfo.profile?.name && !customer.profile?.name) {
+        updates['profile.name'] = customerInfo.profile.name;
+      }
+      if (customerInfo.socials) {
+        for (const [key, val] of Object.entries(customerInfo.socials)) {
+          if (val && !customer.socials?.[key]) updates[`socials.${key}`] = val;
+        }
+      }
+      if (Object.keys(updates).length > 0) {
+        await Customer.updateOne({ _id: customer._id }, { $set: updates });
+        customer = await Customer.findById(customer._id);
+      }
+    }
     if (!customer) {
       // Create visitor for anonymous customer
       const visitorsService = getVisitorsService();
@@ -217,6 +348,25 @@ const controllerFactory = db => {
     });
 
 
+    // Server-side price validation
+    if (orderData.positions && orderData.positions.length > 0) {
+      const variantIds = orderData.positions.map(pos => pos.variant).filter(Boolean);
+      const variants = variantIds.length > 0 ? await Variant.find({ _id: { $in: variantIds } }).lean() : [];
+      const variantMap = {};
+      for (const v of variants) {
+        variantMap[v._id.toString()] = v;
+      }
+      for (const pos of orderData.positions) {
+        if (pos.variant) {
+          const variant = variantMap[pos.variant.toString ? pos.variant.toString() : pos.variant];
+          if (!variant) {
+            return res.status(400).send({ errorCode: 'INVALID_VARIANT', message: `Variant ${pos.variant} not found.` });
+          }
+          pos.price = variant.price;
+        }
+      }
+    }
+
     // Start a database transaction
     const session = await db.mongoose.startSession();
     session.startTransaction();
@@ -243,12 +393,69 @@ const controllerFactory = db => {
         }
       }
       console.log('Order data after customer processing:', orderData);
+      // Snapshot prices into positions and calculate totalPrice
+      if (orderData.positions && orderData.positions.length > 0) {
+        let orderTotal = 0;
+        for (const pos of orderData.positions) {
+          if (pos.listing === 'rent' && pos.date?.start && pos.date?.end) {
+            pos.totalPrice = calcRentTotalPrice(pos.price, pos.quantity, pos.date.start, pos.date.end, pos.rentPeriod || 'day');
+          } else {
+            pos.totalPrice = (pos.price || 0) * (pos.quantity || 1);
+          }
+          orderTotal += pos.totalPrice;
+        }
+        orderData.totalPrice = orderTotal;
+      }
       // Now create the order with proper references
       const order = await Order.create([orderData], { session });
       const createdOrder = order[0];
-      // Don't process positions during order creation - moved to update when status changes to confirmed
+
       // Commit the transaction
       await session.commitTransaction();
+
+      // Create rents immediately after order creation (outside transaction — via API)
+      // Skip if rents were already created externally (e.g. from Rents page)
+      const existingRents = req.body.existingRents || [];
+      try {
+        const rentPositions = existingRents.length > 0 ? [] : (createdOrder.positions || []).filter(pos => pos.listing === 'rent' && pos.date?.start && pos.date?.end);
+        if (rentPositions.length > 0) {
+          console.log(`Creating ${rentPositions.length} rents for new order ${createdOrder._id}`);
+          const rentPromises = rentPositions.map((position, index) => {
+            const rentData = {
+              order: createdOrder._id,
+              product: position._id,
+              variant: position.variant,
+              quantity: position.quantity,
+              startDate: position.date.start,
+              endDate: position.date.end,
+              status: 'pending',
+              creator: createdOrder.creator,
+              owner: createdOrder.owner,
+              comment: `Created from order ${createdOrder._id}`,
+            };
+            return fetch(`${process.env.API_URL || ''}/api/rents`, {
+              method: 'POST',
+              headers: {
+                'Content-Type': 'application/json',
+                'X-Service-Key': process.env.SERVICE_KEY,
+              },
+              body: JSON.stringify(rentData),
+            }).then(async (response) => {
+              if (!response.ok) {
+                const errorData = await response.json();
+                console.error(`Failed to create rent for position ${index + 1}:`, errorData);
+              } else {
+                const result = await response.json();
+                console.log(`Rent created for position ${index + 1}:`, result._id);
+              }
+            });
+          });
+          await Promise.all(rentPromises);
+        }
+      } catch (rentError) {
+        console.error('Error creating rents for new order:', rentError);
+        // Don't fail the order creation if rent creation fails
+      }
       
       // ПОСЛЕ транзакции - отправка уведомлений
       try {
@@ -271,7 +478,6 @@ const controllerFactory = db => {
       res.status(500).send({
         errorCode: 'CREATE_ORDER_FAILED',
         message: 'Error occurred while creating the order.',
-        error: err.message,
       });
     } finally {
       // End session
@@ -279,23 +485,10 @@ const controllerFactory = db => {
     }
   };
   const read = async (req, res) => {
-    console.log(req.query);
     let stages = [
       ...queryProcessorCore.getBasicOptions(req.query),
       ...queryProcessorCore.getFilterDate(req.query.dateStart, req.query.dateEnd),
-      ...queryProcessorCore.getSearchOptions(req.query.search, {
-        fields: ['positions.name'],
-      }),
-      // For spots
-      {
-        $lookup: {
-          from: 'spots',
-          localField: 'delivery.spot',
-          foreignField: '_id',
-          as: 'delivery.spot',
-        },
-      },
-      // For customer
+      // For customer (before search so we can search by customer fields)
       {
         $lookup: {
           from: 'customers',
@@ -309,6 +502,18 @@ const controllerFactory = db => {
           'customer.target': { $arrayElemAt: ['$customerTarget', 0] },
         },
       },
+      ...queryProcessorCore.getSearchOptions(req.query.search, {
+        fields: ['positions.name', 'customer.target.profile.name', 'customer.target.phone', 'customer.target.email', 'customer.target.socials.telegram'],
+      }),
+      // For spots
+      {
+        $lookup: {
+          from: 'spots',
+          localField: 'delivery.spot',
+          foreignField: '_id',
+          as: 'delivery.spot',
+        },
+      },
       // For creator
       queryProcessorCore.getCreatorUserLookupStage(),
       queryProcessorCore.getCreatorOrganizationLookupStage(),
@@ -332,7 +537,6 @@ const controllerFactory = db => {
       res.status(500).send({
         errorCode: 'GET_ORDERS_FAILED',
         message: 'Error occurred while fetching orders.',
-        error: err,
       });
     }
   };
@@ -364,108 +568,108 @@ const controllerFactory = db => {
       const oldStatus = order.status;
       console.log('Status changed:', statusChanged, 'from', oldStatus, 'to', req.body.status);
       
-      // Process positions FIRST when status changes to confirmed
+      // Process positions when status changes to confirmed (stock adjustments for sales only — rents are created at order creation)
       if (req.body.status === 'confirmed' && oldStatus !== 'confirmed') {
-        console.log('Processing confirmed status change - creating rents/adjustments');
+        console.log('Processing confirmed status change - creating stock adjustments');
         // Update positions if they were changed
         if (req.body.positions) {
           console.log('Updating order positions');
           order.positions = req.body.positions;
         }
-        
-        console.log('Total positions to process:', order.positions.length);
-        
-        // Create promises for parallel execution
+
+        // Server-side price validation for positions
+        const variantIds = order.positions.map(pos => pos.variant).filter(Boolean);
+        if (variantIds.length > 0) {
+          const variants = await Variant.find({ _id: { $in: variantIds } }).lean();
+          const variantMap = {};
+          for (const v of variants) {
+            variantMap[v._id.toString()] = v;
+          }
+          for (const pos of order.positions) {
+            if (pos.variant) {
+              const variant = variantMap[pos.variant.toString ? pos.variant.toString() : pos.variant];
+              if (variant) {
+                pos.price = variant.price;
+              }
+            }
+          }
+        }
+
+        // Create stock adjustments for sale positions
         const apiCalls = [];
-        
+
         for (const [index, position] of order.positions.entries()) {
-          console.log(`Processing position ${index + 1}/${order.positions.length}:`, position.name, 'listing:', position.listing);
-          
-          switch (position.listing) {
-            case 'rent':
-              console.log(`Creating rent for position ${index + 1}`);
-              const rentData = {
-                order: order._id,
-                product: position._id,
-                variant: position.variant,
-                quantity: position.quantity,
-                startDate: position.date.start,
-                endDate: position.date.end,
-                status: 'pending',
-                creator: order.creator,
-                owner: order.owner,
-                comment: `Created from order ${order._id}`,
-              };
-              
-              const rentPromise = fetch(`${process.env.API_URL || ''}/api/rents`, {
-                method: 'POST',
-                headers: {
-                  'Content-Type': 'application/json',
-                  'X-Service-Key': process.env.SERVICE_KEY,
-                },
-                body: JSON.stringify(rentData),
-              }).then(async (response) => {
-                console.log(`Rent API response for position ${index + 1}:`, response.status);
-                if (!response.ok) {
-                  const errorData = await response.json();
-                  throw new Error(`Failed to create rent for position ${index + 1}: ${JSON.stringify(errorData)}`);
-                }
-                const result = await response.json();
-                console.log(`Rent created successfully for position ${index + 1}:`, result._id);
-                return result;
-              });
-              
-              apiCalls.push(rentPromise);
-              break;
-              
-            case 'sale':
-              console.log(`Creating stock adjustment for position ${index + 1}`);
-              const adjustmentData = {
-                product: position._id,
-                variant: position.variant,
-                storage: order.delivery?.spot,
-                source: { type: 'Order', target: order._id },
-                reason: 'sale',
-                quantity: -position.quantity, // Negative for stock-out
-                comment: `Stock-out for order ${order._id}`,
-                owner: order.owner,
-                creator: { type: 'User', target: req.userId }
-              };
-              
-
-              const adjustmentPromise = fetch(`${process.env.API_URL || ''}/api/inventory/adjustments/create`, {
-                method: 'POST',
+          if (position.listing === 'sale') {
+            console.log(`Creating stock adjustment for position ${index + 1}`);
+            const adjustmentData = {
+              product: position._id,
+              variant: position.variant,
+              storage: order.delivery?.spot,
+              source: { type: 'Order', target: order._id },
+              reason: 'sale',
+              quantity: -position.quantity, // Negative for stock-out
+              comment: `Stock-out for order ${order._id}`,
+              owner: order.owner,
+              creator: { type: 'User', target: req.userId }
+            };
+
+            const adjustmentPromise = fetch(`${process.env.API_URL || ''}/api/inventory/adjustments/create`, {
+              method: 'POST',
+              headers: {
+                'Content-Type': 'application/json',
+                'X-Service-Key': process.env.SERVICE_KEY,
+              },
+              body: JSON.stringify(adjustmentData),
+            }).then(async (response) => {
+              console.log(`Adjustment API response for position ${index + 1}:`, response.status);
+              if (!response.ok) {
+                const errorData = await response.json();
+                throw new Error(`Failed to create stock adjustment for position ${index + 1}: ${JSON.stringify(errorData)}`);
+              }
+              const result = await response.json();
+              console.log(`Stock adjustment created successfully for position ${index + 1}:`, result._id);
+              return result;
+            });
+
+            apiCalls.push(adjustmentPromise);
+          }
+        }
+
+        // Execute all API calls in parallel
+        if (apiCalls.length > 0) {
+          console.log(`Executing ${apiCalls.length} stock adjustment API calls in parallel...`);
+          await Promise.all(apiCalls);
+          console.log('All stock adjustment API calls completed successfully');
+        }
+      }
+
+      // When order is cancelled — delete associated rents
+      if (req.body.status === 'canceled' && oldStatus !== 'canceled') {
+        console.log('Order canceled - deleting associated rents');
+        try {
+          const Rent = db.mongoose.model('Rent');
+          const rents = await Rent.find({ order: order._id }).lean();
+          if (rents.length > 0) {
+            console.log(`Deleting ${rents.length} rents for canceled order ${order._id}`);
+            const deletePromises = rents.map(rent =>
+              fetch(`${process.env.API_URL || ''}/api/rents/${rent._id}`, {
+                method: 'DELETE',
                 headers: {
                   'Content-Type': 'application/json',
                   'X-Service-Key': process.env.SERVICE_KEY,
                 },
-                body: JSON.stringify(adjustmentData),
               }).then(async (response) => {
-                console.log(`Adjustment API response for position ${index + 1}:`, response.status);
                 if (!response.ok) {
-                  const errorData = await response.json();
-                  throw new Error(`Failed to create stock adjustment for position ${index + 1}: ${JSON.stringify(errorData)}`);
+                  console.error(`Failed to delete rent ${rent._id}:`, response.status);
+                } else {
+                  console.log(`Rent ${rent._id} deleted`);
                 }
-                const result = await response.json();
-                console.log(`Stock adjustment created successfully for position ${index + 1}:`, result._id);
-                return result;
-              });
-              
-              apiCalls.push(adjustmentPromise);
-              break;
-              
-            default:
-              console.warn(`Unknown listing type: ${position.listing} for position ${position._id}`);
+              })
+            );
+            await Promise.all(deletePromises);
           }
-        }
-        
-        // Execute all API calls in parallel
-        if (apiCalls.length > 0) {
-          console.log(`Executing ${apiCalls.length} API calls in parallel...`);
-          await Promise.all(apiCalls);
-          console.log('All API calls completed successfully');
-        } else {
-          console.log('No API calls to execute');
+        } catch (rentDeleteError) {
+          console.error('Error deleting rents for canceled order:', rentDeleteError);
         }
       }
       
@@ -539,7 +743,6 @@ const controllerFactory = db => {
       res.status(500).send({
         errorCode: 'UPDATE_ORDER_FAILED',
         message: 'Error occurred while updating the order.',
-        error: err.message,
       });
       console.log('Error response sent to client');
     } finally {
@@ -556,7 +759,7 @@ const controllerFactory = db => {
   // Изменение статуса оплаты
   const changePaymentStatus = async (req, res) => {
     try {
-      const order = await Order.findOneAndUpdate({ _id: req.params._id }, { status: 'closed', payment: { type: 'Cash', status: 'paid' } }, { new: true }).exec();
+      const order = await Order.findOneAndUpdate({ _id: req.params._id }, { status: 'finished', payment: { type: 'Cash', status: 'paid' } }, { new: true }).exec();
       if (!order) {
         return res.status(404).send({
           errorCode: 'PAYMENT_STATUS_CHANGE_FAILED',
@@ -568,14 +771,13 @@ const controllerFactory = db => {
       res.status(500).send({
         errorCode: 'CHANGE_PAYMENT_STATUS_FAILED',
         message: 'Error occurred while changing the payment status.',
-        error: err,
       });
     }
   };
   // Удаление заказа
   const deleteOrder = async (req, res) => {
     try {
-      const order = await Order.findOneAndDelete({ _id: req.params._id }).exec();
+      const order = await Order.findOneAndDelete({ _id: req.body._id }).exec();
       if (!order) {
         return res.status(404).send({ errorCode: 'ORDER_DELETE_FAILED', message: 'Failed to delete the order.' });
       }
@@ -584,7 +786,6 @@ const controllerFactory = db => {
       res.status(500).send({
         errorCode: 'DELETE_ORDER_FAILED',
         message: 'Error occurred while deleting the order.',
-        error: err,
       });
     }
   };
@@ -611,11 +812,7 @@ const controllerFactory = db => {
           { $match: matchStage },
           { $group: {
             _id: null,
-            totalRevenue: { $sum: { $reduce: {
-              input: '$positions',
-              initialValue: 0,
-              in: { $add: ['$$value', { $multiply: [{ $ifNull: ['$$this.price', 0] }, { $ifNull: ['$$this.quantity', 1] }] }] }
-            }}},
+            totalRevenue: { $sum: '$totalPrice' },
             orderCount: { $sum: 1 }
           }}
         ]),
@@ -625,11 +822,7 @@ const controllerFactory = db => {
           { $match: (startDate && endDate) ? matchStage : { ...matchStage, createdAt: { $gte: startOfMonth } } },
           { $group: {
             _id: null,
-            totalRevenue: { $sum: { $reduce: {
-              input: '$positions',
-              initialValue: 0,
-              in: { $add: ['$$value', { $multiply: [{ $ifNull: ['$$this.price', 0] }, { $ifNull: ['$$this.quantity', 1] }] }] }
-            }}},
+            totalRevenue: { $sum: '$totalPrice' },
             orderCount: { $sum: 1 }
           }}
         ]),
@@ -639,11 +832,7 @@ const controllerFactory = db => {
           { $match: matchStage },
           { $group: {
             _id: { $dateToString: { format: '%Y-%m-%d', date: '$createdAt' } },
-            revenue: { $sum: { $reduce: {
-              input: '$positions',
-              initialValue: 0,
-              in: { $add: ['$$value', { $multiply: [{ $ifNull: ['$$this.price', 0] }, { $ifNull: ['$$this.quantity', 1] }] }] }
-            }}},
+            revenue: { $sum: '$totalPrice' },
             count: { $sum: 1 }
           }},
           { $sort: { _id: 1 } }
@@ -664,7 +853,7 @@ const controllerFactory = db => {
             name: { $first: '$positions.name' },
             image: { $first: { $arrayElemAt: ['$positions.images', 0] } },
             totalQuantity: { $sum: { $ifNull: ['$positions.quantity', 1] } },
-            totalRevenue: { $sum: { $multiply: [{ $ifNull: ['$positions.price', 0] }, { $ifNull: ['$positions.quantity', 1] }] } }
+            totalRevenue: { $sum: '$positions.totalPrice' }
           }},
           { $sort: { totalQuantity: -1 } },
           { $limit: 10 }
@@ -694,18 +883,158 @@ const controllerFactory = db => {
       res.status(500).send({
         errorCode: 'GET_ORDER_STATS_FAILED',
         message: 'Error occurred while fetching order stats.',
-        error: err.message,
       });
     }
   };
 
+  // Чтение своих заказов (по userId или visitorId)
+  const readMy = async (req, res) => {
+    try {
+      let customerQuery;
+      if (req.userId) {
+        customerQuery = { 'identity.type': 'User', 'identity.target': new db.mongoose.Types.ObjectId(req.userId) };
+      } else if (req.visitorId) {
+        customerQuery = { 'identity.type': 'Visitor', 'identity.target': new db.mongoose.Types.ObjectId(req.visitorId) };
+      } else {
+        return res.status(401).send({ errorCode: 'UNAUTHORIZED', message: 'Authentication required.' });
+      }
+
+      const customers = await Customer.find(customerQuery, { _id: 1 }).lean();
+      if (!customers.length) {
+        return res.status(200).send([]);
+      }
+
+      const customerIds = customers.map(c => c._id);
+      const orders = await Order.aggregate([
+        { $match: { 'customer.target': { $in: customerIds } } },
+        { $sort: { createdAt: -1 } },
+        {
+          $lookup: {
+            from: 'customers',
+            localField: 'customer.target',
+            foreignField: '_id',
+            as: 'customerTarget',
+          },
+        },
+        {
+          $addFields: {
+            'customer.target': { $arrayElemAt: ['$customerTarget', 0] },
+          },
+        },
+        {
+          $lookup: {
+            from: 'spots',
+            localField: 'delivery.spot',
+            foreignField: '_id',
+            as: 'delivery.spot',
+          },
+        },
+        { $project: { customerTarget: 0 } },
+      ]);
+
+      res.status(200).send(orders);
+    } catch (err) {
+      console.error(err);
+      res.status(500).send({
+        errorCode: 'GET_MY_ORDERS_FAILED',
+        message: 'Error occurred while fetching your orders.',
+      });
+    }
+  };
+
+  // Handle Telegram inline button actions (confirm/cancel order)
+  const handleTelegramAction = async (action, orderId) => {
+    const order = await Order.findById(orderId);
+    if (!order) {
+      return { success: false, message: 'Order not found' };
+    }
+
+    if (order.status !== 'created') {
+      return { success: false, message: `Order already ${order.status}` };
+    }
+
+    const newStatus = action === 'confirm' ? 'confirmed' : 'canceled';
+
+    // For confirmed orders — create stock adjustments for sale positions
+    if (newStatus === 'confirmed') {
+      const salePositions = order.positions.filter(pos => pos.listing === 'sale');
+      for (const position of salePositions) {
+        try {
+          await fetch(`${process.env.API_URL || ''}/api/inventory/adjustments/create`, {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+              'X-Service-Key': process.env.SERVICE_KEY,
+            },
+            body: JSON.stringify({
+              product: position._id,
+              variant: position.variant,
+              storage: order.delivery?.spot,
+              source: { type: 'Order', target: order._id },
+              reason: 'sale',
+              quantity: -position.quantity,
+              comment: `Stock-out for order ${order._id}`,
+              owner: order.owner,
+              creator: order.creator,
+            }),
+          });
+        } catch (e) {
+          console.error('Stock adjustment failed:', e.message);
+        }
+      }
+    }
+
+    // For canceled orders — delete associated rents
+    if (newStatus === 'canceled') {
+      try {
+        const Rent = db.mongoose.model('Rent');
+        const rents = await Rent.find({ order: order._id }).lean();
+        for (const rent of rents) {
+          await fetch(`${process.env.API_URL || ''}/api/rents/${rent._id}`, {
+            method: 'DELETE',
+            headers: {
+              'Content-Type': 'application/json',
+              'X-Service-Key': process.env.SERVICE_KEY,
+            },
+          }).catch(e => console.error('Rent delete failed:', e.message));
+        }
+      } catch (e) {
+        console.error('Error deleting rents:', e.message);
+      }
+    }
+
+    order.status = newStatus;
+    order.status_history.push({
+      status: newStatus,
+      timestamp: new Date(),
+      comment: `${newStatus} via Telegram`,
+    });
+    await order.save();
+
+    // Send status change notification
+    try {
+      const usersWithAccess = await getUsersWithOrdersConfirmAccess(order.owner.target);
+      await sendOrderNotifications(order, 'order_status', usersWithAccess, {
+        oldStatus: 'created',
+        newStatus: newStatus,
+        organization: order.owner.target,
+      });
+    } catch (e) {
+      console.error('Notification error:', e.message);
+    }
+
+    return { success: true, status: newStatus };
+  };
+
   return {
     create,
     read,
+    readMy,
     update,
     changePaymentStatus,
     deleteOrder,
     getStats,
+    handleTelegramAction,
   };
 };
 export default controllerFactory;