pharmacy-erp 1.0.0

package/backend/app/core/deps.py

@@ -0,0 +1,49 @@
+from fastapi import Depends, Request
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
+from app.core.database import get_db
+from app.core.security import verify_token
+from app.core.exceptions import AuthError, PermissionError
+from app.modules.auth.models import User
+
+async def get_current_user(request: Request, db: AsyncSession = Depends(get_db)):
+    token = request.cookies.get("access_token")
+    if not token:
+        raise AuthError("Not authenticated")
+    try:
+        payload = verify_token(token)
+        user_id = payload.get("sub")
+        if not user_id:
+            raise AuthError("Invalid token")
+        
+        import uuid
+        try:
+            uid = uuid.UUID(user_id)
+        except:
+            uid = user_id
+            
+        result = await db.execute(select(User).where(User.id == uid))
+        user = result.scalar_one_or_none()
+        if not user or not user.is_active:
+            raise AuthError("User not found or inactive")
+        return user
+    except Exception:
+        raise AuthError("Invalid or expired token")
+
+def require_role(*roles):
+    async def role_checker(current_user: User = Depends(get_current_user)):
+        user_role = current_user.role.upper() if current_user.role else ""
+        allowed_roles = [r.upper() for r in roles]
+        if user_role not in allowed_roles and user_role not in ["SUPER_ADMIN", "ADMIN"]:
+            raise PermissionError("Not enough permissions")
+        return current_user
+    return role_checker
+
+def require_permission(permission: str):
+    async def permission_checker(current_user: User = Depends(get_current_user)):
+        # Granular check logic here
+        user_role = current_user.role.upper() if current_user.role else ""
+        if user_role not in ["SUPER_ADMIN", "ADMIN"]:
+            raise PermissionError("Not enough permissions")
+        return current_user
+    return permission_checker

package/backend/app/core/exceptions.py

@@ -0,0 +1,43 @@
+from fastapi import Request
+from fastapi.responses import JSONResponse
+import uuid
+
+class AppException(Exception):
+    def __init__(self, code: str, message: str, status_code: int = 400, fields: dict = None):
+        self.code = code
+        self.message = message
+        self.status_code = status_code
+        self.fields = fields or {}
+
+class NotFoundError(AppException):
+    def __init__(self, message: str = "Resource not found"):
+        super().__init__("NOT_FOUND", message, 404)
+
+class ValidationError(AppException):
+    def __init__(self, message: str = "Validation error", fields: dict = None):
+        super().__init__("VALIDATION_ERROR", message, 422, fields)
+
+class AuthError(AppException):
+    def __init__(self, message: str = "Authentication failed"):
+        super().__init__("AUTH_ERROR", message, 401)
+
+class PermissionError(AppException):
+    def __init__(self, message: str = "Permission denied"):
+        super().__init__("PERMISSION_DENIED", message, 403)
+
+class ConflictError(AppException):
+    def __init__(self, message: str = "Resource conflict"):
+        super().__init__("CONFLICT", message, 409)
+
+async def app_exception_handler(request: Request, exc: AppException):
+    return JSONResponse(
+        status_code=exc.status_code,
+        content={
+            "error": {
+                "code": exc.code,
+                "message": exc.message,
+                "correlation_id": str(uuid.uuid4()),
+                "fields": exc.fields
+            }
+        }
+    )

package/backend/app/core/security.py

@@ -0,0 +1,32 @@
+from datetime import datetime, timedelta
+from typing import Optional
+from jose import jwt
+from passlib.context import CryptContext
+from app.core.config import settings
+
+pwd_context = CryptContext(schemes=["argon2"], deprecated="auto")
+ALGORITHM = "HS256"
+
+def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
+    to_encode = data.copy()
+    if expires_delta:
+        expire = datetime.utcnow() + expires_delta
+    else:
+        expire = datetime.utcnow() + timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
+    to_encode.update({"exp": expire})
+    return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=ALGORITHM)
+
+def create_refresh_token(data: dict) -> str:
+    to_encode = data.copy()
+    expire = datetime.utcnow() + timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS)
+    to_encode.update({"exp": expire})
+    return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=ALGORITHM)
+
+def verify_token(token: str) -> dict:
+    return jwt.decode(token, settings.SECRET_KEY, algorithms=[ALGORITHM])
+
+def hash_password(password: str) -> str:
+    return pwd_context.hash(password)
+
+def verify_password(plain: str, hashed: str) -> bool:
+    return pwd_context.verify(plain, hashed)

package/backend/app/main.py

@@ -0,0 +1,54 @@
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from app.core.config import settings
+from app.core.database import init_db
+from app.core.exceptions import AppException, app_exception_handler
+
+# Ensure all models are imported before init_db
+from app.modules.auth.models import User
+from app.modules.organizations.models import Branch
+from app.modules.medicines.models import Medicine, MedicineCategory, MedicineBatch
+from app.modules.suppliers.models import Supplier
+from app.modules.inventory.models import InventoryMovement
+from app.modules.sales.models import Sale, SaleItem, HeldSale
+from app.modules.customers.models import Customer, CustomerPayment
+from app.modules.cash_sessions.models import CashSession
+from app.modules.roles.models import Role, Permission
+from app.modules.admin.models import AuditLog
+from app.modules.notifications.models import Notification
+
+from app.modules.auth.router import router as auth_router
+from app.modules.organizations.router import router as org_router
+from app.modules.medicines.router import router as medicine_router
+from app.modules.sales.router import router as sales_router
+from app.modules.inventory.router import router as inventory_router
+from app.modules.suppliers.router import router as suppliers_router
+from app.modules.customers.router import router as customers_router
+from app.modules.cash_sessions.router import router as cash_sessions_router
+from app.modules.reports.router import router as reports_router
+from app.modules.users.router import router as users_router
+from app.modules.roles.router import router as roles_router
+from app.modules.admin.router import router as admin_router
+from app.modules.notifications.router import router as notifications_router
+
+app = FastAPI(title=settings.APP_NAME)
+app.add_middleware(CORSMiddleware, allow_origins=settings.CORS_ORIGINS, allow_credentials=True, allow_methods=["*"], allow_headers=["*"])
+app.add_exception_handler(AppException, app_exception_handler)
+
+app.include_router(auth_router, prefix="/api/v1/auth")
+app.include_router(org_router, prefix="/api/v1/branches")
+app.include_router(medicine_router, prefix="/api/v1/medicines")
+app.include_router(sales_router, prefix="/api/v1/sales")
+app.include_router(inventory_router, prefix="/api/v1/inventory")
+app.include_router(suppliers_router, prefix="/api/v1/suppliers")
+app.include_router(customers_router, prefix="/api/v1/customers")
+app.include_router(cash_sessions_router, prefix="/api/v1/cash-sessions")
+app.include_router(reports_router, prefix="/api/v1/reports")
+app.include_router(users_router, prefix="/api/v1/users")
+app.include_router(roles_router, prefix="/api/v1/roles")
+app.include_router(admin_router, prefix="/api/v1/admin")
+app.include_router(notifications_router, prefix="/api/v1/notifications")
+
+@app.on_event("startup")
+async def startup():
+    await init_db()

package/backend/app/modules/admin/__init__.py

@@ -0,0 +1 @@
+# Admin module

package/backend/app/modules/admin/models.py

@@ -0,0 +1,15 @@
+from sqlalchemy.orm import Mapped, mapped_column
+from sqlalchemy import String, ForeignKey, Text
+from app.core.database import Base
+import uuid
+
+class AuditLog(Base):
+    __tablename__ = "audit_logs"
+    user_id: Mapped[uuid.UUID] = mapped_column(ForeignKey("users.id"), nullable=True)
+    user_email: Mapped[str] = mapped_column(String, nullable=True)
+    action: Mapped[str] = mapped_column(String)  # CREATE, UPDATE, DELETE, LOGIN, LOGOUT, IMPORT, WIPE, EXPORT
+    module: Mapped[str] = mapped_column(String)  # Auth, Medicine, Sales, Inventory, Customer, Admin, System
+    entity_type: Mapped[str] = mapped_column(String, nullable=True)  # Medicine, Sale, Batch, etc.
+    entity_id: Mapped[str] = mapped_column(String, nullable=True)  # UUID of affected record
+    details: Mapped[str] = mapped_column(Text)  # Human-readable description
+    ip_address: Mapped[str] = mapped_column(String, nullable=True)

package/backend/app/modules/admin/router.py

@@ -0,0 +1,353 @@
+from fastapi import APIRouter, Depends, Response, UploadFile, File, HTTPException, Request
+from fastapi.responses import FileResponse
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import text, select, func, desc
+from app.core.database import get_db
+from app.core.deps import get_current_user, require_role
+from app.modules.auth.models import User
+from app.core.security import hash_password
+from app.modules.admin.models import AuditLog
+from app.core.audit import log_action
+from pydantic import BaseModel
+from typing import List, Optional
+from datetime import datetime
+import shutil
+import os
+from pathlib import Path
+
+router = APIRouter(tags=["Admin"])
+
+# ─── Schemas ─────────────────────────────────────────────────────────
+class AuditLogResponse(BaseModel):
+    id: str
+    user_email: Optional[str] = None
+    action: str
+    module: str
+    entity_type: Optional[str] = None
+    entity_id: Optional[str] = None
+    details: str
+    ip_address: Optional[str] = None
+    created_at: datetime
+    model_config = {"from_attributes": True}
+
+class AuditLogPage(BaseModel):
+    items: List[AuditLogResponse]
+    total: int
+    page: int
+    pages: int
+
+class BackupInfo(BaseModel):
+    filename: str
+    size_bytes: int
+    size_display: str
+    created_at: str
+
+BACKUP_DIR = Path("data/backups")
+DB_PATH = Path("data/pharmacy.db")
+
+# ═══════════════════════════════════════════════════════════════════
+# AUDIT LOG ENDPOINTS
+# ═══════════════════════════════════════════════════════════════════
+
+@router.get("/audit-logs", response_model=AuditLogPage)
+async def get_audit_logs(
+    page: int = 1,
+    per_page: int = 50,
+    module: Optional[str] = None,
+    action: Optional[str] = None,
+    search: Optional[str] = None,
+    db: AsyncSession = Depends(get_db),
+    admin: User = Depends(require_role("SUPER_ADMIN", "ADMIN"))
+):
+    """Get paginated audit logs with optional filters."""
+    query = select(AuditLog)
+    count_query = select(func.count(AuditLog.id))
+    
+    if module and module != 'all':
+        query = query.where(AuditLog.module == module)
+        count_query = count_query.where(AuditLog.module == module)
+    if action and action != 'all':
+        query = query.where(AuditLog.action == action)
+        count_query = count_query.where(AuditLog.action == action)
+    if search:
+        query = query.where(AuditLog.details.ilike(f"%{search}%"))
+        count_query = count_query.where(AuditLog.details.ilike(f"%{search}%"))
+    
+    total_result = await db.execute(count_query)
+    total = total_result.scalar() or 0
+    pages = max(1, (total + per_page - 1) // per_page)
+    
+    query = query.order_by(desc(AuditLog.created_at)).offset((page - 1) * per_page).limit(per_page)
+    result = await db.execute(query)
+    items = result.scalars().all()
+    
+    return AuditLogPage(
+        items=[AuditLogResponse(
+            id=str(log.id),
+            user_email=log.user_email,
+            action=log.action,
+            module=log.module,
+            entity_type=log.entity_type,
+            entity_id=log.entity_id,
+            details=log.details,
+            ip_address=log.ip_address,
+            created_at=log.created_at
+        ) for log in items],
+        total=total,
+        page=page,
+        pages=pages
+    )
+
+
+# ═══════════════════════════════════════════════════════════════════
+# BACKUP ENDPOINTS
+# ═══════════════════════════════════════════════════════════════════
+
+def _format_size(size_bytes: int) -> str:
+    if size_bytes < 1024:
+        return f"{size_bytes} B"
+    elif size_bytes < 1024 * 1024:
+        return f"{size_bytes / 1024:.1f} KB"
+    else:
+        return f"{size_bytes / (1024 * 1024):.1f} MB"
+
+
+@router.post("/backups", response_model=BackupInfo)
+async def create_backup(
+    request: Request,
+    db: AsyncSession = Depends(get_db),
+    admin: User = Depends(require_role("SUPER_ADMIN"))
+):
+    """Create a new database backup."""
+    BACKUP_DIR.mkdir(parents=True, exist_ok=True)
+    
+    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+    backup_filename = f"backup_{timestamp}.db"
+    backup_path = BACKUP_DIR / backup_filename
+    
+    shutil.copy2(str(DB_PATH), str(backup_path))
+    
+    size = backup_path.stat().st_size
+    
+    await log_action(
+        db=db, action="BACKUP", module="Admin",
+        details=f"Database backup created: {backup_filename}",
+        user=admin, ip_address=request.client.host if request.client else None
+    )
+    await db.commit()
+    
+    return BackupInfo(
+        filename=backup_filename,
+        size_bytes=size,
+        size_display=_format_size(size),
+        created_at=datetime.now().isoformat()
+    )
+
+
+@router.get("/backups", response_model=List[BackupInfo])
+async def list_backups(
+    admin: User = Depends(require_role("SUPER_ADMIN"))
+):
+    """List all available backups."""
+    if not BACKUP_DIR.exists():
+        return []
+    
+    backups = []
+    for f in sorted(BACKUP_DIR.glob("*.db"), key=lambda x: x.stat().st_mtime, reverse=True):
+        stat = f.stat()
+        backups.append(BackupInfo(
+            filename=f.name,
+            size_bytes=stat.st_size,
+            size_display=_format_size(stat.st_size),
+            created_at=datetime.fromtimestamp(stat.st_mtime).isoformat()
+        ))
+    return backups
+
+
+@router.get("/backups/{filename}/download")
+async def download_backup(
+    filename: str,
+    admin: User = Depends(require_role("SUPER_ADMIN"))
+):
+    """Download a specific backup file."""
+    backup_path = BACKUP_DIR / filename
+    if not backup_path.exists() or not backup_path.name.endswith('.db'):
+        raise HTTPException(status_code=404, detail="Backup not found")
+    return FileResponse(str(backup_path), media_type="application/octet-stream", filename=filename)
+
+
+@router.delete("/backups/{filename}")
+async def delete_backup(
+    filename: str,
+    request: Request,
+    db: AsyncSession = Depends(get_db),
+    admin: User = Depends(require_role("SUPER_ADMIN"))
+):
+    """Delete a backup file."""
+    backup_path = BACKUP_DIR / filename
+    if not backup_path.exists():
+        raise HTTPException(status_code=404, detail="Backup not found")
+    backup_path.unlink()
+    
+    await log_action(
+        db=db, action="DELETE", module="Admin",
+        details=f"Backup deleted: {filename}",
+        user=admin, ip_address=request.client.host if request.client else None
+    )
+    await db.commit()
+    
+    return {"message": f"Backup {filename} deleted"}
+
+
+@router.post("/backups/restore")
+async def restore_backup(
+    file: UploadFile = File(...),
+    request: Request = None,
+    db: AsyncSession = Depends(get_db),
+    admin: User = Depends(require_role("SUPER_ADMIN"))
+):
+    """Restore database from an uploaded backup file. Creates a safety backup first."""
+    if not file.filename.endswith('.db'):
+        raise HTTPException(status_code=400, detail="Only .db files are accepted")
+    
+    # Create safety backup first
+    BACKUP_DIR.mkdir(parents=True, exist_ok=True)
+    safety_name = f"pre_restore_{datetime.now().strftime('%Y%m%d_%H%M%S')}.db"
+    shutil.copy2(str(DB_PATH), str(BACKUP_DIR / safety_name))
+    
+    await log_action(
+        db=db, action="RESTORE", module="Admin",
+        details=f"Database restore initiated from: {file.filename}. Safety backup: {safety_name}",
+        user=admin, ip_address=request.client.host if request and request.client else None
+    )
+    await db.commit()
+    
+    # Write uploaded file to DB path
+    content = await file.read()
+    with open(str(DB_PATH), 'wb') as f:
+        f.write(content)
+    
+    return {"message": "Database restored successfully. Please restart the server.", "safety_backup": safety_name}
+
+
+
+
+@router.post("/wipe-data")
+async def wipe_data(
+    request: Request,
+    response: Response,
+    db: AsyncSession = Depends(get_db),
+    admin: User = Depends(require_role("SUPER_ADMIN"))
+):
+    """
+    Wipe all business data: medicines, batches, inventory, sales, cash sessions,
+    customers, suppliers, purchase orders. Keeps users, roles, branches, and system settings.
+    """
+    # Order matters due to foreign key constraints
+    tables_to_wipe = [
+        "sale_items",
+        "sales",
+        "held_sales",
+        "cash_movements",
+        "cash_sessions",
+        "inventory_movements",
+        "medicine_batches",
+        "medicines",
+        "medicine_categories",
+        "customers",
+        "suppliers",
+    ]
+    
+    for table in tables_to_wipe:
+        try:
+            await db.execute(text(f"DELETE FROM {table}"))
+        except Exception:
+            pass  # Table might not exist yet
+    
+    await db.commit()
+    
+    await log_action(
+        db=db, action="WIPE", module="Admin",
+        details="All business data wiped",
+        user=admin, ip_address=request.client.host if request.client else None
+    )
+    await db.commit()
+    
+    return {"message": "All business data has been wiped successfully"}
+
+
+@router.post("/factory-reset")
+async def factory_reset(
+    request: Request,
+    response: Response,
+    db: AsyncSession = Depends(get_db),
+    admin: User = Depends(require_role("SUPER_ADMIN"))
+):
+    """
+    Full factory reset: wipe ALL data including users, then recreate default admin.
+    """
+    # Wipe everything in the correct order
+    tables_to_wipe = [
+        "sale_items",
+        "sales",
+        "held_sales",
+        "cash_movements",
+        "cash_sessions",
+        "inventory_movements",
+        "medicine_batches",
+        "medicines",
+        "medicine_categories",
+        "customers",
+        "suppliers",
+        "users",
+        "role_permissions",
+        "roles",
+        "branches",
+    ]
+    
+    for table in tables_to_wipe:
+        try:
+            await db.execute(text(f"DELETE FROM {table}"))
+        except Exception:
+            pass
+    
+    await db.commit()
+    
+    # Re-create default admin user
+    from app.modules.auth.models import User as UserModel
+    default_admin = UserModel(
+        email="admin",
+        password_hash=hash_password("admin"),
+        full_name="Administrator",
+        full_name_ar="المدير",
+        role="SUPER_ADMIN",
+        is_active=True,
+    )
+    db.add(default_admin)
+    
+    # Re-create default branch
+    from app.modules.organizations.models import Branch
+    default_branch = Branch(
+        name="Main Branch",
+        name_ar="الفرع الرئيسي",
+        code="HQ",
+        is_active=True,
+    )
+    db.add(default_branch)
+    
+    await db.commit()
+    
+    await db.commit()
+    
+    await log_action(
+        db=db, action="RESET", module="Admin",
+        details="Full factory reset performed",
+        user=default_admin, ip_address=request.client.host if request.client else None
+    )
+    await db.commit()
+    
+    # Clear auth cookies
+    response.delete_cookie("access_token")
+    response.delete_cookie("refresh_token")
+    
+    return {"message": "Factory reset complete. Please log in with admin/admin."}

package/backend/app/modules/auth/models.py

@@ -0,0 +1,16 @@
+from sqlalchemy.orm import Mapped, mapped_column
+from sqlalchemy import String, Boolean, DateTime
+from app.core.database import Base
+from datetime import datetime
+
+class User(Base):
+    __tablename__ = "users"
+    
+    email: Mapped[str] = mapped_column(String, unique=True, index=True)
+    password_hash: Mapped[str] = mapped_column(String)
+    full_name: Mapped[str] = mapped_column(String)
+    full_name_ar: Mapped[str] = mapped_column(String, nullable=True)
+    role: Mapped[str] = mapped_column(String)
+    phone: Mapped[str] = mapped_column(String, nullable=True)
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True)
+    last_login: Mapped[datetime] = mapped_column(DateTime, nullable=True)

package/backend/app/modules/auth/router.py

@@ -0,0 +1,73 @@
+from fastapi import APIRouter, Depends, Response, Request
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.core.audit import log_action
+from sqlalchemy import select
+from app.core.database import get_db
+from app.core.security import verify_password, create_access_token, create_refresh_token, hash_password
+from app.core.exceptions import AuthError
+from app.modules.auth.models import User
+from app.modules.auth.schemas import LoginRequest, RegisterRequest, UserResponse
+from app.core.deps import get_current_user, require_role
+from datetime import datetime, timedelta
+
+router = APIRouter(tags=["Auth"])
+
+@router.post("/login", response_model=UserResponse)
+async def login(req: LoginRequest, response: Response, request: Request, db: AsyncSession = Depends(get_db)):
+    result = await db.execute(select(User).where(User.email == req.email))
+    user = result.scalar_one_or_none()
+    if not user or not verify_password(req.password, user.password_hash):
+        raise AuthError("Invalid credentials")
+    
+    user.last_login = datetime.utcnow()
+    await db.commit()
+    
+    if req.remember_me:
+        access_token_expires = timedelta(days=30)
+        max_age = 30 * 24 * 60 * 60
+    else:
+        access_token_expires = None
+        max_age = 120 * 60
+        
+    access_token = create_access_token(
+        data={"sub": str(user.id), "role": user.role},
+        expires_delta=access_token_expires
+    )
+    refresh_token = create_refresh_token({"sub": str(user.id)})
+    
+    response.set_cookie(key="access_token", value=access_token, httponly=True, samesite="lax", max_age=max_age)
+    response.set_cookie(key="refresh_token", value=refresh_token, httponly=True, samesite="lax", max_age=max_age)
+    
+    await log_action(
+        db=db, action="LOGIN", module="Auth",
+        details=f"User logged in: {user.email}",
+        user=user, ip_address=request.client.host if request.client else None
+    )
+    await db.commit()
+    
+    return user
+
+@router.post("/register", response_model=UserResponse)
+async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db), admin: User = Depends(require_role("SUPER_ADMIN"))):
+    new_user = User(
+        email=req.email,
+        password_hash=hash_password(req.password),
+        full_name=req.full_name,
+        full_name_ar=req.full_name_ar,
+        role=req.role,
+        phone=req.phone
+    )
+    db.add(new_user)
+    await db.commit()
+    await db.refresh(new_user)
+    return new_user
+
+@router.post("/logout")
+async def logout(response: Response):
+    response.delete_cookie("access_token")
+    response.delete_cookie("refresh_token")
+    return {"message": "Logged out"}
+
+@router.get("/me", response_model=UserResponse)
+async def get_me(user: User = Depends(get_current_user)):
+    return user

package/backend/app/modules/auth/schemas.py

@@ -0,0 +1,29 @@
+from pydantic import BaseModel
+from typing import Optional
+import uuid
+from datetime import datetime
+
+class LoginRequest(BaseModel):
+    email: str
+    password: str
+    remember_me: Optional[bool] = False
+
+class RegisterRequest(BaseModel):
+    email: str
+    password: str
+    full_name: str
+    full_name_ar: Optional[str] = None
+    role: str
+    phone: Optional[str] = None
+
+class UserResponse(BaseModel):
+    id: uuid.UUID
+    email: str
+    full_name: str
+    full_name_ar: Optional[str] = None
+    role: str
+    phone: Optional[str] = None
+    is_active: bool
+    created_at: datetime
+    
+    model_config = {"from_attributes": True}