shutro-erp 0.2.0 → 0.3.0

package/dist/portal/routes.js

@@ -0,0 +1,313 @@
+/**
+ * Portal access (RFC 0015 §5.1–5.2).
+ *
+ * In the back-office, for holders of `portal.manager` (and administrators):
+ * - `GET    /api/v1/portal/access?partner=…`         the contact's portal users (active or not, activated or not)
+ * - `POST   /api/v1/portal/access`                   `{ partner }`: a portal user for the contact, and an invitation
+ * - `POST   /api/v1/portal/access/:user/invitation`  a new invitation (the earlier ones stop working)
+ * - `DELETE /api/v1/portal/access/:user`             revoke: the user is archived and their sessions end
+ *
+ * In the portal:
+ * - `POST /api/portal/v1/activate`                   `{ token, password }`: the invited contact chooses a password;
+ *                                                      their login comes back
+ * - `GET  /api/portal/v1/me`                         who is signed in, for which contact and company
+ *
+ * Invitations are single use, valid 7 days and stored as SHA-256 digests; the link goes by email when a mailer is
+ * configured, and back to the inviter either way. Every step is audited.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { layout } from '../mail/index.js';
+import { audit, HttpProblem } from '../server/index.js';
+const ref = (env, name) => env.model(name);
+/** How long an invitation works. */
+export const INVITATION_DAYS = 7;
+/** The group of portal users. */
+export const PORTAL_USER = 'portal.user';
+const digest = (token) => createHash('sha256').update(token).digest('hex');
+const idOf = (value, what) => {
+    const id = Number(value);
+    if (!Number.isSafeInteger(id) || id <= 0)
+        throw new HttpProblem(400, 'invalid-id', 'Invalid id', `${what} is a positive integer.`);
+    return id;
+};
+export function registerPortalRoutes(context, options) {
+    const { app } = context;
+    const auth = context.auth;
+    if (auth === undefined)
+        return; // no sign-in without base
+    const manager = (env) => {
+        if (!env.administrator && !env.groups.has('portal.manager'))
+            throw new HttpProblem(403, 'access', 'Portal access managers only', 'Granting portal access needs the Portal access level.');
+    };
+    const portalOnly = (env) => {
+        if (!env.groups.has(PORTAL_USER) || env.groups.has('base.user'))
+            throw new HttpProblem(403, 'portal-only', 'Portal users only', 'This is the portal’s API.');
+    };
+    /** A new invitation for `user` (earlier unused ones are expired); its link. */
+    const invite = async (su, user, by) => {
+        const pending = await ref(su, 'portal.invitation').search({
+            where: { user, usedAt: null },
+        });
+        if (pending.length > 0)
+            await pending.write({ expiresAt: new Date() });
+        const token = randomBytes(32).toString('base64url');
+        const expiresAt = new Date(Date.now() + INVITATION_DAYS * 86_400_000);
+        await ref(su, 'portal.invitation').create([
+            { user, tokenHash: digest(token), expiresAt, invitedBy: by },
+        ]);
+        const url = `${options.portalUrl.replace(/\/$/, '')}/activate?token=${token}`;
+        return { url, expiresAt };
+    };
+    /** Emails the invitation once the transaction commits (a failed send is logged; the inviter has the link). */
+    const email = (env, to, name, company, url) => {
+        const mailer = options.mailer;
+        if (mailer === undefined)
+            return false;
+        env.afterCommit(async () => {
+            const body = layout({
+                title: `Your access to ${company}`,
+                paragraphs: [
+                    `Hello ${name},`,
+                    `${company} invites you to its portal: your quotations, orders and invoices in one place.`,
+                    `The link works for ${INVITATION_DAYS} days.`,
+                ],
+                action: { label: 'Choose your password', url },
+            });
+            await mailer
+                .send({ to, subject: `Your access to ${company}`, ...body })
+                .catch((error) => app.log.error({ err: error }, 'portal invitation not sent'));
+        });
+        return true;
+    };
+    const companyName = async (su, company) => {
+        const [row] = (await ref(su, 'res.company').browse([company]).load(['name'])).read(['name']);
+        return String(row?.['name'] ?? '');
+    };
+    app.get('/api/v1/portal/access', async (request) => {
+        const partner = idOf(request.query?.['partner'], 'partner');
+        return request.env(async (env) => {
+            manager(env);
+            const visible = await ref(env, 'res.partner').search({ where: { id: partner }, limit: 1 });
+            if (visible.length === 0)
+                throw new HttpProblem(404, 'not-found', 'No such contact', `No contact #${partner}.`);
+            return env.asSuperuser({ reason: 'portal access' }, async (su) => {
+                const keys = ['login', 'active'];
+                // Revoked (archived) users too.
+                const users = await ref(su.withFlags({ activeTest: false }), 'res.users').search({
+                    where: { portalPartner: partner },
+                });
+                const rows = (await users.load(keys)).read(keys);
+                const out = [];
+                for (const row of rows) {
+                    const id = row['id'];
+                    const invitations = await ref(su, 'portal.invitation').search({ where: { user: id } });
+                    const sent = (await invitations.load(['usedAt', 'expiresAt'])).read([
+                        'usedAt',
+                        'expiresAt',
+                    ]);
+                    const open = sent
+                        .filter((i) => i['usedAt'] === null && new Date(String(i['expiresAt'])).getTime() > Date.now())
+                        .map((i) => String(i['expiresAt']));
+                    out.push({
+                        id,
+                        login: String(row['login']),
+                        active: row['active'] === true,
+                        activated: sent.some((i) => i['usedAt'] !== null),
+                        invitationExpiresAt: open[0] ?? null,
+                    });
+                }
+                return { users: out };
+            });
+        }, { write: true });
+    });
+    app.post('/api/v1/portal/access', async (request, reply) => {
+        const partner = idOf(request.body?.['partner'], 'partner');
+        const granted = await request.env(async (env) => {
+            manager(env);
+            const found = await ref(env, 'res.partner').search({ where: { id: partner }, limit: 1 });
+            const [contact] = (await found.load(['name', 'email'])).read(['name', 'email']);
+            if (contact === undefined)
+                throw new HttpProblem(404, 'not-found', 'No such contact', `No contact #${partner}.`);
+            const login = String(contact['email'] ?? '')
+                .trim()
+                .toLowerCase();
+            if (login === '')
+                throw new HttpProblem(422, 'no-email', 'No email address', 'The contact needs an email address: it is their login and where the invitation goes.');
+            const name = String(contact['name']);
+            return env.asSuperuser({ reason: 'portal access' }, async (su) => {
+                const all = su.withFlags({ activeTest: false });
+                const taken = await ref(all, 'res.users').search({ where: { login }, limit: 1 });
+                const [existing] = (await taken.load(['active', 'portalPartner'])).read([
+                    'active',
+                    'portalPartner',
+                ]);
+                let user;
+                if (existing !== undefined) {
+                    // This contact's revoked portal user comes back; any other user keeps the login.
+                    if (existing['portalPartner'] !== partner || existing['active'] === true)
+                        throw new HttpProblem(409, 'login-taken', 'Already a user', `A user with the login ${login} exists already.`, 'Send the invitation again, or use another email for this contact.');
+                    user = existing['id'];
+                    await taken.write({ active: true });
+                    await auth.setPassword(su, user, randomBytes(32).toString('base64url'));
+                }
+                else {
+                    const created = await ref(su, 'res.users').create([
+                        {
+                            login,
+                            name,
+                            email: login,
+                            company: env.companyId,
+                            companies: { set: [env.companyId] },
+                            portalPartner: partner,
+                        },
+                    ]);
+                    user = created.ids[0];
+                    // No usable password until the invitation is used.
+                    await auth.setPassword(su, user, randomBytes(32).toString('base64url'));
+                    await ref(su, 'auth.user_group').create([{ user, group: PORTAL_USER }]);
+                }
+                const { url, expiresAt } = await invite(su, user, env.uid);
+                await audit(env, {
+                    kind: 'portal.invited',
+                    summary: `Portal access granted to ${name} (${login}).`,
+                    targetModel: 'res.users',
+                    targetId: user,
+                    details: { partner },
+                    ip: request.ip,
+                });
+                const emailed = email(env, login, name, await companyName(su, env.companyId), url);
+                return { user, login, activationUrl: url, expiresAt: expiresAt.toISOString(), emailed };
+            });
+        }, { write: true });
+        return reply.code(201).send(granted);
+    });
+    /** The portal user `id`, if it is a portal user the caller may manage (their contact is readable). */
+    const portalUser = async (env, su, id) => {
+        const keys = ['login', 'name', 'portalPartner', 'active'];
+        const [row] = (await ref(su, 'res.users').browse([id]).load(keys)).read(keys);
+        const partner = row?.['portalPartner'];
+        if (row === undefined || typeof partner !== 'number')
+            throw new HttpProblem(404, 'not-found', 'No such portal user', `No portal user #${id}.`);
+        const visible = await ref(env, 'res.partner').search({ where: { id: partner }, limit: 1 });
+        if (visible.length === 0)
+            throw new HttpProblem(404, 'not-found', 'No such portal user', `No portal user #${id}.`);
+        return {
+            login: String(row['login']),
+            name: String(row['name']),
+            active: row['active'] === true,
+        };
+    };
+    app.post('/api/v1/portal/access/:user/invitation', async (request, reply) => {
+        const id = idOf(request.params['user'], 'user');
+        const sent = await request.env(async (env) => {
+            manager(env);
+            return env.asSuperuser({ reason: 'portal access' }, async (su) => {
+                const user = await portalUser(env, su, id);
+                if (!user.active)
+                    throw new HttpProblem(409, 'revoked', 'Access revoked', 'Grant access again first.');
+                const { url, expiresAt } = await invite(su, id, env.uid);
+                await audit(env, {
+                    kind: 'portal.invited',
+                    summary: `Portal invitation sent again to ${user.name} (${user.login}).`,
+                    targetModel: 'res.users',
+                    targetId: id,
+                    ip: request.ip,
+                });
+                const emailed = email(env, user.login, user.name, await companyName(su, env.companyId), url);
+                return { activationUrl: url, expiresAt: expiresAt.toISOString(), emailed };
+            });
+        }, { write: true });
+        return reply.code(201).send(sent);
+    });
+    app.delete('/api/v1/portal/access/:user', async (request, reply) => {
+        const id = idOf(request.params['user'], 'user');
+        await request.env(async (env) => {
+            manager(env);
+            await env.asSuperuser({ reason: 'portal access' }, async (su) => {
+                const user = await portalUser(env, su, id);
+                await ref(su, 'res.users').browse([id]).write({ active: false });
+                const sessions = await ref(su, 'auth.session').search({
+                    where: { user: id, revoked: false },
+                });
+                if (sessions.length > 0)
+                    await sessions.write({ revoked: true });
+                const pending = await ref(su, 'portal.invitation').search({
+                    where: { user: id, usedAt: null },
+                });
+                if (pending.length > 0)
+                    await pending.write({ expiresAt: new Date() });
+                await audit(env, {
+                    kind: 'portal.revoked',
+                    summary: `Portal access revoked for ${user.name} (${user.login}).`,
+                    targetModel: 'res.users',
+                    targetId: id,
+                    ip: request.ip,
+                });
+            });
+        }, { write: true });
+        return reply.code(204).send();
+    });
+    app.post('/api/portal/v1/activate', { config: { auth: false } }, async (request, reply) => {
+        const body = (request.body ?? {});
+        const token = typeof body['token'] === 'string' ? body['token'] : '';
+        const password = typeof body['password'] === 'string' ? body['password'] : '';
+        const invalid = () => new HttpProblem(410, 'invitation-invalid', 'This link no longer works', 'The invitation was used, replaced or has expired.', 'Ask for a new invitation.');
+        if (token === '')
+            throw invalid();
+        const login = await context.shutro.bootstrap({ reason: 'portal activation' }, async (su) => {
+            const found = await ref(su, 'portal.invitation').search({
+                where: { tokenHash: digest(token) },
+                limit: 1,
+            });
+            const [row] = (await found.load(['user', 'expiresAt', 'usedAt'])).read([
+                'user',
+                'expiresAt',
+                'usedAt',
+            ]);
+            if (row === undefined ||
+                row['usedAt'] !== null ||
+                new Date(String(row['expiresAt'])).getTime() <= Date.now())
+                throw invalid();
+            const user = row['user'];
+            const [account] = (await ref(su, 'res.users').browse([user]).load(['active', 'company', 'login'])).read(['active', 'company', 'login']);
+            if (account?.['active'] !== true)
+                throw invalid();
+            await auth.setPassword(su, user, password);
+            await found.write({ usedAt: new Date() });
+            await audit(su, {
+                kind: 'portal.activated',
+                summary: 'A portal user chose their password.',
+                actor: user,
+                company: account['company'] ?? null,
+                targetModel: 'res.users',
+                targetId: user,
+                ip: request.ip,
+            });
+            return String(account['login']);
+        });
+        // The login: the portal signs the user in with the password they just chose.
+        return reply.send({ login });
+    });
+    app.get('/api/portal/v1/me', async (request) => request.env(async (env) => {
+        portalOnly(env);
+        return env.asSuperuser({ reason: 'portal me' }, async (su) => {
+            const keys = ['login', 'name', 'portalPartner', 'company', 'lang'];
+            const [user] = (await ref(su, 'res.users').browse([env.uid]).load(keys)).read(keys);
+            const partnerId = user?.['portalPartner'];
+            const [partner] = typeof partnerId === 'number'
+                ? (await ref(su, 'res.partner').browse([partnerId]).load(['name', 'parent'])).read([
+                    'name',
+                    'parent',
+                ])
+                : [];
+            return {
+                user: env.uid,
+                login: String(user?.['login'] ?? ''),
+                name: String(user?.['name'] ?? ''),
+                lang: String(user?.['lang'] ?? 'en_US'),
+                partner: partner === undefined ? null : { id: partner['id'], name: String(partner['name']) },
+                company: { id: env.companyId, name: await companyName(su, env.companyId) },
+            };
+        });
+    }, { write: true }));
+}

package/dist/portal/rules.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The record rule that keeps a document to its customer (RFC 0015 §5.1): a portal user sees the documents of their
+ * contact and of the company their contact works for — the company's own, and those of its other people. Bridges
+ * add it to the models they show in the portal (`extendModel(…, { rules: { portal: portalRule('partner') } })`).
+ */
+/** Holders of `portal.user` whose contact or company is the record's `partner`. */
+export declare function portalRule(partner: string): {
+    readonly groups: readonly string[];
+    readonly perms: readonly ['read'];
+    readonly domain: Readonly<Record<string, unknown>>;
+};

package/dist/portal/rules.js

@@ -0,0 +1,25 @@
+/**
+ * The record rule that keeps a document to its customer (RFC 0015 §5.1): a portal user sees the documents of their
+ * contact and of the company their contact works for — the company's own, and those of its other people. Bridges
+ * add it to the models they show in the portal (`extendModel(…, { rules: { portal: portalRule('partner') } })`).
+ */
+/** Holders of `portal.user` whose contact or company is the record's `partner`. */
+export function portalRule(partner) {
+    const me = { portalUsers: { any: { id: { $env: 'uid' } } } };
+    return {
+        groups: ['portal.user'],
+        perms: ['read'],
+        domain: {
+            or: [
+                // Their own contact, or (a company's portal user) the company itself.
+                { [`${partner}.portalUsers`]: me.portalUsers },
+                // A person of the company whose portal user they are.
+                { [`${partner}.parent.portalUsers`]: me.portalUsers },
+                // Their company (the contact's parent).
+                { [`${partner}.contacts`]: { any: me } },
+                // A colleague at their company.
+                { [`${partner}.parent.contacts`]: { any: me } },
+            ],
+        },
+    };
+}

package/dist/portal/web/PortalAccess.d.ts

@@ -0,0 +1,8 @@
+/**
+ * "Portal access" on a contact's form (RFC 0015 §5.2), for portal access managers: grant access (the invitation is
+ * emailed when the server can, and its link shown to share), send it again, revoke. Hidden from anyone else (the
+ * server answers 403 and the panel stays away).
+ */
+import { type NodeComponentProps } from '../../ui/index.js';
+import { type ReactElement } from 'react';
+export declare function PortalAccess({ record, api }: NodeComponentProps): ReactElement | null;

package/dist/portal/web/PortalAccess.js

@@ -0,0 +1,66 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * "Portal access" on a contact's form (RFC 0015 §5.2), for portal access managers: grant access (the invitation is
+ * emailed when the server can, and its link shown to share), send it again, revoke. Hidden from anyone else (the
+ * server answers 403 and the panel stays away).
+ */
+import { Alert, Button, Input, useKosh } from '../../ui/index.js';
+import { useMutation, useQuery } from '@tanstack/react-query';
+import { Copy, KeyRound, Send, UserX } from 'lucide-react';
+import { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+export function PortalAccess({ record, api }) {
+    const { t } = useTranslation('portal');
+    const { format } = useKosh();
+    const partner = typeof record?.['id'] === 'number' ? record['id'] : null;
+    const [link, setLink] = useState(null);
+    const [copied, setCopied] = useState(false);
+    const access = useQuery({
+        queryKey: ['portal', 'access', partner],
+        queryFn: () => api.call('GET', `/api/v1/portal/access?partner=${partner}`),
+        enabled: partner !== null,
+        retry: false,
+    });
+    const done = (invitation) => {
+        if (invitation !== undefined)
+            setLink(invitation);
+        setCopied(false);
+        void access.refetch();
+    };
+    const grant = useMutation({
+        mutationFn: () => api.call('POST', '/api/v1/portal/access', { partner }),
+        onSuccess: (invitation) => done(invitation),
+    });
+    const resend = useMutation({
+        mutationFn: (user) => api.call('POST', `/api/v1/portal/access/${user}/invitation`, {}),
+        onSuccess: (invitation) => done(invitation),
+    });
+    const revoke = useMutation({
+        mutationFn: (user) => api.call('DELETE', `/api/v1/portal/access/${user}`),
+        onSuccess: () => {
+            setLink(null);
+            done();
+        },
+    });
+    if (partner === null || access.data === undefined)
+        return null;
+    const users = access.data.users;
+    const current = users.find((u) => u.active);
+    const former = users[0];
+    const error = grant.error ?? resend.error ?? revoke.error;
+    let status;
+    if (current === undefined)
+        status = former === undefined ? t('none') : t('revoked', { login: former.login });
+    else if (current.activated)
+        status = t('active', { login: current.login });
+    else if (current.invitationExpiresAt === null)
+        status = t('expired', { login: current.login });
+    else
+        status = t('pending', {
+            login: current.login,
+            until: format.datetime(current.invitationExpiresAt),
+        });
+    return (_jsxs("section", { className: "grid gap-2 rounded-md border p-3", "aria-labelledby": "portal-access-title", children: [_jsx("h3", { id: "portal-access-title", className: "text-sm font-semibold", children: t('title') }), _jsx("p", { className: "text-sm text-muted-foreground", children: status }), _jsx("div", { className: "flex flex-wrap gap-2", children: current === undefined ? (_jsxs(Button, { size: "sm", variant: "secondary", busy: grant.isPending, onClick: () => grant.mutate(), children: [_jsx(KeyRound, { "aria-hidden": true }), t('grant')] })) : (_jsxs(_Fragment, { children: [_jsxs(Button, { size: "sm", busy: resend.isPending, onClick: () => resend.mutate(current.id), children: [_jsx(Send, { "aria-hidden": true }), t('resend')] }), _jsxs(Button, { size: "sm", variant: "danger", busy: revoke.isPending, onClick: () => revoke.mutate(current.id), children: [_jsx(UserX, { "aria-hidden": true }), t('revoke')] })] })) }), link === null ? null : (_jsxs("div", { className: "grid gap-1", children: [_jsx("p", { className: "text-sm", children: link.emailed ? t('emailed') : t('share') }), _jsxs("div", { className: "flex gap-2", children: [_jsx(Input, { readOnly: true, value: link.activationUrl, "aria-label": t('copy') }), _jsx(Button, { size: "sm", variant: "ghost", "aria-label": t('copy'), onClick: () => {
+                                    void navigator.clipboard?.writeText(link.activationUrl).then(() => setCopied(true));
+                                }, children: _jsx(Copy, { "aria-hidden": true }) })] }), copied ? (_jsx("p", { role: "status", className: "text-xs text-muted-foreground", children: t('copied') })) : null] })), error === null ? null : _jsx(Alert, { children: error.message })] }));
+}

package/dist/portal/web/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @packageDocumentation
+ * The back-office contribution of `shutro-erp/portal` (RFC 0015): "Portal access" on the contact form
+ * (`portal.Access`) and its messages.
+ */
+import { type Registry } from '../../ui/index.js';
+import type { i18n } from 'i18next';
+import { messages } from './messages.js';
+export { PortalAccess } from './PortalAccess.js';
+/** Registers "Portal access" (and the messages in `i18n`, when given). */
+export declare function registerPortalWeb(registry: Registry, i18n?: i18n): Registry;
+export { messages as portalMessages };

package/dist/portal/web/index.js

@@ -0,0 +1,17 @@
+/**
+ * @packageDocumentation
+ * The back-office contribution of `shutro-erp/portal` (RFC 0015): "Portal access" on the contact form
+ * (`portal.Access`) and its messages.
+ */
+import { addMessages } from '../../ui/index.js';
+import { messages } from './messages.js';
+import { PortalAccess } from './PortalAccess.js';
+export { PortalAccess } from './PortalAccess.js';
+/** Registers "Portal access" (and the messages in `i18n`, when given). */
+export function registerPortalWeb(registry, i18n) {
+    registry.registerComponent('portal.Access', PortalAccess);
+    if (i18n !== undefined)
+        addMessages(i18n, 'portal', messages);
+    return registry;
+}
+export { messages as portalMessages };

package/dist/portal/web/messages.d.ts

@@ -0,0 +1,2 @@
+/** Messages of the portal's back-office parts (namespace `portal`). */
+export declare const messages: Readonly<Record<string, object>>;

package/dist/portal/web/messages.js

@@ -0,0 +1,33 @@
+/** Messages of the portal's back-office parts (namespace `portal`). */
+export const messages = {
+    en: {
+        title: 'Portal access',
+        none: 'This contact has no portal access.',
+        grant: 'Grant portal access',
+        resend: 'Send the invitation again',
+        revoke: 'Revoke access',
+        active: 'Active: {{login}}',
+        pending: 'Invited: {{login}} has not chosen a password yet (the link works until {{until}}).',
+        expired: 'Invited: {{login}}; the link has expired.',
+        revoked: 'Access revoked: {{login}}',
+        emailed: 'The invitation was emailed. You can also share this link:',
+        share: 'Email is not set up on this server: share this link with the contact:',
+        copy: 'Copy the link',
+        copied: 'Copied.',
+    },
+    bn: {
+        title: 'পোর্টাল অ্যাক্সেস',
+        none: 'এই যোগাযোগের কোনো পোর্টাল অ্যাক্সেস নেই।',
+        grant: 'পোর্টাল অ্যাক্সেস দিন',
+        resend: 'আবার আমন্ত্রণ পাঠান',
+        revoke: 'অ্যাক্সেস প্রত্যাহার করুন',
+        active: 'সক্রিয়: {{login}}',
+        pending: 'আমন্ত্রিত: {{login}} এখনও পাসওয়ার্ড বেছে নেননি ({{until}} পর্যন্ত লিংকটি কাজ করবে)।',
+        expired: 'আমন্ত্রিত: {{login}}; লিংকের মেয়াদ শেষ।',
+        revoked: 'অ্যাক্সেস প্রত্যাহার করা হয়েছে: {{login}}',
+        emailed: 'আমন্ত্রণ ইমেইল করা হয়েছে। এই লিংকটিও শেয়ার করতে পারেন:',
+        share: 'এই সার্ভারে ইমেইল চালু নেই: লিংকটি যোগাযোগের সাথে শেয়ার করুন:',
+        copy: 'লিংক কপি করুন',
+        copied: 'কপি হয়েছে।',
+    },
+};

package/dist/product/.kosh/bindings.js

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 6879099070364273
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 5d099798463eb84a
 // Bindings of module `product`: import the definition API from here to get types scoped to what it can see.
 export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
 import { definitions } from '../../server/orm.js';

package/dist/product/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 6879099070364273
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 5d099798463eb84a
 // Schema view of module `product` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -32,7 +32,13 @@ export interface AccountTax {
     readonly active: F.Bool<{ readonly required: true; readonly default: true }>;
     readonly name: F.Char<{ readonly required: true; readonly translate: true }>;
     readonly use: F.Selection<'sale' | 'purchase', { readonly required: true; readonly default: true }>;
+    readonly sequence: F.Integer<{ readonly required: true; readonly default: true }>;
+    readonly amountType: F.Selection<'percent' | 'fixed', { readonly required: true; readonly default: true }>;
     readonly rate: F.Decimal<{ readonly required: true; readonly default: true }>;
+    readonly fixedAmount: F.Decimal<{ readonly required: true; readonly default: true }>;
+    readonly affectsBase: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly priceIncluded: F.Bool<{ readonly required: true; readonly default: true }>;
+    readonly reverseCharge: F.Bool<{ readonly required: true; readonly default: true }>;
   };
   readonly methods: AccountTaxMethods;
 }
@@ -227,8 +233,10 @@ export interface ProductProduct {
     readonly standardPrice: F.Decimal<{ readonly required: true; readonly default: true }>;
     readonly saleOk: F.Bool<{ readonly required: true; readonly default: true }>;
     readonly purchaseOk: F.Bool<{ readonly required: true; readonly default: true }>;
-    readonly tax: F.Many2one<'account.tax'>;
-    readonly purchaseTax: F.Many2one<'account.tax'>;
+    readonly taxes: F.Many2many<'account.tax', { readonly required: true }>;
+    readonly purchaseTaxes: F.Many2many<'account.tax', { readonly required: true }>;
+    readonly tax: F.Many2one<'account.tax', { readonly readonly: true }>;
+    readonly purchaseTax: F.Many2one<'account.tax', { readonly readonly: true }>;
     readonly description: F.Text<{ readonly translate: true }>;
   };
   readonly methods: ProductProductMethods;
@@ -250,6 +258,7 @@ export interface ResCompany {
     readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
     readonly name: F.Char<{ readonly required: true }>;
     readonly currency: F.Many2one<'res.currency', { readonly required: true }>;
+    readonly numberGrouping: F.Selection<'international' | 'lakh', { readonly required: true; readonly default: true }>;
   };
   readonly methods: ResCompanyMethods;
 }

package/dist/product/demo.js

@@ -1,5 +1,5 @@
 /** Demo data of Products (RFC 0008 §5.8): construction goods, electronics and services, with Bangladesh VAT. */
-import { idByName } from '../modules-sdk/index.js';
+import { idByName, maybeIdByName } from '../modules-sdk/index.js';
 import { orm } from '../server/orm.js';
 const DINA = { login: 'dina', name: 'Dina Rahman', groups: ['product.manager'] };
 const CATEGORIES = ['Construction', 'Electronics', 'Services'];
@@ -54,8 +54,9 @@ export async function productDemo(context) {
             .model('product.category')
             .create(CATEGORIES.map((name) => ({ name })));
         const category = new Map(CATEGORIES.map((name, i) => [name, categories.ids[i]]));
-        const vatSale = await idByName(env, 'account.tax', 'VAT 15%');
-        const vatPurchase = await idByName(env, 'account.tax', 'VAT 15% (purchases)');
+        // The VAT comes with the country's localization (l10n_bd); without one, products have no taxes.
+        const vatSale = await maybeIdByName(env, 'account.tax', 'VAT 15%');
+        const vatPurchase = await maybeIdByName(env, 'account.tax', 'VAT 15% (purchases)');
         const uoms = new Map();
         for (const name of new Set(PRODUCTS.map((p) => p.uom)))
             uoms.set(name, await idByName(env, 'uom.uom', name));
@@ -66,8 +67,8 @@ export async function productDemo(context) {
             uom: orm.asId(uoms.get(p.uom), 'uom.uom'),
             listPrice: p.list,
             standardPrice: p.cost,
-            tax: orm.asId(vatSale, 'account.tax'),
-            purchaseTax: orm.asId(vatPurchase, 'account.tax'),
+            taxes: { set: vatSale === null ? [] : [orm.asId(vatSale, 'account.tax')] },
+            purchaseTaxes: { set: vatPurchase === null ? [] : [orm.asId(vatPurchase, 'account.tax')] },
         })));
         return `${CATEGORIES.length} categories and ${PRODUCTS.length} products`;
     });

package/dist/product/index.d.ts

@@ -5,4 +5,5 @@
  */
 import { defineModule } from '../modules-sdk/index.js';
 export { AccountTax, ProductCategory, ProductProduct, productShutro, UomUom } from './module.js';
+export { computeTaxes, ordered, type TaxLine, type TaxResult, type TaxRule, taxRule, } from './taxes.js';
 export declare const product: ReturnType<typeof defineModule>;

package/dist/product/index.js

@@ -9,6 +9,7 @@ import { action, form, kanban, list, search } from '../views/index.js';
 import { productDemo } from './demo.js';
 import { AccountTax, ProductCategory, ProductProduct, productShutro, UomUom } from './module.js';
 export { AccountTax, ProductCategory, ProductProduct, productShutro, UomUom } from './module.js';
+export { computeTaxes, ordered, taxRule, } from './taxes.js';
 export const product = defineModule({
     shutro: productShutro,
     kosh: '^0.1.0',
@@ -82,8 +83,8 @@ export const product = defineModule({
                 k.group('prices', ['listPrice', 'standardPrice', 'uom'], { label: 'Prices' }),
                 k.notebook('more', [
                     k.page('sales', 'Sales & purchase', [
-                        k.group('sell', ['saleOk', 'tax']),
-                        k.group('buy', ['purchaseOk', 'purchaseTax']),
+                        k.group('sell', ['saleOk', 'taxes']),
+                        k.group('buy', ['purchaseOk', 'purchaseTaxes']),
                     ]),
                     k.page('description_page', 'Description', ['description']),
                 ]),
@@ -97,9 +98,21 @@ export const product = defineModule({
         'uom.uom.form': form(UomUom, (k) => ({
             sheet: [k.group('main', ['name', 'category', 'ratio', 'rounding'])],
         })),
-        'account.tax.list': list(AccountTax, { columns: ['name', 'use', 'rate'] }),
+        'account.tax.list': list(AccountTax, {
+            columns: ['sequence', 'name', 'use', 'amountType', 'rate', 'affectsBase'],
+        }),
         'account.tax.form': form(AccountTax, (k) => ({
-            sheet: [k.group('main', ['name', 'use', 'rate'])],
+            sheet: [
+                k.group('main', ['name', 'use', 'sequence']),
+                k.group('amount', [
+                    'amountType',
+                    'rate',
+                    'fixedAmount',
+                    'affectsBase',
+                    'priceIncluded',
+                    'reverseCharge',
+                ]),
+            ],
         })),
     },
     search: {