tango-app-api-payment-subscription 3.5.0 → 3.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tango-app-api-payment-subscription",
-    "version": "3.5.0",
+    "version": "3.5.2",
     "description": "paymentSubscription",
     "main": "index.js",
     "type": "module",

package/src/controllers/brandsBilling.controller.js

@@ -2,6 +2,7 @@ import * as clientService from '../services/clientPayment.services.js';
 import * as invoiceService from '../services/invoice.service.js';
 import * as billingService from '../services/billing.service.js';
 import * as dailyPriceService from '../services/dailyPrice.service.js';
+import * as storeService from '../services/store.service.js';
 import dayjs from 'dayjs';
 import { logger, checkFileExist, signedUrl, download, insertOpenSearchData } from 'tango-app-api-middleware';
 import * as XLSX from 'xlsx';
@@ -230,7 +231,10 @@ export async function brandInvoiceList( req, res ) {
       },
     } ];
 
-    if ( req.body.durationFilter && req.body.durationFilter !== '' ) {
+    // If the user picked an explicit Month or Year, ignore durationFilter so the
+    // two ranges don't conflict (e.g. "current month" + April would always 0).
+    const hasMonthYear = ( req.body.monthFilter && String( req.body.monthFilter ) !== '' ) || ( req.body.yearFilter && String( req.body.yearFilter ) !== '' );
+    if ( !hasMonthYear && req.body.durationFilter && req.body.durationFilter !== '' ) {
       let dateFrom;
       const now = dayjs();
       if ( req.body.durationFilter === 'current' ) {
@@ -247,6 +251,30 @@ export async function brandInvoiceList( req, res ) {
       }
     }
 
+    // Month / Year filters (independent of durationFilter). Both are 1-based:
+    // monthFilter '1'..'12', yearFilter four-digit string like '2026'.
+    // billingDate may be stored as Date OR as a string in some legacy rows, so
+    // coerce to date inside the pipeline before $year/$month.
+    const monthNum = req.body.monthFilter ? parseInt( req.body.monthFilter, 10 ) : null;
+    const yearNum = req.body.yearFilter ? parseInt( req.body.yearFilter, 10 ) : null;
+    if ( ( monthNum && monthNum >= 1 && monthNum <= 12 ) || yearNum ) {
+      const billingDateExpr = {
+        $cond: [
+          { $eq: [ { $type: '$billingDate' }, 'date' ] },
+          '$billingDate',
+          { $toDate: '$billingDate' },
+        ],
+      };
+      const expr = { $and: [] };
+      if ( yearNum ) {
+        expr.$and.push( { $eq: [ { $year: billingDateExpr }, yearNum ] } );
+      }
+      if ( monthNum && monthNum >= 1 && monthNum <= 12 ) {
+        expr.$and.push( { $eq: [ { $month: billingDateExpr }, monthNum ] } );
+      }
+      query.push( { $match: { $expr: expr } } );
+    }
+
     if ( req.body.paymentStatus && req.body.paymentStatus.length > 0 ) {
       query.push( {
         $match: {
@@ -453,25 +481,33 @@ export async function latestDailyPricing( req, res ) {
         const products = store.products || [];
         if ( products.length > 0 ) {
           products.forEach( ( product ) => {
+            // Per-product zeroing: tangoTraffic rows only carry the traffic
+            // camera count; tangoZone rows only carry zone camera + zone count.
+            // Previously every row repeated all three values, which made
+            // tangoTraffic and tangoZone rows look identical in the export.
+            const isTraffic = product.productName === 'tangoTraffic';
+            const isZone = product.productName === 'tangoZone';
             exportdata.push( {
               'Store Name': store.storeName,
               'Store ID': store.storeId,
               'Product': product.productName,
-              'Traffic Camera Count': store.trafficCameraCount || 0,
-              'Zone Camera Count': store.zoneCameraCount || 0,
-              'Zone Count': store.zoneCount || 0,
+              'Traffic Camera Count': isTraffic ? ( store.trafficCameraCount || 0 ) : 0,
+              'Zone Camera Count': isZone ? ( store.zoneCameraCount || 0 ) : 0,
+              'Zone Count': isZone ? ( store.zoneCount || 0 ) : 0,
               'Working Days': product.workingdays || 0,
               'Status': store.status || '',
             } );
           } );
         } else {
+          // No product attached — leave all camera/zone columns at 0 so an
+          // unattributed row never carries product-specific counts.
           exportdata.push( {
             'Store Name': store.storeName,
             'Store ID': store.storeId,
             'Product': '',
-            'Traffic Camera Count': store.trafficCameraCount || 0,
-            'Zone Camera Count': store.zoneCameraCount || 0,
-            'Zone Count': store.zoneCount || 0,
+            'Traffic Camera Count': 0,
+            'Zone Camera Count': 0,
+            'Zone Count': 0,
             'Working Days': 0,
             'Status': store.status || '',
           } );
@@ -722,9 +758,6 @@ export async function getClientBillingInfo( req, res ) {
 }
 
 const COLUMN_HEADERS = [
-  '_id (read-only)',
-  'Client ID (read-only)',
-  'Brand (read-only)',
   'Group Name',
   'Group Tag',
   'Registered Company Name',
@@ -735,7 +768,7 @@ const COLUMN_HEADERS = [
   'State',
   'Country',
   'Pin Code',
-  'Place Of Supply',
+  'Place Of Supply (read-only)',
   'PO #',
   'Pro-Rata',
   'Payment Category',
@@ -746,15 +779,65 @@ const COLUMN_HEADERS = [
   'Is Installation One-Time',
   'Attach Annexure',
   'Advance Invoice',
-  'Is Primary (read-only)',
-  'Stores (count, read-only)',
-  'Invoice Receivers (count, read-only)',
+  'Store ID',
+  'Store Name (read-only)',
 ];
 
 const COLUMN_WIDTHS = [
-  28, 14, 24, 22, 12, 28, 18, 22, 22, 16, 16, 16, 12, 20, 14, 14, 18, 12, 16, 18, 16, 22, 18, 16, 18, 20, 28,
+  22, 12, 28, 18, 22, 22, 16, 16, 16, 12, 22, 14, 14, 18, 12, 16, 18, 16, 22, 18, 16, 16, 28,
 ];
 
+// GSTIN state-code prefix → Place of Supply (mirrors the UI map).
+const GST_STATE_CODE_MAP = {
+  '01': 'Jammu and Kashmir',
+  '02': 'Himachal Pradesh',
+  '03': 'Punjab',
+  '04': 'Chandigarh',
+  '05': 'Uttarakhand',
+  '06': 'Haryana',
+  '07': 'Delhi',
+  '08': 'Rajasthan',
+  '09': 'Uttar Pradesh',
+  '10': 'Bihar',
+  '11': 'Sikkim',
+  '12': 'Arunachal Pradesh',
+  '13': 'Nagaland',
+  '14': 'Manipur',
+  '15': 'Mizoram',
+  '16': 'Tripura',
+  '17': 'Meghalaya',
+  '18': 'Assam',
+  '19': 'West Bengal',
+  '20': 'Jharkhand',
+  '21': 'Odisha',
+  '22': 'Chhattisgarh',
+  '23': 'Madhya Pradesh',
+  '24': 'Gujarat',
+  '25': 'Daman and Diu',
+  '26': 'Dadra and Nagar Haveli and Daman and Diu',
+  '27': 'Maharashtra',
+  '28': 'Andhra Pradesh (Old)',
+  '29': 'Karnataka',
+  '30': 'Goa',
+  '31': 'Lakshadweep',
+  '32': 'Kerala',
+  '33': 'Tamil Nadu',
+  '34': 'Puducherry',
+  '35': 'Andaman and Nicobar Islands',
+  '36': 'Telangana',
+  '37': 'Andhra Pradesh',
+  '38': 'Ladakh',
+  '97': 'Other Territory',
+  '99': 'Centre Jurisdiction',
+};
+
+function placeOfSupplyFromGst( gst ) {
+  if ( !gst ) return '';
+  const code = String( gst ).trim().toUpperCase().substring( 0, 2 );
+  const state = GST_STATE_CODE_MAP[code];
+  return state ? `${state} (${code})` : '';
+}
+
 function boolToYesNo( v ) {
   return v === true ? 'Yes' : 'No';
 }
@@ -780,19 +863,21 @@ function numberOrUndefined( v ) {
 }
 
 function normalizeRow( rawRow ) {
+  const gst = trimOrEmpty( rawRow['GST'] );
   return {
-    _id: trimOrEmpty( rawRow['_id (read-only)'] ),
     groupName: trimOrEmpty( rawRow['Group Name'] ),
     groupTag: trimOrEmpty( rawRow['Group Tag'] ),
     registeredCompanyName: trimOrEmpty( rawRow['Registered Company Name'] ),
-    gst: trimOrEmpty( rawRow['GST'] ),
+    gst,
     addressLineOne: trimOrEmpty( rawRow['Address Line 1'] ),
     addressLineTwo: trimOrEmpty( rawRow['Address Line 2'] ),
     city: trimOrEmpty( rawRow['City'] ),
     state: trimOrEmpty( rawRow['State'] ),
     country: trimOrEmpty( rawRow['Country'] ),
     pinCode: trimOrEmpty( rawRow['Pin Code'] ),
-    placeOfSupply: trimOrEmpty( rawRow['Place Of Supply'] ),
+    // Place of Supply is derived from the GST prefix on the server, ignoring
+    // whatever the cell holds (the column is read-only in the template).
+    placeOfSupply: placeOfSupplyFromGst( gst ),
     po: trimOrEmpty( rawRow['PO #'] ),
     proRata: trimOrEmpty( rawRow['Pro-Rata'] ),
     paymentCategory: trimOrEmpty( rawRow['Payment Category'] ),
@@ -803,6 +888,7 @@ function normalizeRow( rawRow ) {
     isInstallationOneTime: yesNoToBool( rawRow['Is Installation One-Time'] ),
     attachAnnexure: yesNoToBool( rawRow['Attach Annexure'] ),
     advanceInvoice: yesNoToBool( rawRow['Advance Invoice'] ),
+    storeId: trimOrEmpty( rawRow['Store ID'] ),
   };
 }
 
@@ -825,42 +911,60 @@ export async function bulkDownloadBillingGroups( req, res ) {
       { $sort: { groupName: 1 } },
     ] );
 
-    const rows = groups.map( ( g ) => ( {
-      [COLUMN_HEADERS[0]]: String( g._id || '' ),
-      [COLUMN_HEADERS[1]]: g.clientId || '',
-      [COLUMN_HEADERS[2]]: g._client?.clientName || '',
-      [COLUMN_HEADERS[3]]: g.groupName || '',
-      [COLUMN_HEADERS[4]]: g.groupTag || '',
-      [COLUMN_HEADERS[5]]: g.registeredCompanyName || '',
-      [COLUMN_HEADERS[6]]: g.gst || '',
-      [COLUMN_HEADERS[7]]: g.addressLineOne || '',
-      [COLUMN_HEADERS[8]]: g.addressLineTwo || '',
-      [COLUMN_HEADERS[9]]: g.city || '',
-      [COLUMN_HEADERS[10]]: g.state || '',
-      [COLUMN_HEADERS[11]]: g.country || '',
-      [COLUMN_HEADERS[12]]: g.pinCode || '',
-      [COLUMN_HEADERS[13]]: g.placeOfSupply || '',
-      [COLUMN_HEADERS[14]]: g.po || '',
-      [COLUMN_HEADERS[15]]: g.proRata || '',
-      [COLUMN_HEADERS[16]]: g.paymentCategory || '',
-      [COLUMN_HEADERS[17]]: g.currency || '',
-      [COLUMN_HEADERS[18]]: g.paymentCycle || '',
-      [COLUMN_HEADERS[19]]: g.paymentTerm ?? '',
-      [COLUMN_HEADERS[20]]: g.installationFee ?? '',
-      [COLUMN_HEADERS[21]]: boolToYesNo( g.isInstallationOneTime ),
-      [COLUMN_HEADERS[22]]: boolToYesNo( g.attachAnnexure ),
-      [COLUMN_HEADERS[23]]: boolToYesNo( g.advanceInvoice ),
-      [COLUMN_HEADERS[24]]: boolToYesNo( g.isPrimary ),
-      [COLUMN_HEADERS[25]]: Array.isArray( g.stores ) ? g.stores.length : 0,
-      [COLUMN_HEADERS[26]]: Array.isArray( g.generateInvoiceTo ) ? g.generateInvoiceTo.length : 0,
-    } ) );
+    // Build storeId → storeName lookup for this brand so we can show the name
+    // alongside the (editable) store id in the template.
+    const allStoreIds = new Set();
+    groups.forEach( ( g ) => {
+      if ( Array.isArray( g.stores ) ) g.stores.forEach( ( sid ) => allStoreIds.add( String( sid ) ) );
+    } );
+    const storeDocs = allStoreIds.size > 0 ?
+        await storeService.find( { clientId, storeId: { $in: Array.from( allStoreIds ) } }, { storeId: 1, storeName: 1 } ) :
+        [];
+    const storeNameById = new Map( storeDocs.map( ( s ) => [ String( s.storeId ), s.storeName || '' ] ) );
+
+    // Emit one row per store; group columns repeat. Groups with no stores
+    // still produce a single row (with empty store fields) so the user can
+    // see the group and add stores by editing the Store ID cell.
+    const rows = [];
+    for ( const g of groups ) {
+      const groupBase = {
+        [COLUMN_HEADERS[0]]: g.groupName || '',
+        [COLUMN_HEADERS[1]]: g.groupTag || '',
+        [COLUMN_HEADERS[2]]: g.registeredCompanyName || '',
+        [COLUMN_HEADERS[3]]: g.gst || '',
+        [COLUMN_HEADERS[4]]: g.addressLineOne || '',
+        [COLUMN_HEADERS[5]]: g.addressLineTwo || '',
+        [COLUMN_HEADERS[6]]: g.city || '',
+        [COLUMN_HEADERS[7]]: g.state || '',
+        [COLUMN_HEADERS[8]]: g.country || '',
+        [COLUMN_HEADERS[9]]: g.pinCode || '',
+        [COLUMN_HEADERS[10]]: g.placeOfSupply || placeOfSupplyFromGst( g.gst ),
+        [COLUMN_HEADERS[11]]: g.po || '',
+        [COLUMN_HEADERS[12]]: g.proRata || '',
+        [COLUMN_HEADERS[13]]: g.paymentCategory || '',
+        [COLUMN_HEADERS[14]]: g.currency || '',
+        [COLUMN_HEADERS[15]]: g.paymentCycle || '',
+        [COLUMN_HEADERS[16]]: g.paymentTerm ?? '',
+        [COLUMN_HEADERS[17]]: g.installationFee ?? '',
+        [COLUMN_HEADERS[18]]: boolToYesNo( g.isInstallationOneTime ),
+        [COLUMN_HEADERS[19]]: boolToYesNo( g.attachAnnexure ),
+        [COLUMN_HEADERS[20]]: boolToYesNo( g.advanceInvoice ),
+      };
+      const storeIds = Array.isArray( g.stores ) && g.stores.length > 0 ? g.stores : [ '' ];
+      for ( const sid of storeIds ) {
+        rows.push( {
+          ...groupBase,
+          [COLUMN_HEADERS[21]]: sid || '',
+          [COLUMN_HEADERS[22]]: sid ? ( storeNameById.get( String( sid ) ) || '' ) : '',
+        } );
+      }
+    }
 
     // Build the workbook with ExcelJS so cell protection is actually written
     // to the file (the community xlsx build strips per-cell styles on write).
-    // Read-only columns by index: 0 (_id), 1 (Client ID), 2 (Brand),
-    //                              24 (Is Primary), 25 (Stores count),
-    //                              26 (Invoice Receivers count).
-    const READ_ONLY_COLS = new Set( [ 0, 1, 2, 24, 25, 26 ] );
+    // Read-only columns by index: 10 (Place Of Supply — derived from GST),
+    //                              22 (Store Name).
+    const READ_ONLY_COLS = new Set( [ 10, 22 ] );
     const wb = new ExcelJS.Workbook();
     const ws = wb.addWorksheet( 'Billing Groups' );
     ws.columns = COLUMN_HEADERS.map( ( header, i ) => ( {
@@ -918,7 +1022,11 @@ export async function bulkDownloadBillingGroups( req, res ) {
 
 export async function bulkUpdateBillingGroups( req, res ) {
   try {
-    if ( !req.file?.buffer ) {
+    // The frontend sends the XLSX as base64 in JSON (see billing.service.ts).
+    // Switching off multipart sidestepped multer's "Unexpected end of form"
+    // failures we were seeing in production.
+    const fileBase64 = req.body?.fileBase64;
+    if ( !fileBase64 || typeof fileBase64 !== 'string' ) {
       return res.sendError( 'No file uploaded', 400 );
     }
 
@@ -927,9 +1035,22 @@ export async function bulkUpdateBillingGroups( req, res ) {
       return res.sendError( 'clientId form field is required', 400 );
     }
 
+    let fileBuffer;
+    try {
+      fileBuffer = Buffer.from( fileBase64, 'base64' );
+    } catch ( decodeErr ) {
+      logger.error( { error: decodeErr, function: 'bulkUpdateBillingGroups.decode' } );
+      return res.sendError( 'Invalid file payload', 400 );
+    }
+
+    // Match the 5MB cap multer was enforcing.
+    if ( fileBuffer.length > 5 * 1024 * 1024 ) {
+      return res.sendError( 'File too large (max 5MB)', 413 );
+    }
+
     let rawRows;
     try {
-      const wb = XLSX.read( req.file.buffer, { type: 'buffer' } );
+      const wb = XLSX.read( fileBuffer, { type: 'buffer' } );
       const sheet = wb.Sheets[wb.SheetNames[0]];
       rawRows = XLSX.utils.sheet_to_json( sheet, { defval: '' } );
     } catch ( parseErr ) {
@@ -961,25 +1082,19 @@ export async function bulkUpdateBillingGroups( req, res ) {
       }
 
       // Boolean cells that the user filled in but we couldn't parse → error (not silent skip).
-      const rawIsOneTime = trimOrEmpty( raw[COLUMN_HEADERS[21]] );
+      const rawIsOneTime = trimOrEmpty( raw['Is Installation One-Time'] );
       if ( rawIsOneTime !== '' && row.isInstallationOneTime === undefined ) {
         rowErrors.push( 'Is Installation One-Time must be Yes or No' );
       }
-      const rawAttachAnnexure = trimOrEmpty( raw[COLUMN_HEADERS[22]] );
+      const rawAttachAnnexure = trimOrEmpty( raw['Attach Annexure'] );
       if ( rawAttachAnnexure !== '' && row.attachAnnexure === undefined ) {
         rowErrors.push( 'Attach Annexure must be Yes or No' );
       }
-      const rawAdvanceInvoice = trimOrEmpty( raw[COLUMN_HEADERS[23]] );
+      const rawAdvanceInvoice = trimOrEmpty( raw['Advance Invoice'] );
       if ( rawAdvanceInvoice !== '' && row.advanceInvoice === undefined ) {
         rowErrors.push( 'Advance Invoice must be Yes or No' );
       }
 
-      // Cross-brand guard: every row must belong to the brand the user is on.
-      const rowClientId = trimOrEmpty( raw[COLUMN_HEADERS[1]] );
-      if ( rowClientId !== '' && rowClientId !== clientId ) {
-        rowErrors.push( `Row belongs to client ${rowClientId}, not ${clientId}. Upload only rows for the current brand.` );
-      }
-
       const { error: joiError } = bulkUpdateBillingGroupRowSchema.validate( row, { abortEarly: false, stripUnknown: true } );
       if ( joiError ) {
         for ( const d of joiError.details ) rowErrors.push( d.message );
@@ -988,8 +1103,7 @@ export async function bulkUpdateBillingGroups( req, res ) {
       if ( rowErrors.length > 0 ) {
         errors.push( {
           rowNumber,
-          _id: row._id,
-          brand: raw[COLUMN_HEADERS[2]] || '',
+          groupName: row.groupName,
           errors: rowErrors,
         } );
         normalized.push( null );
@@ -998,28 +1112,121 @@ export async function bulkUpdateBillingGroups( req, res ) {
       normalized.push( row );
     }
 
-    // Second pass: verify each _id exists in the DB AND belongs to clientId.
-    const idsToCheck = normalized
+    // Second pass: resolve each unique Group Name to a DB _id within this brand.
+    const groupNamesToCheck = Array.from( new Set( normalized
         .filter( ( r ) => r !== null )
-        .map( ( r ) => r._id );
-    const foundDocs = idsToCheck.length > 0 ?
-        await billingService.find( { _id: { $in: idsToCheck }, clientId } ) :
+        .map( ( r ) => r.groupName ) ) );
+    const foundDocs = groupNamesToCheck.length > 0 ?
+        await billingService.find( { groupName: { $in: groupNamesToCheck }, clientId } ) :
         [];
-    const foundIds = new Set( foundDocs.map( ( d ) => String( d._id ) ) );
+    const idByGroupName = new Map( foundDocs.map( ( d ) => [ d.groupName, String( d._id ) ] ) );
     for ( let i = 0; i < normalized.length; i++ ) {
       const row = normalized[i];
       if ( !row ) continue;
-      if ( !foundIds.has( row._id ) ) {
+      if ( !idByGroupName.has( row.groupName ) ) {
         errors.push( {
           rowNumber: i + 2,
-          _id: row._id,
-          brand: rawRows[i][COLUMN_HEADERS[2]] || '',
-          errors: [ 'Billing group not found' ],
+          groupName: row.groupName,
+          errors: [ `Billing group "${row.groupName}" not found for this brand` ],
         } );
         normalized[i] = null;
       }
     }
 
+    // Third pass: aggregate rows by Group Name. Each group's stores[] is the
+    // union of the Store ID cells across all of its rows. Group-level fields
+    // are taken from the FIRST row for that group.
+    const groupedByName = new Map(); // groupName → { _id, firstRowIndex, payload, storeIds: [] }
+    for ( let i = 0; i < normalized.length; i++ ) {
+      const row = normalized[i];
+      if ( !row ) continue;
+      const key = row.groupName;
+      // eslint-disable-next-line no-unused-vars
+      const { storeId, ...groupFields } = row;
+      if ( !groupedByName.has( key ) ) {
+        groupedByName.set( key, {
+          _id: idByGroupName.get( key ),
+          groupName: key,
+          firstRowIndex: i,
+          payload: groupFields,
+          storeIds: [],
+          storeIdSet: new Set(),
+        } );
+      }
+      const entry = groupedByName.get( key );
+      if ( storeId ) {
+        if ( entry.storeIdSet.has( storeId ) ) {
+          errors.push( {
+            rowNumber: i + 2,
+            groupName: key,
+            errors: [ `Store ID ${storeId} is listed more than once for this billing group` ],
+          } );
+          continue;
+        }
+        entry.storeIdSet.add( storeId );
+        entry.storeIds.push( storeId );
+      }
+    }
+
+    // Fourth pass: cross-group uniqueness — same Store ID may NOT appear in
+    // two different groups in the upload.
+    const storeIdToGroup = new Map(); // storeId → groupName
+    for ( const entry of groupedByName.values() ) {
+      for ( const sid of entry.storeIds ) {
+        if ( storeIdToGroup.has( sid ) && storeIdToGroup.get( sid ) !== entry.groupName ) {
+          errors.push( {
+            rowNumber: entry.firstRowIndex + 2,
+            groupName: entry.groupName,
+            errors: [ `Store ID ${sid} is assigned to another billing group in this upload ("${storeIdToGroup.get( sid )}")` ],
+          } );
+        } else {
+          storeIdToGroup.set( sid, entry.groupName );
+        }
+      }
+    }
+
+    // Fifth pass: store existence — every Store ID must exist for this clientId.
+    const allStoreIds = Array.from( storeIdToGroup.keys() );
+    const existingStoreDocs = allStoreIds.length > 0 ?
+        await storeService.find( { clientId, storeId: { $in: allStoreIds } }, { storeId: 1 } ) :
+        [];
+    const existingStoreIds = new Set( existingStoreDocs.map( ( s ) => String( s.storeId ) ) );
+    for ( const entry of groupedByName.values() ) {
+      const missing = entry.storeIds.filter( ( sid ) => !existingStoreIds.has( String( sid ) ) );
+      if ( missing.length > 0 ) {
+        errors.push( {
+          rowNumber: entry.firstRowIndex + 2,
+          groupName: entry.groupName,
+          errors: [ `Store ID${missing.length > 1 ? 's' : ''} ${missing.join( ', ' )} not found for this brand` ],
+        } );
+      }
+    }
+
+    // Sixth pass: cross-group conflict with OTHER existing groups in the DB.
+    // A store already assigned to a different billing group cannot be claimed
+    // by this upload.
+    const idsInUpload = Array.from( groupedByName.values() ).map( ( e ) => e._id );
+    if ( allStoreIds.length > 0 ) {
+      const conflictDocs = await billingService.find(
+          { clientId, stores: { $in: allStoreIds }, _id: { $nin: idsInUpload } },
+          { _id: 1, groupName: 1, stores: 1 },
+      );
+      for ( const doc of conflictDocs ) {
+        const conflictIds = ( doc.stores || [] ).filter( ( sid ) => allStoreIds.includes( String( sid ) ) );
+        for ( const sid of conflictIds ) {
+          const claimingGroupName = storeIdToGroup.get( String( sid ) );
+          const claimingEntry = groupedByName.get( claimingGroupName );
+          if ( claimingEntry ) {
+            errors.push( {
+              rowNumber: claimingEntry.firstRowIndex + 2,
+              groupName: claimingEntry.groupName,
+              errors: [ `Store ID ${sid} is already assigned to billing group "${doc.groupName}"` ],
+            } );
+          }
+        }
+      }
+    }
+
     if ( errors.length > 0 ) {
       errors.sort( ( a, b ) => a.rowNumber - b.rowNumber );
       return res.sendError(
@@ -1030,31 +1237,28 @@ export async function bulkUpdateBillingGroups( req, res ) {
 
     const openSearchActivityLog = JSON.parse( process.env.OPENSEARCH ).activityLog;
 
-    // Third pass: serial DB writes.
+    // Seventh pass: serial DB writes — one per billing group.
     let updated = 0;
     let aborted = null;
-    for ( let i = 0; i < normalized.length; i++ ) {
-      const row = normalized[i];
-      // eslint-disable-next-line no-unused-vars
-      const { _id, ...payload } = row;
+    for ( const entry of groupedByName.values() ) {
       try {
-        await billingService.updateOne( { _id }, payload );
+        await billingService.updateOne( { _id: entry._id }, { ...entry.payload, stores: entry.storeIds } );
         updated++;
         insertOpenSearchData( openSearchActivityLog, {
           userName: req.user?.userName,
           email: req.user?.email,
-          clientId: rawRows[i][COLUMN_HEADERS[1]] || '',
+          clientId,
           logSubType: 'billingGroupUpdate',
           logType: 'billing',
           date: new Date(),
-          changes: [ `Billing group ${_id} updated via bulk upload` ],
+          changes: [ `Billing group "${entry.groupName}" updated via bulk upload (stores=${entry.storeIds.length})` ],
           eventType: '',
           timestamp: new Date(),
           showTo: [ 'tango' ],
         } );
       } catch ( writeErr ) {
-        logger.error( { error: writeErr, function: 'bulkUpdateBillingGroups.write', rowNumber: i + 2, _id } );
-        aborted = { rowNumber: i + 2, _id, message: writeErr?.message || String( writeErr ) };
+        logger.error( { error: writeErr, function: 'bulkUpdateBillingGroups.write', groupName: entry.groupName } );
+        aborted = { rowNumber: entry.firstRowIndex + 2, groupName: entry.groupName, message: writeErr?.message || String( writeErr ) };
         break;
       }
     }
@@ -1066,7 +1270,7 @@ export async function bulkUpdateBillingGroups( req, res ) {
       logSubType: 'billingGroupBulkUpdate',
       logType: 'billing',
       date: new Date(),
-      changes: [ `Bulk billing-group update: ${updated} of ${normalized.length} groups updated by ${req.user?.email}` ],
+      changes: [ `Bulk billing-group update: ${updated} of ${groupedByName.size} groups updated by ${req.user?.email}` ],
       eventType: '',
       timestamp: new Date(),
       showTo: [ 'tango' ],
@@ -1074,12 +1278,12 @@ export async function bulkUpdateBillingGroups( req, res ) {
 
     if ( aborted ) {
       return res.sendError(
-          { summary: { total: normalized.length, updated, remaining: normalized.length - updated }, aborted },
+          { summary: { total: groupedByName.size, updated, remaining: groupedByName.size - updated }, aborted },
           207,
       );
     }
 
-    return res.sendSuccess( { summary: { total: normalized.length, updated } } );
+    return res.sendSuccess( { summary: { total: groupedByName.size, updated } } );
   } catch ( error ) {
     logger.error( { error: error, function: 'bulkUpdateBillingGroups' } );
     return res.sendError( error, 500 );

package/src/controllers/invoice.controller.js

@@ -174,6 +174,7 @@ export async function createInvoice( req, res ) {
       let invoicedate = req.body.invoiceId ? dayjs( findInvoice.billingDate ).format( 'YYYY-MM-DD' ) : baseDate.format( 'YYYY-MM-DD' );
       let daysExtend = group?.paymentTerm ? group?.paymentTerm : 30;
       let dueDate = baseDate.add( daysExtend, 'days' );
+      console.log( 'group.currencygroup.currency', group.currency );
       let data = {
         groupName: group.groupName,
         groupId: group._id,
@@ -265,6 +266,11 @@ export async function invoiceDownload( req, res ) {
     let invoiceInfo = await invoiceService.findOne( { _id: req.params.invoiceId } );
     if ( invoiceInfo ) {
       let clientDetails = await clientService.findOne( { clientId: invoiceInfo.clientId } );
+      // The invoice records its own currency at creation time (from the
+      // billing group). That's the source of truth for the PDF — using
+      // client.paymentInvoice or virtualAccount.currency causes historical
+      // invoices to re-render in the wrong currency if those settings change.
+      const invoiceCurrency = symbolFor( invoiceInfo.currency );
       invoiceInfo.products.forEach( ( item, index ) => {
         item.index = index + 1;
         let [ firstWord, secondWord ] = item.productName.replace( /([a-z])([A-Z])/g, '$1 $2' ).split( ' ' );
@@ -272,7 +278,7 @@ export async function invoiceDownload( req, res ) {
         item.productName = firstWord + ' ' + secondWord;
         item.price = Math.round( item.price ).toLocaleString( 'en-IN' );
         item.amount = item.amount.toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } );
-        item.currency = symbolFor( clientDetails?.paymentInvoice?.currencyType );
+        item.currency = invoiceCurrency;
       } );
 
 
@@ -304,7 +310,7 @@ export async function invoiceDownload( req, res ) {
         PoNum: getgroup?.po,
         amountwords: AmountinWords,
         Terms: `Term ${getgroup?.paymentTerm ? getgroup?.paymentTerm : '30'}`,
-        currencyType: symbolFor( virtualAccount?.currency ),
+        currencyType: invoiceCurrency,
         totalAmount: invoiceInfo.totalAmount.toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } ),
         invoiceDate,
         dueDate,
@@ -375,7 +381,7 @@ export async function invoiceDownload( req, res ) {
               storeName: '$stores.storeName',
               edgefirstFileDate: '$stores.edgefirstFileDate',
               workingdays: '$stores.products.workingdays',
-              currencyType: { $literal: symbolFor( clientDetails?.paymentInvoice?.currencyType ) },
+              currencyType: { $literal: invoiceCurrency },
             },
           },
           {
@@ -580,6 +586,10 @@ async function buildInvoicePdfBuffer( invoiceId ) {
   }
 
   let clientDetails = await clientService.findOne( { clientId: invoiceInfo.clientId } );
+  // Source of truth for the PDF currency is the invoice's own `currency`
+  // field, recorded at creation from the billing group. See invoiceDownload
+  // above for the same pattern.
+  const invoiceCurrency = symbolFor( invoiceInfo.currency );
   invoiceInfo.products.forEach( ( item, index ) => {
     item.index = index + 1;
     let [ firstWord, secondWord ] = item.productName.replace( /([a-z])([A-Z])/g, '$1 $2' ).split( ' ' );
@@ -587,7 +597,7 @@ async function buildInvoicePdfBuffer( invoiceId ) {
     item.productName = firstWord + ' ' + secondWord;
     item.price = Math.round( item.price ).toLocaleString( 'en-IN' );
     item.amount = item.amount.toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } );
-    item.currency = symbolFor( clientDetails?.paymentInvoice?.currencyType );
+    item.currency = invoiceCurrency;
   } );
 
   let invoiceDate = dayjs( invoiceInfo.billingDate ).format( 'DD/MM/YYYY' );
@@ -616,7 +626,7 @@ async function buildInvoicePdfBuffer( invoiceId ) {
     PoNum: getgroup?.po,
     amountwords: AmountinWords,
     Terms: `Term ${getgroup?.paymentTerm ? getgroup?.paymentTerm : '30'}`,
-    currencyType: symbolFor( virtualAccount?.currency ),
+    currencyType: invoiceCurrency,
     totalAmount: invoiceInfo.totalAmount.toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } ),
     invoiceDate,
     dueDate,
@@ -661,7 +671,7 @@ async function buildInvoicePdfBuffer( invoiceId ) {
         storeName: '$stores.storeName',
         edgefirstFileDate: '$stores.edgefirstFileDate',
         workingdays: '$stores.products.workingdays',
-        currencyType: { $literal: symbolFor( clientDetails?.paymentInvoice?.currencyType ) },
+        currencyType: { $literal: invoiceCurrency },
       } },
       { $sort: { productName: 1, workingdays: -1 } },
       { $match: { workingdays: { $gt: 0 } } },
@@ -816,8 +826,10 @@ export async function invoiceAnnexure( req, res ) {
       return res.sendSuccess( { data: [] } );
     }
 
-    const clientDetails = await clientService.findOne( { clientId: invoiceInfo.clientId } );
     const currentMonthDays = dayjs().daysInMonth();
+    // Annexure must show the same currency as the invoice it accompanies —
+    // see invoiceDownload / buildInvoicePdfBuffer for the same pattern.
+    const invoiceCurrency = symbolFor( invoiceInfo.currency );
 
     const annexureData = await dailyPricingService.aggregate( [
       { $match: { clientId: invoiceInfo.clientId } },
@@ -832,7 +844,7 @@ export async function invoiceAnnexure( req, res ) {
         storeName: '$stores.storeName',
         edgefirstFileDate: '$stores.edgefirstFileDate',
         workingdays: '$stores.products.workingdays',
-        currencyType: { $literal: symbolFor( clientDetails?.paymentInvoice?.currencyType ) },
+        currencyType: { $literal: invoiceCurrency },
       } },
       { $sort: { productName: 1, workingdays: -1 } },
       { $match: { workingdays: { $gt: 0 } } },
@@ -2210,6 +2222,20 @@ export async function deleteInvoice( req, res ) {
 
     await invoiceService.deleteRecord( { _id: invoiceId } );
 
+    const logObj = {
+      userName: req.user?.userName,
+      email: req.user?.email,
+      clientId: invoice.clientId,
+      logSubType: 'invoiceDeleted',
+      logType: 'invoice',
+      date: new Date(),
+      changes: [ `Invoice ${invoice.invoice} has been deleted by ${req.user?.email}` ],
+      eventType: 'delete',
+      timestamp: new Date(),
+      showTo: [ 'tango' ],
+    };
+    insertOpenSearchData( JSON.parse( process.env.OPENSEARCH ).activityLog, logObj );
+
     res.sendSuccess( { message: 'Invoice deleted successfully' } );
   } catch ( error ) {
     logger.error( { error: error, function: 'deleteInvoice' } );

package/src/dtos/validation.dtos.js

@@ -372,7 +372,6 @@ export const updateBillingGroupsSchema = {
 };
 
 export const bulkUpdateBillingGroupRowSchema = joi.object( {
-  _id: joi.string().length( 24 ).hex().required(),
   groupName: joi.string().required(),
   groupTag: joi.string().required(),
   registeredCompanyName: joi.string().required(),
@@ -394,6 +393,7 @@ export const bulkUpdateBillingGroupRowSchema = joi.object( {
   isInstallationOneTime: joi.boolean().optional(),
   attachAnnexure: joi.boolean().optional(),
   advanceInvoice: joi.boolean().optional(),
+  storeId: joi.string().allow( '' ).optional(),
 } );
 
 export const deleteBillingGroupQuery = {

package/src/routes/brandsBilling.routes.js

@@ -1,21 +1,8 @@
 
 import express from 'express';
-import multer from 'multer';
 import { brandsBillingList, brandInvoiceList, latestDailyPricing, brandBillingGroups, updateDailyPricingWorkingDays, updateDailyPricingStoreField, getClientBillingInfo, bulkDownloadBillingGroups, bulkUpdateBillingGroups } from '../controllers/brandsBilling.controller.js';
 import { isAllowedSessionHandler, accessVerification } from 'tango-app-api-middleware';
 
-const bulkUpload = multer( {
-  storage: multer.memoryStorage(),
-  limits: { fileSize: 5 * 1024 * 1024 },
-  fileFilter: ( _req, file, cb ) => {
-    const ok = [
-      'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-      'application/vnd.ms-excel',
-      'application/octet-stream',
-    ].includes( file.mimetype );
-    cb( ok ? null : new Error( 'Invalid file format — use XLSX' ), ok );
-  },
-} );
 export const brandsBillingRouter = express.Router();
 
 brandsBillingRouter.post( '/brandsBillingList', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), brandsBillingList );
@@ -26,4 +13,4 @@ brandsBillingRouter.put( '/updateDailyPricingWorkingDays', isAllowedSessionHandl
 brandsBillingRouter.put( '/updateDailyPricingStoreField', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), updateDailyPricingStoreField );
 brandsBillingRouter.post( '/getClientBillingInfo', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), getClientBillingInfo );
 brandsBillingRouter.get( '/bulk-download-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), bulkDownloadBillingGroups );
-brandsBillingRouter.post( '/bulk-update-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), bulkUpload.single( 'file' ), bulkUpdateBillingGroups );
+brandsBillingRouter.post( '/bulk-update-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), bulkUpdateBillingGroups );

package/src/routes/invoice.routes.js

@@ -5,6 +5,19 @@ import { getInvoiceHeads, updateInvoiceHeads } from '../controllers/applicationD
 import { updateInvoiceHeadsSchema } from '../dtos/validation.dtos.js';
 export const invoiceRouter = express.Router();
 
+// Superadmin bypass: if the authenticated user has role 'superadmin', skip the
+// granular access check that follows. Place between isAllowedSessionHandler and
+// accessVerification so req.user is populated.
+function superadminBypass( accessConfig ) {
+  const verify = accessVerification( accessConfig );
+  return function( req, res, next ) {
+    if ( req.user && req.user.role === 'superadmin' ) {
+      return next();
+    }
+    return verify( req, res, next );
+  };
+}
+
 
 invoiceRouter.post( '/createInvoice', isAllowedSessionHandler, createInvoice );
 invoiceRouter.post( '/regerateInvoice', isAllowedSessionHandler, createInvoice );
@@ -13,19 +26,19 @@ invoiceRouter.post( '/invoiceDownload/:invoiceId', isAllowedSessionHandler, invo
 invoiceRouter.post( '/clientInvoiceList', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), clientInvoiceList );
 invoiceRouter.post( '/creditTransactionlist', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), creditTransactionlist );
 invoiceRouter.post( '/pendingInvoices', isAllowedSessionHandler, pendingInvoices );
-invoiceRouter.post( '/applyDiscount', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), applyDiscount );
+invoiceRouter.post( '/applyDiscount', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), applyDiscount );
 invoiceRouter.post( '/migrateInvoice', migrateInvoice );
-invoiceRouter.post( '/PaymentStatusChange', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), PaymentStatusChange );
+invoiceRouter.post( '/PaymentStatusChange', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), PaymentStatusChange );
 invoiceRouter.post( '/checkPaymentStatus', checkPaymentStatus );
-invoiceRouter.get( '/getInvoice/:invoiceId', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), getInvoice );
-invoiceRouter.get( '/invoiceAnnexure/:invoiceId', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), invoiceAnnexure );
-invoiceRouter.put( '/updateInvoice', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), updateInvoice );
+invoiceRouter.get( '/getInvoice/:invoiceId', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), getInvoice );
+invoiceRouter.get( '/invoiceAnnexure/:invoiceId', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), invoiceAnnexure );
+invoiceRouter.put( '/updateInvoice', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), updateInvoice );
 invoiceRouter.get( '/getClientBasePricing/:clientId', isAllowedSessionHandler, getClientBasePricing );
-invoiceRouter.delete( '/deleteInvoice/:invoiceId', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), deleteInvoice );
+invoiceRouter.delete( '/deleteInvoice/:invoiceId', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), deleteInvoice );
 
-invoiceRouter.post( '/approveInvoiceCsm', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'csmApproval', permissions: [ 'isEdit' ] } ] } ), approveInvoiceCsm );
-invoiceRouter.post( '/approveInvoiceFinance', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'financeApproval', permissions: [ 'isEdit' ] } ] } ), approveInvoiceFinance );
-invoiceRouter.post( '/approveInvoiceApproval', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), approveInvoiceApproval );
+invoiceRouter.post( '/approveInvoiceCsm', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'csmApproval', permissions: [ 'isEdit' ] } ] } ), approveInvoiceCsm );
+invoiceRouter.post( '/approveInvoiceFinance', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'financeApproval', permissions: [ 'isEdit' ] } ] } ), approveInvoiceFinance );
+invoiceRouter.post( '/approveInvoiceApproval', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), approveInvoiceApproval );
 
 invoiceRouter.get( '/getInvoiceHeads', isAllowedSessionHandler, getInvoiceHeads );
 invoiceRouter.post( '/updateInvoiceHeads', isAllowedSessionHandler, validate( updateInvoiceHeadsSchema ), updateInvoiceHeads );