tango-app-api-payment-subscription 3.5.1 → 3.5.3

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tango-app-api-payment-subscription",
-    "version": "3.5.1",
+    "version": "3.5.3",
     "description": "paymentSubscription",
     "main": "index.js",
     "type": "module",

package/src/controllers/brandsBilling.controller.js

@@ -481,25 +481,33 @@ export async function latestDailyPricing( req, res ) {
         const products = store.products || [];
         if ( products.length > 0 ) {
           products.forEach( ( product ) => {
+            // Per-product zeroing: tangoTraffic rows only carry the traffic
+            // camera count; tangoZone rows only carry zone camera + zone count.
+            // Previously every row repeated all three values, which made
+            // tangoTraffic and tangoZone rows look identical in the export.
+            const isTraffic = product.productName === 'tangoTraffic';
+            const isZone = product.productName === 'tangoZone';
             exportdata.push( {
               'Store Name': store.storeName,
               'Store ID': store.storeId,
               'Product': product.productName,
-              'Traffic Camera Count': store.trafficCameraCount || 0,
-              'Zone Camera Count': store.zoneCameraCount || 0,
-              'Zone Count': store.zoneCount || 0,
+              'Traffic Camera Count': isTraffic ? ( store.trafficCameraCount || 0 ) : 0,
+              'Zone Camera Count': isZone ? ( store.zoneCameraCount || 0 ) : 0,
+              'Zone Count': isZone ? ( store.zoneCount || 0 ) : 0,
               'Working Days': product.workingdays || 0,
               'Status': store.status || '',
             } );
           } );
         } else {
+          // No product attached — leave all camera/zone columns at 0 so an
+          // unattributed row never carries product-specific counts.
           exportdata.push( {
             'Store Name': store.storeName,
             'Store ID': store.storeId,
             'Product': '',
-            'Traffic Camera Count': store.trafficCameraCount || 0,
-            'Zone Camera Count': store.zoneCameraCount || 0,
-            'Zone Count': store.zoneCount || 0,
+            'Traffic Camera Count': 0,
+            'Zone Camera Count': 0,
+            'Zone Count': 0,
             'Working Days': 0,
             'Status': store.status || '',
           } );
@@ -1014,7 +1022,11 @@ export async function bulkDownloadBillingGroups( req, res ) {
 
 export async function bulkUpdateBillingGroups( req, res ) {
   try {
-    if ( !req.file?.buffer ) {
+    // The frontend sends the XLSX as base64 in JSON (see billing.service.ts).
+    // Switching off multipart sidestepped multer's "Unexpected end of form"
+    // failures we were seeing in production.
+    const fileBase64 = req.body?.fileBase64;
+    if ( !fileBase64 || typeof fileBase64 !== 'string' ) {
       return res.sendError( 'No file uploaded', 400 );
     }
 
@@ -1023,9 +1035,22 @@ export async function bulkUpdateBillingGroups( req, res ) {
       return res.sendError( 'clientId form field is required', 400 );
     }
 
+    let fileBuffer;
+    try {
+      fileBuffer = Buffer.from( fileBase64, 'base64' );
+    } catch ( decodeErr ) {
+      logger.error( { error: decodeErr, function: 'bulkUpdateBillingGroups.decode' } );
+      return res.sendError( 'Invalid file payload', 400 );
+    }
+
+    // Match the 5MB cap multer was enforcing.
+    if ( fileBuffer.length > 5 * 1024 * 1024 ) {
+      return res.sendError( 'File too large (max 5MB)', 413 );
+    }
+
     let rawRows;
     try {
-      const wb = XLSX.read( req.file.buffer, { type: 'buffer' } );
+      const wb = XLSX.read( fileBuffer, { type: 'buffer' } );
       const sheet = wb.Sheets[wb.SheetNames[0]];
       rawRows = XLSX.utils.sheet_to_json( sheet, { defval: '' } );
     } catch ( parseErr ) {

package/src/controllers/invoice.controller.js

@@ -2,6 +2,7 @@ import * as invoiceService from '../services/invoice.service.js';
 import * as dailyPricingService from '../services/dailyPrice.service.js';
 import * as clientService from '../services/clientPayment.services.js';
 import * as billingService from '../services/billing.service.js';
+import mongoose from 'mongoose';
 import dayjs from 'dayjs';
 import { logger, checkFileExist, signedUrl, download, sendEmailWithSES, insertOpenSearchData } from 'tango-app-api-middleware';
 // import Handlebars from 'handlebars';
@@ -65,6 +66,25 @@ async function getInvoiceCcEmails( clientId ) {
 export async function createInvoice( req, res ) {
   try {
     let invoiceGroupList = [];
+    // Optional groupIds filter — when present, only those billing groups will
+    // be processed. Lets the UI generate an invoice for a specific subset of
+    // groups instead of every group on the client. Strings are matched against
+    // billing _id.
+    const groupIdsFilter = Array.isArray( req.body.groupIds ) && req.body.groupIds.length > 0 ?
+      req.body.groupIds :
+      null;
+    const groupObjectIdFilter = groupIdsFilter ?
+      groupIdsFilter
+          .map( ( id ) => {
+            try {
+              return new mongoose.Types.ObjectId( id );
+            } catch {
+              return null;
+            }
+          } )
+          .filter( ( id ) => id !== null ) :
+      null;
+
     if ( req.body.allClient ) {
       if ( req.body.clientList && req.body.clientList.length > 0 ) {
         req.body.clientList = req.body.clientList;
@@ -74,12 +94,12 @@ export async function createInvoice( req, res ) {
       }
 
       for ( let client of req.body.clientList ) {
+        const matchStage = { clientId: client };
+        if ( groupObjectIdFilter && groupObjectIdFilter.length ) {
+          matchStage._id = { $in: groupObjectIdFilter };
+        }
         let invoiceGroup = await billingService.aggregatebilling( [
-          {
-            $match: {
-              clientId: client,
-            },
-          },
+          { $match: matchStage },
         ] );
         for ( let invGrp of invoiceGroup ) {
           invoiceGroupList.push( invGrp );
@@ -95,7 +115,14 @@ export async function createInvoice( req, res ) {
 
     for ( let group of invoiceGroupList ) {
       let Finacialyear = getCurrentFinancialYear();
-      let previousinvoice = await invoiceService.findandsort( {}, {}, { invoiceIndex: -1 } );
+      // Scope the highest-index lookup to invoices created in the current FY
+      // (invoice IDs are `INV-${FY}-${index}`). Without this scope the new FY
+      // would continue the previous year's sequence instead of resetting.
+      let previousinvoice = await invoiceService.findandsort(
+          { invoice: { $regex: `^INV-${Finacialyear}-` } },
+          {},
+          { invoiceIndex: -1 },
+      );
       let invoiceNo = '00001';
       if ( previousinvoice && previousinvoice.length > 0 ) {
         invoiceNo = Number( previousinvoice[0].invoiceIndex ) + 1;
@@ -174,6 +201,7 @@ export async function createInvoice( req, res ) {
       let invoicedate = req.body.invoiceId ? dayjs( findInvoice.billingDate ).format( 'YYYY-MM-DD' ) : baseDate.format( 'YYYY-MM-DD' );
       let daysExtend = group?.paymentTerm ? group?.paymentTerm : 30;
       let dueDate = baseDate.add( daysExtend, 'days' );
+      console.log( 'group.currencygroup.currency', group.currency );
       let data = {
         groupName: group.groupName,
         groupId: group._id,
@@ -265,6 +293,11 @@ export async function invoiceDownload( req, res ) {
     let invoiceInfo = await invoiceService.findOne( { _id: req.params.invoiceId } );
     if ( invoiceInfo ) {
       let clientDetails = await clientService.findOne( { clientId: invoiceInfo.clientId } );
+      // The invoice records its own currency at creation time (from the
+      // billing group). That's the source of truth for the PDF — using
+      // client.paymentInvoice or virtualAccount.currency causes historical
+      // invoices to re-render in the wrong currency if those settings change.
+      const invoiceCurrency = symbolFor( invoiceInfo.currency );
       invoiceInfo.products.forEach( ( item, index ) => {
         item.index = index + 1;
         let [ firstWord, secondWord ] = item.productName.replace( /([a-z])([A-Z])/g, '$1 $2' ).split( ' ' );
@@ -272,7 +305,7 @@ export async function invoiceDownload( req, res ) {
         item.productName = firstWord + ' ' + secondWord;
         item.price = Math.round( item.price ).toLocaleString( 'en-IN' );
         item.amount = item.amount.toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } );
-        item.currency = symbolFor( clientDetails?.paymentInvoice?.currencyType );
+        item.currency = invoiceCurrency;
       } );
 
 
@@ -304,7 +337,7 @@ export async function invoiceDownload( req, res ) {
         PoNum: getgroup?.po,
         amountwords: AmountinWords,
         Terms: `Term ${getgroup?.paymentTerm ? getgroup?.paymentTerm : '30'}`,
-        currencyType: symbolFor( virtualAccount?.currency ),
+        currencyType: invoiceCurrency,
         totalAmount: invoiceInfo.totalAmount.toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } ),
         invoiceDate,
         dueDate,
@@ -375,7 +408,7 @@ export async function invoiceDownload( req, res ) {
               storeName: '$stores.storeName',
               edgefirstFileDate: '$stores.edgefirstFileDate',
               workingdays: '$stores.products.workingdays',
-              currencyType: { $literal: symbolFor( clientDetails?.paymentInvoice?.currencyType ) },
+              currencyType: { $literal: invoiceCurrency },
             },
           },
           {
@@ -580,6 +613,10 @@ async function buildInvoicePdfBuffer( invoiceId ) {
   }
 
   let clientDetails = await clientService.findOne( { clientId: invoiceInfo.clientId } );
+  // Source of truth for the PDF currency is the invoice's own `currency`
+  // field, recorded at creation from the billing group. See invoiceDownload
+  // above for the same pattern.
+  const invoiceCurrency = symbolFor( invoiceInfo.currency );
   invoiceInfo.products.forEach( ( item, index ) => {
     item.index = index + 1;
     let [ firstWord, secondWord ] = item.productName.replace( /([a-z])([A-Z])/g, '$1 $2' ).split( ' ' );
@@ -587,7 +624,7 @@ async function buildInvoicePdfBuffer( invoiceId ) {
     item.productName = firstWord + ' ' + secondWord;
     item.price = Math.round( item.price ).toLocaleString( 'en-IN' );
     item.amount = item.amount.toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } );
-    item.currency = symbolFor( clientDetails?.paymentInvoice?.currencyType );
+    item.currency = invoiceCurrency;
   } );
 
   let invoiceDate = dayjs( invoiceInfo.billingDate ).format( 'DD/MM/YYYY' );
@@ -616,7 +653,7 @@ async function buildInvoicePdfBuffer( invoiceId ) {
     PoNum: getgroup?.po,
     amountwords: AmountinWords,
     Terms: `Term ${getgroup?.paymentTerm ? getgroup?.paymentTerm : '30'}`,
-    currencyType: symbolFor( virtualAccount?.currency ),
+    currencyType: invoiceCurrency,
     totalAmount: invoiceInfo.totalAmount.toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } ),
     invoiceDate,
     dueDate,
@@ -661,7 +698,7 @@ async function buildInvoicePdfBuffer( invoiceId ) {
         storeName: '$stores.storeName',
         edgefirstFileDate: '$stores.edgefirstFileDate',
         workingdays: '$stores.products.workingdays',
-        currencyType: { $literal: symbolFor( clientDetails?.paymentInvoice?.currencyType ) },
+        currencyType: { $literal: invoiceCurrency },
       } },
       { $sort: { productName: 1, workingdays: -1 } },
       { $match: { workingdays: { $gt: 0 } } },
@@ -816,8 +853,10 @@ export async function invoiceAnnexure( req, res ) {
       return res.sendSuccess( { data: [] } );
     }
 
-    const clientDetails = await clientService.findOne( { clientId: invoiceInfo.clientId } );
     const currentMonthDays = dayjs().daysInMonth();
+    // Annexure must show the same currency as the invoice it accompanies —
+    // see invoiceDownload / buildInvoicePdfBuffer for the same pattern.
+    const invoiceCurrency = symbolFor( invoiceInfo.currency );
 
     const annexureData = await dailyPricingService.aggregate( [
       { $match: { clientId: invoiceInfo.clientId } },
@@ -832,7 +871,7 @@ export async function invoiceAnnexure( req, res ) {
         storeName: '$stores.storeName',
         edgefirstFileDate: '$stores.edgefirstFileDate',
         workingdays: '$stores.products.workingdays',
-        currencyType: { $literal: symbolFor( clientDetails?.paymentInvoice?.currencyType ) },
+        currencyType: { $literal: invoiceCurrency },
       } },
       { $sort: { productName: 1, workingdays: -1 } },
       { $match: { workingdays: { $gt: 0 } } },
@@ -2098,6 +2137,13 @@ export async function updateInvoice( req, res ) {
       return res.sendError( 'Invoice not found', 404 );
     }
 
+    // Lock once final-approved. The UI hides the Edit icon for these rows,
+    // but a direct API call would otherwise still let someone mutate a
+    // finalised invoice. Match the frontend's isInvoiceLocked() check.
+    if ( invoice.status === 'approved' ) {
+      return res.sendError( 'Cannot edit a final-approved invoice.', 409 );
+    }
+
     let updateData = {};
     const allowedFields = [
       'companyName', 'companyAddress', 'GSTNumber', 'PlaceOfSupply',
@@ -2208,6 +2254,12 @@ export async function deleteInvoice( req, res ) {
       return res.sendError( 'Invoice not found', 404 );
     }
 
+    // Same lock the UI enforces — a final-approved invoice must not be
+    // deletable, even by a power user hitting the API directly.
+    if ( invoice.status === 'approved' ) {
+      return res.sendError( 'Cannot delete a final-approved invoice.', 409 );
+    }
+
     await invoiceService.deleteRecord( { _id: invoiceId } );
 
     const logObj = {

package/src/controllers/paymentSubscription.controllers.js

@@ -3772,7 +3772,15 @@ export const invoiceGenerate = async ( req, res ) => {
           }
 
 
-          let previousinvoice = await invoiceService.findandsort( {}, {}, { _id: -1 } );
+          // Scope the highest-index lookup to the current financial year
+          // (invoice IDs are `INV-${FY}-${index}`). Sort by invoiceIndex (not
+          // _id) so the largest sequence number wins even if records were
+          // back-dated or imported out of order.
+          let previousinvoice = await invoiceService.findandsort(
+              { invoice: { $regex: `^INV-${Finacialyear}-` } },
+              {},
+              { invoiceIndex: -1 },
+          );
           let invoiceNo = '00001';
           if ( previousinvoice && previousinvoice.length > 0 ) {
             invoiceNo = Number( previousinvoice[0].invoiceIndex ) + 1;

package/src/hbs/invoicePdf.hbs

@@ -1643,7 +1643,7 @@
                     </div>
                     <div class="frame-54">
                         <div class="ifsc-code">IFSC Code</div>
-                        <div class="hdfc-0000269">HDFC0000269</div>
+                        <div class="hdfc-0000269">HDFC0000386</div>
                     </div>
                     <div class="frame-532">
                         <div class="payment-type">Payment Type</div>

package/src/routes/brandsBilling.routes.js

@@ -1,21 +1,8 @@
 
 import express from 'express';
-import multer from 'multer';
 import { brandsBillingList, brandInvoiceList, latestDailyPricing, brandBillingGroups, updateDailyPricingWorkingDays, updateDailyPricingStoreField, getClientBillingInfo, bulkDownloadBillingGroups, bulkUpdateBillingGroups } from '../controllers/brandsBilling.controller.js';
 import { isAllowedSessionHandler, accessVerification } from 'tango-app-api-middleware';
 
-const bulkUpload = multer( {
-  storage: multer.memoryStorage(),
-  limits: { fileSize: 5 * 1024 * 1024 },
-  fileFilter: ( _req, file, cb ) => {
-    const ok = [
-      'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-      'application/vnd.ms-excel',
-      'application/octet-stream',
-    ].includes( file.mimetype );
-    cb( ok ? null : new Error( 'Invalid file format — use XLSX' ), ok );
-  },
-} );
 export const brandsBillingRouter = express.Router();
 
 brandsBillingRouter.post( '/brandsBillingList', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), brandsBillingList );
@@ -26,4 +13,4 @@ brandsBillingRouter.put( '/updateDailyPricingWorkingDays', isAllowedSessionHandl
 brandsBillingRouter.put( '/updateDailyPricingStoreField', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), updateDailyPricingStoreField );
 brandsBillingRouter.post( '/getClientBillingInfo', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), getClientBillingInfo );
 brandsBillingRouter.get( '/bulk-download-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), bulkDownloadBillingGroups );
-brandsBillingRouter.post( '/bulk-update-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), bulkUpload.single( 'file' ), bulkUpdateBillingGroups );
+brandsBillingRouter.post( '/bulk-update-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), bulkUpdateBillingGroups );