tango-app-api-payment-subscription 3.5.21 → 3.5.23

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tango-app-api-payment-subscription",
-    "version": "3.5.21",
+    "version": "3.5.23",
     "description": "paymentSubscription",
     "main": "index.js",
     "type": "module",
@@ -20,12 +20,12 @@
         "dotenv": "^16.4.5",
         "exceljs": "^4.4.0",
         "express": "^4.18.3",
+        "express-fileupload": "^1.5.2",
         "handlebars": "^4.7.8",
         "html-pdf-node": "^1.0.8",
         "joi-to-swagger": "^6.2.0",
         "jsdom": "^24.0.0",
         "mongodb": "^6.4.0",
-        "multer": "^1.4.5-lts.1",
         "nodemon": "^3.1.0",
         "puppeteer": "^24.41.0",
         "swagger-ui-express": "^5.0.0",

package/src/controllers/brandsBilling.controller.js

@@ -8,7 +8,7 @@ import * as basePriceService from '../services/basePrice.service.js';
 import * as cameraService from '../services/camera.service.js';
 import * as planogramService from '../services/planogram.service.js';
 import dayjs from 'dayjs';
-import { logger, checkFileExist, signedUrl, download, insertOpenSearchData, getOpenSearchData } from 'tango-app-api-middleware';
+import { logger, checkFileExist, signedUrl, download, insertOpenSearchData, getOpenSearchData, searchOpenSearchData, scrollResponse, clearScroll } from 'tango-app-api-middleware';
 import * as XLSX from 'xlsx';
 import ExcelJS from 'exceljs';
 import { bulkUpdateBillingGroupRowSchema } from '../dtos/validation.dtos.js';
@@ -1944,7 +1944,11 @@ export async function billingSummary( req, res ) {
           csm: [ ...( csmByClient.get( key ) || [] ) ].join( ', ' ),
           revenueMonths: {},
           billedStoresMonths: {},
-          installationFee: 0,
+          // Installation fee per month (keyed YYYY-MM). The summary surfaces
+          // ONLY the current month's value — see installationOut below — so the
+          // column stays hidden until the current-month invoice is generated
+          // with an installation fee.
+          installationMonths: {},
           invDollar: 0,
           invInr: 0,
         } );
@@ -1956,7 +1960,8 @@ export async function billingSummary( req, res ) {
       const r = rowOf( inv._id.c );
       r.revenueMonths[inv._id.ym] = Math.round( ( ( inv.revenueInr || 0 ) + ( inv.revenueUsd || 0 ) * usdRate ) * 100 ) / 100;
       r.billedStoresMonths[inv._id.ym] = inv.stores || 0;
-      r.installationFee += ( inv.installationInr || 0 ) + ( inv.installationUsd || 0 ) * usdRate;
+      r.installationMonths[inv._id.ym] = ( r.installationMonths[inv._id.ym] || 0 ) +
+        ( inv.installationInr || 0 ) + ( inv.installationUsd || 0 ) * usdRate;
       r.invDollar += ( inv.dollarInvoices || 0 );
       r.invInr += ( inv.inrInvoices || 0 );
       if ( inv.companyName ) {
@@ -2074,7 +2079,11 @@ export async function billingSummary( req, res ) {
       // in native USD for dollar clients.
       revCur = revCur == null ? null : Math.round( revCur );
       const revPrevOut = revPrev == null ? null : Math.round( revPrev );
-      const installationOut = r.installationFee ? Math.round( r.installationFee ) : null;
+      // Show the installation fee ONLY for the current month, and only once
+      // that month's invoice (which carries the installationFee line) exists.
+      // Until then it's null so the UI hides the whole column.
+      const curInstallation = r.installationMonths[curKey] || 0;
+      const installationOut = curInstallation ? Math.round( curInstallation ) : null;
       // Registered Entity from the billings collection (distinct group names).
       // First name shown in the column; the full list is sent so the UI can
       // reveal the others on hover. Fall back to the invoice company name when
@@ -2176,6 +2185,11 @@ const ADDITIONAL_PRODUCT_PRICES = {
   planogram: 770,
   aiManager: 500,
 };
+// Product Lambda Function URLs (VMS / Run AI). Each returns the list of billable
+// store IDs for a client; used both for the detailed export and for the invoice
+// additional-products quantity (scoped to a billing group's stores).
+const RUN_AI_LAMBDA_URL = 'https://mdm3mf7wuficgv3jjspkws2nu40azlsc.lambda-url.ap-south-1.on.aws/';
+const VMS_LAMBDA_URL = 'https://ppf3l3mxc2lorh5hkrsj6zwyim0bupxw.lambda-url.ap-south-1.on.aws/';
 // OpenSearch index holding extra billed products (VMS, Run AI, etc.). Each
 // record is a daily snapshot carrying its own quantity + price per product.
 const BILLING_DETAILS_INDEX = ( () => {
@@ -2190,12 +2204,37 @@ const BILLING_DETAILS_INDEX = ( () => {
 // that has none (currently only clientId 11). Shared by the Billing Breakdown
 // table (additionalProducts controller) AND invoice generation, so both stay in
 // sync. Each entry: { productName, quantity, price, total }.
-export async function getAdditionalProducts( clientId ) {
+//
+// storeIds (optional): when a non-empty array is passed, the Eyetest / Planogram
+// / AI Manager quantities are restricted to those stores only — used by invoice
+// generation so a billing group is billed for its assigned stores, not the whole
+// brand. When omitted (e.g. the brand-wide Billing Breakdown endpoint) the counts
+// stay client-wide.
+//
+// Run AI / VMS are sourced by caller: invoice generation (storeIds passed) uses
+// the product Lambdas (called brand-wide, then intersected with the group's
+// stores locally); the brand-wide Billing Breakdown (no storeIds) uses the
+// billing_details snapshot instead.
+//
+// Remote Optum is store-scoped for invoices too: its quantity becomes the count
+// of remote_optom_steps_summary records for the group over the latest inserted
+// month in that index (see remoteOptumRecordCount). Factory is dropped from
+// invoices entirely. The brand-wide Billing Breakdown keeps taking Remote Optum /
+// Factory from the billing_details snapshot as-is.
+export async function getAdditionalProducts( clientId, storeIds ) {
   clientId = String( clientId ?? '' );
   if ( clientId !== ADDITIONAL_PRODUCTS_CLIENT_ID ) {
     return [];
   }
 
+  // Restrict the Mongo aggregations to the billing group's stores when provided.
+  // group.stores holds storeIds, matched via $in against each collection's
+  // storeId field (top-level for cameras/planograms, stores.storeId once
+  // unwound for daily-pricing).
+  const scopeStores = Array.isArray( storeIds ) && storeIds.length;
+  const storeMatch = scopeStores ? { storeId: { $in: storeIds } } : {};
+  const unwoundStoreMatch = scopeStores ? { 'stores.storeId': { $in: storeIds } } : {};
+
   // Eyetest: distinct stores in the cameras collection that have an eye-test
   // stream with a QR code.
   const eyetestRows = await cameraService.aggregate( [
@@ -2203,6 +2242,7 @@ export async function getAdditionalProducts( clientId ) {
       { clientId: clientId },
       { isEyeTestStream: true },
       { qrCode: { $exists: true } },
+      storeMatch,
     ] } },
     { $group: { _id: '$storeId' } },
     { $count: 'stores' },
@@ -2211,7 +2251,7 @@ export async function getAdditionalProducts( clientId ) {
 
   // Planogram: distinct storeName in the planograms collection.
   const planogramRows = await planogramService.aggregate( [
-    { $match: { clientId: clientId } },
+    { $match: { clientId: clientId, ...storeMatch } },
     { $group: { _id: null, storecount: { $addToSet: '$storeName' } } },
     { $project: { count: { $size: '$storecount' } } },
   ] );
@@ -2225,6 +2265,7 @@ export async function getAdditionalProducts( clientId ) {
     { $sort: { dateISO: -1 } },
     { $limit: 1 },
     { $unwind: '$stores' },
+    ...( scopeStores ? [ { $match: unwoundStoreMatch } ] : [] ),
     { $unwind: '$stores.products' },
     { $match: { 'stores.products.productName': 'tangoTraffic', 'stores.products.workingdays': { $gt: 1 } } },
     { $group: { _id: '$stores.storeId' } },
@@ -2245,10 +2286,45 @@ export async function getAdditionalProducts( clientId ) {
     build( 'AI Manager', aiManagerQty, ADDITIONAL_PRODUCT_PRICES.aiManager ),
   ];
 
+  // Run AI and VMS quantities come from two different sources depending on the
+  // caller:
+  //   - Invoice generation (storeIds passed): use the product Lambdas. The
+  //     Lambda's own store_ids filter is unreliable, so lambdaStoreCount calls it
+  //     brand-wide and intersects the returned store list with the group's stores
+  //     locally — giving a per-group scoped count. Unit price from billing_details.
+  //   - Brand-wide Billing Breakdown (no storeIds): use the billing_details
+  //     OpenSearch snapshot instead (handled by the loop below), same as Remote
+  //     Optum / Factory.
+  // lambdaSourced marks which productNames the loop below must skip so they are
+  // not counted twice — only populated in the invoice (scoped) case.
+  const lambdaSourced = new Set();
+  if ( scopeStores ) {
+    const [ runAiQty, vmsQty, runAiPrice, vmsPrice, optumQty, optumPrice ] = await Promise.all( [
+      lambdaStoreCount( clientId, RUN_AI_LAMBDA_URL, storeIds ),
+      lambdaStoreCount( clientId, VMS_LAMBDA_URL, storeIds ),
+      billingDetailsPrice( clientId, 'Run AI' ),
+      billingDetailsPrice( clientId, 'VMS' ),
+      remoteOptumRecordCount( clientId, storeIds ),
+      billingDetailsPrice( clientId, 'Remote Optum' ),
+    ] );
+    products.push( build( 'Run AI', runAiQty, runAiPrice ) );
+    products.push( build( 'VMS', vmsQty, vmsPrice ) );
+    products.push( build( 'Remote Optum', optumQty, optumPrice ) );
+    // Skipped in the billing_details loop below so they are not counted twice.
+    lambdaSourced.add( 'run ai' );
+    lambdaSourced.add( 'vms' );
+    lambdaSourced.add( 'remote optum' );
+  }
+
   // Extra products from the billing_details OpenSearch index — the LATEST daily
   // snapshot for this client. quantity/price are stored as strings, so coerce
-  // them. If OpenSearch is unreachable we just skip these rows rather than
-  // failing the whole list.
+  // them. In the invoice (scoped) case VMS / Run AI / Remote Optum are skipped
+  // here (already added store-scoped above) to avoid double-counting; in the
+  // brand-wide case they are taken from this snapshot like the other extra
+  // products. If OpenSearch is unreachable we just skip these rows rather than
+  // failing the whole list. Factory is excluded from invoices (scoped) but still
+  // shown in the brand-wide Billing Breakdown table.
+  const invoiceExcluded = scopeStores ? new Set( [ 'factory' ] ) : new Set();
   try {
     const osRes = await getOpenSearchData( BILLING_DETAILS_INDEX, {
       size: 1,
@@ -2258,6 +2334,10 @@ export async function getAdditionalProducts( clientId ) {
     const hits = osRes?.body?.hits?.hits || osRes?.hits?.hits || [];
     const osProducts = hits[0]?._source?.products || [];
     for ( const p of osProducts ) {
+      const nameKey = String( p.productName ).toLowerCase();
+      if ( lambdaSourced.has( nameKey ) || invoiceExcluded.has( nameKey ) ) {
+        continue;
+      }
       const quantity = Number( p.quantity ) || 0;
       const price = Number( p.price ) || 0;
       products.push( build( p.productName, quantity, price ) );
@@ -2272,8 +2352,13 @@ export async function getAdditionalProducts( clientId ) {
 export async function additionalProducts( req, res ) {
   try {
     const clientId = String( req.query?.clientId ?? req.body?.clientId ?? '' );
-    const products = await getAdditionalProducts( clientId );
-    return res.sendSuccess( { currency: 'inr', products } );
+    const [ products, billingDate ] = await Promise.all( [
+      getAdditionalProducts( clientId ),
+      billingDetailsDate( clientId ),
+    ] );
+    // billingDate (YYYY-MM-DD) is the billing_details snapshot behind the counts;
+    // the UI passes it back to the export endpoint so exports match the cards.
+    return res.sendSuccess( { currency: 'inr', products, billingDate } );
   } catch ( error ) {
     logger.error( { error: error, function: 'additionalProducts' } );
     return res.sendError( error, 500 );
@@ -2300,6 +2385,35 @@ async function lamdaServiceCall( url, data ) {
   }
 }
 
+// Date (YYYY-MM-DD) of the latest billing_details OpenSearch snapshot for a
+// client — the snapshot whose product counts back the Additional Products cards.
+// The UI passes this back to the export endpoint so the export reflects the same
+// day as the card. Returns '' if unavailable; date_string is normalised to
+// YYYY-MM-DD (it may be stored as DD-MM-YYYY).
+async function billingDetailsDate( clientId ) {
+  try {
+    const osRes = await getOpenSearchData( BILLING_DETAILS_INDEX, {
+      size: 1,
+      query: { term: { 'client_id': clientId } },
+      sort: [ { date_string: { order: 'desc' } } ],
+    } );
+    const hits = osRes?.body?.hits?.hits || osRes?.hits?.hits || [];
+    const raw = String( hits[0]?._source?.date_string || '' ).trim();
+    if ( !raw ) {
+      return '';
+    }
+    // Accept DD-MM-YYYY or YYYY-MM-DD; return YYYY-MM-DD.
+    const ddmmyyyy = raw.match( /^(\d{2})-(\d{2})-(\d{4})$/ );
+    if ( ddmmyyyy ) {
+      return `${ddmmyyyy[3]}-${ddmmyyyy[2]}-${ddmmyyyy[1]}`;
+    }
+    return raw;
+  } catch ( osErr ) {
+    logger.error( { error: osErr, function: 'billingDetailsDate', clientId } );
+    return '';
+  }
+}
+
 // Unit price for a product from the latest billing_details OpenSearch record.
 // productName match is case-insensitive. Returns 0 if not found / unavailable.
 async function billingDetailsPrice( clientId, productName ) {
@@ -2319,13 +2433,82 @@ async function billingDetailsPrice( clientId, productName ) {
   }
 }
 
+// Date (YYYY-MM-DD) of the most recent record in the remote_optom_steps_summary
+// index — the latest day audit data was inserted. Date is a keyword so it sorts
+// lexically. Returns '' if the index is empty / unreachable.
+async function remoteOptumLatestDate() {
+  try {
+    const osRes = await getOpenSearchData( 'remote_optom_steps_summary', {
+      size: 1,
+      _source: [ 'Date' ],
+      sort: [ { 'Date': { order: 'desc' } } ],
+    } );
+    const hits = osRes?.body?.hits?.hits || osRes?.hits?.hits || [];
+    return String( hits[0]?._source?.Date || '' ).trim();
+  } catch ( osErr ) {
+    logger.error( { error: osErr, function: 'remoteOptumLatestDate' } );
+    return '';
+  }
+}
+
+// Remote Optum billed quantity for a billing group = number of audit records in
+// the remote_optom_steps_summary index that belong to the group's stores, over
+// the range [to_date's month-start .. to_date], where to_date is the latest
+// record date in the index (e.g. to_date 2026-06-30 → from_date 2026-06-01). That
+// index keys by store NAME (no storeId), so group.stores (storeIds) are first
+// mapped to names via the stores collection, then matched with a terms filter on
+// storeName.keyword. Date is a keyword (YYYY-MM-DD per record), so the range is
+// lexical. size:0 + track_total_hits gives the exact count without paging past
+// the 10k window. Returns 0 on any failure or when the group has no matching
+// store names / the index is empty.
+async function remoteOptumRecordCount( clientId, storeIds ) {
+  try {
+    if ( !Array.isArray( storeIds ) || !storeIds.length ) {
+      return 0;
+    }
+    const toDate = await remoteOptumLatestDate();
+    if ( !toDate ) {
+      return 0;
+    }
+    const fromDate = dayjs( toDate ).startOf( 'month' ).format( 'YYYY-MM-DD' );
+    const stores = await storeService.find(
+        { clientId: clientId, storeId: { $in: storeIds } },
+        { storeName: 1 },
+    );
+    const storeNames = [ ...new Set(
+        stores.map( ( s ) => String( s.storeName || '' ).trim() ).filter( Boolean ),
+    ) ];
+    if ( !storeNames.length ) {
+      return 0;
+    }
+    const osRes = await getOpenSearchData( 'remote_optom_steps_summary', {
+      size: 0,
+      track_total_hits: true,
+      query: { bool: { filter: [
+        { range: { 'Date': { gte: fromDate, lte: toDate } } },
+        { terms: { 'storeName.keyword': storeNames } },
+      ] } },
+    } );
+    const total = osRes?.body?.hits?.total?.value ?? osRes?.hits?.total?.value ?? 0;
+    return Number( total ) || 0;
+  } catch ( osErr ) {
+    logger.error( { error: osErr, function: 'remoteOptumRecordCount', clientId } );
+    return 0;
+  }
+}
+
 // Build the Lambda-backed export rows (VMS / Run AI / etc.). Calls the product's
 // Lambda for store_names (storeIds), maps them to the stores collection for
 // name + country (Zone), with current-month days and the billing_details price.
-async function lambdaStoreExport( clientId, lambdaUrl, billingProductName ) {
-  const toDate = dayjs().format( 'DD-MM-YYYY' );
+// reqDate (YYYY-MM-DD, optional) is the billing_details snapshot date the UI
+// picked so the export matches the card count; it is sent to the Lambda as
+// to_date (DD-MM-YYYY). Defaults to today when absent.
+async function lambdaStoreExport( clientId, lambdaUrl, billingProductName, reqDate ) {
+  // reqDate is ISO YYYY-MM-DD, which dayjs parses natively; reformat to the
+  // Lambda's DD-MM-YYYY. Fall back to today when absent / unparseable.
+  const parsed = reqDate ? dayjs( reqDate ) : null;
+  const toDate = parsed && parsed.isValid() ? parsed.format( 'DD-MM-YYYY' ) : dayjs().format( 'DD-MM-YYYY' );
   const lambdaResult = await lamdaServiceCall( lambdaUrl, { to_date: toDate, client_id: clientId } );
-  console.log( '🚀 ~ lambdaStoreExport ~ lambdaResult:', lambdaResult );
   // These Lambdas return the storeIds under either `store_ids` (Run AI) or
   // `store_names` (VMS) with no status_code. Accept whichever is present; data
   // availability = a non-empty array.
@@ -2353,6 +2536,33 @@ async function lambdaStoreExport( clientId, lambdaUrl, billingProductName ) {
   } );
 }
 
+// Count the billable stores a product Lambda (VMS / Run AI) reports, optionally
+// scoped to a billing group's stores. The Lambda's own store_ids request filter
+// is unreliable — passing store_ids returns 0 even for IDs it itself reports as
+// billable — so we always call it BRAND-WIDE (client only) to get the true store
+// list, then intersect that list with the group's stores locally. Both sides use
+// the same `clientId-n` storeId format (e.g. `11-2911`), matching how the Mongo
+// aggregations scope by group.stores. Returns 0 on any failure (Lambda
+// unreachable / empty), so the caller just omits the line rather than failing the
+// whole invoice.
+async function lambdaStoreCount( clientId, lambdaUrl, storeIds ) {
+  const toDate = dayjs().format( 'DD-MM-YYYY' );
+  const lambdaResult = await lamdaServiceCall( lambdaUrl, { to_date: toDate, client_id: clientId } );
+  // The Lambdas return the storeIds under either `store_ids` (Run AI) or
+  // `store_names` (VMS); accept whichever is present.
+  const rawIds = ( lambdaResult && Array.isArray( lambdaResult.store_ids ) ) ? lambdaResult.store_ids :
+    ( ( lambdaResult && Array.isArray( lambdaResult.store_names ) ) ? lambdaResult.store_names : [] );
+  const ids = rawIds.map( ( s ) => String( s ) );
+  // Scope to the billing group's stores when provided; otherwise (brand-wide
+  // Billing Breakdown) count every store the Lambda reports.
+  const scope = Array.isArray( storeIds ) && storeIds.length ? storeIds.map( ( s ) => String( s ) ) : null;
+  if ( scope ) {
+    const allowed = new Set( scope );
+    return ids.filter( ( id ) => allowed.has( id ) ).length;
+  }
+  return ids.length;
+}
+
 // tangoTraffic working days per store, from the latest daily-pricing doc.
 // Map<storeId, workingdays>; stores with no tangoTraffic record are absent.
 async function tangoTrafficDaysByStore( clientId ) {
@@ -2522,8 +2732,9 @@ export async function additionalProductExport( req, res ) {
     if ( product === 'vms' ) {
       const exportData = await lambdaStoreExport(
           clientId,
-          'https://ppf3l3mxc2lorh5hkrsj6zwyim0bupxw.lambda-url.ap-south-1.on.aws/',
+          VMS_LAMBDA_URL,
           'VMS',
+          reqDate,
       );
       if ( !exportData.length ) {
         return res.sendError( 'No data', 204 );
@@ -2535,10 +2746,10 @@ export async function additionalProductExport( req, res ) {
     if ( product === 'runai' ) {
       const exportData = await lambdaStoreExport(
           clientId,
-          'https://mdm3mf7wuficgv3jjspkws2nu40azlsc.lambda-url.ap-south-1.on.aws/',
+          RUN_AI_LAMBDA_URL,
           'Run AI',
+          reqDate,
       );
-      console.log( '🚀 ~ additionalProductExport ~ exportData:', exportData );
       if ( !exportData.length ) {
         return res.sendError( 'No data', 204 );
       }
@@ -2547,29 +2758,54 @@ export async function additionalProductExport( req, res ) {
     }
 
     if ( product === 'remoteoptum' ) {
-      // Detailed optom-audit export from the remote_optom_steps_summary index
-      // for the given date (passed from the UI, defaults to today). Each record
-      // is one row; the nested `steps` object is flattened into TRUE/FALSE
-      // columns in a fixed (alphabetical) order.
+      // Detailed optom-audit export from the remote_optom_steps_summary index.
+      // to_date is the date from the payload (reqDate); from_date is the first
+      // day of that date's month — so the export covers month-start through the
+      // requested date. Each record is one row; the nested `steps` object is
+      // flattened into TRUE/FALSE columns in a fixed (alphabetical) order.
       const STEP_COLUMNS = [
         'Adjust-Phoropter', 'DuoChrome-Test', 'Explanation', 'Final-Prescription',
         'Handover', 'History-Taking', 'JCC', 'Near-Vision', 'Personal-Intro',
         'Subjective-Refraction', 'Trial-Frame', 'VA-Check',
       ];
+      const fromDate = dayjs( reqDate ).startOf( 'month' ).format( 'YYYY-MM-DD' );
       let optomHits = [];
+      let scrollId = null;
       try {
-        const osRes = await getOpenSearchData( 'remote_optom_steps_summary', {
-          // A single day is well under the 10k window; pull up to the cap.
-          // NOTE: do NOT sort on StartTime — it's an analyzed text field, and
-          // sorting on it makes OpenSearch return ZERO hits. The day filter is
-          // enough; rows come back in index order.
+        // A month-to-date span can exceed the 10k max_result_window, so scroll
+        // through all pages. Date is a keyword (YYYY-MM-DD) → the span is a lexical
+        // range. NOTE: do NOT sort on StartTime — it's an analyzed text field, and
+        // sorting on it makes OpenSearch return ZERO hits. The range filter is
+        // enough; rows come back in index order.
+        let osRes = await searchOpenSearchData( 'remote_optom_steps_summary', {
           size: 10000,
-          query: { term: { 'Date': reqDate } },
+          query: { range: { 'Date': { gte: fromDate, lte: reqDate } } },
         } );
-        optomHits = osRes?.body?.hits?.hits || osRes?.hits?.hits || [];
+        let body = osRes?.body || osRes;
+        let hits = body?.hits?.hits || [];
+        scrollId = body?._scroll_id;
+        while ( hits.length ) {
+          optomHits.push( ...hits );
+          if ( !scrollId ) {
+            break;
+          }
+          osRes = await scrollResponse( scrollId );
+          body = osRes?.body || osRes;
+          hits = body?.hits?.hits || [];
+          scrollId = body?._scroll_id || scrollId;
+        }
       } catch ( osErr ) {
         logger.error( { error: osErr, function: 'additionalProductExport.remoteOptum', clientId } );
         return res.sendError( 'Failed to fetch Remote Optum data', 502 );
+      } finally {
+        // Free the scroll context; ignore failures (context may already be gone).
+        if ( scrollId ) {
+          try {
+            await clearScroll( scrollId );
+          } catch ( clearErr ) {
+            logger.error( { error: clearErr, function: 'additionalProductExport.remoteOptum.clearScroll' } );
+          }
+        }
       }
 
       const exportData = optomHits.map( ( h ) => {

package/src/controllers/estimate.controller.js

@@ -7,7 +7,7 @@ import Handlebars from '../utils/validations/helper/handlebar.helper.js';
 import fs from 'fs';
 import path from 'path';
 import htmlpdf from 'html-pdf-node';
-import { symbolFor } from '../utils/currency.js';
+import { symbolFor, roundAmount } from '../utils/currency.js';
 import { getInvoiceCcEmails } from './invoice.controller.js';
 
 // Build the estimate PDF buffer + the template data + a safe filename. Shared
@@ -45,7 +45,9 @@ async function buildEstimatePdf( estimate ) {
     companyAddress: e.companyAddress || '',
     GSTNumber: e.GSTNumber || '',
     PlaceOfSupply: e.PlaceOfSupply || '',
-    groupName: e.groupName || '',
+    // "Default Group" is the placeholder used when no real billing group was
+    // chosen — don't surface it on the estimate (the template hides empty).
+    groupName: ( e.groupName && e.groupName !== 'Default Group' ) ? e.groupName : '',
     period: e.period || '',
     createdDate: e.createdDate ? dayjs( e.createdDate ).format( 'DD/MM/YYYY' ) : '',
     validTill: e.validTill ? dayjs( e.validTill ).format( 'DD/MM/YYYY' ) : '',
@@ -211,11 +213,13 @@ export async function createEstimate( req, res ) {
         { 'clientName': 1, 'paymentInvoice.currencyType': 1 },
     );
 
-    const amount = Math.round( Number( b.amount ) || 0 );
-    let totalAmount = Math.round( Number( b.totalAmount ) || 0 );
+    // INR rounds to whole; other currencies keep 2 decimals.
+    const estimateCurrency = b.currency || ( client?.paymentInvoice?.currencyType === 'dollar' ? 'dollar' : 'inr' );
+    const amount = roundAmount( Number( b.amount ) || 0, estimateCurrency );
+    let totalAmount = roundAmount( Number( b.totalAmount ) || 0, estimateCurrency );
     if ( !totalAmount && amount ) {
       // Default to 18% GST when caller sends only the pre-tax amount.
-      totalAmount = Math.round( amount * 1.18 );
+      totalAmount = roundAmount( amount * 1.18, estimateCurrency );
     }
 
     const { estimate, estimateIndex } = await nextEstimateNumber();
@@ -239,7 +243,7 @@ export async function createEstimate( req, res ) {
       tax: Array.isArray( b.tax ) ? b.tax : [],
       amount,
       totalAmount,
-      currency: b.currency || ( client?.paymentInvoice?.currencyType === 'dollar' ? 'dollar' : 'inr' ),
+      currency: estimateCurrency,
       status: b.status === 'sent' ? 'sent' : 'pending',
       createdDate,
       validTill,
@@ -273,10 +277,12 @@ export async function updateEstimate( req, res ) {
       return res.sendError( 'An accepted estimate cannot be edited.', 409 );
     }
 
-    const amount = Math.round( Number( b.amount ) || 0 );
-    let totalAmount = Math.round( Number( b.totalAmount ) || 0 );
+    // INR rounds to whole; other currencies keep 2 decimals.
+    const estimateCurrency = b.currency || existing.currency;
+    const amount = roundAmount( Number( b.amount ) || 0, estimateCurrency );
+    let totalAmount = roundAmount( Number( b.totalAmount ) || 0, estimateCurrency );
     if ( !totalAmount && amount ) {
-      totalAmount = Math.round( amount * 1.18 );
+      totalAmount = roundAmount( amount * 1.18, estimateCurrency );
     }
 
     // Only the editable fields are updated. The estimate number, index,
@@ -294,7 +300,7 @@ export async function updateEstimate( req, res ) {
       tax: Array.isArray( b.tax ) ? b.tax : existing.tax,
       amount,
       totalAmount,
-      currency: b.currency || existing.currency,
+      currency: estimateCurrency,
       notes: b.notes ?? existing.notes,
       updatedBy: req.user?.email || req.user?.userName || '',
     };

package/src/controllers/invoice.controller.js

@@ -312,8 +312,17 @@ export async function createInvoice( req, res ) {
       // Skip when reusing advance-invoice line items — those already include any
       // additional products from when the advance invoice was generated.
       if ( !advanceCoverProducts ) {
-        const extraProducts = await getAdditionalProducts( group.clientId );
+        // Scope additional-product quantities to this billing group's assigned
+        // stores (group.stores). Without this the counts span the whole brand
+        // and every group's invoice would be billed for all stores.
+        const extraProducts = await getAdditionalProducts( group.clientId, group.stores );
         for ( const ep of extraProducts ) {
+          // Skip additional products with no billable quantity — an Eyetest /
+          // Planogram / AI Manager / VMS line that resolved to 0 stores for this
+          // billing group should not appear as a ₹0 row on the invoice.
+          if ( ( Number( ep.quantity ) || 0 ) <= 0 ) {
+            continue;
+          }
           products.push( {
             productName: ep.productName,
             period: 'fullmonth',
@@ -805,7 +814,7 @@ export async function invoiceDownload( req, res ) {
       let invoiceDate = dayjs( invoiceInfo.billingDate ).format( 'DD/MM/YYYY' );
 
       invoiceInfo.totalAmount = roundAmount( invoiceInfo.totalAmount, invoiceInfo.currency );
-      let AmountinWords = inWords( invoiceInfo.totalAmount );
+      let AmountinWords = amountToWords( invoiceInfo.totalAmount, invoiceInfo.currency );
       let getgroup;
       let days = getgroup?.paymentTerm ? getgroup?.paymentTerm : '30';
       let dueDate = invoiceInfo?.dueDate ? dayjs( invoiceInfo?.dueDate ).format( 'DD/MM/YYYY' ) : dayjs().add( days, 'days' ).format( 'DD/MM/YYYY' );
@@ -1006,7 +1015,7 @@ async function buildInvoicePdfBuffer( invoiceId ) {
 
   let invoiceDate = dayjs( invoiceInfo.billingDate ).format( 'DD/MM/YYYY' );
   invoiceInfo.totalAmount = roundAmount( invoiceInfo.totalAmount, invoiceInfo.currency );
-  let AmountinWords = inWords( invoiceInfo.totalAmount );
+  let AmountinWords = amountToWords( invoiceInfo.totalAmount, invoiceInfo.currency );
   let getgroup;
   if ( invoiceInfo.groupId ) {
     getgroup = await billingService.findOne( { _id: invoiceInfo.groupId } );
@@ -1218,6 +1227,32 @@ function inWords( num ) {
   return str.toLowerCase().split( ' ' ).map( ( word ) => word.charAt( 0 ).toUpperCase() + word.slice( 1 ) ).join( ' ' );
 }
 
+// Sub-unit (fraction) name per currency for the "Total In Words" cents part.
+// INR is whole-number only, so it has no fraction.
+const CURRENCY_FRACTION_WORDS = {
+  dollar: 'Cents',
+  singaporedollar: 'Cents',
+  euro: 'Cents',
+  aed: 'Fils',
+};
+
+// Spell out an amount. INR -> whole number only. Other currencies keep 2
+// decimals, so the cents are spelled out too when non-zero
+// (e.g. 3191.10 -> "Three Thousand One Hundred And Ninety One and Ten Cents").
+function amountToWords( value, currency ) {
+  const n = Number( value ) || 0;
+  if ( currency === 'inr' ) {
+    return inWords( Math.round( n ) );
+  }
+  const whole = Math.trunc( n );
+  const cents = Math.round( ( n - whole ) * 100 );
+  const fraction = CURRENCY_FRACTION_WORDS[currency] || 'Cents';
+  if ( cents > 0 ) {
+    return `${inWords( whole )} and ${inWords( cents )} ${fraction}`;
+  }
+  return inWords( whole );
+}
+
 
 // Resolve which basepricing doc applies to a billing group. When the client
 // has billingGroupWisePricing enabled AND a doc exists for this group, returns

package/src/controllers/paymentSubscription.controllers.js

@@ -3125,7 +3125,7 @@ export const invoiceDownload = async ( req, res ) => {
       let dueDate = invoiceInfo?.dueDate ? dayjs( invoiceInfo?.dueDate ).format( 'DD/MM/YYYY' ) : dayjs().add( days, 'days' ).format( 'DD/MM/YYYY' );
 
       invoiceInfo.totalAmount = invoiceInfo.totalAmount;
-      let AmountinWords = inWords( invoiceInfo.totalAmount );
+      let AmountinWords = amountToWords( invoiceInfo.totalAmount, invoicePdfCurrency );
       invoiceData = {
         ...invoiceInfo._doc,
         clientName: clientDetails.clientName,
@@ -3254,6 +3254,31 @@ function inWords( num ) {
   return str.toLowerCase().split( ' ' ).map( ( word ) => word.charAt( 0 ).toUpperCase() + word.slice( 1 ) ).join( ' ' );
 }
 
+// Sub-unit (fraction) name per currency for the "Total In Words" cents part.
+const CURRENCY_FRACTION_WORDS = {
+  dollar: 'Cents',
+  singaporedollar: 'Cents',
+  euro: 'Cents',
+  aed: 'Fils',
+};
+
+// Spell out an amount. INR -> whole number only. Other currencies keep 2
+// decimals, so the cents are spelled out too when non-zero
+// (e.g. 383.04 -> "Three Hundred And Eighty Three and Four Cents").
+function amountToWords( value, currency ) {
+  const n = Number( value ) || 0;
+  if ( currency === 'inr' ) {
+    return inWords( Math.round( n ) );
+  }
+  const whole = Math.trunc( n );
+  const cents = Math.round( ( n - whole ) * 100 );
+  const fraction = CURRENCY_FRACTION_WORDS[currency] || 'Cents';
+  if ( cents > 0 ) {
+    return `${inWords( whole )} and ${inWords( cents )} ${fraction}`;
+  }
+  return inWords( whole );
+}
+
 export const updateInvoiceStatus = async ( req, res ) => {
   try {
     if ( !req.params?.invoiceId ) {
@@ -4225,7 +4250,7 @@ export async function uploadClientDocument( req, res ) {
     const clientId = String( req.body?.clientId || '' );
     const documentName = String( req.body?.documentName || '' ).trim();
     const expiryDateRaw = req.body?.expiryDate;
-    const file = req.file; // multer single('file')
+    const file = req.files?.file; // express-fileupload → req.files.file
 
     if ( !clientId ) {
       return res.sendError( 'clientId is required', 400 );
@@ -4257,7 +4282,7 @@ export async function uploadClientDocument( req, res ) {
       Key: key,
       fileName: fileName,
       ContentType: file.mimetype,
-      body: file.buffer,
+      body: file.data,
     } );
 
     const storedPath = `${key}${fileName}`;
@@ -4307,6 +4332,86 @@ export async function getClientDocuments( req, res ) {
   }
 }
 
+// Update a client document (name / expiry, and optionally replace the PDF).
+export async function updateClientDocument( req, res ) {
+  try {
+    const clientId = String( req.body?.clientId || '' );
+    const documentId = String( req.body?.documentId || '' );
+    const documentName = String( req.body?.documentName || '' ).trim();
+    const expiryDateRaw = req.body?.expiryDate;
+    const file = req.files?.file; // optional PDF replacement
+
+    if ( !clientId ) {
+      return res.sendError( 'clientId is required', 400 );
+    }
+    if ( !documentId ) {
+      return res.sendError( 'documentId is required', 400 );
+    }
+    if ( !documentName ) {
+      return res.sendError( 'documentName is required', 400 );
+    }
+
+    const client = await paymentService.findOneClient(
+        { clientId, 'additionalDocuments._id': documentId },
+        { clientId: 1 },
+    );
+    if ( !client ) {
+      return res.sendError( 'Document not found', 404 );
+    }
+
+    const expiryDate = expiryDateRaw ? new Date( expiryDateRaw ) : null;
+    const fields = {
+      documentName: documentName,
+      expiryDate: ( expiryDate && !isNaN( expiryDate.getTime() ) ) ? expiryDate : null,
+    };
+
+    // Optional new file → upload and point the subdoc at the new path.
+    if ( file ) {
+      if ( file.mimetype !== 'application/pdf' ) {
+        return res.sendError( 'Only PDF files are allowed', 400 );
+      }
+      const bucket = JSON.parse( process.env.BUCKET );
+      const safeName = documentName.replace( /[^a-zA-Z0-9-_]/g, '_' );
+      const fileName = `${safeName}_${Date.now()}.pdf`;
+      const key = `${clientId}/documents/`;
+      await fileUpload( {
+        Bucket: bucket.assets,
+        Key: key,
+        fileName: fileName,
+        ContentType: file.mimetype,
+        body: file.data,
+      } );
+      fields.path = `${key}${fileName}`;
+    }
+
+    await paymentService.updateAdditionalDocument( clientId, documentId, fields );
+    return res.sendSuccess( { message: 'Document updated', documentName, expiryDate: fields.expiryDate } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'updateClientDocument' } );
+    return res.sendError( error, 500 );
+  }
+}
+
+// Delete a client document (removes the subdoc; the S3 object is left as-is,
+// matching the app's existing replace-without-delete behavior).
+export async function deleteClientDocument( req, res ) {
+  try {
+    const clientId = String( req.body?.clientId || req.query?.clientId || '' );
+    const documentId = String( req.params?.documentId || req.body?.documentId || '' );
+    if ( !clientId ) {
+      return res.sendError( 'clientId is required', 400 );
+    }
+    if ( !documentId ) {
+      return res.sendError( 'documentId is required', 400 );
+    }
+    await paymentService.pullAdditionalDocument( clientId, documentId );
+    return res.sendSuccess( { message: 'Document deleted' } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'deleteClientDocument' } );
+    return res.sendError( error, 500 );
+  }
+}
+
 // Toggle billing-group-wise pricing on the client. When enabled, pricing is
 // maintained per billing group (separate basepricing docs keyed by groupId).
 export async function setBillingGroupWisePricing( req, res ) {

package/src/controllers/purchaseOrder.controller.js

@@ -57,10 +57,10 @@ export async function createPurchaseOrder( req, res ) {
       return res.sendError( 'A purchase order with this number already exists', 409 );
     }
 
-    // Optional PO PDF upload (multer single 'file') → assets bucket, same as
-    // brand document upload. PDF only.
+    // Optional PO PDF upload (express-fileupload → req.files.file) → assets
+    // bucket, same as brand document upload. PDF only.
     let pdfPath = '';
-    const file = req.file;
+    const file = req.files?.file;
     if ( file ) {
       if ( file.mimetype !== 'application/pdf' ) {
         return res.sendError( 'Only PDF files are allowed', 400 );
@@ -74,7 +74,7 @@ export async function createPurchaseOrder( req, res ) {
         Key: key,
         fileName: fileName,
         ContentType: file.mimetype,
-        body: file.buffer,
+        body: file.data,
       } );
       pdfPath = `${key}${fileName}`;
       console.log( '🚀 ~ createPurchaseOrder ~ result:', result );
@@ -132,6 +132,114 @@ export async function getPurchaseOrders( req, res ) {
   }
 }
 
+// Update a purchase order. Editable: companyName, purchaseOrderNumber,
+// totalAmount, date and (optionally) the PO PDF. Changing totalAmount keeps the
+// already-used amount intact and recomputes remainingAmount + status.
+export async function updatePurchaseOrder( req, res ) {
+  try {
+    const id = String( req.params?.id || req.body?._id || '' );
+    if ( !id ) {
+      return res.sendError( 'purchase order id is required', 400 );
+    }
+    const existing = await purchaseOrderService.findOne( { _id: id } );
+    if ( !existing ) {
+      return res.sendError( 'Purchase order not found', 404 );
+    }
+
+    const clientId = existing.clientId;
+    const companyName = String( req.body?.companyName || '' ).trim();
+    const purchaseOrderNumber = String( req.body?.purchaseOrderNumber || '' ).trim();
+    const totalAmount = Number( req.body?.totalAmount );
+    const date = req.body?.date ? new Date( req.body.date ) : existing.date;
+
+    if ( !purchaseOrderNumber ) {
+      return res.sendError( 'purchaseOrderNumber is required', 400 );
+    }
+    if ( !( totalAmount > 0 ) ) {
+      return res.sendError( 'totalAmount must be greater than 0', 400 );
+    }
+
+    // Reject a number that already belongs to a DIFFERENT PO for this client.
+    if ( purchaseOrderNumber !== existing.purchaseOrderNumber ) {
+      const clash = await purchaseOrderService.findOne( { clientId, purchaseOrderNumber } );
+      if ( clash && String( clash._id ) !== id ) {
+        return res.sendError( 'A purchase order with this number already exists', 409 );
+      }
+    }
+
+    // Preserve the amount already consumed by mapped invoices; the new total
+    // can't drop below it.
+    const usedAmount = Number( existing.totalAmount ) - Number( existing.remainingAmount );
+    if ( totalAmount < usedAmount ) {
+      return res.sendError(
+          `totalAmount cannot be less than the amount already used (${usedAmount})`,
+          400,
+      );
+    }
+    const remainingAmount = totalAmount - usedAmount;
+
+    const update = {
+      companyName,
+      purchaseOrderNumber,
+      totalAmount,
+      remainingAmount,
+      date,
+      status: statusFor( totalAmount, remainingAmount ),
+    };
+
+    // Optional PDF replacement (express-fileupload → req.files.file). PDF only.
+    const file = req.files?.file;
+    if ( file ) {
+      if ( file.mimetype !== 'application/pdf' ) {
+        return res.sendError( 'Only PDF files are allowed', 400 );
+      }
+      const bucket = JSON.parse( process.env.BUCKET );
+      const safeName = purchaseOrderNumber.replace( /[^a-zA-Z0-9-_]/g, '_' );
+      const fileName = `${safeName}_${Date.now()}.pdf`;
+      const key = `${clientId}/purchase-orders/`;
+      await fileUpload( {
+        Bucket: bucket.assets,
+        Key: key,
+        fileName: fileName,
+        ContentType: file.mimetype,
+        body: file.data,
+      } );
+      update.pdfPath = `${key}${fileName}`;
+    }
+
+    await purchaseOrderService.updateOne( { _id: id }, update );
+    logPO( req, clientId, 'purchaseOrderUpdated', [ `PO ${purchaseOrderNumber} updated (total ${totalAmount})` ] );
+    return res.sendSuccess( { message: 'Purchase order updated' } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'updatePurchaseOrder' } );
+    return res.sendError( error, 500 );
+  }
+}
+
+// Delete a purchase order. Blocked when invoices are already mapped to it
+// (deleting would orphan those invoice → PO links).
+export async function deletePurchaseOrder( req, res ) {
+  try {
+    const id = String( req.params?.id || '' );
+    if ( !id ) {
+      return res.sendError( 'purchase order id is required', 400 );
+    }
+    const existing = await purchaseOrderService.findOne( { _id: id } );
+    if ( !existing ) {
+      return res.sendError( 'Purchase order not found', 404 );
+    }
+    if ( ( existing.usage || [] ).length > 0 ) {
+      return res.sendError( 'Cannot delete a purchase order with mapped invoices', 409 );
+    }
+    await purchaseOrderService.deleteRecord( { _id: id } );
+    logPO( req, existing.clientId, 'purchaseOrderDeleted', [ `PO ${existing.purchaseOrderNumber} deleted` ] );
+    return res.sendSuccess( { message: 'Purchase order deleted' } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'deletePurchaseOrder' } );
+    return res.sendError( error, 500 );
+  }
+}
+
 // Map an invoice to a PO: deduct the invoice amount from the PO's remaining
 // balance, record the usage, update status, and log it. Shared with invoice
 // generation/edit so the deduction happens wherever an invoice gets a PO.

package/src/hbs/estimatePdf.hbs

@@ -1423,7 +1423,6 @@
                         </div>
                     </div>
                     <div class="_1234"># {{estimate}}</div>
-                    <div><span class="pill pill-{{status}}">{{statusLabel}}</span></div>
 
                 </div>
 

package/src/hbs/invoicePdf.hbs

@@ -881,6 +881,10 @@
             align-self: stretch;
             flex-shrink: 0;
             position: relative;
+            /* Keep the whole totals block (Sub Total ... Total In Words) on a
+               single page so the amount-in-words can't be split across pages. */
+            break-inside: avoid;
+            page-break-inside: avoid;
         }
 
         .frame-2394 {
@@ -1011,6 +1015,8 @@
             justify-content: flex-start;
             flex-shrink: 0;
             position: relative;
+            break-inside: avoid;
+            page-break-inside: avoid;
         }
 
         .text13 {

package/src/hbs/invoicePdf1.hbs

@@ -844,6 +844,10 @@
             align-self: stretch;
             flex-shrink: 0;
             position: relative;
+            /* Keep the whole totals block (Sub Total ... Total In Words) on a
+               single page so the amount-in-words can't be split across pages. */
+            break-inside: avoid;
+            page-break-inside: avoid;
         }
 
         .frame-2394 {
@@ -974,6 +978,8 @@
             justify-content: flex-start;
             flex-shrink: 0;
             position: relative;
+            break-inside: avoid;
+            page-break-inside: avoid;
         }
 
         .text13 {

package/src/hbs/invoicepaymentemail.hbs

@@ -652,6 +652,7 @@ img {
         </tbody></table>
         </td>
         </tr>
+        {{#gtZero tax.0.value}}
         <tr>
         <td height="12" style="height:12px; min-height:12px; line-height:12px;"></td>
         </tr>
@@ -673,6 +674,7 @@ img {
         <table width="100%" border="0" cellpadding="0" cellspacing="0">
         <tbody>
          {{#each tax }}
+        {{#gtZero value}}
         <tr>
         <td>
         <div style="line-height:24px;text-align:right;">
@@ -680,6 +682,7 @@ img {
         </div>
         </td>
         </tr>
+        {{/gtZero}}
         {{/each}}
 
 
@@ -689,6 +692,7 @@ img {
         </tbody></table>
         </td>
         </tr>
+        {{/gtZero}}
         <tr>
         <td height="12" style="height:12px; min-height:12px; line-height:12px;"></td>
         </tr>

package/src/routes/billing.routes.js

@@ -1,11 +1,9 @@
 import express from 'express';
-import multer from 'multer';
 export const billingRouter = express.Router();
-const poUpload = multer( { storage: multer.memoryStorage(), limits: { fileSize: 10 * 1024 * 1024 } } );
 import { accessVerification, isAllowedSessionHandler, validate } from 'tango-app-api-middleware';
 import { getPaymentReminder, savePaymentReminder } from '../controllers/paymentReminder.controller.js';
 import { triggerPaymentReminders } from '../controllers/paymentReminderTrigger.controller.js';
-import { createPurchaseOrder, getPurchaseOrders } from '../controllers/purchaseOrder.controller.js';
+import { createPurchaseOrder, getPurchaseOrders, updatePurchaseOrder, deletePurchaseOrder } from '../controllers/purchaseOrder.controller.js';
 import { createBillingGroup, deleteBillingGroup, getAllBillingGroups, getBillingGroups, getClientProducts, getInvoices, getLeadProducts, getBaseProducts, onetimePayment, subscribedStoreList, updateBillingGroup, gstinLookup } from '../controllers/billing.controllers.js';
 import { billingGroupSchema, clientProductsValid, createBillingGroupsSchema, deleteBillingGroupsSchema, getBillingGroupsSchema, getInvoiceSchema, leadProductsValid, onetimeFeeValid, subscribedStoreListSchema, updateBillingGroupsSchema } from '../dtos/validation.dtos.js';
 
@@ -42,11 +40,12 @@ billingRouter.post( '/payment-reminder', isAllowedSessionHandler, accessVerifica
 
 // Purchase Orders (brand-view Purchase Order tab).
 billingRouter.get( '/purchase-orders', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), getPurchaseOrders );
-// multer runs FIRST so it consumes the multipart stream off the live request.
-// The auth middlewares are async and do DB awaits while touching req.body;
-// running them before multer leaves the multipart stream unread and busboy
-// throws 'Unexpected end of form'. After multer, text fields are on req.body.
-billingRouter.post( '/purchase-orders', poUpload.single( 'file' ), isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), createPurchaseOrder );
+// The multipart body is parsed app-wide by express-fileupload (see app.js), so
+// the uploaded PDF is on req.files.file and text fields on req.body regardless
+// of middleware order — no per-route upload middleware needed.
+billingRouter.post( '/purchase-orders', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), createPurchaseOrder );
+billingRouter.put( '/purchase-orders/:id', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), updatePurchaseOrder );
+billingRouter.delete( '/purchase-orders/:id', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), deletePurchaseOrder );
 
 // Cron-triggered: sends the configured payment reminder emails. Unauthenticated
 // like the other cron endpoints; protect at the network / scheduler layer.

package/src/routes/paymentSubscription.routes.js

@@ -1,16 +1,11 @@
 
 import express from 'express';
-import multer from 'multer';
 import * as paymentController from '../controllers/paymentSubscription.controllers.js';
 import { validate, isAllowedSessionHandler, accessVerification } from 'tango-app-api-middleware';
 import * as validationDtos from '../dtos/validation.dtos.js';
 import { validateClient } from '../utils/validations/client.validation.js';
 export const paymentSubscriptionRouter = express.Router();
 
-// PDF document upload (Plans & Subscription > Documents). In-memory storage,
-// 10MB cap; the controller streams the buffer to the assets S3 bucket.
-const documentUpload = multer( { storage: multer.memoryStorage(), limits: { fileSize: 10 * 1024 * 1024 } } );
-
 paymentSubscriptionRouter.post( '/addBilling', isAllowedSessionHandler, accessVerification( {
   userType: [ 'tango', 'client' ], access: [
     { featureName: 'Global', name: 'Subscription', permissions: [ 'isAdd' ] },
@@ -151,9 +146,12 @@ paymentSubscriptionRouter.put( '/pushNotification/update/:notificationId', isAll
 paymentSubscriptionRouter.post( '/updateRemind/:notificationId', isAllowedSessionHandler, validate( validationDtos.validateId ), paymentController.updateRemind );
 paymentSubscriptionRouter.post( '/createDefaultbillings', paymentController.createDefaultbillings );
 
-// Brand documents (Plans & Subscription > Documents accordion).
-paymentSubscriptionRouter.post( '/client-document/upload', documentUpload.single( 'file' ), isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.uploadClientDocument );
+// Brand documents (Plans & Subscription > Documents accordion). The multipart
+// body is parsed app-wide by express-fileupload (see app.js) → req.files.file.
+paymentSubscriptionRouter.post( '/client-document/upload', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.uploadClientDocument );
 paymentSubscriptionRouter.get( '/client-document/list', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [] } ] } ), paymentController.getClientDocuments );
+paymentSubscriptionRouter.put( '/client-document/update', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.updateClientDocument );
+paymentSubscriptionRouter.delete( '/client-document/:documentId', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.deleteClientDocument );
 
 // Toggle billing-group-wise pricing for a client (tango only, edit perm).
 paymentSubscriptionRouter.post( '/billingGroupWisePricing', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.setBillingGroupWisePricing );

package/src/services/clientPayment.services.js

@@ -21,6 +21,27 @@ export const pushAdditionalDocument = ( query = {}, document = {} ) => {
   return model.clientModel.updateOne( query, { $push: { additionalDocuments: document } } );
 };
 
+// Update fields of a single additionalDocuments subdoc (matched by _id). `fields`
+// keys are the subdoc field names, e.g. { documentName, expiryDate, path }.
+export const updateAdditionalDocument = ( clientId, documentId, fields = {} ) => {
+  const set = {};
+  for ( const [ k, v ] of Object.entries( fields ) ) {
+    set[`additionalDocuments.$.${k}`] = v;
+  }
+  return model.clientModel.updateOne(
+      { clientId, 'additionalDocuments._id': documentId },
+      { $set: set },
+  );
+};
+
+// Remove a single additionalDocuments subdoc (matched by _id).
+export const pullAdditionalDocument = ( clientId, documentId ) => {
+  return model.clientModel.updateOne(
+      { clientId },
+      { $pull: { additionalDocuments: { _id: documentId } } },
+  );
+};
+
 export const aggregate = ( query = [] ) => {
   return model.clientModel.aggregate( query );
 };

package/src/services/purchaseOrder.service.js

@@ -16,6 +16,10 @@ export const updateOne = ( query, record ) => {
   return model.purchaseOrderModel.updateOne( query, { $set: record } );
 };
 
+export const deleteRecord = ( query ) => {
+  return model.purchaseOrderModel.deleteOne( query );
+};
+
 export const aggregate = ( query = [] ) => {
   return model.purchaseOrderModel.aggregate( query );
 };