tango-app-api-payment-subscription 3.5.22 → 3.5.23

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tango-app-api-payment-subscription",
-    "version": "3.5.22",
+    "version": "3.5.23",
     "description": "paymentSubscription",
     "main": "index.js",
     "type": "module",
@@ -20,12 +20,12 @@
         "dotenv": "^16.4.5",
         "exceljs": "^4.4.0",
         "express": "^4.18.3",
+        "express-fileupload": "^1.5.2",
         "handlebars": "^4.7.8",
         "html-pdf-node": "^1.0.8",
         "joi-to-swagger": "^6.2.0",
         "jsdom": "^24.0.0",
         "mongodb": "^6.4.0",
-        "multer": "^1.4.5-lts.1",
         "nodemon": "^3.1.0",
         "puppeteer": "^24.41.0",
         "swagger-ui-express": "^5.0.0",

package/src/controllers/brandsBilling.controller.js

@@ -8,7 +8,7 @@ import * as basePriceService from '../services/basePrice.service.js';
 import * as cameraService from '../services/camera.service.js';
 import * as planogramService from '../services/planogram.service.js';
 import dayjs from 'dayjs';
-import { logger, checkFileExist, signedUrl, download, insertOpenSearchData, getOpenSearchData } from 'tango-app-api-middleware';
+import { logger, checkFileExist, signedUrl, download, insertOpenSearchData, getOpenSearchData, searchOpenSearchData, scrollResponse, clearScroll } from 'tango-app-api-middleware';
 import * as XLSX from 'xlsx';
 import ExcelJS from 'exceljs';
 import { bulkUpdateBillingGroupRowSchema } from '../dtos/validation.dtos.js';
@@ -2185,6 +2185,11 @@ const ADDITIONAL_PRODUCT_PRICES = {
   planogram: 770,
   aiManager: 500,
 };
+// Product Lambda Function URLs (VMS / Run AI). Each returns the list of billable
+// store IDs for a client; used both for the detailed export and for the invoice
+// additional-products quantity (scoped to a billing group's stores).
+const RUN_AI_LAMBDA_URL = 'https://mdm3mf7wuficgv3jjspkws2nu40azlsc.lambda-url.ap-south-1.on.aws/';
+const VMS_LAMBDA_URL = 'https://ppf3l3mxc2lorh5hkrsj6zwyim0bupxw.lambda-url.ap-south-1.on.aws/';
 // OpenSearch index holding extra billed products (VMS, Run AI, etc.). Each
 // record is a daily snapshot carrying its own quantity + price per product.
 const BILLING_DETAILS_INDEX = ( () => {
@@ -2199,12 +2204,37 @@ const BILLING_DETAILS_INDEX = ( () => {
 // that has none (currently only clientId 11). Shared by the Billing Breakdown
 // table (additionalProducts controller) AND invoice generation, so both stay in
 // sync. Each entry: { productName, quantity, price, total }.
-export async function getAdditionalProducts( clientId ) {
+//
+// storeIds (optional): when a non-empty array is passed, the Eyetest / Planogram
+// / AI Manager quantities are restricted to those stores only — used by invoice
+// generation so a billing group is billed for its assigned stores, not the whole
+// brand. When omitted (e.g. the brand-wide Billing Breakdown endpoint) the counts
+// stay client-wide.
+//
+// Run AI / VMS are sourced by caller: invoice generation (storeIds passed) uses
+// the product Lambdas (called brand-wide, then intersected with the group's
+// stores locally); the brand-wide Billing Breakdown (no storeIds) uses the
+// billing_details snapshot instead.
+//
+// Remote Optum is store-scoped for invoices too: its quantity becomes the count
+// of remote_optom_steps_summary records for the group over the latest inserted
+// month in that index (see remoteOptumRecordCount). Factory is dropped from
+// invoices entirely. The brand-wide Billing Breakdown keeps taking Remote Optum /
+// Factory from the billing_details snapshot as-is.
+export async function getAdditionalProducts( clientId, storeIds ) {
   clientId = String( clientId ?? '' );
   if ( clientId !== ADDITIONAL_PRODUCTS_CLIENT_ID ) {
     return [];
   }
 
+  // Restrict the Mongo aggregations to the billing group's stores when provided.
+  // group.stores holds storeIds, matched via $in against each collection's
+  // storeId field (top-level for cameras/planograms, stores.storeId once
+  // unwound for daily-pricing).
+  const scopeStores = Array.isArray( storeIds ) && storeIds.length;
+  const storeMatch = scopeStores ? { storeId: { $in: storeIds } } : {};
+  const unwoundStoreMatch = scopeStores ? { 'stores.storeId': { $in: storeIds } } : {};
+
   // Eyetest: distinct stores in the cameras collection that have an eye-test
   // stream with a QR code.
   const eyetestRows = await cameraService.aggregate( [
@@ -2212,6 +2242,7 @@ export async function getAdditionalProducts( clientId ) {
       { clientId: clientId },
       { isEyeTestStream: true },
       { qrCode: { $exists: true } },
+      storeMatch,
     ] } },
     { $group: { _id: '$storeId' } },
     { $count: 'stores' },
@@ -2220,7 +2251,7 @@ export async function getAdditionalProducts( clientId ) {
 
   // Planogram: distinct storeName in the planograms collection.
   const planogramRows = await planogramService.aggregate( [
-    { $match: { clientId: clientId } },
+    { $match: { clientId: clientId, ...storeMatch } },
     { $group: { _id: null, storecount: { $addToSet: '$storeName' } } },
     { $project: { count: { $size: '$storecount' } } },
   ] );
@@ -2234,6 +2265,7 @@ export async function getAdditionalProducts( clientId ) {
     { $sort: { dateISO: -1 } },
     { $limit: 1 },
     { $unwind: '$stores' },
+    ...( scopeStores ? [ { $match: unwoundStoreMatch } ] : [] ),
     { $unwind: '$stores.products' },
     { $match: { 'stores.products.productName': 'tangoTraffic', 'stores.products.workingdays': { $gt: 1 } } },
     { $group: { _id: '$stores.storeId' } },
@@ -2254,10 +2286,45 @@ export async function getAdditionalProducts( clientId ) {
     build( 'AI Manager', aiManagerQty, ADDITIONAL_PRODUCT_PRICES.aiManager ),
   ];
 
+  // Run AI and VMS quantities come from two different sources depending on the
+  // caller:
+  //   - Invoice generation (storeIds passed): use the product Lambdas. The
+  //     Lambda's own store_ids filter is unreliable, so lambdaStoreCount calls it
+  //     brand-wide and intersects the returned store list with the group's stores
+  //     locally — giving a per-group scoped count. Unit price from billing_details.
+  //   - Brand-wide Billing Breakdown (no storeIds): use the billing_details
+  //     OpenSearch snapshot instead (handled by the loop below), same as Remote
+  //     Optum / Factory.
+  // lambdaSourced marks which productNames the loop below must skip so they are
+  // not counted twice — only populated in the invoice (scoped) case.
+  const lambdaSourced = new Set();
+  if ( scopeStores ) {
+    const [ runAiQty, vmsQty, runAiPrice, vmsPrice, optumQty, optumPrice ] = await Promise.all( [
+      lambdaStoreCount( clientId, RUN_AI_LAMBDA_URL, storeIds ),
+      lambdaStoreCount( clientId, VMS_LAMBDA_URL, storeIds ),
+      billingDetailsPrice( clientId, 'Run AI' ),
+      billingDetailsPrice( clientId, 'VMS' ),
+      remoteOptumRecordCount( clientId, storeIds ),
+      billingDetailsPrice( clientId, 'Remote Optum' ),
+    ] );
+    products.push( build( 'Run AI', runAiQty, runAiPrice ) );
+    products.push( build( 'VMS', vmsQty, vmsPrice ) );
+    products.push( build( 'Remote Optum', optumQty, optumPrice ) );
+    // Skipped in the billing_details loop below so they are not counted twice.
+    lambdaSourced.add( 'run ai' );
+    lambdaSourced.add( 'vms' );
+    lambdaSourced.add( 'remote optum' );
+  }
+
   // Extra products from the billing_details OpenSearch index — the LATEST daily
   // snapshot for this client. quantity/price are stored as strings, so coerce
-  // them. If OpenSearch is unreachable we just skip these rows rather than
-  // failing the whole list.
+  // them. In the invoice (scoped) case VMS / Run AI / Remote Optum are skipped
+  // here (already added store-scoped above) to avoid double-counting; in the
+  // brand-wide case they are taken from this snapshot like the other extra
+  // products. If OpenSearch is unreachable we just skip these rows rather than
+  // failing the whole list. Factory is excluded from invoices (scoped) but still
+  // shown in the brand-wide Billing Breakdown table.
+  const invoiceExcluded = scopeStores ? new Set( [ 'factory' ] ) : new Set();
   try {
     const osRes = await getOpenSearchData( BILLING_DETAILS_INDEX, {
       size: 1,
@@ -2267,6 +2334,10 @@ export async function getAdditionalProducts( clientId ) {
     const hits = osRes?.body?.hits?.hits || osRes?.hits?.hits || [];
     const osProducts = hits[0]?._source?.products || [];
     for ( const p of osProducts ) {
+      const nameKey = String( p.productName ).toLowerCase();
+      if ( lambdaSourced.has( nameKey ) || invoiceExcluded.has( nameKey ) ) {
+        continue;
+      }
       const quantity = Number( p.quantity ) || 0;
       const price = Number( p.price ) || 0;
       products.push( build( p.productName, quantity, price ) );
@@ -2281,8 +2352,13 @@ export async function getAdditionalProducts( clientId ) {
 export async function additionalProducts( req, res ) {
   try {
     const clientId = String( req.query?.clientId ?? req.body?.clientId ?? '' );
-    const products = await getAdditionalProducts( clientId );
-    return res.sendSuccess( { currency: 'inr', products } );
+    const [ products, billingDate ] = await Promise.all( [
+      getAdditionalProducts( clientId ),
+      billingDetailsDate( clientId ),
+    ] );
+    // billingDate (YYYY-MM-DD) is the billing_details snapshot behind the counts;
+    // the UI passes it back to the export endpoint so exports match the cards.
+    return res.sendSuccess( { currency: 'inr', products, billingDate } );
   } catch ( error ) {
     logger.error( { error: error, function: 'additionalProducts' } );
     return res.sendError( error, 500 );
@@ -2309,6 +2385,35 @@ async function lamdaServiceCall( url, data ) {
   }
 }
 
+// Date (YYYY-MM-DD) of the latest billing_details OpenSearch snapshot for a
+// client — the snapshot whose product counts back the Additional Products cards.
+// The UI passes this back to the export endpoint so the export reflects the same
+// day as the card. Returns '' if unavailable; date_string is normalised to
+// YYYY-MM-DD (it may be stored as DD-MM-YYYY).
+async function billingDetailsDate( clientId ) {
+  try {
+    const osRes = await getOpenSearchData( BILLING_DETAILS_INDEX, {
+      size: 1,
+      query: { term: { 'client_id': clientId } },
+      sort: [ { date_string: { order: 'desc' } } ],
+    } );
+    const hits = osRes?.body?.hits?.hits || osRes?.hits?.hits || [];
+    const raw = String( hits[0]?._source?.date_string || '' ).trim();
+    if ( !raw ) {
+      return '';
+    }
+    // Accept DD-MM-YYYY or YYYY-MM-DD; return YYYY-MM-DD.
+    const ddmmyyyy = raw.match( /^(\d{2})-(\d{2})-(\d{4})$/ );
+    if ( ddmmyyyy ) {
+      return `${ddmmyyyy[3]}-${ddmmyyyy[2]}-${ddmmyyyy[1]}`;
+    }
+    return raw;
+  } catch ( osErr ) {
+    logger.error( { error: osErr, function: 'billingDetailsDate', clientId } );
+    return '';
+  }
+}
+
 // Unit price for a product from the latest billing_details OpenSearch record.
 // productName match is case-insensitive. Returns 0 if not found / unavailable.
 async function billingDetailsPrice( clientId, productName ) {
@@ -2328,13 +2433,82 @@ async function billingDetailsPrice( clientId, productName ) {
   }
 }
 
+// Date (YYYY-MM-DD) of the most recent record in the remote_optom_steps_summary
+// index — the latest day audit data was inserted. Date is a keyword so it sorts
+// lexically. Returns '' if the index is empty / unreachable.
+async function remoteOptumLatestDate() {
+  try {
+    const osRes = await getOpenSearchData( 'remote_optom_steps_summary', {
+      size: 1,
+      _source: [ 'Date' ],
+      sort: [ { 'Date': { order: 'desc' } } ],
+    } );
+    const hits = osRes?.body?.hits?.hits || osRes?.hits?.hits || [];
+    return String( hits[0]?._source?.Date || '' ).trim();
+  } catch ( osErr ) {
+    logger.error( { error: osErr, function: 'remoteOptumLatestDate' } );
+    return '';
+  }
+}
+
+// Remote Optum billed quantity for a billing group = number of audit records in
+// the remote_optom_steps_summary index that belong to the group's stores, over
+// the range [to_date's month-start .. to_date], where to_date is the latest
+// record date in the index (e.g. to_date 2026-06-30 → from_date 2026-06-01). That
+// index keys by store NAME (no storeId), so group.stores (storeIds) are first
+// mapped to names via the stores collection, then matched with a terms filter on
+// storeName.keyword. Date is a keyword (YYYY-MM-DD per record), so the range is
+// lexical. size:0 + track_total_hits gives the exact count without paging past
+// the 10k window. Returns 0 on any failure or when the group has no matching
+// store names / the index is empty.
+async function remoteOptumRecordCount( clientId, storeIds ) {
+  try {
+    if ( !Array.isArray( storeIds ) || !storeIds.length ) {
+      return 0;
+    }
+    const toDate = await remoteOptumLatestDate();
+    if ( !toDate ) {
+      return 0;
+    }
+    const fromDate = dayjs( toDate ).startOf( 'month' ).format( 'YYYY-MM-DD' );
+    const stores = await storeService.find(
+        { clientId: clientId, storeId: { $in: storeIds } },
+        { storeName: 1 },
+    );
+    const storeNames = [ ...new Set(
+        stores.map( ( s ) => String( s.storeName || '' ).trim() ).filter( Boolean ),
+    ) ];
+    if ( !storeNames.length ) {
+      return 0;
+    }
+    const osRes = await getOpenSearchData( 'remote_optom_steps_summary', {
+      size: 0,
+      track_total_hits: true,
+      query: { bool: { filter: [
+        { range: { 'Date': { gte: fromDate, lte: toDate } } },
+        { terms: { 'storeName.keyword': storeNames } },
+      ] } },
+    } );
+    const total = osRes?.body?.hits?.total?.value ?? osRes?.hits?.total?.value ?? 0;
+    return Number( total ) || 0;
+  } catch ( osErr ) {
+    logger.error( { error: osErr, function: 'remoteOptumRecordCount', clientId } );
+    return 0;
+  }
+}
+
 // Build the Lambda-backed export rows (VMS / Run AI / etc.). Calls the product's
 // Lambda for store_names (storeIds), maps them to the stores collection for
 // name + country (Zone), with current-month days and the billing_details price.
-async function lambdaStoreExport( clientId, lambdaUrl, billingProductName ) {
-  const toDate = dayjs().format( 'DD-MM-YYYY' );
+// reqDate (YYYY-MM-DD, optional) is the billing_details snapshot date the UI
+// picked so the export matches the card count; it is sent to the Lambda as
+// to_date (DD-MM-YYYY). Defaults to today when absent.
+async function lambdaStoreExport( clientId, lambdaUrl, billingProductName, reqDate ) {
+  // reqDate is ISO YYYY-MM-DD, which dayjs parses natively; reformat to the
+  // Lambda's DD-MM-YYYY. Fall back to today when absent / unparseable.
+  const parsed = reqDate ? dayjs( reqDate ) : null;
+  const toDate = parsed && parsed.isValid() ? parsed.format( 'DD-MM-YYYY' ) : dayjs().format( 'DD-MM-YYYY' );
   const lambdaResult = await lamdaServiceCall( lambdaUrl, { to_date: toDate, client_id: clientId } );
-  console.log( '🚀 ~ lambdaStoreExport ~ lambdaResult:', lambdaResult );
   // These Lambdas return the storeIds under either `store_ids` (Run AI) or
   // `store_names` (VMS) with no status_code. Accept whichever is present; data
   // availability = a non-empty array.
@@ -2362,6 +2536,33 @@ async function lambdaStoreExport( clientId, lambdaUrl, billingProductName ) {
   } );
 }
 
+// Count the billable stores a product Lambda (VMS / Run AI) reports, optionally
+// scoped to a billing group's stores. The Lambda's own store_ids request filter
+// is unreliable — passing store_ids returns 0 even for IDs it itself reports as
+// billable — so we always call it BRAND-WIDE (client only) to get the true store
+// list, then intersect that list with the group's stores locally. Both sides use
+// the same `clientId-n` storeId format (e.g. `11-2911`), matching how the Mongo
+// aggregations scope by group.stores. Returns 0 on any failure (Lambda
+// unreachable / empty), so the caller just omits the line rather than failing the
+// whole invoice.
+async function lambdaStoreCount( clientId, lambdaUrl, storeIds ) {
+  const toDate = dayjs().format( 'DD-MM-YYYY' );
+  const lambdaResult = await lamdaServiceCall( lambdaUrl, { to_date: toDate, client_id: clientId } );
+  // The Lambdas return the storeIds under either `store_ids` (Run AI) or
+  // `store_names` (VMS); accept whichever is present.
+  const rawIds = ( lambdaResult && Array.isArray( lambdaResult.store_ids ) ) ? lambdaResult.store_ids :
+    ( ( lambdaResult && Array.isArray( lambdaResult.store_names ) ) ? lambdaResult.store_names : [] );
+  const ids = rawIds.map( ( s ) => String( s ) );
+  // Scope to the billing group's stores when provided; otherwise (brand-wide
+  // Billing Breakdown) count every store the Lambda reports.
+  const scope = Array.isArray( storeIds ) && storeIds.length ? storeIds.map( ( s ) => String( s ) ) : null;
+  if ( scope ) {
+    const allowed = new Set( scope );
+    return ids.filter( ( id ) => allowed.has( id ) ).length;
+  }
+  return ids.length;
+}
+
 // tangoTraffic working days per store, from the latest daily-pricing doc.
 // Map<storeId, workingdays>; stores with no tangoTraffic record are absent.
 async function tangoTrafficDaysByStore( clientId ) {
@@ -2531,8 +2732,9 @@ export async function additionalProductExport( req, res ) {
     if ( product === 'vms' ) {
       const exportData = await lambdaStoreExport(
           clientId,
-          'https://ppf3l3mxc2lorh5hkrsj6zwyim0bupxw.lambda-url.ap-south-1.on.aws/',
+          VMS_LAMBDA_URL,
           'VMS',
+          reqDate,
       );
       if ( !exportData.length ) {
         return res.sendError( 'No data', 204 );
@@ -2544,10 +2746,10 @@ export async function additionalProductExport( req, res ) {
     if ( product === 'runai' ) {
       const exportData = await lambdaStoreExport(
           clientId,
-          'https://mdm3mf7wuficgv3jjspkws2nu40azlsc.lambda-url.ap-south-1.on.aws/',
+          RUN_AI_LAMBDA_URL,
           'Run AI',
+          reqDate,
       );
-      console.log( '🚀 ~ additionalProductExport ~ exportData:', exportData );
       if ( !exportData.length ) {
         return res.sendError( 'No data', 204 );
       }
@@ -2556,29 +2758,54 @@ export async function additionalProductExport( req, res ) {
     }
 
     if ( product === 'remoteoptum' ) {
-      // Detailed optom-audit export from the remote_optom_steps_summary index
-      // for the given date (passed from the UI, defaults to today). Each record
-      // is one row; the nested `steps` object is flattened into TRUE/FALSE
-      // columns in a fixed (alphabetical) order.
+      // Detailed optom-audit export from the remote_optom_steps_summary index.
+      // to_date is the date from the payload (reqDate); from_date is the first
+      // day of that date's month — so the export covers month-start through the
+      // requested date. Each record is one row; the nested `steps` object is
+      // flattened into TRUE/FALSE columns in a fixed (alphabetical) order.
       const STEP_COLUMNS = [
         'Adjust-Phoropter', 'DuoChrome-Test', 'Explanation', 'Final-Prescription',
         'Handover', 'History-Taking', 'JCC', 'Near-Vision', 'Personal-Intro',
         'Subjective-Refraction', 'Trial-Frame', 'VA-Check',
       ];
+      const fromDate = dayjs( reqDate ).startOf( 'month' ).format( 'YYYY-MM-DD' );
       let optomHits = [];
+      let scrollId = null;
       try {
-        const osRes = await getOpenSearchData( 'remote_optom_steps_summary', {
-          // A single day is well under the 10k window; pull up to the cap.
-          // NOTE: do NOT sort on StartTime — it's an analyzed text field, and
-          // sorting on it makes OpenSearch return ZERO hits. The day filter is
-          // enough; rows come back in index order.
+        // A month-to-date span can exceed the 10k max_result_window, so scroll
+        // through all pages. Date is a keyword (YYYY-MM-DD) → the span is a lexical
+        // range. NOTE: do NOT sort on StartTime — it's an analyzed text field, and
+        // sorting on it makes OpenSearch return ZERO hits. The range filter is
+        // enough; rows come back in index order.
+        let osRes = await searchOpenSearchData( 'remote_optom_steps_summary', {
           size: 10000,
-          query: { term: { 'Date': reqDate } },
+          query: { range: { 'Date': { gte: fromDate, lte: reqDate } } },
         } );
-        optomHits = osRes?.body?.hits?.hits || osRes?.hits?.hits || [];
+        let body = osRes?.body || osRes;
+        let hits = body?.hits?.hits || [];
+        scrollId = body?._scroll_id;
+        while ( hits.length ) {
+          optomHits.push( ...hits );
+          if ( !scrollId ) {
+            break;
+          }
+          osRes = await scrollResponse( scrollId );
+          body = osRes?.body || osRes;
+          hits = body?.hits?.hits || [];
+          scrollId = body?._scroll_id || scrollId;
+        }
       } catch ( osErr ) {
         logger.error( { error: osErr, function: 'additionalProductExport.remoteOptum', clientId } );
         return res.sendError( 'Failed to fetch Remote Optum data', 502 );
+      } finally {
+        // Free the scroll context; ignore failures (context may already be gone).
+        if ( scrollId ) {
+          try {
+            await clearScroll( scrollId );
+          } catch ( clearErr ) {
+            logger.error( { error: clearErr, function: 'additionalProductExport.remoteOptum.clearScroll' } );
+          }
+        }
       }
 
       const exportData = optomHits.map( ( h ) => {

package/src/controllers/invoice.controller.js

@@ -312,8 +312,17 @@ export async function createInvoice( req, res ) {
       // Skip when reusing advance-invoice line items — those already include any
       // additional products from when the advance invoice was generated.
       if ( !advanceCoverProducts ) {
-        const extraProducts = await getAdditionalProducts( group.clientId );
+        // Scope additional-product quantities to this billing group's assigned
+        // stores (group.stores). Without this the counts span the whole brand
+        // and every group's invoice would be billed for all stores.
+        const extraProducts = await getAdditionalProducts( group.clientId, group.stores );
         for ( const ep of extraProducts ) {
+          // Skip additional products with no billable quantity — an Eyetest /
+          // Planogram / AI Manager / VMS line that resolved to 0 stores for this
+          // billing group should not appear as a ₹0 row on the invoice.
+          if ( ( Number( ep.quantity ) || 0 ) <= 0 ) {
+            continue;
+          }
           products.push( {
             productName: ep.productName,
             period: 'fullmonth',

package/src/controllers/paymentSubscription.controllers.js

@@ -4250,7 +4250,7 @@ export async function uploadClientDocument( req, res ) {
     const clientId = String( req.body?.clientId || '' );
     const documentName = String( req.body?.documentName || '' ).trim();
     const expiryDateRaw = req.body?.expiryDate;
-    const file = req.file; // multer single('file')
+    const file = req.files?.file; // express-fileupload → req.files.file
 
     if ( !clientId ) {
       return res.sendError( 'clientId is required', 400 );
@@ -4282,7 +4282,7 @@ export async function uploadClientDocument( req, res ) {
       Key: key,
       fileName: fileName,
       ContentType: file.mimetype,
-      body: file.buffer,
+      body: file.data,
     } );
 
     const storedPath = `${key}${fileName}`;
@@ -4332,6 +4332,86 @@ export async function getClientDocuments( req, res ) {
   }
 }
 
+// Update a client document (name / expiry, and optionally replace the PDF).
+export async function updateClientDocument( req, res ) {
+  try {
+    const clientId = String( req.body?.clientId || '' );
+    const documentId = String( req.body?.documentId || '' );
+    const documentName = String( req.body?.documentName || '' ).trim();
+    const expiryDateRaw = req.body?.expiryDate;
+    const file = req.files?.file; // optional PDF replacement
+
+    if ( !clientId ) {
+      return res.sendError( 'clientId is required', 400 );
+    }
+    if ( !documentId ) {
+      return res.sendError( 'documentId is required', 400 );
+    }
+    if ( !documentName ) {
+      return res.sendError( 'documentName is required', 400 );
+    }
+
+    const client = await paymentService.findOneClient(
+        { clientId, 'additionalDocuments._id': documentId },
+        { clientId: 1 },
+    );
+    if ( !client ) {
+      return res.sendError( 'Document not found', 404 );
+    }
+
+    const expiryDate = expiryDateRaw ? new Date( expiryDateRaw ) : null;
+    const fields = {
+      documentName: documentName,
+      expiryDate: ( expiryDate && !isNaN( expiryDate.getTime() ) ) ? expiryDate : null,
+    };
+
+    // Optional new file → upload and point the subdoc at the new path.
+    if ( file ) {
+      if ( file.mimetype !== 'application/pdf' ) {
+        return res.sendError( 'Only PDF files are allowed', 400 );
+      }
+      const bucket = JSON.parse( process.env.BUCKET );
+      const safeName = documentName.replace( /[^a-zA-Z0-9-_]/g, '_' );
+      const fileName = `${safeName}_${Date.now()}.pdf`;
+      const key = `${clientId}/documents/`;
+      await fileUpload( {
+        Bucket: bucket.assets,
+        Key: key,
+        fileName: fileName,
+        ContentType: file.mimetype,
+        body: file.data,
+      } );
+      fields.path = `${key}${fileName}`;
+    }
+
+    await paymentService.updateAdditionalDocument( clientId, documentId, fields );
+    return res.sendSuccess( { message: 'Document updated', documentName, expiryDate: fields.expiryDate } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'updateClientDocument' } );
+    return res.sendError( error, 500 );
+  }
+}
+
+// Delete a client document (removes the subdoc; the S3 object is left as-is,
+// matching the app's existing replace-without-delete behavior).
+export async function deleteClientDocument( req, res ) {
+  try {
+    const clientId = String( req.body?.clientId || req.query?.clientId || '' );
+    const documentId = String( req.params?.documentId || req.body?.documentId || '' );
+    if ( !clientId ) {
+      return res.sendError( 'clientId is required', 400 );
+    }
+    if ( !documentId ) {
+      return res.sendError( 'documentId is required', 400 );
+    }
+    await paymentService.pullAdditionalDocument( clientId, documentId );
+    return res.sendSuccess( { message: 'Document deleted' } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'deleteClientDocument' } );
+    return res.sendError( error, 500 );
+  }
+}
+
 // Toggle billing-group-wise pricing on the client. When enabled, pricing is
 // maintained per billing group (separate basepricing docs keyed by groupId).
 export async function setBillingGroupWisePricing( req, res ) {

package/src/controllers/purchaseOrder.controller.js

@@ -57,10 +57,10 @@ export async function createPurchaseOrder( req, res ) {
       return res.sendError( 'A purchase order with this number already exists', 409 );
     }
 
-    // Optional PO PDF upload (multer single 'file') → assets bucket, same as
-    // brand document upload. PDF only.
+    // Optional PO PDF upload (express-fileupload → req.files.file) → assets
+    // bucket, same as brand document upload. PDF only.
     let pdfPath = '';
-    const file = req.file;
+    const file = req.files?.file;
     if ( file ) {
       if ( file.mimetype !== 'application/pdf' ) {
         return res.sendError( 'Only PDF files are allowed', 400 );
@@ -74,7 +74,7 @@ export async function createPurchaseOrder( req, res ) {
         Key: key,
         fileName: fileName,
         ContentType: file.mimetype,
-        body: file.buffer,
+        body: file.data,
       } );
       pdfPath = `${key}${fileName}`;
       console.log( '🚀 ~ createPurchaseOrder ~ result:', result );
@@ -132,6 +132,114 @@ export async function getPurchaseOrders( req, res ) {
   }
 }
 
+// Update a purchase order. Editable: companyName, purchaseOrderNumber,
+// totalAmount, date and (optionally) the PO PDF. Changing totalAmount keeps the
+// already-used amount intact and recomputes remainingAmount + status.
+export async function updatePurchaseOrder( req, res ) {
+  try {
+    const id = String( req.params?.id || req.body?._id || '' );
+    if ( !id ) {
+      return res.sendError( 'purchase order id is required', 400 );
+    }
+    const existing = await purchaseOrderService.findOne( { _id: id } );
+    if ( !existing ) {
+      return res.sendError( 'Purchase order not found', 404 );
+    }
+
+    const clientId = existing.clientId;
+    const companyName = String( req.body?.companyName || '' ).trim();
+    const purchaseOrderNumber = String( req.body?.purchaseOrderNumber || '' ).trim();
+    const totalAmount = Number( req.body?.totalAmount );
+    const date = req.body?.date ? new Date( req.body.date ) : existing.date;
+
+    if ( !purchaseOrderNumber ) {
+      return res.sendError( 'purchaseOrderNumber is required', 400 );
+    }
+    if ( !( totalAmount > 0 ) ) {
+      return res.sendError( 'totalAmount must be greater than 0', 400 );
+    }
+
+    // Reject a number that already belongs to a DIFFERENT PO for this client.
+    if ( purchaseOrderNumber !== existing.purchaseOrderNumber ) {
+      const clash = await purchaseOrderService.findOne( { clientId, purchaseOrderNumber } );
+      if ( clash && String( clash._id ) !== id ) {
+        return res.sendError( 'A purchase order with this number already exists', 409 );
+      }
+    }
+
+    // Preserve the amount already consumed by mapped invoices; the new total
+    // can't drop below it.
+    const usedAmount = Number( existing.totalAmount ) - Number( existing.remainingAmount );
+    if ( totalAmount < usedAmount ) {
+      return res.sendError(
+          `totalAmount cannot be less than the amount already used (${usedAmount})`,
+          400,
+      );
+    }
+    const remainingAmount = totalAmount - usedAmount;
+
+    const update = {
+      companyName,
+      purchaseOrderNumber,
+      totalAmount,
+      remainingAmount,
+      date,
+      status: statusFor( totalAmount, remainingAmount ),
+    };
+
+    // Optional PDF replacement (express-fileupload → req.files.file). PDF only.
+    const file = req.files?.file;
+    if ( file ) {
+      if ( file.mimetype !== 'application/pdf' ) {
+        return res.sendError( 'Only PDF files are allowed', 400 );
+      }
+      const bucket = JSON.parse( process.env.BUCKET );
+      const safeName = purchaseOrderNumber.replace( /[^a-zA-Z0-9-_]/g, '_' );
+      const fileName = `${safeName}_${Date.now()}.pdf`;
+      const key = `${clientId}/purchase-orders/`;
+      await fileUpload( {
+        Bucket: bucket.assets,
+        Key: key,
+        fileName: fileName,
+        ContentType: file.mimetype,
+        body: file.data,
+      } );
+      update.pdfPath = `${key}${fileName}`;
+    }
+
+    await purchaseOrderService.updateOne( { _id: id }, update );
+    logPO( req, clientId, 'purchaseOrderUpdated', [ `PO ${purchaseOrderNumber} updated (total ${totalAmount})` ] );
+    return res.sendSuccess( { message: 'Purchase order updated' } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'updatePurchaseOrder' } );
+    return res.sendError( error, 500 );
+  }
+}
+
+// Delete a purchase order. Blocked when invoices are already mapped to it
+// (deleting would orphan those invoice → PO links).
+export async function deletePurchaseOrder( req, res ) {
+  try {
+    const id = String( req.params?.id || '' );
+    if ( !id ) {
+      return res.sendError( 'purchase order id is required', 400 );
+    }
+    const existing = await purchaseOrderService.findOne( { _id: id } );
+    if ( !existing ) {
+      return res.sendError( 'Purchase order not found', 404 );
+    }
+    if ( ( existing.usage || [] ).length > 0 ) {
+      return res.sendError( 'Cannot delete a purchase order with mapped invoices', 409 );
+    }
+    await purchaseOrderService.deleteRecord( { _id: id } );
+    logPO( req, existing.clientId, 'purchaseOrderDeleted', [ `PO ${existing.purchaseOrderNumber} deleted` ] );
+    return res.sendSuccess( { message: 'Purchase order deleted' } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'deletePurchaseOrder' } );
+    return res.sendError( error, 500 );
+  }
+}
+
 // Map an invoice to a PO: deduct the invoice amount from the PO's remaining
 // balance, record the usage, update status, and log it. Shared with invoice
 // generation/edit so the deduction happens wherever an invoice gets a PO.

package/src/hbs/invoicepaymentemail.hbs

@@ -652,6 +652,7 @@ img {
         </tbody></table>
         </td>
         </tr>
+        {{#gtZero tax.0.value}}
         <tr>
         <td height="12" style="height:12px; min-height:12px; line-height:12px;"></td>
         </tr>
@@ -673,6 +674,7 @@ img {
         <table width="100%" border="0" cellpadding="0" cellspacing="0">
         <tbody>
          {{#each tax }}
+        {{#gtZero value}}
         <tr>
         <td>
         <div style="line-height:24px;text-align:right;">
@@ -680,6 +682,7 @@ img {
         </div>
         </td>
         </tr>
+        {{/gtZero}}
         {{/each}}
 
 
@@ -689,6 +692,7 @@ img {
         </tbody></table>
         </td>
         </tr>
+        {{/gtZero}}
         <tr>
         <td height="12" style="height:12px; min-height:12px; line-height:12px;"></td>
         </tr>

package/src/routes/billing.routes.js

@@ -1,11 +1,9 @@
 import express from 'express';
-import multer from 'multer';
 export const billingRouter = express.Router();
-const poUpload = multer( { storage: multer.memoryStorage(), limits: { fileSize: 10 * 1024 * 1024 } } );
 import { accessVerification, isAllowedSessionHandler, validate } from 'tango-app-api-middleware';
 import { getPaymentReminder, savePaymentReminder } from '../controllers/paymentReminder.controller.js';
 import { triggerPaymentReminders } from '../controllers/paymentReminderTrigger.controller.js';
-import { createPurchaseOrder, getPurchaseOrders } from '../controllers/purchaseOrder.controller.js';
+import { createPurchaseOrder, getPurchaseOrders, updatePurchaseOrder, deletePurchaseOrder } from '../controllers/purchaseOrder.controller.js';
 import { createBillingGroup, deleteBillingGroup, getAllBillingGroups, getBillingGroups, getClientProducts, getInvoices, getLeadProducts, getBaseProducts, onetimePayment, subscribedStoreList, updateBillingGroup, gstinLookup } from '../controllers/billing.controllers.js';
 import { billingGroupSchema, clientProductsValid, createBillingGroupsSchema, deleteBillingGroupsSchema, getBillingGroupsSchema, getInvoiceSchema, leadProductsValid, onetimeFeeValid, subscribedStoreListSchema, updateBillingGroupsSchema } from '../dtos/validation.dtos.js';
 
@@ -42,11 +40,12 @@ billingRouter.post( '/payment-reminder', isAllowedSessionHandler, accessVerifica
 
 // Purchase Orders (brand-view Purchase Order tab).
 billingRouter.get( '/purchase-orders', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), getPurchaseOrders );
-// multer runs FIRST so it consumes the multipart stream off the live request.
-// The auth middlewares are async and do DB awaits while touching req.body;
-// running them before multer leaves the multipart stream unread and busboy
-// throws 'Unexpected end of form'. After multer, text fields are on req.body.
-billingRouter.post( '/purchase-orders', poUpload.single( 'file' ), isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), createPurchaseOrder );
+// The multipart body is parsed app-wide by express-fileupload (see app.js), so
+// the uploaded PDF is on req.files.file and text fields on req.body regardless
+// of middleware order — no per-route upload middleware needed.
+billingRouter.post( '/purchase-orders', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), createPurchaseOrder );
+billingRouter.put( '/purchase-orders/:id', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), updatePurchaseOrder );
+billingRouter.delete( '/purchase-orders/:id', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), deletePurchaseOrder );
 
 // Cron-triggered: sends the configured payment reminder emails. Unauthenticated
 // like the other cron endpoints; protect at the network / scheduler layer.

package/src/routes/paymentSubscription.routes.js

@@ -1,16 +1,11 @@
 
 import express from 'express';
-import multer from 'multer';
 import * as paymentController from '../controllers/paymentSubscription.controllers.js';
 import { validate, isAllowedSessionHandler, accessVerification } from 'tango-app-api-middleware';
 import * as validationDtos from '../dtos/validation.dtos.js';
 import { validateClient } from '../utils/validations/client.validation.js';
 export const paymentSubscriptionRouter = express.Router();
 
-// PDF document upload (Plans & Subscription > Documents). In-memory storage,
-// 10MB cap; the controller streams the buffer to the assets S3 bucket.
-const documentUpload = multer( { storage: multer.memoryStorage(), limits: { fileSize: 10 * 1024 * 1024 } } );
-
 paymentSubscriptionRouter.post( '/addBilling', isAllowedSessionHandler, accessVerification( {
   userType: [ 'tango', 'client' ], access: [
     { featureName: 'Global', name: 'Subscription', permissions: [ 'isAdd' ] },
@@ -151,9 +146,12 @@ paymentSubscriptionRouter.put( '/pushNotification/update/:notificationId', isAll
 paymentSubscriptionRouter.post( '/updateRemind/:notificationId', isAllowedSessionHandler, validate( validationDtos.validateId ), paymentController.updateRemind );
 paymentSubscriptionRouter.post( '/createDefaultbillings', paymentController.createDefaultbillings );
 
-// Brand documents (Plans & Subscription > Documents accordion).
-paymentSubscriptionRouter.post( '/client-document/upload', documentUpload.single( 'file' ), isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.uploadClientDocument );
+// Brand documents (Plans & Subscription > Documents accordion). The multipart
+// body is parsed app-wide by express-fileupload (see app.js) → req.files.file.
+paymentSubscriptionRouter.post( '/client-document/upload', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.uploadClientDocument );
 paymentSubscriptionRouter.get( '/client-document/list', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [] } ] } ), paymentController.getClientDocuments );
+paymentSubscriptionRouter.put( '/client-document/update', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.updateClientDocument );
+paymentSubscriptionRouter.delete( '/client-document/:documentId', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.deleteClientDocument );
 
 // Toggle billing-group-wise pricing for a client (tango only, edit perm).
 paymentSubscriptionRouter.post( '/billingGroupWisePricing', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.setBillingGroupWisePricing );

package/src/services/clientPayment.services.js

@@ -21,6 +21,27 @@ export const pushAdditionalDocument = ( query = {}, document = {} ) => {
   return model.clientModel.updateOne( query, { $push: { additionalDocuments: document } } );
 };
 
+// Update fields of a single additionalDocuments subdoc (matched by _id). `fields`
+// keys are the subdoc field names, e.g. { documentName, expiryDate, path }.
+export const updateAdditionalDocument = ( clientId, documentId, fields = {} ) => {
+  const set = {};
+  for ( const [ k, v ] of Object.entries( fields ) ) {
+    set[`additionalDocuments.$.${k}`] = v;
+  }
+  return model.clientModel.updateOne(
+      { clientId, 'additionalDocuments._id': documentId },
+      { $set: set },
+  );
+};
+
+// Remove a single additionalDocuments subdoc (matched by _id).
+export const pullAdditionalDocument = ( clientId, documentId ) => {
+  return model.clientModel.updateOne(
+      { clientId },
+      { $pull: { additionalDocuments: { _id: documentId } } },
+  );
+};
+
 export const aggregate = ( query = [] ) => {
   return model.clientModel.aggregate( query );
 };

package/src/services/purchaseOrder.service.js

@@ -16,6 +16,10 @@ export const updateOne = ( query, record ) => {
   return model.purchaseOrderModel.updateOne( query, { $set: record } );
 };
 
+export const deleteRecord = ( query ) => {
+  return model.purchaseOrderModel.deleteOne( query );
+};
+
 export const aggregate = ( query = [] ) => {
   return model.purchaseOrderModel.aggregate( query );
 };