tango-app-api-payment-subscription 3.5.22 → 3.5.24

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tango-app-api-payment-subscription",
-    "version": "3.5.22",
+    "version": "3.5.24",
     "description": "paymentSubscription",
     "main": "index.js",
     "type": "module",
@@ -20,16 +20,16 @@
         "dotenv": "^16.4.5",
         "exceljs": "^4.4.0",
         "express": "^4.18.3",
+        "express-fileupload": "^1.5.2",
         "handlebars": "^4.7.8",
         "html-pdf-node": "^1.0.8",
         "joi-to-swagger": "^6.2.0",
         "jsdom": "^24.0.0",
         "mongodb": "^6.4.0",
-        "multer": "^1.4.5-lts.1",
         "nodemon": "^3.1.0",
         "puppeteer": "^24.41.0",
         "swagger-ui-express": "^5.0.0",
-        "tango-api-schema": "^2.6.37",
+        "tango-api-schema": "^2.6.43",
         "tango-app-api-middleware": "^3.6.18",
         "winston": "^3.12.0",
         "winston-daily-rotate-file": "^5.0.0",

package/src/controllers/billing.controllers.js

@@ -343,14 +343,15 @@ export const updateBillingGroup = async ( req, res ) => {
 
       if ( removedStores.length ) {
         await updateOne( { _id: new mongoose.Types.ObjectId( req.body._id ) }, { $pull: { stores: { $in: removedStores } } } );
-        await updateOne( { clientId: req.body.clientId, isPrimary: true }, { $push: { stores: { $each: removedStores } } } );
+        // $addToSet (not $push) so stores already in the primary group aren't duplicated.
+        await updateOne( { clientId: req.body.clientId, isPrimary: true }, { $addToSet: { stores: { $each: removedStores } } } );
       }
 
       const addedStores = req.body?.stores?.filter( ( val ) => !previousStores?.stores.includes( val ) );
 
       if ( addedStores.length ) {
         await updateMany( { clientId: req.body.clientId, _id: { $ne: new mongoose.Types.ObjectId( req.body._id ) } }, { $pull: { stores: { $in: req.body.stores } } } );
-        await updateOne( { _id: new mongoose.Types.ObjectId( req.body._id ) }, { $push: { stores: { $each: addedStores } } } );
+        await updateOne( { _id: new mongoose.Types.ObjectId( req.body._id ) }, { $addToSet: { stores: { $each: addedStores } } } );
       }
     }
 
@@ -436,13 +437,32 @@ export const updateBillingGroup = async ( req, res ) => {
 
 export const deleteBillingGroup = async ( req, res ) => {
   try {
-    const previousGroup = await findOne( { _id: new mongoose.Types.ObjectId( req.query._id ) }, { stores: 1, clientId: 1, groupName: 1 } );
+    const previousGroup = await findOne( { _id: new mongoose.Types.ObjectId( req.query._id ) }, { stores: 1, clientId: 1, groupName: 1, isPrimary: 1 } );
+    console.log( '🚀 ~ deleteBillingGroup ~ previousGroup:', previousGroup );
+
+    // No such group — surface a 404 instead of dereferencing null below (which
+    // would throw and 500). Covers a stale / already-deleted id.
+    if ( !previousGroup ) {
+      return res.sendError( 'Billing group not found', 404 );
+    }
+    // The primary group can't be deleted (stores fall back to it). Reject
+    // explicitly rather than silently no-op'ing the delete.
+    if ( previousGroup.isPrimary ) {
+      return res.sendError( 'The primary billing group cannot be deleted', 400 );
+    }
 
     if ( previousGroup?.stores?.length ) {
-      await updateOne( { clientId: previousGroup.clientId, isPrimary: true }, { $push: { stores: { $each: previousGroup?.stores } } } );
+      // Move the deleted group's stores back to the primary group. Use $addToSet
+      // (not $push) so stores already present in the primary group aren't
+      // duplicated in its stores array.
+      await updateOne( { clientId: previousGroup.clientId, isPrimary: true }, { $addToSet: { stores: { $each: previousGroup?.stores } } } );
     }
 
     const deletedGroup = await deleteOne( { _id: new mongoose.Types.ObjectId( req.query._id ), isPrimary: false } );
+    // Guard against a silent no-op (e.g. a concurrent delete removed it first).
+    if ( !deletedGroup?.deletedCount ) {
+      return res.sendError( 'Billing group could not be deleted', 404 );
+    }
     const updateKeys = [];
     updateKeys.push( previousGroup.groupName );
     const logObj = {
@@ -939,13 +959,12 @@ export async function getClientProducts( req, res ) {
   }
 }
 
-// GSTIN address lookup via Sheet GST Check
-// (https://sheet.gstincheck.co.in). Returns the registered company name
-// + principal place of business address so the UI can auto-fill the
-// billing-group form.
+// GSTIN address lookup via GST Verify (https://gstverify.co.in). Returns
+// the registered company name + principal place of business address so the
+// UI can auto-fill the billing-group form.
 //
-// Requires GST_LOOKUP_API_KEY in the API environment. The key is embedded
-// in the provider's URL path (their auth scheme); we never log it.
+// Requires GST_LOOKUP_API_KEY in the API environment. The key is sent in
+// the `X-API-Key` request header (the provider's auth scheme); we never log it.
 //
 // Caller validates GSTIN format (15 chars, alphanumeric). Server-side we
 // re-check before forwarding to the provider.
@@ -976,12 +995,11 @@ export async function gstinLookup( req, res ) {
       return res.sendError( 'Unknown state code in GSTIN', 404 );
     }
 
-    // Real lookup via Sheet GST Check (https://gstincheck.co.in/).
-    // Endpoint: GET https://sheet.gstincheck.co.in/check/{API_KEY}/{GSTIN}
-    // Auth: API key embedded in the URL path (no header). Set
-    // GST_LOOKUP_API_KEY in the API's environment.
+    // Real lookup via GST Verify (https://gstverify.co.in/).
+    // Endpoint: GET https://gstverify.co.in/api/v1/verify/{GSTIN}
+    // Auth: API key sent in the `X-API-Key` header. Set GST_LOOKUP_API_KEY
+    // in the API's environment.
     const apiKey = process.env.GST_LOOKUP_API_KEY;
-    console.log( '🚀 ~ gstinLookup ~ apiKey:', apiKey );
     if ( !apiKey ) {
       // Fail explicitly rather than silently fall back — that way a missing
       // key shows up immediately instead of mock data leaking into prod.
@@ -992,8 +1010,8 @@ export async function gstinLookup( req, res ) {
     let providerResponse;
     try {
       providerResponse = await axios.get(
-          `https://sheet.gstincheck.co.in/check/${encodeURIComponent( apiKey )}/${encodeURIComponent( gstin )}`,
-          { timeout: 8000 },
+          `https://gstverify.co.in/api/v1/verify/${encodeURIComponent( gstin )}`,
+          { timeout: 8000, headers: { 'X-API-Key': apiKey } },
       );
     } catch ( axiosErr ) {
       // Distinguish provider-down vs other errors so the client can show a
@@ -1008,69 +1026,84 @@ export async function gstinLookup( req, res ) {
     }
 
     const body = providerResponse?.data || {};
-    if ( !body.flag || !body.data ) {
+    if ( !body.success || !body.data ) {
       // Provider reached but couldn't resolve this GSTIN.
       return res.sendError( 'GSTIN not found', 404 );
     }
 
     // Map provider's response shape into the contract the frontend expects.
-    // Provider uses Indian-government short names (lgnm, tradeNam, pradr,
-    // sts, etc.); we normalize to our flat structure.
+    // GST Verify returns a flat object: gstin, legal_name, trade_name,
+    // status, state, pan, and a single concatenated `address` string
+    // (e.g. "123 Business Park, Mumbai — 400001"). We normalize to our
+    // flat structure and parse the address string into the discrete fields
+    // the form needs.
     const src = body.data;
-    // TEMP: full raw response logged so we can confirm field names per
-    // GSTIN — remove once the mapping is verified across a few real cases.
-    logger.error( { function: 'gstinLookup.raw', gstin, providerData: src } );
-
-    const principal = src.pradr || src.pradr1 || {};
-    // The provider has used both `addr` (newer) and a flatter form
-    // (older). Coalesce — `addr` if present, otherwise the principal
-    // itself contains the address fields.
+
+    // Some records may still expose the structured GSTN principal-address
+    // object; prefer explicit fields when present, else parse the string.
+    const principal = src.pradr || {};
     const addr = principal.addr || principal || {};
 
-    // If the provider returned a fully-formed display address string, use
-    // it directly for addressLineOne — that's the canonical comma-joined
-    // address GSTN itself displays. Otherwise build it from the
-    // individual fields. This avoids re-joining in a different order than
-    // the registry intended.
-    const fullAddr = ( principal.adr || principal.address || src.adr || '' ).trim();
+    // Pull the display address, whether it comes back as a plain string or
+    // nested under the structured principal-address object.
+    const fullAddr = String(
+        src.address || principal.adr || principal.address || src.adr || '',
+    ).trim();
+
+    // Pincode: prefer an explicit field, otherwise pull the first 6-digit
+    // run out of the address string.
+    const pinFromString = ( fullAddr.match( /\b(\d{6})\b/ ) || [] )[1] || '';
+    const pinCode = addr.pncd ? String( addr.pncd ) :
+      ( addr.pincode ? String( addr.pincode ) : pinFromString );
+
+    // State: provider's explicit state wins; fall back to our state-code map
+    // so a missing field never blanks out the Place of Supply.
+    const stateValue = src.state || addr.stcd || addr.state || stateName;
+
+    let addressLineOne = '';
+    let addressLineTwo = '';
+    let cityValue = addr.city || addr.dst || addr.loc || '';
 
-    let addressLineOne;
-    let addressLineTwo;
     if ( fullAddr ) {
-      // The registry format is `bno, bnm, flno, st, loc, lndmrk, city,
-      // dst, stcd, pncd`. Split on commas, take the first half for line 1
-      // and the rest (minus city/state/pincode tail which goes to the
-      // separate fields) for line 2. Heuristic: split into two halves.
-      const parts = fullAddr.split( ',' ).map( ( s ) => s.trim() ).filter( Boolean );
+      // Split the display address on commas / em-dash and drop the trailing
+      // tokens that belong in the discrete fields (state, pincode).
+      let parts = fullAddr
+          .split( /[,—-]/ )
+          .map( ( s ) => s.trim() )
+          .filter( Boolean )
+          .filter( ( p ) => !/^\d{6}$/.test( p ) )
+          .filter( ( p ) => p.toLowerCase() !== String( stateValue ).toLowerCase() );
+
+      // Last remaining token is typically the city/district — lift it out
+      // when we don't already have an explicit city.
+      if ( !cityValue && parts.length ) {
+        cityValue = parts[parts.length - 1];
+        parts = parts.slice( 0, -1 );
+      }
+
+      // Split the rest across the two address lines.
       const half = Math.ceil( parts.length / 2 );
       addressLineOne = parts.slice( 0, half ).join( ', ' );
       addressLineTwo = parts.slice( half ).join( ', ' );
-    } else {
+    } else if ( Object.keys( addr ).length ) {
       const line1Parts = [ addr.bno, addr.bnm, addr.flno, addr.st ].filter( ( p ) => p && String( p ).trim() );
       const line2Parts = [ addr.loc, addr.lndmrk, addr.dst ].filter( ( p ) => p && String( p ).trim() );
       addressLineOne = line1Parts.join( ', ' );
       addressLineTwo = line2Parts.join( ', ' );
     }
 
-    // City: prefer explicit `city` / `dst`. Some records put the city
-    // name in `loc` and the colony / sub-area in `dst` — prefer city, but
-    // fall back to dst then loc when missing.
-    const cityValue = addr.city || addr.dst || addr.loc || '';
-
     const data = {
       gstin: src.gstin || gstin,
-      legalName: src.lgnm || src.legalName || '',
-      tradeName: src.tradeNam || src.tradeName || '',
+      legalName: src.legal_name || src.lgnm || src.legalName || '',
+      tradeName: src.trade_name || src.tradeNam || src.tradeName || '',
       addressLineOne,
       addressLineTwo,
       city: cityValue,
-      // Prefer provider's state name; fall back to our state-code map so a
-      // missing field doesn't blank out the Place of Supply.
-      state: addr.stcd || addr.state || stateName,
+      state: stateValue,
       country: 'India',
-      pinCode: addr.pncd ? String( addr.pncd ) : ( addr.pincode ? String( addr.pincode ) : '' ),
-      placeOfSupply: `${addr.stcd || addr.state || stateName} (${code})`,
-      status: src.sts || '',
+      pinCode,
+      placeOfSupply: `${stateValue} (${code})`,
+      status: src.status || src.sts || '',
     };
 
     return res.sendSuccess( data );