tango-app-api-payment-subscription 3.5.22 → 3.5.24

package/src/controllers/estimate.controller.js

@@ -2,7 +2,7 @@ import * as estimateService from '../services/estimate.service.js';
 import * as clientService from '../services/clientPayment.services.js';
 import * as billingService from '../services/billing.service.js';
 import dayjs from 'dayjs';
-import { logger, download, sendEmailWithSES } from 'tango-app-api-middleware';
+import { logger, download, sendEmailWithSES, insertOpenSearchData } from 'tango-app-api-middleware';
 import Handlebars from '../utils/validations/helper/handlebar.helper.js';
 import fs from 'fs';
 import path from 'path';
@@ -17,6 +17,9 @@ async function buildEstimatePdf( estimate ) {
   const currencyType = symbolFor( e.currency );
   const fmt = ( n ) => Number( n || 0 ).toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } );
 
+  // Month per line item, mirroring the invoice PDF's Month column: use the
+  // product's stored month, else fall back to the estimate's created month.
+  const fallbackMonth = e.createdDate ? dayjs( e.createdDate ).format( 'MMM YYYY' ) : '';
   const products = ( e.products || [] ).map( ( p, i ) => {
     let name = String( p.productName || '' ).replace( /([a-z])([A-Z])/g, '$1 $2' );
     name = name.charAt( 0 ).toUpperCase() + name.slice( 1 );
@@ -24,6 +27,7 @@ async function buildEstimatePdf( estimate ) {
       index: i + 1,
       productName: name,
       description: p.description || '',
+      month: p.month || fallbackMonth,
       hsn: p.hsn || p.hsnCode || '998314',
       storeCount: p.storeCount || e.stores || '',
       price: fmt( p.price ),
@@ -36,7 +40,7 @@ async function buildEstimatePdf( estimate ) {
     taxAmount: fmt( t.taxAmount ),
   } ) );
 
-  const statusLabelMap = { pending: 'Pending', sent: 'Sent', accepted: 'Accepted', declined: 'Declined', expired: 'Expired' };
+  const statusLabelMap = { pendingCsm: 'Pending CSM', pendingFinance: 'Pending Finance', pendingApproval: 'Pending Approval', approved: 'Approved', pending: 'Pending CSM' };
   const data = {
     estimate: e.estimate,
     status: e.status,
@@ -106,26 +110,19 @@ async function nextEstimateNumber() {
   };
 }
 
-// Expire stale estimates lazily on read: anything sent/draft past validTill
-// flips to 'expired' so the list reflects reality without a cron.
-async function expireOverdue( clientId ) {
-  await estimateService.updateOne(
-      { clientId, status: { $in: [ 'pending', 'sent' ] }, validTill: { $lt: new Date() } },
-      { $set: { status: 'expired' } },
-  );
-}
-
 export async function estimateList( req, res ) {
   try {
     const clientId = req.body?.clientId;
     if ( !clientId ) {
       return res.sendError( 'clientId is required', 400 );
     }
-    await expireOverdue( clientId );
 
     const match = { clientId };
     if ( req.body?.status && req.body.status !== 'All' ) {
-      match.status = req.body.status;
+      // Legacy 'pending' estimates are equivalent to the first CSM stage.
+      match.status = req.body.status === 'pendingCsm' ?
+        { $in: [ 'pendingCsm', 'pending' ] } :
+        req.body.status;
     }
 
     // Optional month / year filter on the estimate period (stored as a
@@ -186,10 +183,12 @@ export async function estimateList( req, res ) {
       { $match: { clientId } },
       { $group: { _id: '$status', count: { $sum: 1 } } },
     ] );
-    const counts = { pending: 0, sent: 0, accepted: 0, declined: 0, expired: 0, total: 0 };
+    const counts = { pendingCsm: 0, pendingFinance: 0, pendingApproval: 0, approved: 0, total: 0 };
     statusAgg.forEach( ( s ) => {
-      if ( counts[s._id] != null ) {
-        counts[s._id] = s.count;
+      // Fold legacy 'pending' into the CSM stage.
+      const key = s._id === 'pending' ? 'pendingCsm' : s._id;
+      if ( counts[key] != null ) {
+        counts[key] += s.count;
       }
       counts.total += s.count;
     } );
@@ -244,7 +243,8 @@ export async function createEstimate( req, res ) {
       amount,
       totalAmount,
       currency: estimateCurrency,
-      status: b.status === 'sent' ? 'sent' : 'pending',
+      // Estimates enter the approval pipeline at the CSM stage.
+      status: 'pendingCsm',
       createdDate,
       validTill,
       createdBy: req.user?.email || req.user?.userName || '',
@@ -374,6 +374,100 @@ export async function downloadEstimate( req, res ) {
   }
 }
 
+// Advance an estimate one stage in the approval pipeline
+// (pendingCsm → pendingFinance → pendingApproval → approved), mirroring
+// transitionInvoiceStatus. On the FINAL transition to 'approved' the estimate
+// PDF is emailed to the billing group recipients (same logic as the old
+// approve-and-send). A wrong current status returns 409.
+async function transitionEstimateStatus( req, res, fromStatus, toStatus ) {
+  try {
+    const { estimateId } = req.body || {};
+    if ( !estimateId ) {
+      return res.sendError( 'estimateId is required', 400 );
+    }
+    const estimate = await estimateService.findOne( { _id: estimateId } );
+    if ( !estimate ) {
+      return res.sendError( 'Estimate not found', 404 );
+    }
+    const e = estimate._doc || estimate;
+
+    // Legacy 'pending' estimates are equivalent to the first CSM stage.
+    const acceptedFrom = fromStatus === 'pendingCsm' ? [ 'pendingCsm', 'pending' ] : [ fromStatus ];
+    if ( !acceptedFrom.includes( e.status ) ) {
+      return res.sendError(
+          `Estimate is currently at status '${e.status}', not '${fromStatus}'. Another user may have advanced it.`,
+          409,
+      );
+    }
+
+    await estimateService.updateOne( { _id: estimateId }, { $set: { status: toStatus } } );
+
+    insertOpenSearchData( JSON.parse( process.env.OPENSEARCH ).activityLog, {
+      userName: req.user?.userName,
+      email: req.user?.email,
+      clientId: e.clientId,
+      logSubType: 'estimateStatusTransition',
+      logType: 'estimate',
+      date: new Date(),
+      changes: [ `Estimate ${e.estimate} advanced from ${fromStatus} to ${toStatus} by ${req.user?.email}` ],
+      eventType: '',
+      timestamp: new Date(),
+      showTo: [ 'tango' ],
+    } );
+
+    // Final approval → email the estimate PDF to the billing group recipients.
+    // Non-fatal: a send failure is logged but the approval still stands.
+    if ( toStatus === 'approved' ) {
+      try {
+        let toEmails = [];
+        if ( e.groupId ) {
+          const group = await billingService.findOne( { _id: e.groupId } );
+          toEmails = ( group?.generateInvoiceTo || [] ).map( ( x ) => String( x || '' ).trim() ).filter( Boolean );
+        }
+        toEmails = [ ...new Set( toEmails ) ];
+        if ( toEmails.length ) {
+          const ccRaw = await getInvoiceCcEmails( e.clientId );
+          const toSet = new Set( toEmails.map( ( x ) => x.toLowerCase() ) );
+          const ccEmails = [ ...new Set( ( ccRaw || [] ).map( ( x ) => String( x || '' ).trim() ).filter( Boolean ) ) ]
+              .filter( ( x ) => !toSet.has( x.toLowerCase() ) );
+          const { pdfBuffer, filename, data } = await buildEstimatePdf( estimate );
+          const client = await clientService.findOne( { clientId: e.clientId }, { clientName: 1 } );
+          const emailData = { ...data, clientName: client?.clientName || e.companyName || 'Customer', companyName: 'Team Tango' };
+          const emailHtml = Handlebars.compile(
+              fs.readFileSync( path.resolve( path.dirname( '' ) ) + '/src/hbs/estimateEmail.hbs', 'utf8' ),
+          )( emailData );
+          const SES = JSON.parse( process.env.SES );
+          const fromEmail = SES.accountsEmail || SES.adminEmail;
+          const subject = `Estimate ${e.estimate} - Tango/${client?.clientName || e.companyName || ''}`;
+          const attachment = { filename, content: pdfBuffer, contentType: 'application/pdf' };
+          await sendEmailWithSES( toEmails, subject, emailHtml, attachment, fromEmail, ccEmails.length ? ccEmails : undefined );
+        } else {
+          logger.info?.( { function: 'transitionEstimateStatus', estimateId, message: 'No recipients configured; approval email skipped.' } );
+        }
+      } catch ( mailErr ) {
+        logger.error( { error: mailErr, function: 'transitionEstimateStatus.email', estimateId } );
+      }
+    }
+
+    return res.sendSuccess( { estimateId, fromStatus, status: toStatus } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'transitionEstimateStatus', fromStatus, toStatus, estimateId: req.body?.estimateId } );
+    return res.sendError( error, 500 );
+  }
+}
+
+export async function approveEstimateCsm( req, res ) {
+  return transitionEstimateStatus( req, res, 'pendingCsm', 'pendingFinance' );
+}
+
+export async function approveEstimateFinance( req, res ) {
+  return transitionEstimateStatus( req, res, 'pendingFinance', 'pendingApproval' );
+}
+
+export async function approveEstimateApproval( req, res ) {
+  return transitionEstimateStatus( req, res, 'pendingApproval', 'approved' );
+}
+
 // Approve & send an estimate: render the PDF, email it (with the PDF attached)
 // to the billing group's recipients — same recipient logic as invoice send —
 // then flip the status to 'sent'. Triggered by the Approve action's confirm.

package/src/controllers/invoice.controller.js

@@ -18,7 +18,7 @@ import { invoiceStatusEnum } from '../dtos/validation.dtos.js';
 import { findOneApplicationDefault } from '../services/applicationDefault.service.js';
 import * as assignedStoreService from '../services/assignedStore.service.js';
 import * as bankTransactionService from '../services/bankTransaction.service.js';
-import { getUsdInrRate, getAdditionalProducts } from './brandsBilling.controller.js';
+import { getInrRate, getAdditionalProducts } from './brandsBilling.controller.js';
 import { applyInvoiceToPurchaseOrder } from './purchaseOrder.controller.js';
 
 // Pulls CSM + Finance head emails (stored under applicationDefault
@@ -312,8 +312,17 @@ export async function createInvoice( req, res ) {
       // Skip when reusing advance-invoice line items — those already include any
       // additional products from when the advance invoice was generated.
       if ( !advanceCoverProducts ) {
-        const extraProducts = await getAdditionalProducts( group.clientId );
+        // Scope additional-product quantities to this billing group's assigned
+        // stores (group.stores). Without this the counts span the whole brand
+        // and every group's invoice would be billed for all stores.
+        const extraProducts = await getAdditionalProducts( group.clientId, group.stores, baseDate );
         for ( const ep of extraProducts ) {
+          // Skip additional products with no billable quantity — an Eyetest /
+          // Planogram / AI Manager / VMS line that resolved to 0 stores for this
+          // billing group should not appear as a ₹0 row on the invoice.
+          if ( ( Number( ep.quantity ) || 0 ) <= 0 ) {
+            continue;
+          }
           products.push( {
             productName: ep.productName,
             period: 'fullmonth',
@@ -1271,7 +1280,8 @@ async function resolveBasePricingScope( group, getClient ) {
 
 async function standardPrice( group, getClient, baseDate ) {
   console.log( '🚀 ~ standardPrice ~ baseDate:', baseDate.format( 'MMM YYYY' ) );
-  const currentMonthDays = dayjs().daysInMonth();
+  const currentMonthDays = 30;
+  console.log( '🚀 ~ standardPrice ~ currentMonthDays:', currentMonthDays );
   // Pricing method: 'flat' => bill every store for the full month
   // regardless of working days. 'prorate' => bill for actual working days.
   // Computed once so the aggregation pipelines can inline a $literal.
@@ -2002,6 +2012,16 @@ export async function clientInvoiceList( req, res ) {
       },
     } ];
 
+    // Invoice type sub-toggle: 'advance' shows only advance invoices (invoice #
+    // starts with 'TINV-'); 'all' (default) shows only regular invoices (INV-*),
+    // i.e. everything that is NOT a TINV-. Applied to the whole pipeline so the
+    // list, count and cards all reflect the selected type.
+    if ( req.body.invoiceType === 'advance' ) {
+      query.push( { $match: { invoice: { $regex: '^TINV-' } } } );
+    } else if ( req.body.invoiceType === 'all' ) {
+      query.push( { $match: { invoice: { $not: { $regex: '^TINV-' } } } } );
+    }
+
     // If the user picked an explicit Month or Year, ignore the Duration
     // filter — otherwise the two ranges conflict (e.g. "current month" +
     // April would always return zero results). Mirrors brand-invoices.
@@ -2239,30 +2259,49 @@ export async function clientInvoiceList( req, res ) {
     // converted to INR at today's rate so all three totals are a single ₹
     // figure. Outstanding = unpaid remaining (totalAmount - paidAmount);
     // Overdue = past-due unpaid subset; Pending Payment = approved-but-unpaid.
-    const usdRate = await getUsdInrRate();
     const now = new Date();
+    // Convert every non-INR invoice to INR so the ₹ card totals are comparable.
+    // Resolve one rate per distinct currency present (dollar, euro, sgd, aed, …)
+    // via getInrRate, so euro/others are converted too — not just dollar.
+    const rateByCurrency = {};
+    for ( const cur of new Set( count.map( ( c ) => String( c.currency || 'inr' ) ) ) ) {
+      rateByCurrency[cur] = await getInrRate( cur );
+    }
+    // Each card carries the total remaining (incl. GST, net of payments — the
+    // *Amount fields, kept for back-compat) PLUS a GST split of the GROSS invoice
+    // figures: *ExclAmount = sum of `amount` (pre-tax subtotal), *InclAmount =
+    // sum of `totalAmount` (with tax), matching the table's Excl/Incl columns.
     const cards = {
-      outstandingAmount: 0, outstandingCount: 0,
-      overdueAmount: 0, overdueCount: 0,
-      pendingPaymentAmount: 0, pendingPaymentCount: 0,
+      outstandingAmount: 0, outstandingExclAmount: 0, outstandingInclAmount: 0, outstandingCount: 0,
+      overdueAmount: 0, overdueExclAmount: 0, overdueInclAmount: 0, overdueCount: 0,
+      pendingPaymentAmount: 0, pendingPaymentExclAmount: 0, pendingPaymentInclAmount: 0, pendingPaymentCount: 0,
     };
     for ( const inv of count ) {
       if ( inv.paymentStatus === 'paid' ) {
         continue;
       }
-      const fx = inv.currency === 'dollar' ? usdRate : 1;
+      const fx = rateByCurrency[String( inv.currency || 'inr' )] || 1;
       const total = Number( inv.totalAmount ) || Number( inv.amount ) || 0;
       const paid = Number( inv.paidAmount ) || 0;
       const remaining = Math.max( 0, total - paid ) * fx;
+      // Gross GST split (FX-normalised to INR): excl = subtotal, incl = with tax.
+      const exclGross = ( Number( inv.amount ) || 0 ) * fx;
+      const inclGross = ( Number( inv.totalAmount ) || Number( inv.amount ) || 0 ) * fx;
 
       cards.outstandingAmount += remaining;
+      cards.outstandingExclAmount += exclGross;
+      cards.outstandingInclAmount += inclGross;
       cards.outstandingCount += 1;
       if ( inv.dueDate && new Date( inv.dueDate ) < now ) {
         cards.overdueAmount += remaining;
+        cards.overdueExclAmount += exclGross;
+        cards.overdueInclAmount += inclGross;
         cards.overdueCount += 1;
       }
       if ( inv.status === 'approved' ) {
         cards.pendingPaymentAmount += remaining;
+        cards.pendingPaymentExclAmount += exclGross;
+        cards.pendingPaymentInclAmount += inclGross;
         cards.pendingPaymentCount += 1;
       }
     }
@@ -2271,6 +2310,12 @@ export async function clientInvoiceList( req, res ) {
     cards.outstandingAmount = roundAmount( cards.outstandingAmount, 'inr' );
     cards.overdueAmount = roundAmount( cards.overdueAmount, 'inr' );
     cards.pendingPaymentAmount = roundAmount( cards.pendingPaymentAmount, 'inr' );
+    cards.outstandingExclAmount = roundAmount( cards.outstandingExclAmount, 'inr' );
+    cards.outstandingInclAmount = roundAmount( cards.outstandingInclAmount, 'inr' );
+    cards.overdueExclAmount = roundAmount( cards.overdueExclAmount, 'inr' );
+    cards.overdueInclAmount = roundAmount( cards.overdueInclAmount, 'inr' );
+    cards.pendingPaymentExclAmount = roundAmount( cards.pendingPaymentExclAmount, 'inr' );
+    cards.pendingPaymentInclAmount = roundAmount( cards.pendingPaymentInclAmount, 'inr' );
 
     res.sendSuccess( { count: count.length, data: invoiceList, cards } );
   } catch ( error ) {

package/src/controllers/paymentSubscription.controllers.js

@@ -4250,7 +4250,7 @@ export async function uploadClientDocument( req, res ) {
     const clientId = String( req.body?.clientId || '' );
     const documentName = String( req.body?.documentName || '' ).trim();
     const expiryDateRaw = req.body?.expiryDate;
-    const file = req.file; // multer single('file')
+    const file = req.files?.file; // express-fileupload → req.files.file
 
     if ( !clientId ) {
       return res.sendError( 'clientId is required', 400 );
@@ -4282,7 +4282,7 @@ export async function uploadClientDocument( req, res ) {
       Key: key,
       fileName: fileName,
       ContentType: file.mimetype,
-      body: file.buffer,
+      body: file.data,
     } );
 
     const storedPath = `${key}${fileName}`;
@@ -4332,6 +4332,86 @@ export async function getClientDocuments( req, res ) {
   }
 }
 
+// Update a client document (name / expiry, and optionally replace the PDF).
+export async function updateClientDocument( req, res ) {
+  try {
+    const clientId = String( req.body?.clientId || '' );
+    const documentId = String( req.body?.documentId || '' );
+    const documentName = String( req.body?.documentName || '' ).trim();
+    const expiryDateRaw = req.body?.expiryDate;
+    const file = req.files?.file; // optional PDF replacement
+
+    if ( !clientId ) {
+      return res.sendError( 'clientId is required', 400 );
+    }
+    if ( !documentId ) {
+      return res.sendError( 'documentId is required', 400 );
+    }
+    if ( !documentName ) {
+      return res.sendError( 'documentName is required', 400 );
+    }
+
+    const client = await paymentService.findOneClient(
+        { clientId, 'additionalDocuments._id': documentId },
+        { clientId: 1 },
+    );
+    if ( !client ) {
+      return res.sendError( 'Document not found', 404 );
+    }
+
+    const expiryDate = expiryDateRaw ? new Date( expiryDateRaw ) : null;
+    const fields = {
+      documentName: documentName,
+      expiryDate: ( expiryDate && !isNaN( expiryDate.getTime() ) ) ? expiryDate : null,
+    };
+
+    // Optional new file → upload and point the subdoc at the new path.
+    if ( file ) {
+      if ( file.mimetype !== 'application/pdf' ) {
+        return res.sendError( 'Only PDF files are allowed', 400 );
+      }
+      const bucket = JSON.parse( process.env.BUCKET );
+      const safeName = documentName.replace( /[^a-zA-Z0-9-_]/g, '_' );
+      const fileName = `${safeName}_${Date.now()}.pdf`;
+      const key = `${clientId}/documents/`;
+      await fileUpload( {
+        Bucket: bucket.assets,
+        Key: key,
+        fileName: fileName,
+        ContentType: file.mimetype,
+        body: file.data,
+      } );
+      fields.path = `${key}${fileName}`;
+    }
+
+    await paymentService.updateAdditionalDocument( clientId, documentId, fields );
+    return res.sendSuccess( { message: 'Document updated', documentName, expiryDate: fields.expiryDate } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'updateClientDocument' } );
+    return res.sendError( error, 500 );
+  }
+}
+
+// Delete a client document (removes the subdoc; the S3 object is left as-is,
+// matching the app's existing replace-without-delete behavior).
+export async function deleteClientDocument( req, res ) {
+  try {
+    const clientId = String( req.body?.clientId || req.query?.clientId || '' );
+    const documentId = String( req.params?.documentId || req.body?.documentId || '' );
+    if ( !clientId ) {
+      return res.sendError( 'clientId is required', 400 );
+    }
+    if ( !documentId ) {
+      return res.sendError( 'documentId is required', 400 );
+    }
+    await paymentService.pullAdditionalDocument( clientId, documentId );
+    return res.sendSuccess( { message: 'Document deleted' } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'deleteClientDocument' } );
+    return res.sendError( error, 500 );
+  }
+}
+
 // Toggle billing-group-wise pricing on the client. When enabled, pricing is
 // maintained per billing group (separate basepricing docs keyed by groupId).
 export async function setBillingGroupWisePricing( req, res ) {

package/src/controllers/purchaseOrder.controller.js

@@ -57,10 +57,10 @@ export async function createPurchaseOrder( req, res ) {
       return res.sendError( 'A purchase order with this number already exists', 409 );
     }
 
-    // Optional PO PDF upload (multer single 'file') → assets bucket, same as
-    // brand document upload. PDF only.
+    // Optional PO PDF upload (express-fileupload → req.files.file) → assets
+    // bucket, same as brand document upload. PDF only.
     let pdfPath = '';
-    const file = req.file;
+    const file = req.files?.file;
     if ( file ) {
       if ( file.mimetype !== 'application/pdf' ) {
         return res.sendError( 'Only PDF files are allowed', 400 );
@@ -74,7 +74,7 @@ export async function createPurchaseOrder( req, res ) {
         Key: key,
         fileName: fileName,
         ContentType: file.mimetype,
-        body: file.buffer,
+        body: file.data,
       } );
       pdfPath = `${key}${fileName}`;
       console.log( '🚀 ~ createPurchaseOrder ~ result:', result );
@@ -132,6 +132,114 @@ export async function getPurchaseOrders( req, res ) {
   }
 }
 
+// Update a purchase order. Editable: companyName, purchaseOrderNumber,
+// totalAmount, date and (optionally) the PO PDF. Changing totalAmount keeps the
+// already-used amount intact and recomputes remainingAmount + status.
+export async function updatePurchaseOrder( req, res ) {
+  try {
+    const id = String( req.params?.id || req.body?._id || '' );
+    if ( !id ) {
+      return res.sendError( 'purchase order id is required', 400 );
+    }
+    const existing = await purchaseOrderService.findOne( { _id: id } );
+    if ( !existing ) {
+      return res.sendError( 'Purchase order not found', 404 );
+    }
+
+    const clientId = existing.clientId;
+    const companyName = String( req.body?.companyName || '' ).trim();
+    const purchaseOrderNumber = String( req.body?.purchaseOrderNumber || '' ).trim();
+    const totalAmount = Number( req.body?.totalAmount );
+    const date = req.body?.date ? new Date( req.body.date ) : existing.date;
+
+    if ( !purchaseOrderNumber ) {
+      return res.sendError( 'purchaseOrderNumber is required', 400 );
+    }
+    if ( !( totalAmount > 0 ) ) {
+      return res.sendError( 'totalAmount must be greater than 0', 400 );
+    }
+
+    // Reject a number that already belongs to a DIFFERENT PO for this client.
+    if ( purchaseOrderNumber !== existing.purchaseOrderNumber ) {
+      const clash = await purchaseOrderService.findOne( { clientId, purchaseOrderNumber } );
+      if ( clash && String( clash._id ) !== id ) {
+        return res.sendError( 'A purchase order with this number already exists', 409 );
+      }
+    }
+
+    // Preserve the amount already consumed by mapped invoices; the new total
+    // can't drop below it.
+    const usedAmount = Number( existing.totalAmount ) - Number( existing.remainingAmount );
+    if ( totalAmount < usedAmount ) {
+      return res.sendError(
+          `totalAmount cannot be less than the amount already used (${usedAmount})`,
+          400,
+      );
+    }
+    const remainingAmount = totalAmount - usedAmount;
+
+    const update = {
+      companyName,
+      purchaseOrderNumber,
+      totalAmount,
+      remainingAmount,
+      date,
+      status: statusFor( totalAmount, remainingAmount ),
+    };
+
+    // Optional PDF replacement (express-fileupload → req.files.file). PDF only.
+    const file = req.files?.file;
+    if ( file ) {
+      if ( file.mimetype !== 'application/pdf' ) {
+        return res.sendError( 'Only PDF files are allowed', 400 );
+      }
+      const bucket = JSON.parse( process.env.BUCKET );
+      const safeName = purchaseOrderNumber.replace( /[^a-zA-Z0-9-_]/g, '_' );
+      const fileName = `${safeName}_${Date.now()}.pdf`;
+      const key = `${clientId}/purchase-orders/`;
+      await fileUpload( {
+        Bucket: bucket.assets,
+        Key: key,
+        fileName: fileName,
+        ContentType: file.mimetype,
+        body: file.data,
+      } );
+      update.pdfPath = `${key}${fileName}`;
+    }
+
+    await purchaseOrderService.updateOne( { _id: id }, update );
+    logPO( req, clientId, 'purchaseOrderUpdated', [ `PO ${purchaseOrderNumber} updated (total ${totalAmount})` ] );
+    return res.sendSuccess( { message: 'Purchase order updated' } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'updatePurchaseOrder' } );
+    return res.sendError( error, 500 );
+  }
+}
+
+// Delete a purchase order. Blocked when invoices are already mapped to it
+// (deleting would orphan those invoice → PO links).
+export async function deletePurchaseOrder( req, res ) {
+  try {
+    const id = String( req.params?.id || '' );
+    if ( !id ) {
+      return res.sendError( 'purchase order id is required', 400 );
+    }
+    const existing = await purchaseOrderService.findOne( { _id: id } );
+    if ( !existing ) {
+      return res.sendError( 'Purchase order not found', 404 );
+    }
+    if ( ( existing.usage || [] ).length > 0 ) {
+      return res.sendError( 'Cannot delete a purchase order with mapped invoices', 409 );
+    }
+    await purchaseOrderService.deleteRecord( { _id: id } );
+    logPO( req, existing.clientId, 'purchaseOrderDeleted', [ `PO ${existing.purchaseOrderNumber} deleted` ] );
+    return res.sendSuccess( { message: 'Purchase order deleted' } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'deletePurchaseOrder' } );
+    return res.sendError( error, 500 );
+  }
+}
+
 // Map an invoice to a PO: deduct the invoice amount from the PO's remaining
 // balance, record the usage, update status, and log it. Shared with invoice
 // generation/edit so the deduction happens wherever an invoice gets a PO.

package/src/hbs/estimatePdf.hbs

@@ -1540,6 +1540,18 @@
                         </div>
                         {{/each}}
                     </div>
+                    <div class="column2">
+                        <div class="table-header-cell2">
+                            <div class="table-header2">
+                                <div class="text6">Month</div>
+                            </div>
+                        </div>
+                        {{#each products}}
+                        <div class="table-cell4">
+                            <div class="text7">{{month}}</div>
+                        </div>
+                        {{/each}}
+                    </div>
                     <div class="column2">
                         <div class="table-header-cell2">
                             <div class="table-header2">

package/src/hbs/invoicepaymentemail.hbs

@@ -652,6 +652,7 @@ img {
         </tbody></table>
         </td>
         </tr>
+        {{#gtZero tax.0.value}}
         <tr>
         <td height="12" style="height:12px; min-height:12px; line-height:12px;"></td>
         </tr>
@@ -673,6 +674,7 @@ img {
         <table width="100%" border="0" cellpadding="0" cellspacing="0">
         <tbody>
          {{#each tax }}
+        {{#gtZero value}}
         <tr>
         <td>
         <div style="line-height:24px;text-align:right;">
@@ -680,6 +682,7 @@ img {
         </div>
         </td>
         </tr>
+        {{/gtZero}}
         {{/each}}
 
 
@@ -689,6 +692,7 @@ img {
         </tbody></table>
         </td>
         </tr>
+        {{/gtZero}}
         <tr>
         <td height="12" style="height:12px; min-height:12px; line-height:12px;"></td>
         </tr>

package/src/routes/billing.routes.js

@@ -1,11 +1,9 @@
 import express from 'express';
-import multer from 'multer';
 export const billingRouter = express.Router();
-const poUpload = multer( { storage: multer.memoryStorage(), limits: { fileSize: 10 * 1024 * 1024 } } );
 import { accessVerification, isAllowedSessionHandler, validate } from 'tango-app-api-middleware';
 import { getPaymentReminder, savePaymentReminder } from '../controllers/paymentReminder.controller.js';
 import { triggerPaymentReminders } from '../controllers/paymentReminderTrigger.controller.js';
-import { createPurchaseOrder, getPurchaseOrders } from '../controllers/purchaseOrder.controller.js';
+import { createPurchaseOrder, getPurchaseOrders, updatePurchaseOrder, deletePurchaseOrder } from '../controllers/purchaseOrder.controller.js';
 import { createBillingGroup, deleteBillingGroup, getAllBillingGroups, getBillingGroups, getClientProducts, getInvoices, getLeadProducts, getBaseProducts, onetimePayment, subscribedStoreList, updateBillingGroup, gstinLookup } from '../controllers/billing.controllers.js';
 import { billingGroupSchema, clientProductsValid, createBillingGroupsSchema, deleteBillingGroupsSchema, getBillingGroupsSchema, getInvoiceSchema, leadProductsValid, onetimeFeeValid, subscribedStoreListSchema, updateBillingGroupsSchema } from '../dtos/validation.dtos.js';
 
@@ -42,11 +40,12 @@ billingRouter.post( '/payment-reminder', isAllowedSessionHandler, accessVerifica
 
 // Purchase Orders (brand-view Purchase Order tab).
 billingRouter.get( '/purchase-orders', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), getPurchaseOrders );
-// multer runs FIRST so it consumes the multipart stream off the live request.
-// The auth middlewares are async and do DB awaits while touching req.body;
-// running them before multer leaves the multipart stream unread and busboy
-// throws 'Unexpected end of form'. After multer, text fields are on req.body.
-billingRouter.post( '/purchase-orders', poUpload.single( 'file' ), isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), createPurchaseOrder );
+// The multipart body is parsed app-wide by express-fileupload (see app.js), so
+// the uploaded PDF is on req.files.file and text fields on req.body regardless
+// of middleware order — no per-route upload middleware needed.
+billingRouter.post( '/purchase-orders', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), createPurchaseOrder );
+billingRouter.put( '/purchase-orders/:id', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), updatePurchaseOrder );
+billingRouter.delete( '/purchase-orders/:id', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), deletePurchaseOrder );
 
 // Cron-triggered: sends the configured payment reminder emails. Unauthenticated
 // like the other cron endpoints; protect at the network / scheduler layer.