tango-app-api-payment-subscription 3.5.23 → 3.5.25

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tango-app-api-payment-subscription",
-    "version": "3.5.23",
+    "version": "3.5.25",
     "description": "paymentSubscription",
     "main": "index.js",
     "type": "module",
@@ -29,7 +29,7 @@
         "nodemon": "^3.1.0",
         "puppeteer": "^24.41.0",
         "swagger-ui-express": "^5.0.0",
-        "tango-api-schema": "^2.6.37",
+        "tango-api-schema": "^2.6.43",
         "tango-app-api-middleware": "^3.6.18",
         "winston": "^3.12.0",
         "winston-daily-rotate-file": "^5.0.0",

package/src/controllers/billing.controllers.js

@@ -343,14 +343,15 @@ export const updateBillingGroup = async ( req, res ) => {
 
       if ( removedStores.length ) {
         await updateOne( { _id: new mongoose.Types.ObjectId( req.body._id ) }, { $pull: { stores: { $in: removedStores } } } );
-        await updateOne( { clientId: req.body.clientId, isPrimary: true }, { $push: { stores: { $each: removedStores } } } );
+        // $addToSet (not $push) so stores already in the primary group aren't duplicated.
+        await updateOne( { clientId: req.body.clientId, isPrimary: true }, { $addToSet: { stores: { $each: removedStores } } } );
       }
 
       const addedStores = req.body?.stores?.filter( ( val ) => !previousStores?.stores.includes( val ) );
 
       if ( addedStores.length ) {
         await updateMany( { clientId: req.body.clientId, _id: { $ne: new mongoose.Types.ObjectId( req.body._id ) } }, { $pull: { stores: { $in: req.body.stores } } } );
-        await updateOne( { _id: new mongoose.Types.ObjectId( req.body._id ) }, { $push: { stores: { $each: addedStores } } } );
+        await updateOne( { _id: new mongoose.Types.ObjectId( req.body._id ) }, { $addToSet: { stores: { $each: addedStores } } } );
       }
     }
 
@@ -436,13 +437,32 @@ export const updateBillingGroup = async ( req, res ) => {
 
 export const deleteBillingGroup = async ( req, res ) => {
   try {
-    const previousGroup = await findOne( { _id: new mongoose.Types.ObjectId( req.query._id ) }, { stores: 1, clientId: 1, groupName: 1 } );
+    const previousGroup = await findOne( { _id: new mongoose.Types.ObjectId( req.query._id ) }, { stores: 1, clientId: 1, groupName: 1, isPrimary: 1 } );
+    console.log( '🚀 ~ deleteBillingGroup ~ previousGroup:', previousGroup );
+
+    // No such group — surface a 404 instead of dereferencing null below (which
+    // would throw and 500). Covers a stale / already-deleted id.
+    if ( !previousGroup ) {
+      return res.sendError( 'Billing group not found', 404 );
+    }
+    // The primary group can't be deleted (stores fall back to it). Reject
+    // explicitly rather than silently no-op'ing the delete.
+    if ( previousGroup.isPrimary ) {
+      return res.sendError( 'The primary billing group cannot be deleted', 400 );
+    }
 
     if ( previousGroup?.stores?.length ) {
-      await updateOne( { clientId: previousGroup.clientId, isPrimary: true }, { $push: { stores: { $each: previousGroup?.stores } } } );
+      // Move the deleted group's stores back to the primary group. Use $addToSet
+      // (not $push) so stores already present in the primary group aren't
+      // duplicated in its stores array.
+      await updateOne( { clientId: previousGroup.clientId, isPrimary: true }, { $addToSet: { stores: { $each: previousGroup?.stores } } } );
     }
 
     const deletedGroup = await deleteOne( { _id: new mongoose.Types.ObjectId( req.query._id ), isPrimary: false } );
+    // Guard against a silent no-op (e.g. a concurrent delete removed it first).
+    if ( !deletedGroup?.deletedCount ) {
+      return res.sendError( 'Billing group could not be deleted', 404 );
+    }
     const updateKeys = [];
     updateKeys.push( previousGroup.groupName );
     const logObj = {
@@ -939,13 +959,12 @@ export async function getClientProducts( req, res ) {
   }
 }
 
-// GSTIN address lookup via Sheet GST Check
-// (https://sheet.gstincheck.co.in). Returns the registered company name
-// + principal place of business address so the UI can auto-fill the
-// billing-group form.
+// GSTIN address lookup via GST Verify (https://gstverify.co.in). Returns
+// the registered company name + principal place of business address so the
+// UI can auto-fill the billing-group form.
 //
-// Requires GST_LOOKUP_API_KEY in the API environment. The key is embedded
-// in the provider's URL path (their auth scheme); we never log it.
+// Requires GST_LOOKUP_API_KEY in the API environment. The key is sent in
+// the `X-API-Key` request header (the provider's auth scheme); we never log it.
 //
 // Caller validates GSTIN format (15 chars, alphanumeric). Server-side we
 // re-check before forwarding to the provider.
@@ -976,12 +995,11 @@ export async function gstinLookup( req, res ) {
       return res.sendError( 'Unknown state code in GSTIN', 404 );
     }
 
-    // Real lookup via Sheet GST Check (https://gstincheck.co.in/).
-    // Endpoint: GET https://sheet.gstincheck.co.in/check/{API_KEY}/{GSTIN}
-    // Auth: API key embedded in the URL path (no header). Set
-    // GST_LOOKUP_API_KEY in the API's environment.
+    // Real lookup via GST Verify (https://gstverify.co.in/).
+    // Endpoint: GET https://gstverify.co.in/api/v1/verify/{GSTIN}
+    // Auth: API key sent in the `X-API-Key` header. Set GST_LOOKUP_API_KEY
+    // in the API's environment.
     const apiKey = process.env.GST_LOOKUP_API_KEY;
-    console.log( '🚀 ~ gstinLookup ~ apiKey:', apiKey );
     if ( !apiKey ) {
       // Fail explicitly rather than silently fall back — that way a missing
       // key shows up immediately instead of mock data leaking into prod.
@@ -992,8 +1010,8 @@ export async function gstinLookup( req, res ) {
     let providerResponse;
     try {
       providerResponse = await axios.get(
-          `https://sheet.gstincheck.co.in/check/${encodeURIComponent( apiKey )}/${encodeURIComponent( gstin )}`,
-          { timeout: 8000 },
+          `https://gstverify.co.in/api/v1/verify/${encodeURIComponent( gstin )}`,
+          { timeout: 8000, headers: { 'X-API-Key': apiKey } },
       );
     } catch ( axiosErr ) {
       // Distinguish provider-down vs other errors so the client can show a
@@ -1008,69 +1026,84 @@ export async function gstinLookup( req, res ) {
     }
 
     const body = providerResponse?.data || {};
-    if ( !body.flag || !body.data ) {
+    if ( !body.success || !body.data ) {
       // Provider reached but couldn't resolve this GSTIN.
       return res.sendError( 'GSTIN not found', 404 );
     }
 
     // Map provider's response shape into the contract the frontend expects.
-    // Provider uses Indian-government short names (lgnm, tradeNam, pradr,
-    // sts, etc.); we normalize to our flat structure.
+    // GST Verify returns a flat object: gstin, legal_name, trade_name,
+    // status, state, pan, and a single concatenated `address` string
+    // (e.g. "123 Business Park, Mumbai — 400001"). We normalize to our
+    // flat structure and parse the address string into the discrete fields
+    // the form needs.
     const src = body.data;
-    // TEMP: full raw response logged so we can confirm field names per
-    // GSTIN — remove once the mapping is verified across a few real cases.
-    logger.error( { function: 'gstinLookup.raw', gstin, providerData: src } );
-
-    const principal = src.pradr || src.pradr1 || {};
-    // The provider has used both `addr` (newer) and a flatter form
-    // (older). Coalesce — `addr` if present, otherwise the principal
-    // itself contains the address fields.
+
+    // Some records may still expose the structured GSTN principal-address
+    // object; prefer explicit fields when present, else parse the string.
+    const principal = src.pradr || {};
     const addr = principal.addr || principal || {};
 
-    // If the provider returned a fully-formed display address string, use
-    // it directly for addressLineOne — that's the canonical comma-joined
-    // address GSTN itself displays. Otherwise build it from the
-    // individual fields. This avoids re-joining in a different order than
-    // the registry intended.
-    const fullAddr = ( principal.adr || principal.address || src.adr || '' ).trim();
+    // Pull the display address, whether it comes back as a plain string or
+    // nested under the structured principal-address object.
+    const fullAddr = String(
+        src.address || principal.adr || principal.address || src.adr || '',
+    ).trim();
+
+    // Pincode: prefer an explicit field, otherwise pull the first 6-digit
+    // run out of the address string.
+    const pinFromString = ( fullAddr.match( /\b(\d{6})\b/ ) || [] )[1] || '';
+    const pinCode = addr.pncd ? String( addr.pncd ) :
+      ( addr.pincode ? String( addr.pincode ) : pinFromString );
+
+    // State: provider's explicit state wins; fall back to our state-code map
+    // so a missing field never blanks out the Place of Supply.
+    const stateValue = src.state || addr.stcd || addr.state || stateName;
+
+    let addressLineOne = '';
+    let addressLineTwo = '';
+    let cityValue = addr.city || addr.dst || addr.loc || '';
 
-    let addressLineOne;
-    let addressLineTwo;
     if ( fullAddr ) {
-      // The registry format is `bno, bnm, flno, st, loc, lndmrk, city,
-      // dst, stcd, pncd`. Split on commas, take the first half for line 1
-      // and the rest (minus city/state/pincode tail which goes to the
-      // separate fields) for line 2. Heuristic: split into two halves.
-      const parts = fullAddr.split( ',' ).map( ( s ) => s.trim() ).filter( Boolean );
+      // Split the display address on commas / em-dash and drop the trailing
+      // tokens that belong in the discrete fields (state, pincode).
+      let parts = fullAddr
+          .split( /[,—-]/ )
+          .map( ( s ) => s.trim() )
+          .filter( Boolean )
+          .filter( ( p ) => !/^\d{6}$/.test( p ) )
+          .filter( ( p ) => p.toLowerCase() !== String( stateValue ).toLowerCase() );
+
+      // Last remaining token is typically the city/district — lift it out
+      // when we don't already have an explicit city.
+      if ( !cityValue && parts.length ) {
+        cityValue = parts[parts.length - 1];
+        parts = parts.slice( 0, -1 );
+      }
+
+      // Split the rest across the two address lines.
       const half = Math.ceil( parts.length / 2 );
       addressLineOne = parts.slice( 0, half ).join( ', ' );
       addressLineTwo = parts.slice( half ).join( ', ' );
-    } else {
+    } else if ( Object.keys( addr ).length ) {
       const line1Parts = [ addr.bno, addr.bnm, addr.flno, addr.st ].filter( ( p ) => p && String( p ).trim() );
       const line2Parts = [ addr.loc, addr.lndmrk, addr.dst ].filter( ( p ) => p && String( p ).trim() );
       addressLineOne = line1Parts.join( ', ' );
       addressLineTwo = line2Parts.join( ', ' );
     }
 
-    // City: prefer explicit `city` / `dst`. Some records put the city
-    // name in `loc` and the colony / sub-area in `dst` — prefer city, but
-    // fall back to dst then loc when missing.
-    const cityValue = addr.city || addr.dst || addr.loc || '';
-
     const data = {
       gstin: src.gstin || gstin,
-      legalName: src.lgnm || src.legalName || '',
-      tradeName: src.tradeNam || src.tradeName || '',
+      legalName: src.legal_name || src.lgnm || src.legalName || '',
+      tradeName: src.trade_name || src.tradeNam || src.tradeName || '',
       addressLineOne,
       addressLineTwo,
       city: cityValue,
-      // Prefer provider's state name; fall back to our state-code map so a
-      // missing field doesn't blank out the Place of Supply.
-      state: addr.stcd || addr.state || stateName,
+      state: stateValue,
       country: 'India',
-      pinCode: addr.pncd ? String( addr.pncd ) : ( addr.pincode ? String( addr.pincode ) : '' ),
-      placeOfSupply: `${addr.stcd || addr.state || stateName} (${code})`,
-      status: src.sts || '',
+      pinCode,
+      placeOfSupply: `${stateValue} (${code})`,
+      status: src.status || src.sts || '',
     };
 
     return res.sendSuccess( data );

package/src/controllers/brandsBilling.controller.js

@@ -428,6 +428,21 @@ export async function brandInvoiceList( req, res ) {
       },
     } ];
 
+    // Invoice type sub-toggle: 'advance' shows only advance invoices (invoice #
+    // starts with 'TINV-'); 'all' shows only regular invoices (NOT TINV-*).
+    // Applied for BOTH tango and client views. Uses $expr + $regexMatch (not the
+    // fragile { $not: <regex> } query operator, which was matching nothing and
+    // hiding every row) and treats a missing invoice # as a regular invoice.
+    if ( req.body.invoiceType === 'advance' ) {
+      query.push( { $match: { $expr: {
+        $regexMatch: { input: { $ifNull: [ '$invoice', '' ] }, regex: '^TINV-' },
+      } } } );
+    } else if ( req.body.invoiceType === 'all' ) {
+      query.push( { $match: { $expr: {
+        $not: { $regexMatch: { input: { $ifNull: [ '$invoice', '' ] }, regex: '^TINV-' } },
+      } } } );
+    }
+
     // Client users only ever see APPROVED invoices — the approval pipeline
     // (pendingCsm/pendingFinance/pendingApproval/pending) is internal to tango
     // and must not be exposed to clients, even in the raw list response.
@@ -451,7 +466,20 @@ export async function brandInvoiceList( req, res ) {
         dateFrom = now.subtract( 12, 'month' ).startOf( 'month' ).toDate();
       }
       if ( dateFrom ) {
-        query.push( { $match: { billingDate: { $gte: dateFrom } } } );
+        // billingDate is stored as a STRING on many invoices (e.g.
+        // "2024-06-10T00:00:00.000Z"), so a plain { $gte: <Date> } compares
+        // string-vs-Date and matches nothing (this is why the client list came
+        // back empty on the default 'prev' filter). Coerce to a date first.
+        query.push( { $match: { $expr: {
+          $gte: [
+            { $cond: [
+              { $eq: [ { $type: '$billingDate' }, 'date' ] },
+              '$billingDate',
+              { $toDate: '$billingDate' },
+            ] },
+            dateFrom,
+          ],
+        } } } );
       }
     }
 
@@ -580,16 +608,18 @@ export async function brandInvoiceList( req, res ) {
     }
 
     // Footer totals are shown in a single ₹ figure, but individual invoices may
-    // be in USD ($). Convert dollar invoices to INR at today's rate before
-    // summing so the ₹ total is correct (mirrors the table's per-invoice symbol
-    // → one combined rupee total).
-    const usdRate = await getUsdInrRate();
-    const toInr = ( inv, value ) => ( inv.currency === 'dollar' ? ( Number( value ) || 0 ) * usdRate : ( Number( value ) || 0 ) );
+    // be in a foreign currency ($, €, S$, AED). Convert each to INR at today's
+    // rate (per-currency, not just USD) before summing so the ₹ total is correct.
+    const rateByCurrency = {};
+    for ( const cur of new Set( allInvoices.map( ( c ) => String( c.currency || 'inr' ) ) ) ) {
+      rateByCurrency[cur] = await getInrRate( cur );
+    }
+    const toInr = ( inv, value ) => ( Number( value ) || 0 ) * ( rateByCurrency[String( inv.currency || 'inr' )] || 1 );
     let summary = {
       totalInvoices: allInvoices.length,
       totalInvoiced: Math.round( allInvoices.reduce( ( sum, inv ) => sum + toInr( inv, inv.totalAmount ), 0 ) ),
       // Footer totals over the FULL filtered set (not just the current page):
-      // stores, amount excl. GST and amount incl. GST (USD → INR converted).
+      // stores, amount excl. GST and amount incl. GST (foreign → INR converted).
       totalStores: allInvoices.reduce( ( sum, inv ) => sum + ( inv.stores || 0 ), 0 ),
       totalAmountExclGst: Math.round( allInvoices.reduce( ( sum, inv ) => sum + toInr( inv, inv.amount ), 0 ) ),
       totalAmountInclGst: Math.round( allInvoices.reduce( ( sum, inv ) => sum + toInr( inv, inv.totalAmount ), 0 ) ),
@@ -598,6 +628,41 @@ export async function brandInvoiceList( req, res ) {
       paid: allInvoices.filter( ( inv ) => inv.paymentStatus === 'paid' ).length,
     };
 
+    // Header cards — Outstanding / Overdue / Pending Payment — each split into a
+    // GST excl (sum of `amount`) and incl (sum of `totalAmount`) figure, all
+    // converted to INR. Same shape/semantics as the All Invoices page cards.
+    const nowDate = new Date();
+    const cards = {
+      outstandingExclAmount: 0, outstandingInclAmount: 0, outstandingCount: 0,
+      overdueExclAmount: 0, overdueInclAmount: 0, overdueCount: 0,
+      pendingPaymentExclAmount: 0, pendingPaymentInclAmount: 0, pendingPaymentCount: 0,
+    };
+    for ( const inv of allInvoices ) {
+      if ( inv.paymentStatus === 'paid' ) {
+        continue;
+      }
+      const excl = toInr( inv, inv.amount );
+      const incl = toInr( inv, inv.totalAmount || inv.amount );
+      cards.outstandingExclAmount += excl;
+      cards.outstandingInclAmount += incl;
+      cards.outstandingCount += 1;
+      if ( inv.dueDate && new Date( inv.dueDate ) < nowDate ) {
+        cards.overdueExclAmount += excl;
+        cards.overdueInclAmount += incl;
+        cards.overdueCount += 1;
+      }
+      if ( inv.status === 'approved' ) {
+        cards.pendingPaymentExclAmount += excl;
+        cards.pendingPaymentInclAmount += incl;
+        cards.pendingPaymentCount += 1;
+      }
+    }
+    for ( const k of Object.keys( cards ) ) {
+      if ( k.endsWith( 'Amount' ) ) {
+        cards[k] = Math.round( cards[k] );
+      }
+    }
+
     if ( req.body.export ) {
       // Mirror the on-screen table exactly: same columns (excl. GST and incl.
       // GST as separate amounts), same currency symbol, and the same status
@@ -653,7 +718,7 @@ export async function brandInvoiceList( req, res ) {
     clientInfo.totalStores = billingGroups.reduce( ( sum, bg ) => sum + ( bg.stores ? bg.stores.length : 0 ), 0 );
     clientInfo.totalGroups = billingGroups.length;
 
-    res.sendSuccess( { clientInfo, summary, count, data: invoiceList } );
+    res.sendSuccess( { clientInfo, summary, cards, count, data: invoiceList } );
   } catch ( error ) {
     logger.error( { error: error, function: 'brandInvoiceList' } );
     return res.sendError( error, 500 );
@@ -688,6 +753,27 @@ export async function latestDailyPricing( req, res ) {
     let stores = record.stores || [];
     let count = stores.length;
 
+    // The daily-pricing store objects don't carry the store's country — it lives
+    // in the stores collection under storeProfile.country. Build a
+    // storeId → country map for this client and stamp `country` onto each store
+    // so the UI can show it as a column and filter by it.
+    const countryByStore = new Map();
+    try {
+      const storeDocs = await storeService.find(
+          { clientId: req.body.clientId },
+          { 'storeId': 1, 'storeProfile.country': 1 },
+      );
+      for ( const s of ( storeDocs || [] ) ) {
+        countryByStore.set( String( s.storeId ), s?.storeProfile?.country || '' );
+      }
+    } catch ( cErr ) {
+      logger.error( { error: cErr, function: 'latestDailyPricing.country', clientId: req.body.clientId } );
+    }
+    stores = stores.map( ( s ) => {
+      const base = s._doc || s;
+      return { ...base, country: countryByStore.get( String( base.storeId ) ) || '' };
+    } );
+
     // statusFilter may be an array (multi-select) or a legacy string. An empty
     // value / empty array means "all statuses".
     const statusFilterList = Array.isArray( req.body.statusFilter ) ?
@@ -698,6 +784,15 @@ export async function latestDailyPricing( req, res ) {
       stores = stores.filter( ( s ) => allowed.has( s.status ) );
     }
 
+    // countryFilter may be an array (multi-select) or a string; empty = all.
+    const countryFilterList = Array.isArray( req.body.countryFilter ) ?
+      req.body.countryFilter.filter( Boolean ) :
+      ( req.body.countryFilter ? [ req.body.countryFilter ] : [] );
+    if ( countryFilterList.length ) {
+      const allowedCountries = new Set( countryFilterList );
+      stores = stores.filter( ( s ) => allowedCountries.has( s.country ) );
+    }
+
     if ( req.body.searchValue && req.body.searchValue !== '' ) {
       const searchRegex = new RegExp( req.body.searchValue, 'i' );
       stores = stores.filter( ( s ) => searchRegex.test( s.storeName ) || searchRegex.test( s.storeId ) );
@@ -708,9 +803,22 @@ export async function latestDailyPricing( req, res ) {
     if ( req.body.sortColumName && req.body.sortColumName !== '' && req.body.sortBy ) {
       const sortKey = req.body.sortColumName;
       const sortDir = req.body.sortBy;
+      // Working days ('daysDifference' — the WORKING DAYS column) is not a
+      // top-level store field; it's per-product (products[].workingdays). So for
+      // that column sort by the store's MAX product working-days. Other columns
+      // (storeName, *CameraCount, zoneCount) sort by their top-level field.
+      const sortVal = ( s ) => {
+        if ( sortKey === 'daysDifference' ) {
+          return ( s.products || [] ).reduce(
+              ( mx, p ) => Math.max( mx, Number( p.workingdays ) || 0 ), 0 );
+        }
+        return s[sortKey];
+      };
       stores.sort( ( a, b ) => {
-        if ( a[sortKey] < b[sortKey] ) return -1 * sortDir;
-        if ( a[sortKey] > b[sortKey] ) return 1 * sortDir;
+        const av = sortVal( a );
+        const bv = sortVal( b );
+        if ( av < bv ) return -1 * sortDir;
+        if ( av > bv ) return 1 * sortDir;
         return 0;
       } );
     }
@@ -720,10 +828,16 @@ export async function latestDailyPricing( req, res ) {
     // BOTH the export and the on-screen table use the same numbers.
     const priceByProduct = {};
     let bpCurrency = 'inr';
+    // Step-pricing support: for STEP clients the per-store price depends on the
+    // store's 1-based POSITION within the product (tier ranges), so we can't use
+    // a single price per product. We pull the tiers here and resolve per-store
+    // prices by position below (mirrors invoice.controller's stepPrice).
+    let isStepClient = false;
+    const stepTiersByProduct = {};
     try {
       const bp = await basePriceService.findOne(
           { clientId: req.body.clientId },
-          { standard: 1, currency: 1 },
+          { standard: 1, step: 1, currency: 1 },
       );
       bpCurrency = bp?.currency || 'inr';
       for ( const p of ( bp?.standard || [] ) ) {
@@ -732,9 +846,48 @@ export async function latestDailyPricing( req, res ) {
           priceByProduct[p.productName] = price;
         }
       }
+      // Client priceType drives whether we use step tiers.
+      const priceClient = await clientService.findOne(
+          { clientId: req.body.clientId }, { priceType: 1 } );
+      isStepClient = priceClient?.priceType === 'step';
+      if ( isStepClient ) {
+        for ( const p of ( bp?.step || [] ) ) {
+          if ( !p.productName ) {
+            continue;
+          }
+          if ( !stepTiersByProduct[p.productName] ) {
+            stepTiersByProduct[p.productName] = [];
+          }
+          stepTiersByProduct[p.productName].push( p );
+        }
+        // Tiers ordered by range start so the position lookup is correct.
+        for ( const name of Object.keys( stepTiersByProduct ) ) {
+          stepTiersByProduct[name].sort( ( a, b ) => {
+            const aStart = parseInt( String( a.storeRange || '0' ).split( '-' )[0], 10 ) || 0;
+            const bStart = parseInt( String( b.storeRange || '0' ).split( '-' )[0], 10 ) || 0;
+            return aStart - bStart;
+          } );
+        }
+      }
     } catch ( bpErr ) {
       logger.error( { error: bpErr, function: 'latestDailyPricing.basePrice', clientId: req.body.clientId } );
     }
+    // Per-store step price by 1-based position within the product. Falls back to
+    // the last tier's price beyond the defined ranges (mirrors invoice stepPrice).
+    const stepPriceForPosition = ( productName, positionInProduct ) => {
+      const tiers = stepTiersByProduct[productName] || [];
+      if ( !tiers.length ) {
+        return 0;
+      }
+      for ( const tier of tiers ) {
+        const [ min, max ] = String( tier.storeRange || '' ).split( '-' ).map( Number );
+        if ( positionInProduct >= min && positionInProduct <= max ) {
+          return Number( tier.negotiatePrice ) || Number( tier.basePrice ) || 0;
+        }
+      }
+      const last = tiers[tiers.length - 1];
+      return Number( last.negotiatePrice ) || Number( last.basePrice ) || 0;
+    };
     // Billing type per product (perStore / perZone / perCamera) from the client
     // plan — drives whether the amount multiplies by camera/zone count. The
     // same client doc supplies the invoice-amount currency below.
@@ -783,8 +936,31 @@ export async function latestDailyPricing( req, res ) {
       }
       return 1;
     };
+    // Step clients: resolve each store's per-product price by its 1-based
+    // POSITION within the product, over the CURRENT SORTED order (so re-sorting
+    // re-tiers the amounts). Built here — after the sort, over the FULL list —
+    // so a store on page 2 still gets the position determined by all preceding
+    // stores. Keyed `storeId||productName`. Standard clients use priceByProduct.
+    const stepPriceByStoreProduct = {};
+    if ( isStepClient ) {
+      const positionByProduct = {};
+      for ( const s of stores ) {
+        for ( const p of ( s.products || [] ) ) {
+          const name = p.productName;
+          positionByProduct[name] = ( positionByProduct[name] || 0 ) + 1;
+          stepPriceByStoreProduct[`${s.storeId}||${name}`] =
+            stepPriceForPosition( name, positionByProduct[name] );
+        }
+      }
+    }
+    const priceForStoreProduct = ( store, product ) => {
+      if ( isStepClient ) {
+        return stepPriceByStoreProduct[`${store.storeId}||${product.productName}`] || 0;
+      }
+      return priceByProduct[product.productName] || 0;
+    };
     const productInvoiceAmount = ( store, product ) => {
-      const price = priceByProduct[product.productName] || 0;
+      const price = priceForStoreProduct( store, product );
       const workingDays = Number( product.workingdays ) || 0;
       if ( price <= 0 || workingDays <= 0 ) {
         return 0;
@@ -859,7 +1035,7 @@ export async function latestDailyPricing( req, res ) {
         invoiceBreakdown.push( {
           productName: product.productName,
           label: prettyProduct( product.productName ),
-          price: priceByProduct[product.productName] || 0,
+          price: priceForStoreProduct( store, product ),
           workingDays: Number( product.workingdays ) || 0,
           amount,
         } );
@@ -928,6 +1104,11 @@ export async function latestDailyPricing( req, res ) {
         .sort( ( a, b ) => a.firstFileDate.localeCompare( b.firstFileDate ) );
     const newlyOnboardedStores = newlyOnboardedStoreList.length;
 
+    // Unique, sorted, non-empty countries across ALL of the client's stores
+    // (from the map above) — feeds the Country filter dropdown independent of
+    // the current page / status / country selection.
+    const countries = [ ...new Set( [ ...countryByStore.values() ].filter( Boolean ) ) ].sort();
+
     let data = {
       clientId: record.clientId,
       brandName: record.brandName,
@@ -938,6 +1119,7 @@ export async function latestDailyPricing( req, res ) {
       status: record.status,
       proRate: record.proRate,
       count,
+      countries,
       newlyOnboardedStores,
       newlyOnboardedStoreList,
       data: storeList,
@@ -1709,30 +1891,77 @@ export async function bulkUpdateBillingGroups( req, res ) {
 // including the current. Filtering/sorting happen client-side (the dataset
 // is one row per client).
 // ---------------------------------------------------------------------------
+// Live USD-based FX rates (cached 6h) from open.er-api.com. The response gives
+// every currency relative to USD (rates.INR, rates.EUR, rates.SGD, …), so we
+// cache the whole table and derive any currency→INR rate as rates.INR / rates.X.
+let fxRatesCache = { rates: null, at: 0 };
+async function getUsdRates() {
+  if ( fxRatesCache.rates && ( Date.now() - fxRatesCache.at ) < 6 * 60 * 60 * 1000 ) {
+    return fxRatesCache.rates;
+  }
+  try {
+    const resp = await fetch( 'https://open.er-api.com/v6/latest/USD', { signal: AbortSignal.timeout( 4000 ) } );
+    const body = await resp.json();
+    if ( body?.rates && Number( body.rates.INR ) > 0 ) {
+      fxRatesCache = { rates: body.rates, at: Date.now() };
+      return body.rates;
+    }
+  } catch ( err ) {
+    logger.error( { error: err, function: 'getUsdRates' } );
+  }
+  return fxRatesCache.rates; // may be null on cold-start failure
+}
+
 // Today's USD->INR rate for dollar-priced clients. Live rate (cached 6h)
 // with an env override (USD_INR_RATE) and a last-known/static fallback so
 // the summary never fails because a rate API is down.
-let usdRateCache = { rate: null, at: 0 };
 export async function getUsdInrRate() {
   const override = Number( process.env.USD_INR_RATE );
   if ( override > 0 ) {
     return override;
   }
-  if ( usdRateCache.rate && ( Date.now() - usdRateCache.at ) < 6 * 60 * 60 * 1000 ) {
-    return usdRateCache.rate;
+  const rates = await getUsdRates();
+  const rate = Number( rates?.INR );
+  return rate > 0 ? rate : 83.33;
+}
+
+// The app's own currency codes → ISO codes used by the FX API.
+const CURRENCY_ISO = { inr: 'INR', dollar: 'USD', usd: 'USD', euro: 'EUR', eur: 'EUR', singaporedollar: 'SGD', sgd: 'SGD', aed: 'AED' };
+// Static last-resort rates (currency→INR) if the FX API is unreachable on a
+// cold start. Approximate; only used so totals aren't wildly wrong.
+const FALLBACK_INR = { INR: 1, USD: 83.33, EUR: 90, SGD: 62, AED: 22.7 };
+
+// Multiplier to convert an amount in `currency` to INR. INR → 1. Unknown
+// currencies fall back to 1 (treated as already-INR) so nothing is dropped.
+export async function getInrRate( currency ) {
+  const iso = CURRENCY_ISO[String( currency || '' ).toLowerCase()];
+  if ( !iso || iso === 'INR' ) {
+    return 1;
+  }
+  const rates = await getUsdRates();
+  const inr = Number( rates?.INR );
+  const cur = Number( rates?.[iso] );
+  if ( inr > 0 && cur > 0 ) {
+    return inr / cur; // 1 <currency> = (INR per USD) / (currency per USD) INR
   }
+  return FALLBACK_INR[iso] || 1;
+}
+
+// FX rates for the app's supported currencies, expressed as INR-per-1-unit.
+// The UI converts an amount from currency A to B as: amount * (rates[A] / rates[B]).
+// Reuses the cached live rates (getInrRate); inr is always 1.
+export async function fxRates( req, res ) {
   try {
-    const resp = await fetch( 'https://open.er-api.com/v6/latest/USD', { signal: AbortSignal.timeout( 4000 ) } );
-    const body = await resp.json();
-    const rate = Number( body?.rates?.INR );
-    if ( rate > 0 ) {
-      usdRateCache = { rate, at: Date.now() };
-      return rate;
+    const codes = [ 'inr', 'dollar', 'singaporedollar', 'euro', 'aed' ];
+    const rates = {};
+    for ( const c of codes ) {
+      rates[c] = await getInrRate( c );
     }
-  } catch ( err ) {
-    logger.error( { error: err, function: 'getUsdInrRate' } );
+    return res.sendSuccess( { rates } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'fxRates' } );
+    return res.sendError( error, 500 );
   }
-  return usdRateCache.rate || 83.33;
 }
 
 export async function billingSummary( req, res ) {
@@ -2769,36 +2998,84 @@ export async function additionalProductExport( req, res ) {
         'Subjective-Refraction', 'Trial-Frame', 'VA-Check',
       ];
       const fromDate = dayjs( reqDate ).startOf( 'month' ).format( 'YYYY-MM-DD' );
-      let optomHits = [];
-      let scrollId = null;
+      const HEADER_COLUMNS = [
+        'storeName', 'engagementId', 'queue_id', 'optm_name', 'optm_id',
+        'optm_Emailid', 'Date', 'StartTime', 'EndTime', 'Duration (min)',
+        ...STEP_COLUMNS,
+      ];
+      // Flatten one OpenSearch hit into a row array aligned with HEADER_COLUMNS.
+      const hitToRow = ( h ) => {
+        const s = h._source || {};
+        const steps = s.steps || {};
+        return [
+          s.storeName || '', s.engagementId || '', s.queue_id || '',
+          s.optm_name || '', s.optm_id || '', s.optm_Emailid || '',
+          s.Date || '', s.StartTime || '', s.EndTime || '',
+          s['Duration (min)'] != null ? s['Duration (min)'] : '',
+          ...STEP_COLUMNS.map( ( col ) => ( steps[col] === true ? 'TRUE' : 'FALSE' ) ),
+        ];
+      };
+
+      // NOTE: do NOT sort on StartTime — it's an analyzed text field, and sorting
+      // on it makes OpenSearch return ZERO hits. Date is a keyword (YYYY-MM-DD),
+      // so the month-to-date span is a lexical range; rows come back in index
+      // order. A whole month can be hundreds of thousands of records, so we scroll
+      // through pages AND stream each page straight into an ExcelJS streaming
+      // workbook — building the full .xlsx in memory (the old excel4node path)
+      // blew the heap / gateway timeout at this scale, causing 502s.
+      let firstRes;
       try {
-        // A month-to-date span can exceed the 10k max_result_window, so scroll
-        // through all pages. Date is a keyword (YYYY-MM-DD) → the span is a lexical
-        // range. NOTE: do NOT sort on StartTime — it's an analyzed text field, and
-        // sorting on it makes OpenSearch return ZERO hits. The range filter is
-        // enough; rows come back in index order.
-        let osRes = await searchOpenSearchData( 'remote_optom_steps_summary', {
+        firstRes = await searchOpenSearchData( 'remote_optom_steps_summary', {
           size: 10000,
           query: { range: { 'Date': { gte: fromDate, lte: reqDate } } },
         } );
-        let body = osRes?.body || osRes;
-        let hits = body?.hits?.hits || [];
-        scrollId = body?._scroll_id;
+      } catch ( osErr ) {
+        logger.error( { error: osErr, function: 'additionalProductExport.remoteOptum', clientId } );
+        return res.sendError( 'Failed to fetch Remote Optum data', 502 );
+      }
+      let body = firstRes?.body || firstRes;
+      let hits = body?.hits?.hits || [];
+      let scrollId = body?._scroll_id;
+      // Nothing to export — respond BEFORE any stream headers are sent.
+      if ( !hits.length ) {
+        if ( scrollId ) {
+          try {
+            await clearScroll( scrollId );
+          } catch ( clearErr ) {
+            logger.error( { error: clearErr, function: 'additionalProductExport.remoteOptum.clearScroll' } );
+          }
+        }
+        return res.sendError( 'No data', 204 );
+      }
+
+      // From here the response is a streamed workbook; headers are committed, so
+      // a mid-stream failure can only abort the connection, not send a new status.
+      res.setHeader( 'Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' );
+      res.setHeader( 'Content-Disposition', `attachment; filename="Remote Optum-${clientId}.xlsx"` );
+      const workbook = new ExcelJS.stream.xlsx.WorkbookWriter( { stream: res, useStyles: false } );
+      const ws = workbook.addWorksheet( 'Worksheet Name' );
+      ws.addRow( HEADER_COLUMNS ).commit();
+      try {
         while ( hits.length ) {
-          optomHits.push( ...hits );
+          for ( const h of hits ) {
+            ws.addRow( hitToRow( h ) ).commit();
+          }
           if ( !scrollId ) {
             break;
           }
-          osRes = await scrollResponse( scrollId );
+          const osRes = await scrollResponse( scrollId );
           body = osRes?.body || osRes;
           hits = body?.hits?.hits || [];
           scrollId = body?._scroll_id || scrollId;
         }
-      } catch ( osErr ) {
-        logger.error( { error: osErr, function: 'additionalProductExport.remoteOptum', clientId } );
-        return res.sendError( 'Failed to fetch Remote Optum data', 502 );
+        ws.commit();
+        await workbook.commit();
+      } catch ( streamErr ) {
+        // Headers are already sent — log and tear down the connection so the
+        // client sees a failed/aborted download rather than a truncated file.
+        logger.error( { error: streamErr, function: 'additionalProductExport.remoteOptum.stream', clientId } );
+        res.destroy( streamErr );
       } finally {
-        // Free the scroll context; ignore failures (context may already be gone).
         if ( scrollId ) {
           try {
             await clearScroll( scrollId );
@@ -2807,32 +3084,6 @@ export async function additionalProductExport( req, res ) {
           }
         }
       }
-
-      const exportData = optomHits.map( ( h ) => {
-        const s = h._source || {};
-        const steps = s.steps || {};
-        const row = {
-          'storeName': s.storeName || '',
-          'engagementId': s.engagementId || '',
-          'queue_id': s.queue_id || '',
-          'optm_name': s.optm_name || '',
-          'optm_id': s.optm_id || '',
-          'optm_Emailid': s.optm_Emailid || '',
-          'Date': s.Date || '',
-          'StartTime': s.StartTime || '',
-          'EndTime': s.EndTime || '',
-          'Duration (min)': s['Duration (min)'] != null ? s['Duration (min)'] : '',
-        };
-        for ( const col of STEP_COLUMNS ) {
-          row[col] = steps[col] === true ? 'TRUE' : 'FALSE';
-        }
-        return row;
-      } );
-
-      if ( !exportData.length ) {
-        return res.sendError( 'No data', 204 );
-      }
-      await download( exportData, res );
       return;
     }
 

package/src/controllers/estimate.controller.js

@@ -2,7 +2,7 @@ import * as estimateService from '../services/estimate.service.js';
 import * as clientService from '../services/clientPayment.services.js';
 import * as billingService from '../services/billing.service.js';
 import dayjs from 'dayjs';
-import { logger, download, sendEmailWithSES } from 'tango-app-api-middleware';
+import { logger, download, sendEmailWithSES, insertOpenSearchData } from 'tango-app-api-middleware';
 import Handlebars from '../utils/validations/helper/handlebar.helper.js';
 import fs from 'fs';
 import path from 'path';
@@ -17,6 +17,9 @@ async function buildEstimatePdf( estimate ) {
   const currencyType = symbolFor( e.currency );
   const fmt = ( n ) => Number( n || 0 ).toLocaleString( 'en-IN', { minimumFractionDigits: 2, maximumFractionDigits: 2 } );
 
+  // Month per line item, mirroring the invoice PDF's Month column: use the
+  // product's stored month, else fall back to the estimate's created month.
+  const fallbackMonth = e.createdDate ? dayjs( e.createdDate ).format( 'MMM YYYY' ) : '';
   const products = ( e.products || [] ).map( ( p, i ) => {
     let name = String( p.productName || '' ).replace( /([a-z])([A-Z])/g, '$1 $2' );
     name = name.charAt( 0 ).toUpperCase() + name.slice( 1 );
@@ -24,6 +27,7 @@ async function buildEstimatePdf( estimate ) {
       index: i + 1,
       productName: name,
       description: p.description || '',
+      month: p.month || fallbackMonth,
       hsn: p.hsn || p.hsnCode || '998314',
       storeCount: p.storeCount || e.stores || '',
       price: fmt( p.price ),
@@ -36,7 +40,7 @@ async function buildEstimatePdf( estimate ) {
     taxAmount: fmt( t.taxAmount ),
   } ) );
 
-  const statusLabelMap = { pending: 'Pending', sent: 'Sent', accepted: 'Accepted', declined: 'Declined', expired: 'Expired' };
+  const statusLabelMap = { pendingCsm: 'Pending CSM', pendingFinance: 'Pending Finance', pendingApproval: 'Pending Approval', approved: 'Approved', pending: 'Pending CSM' };
   const data = {
     estimate: e.estimate,
     status: e.status,
@@ -106,26 +110,19 @@ async function nextEstimateNumber() {
   };
 }
 
-// Expire stale estimates lazily on read: anything sent/draft past validTill
-// flips to 'expired' so the list reflects reality without a cron.
-async function expireOverdue( clientId ) {
-  await estimateService.updateOne(
-      { clientId, status: { $in: [ 'pending', 'sent' ] }, validTill: { $lt: new Date() } },
-      { $set: { status: 'expired' } },
-  );
-}
-
 export async function estimateList( req, res ) {
   try {
     const clientId = req.body?.clientId;
     if ( !clientId ) {
       return res.sendError( 'clientId is required', 400 );
     }
-    await expireOverdue( clientId );
 
     const match = { clientId };
     if ( req.body?.status && req.body.status !== 'All' ) {
-      match.status = req.body.status;
+      // Legacy 'pending' estimates are equivalent to the first CSM stage.
+      match.status = req.body.status === 'pendingCsm' ?
+        { $in: [ 'pendingCsm', 'pending' ] } :
+        req.body.status;
     }
 
     // Optional month / year filter on the estimate period (stored as a
@@ -186,10 +183,12 @@ export async function estimateList( req, res ) {
       { $match: { clientId } },
       { $group: { _id: '$status', count: { $sum: 1 } } },
     ] );
-    const counts = { pending: 0, sent: 0, accepted: 0, declined: 0, expired: 0, total: 0 };
+    const counts = { pendingCsm: 0, pendingFinance: 0, pendingApproval: 0, approved: 0, total: 0 };
     statusAgg.forEach( ( s ) => {
-      if ( counts[s._id] != null ) {
-        counts[s._id] = s.count;
+      // Fold legacy 'pending' into the CSM stage.
+      const key = s._id === 'pending' ? 'pendingCsm' : s._id;
+      if ( counts[key] != null ) {
+        counts[key] += s.count;
       }
       counts.total += s.count;
     } );
@@ -244,7 +243,8 @@ export async function createEstimate( req, res ) {
       amount,
       totalAmount,
       currency: estimateCurrency,
-      status: b.status === 'sent' ? 'sent' : 'pending',
+      // Estimates enter the approval pipeline at the CSM stage.
+      status: 'pendingCsm',
       createdDate,
       validTill,
       createdBy: req.user?.email || req.user?.userName || '',
@@ -374,6 +374,100 @@ export async function downloadEstimate( req, res ) {
   }
 }
 
+// Advance an estimate one stage in the approval pipeline
+// (pendingCsm → pendingFinance → pendingApproval → approved), mirroring
+// transitionInvoiceStatus. On the FINAL transition to 'approved' the estimate
+// PDF is emailed to the billing group recipients (same logic as the old
+// approve-and-send). A wrong current status returns 409.
+async function transitionEstimateStatus( req, res, fromStatus, toStatus ) {
+  try {
+    const { estimateId } = req.body || {};
+    if ( !estimateId ) {
+      return res.sendError( 'estimateId is required', 400 );
+    }
+    const estimate = await estimateService.findOne( { _id: estimateId } );
+    if ( !estimate ) {
+      return res.sendError( 'Estimate not found', 404 );
+    }
+    const e = estimate._doc || estimate;
+
+    // Legacy 'pending' estimates are equivalent to the first CSM stage.
+    const acceptedFrom = fromStatus === 'pendingCsm' ? [ 'pendingCsm', 'pending' ] : [ fromStatus ];
+    if ( !acceptedFrom.includes( e.status ) ) {
+      return res.sendError(
+          `Estimate is currently at status '${e.status}', not '${fromStatus}'. Another user may have advanced it.`,
+          409,
+      );
+    }
+
+    await estimateService.updateOne( { _id: estimateId }, { $set: { status: toStatus } } );
+
+    insertOpenSearchData( JSON.parse( process.env.OPENSEARCH ).activityLog, {
+      userName: req.user?.userName,
+      email: req.user?.email,
+      clientId: e.clientId,
+      logSubType: 'estimateStatusTransition',
+      logType: 'estimate',
+      date: new Date(),
+      changes: [ `Estimate ${e.estimate} advanced from ${fromStatus} to ${toStatus} by ${req.user?.email}` ],
+      eventType: '',
+      timestamp: new Date(),
+      showTo: [ 'tango' ],
+    } );
+
+    // Final approval → email the estimate PDF to the billing group recipients.
+    // Non-fatal: a send failure is logged but the approval still stands.
+    if ( toStatus === 'approved' ) {
+      try {
+        let toEmails = [];
+        if ( e.groupId ) {
+          const group = await billingService.findOne( { _id: e.groupId } );
+          toEmails = ( group?.generateInvoiceTo || [] ).map( ( x ) => String( x || '' ).trim() ).filter( Boolean );
+        }
+        toEmails = [ ...new Set( toEmails ) ];
+        if ( toEmails.length ) {
+          const ccRaw = await getInvoiceCcEmails( e.clientId );
+          const toSet = new Set( toEmails.map( ( x ) => x.toLowerCase() ) );
+          const ccEmails = [ ...new Set( ( ccRaw || [] ).map( ( x ) => String( x || '' ).trim() ).filter( Boolean ) ) ]
+              .filter( ( x ) => !toSet.has( x.toLowerCase() ) );
+          const { pdfBuffer, filename, data } = await buildEstimatePdf( estimate );
+          const client = await clientService.findOne( { clientId: e.clientId }, { clientName: 1 } );
+          const emailData = { ...data, clientName: client?.clientName || e.companyName || 'Customer', companyName: 'Team Tango' };
+          const emailHtml = Handlebars.compile(
+              fs.readFileSync( path.resolve( path.dirname( '' ) ) + '/src/hbs/estimateEmail.hbs', 'utf8' ),
+          )( emailData );
+          const SES = JSON.parse( process.env.SES );
+          const fromEmail = SES.accountsEmail || SES.adminEmail;
+          const subject = `Estimate ${e.estimate} - Tango/${client?.clientName || e.companyName || ''}`;
+          const attachment = { filename, content: pdfBuffer, contentType: 'application/pdf' };
+          await sendEmailWithSES( toEmails, subject, emailHtml, attachment, fromEmail, ccEmails.length ? ccEmails : undefined );
+        } else {
+          logger.info?.( { function: 'transitionEstimateStatus', estimateId, message: 'No recipients configured; approval email skipped.' } );
+        }
+      } catch ( mailErr ) {
+        logger.error( { error: mailErr, function: 'transitionEstimateStatus.email', estimateId } );
+      }
+    }
+
+    return res.sendSuccess( { estimateId, fromStatus, status: toStatus } );
+  } catch ( error ) {
+    logger.error( { error: error, function: 'transitionEstimateStatus', fromStatus, toStatus, estimateId: req.body?.estimateId } );
+    return res.sendError( error, 500 );
+  }
+}
+
+export async function approveEstimateCsm( req, res ) {
+  return transitionEstimateStatus( req, res, 'pendingCsm', 'pendingFinance' );
+}
+
+export async function approveEstimateFinance( req, res ) {
+  return transitionEstimateStatus( req, res, 'pendingFinance', 'pendingApproval' );
+}
+
+export async function approveEstimateApproval( req, res ) {
+  return transitionEstimateStatus( req, res, 'pendingApproval', 'approved' );
+}
+
 // Approve & send an estimate: render the PDF, email it (with the PDF attached)
 // to the billing group's recipients — same recipient logic as invoice send —
 // then flip the status to 'sent'. Triggered by the Approve action's confirm.

package/src/controllers/invoice.controller.js

@@ -18,7 +18,7 @@ import { invoiceStatusEnum } from '../dtos/validation.dtos.js';
 import { findOneApplicationDefault } from '../services/applicationDefault.service.js';
 import * as assignedStoreService from '../services/assignedStore.service.js';
 import * as bankTransactionService from '../services/bankTransaction.service.js';
-import { getUsdInrRate, getAdditionalProducts } from './brandsBilling.controller.js';
+import { getInrRate, getAdditionalProducts } from './brandsBilling.controller.js';
 import { applyInvoiceToPurchaseOrder } from './purchaseOrder.controller.js';
 
 // Pulls CSM + Finance head emails (stored under applicationDefault
@@ -315,7 +315,7 @@ export async function createInvoice( req, res ) {
         // Scope additional-product quantities to this billing group's assigned
         // stores (group.stores). Without this the counts span the whole brand
         // and every group's invoice would be billed for all stores.
-        const extraProducts = await getAdditionalProducts( group.clientId, group.stores );
+        const extraProducts = await getAdditionalProducts( group.clientId, group.stores, baseDate );
         for ( const ep of extraProducts ) {
           // Skip additional products with no billable quantity — an Eyetest /
           // Planogram / AI Manager / VMS line that resolved to 0 stores for this
@@ -1280,7 +1280,8 @@ async function resolveBasePricingScope( group, getClient ) {
 
 async function standardPrice( group, getClient, baseDate ) {
   console.log( '🚀 ~ standardPrice ~ baseDate:', baseDate.format( 'MMM YYYY' ) );
-  const currentMonthDays = dayjs().daysInMonth();
+  const currentMonthDays = 30;
+  console.log( '🚀 ~ standardPrice ~ currentMonthDays:', currentMonthDays );
   // Pricing method: 'flat' => bill every store for the full month
   // regardless of working days. 'prorate' => bill for actual working days.
   // Computed once so the aggregation pipelines can inline a $literal.
@@ -2011,6 +2012,16 @@ export async function clientInvoiceList( req, res ) {
       },
     } ];
 
+    // Invoice type sub-toggle: 'advance' shows only advance invoices (invoice #
+    // starts with 'TINV-'); 'all' (default) shows only regular invoices (INV-*),
+    // i.e. everything that is NOT a TINV-. Applied to the whole pipeline so the
+    // list, count and cards all reflect the selected type.
+    if ( req.body.invoiceType === 'advance' ) {
+      query.push( { $match: { invoice: { $regex: '^TINV-' } } } );
+    } else if ( req.body.invoiceType === 'all' ) {
+      query.push( { $match: { invoice: { $not: { $regex: '^TINV-' } } } } );
+    }
+
     // If the user picked an explicit Month or Year, ignore the Duration
     // filter — otherwise the two ranges conflict (e.g. "current month" +
     // April would always return zero results). Mirrors brand-invoices.
@@ -2248,30 +2259,49 @@ export async function clientInvoiceList( req, res ) {
     // converted to INR at today's rate so all three totals are a single ₹
     // figure. Outstanding = unpaid remaining (totalAmount - paidAmount);
     // Overdue = past-due unpaid subset; Pending Payment = approved-but-unpaid.
-    const usdRate = await getUsdInrRate();
     const now = new Date();
+    // Convert every non-INR invoice to INR so the ₹ card totals are comparable.
+    // Resolve one rate per distinct currency present (dollar, euro, sgd, aed, …)
+    // via getInrRate, so euro/others are converted too — not just dollar.
+    const rateByCurrency = {};
+    for ( const cur of new Set( count.map( ( c ) => String( c.currency || 'inr' ) ) ) ) {
+      rateByCurrency[cur] = await getInrRate( cur );
+    }
+    // Each card carries the total remaining (incl. GST, net of payments — the
+    // *Amount fields, kept for back-compat) PLUS a GST split of the GROSS invoice
+    // figures: *ExclAmount = sum of `amount` (pre-tax subtotal), *InclAmount =
+    // sum of `totalAmount` (with tax), matching the table's Excl/Incl columns.
     const cards = {
-      outstandingAmount: 0, outstandingCount: 0,
-      overdueAmount: 0, overdueCount: 0,
-      pendingPaymentAmount: 0, pendingPaymentCount: 0,
+      outstandingAmount: 0, outstandingExclAmount: 0, outstandingInclAmount: 0, outstandingCount: 0,
+      overdueAmount: 0, overdueExclAmount: 0, overdueInclAmount: 0, overdueCount: 0,
+      pendingPaymentAmount: 0, pendingPaymentExclAmount: 0, pendingPaymentInclAmount: 0, pendingPaymentCount: 0,
     };
     for ( const inv of count ) {
       if ( inv.paymentStatus === 'paid' ) {
         continue;
       }
-      const fx = inv.currency === 'dollar' ? usdRate : 1;
+      const fx = rateByCurrency[String( inv.currency || 'inr' )] || 1;
       const total = Number( inv.totalAmount ) || Number( inv.amount ) || 0;
       const paid = Number( inv.paidAmount ) || 0;
       const remaining = Math.max( 0, total - paid ) * fx;
+      // Gross GST split (FX-normalised to INR): excl = subtotal, incl = with tax.
+      const exclGross = ( Number( inv.amount ) || 0 ) * fx;
+      const inclGross = ( Number( inv.totalAmount ) || Number( inv.amount ) || 0 ) * fx;
 
       cards.outstandingAmount += remaining;
+      cards.outstandingExclAmount += exclGross;
+      cards.outstandingInclAmount += inclGross;
       cards.outstandingCount += 1;
       if ( inv.dueDate && new Date( inv.dueDate ) < now ) {
         cards.overdueAmount += remaining;
+        cards.overdueExclAmount += exclGross;
+        cards.overdueInclAmount += inclGross;
         cards.overdueCount += 1;
       }
       if ( inv.status === 'approved' ) {
         cards.pendingPaymentAmount += remaining;
+        cards.pendingPaymentExclAmount += exclGross;
+        cards.pendingPaymentInclAmount += inclGross;
         cards.pendingPaymentCount += 1;
       }
     }
@@ -2280,6 +2310,12 @@ export async function clientInvoiceList( req, res ) {
     cards.outstandingAmount = roundAmount( cards.outstandingAmount, 'inr' );
     cards.overdueAmount = roundAmount( cards.overdueAmount, 'inr' );
     cards.pendingPaymentAmount = roundAmount( cards.pendingPaymentAmount, 'inr' );
+    cards.outstandingExclAmount = roundAmount( cards.outstandingExclAmount, 'inr' );
+    cards.outstandingInclAmount = roundAmount( cards.outstandingInclAmount, 'inr' );
+    cards.overdueExclAmount = roundAmount( cards.overdueExclAmount, 'inr' );
+    cards.overdueInclAmount = roundAmount( cards.overdueInclAmount, 'inr' );
+    cards.pendingPaymentExclAmount = roundAmount( cards.pendingPaymentExclAmount, 'inr' );
+    cards.pendingPaymentInclAmount = roundAmount( cards.pendingPaymentInclAmount, 'inr' );
 
     res.sendSuccess( { count: count.length, data: invoiceList, cards } );
   } catch ( error ) {

package/src/hbs/estimatePdf.hbs

@@ -1540,6 +1540,18 @@
                         </div>
                         {{/each}}
                     </div>
+                    <div class="column2">
+                        <div class="table-header-cell2">
+                            <div class="table-header2">
+                                <div class="text6">Month</div>
+                            </div>
+                        </div>
+                        {{#each products}}
+                        <div class="table-cell4">
+                            <div class="text7">{{month}}</div>
+                        </div>
+                        {{/each}}
+                    </div>
                     <div class="column2">
                         <div class="table-header-cell2">
                             <div class="table-header2">

package/src/routes/brandsBilling.routes.js

@@ -1,20 +1,21 @@
 
 import express from 'express';
-import { brandsBillingList, brandInvoiceList, latestDailyPricing, brandBillingGroups, updateDailyPricingWorkingDays, updateDailyPricingStoreField, getClientBillingInfo, bulkDownloadBillingGroups, bulkUpdateBillingGroups, billingSummary, additionalProducts, additionalProductExport } from '../controllers/brandsBilling.controller.js';
+import { brandsBillingList, brandInvoiceList, latestDailyPricing, brandBillingGroups, updateDailyPricingWorkingDays, updateDailyPricingStoreField, getClientBillingInfo, bulkDownloadBillingGroups, bulkUpdateBillingGroups, billingSummary, additionalProducts, additionalProductExport, fxRates } from '../controllers/brandsBilling.controller.js';
 import { isAllowedSessionHandler, accessVerification } from 'tango-app-api-middleware';
 
 export const brandsBillingRouter = express.Router();
 
-brandsBillingRouter.post( '/brandsBillingList', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), brandsBillingList );
+brandsBillingRouter.post( '/brandsBillingList', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [] } ] } ), brandsBillingList );
 brandsBillingRouter.post( '/brandInvoiceList', isAllowedSessionHandler, accessVerification( { userType: [ 'tango', 'client' ], access: [ ] } ), brandInvoiceList );
-brandsBillingRouter.post( '/latestDailyPricing', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), latestDailyPricing );
-brandsBillingRouter.post( '/brandBillingGroups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), brandBillingGroups );
-brandsBillingRouter.put( '/updateDailyPricingWorkingDays', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), updateDailyPricingWorkingDays );
-brandsBillingRouter.put( '/updateDailyPricingStoreField', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), updateDailyPricingStoreField );
-brandsBillingRouter.post( '/getClientBillingInfo', isAllowedSessionHandler, accessVerification( { userType: [ 'tango', 'client' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), getClientBillingInfo );
-brandsBillingRouter.get( '/bulk-download-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), bulkDownloadBillingGroups );
-brandsBillingRouter.post( '/bulk-update-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), bulkUpdateBillingGroups );
-brandsBillingRouter.post( '/billingSummary', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), billingSummary );
-brandsBillingRouter.get( '/billingSummary', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), billingSummary );
-brandsBillingRouter.get( '/additionalProducts', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), additionalProducts );
-brandsBillingRouter.get( '/additionalProductExport', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), additionalProductExport );
+brandsBillingRouter.post( '/latestDailyPricing', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [] } ] } ), latestDailyPricing );
+brandsBillingRouter.post( '/brandBillingGroups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [] } ] } ), brandBillingGroups );
+brandsBillingRouter.put( '/updateDailyPricingWorkingDays', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [ 'isEdit' ] } ] } ), updateDailyPricingWorkingDays );
+brandsBillingRouter.put( '/updateDailyPricingStoreField', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [ 'isEdit' ] } ] } ), updateDailyPricingStoreField );
+brandsBillingRouter.post( '/getClientBillingInfo', isAllowedSessionHandler, accessVerification( { userType: [ 'tango', 'client' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [] } ] } ), getClientBillingInfo );
+brandsBillingRouter.get( '/bulk-download-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [ 'isEdit' ] } ] } ), bulkDownloadBillingGroups );
+brandsBillingRouter.post( '/bulk-update-billing-groups', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [ 'isEdit' ] } ] } ), bulkUpdateBillingGroups );
+brandsBillingRouter.post( '/billingSummary', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [] } ] } ), billingSummary );
+brandsBillingRouter.get( '/billingSummary', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [] } ] } ), billingSummary );
+brandsBillingRouter.get( '/additionalProducts', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [] } ] } ), additionalProducts );
+brandsBillingRouter.get( '/additionalProductExport', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [] } ] } ), additionalProductExport );
+brandsBillingRouter.get( '/fxRates', isAllowedSessionHandler, accessVerification( { userType: [ 'tango', 'client' ], access: [ { featureName: 'TangoAdmin', name: 'EditBilling', permissions: [] } ] } ), fxRates );

package/src/routes/invoice.routes.js

@@ -3,7 +3,7 @@ import { createInvoice, invoiceDownload, invoiceDownloadBulk, clientInvoiceList,
 import { isAllowedSessionHandler, accessVerification, validate } from 'tango-app-api-middleware';
 import { getInvoiceHeads, updateInvoiceHeads } from '../controllers/applicationDefault.controllers.js';
 import { uploadBankStatement, bankTransactionList, resolveOptions, resolveBankTransaction } from '../controllers/bankTransaction.controller.js';
-import { estimateList, createEstimate, updateEstimate, getEstimate, estimateStatusUpdate, deleteEstimate, downloadEstimate, sendEstimate } from '../controllers/estimate.controller.js';
+import { estimateList, createEstimate, updateEstimate, getEstimate, deleteEstimate, downloadEstimate, approveEstimateCsm, approveEstimateFinance, approveEstimateApproval } from '../controllers/estimate.controller.js';
 import { updateInvoiceHeadsSchema } from '../dtos/validation.dtos.js';
 export const invoiceRouter = express.Router();
 
@@ -58,9 +58,10 @@ invoiceRouter.post( '/bankStatement/resolve', isAllowedSessionHandler, superadmi
 // lifecycle. List/get are read; create/status/delete need edit rights.
 invoiceRouter.post( '/estimate/list', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), estimateList );
 invoiceRouter.post( '/estimate/create', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), createEstimate );
+invoiceRouter.post( '/estimate/approveCsm', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'csmApproval', permissions: [ 'isEdit' ] } ] } ), approveEstimateCsm );
+invoiceRouter.post( '/estimate/approveFinance', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'financeApproval', permissions: [ 'isEdit' ] } ] } ), approveEstimateFinance );
+invoiceRouter.post( '/estimate/approveApproval', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), approveEstimateApproval );
 invoiceRouter.post( '/estimate/update', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), updateEstimate );
-invoiceRouter.post( '/estimate/send', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), sendEstimate );
 invoiceRouter.post( '/estimate/download/:estimateId', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), downloadEstimate );
 invoiceRouter.get( '/estimate/:estimateId', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [] } ] } ), getEstimate );
-invoiceRouter.post( '/estimate/statusUpdate', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), estimateStatusUpdate );
 invoiceRouter.delete( '/estimate/:estimateId', isAllowedSessionHandler, superadminBypass( { userType: [ 'tango' ], access: [ { featureName: 'TangoAdmin', name: 'invoiceApproval', permissions: [ 'isEdit' ] } ] } ), deleteEstimate );