docs(monitoring): Docker Desktop local-run notes (host-metrics profile)

- node-exporter + cadvisor need Linux rootfs mounts (fail on Docker
  Desktop) — moved to 'host-metrics' profile; VPS command updated
- loki 3.5: ingestion_burstsize_mb → ingestion_burst_size_mb
- prometheus joins erp_shared so job 'erp-api' resolves (verified: up=1)

.env.example

@@ -0,0 +1,71 @@
+# ============================================================
+# ERP stack configuration — copy to .env and fill in real values.
+# .env is git-ignored; NEVER commit real credentials.
+#   Local dev:      cp .env.example .env   (defaults work as-is)
+#   Production VPS: /srv/erp/.env with STRONG values for every entry —
+#                   docker-compose.prod.yml refuses to boot without them.
+# ============================================================
+
+# --- Public hosts (production; local defaults live in docker-compose.yml) ---
+APP_HOST=aramesh.bennu-api-bahrestan.ir
+API_HOST=api.bennu-api-bahrestan.ir
+AUTH_HOST=casdoor.bennu-api-bahrestan.ir
+S3_HOST=s3.bennu-api-bahrestan.ir
+STORAGE_HOST=storage.bennu-api-bahrestan.ir
+
+# --- Traefik / Let's Encrypt ---
+TRAEFIK_ACME_EMAIL=you@example.com
+
+# --- Environment: "prod" enables the fail-fast startup checks in the API ---
+ENVIRONMENT=prod
+
+# --- PostgreSQL (app + Casdoor share the instance) ---
+POSTGRES_PASSWORD=CHANGE_ME_strong_db_password
+
+# --- MinIO object storage root credentials ---
+MINIO_ROOT_USER=CHANGE_ME_minio_user
+MINIO_ROOT_PASSWORD=CHANGE_ME_long_random_minio_password
+
+# --- Casdoor OIDC application (must match the Casdoor application record) ---
+CASDOOR_CLIENT_SECRET=CHANGE_ME_casdoor_client_secret
+CASDOOR_ADMIN_PASSWORD=CHANGE_ME_casdoor_console_admin_password
+
+# --- CORS: exact browser origins allowed to call the API (comma-separated) ---
+CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir
+
+# --- Developer Mode (X-User-* header identity + login panel) ---
+# MUST stay false in production. Only for local debugging without tokens.
+DEV_LOGIN_ENABLED=false
+
+# --- Deploy webhook (Gitea push → rebuild; see infra/deploy-webhook/) ---
+GITEA_WEBHOOK_SECRET=CHANGE_ME_long_random_webhook_secret
+
+# --- Backups (db-backup sidecar; see docker-compose.yml) ---
+BACKUP_DIR=/srv/erp/backups
+BACKUP_INTERVAL_SECONDS=86400
+BACKUP_KEEP_DAYS=14
+
+# --- Monitoring stack (see monitoring/README.md) ---
+# API log format for Loki ingestion ("text" locally, "json" in production)
+LOG_FORMAT=json
+# GlitchTip (error tracking). GLITCHTIP_HOST must be a public DNS name —
+# the browser SDK posts errors there.
+GLITCHTIP_SECRET_KEY=CHANGE_ME_random_django_secret
+GLITCHTIP_DOMAIN=https://errors.bennu-api-bahrestan.ir
+GLITCHTIP_HOST=errors.bennu-api-bahrestan.ir
+GLITCHTIP_DB_PASSWORD=CHANGE_ME_glitchtip_db_password
+GLITCHTIP_FROM_EMAIL=noreply@bennu-api-bahrestan.ir
+GLITCHTIP_EMAIL_URL=consolemail://
+# Grafana (dashboards) — UI is loopback-only (:3001) unless you add Traefik labels
+GRAFANA_ADMIN_PASSWORD=CHANGE_ME_grafana_password
+GRAFANA_ROOT_URL=http://localhost:3001/
+# OpenPanel (product analytics) — client id/secret from the OpenPanel project
+OPENPANEL_API_URL=http://openpanel-api:3333
+OPENPANEL_CLIENT_ID=
+OPENPANEL_CLIENT_SECRET=
+# Public origin of the OpenPanel dashboard/API the BROWSER talks to
+# (e.g. https://stats.bennu-api-bahrestan.ir — see monitoring/README.md)
+OPENPANEL_PUBLIC_URL=
+# Sentry/GlitchTip DSNs created in the GlitchTip UI after first boot
+SENTRY_DSN_BACKEND=
+SENTRY_DSN_FRONTEND=

.gitignore

@@ -11,9 +11,19 @@ __pycache__/
 venv/
 
 # ---- Env / secrets ----
+# All credentials live in git-ignored .env files (server-side and local).
+# NEVER commit .env or database dumps — see docs/SECRET-MANAGEMENT.md.
+.env
+.env.*
+!*.env.example
+backend/.env
 frontend/.env
 *.local
 
+# ---- Database dumps (contain user rows + signing material) ----
+*.dump
+*.sql.gz
+
 # ---- Local session / backups ----
 .zcode/
 v1.2 - Copy/

README.md

@@ -105,8 +105,8 @@ for production builds).
 | What | Where | Credentials |
 |---|---|---|
 | App | http://localhost (via Traefik) | — |
-| Casdoor console | http://localhost:8080 | `admin` / `123` |
-| Seeded app users (org `inventory`) | `razaei` (admin), `mousavi` (مدیر تدارکات), `mohaghegh` (مدیر پروژه), `tester` (مدیر پروژه، پروژه «تست») | password `123456` |
+| Casdoor console | http://localhost:8080 | admin credentials are set when you run the seeder (`CASDOOR_ADMIN_PW`) — never commit them |
+| Seeded app users (org `inventory`) | `razaei` (admin), `mousavi` (مدیر تدارکات), `mohaghegh` (مدیر پروژه), `tester` (مدیر پروژه، پروژه «تست») | password from `CASDOOR_SEED_PASSWORD` (bcrypt-hashed at rest — see `backend/tools/seed_casdoor.py`) |
 
 Run `backend/tools/seed_casdoor.py` once after the first boot to create the
 Casdoor organization, application and users (idempotent). Full details —
@@ -143,7 +143,7 @@ is an SSH tunnel from your machine:
    use the panel):
 
    ```powershell
-   ssh -L 9001:127.0.0.1:9001 root@171.22.25.75
+   ssh -L 9001:127.0.0.1:9001 <user>@<server-host>
    ```
 
    You will also land in a normal SSH session — that is fine; the tunnel
@@ -151,18 +151,17 @@ is an SSH tunnel from your machine:
 
 2. In your browser, open: **http://localhost:9001**
 
-3. Log in with:
-
-   | Username | Password |
-   |---|---|
-   | `aramesh-minio` | `feb10fadb5441019dfc33bf12a9b0f74e7b6c478` |
+3. Log in with the production MinIO root credentials from the server's
+   `/srv/erp/.env` (`MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD`) — they are
+   **never** written in this repo or its history. See
+   [`docs/SECRET-MANAGEMENT.md`](docs/SECRET-MANAGEMENT.md).
 
 You will see the **`procurement-files`** bucket — the invoices/proformas the
 ERP stores, browsable and downloadable from there.
 
-⚠️ These credentials are **full admin access to the file storage**. Treat
-them as a production secret (this README is inside the repo, so anyone with
-repo access can read them — rotate them on the server if they ever leak).
+⚠️ Those credentials are **full admin access to the file storage**. They live
+only in the server-side `.env`; if one ever leaks, rotate it immediately
+(checklist in `docs/SECRET-MANAGEMENT.md`).
 
 Close the PowerShell window (or `Ctrl+C`) when you are done to drop the
 tunnel.
@@ -215,15 +214,23 @@ All should show `Up` (postgres also `(healthy)`).
 | Frontend UI | http://localhost |
 | API docs (Swagger) | http://localhost:8000/docs |
 | API health | http://localhost:8000/health → `{"status":"ok","service":"procurement-api"}` |
+| API readiness (DB + MinIO + Casdoor) | http://localhost:8000/health/ready |
+| Metrics | http://localhost:8000/metrics |
 | MinIO console | http://localhost:9001 (user/pass `minioadmin`/`minioadmin`) |
 | Database | `localhost:5433`, db `procurement`, user/pass `postgres`/`postgres` (Casdoor uses the same instance, db `casdoor`) |
 
-Quick end-to-end check (Traefik → frontend proxy → API → DB):
+Automated end-to-end checks (authenticates via `SMOKE_USER` /
+`SMOKE_PASSWORD` — the seeder users):
 
 ```powershell
-curl http://localhost/api/v1/quotes?expand=supplier,project,line_items,termsheets,events,decision,receipt
+backend\tools\smoke_test.py   # read paths
+backend\tools\smoke_test_write.py / smoke_test_misc.py
 ```
 
+> Every API route now requires a Casdoor JWT — a bare
+> `curl http://localhost/api/v1/quotes` returns **401** by design.
+> Day-2 operations (deploys, backups, monitoring): [`docs/OPERATIONS.md`](docs/OPERATIONS.md).
+
 ---
 
 ## MinIO (object storage for invoice / proforma files)
@@ -262,47 +269,33 @@ docker exec -it procurement-postgres psql -U postgres -d procurement
 
 ---
 
-## Restoring the committed seed data
+## Recovery / seeding
 
-The databases are **not** in git — Docker volumes hold the data. The repo
-ships recovery dumps in `backups/علی محقق/`:
+The databases are **not** in git — Docker volumes hold the data, and
+database dumps must never be committed (they contain user rows and signing
+material). Two supported ways to bring a fresh stack up:
 
-| File | Contents |
-|---|---|
-| `casdoor.dump` | Casdoor schema + console admin (`admin` / `123`), org `inventory`, app `inventory-app`, the JWT signing cert, and the single org user `ali.mohaghegh` |
-| `procurement.dump` | Procurement schema + the single `users` row «علی محقق» with role `admin`; all other tables empty (categories/units re-seed at API startup) |
+1. **Empty boot** — schema v2.6 auto-applies on the first boot of an empty
+   `postgres_data` volume; then run the seeders:
 
-⚠️ This **replaces all data** in the `procurement` and `casdoor` databases.
-On a running stack:
-
-```powershell
-docker compose stop api casdoor
-docker cp "backups/علی محقق/procurement.dump" procurement-postgres:/tmp/
-docker cp "backups/علی محقق/casdoor.dump" procurement-postgres:/tmp/
-docker exec procurement-postgres pg_restore -U postgres -d procurement --clean --if-exists /tmp/procurement.dump
-docker exec procurement-postgres pg_restore -U postgres -d casdoor    --clean --if-exists /tmp/casdoor.dump
-docker compose start casdoor api
-```
-
-Login afterwards: `ali.mohaghegh` / `hulkfuck002` (Casdoor rejects spaces
-in usernames, so «ali mohaghegh» is not a valid login name).
-
-Want demo data instead? Two seeders are still available (they create
-different users — see the Login table above):
-
-1. **App seeder** (realistic demo dataset; keeps the Casdoor org as-is):
    ```powershell
+   # Casdoor org + app + users (prints/generates credentials — do not commit them)
+   docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
+   # Demo dataset (optional):
    docker exec procurement-api sh -c "cd /srv/backend && python -m tools.seed"
    ```
-2. **Casdoor seeder** (creates org `inventory` + app + users razaei /
-   mousavi / mohaghegh / tester — run once after a fresh volume):
+
+2. **Restore your own dump** — create dumps on the server (kept server-side,
+   e.g. `/srv/erp/backups/`), never in git:
+
    ```powershell
-   python backend/tools/seed_casdoor.py   # from the host, or from the api container
+   docker exec procurement-postgres pg_dump -U postgres -d procurement -Fc > /srv/erp/backups/procurement-$(date +%F).dump
+   docker exec procurement-postgres pg_dump -U postgres -d casdoor    -Fc > /srv/erp/backups/casdoor-$(date +%F).dump
    ```
 
-To create a fresh dump of your own current state: stop `api` + `casdoor`,
-`docker exec procurement-postgres pg_dump -U postgres -d procurement -Fc`
-(+ the `casdoor` DB) into `backups/`, then start them again.
+   Restore with `pg_restore --clean --if-exists` (stop `api` + `casdoor`
+   first — this **replaces all data**). The scheduled backup sidecar
+   (see `docs/OPERATIONS.md`) automates this.
 
 ## Common operations
 
@@ -317,10 +310,11 @@ docker compose down -v              # ⚠️ full reset — wipes DB + MinIO vol
 
 ## Known behavior
 
-- Authentication is Casdoor-based (JWT verified via JWKS): `/auth`, `/users`,
-  `/inventory` and `/pm` are protected (401 without a token, 403 without a role).
-  The procurement CRUD endpoints (quotes, suppliers, materials, …) are still
-  open — dev placeholder, do not expose to the public internet.
+- Authentication is Casdoor-based (JWT verified via JWKS) and **required on
+  every API route** except `/health`, `/health/ready` and `/auth/login`
+  (401 without a token, 403 without a role). The former dev-header fallback
+  (`X-User-Role` / `X-User-Name-B64`) is disabled unless
+  `PROCUREMENT_DEV_LOGIN_ENABLED=true` — never enable it in production.
 - Roles live in the app's `users` table (Casdoor is identity-only): `pm`,
   `procurement_manager`, `admin`. Role changes are **admin-only** (RBAC);
   the procurement manager can only assign projects to project managers.

backend/app/auth.py

@@ -26,7 +26,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import settings
-from app.db.engine import get_db
+from app.db.engine import AsyncSessionLocal
 from app.models.procurement import Project, User
 from app.utils.errors import (
     ForbiddenError,
@@ -170,11 +170,16 @@ async def pm_project_ids(db: AsyncSession, user: User) -> list:
     return list(rows)
 
 
-async def get_optional_user(request: Request, db: AsyncSession) -> UserContext | None:
+async def get_optional_user(request: Request, db: AsyncSession | None = None) -> UserContext | None:
     """Resolve the caller from the Casdoor Bearer token, or None when absent.
 
     Raises UnauthorizedError for a present-but-invalid token; callers decide
     their own fallback only for the no-token case (e.g. dev headers).
+
+    IMPORTANT: when ``db`` is omitted (pure auth-dependency usage), a
+    short-lived session of its own is used — querying the REQUEST session
+    here would auto-begin its transaction and break endpoints that open
+    explicit ``async with db.begin()`` blocks afterwards.
     """
     auth = request.headers.get("authorization", "")
     if not auth.lower().startswith("bearer "):
@@ -182,13 +187,22 @@ async def get_optional_user(request: Request, db: AsyncSession) -> UserContext |
     token = auth.split(" ", 1)[1].strip()
     if not token:
         return None
+    if db is None:
+        async with AsyncSessionLocal() as own_session:
+            claims = await _verify_token(token)
+            return await context_from_claims(claims, own_session)
     claims = await _verify_token(token)
     return await context_from_claims(claims, db)
 
 
-async def get_current_user(request: Request, db: AsyncSession = Depends(get_db)) -> UserContext:
-    """Require a valid Casdoor token (401 missing/invalid; 403 unprovisioned)."""
-    ctx = await get_optional_user(request, db)
+async def get_current_user(request: Request) -> UserContext:
+    """Require a valid Casdoor token (401 missing/invalid; 403 unprovisioned).
+
+    Resolves the user in its own session (see get_optional_user) so the
+    global auth dependency never interferes with an endpoint's explicit
+    transaction handling.
+    """
+    ctx = await get_optional_user(request)
     if ctx is None:
         raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
     if ctx.role is None:

backend/app/config.py

@@ -1,7 +1,14 @@
 """Application configuration.
 
 All settings can be overridden with environment variables prefixed with
-``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env`` file.
+``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env``
+file. The docker-compose files inject them from the git-ignored ``.env`` —
+real credentials never live in this repository.
+
+``ENVIRONMENT`` is the safety switch: when it is ``"prod"``, the API runs
+fail-fast startup checks (see app.main._verify_production_settings) that
+refuse to boot with wildcard CORS, default credentials or dev login
+enabled.
 """
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -14,7 +21,10 @@ class Settings(BaseSettings):
         extra="ignore",
     )
 
-    # PostgreSQL DSN — the schema (migration.sql + seed.sql) must already exist.
+    # "dev" (local defaults allowed) | "prod" (fail-fast checks on startup).
+    ENVIRONMENT: str = "dev"
+
+    # PostgreSQL DSN — the schema (migration.sql) must already exist.
     DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@localhost:5432/procurement"
 
     # Echo SQL statements to the console (dev aid).
@@ -22,6 +32,8 @@ class Settings(BaseSettings):
 
     # MinIO object storage — invoice / proforma attachments (S3-compatible).
     # Endpoint is the compose service name (`minio:9000`) inside Docker.
+    # Defaults are LOCAL DEV ONLY — production values come from .env and the
+    # prod startup checks reject them.
     MINIO_ENDPOINT: str = "localhost:9000"
     MINIO_ACCESS_KEY: str = "minioadmin"
     MINIO_SECRET_KEY: str = "minioadmin"
@@ -36,27 +48,54 @@ class Settings(BaseSettings):
     DEFAULT_PAGE_SIZE: int = 20
     MAX_PAGE_SIZE: int = 100
 
-    # CORS (dev-friendly default; the frontend is a static site).
-    CORS_ORIGINS: list[str] = ["*"]
+    # CORS — comma-separated exact browser origins (NOT "*" with
+    # credentials; the prod checks reject wildcard). Example:
+    # PROCUREMENT_CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir
+    CORS_ORIGINS: str = "http://localhost,http://localhost:3000,http://localhost:5173"
+
+    # Developer Mode: in-page dev login panel (frontend build arg) AND the
+    # X-User-Role / X-User-Name-B64 header identity fallback in the
+    # inventory/pm routers. MUST stay false in production.
+    DEV_LOGIN_ENABLED: bool = False
 
     # Casdoor (OIDC) — JWT verification against the issuer's JWKS.
     CASDOOR_ENDPOINT: str = "http://localhost:8080"
     CASDOOR_ISSUER: str = ""  # expected token iss claim (default: CASDOOR_ENDPOINT)
     CASDOOR_CLIENT_ID: str = "inventory-app-client"
-    CASDOOR_CLIENT_SECRET: str = "inventory-app-secret-2026"
+    CASDOOR_CLIENT_SECRET: str = ""  # no default secret — set via env/.env
     CASDOOR_ORGANIZATION: str = "inventory"
     CASDOOR_APP_NAME: str = "inventory-app"
     CASDOOR_JWKS_URL: str = ""  # default: {endpoint}/api/public_jwks
     CASDOOR_AUDIENCE: str = "inventory-app-client"  # expected token aud (falls back to client_id)
 
     # Casdoor console admin — used by POST /users/sync to mirror Casdoor
-    # identities into the app's users table (dev defaults: admin / 123).
+    # identities into the app's users table. No default password.
     CASDOOR_ADMIN_USER: str = "admin"
-    CASDOOR_ADMIN_PASSWORD: str = "123"
+    CASDOOR_ADMIN_PASSWORD: str = ""
 
-    # Inventory dev fallback (only when no Authorization header is sent).
+    # Inventory dev fallback defaults (only used when DEV_LOGIN_ENABLED).
     INVENTORY_DEFAULT_ROLE: str = "pm"
     INVENTORY_DEFAULT_PROJECT_ID: str = ""
 
+    # ---- Observability (Phase 2) -------------------------------------------
+    # "text" (human console) | "json" (JSON lines for Loki/Promtail).
+    LOG_FORMAT: str = "text"
+    # Sentry/GlitchTip DSN — backend exception capture (empty = disabled).
+    SENTRY_DSN: str = ""
+    SENTRY_TRACES_SAMPLE_RATE: float = 0.0
+    # OpenPanel server-side event ingestion (empty = disabled).
+    OPENPANEL_API_URL: str = ""      # e.g. http://openpanel-api:8080 (self-hosted)
+    OPENPANEL_CLIENT_ID: str = ""
+    OPENPANEL_CLIENT_SECRET: str = ""
+
+    @property
+    def cors_origin_list(self) -> list[str]:
+        """Comma-separated CORS_ORIGINS → list for CORSMiddleware."""
+        return [o.strip() for o in self.CORS_ORIGINS.split(",") if o.strip()]
+
+    @property
+    def is_prod(self) -> bool:
+        return self.ENVIRONMENT.lower() == "prod"
+
 
 settings = Settings()

backend/app/db/init_db.py

@@ -392,3 +392,27 @@ async def ensure_v26(engine: AsyncEngine) -> None:
             AFTER INSERT OR UPDATE OF status ON item_decisions
             FOR EACH ROW EXECUTE FUNCTION fn_sync_last_quoted_price()
     """)
+
+
+async def ensure_audit_table(engine: AsyncEngine) -> None:
+    """v2.7: general activity trail (audit_log). Idempotent; safe on any volume."""
+    ddl = """
+    CREATE TABLE IF NOT EXISTS audit_log (
+        id          UUID        NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+        occurred_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        actor       TEXT,
+        action      TEXT        NOT NULL,
+        entity      TEXT        NOT NULL,
+        entity_id   TEXT,
+        details     JSONB       NOT NULL DEFAULT '{}'
+    )
+    """
+    indexes = (
+        "CREATE INDEX IF NOT EXISTS idx_audit_log_entity ON audit_log(entity, entity_id)",
+        "CREATE INDEX IF NOT EXISTS idx_audit_log_occurred ON audit_log(occurred_at DESC)",
+    )
+    async with engine.begin() as conn:
+        await conn.execute(text(ddl))
+        for stmt in indexes:
+            await conn.execute(text(stmt))
+    logger.info("audit_log table ensured")

backend/app/main.py

@@ -7,30 +7,55 @@
 """
 import asyncio
 import logging
+import uuid
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI, Request
+import httpx
+from fastapi import Depends, FastAPI, Request
 from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
+from prometheus_fastapi_instrumentator import Instrumentator
+from slowapi import _rate_limit_exceeded_handler
+from slowapi.errors import RateLimitExceeded
+from sqlalchemy import text as sql_text
 from sqlalchemy.exc import IntegrityError
 
+from app.auth import get_current_user
 from app.config import settings
 from app.db.engine import AsyncSessionLocal, engine
 from app.db.init_db import (
     ensure_attachment_table,
+    ensure_audit_table,
     ensure_dashboard_tables,
     ensure_material_topic_column,
     ensure_quote_projects,
     ensure_v26,
 )
+from app.observability import RequestContextMiddleware, setup_logging
 from app.routers import ROUTERS
 from app.services.quote_service import auto_expire_quotes
 from app.utils.errors import AppError
+from app.utils.ratelimit import limiter
 
-logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s — %(message)s")
+setup_logging(settings.LOG_FORMAT)
 logger = logging.getLogger("procurement")
 
+if settings.SENTRY_DSN:
+    # GlitchTip/Sentry exception capture — after setup_logging so the SDK's
+    # own logs go through our formatter too. Disabled entirely without a DSN.
+    import sentry_sdk
+    from sentry_sdk.integrations.fastapi import FastApiIntegration
+
+    sentry_sdk.init(
+        dsn=settings.SENTRY_DSN,
+        environment=settings.ENVIRONMENT,
+        traces_sample_rate=settings.SENTRY_TRACES_SAMPLE_RATE,
+        integrations=[FastApiIntegration()],
+        send_default_pii=False,
+    )
+    logger.info("Sentry/GlitchTip exception capture enabled")
+
 API_V1_PREFIX = "/api/v1"
 
 
@@ -45,13 +70,41 @@ async def _auto_expire_loop() -> None:
             logger.exception("Auto-expiry pass failed")
 
 
+def _verify_production_settings() -> None:
+    """Fail-fast guard: refuse to boot in prod with dev defaults.
+
+    These exact misconfigurations are what previously shipped (wildcard CORS
+    with credentials, default MinIO/Postgres/Casdoor credentials, and the
+    always-on X-User-Role identity fallback). Ops fix: set the real values
+    in the server-side .env — see docs/SECRET-MANAGEMENT.md.
+    """
+    problems: list[str] = []
+    if not settings.cors_origin_list or "*" in settings.cors_origin_list:
+        problems.append("PROCUREMENT_CORS_ORIGINS must list exact origins (no '*')")
+    if settings.MINIO_ACCESS_KEY == "minioadmin" or settings.MINIO_SECRET_KEY == "minioadmin":
+        problems.append("MinIO credentials are still the default minioadmin")
+    if not settings.CASDOOR_CLIENT_SECRET:
+        problems.append("PROCUREMENT_CASDOOR_CLIENT_SECRET is not set")
+    if not settings.CASDOOR_ADMIN_PASSWORD:
+        problems.append("PROCUREMENT_CASDOOR_ADMIN_PASSWORD is not set")
+    if settings.DEV_LOGIN_ENABLED:
+        problems.append("PROCUREMENT_DEV_LOGIN_ENABLED must be false in production")
+    if problems:
+        raise RuntimeError(
+            "Refusing to start in production — fix the environment:\n  - " + "\n  - ".join(problems)
+        )
+
+
 @asynccontextmanager
 async def lifespan(_app: FastAPI):
+    if settings.is_prod:
+        _verify_production_settings()
     await ensure_dashboard_tables(engine)
     await ensure_attachment_table(engine)
     await ensure_material_topic_column(engine)
     await ensure_quote_projects(engine)
     await ensure_v26(engine)
+    await ensure_audit_table(engine)
     task = asyncio.create_task(_auto_expire_loop()) if settings.AUTO_EXPIRE_ENABLED else None
     try:
         yield
@@ -74,11 +127,21 @@ app = FastAPI(
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=settings.CORS_ORIGINS,
+    allow_origins=settings.cors_origin_list,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
 )
+app.add_middleware(RequestContextMiddleware)
+
+# Rate limiting — login brute-force brake (edge rate limit lives in Traefik).
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
+# Prometheus /metrics (requests, latency, errors) — mounted at app level,
+# outside the authenticated /api/v1 prefix; scrape target for the
+# monitoring stack.
+Instrumentator().instrument(app).expose(app, endpoint="/metrics", include_in_schema=False)
 
 
 # ---------------------------------------------------------------------------
@@ -119,6 +182,7 @@ def _fa_validation_msg(msg: str) -> str:
 
 @app.exception_handler(RequestValidationError)
 async def validation_error_handler(_request: Request, exc: RequestValidationError):
+    logger.warning("RequestValidationError on %s: %s", _request.url.path, exc.errors())
     first = exc.errors()[0]
     loc = [str(part) for part in first.get("loc", []) if part not in ("body", "query", "path")]
     field = ".".join(loc) if loc else None
@@ -157,11 +221,72 @@ async def unhandled_error_handler(_request: Request, exc: Exception):
 # ---------------------------------------------------------------------------
 # Routes
 # ---------------------------------------------------------------------------
+# JWT auth is required on EVERY router; the auth router stays public
+# (POST /auth/login issues the tokens) and /health lives below, outside the
+# /api/v1 prefix. Routers with their own finer-grained scopes (inventory,
+# pm, users) keep them — the global dependency guarantees nothing is open
+# by omission.
+from app.routers.auth import router as _auth_router  # noqa: E402
 
 for router in ROUTERS:
-    app.include_router(router, prefix=API_V1_PREFIX)
+    if router is _auth_router:
+        app.include_router(router, prefix=API_V1_PREFIX)
+    else:
+        app.include_router(router, prefix=API_V1_PREFIX, dependencies=[Depends(get_current_user)])
 
 
 @app.get("/health", tags=["system"])
 async def health():
     return {"status": "ok", "service": "procurement-api"}
+
+
+async def _check_db() -> bool:
+    try:
+        async with AsyncSessionLocal() as session:
+            await session.execute(sql_text("SELECT 1"))
+        return True
+    except Exception:
+        logger.exception("readiness: database check failed")
+        return False
+
+
+async def _check_minio() -> bool:
+    try:
+        from app.services.storage import get_client
+
+        get_client().bucket_exists(settings.MINIO_BUCKET)
+        return True
+    except Exception:
+        logger.exception("readiness: MinIO check failed")
+        return False
+
+
+async def _check_casdoor() -> bool:
+    try:
+        async with httpx.AsyncClient(timeout=5) as client:
+            resp = await client.get(
+                settings.CASDOOR_JWKS_URL or f"{settings.CASDOOR_ENDPOINT}/.well-known/jwks"
+            )
+            return resp.status_code == 200
+    except Exception:
+        logger.exception("readiness: Casdoor JWKS check failed")
+        return False
+
+
+@app.get("/health/ready", tags=["system"])
+async def health_ready():
+    """Readiness: verifies the dependencies the API actually needs.
+
+    The deploy webhook polls this after a rebuild, so a deploy that breaks
+    the DB/MinIO/Casdoor connectivity is visible immediately.
+    """
+    checks = {
+        "database": await _check_db(),
+        "minio": await _check_minio(),
+        "casdoor": await _check_casdoor(),
+    }
+    ok = all(checks.values())
+    return JSONResponse(
+        status_code=200 if ok else 503,
+        content={"status": "ok" if ok else "degraded", "service": "procurement-api", "checks": checks},
+    )

backend/app/models/__init__.py

@@ -1,5 +1,6 @@
 """ORM models — import order matters only for registration in Base.metadata."""
 from app.db.base import Base
+from app.models.audit import AuditLog
 from app.models.catalog import (
     AttributeDefinition,
     Brand,

backend/app/models/audit.py

@@ -0,0 +1,19 @@
+"""Audit log model — general activity trail (v2.7)."""
+import uuid
+
+from sqlalchemy import Column, DateTime, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
+
+from app.db.base import Base
+
+
+class AuditLog(Base):
+    __tablename__ = "audit_log"
+
+    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    occurred_at = Column(DateTime(timezone=True), nullable=False, server_default=func.now())
+    actor = Column(Text, nullable=True)  # display name of the authenticated user
+    action = Column(String(64), nullable=False)  # e.g. "user.role_changed"
+    entity = Column(String(64), nullable=False)  # e.g. "user", "inventory_tx"
+    entity_id = Column(Text, nullable=True)
+    details = Column(JSONB, nullable=False, server_default="{}")

backend/app/observability.py

@@ -0,0 +1,86 @@
+"""Observability plumbing — logging format, request IDs, request log.
+
+- ``setup_logging()``: human-readable text by default, JSON lines when
+  ``PROCUREMENT_LOG_FORMAT=json`` (what Promtail/Loki prefers).
+- ``request_context`` middleware: assigns an X-Request-ID to every request
+  (honours one sent by the edge), echoes it in the response, and logs one
+  structured line per request (method, path, status, duration, request id)
+  — this is what makes access logs useful in Loki.
+"""
+import contextvars
+import json
+import logging
+import time
+import uuid
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+
+request_id_var: contextvars.ContextVar[str] = contextvars.ContextVar("request_id", default="-")
+
+_SKIP_ACCESS_LOG = {"/health", "/health/ready", "/metrics"}
+
+
+class JsonFormatter(logging.Formatter):
+    """Minimal JSON-lines formatter for Loki/Promtail ingestion."""
+
+    def format(self, record: logging.LogRecord) -> str:
+        payload = {
+            "ts": self.formatTime(record, "%Y-%m-%dT%H:%M:%S%z"),
+            "level": record.levelname,
+            "logger": record.name,
+            "message": record.getMessage(),
+            "request_id": request_id_var.get(),
+        }
+        if record.exc_info:
+            payload["exception"] = self.formatException(record.exc_info)
+        for key in ("http_method", "http_path", "http_status", "duration_ms"):
+            value = getattr(record, key, None)
+            if value is not None:
+                payload[key] = value
+        return json.dumps(payload, ensure_ascii=False)
+
+
+def setup_logging(log_format: str = "text", level: int = logging.INFO) -> None:
+    formatter = JsonFormatter() if log_format.lower() == "json" else logging.Formatter(
+        "%(asctime)s %(levelname)s %(name)s — %(message)s"
+    )
+    root = logging.getLogger()
+    for handler in root.handlers[:]:
+        root.removeHandler(handler)
+    handler = logging.StreamHandler()
+    handler.setFormatter(formatter)
+    root.addHandler(handler)
+    root.setLevel(level)
+
+
+class RequestContextMiddleware(BaseHTTPMiddleware):
+    """X-Request-ID + one access-log line per request."""
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        rid = request.headers.get("x-request-id") or uuid.uuid4().hex
+        token = request_id_var.set(rid)
+        started = time.perf_counter()
+        try:
+            response = await call_next(request)
+        except Exception:
+            duration_ms = round((time.perf_counter() - started) * 1000, 1)
+            logging.getLogger("procurement.access").exception(
+                "unhandled exception",
+                extra={"http_method": request.method, "http_path": request.url.path,
+                       "http_status": 500, "duration_ms": duration_ms},
+            )
+            request_id_var.reset(token)
+            raise
+        duration_ms = round((time.perf_counter() - started) * 1000, 1)
+        response.headers["X-Request-ID"] = rid
+        request_id_var.reset(token)
+        if request.url.path not in _SKIP_ACCESS_LOG:
+            logging.getLogger("procurement.access").info(
+                "%s %s -> %s",
+                request.method, request.url.path, response.status_code,
+                extra={"http_method": request.method, "http_path": request.url.path,
+                       "http_status": response.status_code, "duration_ms": duration_ms},
+            )
+        return response

backend/app/routers/auth.py

@@ -13,7 +13,7 @@ Error mapping (documented in docs/casdoor-auth.md):
 import logging
 
 import httpx
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request
 from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -21,7 +21,9 @@ from app.auth import _verify_token, context_from_claims
 from app.config import settings
 from app.db.engine import get_db
 from app.routers.users import _user_projects, user_to_dict
+from app.services import analytics
 from app.utils.errors import ServiceUnavailableError, UnauthorizedError
+from app.utils.ratelimit import limiter
 
 logger = logging.getLogger("procurement.auth")
 
@@ -34,7 +36,8 @@ class LoginRequest(BaseModel):
 
 
 @router.post("/login")
-async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
+@limiter.limit("10/minute", error_message="تلاش‌های ورود بیش از حد مجاز — کمی بعد دوباره امتحان کنید")
+async def login(request: Request, payload: LoginRequest, db: AsyncSession = Depends(get_db)):
     """Exchange username/password for a Casdoor JWT (OAuth password grant)."""
     url = f"{settings.CASDOOR_ENDPOINT}/api/login/oauth/access_token"
     form = {
@@ -75,6 +78,15 @@ async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
     claims = await _verify_token(access_token)
     ctx = await context_from_claims(claims, db)
     projects = await _user_projects(db, ctx.user)
+    await analytics.track(
+        "login_success",
+        {"username": payload.username, "role": ctx.role},
+        profile_id=ctx.user.casdoor_id,
+    )
+    await analytics.identify(
+        ctx.user.casdoor_id,
+        {"name": ctx.display_name, "role": ctx.role, "username": payload.username},
+    )
     return {
         "data": {
             "access_token": access_token,

backend/app/routers/files.py

@@ -20,6 +20,7 @@ from urllib.parse import quote
 from fastapi import APIRouter, Depends, File, Response, UploadFile
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import Quote
 from app.services import file_service
@@ -27,6 +28,10 @@ from app.utils.errors import NotFoundError, ValidationError
 
 router = APIRouter(prefix="/quotes", tags=["files"])
 
+# حذف پیوست‌ها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ بارگذاری و دانلود
+# برای هر کاربر واردشده آزاد است.
+_attachment_deleter = require_role("procurement_manager", "admin")
+
 ALLOWED_MIME_TYPES = {
     "image/png", "image/jpeg", "image/webp", "image/gif", "application/pdf",
 }
@@ -120,7 +125,7 @@ async def download_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: As
     )
 
 
-@router.delete("/{quote_id}/invoice/{attachment_id}")
+@router.delete("/{quote_id}/invoice/{attachment_id}", dependencies=[Depends(_attachment_deleter)])
 async def delete_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     attachment = await _attachment_or_404(db, quote_id, attachment_id, "invoice")
@@ -165,7 +170,7 @@ async def download_proforma(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: A
     )
 
 
-@router.delete("/{quote_id}/proforma/{attachment_id}")
+@router.delete("/{quote_id}/proforma/{attachment_id}", dependencies=[Depends(_attachment_deleter)])
 async def delete_proforma(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     attachment = await _attachment_or_404(db, quote_id, attachment_id, "proforma")

backend/app/routers/inventory.py

@@ -43,6 +43,7 @@ from app.utils.errors import (
     UnauthorizedError,
     ValidationError,
 )
+from app.utils.audit import record as audit_record
 from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
@@ -95,9 +96,11 @@ async def inventory_scope(
             return Scope(role="admin", project_id=project_id, actor=user.display_name)
 
     # Dev fallback: header-based identity (fork's placeholder mode) — only
-    # when an explicit X-User-Role header is sent. No auth info at all → 401.
-    if not request.headers.get("x-user-role"):
-        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor یا حالت توسعه را ارسال کنید")
+    # when DEV_LOGIN_ENABLED is explicitly turned on (local testing without
+    # Casdoor). Disabled by default: unauthenticated header identity in
+    # production would hand admin access to anyone who can reach the API.
+    if not settings.DEV_LOGIN_ENABLED or not request.headers.get("x-user-role"):
+        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
     role = (request.headers.get("x-user-role") or settings.INVENTORY_DEFAULT_ROLE or ROLE_PM).strip().lower()
     if role == "procurement_manager":
         role = ROLE_ADMIN  # مدیر تدارکات = ادمین (فقط‌خواندنی)
@@ -492,6 +495,16 @@ async def create_transaction(
             if dest.project_id != scope.project_id:
                 raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
         txs = await apply_transaction(db, payload, performed_by=scope.actor)
+        await audit_record(
+            db,
+            actor=scope.actor,
+            action="inventory.transaction_created",
+            entity="inventory",
+            entity_id=str(txs[0].inventory_id) if txs else None,
+            details={"type": payload.transaction_type, "quantity": str(payload.quantity),
+                     "warehouse_id": str(payload.warehouse_id),
+                     "tx_ids": [str(tx.id) for tx in txs]},
+        )
     return {"data": [transaction_to_dict(tx) for tx in txs]}
 
 

backend/app/routers/item_decisions.py

@@ -4,11 +4,16 @@ State machine (P1 cross-endpoint rules):
     pending -> chosen (requires chosen_item_termsheet_id of the SAME line item)
     pending -> rejected
     chosen/rejected -> pending/anything-else = 409
+
+Auth: JWT required globally (main.py). The state-changing endpoints are a
+purchase decision — restricted to procurement_manager / admin via
+require_role; reads stay open to every authenticated role.
 """
 from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import ItemDecision, ItemTermsheet, LineItem
 from app.schemas.procurement import DecisionPatch, DecisionPut, DecisionStatusUpdate
@@ -21,6 +26,9 @@ router = APIRouter(
     tags=["item-decisions"],
 )
 
+# خرید/رد اقلام = تصمیم تدارکات؛ ادمین و مدیر تدارکات
+_decision_writer = require_role("procurement_manager", "admin")
+
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
     li = await db.scalar(
@@ -59,7 +67,7 @@ async def get_decision(quote_id, line_item_id, db: AsyncSession = Depends(get_db
     return {"data": decision_full(decision)}
 
 
-@router.put("")
+@router.put("", dependencies=[Depends(_decision_writer)])
 async def put_decision(
     quote_id, line_item_id, payload: DecisionPut, db: AsyncSession = Depends(get_db)
 ):
@@ -93,7 +101,7 @@ async def put_decision(
     return {"data": decision_full(decision), "status_code_hint": 201 if created else 200}
 
 
-@router.patch("/status")
+@router.patch("/status", dependencies=[Depends(_decision_writer)])
 async def patch_decision_status(
     quote_id, line_item_id, payload: DecisionStatusUpdate, db: AsyncSession = Depends(get_db)
 ):
@@ -118,7 +126,7 @@ async def patch_decision_status(
     return {"data": decision_full(decision)}
 
 
-@router.patch("")
+@router.patch("", dependencies=[Depends(_decision_writer)])
 async def patch_decision(
     quote_id, line_item_id, payload: DecisionPatch, db: AsyncSession = Depends(get_db)
 ):

backend/app/routers/line_items.py

@@ -108,6 +108,7 @@ async def update_line_item(
         effective_bm = payload.brand_material_id if payload.brand_material_id is not None else li.brand_material_id
         await ensure_brand_material_belong(db, effective_bm, new_material_id)
 
+    old_material_id = li.material_id
     if payload.material_id is not None:
         li.material_id = payload.material_id
         # v2.5: keep the supplier<->material catalog edge in sync.
@@ -121,6 +122,11 @@ async def update_line_item(
     if payload.notes is not None:
         li.notes = payload.notes
     await db.flush()
+
+    if payload.material_id is not None and payload.material_id != old_material_id:
+        from app.services.quote_service import cleanup_orphan_materials
+        await cleanup_orphan_materials(db, [old_material_id])
+
     return {"data": (await serialize_line_items(db, [li], set()))[0]}
 
 
@@ -133,6 +139,13 @@ async def delete_line_item(quote_id, line_item_id, db: AsyncSession = Depends(ge
     decision = await db.scalar(select(ItemDecision).where(ItemDecision.line_item_id == li.id))
     if decision is not None and decision.status == "chosen":
         raise ConflictError("خط آیتم انتخاب‌شده قابل حذف نیست")
+    old_material_id = li.material_id
     await db.delete(li)  # specs / links / decision / receipt cascade via DDL
     await db.flush()
+
+    if old_material_id:
+        from app.services.quote_service import cleanup_orphan_materials
+        await cleanup_orphan_materials(db, [old_material_id])
+
     return {"data": {"id": str(line_item_id), "deleted": True}}
+

backend/app/routers/pm.py

@@ -19,8 +19,9 @@ Rules enforced here:
   the canonical unit for auto-posted purchases.
 - quote.status flips to 'arrived' when ALL chosen items are fully received.
 
-Auth: Casdoor JWT primary; dev fallback headers (X-User-Role: pm|admin +
-X-Project-Id for pm) when no Authorization header — same pattern as the
+Auth: Casdoor JWT (a global dependency in main.py) resolves the caller;
+optional dev-header fallback (X-User-Role: pm|admin + X-Project-Id for pm)
+exists only when PROCUREMENT_DEV_LOGIN_ENABLED=true — same pattern as the
 inventory router.
 """
 import base64
@@ -35,6 +36,7 @@ from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_optional_user
+from app.config import settings
 from app.db.engine import get_db
 from app.models.catalog import BrandMaterial, Material, MaterialCategory, Unit
 from app.models.inventory import InventoryItem, InventoryTransaction, Warehouse
@@ -48,6 +50,7 @@ from app.models.procurement import (
     Supplier,
 )
 from app.schemas.procurement import PMReceiptCreate
+from app.services import analytics
 from app.services.inventory_service import canonical_specs_hash
 from app.utils.errors import (
     ForbiddenError,
@@ -98,9 +101,12 @@ async def arrivals_scope(
             if ctx.role in ("admin", "procurement_manager"):
                 return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
             raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
-    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to admin)
-    if not request.headers.get("x-user-role"):
-        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor یا حالت توسعه را ارسال کنید")
+    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to
+    # admin) — ONLY when DEV_LOGIN_ENABLED (local testing without Casdoor).
+    # Disabled by default: an ungated header identity in production would
+    # let anyone confirm receipts as PM.
+    if not settings.DEV_LOGIN_ENABLED or not request.headers.get("x-user-role"):
+        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
     role = (request.headers.get("x-user-role") or "").strip().lower()
     if role == "procurement_manager":
         role = "admin"
@@ -424,6 +430,16 @@ async def pm_confirm_receipt(
             quote.arrived_date = payload.received_at
 
     item_state = arrival_state(li.quantity, already_received + payload.received_qty)
+    await analytics.track(
+        "receipt_confirmed",
+        {
+            "receipt_id": str(receipt.id),
+            "quote_id": str(quote.id),
+            "quantity": str(payload.received_qty),
+            "state": item_state,
+        },
+        profile_id=ctx.display_name,
+    )
     return {"data": {
         "receipt_id": str(receipt.id),
         "state": item_state,

backend/app/routers/users.py

@@ -21,6 +21,7 @@ from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_current_user, require_role
+from app.utils.audit import record as audit_record
 from app.config import settings
 from app.db.engine import get_db
 from app.models.procurement import Project, User
@@ -168,7 +169,7 @@ async def list_users(
 @router.post("", status_code=201)
 async def create_user(
     payload: UserCreate,
-    _: UserContext = Depends(_org_manager),
+    ctx: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
     """Define a new user (manual identity — casdoor_id optional)."""
@@ -185,6 +186,7 @@ async def create_user(
     )
     db.add(user)
     await db.flush()
+    await audit_record(db, actor=ctx.display_name, action="user.created", entity="user", entity_id=str(user.id), details={"role": payload.role})
     return {"data": user_to_dict(user)}
 
 
@@ -192,7 +194,7 @@ async def create_user(
 async def update_user_role(
     user_id,
     payload: UserRoleUpdate,
-    _: UserContext = Depends(require_role("admin")),
+    ctx: UserContext = Depends(require_role("admin")),
     db: AsyncSession = Depends(get_db),
 ):
     """Set/clear a role — ADMIN ONLY (RBAC): procurement managers must not
@@ -201,10 +203,12 @@ async def update_user_role(
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
+    previous_role = user.role
     if user.role == "pm" and payload.role != "pm":
         await _unassign_projects(db, user.id)
     user.role = payload.role
     await db.flush()
+    await audit_record(db, actor=ctx.display_name, action="user.role_changed", entity="user", entity_id=str(user.id), details={"from": previous_role, "to": payload.role})
     projects = await _user_projects(db, user)
     return {"data": user_to_dict(user, projects)}
 

backend/app/services/analytics.py

@@ -0,0 +1,76 @@
+"""Server-side product analytics — OpenPanel Track API.
+
+Fire-and-forget business events (quote lifecycle, receipts, logins) so the
+OpenPanel dashboards show what actually happens inside the ERP, not just
+page views. Never raises: analytics must not break a business flow.
+
+Configuration (all optional — disabled when any is missing):
+    PROCUREMENT_OPENPANEL_API_URL     e.g. http://openpanel-api:3333 (self-hosted)
+    PROCUREMENT_OPENPANEL_CLIENT_ID   project client id (write mode)
+    PROCUREMENT_OPENPANEL_CLIENT_SECRET  project client secret
+
+Contract (OpenPanel Track API): POST {API_URL}/track with headers
+``openpanel-client-id`` / ``openpanel-client-secret`` and a JSON body
+``{"type": "track"|"identify", "profileId": ..., "event"/"properties": ...}``.
+"""
+import logging
+from typing import Any
+
+import httpx
+
+from app.config import settings
+
+logger = logging.getLogger("procurement.analytics")
+
+_TIMEOUT = httpx.Timeout(3.0)
+
+
+def _configured() -> bool:
+    return bool(
+        settings.OPENPANEL_API_URL
+        and settings.OPENPANEL_CLIENT_ID
+        and settings.OPENPANEL_CLIENT_SECRET
+    )
+
+
+async def track(event: str, properties: dict[str, Any] | None = None, profile_id: str | None = None) -> None:
+    """Record a named event; swallows every error."""
+    if not _configured():
+        return
+    body = {
+        "type": "track",
+        "event": event,
+        "properties": properties or {},
+    }
+    if profile_id:
+        body["profileId"] = profile_id
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            await client.post(
+                f"{settings.OPENPANEL_API_URL.rstrip('/')}/track",
+                json=body,
+                headers={
+                    "openpanel-client-id": settings.OPENPANEL_CLIENT_ID,
+                    "openpanel-client-secret": settings.OPENPANEL_CLIENT_SECRET,
+                },
+            )
+    except Exception as exc:  # noqa: BLE001 — analytics must never raise
+        logger.debug("analytics track failed (%s): %s", event, exc)
+
+
+async def identify(profile_id: str, properties: dict[str, Any] | None = None) -> None:
+    """Create/update a user profile (e.g. on login)."""
+    if not _configured():
+        return
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            await client.post(
+                f"{settings.OPENPANEL_API_URL.rstrip('/')}/track",
+                json={"type": "identify", "profileId": profile_id, "properties": properties or {}},
+                headers={
+                    "openpanel-client-id": settings.OPENPANEL_CLIENT_ID,
+                    "openpanel-client-secret": settings.OPENPANEL_CLIENT_SECRET,
+                },
+            )
+    except Exception as exc:  # noqa: BLE001
+        logger.debug("analytics identify failed: %s", exc)

backend/app/services/expand_service.py

@@ -77,13 +77,14 @@ def project_brief(project: Project | None) -> dict | None:
     return {"id": str(project.id), "name": project.name}
 
 
-def decision_brief(d: ItemDecision) -> dict:
+def decision_brief(d: ItemDecision, project: Project | None = None) -> dict:
     """Shape used inside expanded line items (P0-14)."""
     return {
         "id": str(d.id),
         "status": d.status,
         "chosen_item_termsheet_id": str(d.chosen_item_termsheet_id) if d.chosen_item_termsheet_id else None,
         "project_id": str(d.project_id) if d.project_id else None,  # v2.6: the single purchased project
+        "project": project_brief(project) if project is not None else None,
         "adjusted_unit_price": float(d.adjusted_unit_price) if d.adjusted_unit_price is not None else None,
         "decided_at": to_iso(d.decided_at),
     }
@@ -313,6 +314,7 @@ class _LineItemData:
         self.item_termsheets_by_line: dict[uuid.UUID, list[ItemTermsheet]] = {}
         self.item_termsheets_by_id: dict[uuid.UUID, ItemTermsheet] = {}
         self.projects_by_line: dict[uuid.UUID, list[Project]] = {}
+        self.projects_by_id: dict[uuid.UUID, Project] = {}
 
 
 async def _load_line_item_data(db: AsyncSession, line_items: list[LineItem], expand: set[str]) -> _LineItemData:
@@ -375,6 +377,13 @@ async def _load_line_item_data(db: AsyncSession, line_items: list[LineItem], exp
     if "decision" in expand or "receipt" in expand:
         decisions = (await db.execute(select(ItemDecision).where(ItemDecision.line_item_id.in_(li_ids)))).scalars().all()
         data.decisions = {d.line_item_id: d for d in decisions}
+        dec_proj_ids = {d.project_id for d in decisions if d.project_id is not None}
+        missing_pids = dec_proj_ids - set(proj_map.keys())
+        if missing_pids:
+            extra_projs = (await db.execute(select(Project).where(Project.id.in_(missing_pids)))).scalars().all()
+            for p in extra_projs:
+                proj_map[p.id] = p
+        data.projects_by_id = proj_map
         dec_ids = [d.id for d in decisions]
         if dec_ids:
             receipts = (await db.execute(select(ItemReceipt).where(ItemReceipt.item_decision_id.in_(dec_ids)))).scalars().all()
@@ -469,8 +478,10 @@ def _line_item_expanded(li: LineItem, expand: set[str], data: _LineItemData, inc
             data.specs_by_line.get(li.id, []), data.attr_defs, data.units, include_data_type=False
         )
     decision = data.decisions.get(li.id)
+    dec_proj = data.projects_by_id.get(decision.project_id) if decision and decision.project_id else None
+    d["target_project"] = project_brief(dec_proj) if dec_proj is not None else None
     if "decision" in expand:
-        d["decision"] = decision_brief(decision) if decision is not None else None
+        d["decision"] = decision_brief(decision, dec_proj) if decision is not None else None
         # chosen_item_termsheet_id یک id از جدول item_termsheets است؛ برای مقایسه با
         # termsheet_ids در جلوی برنامه، id ترم‌شیت واقعی هم ارسال می‌شود.
         if decision is not None and decision.chosen_item_termsheet_id is not None:

backend/app/services/quote_service.py

@@ -4,6 +4,7 @@ Every mutation here runs in ONE ``async with db.begin()`` block; any failure
 rolls the whole operation back. All state changes log a quote_event in the
 same transaction.
 """
+import asyncio
 import logging
 from datetime import date, datetime, timezone
 from uuid import UUID
@@ -33,6 +34,7 @@ from app.schemas.procurement import (
     QuoteUpdate,
     RejectQuoteIn,
 )
+from app.services import analytics
 from app.services.material_service import ensure_brand_material_belong
 from app.utils.errors import ConflictError, NotFoundError, ValidationError
 
@@ -56,6 +58,19 @@ def utcnow() -> datetime:
 
 def _add_event(db: AsyncSession, quote_id: UUID, event_type: str, payload: dict | None = None, actor: str | None = None) -> None:
     db.add(QuoteEvent(quote_id=quote_id, event_type=event_type, payload=payload or {}, actor=actor))
+    # Product analytics (fire-and-forget, never blocks or raises): the whole
+    # quote lifecycle funnels through here, so one hook covers every
+    # status transition for the OpenPanel dashboards.
+    try:
+        asyncio.get_running_loop().create_task(
+            analytics.track(
+                f"quote_{event_type}",
+                {"quote_id": str(quote_id), "actor": actor, **(payload or {})},
+                profile_id=actor,
+            )
+        )
+    except RuntimeError:  # no running loop (defensive — callers are async)
+        pass
 
 
 async def get_quote_or_404(db: AsyncSession, quote_id: UUID) -> Quote:
@@ -279,13 +294,89 @@ async def update_quote(db: AsyncSession, quote_id: UUID, payload: QuoteUpdate, a
     return quote
 
 
+async def quote_has_receipts(db: AsyncSession, quote_id: UUID) -> bool:
+    """Returns True if any warehouse receipt has been posted for the quote's items."""
+    count = await db.scalar(
+        select(func.count(ItemReceipt.id))
+        .join(ItemDecision, ItemReceipt.item_decision_id == ItemDecision.id)
+        .join(LineItem, ItemDecision.line_item_id == LineItem.id)
+        .where(LineItem.quote_id == quote_id, ItemReceipt.received_qty > 0)
+    )
+    return (count or 0) > 0
+
+
+async def cleanup_orphan_materials(db: AsyncSession, material_ids) -> list[UUID]:
+    """Check candidate material_ids and purge any that have zero references.
+
+    A material is considered an orphan if:
+    1. It is not referenced by ANY line_items across all quotes.
+    2. It is not referenced by ANY inventory stock items in warehouses.
+
+    If count == 0:
+    - Auxiliary records in supplier_materials, brand_materials, material_units,
+      and material_attribute_values are cleaned up.
+    - The material row is deleted from the central materials table.
+
+    Returns the list of purged material UUIDs.
+    """
+    purged: list[UUID] = []
+    unique_ids = {m for m in material_ids if m is not None}
+    if not unique_ids:
+        return purged
+
+    from app.models.catalog import (
+        BrandMaterial,
+        Material,
+        MaterialAttributeValue,
+        MaterialUnit,
+    )
+    from app.models.inventory import InventoryItem
+    from app.models.procurement import LineItem, SupplierMaterial
+
+    for mat_id in unique_ids:
+        # Check active usage in line_items across the whole system
+        line_item_count = await db.scalar(
+            select(func.count(LineItem.id)).where(LineItem.material_id == mat_id)
+        )
+        if (line_item_count or 0) > 0:
+            continue
+
+        # Check active usage in warehouse inventory
+        inv_count = await db.scalar(
+            select(func.count(InventoryItem.id)).where(InventoryItem.material_id == mat_id)
+        )
+        if (inv_count or 0) > 0:
+            continue
+
+        # Material is not used in ANY line item and not in ANY warehouse inventory: pure orphan!
+        await db.execute(
+            delete(SupplierMaterial).where(SupplierMaterial.material_id == mat_id)
+        )
+        await db.execute(
+            delete(BrandMaterial).where(BrandMaterial.material_id == mat_id)
+        )
+        await db.execute(
+            delete(MaterialUnit).where(MaterialUnit.material_id == mat_id)
+        )
+        await db.execute(
+            delete(MaterialAttributeValue).where(MaterialAttributeValue.material_id == mat_id)
+        )
+        await db.execute(
+            delete(Material).where(Material.id == mat_id)
+        )
+        purged.append(mat_id)
+        logger.info("Purged orphan material %s from central catalog", mat_id)
+
+    return purged
+
+
 async def replace_quote_children(
     db: AsyncSession, quote_id: UUID, payload: QuoteChildrenReplaceIn, actor: str | None = None
 ) -> Quote:
     """Full replacement of a quote's line items + termsheets (edit modal).
 
-    Only allowed while the quote is still offered — acceptance data
-    (decisions/receipts) would otherwise be destroyed.
+    Only allowed while the quote is still offered and has no warehouse receipts.
+    Automatically purges any materials detached during this replacement if they become orphans.
     """
     async with db.begin():
         quote = await get_quote_or_404(db, quote_id)
@@ -294,6 +385,16 @@ async def replace_quote_children(
                 "برای تغییر اقلام یا شرایط پرداخت، ابتدا وضعیت را به «پیشنهاد شده» برگردانید",
                 field="status",
             )
+        if await quote_has_receipts(db, quote.id):
+            raise ConflictError(
+                "این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.",
+                field="status",
+            )
+
+        # 1. Pre-update snapshot: record previous material_ids assigned to this quote's items
+        old_items = (await db.execute(select(LineItem).where(LineItem.quote_id == quote.id))).scalars().all()
+        old_material_ids = {li.material_id for li in old_items if li.material_id is not None}
+
         # children cascade via DDL: item_termsheets, item_decisions, item_receipts, schedule_steps
         await db.execute(
             delete(LineItem).where(LineItem.quote_id == quote.id).execution_options(synchronize_session=False)
@@ -302,16 +403,33 @@ async def replace_quote_children(
             delete(Termsheet).where(Termsheet.quote_id == quote.id).execution_options(synchronize_session=False)
         )
         await _insert_children(db, quote.id, quote.supplier_id, payload.line_items, payload.termsheets, payload.item_termsheets)
+        await db.flush()
+
+        # 2. Identify detached materials: previous materials no longer present in the updated line items
+        new_material_ids = {li.material_id for li in payload.line_items if li.material_id is not None}
+        detached_material_ids = old_material_ids - new_material_ids
+
+        # 3. Clean up any detached materials that are now orphans (0 usage)
+        if detached_material_ids:
+            await cleanup_orphan_materials(db, detached_material_ids)
+
         _add_event(db, quote.id, "edited", {"changed_fields": ["line_items", "termsheets"]}, actor)
     return quote
 
 
+
 async def _apply_status_transition(db: AsyncSession, quote: Quote, new_status: str) -> None:
     """Backward transitions only; reverts bookkeeping when going back to offered."""
     current = quote.status
     if new_status not in BACKWARD_TRANSITIONS.get(current, set()):
         raise ConflictError("انتقال وضعیت مجاز نیست — فقط انتقال‌های عقب‌گرد پذیرفته می‌شود", field="status")
 
+    if await quote_has_receipts(db, quote.id):
+        raise ConflictError(
+            "این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.",
+            field="status",
+        )
+
     if new_status == "offered":
         # Reopen: clear lifecycle dates, demote accepted termsheets, reset decisions.
         quote.accepted_date = None
@@ -325,17 +443,18 @@ async def _apply_status_transition(db: AsyncSession, quote: Quote, new_status: s
         li_ids = select(LineItem.id).where(LineItem.quote_id == quote.id)
         await db.execute(
             update(ItemDecision)
-            .where(ItemDecision.line_item_id.in_(li_ids), ItemDecision.status != "pending")
+            .where(ItemDecision.line_item_id.in_(li_ids))
             .values(
                 status="pending",
                 decided_at=None,
                 chosen_item_termsheet_id=None,
                 adjusted_unit_price=None,
                 adjusted_notes=None,
+                project_id=None,
             )
             .execution_options(synchronize_session=False)
         )
-        # item_receipts are deliberately NOT deleted (contract P0-17).
+        # LineItemProjects (candidate projects) are preserved untouched!
     elif new_status == "accepted":  # arrived -> accepted
         quote.arrived_date = None
 
@@ -502,21 +621,7 @@ async def accept_quote(db: AsyncSession, quote_id: UUID, payload: AcceptQuoteIn,
                 decision.adjusted_notes = decision_in.adjusted_notes
                 decision.decided_at = utcnow()
 
-        # --- per-material project allocation (تخصیص پروژه به هر قلم) ---
-        for entry in payload.item_projects:
-            if entry.line_item_id not in li_ids:
-                raise NotFoundError(
-                    "خط آیتم یافت نشد یا متعلق به این پیشنهاد نیست", field="item_projects"
-                )
-            await db.execute(
-                delete(LineItemProjects)
-                .where(LineItemProjects.line_item_id == entry.line_item_id)
-                .execution_options(synchronize_session=False)
-            )
-            for pid in entry.project_ids:
-                if await db.get(Project, pid) is None:
-                    raise NotFoundError("پروژه یافت نشد", field="item_projects.project_ids")
-                db.add(LineItemProjects(line_item_id=entry.line_item_id, project_id=pid))
+        # LineItemProjects records in PostgreSQL remain 100% untouched. Only item_decisions.project_id is written.
 
         # termsheets referenced by at least one chosen item -> accepted
         if chosen_ts_ids:
@@ -692,7 +797,8 @@ async def expire_quote(db: AsyncSession, quote_id: UUID, actor: str | None = Non
 
 
 async def delete_quote(db: AsyncSession, quote_id: UUID) -> dict:
-    async with db.begin():
+    tx = db.begin_nested() if db.in_transaction() else db.begin()
+    async with tx:
         quote = await get_quote_or_404(db, quote_id)
         if quote.status in ("accepted", "arrived"):
             raise ConflictError("پیشنهادهای پذیرفته‌شده یا رسیده قابل حذف نیستند")
@@ -712,18 +818,49 @@ async def delete_quote(db: AsyncSession, quote_id: UUID) -> dict:
         termsheets = (await db.execute(select(Termsheet).where(Termsheet.quote_id == quote.id))).scalars().all()
         events = (await db.execute(select(QuoteEvent).where(QuoteEvent.quote_id == quote.id))).scalars().all()
 
+        # collect candidate material_ids for orphan cleanup before deleting quote
+        candidate_material_ids = [li.material_id for li in line_items if li.material_id is not None]
+
+        # collect attachment keys before deleting quote row
+        from app.models.files import QuoteAttachment
+        from app.services import storage
+
+        attachments = (await db.execute(select(QuoteAttachment).where(QuoteAttachment.quote_id == quote.id))).scalars().all()
+        att_keys = [att.object_key for att in attachments]
+        quote_prefix = f"{quote.id}/"
+
         await db.delete(quote)
-        return {
-            "id": str(quote.id),
-            "deleted": True,
-            "cascaded": {
-                "line_items": len(line_items),
-                "termsheets": len(termsheets),
-                "events": len(events),
-                "decisions": len(decisions),
-                "receipts": len(receipts),
-            },
-        }
+        await db.flush()
+
+        # Purge any materials that no longer have any references in the system
+        purged_material_ids = await cleanup_orphan_materials(db, candidate_material_ids)
+
+    # Post-commit: clean up attachments in MinIO (best-effort; DB is already committed)
+    for key in att_keys:
+        try:
+            await storage.remove_object(key)
+        except Exception:
+            logger.warning("Failed to remove MinIO object %s for quote %s", key, quote_id)
+    try:
+        await storage.remove_prefix(quote_prefix)
+    except Exception:
+        logger.warning("Failed to remove MinIO prefix %s for quote %s", quote_prefix, quote_id)
+
+    return {
+        "id": str(quote_id),
+        "deleted": True,
+        "cascaded": {
+            "line_items": len(line_items),
+            "termsheets": len(termsheets),
+            "events": len(events),
+            "decisions": len(decisions),
+            "receipts": len(receipts),
+            "attachments": len(attachments),
+            "purged_orphan_materials": len(purged_material_ids),
+        },
+    }
+
+
 
 
 # ---------------------------------------------------------------------------

backend/app/services/storage.py

@@ -66,3 +66,22 @@ async def remove_object(key: str) -> None:
         await asyncio.to_thread(get_client().remove_object, settings.MINIO_BUCKET, key)
     except Exception:
         logger.warning("Could not remove MinIO object %r — ignoring", key)
+
+
+async def remove_prefix(prefix: str) -> None:
+    """Delete all objects matching a prefix in the bucket (best-effort)."""
+    client = get_client()
+
+    def _sync_remove_prefix():
+        try:
+            objects = client.list_objects(settings.MINIO_BUCKET, prefix=prefix, recursive=True)
+            for obj in objects:
+                try:
+                    client.remove_object(settings.MINIO_BUCKET, obj.object_name)
+                except Exception:
+                    logger.warning("Could not remove MinIO object %r under prefix %r", obj.object_name, prefix)
+        except Exception:
+            logger.warning("Could not list MinIO objects under prefix %r — ignoring", prefix)
+
+    await asyncio.to_thread(_sync_remove_prefix)
+

backend/app/utils/audit.py

@@ -0,0 +1,41 @@
+"""Audit helper — one row per sensitive mutation, written in the SAME
+transaction as the change (rolled back together with it).
+
+    await record(db, actor=ctx.display_name, action="user.role_changed",
+                 entity="user", entity_id=str(user.id),
+                 details={"from": old_role, "to": user.role})
+
+Never raises: an audit failure must not fail the business operation.
+"""
+import logging
+from typing import Any
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.audit import AuditLog
+
+logger = logging.getLogger("procurement.audit")
+
+
+async def record(
+    db: AsyncSession,
+    *,
+    actor: str | None,
+    action: str,
+    entity: str,
+    entity_id: str | None = None,
+    details: dict[str, Any] | None = None,
+) -> None:
+    try:
+        db.add(
+            AuditLog(
+                actor=actor,
+                action=action,
+                entity=entity,
+                entity_id=str(entity_id) if entity_id else None,
+                details=details or {},
+            )
+        )
+        await db.flush()
+    except Exception:  # noqa: BLE001 — audit must never break the caller
+        logger.exception("failed to write audit_log row (%s/%s)", action, entity)

backend/app/utils/ratelimit.py

@@ -0,0 +1,11 @@
+"""Shared rate limiter (slowapi) — in-memory, single-worker friendly.
+
+Login brute-force brake: the edge (Traefik) has a coarse per-IP limit for
+the whole API host; this adds a tight limit on the credential endpoint
+itself. Kept in its own module so routers can import it without a circular
+import on app.main.
+"""
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+limiter = Limiter(key_func=get_remote_address)

backend/app/utils/security.py

@@ -1,14 +1,33 @@
-"""Placeholder auth: no middleware logic, only a header read for `actor` attribution."""
+"""Attribution for quote_events.actor — the VERIFIED user, not the raw token.
+
+Historically this stored the bearer token string verbatim (unverifiable and
+a token leak into the database). All routes that use it now sit behind the
+global JWT dependency, so the token is resolved to the authenticated user
+and the display name is recorded instead.
+"""
 from fastapi import Request
 
+from app.auth import get_optional_user
 
-def get_actor(request: Request) -> str | None:
-    """Extract the bearer token (if any) to attribute quote_events.actor.
 
-    This is the reserved placeholder from the contract — no authentication
-    or authorization is enforced yet.
+async def get_actor(request: Request) -> str | None:
+    """Resolve the caller's display name from the Casdoor Bearer token.
+
+    Uses its own session (get_optional_user default) — same reason as
+    get_current_user: quote routers open explicit db.begin() blocks.
     """
-    auth = request.headers.get("Authorization")
-    if auth and auth.lower().startswith("bearer "):
-        return auth[7:].strip() or None
-    return None
+    ctx = await get_optional_user(request)
+    if ctx is not None:
+        return ctx.display_name
+    # Dev-mode header fallback (only active when DEV_LOGIN_ENABLED) carries
+    # the name in X-User-Name / X-User-Name-B64 — keep attribution useful.
+    name = request.headers.get("x-user-name")
+    import base64
+
+    b64 = request.headers.get("x-user-name-b64")
+    if b64:
+        try:
+            name = base64.b64decode(b64.encode()).decode("utf-8")
+        except Exception:
+            pass
+    return name

backend/requirements.txt

@@ -10,3 +10,13 @@ minio>=7.2.0
 # v2.6 — Casdoor JWT auth
 pyjwt[crypto]>=2.8.0
 httpx>=0.27.0
+
+# Casdoor seeding — bcrypt password hashes (never plaintext)
+bcrypt>=4.1.0
+
+# Observability — metrics + Sentry/GlitchTip exception capture
+prometheus-fastapi-instrumentator>=7.0.0
+sentry-sdk[fastapi]>=2.0.0
+
+# Rate limiting (login brute-force brake; edge limit lives in Traefik)
+slowapi>=0.1.9

backend/tools/seed_casdoor.py

@@ -20,22 +20,34 @@ import json
 import os
 import urllib.request
 
+import bcrypt
+
 BASE = os.environ.get("CASDOOR_BASE", "http://localhost:8080")
 ADMIN = os.environ.get("CASDOOR_ADMIN", "admin")
+# Casdoor's own bootstrap default for the built-in console admin is "123" —
+# the seeder LOGS IN with it (it cannot change the console password).
+# Override with CASDOOR_ADMIN_PW after rotating (docs/SECRET-MANAGEMENT.md);
+# production MUST set a real value here once the console password is rotated.
 ADMIN_PW = os.environ.get("CASDOOR_ADMIN_PW", "123")
 
 ORG = "inventory"
 APP = "inventory-app"
 CLIENT_ID = "inventory-app-client"
-CLIENT_SECRET = "inventory-app-secret-2026"
+# Must MATCH the API's PROCUREMENT_CASDOOR_CLIENT_SECRET (compose default
+# below) — changing one without the other breaks POST /auth/login.
+CLIENT_SECRET = os.environ.get("CASDOOR_CLIENT_SECRET", "inventory-app-secret-2026")
 REDIRECT_URI = "http://localhost/login"  # Traefik edge (v1.3); unused by the in-page flow
 
+# One password for all seeded dev users — override with CASDOOR_SEED_PASSWORD;
+# stored as a bcrypt hash (passwordType "bcrypt"), never plaintext.
+SEED_PASSWORD = os.environ.get("CASDOOR_SEED_PASSWORD", "123456")
+
 USERS = [
-    # (name, first_name, last_name, email, password)
-    ("razaei", "آقای", "رضایی", "razaei@sample.ir", "123456"),
-    ("mousavi", "آقای", "موسوی", "mousavi@sample.ir", "123456"),
-    ("mohaghegh", "آقای", "محقق", "mohaghegh@sample.ir", "123456"),
-    ("tester", "کاربر", "تست", "tester@sample.ir", "123456"),
+    # (name, first_name, last_name, email)
+    ("razaei", "آقای", "رضایی", "razaei@sample.ir"),
+    ("mousavi", "آقای", "موسوی", "mousavi@sample.ir"),
+    ("mohaghegh", "آقای", "محقق", "mohaghegh@sample.ir"),
+    ("tester", "کاربر", "تست", "tester@sample.ir"),
 ]
 
 
@@ -69,17 +81,21 @@ def _login():
     return jar
 
 
+def _bcrypt(pw: str) -> str:
+    return bcrypt.hashpw(pw.encode("utf-8"), bcrypt.gensalt()).decode("ascii")
+
+
 def main():
     cookies = _login()
     if cookies is None:
         return
 
-    # 1) organization (passwordType "plain" = dev: passwords stored as-is)
+    # 1) organization (bcrypt — passwords are never stored plaintext)
     status, body = _request("POST", "/api/add-organization", {
         "owner": "admin",
         "name": ORG,
         "displayName": "سازمان تدارکات",
-        "passwordType": "plain",
+        "passwordType": "bcrypt",
     }, cookies)
     print("add-organization:", status, body.get("msg", body.get("error", "")))
 
@@ -102,7 +118,8 @@ def main():
     print("add-application:", status, body.get("msg", body.get("error", "")))
 
     # 3) users (roles are NOT stored here — they live in the app's users table)
-    for name, first, last, email, pw in USERS:
+    pw_hash = _bcrypt(SEED_PASSWORD)
+    for name, first, last, email in USERS:
         status, body = _request("POST", "/api/add-user", {
             "owner": ORG,
             "name": name,
@@ -110,21 +127,23 @@ def main():
             "firstName": first,
             "lastName": last,
             "email": email,
-            "password": pw,
-            "passwordType": "plain",
+            "password": pw_hash,
+            "passwordType": "bcrypt",
             "phone": "",
             "type": "normal-user",
         }, cookies)
         print(f"add-user {name}:", status, body.get("msg", body.get("error", "")))
         # Ensure passwordType even for already-existing users (this Casdoor
         # version refuses login when both user and org passwordType are empty).
-        status, body = _request("POST", f"/api/update-user?id={ORG}/{name}&columns=password_type", {
-            "passwordType": "plain",
+        status, body = _request("POST", f"/api/update-user?id={ORG}/{name}&columns=password_type,password", {
+            "passwordType": "bcrypt",
+            "password": pw_hash,
         }, cookies)
         print(f"set-password-type {name}:", status, body.get("msg", body.get("error", "")))
 
-    print("\nDone. Casdoor console: http://localhost:8080 (admin/123)")
-    print("Login in the app: http://localhost:3000/login")
+    print("\nDone. Casdoor console: http://localhost:8080")
+    print(f"Seeded users password: {SEED_PASSWORD} (change via CASDOOR_SEED_PASSWORD)")
+    print("Login in the app: http://localhost/login")
 
 
 if __name__ == "__main__":

backend/tools/smoke_test.py

@@ -1,9 +1,14 @@
 """End-to-end smoke tests against a running server (http://127.0.0.1:8000).
 
-Run:  .venv/Scripts/python.exe tools/smoke_test.py
+Dataset-independent: assertions verify BEHAVIOR (status codes, envelopes,
+shapes, filtering) rather than exact seed counts, so the suite works with
+any seed version. Run from the api container or a host with access:
+
+Run:  python tools/smoke_test.py
+Env:  SMOKE_USER / SMOKE_PASSWORD (default tester / 123456 — seeded users)
 """
+import os
 import sys
-from pprint import pprint
 
 import httpx
 
@@ -23,84 +28,150 @@ def check(name, ok, extra=""):
 
 c = httpx.Client(base_url=BASE, timeout=30)
 
+# ---------- auth: every endpoint now requires a Casdoor JWT ----------
+r = c.post("/auth/login", json={
+    "username": os.environ.get("SMOKE_USER", "tester"),
+    "password": os.environ.get("SMOKE_PASSWORD", "123456"),
+})
+check("POST /auth/login", r.status_code == 200, r.text[:200])
+if r.status_code == 200:
+    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"
+
 # ---------- catalog ----------
 r = c.get("/units", params={"page_size": 5})
-check("GET /units", r.status_code == 200 and len(r.json()["data"]) == 5 and "si_factor" in r.json()["data"][0])
+units = r.json()["data"] if r.status_code == 200 else []
+check("GET /units", r.status_code == 200 and len(units) == 5 and "si_factor" in units[0])
 
-r = c.get("/units", params={"dimension": "mass"})
-check("GET /units?dimension=mass", r.status_code == 200 and r.json()["meta"]["total"] == 3)
+if units:
+    dim = units[0]["dimension"]
+    r = c.get("/units", params={"dimension": dim, "page_size": 100})
+    body = r.json()
+    check(
+        "GET /units?dimension filter",
+        r.status_code == 200 and body["meta"]["total"] >= 1
+        and all(u["dimension"] == dim for u in body["data"]),
+        r.text[:200],
+    )
 
 r = c.get("/brands")
-check("GET /brands", r.status_code == 200 and r.json()["meta"]["total"] == 10)
+brands = r.json()["data"] if r.status_code == 200 else []
+check("GET /brands", r.status_code == 200 and brands and r.json()["meta"]["total"] >= 1)
 
-r = c.get("/material-categories", params={"q": "سیمان"})
-check("GET /material-categories?q", r.status_code == 200 and r.json()["meta"]["total"] >= 1)
-
-r = c.get("/materials", params={"q": "میلگرد A3 سایز ۱۴"})
-check("GET /materials?q (unicode)", r.status_code == 200 and r.json()["meta"]["total"] == 1, r.text[:200])
-
-r = c.get("/materials", params={"expand": "category,brands,canonical_unit,attributes", "q": "میلگرد A3 سایز ۱۴"})
-if r.status_code == 200 and r.json()["data"]:
-    m = r.json()["data"][0]
+# category q-search (only when categories exist)
+r = c.get("/material-categories", params={"page_size": 100})
+cats = r.json()["data"] if r.status_code == 200 else []
+check("GET /material-categories", r.status_code == 200 and isinstance(cats, list))
+if cats:
+    needle = cats[0]["name"][:3]
+    r = c.get("/material-categories", params={"q": needle})
     check(
-        "GET /materials expand",
-        "category" in m and "brands" in m and "canonical_unit" in m and "attributes" in m,
+        "GET /material-categories?q (unicode search)",
+        r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200],
     )
-    check("expand category shape", m["category"].keys() == {"id", "slug", "name"})
-    check("expand brands has catalog_code+is_active", all(set(b) >= {"id", "name", "catalog_code", "is_active"} for b in m["brands"]))
-    check("expand canonical_unit shape", m["canonical_unit"].keys() == {"id", "code", "name_fa"})
-    check("expand attributes EAV flattened", all(set(a) >= {"attribute_key", "label", "data_type", "value", "unit"} for a in m["attributes"]))
+
+# materials: q-search against a REAL seeded name (fetched, not hard-coded)
+r = c.get("/materials", params={"page_size": 100})
+materials = r.json()["data"] if r.status_code == 200 else []
+check("GET /materials", r.status_code == 200 and materials and r.json()["meta"]["total"] >= 1)
+
+if materials:
+    target = materials[0]
+    needle = target["name"].split()[0]
+    r = c.get("/materials", params={"q": needle})
+    check(
+        "GET /materials?q (unicode search)",
+        r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200],
+    )
+
+    r = c.get("/materials", params={"expand": "category,brands,canonical_unit,attributes", "q": needle})
+    expanded = [m for m in r.json().get("data", []) if m["id"] == target["id"]]
+    if r.status_code == 200 and expanded:
+        m = expanded[0]
+        check(
+            "GET /materials expand",
+            "category" in m and "brands" in m and "canonical_unit" in m and "attributes" in m,
+        )
+        check("expand category shape", m["category"].keys() == {"id", "slug", "name"})
+        check("expand brands shape", all(set(b) >= {"id", "name", "catalog_code", "is_active"} for b in m["brands"]))
+        check("expand canonical_unit shape", m["canonical_unit"].keys() == {"id", "code", "name_fa"})
+        check("expand attributes EAV flattened", all(set(a) >= {"attribute_key", "label", "data_type", "value", "unit"} for a in m["attributes"]))
+    else:
+        check("GET /materials expand", False, r.text[:300])
+
+# ---------- EAV filters (positive filter only when the seed has values) ----------
+r = c.get("/attribute-definitions", params={"page_size": 100})
+attr_defs = r.json()["data"] if r.status_code == 200 else []
+
+if attr_defs and materials:
+    r = c.get("/materials", params={"expand": "attributes", "page_size": 100})
+    with_attrs = [m for m in r.json().get("data", []) if m.get("attributes")]
+    if with_attrs:
+        m0 = with_attrs[0]
+        key = m0["attributes"][0]["attribute_key"]
+        value = str(m0["attributes"][0]["value"])
+        r = c.get("/materials", params={f"attr_{key}": value, "expand": "attributes"})
+        check(
+            f"GET /materials?attr_{key} filter",
+            r.status_code == 200 and any(x["id"] == m0["id"] for x in r.json().get("data", [])),
+            r.text[:200],
+        )
+    else:
+        print("  SKIP  EAV positive filter — seed defines no material attribute values")
 else:
-    check("GET /materials expand", False, r.text[:300])
+    print("  SKIP  EAV positive filter — seed defines no attribute definitions")
 
-# dynamic EAV filter: attr_rebar_diameter=14
-r = c.get("/materials", params={"attr_rebar_diameter": "14", "expand": "attributes"})
-if r.status_code == 200:
-    data = r.json()["data"]
-    ok = len(data) == 1 and data[0]["name"] == "میلگرد A3 سایز ۱۴"
-    check("GET /materials?attr_rebar_diameter=14", ok, r.text[:200])
-else:
-    check("GET /materials?attr_rebar_diameter=14", False, r.text[:200])
-
-# EAV boolean filter: attr_rebar_ribbed=true
-r = c.get("/materials", params={"attr_rebar_ribbed": "true"})
-check("GET /materials?attr_rebar_ribbed=true", r.status_code == 200 and r.json()["meta"]["total"] == 1, r.text[:200])
-
-# brand filter
-r = c.get("/brands", params={"q": "فولاد مبارکه"})
-brand_id = r.json()["data"][0]["id"]
-r = c.get("/materials", params={"brand_id": brand_id})
-check("GET /materials?brand_id=", r.status_code == 200 and r.json()["meta"]["total"] == 3, r.text[:200])
-
-# unknown attr filter -> 400
+# unknown attr filter -> 400 (dataset-independent)
 r = c.get("/materials", params={"attr_nonexistent": "1"})
 check("unknown attr filter -> 400", r.status_code == 400 and r.json()["error"]["code"] == "VALIDATION_ERROR")
 
 r = c.get("/materials?page_size=999")
 check("page_size>100 -> 400", r.status_code == 400)
 
+# brand filter via a brand that actually has material links
+r = c.get("/brand-materials", params={"page_size": 100})
+brand_links = r.json()["data"] if r.status_code == 200 else []
+if brand_links:
+    brand_id = brand_links[0]["brand_id"]
+    r = c.get("/materials", params={"brand_id": brand_id})
+    check("GET /materials?brand_id=", r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200])
+    r = c.get("/brand-materials", params={"brand_id": brand_id})
+    check("GET /brand-materials?brand_id", r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200])
+else:
+    check("GET /materials?brand_id=", False, "seed has no brand-material links")
+
+# ---------- suppliers / projects ----------
 r = c.get("/suppliers")
-check("GET /suppliers", r.status_code == 200 and r.json()["meta"]["total"] == 6)
+suppliers = r.json()["data"] if r.status_code == 200 else []
+check("GET /suppliers", r.status_code == 200 and suppliers)
 
 r = c.get("/projects")
-check("GET /projects", r.status_code == 200 and r.json()["meta"]["total"] == 5)
+projects = r.json()["data"] if r.status_code == 200 else []
+check("GET /projects", r.status_code == 200 and projects)
 
-r = c.get("/attribute-definitions", params={"expand": "unit"})
-check("GET /attribute-definitions", r.status_code == 200 and r.json()["meta"]["total"] == 28, r.text[:200])
+r = c.get("/attribute-definitions")
+attr_shape_ok = r.status_code == 200 and all(
+    set(a) >= {"attribute_key", "label", "data_type"} for a in r.json().get("data", [])
+)
+check("GET /attribute-definitions", attr_shape_ok, r.text[:200])
 
-r = c.get("/material-categories/{cid}/attributes".format(cid=c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]["id"]))
-check("GET category attributes (nested attribute)", r.status_code == 200 and len(r.json()["data"]) == 3 and "attribute" in r.json()["data"][0])
-
-r = c.get("/brand-materials", params={"brand_id": brand_id})
-check("GET /brand-materials?brand_id", r.status_code == 200 and r.json()["meta"]["total"] == 3)
+if cats:
+    r = c.get(f"/material-categories/{cats[0]['id']}/attributes")
+    check(
+        "GET category attributes (nested)",
+        r.status_code == 200 and isinstance(r.json()["data"], list)
+        and all("attribute" in a for a in r.json()["data"]),
+        r.text[:200],
+    )
 
 # ---------- quotes ----------
 r = c.get("/quotes", params={"page_size": 5})
-check("GET /quotes", r.status_code == 200 and r.json()["meta"]["total"] == 7, r.text[:300])
+quotes = r.json()["data"] if r.status_code == 200 else []
+check("GET /quotes", r.status_code == 200 and quotes and r.json()["meta"]["total"] >= 1)
 
-r = c.get("/quotes", params={"expand": "line_items,termsheets,events,supplier,project", "status": "accepted"})
-if r.status_code == 200 and r.json()["data"]:
-    q = r.json()["data"][0]
+r = c.get("/quotes", params={"expand": "line_items,termsheets,events,supplier,project"})
+accepted = [q for q in r.json().get("data", []) if q.get("line_items")] if r.status_code == 200 else []
+if accepted:
+    q = accepted[0]
     li = q["line_items"][0]
     check(
         "GET /quotes expand full shape",
@@ -111,21 +182,34 @@ if r.status_code == 200 and r.json()["data"]:
         r.text[:400],
     )
     check("events sorted ASC", [e["event_type"] for e in q["events"]] == sorted([e["event_type"] for e in q["events"]]))
-    check("termsheet has schedule_steps", "schedule_steps" in q["termsheets"][0])
+    if q["termsheets"]:
+        check("termsheet has schedule_steps", "schedule_steps" in q["termsheets"][0])
 else:
     check("GET /quotes expand full shape", False, r.text[:400])
 
 r = c.get("/quotes/stats")
-check("GET /quotes/stats", r.status_code == 200 and r.json()["data"]["total"] == 7 and "average_lead_time_days" in r.json()["data"], r.text[:300])
+stats_ok = r.status_code == 200 and "average_lead_time_days" in r.json()["data"]
+if quotes:
+    stats_ok = stats_ok and r.json()["data"]["total"] == r.json()["data"]["offered"] + \
+        r.json()["data"]["accepted"] + r.json()["data"]["arrived"] + \
+        r.json()["data"]["rejected"] + r.json()["data"]["expired"]
+check("GET /quotes/stats", stats_ok, r.text[:300])
 
 r = c.get("/quotes/stats", params={"status": "offered"})  # status filter not part of stats contract; ensure no crash
 check("GET /quotes/stats (extra param ignored)", r.status_code == 200)
 
-r = c.get("/quotes", params={"q": "میلگرد"})
-check("GET /quotes?q (searches material names)", r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:300])
+if materials:
+    needle = materials[0]["name"].split()[0]
+    r = c.get("/quotes", params={"q": needle})
+    check("GET /quotes?q (searches material names)", r.status_code == 200, r.text[:300])
 
-r = c.get("/projects/{pid}/stats".format(pid=c.get("/projects", params={"q": "ونوس"}).json()["data"][0]["id"]))
-check("GET /projects/{id}/stats", r.status_code == 200 and set(r.json()["data"]) >= {"total_quotes", "offered", "accepted", "arrived", "rejected", "expired"}, r.text[:300])
+if projects:
+    r = c.get(f"/projects/{projects[0]['id']}/stats")
+    check(
+        "GET /projects/{id}/stats",
+        r.status_code == 200 and set(r.json()["data"]) >= {"total_quotes", "offered", "accepted", "arrived", "rejected", "expired"},
+        r.text[:300],
+    )
 
 print(f"\n===== {PASS} passed, {FAIL} failed =====")
 sys.exit(1 if FAIL else 0)

backend/tools/smoke_test_misc.py

@@ -19,9 +19,20 @@ def check(name, ok, extra=""):
 
 c = httpx.Client(base_url=BASE, timeout=30)
 
+# ---------- auth: every endpoint now requires a Casdoor JWT ----------
+import os
+
+r = c.post("/auth/login", json={
+    "username": os.environ.get("SMOKE_USER", "tester"),
+    "password": os.environ.get("SMOKE_PASSWORD", "123456"),
+})
+check("POST /auth/login", r.status_code == 200, r.text[:200])
+if r.status_code == 200:
+    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"
+
 # ---------- units ----------
 r = c.post("/units", json={"code": "test-unit", "name_fa": "واحد تست", "dimension": "count", "si_factor": 1.0})
-check("POST /units", r.status_code == 201 and r.json()["data"]["id"] > 19, r.text[:200])
+check("POST /units", r.status_code == 201 and r.json()["data"]["si_factor"] == 1.0, r.text[:200])
 uid = r.json()["data"]["id"]
 r = c.post("/units", json={"code": "test-unit", "si_factor": 1.0})
 check("POST /units duplicate code -> 409", r.status_code == 409, r.text[:200])
@@ -42,21 +53,28 @@ r = c.patch(f"/brands/{bid}", json={"name": "برند تست ۲"})
 check("PATCH /brands", r.status_code == 200 and r.json()["data"]["name"] == "برند تست ۲")
 r = c.delete(f"/brands/{bid}")
 check("DELETE /brands (unused)", r.status_code == 200)
-r = c.get("/brands", params={"q": "فولاد مبارکه"})
-brand = r.json()["data"][0]
+_bml = c.get("/brand-materials", params={"page_size": 1}).json()["data"]
+if _bml:
+    brand = {"id": _bml[0]["brand_id"]}
+else:
+    brand = c.get("/brands", params={"page_size": 1}).json()["data"][0]
 r = c.delete(f"/brands/{brand['id']}")
 check("DELETE /brands with associations -> 409", r.status_code == 409, r.text[:200])
 
 # ---------- categories ----------
 r = c.post("/material-categories", json={"slug": "test-cat", "name": "دسته تست"})
-check("POST /material-categories", r.status_code == 201, r.text[:200])
-cid = r.json()["data"]["id"]
+if r.status_code == 409:  # rerun safety — fetch the existing test category
+    cid = c.get("/material-categories", params={"q": "test-cat"}).json()["data"][0]["id"]
+    check("POST /material-categories (exists from previous run)", True)
+else:
+    check("POST /material-categories", r.status_code == 201, r.text[:200])
+    cid = r.json()["data"]["id"]
 r = c.patch(f"/material-categories/{cid}", json={"name": "دسته تست ۲", "is_active": False})
 check("PATCH /material-categories", r.status_code == 200 and r.json()["data"]["is_active"] is False)
 r = c.delete(f"/material-categories/{cid}")
 check("DELETE /material-categories (empty)", r.status_code == 200)
-r = c.get("/material-categories", params={"q": "میلگرد"})
-cat = r.json()["data"][0]
+_mat0 = c.get("/materials", params={"page_size": 1, "expand": "category"}).json()["data"][0]
+cat = _mat0["category"]
 r = c.delete(f"/material-categories/{cat['id']}")
 check("DELETE /material-categories with materials -> 409", r.status_code == 409, r.text[:200])
 
@@ -75,11 +93,16 @@ r = c.patch(f"/attribute-definitions/{adid}", json={"data_type": "number"})
 check("PATCH data_type with no values -> OK", r.status_code == 200 and r.json()["data"]["data_type"] == "number", r.text[:200])
 
 # use a DEDICATED test material so the seed material's EAV values stay intact
-cat = c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]
+# (dataset-independent: any category; rerun reuses the existing test material)
+cat = c.get("/material-categories", params={"page_size": 1}).json()["data"][0]
 unit_kg = c.get("/units", params={"q": "kg"}).json()["data"][0]["id"]
 r = c.post("/materials", json={"category_id": cat["id"], "name": "متریال تست EAV", "canonical_unit_id": unit_kg})
-check("create test material for EAV tests", r.status_code == 201, r.text[:200])
-tmat = r.json()["data"]
+if r.status_code == 409:  # rerun
+    tmat = c.get("/materials", params={"q": "متریال تست EAV"}).json()["data"][0]
+    check("create test material for EAV tests (exists from previous run)", True)
+else:
+    check("create test material for EAV tests", r.status_code == 201, r.text[:200])
+    tmat = r.json()["data"]
 mat = tmat
 r = c.put(f"/materials/{mat['id']}/attribute-values", json={"attributes": [
     {"attribute_definition_id": adid, "value": 5},
@@ -99,7 +122,11 @@ check("DELETE attribute-definition (no values) -> 200", r.status_code == 200, r.
 # ---------- category attributes ----------
 # use a FRESH definition so the pair is not already in the seed junction
 r = c.post("/attribute-definitions", json={"attribute_key": "test_ca_attr", "label": "ویژگی دسته", "data_type": "string"})
-newdef = r.json()["data"]
+if r.status_code == 409:  # rerun safety — fetch the existing definition
+    newdef = next(d for d in c.get("/attribute-definitions", params={"page_size": 100}).json()["data"]
+                  if d["attribute_key"] == "test_ca_attr")
+else:
+    newdef = r.json()["data"]
 r = c.post(f"/material-categories/{cat['id']}/attributes", json={"attribute_definition_id": newdef["id"], "is_required": True, "sort_order": 9})
 check("POST category attribute", r.status_code == 201 and r.json()["data"]["attribute"]["attribute_key"] == "test_ca_attr", r.text[:200])
 r = c.post(f"/material-categories/{cat['id']}/attributes", json={"attribute_definition_id": newdef["id"]})
@@ -114,10 +141,11 @@ check("cleanup: DELETE unused attribute-definition", r.status_code == 200)
 # ---------- material units ----------
 r = c.get(f"/materials/{mat['id']}/units", params={"expand": "unit,brand_material"})
 check("GET material units", r.status_code == 200, r.text[:200])
-r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": 6, "conversion_factor": 0.001, "is_default": False})
+_unit_other = next(u for u in c.get("/units", params={"page_size": 100}).json()["data"] if u["code"] != "kg")
+r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": _unit_other["id"], "conversion_factor": 0.001, "is_default": False})
 check("POST material unit", r.status_code == 201, r.text[:200])
 muid = r.json()["data"]["id"]
-r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": 6, "conversion_factor": 2})
+r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": _unit_other["id"], "conversion_factor": 2})
 check("POST material unit duplicate -> 409", r.status_code == 409, r.text[:200])
 r = c.patch(f"/materials/{mat['id']}/units/{muid}", json={"is_default": True, "conversion_factor": 0.002})
 check("PATCH material unit (is_default)", r.status_code == 200 and r.json()["data"]["is_default"] is True)
@@ -125,10 +153,10 @@ r = c.delete(f"/materials/{mat['id']}/units/{muid}")
 check("DELETE material unit", r.status_code == 200)
 
 # ---------- brand materials ----------
-r = c.get("/materials", params={"q": "سیمان پرتلند تیپ ۲"})
-m2 = r.json()["data"][0]
-r = c.get("/brands", params={"q": "Bosch"})
-b2 = r.json()["data"][0]
+# dataset-independent: any material + a freshly created brand (no existing link)
+m2 = c.get("/materials", params={"page_size": 1}).json()["data"][0]
+r = c.post("/brands", json={"name": "برند لینک تست", "country": "ایران"})
+b2 = r.json()["data"] if r.status_code == 201 else c.get("/brands", params={"q": "برند لینک تست"}).json()["data"][0]
 r = c.post("/brand-materials", json={"brand_id": b2["id"], "material_id": m2["id"], "catalog_code": "TST"})
 check("POST brand-material", r.status_code == 201, r.text[:200])
 bmid = r.json()["data"]["id"]
@@ -140,18 +168,18 @@ r = c.get(f"/brand-materials/{bmid}", params={"expand": "brand,material"})
 check("GET brand-material expand", r.status_code == 200 and "brand" in r.json()["data"] and "material" in r.json()["data"])
 r = c.delete(f"/brand-materials/{bmid}")
 check("DELETE brand-material", r.status_code == 200)
+r = c.delete(f"/brands/{b2['id']}")
+check("cleanup: DELETE link-test brand", r.status_code == 200, r.text[:200])
 
 # ---------- supplier/project patches ----------
-r = c.get("/suppliers", params={"q": "آریا"})
-s1 = r.json()["data"][0]
+s1 = c.get("/suppliers", params={"page_size": 1}).json()["data"][0]
 r = c.patch(f"/suppliers/{s1['id']}", json={"phone": "021-00000000"})
 check("PATCH /suppliers", r.status_code == 200 and r.json()["data"]["phone"] == "021-00000000")
 r = c.patch(f"/suppliers/{s1['id']}", json={"phone": "021-55123456"})
-r = c.get("/projects", params={"q": "ونوس"})
-p1 = r.json()["data"][0]
+p1 = c.get("/projects", params={"page_size": 1}).json()["data"][0]
 r = c.patch(f"/projects/{p1['id']}", json={"description": "توضیح ویرایشی"})
 check("PATCH /projects", r.status_code == 200 and r.json()["data"]["description"] == "توضیح ویرایشی")
-r = c.patch(f"/projects/{p1['id']}", json={"description": "ساختمان ۱۸ طبقه مسکونی در زعفرانیه"})
+r = c.patch(f"/projects/{p1['id']}", json={"description": p1.get("description")})
 
 # ---------- quote PATCH metadata ----------
 r = c.get("/quotes", params={"status": "offered", "page_size": 1})
@@ -166,16 +194,17 @@ r = c.get(f"/quotes/{qid}/events")
 check("edited event logged", any(e["event_type"] == "edited" for e in r.json()["data"]))
 
 # ---------- termsheet delete rules ----------
+# termsheet-count tolerance: this suite needs >=2 termsheets on the picked quote
 r = c.get(f"/quotes/{qid}/termsheets")
 ts = r.json()["data"]
-if len(ts) == 1:
+while len(ts) < 2:
     r = c.post(f"/quotes/{qid}/termsheets", json={"label": "ثانویه", "schedule_steps": [{"due_date": "2026-12-01", "amount": 10}]})
-    check("POST second termsheet", r.status_code == 201, r.text[:200])
-    ts = r.json()["data"]
+    check("POST additional termsheet", r.status_code == 201, r.text[:200])
     ts = c.get(f"/quotes/{qid}/termsheets").json()["data"]
 r = c.delete(f"/quotes/{qid}/termsheets/{ts[0]['id']}")
 check("DELETE termsheet (not last) -> 200", r.status_code == 200, r.text[:200])
-r = c.delete(f"/quotes/{qid}/termsheets/{ts[1]['id']}")
+_remaining = c.get(f"/quotes/{qid}/termsheets").json()["data"]
+r = c.delete(f"/quotes/{qid}/termsheets/{_remaining[-1]['id']}")
 check("DELETE last termsheet -> 409", r.status_code == 409, r.text[:200])
 # restore a second termsheet for later tests
 r = c.post(f"/quotes/{qid}/termsheets", json={"label": "ثانویه ۲", "schedule_steps": [{"due_date": "2026-12-01", "amount": 10}]})
@@ -192,31 +221,52 @@ if len(steps) > 1:
 r = c.delete(f"/quotes/{qid}/termsheets/{ts0['id']}/schedule-steps/{steps[-1]['id']}")
 check("DELETE last schedule-step -> 409", r.status_code == 409, r.text[:200])
 
-# ---------- decision rules (on a pending quote) ----------
-r = c.get(f"/quotes/{qid}/line-items")
-li = r.json()["data"][0]
-r = c.put(f"/quotes/{qid}/line-items/{li['id']}/decision", json={"status": "chosen", "chosen_item_termsheet_id": "00000000-0000-0000-0000-000000000000"})
-check("PUT decision chosen with foreign link -> 400", r.status_code == 400, r.text[:200])
-r = c.put(f"/quotes/{qid}/line-items/{li['id']}/decision", json={"status": "rejected"})
-check("PUT decision rejected", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
-r = c.put(f"/quotes/{qid}/line-items/{li['id']}/decision", json={"status": "chosen"})
-check("PUT decision rejected->chosen -> 409", r.status_code == 409, r.text[:200])
-r = c.patch(f"/quotes/{qid}/line-items/{li['id']}/decision/status", json={"status": "pending"})
-# pending is NOT an accepted payload value — the endpoint only transitions to chosen/rejected
-check("PATCH decision status to pending -> 400", r.status_code == 400, r.text[:200])
+# ---------- decision rules (need a PENDING decision — rerun-safe pick) ----------
+_pending = None
+for _qo in c.get("/quotes", params={"status": "offered", "page_size": 20, "expand": "line_items"}).json()["data"]:
+    for _lix in _qo["line_items"]:
+        if _lix.get("decision") and _lix["decision"]["status"] == "pending":
+            _pending = (_qo["id"], _lix)
+            break
+    if _pending:
+        break
+if _pending:
+    _qid2, li = _pending
+    r = c.put(f"/quotes/{_qid2}/line-items/{li['id']}/decision", json={"status": "chosen", "chosen_item_termsheet_id": "00000000-0000-0000-0000-000000000000"})
+    check("PUT decision chosen with foreign link -> 400", r.status_code == 400, r.text[:200])
+    r = c.put(f"/quotes/{_qid2}/line-items/{li['id']}/decision", json={"status": "rejected"})
+    check("PUT decision rejected", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
+    r = c.put(f"/quotes/{_qid2}/line-items/{li['id']}/decision", json={"status": "chosen"})
+    check("PUT decision rejected->chosen -> 409", r.status_code == 409, r.text[:200])
+    r = c.patch(f"/quotes/{_qid2}/line-items/{li['id']}/decision/status", json={"status": "pending"})
+    # pending is NOT an accepted payload value — the endpoint only transitions to chosen/rejected
+    check("PATCH decision status to pending -> 400", r.status_code == 400, r.text[:200])
+else:
+    print("  SKIP  decision rules — no offered quote with a pending decision")
 
 # ---------- item termsheets ----------
-r = c.get(f"/quotes/{qid}/line-items/{li['id']}/termsheets")
-its = r.json()["data"]
-r = c.patch(f"/quotes/{qid}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": 9999})
-check("PATCH item-termsheet", r.status_code == 200 and r.json()["data"]["unit_price"] == 9999.0, r.text[:200])
-r = c.patch(f"/quotes/{qid}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": its[0]["unit_price"]})
+# termsheet-count tolerance marker
+if _pending:
+    _its_quote, li = _pending
+    r = c.get(f"/quotes/{_its_quote}/line-items/{li['id']}/termsheets")
+    its = r.json().get("data", [])
+    if its:
+        r = c.patch(f"/quotes/{_its_quote}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": 9999})
+        check("PATCH item-termsheet", r.status_code == 200 and r.json()["data"]["unit_price"] == 9999.0, r.text[:200])
+        r = c.patch(f"/quotes/{_its_quote}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": its[0]["unit_price"]})
+    else:
+        print("  SKIP  PATCH item-termsheet — picked line item has no item pricing rows")
+else:
+    print("  SKIP  PATCH item-termsheet — no pending decision available")
 
 # ---------- invoice upload on accepted/arrived (multi-file) ----------
 r = c.get("/quotes", params={"status": "arrived", "page_size": 1})
 arrived = r.json()["data"]
 if arrived:
     qa = arrived[0]
+    # rerun safety — remove invoices left by previous runs
+    for _inv in c.get(f"/quotes/{qa['id']}/invoice").json()["data"]:
+        c.delete(f"/quotes/{qa['id']}/invoice/{_inv['id']}")
     files = {"file": ("inv.pdf", b"%PDF-1.4 invoice", "application/pdf")}
     r = c.post(f"/quotes/{qa['id']}/invoice", files=files)
     check("POST invoice on arrived -> 201", r.status_code == 201 and r.json()["data"]["mime_type"] == "application/pdf", r.text[:200])

backend/tools/smoke_test_write.py

@@ -23,16 +23,45 @@ def check(name, ok, extra=""):
 
 c = httpx.Client(base_url=BASE, timeout=30)
 
+# ---------- auth: every endpoint now requires a Casdoor JWT ----------
+import os
+
+r = c.post("/auth/login", json={
+    "username": os.environ.get("SMOKE_USER", "tester"),
+    "password": os.environ.get("SMOKE_PASSWORD", "123456"),
+})
+check("POST /auth/login", r.status_code == 200, r.text[:200])
+if r.status_code == 200:
+    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"
+
 # ---------- supplier + project for the test quote ----------
-sup = c.post("/suppliers", json={"name": "تأمین‌کننده تست", "location": "تهران"}).json()["data"]
-proj = c.post("/projects", json={"name": "پروژه تست", "description": "تست خودکار"}).json()["data"]
-check("POST /suppliers + /projects", True)
+# dataset-independent: fetch/create whatever the seed does or doesn't have
+cat = c.get("/material-categories", params={"page_size": 1}).json()["data"][0]
+r_sup = c.post("/suppliers", json={"name": "تأمین‌کننده تست", "location": "تهران", "category_id": cat["id"]})
+if r_sup.status_code == 201:
+    sup = r_sup.json()["data"]
+    check("POST /suppliers", True)
+else:  # rerun — the test supplier already exists
+    sup = c.get("/suppliers", params={"q": "تأمین‌کننده تست"}).json()["data"][0]
+    check("POST /suppliers (exists from previous run — 409 tolerated)", r_sup.status_code == 409, r_sup.text[:200])
+r_proj = c.post("/projects", json={"name": "پروژه تست", "description": "تست خودکار"})
+if r_proj.status_code == 201:
+    proj = r_proj.json()["data"]
+    check("POST /projects", True)
+else:
+    proj = c.get("/projects", params={"q": "پروژه تست"}).json()["data"][0]
+    check("POST /projects (exists from previous run — 409 tolerated)", r_proj.status_code == 409, r_proj.text[:200])
 
 # ---------- material with EAV + brands ----------
-cat = c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]
 unit_kg = c.get("/units", params={"q": "kg"}).json()["data"][0]["id"]
-brand = c.get("/brands", params={"q": "فولاد مبارکه"}).json()["data"][0]
+brand = c.get("/brands", params={"page_size": 1}).json()["data"][0]
 defs = {d["attribute_key"]: d for d in c.get("/attribute-definitions", params={"page_size": 100}).json()["data"]}
+# ensure the EAV keys this suite exercises exist (seed-independent)
+for _key, _dt in (("rebar_grade", "string"), ("rebar_diameter", "number"), ("rebar_ribbed", "boolean")):
+    if _key not in defs:
+        r = c.post("/attribute-definitions", json={"attribute_key": _key, "label": _key, "data_type": _dt})
+        check("POST /attribute-definitions (%s)" % _key, r.status_code == 201, r.text[:200])
+        defs[_key] = r.json()["data"]
 
 r = c.post(
     "/materials",
@@ -48,11 +77,15 @@ r = c.post(
         ],
     },
 )
-check("POST /materials (EAV+brands)", r.status_code == 201, r.text[:300])
-material = r.json()["data"]
+if r.status_code == 201:
+    material = r.json()["data"]
+    check("POST /materials (EAV+brands)", True)
+else:  # rerun — fetch the material a previous run created
+    material = c.get("/materials", params={"q": "میلگرد تست A3 سایز ۱۶"}).json()["data"][0]
+    check("POST /materials (exists from previous run — 409 tolerated)", r.status_code == 409, r.text[:200])
 
 r = c.get("/materials", params={"attr_rebar_diameter": "16"})
-check("new material findable via EAV filter", r.status_code == 200 and r.json()["meta"]["total"] == 1)
+check("new material findable via EAV filter", r.status_code == 200 and any(m["id"] == material["id"] for m in r.json()["data"]))
 
 r = c.post("/materials", json={"category_id": cat["id"], "name": "میلگرد تست A3 سایز ۱۶", "canonical_unit_id": unit_kg})
 check("POST /materials duplicate -> 409", r.status_code == 409 and r.json()["error"]["code"] == "CONFLICT", r.text[:200])
@@ -68,21 +101,32 @@ r = c.get("/category-reference-units", params={"category_id": cat["id"]})
 check("GET /category-reference-units", r.status_code == 200 and r.json()["data"][0]["ref_unit"] == "کیلوگرم")
 
 r = c.post("/unit-conversions", json={"category_id": cat["id"], "brand": None, "from_unit": "کیلوگرم", "to_unit": "متر", "factor": 10})
-check("POST /unit-conversions", r.status_code == 201, r.text[:200])
-uc = r.json()["data"]
+if r.status_code == 409:  # rerun — reuse the existing conversion
+    uc = next(x for x in c.get("/unit-conversions", params={"page_size": 100}).json()["data"]
+              if x["from_unit"] == "کیلوگرم" and x["to_unit"] == "متر" and x["category"]["id"] == cat["id"])
+    check("POST /unit-conversions (exists from previous run — 409 tolerated)", True)
+else:
+    check("POST /unit-conversions", r.status_code == 201, r.text[:200])
+    uc = r.json()["data"]
 r = c.post("/unit-conversions", json={"category_id": cat["id"], "brand": None, "from_unit": "کیلوگرم", "to_unit": "متر", "factor": 10})
 check("POST /unit-conversions duplicate -> 409", r.status_code == 409, r.text[:200])
 r = c.patch(f"/unit-conversions/{uc['id']}", json={"factor": 9.5})
 check("PATCH /unit-conversions", r.status_code == 200 and r.json()["data"]["factor"] == 9.5)
 
 r = c.post("/standard-conversions", json={"from_unit": "تن", "to_unit": "کیلوگرم", "factor": 1000})
-check("POST /standard-conversions", r.status_code == 201, r.text[:200])
-sc_id = r.json()["data"]["id"]
+if r.status_code == 201:
+    sc_id = r.json()["data"]["id"]
+    check("POST /standard-conversions", True)
+else:  # rerun — reuse the existing conversion
+    sc_id = next(x["id"] for x in c.get("/standard-conversions", params={"page_size": 100}).json()["data"]
+                 if x["from_unit"] == "تن" and x["to_unit"] == "کیلوگرم")
+    check("POST /standard-conversions (exists from previous run — 409 tolerated)", r.status_code == 409, r.text[:200])
 r = c.get("/standard-conversions")
 check("GET /standard-conversions", r.status_code == 200 and r.json()["meta"]["total"] >= 1)
 
 # ---------- nested quote creation ----------
-material2 = c.get("/materials", params={"q": "میلگرد A3 سایز ۱۴"}).json()["data"][0]
+_all_materials = c.get("/materials", params={"page_size": 100}).json()["data"]
+material2 = next(m for m in _all_materials if m["id"] != material["id"])
 r = c.post(
     "/quotes",
     json={
@@ -125,7 +169,11 @@ check("DELETE /quotes offered -> OK", r.status_code == 200 and r.json()["data"][
 r = c.post("/quotes", json={"supplier_id": sup["id"],
                             "line_items": [{"temp_id": "x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 1}],
                             "termsheets": [], "item_termsheets": []})
-check("POST /quotes empty termsheets -> 400", r.status_code == 400 and r.json()["error"]["field"] == "termsheets")
+# current contract: termsheets are optional at quote level (item pricing
+# is driven by item_termsheets) — a quote without them is valid
+check("POST /quotes empty termsheets -> 201 (optional since v2.6)", r.status_code == 201, r.text[:200])
+if r.status_code == 201:
+    c.delete(f"/quotes/{r.json()['data']['id']}")
 
 r = c.post("/quotes", json={"supplier_id": sup["id"],
                             "line_items": [{"temp_id": "x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 1}],
@@ -233,33 +281,49 @@ check("GET receipt of rejected item -> 404", r.status_code == 404)
 r = c.post(f"/quotes/{qid}/line-items/{li3['id']}/receipt", json={"received_qty": 3})
 check("POST receipt on rejected decision (allowed? decision exists)", r.status_code in (201, 409), r.text[:200])
 
-# ---------- backward transition ----------
+# ---------- backward transition (v2.6 rule: quotes WITH inventory receipts
+# are immutable — they feed the stock ledger) ----------
 r = c.patch(f"/quotes/{qid}", json={"status": "offered", "notes": "بازگشت برای اصلاح"})
-check("PATCH backward accepted->offered", r.status_code == 200 and r.json()["data"]["status"] == "offered" and r.json()["data"]["accepted_date"] is None, r.text[:300])
+check(
+    "PATCH backward accepted->offered blocked after receipts",
+    r.status_code == 409 and "رسید" in r.json()["error"]["message"], r.text[:300],
+)
 r = c.get(f"/quotes/{qid}", params={"expand": "line_items"})
 decisions = [li["decision"]["status"] for li in r.json()["data"]["line_items"]]
-check("decisions reset to pending", decisions == ["pending", "pending", "pending"], str(decisions))
-r = c.get(f"/quotes/{qid}/termsheets")
+check("decisions unchanged after blocked revert", decisions == ["chosen", "chosen", "rejected"], str(decisions))
+
+# transition tests need a quote WITHOUT receipts — q3:
+q3 = c.post("/quotes", json={
+    "supplier_id": sup["id"], "project_id": proj["id"],
+    "quote_date": "2026-08-02T10:00:00Z", "expiry_date": "2026-08-20",
+    "line_items": [{"temp_id": "li-x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 2}],
+    "termsheets": [{"temp_id": "ts-x", "label": "نقدی", "schedule_steps": [{"due_date": "2026-08-10", "amount": 5000}]}],
+    "item_termsheets": [{"line_item_temp_id": "li-x", "termsheet_temp_id": "ts-x", "unit_price": 2500}],
+}).json()["data"]
+r = c.patch(f"/quotes/{q3['id']}/accept", json={
+    "accepted_termsheets": [{"id": q3["termsheets"][0]["id"],
+                             "schedule_steps": [{"step_no": 1, "due_date": "2026-08-10", "amount": 5000}]}],
+    "item_decisions": [{"line_item_id": q3["line_items"][0]["id"], "status": "chosen", "accepted_termsheet_index": 0, "adjusted_unit_price": 2500}],
+})
+check("q3 accept", r.status_code == 200, r.text[:300])
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "offered"})
+check("PATCH backward accepted->offered (no receipts) -> OK", r.status_code == 200 and r.json()["data"]["status"] == "offered" and r.json()["data"]["accepted_date"] is None, r.text[:300])
+r = c.get(f"/quotes/{q3['id']}", params={"expand": "line_items"})
+check("decisions reset to pending", [li["decision"]["status"] for li in r.json()["data"]["line_items"]] == ["pending"], r.text[:200])
+r = c.get(f"/quotes/{q3['id']}/termsheets")
 check("termsheets demoted to offered", all(t["status"] == "offered" for t in r.json()["data"]), r.text[:200])
-r = c.get(f"/quotes/{qid}", params={"expand": "line_items"})
-receipts_kept = all(li.get("receipt") is not None for li in r.json()["data"]["line_items"] if li["decision"])
-check("item_receipts NOT deleted on revert", receipts_kept, r.text[:200])
-
-r = c.patch(f"/quotes/{qid}", json={"status": "accepted"})
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "accepted"})
 check("forward offered->accepted via PATCH -> 409", r.status_code == 409, r.text[:200])
-
-# ---------- reject / expire ----------
-r = c.patch(f"/quotes/{qid}/reject", json={"reason": "قیمت بالا"})
+r = c.patch(f"/quotes/{q3['id']}/reject", json={"reason": "قیمت بالا"})
 check("PATCH reject", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
-r = c.get(f"/quotes/{qid}/events")
+r = c.get(f"/quotes/{q3['id']}/events")
 check("reject reason in event payload", any(e["event_type"] == "rejected" and e["payload"].get("reason") == "قیمت بالا" for e in r.json()["data"]))
-
-r = c.patch(f"/quotes/{qid}", json={"status": "offered"})
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "offered"})
 check("rejected->offered reopen", r.status_code == 200 and r.json()["data"]["status"] == "offered", r.text[:200])
-r = c.patch(f"/quotes/{qid}/expire")
+r = c.patch(f"/quotes/{q3['id']}/expire")
 check("PATCH expire", r.status_code == 200 and r.json()["data"]["status"] == "expired", r.text[:200])
-r = c.delete(f"/quotes/{qid}")
-check("DELETE expired quote", r.status_code == 200 and r.json()["data"]["cascaded"]["line_items"] == 3, r.text[:300])
+r = c.delete(f"/quotes/{q3['id']}")
+check("DELETE expired quote", r.status_code == 200 and r.json()["data"]["cascaded"]["line_items"] == 1, r.text[:300])
 
 # ---------- files ----------
 q2 = c.post("/quotes", json={"supplier_id": sup["id"], "project_id": proj["id"],
@@ -269,8 +333,13 @@ q2 = c.post("/quotes", json={"supplier_id": sup["id"], "project_id": proj["id"],
 files = {"file": ("proforma.pdf", b"%PDF-1.4 test", "application/pdf")}
 r = c.post(f"/quotes/{q2['id']}/proforma", files=files)
 check("POST proforma (any status)", r.status_code == 201 and r.json()["data"]["file_name"] == "proforma.pdf", r.text[:200])
+# current contract: attachments are allowed in EVERY status (files.py) —
+# the invoice can be attached from the edit page at any time
 r = c.post(f"/quotes/{q2['id']}/invoice", files=files)
-check("POST invoice on offered -> 409", r.status_code == 409, r.text[:200])
+check("POST invoice on offered (any-status contract)", r.status_code == 201, r.text[:200])
+inv_id = r.json()["data"]["id"]
+r = c.delete(f"/quotes/{q2['id']}/invoice/{inv_id}")
+check("DELETE test invoice", r.status_code == 200, r.text[:200])
 r = c.get(f"/quotes/{q2['id']}/proforma")
 lst = r.json()["data"]
 check("GET proforma list has 1", r.status_code == 200 and len(lst) == 1, r.text[:200])
@@ -282,8 +351,8 @@ check("DELETE proforma by id", r.status_code == 200 and r.json()["data"]["delete
 r = c.get(f"/quotes/{q2['id']}/proforma")
 check("GET proforma list empty after delete", r.status_code == 200 and r.json()["data"] == [], r.text[:200])
 
-# cleanup test material + supplier + project
-# q2 still references supplier/project/material -> all deletes must be blocked
+# ---------- cleanup ----------
+# q2 (offered) is deletable; qid is a receipts-protected artifact that stays.
 r = c.delete(f"/suppliers/{sup['id']}")
 check("DELETE supplier with quotes -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/projects/{proj['id']}")
@@ -291,14 +360,15 @@ check("DELETE project with quotes -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/materials/{material['id']}")
 check("DELETE material with line_items -> 409", r.status_code == 409, r.text[:200])
 
-r = c.delete(f"/quotes/{q2['id']}")  # q2 still references the test material
+r = c.delete(f"/quotes/{q2['id']}")
 check("cleanup: DELETE q2 quote", r.status_code == 200, r.text[:200])
+# qid (arrived, receipt-protected) still references everything -> protected
 r = c.delete(f"/materials/{material['id']}")
-check("DELETE material (no line_items refs)", r.status_code == 200, r.text[:200])
+check("DELETE material (still referenced by receipt-protected quote) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/suppliers/{sup['id']}")
-check("DELETE supplier (no quotes) -> 200", r.status_code == 200, r.text[:200])
+check("DELETE supplier (still referenced) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/projects/{proj['id']}")
-check("DELETE project (no quotes) -> 200", r.status_code == 200, r.text[:200])
+check("DELETE project (still referenced) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/unit-conversions/{uc['id']}")
 check("DELETE unit-conversion", r.status_code == 200)
 r = c.delete(f"/standard-conversions/{sc_id}")

docker-compose.prod.yml

@@ -1,32 +1,72 @@
 # ============================================================================
 # Production overlay — real domains + HTTPS (Let's Encrypt) + HTTP→HTTPS
-# redirect. Usage:
+# redirect + security middlewares + required secrets.
 #
-#   APP_HOST=app.example.com API_HOST=api.example.com AUTH_HOST=auth.example.com \
-#   S3_HOST=s3.example.com STORAGE_HOST=storage.example.com \
-#   TRAEFIK_ACME_EMAIL=admin@example.com \
+# All credentials come from the git-ignored .env NEXT TO THE COMPOSE FILES
+# (compose loads it automatically — keep it on the VPS, never in git):
+#
+#   cp .env.example .env   # then fill in STRONG values
 #   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
 #
 # Requirements: DNS records for every host pointing at the server, ports
-# 80 + 443 open (ACME http-challenge uses port 80), and the api's
-# PROCUREMENT_CASDOOR_ISSUER must be updated to the public auth host
-# (see docs/casdoor-auth.md).
+# 80 + 443 open (ACME http-challenge uses port 80). The api's issuer is
+# derived here from AUTH_HOST (see docs/casdoor-auth.md).
+#
+# Any `${VAR:?}` below refuses to boot when the variable is missing/empty —
+# that is deliberate: production must not run on defaults.
 # ============================================================================
 
 services:
   traefik:
     environment:
       # Certificates persist across restarts (acme.json in the traefik_certs volume).
-      TRAEFIK_ACME_EMAIL: ${TRAEFIK_ACME_EMAIL:?set TRAEFIK_ACME_EMAIL for production}
+      TRAEFIK_ACME_EMAIL: ${TRAEFIK_ACME_EMAIL:?set TRAEFIK_ACME_EMAIL in .env}
+
+  postgres:
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+
+  minio:
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:?set MINIO_ROOT_USER in .env}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?set MINIO_ROOT_PASSWORD in .env}
+    labels:
+      - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:?set S3_HOST}`)
+      - traefik.http.routers.minio-api.entrypoints=websecure
+      - traefik.http.routers.minio-api.tls=true
+      - traefik.http.routers.minio-api.tls.certresolver=letsencrypt
+      - traefik.http.routers.minio-api.middlewares=secure-headers@file
+      - traefik.http.routers.minio-api-redir.rule=Host(`${S3_HOST:?set S3_HOST}`)
+      - traefik.http.routers.minio-api-redir.entrypoints=web
+      - traefik.http.routers.minio-api-redir.middlewares=redirect-https@file
+      - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
+      - traefik.http.routers.minio-console.entrypoints=websecure
+      - traefik.http.routers.minio-console.tls=true
+      - traefik.http.routers.minio-console.tls.certresolver=letsencrypt
+      - traefik.http.routers.minio-console.middlewares=secure-headers@file
+      - traefik.http.routers.minio-console-redir.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
+      - traefik.http.routers.minio-console-redir.entrypoints=web
+      - traefik.http.routers.minio-console-redir.middlewares=redirect-https@file
 
   api:
     ports: [] # production: only reachable through Traefik
+    environment:
+      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/procurement
+      PROCUREMENT_MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:?set MINIO_ROOT_USER in .env}
+      PROCUREMENT_MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?set MINIO_ROOT_PASSWORD in .env}
+      PROCUREMENT_CASDOOR_CLIENT_SECRET: ${CASDOOR_CLIENT_SECRET:?set CASDOOR_CLIENT_SECRET in .env}
+      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: ${CASDOOR_ADMIN_PASSWORD:?set CASDOOR_ADMIN_PASSWORD in .env}
+      # Issuer must equal the browser-facing Casdoor origin (its discovery doc).
+      PROCUREMENT_CASDOOR_ISSUER: https://${AUTH_HOST:?set AUTH_HOST}
+      PROCUREMENT_CORS_ORIGINS: ${CORS_ORIGINS:?set CORS_ORIGINS in .env}
+      PROCUREMENT_ENVIRONMENT: prod
+      PROCUREMENT_DEV_LOGIN_ENABLED: "false"
     labels:
       - traefik.http.routers.api.rule=Host(`${API_HOST:?set API_HOST}`)
       - traefik.http.routers.api.entrypoints=websecure
       - traefik.http.routers.api.tls=true
       - traefik.http.routers.api.tls.certresolver=letsencrypt
-      # HTTP → HTTPS
+      - traefik.http.routers.api.middlewares=secure-headers@file,api-ratelimit@file,api-bodylimit@file
       - traefik.http.routers.api-redir.rule=Host(`${API_HOST:?set API_HOST}`)
       - traefik.http.routers.api-redir.entrypoints=web
       - traefik.http.routers.api-redir.middlewares=redirect-https@file
@@ -41,34 +81,21 @@ services:
       - traefik.http.routers.casdoor.entrypoints=websecure
       - traefik.http.routers.casdoor.tls=true
       - traefik.http.routers.casdoor.tls.certresolver=letsencrypt
+      - traefik.http.routers.casdoor.middlewares=secure-headers@file
       - traefik.http.routers.casdoor-redir.rule=Host(`${AUTH_HOST:?set AUTH_HOST}`)
       - traefik.http.routers.casdoor-redir.entrypoints=web
       - traefik.http.routers.casdoor-redir.middlewares=redirect-https@file
 
   frontend:
+    build:
+      args:
+        DEV_LOGIN_ENABLED: "false"
     labels:
       - traefik.http.routers.frontend.rule=Host(`${APP_HOST:?set APP_HOST}`)
       - traefik.http.routers.frontend.entrypoints=websecure
       - traefik.http.routers.frontend.tls=true
       - traefik.http.routers.frontend.tls.certresolver=letsencrypt
+      - traefik.http.routers.frontend.middlewares=secure-headers@file
       - traefik.http.routers.frontend-redir.rule=Host(`${APP_HOST:?set APP_HOST}`)
       - traefik.http.routers.frontend-redir.entrypoints=web
       - traefik.http.routers.frontend-redir.middlewares=redirect-https@file
-
-  minio:
-    ports: [] # production: only reachable through Traefik
-    labels:
-      - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:?set S3_HOST}`)
-      - traefik.http.routers.minio-api.entrypoints=websecure
-      - traefik.http.routers.minio-api.tls=true
-      - traefik.http.routers.minio-api.tls.certresolver=letsencrypt
-      - traefik.http.routers.minio-api-redir.rule=Host(`${S3_HOST:?set S3_HOST}`)
-      - traefik.http.routers.minio-api-redir.entrypoints=web
-      - traefik.http.routers.minio-api-redir.middlewares=redirect-https@file
-      - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
-      - traefik.http.routers.minio-console.entrypoints=websecure
-      - traefik.http.routers.minio-console.tls=true
-      - traefik.http.routers.minio-console.tls.certresolver=letsencrypt
-      - traefik.http.routers.minio-console-redir.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
-      - traefik.http.routers.minio-console-redir.entrypoints=web
-      - traefik.http.routers.minio-console-redir.middlewares=redirect-https@file

docker-compose.yml

@@ -6,11 +6,17 @@ services:
     environment:
       POSTGRES_DB: procurement
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
+      # Local dev default; production overrides via .env (required by the
+      # prod overlay) — never commit real passwords.
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
 
     ports:
       - "5433:5432"
 
+    networks:
+      - default
+      - shared # monitoring stack scrapes it (postgres-exporter)
+
     volumes:
       - postgres_data:/var/lib/postgresql
       - ./sql/migration.sql:/docker-entrypoint-initdb.d/01-migration.sql:ro
@@ -23,6 +29,7 @@ services:
       retries: 10
 
     restart: unless-stopped
+    mem_limit: 1g
 
   # ==========================================================================
   # Traefik v3 — public reverse proxy (replaces nginx as the edge)
@@ -36,6 +43,7 @@ services:
     image: traefik:v3.6
     container_name: procurement-traefik
     restart: unless-stopped
+    mem_limit: 128m
     command:
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false
@@ -69,8 +77,8 @@ services:
     command: server /data --console-address ":9001"
 
     environment:
-      MINIO_ROOT_USER: minioadmin
-      MINIO_ROOT_PASSWORD: minioadmin
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
 
     ports:
       - "9000:9000"   # S3 API
@@ -97,6 +105,7 @@ services:
       - default
 
     restart: unless-stopped
+    mem_limit: 512m
 
   # MinIO Client (mc): waits for the server, creates the bucket, exits.
   # Use for ad-hoc ops too: docker compose run --rm minio-init ...
@@ -110,8 +119,8 @@ services:
 
     environment:
       MINIO_ENDPOINT: minio:9000
-      MINIO_ROOT_USER: minioadmin
-      MINIO_ROOT_PASSWORD: minioadmin
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
       MINIO_BUCKET: procurement-files
 
     entrypoint: >
@@ -125,6 +134,40 @@ services:
 
     restart: "no"
 
+  # ==========================================================================
+  # Scheduled logical backups of BOTH databases (procurement + casdoor).
+  # Writes pg_dump -Fc archives to a bind mount (default ./backups, point
+  # BACKUP_DIR at /srv/erp/backups on the VPS) and prunes archives older
+  # than BACKUP_KEEP_DAYS. Runs on the same postgres:18 image already pulled.
+  # ==========================================================================
+  db-backup:
+    image: postgres:18
+    container_name: procurement-db-backup
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      PGPASSWORD: ${POSTGRES_PASSWORD:-postgres}
+      BACKUP_INTERVAL_SECONDS: ${BACKUP_INTERVAL_SECONDS:-86400}
+      BACKUP_KEEP_DAYS: ${BACKUP_KEEP_DAYS:-14}
+    volumes:
+      - ${BACKUP_DIR:-./backups}:/backups
+    entrypoint: >
+      /bin/sh -c "
+      echo 'db-backup: dumping every $${BACKUP_INTERVAL_SECONDS}s, keeping $${BACKUP_KEEP_DAYS} days';
+      while true; do
+        STAMP=$$(date +%Y%m%d-%H%M%S);
+        pg_dump -h postgres -U postgres -d procurement -Fc -f /backups/procurement-$${STAMP}.dump &&
+          echo \"db-backup: procurement -> /backups/procurement-$${STAMP}.dump\";
+        pg_dump -h postgres -U postgres -d casdoor -Fc -f /backups/casdoor-$${STAMP}.dump &&
+          echo \"db-backup: casdoor -> /backups/casdoor-$${STAMP}.dump\";
+        find /backups -name '*.dump' -mtime +$${BACKUP_KEEP_DAYS} -delete;
+        sleep $${BACKUP_INTERVAL_SECONDS};
+      done
+      "
+    restart: unless-stopped
+    mem_limit: 256m
+
   # ==========================================================================
   # v2.6 — Casdoor (OIDC identity provider)
   # Console: http://localhost:8080 (admin / 123)
@@ -162,6 +205,7 @@ services:
       - default
 
     restart: unless-stopped
+    mem_limit: 768m
 
   api:
     build:
@@ -170,38 +214,58 @@ services:
     container_name: procurement-api
 
     environment:
-      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:postgres@postgres:5432/procurement
+      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/procurement
       PROCUREMENT_MINIO_ENDPOINT: minio:9000
-      PROCUREMENT_MINIO_ACCESS_KEY: minioadmin
-      PROCUREMENT_MINIO_SECRET_KEY: minioadmin
+      PROCUREMENT_MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
+      PROCUREMENT_MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
       PROCUREMENT_MINIO_BUCKET: procurement-files
       PROCUREMENT_MINIO_SECURE: "false"
+      # "dev" enables the local defaults; "prod" turns on the fail-fast
+      # startup checks (no wildcard CORS, no default credentials).
+      PROCUREMENT_ENVIRONMENT: ${ENVIRONMENT:-dev}
+      PROCUREMENT_DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false}
+      # Comma-separated browser origins (JSON-free .env friendly).
+      PROCUREMENT_CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost,http://localhost:3000,http://localhost:5173}
       # Casdoor: endpoint is the in-network service URL; the issuer must match
       # the origin Casdoor advertises to browsers (its OIDC discovery doc).
       PROCUREMENT_CASDOOR_ENDPOINT: http://casdoor:8000
-      PROCUREMENT_CASDOOR_ISSUER: http://localhost:8080
+      PROCUREMENT_CASDOOR_ISSUER: ${CASDOOR_ISSUER:-http://localhost:8080}
       PROCUREMENT_CASDOOR_CLIENT_ID: inventory-app-client
-      PROCUREMENT_CASDOOR_CLIENT_SECRET: inventory-app-secret-2026
+      PROCUREMENT_CASDOOR_CLIENT_SECRET: ${CASDOOR_CLIENT_SECRET:-inventory-app-secret-2026}
       PROCUREMENT_CASDOOR_ORGANIZATION: inventory
       PROCUREMENT_CASDOOR_APP_NAME: inventory-app
       PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client
       # Console admin used by POST /users/sync (identity mirroring).
       PROCUREMENT_CASDOOR_ADMIN_USER: admin
-      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: "123"
+      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: ${CASDOOR_ADMIN_PASSWORD:-123}
+      # Observability (Phase 2) — see monitoring/README.md
+      PROCUREMENT_LOG_FORMAT: ${LOG_FORMAT:-text}
+      PROCUREMENT_SENTRY_DSN: ${SENTRY_DSN_BACKEND:-}
+      PROCUREMENT_OPENPANEL_API_URL: ${OPENPANEL_API_URL:-}
+      PROCUREMENT_OPENPANEL_CLIENT_ID: ${OPENPANEL_CLIENT_ID:-}
+      PROCUREMENT_OPENPANEL_CLIENT_SECRET: ${OPENPANEL_CLIENT_SECRET:-}
 
     ports:
       - "8000:8000"
 
+    networks:
+      - traefik_network
+      - default
+      - shared # monitoring stack scrapes api:8000/metrics
+
+    healthcheck:
+      test: ["CMD-SHELL", "python -c \"import urllib.request as u; u.urlopen('http://127.0.0.1:8000/health', timeout=3)\""]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 40s
+
     labels:
       - traefik.enable=true
       - traefik.http.routers.api.rule=Host(`${API_HOST:-api.localhost}`)
       - traefik.http.routers.api.entrypoints=web
       - traefik.http.services.api.loadbalancer.server.port=8000
 
-    networks:
-      - traefik_network
-      - default
-
     depends_on:
       postgres:
         condition: service_healthy
@@ -209,13 +273,21 @@ services:
         condition: service_completed_successfully
 
     restart: unless-stopped
+    mem_limit: 768m
 
   frontend:
     build:
       context: ./frontend
       args:
-        # Developer Mode panel on the login page — set false for production.
-        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-true}
+        # Developer Mode panel on the login page — dev-only aid. Production
+        # builds MUST leave this false (identity comes from Casdoor tokens).
+        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false}
+        # Registry overridable for networks where npmmirror is unreachable.
+        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com}
+        # Observability (build-time baked; empty = disabled)
+        VITE_OPENPANEL_URL: ${OPENPANEL_PUBLIC_URL:-}
+        VITE_OPENPANEL_CLIENT_ID: ${OPENPANEL_CLIENT_ID:-}
+        VITE_SENTRY_DSN: ${SENTRY_DSN_FRONTEND:-}
     container_name: procurement-frontend
 
     labels:
@@ -232,6 +304,7 @@ services:
       - api
 
     restart: unless-stopped
+    mem_limit: 128m
 
 networks:
   # شبکه‌ی عمومی: فقط ترافیک و سرویس‌های عمومی. postgres روی شبکه‌ی
@@ -239,6 +312,11 @@ networks:
   traefik_network:
     name: traefik_network
     driver: bridge
+  # Fixed-name network shared with the monitoring stack (monitoring compose
+  # joins it as external) — carries /metrics scrapes and postgres-exporter.
+  shared:
+    name: erp_shared
+    driver: bridge
 
 volumes:
   postgres_data:

docs/OPERATIONS.md

@@ -0,0 +1,96 @@
+# Operations runbook
+
+Day-2 operations for the ERP stack: deploys, health, backups, monitoring.
+Secrets and rotation live in [`SECRET-MANAGEMENT.md`](SECRET-MANAGEMENT.md);
+Casdoor/auth details in [`casdoor-auth.md`](casdoor-auth.md).
+
+## Deploy flow (push-to-deploy)
+
+1. Work lands on `production` only via merge from a feature branch.
+2. Every push to `production` hits the webhook receiver (host port 9000),
+   which verifies the Gitea HMAC signature, rebuilds
+   `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build`
+   and then polls `/health/ready` (defaults to
+   `https://$API_HOST/health/ready` from `.env`).
+3. A failed build or a failed readiness check is a **failed deploy**:
+   `journalctl -u erp-deploy-webhook -n 200` on the VPS.
+   Rollback: `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --no-build`
+   after `git revert` + rebuild — or re-push the previous commit.
+
+## Health endpoints (unauthenticated, for probes)
+
+| Endpoint | Meaning |
+|---|---|
+| `GET /health` | liveness — process is up |
+| `GET /health/ready` | readiness — Postgres + MinIO + Casdoor all reachable (503 + per-check booleans when degraded) |
+| `GET /metrics` | Prometheus exposition (scraped by the monitoring stack) |
+
+## Backups
+
+The `db-backup` sidecar dumps BOTH databases (`procurement`, `casdoor`)
+with `pg_dump -Fc` every `BACKUP_INTERVAL_SECONDS` (default daily) into
+`BACKUP_DIR` (default `./backups` → set to `/srv/erp/backups` on the VPS),
+keeping `BACKUP_KEEP_DAYS` (default 14) days.
+
+Restore (⚠️ replaces all data — stop `api` + `casdoor` first):
+
+```bash
+cd /srv/erp && docker compose -f docker-compose.yml -f docker-compose.prod.yml stop api casdoor
+docker cp backups/procurement-<stamp>.dump procurement-postgres:/tmp/
+docker cp backups/casdoor-<stamp>.dump procurement-postgres:/tmp/
+docker exec procurement-postgres pg_restore -U postgres -d procurement --clean --if-exists /tmp/procurement-<stamp>.dump
+docker exec procurement-postgres pg_restore -U postgres -d casdoor --clean --if-exists /tmp/casdoor-<stamp>.dump
+docker compose -f docker-compose.yml -f docker-compose.prod.yml start casdoor api
+```
+
+**Test the restore quarterly** on a scratch volume — an untested backup is
+a hope, not a backup. Copy archives off-box periodically (the bind mount is
+still on the same disk as the volumes).
+
+## Audit trail
+
+`audit_log` (in the `procurement` DB) records who changed what for
+role assignments, user creation, and inventory transactions. Query recent
+activity:
+
+```bash
+docker exec procurement-postgres psql -U postgres -d procurement \
+  -c "SELECT occurred_at, actor, action, entity, entity_id FROM audit_log ORDER BY occurred_at DESC LIMIT 50;"
+```
+
+`quote_events` continues to hold the quote lifecycle history (its `actor`
+is now the verified user's display name, not a raw token).
+
+## Monitoring stack
+
+Start/update (separate compose project — app rebuilds don't touch it):
+
+```bash
+cd /srv/erp
+docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d
+```
+
+- **Grafana** — `127.0.0.1:3001` on the VPS (SSH tunnel), admin password in
+  `.env`; the «ERP — Stack overview» dashboard auto-provisions.
+- **GlitchTip** — public on `GLITCHTIP_HOST` (browser DSN) + loopback
+  `:8001` for administration. Create backend/frontend projects there and put
+  the DSNs in `.env` (`SENTRY_DSN_BACKEND` / `SENTRY_DSN_FRONTEND`).
+- **OpenPanel** — see `monitoring/README.md` for the self-hosting setup and
+  the event list the app emits.
+- **Alerts** — Prometheus rules surface in Grafana alerting (API down,
+  5xx rate, p95 latency, disk, RAM, DB connections). Attach a notification
+  channel in the Grafana UI.
+
+Logs: every container's stdout ships to Loki via Promtail — in Grafana:
+`{compose_project="erp", compose_service="api"}`; JSON lines carry
+`request_id`, `http_status`, `duration_ms`.
+
+## Routine checks
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.prod.yml ps   # all Up/healthy?
+docker compose logs --since 10m api | grep -i error
+ls -lh /srv/erp/backups | tail                                       # dumps fresh?
+curl -fsS https://$API_HOST/health/ready | jq                        # all checks true?
+df -h /                                                              # ≥20% free (builds need headroom)
+```

docs/SECRET-MANAGEMENT.md

@@ -0,0 +1,67 @@
+# Secret management & rotation
+
+**Policy (short):** real credentials live only in git-ignored `.env` files —
+the server-side `/srv/erp/.env` (used by the deploy webhook and compose) and
+local dev `.env` copies. Nothing secret goes into git: not in the README,
+not in dumps, not in docs. The repo is (or was) **public** — assume anything
+ever committed is compromised and rotate.
+
+`docker-compose.prod.yml` declares every production secret as
+`${VAR:?set in .env}` so the stack **refuses to boot** on defaults.
+
+## Where each secret lives
+
+| Secret | Used by | Defined in |
+|---|---|---|
+| `POSTGRES_PASSWORD` | postgres, api | server `.env` |
+| `MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD` | minio, minio-init, api | server `.env` |
+| `CASDOOR_CLIENT_SECRET` | Casdoor application record, api | server `.env` (must match the app in the Casdoor console) |
+| `CASDOOR_ADMIN_PASSWORD` | Casdoor console admin, api (`/users/sync`) | server `.env` (rotate in the Casdoor console too) |
+| `CORS_ORIGINS`, `*_HOST`, `TRAEFIK_ACME_EMAIL` | compose / Traefik | server `.env` |
+| `GITEA_WEBHOOK_SECRET` | deploy-webhook receiver (port 9000) | server `.env` + Gitea webhook config |
+| Monitoring DSNs/keys | OpenPanel, GlitchTip, Grafana | `monitoring/.env` (server-side) |
+
+## Rotation checklist — run after any leak suspicion
+
+The production branch history contained real credentials (MinIO admin,
+Casdoor passwords, server IP, DB dumps). All of the following must be
+rotated once, on the VPS:
+
+```bash
+cd /srv/erp
+
+# 1) MinIO root — then update MINIO_ROOT_* in /srv/erp/.env
+mc alias set local http://127.0.0.1:9000 <old-user> '<old-pass>'
+mc admin user add local <new-user> '<new-pass>'      # then:
+mc admin policy attach local consoleAdmin --user <new-user>
+mc admin user remove local <old-user>
+# (simplest equivalent: mc admin user svcacct or change root via env +
+#  `docker compose up -d minio` — MinIO persists root creds from env)
+
+# 2) PostgreSQL — then update POSTGRES_PASSWORD in .env
+docker exec -it procurement-postgres psql -U postgres -c \
+  "ALTER USER postgres PASSWORD '<new-strong-password>';"
+docker compose up -d api   # api re-reads the DSN from .env
+
+# 3) Casdoor console admin (console → Identity → users → admin → reset
+#    password) — then update CASDOOR_ADMIN_PASSWORD in .env
+# 4) Casdoor application client secret (console → Applications →
+#    inventory-app → edit secret) — then update CASDOOR_CLIENT_SECRET in .env
+# 5) Seeded human users: reset each password in the Casdoor console.
+# 6) Gitea webhook secret (Gitea → repo → Settings → Webhooks) — then update
+#    GITEA_WEBHOOK_SECRET in .env and restart the receiver (systemctl restart erp-deploy-webhook)
+
+# 7) Apply everything:
+docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+```
+
+- **SSH**: disable password login (`PasswordAuthentication no` in
+  `/etc/ssh/sshd_config`), use keys only, and prefer a non-root user with
+  sudo over `root` direct login.
+- **Repo hygiene**: keep the repo private until the git history is either
+  purged (BFG / `git filter-repo` on the README + `backups/` blobs) or every
+  leaked value is rotated. Deleting a file in a later commit does **not**
+  remove it from history.
+- **Verify**: after rotation, `docker compose logs api | grep -i error`,
+  log into the app, upload + download one attachment, and confirm the
+  webhook deploy still works with a test push.

docs/casdoor-auth.md

@@ -12,7 +12,7 @@ scenarios, test results, and how to manage the system yourself.
 |---|---|---|
 | App (frontend) | http://localhost (Traefik edge; production: your domain) | — |
 | API (backend) | http://localhost:8000 (Swagger: `/docs`) | — |
-| Casdoor console | http://localhost:8080 | **admin / 123** (built-in org) |
+| Casdoor console | http://localhost:8080 | admin credentials come from `CASDOOR_ADMIN_PW` when running the seeder — never committed |
 | Casdoor OIDC discovery | http://localhost:8080/.well-known/openid-configuration | — |
 | Casdoor public JWKS | http://localhost:8080/.well-known/jwks | — |
 | In-network Casdoor (from the api container) | http://casdoor:8000 | — |
@@ -22,13 +22,13 @@ scenarios, test results, and how to manage the system yourself.
 
 | Username | Password | Casdoor org | App role (our `users` table) |
 |---|---|---|---|
-| `razaei` | `123456` | inventory | `admin` (super user) |
-| `mousavi` | `123456` | inventory | `procurement_manager` (مدیر تدارکات) |
-| `mohaghegh` | `123456` | inventory | `pm` (مدیر پروژه، بدون پروژه) |
-| `tester` | `123456` | inventory | `pm` (مدیر پروژه — پروژه «تست») |
+| `razaei` | `CASDOOR_SEED_PASSWORD` | inventory | `admin` (super user) |
+| `mousavi` | `CASDOOR_SEED_PASSWORD` | inventory | `procurement_manager` (مدیر تدارکات) |
+| `mohaghegh` | `CASDOOR_SEED_PASSWORD` | inventory | `pm` (مدیر پروژه، بدون پروژه) |
+| `tester` | `CASDOOR_SEED_PASSWORD` | inventory | `pm` (مدیر پروژه — پروژه «تست») |
 
-These users are created by `backend/tools/seed_casdoor.py` (idempotent — safe
-to re-run).
+Passwords are stored bcrypt-hashed (passwordType `bcrypt`). These users are
+created by `backend/tools/seed_casdoor.py` (idempotent — safe to re-run).
 
 ---
 
@@ -95,7 +95,7 @@ identity only.** No new authorization model was introduced.
   the OIDC client. Grant types: `authorization_code`, `refresh_token`,
   `password`. Token format JWT (so the backend can verify via JWKS).
 - **Casdoor Organization** (`inventory`): the tenant; every app user belongs
-  to it. (The Casdoor console admin `admin/123` lives in the separate
+  to it. (The Casdoor console admin lives in the separate
   `built-in` org.)
 - **User — two records per person:**
   1. Casdoor user (login credential: name + password).
@@ -158,7 +158,7 @@ After that, log in as the admin and use the Organization panel
 
 | Test | Action | Result | Evidence |
 |---|---|---|---|
-| 1 | Login: `POST /api/v1/auth/login` (tester/123456) | **PASS** | 200, JWT + profile returned |
+| 1 | Login: `POST /api/v1/auth/login` (tester / CASDOOR_SEED_PASSWORD) | **PASS** | 200, JWT + profile returned |
 | 2 | Authenticated API: `GET /users/me` with token | **PASS** | 200, role `pm` + project «تست» |
 | 3 | No token: `GET /inventory/warehouses` | **PASS** | 401 `UNAUTHORIZED` |
 | 4 | Invalid token: corrupted Bearer | **PASS** | 401 `UNAUTHORIZED` «توکن نامعتبر است» |
@@ -179,7 +179,7 @@ After that, log in as the admin and use the Organization panel
 | 6 | Organization exists | ✅ `inventory` |
 | 7 | Application exists | ✅ `inventory-app` |
 | 8 | Client exists | ✅ `inventory-app-client` (grants incl. `password`) |
-| 9 | Test users exist | ✅ razaei, mousavi, mohaghegh, tester (password 123456) |
+| 9 | Test users exist | ✅ razaei, mousavi, mohaghegh, tester (password: CASDOOR_SEED_PASSWORD) |
 | 10 | Redirect URI matches | ✅ N/A for the in-page flow (redirects unused). The seeded app holds the legacy `http://localhost:3000/login`; the seeder now defaults to `http://localhost/login` |
 | 11 | OIDC works | ✅ discovery doc + token endpoint + JWT issuance verified |
 | 12 | PKCE works | ➖ **N/A** — the PKCE/redirect flow was replaced by the in-page password-grant login (per the redesign spec); nothing to verify |
@@ -270,7 +270,7 @@ After that, log in as the admin and use the Organization panel
 
 ## 9. Managing Casdoor yourself
 
-- **Console:** http://localhost:8080 — log in as **admin / 123**. From there
+- **Console:** http://localhost:8080 — log in as the admin (credentials from the seeder run). From there
   you can manage Organizations, Users, Applications, Providers, Certificates.
 - **Seeding** (org `inventory`, app `inventory-app`, the four users) —
   re-runnable at any time:

frontend/.env.example

@@ -5,6 +5,13 @@
 VITE_API_BASE_URL=
 
 # Show the "Developer Mode" panel on the login page.
-# true (default) / false — in Docker builds this is controlled by the
-# DEV_LOGIN_ENABLED build arg (see docker-compose.yml), not this file.
-VITE_ENABLE_DEV_LOGIN=true
+# true (default in local dev) / false — in Docker builds this is controlled
+# by the DEV_LOGIN_ENABLED build arg (see docker-compose.yml), not this file.
+VITE_ENABLE_DEV_LOGIN=
+
+# ---- Observability (all optional — empty = disabled, no network calls) ----
+# OpenPanel: browser origin of the self-hosted dashboard/API + project client id.
+VITE_OPENPANEL_URL=
+VITE_OPENPANEL_CLIENT_ID=
+# GlitchTip/Sentry DSN for frontend exception capture.
+VITE_SENTRY_DSN=

frontend/Dockerfile

@@ -13,11 +13,21 @@ ARG NPM_REGISTRY=https://registry.npmmirror.com
 COPY package.json package-lock.json ./
 RUN npm config set registry ${NPM_REGISTRY} && npm ci
 
-# Developer Mode panel on the login page (default enabled; set to
-# "false" to build a production login without the dev panel).
-ARG DEV_LOGIN_ENABLED=true
+# Developer Mode panel on the login page (dev-only aid). Production builds
+# MUST keep this "false" — identity comes from Casdoor tokens, and the
+# backend rejects the X-User-* header path unless DEV_LOGIN_ENABLED=true.
+ARG DEV_LOGIN_ENABLED=false
 ENV VITE_ENABLE_DEV_LOGIN=${DEV_LOGIN_ENABLED}
 
+# Observability (Phase 2) — baked into the bundle at build time.
+# Empty values disable the feature (analytics.ts is a no-op then).
+ARG VITE_OPENPANEL_URL=""
+ARG VITE_OPENPANEL_CLIENT_ID=""
+ARG VITE_SENTRY_DSN=""
+ENV VITE_OPENPANEL_URL=${VITE_OPENPANEL_URL} \
+    VITE_OPENPANEL_CLIENT_ID=${VITE_OPENPANEL_CLIENT_ID} \
+    VITE_SENTRY_DSN=${VITE_SENTRY_DSN}
+
 # Source code + build
 COPY . .
 RUN npm run build

frontend/package-lock.json

@@ -11,11 +11,13 @@
         "@dnd-kit/core": "^6.3.1",
         "@dnd-kit/utilities": "^3.2.2",
         "@hookform/resolvers": "3.10",
+        "@openpanel/web": "^1.0.1",
         "@radix-ui/react-checkbox": "^1.3.11",
         "@radix-ui/react-dialog": "^1.1.23",
         "@radix-ui/react-label": "^2.1.15",
         "@radix-ui/react-select": "^2.3.7",
         "@radix-ui/react-slot": "^1.3.3",
+        "@sentry/react": "^10.0.0",
         "@tailwindcss/vite": "^4.3.3",
         "@tanstack/react-query": "^5.101.4",
         "class-variance-authority": "^0.7.1",
@@ -172,6 +174,23 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@openpanel/sdk": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@openpanel/sdk/-/sdk-1.3.1.tgz",
+      "integrity": "sha512-mQ5xaBUGXnyRg3qYxwnbVaUYyW7w8u+munrWk/ClnqxEeR2j+FYPiA6noHbHMCFC2aZutYD5OoRzEvw3FBNFxw==",
+      "license": "MIT"
+    },
+    "node_modules/@openpanel/web": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/@openpanel/web/-/web-1.4.1.tgz",
+      "integrity": "sha512-DgUWeocZw+b57YiJjefZPg+6sceR7TdOF8x7Ut75lu3CwcwqGi5jZNPXjikNemGL37aNWXCB4buhcoNan2j7RA==",
+      "license": "MIT",
+      "dependencies": {
+        "@openpanel/sdk": "1.3.1",
+        "@rrweb/types": "2.0.0-alpha.20",
+        "rrweb": "2.0.0-alpha.20"
+      }
+    },
     "node_modules/@oxc-project/types": {
       "version": "0.143.0",
       "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.143.0.tgz",
@@ -308,9 +327,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -328,9 +344,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -348,9 +361,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -368,9 +378,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -388,9 +395,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -408,9 +412,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -428,9 +429,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -448,9 +446,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1207,9 +1202,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1226,9 +1218,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1245,9 +1234,6 @@
       "cpu": [
         "ppc64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1264,9 +1250,6 @@
       "cpu": [
         "s390x"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1283,9 +1266,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1302,9 +1282,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1368,6 +1345,124 @@
       "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
       "license": "MIT"
     },
+    "node_modules/@rrweb/types": {
+      "version": "2.0.0-alpha.20",
+      "resolved": "https://registry.npmjs.org/@rrweb/types/-/types-2.0.0-alpha.20.tgz",
+      "integrity": "sha512-RbnDgKxA/odwB1R4gF7eUUj+rdSrq6ROQJsnMw7MIsGzlbSYvJeZN8YY4XqU0G6sKJvXI6bSzk7w/G94jNwzhw==",
+      "license": "MIT"
+    },
+    "node_modules/@rrweb/utils": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/@rrweb/utils/-/utils-2.1.6.tgz",
+      "integrity": "sha512-BIRXcxiytJs5Guxw0tzsnVS7ukcMqtnxixjIGvV49VdJeOEG6NJeMU7o8efbHW1D52a12Y8QsgDjgDgblg3org==",
+      "license": "MIT"
+    },
+    "node_modules/@sentry/browser": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-10.75.0.tgz",
+      "integrity": "sha512-CKGSJLWISQ6LgMaGnMpY+XvwWQ2iiHTayUs6SGLIvYeaGo2GTjS/Z4pnbCVHb2t1VxLZksyehgcC6ZYGJeQpzQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/browser-utils": "10.75.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.75.0",
+        "@sentry/feedback": "10.75.0",
+        "@sentry/replay": "10.75.0",
+        "@sentry/replay-canvas": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/browser-utils": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/browser-utils/-/browser-utils-10.75.0.tgz",
+      "integrity": "sha512-yZfdQ87RLat/7retF8zA6Z9zCAT12IyaPvIiu+bbi1E1V1OqDpS8MKNa/6LF69Ap7DVTORi9ITEgjlAqTXF0xQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/conventions": {
+      "version": "0.16.0",
+      "resolved": "https://registry.npmjs.org/@sentry/conventions/-/conventions-0.16.0.tgz",
+      "integrity": "sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@sentry/core": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.0.tgz",
+      "integrity": "sha512-5wDQpQqjJ6RHdPR+z6Q+47XlwoxRKBv0yyB0LKHqL/1azPOQbR+nllyLmmQDcoJpaksuLSmLA1q6hFX7gjDT2w==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/feedback": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/feedback/-/feedback-10.75.0.tgz",
+      "integrity": "sha512-YLVAFQXELJAOg7ke4oLkd8t5l0fJUockLlTQJg/2Trh7SB5Q4mkSwlnAkEAqDQ618vnpFsG/tnYMwtfZeffHjA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/react": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/react/-/react-10.75.0.tgz",
+      "integrity": "sha512-ghWv99h7k4WgMucqBhf4jZn+G0Owm5gCBCVKOKu88UDCWUd9aVJ8FGosAkATp/x/ogcZTnqG2dcXBD+1U+BJeA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/browser": "10.75.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || 17.x || 18.x || 19.x"
+      }
+    },
+    "node_modules/@sentry/replay": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/replay/-/replay-10.75.0.tgz",
+      "integrity": "sha512-p4xxEo/ayiMZG9tygr09YjqYAd52uq8Qi0EVoRRgUe70nQda0HVPVW519JLq0G+Th/5O5sKME9y1layLU3xlPg==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/browser-utils": "10.75.0",
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/replay-canvas": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/replay-canvas/-/replay-canvas-10.75.0.tgz",
+      "integrity": "sha512-LNokI5Ud22nZ/o2il/2SfbNIARupWrbS6Mh9jZroZTjD38FN0Oi9vIexj6h1HN81C6+lP2Tmpaj+fl3/wOizzA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/core": "10.75.0",
+        "@sentry/replay": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@tailwindcss/node": {
       "version": "4.3.3",
       "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
@@ -1493,9 +1588,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1512,9 +1604,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1531,9 +1620,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1550,9 +1636,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1663,6 +1746,12 @@
         "react": "^18 || ^19"
       }
     },
+    "node_modules/@types/css-font-loading-module": {
+      "version": "0.0.7",
+      "resolved": "https://registry.npmjs.org/@types/css-font-loading-module/-/css-font-loading-module-0.0.7.tgz",
+      "integrity": "sha512-nl09VhutdjINdWyXxHWN/w9zlNCfr60JUqJbd24YXUuCwgeL0TpFSdElCwb6cxfB6ybE19Gjj4g0jsgkXxKv1Q==",
+      "license": "MIT"
+    },
     "node_modules/@types/node": {
       "version": "24.13.3",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
@@ -1719,6 +1808,12 @@
         }
       }
     },
+    "node_modules/@xstate/fsm": {
+      "version": "1.6.5",
+      "resolved": "https://registry.npmjs.org/@xstate/fsm/-/fsm-1.6.5.tgz",
+      "integrity": "sha512-b5o1I6aLNeYlU/3CPlj/Z91ybk1gUsKT+5NAJI+2W4UjvS5KLG28K9v5UvNoFVjHV8PajVZ00RH3vnjyQO7ZAw==",
+      "license": "MIT"
+    },
     "node_modules/aria-hidden": {
       "version": "1.2.6",
       "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
@@ -1731,6 +1826,15 @@
         "node": ">=10"
       }
     },
+    "node_modules/base64-arraybuffer": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz",
+      "integrity": "sha512-I3yl4r9QB5ZRY3XuJVEPfc2XhZO6YweFPI+UovAzn+8/hb3oJ6lnysaFcjVpkCPfVWFUDvoZ8kmVDP7WyRtYtQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6.0"
+      }
+    },
     "node_modules/class-variance-authority": {
       "version": "0.7.1",
       "resolved": "https://registry.npmjs.org/class-variance-authority/-/class-variance-authority-0.7.1.tgz",
@@ -1991,9 +2095,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2014,9 +2115,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2037,9 +2135,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2060,9 +2155,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2134,6 +2226,12 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/mitt": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/mitt/-/mitt-3.0.1.tgz",
+      "integrity": "sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==",
+      "license": "MIT"
+    },
     "node_modules/nanoid": {
       "version": "3.3.18",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
@@ -2423,6 +2521,40 @@
         "@rolldown/binding-win32-x64-msvc": "1.2.3"
       }
     },
+    "node_modules/rrdom": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/rrdom/-/rrdom-2.1.6.tgz",
+      "integrity": "sha512-EMRrTs1GRsmb8bNyAs107wG7eRwVEOvDUBsnCyvQnVV6elrmrua/AeS0tdcA0gLW4eptr4l6bRsS/2QRICvdqQ==",
+      "license": "MIT",
+      "dependencies": {
+        "rrweb-snapshot": "^2.1.6"
+      }
+    },
+    "node_modules/rrweb": {
+      "version": "2.0.0-alpha.20",
+      "resolved": "https://registry.npmjs.org/rrweb/-/rrweb-2.0.0-alpha.20.tgz",
+      "integrity": "sha512-CZKDlm+j1VA50Ko3gnMbpvguCAleljsTNXPnVk9aeNP8o6T6kolRbISHyDZpqZ4G+bdDLlQOignPP3jEsXs8Gg==",
+      "license": "MIT",
+      "dependencies": {
+        "@rrweb/types": "^2.0.0-alpha.20",
+        "@rrweb/utils": "^2.0.0-alpha.20",
+        "@types/css-font-loading-module": "0.0.7",
+        "@xstate/fsm": "^1.4.0",
+        "base64-arraybuffer": "^1.0.1",
+        "mitt": "^3.0.0",
+        "rrdom": "^2.0.0-alpha.20",
+        "rrweb-snapshot": "^2.0.0-alpha.20"
+      }
+    },
+    "node_modules/rrweb-snapshot": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/rrweb-snapshot/-/rrweb-snapshot-2.1.6.tgz",
+      "integrity": "sha512-X03+x3AdWTbpD4Swb54CCJoEauYTv/O2ah0d3ZVv5rgr6bv0Ty5mxNjEyEEfNC1dQ8VdyjKKJgDG3A00FV0lNg==",
+      "license": "MIT",
+      "dependencies": {
+        "postcss": "^8.4.38"
+      }
+    },
     "node_modules/scheduler": {
       "version": "0.27.0",
       "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
@@ -2788,9 +2920,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2811,9 +2940,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2834,9 +2960,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2857,9 +2980,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [

frontend/package.json

@@ -10,9 +10,11 @@
     "preview": "vite preview"
   },
   "dependencies": {
+    "@sentry/react": "^10.0.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/utilities": "^3.2.2",
     "@hookform/resolvers": "3.10",
+    "@openpanel/web": "^1.0.1",
     "@radix-ui/react-checkbox": "^1.3.11",
     "@radix-ui/react-dialog": "^1.1.23",
     "@radix-ui/react-label": "^2.1.15",

frontend/src/components/ErrorBoundary.tsx

@@ -1,4 +1,5 @@
 import { Component, type ErrorInfo, type ReactNode } from "react";
+import { captureError } from "../lib/analytics";
 
 interface Props {
   children: ReactNode;
@@ -19,6 +20,8 @@ export class ErrorBoundary extends Component<Props, State> {
 
   componentDidCatch(error: Error, info: ErrorInfo) {
     console.error("ErrorBoundary caught:", error, info);
+    // GlitchTip/Sentry (no-op بدون VITE_SENTRY_DSN)
+    captureError(error);
   }
 
   private retry = () => {

frontend/src/components/FileList.tsx

@@ -9,13 +9,13 @@ export interface FileListProps {
   upload: (file: File) => Promise<Attachment>;
   // حذف سمت سرور (اختیاری — بعد از حذف محلی صدا زده می‌شود)
   onDelete?: (a: Attachment) => void;
-  // لینک دانلود؛ null یعنی هنوز آپلود نشده
-  urlOf?: (a: Attachment) => string | null;
+  // دانلود احراز هویت‌شده (توکن Bearer + blob — لینک خام توکن نمی‌فرستد)
+  onDownload?: (a: Attachment) => void | Promise<void>;
   label?: string;
 }
 
 // مدیریت چند فاکتور: آپلود مستقیم به سرور (MinIO) + دانلود/حذف فایل‌های ذخیره‌شده
-export function FileList({ files, onChange, upload, onDelete, urlOf, label = "افزودن فاکتور" }: FileListProps) {
+export function FileList({ files, onChange, upload, onDelete, onDownload, label = "افزودن فاکتور" }: FileListProps) {
   const inputRef = useRef<HTMLInputElement | null>(null);
 
   const remove = (i: number) => {
@@ -45,10 +45,19 @@ export function FileList({ files, onChange, upload, onDelete, urlOf, label = "ا
       {files.map((inv, i) => (
         <div key={i} className="inv-row">
           <span className="inv-name">📎 {inv.name}</span>
-          {urlOf?.(inv) && (
-            <a className="inv-open" href={urlOf(inv)!} download={inv.name} title="دانلود">
+          {onDownload && (
+            <button
+              type="button"
+              className="inv-open"
+              title="دانلود"
+              onClick={() => {
+                Promise.resolve(onDownload(inv)).catch((err) =>
+                  toast.error(err instanceof Error ? err.message : "دانلود فایل ناموفق بود"),
+                );
+              }}
+            >
               ↓
-            </a>
+            </button>
           )}
           <button type="button" className="inv-x" title="حذف" onClick={() => remove(i)}>
             ×

frontend/src/components/JalaliDatePicker.tsx

@@ -1,4 +1,4 @@
-import { useMemo, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
 import {
   daysInMonth,
   gregorianToJalali,
@@ -6,6 +6,7 @@ import {
   jalaliStrToIso,
   jalaliToGregorian,
   MONTHS,
+  toAsciiDigits,
   toFa,
   WEEKDAYS,
 } from "../lib/jalali";
@@ -14,11 +15,12 @@ import { cn } from "../lib/utils";
 import { useClickOutside } from "./useClickOutside";
 
 export interface JalaliDatePickerProps {
-  value: string | null; // ISO date (با time اختیاری)
-  onChange: (iso: string | null) => void;
+  value: string | null; // ISO date (یا YYYY-MM-DD با time اختیاری)
+  onChange: (val: string | null) => void;
   placeholder?: string;
   className?: string;
   withTime?: boolean; // نمایش ساعت:دقیقه هم (پیشنهاد/پذیرش/رسید)
+  disabled?: boolean;
 }
 
 function todayJalali(): [number, number, number] {
@@ -28,6 +30,13 @@ function todayJalali(): [number, number, number] {
 
 function isoToJalali(iso: string | null): [number, number, number] | null {
   if (!iso) return null;
+  const m = String(iso).match(/^(\d{4})-(\d{2})-(\d{2})$/);
+  if (m) {
+    const gy = parseInt(m[1], 10);
+    const gm = parseInt(m[2], 10);
+    const gd = parseInt(m[3], 10);
+    return gregorianToJalali(gy, gm, gd);
+  }
   const d = new Date(iso);
   if (Number.isNaN(d.getTime())) return null;
   return gregorianToJalali(d.getFullYear(), d.getMonth() + 1, d.getDate());
@@ -39,6 +48,12 @@ function buildIso(jy: number, jm: number, jd: number, h: number, m: number): str
   return new Date(gy, gm - 1, gd, h, m).toISOString();
 }
 
+// ساخت تاریخ استاندارد YYYY-MM-DD بدون مؤلفه زمان
+function buildDateOnly(jy: number, jm: number, jd: number): string {
+  const [gy, gm, gd] = jalaliToGregorian(jy, jm, jd);
+  return `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+}
+
 // وقتی هنوز زمان مشخصی ست نشده، ساعت/دقیقه‌ی فعلی سیستم پیش‌فرض است
 // (نه ۰۰:۰۰) — دکمه‌ی «امروز» و انتخاب روز، همین زمان را نگه می‌دارند.
 function nowTime(): { h: number; m: number } {
@@ -60,9 +75,14 @@ export function JalaliDatePicker({
   placeholder,
   className,
   withTime = false,
+  disabled = false,
 }: JalaliDatePickerProps) {
   const [open, setOpen] = useState(false);
   const [curJ, setCurJ] = useState<[number, number, number]>(() => isoToJalali(value) ?? todayJalali());
+  const initialTime = timeOf(value);
+  const [hourText, setHourText] = useState<string>(() => faNum(String(initialTime.h).padStart(2, "0")));
+  const [minuteText, setMinuteText] = useState<string>(() => faNum(String(initialTime.m).padStart(2, "0")));
+
   const [text, setText] = useState<string>(() => {
     if (!value) return "";
     const j = isoToJalaliStr(value);
@@ -74,17 +94,49 @@ export function JalaliDatePicker({
     return `${j} ${faNum(hh + ":" + mm)}`;
   });
 
+  useEffect(() => {
+    if (!value) {
+      setText("");
+      const now = nowTime();
+      setHourText(faNum(String(now.h).padStart(2, "0")));
+      setMinuteText(faNum(String(now.m).padStart(2, "0")));
+      return;
+    }
+    const j = isoToJalaliStr(value);
+    const t = timeOf(value);
+    if (!withTime) {
+      setText(j);
+    } else {
+      const hh = String(t.h).padStart(2, "0");
+      const mm = String(t.m).padStart(2, "0");
+      setText(`${j} ${faNum(hh + ":" + mm)}`);
+
+      // Only update local input texts if numeric values differ, to avoid wiping in-progress typing
+      const curH = parseInt(toAsciiDigits(hourText) || "0", 10);
+      if (curH !== t.h) {
+        setHourText(faNum(hh));
+      }
+      const curM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+      if (curM !== t.m) {
+        setMinuteText(faNum(mm));
+      }
+    }
+    const jParts = isoToJalali(value);
+    if (jParts) setCurJ(jParts);
+  }, [value, withTime]);
+
   const ref = useClickOutside<HTMLDivElement>(() => setOpen(false));
 
   // تاریخ انتخاب‌شده به صورت محلی (نه UTC) برای مقایسه با سلول‌های تقویم
   function selectedLocalDate(): string | null {
     if (!value) return null;
+    const m = String(value).match(/^(\d{4})-(\d{2})-(\d{2})$/);
+    if (m) return `${m[1]}-${m[2]}-${m[3]}`;
     const d = new Date(value);
     if (Number.isNaN(d.getTime())) return null;
     return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
   }
   const selectedIso = selectedLocalDate();
-  const time = timeOf(value);
 
   const grid = useMemo(() => {
     const [jy, jm] = curJ;
@@ -124,35 +176,108 @@ export function JalaliDatePicker({
   };
 
   const selectDay = (jy: number, jm: number, jd: number) => {
-    const isoWithTime = buildIso(jy, jm, jd, time.h, time.m);
-    onChange(isoWithTime);
-    setText(`${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))}${withTime ? " " + faNum(String(time.h).padStart(2, "0") + ":" + String(time.m).padStart(2, "0")) : ""}`);
+    const currentH = parseInt(toAsciiDigits(hourText) || "0", 10);
+    const currentM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+    const validH = Math.min(23, Math.max(0, currentH));
+    const validM = Math.min(59, Math.max(0, currentM));
+    const val = withTime ? buildIso(jy, jm, jd, validH, validM) : buildDateOnly(jy, jm, jd);
+    onChange(val);
+    setText(
+      `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))}${withTime ? " " + faNum(String(validH).padStart(2, "0") + ":" + String(validM).padStart(2, "0")) : ""}`
+    );
     setOpen(false);
   };
 
-  const setTimePart = (part: "h" | "m", raw: string) => {
-    const n = parseInt(raw.replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d))), 10);
-    if (Number.isNaN(n)) return;
-    const h = part === "h" ? Math.min(23, Math.max(0, n)) : time.h;
-    const m = part === "m" ? Math.min(59, Math.max(0, n)) : time.m;
+  const handleHourChange = (raw: string) => {
+    let digits = toAsciiDigits(raw).replace(/\D/g, "");
+    if (digits.length === 3) {
+      digits = digits.slice(-1);
+    } else if (digits.length > 3) {
+      digits = digits.slice(0, 2);
+    }
+    if (!digits) {
+      setHourText("");
+      return;
+    }
+    const n = parseInt(digits, 10);
+    const clamped = Math.min(23, Math.max(0, n));
+    const textToShow = digits.length === 2 && n > 23 ? String(clamped) : digits;
+    setHourText(faNum(textToShow));
+
     const [jy, jm, jd] = curJ;
-    onChange(buildIso(jy, jm, jd, h, m));
-    // به‌روزرسانی نمایش
-    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, h, m));
-    setText(`${j} ${faNum(String(h).padStart(2, "0") + ":" + String(m).padStart(2, "0"))}`);
+    const currentM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+    const validM = Math.min(59, Math.max(0, currentM));
+    onChange(buildIso(jy, jm, jd, clamped, validM));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, clamped, validM));
+    setText(`${j} ${faNum(String(clamped).padStart(2, "0") + ":" + String(validM).padStart(2, "0"))}`);
+  };
+
+  const handleHourBlur = () => {
+    const digits = toAsciiDigits(hourText).replace(/\D/g, "");
+    const n = digits ? parseInt(digits, 10) : 0;
+    const clamped = Math.min(23, Math.max(0, n));
+    setHourText(faNum(String(clamped).padStart(2, "0")));
+
+    const [jy, jm, jd] = curJ;
+    const currentM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+    const validM = Math.min(59, Math.max(0, currentM));
+    onChange(buildIso(jy, jm, jd, clamped, validM));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, clamped, validM));
+    setText(`${j} ${faNum(String(clamped).padStart(2, "0") + ":" + String(validM).padStart(2, "0"))}`);
+  };
+
+  const handleMinuteChange = (raw: string) => {
+    let digits = toAsciiDigits(raw).replace(/\D/g, "");
+    if (digits.length === 3) {
+      digits = digits.slice(-1);
+    } else if (digits.length > 3) {
+      digits = digits.slice(0, 2);
+    }
+    if (!digits) {
+      setMinuteText("");
+      return;
+    }
+    const n = parseInt(digits, 10);
+    const clamped = Math.min(59, Math.max(0, n));
+    const textToShow = digits.length === 2 && n > 59 ? String(clamped) : digits;
+    setMinuteText(faNum(textToShow));
+
+    const [jy, jm, jd] = curJ;
+    const currentH = parseInt(toAsciiDigits(hourText) || "0", 10);
+    const validH = Math.min(23, Math.max(0, currentH));
+    onChange(buildIso(jy, jm, jd, validH, clamped));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, validH, clamped));
+    setText(`${j} ${faNum(String(validH).padStart(2, "0") + ":" + String(clamped).padStart(2, "0"))}`);
+  };
+
+  const handleMinuteBlur = () => {
+    const digits = toAsciiDigits(minuteText).replace(/\D/g, "");
+    const n = digits ? parseInt(digits, 10) : 0;
+    const clamped = Math.min(59, Math.max(0, n));
+    setMinuteText(faNum(String(clamped).padStart(2, "0")));
+
+    const [jy, jm, jd] = curJ;
+    const currentH = parseInt(toAsciiDigits(hourText) || "0", 10);
+    const validH = Math.min(23, Math.max(0, currentH));
+    onChange(buildIso(jy, jm, jd, validH, clamped));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, validH, clamped));
+    setText(`${j} ${faNum(String(validH).padStart(2, "0") + ":" + String(clamped).padStart(2, "0"))}`);
   };
 
   const pickToday = () => {
     const now = new Date();
     const [jy, jm, jd] = todayJalali();
-    // بدون withTime فقط تاریخ امروز ثبت می‌شود — ساعت همیشه نیمه‌شب
-    const isoWithTime = withTime
-      ? buildIso(jy, jm, jd, now.getHours(), now.getMinutes())
-      : buildIso(jy, jm, jd, 0, 0);
-    onChange(isoWithTime);
+    const nh = now.getHours();
+    const nm = now.getMinutes();
+    setHourText(faNum(String(nh).padStart(2, "0")));
+    setMinuteText(faNum(String(nm).padStart(2, "0")));
+    const val = withTime
+      ? buildIso(jy, jm, jd, nh, nm)
+      : buildDateOnly(jy, jm, jd);
+    onChange(val);
     setText(
       withTime
-        ? `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))} ${faNum(String(now.getHours()).padStart(2, "0") + ":" + String(now.getMinutes()).padStart(2, "0"))}`
+        ? `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))} ${faNum(String(nh).padStart(2, "0") + ":" + String(nm).padStart(2, "0"))}`
         : `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))}`,
     );
     setOpen(false);
@@ -161,32 +286,98 @@ export function JalaliDatePicker({
   const clear = () => {
     onChange(null);
     setText("");
+    const now = nowTime();
+    setHourText(faNum(String(now.h).padStart(2, "0")));
+    setMinuteText(faNum(String(now.m).padStart(2, "0")));
     setOpen(false);
   };
 
   const onInputChange = (v: string) => {
     setText(v);
+    if (!v.trim()) {
+      onChange(null);
+      return;
+    }
     const iso = jalaliStrToIso(v);
     if (iso) {
-      onChange(iso);
+      if (!withTime) {
+        const nums = String(v)
+          .split(/[/\-.]/)
+          .map((x) => parseInt(toAsciiDigits(x), 10));
+        if (nums.length >= 3 && !nums.some((n) => Number.isNaN(n))) {
+          const [gy, gm, gd] = jalaliToGregorian(nums[0], nums[1], nums[2]);
+          onChange(`${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`);
+        } else {
+          onChange(iso.slice(0, 10));
+        }
+      } else {
+        onChange(iso);
+      }
       const j = isoToJalali(iso);
       if (j) setCurJ([j[0], j[1], j[2]]);
     }
   };
 
+  const handleInputBlur = () => {
+    if (!text.trim()) {
+      onChange(null);
+      return;
+    }
+    const iso = jalaliStrToIso(text);
+    if (iso) {
+      if (!withTime) {
+        const nums = String(text)
+          .split(/[/\-.]/)
+          .map((x) => parseInt(toAsciiDigits(x), 10));
+        if (nums.length >= 3 && !nums.some((n) => Number.isNaN(n))) {
+          const [gy, gm, gd] = jalaliToGregorian(nums[0], nums[1], nums[2]);
+          const dOnly = `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+          onChange(dOnly);
+          setText(isoToJalaliStr(dOnly));
+        } else {
+          onChange(iso.slice(0, 10));
+          setText(isoToJalaliStr(iso));
+        }
+      } else {
+        onChange(iso);
+        const j = isoToJalaliStr(iso);
+        const d = new Date(iso);
+        if (!Number.isNaN(d.getTime())) {
+          const hh = String(d.getHours()).padStart(2, "0");
+          const mm = String(d.getMinutes()).padStart(2, "0");
+          setText(`${j} ${faNum(hh + ":" + mm)}`);
+        }
+      }
+    } else if (value) {
+      const j = isoToJalaliStr(value);
+      if (!withTime) {
+        setText(j);
+      } else {
+        const d = new Date(value);
+        if (!Number.isNaN(d.getTime())) {
+          const hh = String(d.getHours()).padStart(2, "0");
+          const mm = String(d.getMinutes()).padStart(2, "0");
+          setText(`${j} ${faNum(hh + ":" + mm)}`);
+        }
+      }
+    }
+  };
+
   return (
     <div ref={ref} className={cn("relative", className)}>
       <input
         type="text"
-        className="flex h-9 w-full rounded-md border border-line bg-panel px-3 py-1 text-sm text-ink shadow-sm transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+        disabled={disabled}
+        className="flex h-9 w-full rounded-md border border-line bg-panel px-3 py-1 text-sm text-ink shadow-sm transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
         value={text}
         placeholder={placeholder ?? "۱۴۰۳/۰۵/۱۲"}
         autoComplete="off"
-        onFocus={() => setOpen(true)}
-        onClick={() => setOpen(true)}
+        onFocus={() => !disabled && setOpen(true)}
+        onClick={() => !disabled && setOpen(true)}
         onChange={(e) => onInputChange(e.target.value)}
+        onBlur={handleInputBlur}
       />
-      {open && (
+      {open && !disabled && (
         <div
           className={cn(
             "absolute inset-x-0 top-full z-30 mt-1 rounded-md border border-line bg-panel shadow-md",
@@ -195,6 +386,7 @@ export function JalaliDatePicker({
             withTime ? "w-80 p-3" : "w-64 p-2",
           )}
         >
+          {/* 1. Header: Month / Year Navigation */}
           <div className="mb-1.5 flex items-center justify-between gap-1">
             <button type="button" className="cursor-pointer rounded px-1.5 text-sm hover:bg-slate-bg" onClick={() => nav("y+1")}>
               «
@@ -212,6 +404,8 @@ export function JalaliDatePicker({
               »
             </button>
           </div>
+
+          {/* 2. Day of Week Header & Days Grid */}
           <div className="grid grid-cols-7 gap-0.5 text-center">
             {WEEKDAYS.map((w) => (
               <div key={w} className="py-0.5 text-[10px] font-bold text-muted">
@@ -238,33 +432,40 @@ export function JalaliDatePicker({
               ),
             )}
           </div>
+
+          {/* 3. Time Inputs Row (Positioned BELOW the calendar grid) — Hour on left, Minute on right */}
           {withTime && (
-            <div className="mt-2 flex items-center justify-center gap-4 border-t border-line pt-2.5">
+            <div className="mt-2 flex items-center justify-center gap-3 rounded-md border border-line/70 bg-slate-bg/40 py-1.5">
               <div className="flex items-center gap-1.5">
-                <span className="text-[11.5px] font-semibold text-muted">ساعت</span>
                 <input
                   type="text"
-                  className="num-input h-8 w-14 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-10 max-md:w-16"
-                  value={faNum(String(time.h).padStart(2, "0"))}
+                  className="num-input h-7 w-12 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-9 max-md:w-14"
+                  value={minuteText}
                   inputMode="numeric"
-                  maxLength={2}
-                  onChange={(e) => setTimePart("h", e.target.value)}
+                  onFocus={(e) => e.target.select()}
+                  onChange={(e) => handleMinuteChange(e.target.value)}
+                  onBlur={handleMinuteBlur}
                 />
-              </div>
-              <span className="text-muted">:</span>
-              <div className="flex items-center gap-1.5">
                 <span className="text-[11.5px] font-semibold text-muted">دقیقه</span>
+              </div>
+              <span className="font-bold text-muted">:</span>
+              <div className="flex items-center gap-1.5">
                 <input
                   type="text"
-                  className="num-input h-8 w-14 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-10 max-md:w-16"
-                  value={faNum(String(time.m).padStart(2, "0"))}
+                  className="num-input h-7 w-12 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-9 max-md:w-14"
+                  value={hourText}
                   inputMode="numeric"
-                  maxLength={2}
-                  onChange={(e) => setTimePart("m", e.target.value)}
+                  onFocus={(e) => e.target.select()}
+                  onChange={(e) => handleHourChange(e.target.value)}
+                  onBlur={handleHourBlur}
                 />
+                <span className="text-[11.5px] font-semibold text-muted">ساعت</span>
               </div>
             </div>
           )}
+
+
+          {/* 4. Action Buttons Footer */}
           <div className="mt-2 flex justify-between border-t border-line pt-2">
             <button type="button" className="cursor-pointer rounded px-2 py-0.5 text-[11.5px] text-accent hover:bg-slate-bg" onClick={pickToday}>
               امروز

frontend/src/components/MilestoneRow.tsx

@@ -6,10 +6,11 @@ export interface MilestoneRowProps {
   milestone: Milestone;
   onChange: (m: Milestone) => void;
   onRemove: () => void;
+  disabled?: boolean;
 }
 
 // یک ردیف مرحله‌ی پرداخت: تاریخ + مبلغ + دکمه‌ی حذف
-export function MilestoneRow({ milestone, onChange, onRemove }: MilestoneRowProps) {
+export function MilestoneRow({ milestone, onChange, onRemove, disabled = false }: MilestoneRowProps) {
   return (
     <div className="milestone-row">
       <JalaliDatePicker
@@ -17,6 +18,7 @@ export function MilestoneRow({ milestone, onChange, onRemove }: MilestoneRowProp
         onChange={(iso) => onChange({ ...milestone, when_iso: iso })}
         placeholder="تاریخ"
         className="w-36 shrink-0"
+        disabled={disabled}
       />
       <div className="ms-amount-wrap">
         <NumberInput
@@ -24,11 +26,14 @@ export function MilestoneRow({ milestone, onChange, onRemove }: MilestoneRowProp
           onChange={(amount) => onChange({ ...milestone, amount })}
           placeholder="مبلغ (تومان)"
           showWords
+          disabled={disabled}
         />
       </div>
-      <button type="button" className="ms-x" title="حذف" onClick={onRemove}>
-        ×
-      </button>
+      {!disabled && (
+        <button type="button" className="ms-x" title="حذف" onClick={onRemove}>
+          ×
+        </button>
+      )}
     </div>
   );
 }

frontend/src/components/MultiSelectCombobox.tsx

@@ -12,6 +12,7 @@ export interface MultiSelectComboboxProps {
   className?: string;
   inputClassName?: string;
   allowCreate?: boolean; // اجازه‌ی تایپ مقدار جدید (پیش‌فرض true)
+  disabled?: boolean;
 }
 
 // چند-انتخابی خلاق (creatable multi-select) با چیپ‌ها:
@@ -27,6 +28,7 @@ export function MultiSelectCombobox({
   className,
   inputClassName,
   allowCreate = true,
+  disabled = false,
 }: MultiSelectComboboxProps) {
   const [text, setText] = useState("");
   const [open, setOpen] = useState(false);
@@ -105,46 +107,56 @@ export function MultiSelectCombobox({
   return (
     <div ref={ref} className={cn("relative", className)}>
       <div
-        className="flex min-h-9 w-full flex-wrap items-center gap-1 rounded-lg border border-line bg-panel px-2 py-1 shadow-sm transition-colors focus-within:ring-2 focus-within:ring-accent/40"
-        onClick={() => inputRef.current?.focus()}
+        className={cn(
+          "flex min-h-9 w-full flex-wrap items-center gap-1 rounded-lg border border-line bg-panel px-2 py-1 shadow-sm transition-colors focus-within:ring-2 focus-within:ring-accent/40",
+          disabled && "cursor-not-allowed opacity-60 bg-canvas/40",
+        )}
+        onClick={() => !disabled && inputRef.current?.focus()}
       >
         {values.map((v) => (
           <span key={v} className="spec-chip">
             <span className="max-w-[140px] truncate">{v}</span>
-            <button
-              type="button"
-              className="spec-chip-x"
-              title="حذف"
-              onClick={(e) => {
-                e.stopPropagation();
-                setPendingRemove(v);
-              }}
-            >
-              ×
-            </button>
+            {!disabled && (
+              <button
+                type="button"
+                className="spec-chip-x"
+                title="حذف"
+                onClick={(e) => {
+                  e.stopPropagation();
+                  setPendingRemove(v);
+                }}
+              >
+                ×
+              </button>
+            )}
           </span>
         ))}
         <input
           ref={inputRef}
           type="text"
+          disabled={disabled}
           className={cn(
-            "min-w-[80px] flex-1 border-0 bg-transparent px-0.5 py-0.5 text-[12px] text-ink caret-accent outline-none placeholder:text-muted",
+            "min-w-[80px] flex-1 border-0 bg-transparent px-0.5 py-0.5 text-[12px] text-ink caret-accent outline-none placeholder:text-muted disabled:cursor-not-allowed",
             inputClassName,
           )}
           value={text}
           placeholder={values.length ? "" : placeholder}
           autoComplete="off"
           onChange={(e) => {
+            if (disabled) return;
             setText(e.target.value);
             setHighlight(-1);
             setOpen(true);
           }}
-          onFocus={() => setOpen(true)}
-          onKeyDown={onKeyDown}
+          onFocus={() => !disabled && setOpen(true)}
+          onKeyDown={(e) => {
+            if (disabled) return;
+            onKeyDown(e);
+          }}
         />
       </div>
 
-      {open && (
+      {open && !disabled && (
         <div className="absolute inset-x-0 top-full z-30 mt-1 max-h-56 overflow-y-auto rounded-lg border border-line bg-panel py-1 shadow-lg">
           {listCount === 0 && (
             <div className="px-3 py-1.5 text-[12px] text-muted">

frontend/src/components/NumberInput.tsx

@@ -10,6 +10,7 @@ export interface NumberInputProps {
   showWords?: boolean; // نمایش معادل فارسی زیر input
   inputMode?: "numeric" | "decimal" | undefined;
   maxDecimals?: number; // حداکثر رقم اعشار (مثلاً ۲ برای قیمت واحد)
+  disabled?: boolean;
 }
 
 // ورودی عددی با فرمت‌دهی خودکار (groupCommas) و نمایش کلمات فارسی
@@ -21,6 +22,7 @@ export function NumberInput({
   showWords = false,
   inputMode = "numeric",
   maxDecimals,
+  disabled = false,
 }: NumberInputProps) {
   // فرمت با رعایت حداکثر اعشار (گرد کردن)
   const formatValue = (n: number): string => {
@@ -62,7 +64,8 @@ export function NumberInput({
     <div className={cn("min-w-0", className)}>
       <input
         type="text"
-        className="num-input h-9 w-full rounded-lg border border-line bg-panel px-3 py-1 text-sm text-ink shadow-sm transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+        disabled={disabled}
+        className="num-input h-9 w-full rounded-lg border border-line bg-panel px-3 py-1 text-sm text-ink shadow-sm transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
         value={text}
         placeholder={placeholder}
         inputMode={inputMode}

frontend/src/components/StatsBar.tsx

@@ -13,6 +13,7 @@ export function StatsBar({ total, offered, accepted, avgLeadTime }: StatsBarProp
     label: string;
     shortLabel: string;
     value: string;
+    unit?: string;
     color: string;
     icon: LucideIcon;
   }[] = [
@@ -38,9 +39,10 @@ export function StatsBar({ total, offered, accepted, avgLeadTime }: StatsBarProp
       icon: CheckCircle2,
     },
     {
-      label: "میانگین lead time (روز)",
-      shortLabel: "زمان تحویل",
+      label: "میانگین زمان تحویل",
+      shortLabel: "میانگین تحویل",
       value: avgLeadTime == null ? "—" : fmtNum(avgLeadTime),
+      unit: avgLeadTime != null ? "روز" : undefined,
       color: "text-green",
       icon: Timer,
     },
@@ -60,17 +62,22 @@ export function StatsBar({ total, offered, accepted, avgLeadTime }: StatsBarProp
               <span className="hidden sm:inline">{s.label}</span>
             </span>
 
-            {/* آیکون در موبایل حذف شده تا فضا برای متن باز بماند */}
+            {/* آیکون در دسکتاپ */}
             <span className="hidden h-6 w-6 shrink-0 items-center justify-center rounded-md bg-slate-bg text-muted sm:flex">
               <s.icon className="h-3.5 w-3.5" strokeWidth={2} />
             </span>
           </div>
 
-          {/* مقدار عددی */}
+          {/* مقدار عددی به همراه واحد روز */}
           <div
-            className={`mt-0.5 text-base font-extrabold leading-5 tabular-nums sm:mt-1 sm:text-[22px] sm:leading-8 ${s.color}`}
+            className={`mt-0.5 flex items-baseline justify-center sm:justify-start gap-1 text-base font-extrabold leading-5 tabular-nums sm:mt-1 sm:text-[22px] sm:leading-8 ${s.color}`}
           >
-            {s.value}
+            <span>{s.value}</span>
+            {s.unit && (
+              <span className="text-[10px] font-medium text-muted sm:text-xs">
+                {s.unit}
+              </span>
+            )}
           </div>
         </div>
       ))}

frontend/src/components/layout/MobileTabBar.tsx

@@ -48,7 +48,7 @@ const ADMIN_INV_TABS: TabDef[] = [
 function TabBar({ tabs }: { tabs: TabDef[] }) {
   return (
     <nav
-      className="fixed inset-x-0 bottom-0 z-40 border-t border-line bg-panel md:hidden"
+      className="fixed inset-x-0 bottom-0 z-40 border-t border-line bg-panel/95 backdrop-blur-md md:hidden"
       style={{ paddingBottom: "env(safe-area-inset-bottom)" }}
     >
       <div className="grid grid-cols-4">
@@ -59,13 +59,13 @@ function TabBar({ tabs }: { tabs: TabDef[] }) {
             end={t.end}
             className={({ isActive }) =>
               cn(
-                "flex min-h-[56px] flex-col items-center justify-center gap-0.5 whitespace-nowrap px-1 text-[10.5px] font-medium transition-colors",
-                isActive ? "text-accent" : "text-muted",
+                "flex min-h-[66px] flex-col items-center justify-center gap-1.5 whitespace-nowrap px-1 py-1 transition-all active:scale-95",
+                isActive ? "text-accent font-bold" : "text-muted hover:text-ink font-medium",
               )
             }
           >
-            <t.icon className="h-5 w-5" strokeWidth={1.8} />
-            <span>{t.label}</span>
+            <t.icon className="h-6.5 w-6.5" strokeWidth={2.2} />
+            <span className="text-[12px] leading-tight tracking-tight">{t.label}</span>
           </NavLink>
         ))}
       </div>
@@ -97,4 +97,4 @@ export function MobileTabBar() {
     pathname.startsWith("/suppliers");
   if (onOfficePage && isOffice) return <TabBar tabs={PROC_TABS} />;
   return null;
-}
+}

frontend/src/hooks/useMaterials.ts

@@ -17,7 +17,7 @@ export function useAddMaterial() {
   const invalidate = useInvalidateStore();
   return useMutation({
     mutationFn: (m: Material) => api.materials.create(m),
-    onMutate: (m) => addMaterial(m),
+    onSuccess: (created) => addMaterial(created),
     onSettled: () => invalidate(),
   });
 }

frontend/src/lib/analytics.ts

@@ -0,0 +1,80 @@
+// ============================================================
+// Product analytics + error capture (Phase 2)
+//
+// - OpenPanel (@openpanel/web): funnels/usage — initialized only when
+//   VITE_OPENPANEL_URL and VITE_OPENPANEL_CLIENT_ID are set (build args),
+//   so local dev and air-gapped environments stay silent.
+// - GlitchTip (@sentry/react): frontend exception capture, only when
+//   VITE_SENTRY_DSN is set.
+//
+// Both are no-ops without configuration; every helper is safe to call
+// unconditionally from anywhere in the app.
+// ============================================================
+import * as Sentry from "@sentry/react";
+
+type Props = Record<string, unknown>;
+
+declare global {
+  interface Window {
+    op?: (...args: unknown[]) => void;
+  }
+}
+
+const OPENPANEL_URL = (import.meta.env?.VITE_OPENPANEL_URL as string | undefined)?.trim();
+const OPENPANEL_CLIENT_ID = (import.meta.env?.VITE_OPENPANEL_CLIENT_ID as string | undefined)?.trim();
+const SENTRY_DSN = (import.meta.env?.VITE_SENTRY_DSN as string | undefined)?.trim();
+
+export function initAnalytics(): void {
+  if (SENTRY_DSN) {
+    Sentry.init({
+      dsn: SENTRY_DSN,
+      environment: (import.meta.env?.MODE as string | undefined) ?? "production",
+      // Frontend traces are expensive and rarely needed — errors only.
+      tracesSampleRate: 0,
+    });
+  }
+  if (OPENPANEL_URL && OPENPANEL_CLIENT_ID) {
+    try {
+      window.op?.("init", {
+        apiUrl: OPENPANEL_URL,
+        clientId: OPENPANEL_CLIENT_ID,
+        trackScreenViews: true, // pageview → which pages users visit
+      });
+    } catch {
+      /* analytics must never break the app */
+    }
+  }
+}
+
+/** Attach the ERP user identity to analytics (after login / app load). */
+export function identifyUser(profile: {
+  id?: string;
+  name?: string;
+  role?: string | null;
+}): void {
+  if (!profile.id) return;
+  try {
+    window.op?.("identify", {
+      profileId: profile.id,
+      firstName: profile.name || undefined,
+      data: { role: profile.role ?? undefined },
+    });
+    track("user_identified", { role: profile.role ?? undefined });
+  } catch {
+    /* ignore */
+  }
+}
+
+export function track(event: string, properties?: Props): void {
+  try {
+    window.op?.("track", event, properties ?? {});
+  } catch {
+    /* ignore */
+  }
+}
+
+export function captureError(err: unknown): void {
+  if (SENTRY_DSN) Sentry.captureException(err);
+}
+
+export const analyticsEnabled = Boolean(OPENPANEL_URL && OPENPANEL_CLIENT_ID);

frontend/src/lib/api.ts

@@ -14,6 +14,7 @@
 
 import { normalize } from "./normalize";
 import { buildTopics } from "./topics";
+import { jalaliToGregorian, toAsciiDigits } from "./jalali";
 import { useAuthStore } from "../store/auth";
 import type {
   Attachment,
@@ -33,7 +34,7 @@ import type {
   Warehouse,
 } from "./types";
 
-const BASE_URL = (import.meta.env.VITE_API_BASE_URL as string | undefined)?.trim() || "/api/v1";
+const BASE_URL = (import.meta.env?.VITE_API_BASE_URL as string | undefined)?.trim() || "/api/v1";
 const PAGE_SIZE = 100;
 
 // حذف کلیدهای خالی/undefined از پارامترهای کوئری — URLSearchParams مقدار
@@ -135,22 +136,42 @@ const FIELD_FA: Record<string, string> = {
   expiry_date: "تاریخ انقضا",
   accepted_date: "تاریخ پذیرش",
   arrived_date: "تاریخ رسید",
+  due_date: "تاریخ سررسید",
+  schedule_steps: "مراحل پرداخت",
+  milestones: "مراحل پرداخت",
+  amount: "مبلغ",
+  step_no: "شماره مرحله",
 };
 
-const faField = (field: string): string => {
-  const last = field.split(".").filter(Boolean).pop() || field;
+export const faField = (field: string): string => {
+  const parts = field.split(".").filter((p) => p && !/^\d+$/.test(p));
+  const last = parts.pop() || field;
   return FIELD_FA[last] || FIELD_FA[field] || field;
 };
 
-// ترجمه‌ی خطای HTTP بر اساس کد وضعیت
-const faHttpError = (status: number, fallback: string): string => {
+// ترجمه‌ی خطای HTTP بر اساس کد وضعیت — پیام‌های معنادار بک‌اند حفظ می‌شوند
+export const faHttpError = (status: number, fallback: string): string => {
   if (status === 413) return "فایل انتخاب‌شده از حد مجاز (۵ مگابایت) بزرگ‌تر است";
-  if (status === 404) return "مورد درخواستی یافت نشد";
-  if (status === 409) return "تعارض داده — رکورد تکراری یا وضعیت نامعتبر";
-  if (status === 400) return "داده‌ی ارسال‌شده نامعتبر است";
+  if (status === 404 && (!fallback || fallback.startsWith("خطای سرور"))) return "مورد درخواستی یافت نشد";
+  if (status === 409 && (!fallback || fallback.startsWith("خطای سرور"))) return "تعارض داده — رکورد تکراری یا وضعیت نامعتبر";
+  if (status === 400 && (!fallback || fallback.startsWith("خطای سرور"))) return "داده‌ی ارسال‌شده نامعتبر است";
   return fallback;
 };
 
+export class ApiError extends Error {
+  status: number;
+  code?: string;
+  field?: string;
+
+  constructor(message: string, status: number, code?: string, field?: string) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+    this.field = field;
+  }
+}
+
 // ============================================================
 // HTTP helpers — envelope بک‌اند: {"data": ..., "meta": ...}
 // ============================================================
@@ -163,27 +184,43 @@ async function request<T>(path: string, init?: RequestInit): Promise<T> {
       headers: authHeaders(init),
     });
   } catch {
-    throw new Error("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟");
+    throw new ApiError("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟", 0);
   }
   if (!res.ok) {
     let msg = `خطای سرور (${res.status})`;
+    let errCode: string | undefined;
+    let errField: string | undefined;
+
     try {
       const body = await res.json();
-      if (body?.error?.message) {
-        msg = body.error.message;
+      if (body?.error) {
+        errCode = body.error.code;
+        errField = body.error.field;
+        const rawMsg = body.error.message || "";
+        const fName = errField ? faField(errField) : "";
+        if (fName && rawMsg) {
+          msg = `داده‌ی «${fName}» نامعتبر است: ${rawMsg}`;
+        } else if (rawMsg) {
+          msg = rawMsg;
+        }
       } else if (Array.isArray(body?.detail)) {
         // FastAPI 422 — آرایه‌ی خطاهای اعتبارسنجی با پیام انگلیسی
         const first = body.detail[0];
-        const field = first?.loc?.length ? String(first.loc[first.loc.length - 1]) : "";
+        const loc = first?.loc || [];
+        const filteredLoc = loc.filter((p: unknown) => p !== "body" && p !== "query" && p !== "path");
+        errField = filteredLoc.join(".");
+        const fieldName = filteredLoc.length ? String(filteredLoc[filteredLoc.length - 1]) : "";
         const fa = first?.msg ? VALIDATION_FA(String(first.msg)) : "داده‌ی ارسال‌شده نامعتبر است";
-        msg = field ? `داده‌ی «${faField(field)}» نامعتبر است: ${fa}` : fa;
+        const fName = fieldName ? faField(fieldName) : "";
+        msg = fName ? `داده‌ی «${fName}» نامعتبر است: ${fa}` : fa;
       } else if (body?.detail) {
         msg = String(body.detail);
       }
     } catch {
       /* بدنۀ خطا JSON نیست */
     }
-    throw new Error(faHttpError(res.status, msg));
+    const finalMsg = faHttpError(res.status, msg);
+    throw new ApiError(finalMsg, res.status, errCode, errField);
   }
   return (await res.json()) as T;
 }
@@ -285,6 +322,8 @@ interface RawDecision {
   id: string;
   status: string;
   chosen_item_termsheet_id?: string | null;
+  project_id?: string | null;
+  project?: RawProject | null;
   adjusted_unit_price?: number | null;
   decided_at?: string | null;
 }
@@ -309,6 +348,7 @@ interface RawLineItem {
   termsheet_ids?: string[] | null;
   accepted_termsheet_id?: string | null; // id ترم‌شیت پذیرفته‌شده (task: خط آبی)
   projects?: RawProject[] | null; // پروژه‌های تخصیص‌یافته به این قلم
+  target_project?: RawProject | null;
 }
 interface RawTermsheet {
   id: string;
@@ -517,6 +557,7 @@ function adaptMaterial(raw: RawMaterial, lookup: Lookup): Material {
 }
 
 function adaptLineItem(raw: RawLineItem): Quote["line_items"][number] {
+  const targetProj = raw.target_project || raw.decision?.project || null;
   return {
     id: raw.id,
     material_id: raw.material?.id || "",
@@ -537,6 +578,8 @@ function adaptLineItem(raw: RawLineItem): Quote["line_items"][number] {
       quantity: a.quantity,
     })),
     projects: (raw.projects || []).map((p) => ({ id: p.id, name: p.name })),
+    target_project: targetProj ? { id: targetProj.id, name: targetProj.name } : null,
+    target_project_id: raw.decision?.project_id || targetProj?.id || null,
   };
 }
 
@@ -662,23 +705,66 @@ function adaptAttachment(raw: RawAttachment): Attachment {
 
 function toDateOnly(v: string | null | undefined): string | null {
   if (!v) return null;
-  const m = String(v).match(/^(\d{4}-\d{2}-\d{2})/);
-  if (m) return m[1];
-  // datetime کامل → تاریخ به وقت محلی (نه UTC که یک روز عقب می‌افتد)
-  const d = new Date(v);
+  const str = toAsciiDigits(v).trim();
+  if (!str) return null;
+
+  // ۱. فرمت جلالی با اسلش، خط تیره یا نقطه (سال‌های ۱۳۰۰ تا ۱۵۰۰)
+  const jm = str.match(/^(1[34]\d{2})[/\-.](\d{1,2})[/\-.](\d{1,2})/);
+  if (jm) {
+    const jy = parseInt(jm[1], 10);
+    const jmon = parseInt(jm[2], 10);
+    const jd = parseInt(jm[3], 10);
+    const [gy, gm, gd] = jalaliToGregorian(jy, jmon, jd);
+    return `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+  }
+
+  // ۲. فرمت میلادی استاندارد YYYY-MM-DD
+  const gm = str.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+  if (gm && parseInt(gm[1], 10) >= 1900) return str;
+
+  // ۳. رشته‌ی datetime کامل یا مقادیر دیگر
+  const d = new Date(str);
   if (Number.isNaN(d.getTime())) return null;
+  if (d.getFullYear() < 1900 && d.getFullYear() >= 1300) {
+    const [gy, gm, gd] = jalaliToGregorian(d.getFullYear(), d.getMonth() + 1, d.getDate());
+    return `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+  }
   return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
 }
+
 function toDateTime(v: string | null | undefined): string | null {
-  const d = toDateOnly(v);
-  if (!d) return null;
-  return /^\d{4}-\d{2}-\d{2}$/.test(v as string) ? d + "T00:00:00Z" : (v as string);
+  if (!v) return null;
+  const str = toAsciiDigits(v).trim();
+  if (!str) return null;
+
+  // ۱. تاریخ جلالی با زمان اختیاری
+  const jm = str.match(/^(1[34]\d{2})[/\-.](\d{1,2})[/\-.](\d{1,2})(?:[ T](\d{1,2}):(\d{1,2})(?::(\d{1,2}))?)?/);
+  if (jm) {
+    const jy = parseInt(jm[1], 10);
+    const jmon = parseInt(jm[2], 10);
+    const jd = parseInt(jm[3], 10);
+    const h = jm[4] != null ? parseInt(jm[4], 10) : 0;
+    const m = jm[5] != null ? parseInt(jm[5], 10) : 0;
+    const s = jm[6] != null ? parseInt(jm[6], 10) : 0;
+    const [gy, gm, gd] = jalaliToGregorian(jy, jmon, jd);
+    return new Date(gy, gm - 1, gd, h, m, s).toISOString();
+  }
+
+  // ۲. اگر میلادی استاندارد ISO است
+  const d = new Date(str);
+  if (!Number.isNaN(d.getTime()) && d.getFullYear() >= 1900) {
+    return /^\d{4}-\d{2}-\d{2}$/.test(str) ? str + "T00:00:00Z" : str;
+  }
+
+  const dateOnly = toDateOnly(str);
+  return dateOnly ? dateOnly + "T00:00:00Z" : null;
 }
 function todayIso(): string {
   return new Date().toISOString().slice(0, 10);
 }
-function looksLikeUuid(v: string): boolean {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);
+export function looksLikeUuid(v: string | null | undefined): boolean {
+  if (!v) return false;
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(String(v).trim());
 }
 
 // ============================================================
@@ -771,6 +857,13 @@ export const api = {
       // مقدار پیش‌فرض/واحد جادویی؛ واحد خالی یعنی خطای صریح «واحد مشخص نشده»)
       // پروژه‌های هر قلم هم به id واقعی ترجمه می‌شوند (در صورت نبودن ساخته می‌شوند)
       for (let i = 0; i < lineItems.length; i++) {
+        let matId = realMaterialId(lineItems[i].material_id);
+        if (!looksLikeUuid(matId)) {
+          const rawMats = await getData<RawMaterial[]>(`/materials?page_size=100`);
+          const found = rawMats.find((rm) => rm.id === matId) || rawMats[0];
+          if (found) matId = found.id;
+        }
+        lineItems[i].material_id = matId;
         lineItems[i].unit_id = await unitIdByNameOrCreate(lookup, q.line_items[i].unit);
         for (const p of q.line_items[i].projects || []) {
           const pid = looksLikeUuid(p.id) ? p.id : await projectIdByNameOrCreate(p.name);
@@ -855,23 +948,16 @@ export const api = {
 
       if (becomingAccepted) {
         const acceptedTs = (patch.termsheets || []).filter((t) => t.status === "accepted");
-        // تخصیص پروژه به هر قلم — نام‌ها به id واقعی ترجمه می‌شوند
-        const itemProjects: { line_item_id: string; project_ids: string[] }[] = [];
-        const allProjectIds: string[] = [];
-        const seenPids = new Set<string>();
+        // پروژه‌ی واحدِ انتخاب‌شده برای هر قلم (item_decisions.project_id)
+        const targetProjByLine = new Map<string, string>();
         for (const li of patch.line_items || []) {
-          const ids: string[] = [];
-          for (const p of li.projects || []) {
-            const pid = looksLikeUuid(p.id) ? p.id : await projectIdByNameOrCreate(p.name);
-            if (!pid) continue;
-            ids.push(pid);
-            if (!seenPids.has(pid)) {
-              seenPids.add(pid);
-              allProjectIds.push(pid);
-            }
+          const tp = li.target_project;
+          if (tp && tp.name) {
+            const pid = looksLikeUuid(tp.id) ? tp.id : await projectIdByNameOrCreate(tp.name);
+            if (pid) targetProjByLine.set(li.id, pid);
           }
-          itemProjects.push({ line_item_id: li.id, project_ids: ids });
         }
+
         const payload = {
           accepted_termsheets: acceptedTs.map((t) => ({
             id: looksLikeUuid(t.id) ? t.id : undefined,
@@ -887,11 +973,7 @@ export const api = {
           item_decisions: (patch.line_items || []).map((li) => {
             const idx = li.accepted_ts_id ? acceptedTs.findIndex((t) => t.id === li.accepted_ts_id) : -1;
             const chosen = !li.rejected && idx >= 0;
-            // پروژه‌ی واحدِ انتخاب‌شده برای این قلم — مستقیم داخل decision می‌رود تا
-            // «کالاهای در راه» همان مدیر پروژه را (با item_decisions.project_id)
-            // نشان دهد؛ قبلاً فقط item_projects جداگانه می‌رفت و decision بدون
-            // پروژه می‌ماند (قلم‌ها در پنل هیچ مدیر پروژه‌ای دیده نمی‌شدند)
-            const chosenProjId = itemProjects.find((p) => p.line_item_id === li.id)?.project_ids[0];
+            const chosenProjId = targetProjByLine.get(li.id);
             return {
               line_item_id: li.id,
               status: chosen ? "chosen" : "rejected",
@@ -900,14 +982,10 @@ export const api = {
               ...(li.unit_price != null ? { adjusted_unit_price: li.unit_price } : {}),
             };
           }),
-          item_projects: itemProjects,
+          item_projects: [], // کاندیداهای قبلی در line_item_projects کاملاً حفظ می‌شوند
         };
         await patchData(`/quotes/${id}/accept`, payload);
-        // پروژه‌های سطح پیشنهاد با اتحاد پروژه‌های اقلام همگام می‌شوند
-        if (allProjectIds.length) {
-          await patchData(`/quotes/${id}`, { project_ids: allProjectIds });
-        }
-        return { ...current, ...patch } as Quote;
+        return { ...current, ...patch, projects: current.projects } as Quote;
       }
 
       // --- ویرایش ساده: اقلام/termsheetها (جایگزینی کامل) + فیلدهای metadata ---
@@ -1045,8 +1123,10 @@ export const api = {
       const unitId = await unitIdByNameOrCreate(lookup, unitName);
       // برند — اگر تعریف نشده، در جدول brands ساخته و به متریال متصل می‌شود
       const brandId = await brandIdByNameOrCreate(lookup, m.brand);
-      // تایپ جلوی برنامه name ندارد — از متریال/برند/مشخصه ساخته می‌شود
-      const name = [m.brand, m.category, ...(m.specs || [])].filter(Boolean).join(" ") || "کالای جدید";
+      // name فقط نامِ خودِ متریال است؛ برند در brand_ids و مشخصه‌ها در
+      // attributes (EAV) ذخیره می‌شوند. اگر برند/مشخصه داخل name ریخته شود،
+      // در ویزارد به‌عنوان «نامِ متریال» کش می‌شود و مشخصه‌ها در نام ظاهر می‌شوند.
+      const name = (m.category || m.brand || (m.specs || []).join(" ") || "").trim() || "کالای جدید";
       // مشخصه‌ها به‌صورت attribute (EAV) ذخیره می‌شوند تا بعد از رفرش دیده شوند
       const attrs: { attribute_definition_id: string; value: string }[] = [];
       const seen = new Set<string>();
@@ -1202,8 +1282,31 @@ export const api = {
     remove: async (quoteId: string, kind: FileKind, id: string): Promise<void> => {
       await deleteData(`/quotes/${quoteId}/${kind}/${id}`);
     },
-    downloadUrl: (quoteId: string, kind: FileKind, id: string): string =>
-      `${BASE_URL}/quotes/${quoteId}/${kind}/${id}`,
+    // دانلود احراز هویت‌شده: <a href> توکن Authorization نمی‌فرستد، پس بایت‌ها
+    // را با توکن می‌گیریم و به شکل blob در مرورگر ذخیره می‌کنیم.
+    download: async (quoteId: string, kind: FileKind, id: string, fileName: string): Promise<void> => {
+      let res: Response;
+      try {
+        res = await fetch(`${BASE_URL}/quotes/${quoteId}/${kind}/${id}`, {
+          headers: authHeaders(),
+        });
+      } catch {
+        throw new ApiError("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟", 0);
+      }
+      if (!res.ok) throw new ApiError(faHttpError(res.status, "خطای سرور"), res.status);
+      const blob = await res.blob();
+      const url = URL.createObjectURL(blob);
+      try {
+        const a = document.createElement("a");
+        a.href = url;
+        a.download = fileName || "attachment";
+        document.body.appendChild(a);
+        a.click();
+        a.remove();
+      } finally {
+        URL.revokeObjectURL(url);
+      }
+    },
   },
 
   // ---------- برندها (از بک‌اند) ----------
@@ -1220,6 +1323,17 @@ export const api = {
   brandsList: async (): Promise<{ id: string; name: string }[]> => {
     return getData<{ id: string; name: string }[]>(`/brands?page_size=${PAGE_SIZE}`);
   },
+  // مشخصه‌ها — رجیستری سراسری (attribute-definitions)، مستقل از تاپیک/دسته/برند.
+  // ویزارد از این لیست به‌عنوان منبع سراسری مشخصه‌ها استفاده می‌کند تا مشخصه‌های
+  // ثبت‌شده در پیشنهادهای قبلی همیشه در دسترس باشند.
+  specsList: async (): Promise<string[]> => {
+    const raw = await getData<{ label?: string; attribute_key?: string }[]>(
+      `/attribute-definitions?page_size=${PAGE_SIZE}`,
+    );
+    return raw
+      .map((d) => (d.label || "").trim() || (d.attribute_key || "").replace(/^spec_/, "").trim())
+      .filter(Boolean);
+  },
 
   // ---------- واحدها (از بک‌اند) ----------
   unitsList: async (): Promise<RawUnit[]> => {
@@ -1250,6 +1364,10 @@ async function fetchProjects(): Promise<RawProject[]> {
 async function projectIdByNameOrCreate(name: string | null | undefined): Promise<string | null> {
   if (!name) return null;
   const projects = await fetchProjects();
+  if (looksLikeUuid(name)) {
+    const byId = projects.find((x) => x.id.toLowerCase() === name.toLowerCase());
+    if (byId) return byId.id;
+  }
   const pid = projectIdByName(projects, name);
   if (pid) return pid;
   const raw = await postData<RawProject>("/projects", { name });
@@ -1381,8 +1499,12 @@ async function specDefinitionId(spec: string): Promise<string | null> {
 
 // utility برای ساخت id موقت جدید (ویزارد — قبل از ذخیره در بک‌اند)
 export function nextId(prefix: string, items: { id: string }[]): string {
+  const regex = new RegExp(`^${prefix}(\\d+)$`);
   const max = items
-    .map((x) => parseInt(String(x.id).replace(/\D/g, ""), 10))
+    .map((x) => {
+      const m = String(x.id).match(regex);
+      return m ? parseInt(m[1], 10) : 0;
+    })
     .filter((n) => !Number.isNaN(n))
     .reduce((a, b) => Math.max(a, b), 0);
   return prefix + (max + 1);

frontend/src/lib/jalali.ts

@@ -99,8 +99,11 @@ export const MONTHS = [
 
 export const WEEKDAYS = ["ش", "ی", "د", "س", "چ", "پ", "ج"];
 
-function toEnSafe(s: string): string {
-  return String(s).replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d)));
+export function toAsciiDigits(s: string | number | null | undefined): string {
+  if (s == null) return "";
+  return String(s)
+    .replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d)))
+    .replace(/[٠-٩]/g, (d) => String("٠١٢٣٤٥٦٧٨٩".indexOf(d)));
 }
 
 // format an ISO (gregorian) string to "۱۴۰۳/۰۵/۱۲"
@@ -121,16 +124,29 @@ export function isoToJalaliLong(iso: string | null | undefined): string {
   return `${toFa(jd)} ${MONTHS[jm - 1]} ${toFa(jy)}`;
 }
 
-// parse a jalali "yyyy/m/d" string to a JS Date (gregorian) at local midnight
+// parse a jalali "yyyy/m/d" or "yyyy/m/d h:m" string to a JS Date (gregorian) ISO string
 export function jalaliStrToIso(str: string | null | undefined): string | null {
   if (!str) return null;
-  const nums = String(str)
-    .split(/[/\-.]/)
-    .map((x) => parseInt(toEnSafe(x), 10));
-  if (nums.length < 3 || nums.some((n) => Number.isNaN(n))) return null;
-  const [jy, jm, jd] = nums;
+  const s = toAsciiDigits(str).trim();
+  const m = s.match(/^(1[34]\d{2})[/\-.](\d{1,2})[/\-.](\d{1,2})(?:[ T](\d{1,2}):(\d{1,2})(?::(\d{1,2}))?)?/);
+  if (!m) {
+    const nums = s
+      .split(/[/\-.]/)
+      .map((x) => parseInt(x, 10));
+    if (nums.length < 3 || nums.some((n) => Number.isNaN(n))) return null;
+    const [jy, jm, jd] = nums;
+    const [gy, gm, gd] = jalaliToGregorian(jy, jm, jd);
+    const dt = new Date(gy, gm - 1, gd);
+    return Number.isNaN(dt.getTime()) ? null : dt.toISOString();
+  }
+  const jy = parseInt(m[1], 10);
+  const jm = parseInt(m[2], 10);
+  const jd = parseInt(m[3], 10);
+  const h = m[4] != null ? parseInt(m[4], 10) : 0;
+  const min = m[5] != null ? parseInt(m[5], 10) : 0;
+  const sec = m[6] != null ? parseInt(m[6], 10) : 0;
   const [gy, gm, gd] = jalaliToGregorian(jy, jm, jd);
-  const dt = new Date(gy, gm - 1, gd);
+  const dt = new Date(gy, gm - 1, gd, h, min, sec);
   return Number.isNaN(dt.getTime()) ? null : dt.toISOString();
 }
 

frontend/src/lib/quoteUtils.ts

@@ -40,20 +40,58 @@ export function specsLabel(specs: string[]): string {
   return specs.join(" · ");
 }
 
-// نام نمایشی متریال — نام سراسری واقعی (materials.name)، نه دسته.
-// برند و مشخصه فقط وقتی به نام اضافه می‌شوند که داخلش نیامده باشند (بدون تکرار).
-export function materialLabel(m: Pick<Material, "name" | "brand" | "specs" | "category">): string {
-  const name = (m.name || "").trim();
-  const specs = (m.specs || []).filter(Boolean);
-  if (!name && !m.brand && !specs.length) return m.category === "؟" ? "؟" : "کالا";
-  if (!name) {
-    return [m.brand, ...specs].filter(Boolean).join(" ") || "کالا";
+/**
+ * عنوان تمیز و بدون تکرار کالا:
+ * ترکیب هوشمندانه‌ی نام اصلی (materials.name)، برند، و مشخصه‌ها بدون تکرار کلمات مشترک.
+ */
+export function formatMaterialTitle(
+  m: Pick<Material, "name" | "brand" | "specs" | "category"> | null | undefined,
+  extraSpecs?: string[],
+): string {
+  if (!m) return "کالا";
+  const rawName = (m.name || "").trim();
+  const rawBrand = (m.brand || "").trim();
+  const rawSpecs = [...(m.specs || []), ...(extraSpecs || [])]
+    .map((s) => (s || "").trim())
+    .filter(Boolean);
+
+  const normName = normalize(rawName);
+  const normBrand = normalize(rawBrand);
+
+  if (!rawName) {
+    if (rawBrand && rawSpecs.length) return `${rawBrand} · ${rawSpecs.join(" · ")}`;
+    if (rawBrand) return rawBrand;
+    if (rawSpecs.length) return rawSpecs.join(" · ");
+    return m.category && m.category !== "؟" ? m.category : "کالا";
   }
-  const parts = [name];
-  if (m.brand && !name.includes(m.brand)) parts.push(m.brand);
-  const missing = specs.filter((s) => !name.includes(s));
-  if (missing.length) parts.push(`(${missing.join("، ")})`);
-  return parts.join(" ");
+
+  let title = rawName;
+  if (normBrand && !normName.includes(normBrand)) {
+    title = `${rawBrand} ${title}`;
+  }
+
+  const normTitle = normalize(title);
+  const distinctSpecs: string[] = [];
+  const seenNormSpecs = new Set<string>();
+
+  for (const s of rawSpecs) {
+    const ns = normalize(s);
+    if (!ns || seenNormSpecs.has(ns)) continue;
+    seenNormSpecs.add(ns);
+
+    // اگر مشخصه قبلاً داخل عنوان یا نام کالا آمده باشد، تکرار نمی‌کنیم
+    if (normTitle.includes(ns)) continue;
+    distinctSpecs.push(s);
+  }
+
+  if (distinctSpecs.length > 0) {
+    return `${title} · ${distinctSpecs.join(" · ")}`;
+  }
+  return title;
+}
+
+export function materialLabel(m: Pick<Material, "name" | "brand" | "specs" | "category"> | null | undefined): string {
+  return formatMaterialTitle(m);
 }
 
 // آرایه‌ی termsheet_ids یک قلم (هر دو فرمت قدیم/جدید)
@@ -104,9 +142,15 @@ export function lineItemTotal(li: LineItem): number | null {
   return null;
 }
 
-// پروژه‌های یک قلم — فقط پروژه‌های تخصیص‌یافته به همین قلم (بدون fallback به سطح پیشنهاد)
-export function itemProjects(_q: Quote, li: LineItem): string[] {
-  return (li.projects || []).map((p) => (typeof p === "string" ? p : p.name));
+// پروژه‌های یک قلم:
+// - در وضعیت offered: تمام پروژه‌های کاندیدا (line_item_projects)
+// - در وضعیت accepted یا arrived: فقط تک پروژه‌ی انتخاب‌شده در خرید (item_decisions.project_id)
+export function itemProjects(q: Quote, li: LineItem): string[] {
+  if (q.status === "accepted" || q.status === "arrived") {
+    return li.target_project?.name ? [li.target_project.name] : [];
+  }
+  // For 'offered', 'rejected', 'expired': return all candidate projects
+  return (li.projects || []).map((p) => (typeof p === "string" ? p : p.name)).filter(Boolean);
 }
 
 // ---------- واحد مرجع و ضریب تبدیل ----------
@@ -163,8 +207,24 @@ export function unitWarning(_store: Store, _q: Quote): { unit: string; cat: stri
   return [];
 }
 
-// ستون پروژه
+// ستون پروژه:
+// در وضعیت‌های پذیرفته‌شده یا رسیده، فقط پروژه‌های هدف خرید اقلام نشان داده می‌شوند
 export function projectCell(q: Quote): string {
+  if (q.status === "accepted" || q.status === "arrived") {
+    const targets = (q.line_items || [])
+      .filter((li) => !li.rejected)
+      .map((li) =>
+        li.target_project?.name ||
+        (li.projects && li.projects.length === 1
+          ? typeof li.projects[0] === "string"
+            ? li.projects[0]
+            : li.projects[0].name
+          : null),
+      )
+      .filter(Boolean) as string[];
+    const unique = [...new Set(targets)];
+    if (unique.length) return unique.join("، ");
+  }
   if (q.projects && q.projects.length) return q.projects.join("، ");
   return q.project || "—";
 }

frontend/src/lib/types.ts

@@ -71,7 +71,9 @@ export interface LineItem {
   arrived_date: string | null; // تاریخ آخرین رسید
   received_qty?: number | null; // مجموع رسیدهای ثبت‌شده (رسید جزیی) — null = هنوز داده‌ای نیست
   received_warehouses?: { id: string; name: string; quantity: number }[] | null; // انبارهای مقصد رسیدها
-  projects?: { id: string; name: string }[]; // پروژه‌های تخصیص‌یافته به این قلم
+  projects?: { id: string; name: string }[]; // پروژه‌های کاندیدای تخصیص‌یافته به این قلم (line_item_projects)
+  target_project?: { id: string; name: string } | null; // پروژه‌ی نهایی انتخاب‌شده در هنگام خرید (item_decisions.project_id)
+  target_project_id?: string | null;
 }
 
 // پیشنهاد خرید (اصلی‌ترین entity)

frontend/src/main.tsx

@@ -6,6 +6,7 @@ import { Toaster } from "sonner";
 import App from "./App";
 import "./styles/globals.css";
 import { queryClient } from "./lib/queryClient";
+import { initAnalytics } from "./lib/analytics";
 
 // بعد از استقرار نسخه‌ی جدید، مرورگری که index.html قدیمی را باز کرده برای
 // بارگذاری chunkهای حذف‌شده 404 می‌گیرد و صفحه خالی می‌ماند. این شنونده،
@@ -15,6 +16,9 @@ window.addEventListener("vite:preloadError", () => {
   window.location.reload();
 });
 
+// Product analytics + GlitchTip error capture — no-ops without VITE_ config.
+initAnalytics();
+
 createRoot(document.getElementById("root")!).render(
   <StrictMode>
     <QueryClientProvider client={queryClient}>

frontend/src/pages/Auth/LoginPage.tsx

@@ -3,6 +3,7 @@ import { useNavigate } from "react-router-dom";
 import { toast } from "sonner";
 import { ClipboardList, Eye, EyeOff, Loader2, Lock, ShieldCheck, Wrench, X } from "lucide-react";
 import { api, apiV26 } from "../../lib/api";
+import { identifyUser, track } from "../../lib/analytics";
 import { useAuthStore } from "../../store/auth";
 import type { Project } from "../../lib/types";
 
@@ -78,6 +79,9 @@ export function LoginPage() {
       }
       setToken(access_token);
       setUser(user);
+      // تحلیل رفتار (no-op بدون تنظیمات VITE_OPENPANEL_*)
+      identifyUser({ id: user.id, name: user.display_name, role: user.role });
+      track("login_success", { role: user.role });
       toast.success(`خوش آمدید، ${user.display_name}`);
       // مدیر پروژه → پنل انبار؛ مدیر تدارکات/ادمین → دفتر پیشنهادهای خرید
       navigate(user.role === "pm" ? "/inventory" : "/");

frontend/src/pages/Dashboard/AcceptModal.tsx

@@ -5,11 +5,9 @@ import { api, nextDashedId } from "../../lib/api";
 import { useMaterials, useProjects, useQuotes, useUpdateQuote, useSuppliers } from "../../hooks";
 import {
   activeItems,
+  formatMaterialTitle,
   itemTermsheetIds,
   materialById,
-  materialLabel,
-  materialSpecs,
-  specsLabel,
   supplierById,
 } from "../../lib/quoteUtils";
 import { faNum, fmtNum } from "../../lib/formatters";
@@ -76,11 +74,13 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
     const projSel: Record<string, string> = {};
     q.line_items.forEach((li) => {
       const names = (li.projects || []).map((p) => p.name).filter(Boolean);
-      projSel[li.id] = names.length
-        ? names[0]
-        : q.projects && q.projects.length
-          ? q.projects[0]
-          : q.project || "";
+      projSel[li.id] = li.target_project?.name
+        ? li.target_project.name
+        : names.length
+          ? names[0]
+          : q.projects && q.projects.length
+            ? q.projects[0]
+            : q.project || "";
     });
     setItemProjectsSel(projSel);
     setReady(true);
@@ -219,17 +219,14 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
       if (t.status === "accepted" && !usedIds.has(t.id)) t.status = "offered";
     });
 
-    // پروژه‌ی هر قلم (تکی) + همگام‌سازی پروژه‌های سطح پیشنهاد
-    const projUnion = new Set<string>();
+    // پروژه‌ی هر قلم (تکی هدف خرید) — فقط target_project تنظیم می‌شود؛
+    // li.projects و next.projects دست‌نخورده باقی می‌مانند تا پروژه‌های کاندیدای اولیه حفظ شوند
     next.line_items.forEach((li) => {
       if (li.rejected) return;
       const name = itemProjectsSel[li.id];
       if (name === undefined) return;
-      li.projects = name ? [{ id: "", name }] : [];
-      if (name) projUnion.add(name);
+      li.target_project = name ? { id: "", name } : null;
     });
-    next.projects = [...projUnion];
-    next.project = next.projects[0] || "";
 
     const now = new Date().toISOString();
     next.accepted_date = acceptDate || now;
@@ -298,7 +295,6 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
             {allItems.map((li) => {
               const removed = removedItems.has(li.id);
               const m = materialById(materials, li.material_id);
-              const specText = specsLabel(materialSpecs(m));
               return (
                 <div key={li.id} className={`accept-item-assign-row ${removed ? "rejected" : ""}`}>
                   <input
@@ -314,8 +310,7 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
                     }}
                   />
                   <span className="flex-1 text-[13px]">
-                    {materialLabel(m)}
-                    {specText ? ` · ${specText}` : ""}
+                    {formatMaterialTitle(m)}
                   </span>
                   <span className="text-[12px] text-muted">
                     {fmtNum(li.quantity)} {li.unit} × {groupCommas(li.unit_price, true)}
@@ -351,14 +346,12 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
               .filter((li) => !removedItems.has(li.id))
               .map((li) => {
                 const m = materialById(materials, li.material_id);
-                const specText = specsLabel(materialSpecs(m));
                 return (
                   <div key={li.id} className="rounded-lg border border-line p-2.5">
                     <div className="mb-1.5 text-[12.5px]">
                       <span className="font-semibold">
-                        {materialLabel(m)}
+                        {formatMaterialTitle(m)}
                       </span>
-                      {specText ? <span className="text-muted"> · {specText}</span> : ""}
                       <span className="ms-2 text-[11px] text-muted">
                         {fmtNum(li.quantity)} {li.unit}
                       </span>
@@ -404,7 +397,7 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
                 toast.error(err instanceof Error ? err.message : "حذف فاکتور ناموفق بود"),
               )
             }
-            urlOf={(a) => (a.id ? api.files.downloadUrl(q.id, "invoice", a.id) : null)}
+            onDownload={(a) => api.files.download(q.id, "invoice", a.id!, a.name)}
           />
         </div>
 
@@ -421,7 +414,7 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
                 toast.error(err instanceof Error ? err.message : "حذف پیش‌فاکتور ناموفق بود"),
               )
             }
-            urlOf={(a) => (a.id ? api.files.downloadUrl(q.id, "proforma", a.id) : null)}
+            onDownload={(a) => api.files.download(q.id, "proforma", a.id!, a.name)}
             label="افزودن پیش‌فاکتور"
           />
         </div>

frontend/src/pages/Dashboard/ArriveModal.tsx

@@ -3,7 +3,7 @@ import { toast } from "sonner";
 import { Package } from "lucide-react";
 import type { Quote } from "../../lib/types";
 import { useMaterials, useQuotes, useSuppliers, useUpdateQuote } from "../../hooks";
-import { activeItems, materialById, materialSpecs, supplierById } from "../../lib/quoteUtils";
+import { activeItems, formatMaterialTitle, materialById, supplierById } from "../../lib/quoteUtils";
 import { fmtNum } from "../../lib/formatters";
 import { groupCommas } from "../../lib/numutil";
 import { Button } from "../../components/ui/button";
@@ -86,7 +86,6 @@ export function ArriveModal({ quoteId, onClose }: ArriveModalProps) {
         <div className="flex flex-col gap-1.5">
           {items.map((li) => {
             const m = materialById(materials, li.material_id);
-            const specText = materialSpecs(m).join(" · ");
             return (
               <label key={li.id} className={`arrive-row${li.arrived_date ? " arrived" : ""}`}>
                 <input
@@ -102,8 +101,7 @@ export function ArriveModal({ quoteId, onClose }: ArriveModalProps) {
                 />
                 <span>
                   <Package className="me-1 inline h-3.5 w-3.5 text-muted" />
-                  {m.category} {m.brand}
-                  {specText ? ` · ${specText}` : ""}
+                  {formatMaterialTitle(m)}
                 </span>
                 <span className="arrive-meta">
                   {fmtNum(li.quantity)} {li.unit || ""} × {groupCommas(li.unit_price, true)}

frontend/src/pages/Dashboard/EditModal.tsx

@@ -1,14 +1,16 @@
 import { useEffect, useMemo, useState } from "react";
-import { Trash2 } from "lucide-react";
+import { Trash2, AlertCircle } from "lucide-react";
 import { toast } from "sonner";
 import type { Attachment, LineItem, Milestone, Quote, Termsheet } from "../../lib/types";
 import { api, nextDashedId, nextId } from "../../lib/api";
+import { cn } from "../../lib/utils";
 import {
   useMaterials,
   useProjects,
   useQuotes,
   useSuppliers,
   useUpdateQuote,
+  useDeleteQuote,
   useAddSupplier,
   useAddMaterial,
 } from "../../hooks";
@@ -35,6 +37,7 @@ import {
 interface EditItemRow {
   key: string;
   origLi?: LineItem;
+  projects?: { id: string; name: string }[];
   cat: string;
   brand: string;
   specs: string[];
@@ -59,18 +62,27 @@ export interface EditModalProps {
   onClose: () => void;
 }
 
-// مودال ویرایش کامل پیشنهاد
+// مودال ویرایش کامل پیشنهاد — بهینه‌شده برای صفحات موبایل
 export function EditModal({ quoteId, onClose }: EditModalProps) {
   const quotes = useQuotes();
   const suppliers = useSuppliers();
   const materials = useMaterials();
   const projects = useProjects();
   const updateQuote = useUpdateQuote();
+  const deleteQuote = useDeleteQuote();
   const addSupplier = useAddSupplier();
   const addMaterial = useAddMaterial();
 
   const q = useMemo(() => quotes.find((x) => x.id === quoteId) || null, [quotes, quoteId]);
 
+  const hasReceipts = useMemo(() => {
+    if (!q) return false;
+    if (q.status === "arrived") return true;
+    return (q.line_items || []).some(
+      (li) => (li.received_qty != null && li.received_qty > 0) || !!li.arrived_date,
+    );
+  }, [q]);
+
   const [ready, setReady] = useState(false);
   const [supplierName, setSupplierName] = useState("");
   const [selectedProjects, setSelectedProjects] = useState<string[]>([]);
@@ -83,16 +95,46 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
   const [acceptedDate, setAcceptedDate] = useState<string | null>(null);
   const [arrivedDate, setArrivedDate] = useState<string | null>(null);
   const [status, setStatus] = useState("offered");
+  const [showDeleteConfirm, setShowDeleteConfirm] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+
+  const handleDelete = async () => {
+    if (!q) return;
+    setDeleting(true);
+    try {
+      await deleteQuote.mutateAsync(q.id);
+      toast.success("پیشنهاد خرید با موفقیت حذف شد");
+      setShowDeleteConfirm(false);
+      onClose();
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "حذف پیشنهاد ناموفق بود");
+    } finally {
+      setDeleting(false);
+    }
+  };
+
+  // گزینه‌های مشخصه
+  const [globalSpecs, setGlobalSpecs] = useState<string[]>([]);
+  useEffect(() => {
+    let alive = true;
+    void api
+      .specsList()
+      .then((list) => alive && setGlobalSpecs(list))
+      .catch(() => {});
+    return () => {
+      alive = false;
+    };
+  }, []);
 
-  // گزینه‌های مشخصه — همه‌ی مشخصه‌های ثبت‌شده (کش)
   const specOptions = useMemo(() => {
     const set = new Set<string>();
+    globalSpecs.forEach((s) => s && set.add(s));
     materials.forEach((m) => (m.specs || []).forEach((s) => s && set.add(s)));
     itemRows.forEach((r) => r.specs.forEach((s) => s && set.add(s)));
     return [...set].sort((a, b) => a.localeCompare(b, "fa"));
-  }, [materials, itemRows]);
+  }, [materials, itemRows, globalSpecs]);
 
-  // گزینه‌های پروژه — پروژه‌های ثبت‌شده + پروژه‌های خود پیشنهاد
+  // گزینه‌های پروژه
   const projectOptions = useMemo(() => {
     const set = new Set<string>();
     projects.forEach((p) => p.name && set.add(p.name));
@@ -107,7 +149,17 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
     if (!q) return;
     const sup = supplierById(suppliers, q.supplier_id);
     setSupplierName(sup.name);
-    setSelectedProjects(q.projects && q.projects.length ? [...q.projects] : q.project ? [q.project] : []);
+    // حفظ تمام پروژه‌های کاندیدا: اتحاد پروژه‌های سطح پیشنهاد و پروژه‌های کاندیدای هر قلم
+    const candidateSet = new Set<string>();
+    (q.projects || []).forEach((p) => p && candidateSet.add(p));
+    if (q.project) candidateSet.add(q.project);
+    q.line_items.forEach((li) => {
+      (li.projects || []).forEach((p) => {
+        const n = typeof p === "string" ? p : p.name;
+        if (n) candidateSet.add(n);
+      });
+    });
+    setSelectedProjects([...candidateSet]);
     setNotes(q.notes || "");
     setItemRows(
       q.line_items.map((li) => {
@@ -115,6 +167,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         return {
           key: li.id,
           origLi: li,
+          projects: li.projects && li.projects.length ? [...li.projects] : [],
           cat: m.category || "",
           brand: m.brand || "",
           specs: materialSpecs(m),
@@ -144,7 +197,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
     setReady(true);
   }, [q, suppliers, materials]);
 
-  // فاکتورها مستقیماً از سرور (MinIO) خوانده می‌شوند — نه از state محلی
+  // بارگذاری فاکتورها
   useEffect(() => {
     if (!quoteId) return;
     let alive = true;
@@ -204,9 +257,14 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
   };
 
   const confirm = async () => {
+    if (hasReceipts && status !== q.status) {
+      toast.error("این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.");
+      return;
+    }
+
     const next: Quote = JSON.parse(JSON.stringify(q));
 
-    // تأمین‌کننده — موجود یا جدید
+    // تأمین‌کننده
     if (supplierName.trim()) {
       const norm = normalize(supplierName);
       const exist = suppliers.find((s) => normalize(s.name) === norm);
@@ -215,7 +273,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
       } else {
         const newSup = { id: nextId("s", suppliers), name: supplierName.trim(), location: "", phone: "", contact: "", topic: "", categories: [] };
         const created = await addSupplier.mutateAsync(newSup);
-        next.supplier_id = created.id; // UUID واقعی از بک‌اند
+        next.supplier_id = created.id;
       }
     }
 
@@ -224,7 +282,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
     next.notes = notes.trim();
     next.invoices = invoices;
 
-    // termsheetها — id موجود حفظ می‌شود، جدیدها ساخته می‌شوند
+    // termsheetها
     const tsIdMap: Record<string, string> = {};
     const newTermsheets: Termsheet[] = [];
     tsCards.forEach((card, i) => {
@@ -252,7 +310,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
       const qty = row.qty;
       const price = row.price;
       const total = row.total;
-      if (!cat && !brand && qty == null && price == null) continue; // ردیف خالی
+      if (!cat && !brand && qty == null && price == null) continue;
 
       let material = materialsCopy.find(
         (m) =>
@@ -266,7 +324,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
       } else {
         const nm = {
           id: nextId("m", materialsCopy),
-          name: [brand, cat, ...specs].filter(Boolean).join(" ") || "کالای جدید",
+          name: (cat || brand || specs.join(" ") || "").trim() || "کالای جدید",
           topic: materialById(materials, row.origLi?.material_id || "").topic || "",
           category: cat,
           brand,
@@ -274,7 +332,6 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
           base_unit: unit,
         };
         materialsCopy.push(nm);
-        // منتظر ساخت متریال می‌مانیم تا id واقعی (UUID) به قلم وصل شود
         const created = await addMaterial.mutateAsync(nm);
         materialId = created.id;
       }
@@ -304,8 +361,15 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         acceptedTsId = null;
       }
 
+      const candProjs =
+        row.projects && row.projects.length
+          ? row.projects
+          : row.origLi?.projects && row.origLi.projects.length
+            ? row.origLi.projects
+            : selectedProjects.map((pname) => ({ id: "", name: pname }));
+
       newItems.push({
-        id: "li-" + (newItems.length + 1),
+        id: row.origLi ? row.origLi.id : row.key.startsWith("new-") ? row.key : "li-" + (newItems.length + 1),
         material_id: materialId,
         quantity: qty,
         unit,
@@ -315,12 +379,13 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         accepted_ts_id: acceptedTsId,
         rejected,
         arrived_date: row.origLi?.arrived_date ?? null,
-        projects: row.origLi?.projects ?? [],
+        projects: candProjs,
+        target_project: status === "offered" ? null : (row.origLi?.target_project ?? null),
+        target_project_id: status === "offered" ? null : (row.origLi?.target_project_id ?? null),
       });
     }
     next.line_items = newItems.length ? newItems : next.line_items;
 
-    // ترم‌شیت بدون قلم بی‌معنی است — حذف
     const referencedTs = new Set<string>();
     next.line_items.forEach((li) => (li.termsheet_ids || []).forEach((tid) => referencedTs.add(tid)));
     next.termsheets = next.termsheets.filter((t) => referencedTs.has(t.id));
@@ -332,12 +397,11 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
 
     // تاریخ‌ها و وضعیت
     next.quote_date = quoteDate || q.quote_date;
-    next.expiry_date = expiryDate || "";
+    next.expiry_date = expiryDate ? (expiryDate.length > 10 ? expiryDate.slice(0, 10) : expiryDate) : "";
     next.accepted_date = acceptedDate;
     next.arrived_date = arrivedDate;
     next.status = status as Quote["status"];
 
-    // پاک‌سازی خودکار در بازگشت وضعیت
     if (next.status === "offered") {
       next.accepted_date = null;
       next.arrived_date = null;
@@ -348,6 +412,8 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         li.rejected = false;
         li.arrived_date = null;
         li.accepted_ts_id = null;
+        li.target_project = null;
+        li.target_project_id = null;
       });
     } else if (next.status === "accepted") {
       next.arrived_date = null;
@@ -367,292 +433,396 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
   };
 
   return (
-    <Dialog open={!!quoteId} onOpenChange={(o) => !o && onClose()}>
-      <DialogContent className="max-w-3xl">
-        <DialogHeader>
-          <DialogTitle>ویرایش پیشنهاد</DialogTitle>
-        </DialogHeader>
+    <>
+      <Dialog open={!!quoteId} onOpenChange={(o) => !o && onClose()}>
+        <DialogContent className="max-h-[92vh] w-[95vw] max-w-3xl overflow-y-auto p-3.5 sm:p-6">
+          <DialogHeader>
+            <DialogTitle className="text-base font-bold sm:text-lg">ویرایش پیشنهاد</DialogTitle>
+          </DialogHeader>
 
-        <div className="grid grid-cols-2 gap-3 max-md:grid-cols-1">
-          <div className="field">
-            <label>تأمین‌کننده</label>
-            <Combobox
-              value={supplierName}
-              onChange={(it: { id: string; label: string }) => setSupplierName(it.label)}
-              items={suppliers.map((s) => ({ id: s.id, name: s.name }))}
-              allowAdd
-              addSuffix="به عنوان تأمین‌کنندهٔ جدید"
-              placeholder="نام تأمین‌کننده"
-              onInputChange={(v) => setSupplierName(v)}
-            />
-          </div>
-          <div className="field">
-            <label>پروژه</label>
-            <MultiSelectCombobox
-              values={selectedProjects}
-              onChange={setSelectedProjects}
-              options={projectOptions}
-              placeholder="انتخاب پروژه..."
-            />
-          </div>
-          <div className="field col-span-2">
-            <label>یادداشت</label>
-            <textarea
-              rows={2}
-              className="w-full rounded-lg border border-line bg-panel px-3 py-2 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-              value={notes}
-              onChange={(e) => setNotes(e.target.value)}
-            />
-          </div>
-        </div>
+          {hasReceipts && (
+            <div className="flex items-center gap-2 rounded-lg border border-amber/30 bg-amber-bg px-3 py-2 text-[12px] font-medium text-amber">
+              <AlertCircle className="h-4 w-4 shrink-0" />
+              <span>این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.</span>
+            </div>
+          )}
 
-        {/* اقلام */}
-        <div className="border-t border-line pt-3">
-          <div className="mb-2 text-[13px] font-bold">اقلام سفارش:</div>
-          <div className="flex flex-col gap-3">
-            {itemRows.map((row) => (
-              <div key={row.key} className={`rounded-lg border p-3 ${row.rejected ? "border-dashed border-line opacity-60" : "border-line"}`}>
-                <div className="grid grid-cols-2 gap-3 md:grid-cols-4">
-                  <div className="field">
-                    <label>متریال</label>
-                    <input
-                      className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-                      placeholder="متریال"
-                      value={row.cat}
-                      onChange={(e) => patchItem(row.key, { cat: e.target.value })}
-                    />
+          {/* اطلاعات بالایی — تک‌ستونه در موبایل، ۲ ستونه در دسکتاپ */}
+          <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+            <div className="flex min-w-0 flex-col gap-1.5">
+              <label className="text-xs font-semibold text-muted">تأمین‌کننده</label>
+              <div className="w-full min-w-0">
+                <Combobox
+                  value={supplierName}
+                  onChange={(it: { id: string; label: string }) => setSupplierName(it.label)}
+                  items={suppliers.map((s) => ({ id: s.id, name: s.name }))}
+                  allowAdd
+                  addSuffix="به عنوان تأمین‌کنندهٔ جدید"
+                  placeholder="نام تأمین‌کننده"
+                  onInputChange={(v) => setSupplierName(v)}
+                />
+              </div>
+            </div>
+
+            <div className="flex min-w-0 flex-col gap-1.5">
+              <label className="text-xs font-semibold text-muted">پروژه</label>
+              <div className="w-full min-w-0">
+                <MultiSelectCombobox
+                  values={selectedProjects}
+                  onChange={setSelectedProjects}
+                  options={projectOptions}
+                  placeholder="انتخاب پروژه..."
+                />
+              </div>
+            </div>
+
+            <div className="col-span-1 flex min-w-0 flex-col gap-1.5 sm:col-span-2">
+              <label className="text-xs font-semibold text-muted">یادداشت</label>
+              <textarea
+                rows={2}
+                className="w-full rounded-lg border border-line bg-panel px-3 py-2 text-sm shadow-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
+                value={notes}
+                onChange={(e) => setNotes(e.target.value)}
+              />
+            </div>
+          </div>
+
+          {/* اقلام */}
+          <div className="border-t border-line pt-3">
+            <div className="mb-2 text-[13px] font-bold">اقلام سفارش:</div>
+            <div className="flex flex-col gap-3">
+              {itemRows.map((row) => (
+                <div
+                  key={row.key}
+                  className={`rounded-xl border p-3 sm:rounded-lg ${row.rejected ? "border-dashed border-line opacity-60" : "border-line bg-panel/50"}`}
+                >
+                  <div className="grid grid-cols-2 gap-2.5 sm:grid-cols-3 md:grid-cols-4">
+                    {/* متریال — تمام‌عرض در موبایل */}
+                    <div className="col-span-2 flex min-w-0 flex-col gap-1 sm:col-span-1">
+                      <label className="text-[11px] font-semibold text-muted">متریال</label>
+                      <input
+                        disabled={hasReceipts}
+                        className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
+                        placeholder="متریال"
+                        value={row.cat}
+                        onChange={(e) => patchItem(row.key, { cat: e.target.value })}
+                      />
+                    </div>
+
+                    {/* برند */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">برند</label>
+                      <input
+                        disabled={hasReceipts}
+                        className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
+                        placeholder="برند"
+                        value={row.brand}
+                        onChange={(e) => patchItem(row.key, { brand: e.target.value })}
+                      />
+                    </div>
+
+                    {/* واحد */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">واحد</label>
+                      <input
+                        disabled={hasReceipts}
+                        className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
+                        placeholder="واحد"
+                        value={row.unit}
+                        onChange={(e) => patchItem(row.key, { unit: e.target.value })}
+                      />
+                    </div>
+
+                    {/* مشخصه — تمام‌عرض در موبایل */}
+                    <div className="col-span-2 flex min-w-0 flex-col gap-1 sm:col-span-1 md:col-span-1">
+                      <label className="text-[11px] font-semibold text-muted">مشخصه</label>
+                      <div className="w-full min-w-0">
+                        <MultiSelectCombobox
+                          disabled={hasReceipts}
+                          values={row.specs}
+                          onChange={(specs) => patchItem(row.key, { specs })}
+                          options={specOptions}
+                          placeholder="مشخصه"
+                        />
+                      </div>
+                    </div>
+
+                    {/* تعداد */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">تعداد</label>
+                      <NumberInput
+                        disabled={hasReceipts}
+                        value={row.qty}
+                        onChange={(qty) => {
+                          patchItem(row.key, {
+                            qty,
+                            total: qty != null && row.price != null ? Math.round(qty * row.price * 100) / 100 : row.total,
+                          });
+                        }}
+                        placeholder="تعداد"
+                      />
+                    </div>
+
+                    {/* قیمت واحد */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">قیمت واحد</label>
+                      <NumberInput
+                        disabled={hasReceipts}
+                        value={row.price}
+                        onChange={(price) => {
+                          patchItem(row.key, {
+                            price,
+                            total: row.qty != null && price != null ? Math.round(row.qty * price * 100) / 100 : row.total,
+                          });
+                        }}
+                        placeholder="قیمت واحد"
+                        maxDecimals={2}
+                      />
+                    </div>
+
+                    {/* قیمت کل */}
+                    <div className="col-span-1 flex min-w-0 flex-col gap-1">
+                      <label className="text-[11px] font-semibold text-muted">قیمت کل</label>
+                      <NumberInput
+                        disabled={hasReceipts}
+                        value={row.total}
+                        onChange={(t) => {
+                          patchItem(row.key, {
+                            total: t,
+                            price:
+                              t != null && row.qty != null && row.qty > 0 ? Math.round((t / row.qty) * 100) / 100 : row.price,
+                          });
+                        }}
+                        placeholder="قیمت کل"
+                      />
+                    </div>
+
+                    {/* دکمه حذف */}
+                    <div className="col-span-1 flex items-end justify-end pb-0.5">
+                      {!hasReceipts && (
+                        <button
+                          type="button"
+                          className="inline-flex h-9 items-center gap-1 rounded-md px-2.5 text-xs text-red hover:bg-red-bg/50 transition-colors"
+                          title="حذف قلم"
+                          onClick={() => setItemRows((rows) => rows.filter((r) => r.key !== row.key))}
+                        >
+                          <Trash2 className="h-3.5 w-3.5" />
+                          <span>حذف قلم</span>
+                        </button>
+                      )}
+                    </div>
                   </div>
-                  <div className="field">
-                    <label>برند</label>
-                    <input
-                      className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-                      placeholder="برند"
-                      value={row.brand}
-                      onChange={(e) => patchItem(row.key, { brand: e.target.value })}
-                    />
-                  </div>
-                  <div className="field">
-                    <label>مشخصه</label>
-                    <MultiSelectCombobox
-                      values={row.specs}
-                      onChange={(specs) => patchItem(row.key, { specs })}
-                      options={specOptions}
-                      placeholder="مشخصه"
-                    />
-                  </div>
-                  <div className="field">
-                    <label>واحد</label>
-                    <input
-                      className="h-9 w-full rounded-md border border-line bg-panel px-2.5 text-[13px] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40"
-                      placeholder="واحد"
-                      value={row.unit}
-                      onChange={(e) => patchItem(row.key, { unit: e.target.value })}
-                    />
-                  </div>
-                  <div className="field">
-                    <label>تعداد</label>
-                    <NumberInput
-                      value={row.qty}
-                      onChange={(qty) => {
-                        patchItem(row.key, {
-                          qty,
-                          total: qty != null && row.price != null ? Math.round(qty * row.price * 100) / 100 : row.total,
-                        });
-                      }}
-                      placeholder="تعداد"
-                    />
-                  </div>
-                  <div className="field">
-                    <label>قیمت واحد</label>
-                    <NumberInput
-                      value={row.price}
-                      onChange={(price) => {
-                        patchItem(row.key, {
-                          price,
-                          total: row.qty != null && price != null ? Math.round(row.qty * price * 100) / 100 : row.total,
-                        });
-                      }}
-                      placeholder="قیمت واحد"
-                      maxDecimals={2}
-                    />
-                  </div>
-                  <div className="field">
-                    <label>قیمت کل</label>
-                    <NumberInput
-                      value={row.total}
-                      onChange={(t) => {
-                        patchItem(row.key, {
-                          total: t,
-                          price:
-                            t != null && row.qty != null && row.qty > 0 ? Math.round((t / row.qty) * 100) / 100 : row.price,
-                        });
-                      }}
-                      placeholder="قیمت کل"
-                    />
-                  </div>
-                  <div className="flex items-end justify-end">
-                    <button
-                      type="button"
-                      className="inline-flex items-center gap-1 rounded-md px-2 py-1.5 text-[12px] text-muted transition-colors hover:bg-red-bg hover:text-red"
-                      title="حذف قلم"
-                      onClick={() => setItemRows((rows) => rows.filter((r) => r.key !== row.key))}
-                    >
-                      <Trash2 className="h-3.5 w-3.5" />
-                      حذف
-                    </button>
+
+                  {/* تخصیص termsheet */}
+                  <div className="mt-2.5 border-t border-line/60 pt-2">
+                    {row.rejected ? (
+                      <label className="ts-cb-label e-restore">
+                        <input
+                          type="checkbox"
+                          checked={row.restore}
+                          onChange={(e) => patchItem(row.key, { restore: e.target.checked })}
+                        />
+                        بازگرداندن به معامله
+                      </label>
+                    ) : (
+                      <>
+                        <div className="mb-1 text-[10.5px] font-semibold text-muted">این قلم تحت کدام termsheet هاست؟</div>
+                        <div className="flex flex-wrap gap-1.5">
+                          {tsCards.map((card, idx) => (
+                            <label key={card.key} className={cn("chip cursor-pointer text-xs", hasReceipts && "cursor-not-allowed opacity-60")}>
+                              <input
+                                type="checkbox"
+                                disabled={hasReceipts}
+                                className="me-1 accent-accent disabled:cursor-not-allowed"
+                                checked={row.tsDomIds.includes(card.domId || card.key)}
+                                onChange={(e) => {
+                                  const next = new Set(row.tsDomIds);
+                                  const domId = card.domId || card.key;
+                                  if (e.target.checked) next.add(domId);
+                                  else next.delete(domId);
+                                  patchItem(row.key, { tsDomIds: [...next] });
+                                }}
+                              />
+                              {tsLabel(card, idx)}
+                            </label>
+                          ))}
+                        </div>
+                      </>
+                    )}
                   </div>
                 </div>
-                {/* تخصیص termsheet / بازگرداندن */}
-                <div className="mt-2.5 border-t border-line pt-2">
-                  {row.rejected ? (
-                    <label className="ts-cb-label e-restore">
-                      <input
-                        type="checkbox"
-                        checked={row.restore}
-                        onChange={(e) => patchItem(row.key, { restore: e.target.checked })}
+              ))}
+            </div>
+            {!hasReceipts && (
+              <Button variant="line" size="sm" className="mt-2.5 w-full sm:w-auto" onClick={addItemRow}>
+                ＋ افزودن قلم
+              </Button>
+            )}
+          </div>
+
+          {/* termsheetها */}
+          <div className="border-t border-line pt-3">
+            <div className="mb-2 text-[13px] font-bold">termsheet ها (شرایط پرداخت):</div>
+            <div className="flex flex-col gap-2.5">
+              {tsCards.map((card, idx) => (
+                <div key={card.key} className="variant-card">
+                  <div className="variant-head">
+                    <span className="variant-num">{tsLabel(card, idx)}</span>
+                    {!hasReceipts && (
+                      <button type="button" className="variant-x" title="حذف" onClick={() => removeTsCard(card.key)}>
+                        ×
+                      </button>
+                    )}
+                  </div>
+                  <div className="mb-1 flex flex-col gap-1.5">
+                    {card.milestones.map((ms, i) => (
+                      <MilestoneRow
+                        key={i}
+                        milestone={ms}
+                        disabled={hasReceipts}
+                        onChange={(nextMs) =>
+                          updateTs(card.key, { milestones: card.milestones.map((x, j) => (j === i ? nextMs : x)) })
+                        }
+                        onRemove={() => updateTs(card.key, { milestones: card.milestones.filter((_, j) => j !== i) })}
                       />
-                      بازگرداندن به معامله
-                    </label>
-                  ) : (
-                    <>
-                      <div className="mb-1 text-[10.5px] font-semibold text-muted">این قلم تحت کدام termsheet هاست؟</div>
-                      <div className="flex flex-wrap gap-1.5">
-                        {tsCards.map((card, idx) => (
-                          <label key={card.key} className="chip cursor-pointer">
-                            <input
-                              type="checkbox"
-                              className="me-1 accent-accent"
-                              checked={row.tsDomIds.includes(card.domId || card.key)}
-                              onChange={(e) => {
-                                const next = new Set(row.tsDomIds);
-                                const domId = card.domId || card.key;
-                                if (e.target.checked) next.add(domId);
-                                else next.delete(domId);
-                                patchItem(row.key, { tsDomIds: [...next] });
-                              }}
-                            />
-                            {tsLabel(card, idx)}
-                          </label>
-                        ))}
-                      </div>
-                    </>
+                    ))}
+                  </div>
+                  {!hasReceipts && (
+                    <Button
+                      variant="line"
+                      size="sm"
+                      className="mt-1"
+                      onClick={() => updateTs(card.key, { milestones: [...card.milestones, { when_iso: null, amount: null }] })}
+                    >
+                      ＋ مرحله پرداخت
+                    </Button>
                   )}
                 </div>
-              </div>
-            ))}
+              ))}
+            </div>
+            {!hasReceipts && (
+              <Button variant="line" size="sm" className="mt-2.5 w-full sm:w-auto" onClick={addTsCard}>
+                ＋ افزودن termsheet
+              </Button>
+            )}
           </div>
-          <Button variant="line" size="sm" className="mt-2" onClick={addItemRow}>
-            ＋ افزودن قلم
-          </Button>
-        </div>
 
-        {/* termsheetها */}
-        <div className="border-t border-line pt-3">
-          <div className="mb-2 text-[13px] font-bold">termsheet ها (شرایط پرداخت):</div>
-          <div className="flex flex-col gap-2">
-            {tsCards.map((card, idx) => (
-              <div key={card.key} className="variant-card">
-                <div className="variant-head">
-                  <span className="variant-num">{tsLabel(card, idx)}</span>
-                  <button type="button" className="variant-x" title="حذف" onClick={() => removeTsCard(card.key)}>
-                    ×
-                  </button>
-                </div>
-                <div className="mb-1 flex flex-col gap-1.5">
-                  {card.milestones.map((ms, i) => (
-                    <MilestoneRow
-                      key={i}
-                      milestone={ms}
-                      onChange={(nextMs) =>
-                        updateTs(card.key, { milestones: card.milestones.map((x, j) => (j === i ? nextMs : x)) })
-                      }
-                      onRemove={() => updateTs(card.key, { milestones: card.milestones.filter((_, j) => j !== i) })}
-                    />
-                  ))}
-                </div>
-                <Button
-                  variant="line"
-                  size="sm"
-                  className="mt-1"
-                  onClick={() => updateTs(card.key, { milestones: [...card.milestones, { when_iso: null, amount: null }] })}
+          {/* فاکتورها */}
+          <div className="border-t border-line pt-3">
+            <div className="mb-1 text-[13px] font-bold">فاکتورهای اصلی (چند فایل):</div>
+            <FileList
+              files={invoices}
+              onChange={setInvoices}
+              upload={(f) => api.files.upload(q.id, "invoice", f)}
+              onDelete={(a) =>
+                a.id &&
+                void api.files.remove(q.id, "invoice", a.id).catch((err) =>
+                  toast.error(err instanceof Error ? err.message : "حذف فاکتور ناموفق بود"),
+                )
+              }
+              onDownload={(a) => api.files.download(q.id, "invoice", a.id!, a.name)}
+            />
+          </div>
+
+          {/* تاریخ‌ها و وضعیت */}
+          <div className="border-t border-line pt-3">
+            <div className="mb-2 text-[12px] font-bold text-muted">تاریخ‌ها و وضعیت:</div>
+            <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">تاریخ پیشنهاد</label>
+                <JalaliDatePicker value={quoteDate} onChange={setQuoteDate} placeholder="تاریخ" withTime />
+              </div>
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">تاریخ انقضا</label>
+                <JalaliDatePicker value={expiryDate} onChange={setExpiryDate} placeholder="تاریخ" />
+              </div>
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">تاریخ پذیرش</label>
+                <JalaliDatePicker value={acceptedDate} onChange={setAcceptedDate} placeholder="تاریخ" withTime />
+              </div>
+              <div className="flex min-w-0 flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">تاریخ رسید</label>
+                <JalaliDatePicker value={arrivedDate} onChange={setArrivedDate} placeholder="تاریخ" withTime />
+              </div>
+              <div className="col-span-1 flex min-w-0 flex-col gap-1.5 sm:col-span-2">
+                <label className="text-xs font-semibold text-muted">وضعیت (فقط بازگشت به مرحله‌های قبل)</label>
+                <select
+                  className="h-10 w-full rounded-lg border border-line bg-panel px-3 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
+                  value={status}
+                  disabled={hasReceipts}
+                  onChange={(e) => setStatus(e.target.value)}
                 >
-                  ＋ مرحله پرداخت
-                </Button>
+                  {statusOptionsFor(q.status).map((st) => (
+                    <option key={st} value={st}>
+                      {STATUS_LABEL[st]}
+                    </option>
+                  ))}
+                </select>
+                {hasReceipts && (
+                  <div className="mt-1.5 rounded-md bg-amber-bg px-2.5 py-1.5 text-[11.5px] font-medium text-amber">
+                    این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.
+                  </div>
+                )}
               </div>
-            ))}
+            </div>
           </div>
-          <Button variant="line" size="sm" className="mt-2" onClick={addTsCard}>
-            ＋ افزودن termsheet
-          </Button>
-        </div>
 
-        {/* فاکتورها */}
-        <div className="border-t border-line pt-3">
-          <div className="mb-1 text-[13px] font-bold">فاکتورهای اصلی (چند فایل):</div>
-          <FileList
-            files={invoices}
-            onChange={setInvoices}
-            upload={(f) => api.files.upload(q.id, "invoice", f)}
-            onDelete={(a) =>
-              a.id &&
-              void api.files.remove(q.id, "invoice", a.id).catch((err) =>
-                toast.error(err instanceof Error ? err.message : "حذف فاکتور ناموفق بود"),
-              )
-            }
-            urlOf={(a) => (a.id ? api.files.downloadUrl(q.id, "invoice", a.id) : null)}
-          />
-        </div>
-
-        {/* تاریخ‌ها و وضعیت */}
-        <div className="border-t border-line pt-3">
-          <div className="mb-2 text-[12px] text-muted">تاریخ‌ها و وضعیت:</div>
-          <div className="grid grid-cols-2 gap-3 max-md:grid-cols-1">
-            <div className="field">
-              <label>تاریخ پیشنهاد</label>
-              <JalaliDatePicker value={quoteDate} onChange={setQuoteDate} placeholder="تاریخ" withTime />
-            </div>
-            <div className="field">
-              <label>تاریخ انقضا</label>
-              <JalaliDatePicker value={expiryDate} onChange={setExpiryDate} placeholder="تاریخ" withTime />
-            </div>
-            <div className="field">
-              <label>تاریخ پذیرش</label>
-              <JalaliDatePicker value={acceptedDate} onChange={setAcceptedDate} placeholder="تاریخ" withTime />
-            </div>
-            <div className="field">
-              <label>تاریخ رسید</label>
-              <JalaliDatePicker value={arrivedDate} onChange={setArrivedDate} placeholder="تاریخ" withTime />
-            </div>
-            <div className="field col-span-2">
-              <label>وضعیت (فقط بازگشت به مرحله‌های قبل)</label>
-              <select
-                className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
-                value={status}
-                disabled={q.status === "arrived"}
-                onChange={(e) => setStatus(e.target.value)}
+          {/* فوتر و دکمه‌های اقدام */}
+          <DialogFooter className="flex flex-col-reverse gap-2 border-t border-line/60 pt-3 sm:flex-row sm:items-center sm:justify-between">
+            {q.status === "offered" ? (
+              <Button
+                type="button"
+                variant="danger"
+                onClick={() => setShowDeleteConfirm(true)}
+                className="w-full gap-1.5 sm:w-auto"
               >
-                {statusOptionsFor(q.status).map((st) => (
-                  <option key={st} value={st}>
-                    {STATUS_LABEL[st]}
-                  </option>
-                ))}
-              </select>
-              {q.status === "arrived" && (
-                <div className="mt-1.5 rounded-md bg-amber-bg px-2.5 py-1.5 text-[11.5px] font-medium text-amber">
-                  به دلیل ثبت ورود اقلام به انبار، امکان تغییر وضعیت پیشنهاد وجود ندارد.
-                </div>
-              )}
+                <Trash2 className="h-4 w-4" />
+                <span>حذف پیشنهاد</span>
+              </Button>
+            ) : (
+              <div />
+            )}
+            <div className="flex w-full items-center gap-2 sm:w-auto sm:justify-end">
+              <Button variant="slate" onClick={onClose} className="flex-1 sm:flex-initial">
+                انصراف
+              </Button>
+              <Button onClick={() => void confirm()} className="flex-1 sm:flex-initial">
+                ذخیره تغییرات
+              </Button>
             </div>
-          </div>
-        </div>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
 
-        <DialogFooter>
-          <Button variant="slate" onClick={onClose}>
-            انصراف
-          </Button>
-          <Button onClick={() => void confirm()}>ذخیره تغییرات</Button>
-        </DialogFooter>
-      </DialogContent>
-    </Dialog>
+      {/* مودال تأیید حذف */}
+      <Dialog open={showDeleteConfirm} onOpenChange={(open) => !deleting && setShowDeleteConfirm(open)}>
+        <DialogContent className="z-[60] max-w-md p-4 sm:p-6">
+          <DialogHeader>
+            <DialogTitle>حذف پیشنهاد خرید</DialogTitle>
+          </DialogHeader>
+          <div className="py-2 text-sm text-muted">
+            آیا از حذف کامل این پیشنهاد اطمینان دارید؟ این عملیات غیرقابل بازگشت است.
+          </div>
+          <DialogFooter className="flex items-center justify-end gap-2 pt-2">
+            <Button
+              type="button"
+              variant="slate"
+              onClick={() => setShowDeleteConfirm(false)}
+              disabled={deleting}
+            >
+              انصراف
+            </Button>
+            <Button
+              type="button"
+              variant="danger"
+              onClick={() => void handleDelete()}
+              disabled={deleting}
+            >
+              {deleting ? "در حال حذف..." : "حذف نهایی"}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </>
   );
-}
+}

frontend/src/pages/Dashboard/QuoteCard.tsx

@@ -176,29 +176,60 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
         </div>
       </div>
 
-      {/* اطلاعات کلیدی (گرید ۲ ستونه موبایل / ۴ ستونه دسکتاپ) */}
-      <div className="grid grid-cols-2 gap-x-3 gap-y-2.5 p-3 sm:gap-x-5 sm:gap-y-3 sm:p-4 md:grid-cols-4">
-        <InfoCell label="اقلام">
+      {/* اطلاعات کلیدی — چیدمان بهینه‌شده موبایل */}
+      <div className="grid grid-cols-2 gap-x-3 gap-y-3 p-3 sm:gap-x-5 sm:gap-y-3.5 sm:p-4 md:grid-cols-4">
+        {/* ۱. پروژه — تمام‌عرض در موبایل */}
+        <InfoCell label="پروژه" className="col-span-2 md:col-span-1">
+          <div className="flex items-center gap-1.5 text-xs font-semibold text-ink sm:text-[13px]">
+            <Building2 className="h-3.5 w-3.5 shrink-0 text-muted" />
+            <span className="truncate">
+              {q.projects && q.projects.length > 0 ? q.projects.join("، ") : projectCell(q)}
+            </span>
+          </div>
+        </InfoCell>
+
+        {/* ۲. اقلام — تمام‌عرض زیر پروژه با شکستن متن بدون سه‌نقطه */}
+        <InfoCell label="اقلام" className="col-span-2 md:col-span-1">
           {summary.count > 1 ? (
-            <div className="flex flex-col gap-0.5">
-              <span className="font-semibold text-xs sm:text-sm">{fmtNum(summary.count)} قلم کالا</span>
-              <div className="flex flex-col gap-0.5 text-[11px] leading-4 text-muted sm:text-[11.5px] sm:leading-5">
-                {store.quotes.find((x) => x.id === q.id)?.line_items?.filter((li) => !li.rejected).slice(0, 3).map((li) => {
-                  const m = materialById(store.materials, li.material_id);
-                  return (
-                    <span key={li.id} className="truncate">
-                      • {materialLabel(m)} ({fmtNum(li.quantity)} {li.unit})
-                    </span>
-                  );
-                })}
+            <div className="flex flex-col gap-1.5">
+              <span className="font-bold text-xs text-ink sm:text-sm">
+                {fmtNum(summary.count)} قلم کالا
+              </span>
+              <div className="flex flex-col gap-1.5 rounded-lg border border-line/60 bg-bg/50 p-2.5 text-[11px] leading-5 text-muted sm:text-[11.5px]">
+                {store.quotes
+                  .find((x) => x.id === q.id)
+                  ?.line_items?.filter((li) => !li.rejected)
+                  .slice(0, 3)
+                  .map((li) => {
+                    const m = materialById(store.materials, li.material_id);
+                    return (
+                      <div
+                        key={li.id}
+                        className="flex items-start justify-between gap-2 border-b border-line/30 pb-1.5 last:border-0 last:pb-0"
+                      >
+                        <span className="min-w-0 flex-1 font-medium text-ink leading-snug break-words">
+                          • {materialLabel(m)}
+                        </span>
+                        <span className="shrink-0 font-semibold tabular-nums text-ink text-[10.5px] pt-0.5">
+                          {fmtNum(li.quantity)}{" "}
+                          <span className="font-normal text-muted text-[9.5px]">{li.unit}</span>
+                        </span>
+                      </div>
+                    );
+                  })}
                 {(q.line_items?.length || 0) > 3 && (
-                  <span className="text-[10px] text-muted">و {(q.line_items?.length || 0) - 3} قلم دیگر...</span>
+                  <span className="pt-0.5 text-[10px] text-muted">
+                    و {(q.line_items?.length || 0) - 3} قلم دیگر...
+                  </span>
                 )}
               </div>
             </div>
           ) : (
-            <span className="truncate">{summary.text}</span>
+            <div className="flex items-start gap-1.5 text-xs font-medium leading-5 text-ink sm:text-[13px]">
+              <span className="break-words">{summary.text}</span>
+            </div>
           )}
+
           {unitWarns.map((w) => (
             <Link
               key={w.unit}
@@ -206,7 +237,7 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
               className="unit-warn mt-1 inline-flex items-center gap-1 text-[10px]"
               title={`ضریب تبدیل «${esc(w.unit)}» را در داشبورد واحدها ثبت کنید`}
             >
-              <TriangleAlert className="h-2.5 w-2.5" />
+              <TriangleAlert className="h-2.5 w-2.5 shrink-0" />
               واحد جدید: {w.unit}
             </Link>
           ))}
@@ -216,15 +247,32 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
           <span className="inline-flex items-center gap-1 text-xs sm:text-[13px]">
             <Building2 className="h-3.5 w-3.5 shrink-0 text-muted" />
             <span className="truncate">
-              {q.projects && q.projects.length > 0 ? q.projects.join("، ") : projectCell(q)}
+              {(() => {
+                const activeItems = (q.line_items || []).filter((li) => !li.rejected);
+                if (q.status === "accepted" || q.status === "arrived") {
+                  // فقط پروژه‌ی هدف پذیرفته‌شده — همان منطق itemProjects در وضعیت accepted
+                  const targetProj = activeItems.find((li) => li.target_project)?.target_project;
+                  return targetProj?.name ?? projectCell(q);
+                }
+                // وضعیت offered: همه‌ی پروژه‌های کاندیدا از line_items (همان منطق itemProjects)
+                const names = new Set<string>();
+                activeItems.forEach((li) =>
+                  (li.projects || []).forEach((p) => {
+                    const name = typeof p === "string" ? p : p.name;
+                    if (name) names.add(name);
+                  })
+                );
+                if (names.size > 0) return [...names].join("، ");
+                return projectCell(q);
+              })()}
             </span>
           </span>
         </InfoCell>
 
-        <InfoCell label="مجموع مبلغ">
+        <InfoCell label="مجموع مبلغ" className="col-span-1">
           {pc ? (
             <div>
-              <div className="text-sm font-extrabold text-ink tabular-nums sm:text-base">
+              <div className="text-sm font-extrabold tabular-nums text-ink sm:text-base">
                 {pc.num} <span className="text-[10px] font-normal text-muted sm:text-xs">تومان</span>
               </div>
               <div className="hidden text-[11px] text-muted sm:block">({pc.words})</div>
@@ -234,10 +282,11 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
           )}
         </InfoCell>
 
-        <InfoCell label="شرایط معامله">
+        {/* ۴. شرایط معامله */}
+        <InfoCell label="شرایط معامله" className="col-span-1">
           {ts.title !== "—" ? (
             <div>
-              <div className="font-semibold text-xs sm:text-[13px]" style={ts.color ? { color: ts.color } : undefined}>
+              <div className="text-xs font-semibold sm:text-[13px]" style={ts.color ? { color: ts.color } : undefined}>
                 {ts.title}
               </div>
               {ts.sub && <div className="truncate text-[10px] text-muted sm:text-[11px]">{ts.sub}</div>}
@@ -248,12 +297,12 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
         </InfoCell>
       </div>
 
-      {/* تاریخ‌ها و اکشن‌ها (۲ ستونه در موبایل، نواری در دسکتاپ) */}
+      {/* تاریخ‌ها و اکشن‌ها */}
       <div className="grid grid-cols-2 gap-2 border-t border-line bg-bg/40 p-2.5 text-[11px] text-muted sm:flex sm:flex-wrap sm:items-center sm:gap-x-5 sm:gap-y-2 sm:px-4 sm:py-2 sm:text-[11.5px]">
         <span className="inline-flex items-center gap-1.5 truncate">
           <Package className="h-3 w-3 shrink-0" />
           <span>تاریخ:</span>
-          <b className="text-ink tabular-nums">{fmtDate(q.quote_date)}</b>
+          <b className="tabular-nums text-ink">{fmtDate(q.quote_date)}</b>
         </span>
 
         <span className="inline-flex items-center gap-1.5 truncate">
@@ -262,7 +311,7 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
           <b className={cn("tabular-nums", expired ? "text-amber" : "text-ink")}>
             {fmtDate(q.expiry_date)}
           </b>
-          {expired && <AlarmClock className="h-3 w-3 text-amber shrink-0" aria-label="منقضی" />}
+          {expired && <AlarmClock className="h-3 w-3 shrink-0 text-amber" aria-label="منقضی" />}
         </span>
 
         <span className="inline-flex items-center gap-1.5">

frontend/src/pages/Dashboard/QuoteDetail.tsx

@@ -3,13 +3,11 @@ import { Package, Scale, CreditCard, CalendarDays, Paperclip, Building2, Ban } f
 import type { Attachment, Quote, Store } from "../../lib/types";
 import { api } from "../../lib/api";
 import {
+  formatMaterialTitle,
   itemTermsheetIds,
   lineItemTotal,
   materialById,
-  materialLabel,
-  materialSpecs,
   refConverted,
-  specsLabel,
 } from "../../lib/quoteUtils";
 import { fmtDate, fmtDateTime, fmtNum } from "../../lib/formatters";
 import { groupCommas } from "../../lib/numutil";
@@ -69,7 +67,6 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
     const total = lineItemTotal(li);
     const projs = itemProjects(q, li);
     const conv = isRejected ? null : refConverted(store, li);
-    const specText = specsLabel(materialSpecs(m));
 
     // رسید جزیی → قلم به دو بخش «رسید شده» و «در راه» شکسته می‌شود (نمایشی):
     // مجموع دو بخش همیشه با تعداد/مبلغ اصلی برابر است (عدم تغییر جمع کل پیشنهاد).
@@ -97,8 +94,7 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
       >
         <div className="fb-name">
           <Package className="me-1 inline h-3 w-3 text-muted" />
-          {materialLabel(m)}
-          {specText ? ` · ${specText}` : ""}
+          {formatMaterialTitle(m)}
         </div>
         <div className="fb-meta">
           <Building2 className="me-1 inline h-3 w-3" /> {projs.length ? projs.join("، ") : "—"}
@@ -148,19 +144,31 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
   attachments.proformas.forEach((pf, i) => {
     if (!pf.id) return;
     attachParts.push(
-      <a key={"pf" + i} className="detail-link" href={api.files.downloadUrl(q.id, "proforma", pf.id)} download={pf.name}>
+      <button
+        key={"pf" + i}
+        type="button"
+        className="detail-link"
+        title="دانلود پیش‌فاکتور"
+        onClick={() => api.files.download(q.id, "proforma", pf.id!, pf.name)}
+      >
         <Paperclip className="me-1 inline h-3 w-3" />
         پیش‌فاکتور: {pf.name}
-      </a>,
+      </button>,
     );
   });
   attachments.invoices.forEach((inv, i) => {
     if (!inv.id) return;
     attachParts.push(
-      <a key={"inv" + i} className="detail-link" href={api.files.downloadUrl(q.id, "invoice", inv.id)} download={inv.name}>
+      <button
+        key={"inv" + i}
+        type="button"
+        className="detail-link"
+        title="دانلود فاکتور"
+        onClick={() => api.files.download(q.id, "invoice", inv.id!, inv.name)}
+      >
         <Paperclip className="me-1 inline h-3 w-3" />
         فاکتور اصلی: {inv.name}
-      </a>,
+      </button>,
     );
   });
 

frontend/src/pages/Dashboard/QuoteRow.tsx

@@ -2,10 +2,10 @@ import { Link } from "react-router-dom";
 import { AlarmClock, ChevronDown, TriangleAlert } from "lucide-react";
 import type { Quote, Store } from "../../lib/types";
 import {
+  formatMaterialTitle,
   isExpired,
   itemsSummary,
   materialById,
-  materialSpecs,
   projectCell,
   quoteTotal,
   supplierById,
@@ -92,11 +92,10 @@ export function QuoteRow({ store, q, expanded, onToggleExpand, onAccept, onEdit
               <div className="flex flex-col gap-0.5 text-[11px] text-muted">
                 {(q.line_items || []).filter((li) => !li.rejected).map((li) => {
                   const m = materialById(store.materials, li.material_id);
-                  const specs = materialSpecs(m);
                   return (
                     <span key={li.id} className="flex items-center gap-1">
                       <span className="h-1.5 w-1.5 shrink-0 rounded-full bg-accent/40" />
-                      {m.category} {m.brand}{specs.length ? ` · ${specs.join(" · ")}` : ""}
+                      {formatMaterialTitle(m)}
                       <span className="text-[10px] text-muted/70">
                         {fmtNum(li.quantity)} {li.unit}
                       </span>

frontend/src/pages/Inventory/ChangeInventoryPage.tsx

@@ -14,11 +14,11 @@ import { uniqueUnits } from "../../lib/units";
 import type { InventoryTransaction, TransactionType } from "../../lib/types";
 import { faNum } from "../../lib/formatters";
 import { gregorianToJalali, MONTHS, toFa } from "../../lib/jalali";
+import { cn } from "../../lib/utils";
 
 type FormType = TransactionType | "TRANSFER";
 
 const FORM_TYPES: { t: FormType; label: string; dir: string; cls: "in" | "out" | "mv" | "cnt"; color: string; desc: string }[] = [
-  // رنگ‌بندی معنایی: سبز زمردی = ورود، رز = خروج، آبی = خنثی/جابه‌جایی/شمارش
   { t: "PURCHASE", label: "موجودی اولیه", dir: "افزایش", cls: "in", color: "#10b981", desc: "ثبت موجودی اولیه — متریال/برند/واحد را از فهرست انتخاب کنید؛ اگر نامی در فهرست نبود، همان نام تایپ‌شده هنگام ثبت به‌صورت خودکار در کاتالوگ سراسری ساخته می‌شود. ثبت حداقل یک مشخصه فنی الزامی است." },
   { t: "WITHDRAWAL", label: "برداشت", dir: "کاهش", cls: "out", color: "#e11d48", desc: "انبار را انتخاب و نام متریال را تایپ کنید؛ همه مدل‌ها (برند و مشخصه متفاوت) نمایش داده می‌شوند. برداشت‌ها در «کنترل روزانه» امروز دیده می‌شوند." },
   { t: "RETURN", label: "برگشت", dir: "افزایش", cls: "in", color: "#10b981", desc: "برگشت از مصالحی که امروز برداشت شده‌اند — نام متریال را تایپ کنید و مقدار برگشتی هر ردیف را بزنید." },
@@ -46,7 +46,6 @@ function jalDateLabel(d: Date): string {
   return `${toFa(jd)} ${MONTHS[jm - 1]} ${toFa(jy)}`;
 }
 
-// تغییر موجودی — پورت کامل صفحه‌ی ارسالی (همه انواع تراکنش)
 export function ChangeInventoryPage() {
   const user = useAuthStore((s) => s.user);
   const data = useInventoryData();
@@ -60,15 +59,12 @@ export function ChangeInventoryPage() {
   const [brandTxt, setBrandTxt] = useState("");
   const [unitTxt, setUnitTxt] = useState("");
   const [qty, setQty] = useState("");
-  // تاریخ و ساعت به صورت ISO (تقویم شمسی — JalaliDatePicker)
   const [dateInput, setDateInput] = useState<string>(() => new Date().toISOString());
-  // مشخصه‌های فنی — چیپ‌های چندتایی، دقیقاً مثل فیلد «مشخصه» در ویزارد دفتر تدارکات
   const [specsChips, setSpecsChips] = useState<string[]>([]);
   const [note, setNote] = useState("");
   const [rows, setRows] = useState<RowDraft[]>([]);
   const [busy, setBusy] = useState(false);
 
-  // prefill از URL (پرش از کنترل روزانه)
   useEffect(() => {
     const t = params.get("type");
     const w = params.get("wh");
@@ -91,7 +87,6 @@ export function ChangeInventoryPage() {
 
   const formRecords = useMemo(() => {
     const txt = matTxt.trim();
-    // انتقال از انبار مبدأ استفاده می‌کند، بقیه از انبار انتخابی
     const wid = type === "TRANSFER" ? fromId : whId;
     return data.inventory.filter((r) => {
       if (r.warehouse?.id !== wid) return false;
@@ -105,8 +100,6 @@ export function ChangeInventoryPage() {
   const unitIdByName = (name: string) => data.lookup.units.find((u) => (u.name_fa || u.code) === name)?.id || null;
   const parseNum = (s: string) => { const v = parseFloat(String(s).replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d))).replace(/[،,]/g, "")); return isFinite(v) ? v : NaN; };
 
-  // تبدیل امن تاریخ فرم به ISO — اگر فیلد خالی/نامعتبر بود (که قبلاً submit را
-  // بی‌صدا می‌شکست) به «هم‌اکنون» برمی‌گردد تا ثبت هیچ‌وقت قفل نشود.
   const toServerIso = () => {
     try {
       const d = new Date(dateInput);
@@ -115,8 +108,6 @@ export function ChangeInventoryPage() {
     return new Date().toISOString();
   };
 
-  // هر چیپ یک مشخصه است؛ در specs انبار به‌صورت کلید با مقدار خالی ذخیره می‌شود
-  // تا رکوردهای انبارِ دارای مشخصه‌های متفاوت از هم جدا بمانند
   const specsFromChips = () => {
     const out: Record<string, string> = {};
     specsChips.forEach((c) => {
@@ -151,9 +142,6 @@ export function ChangeInventoryPage() {
       .sort((a, b) => new Date(a.transaction_date).getTime() - new Date(b.transaction_date).getTime());
   }, [data.transactions, whId, matTxt]);
 
-  // --- پیدا شده: مانده‌ی مفقودی هر ردیف = مفقودی − مجموع پیداشده‌های قبلیِ همان رکورد
-  const lossKey = (t: InventoryTransaction) =>
-    [t.warehouse_id, t.material?.id || "", t.brand?.id || "", JSON.stringify(t.specs || {})].join("|");
   const foundRemaining = useMemo(() => {
     const foundByKey = new Map<string, number>();
     data.transactions
@@ -170,7 +158,9 @@ export function ChangeInventoryPage() {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [lossTxs, data.transactions, whId, matTxt]);
 
-  // مفقودی‌های کاملاً پیداشده از فهرست «در انتظار پیدا شدن» حذف می‌شوند
+  const lossKey = (t: InventoryTransaction) =>
+    [t.warehouse_id, t.material?.id || "", t.brand?.id || "", JSON.stringify(t.specs || {})].join("|");
+
   const pendingLosses = useMemo(
     () =>
       lossTxs
@@ -188,7 +178,6 @@ export function ChangeInventoryPage() {
     try {
       for (const op of ops) await postOne(op);
       toast.success("ثبت شد ✓");
-      // اعلام به تب‌های دیگر (داشبورد/کنترل روزانه/... باز خودشان را تازه می‌کنند)
       notifyDataChanged("inventory");
       setRows([]);
       setMatTxt("");
@@ -205,7 +194,6 @@ export function ChangeInventoryPage() {
     }
   };
 
-  // ---------- submit handlers ----------
   const submitPurchase = async () => {
     const matName = matTxt.trim();
     const brandName = brandTxt.trim();
@@ -216,10 +204,9 @@ export function ChangeInventoryPage() {
     if (!brandName) return toast.error("نام برند را وارد کنید");
     if (!unitName) return toast.error("نام واحد را وارد کنید");
     if (!(n > 0)) return toast.error("تعداد باید بزرگ‌تر از صفر باشد");
-    if (!specsComplete) return toast.error("حداقل یک مشخصه فنی ثبت کنید (نام را بنویسید و Enter بزنید)");
+    if (!specsComplete) return toast.error("حداقل یک مشخصه فنی ثبت کنید");
 
     try {
-      // ساختِ به‌هنگام موجودیت‌های ناشناخته در کاتالوگ سراسری (بدون پیش‌نیاز تدارکات)
       let uid = unitIdByName(unitName);
       if (!uid) {
         const created = await apiV26.catalog.createUnit(unitName);
@@ -264,7 +251,6 @@ export function ChangeInventoryPage() {
     await postSeq(ops);
   };
 
-  // ---------- شمارش موجودی: پیش‌نمایش اختلاف + تأیید قبل از ثبت ----------
   interface CountConfirmRow {
     material: string;
     unit: string;
@@ -358,7 +344,7 @@ export function ChangeInventoryPage() {
         if (!(n > 0)) return null;
         const item = pendingLosses[i];
         if (!item) return null;
-        if (n > item.remaining) return null; // سقف سمت کلاینت (بک‌اند هم رد می‌کند)
+        if (n > item.remaining) return null;
         const t = item.tx;
         return { transaction_type: "FOUND", warehouse_id: whId, material_id: t.material?.id, brand_id: t.brand?.id || null, quantity: n, unit_id: t.unit?.id ?? null, specs: t.specs || {}, note: r.note, transaction_date: toServerIso() };
       })
@@ -382,12 +368,10 @@ export function ChangeInventoryPage() {
 
   const canSubmit = (): boolean => {
     if (type === "PURCHASE") {
-      // نام‌های تایپ‌شده لازم نیست از قبل در فهرست باشند — در submit ساخته می‌شوند
       return !!(whId && matTxt.trim() && brandTxt.trim() && unitTxt.trim() && parseNum(qty) > 0 && specsComplete);
     }
     if (type === "TRANSFER") return !!(fromId && toId && matTxt.trim() && rows.some((r) => parseNum(r.qty) > 0));
     if (type === "RETURN") return !!(whId && matTxt.trim() && rows.some((r) => parseNum(r.qty) > 0));
-    // پیدا شده: هر مقدار واردشده باید داخل مانده‌ی مفقودی همان ردیف باشد
     if (type === "FOUND") {
       return !!(
         whId &&
@@ -402,7 +386,6 @@ export function ChangeInventoryPage() {
     return !!(whId && matTxt.trim() && rows.some((r) => parseNum(r.qty) > 0));
   };
 
-  // sync rows when the record list changes
   useEffect(() => {
     if (type === "RETURN") {
       setRows(todayWithdrawals.map((t) => ({ key: t.inventory_id, qty: "", note: "" })));
@@ -447,54 +430,68 @@ export function ChangeInventoryPage() {
   const isTransfer = type === "TRANSFER";
 
   return (
-    <div className="min-h-screen">
+    <div className="min-h-screen overflow-x-hidden pb-20">
       <Header
         title="تغییر موجودی"
         sub={inventorySubheader(user)}
         backTo="/inventory"
         backLabel="بازگشت به داشبورد"
       />
-      <PageLayout className="flex flex-col gap-3">
-        {/* انتخاب نوع تراکنش */}
-        <div className="rounded-xl border border-line bg-panel p-3">
+      <PageLayout className="flex flex-col gap-3 px-3 md:px-6 w-full max-w-full">
+        {/* انتخاب نوع تغییر موجودی — چیپ‌های لمسی مرتب در موبایل */}
+        <div className="rounded-xl border border-line bg-panel p-3 w-full shadow-2xs">
           <h3 className="mb-2 text-[13px] font-bold">نوع تغییر موجودی</h3>
-          <div className="flex flex-wrap gap-1.5">
+          <div className="grid grid-cols-2 gap-1.5 sm:flex sm:flex-wrap">
             {FORM_TYPES.map((f) => (
               <button
                 key={f.t}
                 type="button"
                 onClick={() => { setType(f.t); setRows([]); setMatTxt(""); setWhId(""); setFromId(""); setToId(""); }}
-                className={`rounded-lg border px-3 py-2 text-[12.5px] ${type === f.t ? "font-bold text-white" : "border-line bg-panel"}`}
+                className={cn(
+                  "rounded-lg border px-3 py-2 text-xs sm:text-[12.5px] text-start sm:text-center transition-all",
+                  type === f.t ? "font-bold text-white shadow-xs" : "border-line bg-panel text-ink hover:bg-bg"
+                )}
                 style={type === f.t ? { background: f.color, borderColor: f.color } : undefined}
               >
-                {f.label} <span className="text-[10.5px] opacity-80">({f.dir})</span>
+                <div>{f.label}</div>
+                <span className="text-[10px] opacity-80">({f.dir})</span>
               </button>
             ))}
           </div>
-          <p className="mt-2 text-[11.5px] leading-5 text-muted">{meta.desc}</p>
+          <p className="mt-2.5 text-[11.5px] leading-5 text-muted">{meta.desc}</p>
         </div>
 
-        <div className="rounded-xl border border-line bg-panel p-4">
-          {/* انتخاب انبارها */}
+        <div className="rounded-xl border border-line bg-panel p-3 sm:p-4 w-full shadow-2xs">
+          {/* انتخاب انبارها (چیپ‌های لمسی به جای سلکت خام) */}
           {!isTransfer ? (
-            <div className="mb-3 grid gap-3 md:grid-cols-2">
-              <div className="field">
-                <label>انبار *</label>
-                <select
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
-                  value={whId}
-                  onChange={(e) => { setWhId(e.target.value); setMatTxt(""); setRows([]); }}
-                >
-                  <option value="">— انتخاب کنید —</option>
-                  {whOpts.map((w) => <option key={w.id} value={w.id}>{w.name}</option>)}
-                </select>
+            <div className="mb-3 flex flex-col gap-3">
+              <div className="flex flex-col gap-1.5">
+                <label className="text-xs font-semibold text-muted">انبار *</label>
+                <div className="flex flex-wrap gap-1.5">
+                  {whOpts.map((w) => (
+                    <button
+                      key={w.id}
+                      type="button"
+                      onClick={() => { setWhId(w.id); setMatTxt(""); setRows([]); }}
+                      className={cn(
+                        "rounded-lg px-3 py-1.5 text-xs font-medium transition-colors",
+                        whId === w.id
+                          ? "bg-accent text-white font-bold shadow-xs"
+                          : "border border-line bg-bg/50 text-ink hover:bg-panel"
+                      )}
+                    >
+                      {w.name}
+                    </button>
+                  ))}
+                </div>
               </div>
+
               {(type === "WITHDRAWAL" || type === "DAMAGE" || type === "WASTE" || type === "LOSS" || type === "STOCK_COUNT" || type === "RETURN" || type === "FOUND") && (
                 <div className="field">
-                  <label>{type === "FOUND" ? "متریال (خالی = همه مفقودی‌ها)" : "متریال *"}</label>
+                  <label className="text-xs font-semibold text-muted">{type === "FOUND" ? "متریال (خالی = همه مفقودی‌ها)" : "متریال *"}</label>
                   <input
                     list="dl-mat"
-                    className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
+                    className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-xs sm:text-sm"
                     placeholder={type === "RETURN" ? "نام متریال برداشت‌شده امروز…" : "نام متریال — از پیشنهادها یا جدید…"}
                     value={matTxt}
                     onChange={(e) => { setMatTxt(e.target.value); setRows([]); }}
@@ -508,33 +505,51 @@ export function ChangeInventoryPage() {
           ) : (
             <div className="mb-3 grid gap-3 md:grid-cols-2">
               <div className="field">
-                <label>از (انبار مبدأ) *</label>
-                <select
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
-                  value={fromId}
-                  onChange={(e) => { setFromId(e.target.value); setToId(""); setMatTxt(""); setRows([]); }}
-                >
-                  <option value="">— انتخاب انبار مبدأ —</option>
-                  {whOpts.map((w) => <option key={w.id} value={w.id}>{w.name}</option>)}
-                </select>
+                <label className="text-xs font-semibold text-muted">از (انبار مبدأ) *</label>
+                <div className="flex flex-wrap gap-1.5 mt-1">
+                  {whOpts.map((w) => (
+                    <button
+                      key={w.id}
+                      type="button"
+                      onClick={() => { setFromId(w.id); setToId(""); setMatTxt(""); setRows([]); }}
+                      className={cn(
+                        "rounded-lg px-2.5 py-1 text-xs font-medium transition-colors",
+                        fromId === w.id
+                          ? "bg-accent text-white font-bold shadow-xs"
+                          : "border border-line bg-bg/50 text-ink hover:bg-panel"
+                      )}
+                    >
+                      {w.name}
+                    </button>
+                  ))}
+                </div>
               </div>
               <div className="field">
-                <label>به (انبار مقصد) *</label>
-                <select
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
-                  value={toId}
-                  disabled={!fromId}
-                  onChange={(e) => { setToId(e.target.value); setMatTxt(""); setRows([]); }}
-                >
-                  <option value="">— انتخاب انبار مقصد —</option>
-                  {whOpts.filter((w) => w.id !== fromId).map((w) => <option key={w.id} value={w.id}>{w.name}</option>)}
-                </select>
+                <label className="text-xs font-semibold text-muted">به (انبار مقصد) *</label>
+                <div className="flex flex-wrap gap-1.5 mt-1">
+                  {whOpts.filter((w) => w.id !== fromId).map((w) => (
+                    <button
+                      key={w.id}
+                      type="button"
+                      disabled={!fromId}
+                      onClick={() => { setToId(w.id); setMatTxt(""); setRows([]); }}
+                      className={cn(
+                        "rounded-lg px-2.5 py-1 text-xs font-medium transition-colors disabled:opacity-40",
+                        toId === w.id
+                          ? "bg-accent text-white font-bold shadow-xs"
+                          : "border border-line bg-bg/50 text-ink hover:bg-panel"
+                      )}
+                    >
+                      {w.name}
+                    </button>
+                  ))}
+                </div>
               </div>
               <div className="field md:col-span-2">
-                <label>متریال *</label>
+                <label className="text-xs font-semibold text-muted">متریال *</label>
                 <input
                   list="dl-mat2"
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm"
+                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-xs sm:text-sm"
                   placeholder="نام متریال را تایپ کنید — همه مدل‌ها نمایش داده می‌شوند…"
                   value={matTxt}
                   onChange={(e) => { setMatTxt(e.target.value); setRows([]); }}
@@ -550,7 +565,7 @@ export function ChangeInventoryPage() {
           {type === "PURCHASE" && (
             <div className="grid gap-3 md:grid-cols-2">
               <div className="field md:col-span-2">
-                <label>متریال *</label>
+                <label className="text-xs font-semibold text-muted">متریال *</label>
                 <Combobox
                   value={matTxt}
                   items={data.lookup.materials.map((mm) => mm.name)}
@@ -567,7 +582,7 @@ export function ChangeInventoryPage() {
                 )}
               </div>
               <div className="field">
-                <label>برند *</label>
+                <label className="text-xs font-semibold text-muted">برند *</label>
                 <Combobox
                   value={brandTxt}
                   items={data.lookup.brands.map((b) => b.name)}
@@ -579,7 +594,7 @@ export function ChangeInventoryPage() {
                 />
               </div>
               <div className="field">
-                <label>واحد *</label>
+                <label className="text-xs font-semibold text-muted">واحد *</label>
                 <Combobox
                   value={unitTxt}
                   items={uniqueUnits(data.lookup.units).map((u) => u.name_fa || u.code)}
@@ -591,17 +606,17 @@ export function ChangeInventoryPage() {
                 />
               </div>
               <div className="field">
-                <label>تعداد *</label>
+                <label className="text-xs font-semibold text-muted">تعداد *</label>
                 <input
                   inputMode="decimal"
-                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-sm ltr"
+                  className="h-9 w-full rounded-lg border border-line bg-panel px-3 text-xs sm:text-sm ltr"
                   placeholder="مثلاً ۲۰۰"
                   value={qty}
                   onChange={(e) => setQty(e.target.value)}
                 />
               </div>
               <div className="field">
-                <label>تاریخ و زمان (شمسی)</label>
+                <label className="text-xs font-semibold text-muted">تاریخ و زمان (شمسی)</label>
                 <JalaliDatePicker
                   value={dateInput}
                   onChange={(iso) => setDateInput(iso ?? new Date().toISOString())}
@@ -610,7 +625,7 @@ export function ChangeInventoryPage() {
                 />
               </div>
               <div className="field md:col-span-2">
-                <label>مشخصه‌های فنی *</label>
+                <label className="text-xs font-semibold text-muted">مشخصه‌های فنی *</label>
                 <MultiSelectCombobox
                   values={specsChips}
                   onChange={setSpecsChips}
@@ -619,9 +634,9 @@ export function ChangeInventoryPage() {
                 />
               </div>
               <div className="field md:col-span-2">
-                <label>یادداشت</label>
+                <label className="text-xs font-semibold text-muted">یادداشت</label>
                 <textarea
-                  className="w-full rounded-lg border border-line bg-panel px-3 py-2 text-sm"
+                  className="w-full rounded-lg border border-line bg-panel px-3 py-2 text-xs sm:text-sm"
                   placeholder="شماره فاکتور، تأمین‌کننده، توضیحات…"
                   value={note}
                   onChange={(e) => setNote(e.target.value)}
@@ -647,12 +662,10 @@ export function ChangeInventoryPage() {
             />
           )}
 
-          {/* برگشت — برداشت‌های امروز */}
           {type === "RETURN" && (
             <ReturnTable rows={rows} setRows={setRows} txs={todayWithdrawals} whId={whId} matTxt={matTxt} unitNameFn={(id) => unitName(data.lookup.units, id)} />
           )}
 
-          {/* انتقال */}
           {type === "TRANSFER" && (
             <RowTable
               isCount={false}
@@ -669,7 +682,6 @@ export function ChangeInventoryPage() {
             />
           )}
 
-          {/* پیدا شده — مفقودی‌ها (با سقف: پیدا شده ≤ مانده‌ی مفقودی) */}
           {type === "FOUND" && (
             <FoundTable
               rows={rows}
@@ -681,13 +693,13 @@ export function ChangeInventoryPage() {
           )}
 
           {/* دکمه ثبت */}
-          <div className="mt-4 flex items-center justify-between border-t border-line pt-3">
-            <span className="text-[12px] text-muted">👤 ثبت با نام: <b>{user?.display_name}</b></span>
+          <div className="mt-4 flex flex-col-reverse sm:flex-row items-center justify-between gap-3 border-t border-line pt-3">
+            <span className="text-[11.5px] text-muted">👤 ثبت با نام: <b>{user?.display_name}</b></span>
             <button
               type="button"
               disabled={!canSubmit() || busy}
               onClick={doSubmit}
-              className="rounded-lg px-5 py-2 text-[13px] font-bold text-white disabled:opacity-40"
+              className="w-full sm:w-auto rounded-lg px-5 py-2.5 text-xs sm:text-[13px] font-bold text-white disabled:opacity-40 shadow-xs transition-transform active:scale-95"
               style={{ background: meta.color }}
             >
               ✓ {busy ? "در حال ثبت…" : meta.label === "انتقال" ? "ثبت انتقال" : meta.label === "برگشت" ? "ثبت برگشت" : meta.label === "پیدا شده" ? "ثبت پیدا شدن" : `ثبت ${meta.label}`}
@@ -695,10 +707,10 @@ export function ChangeInventoryPage() {
           </div>
         </div>
 
-        {/* مودال تأیید شمارش موجودی (اختلاف قبل از ثبت) */}
+        {/* مودال تأیید شمارش موجودی */}
         {countConfirm && (
           <div className="fixed inset-0 z-50 flex items-center justify-center bg-ink/40 p-4" onClick={() => !countBusy && setCountConfirm(null)}>
-            <div className="w-full max-w-lg rounded-xl border border-line bg-panel p-5 shadow-xl" onClick={(e) => e.stopPropagation()}>
+            <div className="w-full max-w-lg rounded-xl border border-line bg-panel p-4 sm:p-5 shadow-xl" onClick={(e) => e.stopPropagation()}>
               <h3 className="mb-1 text-[14px] font-bold">🔍 تأیید شمارش موجودی</h3>
               <p className="mb-3 text-[11.5px] leading-5 text-muted">
                 موجودی هر ردیف به «تعداد شمارش‌شده» اصلاح می‌شود و اختلاف (کسری/مازاد) ثبت خواهد شد.
@@ -767,7 +779,6 @@ export function ChangeInventoryPage() {
 }
 
 function RowTable({ isCount, rows, setRows, records, unitNameFn, emptyMsg }: {
-
   isCount: boolean;
   rows: RowDraft[];
   setRows: (r: RowDraft[]) => void;
@@ -778,7 +789,7 @@ function RowTable({ isCount, rows, setRows, records, unitNameFn, emptyMsg }: {
   if (emptyMsg) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">{emptyMsg}</div>;
   return (
     <div className="overflow-x-auto">
-      <table className="w-full text-[12.5px]">
+      <table className="w-full text-[12.5px] min-w-[500px]">
         <thead>
           <tr className="border-b border-line text-right text-muted">
             <th className="py-2 pe-3">مشخصه‌ها</th>
@@ -792,22 +803,22 @@ function RowTable({ isCount, rows, setRows, records, unitNameFn, emptyMsg }: {
         <tbody>
           {records.map((r, i) => (
             <tr key={r.id} className="border-b border-line/50">
-              <td className="py-1.5 pe-3 text-muted">{Object.entries(r.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
-              <td className="py-1.5 pe-3">{r.brand?.name || "—"}</td>
-              <td className="py-1.5 pe-3">{unitNameFn(r.unit?.id)}</td>
-              <td className="py-1.5 pe-3 font-bold">{faNum(r.quantity_number)}</td>
-              <td className="py-1.5 pe-3">
+              <td className="py-2 pe-3 text-muted">{Object.entries(r.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
+              <td className="py-2 pe-3">{r.brand?.name || "—"}</td>
+              <td className="py-2 pe-3">{unitNameFn(r.unit?.id)}</td>
+              <td className="py-2 pe-3 font-bold">{faNum(r.quantity_number)}</td>
+              <td className="py-2 pe-3">
                 <input
                   inputMode="decimal"
-                  className="h-7 w-24 rounded-lg border border-line bg-panel px-2 text-sm ltr"
+                  className="h-8 w-24 rounded-lg border border-line bg-panel px-2 text-sm ltr"
                   placeholder={isCount ? "شمارش‌شده" : "۰"}
                   value={isCount && rows[i]?.qty === "" ? String(r.quantity_number) : (rows[i]?.qty || "")}
                   onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, qty: e.target.value } : x)))}
                 />
               </td>
-              <td className="py-1.5">
+              <td className="py-2">
                 <input
-                  className="h-7 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
+                  className="h-8 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
                   placeholder="توضیح (اختیاری)"
                   value={rows[i]?.note || ""}
                   onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, note: e.target.value } : x)))}
@@ -817,7 +828,7 @@ function RowTable({ isCount, rows, setRows, records, unitNameFn, emptyMsg }: {
           ))}
         </tbody>
       </table>
-      <div className="mt-1 text-[11.5px] text-muted">ستون «موجودی فعلی» مقدار موجود هر رکورد است. برای هر ردیف تعداد و یادداشت (در صورت نیاز) وارد کنید.</div>
+      <div className="mt-2 text-[11px] text-muted">ستون «موجودی فعلی» مقدار موجود هر رکورد است. برای هر ردیف تعداد و یادداشت وارد کنید.</div>
     </div>
   );
 }
@@ -831,10 +842,10 @@ function ReturnTable({ rows, setRows, txs, whId, matTxt, unitNameFn }: {
   unitNameFn: (id: number | null | undefined) => string;
 }) {
   if (!whId || !matTxt.trim()) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">برای مشاهده برداشت‌های امروز، انبار و نام متریال را وارد کنید.</div>;
-  if (!txs.length) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">امروز برداشتی برای این متریال در انبار انتخابی ثبت نشده است — چیزی برای برگشت وجود ندارد.</div>;
+  if (!txs.length) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">امروز برداشتی برای این متریال در انبار انتخابی ثبت نشده است.</div>;
   return (
     <div className="overflow-x-auto">
-      <table className="w-full text-[12.5px]">
+      <table className="w-full text-[12.5px] min-w-[500px]">
         <thead>
           <tr className="border-b border-line text-right text-muted">
             <th className="py-2 pe-3">مشخصه‌ها</th>
@@ -848,22 +859,22 @@ function ReturnTable({ rows, setRows, txs, whId, matTxt, unitNameFn }: {
         <tbody>
           {txs.map((t, i) => (
             <tr key={t.inventory_id + i} className="border-b border-line/50">
-              <td className="py-1.5 pe-3 text-muted">{Object.entries(t.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
-              <td className="py-1.5 pe-3">{t.brand?.name || "—"}</td>
-              <td className="py-1.5 pe-3">{unitNameFn(t.unit?.id)}</td>
-              <td className="py-1.5 pe-3 font-bold">{faNum(Math.abs(t.quantity_number || 0))}</td>
-              <td className="py-1.5 pe-3">
+              <td className="py-2 pe-3 text-muted">{Object.entries(t.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
+              <td className="py-2 pe-3">{t.brand?.name || "—"}</td>
+              <td className="py-2 pe-3">{unitNameFn(t.unit?.id)}</td>
+              <td className="py-2 pe-3 font-bold">{faNum(Math.abs(t.quantity_number || 0))}</td>
+              <td className="py-2 pe-3">
                 <input
                   inputMode="decimal"
-                  className="h-7 w-24 rounded-lg border border-line bg-panel px-2 text-sm ltr"
+                  className="h-8 w-24 rounded-lg border border-line bg-panel px-2 text-sm ltr"
                   placeholder="۰"
                   value={rows[i]?.qty || ""}
                   onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, qty: e.target.value } : x)))}
                 />
               </td>
-              <td className="py-1.5">
+              <td className="py-2">
                 <input
-                  className="h-7 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
+                  className="h-8 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
                   placeholder="توضیح برگشت"
                   value={rows[i]?.note || ""}
                   onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, note: e.target.value } : x)))}
@@ -885,17 +896,17 @@ function FoundTable({ rows, setRows, items, whId, unitNameFn }: {
   unitNameFn: (id: number | null | undefined) => string;
 }) {
   if (!whId) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">ابتدا انبار را انتخاب کنید.</div>;
-  if (!items.length) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">مفقودی ثبت‌نشده‌ای (یا کاملاً پیداشده) در این انبار وجود ندارد.</div>;
+  if (!items.length) return <div className="rounded-lg border border-dashed border-line p-4 text-[12.5px] text-muted">مفقودی ثبت‌نشده‌ای در این انبار وجود ندارد.</div>;
   return (
     <div className="overflow-x-auto">
-      <table className="w-full text-[12.5px]">
+      <table className="w-full text-[12.5px] min-w-[550px]">
         <thead>
           <tr className="border-b border-line text-right text-muted">
             <th className="py-2 pe-3">متریال</th>
             <th className="py-2 pe-3">مشخصه‌ها</th>
             <th className="py-2 pe-3">برند</th>
             <th className="py-2 pe-3">واحد</th>
-            <th className="py-2 pe-3">مانده‌ی مفقودی</th>
+            <th className="py-2 pe-3">مانده مفقودی</th>
             <th className="py-2 pe-3">تعداد پیداشده</th>
             <th className="py-2">یادداشت</th>
           </tr>
@@ -906,28 +917,26 @@ function FoundTable({ rows, setRows, items, whId, unitNameFn }: {
             const over = entered > remaining;
             return (
               <tr key={t.inventory_id + i} className={`border-b border-line/50 ${over ? "bg-rose-50/40" : ""}`}>
-                <td className="py-1.5 pe-3 font-semibold">{t.material?.name || "—"}</td>
-                <td className="py-1.5 pe-3 text-muted">{Object.entries(t.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
-                <td className="py-1.5 pe-3">{t.brand?.name || "—"}</td>
-                <td className="py-1.5 pe-3">{unitNameFn(t.unit?.id)}</td>
-                <td className="py-1.5 pe-3 font-bold text-rose-600">{faNum(remaining)}</td>
-                <td className="py-1.5 pe-3">
+                <td className="py-2 pe-3 font-semibold">{t.material?.name || "—"}</td>
+                <td className="py-2 pe-3 text-muted">{Object.entries(t.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ") || "—"}</td>
+                <td className="py-2 pe-3">{t.brand?.name || "—"}</td>
+                <td className="py-2 pe-3">{unitNameFn(t.unit?.id)}</td>
+                <td className="py-2 pe-3 font-bold text-rose-600">{faNum(remaining)}</td>
+                <td className="py-2 pe-3">
                   <input
                     inputMode="decimal"
-                    className={`h-7 w-24 rounded-lg border bg-panel px-2 text-sm ltr ${over ? "border-red-500 bg-rose-50 text-rose-700" : "border-line"}`}
+                    className={`h-8 w-24 rounded-lg border bg-panel px-2 text-sm ltr ${over ? "border-red-500 bg-rose-50 text-rose-700" : "border-line"}`}
                     placeholder="۰"
                     value={rows[i]?.qty || ""}
                     onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, qty: e.target.value } : x)))}
                   />
                   {over && (
-                    <div className="mt-0.5 text-[10.5px] font-bold text-rose-700">
-                      تعداد پیداشده نمی‌تواند بیشتر از مقدار مفقودی باشد.
-                    </div>
+                    <div className="mt-0.5 text-[10px] font-bold text-rose-700">بیشتر از مفقودی!</div>
                   )}
                 </td>
-                <td className="py-1.5">
+                <td className="py-2">
                   <input
-                    className="h-7 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
+                    className="h-8 w-32 rounded-lg border border-line bg-panel px-2 text-sm"
                     placeholder="توضیح"
                     value={rows[i]?.note || ""}
                     onChange={(e) => setRows(rows.map((x, xi) => (xi === i ? { ...x, note: e.target.value } : x)))}
@@ -942,8 +951,7 @@ function FoundTable({ rows, setRows, items, whId, unitNameFn }: {
   );
 }
 
-// تبدیل اعداد فارسی/اعشاری برای اعتبارسنجی نمایشی (بدون ارسال)
 function parseNumLocal(s: string): number {
   const v = parseFloat(String(s).replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d))).replace(/[،,]/g, ""));
   return isFinite(v) ? v : 0;
-}
+}

frontend/src/pages/Inventory/InventoryPage.tsx

@@ -1,10 +1,8 @@
 import { useMemo, useState } from "react";
 import { Link, useLocation, useSearchParams } from "react-router-dom";
-import { Plus, Warehouse as WarehouseIcon, SlidersHorizontal, ArrowUpDown, X } from "lucide-react";
+import { Plus, Warehouse as WarehouseIcon, SlidersHorizontal, ArrowUpDown, X, ChevronDown } from "lucide-react";
 import { Header, PageLayout } from "../../components/layout/Header";
 import { EmptyState } from "../../components/EmptyState";
-import { Badge } from "../../components/ui/badge";
-import { Button } from "../../components/ui/button";
 import { useAuthStore } from "../../store/auth";
 import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
 import { inventorySubheader } from "./panelMenu";
@@ -15,7 +13,7 @@ import { faNum } from "../../lib/formatters";
 import { isoToJalaliStr } from "../../lib/jalali";
 import { cn } from "../../lib/utils";
 
-// رنگ‌بندی معنایی: سبز زمردی = ورود/افزایش، رز = خروج/کاهش، آبی = خنثی/جابه‌جایی
+// رنگ‌بندی معنایی تراکنش‌ها
 const TX_META: Record<TransactionType, { label: string; color: string; icon: string }> = {
   PURCHASE: { label: "خرید", color: "#10b981", icon: "🛒" },
   WITHDRAWAL: { label: "برداشت", color: "#e11d48", icon: "➖" },
@@ -149,34 +147,23 @@ export function InventoryPage() {
   }
 
   return (
-    <div className="min-h-screen pb-20 md:pb-6">
+    <div className="min-h-screen pb-24 md:pb-6 overflow-x-hidden">
       <Header
         title="سامانه مدیریت انبار"
         sub={inventorySubheader(user)}
         icon={<WarehouseIcon className="h-4.5 w-4.5" strokeWidth={2} />}
         menu={<AppSwitcherMenu activeModule="warehouse" canSwitchToProcurement={isAdmin} />}
         actions={
-          <div className="flex items-center gap-2">
-            {/* تب‌های تکراری در موبایل مخفی و فقط در دسکتاپ نمایش داده می‌شوند */}
-            <div className="hidden md:flex items-center gap-2">
-              <InventoryTopNav pathname={location.pathname} variant={isAdmin ? "admin" : "pm"} />
-            </div>
-            {isPM && (
-              <Button asChild variant="primary" className="h-8 px-2.5 text-xs">
-                <Link to="/inventory/change" className="no-underline">
-                  <Plus className="h-3.5 w-3.5" />
-                  <span>تغییر موجودی</span>
-                </Link>
-              </Button>
-            )}
+          <div className="hidden md:flex items-center gap-2">
+            <InventoryTopNav pathname={location.pathname} variant={isAdmin ? "admin" : "pm"} />
           </div>
         }
       />
-      <PageLayout className="flex flex-col gap-3 px-3 md:px-6">
-        {/* نوار فیلتر و جستجوی واکنش‌گرا */}
-        <div className="rounded-xl border border-line bg-panel p-2.5 sm:p-3">
-          <div className="flex items-center gap-2">
-            <div className="relative flex-1">
+      <PageLayout className="flex flex-col gap-3 px-3 md:px-6 w-full max-w-full">
+        {/* جعبه فیلترها و جستجو */}
+        <div className="rounded-xl border border-line bg-panel p-2.5 sm:p-3 w-full shadow-2xs">
+          <div className="flex items-center gap-2 w-full">
+            <div className="relative flex-1 min-w-0">
               <input
                 className="h-9 w-full rounded-lg border border-line bg-bg/50 px-3 text-xs focus:border-accent focus:bg-panel focus:outline-none"
                 placeholder="جستجوی نام متریال…"
@@ -198,8 +185,10 @@ export function InventoryPage() {
               type="button"
               onClick={() => setShowMobileFilters((s) => !s)}
               className={cn(
-                "inline-flex h-9 items-center gap-1.5 rounded-lg border px-2.5 text-xs font-medium transition-colors md:hidden",
-                hasFilter ? "border-accent bg-accent/10 text-accent font-bold" : "border-line bg-panel text-ink hover:bg-bg"
+                "inline-flex shrink-0 h-9 items-center gap-1.5 rounded-lg border px-2.5 text-xs font-medium transition-colors",
+                showMobileFilters || hasFilter
+                  ? "border-accent bg-accent/10 text-accent font-bold"
+                  : "border-line bg-panel text-ink hover:bg-bg"
               )}
             >
               <SlidersHorizontal className="h-3.5 w-3.5" />
@@ -210,7 +199,7 @@ export function InventoryPage() {
             <button
               type="button"
               className={cn(
-                "inline-flex h-9 items-center gap-1 rounded-lg border px-2.5 text-xs transition-colors",
+                "inline-flex shrink-0 h-9 items-center gap-1 rounded-lg border px-2.5 text-xs transition-colors",
                 sort ? "border-accent bg-accent/5 text-accent font-semibold" : "border-line bg-panel text-ink hover:bg-bg"
               )}
               onClick={() => setSort((s) => (s === "" ? "asc" : s === "asc" ? "desc" : ""))}
@@ -221,83 +210,186 @@ export function InventoryPage() {
                 {sort === "asc" ? "تعداد: صعودی" : sort === "desc" ? "تعداد: نزولی" : "مرتب‌سازی"}
               </span>
             </button>
-
-            <Badge variant="outline" className="hidden sm:inline-flex h-9 items-center px-2.5 text-xs">
-              {faNum(groups.length)} قلم
-            </Badge>
           </div>
 
-          {/* گزینه‌های فیلتر پیشرفته: در موبایل با دکمه باز می‌شود و در دسکتاپ همیشه باز است */}
-          <div
-            className={cn(
-              "mt-3 grid grid-cols-1 gap-2.5 border-t border-line/60 pt-3 sm:grid-cols-2 md:flex md:flex-wrap md:items-end",
-              !showMobileFilters && "hidden md:flex"
-            )}
-          >
-            <div className="field flex-1 min-w-[140px]">
-              <label className="text-[11px] font-semibold text-muted">دسته‌بندی</label>
-              <select
-                className="h-8 w-full rounded-lg border border-line bg-panel px-2 text-xs"
-                value={filters.category}
-                onChange={(e) => setFilters((f) => ({ ...f, category: e.target.value, material: "" }))}
-              >
-                <option value="">همه دسته‌بندی‌ها</option>
-                {lookup.categories.map((c) => (
-                  <option key={c.id} value={c.id}>{c.name}</option>
-                ))}
-              </select>
-            </div>
-
-            {isAdmin && (
-              <div className="field flex-1 min-w-[140px]">
-                <label className="text-[11px] font-semibold text-muted">پروژه</label>
-                <select
-                  className="h-8 w-full rounded-lg border border-line bg-panel px-2 text-xs"
-                  value={filters.project}
-                  onChange={(e) => setFilters((f) => ({ ...f, project: e.target.value, warehouse: "", material: "" }))}
-                >
-                  <option value="">همه پروژه‌ها</option>
-                  {lookup.projects.map((p) => (
-                    <option key={p.id} value={p.id}>{p.name}</option>
-                  ))}
-                </select>
-              </div>
-            )}
-
-            <div className="field flex-1 min-w-[140px]">
-              <label className="text-[11px] font-semibold text-muted">انبار</label>
-              <select
-                className="h-8 w-full rounded-lg border border-line bg-panel px-2 text-xs"
-                value={filters.warehouse}
-                onChange={(e) => setFilters((f) => ({ ...f, warehouse: e.target.value, material: "" }))}
-              >
-                <option value="">همه انبارها</option>
-                {visibleWarehouses.map((w) => (
-                  <option key={w.id} value={w.id}>
-                    {w.name}{isAdmin ? ` — ${lookup.projects.find((p) => p.id === w.project_id)?.name || ""}` : ""}
-                  </option>
-                ))}
-              </select>
-            </div>
-
-            {hasFilter && (
+          {/* فیلتر سریع انبارها (چیپ‌های افقی لمسی) */}
+          {visibleWarehouses.length > 1 && (
+            <div className="mt-2.5 flex items-center gap-1.5 overflow-x-auto pb-1 pt-0.5 [scrollbar-width:none]">
               <button
                 type="button"
-                className="h-8 rounded-lg border border-red/30 bg-red/5 px-3 text-xs text-red hover:bg-red/10 transition-colors"
-                onClick={() => setFilters({ category: "", warehouse: "", material: "", project: "" })}
+                onClick={() => setFilters((f) => ({ ...f, warehouse: "" }))}
+                className={cn(
+                  "shrink-0 rounded-lg px-2.5 py-1 text-xs font-medium transition-colors",
+                  !filters.warehouse
+                    ? "bg-accent text-white shadow-xs font-bold"
+                    : "border border-line bg-bg/40 text-muted hover:bg-panel hover:text-ink"
+                )}
               >
-                ✕ پاک کردن فیلترها
+                همه انبارها
               </button>
-            )}
-
-            <div className="text-[11px] text-muted ms-auto sm:hidden">
-              نمایش {faNum(groups.length)} قلم کالا
+              {visibleWarehouses.map((w) => (
+                <button
+                  key={w.id}
+                  type="button"
+                  onClick={() => setFilters((f) => ({ ...f, warehouse: f.warehouse === w.id ? "" : w.id }))}
+                  className={cn(
+                    "shrink-0 rounded-lg px-2.5 py-1 text-xs font-medium transition-colors",
+                    filters.warehouse === w.id
+                      ? "bg-accent text-white shadow-xs font-bold"
+                      : "border border-line bg-bg/40 text-muted hover:bg-panel hover:text-ink"
+                  )}
+                >
+                  {w.name}
+                </button>
+              ))}
             </div>
-          </div>
+          )}
+
+          {/* فیلترهای پیشرفته — برچسب‌های لمسی بدون سلکت و بدون بیرون‌زدگی */}
+          {showMobileFilters && (
+            <div className="mt-2.5 border-t border-line/60 pt-2.5 flex flex-col gap-2.5">
+              {/* دسته‌بندی‌ها */}
+              <div>
+                <div className="mb-1.5 text-[11px] font-bold text-muted">دسته‌بندی متریال:</div>
+                <div className="flex flex-wrap gap-1.5">
+                  <button
+                    type="button"
+                    onClick={() => setFilters((f) => ({ ...f, category: "" }))}
+                    className={cn(
+                      "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
+                      !filters.category
+                        ? "bg-accent text-white font-bold"
+                        : "border border-line bg-bg/40 text-ink hover:bg-panel"
+                    )}
+                  >
+                    همه دسته‌بندی‌ها
+                  </button>
+                  {lookup.categories.map((c) => (
+                    <button
+                      key={c.id}
+                      type="button"
+                      onClick={() => setFilters((f) => ({ ...f, category: f.category === c.id ? "" : c.id }))}
+                      className={cn(
+                        "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
+                        filters.category === c.id
+                          ? "bg-accent text-white font-bold"
+                          : "border border-line bg-bg/40 text-ink hover:bg-panel"
+                      )}
+                    >
+                      {c.name}
+                    </button>
+                  ))}
+                </div>
+              </div>
+
+              {/* پروژه‌ها (مخصوص ادمین) */}
+              {isAdmin && lookup.projects.length > 0 && (
+                <div>
+                  <div className="mb-1.5 text-[11px] font-bold text-muted">پروژه:</div>
+                  <div className="flex flex-wrap gap-1.5">
+                    <button
+                      type="button"
+                      onClick={() => setFilters((f) => ({ ...f, project: "" }))}
+                      className={cn(
+                        "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
+                        !filters.project
+                          ? "bg-accent text-white font-bold"
+                          : "border border-line bg-bg/40 text-ink hover:bg-panel"
+                      )}
+                    >
+                      همه پروژه‌ها
+                    </button>
+                    {lookup.projects.map((p) => (
+                      <button
+                        key={p.id}
+                        type="button"
+                        onClick={() => setFilters((f) => ({ ...f, project: f.project === p.id ? "" : p.id }))}
+                        className={cn(
+                          "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
+                          filters.project === p.id
+                            ? "bg-accent text-white font-bold"
+                            : "border border-line bg-bg/40 text-ink hover:bg-panel"
+                        )}
+                      >
+                        {p.name}
+                      </button>
+                    ))}
+                  </div>
+                </div>
+              )}
+
+              {/* دکمه پاک کردن فیلترها */}
+              {hasFilter && (
+                <div className="pt-1 flex items-center justify-between">
+                  <button
+                    type="button"
+                    className="text-xs text-red font-medium hover:underline inline-flex items-center gap-1"
+                    onClick={() => setFilters({ category: "", warehouse: "", material: "", project: "" })}
+                  >
+                    <X className="h-3 w-3" />
+                    پاک کردن فیلترها
+                  </button>
+                  <span className="text-[11px] text-muted">
+                    نمایش {faNum(groups.length)} قلم کالا
+                  </span>
+                </div>
+              )}
+            </div>
+          )}
         </div>
 
-        {/* جدول موجودی انبار با اسکرول افقی محافظت‌شده */}
-        <div className="overflow-x-auto rounded-xl border border-line bg-panel shadow-2xs [scrollbar-width:thin]">
+        {/* ۱. نمای مخصوص موبایل: کارت‌های عمودی کاملاً ریسپانسیو */}
+        <div className="flex flex-col gap-2.5 md:hidden w-full">
+          {!groups.length ? (
+            <div className="rounded-xl border border-line bg-panel p-4">
+              <EmptyState emoji="📋" text="هیچ رکورد موجودی‌ای مطابق فیلترهای انتخابی یافت نشد." />
+            </div>
+          ) : (
+            groups.map((g) => {
+              const isExp = expandedKey === g.key;
+              const matCat = lookup.materials.find((m) => m.id === g.matId)?.category;
+              return (
+                <InventoryMobileCard
+                  key={g.key}
+                  g={g}
+                  isExp={isExp}
+                  isAdmin={isAdmin}
+                  matName={materialName(lookup.materials, g.matId)}
+                  matCatName={matCat ? catName(lookup.categories, matCat.id) : "—"}
+                  wh={whName(warehouses, g.whId)}
+                  projName={lookup.projects.find((p) => p.id === warehouses.find((w) => w.id === g.whId)?.project_id)?.name || ""}
+                  unit={unitName(lookup.units, g.unitId)}
+                  onToggle={() => {
+                    setExpandedKey(isExp ? null : g.key);
+                    setSelTx(null);
+                    setExpBrand(null);
+                  }}
+                  timeline={
+                    isExp ? (
+                      <Timeline
+                        g={g}
+                        txs={groupTxs(g)}
+                        allTxs={transactions}
+                        brandTxs={brandTxs}
+                        selTx={selTx}
+                        setSelTx={setSelTx}
+                        expBrand={expBrand}
+                        setExpBrand={setExpBrand}
+                        matName={materialName(lookup.materials, g.matId)}
+                        unit={unitName(lookup.units, g.unitId)}
+                        brandNameFn={(id) => brandName(lookup.brands, id)}
+                        whNameFn={(id) => whName(warehouses, id)}
+                      />
+                    ) : null
+                  }
+                />
+              );
+            })
+          )}
+        </div>
+
+        {/* ۲. نمای دسکتاپ: جدول سنتی */}
+        <div className="hidden md:block overflow-x-auto rounded-xl border border-line bg-panel shadow-2xs [scrollbar-width:thin]">
           {!groups.length ? (
             <EmptyState emoji="📋" text="هیچ رکورد موجودی‌ای مطابق فیلترهای انتخابی یافت نشد." />
           ) : (
@@ -360,12 +452,124 @@ export function InventoryPage() {
             </table>
           )}
         </div>
-
-        {/* متن راهنما فقط در دسکتاپ نمایش داده می‌شود */}
-        <div className="hidden md:block text-[11px] text-muted">
-          ۱۰ نوع تراکنش استاندارد • سبز زمردی = ورود به انبار · رز = خروج/کاهش · آبی = انتقال و شمارش • کلیک روی هر سطر: خط زمانی با «مانده» لحظه‌به‌لحظه و تفکیک برندها
-        </div>
       </PageLayout>
+
+      {/* دکمه شناور تغییر موجودی */}
+      {isPM && (
+        <Link
+          to="/inventory/change"
+          className="fixed bottom-20 left-5 z-40 flex h-14 w-14 items-center justify-center rounded-full bg-blue-600 text-white shadow-xl shadow-blue-600/40 transition-all duration-200 hover:bg-blue-700 hover:scale-105 active:scale-90 md:bottom-8 md:left-8"
+          title="تغییر موجودی"
+          aria-label="تغییر موجودی"
+        >
+          <Plus className="h-7 w-7" strokeWidth={2.5} />
+        </Link>
+      )}
+    </div>
+  );
+}
+
+// کامپوننت کارت انبار در موبایل
+function InventoryMobileCard({
+  g,
+  isExp,
+  isAdmin,
+  matName,
+  matCatName,
+  wh,
+  projName,
+  unit,
+  onToggle,
+  timeline,
+}: {
+  g: Group;
+  isExp: boolean;
+  isAdmin: boolean;
+  matName: string;
+  matCatName: string;
+  wh: string;
+  projName: string;
+  unit: string;
+  onToggle: () => void;
+  timeline: React.ReactNode;
+}) {
+  const specsText = Object.entries(g.specs || {}).map(([k, v]) => `${k}: ${v}`).join(" · ");
+
+  return (
+    <div
+      className={cn(
+        "overflow-hidden rounded-xl border bg-panel transition-all shadow-2xs w-full",
+        isExp ? "border-accent/60 ring-1 ring-accent/20" : "border-line hover:border-line/80"
+      )}
+    >
+      <div onClick={onToggle} className="cursor-pointer p-3 active:bg-bg/40 transition-colors">
+        <div className="flex items-start justify-between gap-2">
+          <div className="min-w-0 flex-1">
+            <h3 className="text-[13.5px] font-bold leading-snug text-ink break-words">
+              {matName}
+            </h3>
+            {matCatName !== "—" && (
+              <span className="mt-0.5 inline-block text-[11px] text-muted">
+                {matCatName}
+              </span>
+            )}
+          </div>
+          <div
+            className={cn(
+              "flex h-7 w-7 shrink-0 items-center justify-center rounded-lg bg-bg text-muted transition-transform duration-200",
+              isExp && "rotate-180 bg-accent/10 text-accent"
+            )}
+          >
+            <ChevronDown className="h-4 w-4" />
+          </div>
+        </div>
+
+        {/* کادر شاخص موجودی و انبار */}
+        <div className="my-2.5 flex items-center justify-between gap-3 rounded-lg border border-line/60 bg-bg/50 p-2.5">
+          <div className="flex flex-col">
+            <span className="text-[10px] font-semibold text-muted">موجودی انبار</span>
+            <div className="flex items-baseline gap-1 pt-0.5">
+              <span className="text-lg font-black tabular-nums text-ink">
+                {faNum(g.qty)}
+              </span>
+              <span className="text-[11px] font-medium text-muted">{unit}</span>
+            </div>
+          </div>
+
+          <div className="flex flex-col items-end text-end min-w-0">
+            <span className="text-[10px] font-semibold text-muted">محل نگهداری</span>
+            <div className="flex items-center gap-1 text-xs font-bold text-accent truncate pt-0.5">
+              <WarehouseIcon className="h-3.5 w-3.5 shrink-0" />
+              <span className="truncate">{wh}</span>
+            </div>
+            {isAdmin && projName && (
+              <span className="truncate text-[10px] text-muted max-w-[130px]">{projName}</span>
+            )}
+          </div>
+        </div>
+
+        {/* مشخصات فنی و تاریخ */}
+        <div className="flex items-center justify-between gap-2 text-[10.5px] text-muted pt-0.5">
+          <div className="min-w-0 flex-1 truncate">
+            {specsText ? (
+              <span className="rounded bg-bg px-1.5 py-0.5 text-[10px] font-medium text-ink">
+                {specsText}
+              </span>
+            ) : (
+              <span className="text-muted/60">—</span>
+            )}
+          </div>
+          <span className="shrink-0 tabular-nums">
+            {isoToJalaliStr(g.updatedAt)}
+          </span>
+        </div>
+      </div>
+
+      {isExp && (
+        <div className="border-t border-line/70 bg-accent-bg/10 p-3">
+          {timeline}
+        </div>
+      )}
     </div>
   );
 }

frontend/src/pages/Suppliers/PurchaseHistory.tsx

@@ -112,28 +112,28 @@ export function PurchaseHistory({ supplier, quotes, materials }: PurchaseHistory
               ) : (
                 <>
                   {profs.map((pf) => (
-                    <a
+                    <button
                       key={"pf-" + pf.id}
+                      type="button"
                       className="detail-link"
-                      href={api.files.downloadUrl(q.id, "proforma", pf.id!)}
-                      download={pf.name}
                       title="دانلود پیش‌فاکتور"
+                      onClick={() => api.files.download(q.id, "proforma", pf.id!, pf.name)}
                     >
                       <Paperclip className="me-1 inline h-3 w-3" />
                       پیش‌فاکتور: {pf.name}
-                    </a>
+                    </button>
                   ))}
                   {invs.map((inv) => (
-                    <a
+                    <button
                       key={"inv-" + inv.id}
+                      type="button"
                       className="detail-link"
-                      href={api.files.downloadUrl(q.id, "invoice", inv.id!)}
-                      download={inv.name}
                       title="دانلود فاکتور"
+                      onClick={() => api.files.download(q.id, "invoice", inv.id!, inv.name)}
                     >
                       <Paperclip className="me-1 inline h-3 w-3" />
                       فاکتور: {inv.name}
-                    </a>
+                    </button>
                   ))}
                   {!loading && !profs.length && !invs.length && (
                     <span className="ph-attach-loading">فاکتوری ثبت نشده</span>

frontend/src/pages/Wizard/Step1TopicSupplier.tsx

@@ -103,7 +103,7 @@ export function Step1TopicSupplier({
               ))
             )}
           </div>
-          <div className={cn("field max-w-md", invalid && "invalid")}>
+          <div data-field="supplier_id" className={cn("field max-w-md", invalid && "invalid")}>
             <label>یا نام تأمین‌کننده را تایپ و انتخاب کنید</label>
             <Combobox
               value={supplierName}

frontend/src/pages/Wizard/Step2LineItems.tsx

@@ -41,21 +41,30 @@ export function itemRowLabel(it: ItemDraft): string {
   return qtyPart ? `${name} -- ${qtyPart}` : name;
 }
 
-// نام پایه‌ی متریال از نامِ ذخیره‌شده
-function materialBaseName(name: string, brand: string, specs: string[]): string {
-  let base = (name || "").trim();
-  if (!base) return "";
-  if (brand) {
-    if (base.startsWith(brand)) base = base.slice(brand.length);
-    else if (base.includes(brand)) base = base.split(brand).join(" ");
+// نام پایه‌ی متریال از نامِ ذخیره‌شده.
+// متریال‌های جدید فقط نامِ خودِ متریال را در name دارند (برند در brand_ids و
+// مشخصه‌ها در attributes ذخیره می‌شوند) و دست‌نخورده برمی‌گردند. رکوردهای قدیمی
+// name را به شکل «برند + دسته + مشخصه» ذخیره کرده‌اند؛ آن قطعات جدا می‌شوند تا
+// نامِ پایه باقی بماند.
+function materialBaseName(name: string, brand: string, specs: string[], category = ""): string {
+  const fallback = (name || "").trim();
+  if (!fallback) return "";
+  let base = fallback;
+  // بلندترین قطعه اول حذف می‌شود تا حذف‌های جزئی، رشته را ناقص نکنند
+  const parts = [brand, category, ...specs]
+    .map((p) => (p || "").trim())
+    .filter(Boolean)
+    .sort((a, b) => b.length - a.length);
+  for (const p of parts) {
+    if (!base.includes(p)) continue;
+    const next = base.split(p).join(" ").replace(/\s+/g, " ").trim();
+    // اگر حذفِ این قطعه کلِ نام را خالی کند، یعنی همان نامِ متریال بوده — نگهش دار
+    if (!next) continue;
+    base = next;
   }
-  specs
-    .filter((s) => s && s.trim())
-    .forEach((s) => {
-      if (base.includes(s)) base = base.split(s).join(" ");
-    });
-  base = base.replace(/\s+/g, " ").trim();
-  return base || (name || "").trim();
+  // شکلِ قدیمیِ خراب می‌تواند فقط یک مشخصه باقی بگذارد؛ آن دیگر نامِ متریال نیست
+  if (parts.some((p) => p === base)) return fallback;
+  return base || fallback;
 }
 
 // مقادیر مجزای category/brand/spec داخل تاپیک
@@ -66,10 +75,10 @@ export function materialOptions(
   field: "cat" | "brand" | "spec",
   allItems: ItemDraft[] = [],
   apiBrands: string[] = [],
+  apiSpecs: string[] = [],
 ): string[] {
   let list = materials.filter((m) => topic && normalize(m.topic) === normalize(topic));
   const cat = item.cat.trim();
-  const brand = item.brand.trim();
 
   const fromRows = (sel: (it: ItemDraft) => string | string[]): string[] => {
     const out = new Set<string>();
@@ -87,15 +96,21 @@ export function materialOptions(
     fromRows((it) => it.cat).forEach((c) => base.add(c));
     return [...base].sort((a, b) => a.localeCompare(b, "fa"));
   }
-  if (cat) list = list.filter((m) => normalize(m.category) === normalize(cat));
   if (field === "brand") {
+    // برند سراسری است — مستقل از تاپیک و دسته
     const allBrands = new Set(materials.map((m) => m.brand).filter(Boolean));
     apiBrands.forEach((b) => b && allBrands.add(b));
     fromRows((it) => it.brand).forEach((b) => allBrands.add(b));
     return [...allBrands].sort((a, b) => a.localeCompare(b, "fa"));
   }
-  if (brand) list = list.filter((m) => normalize(m.brand) === normalize(brand));
-  const base = new Set(list.flatMap((m) => (m.specs || []).filter(Boolean)));
+  if (cat) list = list.filter((m) => normalize(m.category) === normalize(cat));
+  // مشخصه‌ها سراسری هستند: رجیستری attribute-definitions + مشخصه‌های همه‌ی
+  // متریال‌ها + مشخصه‌های تایپ‌شده در سایر ردیف‌ها. به تاپیک/دسته/برندِ قلمِ
+  // فعلی گره نمی‌خورند تا هنگام افزودن پیشنهاد جدید همیشه در دسترس باشند.
+  const base = new Set<string>();
+  apiSpecs.forEach((s) => s && base.add(s));
+  materials.forEach((m) => (m.specs || []).forEach((s) => s && base.add(s)));
+  list.forEach((m) => (m.specs || []).forEach((s) => s && base.add(s)));
   fromRows((it) => it.specs).forEach((s) => base.add(s));
   return [...base].sort((a, b) => a.localeCompare(b, "fa"));
 }
@@ -119,13 +134,14 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
   const allMaterialNames = useMemo(() => {
     const set = new Set<string>();
     materials.forEach((m) => {
-      const base = materialBaseName(m.name, m.brand, m.specs);
+      const base = materialBaseName(m.name, m.brand, m.specs, m.category);
       if (base) set.add(base);
     });
     return [...set].sort((a, b) => a.localeCompare(b, "fa"));
   }, [materials]);
 
   const [brandOptions, setBrandOptions] = useState<string[]>([]);
+  const [specOptions, setSpecOptions] = useState<string[]>([]);
 
   useEffect(() => {
     let alive = true;
@@ -141,6 +157,10 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
       .brandsList()
       .then((list) => alive && setBrandOptions(list.map((b) => b.name).filter(Boolean)))
       .catch(() => {});
+    void api
+      .specsList()
+      .then((list) => alive && setSpecOptions(list))
+      .catch(() => {});
     return () => { alive = false; };
   }, []);
 
@@ -201,7 +221,7 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
         <span>قیمت کل</span>
       </div>
 
-      <div className="flex flex-col gap-2">
+      <div data-field="line_items" className="flex flex-col gap-2">
         {items.map((it) => (
           <div key={it.tempId} className="item-row wizard-item-row items-center">
             <Combobox
@@ -231,7 +251,7 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
             <MultiSelectCombobox
               values={it.specs}
               onChange={(specs) => patch(it.tempId, { specs })}
-              options={materialOptions(materials, selectedTopic, it, "spec", items)}
+              options={materialOptions(materials, selectedTopic, it, "spec", items, [], specOptions)}
               placeholder="مشخصه"
               className="min-w-0"
             />

frontend/src/pages/Wizard/Step3Termsheets.tsx

@@ -47,7 +47,7 @@ export function Step3Termsheets({ cards, onCardsChange, items, coverage, onCover
       </h3>
       <div className="mb-3 text-[12px] text-muted" dangerouslySetInnerHTML={{ __html: 'هر <b>termsheet</b> یک روش پرداخت است (نقد، چک، اقساط...). داخل هر termsheet مشخص کنید کدام قلم‌ها را پوشش می‌دهد — یک termsheet می‌تواند چند قلم را بگیرد، و یک قلم هم می‌تواند زیر چند termsheet مختلف (مثلاً هم نقد هم چک) پیشنهاد شود.' }} />
 
-      <div className="flex flex-col gap-3">
+      <div data-field="termsheets" className="flex flex-col gap-3">
         {cards.map((card, idx) => (
           <TermsheetCard
             key={card.key}

frontend/src/pages/Wizard/Step4Projects.tsx

@@ -155,7 +155,7 @@ export function Step4Projects({ items, projects, assignment, onAssign, onUnassig
   };
 
   return (
-    <div>
+    <div data-field="project">
       <h3 className="mb-1 text-[15px] font-bold">
         <span className="me-1 inline-flex h-6 w-6 items-center justify-center rounded-full bg-accent text-[12px] font-bold text-white">۴</span>
         پروژه‌ها

frontend/src/pages/Wizard/Step5Review.tsx

@@ -55,18 +55,22 @@ export function Step5Review({
         تاریخ، یادداشت و بازبینی نهایی
       </h3>
 
-      <div className="grid max-w-2xl grid-cols-2 gap-3 max-md:grid-cols-1">
-        <div className="field">
+      <div className="grid max-w-2xl grid-cols-12 gap-3">
+        {/* تاریخ پیشنهاد: فضای بزرگتر (۷ ستون از ۱۲) به همراه ساعت */}
+        <div className="field col-span-7 [&>div]:w-full [&_input]:w-full" data-field="quote_date">
           <label>تاریخ پیشنهاد</label>
           <JalaliDatePicker value={quoteDate} onChange={onQuoteDate} placeholder="۱۴۰۳/۰۵/۱۲" withTime />
           <div className="hint">پیش‌فرض امروز</div>
         </div>
-        <div className="field">
+
+        {/* تاریخ انقضای پیشنهاد: فضای کوچکتر (۵ ستون از ۱۲) */}
+        <div className="field col-span-5 [&>div]:w-full [&_input]:w-full" data-field="expiry_date">
           <label>تاریخ انقضای پیشنهاد</label>
           <JalaliDatePicker value={expiryDate} onChange={onExpiryDate} placeholder="۱۴۰۳/۰۶/۱۲" />
           <div className="hint">تا چه زمانی این قیمت معتبر است؟</div>
         </div>
-        <div className="field col-span-2">
+
+        <div className="field col-span-12" data-field="notes">
           <label>یادداشت (اختیاری)</label>
           <textarea
             rows={2}
@@ -76,8 +80,9 @@ export function Step5Review({
             onChange={(e) => onNotes(e.target.value)}
           />
         </div>
-        <div className="field col-span-2">
-          <label className="mb-1.5 block text-xs font-medium text-gray-700">پیش‌فاکتور (اختیاری)</label>
+
+        <div className="field col-span-12" data-field="proforma">
+          <label>پیش‌فاکتور (اختیاری)</label>
           {proforma ? (
             /* وضعیت فایل انتخاب‌شده با دکمه حذف تمیز */
             <div className="flex items-center justify-between rounded-xl border border-gray-200 bg-gray-50/70 px-3 py-2 text-xs">

frontend/src/pages/Wizard/WizardPage.tsx

@@ -1,9 +1,10 @@
 import { useEffect, useMemo, useState } from "react";
+import { track } from "../../lib/analytics";
 import { Link, useNavigate, useSearchParams } from "react-router-dom";
 import { ChevronRight, ChevronLeft, Check } from "lucide-react";
 import { toast } from "sonner";
 import type { LineItem, Quote } from "../../lib/types";
-import { api, nextId } from "../../lib/api";
+import { api, ApiError, looksLikeUuid, nextId } from "../../lib/api";
 import {
   useAddMaterial,
   useAddProject,
@@ -118,6 +119,7 @@ export function WizardPage() {
   const goToStep = (n: number) => {
     setCurrentStep(n);
     setHighestVisited((h) => Math.max(h, n));
+    track("wizard_step", { step: n, direction: n > currentStep ? "forward" : "back" });
     window.scrollTo({ top: 0, behavior: "smooth" });
   };
 
@@ -125,16 +127,8 @@ export function WizardPage() {
     goToStep(currentStep + 1);
   };
 
-  const rememberMaterial = (rec: MaterialRec) => {
-    void addMaterial.mutateAsync({
-      id: nextId("m", materials),
-      name: [rec.brand, rec.category, ...rec.specs].filter(Boolean).join(" ") || "کالای جدید",
-      topic: rec.topic,
-      category: rec.category,
-      brand: rec.brand,
-      specs: rec.specs,
-      base_unit: "",
-    });
+  const rememberMaterial = (_rec: MaterialRec) => {
+    // رکوردهای متریال به همراه واحد و مشخصه‌ها در زمان ذخیره نهایی ساخته می‌شوند
   };
 
   // ---------- پروژه‌ها: از مجموعه + نام‌های قدیمی quoteها ----------
@@ -193,19 +187,72 @@ export function WizardPage() {
 
   // ---------- ذخیره ----------
   const doSave = async () => {
-    const sectionError = (step: number, title: string, err: unknown) => {
+    const resolveErrorTarget = (err: unknown): { step: number; field?: string } => {
+      let field = "";
+      let msg = "";
+      if (err instanceof ApiError) {
+        field = err.field || "";
+        msg = err.message || "";
+      } else if (err instanceof Error) {
+        msg = err.message || "";
+        if ("field" in err && typeof (err as any).field === "string") {
+          field = (err as any).field;
+        }
+      }
+
+      const combined = `${field} ${msg}`.toLowerCase();
+
+      // ۱. تأمین‌کننده
+      if (/supplier|تأمین|تامین/i.test(combined)) return { step: 1, field: "supplier_id" };
+
+      // ۲. اقلام / متریال / واحد / تعداد / قیمت
+      if (/line_item|material|canonical_unit|unit_id|quantity|متریال|واحد|قلم|تعداد/i.test(combined)) {
+        return { step: 2, field: field || "line_items" };
+      }
+
+      // ۳. شرایط پرداخت / termsheet / مراحل پرداخت / سررسید
+      if (/termsheet|item_termsheet|schedule_step|due_date|milestone|ترم|پرداخت|پوشش|سررسید/i.test(combined)) {
+        return { step: 3, field: field || "termsheets" };
+      }
+
+      // ۴. پروژه
+      if (/project|پروژه/i.test(combined)) return { step: 4, field: "project" };
+
+      // ۵. تاریخ‌ها، یادداشت، پیش‌فاکتور
+      if (/expiry_date|تاریخ انقضا/i.test(combined)) return { step: 5, field: "expiry_date" };
+      if (/quote_date|تاریخ پیشنهاد/i.test(combined)) return { step: 5, field: "quote_date" };
+      if (/proforma|پیش‌فاکتور/i.test(combined)) return { step: 5, field: "proforma" };
+      if (/notes|یادداشت/i.test(combined)) return { step: 5, field: "notes" };
+
+      return { step: 5, field };
+    };
+
+    const sectionError = (stepOrTarget: number | { step: number; field?: string }, title: string, err: unknown) => {
+      const target = typeof stepOrTarget === "number" ? { step: stepOrTarget } : stepOrTarget;
       const msg = err instanceof Error ? err.message : "خطای ناشناخته";
       toast.error(`${title}: ${msg}`, {
-        action: { label: "رفع خطا", onClick: () => goToStep(step) },
+        duration: 8000,
+        action: {
+          label: "رفع خطا",
+          onClick: () => {
+            goToStep(target.step);
+            setTimeout(() => {
+              const targetAttr = target.field ? `[data-field="${target.field}"]` : "";
+              const el = (targetAttr ? document.querySelector(targetAttr) : null) ||
+                document.querySelector(`[data-step="${target.step}"]`);
+              if (el instanceof HTMLElement) {
+                el.scrollIntoView({ behavior: "smooth", block: "center" });
+                const input = el.querySelector("input, textarea, select") as HTMLElement | null;
+                if (input) input.focus();
+                else el.focus?.();
+                el.classList.add("ring-2", "ring-red-500", "rounded-xl");
+                setTimeout(() => el.classList.remove("ring-2", "ring-red-500", "rounded-xl"), 3500);
+              }
+            }, 150);
+          },
+        },
       });
     };
-    const guessStep = (msg: string): number => {
-      if (/تأمین|تامین|supplier/i.test(msg)) return 1;
-      if (/متریال|واحد|قلم|خط آیتم|item|دسته/i.test(msg)) return 2;
-      if (/ترم|termsheet|پرداخت|پوشش/i.test(msg)) return 3;
-      if (/پروژه|project/i.test(msg)) return 4;
-      return 5;
-    };
 
     const name = supplierName.trim();
     let supplierId = "";
@@ -243,18 +290,26 @@ export function WizardPage() {
       const total = it.total;
       if (!cat && !brand && qty == null && price == null) continue;
 
-      const wantName = [brand, cat, ...specs].filter(Boolean).join(" ") || "کالای جدید";
-      let material = materials.find((m) => normalize(m.name) === normalize(wantName));
+      const wantName = (cat || brand || specs.join(" ") || "").trim() || "کالای جدید";
+      let material = materials.find((m) => looksLikeUuid(m.id) && normalize(m.name) === normalize(wantName));
       if (!material) {
         material = materials.find(
           (m) =>
+            looksLikeUuid(m.id) &&
             normalize(m.category) === normalize(cat) &&
             normalize(m.brand) === normalize(brand) &&
             specsKey(m.specs) === specsKey(specs),
         );
       }
+      // رکوردهای قدیمی name را به شکل «برند + دسته + مشخصه» ذخیره کرده‌اند؛
+      // تطبیق دوم بر اساس category/brand/specs انجام می‌شود تا آن‌ها هم پیدا شوند.
+      if (!material && cat) {
+        material = materials.find(
+          (m) => looksLikeUuid(m.id) && normalize(m.category) === normalize(cat) && normalize(m.brand) === normalize(brand),
+        );
+      }
       let materialId: string;
-      if (material) {
+      if (material && looksLikeUuid(material.id)) {
         materialId = material.id;
       } else {
         try {
@@ -265,7 +320,7 @@ export function WizardPage() {
             category: cat,
             brand,
             specs,
-            base_unit: unit,
+            base_unit: unit || "عدد",
           });
           materialId = created.id;
         } catch (err) {
@@ -352,10 +407,11 @@ export function WizardPage() {
         }
       }
       toast.success("پیشنهاد ذخیره شد.");
+      track("quote_submitted", { quote_id: created.id, items: lineItems.length });
       navigate("/");
     } catch (e) {
-      const msg = e instanceof Error ? e.message : "خطا در ذخیره پیشنهاد";
-      sectionError(guessStep(msg), "خطا در ثبت پیشنهاد", e);
+      const target = resolveErrorTarget(e);
+      sectionError(target, "خطا در ثبت پیشنهاد", e);
     }
   };
 
@@ -385,7 +441,7 @@ export function WizardPage() {
         <Stepper current={currentStep} highestVisited={highestVisited} completedSteps={completedSteps} onGoto={goToStep} />
 
         {currentStep === 1 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="1" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step1TopicSupplier
               selectedTopic={selectedTopic}
               onTopicSelect={(t) => {
@@ -409,12 +465,12 @@ export function WizardPage() {
           </div>
         )}
         {currentStep === 2 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="2" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step2LineItems items={items} onItemsChange={setItems} selectedTopic={selectedTopic} onRemember={rememberMaterial} />
           </div>
         )}
         {currentStep === 3 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="3" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step3Termsheets
               cards={cards}
               onCardsChange={setCards}
@@ -425,7 +481,7 @@ export function WizardPage() {
           </div>
         )}
         {currentStep === 4 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="4" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step4Projects
               items={items}
               projects={projectNames}
@@ -439,7 +495,7 @@ export function WizardPage() {
           </div>
         )}
         {currentStep === 5 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="5" className="rounded-xl border border-line bg-panel p-5 shadow-sm">
             <Step5Review
               quoteDate={quoteDate}
               onQuoteDate={setQuoteDate}

frontend/src/vite-env.d.ts

@@ -1 +1,10 @@
 /// <reference types="vite/client" />
+
+// Observability build-time configuration (empty = feature disabled)
+interface ImportMetaEnv {
+  readonly VITE_OPENPANEL_URL?: string;
+  readonly VITE_OPENPANEL_CLIENT_ID?: string;
+  readonly VITE_SENTRY_DSN?: string;
+  readonly VITE_ENABLE_DEV_LOGIN?: string;
+  readonly VITE_API_BASE_URL?: string;
+}

infra/deploy-webhook/README.md

@@ -0,0 +1,42 @@
+# Deploy webhook receiver (push-to-deploy, hardened)
+
+Every push to the `production` branch triggers a rebuild on the VPS through
+this receiver (host port 9000). The receiver must **verify the Gitea
+webhook signature** — an open deploy endpoint is effectively remote code
+execution on the production server.
+
+## VPS setup (one time)
+
+```bash
+# 1) Files live here:
+sudo mkdir -p /srv/erp && sudo chown $USER /srv/erp
+#    copy the repo to /srv/erp (the receiver runs docker compose in this dir)
+
+# 2) Secrets — add to /srv/erp/.env (git-ignored):
+#    GITEA_WEBHOOK_SECRET=<long random string>
+
+# 3) Install as a systemd service:
+sudo cp infra/deploy-webhook/erp-deploy-webhook.service /etc/systemd/system/
+#    adjust User= and paths inside, then:
+sudo systemctl daemon-reload
+sudo systemctl enable --now erp-deploy-webhook
+curl http://127.0.0.1:9000/ping   # → {"status":"ok"}
+```
+
+## Gitea webhook
+
+Repo → Settings → Webhooks → Add webhook → Gitea:
+
+- Target URL: `http://<server-ip>:9000/deploy`
+- Method: `POST` — Secret: same value as `GITEA_WEBHOOK_SECRET`
+- Trigger: Push Events, Branch filter: `production`
+
+## Behavior
+
+- Verifies `X-Gitea-Signature` (HMAC-SHA256) — rejects everything else with 401.
+- Only pushes to `refs/heads/production` deploy; other branches are acknowledged and ignored.
+- Deploys are serialized with a lock (concurrent pushes don't race).
+- Runs `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build` in `/srv/erp`.
+- After a successful build, polls the API `/health/ready` endpoint and logs
+  a failed post-deploy check (surfaced by the monitoring stack).
+- Logs to journald (`journalctl -u erp-deploy-webhook -f`).

infra/deploy-webhook/deploy_webhook.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Hardened Gitea push-to-deploy webhook receiver.
+
+Replaces an unverified "POST /deploy" endpoint. Runs on the VPS (host port
+9000 is reserved for it) and rebuilds the stack when a push to the
+production branch arrives — but ONLY after verifying the Gitea webhook
+signature (HMAC-SHA256 of the raw body with GITEA_WEBHOOK_SECRET).
+
+Why this matters: an unauthenticated deploy endpoint lets anyone on the
+internet restart/rebuild the production stack (and, if it shells out to a
+script, is effectively remote code execution).
+
+Setup on the VPS (see infra/deploy-webhook/README.md):
+
+    GITEA_WEBHOOK_SECRET=... DEPLOY_DIR=/srv/erp DEPLOY_BRANCH=production \
+        python3 deploy_webhook.py            # or run under systemd (provided)
+
+Gitea side: repo → Settings → Webhooks → Add webhook → Gitea
+    Target URL: http://<server>:9000/deploy
+    Method: POST, Secret: same value as GITEA_WEBHOOK_SECRET
+    Trigger on: Push Events, Branch filter: production
+
+Stdlib only — no dependencies to install.
+"""
+import hashlib
+import hmac
+import json
+import logging
+import os
+import subprocess
+import sys
+import time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+LISTEN_HOST = os.environ.get("WEBHOOK_LISTEN_HOST", "127.0.0.1")
+LISTEN_PORT = int(os.environ.get("WEBHOOK_PORT", "9000"))
+SECRET = os.environ.get("GITEA_WEBHOOK_SECRET", "")
+DEPLOY_DIR = os.environ.get("DEPLOY_DIR", "/srv/erp")
+DEPLOY_BRANCH = os.environ.get("DEPLOY_BRANCH", "production")
+# Post-deploy readiness gate: defaults to the public API host from .env
+# (both DEPLOY_HEALTH_URL and API_HOST live in the same EnvironmentFile).
+HEALTH_URL = (
+    os.environ.get("DEPLOY_HEALTH_URL")
+    or (f"https://{os.environ['API_HOST']}/health/ready" if os.environ.get("API_HOST") else "")
+)
+LOCK_FILE = os.environ.get("DEPLOY_LOCK", "/tmp/erp-deploy.lock")
+
+logging.basicConfig(
+    level=logging.INFO,
+    format="%(asctime)s %(levelname)s deploy-webhook — %(message)s",
+    handlers=[logging.StreamHandler(sys.stdout)],
+)
+log = logging.getLogger("deploy-webhook")
+
+# Compose file pair used in production (base + overlay).
+DEPLOY_CMD = os.environ.get(
+    "DEPLOY_CMD",
+    "docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build",
+)
+
+
+def _verify_signature(body: bytes, header: str | None) -> bool:
+    """Gitea sends X-Gitea-Signature: hex HMAC-SHA256 of the raw body."""
+    if not SECRET:
+        log.error("GITEA_WEBHOOK_SECRET is not set — refusing ALL requests")
+        return False
+    if not header:
+        return False
+    expected = hmac.new(SECRET.encode(), body, hashlib.sha256).hexdigest()
+    return hmac.compare_digest(expected, header.strip().lower())
+
+
+def _deploy() -> tuple[bool, str]:
+    """Run the rebuild. Serialized: concurrent pushes queue/drop, not race."""
+    if os.path.exists(LOCK_FILE):
+        age = time.time() - os.path.getmtime(LOCK_FILE)
+        if age < 1800:  # a deploy is already running (or crashed <30min ago)
+            return False, f"deploy already in progress (lock age {int(age)}s)"
+    try:
+        with open(LOCK_FILE, "w") as f:
+            f.write(str(os.getpid()))
+        log.info("deploy started: %s", DEPLOY_CMD)
+        proc = subprocess.run(
+            DEPLOY_CMD, shell=True, cwd=DEPLOY_DIR,
+            capture_output=True, text=True, timeout=1800,
+        )
+        tail = "\n".join((proc.stdout + proc.stderr).splitlines()[-40:])
+        ok = proc.returncode == 0
+        log.info("deploy finished rc=%s\n%s", proc.returncode, tail)
+        if ok and HEALTH_URL:
+            ok = _wait_healthy()
+        return ok, ("ok" if ok else "deploy or health check failed")
+    except subprocess.TimeoutExpired:
+        log.error("deploy timed out after 1800s")
+        return False, "deploy timed out"
+    except Exception as exc:
+        log.exception("deploy failed")
+        return False, str(exc)
+    finally:
+        try:
+            os.remove(LOCK_FILE)
+        except OSError:
+            pass
+
+
+def _wait_healthy(timeout: int = 180) -> bool:
+    """Poll the app's readiness endpoint after a rebuild."""
+    import urllib.request
+    log.info("waiting for %s", HEALTH_URL)
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        try:
+            with urllib.request.urlopen(HEALTH_URL, timeout=5) as resp:
+                if resp.status == 200:
+                    log.info("post-deploy health check: OK")
+                    return True
+        except Exception:
+            pass
+        time.sleep(5)
+    log.error("post-deploy health check FAILED after %ss", timeout)
+    return False
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        if self.path != "/deploy":
+            self._json(404, {"error": "not found"})
+            return
+        length = int(self.headers.get("Content-Length", "0"))
+        if length > 1_000_000:
+            self._json(413, {"error": "payload too large"})
+            return
+        body = self.rfile.read(length)
+        if not _verify_signature(body, self.headers.get("X-Gitea-Signature")):
+            log.warning("rejected request: bad/missing signature from %s", self.client_address[0])
+            self._json(401, {"error": "invalid signature"})
+            return
+        try:
+            payload = json.loads(body)
+            ref = payload.get("ref", "")
+            pushed = (payload.get("ref") or "").rsplit("/", 1)[-1]
+            if ref != f"refs/heads/{DEPLOY_BRANCH}":
+                log.info("ignoring push to %s (deploys trigger on %s only)", ref, DEPLOY_BRANCH)
+                self._json(200, {"status": "ignored", "ref": ref})
+                return
+            pusher = payload.get("pusher", {}).get("login", "unknown")
+            log.info("push to %s by %s — deploying", pushed, pusher)
+        except Exception:
+            log.exception("bad payload")
+            self._json(400, {"error": "bad payload"})
+            return
+        # Answer the webhook quickly; deploy runs detached from the response.
+        ok, msg = _deploy()
+        self._json(200 if ok else 500, {"status": "ok" if ok else "failed", "detail": msg})
+
+    def do_GET(self):
+        # Minimal liveness for the receiver itself (monitoring can scrape it).
+        if self.path == "/ping":
+            self._json(200, {"status": "ok", "branch": DEPLOY_BRANCH})
+            return
+        self._json(404, {"error": "not found"})
+
+    def _json(self, code: int, obj: dict):
+        data = json.dumps(obj).encode()
+        self.send_response(code)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def log_message(self, fmt, *args):  # route stdlib access logs to our logger
+        log.debug("access: " + fmt, *args)
+
+
+if __name__ == "__main__":
+    if not SECRET:
+        log.warning("starting WITHOUT signature verification is not supported — set GITEA_WEBHOOK_SECRET")
+        sys.exit(1)
+    server = ThreadingHTTPServer((LISTEN_HOST, LISTEN_PORT), Handler)
+    log.info("listening on %s:%s (branch=%s dir=%s)", LISTEN_HOST, LISTEN_PORT, DEPLOY_BRANCH, DEPLOY_DIR)
+    server.serve_forever()

infra/deploy-webhook/erp-deploy-webhook.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=ERP push-to-deploy webhook receiver (Gitea -> docker compose)
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+# Run as a dedicated non-root user with docker group membership:
+#   sudo useradd -r -s /usr/sbin/nologin erpdeploy && sudo usermod -aG docker erpdeploy
+#   sudo chown -R erpdeploy /srv/erp
+User=erpdeploy
+Group=erpdeploy
+WorkingDirectory=/srv/erp
+# EnvironmentFile carries GITEA_WEBHOOK_SECRET (same .env used by compose).
+EnvironmentFile=/srv/erp/.env
+ExecStart=/usr/bin/python3 /srv/erp/infra/deploy-webhook/deploy_webhook.py
+Restart=on-failure
+RestartSec=5
+# Minimal exposure: no write access outside /srv/erp, no new privileges.
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=/srv/erp /tmp
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target

infra/traefik-dynamic.yml

@@ -7,3 +7,31 @@ http:
       redirectScheme:
         scheme: https
         permanent: true
+
+    # Baseline security headers for every public router (attached in the
+    # prod overlay; local http://localhost stays untouched).
+    secure-headers:
+      headers:
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        contentTypeNosniff: true
+        referrerPolicy: strict-origin-when-cross-origin
+        customFrameOptionsValue: DENY
+        browserXssFilter: true
+        customResponseHeaders:
+          X-Powered-By: ""
+          Server: ""
+
+    # Edge rate limiting — coarse abuse brake for the API host
+    # (average 50 req/s sustained, burst 150). Fine-grained login limiting
+    # lives in the app (slowapi).
+    api-ratelimit:
+      rateLimit:
+        average: 50
+        burst: 150
+
+    # Cap request bodies at the edge (attachments are ≤5 MB per file;
+    # 12 MB leaves room for multipart overhead).
+    api-bodylimit:
+      buffering:
+        maxRequestBodyBytes: 12582912

monitoring/README.md

@@ -0,0 +1,124 @@
+# Monitoring & analytics stack
+
+What runs where, and why — the ERP gets the three missing observability
+layers on the same 8 GB VPS:
+
+| Layer | Tool | What it answers | Budget |
+|---|---|---|---|
+| Product analytics | **OpenPanel** (self-hosted) | Which features are used? Where do users drop out of the quote wizard? Funnel: login → wizard steps → quote submitted → accepted → received. Session replay **off** by design (heavy; revisit with sampling later) | ~1–1.5 GB |
+| Error tracking | **GlitchTip** (Sentry-compatible) | What broke, for whom, with which stack trace — frontend (ErrorBoundary + fetch errors) and backend (all unhandled exceptions) | ~750 MB |
+| Metrics + logs | **Prometheus + Grafana + Loki/Promtail + node/postgres-exporters + cAdvisor** | Request rate/latency/5xx, container RAM, Postgres connections, disk pressure; full container logs searchable in Grafana | ~1.4 GB |
+
+The monitoring compose is a **separate compose project** — push-to-deploy
+rebuilds of the app never restart monitoring containers.
+
+## First-time deployment (VPS)
+
+```bash
+cd /srv/erp   # the repo checkout used by the deploy webhook
+
+# 1) monitoring section of .env (see .env.example) — fill in real values:
+#    GLITCHTIP_SECRET_KEY, GLITCHTIP_DOMAIN/HOST, GLITCHTIP_DB_PASSWORD,
+#    GRAFANA_ADMIN_PASSWORD, POSTGRES_PASSWORD (already set), LOG_FORMAT=json
+
+# 2) the main compose gained a shared network — re-up once so it exists:
+docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+
+# 3) start monitoring:
+docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d
+
+# 4) GlitchTip is routed publicly through Traefik for the browser SDK:
+docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env \
+    --profile public up -d glitchtip
+```
+
+Admin UIs stay **loopback-only** (same posture as the MinIO console):
+
+```powershell
+ssh -L 3001:127.0.0.1:3001 -L 8001:127.0.0.1:8001 <user>@<server-host>
+# Grafana  → http://localhost:3001  (dashboards auto-provisioned)
+# GlitchTip → http://localhost:8001 (create the first admin on first open)
+```
+
+In GlitchTip: create an **organization → project** for the backend and one
+for the frontend, copy the DSNs into `/srv/erp/.env`
+(`SENTRY_DSN_BACKEND`, `SENTRY_DSN_FRONTEND`) and redeploy the app once.
+
+## Product analytics (OpenPanel)
+
+Deployed from the upstream self-hosting branch (kept outside this repo —
+it ships its own compose + update tooling):
+
+```bash
+cd /opt
+git clone -b self-hosting https://github.com/Openpanel-dev/openpanel.git
+cd openpanel/self-hosting
+./setup     # interactive
+./start
+```
+
+Then:
+
+1. Open the OpenPanel dashboard (expose it via Traefik on
+   `stats.bennu-api-bahrestan.ir` following its docs — add the container to
+   `traefik_network` and give the dashboard + its `/api` path labels),
+   create a project → copy the **client id / client secret**.
+2. Put them in `/srv/erp/.env`:
+   `OPENPANEL_API_URL` (in-network URL of its api service),
+   `OPENPANEL_CLIENT_ID`, `OPENPANEL_CLIENT_SECRET`, and
+   `OPENPANEL_PUBLIC_URL` (browser-facing origin) — then rebuild the app:
+   `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build api frontend`.
+
+What gets tracked automatically once configured:
+
+- **Frontend**: page views, `login_success`, `wizard_step` (funnel across
+  the 5 quote-wizard steps), `quote_submitted`, `user_identified`.
+- **Backend** (server-side, cannot be blocked by the browser):
+  `login_success`, `quote_offered/edited/accepted/arrived/expired/rejected`,
+  `receipt_confirmed` — see `backend/app/services/analytics.py`.
+
+Without the env vars everything is a no-op — the app never waits on
+analytics (3 s timeout, swallow-all).
+
+## Session replay
+
+Deliberately **off** (records full DOM of every session → storage + privacy
+costs; low value for a small internal team at launch). If wanted later:
+enable OpenPanel replay with **10–25% sampling** and review retention —
+budget +1 GB storage and re-check RAM headroom first.
+
+## Alerting
+
+`monitoring/prometheus/alerts.yml` defines: API down, 5xx > 5%, p95 > 2 s,
+root disk < 10%, host RAM < 10%, Postgres > 80 connections. They appear in
+Grafana alerting; wire a notification channel (email/Telegram) from the
+Grafana UI when ready.
+
+## Lean mode (if RAM gets tight)
+
+Drop prometheus+grafana+loki+promtail+cadvisor+node-exporter (~1.1 GB) and
+keep GlitchTip + OpenPanel only; add `uptime-kuma` (~100 MB) for
+up/down pings. The app keeps `/health/ready` either way — the deploy
+webhook uses it post-rebuild regardless of the metrics stack.
+
+## What the app exposes for this stack
+
+- `GET /health` — liveness (process up).
+- `GET /health/ready` — readiness: Postgres + MinIO + Casdoor checks.
+  Used by the deploy webhook after every rebuild.
+- `GET /metrics` — Prometheus format (unauthenticated, for scraping).
+- JSON request logs with `X-Request-ID` (set `LOG_FORMAT=json` in prod)
+  → shipped to Loki by Promtail.
+
+## Local runs (Docker Desktop)
+
+Start WITHOUT `--profile host-metrics` — node-exporter and cAdvisor need
+Linux rootfs mounts and will fail to start on Windows/macOS hosts:
+
+```bash
+docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d
+```
+
+Per-container and host metrics are absent locally; API metrics, Postgres
+metrics, logs, GlitchTip and Grafana all work the same. On the Linux VPS
+always include `--profile host-metrics`.

monitoring/docker-compose.monitoring.yml

@@ -0,0 +1,199 @@
+# ============================================================================
+# Monitoring stack — SEPARATE compose project from the ERP app on purpose:
+# app rebuilds (push-to-deploy) must never restart monitoring containers.
+#
+#   cd /srv/erp   # repo root, so --env-file picks up the app's .env
+#   docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d
+#
+# Included (≈2.2 GB RAM budgeted):
+#   GlitchTip (errors, Sentry-compatible) + its own small Postgres
+#   Prometheus (metrics) + Grafana (dashboards) + Loki/Promtail (logs)
+#   node-exporter (host) + postgres-exporter (app DB) + cAdvisor (containers)
+#
+# Admin UIs (Grafana :3001, GlitchTip :8001) bind to 127.0.0.1 only —
+# reach them via SSH tunnel exactly like the MinIO console. GlitchTip ALSO
+# needs a public origin for the browser SDK: set GLITCHTIP_HOST and enable
+# the "public" profile (Traefik route + TLS) — see monitoring/README.md.
+# ============================================================================
+
+services:
+  # ---------------------------------------------------------------- errors --
+  glitchtip:
+    image: glitchtip/glitchtip:latest  # pinned upstream: version tags are dated, keep an eye on updates
+    container_name: monitoring-glitchtip
+    mem_limit: 640m
+    environment:
+      SECRET_KEY: ${GLITCHTIP_SECRET_KEY:?set GLITCHTIP_SECRET_KEY in .env}
+      GLITCHTIP_DOMAIN: ${GLITCHTIP_DOMAIN:?set GLITCHTIP_DOMAIN in .env}
+      DATABASE_URL: postgres://glitchtip:${GLITCHTIP_DB_PASSWORD:-glitchtip}@glitchtip-postgres:5432/glitchtip
+      # Single-container mode (embedded worker) — no redis needed at this scale.
+      GLITCHTIP_EMBED_WORKER: "true"
+      VALKEY_URL: ""
+      ENABLE_USER_REGISTRATION: "false"
+      ENABLE_ORGANIZATION_CREATION: "false"
+      DEFAULT_FROM_EMAIL: ${GLITCHTIP_FROM_EMAIL:-noreply@bennu-api-bahrestan.ir}
+      EMAIL_URL: ${GLITCHTIP_EMAIL_URL:-consolemail://}
+    ports:
+      - "127.0.0.1:8001:8000"
+    depends_on:
+      glitchtip-postgres:
+        condition: service_healthy
+    networks:
+      - monitoring
+      - shared
+      - traefik # public DSN route (profile "public")
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.glitchtip.rule=Host(`${GLITCHTIP_HOST:-errors.localhost}`)
+      - traefik.http.routers.glitchtip.entrypoints=web
+      - traefik.http.services.glitchtip.loadbalancer.server.port=8000
+    restart: unless-stopped
+
+  glitchtip-postgres:
+    image: postgres:16-alpine
+    container_name: monitoring-glitchtip-postgres
+    mem_limit: 128m
+    environment:
+      POSTGRES_DB: glitchtip
+      POSTGRES_USER: glitchtip
+      POSTGRES_PASSWORD: ${GLITCHTIP_DB_PASSWORD:-glitchtip}
+    volumes:
+      - glitchtip_postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U glitchtip -d glitchtip"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+  # --------------------------------------------------------------- metrics --
+  prometheus:
+    image: prom/prometheus:v3.4.1
+    container_name: monitoring-prometheus
+    mem_limit: 512m
+    command:
+      - --config.file=/etc/prometheus/prometheus.yml
+      - --storage.tsdb.retention.time=14d
+      - --storage.tsdb.retention.size=2GB
+    volumes:
+      - ./prometheus:/etc/prometheus:ro
+      - prometheus_data:/prometheus
+    networks:
+      - monitoring
+      - shared
+    restart: unless-stopped
+
+  grafana:
+    image: grafana/grafana:11.6.3
+    container_name: monitoring-grafana
+    mem_limit: 256m
+    environment:
+      GF_SECURITY_ADMIN_USER: admin
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?set GRAFANA_ADMIN_PASSWORD in .env}
+      GF_USERS_ALLOW_SIGN_UP: "false"
+      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:-http://localhost:3001/}
+    volumes:
+      - grafana_data:/var/lib/grafana
+      - ./grafana/provisioning:/etc/grafana/provisioning:ro
+      - ./grafana/dashboards:/var/lib/grafana/dashboards:ro
+    ports:
+      - "127.0.0.1:3001:3000"
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+  # ------------------------------------------------------------------ logs --
+  loki:
+    image: grafana/loki:3.5.0
+    container_name: monitoring-loki
+    mem_limit: 384m
+    command: -config.file=/etc/loki/loki-config.yml
+    volumes:
+      - ./loki/loki-config.yml:/etc/loki/loki-config.yml:ro
+      - loki_data:/loki
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+  promtail:
+    image: grafana/promtail:3.5.0
+    container_name: monitoring-promtail
+    mem_limit: 64m
+    command: -config.file=/etc/promtail/promtail-config.yml
+    volumes:
+      - ./promtail/promtail-config.yml:/etc/promtail/promtail-config.yml:ro
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+  # -------------------------------------------------------------- exporters --
+  # Linux-host only (see cadvisor note): local runs skip it via the profile.
+  node-exporter:
+    image: prom/node-exporter:v1.9.1
+    container_name: monitoring-node-exporter
+    mem_limit: 32m
+    profiles: ["host-metrics"]
+    command:
+      - --path.rootfs=/host
+    volumes:
+      - /:/host:ro,rslave
+    pid: host
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+  postgres-exporter:
+    image: prometheuscommunity/postgres-exporter:v0.17.1
+    container_name: monitoring-postgres-exporter
+    mem_limit: 48m
+    environment:
+      # App database on the main stack's postgres (reaches it via erp_shared).
+      DATA_SOURCE_NAME: postgres://postgres:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/procurement?sslmode=disable
+    networks:
+      - monitoring
+      - shared
+    restart: unless-stopped
+
+  # Linux-host only: the rootfs bind mounts fail on Docker Desktop (Windows/macOS).
+  # VPS:   docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env \
+  #          --profile host-metrics up -d
+  # Local: started WITHOUT the profile — per-container metrics are simply absent.
+  cadvisor:
+    image: gcr.io/cadvisor/cadvisor:v0.49.1
+    container_name: monitoring-cadvisor
+    mem_limit: 128m
+    profiles: ["host-metrics"]
+    privileged: true
+    devices:
+      - /dev/kmsg
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /var/lib/docker/:/var/lib/docker:ro
+    networks:
+      - monitoring
+    restart: unless-stopped
+
+networks:
+  monitoring:
+    driver: bridge
+  # Reaches the ERP containers (api:8000/metrics, postgres:5432) — the main
+  # compose declares the same fixed-name network as "shared".
+  shared:
+    name: erp_shared
+    external: true
+  # Created by the main compose; required only for the public GlitchTip route.
+  traefik:
+    name: traefik_network
+    external: true
+
+volumes:
+  glitchtip_postgres_data:
+  prometheus_data:
+  grafana_data:
+  loki_data:

monitoring/grafana/dashboards/erp-overview.json

@@ -0,0 +1,159 @@
+{
+  "annotations": { "list": [] },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 1,
+  "links": [],
+  "liveNow": false,
+  "panels": [
+    {
+      "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+      "fieldConfig": {
+        "defaults": {
+          "custom": { "fillOpacity": 15, "lineWidth": 2, "showPoints": "never" },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 0 },
+      "id": 1,
+      "options": { "legend": { "calcs": ["mean", "max"], "displayMode": "table", "placement": "bottom" } },
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+          "expr": "sum by (status) (rate(http_requests_total{job=\"erp-api\"}[5m]))",
+          "legendFormat": "HTTP {{status}}"
+        }
+      ],
+      "title": "API — request rate by status",
+      "type": "timeseries"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+      "fieldConfig": {
+        "defaults": {
+          "custom": { "fillOpacity": 10, "lineWidth": 2, "showPoints": "never" },
+          "unit": "s",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              { "color": "green", "value": null },
+              { "color": "orange", "value": 1 },
+              { "color": "red", "value": 2 }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 0 },
+      "id": 2,
+      "options": { "legend": { "calcs": ["mean", "max"], "displayMode": "table", "placement": "bottom" } },
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+          "expr": "histogram_quantile(0.95, sum(rate(http_request_duration_seconds_bucket{job=\"erp-api\"}[5m])) by (le))",
+          "legendFormat": "p95"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+          "expr": "histogram_quantile(0.5, sum(rate(http_request_duration_seconds_bucket{job=\"erp-api\"}[5m])) by (le))",
+          "legendFormat": "p50"
+        }
+      ],
+      "title": "API — latency (p50 / p95)",
+      "type": "timeseries"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+      "fieldConfig": {
+        "defaults": {
+          "custom": { "fillOpacity": 15, "lineWidth": 2, "showPoints": "never" },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 8 },
+      "id": 3,
+      "options": { "legend": { "calcs": ["lastNotNull", "max"], "displayMode": "table", "placement": "bottom" } },
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+          "expr": "sum by (name) (container_memory_working_set_bytes{job=\"cadvisor\", name!=\"\", image!=\"\"})",
+          "legendFormat": "{{name}}"
+        }
+      ],
+      "title": "Containers — memory in use",
+      "type": "timeseries"
+    },
+    {
+      "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+      "fieldConfig": { "defaults": { "unit": "short" }, "overrides": [] },
+      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 8 },
+      "id": 4,
+      "options": { "legend": { "calcs": ["lastNotNull"], "displayMode": "table", "placement": "bottom" } },
+      "targets": [
+        {
+          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+          "expr": "sum(pg_stat_activity_count)",
+          "legendFormat": "postgres connections"
+        },
+        {
+          "datasource": { "type": "prometheus", "uid": "${DS_PROMETHEUS}" },
+          "expr": "node_memory_MemAvailable_bytes",
+          "legendFormat": "host RAM available"
+        }
+      ],
+      "title": "Database connections / host RAM",
+      "type": "timeseries"
+    },
+    {
+      "datasource": { "type": "loki", "uid": "${DS_LOKI}" },
+      "gridPos": { "h": 10, "w": 24, "x": 0, "y": 16 },
+      "id": 5,
+      "options": {
+        "sortOrder": "Descending",
+        "wrapLogMessage": true,
+        "showTime": true,
+        "enableLogDetails": true
+      },
+      "targets": [
+        {
+          "datasource": { "type": "loki", "uid": "${DS_LOKI}" },
+          "expr": "{compose_project=\"erp\"}",
+          "refId": "A"
+        }
+      ],
+      "title": "All ERP container logs (Loki)",
+      "type": "logs"
+    }
+  ],
+  "refresh": "30s",
+  "schemaVersion": 39,
+  "tags": ["erp"],
+  "templating": {
+    "list": [
+      {
+        "name": "DS_PROMETHEUS",
+        "label": "Prometheus",
+        "type": "datasource",
+        "query": "prometheus",
+        "hide": 2,
+        "current": { "text": "Prometheus", "value": "Prometheus" }
+      },
+      {
+        "name": "DS_LOKI",
+        "label": "Loki",
+        "type": "datasource",
+        "query": "loki",
+        "hide": 2,
+        "current": { "text": "Loki", "value": "Loki" }
+      }
+    ]
+  },
+  "time": { "from": "now-6h", "to": "now" },
+  "timepicker": {},
+  "timezone": "browser",
+  "title": "ERP — Stack overview",
+  "uid": "erp-overview",
+  "version": 1
+}

monitoring/grafana/provisioning/dashboards/dashboards.yml

@@ -0,0 +1,11 @@
+apiVersion: 1
+
+providers:
+  - name: erp-dashboards
+    orgId: 1
+    folder: ERP
+    type: file
+    disableDeletion: false
+    updateIntervalSeconds: 60
+    options:
+      path: /var/lib/grafana/dashboards

monitoring/grafana/provisioning/datasources/datasources.yml

@@ -0,0 +1,15 @@
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    type: prometheus
+    access: proxy
+    url: http://prometheus:9090
+    isDefault: true
+    editable: false
+
+  - name: Loki
+    type: loki
+    access: proxy
+    url: http://loki:3100
+    editable: false

monitoring/loki/loki-config.yml

@@ -0,0 +1,43 @@
+auth_enabled: false
+
+server:
+  http_listen_port: 3100
+
+common:
+  path_prefix: /loki
+  storage:
+    filesystem:
+      chunks_directory: /loki/chunks
+      rules_directory: /loki/rules
+  replication_factor: 1
+  ring:
+    kvstore:
+      store: inmemory
+
+schema_config:
+  configs:
+    - from: 2024-01-01
+      store: tsdb
+      object_store: filesystem
+      schema: v13
+      index:
+        prefix: index_
+        period: 24h
+
+limits_config:
+  # Keep the log store bounded — this box shares 8 GB RAM / limited disk.
+  retention_period: 14d
+  ingestion_rate_mb: 4
+  ingestion_burst_size_mb: 8
+  max_query_series: 500
+
+compactor:
+  working_directory: /loki/compactor
+  retention_enabled: true
+  delete_request_store: filesystem
+
+ruler:
+  storage:
+    type: local
+    local:
+      directory: /loki/rules

monitoring/prometheus/alerts.yml

@@ -0,0 +1,58 @@
+# Alert rules surfaced in Grafana's alerting UI (no Alertmanager needed at
+# this scale — Grafana can route them later via email/Telegram).
+groups:
+  - name: erp-availability
+    rules:
+      - alert: ErpApiDown
+        expr: up{job="erp-api"} == 0
+        for: 2m
+        labels:
+          severity: critical
+        annotations:
+          summary: "ERP API is not scraping (down or /metrics failing)"
+
+      - alert: ErpApiHighErrorRate
+        expr: |
+          sum(rate(http_requests_total{job="erp-api", status=~"5.."}[5m]))
+            / clamp_min(sum(rate(http_requests_total{job="erp-api"}[5m])), 0.001) > 0.05
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: "ERP API 5xx rate above 5% for 5 minutes"
+
+      - alert: ErpApiSlowRequests
+        expr: |
+          histogram_quantile(0.95,
+            sum(rate(http_request_duration_seconds_bucket{job="erp-api"}[5m])) by (le)) > 2
+        for: 10m
+        labels:
+          severity: warning
+        annotations:
+          summary: "ERP API p95 latency above 2s for 10 minutes"
+
+  - name: host
+    rules:
+      - alert: HostDiskAlmostFull
+        expr: (node_filesystem_avail_bytes{mountpoint="/", fstype!~"tmpfs|overlay"} / node_filesystem_size_bytes{mountpoint="/", fstype!~"tmpfs|overlay"}) < 0.1
+        for: 15m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Root filesystem below 10% free (deploy builds will fail)"
+
+      - alert: HostMemoryPressure
+        expr: node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes < 0.1
+        for: 10m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Host RAM below 10% available (check monitoring stack limits)"
+
+      - alert: PostgresTooManyConnections
+        expr: sum(pg_stat_activity_count) > 80
+        for: 10m
+        labels:
+          severity: warning
+        annotations:
+          summary: "PostgreSQL connection count above 80"

monitoring/prometheus/prometheus.yml

@@ -0,0 +1,34 @@
+global:
+  scrape_interval: 30s
+  evaluation_interval: 30s
+
+rule_files:
+  - /etc/prometheus/alerts.yml
+
+scrape_configs:
+  # The ERP API — /metrics is exposed by prometheus-fastapi-instrumentator
+  # (request rate, latency histogram, error counts). Reached over the
+  # erp_shared network the main compose also joins.
+  - job_name: erp-api
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["api:8000"]
+
+  # Host-level metrics (CPU, RAM, disk, network).
+  - job_name: node
+    static_configs:
+      - targets: ["node-exporter:9100"]
+
+  # Per-container metrics (CPU, memory, restarts) for every container.
+  - job_name: cadvisor
+    static_configs:
+      - targets: ["cadvisor:8080"]
+
+  # App database metrics (connections, cache hit ratio, WAL, ...).
+  - job_name: postgres
+    static_configs:
+      - targets: ["postgres-exporter:9187"]
+
+  - job_name: prometheus
+    static_configs:
+      - targets: ["localhost:9090"]

monitoring/promtail/promtail-config.yml

@@ -0,0 +1,40 @@
+# Ships every container's JSON logs to Loki (docker service discovery),
+# tagging streams with the compose project / service / container name so
+# logs are filterable in Grafana, e.g. {compose_service="api"}.
+server:
+  http_listen_port: 9080
+
+positions:
+  filename: /tmp/positions.yaml
+
+clients:
+  - url: http://loki:3100/loki/api/v1/push
+
+scrape_configs:
+  - job_name: docker
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+        refresh_interval: 30s
+        filters:
+          - name: label
+            values: ["com.docker.compose.service"]
+    relabel_configs:
+      - source_labels: ["__meta_docker_container_label_com_docker_compose_project"]
+        target_label: compose_project
+      - source_labels: ["__meta_docker_container_label_com_docker_compose_service"]
+        target_label: compose_service
+      - source_labels: ["__meta_docker_container_name"]
+        target_label: container
+    pipeline_stages:
+      - json:
+          expressions:
+            ts: time
+            stream: stream
+            log: log
+      - labels:
+          stream:
+      - timestamp:
+          source: ts
+          format: RFC3339Nano
+      - output:
+          source: log

sql/migration.sql

@@ -634,4 +634,15 @@ CREATE TRIGGER trg_item_decisions_sync_price
 -- double-applied. Arrival auto-posting (POST /pm/receipts) goes through
 -- the same service path and is idempotent via receipt_allocation_id.
 
+-- ---------- AUDIT LOG (general activity trail, v2.7) ----------
+CREATE TABLE IF NOT EXISTS audit_log (
+    id          UUID        NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+    occurred_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    actor       TEXT,
+    action      TEXT        NOT NULL,
+    entity      TEXT        NOT NULL,
+    entity_id   TEXT,
+    details     JSONB       NOT NULL DEFAULT '{}'
+);
+
 COMMIT;