feat: improve line items layout, number inputs and supplier click-to-call

Second half of the envelope fix: ITrackPayload is {name, properties, profileId} — sending
'event' is rejected with 400 "payload/name Invalid input: expected string", which the
module swallows by design. Verified against packages/validation/src/track.validation.ts
and the SDK's track(name, properties) signature.

.env.example

@@ -0,0 +1,71 @@
+# ============================================================
+# ERP stack configuration — copy to .env and fill in real values.
+# .env is git-ignored; NEVER commit real credentials.
+#   Local dev:      cp .env.example .env   (defaults work as-is)
+#   Production VPS: /srv/erp/.env with STRONG values for every entry —
+#                   docker-compose.prod.yml refuses to boot without them.
+# ============================================================
+
+# --- Public hosts (production; local defaults live in docker-compose.yml) ---
+APP_HOST=aramesh.bennu-api-bahrestan.ir
+API_HOST=api.bennu-api-bahrestan.ir
+AUTH_HOST=casdoor.bennu-api-bahrestan.ir
+S3_HOST=s3.bennu-api-bahrestan.ir
+STORAGE_HOST=storage.bennu-api-bahrestan.ir
+
+# --- Traefik / Let's Encrypt ---
+TRAEFIK_ACME_EMAIL=you@example.com
+
+# --- Environment: "prod" enables the fail-fast startup checks in the API ---
+ENVIRONMENT=prod
+
+# --- PostgreSQL (app + Casdoor share the instance) ---
+POSTGRES_PASSWORD=CHANGE_ME_strong_db_password
+
+# --- MinIO object storage root credentials ---
+MINIO_ROOT_USER=CHANGE_ME_minio_user
+MINIO_ROOT_PASSWORD=CHANGE_ME_long_random_minio_password
+
+# --- Casdoor OIDC application (must match the Casdoor application record) ---
+CASDOOR_CLIENT_SECRET=CHANGE_ME_casdoor_client_secret
+CASDOOR_ADMIN_PASSWORD=CHANGE_ME_casdoor_console_admin_password
+
+# --- CORS: exact browser origins allowed to call the API (comma-separated) ---
+CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir
+
+# --- Developer Mode (X-User-* header identity + login panel) ---
+# MUST stay false in production. Only for local debugging without tokens.
+DEV_LOGIN_ENABLED=false
+
+# --- Deploy webhook (Gitea push → rebuild; see infra/deploy-webhook/) ---
+GITEA_WEBHOOK_SECRET=CHANGE_ME_long_random_webhook_secret
+
+# --- Backups (db-backup sidecar; see docker-compose.yml) ---
+BACKUP_DIR=/srv/erp/backups
+BACKUP_INTERVAL_SECONDS=86400
+BACKUP_KEEP_DAYS=14
+
+# --- Monitoring stack (see monitoring/README.md) ---
+# API log format for Loki ingestion ("text" locally, "json" in production)
+LOG_FORMAT=json
+# GlitchTip (error tracking). GLITCHTIP_HOST must be a public DNS name —
+# the browser SDK posts errors there.
+GLITCHTIP_SECRET_KEY=CHANGE_ME_random_django_secret
+GLITCHTIP_DOMAIN=https://errors.bennu-api-bahrestan.ir
+GLITCHTIP_HOST=errors.bennu-api-bahrestan.ir
+GLITCHTIP_DB_PASSWORD=CHANGE_ME_glitchtip_db_password
+GLITCHTIP_FROM_EMAIL=noreply@bennu-api-bahrestan.ir
+GLITCHTIP_EMAIL_URL=consolemail://
+# Grafana (dashboards) — UI is loopback-only (:3001) unless you add Traefik labels
+GRAFANA_ADMIN_PASSWORD=CHANGE_ME_grafana_password
+GRAFANA_ROOT_URL=http://localhost:3001/
+# OpenPanel (product analytics) — client id/secret from the OpenPanel project
+OPENPANEL_API_URL=http://openpanel-api:3333
+OPENPANEL_CLIENT_ID=
+OPENPANEL_CLIENT_SECRET=
+# Public origin of the OpenPanel dashboard/API the BROWSER talks to
+# (e.g. https://stats.bennu-api-bahrestan.ir — see monitoring/README.md)
+OPENPANEL_PUBLIC_URL=
+# Sentry/GlitchTip DSNs created in the GlitchTip UI after first boot
+SENTRY_DSN_BACKEND=
+SENTRY_DSN_FRONTEND=

.gitignore

@@ -11,9 +11,19 @@ __pycache__/
 venv/
 
 # ---- Env / secrets ----
+# All credentials live in git-ignored .env files (server-side and local).
+# NEVER commit .env or database dumps — see docs/SECRET-MANAGEMENT.md.
+.env
+.env.*
+!*.env.example
+backend/.env
 frontend/.env
 *.local
 
+# ---- Database dumps (contain user rows + signing material) ----
+*.dump
+*.sql.gz
+
 # ---- Local session / backups ----
 .zcode/
 v1.2 - Copy/

README.md

@@ -105,8 +105,8 @@ for production builds).
 | What | Where | Credentials |
 |---|---|---|
 | App | http://localhost (via Traefik) | — |
-| Casdoor console | http://localhost:8080 | `admin` / `123` |
+| Casdoor console | http://localhost:8080 | admin credentials are set when you run the seeder (`CASDOOR_ADMIN_PW`) — never commit them |
-| Seeded app users (org `inventory`) | `razaei` (admin), `mousavi` (مدیر تدارکات), `mohaghegh` (مدیر پروژه), `tester` (مدیر پروژه، پروژه «تست») | password `123456` |
+| Seeded app users (org `inventory`) | `razaei` (admin), `mousavi` (مدیر تدارکات), `mohaghegh` (مدیر پروژه), `tester` (مدیر پروژه، پروژه «تست») | password from `CASDOOR_SEED_PASSWORD` (bcrypt-hashed at rest — see `backend/tools/seed_casdoor.py`) |
 
 Run `backend/tools/seed_casdoor.py` once after the first boot to create the
 Casdoor organization, application and users (idempotent). Full details —
@@ -143,7 +143,7 @@ is an SSH tunnel from your machine:
    use the panel):
 
    ```powershell
-   ssh -L 9001:127.0.0.1:9001 root@171.22.25.75
+   ssh -L 9001:127.0.0.1:9001 <user>@<server-host>
    ```
 
    You will also land in a normal SSH session — that is fine; the tunnel
@@ -151,18 +151,17 @@ is an SSH tunnel from your machine:
 
 2. In your browser, open: **http://localhost:9001**
 
-3. Log in with:
+3. Log in with the production MinIO root credentials from the server's
-
+   `/srv/erp/.env` (`MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD`) — they are
-   | Username | Password |
+   **never** written in this repo or its history. See
-   |---|---|
+   [`docs/SECRET-MANAGEMENT.md`](docs/SECRET-MANAGEMENT.md).
-   | `aramesh-minio` | `feb10fadb5441019dfc33bf12a9b0f74e7b6c478` |
 
 You will see the **`procurement-files`** bucket — the invoices/proformas the
 ERP stores, browsable and downloadable from there.
 
-⚠️ These credentials are **full admin access to the file storage**. Treat
+⚠️ Those credentials are **full admin access to the file storage**. They live
-them as a production secret (this README is inside the repo, so anyone with
+only in the server-side `.env`; if one ever leaks, rotate it immediately
-repo access can read them — rotate them on the server if they ever leak).
+(checklist in `docs/SECRET-MANAGEMENT.md`).
 
 Close the PowerShell window (or `Ctrl+C`) when you are done to drop the
 tunnel.
@@ -215,15 +214,23 @@ All should show `Up` (postgres also `(healthy)`).
 | Frontend UI | http://localhost |
 | API docs (Swagger) | http://localhost:8000/docs |
 | API health | http://localhost:8000/health → `{"status":"ok","service":"procurement-api"}` |
+| API readiness (DB + MinIO + Casdoor) | http://localhost:8000/health/ready |
+| Metrics | http://localhost:8000/metrics |
 | MinIO console | http://localhost:9001 (user/pass `minioadmin`/`minioadmin`) |
 | Database | `localhost:5433`, db `procurement`, user/pass `postgres`/`postgres` (Casdoor uses the same instance, db `casdoor`) |
 
-Quick end-to-end check (Traefik → frontend proxy → API → DB):
+Automated end-to-end checks (authenticates via `SMOKE_USER` /
+`SMOKE_PASSWORD` — the seeder users):
 
 ```powershell
-curl http://localhost/api/v1/quotes?expand=supplier,project,line_items,termsheets,events,decision,receipt
+backend\tools\smoke_test.py   # read paths
+backend\tools\smoke_test_write.py / smoke_test_misc.py
 ```
 
+> Every API route now requires a Casdoor JWT — a bare
+> `curl http://localhost/api/v1/quotes` returns **401** by design.
+> Day-2 operations (deploys, backups, monitoring): [`docs/OPERATIONS.md`](docs/OPERATIONS.md).
+
 ---
 
 ## MinIO (object storage for invoice / proforma files)
@@ -262,47 +269,33 @@ docker exec -it procurement-postgres psql -U postgres -d procurement
 
 ---
 
-## Restoring the committed seed data
+## Recovery / seeding
 
-The databases are **not** in git — Docker volumes hold the data. The repo
+The databases are **not** in git — Docker volumes hold the data, and
-ships recovery dumps in `backups/علی محقق/`:
+database dumps must never be committed (they contain user rows and signing
+material). Two supported ways to bring a fresh stack up:
 
-| File | Contents |
+1. **Empty boot** — schema v2.6 auto-applies on the first boot of an empty
-|---|---|
+   `postgres_data` volume; then run the seeders:
-| `casdoor.dump` | Casdoor schema + console admin (`admin` / `123`), org `inventory`, app `inventory-app`, the JWT signing cert, and the single org user `ali.mohaghegh` |
-| `procurement.dump` | Procurement schema + the single `users` row «علی محقق» with role `admin`; all other tables empty (categories/units re-seed at API startup) |
 
-⚠️ This **replaces all data** in the `procurement` and `casdoor` databases.
-On a running stack:
-
-```powershell
-docker compose stop api casdoor
-docker cp "backups/علی محقق/procurement.dump" procurement-postgres:/tmp/
-docker cp "backups/علی محقق/casdoor.dump" procurement-postgres:/tmp/
-docker exec procurement-postgres pg_restore -U postgres -d procurement --clean --if-exists /tmp/procurement.dump
-docker exec procurement-postgres pg_restore -U postgres -d casdoor    --clean --if-exists /tmp/casdoor.dump
-docker compose start casdoor api
-```
-
-Login afterwards: `ali.mohaghegh` / `hulkfuck002` (Casdoor rejects spaces
-in usernames, so «ali mohaghegh» is not a valid login name).
-
-Want demo data instead? Two seeders are still available (they create
-different users — see the Login table above):
-
-1. **App seeder** (realistic demo dataset; keeps the Casdoor org as-is):
    ```powershell
+   # Casdoor org + app + users (prints/generates credentials — do not commit them)
+   docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
+   # Demo dataset (optional):
    docker exec procurement-api sh -c "cd /srv/backend && python -m tools.seed"
    ```
-2. **Casdoor seeder** (creates org `inventory` + app + users razaei /
+
-   mousavi / mohaghegh / tester — run once after a fresh volume):
+2. **Restore your own dump** — create dumps on the server (kept server-side,
+   e.g. `/srv/erp/backups/`), never in git:
+
    ```powershell
-   python backend/tools/seed_casdoor.py   # from the host, or from the api container
+   docker exec procurement-postgres pg_dump -U postgres -d procurement -Fc > /srv/erp/backups/procurement-$(date +%F).dump
+   docker exec procurement-postgres pg_dump -U postgres -d casdoor    -Fc > /srv/erp/backups/casdoor-$(date +%F).dump
    ```
 
-To create a fresh dump of your own current state: stop `api` + `casdoor`,
+   Restore with `pg_restore --clean --if-exists` (stop `api` + `casdoor`
-`docker exec procurement-postgres pg_dump -U postgres -d procurement -Fc`
+   first — this **replaces all data**). The scheduled backup sidecar
-(+ the `casdoor` DB) into `backups/`, then start them again.
+   (see `docs/OPERATIONS.md`) automates this.
 
 ## Common operations
 
@@ -317,10 +310,11 @@ docker compose down -v              # ⚠️ full reset — wipes DB + MinIO vol
 
 ## Known behavior
 
-- Authentication is Casdoor-based (JWT verified via JWKS): `/auth`, `/users`,
+- Authentication is Casdoor-based (JWT verified via JWKS) and **required on
-  `/inventory` and `/pm` are protected (401 without a token, 403 without a role).
+  every API route** except `/health`, `/health/ready` and `/auth/login`
-  The procurement CRUD endpoints (quotes, suppliers, materials, …) are still
+  (401 without a token, 403 without a role). The former dev-header fallback
-  open — dev placeholder, do not expose to the public internet.
+  (`X-User-Role` / `X-User-Name-B64`) is disabled unless
+  `PROCUREMENT_DEV_LOGIN_ENABLED=true` — never enable it in production.
 - Roles live in the app's `users` table (Casdoor is identity-only): `pm`,
   `procurement_manager`, `admin`. Role changes are **admin-only** (RBAC);
   the procurement manager can only assign projects to project managers.

backend/app/auth.py

@@ -26,7 +26,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import settings
-from app.db.engine import get_db
+from app.db.engine import AsyncSessionLocal
 from app.models.procurement import Project, User
 from app.utils.errors import (
     ForbiddenError,
@@ -170,11 +170,16 @@ async def pm_project_ids(db: AsyncSession, user: User) -> list:
     return list(rows)
 
 
-async def get_optional_user(request: Request, db: AsyncSession) -> UserContext | None:
+async def get_optional_user(request: Request, db: AsyncSession | None = None) -> UserContext | None:
     """Resolve the caller from the Casdoor Bearer token, or None when absent.
 
     Raises UnauthorizedError for a present-but-invalid token; callers decide
     their own fallback only for the no-token case (e.g. dev headers).
+
+    IMPORTANT: when ``db`` is omitted (pure auth-dependency usage), a
+    short-lived session of its own is used — querying the REQUEST session
+    here would auto-begin its transaction and break endpoints that open
+    explicit ``async with db.begin()`` blocks afterwards.
     """
     auth = request.headers.get("authorization", "")
     if not auth.lower().startswith("bearer "):
@@ -182,13 +187,22 @@ async def get_optional_user(request: Request, db: AsyncSession) -> UserContext |
     token = auth.split(" ", 1)[1].strip()
     if not token:
         return None
+    if db is None:
+        async with AsyncSessionLocal() as own_session:
+            claims = await _verify_token(token)
+            return await context_from_claims(claims, own_session)
     claims = await _verify_token(token)
     return await context_from_claims(claims, db)
 
 
-async def get_current_user(request: Request, db: AsyncSession = Depends(get_db)) -> UserContext:
+async def get_current_user(request: Request) -> UserContext:
-    """Require a valid Casdoor token (401 missing/invalid; 403 unprovisioned)."""
+    """Require a valid Casdoor token (401 missing/invalid; 403 unprovisioned).
-    ctx = await get_optional_user(request, db)
+
+    Resolves the user in its own session (see get_optional_user) so the
+    global auth dependency never interferes with an endpoint's explicit
+    transaction handling.
+    """
+    ctx = await get_optional_user(request)
     if ctx is None:
         raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
     if ctx.role is None:

backend/app/config.py

@@ -1,7 +1,14 @@
 """Application configuration.
 
 All settings can be overridden with environment variables prefixed with
-``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env`` file.
+``PROCUREMENT_`` (e.g. ``PROCUREMENT_DATABASE_URL=...``) or a local ``.env``
+file. The docker-compose files inject them from the git-ignored ``.env`` —
+real credentials never live in this repository.
+
+``ENVIRONMENT`` is the safety switch: when it is ``"prod"``, the API runs
+fail-fast startup checks (see app.main._verify_production_settings) that
+refuse to boot with wildcard CORS, default credentials or dev login
+enabled.
 """
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -14,7 +21,10 @@ class Settings(BaseSettings):
         extra="ignore",
     )
 
-    # PostgreSQL DSN — the schema (migration.sql + seed.sql) must already exist.
+    # "dev" (local defaults allowed) | "prod" (fail-fast checks on startup).
+    ENVIRONMENT: str = "dev"
+
+    # PostgreSQL DSN — the schema (migration.sql) must already exist.
     DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@localhost:5432/procurement"
 
     # Echo SQL statements to the console (dev aid).
@@ -22,6 +32,8 @@ class Settings(BaseSettings):
 
     # MinIO object storage — invoice / proforma attachments (S3-compatible).
     # Endpoint is the compose service name (`minio:9000`) inside Docker.
+    # Defaults are LOCAL DEV ONLY — production values come from .env and the
+    # prod startup checks reject them.
     MINIO_ENDPOINT: str = "localhost:9000"
     MINIO_ACCESS_KEY: str = "minioadmin"
     MINIO_SECRET_KEY: str = "minioadmin"
@@ -36,27 +48,54 @@ class Settings(BaseSettings):
     DEFAULT_PAGE_SIZE: int = 20
     MAX_PAGE_SIZE: int = 100
 
-    # CORS (dev-friendly default; the frontend is a static site).
+    # CORS — comma-separated exact browser origins (NOT "*" with
-    CORS_ORIGINS: list[str] = ["*"]
+    # credentials; the prod checks reject wildcard). Example:
+    # PROCUREMENT_CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir
+    CORS_ORIGINS: str = "http://localhost,http://localhost:3000,http://localhost:5173"
+
+    # Developer Mode: in-page dev login panel (frontend build arg) AND the
+    # X-User-Role / X-User-Name-B64 header identity fallback in the
+    # inventory/pm routers. MUST stay false in production.
+    DEV_LOGIN_ENABLED: bool = False
 
     # Casdoor (OIDC) — JWT verification against the issuer's JWKS.
     CASDOOR_ENDPOINT: str = "http://localhost:8080"
     CASDOOR_ISSUER: str = ""  # expected token iss claim (default: CASDOOR_ENDPOINT)
     CASDOOR_CLIENT_ID: str = "inventory-app-client"
-    CASDOOR_CLIENT_SECRET: str = "inventory-app-secret-2026"
+    CASDOOR_CLIENT_SECRET: str = ""  # no default secret — set via env/.env
     CASDOOR_ORGANIZATION: str = "inventory"
     CASDOOR_APP_NAME: str = "inventory-app"
     CASDOOR_JWKS_URL: str = ""  # default: {endpoint}/api/public_jwks
     CASDOOR_AUDIENCE: str = "inventory-app-client"  # expected token aud (falls back to client_id)
 
     # Casdoor console admin — used by POST /users/sync to mirror Casdoor
-    # identities into the app's users table (dev defaults: admin / 123).
+    # identities into the app's users table. No default password.
     CASDOOR_ADMIN_USER: str = "admin"
-    CASDOOR_ADMIN_PASSWORD: str = "123"
+    CASDOOR_ADMIN_PASSWORD: str = ""
 
-    # Inventory dev fallback (only when no Authorization header is sent).
+    # Inventory dev fallback defaults (only used when DEV_LOGIN_ENABLED).
     INVENTORY_DEFAULT_ROLE: str = "pm"
     INVENTORY_DEFAULT_PROJECT_ID: str = ""
 
+    # ---- Observability (Phase 2) -------------------------------------------
+    # "text" (human console) | "json" (JSON lines for Loki/Promtail).
+    LOG_FORMAT: str = "text"
+    # Sentry/GlitchTip DSN — backend exception capture (empty = disabled).
+    SENTRY_DSN: str = ""
+    SENTRY_TRACES_SAMPLE_RATE: float = 0.0
+    # OpenPanel server-side event ingestion (empty = disabled).
+    OPENPANEL_API_URL: str = ""      # e.g. http://openpanel-api:8080 (self-hosted)
+    OPENPANEL_CLIENT_ID: str = ""
+    OPENPANEL_CLIENT_SECRET: str = ""
+
+    @property
+    def cors_origin_list(self) -> list[str]:
+        """Comma-separated CORS_ORIGINS → list for CORSMiddleware."""
+        return [o.strip() for o in self.CORS_ORIGINS.split(",") if o.strip()]
+
+    @property
+    def is_prod(self) -> bool:
+        return self.ENVIRONMENT.lower() == "prod"
+
 
 settings = Settings()

backend/app/db/init_db.py

@@ -18,28 +18,9 @@ logger = logging.getLogger(__name__)
 
 _DASHBOARD_DDL = [
     # One reference unit per category (units.html «واحد مرجع هر دسته»)
-    """
-    CREATE TABLE IF NOT EXISTS category_reference_units (
-        id          UUID        NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
-        category_id UUID        NOT NULL UNIQUE REFERENCES material_categories(id) ON DELETE CASCADE,
-        ref_unit    TEXT        NOT NULL,
-        updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
-    )
-    """,
     # Brand-scoped / category-scoped conversions: 1 from_unit = factor × to_unit.
     # UNIQUE must treat brand NULL as a concrete value (PG treats NULLs as distinct).
     """
-    CREATE TABLE IF NOT EXISTS unit_conversions (
-        id          UUID           NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
-        category_id UUID           NOT NULL REFERENCES material_categories(id) ON DELETE CASCADE,
-        brand       TEXT,
-        from_unit   TEXT           NOT NULL,
-        to_unit     TEXT           NOT NULL,
-        factor      NUMERIC(18,6)  NOT NULL,
-        updated_at  TIMESTAMPTZ    NOT NULL DEFAULT now()
-    )
-    """,
-    """
     CREATE UNIQUE INDEX IF NOT EXISTS uq_unit_conversion
         ON unit_conversions (category_id, COALESCE(brand, ''), from_unit, to_unit)
     """,
@@ -345,6 +326,18 @@ BASE_UNITS: list[dict] = [
     {"code": "m", "name_fa": "متر", "dimension": "length", "si_factor": 1, "is_base": True},
     {"code": "bag", "name_fa": "کیسه", "dimension": "count", "si_factor": 1, "is_base": False},
     {"code": "ton", "name_fa": "تن", "dimension": "mass", "si_factor": 1000, "is_base": False},
+    {"code": "g", "name_fa": "گرم", "dimension": "mass", "si_factor": 0.001, "is_base": False},
+    {"code": "kpiece", "name_fa": "هزار عدد", "dimension": "count", "si_factor": 1000, "is_base": False},
+]
+
+# تبدیل‌های ثابت جهانی («تبدیل‌های ثابت — همه متریال‌ها») — ضرایب استاندارد و
+# فراگیر که در هر استارت‌آپ به‌صورت idempotent ذخیره می‌شوند. کلید یکتا:
+# (from_unit, to_unit)؛ مقدار فیلدها، نام نمایشی فارسی واحد است — همان
+# قالبی که فرانت‌اند در standard_conversions می‌نویسد.
+STANDARD_CONVERSIONS: list[dict] = [
+    {"from_unit": "تن", "to_unit": "کیلوگرم", "factor": 1000},
+    {"from_unit": "کیلوگرم", "to_unit": "گرم", "factor": 1000},
+    {"from_unit": "هزار عدد", "to_unit": "عدد", "factor": 1000},
 ]
 
 
@@ -379,16 +372,63 @@ async def ensure_v26(engine: AsyncEngine) -> None:
             "VALUES (:code, :name_fa, :dimension, :si_factor, :is_base) ON CONFLICT (code) DO NOTHING",
             u,
         )
-    # v2.5 automation triggers (idempotent — DROP + CREATE keeps them in sync).
+    # Seed the global fixed conversions (idempotent — unique key from/to unit).
+    for c in STANDARD_CONVERSIONS:
+        await run_statement(
+            "INSERT INTO standard_conversions (from_unit, to_unit, factor) "
+            "VALUES (:from_unit, :to_unit, :factor) "
+            "ON CONFLICT (from_unit, to_unit) DO NOTHING",
+            c,
+        )
+    # v2.5/v2.6 category decoupling from materials: drop trigger, function, and column.
     await run_statement("DROP TRIGGER IF EXISTS trg_supplier_materials_derive_category ON supplier_materials")
-    await run_statement("""
+    await run_statement("DROP FUNCTION IF EXISTS fn_derive_material_category()")
-        CREATE TRIGGER trg_supplier_materials_derive_category
+    await run_statement("ALTER TABLE materials DROP CONSTRAINT IF EXISTS materials_category_id_fkey")
-            AFTER INSERT ON supplier_materials
+    await run_statement("ALTER TABLE materials DROP COLUMN IF EXISTS category_id")
-            FOR EACH ROW EXECUTE FUNCTION fn_derive_material_category()
+
-    """)
     await run_statement("DROP TRIGGER IF EXISTS trg_item_decisions_sync_price ON item_decisions")
     await run_statement("""
         CREATE TRIGGER trg_item_decisions_sync_price
             AFTER INSERT OR UPDATE OF status ON item_decisions
             FOR EACH ROW EXECUTE FUNCTION fn_sync_last_quoted_price()
     """)
+
+
+async def ensure_drop_category_tables(engine: AsyncEngine) -> None:
+    """v2.7 follow-up: the category taxonomy is reduced to a supplier label.
+
+    These three tables backed features that were never populated (0 rows on every
+    volume): per-category reference units and conversion factors (the
+    per-reference-unit price line) and the category -> attribute mapping. Dropping
+    them is idempotent and loses no data. material_categories itself stays — every
+    supplier carries one as its label.
+    """
+    async with engine.begin() as conn:
+        await conn.execute(text(
+            "DROP TABLE IF EXISTS category_attributes, category_reference_units, unit_conversions CASCADE"
+        ))
+    logger.info("category taxonomy tables dropped (attributes / ref units / conversions)")
+
+
+async def ensure_audit_table(engine: AsyncEngine) -> None:
+    """v2.7: general activity trail (audit_log). Idempotent; safe on any volume."""
+    ddl = """
+    CREATE TABLE IF NOT EXISTS audit_log (
+        id          UUID        NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+        occurred_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        actor       TEXT,
+        action      TEXT        NOT NULL,
+        entity      TEXT        NOT NULL,
+        entity_id   TEXT,
+        details     JSONB       NOT NULL DEFAULT '{}'
+    )
+    """
+    indexes = (
+        "CREATE INDEX IF NOT EXISTS idx_audit_log_entity ON audit_log(entity, entity_id)",
+        "CREATE INDEX IF NOT EXISTS idx_audit_log_occurred ON audit_log(occurred_at DESC)",
+    )
+    async with engine.begin() as conn:
+        await conn.execute(text(ddl))
+        for stmt in indexes:
+            await conn.execute(text(stmt))
+    logger.info("audit_log table ensured")

backend/app/main.py

@@ -7,30 +7,56 @@
 """
 import asyncio
 import logging
+import uuid
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI, Request
+import httpx
+from fastapi import Depends, FastAPI, Request
 from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
+from prometheus_fastapi_instrumentator import Instrumentator
+from slowapi import _rate_limit_exceeded_handler
+from slowapi.errors import RateLimitExceeded
+from sqlalchemy import text as sql_text
 from sqlalchemy.exc import IntegrityError
 
+from app.auth import get_current_user
 from app.config import settings
 from app.db.engine import AsyncSessionLocal, engine
 from app.db.init_db import (
     ensure_attachment_table,
+    ensure_audit_table,
+    ensure_drop_category_tables,
     ensure_dashboard_tables,
     ensure_material_topic_column,
     ensure_quote_projects,
     ensure_v26,
 )
+from app.observability import RequestContextMiddleware, setup_logging
 from app.routers import ROUTERS
 from app.services.quote_service import auto_expire_quotes
 from app.utils.errors import AppError
+from app.utils.ratelimit import limiter
 
-logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s — %(message)s")
+setup_logging(settings.LOG_FORMAT)
 logger = logging.getLogger("procurement")
 
+if settings.SENTRY_DSN:
+    # GlitchTip/Sentry exception capture — after setup_logging so the SDK's
+    # own logs go through our formatter too. Disabled entirely without a DSN.
+    import sentry_sdk
+    from sentry_sdk.integrations.fastapi import FastApiIntegration
+
+    sentry_sdk.init(
+        dsn=settings.SENTRY_DSN,
+        environment=settings.ENVIRONMENT,
+        traces_sample_rate=settings.SENTRY_TRACES_SAMPLE_RATE,
+        integrations=[FastApiIntegration()],
+        send_default_pii=False,
+    )
+    logger.info("Sentry/GlitchTip exception capture enabled")
+
 API_V1_PREFIX = "/api/v1"
 
 
@@ -45,13 +71,42 @@ async def _auto_expire_loop() -> None:
             logger.exception("Auto-expiry pass failed")
 
 
+def _verify_production_settings() -> None:
+    """Fail-fast guard: refuse to boot in prod with dev defaults.
+
+    These exact misconfigurations are what previously shipped (wildcard CORS
+    with credentials, default MinIO/Postgres/Casdoor credentials, and the
+    always-on X-User-Role identity fallback). Ops fix: set the real values
+    in the server-side .env — see docs/SECRET-MANAGEMENT.md.
+    """
+    problems: list[str] = []
+    if not settings.cors_origin_list or "*" in settings.cors_origin_list:
+        problems.append("PROCUREMENT_CORS_ORIGINS must list exact origins (no '*')")
+    if settings.MINIO_ACCESS_KEY == "minioadmin" or settings.MINIO_SECRET_KEY == "minioadmin":
+        problems.append("MinIO credentials are still the default minioadmin")
+    if not settings.CASDOOR_CLIENT_SECRET:
+        problems.append("PROCUREMENT_CASDOOR_CLIENT_SECRET is not set")
+    if not settings.CASDOOR_ADMIN_PASSWORD:
+        problems.append("PROCUREMENT_CASDOOR_ADMIN_PASSWORD is not set")
+    if settings.DEV_LOGIN_ENABLED:
+        problems.append("PROCUREMENT_DEV_LOGIN_ENABLED must be false in production")
+    if problems:
+        raise RuntimeError(
+            "Refusing to start in production — fix the environment:\n  - " + "\n  - ".join(problems)
+        )
+
+
 @asynccontextmanager
 async def lifespan(_app: FastAPI):
+    if settings.is_prod:
+        _verify_production_settings()
     await ensure_dashboard_tables(engine)
     await ensure_attachment_table(engine)
     await ensure_material_topic_column(engine)
     await ensure_quote_projects(engine)
     await ensure_v26(engine)
+    await ensure_audit_table(engine)
+    await ensure_drop_category_tables(engine)
     task = asyncio.create_task(_auto_expire_loop()) if settings.AUTO_EXPIRE_ENABLED else None
     try:
         yield
@@ -74,11 +129,21 @@ app = FastAPI(
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=settings.CORS_ORIGINS,
+    allow_origins=settings.cors_origin_list,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
 )
+app.add_middleware(RequestContextMiddleware)
+
+# Rate limiting — login brute-force brake (edge rate limit lives in Traefik).
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
+# Prometheus /metrics (requests, latency, errors) — mounted at app level,
+# outside the authenticated /api/v1 prefix; scrape target for the
+# monitoring stack.
+Instrumentator().instrument(app).expose(app, endpoint="/metrics", include_in_schema=False)
 
 
 # ---------------------------------------------------------------------------
@@ -119,6 +184,7 @@ def _fa_validation_msg(msg: str) -> str:
 
 @app.exception_handler(RequestValidationError)
 async def validation_error_handler(_request: Request, exc: RequestValidationError):
+    logger.warning("RequestValidationError on %s: %s", _request.url.path, exc.errors())
     first = exc.errors()[0]
     loc = [str(part) for part in first.get("loc", []) if part not in ("body", "query", "path")]
     field = ".".join(loc) if loc else None
@@ -157,11 +223,78 @@ async def unhandled_error_handler(_request: Request, exc: Exception):
 # ---------------------------------------------------------------------------
 # Routes
 # ---------------------------------------------------------------------------
+# JWT auth is required on EVERY router; the auth router stays public
+# (POST /auth/login issues the tokens) and /health lives below, outside the
+# /api/v1 prefix. Routers with their own finer-grained scopes (inventory,
+# pm, users) keep them — the global dependency guarantees nothing is open
+# by omission.
+from app.routers.auth import router as _auth_router  # noqa: E402
+# The files router enforces its own access check per route: a browser cannot
+# attach an Authorization header to <iframe>/<img> loads, so the two file GET
+# routes accept a short-lived signed ?t= token as well as a Bearer session.
+from app.routers.files import router as _files_router  # noqa: E402
 
 for router in ROUTERS:
+    if router is _auth_router:
         app.include_router(router, prefix=API_V1_PREFIX)
+    elif router is _files_router:
+        app.include_router(router, prefix=API_V1_PREFIX)
+    else:
+        app.include_router(router, prefix=API_V1_PREFIX, dependencies=[Depends(get_current_user)])
 
 
 @app.get("/health", tags=["system"])
 async def health():
     return {"status": "ok", "service": "procurement-api"}
+
+
+async def _check_db() -> bool:
+    try:
+        async with AsyncSessionLocal() as session:
+            await session.execute(sql_text("SELECT 1"))
+        return True
+    except Exception:
+        logger.exception("readiness: database check failed")
+        return False
+
+
+async def _check_minio() -> bool:
+    try:
+        from app.services.storage import get_client
+
+        get_client().bucket_exists(settings.MINIO_BUCKET)
+        return True
+    except Exception:
+        logger.exception("readiness: MinIO check failed")
+        return False
+
+
+async def _check_casdoor() -> bool:
+    try:
+        async with httpx.AsyncClient(timeout=5) as client:
+            resp = await client.get(
+                settings.CASDOOR_JWKS_URL or f"{settings.CASDOOR_ENDPOINT}/.well-known/jwks"
+            )
+            return resp.status_code == 200
+    except Exception:
+        logger.exception("readiness: Casdoor JWKS check failed")
+        return False
+
+
+@app.get("/health/ready", tags=["system"])
+async def health_ready():
+    """Readiness: verifies the dependencies the API actually needs.
+
+    The deploy webhook polls this after a rebuild, so a deploy that breaks
+    the DB/MinIO/Casdoor connectivity is visible immediately.
+    """
+    checks = {
+        "database": await _check_db(),
+        "minio": await _check_minio(),
+        "casdoor": await _check_casdoor(),
+    }
+    ok = all(checks.values())
+    return JSONResponse(
+        status_code=200 if ok else 503,
+        content={"status": "ok" if ok else "degraded", "service": "procurement-api", "checks": checks},
+    )

backend/app/models/__init__.py

@@ -1,5 +1,6 @@
 """ORM models — import order matters only for registration in Base.metadata."""
 from app.db.base import Base
+from app.models.audit import AuditLog
 from app.models.catalog import (
     AttributeDefinition,
     Brand,

backend/app/models/audit.py

@@ -0,0 +1,19 @@
+"""Audit log model — general activity trail (v2.7)."""
+import uuid
+
+from sqlalchemy import Column, DateTime, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
+
+from app.db.base import Base
+
+
+class AuditLog(Base):
+    __tablename__ = "audit_log"
+
+    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    occurred_at = Column(DateTime(timezone=True), nullable=False, server_default=func.now())
+    actor = Column(Text, nullable=True)  # display name of the authenticated user
+    action = Column(String(64), nullable=False)  # e.g. "user.role_changed"
+    entity = Column(String(64), nullable=False)  # e.g. "user", "inventory_tx"
+    entity_id = Column(Text, nullable=True)
+    details = Column(JSONB, nullable=False, server_default="{}")

backend/app/models/catalog.py

@@ -130,14 +130,11 @@ class CategoryAttribute(Base):
 
 class Material(Base):
     __tablename__ = "materials"
-    # v2.5/2.6: name is GLOBALLY unique; category_id is nullable + derived.
+    # v2.6/v2.7: name is GLOBALLY unique; decoupled from categories.
     __table_args__ = (UniqueConstraint("name", name="uq_material_name"),)
     __mapper_args__ = {"eager_defaults": True}
 
     id: Mapped[uuid.UUID] = _uuid_pk()
-    category_id: Mapped[uuid.UUID | None] = mapped_column(
-        ForeignKey("material_categories.id", ondelete="RESTRICT")
-    )
     name: Mapped[str] = mapped_column(Text, nullable=False)
     topic: Mapped[str | None] = mapped_column(Text)  # تاپیک جلوی برنامه (Persian) — legacy
     canonical_unit_id: Mapped[int] = mapped_column(
@@ -149,7 +146,6 @@ class Material(Base):
         DateTime(timezone=True), nullable=False, server_default=func.now(), onupdate=func.now()
     )
 
-    category: Mapped["MaterialCategory | None"] = relationship(lazy="raise")
     canonical_unit: Mapped["Unit"] = relationship(lazy="raise")
     attribute_values: Mapped[list["MaterialAttributeValue"]] = relationship(
         back_populates="material", lazy="raise", passive_deletes=True

backend/app/observability.py

@@ -0,0 +1,86 @@
+"""Observability plumbing — logging format, request IDs, request log.
+
+- ``setup_logging()``: human-readable text by default, JSON lines when
+  ``PROCUREMENT_LOG_FORMAT=json`` (what Promtail/Loki prefers).
+- ``request_context`` middleware: assigns an X-Request-ID to every request
+  (honours one sent by the edge), echoes it in the response, and logs one
+  structured line per request (method, path, status, duration, request id)
+  — this is what makes access logs useful in Loki.
+"""
+import contextvars
+import json
+import logging
+import time
+import uuid
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+
+request_id_var: contextvars.ContextVar[str] = contextvars.ContextVar("request_id", default="-")
+
+_SKIP_ACCESS_LOG = {"/health", "/health/ready", "/metrics"}
+
+
+class JsonFormatter(logging.Formatter):
+    """Minimal JSON-lines formatter for Loki/Promtail ingestion."""
+
+    def format(self, record: logging.LogRecord) -> str:
+        payload = {
+            "ts": self.formatTime(record, "%Y-%m-%dT%H:%M:%S%z"),
+            "level": record.levelname,
+            "logger": record.name,
+            "message": record.getMessage(),
+            "request_id": request_id_var.get(),
+        }
+        if record.exc_info:
+            payload["exception"] = self.formatException(record.exc_info)
+        for key in ("http_method", "http_path", "http_status", "duration_ms"):
+            value = getattr(record, key, None)
+            if value is not None:
+                payload[key] = value
+        return json.dumps(payload, ensure_ascii=False)
+
+
+def setup_logging(log_format: str = "text", level: int = logging.INFO) -> None:
+    formatter = JsonFormatter() if log_format.lower() == "json" else logging.Formatter(
+        "%(asctime)s %(levelname)s %(name)s — %(message)s"
+    )
+    root = logging.getLogger()
+    for handler in root.handlers[:]:
+        root.removeHandler(handler)
+    handler = logging.StreamHandler()
+    handler.setFormatter(formatter)
+    root.addHandler(handler)
+    root.setLevel(level)
+
+
+class RequestContextMiddleware(BaseHTTPMiddleware):
+    """X-Request-ID + one access-log line per request."""
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        rid = request.headers.get("x-request-id") or uuid.uuid4().hex
+        token = request_id_var.set(rid)
+        started = time.perf_counter()
+        try:
+            response = await call_next(request)
+        except Exception:
+            duration_ms = round((time.perf_counter() - started) * 1000, 1)
+            logging.getLogger("procurement.access").exception(
+                "unhandled exception",
+                extra={"http_method": request.method, "http_path": request.url.path,
+                       "http_status": 500, "duration_ms": duration_ms},
+            )
+            request_id_var.reset(token)
+            raise
+        duration_ms = round((time.perf_counter() - started) * 1000, 1)
+        response.headers["X-Request-ID"] = rid
+        request_id_var.reset(token)
+        if request.url.path not in _SKIP_ACCESS_LOG:
+            logging.getLogger("procurement.access").info(
+                "%s %s -> %s",
+                request.method, request.url.path, response.status_code,
+                extra={"http_method": request.method, "http_path": request.url.path,
+                       "http_status": response.status_code, "duration_ms": duration_ms},
+            )
+        return response

backend/app/routers/__init__.py

@@ -4,8 +4,6 @@ from app.routers import (
     auth,
     brand_materials,
     brands,
-    category_attributes,
-    category_ref_units,
     files,
     inventory,
     item_decisions,
@@ -24,7 +22,6 @@ from app.routers import (
     supplier_materials,
     suppliers,
     termsheets,
-    unit_conversions,
     units,
     users,
 )
@@ -35,7 +32,6 @@ ROUTERS = [
     brands.router,
     material_categories.router,
     attribute_definitions.router,
-    category_attributes.router,
     materials.router,
     brand_materials.router,
     suppliers.router,
@@ -51,8 +47,6 @@ ROUTERS = [
     item_receipts.router,
     quote_events.router,
     files.router,
-    category_ref_units.router,
-    unit_conversions.router,
     standard_conversions.router,
     inventory.router,
     pm.router,

backend/app/routers/auth.py

@@ -13,7 +13,7 @@ Error mapping (documented in docs/casdoor-auth.md):
 import logging
 
 import httpx
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request
 from pydantic import BaseModel
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -21,7 +21,9 @@ from app.auth import _verify_token, context_from_claims
 from app.config import settings
 from app.db.engine import get_db
 from app.routers.users import _user_projects, user_to_dict
+from app.services import analytics
 from app.utils.errors import ServiceUnavailableError, UnauthorizedError
+from app.utils.ratelimit import limiter
 
 logger = logging.getLogger("procurement.auth")
 
@@ -34,7 +36,8 @@ class LoginRequest(BaseModel):
 
 
 @router.post("/login")
-async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
+@limiter.limit("10/minute", error_message="تلاش‌های ورود بیش از حد مجاز — کمی بعد دوباره امتحان کنید")
+async def login(request: Request, payload: LoginRequest, db: AsyncSession = Depends(get_db)):
     """Exchange username/password for a Casdoor JWT (OAuth password grant)."""
     url = f"{settings.CASDOOR_ENDPOINT}/api/login/oauth/access_token"
     form = {
@@ -75,6 +78,15 @@ async def login(payload: LoginRequest, db: AsyncSession = Depends(get_db)):
     claims = await _verify_token(access_token)
     ctx = await context_from_claims(claims, db)
     projects = await _user_projects(db, ctx.user)
+    await analytics.track(
+        "login_success",
+        {"username": payload.username, "role": ctx.role},
+        profile_id=ctx.user.casdoor_id,
+    )
+    await analytics.identify(
+        ctx.user.casdoor_id,
+        {"name": ctx.display_name, "role": ctx.role, "username": payload.username},
+    )
     return {
         "data": {
             "access_token": access_token,

backend/app/routers/category_attributes.py

@@ -1,136 +0,0 @@
-"""Category attributes — scoped attribute definitions per category (P2 set).
-
-Identified by composite key {category_id}/{attribute_definition_id}.
-The nested `attribute` object is ALWAYS included (not expand-based).
-"""
-from fastapi import APIRouter, Depends, Query
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from app.db.engine import get_db
-from app.models.catalog import AttributeDefinition, CategoryAttribute, MaterialCategory
-from app.schemas.catalog import CategoryAttributeCreate, CategoryAttributeUpdate
-from app.utils.errors import ConflictError, NotFoundError
-from app.utils.pagination import paginate
-
-router = APIRouter(
-    prefix="/material-categories/{category_id}/attributes",
-    tags=["category-attributes"],
-)
-
-
-def ca_to_dict(ca: CategoryAttribute, attribute: AttributeDefinition) -> dict:
-    return {
-        "id": str(ca.id),
-        "category_id": str(ca.category_id),
-        "attribute_definition_id": str(ca.attribute_definition_id),
-        "is_required": ca.is_required,
-        "is_filterable": ca.is_filterable,
-        "conditional_rules": ca.conditional_rules,
-        "sort_order": ca.sort_order,
-        "attribute": {
-            "attribute_key": attribute.attribute_key,
-            "label": attribute.label,
-            "data_type": attribute.data_type,
-            "unit_id": attribute.unit_id,
-            "enum_values": attribute.enum_values,
-        },
-    }
-
-
-async def _category_or_404(db: AsyncSession, category_id) -> MaterialCategory:
-    category = await db.get(MaterialCategory, category_id)
-    if category is None:
-        raise NotFoundError("دسته‌بندی یافت نشد")
-    return category
-
-
-async def _with_attribute(db: AsyncSession, ca: CategoryAttribute) -> dict:
-    attribute = await db.get(AttributeDefinition, ca.attribute_definition_id)
-    return ca_to_dict(ca, attribute)
-
-
-@router.get("")
-async def list_category_attributes(
-    category_id,
-    page: int = Query(1, ge=1),
-    page_size: int = Query(20, ge=1, le=100),
-    db: AsyncSession = Depends(get_db),
-):
-    await _category_or_404(db, category_id)
-    stmt = (
-        select(CategoryAttribute)
-        .where(CategoryAttribute.category_id == category_id)
-        .order_by(CategoryAttribute.sort_order.asc())
-    )
-    items, meta = await paginate(stmt, page, page_size, db)
-    return {"data": [await _with_attribute(db, ca) for ca in items], "meta": meta}
-
-
-@router.post("", status_code=201)
-async def create_category_attribute(
-    category_id, payload: CategoryAttributeCreate, db: AsyncSession = Depends(get_db)
-):
-    await _category_or_404(db, category_id)
-    if await db.get(AttributeDefinition, payload.attribute_definition_id) is None:
-        raise NotFoundError("تعریف ویژگی یافت نشد", field="attribute_definition_id")
-    duplicate = await db.scalar(
-        select(CategoryAttribute.id).where(
-            CategoryAttribute.category_id == category_id,
-            CategoryAttribute.attribute_definition_id == payload.attribute_definition_id,
-        )
-    )
-    if duplicate is not None:
-        raise ConflictError("این ویژگی قبلاً به این دسته‌بندی اضافه شده است", field="attribute_definition_id")
-    ca = CategoryAttribute(
-        category_id=category_id,
-        attribute_definition_id=payload.attribute_definition_id,
-        is_required=payload.is_required,
-        is_filterable=payload.is_filterable,
-        conditional_rules=payload.conditional_rules,
-        sort_order=payload.sort_order,
-    )
-    db.add(ca)
-    await db.flush()
-    return {"data": await _with_attribute(db, ca)}
-
-
-@router.patch("/{attribute_definition_id}")
-async def update_category_attribute(
-    category_id, attribute_definition_id, payload: CategoryAttributeUpdate, db: AsyncSession = Depends(get_db)
-):
-    ca = await db.scalar(
-        select(CategoryAttribute).where(
-            CategoryAttribute.category_id == category_id,
-            CategoryAttribute.attribute_definition_id == attribute_definition_id,
-        )
-    )
-    if ca is None:
-        raise NotFoundError("ویژگی این دسته‌بندی یافت نشد")
-    if payload.is_required is not None:
-        ca.is_required = payload.is_required
-    if payload.is_filterable is not None:
-        ca.is_filterable = payload.is_filterable
-    if payload.conditional_rules is not None:
-        ca.conditional_rules = payload.conditional_rules
-    if payload.sort_order is not None:
-        ca.sort_order = payload.sort_order
-    await db.flush()
-    return {"data": await _with_attribute(db, ca)}
-
-
-@router.delete("/{attribute_definition_id}")
-async def delete_category_attribute(
-    category_id, attribute_definition_id, db: AsyncSession = Depends(get_db)
-):
-    ca = await db.scalar(
-        select(CategoryAttribute).where(
-            CategoryAttribute.category_id == category_id,
-            CategoryAttribute.attribute_definition_id == attribute_definition_id,
-        )
-    )
-    if ca is None:
-        raise NotFoundError("ویژگی این دسته‌بندی یافت نشد")
-    await db.delete(ca)
-    await db.flush()
-    return {"data": {"deleted": True}}

backend/app/routers/category_ref_units.py

@@ -1,69 +0,0 @@
-"""Category reference units — units.html dashboard (P2-26/27).
-
-One reference unit per category (UNIQUE category_id); PUT is an upsert.
-"""
-from fastapi import APIRouter, Depends, Query
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from app.db.engine import get_db
-from app.models.catalog import CategoryReferenceUnit, MaterialCategory
-from app.schemas.catalog import CategoryReferenceUnitPut
-from app.services.expand_service import category_brief
-from app.utils.errors import NotFoundError
-from app.utils.pagination import paginate
-from app.utils.serialization import to_iso
-
-router = APIRouter(prefix="/category-reference-units", tags=["category-reference-units"])
-
-
-def cru_to_dict(cru: CategoryReferenceUnit, expand: set[str] = frozenset()) -> dict:
-    d = {
-        "id": str(cru.id),
-        "category_id": str(cru.category_id),
-        "ref_unit": cru.ref_unit,
-        "updated_at": to_iso(cru.updated_at),
-    }
-    if "category" in expand and hasattr(cru, "_category"):
-        d["category"] = category_brief(cru._category)
-    return d
-
-
-@router.get("")
-async def list_category_reference_units(
-    page: int = Query(1, ge=1),
-    page_size: int = Query(20, ge=1, le=100),
-    category_id=None,
-    expand: str | None = None,
-    db: AsyncSession = Depends(get_db),
-):
-    stmt = select(CategoryReferenceUnit)
-    if category_id:
-        stmt = stmt.where(CategoryReferenceUnit.category_id == category_id)
-    items, meta = await paginate(stmt, page, page_size, db)
-    tokens = {t.strip() for t in expand.split(",")} if expand else set()
-    if "category" in tokens:
-        cat_ids = {cru.category_id for cru in items}
-        cats = {}
-        if cat_ids:
-            cats = {c.id: c for c in (await db.execute(select(MaterialCategory).where(MaterialCategory.id.in_(cat_ids)))).scalars()}
-        for cru in items:
-            cru._category = cats.get(cru.category_id)
-    return {"data": [cru_to_dict(cru, tokens) for cru in items], "meta": meta}
-
-
-@router.put("/{category_id}")
-async def upsert_category_reference_unit(
-    category_id, payload: CategoryReferenceUnitPut, db: AsyncSession = Depends(get_db)
-):
-    category = await db.get(MaterialCategory, category_id)
-    if category is None:
-        raise NotFoundError("دسته‌بندی یافت نشد")
-    cru = await db.scalar(select(CategoryReferenceUnit).where(CategoryReferenceUnit.category_id == category_id))
-    if cru is None:
-        cru = CategoryReferenceUnit(category_id=category_id, ref_unit=payload.ref_unit)
-        db.add(cru)
-    else:
-        cru.ref_unit = payload.ref_unit
-    await db.flush()
-    return {"data": {"category_id": str(category_id), "ref_unit": cru.ref_unit}}

backend/app/routers/files.py

@@ -17,16 +17,22 @@ import os
 import uuid
 from urllib.parse import quote
 
-from fastapi import APIRouter, Depends, File, Response, UploadFile
+from fastapi import APIRouter, Depends, File, Request, Response, UploadFile
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import UserContext, get_current_user, get_optional_user, require_role
 from app.db.engine import get_db
 from app.models.procurement import Quote
 from app.services import file_service
-from app.utils.errors import NotFoundError, ValidationError
+from app.utils.errors import NotFoundError, UnauthorizedError, ValidationError
+from app.utils.preview_token import make_preview_token, verify_preview_token
 
 router = APIRouter(prefix="/quotes", tags=["files"])
 
+# حذف پیوست‌ها = عملیات تدارکات (ادمین / مدیر تدارکات)؛ بارگذاری و دانلود
+# برای هر کاربر واردشده آزاد است.
+_attachment_deleter = require_role("procurement_manager", "admin")
+
 ALLOWED_MIME_TYPES = {
     "image/png", "image/jpeg", "image/webp", "image/gif", "application/pdf",
 }
@@ -36,13 +42,17 @@ ALLOWED_EXTENSIONS = {".png", ".jpg", ".jpeg", ".webp", ".gif", ".pdf"}
 MAX_FILE_SIZE_BYTES = 5 * 1024 * 1024
 
 
-def _content_disposition(file_name: str) -> str:
+def _content_disposition(file_name: str, inline: bool = False) -> str:
     """Header-safe Content-Disposition for non-ASCII (e.g. Persian) filenames.
 
     HTTP headers are encoded as latin-1, so a Persian name raises
     UnicodeEncodeError and kills the response. Per RFC 6266 / RFC 5987 the
     UTF-8 name goes percent-encoded in ``filename*``, with an ASCII fallback
     in ``filename`` for old clients.
+
+    ``inline=True`` makes the browser render the file (PDF in a viewer,
+    image in the tab) instead of downloading it — required by the preview
+    modal, whose <iframe> would otherwise trigger a download.
     """
     raw = file_name.encode("ascii", "ignore").decode("ascii")
     # keep the fallback header-safe: no quotes, no control characters
@@ -51,9 +61,37 @@ def _content_disposition(file_name: str) -> str:
     stem = fallback[: -len(ext)].strip() if ext and fallback.lower().endswith(ext.lower()) else fallback
     if not stem or not any(ch.isalnum() for ch in stem):
         # nothing meaningful survived ASCII-folding (e.g. a pure-Persian
-        # name): use a generic attachment name that keeps the extension
+        # name): use a generic name that keeps the extension
-        fallback = f"attachment{ext}" if ext else "attachment"
+        fallback = f"{'preview' if inline else 'attachment'}{ext}" if ext else (
-    return f"attachment; filename=\"{fallback}\"; filename*=UTF-8''{quote(file_name)}"
+            "preview" if inline else "attachment"
+        )
+    kind = "inline" if inline else "attachment"
+    return f"{kind}; filename=\"{fallback}\"; filename*=UTF-8''{quote(file_name)}"
+
+
+async def _require_file_access(
+    request: Request,
+    token: str | None,
+    quote_id: uuid.UUID,
+    kind: str,
+    attachment_id: uuid.UUID,
+    db: AsyncSession,
+) -> None:
+    """Authorise a file read by session header OR a signed ``?t=`` token.
+
+    These two GET routes sit outside the global Bearer dependency because a
+    browser cannot attach an Authorization header to <iframe>/<img> loads.
+    A caller is accepted when it presents either a valid Casdoor session
+    (resolved by get_optional_user) or a signed token scoped to exactly
+    this file, which expires within minutes.
+    """
+    if request is not None and request.headers.get("authorization"):
+        user = await get_optional_user(request, db)
+        if user is not None and user.role is not None:
+            return
+    if token and verify_preview_token(token, quote_id, kind, attachment_id):
+        return
+    raise UnauthorizedError("دسترسی به این فایل مجاز نیست — ابتدا وارد شوید")
 
 
 async def _quote_or_404(db: AsyncSession, quote_id: uuid.UUID) -> Quote:
@@ -87,7 +125,7 @@ async def _attachment_or_404(
 # Invoice — قابل بارگذاری در هر وضعیتی (از صفحه‌ی ویرایش)
 # ---------------------------------------------------------------------------
 
-@router.post("/{quote_id}/invoice", status_code=201)
+@router.post("/{quote_id}/invoice", status_code=201, dependencies=[Depends(get_current_user)])
 async def upload_invoice(quote_id: uuid.UUID, file: UploadFile = File(...), db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     mime = _validate_upload(file)
@@ -98,29 +136,67 @@ async def upload_invoice(quote_id: uuid.UUID, file: UploadFile = File(...), db:
     return {"data": stored.to_dict()}
 
 
-@router.get("/{quote_id}/invoice")
+@router.get("/{quote_id}/invoice", dependencies=[Depends(get_current_user)])
 async def list_invoices(quote_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     attachments = await file_service.list_for(db, quote_id, "invoice")
     return {"data": [a.to_dict() for a in attachments]}
 
 
+# ---------------------------------------------------------------------------
+# Preview URL — a real, short-lived URL the browser can load in an
+# <iframe>/<img> (which cannot send an Authorization header). Using a real
+# URL instead of a blob: avoids download managers that hijack blob URLs and
+# leave 0-byte files behind.
+# ---------------------------------------------------------------------------
+@router.get("/{quote_id}/preview-url/{kind}/{attachment_id}")
+async def preview_url(
+    quote_id: uuid.UUID,
+    kind: str,
+    attachment_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db),
+    _ctx: UserContext = Depends(get_current_user),
+):
+    if kind not in ("invoice", "proforma"):
+        raise ValidationError("نوع پیوست نامعتبر است", field="kind")
+    await _quote_or_404(db, quote_id)
+    await _attachment_or_404(db, quote_id, attachment_id, kind)
+    token = make_preview_token(quote_id, kind, attachment_id)
+    # مسیر نسبی برگردانده می‌شود؛ فرانت با BASE_URL خودش کاملش می‌کند
+    return {
+        "data": {
+            "url": f"/quotes/{quote_id}/{kind}/{attachment_id}?disposition=inline&t={token}",
+            "token": token,
+        }
+    }
+
+
 @router.get("/{quote_id}/invoice/{attachment_id}")
-async def download_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
+async def download_invoice(
+    quote_id: uuid.UUID,
+    attachment_id: uuid.UUID,
+    disposition: str = "attachment",
+    t: str | None = None,
+    request: Request = None,
+    db: AsyncSession = Depends(get_db),
+):
     await _quote_or_404(db, quote_id)
     attachment = await _attachment_or_404(db, quote_id, attachment_id, "invoice")
+    await _require_file_access(request, t, quote_id, "invoice", attachment_id, db)
     content = await file_service.read_bytes(attachment)
     return Response(
         content=content,
         media_type=attachment.mime_type,
         headers={
-            "Content-Disposition": _content_disposition(attachment.file_name),
+            "Content-Disposition": _content_disposition(
+                attachment.file_name, inline=disposition == "inline"
+            ),
             "X-File-Id": str(attachment.id),
         },
     )
 
 
-@router.delete("/{quote_id}/invoice/{attachment_id}")
+@router.delete("/{quote_id}/invoice/{attachment_id}", dependencies=[Depends(_attachment_deleter), Depends(get_current_user)])
 async def delete_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     attachment = await _attachment_or_404(db, quote_id, attachment_id, "invoice")
@@ -132,7 +208,7 @@ async def delete_invoice(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: Asyn
 # Proforma — no status restriction
 # ---------------------------------------------------------------------------
 
-@router.post("/{quote_id}/proforma", status_code=201)
+@router.post("/{quote_id}/proforma", status_code=201, dependencies=[Depends(get_current_user)])
 async def upload_proforma(quote_id: uuid.UUID, file: UploadFile = File(...), db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     mime = _validate_upload(file)
@@ -143,7 +219,7 @@ async def upload_proforma(quote_id: uuid.UUID, file: UploadFile = File(...), db:
     return {"data": stored.to_dict()}
 
 
-@router.get("/{quote_id}/proforma")
+@router.get("/{quote_id}/proforma", dependencies=[Depends(get_current_user)])
 async def list_proformas(quote_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     attachments = await file_service.list_for(db, quote_id, "proforma")
@@ -151,21 +227,31 @@ async def list_proformas(quote_id: uuid.UUID, db: AsyncSession = Depends(get_db)
 
 
 @router.get("/{quote_id}/proforma/{attachment_id}")
-async def download_proforma(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
+async def download_proforma(
+    quote_id: uuid.UUID,
+    attachment_id: uuid.UUID,
+    disposition: str = "attachment",
+    t: str | None = None,
+    request: Request = None,
+    db: AsyncSession = Depends(get_db),
+):
     await _quote_or_404(db, quote_id)
     attachment = await _attachment_or_404(db, quote_id, attachment_id, "proforma")
+    await _require_file_access(request, t, quote_id, "proforma", attachment_id, db)
     content = await file_service.read_bytes(attachment)
     return Response(
         content=content,
         media_type=attachment.mime_type,
         headers={
-            "Content-Disposition": _content_disposition(attachment.file_name),
+            "Content-Disposition": _content_disposition(
+                attachment.file_name, inline=disposition == "inline"
+            ),
             "X-File-Id": str(attachment.id),
         },
     )
 
 
-@router.delete("/{quote_id}/proforma/{attachment_id}")
+@router.delete("/{quote_id}/proforma/{attachment_id}", dependencies=[Depends(_attachment_deleter), Depends(get_current_user)])
 async def delete_proforma(quote_id: uuid.UUID, attachment_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
     await _quote_or_404(db, quote_id)
     attachment = await _attachment_or_404(db, quote_id, attachment_id, "proforma")

backend/app/routers/inventory.py

@@ -43,6 +43,7 @@ from app.utils.errors import (
     UnauthorizedError,
     ValidationError,
 )
+from app.utils.audit import record as audit_record
 from app.utils.pagination import paginate, sort_query
 from app.utils.serialization import to_iso
 
@@ -95,9 +96,11 @@ async def inventory_scope(
             return Scope(role="admin", project_id=project_id, actor=user.display_name)
 
     # Dev fallback: header-based identity (fork's placeholder mode) — only
-    # when an explicit X-User-Role header is sent. No auth info at all → 401.
+    # when DEV_LOGIN_ENABLED is explicitly turned on (local testing without
-    if not request.headers.get("x-user-role"):
+    # Casdoor). Disabled by default: unauthenticated header identity in
-        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor یا حالت توسعه را ارسال کنید")
+    # production would hand admin access to anyone who can reach the API.
+    if not settings.DEV_LOGIN_ENABLED or not request.headers.get("x-user-role"):
+        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
     role = (request.headers.get("x-user-role") or settings.INVENTORY_DEFAULT_ROLE or ROLE_PM).strip().lower()
     if role == "procurement_manager":
         role = ROLE_ADMIN  # مدیر تدارکات = ادمین (فقط‌خواندنی)
@@ -271,12 +274,13 @@ async def update_warehouse(
         wh.name = payload.name
     if payload.description is not None:
         wh.description = payload.description
+    # پروژه‌ی انبار تغییرناپذیر است — انبار برای همیشه به پروژه‌ی والدش تعلق
+    # دارد و فقط با حذف و ساخت دوباره می‌تواند جابه‌جا شود.
     if payload.project_id is not None and str(payload.project_id) != str(wh.project_id):
-        if await db.get(Project, payload.project_id) is None:
+        raise ValidationError(
-            raise NotFoundError("پروژه مقصد یافت نشد", field="project_id")
+            "پروژه‌ی انبار قابل تغییر نیست — انبار برای همیشه به پروژه‌ی والدش تعلق دارد",
-        if scope.role == ROLE_PM and payload.project_id != scope.project_id:
+            field="project_id",
-            raise ForbiddenError("PM فقط می‌تواند انبار را در پروژه خودش جابه‌جا کند", field="project_id")
+        )
-        wh.project_id = payload.project_id
     await db.flush()
     return {"data": warehouse_to_dict(wh, await db.get(Project, wh.project_id))}
 
@@ -310,7 +314,6 @@ async def delete_warehouse(
 @router.get("")
 async def list_inventory(
     project_id: uuid.UUID | None = None,
-    category_id=None,
     warehouse_id=None,
     material_id=None,
     sort: str | None = None,
@@ -328,10 +331,6 @@ async def list_inventory(
         stmt = stmt.join(Warehouse, Warehouse.id == InventoryItem.warehouse_id).where(
             Warehouse.project_id == project_id
         )
-    if category_id is not None:
-        stmt = stmt.join(Material, Material.id == InventoryItem.material_id).where(
-            Material.category_id == category_id
-        )
     if warehouse_id is not None:
         stmt = stmt.where(InventoryItem.warehouse_id == warehouse_id)
     if material_id is not None:
@@ -353,10 +352,6 @@ async def _serialize_inventory_rows(db: AsyncSession, items: list[InventoryItem]
     unit_ids = {i.unit_id for i in items}
     warehouses = {w.id: w for w in (await db.execute(select(Warehouse).where(Warehouse.id.in_(wh_ids)))).scalars()}
     materials = {m.id: m for m in (await db.execute(select(Material).where(Material.id.in_(mat_ids)))).scalars()}
-    categories = {}
-    if materials:
-        cat_ids = {m.category_id for m in materials.values()}
-        categories = {c.id: c for c in (await db.execute(select(MaterialCategory).where(MaterialCategory.id.in_(cat_ids)))).scalars()}
     brands = {}
     if brand_ids:
         brands = {b.id: b for b in (await db.execute(select(Brand).where(Brand.id.in_(brand_ids)))).scalars()}
@@ -366,7 +361,7 @@ async def _serialize_inventory_rows(db: AsyncSession, items: list[InventoryItem]
     return [
         inventory_to_dict(
             i, warehouses[i.warehouse_id], materials[i.material_id],
-            categories.get(materials[i.material_id].category_id), brands.get(i.brand_id), units.get(i.unit_id),
+            None, brands.get(i.brand_id), units.get(i.unit_id),
         )
         for i in items
     ]
@@ -492,6 +487,16 @@ async def create_transaction(
             if dest.project_id != scope.project_id:
                 raise ForbiddenError("انبار مقصد متعلق به پروژه شما نیست")
         txs = await apply_transaction(db, payload, performed_by=scope.actor)
+        await audit_record(
+            db,
+            actor=scope.actor,
+            action="inventory.transaction_created",
+            entity="inventory",
+            entity_id=str(txs[0].inventory_id) if txs else None,
+            details={"type": payload.transaction_type, "quantity": str(payload.quantity),
+                     "warehouse_id": str(payload.warehouse_id),
+                     "tx_ids": [str(tx.id) for tx in txs]},
+        )
     return {"data": [transaction_to_dict(tx) for tx in txs]}
 
 
@@ -518,58 +523,3 @@ async def transaction_types():
         "PURCHASE", "WITHDRAWAL", "RETURN", "TRANSFER_IN", "TRANSFER_OUT",
         "DAMAGE", "WASTE", "LOSS", "FOUND", "STOCK_COUNT",
     )]}
-
-
-# ---------------------------------------------------------------------------
-# Material selector — filtered by Category + Warehouse (transaction forms)
-# ---------------------------------------------------------------------------
-
-@router.get("/materials/options")
-async def material_options(
-    category_id: uuid.UUID,
-    warehouse_id: uuid.UUID | None = None,
-    scope: Scope = Depends(inventory_scope),
-    db: AsyncSession = Depends(get_db),
-):
-    """Materials for the transaction form.
-
-    Always filtered by category. When `warehouse_id` is given, only materials
-    that already exist in that warehouse's inventory are returned (so the PM
-    works with the actual stock of that warehouse); otherwise the full
-    category list is returned (e.g. first purchase of a new material).
-    """
-    category = await db.get(MaterialCategory, category_id)
-    if category is None:
-        raise NotFoundError("دسته‌بندی یافت نشد", field="category_id")
-
-    stmt = select(Material).where(Material.category_id == category_id, Material.status == "active")
-    if warehouse_id is not None:
-        wh = await get_warehouse_or_404(db, warehouse_id)
-        if scope.role == ROLE_PM and wh.project_id != scope.project_id:
-            raise ForbiddenError("این انبار متعلق به پروژه شما نیست")
-        stmt = stmt.where(
-            Material.id.in_(
-                select(InventoryItem.material_id).where(InventoryItem.warehouse_id == warehouse_id)
-            )
-        )
-    stmt = stmt.order_by(Material.name)
-    materials = (await db.execute(stmt)).scalars().all()
-
-    # Brands per material (from brand_materials catalog + brands actually used in stock)
-    brand_rows = (await db.execute(
-        select(BrandMaterial.material_id, Brand.id, Brand.name)
-        .join(Brand, Brand.id == BrandMaterial.brand_id)
-        .where(BrandMaterial.material_id.in_([m.id for m in materials]), BrandMaterial.is_active.is_(True))
-    )).all()
-    brands_by_material: dict[str, list[dict]] = {}
-    for mat_id, b_id, b_name in brand_rows:
-        brands_by_material.setdefault(str(mat_id), []).append({"id": str(b_id), "name": b_name})
-
-    return {"data": [
-        {
-            "id": str(m.id),
-            "name": m.name,
-            "brands": brands_by_material.get(str(m.id), []),
-        }
-        for m in materials
-    ]}

backend/app/routers/item_decisions.py

@@ -4,11 +4,16 @@ State machine (P1 cross-endpoint rules):
     pending -> chosen (requires chosen_item_termsheet_id of the SAME line item)
     pending -> rejected
     chosen/rejected -> pending/anything-else = 409
+
+Auth: JWT required globally (main.py). The state-changing endpoints are a
+purchase decision — restricted to procurement_manager / admin via
+require_role; reads stay open to every authenticated role.
 """
 from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import ItemDecision, ItemTermsheet, LineItem
 from app.schemas.procurement import DecisionPatch, DecisionPut, DecisionStatusUpdate
@@ -21,6 +26,9 @@ router = APIRouter(
     tags=["item-decisions"],
 )
 
+# خرید/رد اقلام = تصمیم تدارکات؛ ادمین و مدیر تدارکات
+_decision_writer = require_role("procurement_manager", "admin")
+
 
 async def _line_item_or_404(db: AsyncSession, quote_id, line_item_id) -> LineItem:
     li = await db.scalar(
@@ -59,7 +67,7 @@ async def get_decision(quote_id, line_item_id, db: AsyncSession = Depends(get_db
     return {"data": decision_full(decision)}
 
 
-@router.put("")
+@router.put("", dependencies=[Depends(_decision_writer)])
 async def put_decision(
     quote_id, line_item_id, payload: DecisionPut, db: AsyncSession = Depends(get_db)
 ):
@@ -93,7 +101,7 @@ async def put_decision(
     return {"data": decision_full(decision), "status_code_hint": 201 if created else 200}
 
 
-@router.patch("/status")
+@router.patch("/status", dependencies=[Depends(_decision_writer)])
 async def patch_decision_status(
     quote_id, line_item_id, payload: DecisionStatusUpdate, db: AsyncSession = Depends(get_db)
 ):
@@ -118,7 +126,7 @@ async def patch_decision_status(
     return {"data": decision_full(decision)}
 
 
-@router.patch("")
+@router.patch("", dependencies=[Depends(_decision_writer)])
 async def patch_decision(
     quote_id, line_item_id, payload: DecisionPatch, db: AsyncSession = Depends(get_db)
 ):

backend/app/routers/line_items.py

@@ -108,6 +108,7 @@ async def update_line_item(
         effective_bm = payload.brand_material_id if payload.brand_material_id is not None else li.brand_material_id
         await ensure_brand_material_belong(db, effective_bm, new_material_id)
 
+    old_material_id = li.material_id
     if payload.material_id is not None:
         li.material_id = payload.material_id
         # v2.5: keep the supplier<->material catalog edge in sync.
@@ -121,6 +122,11 @@ async def update_line_item(
     if payload.notes is not None:
         li.notes = payload.notes
     await db.flush()
+
+    if payload.material_id is not None and payload.material_id != old_material_id:
+        from app.services.quote_service import cleanup_orphan_materials
+        await cleanup_orphan_materials(db, [old_material_id])
+
     return {"data": (await serialize_line_items(db, [li], set()))[0]}
 
 
@@ -133,6 +139,13 @@ async def delete_line_item(quote_id, line_item_id, db: AsyncSession = Depends(ge
     decision = await db.scalar(select(ItemDecision).where(ItemDecision.line_item_id == li.id))
     if decision is not None and decision.status == "chosen":
         raise ConflictError("خط آیتم انتخاب‌شده قابل حذف نیست")
+    old_material_id = li.material_id
     await db.delete(li)  # specs / links / decision / receipt cascade via DDL
     await db.flush()
+
+    if old_material_id:
+        from app.services.quote_service import cleanup_orphan_materials
+        await cleanup_orphan_materials(db, [old_material_id])
+
     return {"data": {"id": str(line_item_id), "deleted": True}}
+

backend/app/routers/material_categories.py

@@ -4,7 +4,8 @@ from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.db.engine import get_db
-from app.models.catalog import Material, MaterialCategory
+from app.models.catalog import MaterialCategory
+from app.models.procurement import Supplier
 from app.schemas.catalog import MaterialCategoryCreate, MaterialCategoryUpdate
 from app.utils.errors import ConflictError, NotFoundError
 from app.utils.pagination import paginate, sort_query
@@ -95,10 +96,14 @@ async def delete_category(category_id, db: AsyncSession = Depends(get_db)):
     category = await db.get(MaterialCategory, category_id)
     if category is None:
         raise NotFoundError("دسته‌بندی یافت نشد")
-    # materials.category_id is ON DELETE RESTRICT — block if any material exists.
+    # v2.7: materials no longer carry a category, so what blocks deletion is the
-    linked = await db.scalar(select(func.count()).select_from(Material).where(Material.category_id == category_id))
+    # supplier side — suppliers.category_id is ON DELETE RESTRICT. Every
+    # material of that category is reached through those suppliers.
+    linked = await db.scalar(
+        select(func.count()).select_from(Supplier).where(Supplier.category_id == category_id)
+    )
     if linked:
-        raise ConflictError(f"این دسته‌بندی شامل {linked} متریال است و قابل حذف نیست")
+        raise ConflictError(f"این دسته‌بندی برای {linked} تأمین‌کننده ثبت شده و قابل حذف نیست")
     await db.delete(category)  # category_attributes cascade via DDL
     await db.flush()
     return {"data": {"id": str(category_id), "deleted": True}}

backend/app/routers/materials.py

@@ -97,7 +97,6 @@ async def _apply_attr_filters(db: AsyncSession, stmt, request: Request):
 async def list_materials(
     page: int = Query(1, ge=1),
     page_size: int = Query(20, ge=1, le=100),
-    category_id=None,
     brand_id=None,
     status: str | None = None,
     q: str | None = None,
@@ -107,8 +106,6 @@ async def list_materials(
     db: AsyncSession = Depends(get_db),
 ):
     stmt = select(Material)
-    if category_id:
-        stmt = stmt.where(Material.category_id == category_id)
     if brand_id:
         # WHERE EXISTS brand_materials with that brand_id
         sub = select(1).where(

backend/app/routers/pm.py

@@ -19,8 +19,9 @@ Rules enforced here:
   the canonical unit for auto-posted purchases.
 - quote.status flips to 'arrived' when ALL chosen items are fully received.
 
-Auth: Casdoor JWT primary; dev fallback headers (X-User-Role: pm|admin +
+Auth: Casdoor JWT (a global dependency in main.py) resolves the caller;
-X-Project-Id for pm) when no Authorization header — same pattern as the
+optional dev-header fallback (X-User-Role: pm|admin + X-Project-Id for pm)
+exists only when PROCUREMENT_DEV_LOGIN_ENABLED=true — same pattern as the
 inventory router.
 """
 import base64
@@ -35,8 +36,9 @@ from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_optional_user
+from app.config import settings
 from app.db.engine import get_db
-from app.models.catalog import BrandMaterial, Material, MaterialCategory, Unit
+from app.models.catalog import BrandMaterial, Material, Unit
 from app.models.inventory import InventoryItem, InventoryTransaction, Warehouse
 from app.models.procurement import (
     ItemDecision,
@@ -48,6 +50,7 @@ from app.models.procurement import (
     Supplier,
 )
 from app.schemas.procurement import PMReceiptCreate
+from app.services import analytics
 from app.services.inventory_service import canonical_specs_hash
 from app.utils.errors import (
     ForbiddenError,
@@ -98,9 +101,12 @@ async def arrivals_scope(
             if ctx.role in ("admin", "procurement_manager"):
                 return ArrivalScope(role="admin", user_id=ctx.user.id, project_id=project_id, display_name=ctx.display_name)
             raise ForbiddenError("این بخش فقط برای مدیر پروژه یا مدیر تدارکات است")
-    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to admin)
+    # Dev fallback: X-User-Role: pm | admin (procurement_manager maps to
-    if not request.headers.get("x-user-role"):
+    # admin) — ONLY when DEV_LOGIN_ENABLED (local testing without Casdoor).
-        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor یا حالت توسعه را ارسال کنید")
+    # Disabled by default: an ungated header identity in production would
+    # let anyone confirm receipts as PM.
+    if not settings.DEV_LOGIN_ENABLED or not request.headers.get("x-user-role"):
+        raise UnauthorizedError("احراز هویت لازم است — توکن Casdoor ارسال کنید")
     role = (request.headers.get("x-user-role") or "").strip().lower()
     if role == "procurement_manager":
         role = "admin"
@@ -195,18 +201,6 @@ async def pm_on_the_way(
     # unit / category lookups for display
     unit_ids = {d.LineItem.unit_id for d in decisions}
     units = {u.id: u for u in (await db.execute(select(Unit).where(Unit.id.in_(unit_ids)))).scalars()}
-    mat_ids = {d.Material.id for d in decisions}
-    cats = {}
-    if mat_ids:
-        rows = (
-            await db.execute(
-                select(Material.id, MaterialCategory)
-                .join(MaterialCategory, MaterialCategory.id == Material.category_id)
-                .where(Material.id.in_(mat_ids))
-            )
-        ).all()
-        cats = {m_id: c for m_id, c in rows}
-
     out = []
     for d, li, q, m, sup, proj in decisions:
         received = received_map.get(d.id)
@@ -219,8 +213,7 @@ async def pm_on_the_way(
             "supplier": {"id": str(sup.id), "name": sup.name},
             "project": {"id": str(proj.id), "name": proj.name} if proj else None,
             "decided_at": to_iso(d.decided_at),
-            "material": {"id": str(m.id), "name": m.name,
+            "material": {"id": str(m.id), "name": m.name},
-                         "category": {"id": str(c.id), "name": c.name} if (c := cats.get(m.id)) else None},
             "unit": {"id": units[li.unit_id].id, "code": units[li.unit_id].code,
                      "name_fa": units[li.unit_id].name_fa} if li.unit_id in units else None,
             "ordered_qty": str(li.quantity),
@@ -424,6 +417,16 @@ async def pm_confirm_receipt(
             quote.arrived_date = payload.received_at
 
     item_state = arrival_state(li.quantity, already_received + payload.received_qty)
+    await analytics.track(
+        "receipt_confirmed",
+        {
+            "receipt_id": str(receipt.id),
+            "quote_id": str(quote.id),
+            "quantity": str(payload.received_qty),
+            "state": item_state,
+        },
+        profile_id=ctx.display_name,
+    )
     return {"data": {
         "receipt_id": str(receipt.id),
         "state": item_state,

backend/app/routers/quotes.py

@@ -10,7 +10,16 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.db.engine import get_db
 from app.models.catalog import Material
-from app.models.procurement import ItemDecision, LineItem, Project, Quote, Supplier, Termsheet
+from app.models.procurement import (
+    ItemDecision,
+    LineItem,
+    LineItemProjects,
+    Project,
+    Quote,
+    QuoteProjects,
+    Supplier,
+    Termsheet,
+)
 from app.schemas.procurement import (
     AcceptQuoteIn,
     ArriveItemsIn,
@@ -36,15 +45,6 @@ router = APIRouter(prefix="/quotes", tags=["quotes"])
 
 # --- list filter helpers ---------------------------------------------------
 
-def _quote_category_exists(category_id) -> exists:
-    return exists(
-        select(1).where(
-            LineItem.quote_id == Quote.id,
-            Material.id == LineItem.material_id,
-            Material.category_id == category_id,
-        )
-    )
-
 
 def _quote_search(q: str) -> exists:
     like = f"%{q}%"
@@ -72,7 +72,6 @@ async def get_quote_stats(
     project_id=None,
     quote_date_from: datetime | None = None,
     quote_date_to: datetime | None = None,
-    category_id=None,
     db: AsyncSession = Depends(get_db),
 ):
     return {
@@ -82,7 +81,6 @@ async def get_quote_stats(
             project_id=project_id,
             quote_date_from=quote_date_from,
             quote_date_to=quote_date_to,
-            category_id=category_id,
         )
     }
 
@@ -98,7 +96,6 @@ async def list_quotes(
     status: str | None = None,
     supplier_id=None,
     project_id=None,
-    category_id=None,
     quote_date_from: datetime | None = None,
     quote_date_to: datetime | None = None,
     q: str | None = None,
@@ -112,9 +109,23 @@ async def list_quotes(
     if supplier_id:
         stmt = stmt.where(Quote.supplier_id == supplier_id)
     if project_id:
-        stmt = stmt.where(Quote.project_id == project_id)
+        # any relevant link: legacy mirror, quote-level junction, line-item
-    if category_id:
+        # candidates, or an accepted (decision) target — NOT just the mirror
-        stmt = stmt.where(_quote_category_exists(category_id))
+        stmt = stmt.where(
+            Quote.id.in_(
+                select(Quote.id)
+                .outerjoin(QuoteProjects, QuoteProjects.quote_id == Quote.id)
+                .outerjoin(LineItem, LineItem.quote_id == Quote.id)
+                .outerjoin(LineItemProjects, LineItemProjects.line_item_id == LineItem.id)
+                .outerjoin(ItemDecision, ItemDecision.line_item_id == LineItem.id)
+                .where(
+                    (Quote.project_id == project_id)
+                    | (QuoteProjects.project_id == project_id)
+                    | (LineItemProjects.project_id == project_id)
+                    | (ItemDecision.project_id == project_id)
+                )
+            )
+        )
     if quote_date_from is not None:
         stmt = stmt.where(Quote.quote_date >= quote_date_from)
     if quote_date_to is not None:

backend/app/routers/supplier_materials.py

@@ -58,11 +58,7 @@ async def list_supplier_materials(
     items, meta = await paginate(stmt, page, page_size, db)
     mat_ids = {l.material_id for l in items}
     materials = {m.id: m for m in (await db.execute(select(Material).where(Material.id.in_(mat_ids)))).scalars()}
-    cat_ids = {m.category_id for m in materials.values() if m.category_id}
+    return {"data": [link_to_dict(l, materials.get(l.material_id), None) for l in items], "meta": meta}
-    cats = {}
-    if cat_ids:
-        cats = {c.id: c for c in (await db.execute(select(MaterialCategory).where(MaterialCategory.id.in_(cat_ids)))).scalars()}
-    return {"data": [link_to_dict(l, materials.get(l.material_id), cats.get(materials.get(l.material_id).category_id if l.material_id in materials else None)) for l in items], "meta": meta}
 
 
 @router.post("/suppliers/{supplier_id}/materials", status_code=201)
@@ -72,8 +68,7 @@ async def create_supplier_material(
     async with db.begin():
         link = await link_supplier_material(db, supplier_id, payload.material_id)
         material = await db.get(Material, payload.material_id)
-        category = await db.get(MaterialCategory, material.category_id) if material and material.category_id else None
+    return {"data": link_to_dict(link, material, None)}
-    return {"data": link_to_dict(link, material, category)}
 
 
 @router.delete("/suppliers/{supplier_id}/materials/{material_id}")

backend/app/routers/unit_conversions.py

@@ -1,146 +0,0 @@
-"""Unit conversions — category/brand-scoped (units.html dashboard, P2-28..31).
-
-Model: {category_id, brand?, from_unit, to_unit, factor}
-  1 from_unit = factor × to_unit
-  brand empty = all brands of the category; brand set = that brand only.
-"""
-from fastapi import APIRouter, Depends, Query
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from app.db.engine import get_db
-from app.models.catalog import MaterialCategory, UnitConversion
-from app.schemas.catalog import UnitConversionCreate, UnitConversionUpdate
-from app.services.expand_service import category_brief
-from app.utils.errors import ConflictError, NotFoundError
-from app.utils.pagination import paginate
-from app.utils.serialization import to_iso
-
-router = APIRouter(prefix="/unit-conversions", tags=["unit-conversions"])
-
-
-def uc_to_dict(uc: UnitConversion, expand: set[str] = frozenset()) -> dict:
-    d = {
-        "id": str(uc.id),
-        "category_id": str(uc.category_id),
-        "brand": uc.brand,
-        "from_unit": uc.from_unit,
-        "to_unit": uc.to_unit,
-        "factor": float(uc.factor),
-        "updated_at": to_iso(uc.updated_at),
-    }
-    if "category" in expand and hasattr(uc, "_category"):
-        d["category"] = category_brief(uc._category)
-    return d
-
-
-def _duplicate_condition(uc_or_none, category_id, brand, from_unit, to_unit):
-    """Uniqueness treats NULL brand as a concrete value (matches the partial unique index)."""
-    where = (
-        UnitConversion.category_id == category_id,
-        UnitConversion.from_unit == from_unit,
-        UnitConversion.to_unit == to_unit,
-    )
-    # PG «IS» فقط با NULL معتبر است؛ برای برند مقداردار از «==» استفاده می‌شود
-    where = where + (UnitConversion.brand == brand if brand is not None else UnitConversion.brand.is_(None),)
-    if uc_or_none is not None:
-        where = where + (UnitConversion.id != uc_or_none.id,)
-    return where
-
-
-async def _check_duplicate(db: AsyncSession, exclude_id, category_id, brand, from_unit, to_unit) -> None:
-    duplicate = await db.scalar(
-        select(UnitConversion.id).where(*_duplicate_condition(exclude_id, category_id, brand, from_unit, to_unit))
-    )
-    if duplicate is not None:
-        raise ConflictError("این تبدیل قبلاً ثبت شده است")
-
-
-@router.get("")
-async def list_unit_conversions(
-    page: int = Query(1, ge=1),
-    page_size: int = Query(20, ge=1, le=100),
-    category_id=None,
-    brand: str | None = None,
-    from_unit: str | None = None,
-    to_unit: str | None = None,
-    expand: str | None = None,
-    db: AsyncSession = Depends(get_db),
-):
-    stmt = select(UnitConversion)
-    if category_id:
-        stmt = stmt.where(UnitConversion.category_id == category_id)
-    if brand:
-        stmt = stmt.where(UnitConversion.brand == brand)
-    if from_unit:
-        stmt = stmt.where(UnitConversion.from_unit == from_unit)
-    if to_unit:
-        stmt = stmt.where(UnitConversion.to_unit == to_unit)
-    items, meta = await paginate(stmt, page, page_size, db)
-    tokens = {t.strip() for t in expand.split(",")} if expand else set()
-    if "category" in tokens:
-        cat_ids = {uc.category_id for uc in items}
-        cats = {}
-        if cat_ids:
-            cats = {c.id: c for c in (await db.execute(select(MaterialCategory).where(MaterialCategory.id.in_(cat_ids)))).scalars()}
-        for uc in items:
-            uc._category = cats.get(uc.category_id)
-    return {"data": [uc_to_dict(uc, tokens) for uc in items], "meta": meta}
-
-
-@router.post("", status_code=201)
-async def create_unit_conversion(payload: UnitConversionCreate, db: AsyncSession = Depends(get_db)):
-    category = await db.get(MaterialCategory, payload.category_id)
-    if category is None:
-        raise NotFoundError("دسته‌بندی یافت نشد", field="category_id")
-    await _check_duplicate(db, None, payload.category_id, payload.brand, payload.from_unit, payload.to_unit)
-    uc = UnitConversion(
-        category_id=payload.category_id,
-        brand=payload.brand,
-        from_unit=payload.from_unit,
-        to_unit=payload.to_unit,
-        factor=payload.factor,
-    )
-    db.add(uc)
-    await db.flush()
-    return {"data": uc_to_dict(uc)}
-
-
-@router.get("/{uc_id}")
-async def get_unit_conversion(uc_id, db: AsyncSession = Depends(get_db)):
-    uc = await db.get(UnitConversion, uc_id)
-    if uc is None:
-        raise NotFoundError("تبدیل واحد یافت نشد")
-    return {"data": uc_to_dict(uc)}
-
-
-@router.patch("/{uc_id}")
-async def update_unit_conversion(uc_id, payload: UnitConversionUpdate, db: AsyncSession = Depends(get_db)):
-    uc = await db.get(UnitConversion, uc_id)
-    if uc is None:
-        raise NotFoundError("تبدیل واحد یافت نشد")
-    new_brand = payload.brand if payload.brand is not None else uc.brand
-    new_from = payload.from_unit if payload.from_unit is not None else uc.from_unit
-    new_to = payload.to_unit if payload.to_unit is not None else uc.to_unit
-    if payload.brand is not None or payload.from_unit is not None or payload.to_unit is not None:
-        await _check_duplicate(db, uc.id, uc.category_id, new_brand, new_from, new_to)
-    if payload.brand is not None:
-        uc.brand = payload.brand
-    if payload.from_unit is not None:
-        uc.from_unit = payload.from_unit
-    if payload.to_unit is not None:
-        uc.to_unit = payload.to_unit
-    if payload.factor is not None:
-        uc.factor = payload.factor
-    await db.flush()
-    return {"data": uc_to_dict(uc)}
-
-
-@router.delete("/{uc_id}")
-async def delete_unit_conversion(uc_id, db: AsyncSession = Depends(get_db)):
-    uc = await db.get(UnitConversion, uc_id)
-    if uc is None:
-        raise NotFoundError("تبدیل واحد یافت نشد")
-    await db.delete(uc)
-    await db.flush()
-    return {"data": {"deleted": True}}

backend/app/routers/users.py

@@ -21,6 +21,7 @@ from sqlalchemy import select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.auth import UserContext, get_current_user, require_role
+from app.utils.audit import record as audit_record
 from app.config import settings
 from app.db.engine import get_db
 from app.models.procurement import Project, User
@@ -168,7 +169,7 @@ async def list_users(
 @router.post("", status_code=201)
 async def create_user(
     payload: UserCreate,
-    _: UserContext = Depends(_org_manager),
+    ctx: UserContext = Depends(_org_manager),
     db: AsyncSession = Depends(get_db),
 ):
     """Define a new user (manual identity — casdoor_id optional)."""
@@ -185,6 +186,7 @@ async def create_user(
     )
     db.add(user)
     await db.flush()
+    await audit_record(db, actor=ctx.display_name, action="user.created", entity="user", entity_id=str(user.id), details={"role": payload.role})
     return {"data": user_to_dict(user)}
 
 
@@ -192,7 +194,7 @@ async def create_user(
 async def update_user_role(
     user_id,
     payload: UserRoleUpdate,
-    _: UserContext = Depends(require_role("admin")),
+    ctx: UserContext = Depends(require_role("admin")),
     db: AsyncSession = Depends(get_db),
 ):
     """Set/clear a role — ADMIN ONLY (RBAC): procurement managers must not
@@ -201,10 +203,12 @@ async def update_user_role(
     user = await db.get(User, user_id)
     if user is None:
         raise NotFoundError("کاربر یافت نشد")
+    previous_role = user.role
     if user.role == "pm" and payload.role != "pm":
         await _unassign_projects(db, user.id)
     user.role = payload.role
     await db.flush()
+    await audit_record(db, actor=ctx.display_name, action="user.role_changed", entity="user", entity_id=str(user.id), details={"from": previous_role, "to": payload.role})
     projects = await _user_projects(db, user)
     return {"data": user_to_dict(user, projects)}
 

backend/app/schemas/catalog.py

@@ -89,7 +89,6 @@ class MaterialAttributeIn(APIModel):
 
 
 class MaterialCreate(APIModel):
-    category_id: UUID | None = None  # v2.5: optional — derived from first linked supplier
     name: str = Field(min_length=1)
     topic: str | None = None  # تاپیک جلوی برنامه (Persian) — legacy
     canonical_unit_id: int

backend/app/schemas/inventory.py

@@ -30,6 +30,13 @@ class WarehouseCreate(APIModel):
 
 
 class WarehouseUpdate(APIModel):
+    """Rename/re-describe a warehouse.
+
+    `project_id` is accepted only to be rejected: a warehouse belongs
+    permanently to its parent project and cannot be reassigned (the router
+    answers 400 unless the value equals the current project).
+    """
+
     name: str | None = Field(default=None, min_length=1, max_length=255)
     description: str | None = None
     project_id: UUID | None = None

backend/app/schemas/procurement.py

@@ -37,7 +37,7 @@ class SupplierUpdate(APIModel):
 
 
 class SupplierMaterialCreate(APIModel):
-    """Link a global material to a supplier (derives materials.category_id)."""
+    """Link a global material to a supplier."""
 
     material_id: UUID
 

backend/app/services/analytics.py

@@ -0,0 +1,77 @@
+"""Server-side product analytics — OpenPanel Track API.
+
+Fire-and-forget business events (quote lifecycle, receipts, logins) so the
+OpenPanel dashboards show what actually happens inside the ERP, not just
+page views. Never raises: analytics must not break a business flow.
+
+Configuration (all optional — disabled when any is missing):
+    PROCUREMENT_OPENPANEL_API_URL     e.g. http://openpanel-api:3333 (self-hosted)
+    PROCUREMENT_OPENPANEL_CLIENT_ID   project client id (write mode)
+    PROCUREMENT_OPENPANEL_CLIENT_SECRET  project client secret
+
+Contract (OpenPanel Track API): POST {API_URL}/track with headers
+``openpanel-client-id`` / ``openpanel-client-secret`` and a JSON body
+``{"type": "track"|"identify", "profileId": ..., "event"/"properties": ...}``.
+"""
+import logging
+from typing import Any
+
+import httpx
+
+from app.config import settings
+
+logger = logging.getLogger("procurement.analytics")
+
+_TIMEOUT = httpx.Timeout(3.0)
+
+
+def _configured() -> bool:
+    return bool(
+        settings.OPENPANEL_API_URL
+        and settings.OPENPANEL_CLIENT_ID
+        and settings.OPENPANEL_CLIENT_SECRET
+    )
+
+
+async def track(event: str, properties: dict[str, Any] | None = None, profile_id: str | None = None) -> None:
+    """Record a named event; swallows every error."""
+    if not _configured():
+        return
+    # OpenPanel's Track API takes {type, payload:{…}} (same envelope the browser SDK
+    # sends) — a flat body is rejected with 400, which this module swallows by design.
+    # The payload field is "name" (ITrackPayload in packages/validation) — "event" is
+    # rejected with a 400 that this module swallows.
+    inner: dict[str, Any] = {"name": event, "properties": properties or {}}
+    if profile_id:
+        inner["profileId"] = profile_id
+    body = {"type": "track", "payload": inner}
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            await client.post(
+                f"{settings.OPENPANEL_API_URL.rstrip('/')}/track",
+                json=body,
+                headers={
+                    "openpanel-client-id": settings.OPENPANEL_CLIENT_ID,
+                    "openpanel-client-secret": settings.OPENPANEL_CLIENT_SECRET,
+                },
+            )
+    except Exception as exc:  # noqa: BLE001 — analytics must never raise
+        logger.debug("analytics track failed (%s): %s", event, exc)
+
+
+async def identify(profile_id: str, properties: dict[str, Any] | None = None) -> None:
+    """Create/update a user profile (e.g. on login)."""
+    if not _configured():
+        return
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            await client.post(
+                f"{settings.OPENPANEL_API_URL.rstrip('/')}/track",
+                json={"type": "identify", "payload": {"profileId": profile_id, "properties": properties or {}}},
+                headers={
+                    "openpanel-client-id": settings.OPENPANEL_CLIENT_ID,
+                    "openpanel-client-secret": settings.OPENPANEL_CLIENT_SECRET,
+                },
+            )
+    except Exception as exc:  # noqa: BLE001
+        logger.debug("analytics identify failed: %s", exc)

backend/app/services/expand_service.py

@@ -206,11 +206,6 @@ async def _load_material_maps(db: AsyncSession, materials: list[Material], expan
     material_ids = [m.id for m in materials]
     maps: dict = {"categories": {}, "units": {}, "brands": {}, "material_brands": {}, "mavs": {}, "attr_defs": {}}
 
-    if "category" in expand:
-        cat_ids = {m.category_id for m in materials}
-        rows = (await db.execute(select(MaterialCategory).where(MaterialCategory.id.in_(cat_ids)))).scalars().all()
-        maps["categories"] = {c.id: c for c in rows}
-
     unit_ids: set[int] = set()
     if "canonical_unit" in expand:
         unit_ids |= {m.canonical_unit_id for m in materials}
@@ -257,10 +252,12 @@ def _material_to_dict(m: Material, expand: set[str], maps: dict) -> dict:
         "created_at": to_iso(m.created_at),
         "updated_at": to_iso(m.updated_at),
     }
+    # Category is a supplier attribute now, not a material one — the key stays
+    # in the payload (null) so the contract shape is unchanged.
     if "category" in expand:
-        d["category"] = category_brief(maps["categories"].get(m.category_id))
+        d["category"] = None
     else:
-        d["category_id"] = str(m.category_id)
+        d["category_id"] = None
     if "canonical_unit" in expand:
         d["canonical_unit"] = unit_to_dict(maps["units"].get(m.canonical_unit_id))
     else:
@@ -326,9 +323,6 @@ async def _load_line_item_data(db: AsyncSession, line_items: list[LineItem], exp
         material_ids = {li.material_id for li in line_items}
         materials = (await db.execute(select(Material).where(Material.id.in_(material_ids)))).scalars().all()
         data.materials = {m.id: m for m in materials}
-        cat_ids = {m.category_id for m in materials}
-        cats = (await db.execute(select(MaterialCategory).where(MaterialCategory.id.in_(cat_ids)))).scalars().all()
-        data.categories = {c.id: c for c in cats}
         bms = (await db.execute(select(BrandMaterial).where(BrandMaterial.material_id.in_(material_ids)))).scalars().all()
         brand_ids: set[uuid.UUID] = set()
         for bm in bms:
@@ -450,7 +444,7 @@ def _line_item_expanded(li: LineItem, expand: set[str], data: _LineItemData, inc
             d["material"] = {
                 "id": str(m.id),
                 "name": m.name,
-                "category": category_brief(data.categories.get(m.category_id)),
+                "category": None,
                 "brands": [
                     {"id": str(bm.brand_id), "name": data.brands[bm.brand_id].name, "catalog_code": bm.catalog_code}
                     for bm in data.material_brands.get(m.id, [])

backend/app/services/material_service.py

@@ -12,7 +12,6 @@ from app.models.catalog import (
     BrandMaterial,
     Material,
     MaterialAttributeValue,
-    MaterialCategory,
     Unit,
 )
 from app.schemas.catalog import MaterialAttributeIn, MaterialCreate, MaterialUpdate
@@ -110,9 +109,7 @@ async def validate_attributes(
 async def create_material(db: AsyncSession, payload: MaterialCreate) -> Material:
     """Create a material + brand_materials rows + EAV values in ONE transaction.
 
-    v2.5/2.6: category_id is OPTIONAL — a global material may be created
+    v2.6/v2.7: materials are global and category-free. name is GLOBALLY unique.
-    without a category (it gets derived automatically from the first linked
-    supplier). name is GLOBALLY unique.
     """
     async with db.begin():
         duplicate = await db.scalar(
@@ -121,14 +118,10 @@ async def create_material(db: AsyncSession, payload: MaterialCreate) -> Material
         if duplicate is not None:
             raise ConflictError("متریالی با این نام در کل کاتالوگ قبلاً ثبت شده است", field="name")
 
-        if payload.category_id is not None:
-            if await db.get(MaterialCategory, payload.category_id) is None:
-                raise NotFoundError("دسته‌بندی یافت نشد", field="category_id")
         if not await db.get(Unit, payload.canonical_unit_id):
             raise NotFoundError("واحد مرجع یافت نشد", field="canonical_unit_id")
 
         material = Material(
-            category_id=payload.category_id,
             name=payload.name,
             topic=payload.topic,
             canonical_unit_id=payload.canonical_unit_id,

backend/app/services/quote_service.py

@@ -4,6 +4,7 @@ Every mutation here runs in ONE ``async with db.begin()`` block; any failure
 rolls the whole operation back. All state changes log a quote_event in the
 same transaction.
 """
+import asyncio
 import logging
 from datetime import date, datetime, timezone
 from uuid import UUID
@@ -33,6 +34,7 @@ from app.schemas.procurement import (
     QuoteUpdate,
     RejectQuoteIn,
 )
+from app.services import analytics
 from app.services.material_service import ensure_brand_material_belong
 from app.utils.errors import ConflictError, NotFoundError, ValidationError
 
@@ -56,6 +58,19 @@ def utcnow() -> datetime:
 
 def _add_event(db: AsyncSession, quote_id: UUID, event_type: str, payload: dict | None = None, actor: str | None = None) -> None:
     db.add(QuoteEvent(quote_id=quote_id, event_type=event_type, payload=payload or {}, actor=actor))
+    # Product analytics (fire-and-forget, never blocks or raises): the whole
+    # quote lifecycle funnels through here, so one hook covers every
+    # status transition for the OpenPanel dashboards.
+    try:
+        asyncio.get_running_loop().create_task(
+            analytics.track(
+                f"quote_{event_type}",
+                {"quote_id": str(quote_id), "actor": actor, **(payload or {})},
+                profile_id=actor,
+            )
+        )
+    except RuntimeError:  # no running loop (defensive — callers are async)
+        pass
 
 
 async def get_quote_or_404(db: AsyncSession, quote_id: UUID) -> Quote:
@@ -290,12 +305,78 @@ async def quote_has_receipts(db: AsyncSession, quote_id: UUID) -> bool:
     return (count or 0) > 0
 
 
+async def cleanup_orphan_materials(db: AsyncSession, material_ids) -> list[UUID]:
+    """Check candidate material_ids and purge any that have zero references.
+
+    A material is considered an orphan if:
+    1. It is not referenced by ANY line_items across all quotes.
+    2. It is not referenced by ANY inventory stock items in warehouses.
+
+    If count == 0:
+    - Auxiliary records in supplier_materials, brand_materials, material_units,
+      and material_attribute_values are cleaned up.
+    - The material row is deleted from the central materials table.
+
+    Returns the list of purged material UUIDs.
+    """
+    purged: list[UUID] = []
+    unique_ids = {m for m in material_ids if m is not None}
+    if not unique_ids:
+        return purged
+
+    from app.models.catalog import (
+        BrandMaterial,
+        Material,
+        MaterialAttributeValue,
+        MaterialUnit,
+    )
+    from app.models.inventory import InventoryItem
+    from app.models.procurement import LineItem, SupplierMaterial
+
+    for mat_id in unique_ids:
+        # Check active usage in line_items across the whole system
+        line_item_count = await db.scalar(
+            select(func.count(LineItem.id)).where(LineItem.material_id == mat_id)
+        )
+        if (line_item_count or 0) > 0:
+            continue
+
+        # Check active usage in warehouse inventory
+        inv_count = await db.scalar(
+            select(func.count(InventoryItem.id)).where(InventoryItem.material_id == mat_id)
+        )
+        if (inv_count or 0) > 0:
+            continue
+
+        # Material is not used in ANY line item and not in ANY warehouse inventory: pure orphan!
+        await db.execute(
+            delete(SupplierMaterial).where(SupplierMaterial.material_id == mat_id)
+        )
+        await db.execute(
+            delete(BrandMaterial).where(BrandMaterial.material_id == mat_id)
+        )
+        await db.execute(
+            delete(MaterialUnit).where(MaterialUnit.material_id == mat_id)
+        )
+        await db.execute(
+            delete(MaterialAttributeValue).where(MaterialAttributeValue.material_id == mat_id)
+        )
+        await db.execute(
+            delete(Material).where(Material.id == mat_id)
+        )
+        purged.append(mat_id)
+        logger.info("Purged orphan material %s from central catalog", mat_id)
+
+    return purged
+
+
 async def replace_quote_children(
     db: AsyncSession, quote_id: UUID, payload: QuoteChildrenReplaceIn, actor: str | None = None
 ) -> Quote:
     """Full replacement of a quote's line items + termsheets (edit modal).
 
     Only allowed while the quote is still offered and has no warehouse receipts.
+    Automatically purges any materials detached during this replacement if they become orphans.
     """
     async with db.begin():
         quote = await get_quote_or_404(db, quote_id)
@@ -309,6 +390,11 @@ async def replace_quote_children(
                 "این پیشنهاد به‌دلیل ثبت رسید در انبار، غیرقابل ویرایش یا بازگشت است.",
                 field="status",
             )
+
+        # 1. Pre-update snapshot: record previous material_ids assigned to this quote's items
+        old_items = (await db.execute(select(LineItem).where(LineItem.quote_id == quote.id))).scalars().all()
+        old_material_ids = {li.material_id for li in old_items if li.material_id is not None}
+
         # children cascade via DDL: item_termsheets, item_decisions, item_receipts, schedule_steps
         await db.execute(
             delete(LineItem).where(LineItem.quote_id == quote.id).execution_options(synchronize_session=False)
@@ -317,10 +403,21 @@ async def replace_quote_children(
             delete(Termsheet).where(Termsheet.quote_id == quote.id).execution_options(synchronize_session=False)
         )
         await _insert_children(db, quote.id, quote.supplier_id, payload.line_items, payload.termsheets, payload.item_termsheets)
+        await db.flush()
+
+        # 2. Identify detached materials: previous materials no longer present in the updated line items
+        new_material_ids = {li.material_id for li in payload.line_items if li.material_id is not None}
+        detached_material_ids = old_material_ids - new_material_ids
+
+        # 3. Clean up any detached materials that are now orphans (0 usage)
+        if detached_material_ids:
+            await cleanup_orphan_materials(db, detached_material_ids)
+
         _add_event(db, quote.id, "edited", {"changed_fields": ["line_items", "termsheets"]}, actor)
     return quote
 
 
+
 async def _apply_status_transition(db: AsyncSession, quote: Quote, new_status: str) -> None:
     """Backward transitions only; reverts bookkeeping when going back to offered."""
     current = quote.status
@@ -346,7 +443,7 @@ async def _apply_status_transition(db: AsyncSession, quote: Quote, new_status: s
         li_ids = select(LineItem.id).where(LineItem.quote_id == quote.id)
         await db.execute(
             update(ItemDecision)
-            .where(ItemDecision.line_item_id.in_(li_ids), ItemDecision.status != "pending")
+            .where(ItemDecision.line_item_id.in_(li_ids))
             .values(
                 status="pending",
                 decided_at=None,
@@ -524,21 +621,7 @@ async def accept_quote(db: AsyncSession, quote_id: UUID, payload: AcceptQuoteIn,
                 decision.adjusted_notes = decision_in.adjusted_notes
                 decision.decided_at = utcnow()
 
-        # --- per-material project allocation (تخصیص پروژه به هر قلم) ---
+        # LineItemProjects records in PostgreSQL remain 100% untouched. Only item_decisions.project_id is written.
-        for entry in payload.item_projects:
-            if entry.line_item_id not in li_ids:
-                raise NotFoundError(
-                    "خط آیتم یافت نشد یا متعلق به این پیشنهاد نیست", field="item_projects"
-                )
-            await db.execute(
-                delete(LineItemProjects)
-                .where(LineItemProjects.line_item_id == entry.line_item_id)
-                .execution_options(synchronize_session=False)
-            )
-            for pid in entry.project_ids:
-                if await db.get(Project, pid) is None:
-                    raise NotFoundError("پروژه یافت نشد", field="item_projects.project_ids")
-                db.add(LineItemProjects(line_item_id=entry.line_item_id, project_id=pid))
 
         # termsheets referenced by at least one chosen item -> accepted
         if chosen_ts_ids:
@@ -735,20 +818,36 @@ async def delete_quote(db: AsyncSession, quote_id: UUID) -> dict:
         termsheets = (await db.execute(select(Termsheet).where(Termsheet.quote_id == quote.id))).scalars().all()
         events = (await db.execute(select(QuoteEvent).where(QuoteEvent.quote_id == quote.id))).scalars().all()
 
-        # clean up attachments in MinIO before cascade
+        # collect candidate material_ids for orphan cleanup before deleting quote
+        candidate_material_ids = [li.material_id for li in line_items if li.material_id is not None]
+
+        # collect attachment keys before deleting quote row
         from app.models.files import QuoteAttachment
         from app.services import storage
 
         attachments = (await db.execute(select(QuoteAttachment).where(QuoteAttachment.quote_id == quote.id))).scalars().all()
-        for att in attachments:
+        att_keys = [att.object_key for att in attachments]
-            try:
+        quote_prefix = f"{quote.id}/"
-                await storage.remove_object(att.object_key)
-            except Exception:
-                logger.warning("Failed to remove MinIO object %s for attachment %s", att.object_key, att.id)
 
         await db.delete(quote)
+        await db.flush()
+
+        # Purge any materials that no longer have any references in the system
+        purged_material_ids = await cleanup_orphan_materials(db, candidate_material_ids)
+
+    # Post-commit: clean up attachments in MinIO (best-effort; DB is already committed)
+    for key in att_keys:
+        try:
+            await storage.remove_object(key)
+        except Exception:
+            logger.warning("Failed to remove MinIO object %s for quote %s", key, quote_id)
+    try:
+        await storage.remove_prefix(quote_prefix)
+    except Exception:
+        logger.warning("Failed to remove MinIO prefix %s for quote %s", quote_prefix, quote_id)
+
     return {
-            "id": str(quote.id),
+        "id": str(quote_id),
         "deleted": True,
         "cascaded": {
             "line_items": len(line_items),
@@ -757,10 +856,13 @@ async def delete_quote(db: AsyncSession, quote_id: UUID) -> dict:
             "decisions": len(decisions),
             "receipts": len(receipts),
             "attachments": len(attachments),
+            "purged_orphan_materials": len(purged_material_ids),
         },
     }
 
 
+
+
 # ---------------------------------------------------------------------------
 # Statistics
 # ---------------------------------------------------------------------------
@@ -771,7 +873,6 @@ async def quote_stats(
     project_id: UUID | None = None,
     quote_date_from=None,
     quote_date_to=None,
-    category_id: UUID | None = None,
 ) -> dict:
     conditions = []
     if supplier_id is not None:
@@ -782,8 +883,6 @@ async def quote_stats(
         conditions.append(Quote.quote_date >= quote_date_from)
     if quote_date_to is not None:
         conditions.append(Quote.quote_date <= quote_date_to)
-    if category_id is not None:
-        conditions.append(_quote_has_category(category_id))
 
     rows = (
         await db.execute(
@@ -815,38 +914,46 @@ async def quote_stats(
     }
 
 
-def _quote_has_category(category_id: UUID):
-    """EXISTS: quote has a line item whose material belongs to category_id."""
-    from app.models.catalog import Material
-
-    sub = (
-        select(1)
-        .where(
-            LineItem.quote_id == Quote.id,
-            Material.id == LineItem.material_id,
-            Material.category_id == category_id,
-        )
-    )
-    return func.exists(sub)
-
-
 async def project_stats(db: AsyncSession, project_id: UUID) -> dict:
-    """Counts + total value per quote status for one project.
+    """Counts + total value per quote status for ONE project, isolated per project.
 
-    total_value: SUM(quantity × unit_price) over line items using the chosen
+    A quote lands in this project's «accepted»/«arrived» bucket ONLY if at
-    termsheet link first, else the first link. Rejected line items are
+    least one non-rejected line item's decision targets this project
-    excluded from value sums (contract P1-14).
+    (item_decisions.project_id). A quote merely linked to the project as a
+    candidate (quote-level link, line-item candidates, or accepted for a
+    DIFFERENT project) stays in «offered» — this project never accepted it.
+
+    total_value: SUM(quantity × unit_price) over the bucket's line items,
+    using the chosen termsheet link first, else the first link. Rejected
+    line items are excluded from value sums (contract P1-14).
     """
     project = await db.get(Project, project_id)
     if project is None:
         raise NotFoundError("پروژه یافت نشد")
+    # the route passes the raw path string — normalize for the Python-side
+    # UUID comparisons below (decision.project_id == project_id etc.)
+    project_id = UUID(str(project_id))
 
-    quotes = (await db.execute(select(Quote).where(Quote.project_id == project_id))).scalars().all()
+    # --- every quote RELEVANT to this project (any kind of link) ---
-    if not quotes:
+    quote_id_rows = await db.execute(
+        select(Quote.id)
+        .outerjoin(QuoteProjects, QuoteProjects.quote_id == Quote.id)
+        .outerjoin(LineItem, LineItem.quote_id == Quote.id)
+        .outerjoin(LineItemProjects, LineItemProjects.line_item_id == LineItem.id)
+        .outerjoin(ItemDecision, ItemDecision.line_item_id == LineItem.id)
+        .where(
+            (Quote.project_id == project_id)
+            | (QuoteProjects.project_id == project_id)
+            | (LineItemProjects.project_id == project_id)
+            | (ItemDecision.project_id == project_id)
+        )
+    )
+    quote_ids = [row[0] for row in quote_id_rows.all()]
+    if not quote_ids:
         empty = {status: {"count": 0, "total_value": 0} for status in QUOTE_STATUSES}
         return {"project_id": str(project_id), "total_quotes": 0, **empty}
 
-    quote_ids = [q.id for q in quotes]
+    quotes = (await db.execute(select(Quote).where(Quote.id.in_(quote_ids)))).scalars().all()
     line_items = (await db.execute(select(LineItem).where(LineItem.quote_id.in_(quote_ids)))).scalars().all()
     li_ids = [li.id for li in line_items]
 
@@ -854,6 +961,18 @@ async def project_stats(db: AsyncSession, project_id: UUID) -> dict:
         d.line_item_id: d
         for d in (await db.execute(select(ItemDecision).where(ItemDecision.line_item_id.in_(li_ids)))).scalars().all()
     } if li_ids else {}
+    # line items explicitly linked to this project as candidates
+    candidate_li_ids = set(
+        (
+            await db.execute(
+                select(LineItemProjects.line_item_id).where(
+                    LineItemProjects.line_item_id.in_(li_ids),
+                    LineItemProjects.project_id == project_id,
+                )
+            )
+        ).scalars().all()
+    ) if li_ids else set()
+
     item_termsheets = (
         (await db.execute(select(ItemTermsheet).where(ItemTermsheet.line_item_id.in_(li_ids)))).scalars().all()
     ) if li_ids else []
@@ -862,12 +981,56 @@ async def project_stats(db: AsyncSession, project_id: UUID) -> dict:
     for it in item_termsheets:
         its_by_line.setdefault(it.line_item_id, []).append(it)
 
+    def _items_of(quote: Quote) -> list[LineItem]:
+        return [li for li in line_items if li.quote_id == quote.id]
+
+    def _accepted_for_project(quote: Quote) -> bool:
+        """≥1 non-rejected line item whose decision targets THIS project."""
+        return any(
+            (decision := decisions.get(li.id)) is not None
+            and decision.status == "chosen"
+            and decision.project_id == project_id
+            for li in _items_of(quote)
+        )
+
+    def _has_any_target(quote: Quote) -> bool:
+        """Whether any decision of this quote carries a target project at all
+        (legacy quotes accepted before the decision-project era have none —
+        they keep the old global-status classification)."""
+        return any(
+            (decisions.get(li.id) is not None and decisions[li.id].project_id is not None)
+            for li in _items_of(quote)
+        )
+
     per_status = {status: {"count": 0, "total_value": 0.0} for status in QUOTE_STATUSES}
     for q in quotes:
+        if q.status in ("accepted", "arrived") and _has_any_target(q) and not _accepted_for_project(q):
+            per_status["offered"]["count"] += 1  # linked, but never accepted for THIS project
+        else:
             per_status[q.status]["count"] += 1
 
     for li in line_items:
+        quote = next(q for q in quotes if q.id == li.quote_id)
         decision = decisions.get(li.id)
+
+        # --- which status bucket does this line item's value belong to? ---
+        accepted_here = (
+            decision is not None
+            and decision.status == "chosen"
+            and decision.project_id == project_id
+        )
+        if quote.status in ("accepted", "arrived") and _has_any_target(quote):
+            if accepted_here:
+                bucket = quote.status
+            elif li.id in candidate_li_ids:
+                # the quote is still just a proposal for this project — the
+                # item's candidate value stays in the offered bucket
+                bucket = "offered"
+            else:
+                continue  # this item targets another project entirely
+        else:
+            bucket = quote.status
+
         if decision is not None and decision.status == "rejected":
             continue  # rejected items excluded from value sums
         if decision is not None and decision.chosen_item_termsheet_id is not None:
@@ -877,8 +1040,7 @@ async def project_stats(db: AsyncSession, project_id: UUID) -> dict:
             price_it = links[0] if links else None
         if price_it is None:
             continue
-        quote = next(q for q in quotes if q.id == li.quote_id)
+        per_status[bucket]["total_value"] += float(price_it.unit_price * li.quantity)
-        per_status[quote.status]["total_value"] += float(price_it.unit_price * li.quantity)
 
     result = {"project_id": str(project_id), "total_quotes": len(quotes)}
     for status, values in per_status.items():

backend/app/services/storage.py

@@ -66,3 +66,22 @@ async def remove_object(key: str) -> None:
         await asyncio.to_thread(get_client().remove_object, settings.MINIO_BUCKET, key)
     except Exception:
         logger.warning("Could not remove MinIO object %r — ignoring", key)
+
+
+async def remove_prefix(prefix: str) -> None:
+    """Delete all objects matching a prefix in the bucket (best-effort)."""
+    client = get_client()
+
+    def _sync_remove_prefix():
+        try:
+            objects = client.list_objects(settings.MINIO_BUCKET, prefix=prefix, recursive=True)
+            for obj in objects:
+                try:
+                    client.remove_object(settings.MINIO_BUCKET, obj.object_name)
+                except Exception:
+                    logger.warning("Could not remove MinIO object %r under prefix %r", obj.object_name, prefix)
+        except Exception:
+            logger.warning("Could not list MinIO objects under prefix %r — ignoring", prefix)
+
+    await asyncio.to_thread(_sync_remove_prefix)
+

backend/app/services/supplier_material_service.py

@@ -1,10 +1,6 @@
-"""Supplier ↔ material link service (v2.5) — the direct edge of the new flow.
+"""Supplier ↔ material link service (v2.6/v2.7) — the direct edge of the catalog flow.
 
-Linking a material to a supplier derives materials.category_id from the
+Suppliers can supply any global material across categories.
-supplier's category when the material has none (first-link-wins). The same
-rule is enforced by the DB trigger trg_supplier_materials_derive_category;
-this service applies it in the application layer so the ORM state is
-consistent inside the same transaction.
 """
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -17,7 +13,7 @@ from app.utils.errors import NotFoundError, ValidationError
 async def link_supplier_material(
     db: AsyncSession, supplier_id, material_id, is_active: bool = True
 ) -> SupplierMaterial:
-    """Upsert a supplier<->material link (idempotent) + derive category (first-link-wins).
+    """Upsert a supplier<->material link (idempotent).
 
     Caller is responsible for the surrounding transaction.
     """
@@ -42,15 +38,11 @@ async def link_supplier_material(
     link = SupplierMaterial(supplier_id=supplier_id, material_id=material_id, is_active=is_active)
     db.add(link)
     await db.flush()
-
-    # First-link-wins: only when the material has no category yet.
-    if material.category_id is None:
-        material.category_id = supplier.category_id
     return link
 
 
 async def unlink_supplier_material(db: AsyncSession, supplier_id, material_id) -> None:
-    """Remove the link. The material's category is NEVER auto-cleared (documented rule)."""
+    """Remove the link."""
     link = await db.scalar(
         select(SupplierMaterial).where(
             SupplierMaterial.supplier_id == supplier_id,

backend/app/utils/audit.py

@@ -0,0 +1,41 @@
+"""Audit helper — one row per sensitive mutation, written in the SAME
+transaction as the change (rolled back together with it).
+
+    await record(db, actor=ctx.display_name, action="user.role_changed",
+                 entity="user", entity_id=str(user.id),
+                 details={"from": old_role, "to": user.role})
+
+Never raises: an audit failure must not fail the business operation.
+"""
+import logging
+from typing import Any
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.audit import AuditLog
+
+logger = logging.getLogger("procurement.audit")
+
+
+async def record(
+    db: AsyncSession,
+    *,
+    actor: str | None,
+    action: str,
+    entity: str,
+    entity_id: str | None = None,
+    details: dict[str, Any] | None = None,
+) -> None:
+    try:
+        db.add(
+            AuditLog(
+                actor=actor,
+                action=action,
+                entity=entity,
+                entity_id=str(entity_id) if entity_id else None,
+                details=details or {},
+            )
+        )
+        await db.flush()
+    except Exception:  # noqa: BLE001 — audit must never break the caller
+        logger.exception("failed to write audit_log row (%s/%s)", action, entity)

backend/app/utils/preview_token.py

@@ -0,0 +1,71 @@
+"""Ephemeral, URL-safe file-preview tokens.
+
+Why this exists
+---------------
+File downloads require an ``Authorization: Bearer`` header, but a browser
+cannot attach headers to the requests made by ``<iframe src>`` / ``<img
+src>`` — which is what the preview modal uses. The previous workaround
+fetched the bytes with ``fetch`` and rendered a local ``blob:`` URL, but
+download managers (IDM et al.) hook ``blob:`` URLs, fail to resolve them
+outside the originating document, and hand the browser a 0-byte file under
+a bare UUID name — so the preview broke and a junk download appeared.
+
+Instead we mint a short-lived HMAC token scoped to a single attachment and
+put it in the query string, giving the iframe a *real* URL that also
+carries its own authorization. The token is not a session credential: it
+authorises exactly one (quote_id, kind, attachment_id) triple and expires
+in minutes.
+
+Format: ``<expiry-unix>.<hex-hmac>`` over ``"{quote_id}:{kind}:{attachment_id}:{expiry}"``.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import time
+import uuid
+
+from app.config import settings
+
+# پیش‌نمایش کوتاه‌عمر است — فقط برای باز شدن مودال، نه اشتراک‌گذاری لینک
+DEFAULT_TTL_SECONDS = 300
+
+
+def _secret() -> bytes:
+    """Key for the HMAC. Reuses existing secrets so no new config is needed."""
+    base = (
+        settings.CASDOOR_CLIENT_SECRET
+        or settings.MINIO_SECRET_KEY
+        or "procurement-preview-fallback"
+    )
+    return base.encode("utf-8")
+
+
+def _sign(quote_id: uuid.UUID, kind: str, attachment_id: uuid.UUID, expiry: int) -> str:
+    msg = f"{quote_id}:{kind}:{attachment_id}:{expiry}".encode("utf-8")
+    return hmac.new(_secret(), msg, hashlib.sha256).hexdigest()
+
+
+def make_preview_token(
+    quote_id: uuid.UUID, kind: str, attachment_id: uuid.UUID, ttl: int = DEFAULT_TTL_SECONDS
+) -> str:
+    expiry = int(time.time()) + ttl
+    return f"{expiry}.{_sign(quote_id, kind, attachment_id, expiry)}"
+
+
+def verify_preview_token(
+    token: str, quote_id: uuid.UUID, kind: str, attachment_id: uuid.UUID
+) -> bool:
+    """True when the token is well-formed, unexpired and matches this file."""
+    if not token or "." not in token:
+        return False
+    expiry_raw, signature = token.split(".", 1)
+    try:
+        expiry = int(expiry_raw)
+    except ValueError:
+        return False
+    if expiry < int(time.time()):
+        return False
+    expected = _sign(quote_id, kind, attachment_id, expiry)
+    return hmac.compare_digest(expected, signature)

backend/app/utils/ratelimit.py

@@ -0,0 +1,11 @@
+"""Shared rate limiter (slowapi) — in-memory, single-worker friendly.
+
+Login brute-force brake: the edge (Traefik) has a coarse per-IP limit for
+the whole API host; this adds a tight limit on the credential endpoint
+itself. Kept in its own module so routers can import it without a circular
+import on app.main.
+"""
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+limiter = Limiter(key_func=get_remote_address)

backend/app/utils/security.py

@@ -1,14 +1,33 @@
-"""Placeholder auth: no middleware logic, only a header read for `actor` attribution."""
+"""Attribution for quote_events.actor — the VERIFIED user, not the raw token.
+
+Historically this stored the bearer token string verbatim (unverifiable and
+a token leak into the database). All routes that use it now sit behind the
+global JWT dependency, so the token is resolved to the authenticated user
+and the display name is recorded instead.
+"""
 from fastapi import Request
 
+from app.auth import get_optional_user
 
-def get_actor(request: Request) -> str | None:
-    """Extract the bearer token (if any) to attribute quote_events.actor.
 
-    This is the reserved placeholder from the contract — no authentication
+async def get_actor(request: Request) -> str | None:
-    or authorization is enforced yet.
+    """Resolve the caller's display name from the Casdoor Bearer token.
+
+    Uses its own session (get_optional_user default) — same reason as
+    get_current_user: quote routers open explicit db.begin() blocks.
     """
-    auth = request.headers.get("Authorization")
+    ctx = await get_optional_user(request)
-    if auth and auth.lower().startswith("bearer "):
+    if ctx is not None:
-        return auth[7:].strip() or None
+        return ctx.display_name
-    return None
+    # Dev-mode header fallback (only active when DEV_LOGIN_ENABLED) carries
+    # the name in X-User-Name / X-User-Name-B64 — keep attribution useful.
+    name = request.headers.get("x-user-name")
+    import base64
+
+    b64 = request.headers.get("x-user-name-b64")
+    if b64:
+        try:
+            name = base64.b64decode(b64.encode()).decode("utf-8")
+        except Exception:
+            pass
+    return name

backend/requirements.txt

@@ -10,3 +10,13 @@ minio>=7.2.0
 # v2.6 — Casdoor JWT auth
 pyjwt[crypto]>=2.8.0
 httpx>=0.27.0
+
+# Casdoor seeding — bcrypt password hashes (never plaintext)
+bcrypt>=4.1.0
+
+# Observability — metrics + Sentry/GlitchTip exception capture
+prometheus-fastapi-instrumentator>=7.0.0
+sentry-sdk[fastapi]>=2.0.0
+
+# Rate limiting (login brute-force brake; edge limit lives in Traefik)
+slowapi>=0.1.9

backend/tools/seed.py

@@ -209,7 +209,7 @@ async def run() -> None:
             "item_decisions, item_termsheets, termsheet_schedule_steps, termsheets, line_item_specs, "
             "line_items, quotes, supplier_materials, suppliers, brand_materials, "
             "material_attribute_values, materials, brands, warehouses, projects, users, "
-            "category_reference_units, unit_conversions, standard_conversions "
+            "standard_conversions "
             "RESTART IDENTITY CASCADE"
         ))
         # Only the 8 canonical topic categories may exist — any leftover slug
@@ -261,9 +261,7 @@ async def run() -> None:
         material_by_name: dict[str, Material] = {}
         brand_material_by_material: dict[str, object] = {}
         for name, cat_slug, unit_code, brand_name in MATERIALS:
-            cat = await get_category(db, cat_slug)
             material = Material(
-                category_id=cat.id,
                 name=name,
                 canonical_unit_id=unit_ids[unit_code],
                 status="active",
@@ -289,8 +287,10 @@ async def run() -> None:
             await db.flush()
             suppliers.append(sup)
         # last-quoted prices: link each supplier to 2 materials of its category
+        sup_cat_slug = {name: cat_slug for name, cat_slug, *_ in SUPPLIERS}
         for sup in suppliers:
-            cat_materials = [m for m in material_by_name.values() if m.category_id == sup.category_id]
+            target_slug = sup_cat_slug.get(sup.name)
+            cat_materials = [material_by_name[mat_name] for mat_name, c_slug, *_ in MATERIALS if c_slug == target_slug]
             for m in cat_materials[:2]:
                 db.add(SupplierMaterial(
                     supplier_id=sup.id, material_id=m.id, is_active=True,

backend/tools/seed_casdoor.py

@@ -20,22 +20,34 @@ import json
 import os
 import urllib.request
 
+import bcrypt
+
 BASE = os.environ.get("CASDOOR_BASE", "http://localhost:8080")
 ADMIN = os.environ.get("CASDOOR_ADMIN", "admin")
+# Casdoor's own bootstrap default for the built-in console admin is "123" —
+# the seeder LOGS IN with it (it cannot change the console password).
+# Override with CASDOOR_ADMIN_PW after rotating (docs/SECRET-MANAGEMENT.md);
+# production MUST set a real value here once the console password is rotated.
 ADMIN_PW = os.environ.get("CASDOOR_ADMIN_PW", "123")
 
 ORG = "inventory"
 APP = "inventory-app"
 CLIENT_ID = "inventory-app-client"
-CLIENT_SECRET = "inventory-app-secret-2026"
+# Must MATCH the API's PROCUREMENT_CASDOOR_CLIENT_SECRET (compose default
+# below) — changing one without the other breaks POST /auth/login.
+CLIENT_SECRET = os.environ.get("CASDOOR_CLIENT_SECRET", "inventory-app-secret-2026")
 REDIRECT_URI = "http://localhost/login"  # Traefik edge (v1.3); unused by the in-page flow
 
+# One password for all seeded dev users — override with CASDOOR_SEED_PASSWORD;
+# stored as a bcrypt hash (passwordType "bcrypt"), never plaintext.
+SEED_PASSWORD = os.environ.get("CASDOOR_SEED_PASSWORD", "123456")
+
 USERS = [
-    # (name, first_name, last_name, email, password)
+    # (name, first_name, last_name, email)
-    ("razaei", "آقای", "رضایی", "razaei@sample.ir", "123456"),
+    ("razaei", "آقای", "رضایی", "razaei@sample.ir"),
-    ("mousavi", "آقای", "موسوی", "mousavi@sample.ir", "123456"),
+    ("mousavi", "آقای", "موسوی", "mousavi@sample.ir"),
-    ("mohaghegh", "آقای", "محقق", "mohaghegh@sample.ir", "123456"),
+    ("mohaghegh", "آقای", "محقق", "mohaghegh@sample.ir"),
-    ("tester", "کاربر", "تست", "tester@sample.ir", "123456"),
+    ("tester", "کاربر", "تست", "tester@sample.ir"),
 ]
 
 
@@ -69,17 +81,21 @@ def _login():
     return jar
 
 
+def _bcrypt(pw: str) -> str:
+    return bcrypt.hashpw(pw.encode("utf-8"), bcrypt.gensalt()).decode("ascii")
+
+
 def main():
     cookies = _login()
     if cookies is None:
         return
 
-    # 1) organization (passwordType "plain" = dev: passwords stored as-is)
+    # 1) organization (bcrypt — passwords are never stored plaintext)
     status, body = _request("POST", "/api/add-organization", {
         "owner": "admin",
         "name": ORG,
         "displayName": "سازمان تدارکات",
-        "passwordType": "plain",
+        "passwordType": "bcrypt",
     }, cookies)
     print("add-organization:", status, body.get("msg", body.get("error", "")))
 
@@ -102,7 +118,8 @@ def main():
     print("add-application:", status, body.get("msg", body.get("error", "")))
 
     # 3) users (roles are NOT stored here — they live in the app's users table)
-    for name, first, last, email, pw in USERS:
+    pw_hash = _bcrypt(SEED_PASSWORD)
+    for name, first, last, email in USERS:
         status, body = _request("POST", "/api/add-user", {
             "owner": ORG,
             "name": name,
@@ -110,21 +127,23 @@ def main():
             "firstName": first,
             "lastName": last,
             "email": email,
-            "password": pw,
+            "password": pw_hash,
-            "passwordType": "plain",
+            "passwordType": "bcrypt",
             "phone": "",
             "type": "normal-user",
         }, cookies)
         print(f"add-user {name}:", status, body.get("msg", body.get("error", "")))
         # Ensure passwordType even for already-existing users (this Casdoor
         # version refuses login when both user and org passwordType are empty).
-        status, body = _request("POST", f"/api/update-user?id={ORG}/{name}&columns=password_type", {
+        status, body = _request("POST", f"/api/update-user?id={ORG}/{name}&columns=password_type,password", {
-            "passwordType": "plain",
+            "passwordType": "bcrypt",
+            "password": pw_hash,
         }, cookies)
         print(f"set-password-type {name}:", status, body.get("msg", body.get("error", "")))
 
-    print("\nDone. Casdoor console: http://localhost:8080 (admin/123)")
+    print("\nDone. Casdoor console: http://localhost:8080")
-    print("Login in the app: http://localhost:3000/login")
+    print(f"Seeded users password: {SEED_PASSWORD} (change via CASDOOR_SEED_PASSWORD)")
+    print("Login in the app: http://localhost/login")
 
 
 if __name__ == "__main__":

backend/tools/smoke_test.py

@@ -1,9 +1,14 @@
 """End-to-end smoke tests against a running server (http://127.0.0.1:8000).
 
-Run:  .venv/Scripts/python.exe tools/smoke_test.py
+Dataset-independent: assertions verify BEHAVIOR (status codes, envelopes,
+shapes, filtering) rather than exact seed counts, so the suite works with
+any seed version. Run from the api container or a host with access:
+
+Run:  python tools/smoke_test.py
+Env:  SMOKE_USER / SMOKE_PASSWORD (default tester / 123456 — seeded users)
 """
+import os
 import sys
-from pprint import pprint
 
 import httpx
 
@@ -23,84 +28,150 @@ def check(name, ok, extra=""):
 
 c = httpx.Client(base_url=BASE, timeout=30)
 
+# ---------- auth: every endpoint now requires a Casdoor JWT ----------
+r = c.post("/auth/login", json={
+    "username": os.environ.get("SMOKE_USER", "tester"),
+    "password": os.environ.get("SMOKE_PASSWORD", "123456"),
+})
+check("POST /auth/login", r.status_code == 200, r.text[:200])
+if r.status_code == 200:
+    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"
+
 # ---------- catalog ----------
 r = c.get("/units", params={"page_size": 5})
-check("GET /units", r.status_code == 200 and len(r.json()["data"]) == 5 and "si_factor" in r.json()["data"][0])
+units = r.json()["data"] if r.status_code == 200 else []
+check("GET /units", r.status_code == 200 and len(units) == 5 and "si_factor" in units[0])
 
-r = c.get("/units", params={"dimension": "mass"})
+if units:
-check("GET /units?dimension=mass", r.status_code == 200 and r.json()["meta"]["total"] == 3)
+    dim = units[0]["dimension"]
+    r = c.get("/units", params={"dimension": dim, "page_size": 100})
+    body = r.json()
+    check(
+        "GET /units?dimension filter",
+        r.status_code == 200 and body["meta"]["total"] >= 1
+        and all(u["dimension"] == dim for u in body["data"]),
+        r.text[:200],
+    )
 
 r = c.get("/brands")
-check("GET /brands", r.status_code == 200 and r.json()["meta"]["total"] == 10)
+brands = r.json()["data"] if r.status_code == 200 else []
+check("GET /brands", r.status_code == 200 and brands and r.json()["meta"]["total"] >= 1)
 
-r = c.get("/material-categories", params={"q": "سیمان"})
+# category q-search (only when categories exist)
-check("GET /material-categories?q", r.status_code == 200 and r.json()["meta"]["total"] >= 1)
+r = c.get("/material-categories", params={"page_size": 100})
+cats = r.json()["data"] if r.status_code == 200 else []
+check("GET /material-categories", r.status_code == 200 and isinstance(cats, list))
+if cats:
+    needle = cats[0]["name"][:3]
+    r = c.get("/material-categories", params={"q": needle})
+    check(
+        "GET /material-categories?q (unicode search)",
+        r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200],
+    )
 
-r = c.get("/materials", params={"q": "میلگرد A3 سایز ۱۴"})
+# materials: q-search against a REAL seeded name (fetched, not hard-coded)
-check("GET /materials?q (unicode)", r.status_code == 200 and r.json()["meta"]["total"] == 1, r.text[:200])
+r = c.get("/materials", params={"page_size": 100})
+materials = r.json()["data"] if r.status_code == 200 else []
+check("GET /materials", r.status_code == 200 and materials and r.json()["meta"]["total"] >= 1)
 
-r = c.get("/materials", params={"expand": "category,brands,canonical_unit,attributes", "q": "میلگرد A3 سایز ۱۴"})
+if materials:
-if r.status_code == 200 and r.json()["data"]:
+    target = materials[0]
-    m = r.json()["data"][0]
+    needle = target["name"].split()[0]
+    r = c.get("/materials", params={"q": needle})
+    check(
+        "GET /materials?q (unicode search)",
+        r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200],
+    )
+
+    r = c.get("/materials", params={"expand": "category,brands,canonical_unit,attributes", "q": needle})
+    expanded = [m for m in r.json().get("data", []) if m["id"] == target["id"]]
+    if r.status_code == 200 and expanded:
+        m = expanded[0]
         check(
             "GET /materials expand",
             "category" in m and "brands" in m and "canonical_unit" in m and "attributes" in m,
         )
         check("expand category shape", m["category"].keys() == {"id", "slug", "name"})
-    check("expand brands has catalog_code+is_active", all(set(b) >= {"id", "name", "catalog_code", "is_active"} for b in m["brands"]))
+        check("expand brands shape", all(set(b) >= {"id", "name", "catalog_code", "is_active"} for b in m["brands"]))
         check("expand canonical_unit shape", m["canonical_unit"].keys() == {"id", "code", "name_fa"})
         check("expand attributes EAV flattened", all(set(a) >= {"attribute_key", "label", "data_type", "value", "unit"} for a in m["attributes"]))
-else:
+    else:
         check("GET /materials expand", False, r.text[:300])
 
-# dynamic EAV filter: attr_rebar_diameter=14
+# ---------- EAV filters (positive filter only when the seed has values) ----------
-r = c.get("/materials", params={"attr_rebar_diameter": "14", "expand": "attributes"})
+r = c.get("/attribute-definitions", params={"page_size": 100})
-if r.status_code == 200:
+attr_defs = r.json()["data"] if r.status_code == 200 else []
-    data = r.json()["data"]
+
-    ok = len(data) == 1 and data[0]["name"] == "میلگرد A3 سایز ۱۴"
+if attr_defs and materials:
-    check("GET /materials?attr_rebar_diameter=14", ok, r.text[:200])
+    r = c.get("/materials", params={"expand": "attributes", "page_size": 100})
+    with_attrs = [m for m in r.json().get("data", []) if m.get("attributes")]
+    if with_attrs:
+        m0 = with_attrs[0]
+        key = m0["attributes"][0]["attribute_key"]
+        value = str(m0["attributes"][0]["value"])
+        r = c.get("/materials", params={f"attr_{key}": value, "expand": "attributes"})
+        check(
+            f"GET /materials?attr_{key} filter",
+            r.status_code == 200 and any(x["id"] == m0["id"] for x in r.json().get("data", [])),
+            r.text[:200],
+        )
+    else:
+        print("  SKIP  EAV positive filter — seed defines no material attribute values")
 else:
-    check("GET /materials?attr_rebar_diameter=14", False, r.text[:200])
+    print("  SKIP  EAV positive filter — seed defines no attribute definitions")
 
-# EAV boolean filter: attr_rebar_ribbed=true
+# unknown attr filter -> 400 (dataset-independent)
-r = c.get("/materials", params={"attr_rebar_ribbed": "true"})
-check("GET /materials?attr_rebar_ribbed=true", r.status_code == 200 and r.json()["meta"]["total"] == 1, r.text[:200])
-
-# brand filter
-r = c.get("/brands", params={"q": "فولاد مبارکه"})
-brand_id = r.json()["data"][0]["id"]
-r = c.get("/materials", params={"brand_id": brand_id})
-check("GET /materials?brand_id=", r.status_code == 200 and r.json()["meta"]["total"] == 3, r.text[:200])
-
-# unknown attr filter -> 400
 r = c.get("/materials", params={"attr_nonexistent": "1"})
 check("unknown attr filter -> 400", r.status_code == 400 and r.json()["error"]["code"] == "VALIDATION_ERROR")
 
 r = c.get("/materials?page_size=999")
 check("page_size>100 -> 400", r.status_code == 400)
 
+# brand filter via a brand that actually has material links
+r = c.get("/brand-materials", params={"page_size": 100})
+brand_links = r.json()["data"] if r.status_code == 200 else []
+if brand_links:
+    brand_id = brand_links[0]["brand_id"]
+    r = c.get("/materials", params={"brand_id": brand_id})
+    check("GET /materials?brand_id=", r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200])
+    r = c.get("/brand-materials", params={"brand_id": brand_id})
+    check("GET /brand-materials?brand_id", r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:200])
+else:
+    check("GET /materials?brand_id=", False, "seed has no brand-material links")
+
+# ---------- suppliers / projects ----------
 r = c.get("/suppliers")
-check("GET /suppliers", r.status_code == 200 and r.json()["meta"]["total"] == 6)
+suppliers = r.json()["data"] if r.status_code == 200 else []
+check("GET /suppliers", r.status_code == 200 and suppliers)
 
 r = c.get("/projects")
-check("GET /projects", r.status_code == 200 and r.json()["meta"]["total"] == 5)
+projects = r.json()["data"] if r.status_code == 200 else []
+check("GET /projects", r.status_code == 200 and projects)
 
-r = c.get("/attribute-definitions", params={"expand": "unit"})
+r = c.get("/attribute-definitions")
-check("GET /attribute-definitions", r.status_code == 200 and r.json()["meta"]["total"] == 28, r.text[:200])
+attr_shape_ok = r.status_code == 200 and all(
+    set(a) >= {"attribute_key", "label", "data_type"} for a in r.json().get("data", [])
+)
+check("GET /attribute-definitions", attr_shape_ok, r.text[:200])
 
-r = c.get("/material-categories/{cid}/attributes".format(cid=c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]["id"]))
+if cats:
-check("GET category attributes (nested attribute)", r.status_code == 200 and len(r.json()["data"]) == 3 and "attribute" in r.json()["data"][0])
+    r = c.get(f"/material-categories/{cats[0]['id']}/attributes")
-
+    check(
-r = c.get("/brand-materials", params={"brand_id": brand_id})
+        "GET category attributes (nested)",
-check("GET /brand-materials?brand_id", r.status_code == 200 and r.json()["meta"]["total"] == 3)
+        r.status_code == 200 and isinstance(r.json()["data"], list)
+        and all("attribute" in a for a in r.json()["data"]),
+        r.text[:200],
+    )
 
 # ---------- quotes ----------
 r = c.get("/quotes", params={"page_size": 5})
-check("GET /quotes", r.status_code == 200 and r.json()["meta"]["total"] == 7, r.text[:300])
+quotes = r.json()["data"] if r.status_code == 200 else []
+check("GET /quotes", r.status_code == 200 and quotes and r.json()["meta"]["total"] >= 1)
 
-r = c.get("/quotes", params={"expand": "line_items,termsheets,events,supplier,project", "status": "accepted"})
+r = c.get("/quotes", params={"expand": "line_items,termsheets,events,supplier,project"})
-if r.status_code == 200 and r.json()["data"]:
+accepted = [q for q in r.json().get("data", []) if q.get("line_items")] if r.status_code == 200 else []
-    q = r.json()["data"][0]
+if accepted:
+    q = accepted[0]
     li = q["line_items"][0]
     check(
         "GET /quotes expand full shape",
@@ -111,21 +182,34 @@ if r.status_code == 200 and r.json()["data"]:
         r.text[:400],
     )
     check("events sorted ASC", [e["event_type"] for e in q["events"]] == sorted([e["event_type"] for e in q["events"]]))
+    if q["termsheets"]:
         check("termsheet has schedule_steps", "schedule_steps" in q["termsheets"][0])
 else:
     check("GET /quotes expand full shape", False, r.text[:400])
 
 r = c.get("/quotes/stats")
-check("GET /quotes/stats", r.status_code == 200 and r.json()["data"]["total"] == 7 and "average_lead_time_days" in r.json()["data"], r.text[:300])
+stats_ok = r.status_code == 200 and "average_lead_time_days" in r.json()["data"]
+if quotes:
+    stats_ok = stats_ok and r.json()["data"]["total"] == r.json()["data"]["offered"] + \
+        r.json()["data"]["accepted"] + r.json()["data"]["arrived"] + \
+        r.json()["data"]["rejected"] + r.json()["data"]["expired"]
+check("GET /quotes/stats", stats_ok, r.text[:300])
 
 r = c.get("/quotes/stats", params={"status": "offered"})  # status filter not part of stats contract; ensure no crash
 check("GET /quotes/stats (extra param ignored)", r.status_code == 200)
 
-r = c.get("/quotes", params={"q": "میلگرد"})
+if materials:
-check("GET /quotes?q (searches material names)", r.status_code == 200 and r.json()["meta"]["total"] >= 1, r.text[:300])
+    needle = materials[0]["name"].split()[0]
+    r = c.get("/quotes", params={"q": needle})
+    check("GET /quotes?q (searches material names)", r.status_code == 200, r.text[:300])
 
-r = c.get("/projects/{pid}/stats".format(pid=c.get("/projects", params={"q": "ونوس"}).json()["data"][0]["id"]))
+if projects:
-check("GET /projects/{id}/stats", r.status_code == 200 and set(r.json()["data"]) >= {"total_quotes", "offered", "accepted", "arrived", "rejected", "expired"}, r.text[:300])
+    r = c.get(f"/projects/{projects[0]['id']}/stats")
+    check(
+        "GET /projects/{id}/stats",
+        r.status_code == 200 and set(r.json()["data"]) >= {"total_quotes", "offered", "accepted", "arrived", "rejected", "expired"},
+        r.text[:300],
+    )
 
 print(f"\n===== {PASS} passed, {FAIL} failed =====")
 sys.exit(1 if FAIL else 0)

backend/tools/smoke_test_misc.py

@@ -19,9 +19,20 @@ def check(name, ok, extra=""):
 
 c = httpx.Client(base_url=BASE, timeout=30)
 
+# ---------- auth: every endpoint now requires a Casdoor JWT ----------
+import os
+
+r = c.post("/auth/login", json={
+    "username": os.environ.get("SMOKE_USER", "tester"),
+    "password": os.environ.get("SMOKE_PASSWORD", "123456"),
+})
+check("POST /auth/login", r.status_code == 200, r.text[:200])
+if r.status_code == 200:
+    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"
+
 # ---------- units ----------
 r = c.post("/units", json={"code": "test-unit", "name_fa": "واحد تست", "dimension": "count", "si_factor": 1.0})
-check("POST /units", r.status_code == 201 and r.json()["data"]["id"] > 19, r.text[:200])
+check("POST /units", r.status_code == 201 and r.json()["data"]["si_factor"] == 1.0, r.text[:200])
 uid = r.json()["data"]["id"]
 r = c.post("/units", json={"code": "test-unit", "si_factor": 1.0})
 check("POST /units duplicate code -> 409", r.status_code == 409, r.text[:200])
@@ -42,21 +53,28 @@ r = c.patch(f"/brands/{bid}", json={"name": "برند تست ۲"})
 check("PATCH /brands", r.status_code == 200 and r.json()["data"]["name"] == "برند تست ۲")
 r = c.delete(f"/brands/{bid}")
 check("DELETE /brands (unused)", r.status_code == 200)
-r = c.get("/brands", params={"q": "فولاد مبارکه"})
+_bml = c.get("/brand-materials", params={"page_size": 1}).json()["data"]
-brand = r.json()["data"][0]
+if _bml:
+    brand = {"id": _bml[0]["brand_id"]}
+else:
+    brand = c.get("/brands", params={"page_size": 1}).json()["data"][0]
 r = c.delete(f"/brands/{brand['id']}")
 check("DELETE /brands with associations -> 409", r.status_code == 409, r.text[:200])
 
 # ---------- categories ----------
 r = c.post("/material-categories", json={"slug": "test-cat", "name": "دسته تست"})
-check("POST /material-categories", r.status_code == 201, r.text[:200])
+if r.status_code == 409:  # rerun safety — fetch the existing test category
-cid = r.json()["data"]["id"]
+    cid = c.get("/material-categories", params={"q": "test-cat"}).json()["data"][0]["id"]
+    check("POST /material-categories (exists from previous run)", True)
+else:
+    check("POST /material-categories", r.status_code == 201, r.text[:200])
+    cid = r.json()["data"]["id"]
 r = c.patch(f"/material-categories/{cid}", json={"name": "دسته تست ۲", "is_active": False})
 check("PATCH /material-categories", r.status_code == 200 and r.json()["data"]["is_active"] is False)
 r = c.delete(f"/material-categories/{cid}")
 check("DELETE /material-categories (empty)", r.status_code == 200)
-r = c.get("/material-categories", params={"q": "میلگرد"})
+_mat0 = c.get("/materials", params={"page_size": 1, "expand": "category"}).json()["data"][0]
-cat = r.json()["data"][0]
+cat = _mat0["category"]
 r = c.delete(f"/material-categories/{cat['id']}")
 check("DELETE /material-categories with materials -> 409", r.status_code == 409, r.text[:200])
 
@@ -75,11 +93,16 @@ r = c.patch(f"/attribute-definitions/{adid}", json={"data_type": "number"})
 check("PATCH data_type with no values -> OK", r.status_code == 200 and r.json()["data"]["data_type"] == "number", r.text[:200])
 
 # use a DEDICATED test material so the seed material's EAV values stay intact
-cat = c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]
+# (dataset-independent: any category; rerun reuses the existing test material)
+cat = c.get("/material-categories", params={"page_size": 1}).json()["data"][0]
 unit_kg = c.get("/units", params={"q": "kg"}).json()["data"][0]["id"]
 r = c.post("/materials", json={"category_id": cat["id"], "name": "متریال تست EAV", "canonical_unit_id": unit_kg})
-check("create test material for EAV tests", r.status_code == 201, r.text[:200])
+if r.status_code == 409:  # rerun
-tmat = r.json()["data"]
+    tmat = c.get("/materials", params={"q": "متریال تست EAV"}).json()["data"][0]
+    check("create test material for EAV tests (exists from previous run)", True)
+else:
+    check("create test material for EAV tests", r.status_code == 201, r.text[:200])
+    tmat = r.json()["data"]
 mat = tmat
 r = c.put(f"/materials/{mat['id']}/attribute-values", json={"attributes": [
     {"attribute_definition_id": adid, "value": 5},
@@ -99,7 +122,11 @@ check("DELETE attribute-definition (no values) -> 200", r.status_code == 200, r.
 # ---------- category attributes ----------
 # use a FRESH definition so the pair is not already in the seed junction
 r = c.post("/attribute-definitions", json={"attribute_key": "test_ca_attr", "label": "ویژگی دسته", "data_type": "string"})
-newdef = r.json()["data"]
+if r.status_code == 409:  # rerun safety — fetch the existing definition
+    newdef = next(d for d in c.get("/attribute-definitions", params={"page_size": 100}).json()["data"]
+                  if d["attribute_key"] == "test_ca_attr")
+else:
+    newdef = r.json()["data"]
 r = c.post(f"/material-categories/{cat['id']}/attributes", json={"attribute_definition_id": newdef["id"], "is_required": True, "sort_order": 9})
 check("POST category attribute", r.status_code == 201 and r.json()["data"]["attribute"]["attribute_key"] == "test_ca_attr", r.text[:200])
 r = c.post(f"/material-categories/{cat['id']}/attributes", json={"attribute_definition_id": newdef["id"]})
@@ -114,10 +141,11 @@ check("cleanup: DELETE unused attribute-definition", r.status_code == 200)
 # ---------- material units ----------
 r = c.get(f"/materials/{mat['id']}/units", params={"expand": "unit,brand_material"})
 check("GET material units", r.status_code == 200, r.text[:200])
-r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": 6, "conversion_factor": 0.001, "is_default": False})
+_unit_other = next(u for u in c.get("/units", params={"page_size": 100}).json()["data"] if u["code"] != "kg")
+r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": _unit_other["id"], "conversion_factor": 0.001, "is_default": False})
 check("POST material unit", r.status_code == 201, r.text[:200])
 muid = r.json()["data"]["id"]
-r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": 6, "conversion_factor": 2})
+r = c.post(f"/materials/{mat['id']}/units", json={"unit_id": _unit_other["id"], "conversion_factor": 2})
 check("POST material unit duplicate -> 409", r.status_code == 409, r.text[:200])
 r = c.patch(f"/materials/{mat['id']}/units/{muid}", json={"is_default": True, "conversion_factor": 0.002})
 check("PATCH material unit (is_default)", r.status_code == 200 and r.json()["data"]["is_default"] is True)
@@ -125,10 +153,10 @@ r = c.delete(f"/materials/{mat['id']}/units/{muid}")
 check("DELETE material unit", r.status_code == 200)
 
 # ---------- brand materials ----------
-r = c.get("/materials", params={"q": "سیمان پرتلند تیپ ۲"})
+# dataset-independent: any material + a freshly created brand (no existing link)
-m2 = r.json()["data"][0]
+m2 = c.get("/materials", params={"page_size": 1}).json()["data"][0]
-r = c.get("/brands", params={"q": "Bosch"})
+r = c.post("/brands", json={"name": "برند لینک تست", "country": "ایران"})
-b2 = r.json()["data"][0]
+b2 = r.json()["data"] if r.status_code == 201 else c.get("/brands", params={"q": "برند لینک تست"}).json()["data"][0]
 r = c.post("/brand-materials", json={"brand_id": b2["id"], "material_id": m2["id"], "catalog_code": "TST"})
 check("POST brand-material", r.status_code == 201, r.text[:200])
 bmid = r.json()["data"]["id"]
@@ -140,18 +168,18 @@ r = c.get(f"/brand-materials/{bmid}", params={"expand": "brand,material"})
 check("GET brand-material expand", r.status_code == 200 and "brand" in r.json()["data"] and "material" in r.json()["data"])
 r = c.delete(f"/brand-materials/{bmid}")
 check("DELETE brand-material", r.status_code == 200)
+r = c.delete(f"/brands/{b2['id']}")
+check("cleanup: DELETE link-test brand", r.status_code == 200, r.text[:200])
 
 # ---------- supplier/project patches ----------
-r = c.get("/suppliers", params={"q": "آریا"})
+s1 = c.get("/suppliers", params={"page_size": 1}).json()["data"][0]
-s1 = r.json()["data"][0]
 r = c.patch(f"/suppliers/{s1['id']}", json={"phone": "021-00000000"})
 check("PATCH /suppliers", r.status_code == 200 and r.json()["data"]["phone"] == "021-00000000")
 r = c.patch(f"/suppliers/{s1['id']}", json={"phone": "021-55123456"})
-r = c.get("/projects", params={"q": "ونوس"})
+p1 = c.get("/projects", params={"page_size": 1}).json()["data"][0]
-p1 = r.json()["data"][0]
 r = c.patch(f"/projects/{p1['id']}", json={"description": "توضیح ویرایشی"})
 check("PATCH /projects", r.status_code == 200 and r.json()["data"]["description"] == "توضیح ویرایشی")
-r = c.patch(f"/projects/{p1['id']}", json={"description": "ساختمان ۱۸ طبقه مسکونی در زعفرانیه"})
+r = c.patch(f"/projects/{p1['id']}", json={"description": p1.get("description")})
 
 # ---------- quote PATCH metadata ----------
 r = c.get("/quotes", params={"status": "offered", "page_size": 1})
@@ -166,16 +194,17 @@ r = c.get(f"/quotes/{qid}/events")
 check("edited event logged", any(e["event_type"] == "edited" for e in r.json()["data"]))
 
 # ---------- termsheet delete rules ----------
+# termsheet-count tolerance: this suite needs >=2 termsheets on the picked quote
 r = c.get(f"/quotes/{qid}/termsheets")
 ts = r.json()["data"]
-if len(ts) == 1:
+while len(ts) < 2:
     r = c.post(f"/quotes/{qid}/termsheets", json={"label": "ثانویه", "schedule_steps": [{"due_date": "2026-12-01", "amount": 10}]})
-    check("POST second termsheet", r.status_code == 201, r.text[:200])
+    check("POST additional termsheet", r.status_code == 201, r.text[:200])
-    ts = r.json()["data"]
     ts = c.get(f"/quotes/{qid}/termsheets").json()["data"]
 r = c.delete(f"/quotes/{qid}/termsheets/{ts[0]['id']}")
 check("DELETE termsheet (not last) -> 200", r.status_code == 200, r.text[:200])
-r = c.delete(f"/quotes/{qid}/termsheets/{ts[1]['id']}")
+_remaining = c.get(f"/quotes/{qid}/termsheets").json()["data"]
+r = c.delete(f"/quotes/{qid}/termsheets/{_remaining[-1]['id']}")
 check("DELETE last termsheet -> 409", r.status_code == 409, r.text[:200])
 # restore a second termsheet for later tests
 r = c.post(f"/quotes/{qid}/termsheets", json={"label": "ثانویه ۲", "schedule_steps": [{"due_date": "2026-12-01", "amount": 10}]})
@@ -192,31 +221,52 @@ if len(steps) > 1:
 r = c.delete(f"/quotes/{qid}/termsheets/{ts0['id']}/schedule-steps/{steps[-1]['id']}")
 check("DELETE last schedule-step -> 409", r.status_code == 409, r.text[:200])
 
-# ---------- decision rules (on a pending quote) ----------
+# ---------- decision rules (need a PENDING decision — rerun-safe pick) ----------
-r = c.get(f"/quotes/{qid}/line-items")
+_pending = None
-li = r.json()["data"][0]
+for _qo in c.get("/quotes", params={"status": "offered", "page_size": 20, "expand": "line_items"}).json()["data"]:
-r = c.put(f"/quotes/{qid}/line-items/{li['id']}/decision", json={"status": "chosen", "chosen_item_termsheet_id": "00000000-0000-0000-0000-000000000000"})
+    for _lix in _qo["line_items"]:
-check("PUT decision chosen with foreign link -> 400", r.status_code == 400, r.text[:200])
+        if _lix.get("decision") and _lix["decision"]["status"] == "pending":
-r = c.put(f"/quotes/{qid}/line-items/{li['id']}/decision", json={"status": "rejected"})
+            _pending = (_qo["id"], _lix)
-check("PUT decision rejected", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
+            break
-r = c.put(f"/quotes/{qid}/line-items/{li['id']}/decision", json={"status": "chosen"})
+    if _pending:
-check("PUT decision rejected->chosen -> 409", r.status_code == 409, r.text[:200])
+        break
-r = c.patch(f"/quotes/{qid}/line-items/{li['id']}/decision/status", json={"status": "pending"})
+if _pending:
-# pending is NOT an accepted payload value — the endpoint only transitions to chosen/rejected
+    _qid2, li = _pending
-check("PATCH decision status to pending -> 400", r.status_code == 400, r.text[:200])
+    r = c.put(f"/quotes/{_qid2}/line-items/{li['id']}/decision", json={"status": "chosen", "chosen_item_termsheet_id": "00000000-0000-0000-0000-000000000000"})
+    check("PUT decision chosen with foreign link -> 400", r.status_code == 400, r.text[:200])
+    r = c.put(f"/quotes/{_qid2}/line-items/{li['id']}/decision", json={"status": "rejected"})
+    check("PUT decision rejected", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
+    r = c.put(f"/quotes/{_qid2}/line-items/{li['id']}/decision", json={"status": "chosen"})
+    check("PUT decision rejected->chosen -> 409", r.status_code == 409, r.text[:200])
+    r = c.patch(f"/quotes/{_qid2}/line-items/{li['id']}/decision/status", json={"status": "pending"})
+    # pending is NOT an accepted payload value — the endpoint only transitions to chosen/rejected
+    check("PATCH decision status to pending -> 400", r.status_code == 400, r.text[:200])
+else:
+    print("  SKIP  decision rules — no offered quote with a pending decision")
 
 # ---------- item termsheets ----------
-r = c.get(f"/quotes/{qid}/line-items/{li['id']}/termsheets")
+# termsheet-count tolerance marker
-its = r.json()["data"]
+if _pending:
-r = c.patch(f"/quotes/{qid}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": 9999})
+    _its_quote, li = _pending
-check("PATCH item-termsheet", r.status_code == 200 and r.json()["data"]["unit_price"] == 9999.0, r.text[:200])
+    r = c.get(f"/quotes/{_its_quote}/line-items/{li['id']}/termsheets")
-r = c.patch(f"/quotes/{qid}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": its[0]["unit_price"]})
+    its = r.json().get("data", [])
+    if its:
+        r = c.patch(f"/quotes/{_its_quote}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": 9999})
+        check("PATCH item-termsheet", r.status_code == 200 and r.json()["data"]["unit_price"] == 9999.0, r.text[:200])
+        r = c.patch(f"/quotes/{_its_quote}/line-items/{li['id']}/termsheets/{its[0]['id']}", json={"unit_price": its[0]["unit_price"]})
+    else:
+        print("  SKIP  PATCH item-termsheet — picked line item has no item pricing rows")
+else:
+    print("  SKIP  PATCH item-termsheet — no pending decision available")
 
 # ---------- invoice upload on accepted/arrived (multi-file) ----------
 r = c.get("/quotes", params={"status": "arrived", "page_size": 1})
 arrived = r.json()["data"]
 if arrived:
     qa = arrived[0]
+    # rerun safety — remove invoices left by previous runs
+    for _inv in c.get(f"/quotes/{qa['id']}/invoice").json()["data"]:
+        c.delete(f"/quotes/{qa['id']}/invoice/{_inv['id']}")
     files = {"file": ("inv.pdf", b"%PDF-1.4 invoice", "application/pdf")}
     r = c.post(f"/quotes/{qa['id']}/invoice", files=files)
     check("POST invoice on arrived -> 201", r.status_code == 201 and r.json()["data"]["mime_type"] == "application/pdf", r.text[:200])

backend/tools/smoke_test_write.py

@@ -23,16 +23,45 @@ def check(name, ok, extra=""):
 
 c = httpx.Client(base_url=BASE, timeout=30)
 
+# ---------- auth: every endpoint now requires a Casdoor JWT ----------
+import os
+
+r = c.post("/auth/login", json={
+    "username": os.environ.get("SMOKE_USER", "tester"),
+    "password": os.environ.get("SMOKE_PASSWORD", "123456"),
+})
+check("POST /auth/login", r.status_code == 200, r.text[:200])
+if r.status_code == 200:
+    c.headers["Authorization"] = f"Bearer {r.json()['data']['access_token']}"
+
 # ---------- supplier + project for the test quote ----------
-sup = c.post("/suppliers", json={"name": "تأمین‌کننده تست", "location": "تهران"}).json()["data"]
+# dataset-independent: fetch/create whatever the seed does or doesn't have
-proj = c.post("/projects", json={"name": "پروژه تست", "description": "تست خودکار"}).json()["data"]
+cat = c.get("/material-categories", params={"page_size": 1}).json()["data"][0]
-check("POST /suppliers + /projects", True)
+r_sup = c.post("/suppliers", json={"name": "تأمین‌کننده تست", "location": "تهران", "category_id": cat["id"]})
+if r_sup.status_code == 201:
+    sup = r_sup.json()["data"]
+    check("POST /suppliers", True)
+else:  # rerun — the test supplier already exists
+    sup = c.get("/suppliers", params={"q": "تأمین‌کننده تست"}).json()["data"][0]
+    check("POST /suppliers (exists from previous run — 409 tolerated)", r_sup.status_code == 409, r_sup.text[:200])
+r_proj = c.post("/projects", json={"name": "پروژه تست", "description": "تست خودکار"})
+if r_proj.status_code == 201:
+    proj = r_proj.json()["data"]
+    check("POST /projects", True)
+else:
+    proj = c.get("/projects", params={"q": "پروژه تست"}).json()["data"][0]
+    check("POST /projects (exists from previous run — 409 tolerated)", r_proj.status_code == 409, r_proj.text[:200])
 
 # ---------- material with EAV + brands ----------
-cat = c.get("/material-categories", params={"q": "میلگرد"}).json()["data"][0]
 unit_kg = c.get("/units", params={"q": "kg"}).json()["data"][0]["id"]
-brand = c.get("/brands", params={"q": "فولاد مبارکه"}).json()["data"][0]
+brand = c.get("/brands", params={"page_size": 1}).json()["data"][0]
 defs = {d["attribute_key"]: d for d in c.get("/attribute-definitions", params={"page_size": 100}).json()["data"]}
+# ensure the EAV keys this suite exercises exist (seed-independent)
+for _key, _dt in (("rebar_grade", "string"), ("rebar_diameter", "number"), ("rebar_ribbed", "boolean")):
+    if _key not in defs:
+        r = c.post("/attribute-definitions", json={"attribute_key": _key, "label": _key, "data_type": _dt})
+        check("POST /attribute-definitions (%s)" % _key, r.status_code == 201, r.text[:200])
+        defs[_key] = r.json()["data"]
 
 r = c.post(
     "/materials",
@@ -48,11 +77,15 @@ r = c.post(
         ],
     },
 )
-check("POST /materials (EAV+brands)", r.status_code == 201, r.text[:300])
+if r.status_code == 201:
-material = r.json()["data"]
+    material = r.json()["data"]
+    check("POST /materials (EAV+brands)", True)
+else:  # rerun — fetch the material a previous run created
+    material = c.get("/materials", params={"q": "میلگرد تست A3 سایز ۱۶"}).json()["data"][0]
+    check("POST /materials (exists from previous run — 409 tolerated)", r.status_code == 409, r.text[:200])
 
 r = c.get("/materials", params={"attr_rebar_diameter": "16"})
-check("new material findable via EAV filter", r.status_code == 200 and r.json()["meta"]["total"] == 1)
+check("new material findable via EAV filter", r.status_code == 200 and any(m["id"] == material["id"] for m in r.json()["data"]))
 
 r = c.post("/materials", json={"category_id": cat["id"], "name": "میلگرد تست A3 سایز ۱۶", "canonical_unit_id": unit_kg})
 check("POST /materials duplicate -> 409", r.status_code == 409 and r.json()["error"]["code"] == "CONFLICT", r.text[:200])
@@ -68,21 +101,32 @@ r = c.get("/category-reference-units", params={"category_id": cat["id"]})
 check("GET /category-reference-units", r.status_code == 200 and r.json()["data"][0]["ref_unit"] == "کیلوگرم")
 
 r = c.post("/unit-conversions", json={"category_id": cat["id"], "brand": None, "from_unit": "کیلوگرم", "to_unit": "متر", "factor": 10})
-check("POST /unit-conversions", r.status_code == 201, r.text[:200])
+if r.status_code == 409:  # rerun — reuse the existing conversion
-uc = r.json()["data"]
+    uc = next(x for x in c.get("/unit-conversions", params={"page_size": 100}).json()["data"]
+              if x["from_unit"] == "کیلوگرم" and x["to_unit"] == "متر" and x["category"]["id"] == cat["id"])
+    check("POST /unit-conversions (exists from previous run — 409 tolerated)", True)
+else:
+    check("POST /unit-conversions", r.status_code == 201, r.text[:200])
+    uc = r.json()["data"]
 r = c.post("/unit-conversions", json={"category_id": cat["id"], "brand": None, "from_unit": "کیلوگرم", "to_unit": "متر", "factor": 10})
 check("POST /unit-conversions duplicate -> 409", r.status_code == 409, r.text[:200])
 r = c.patch(f"/unit-conversions/{uc['id']}", json={"factor": 9.5})
 check("PATCH /unit-conversions", r.status_code == 200 and r.json()["data"]["factor"] == 9.5)
 
 r = c.post("/standard-conversions", json={"from_unit": "تن", "to_unit": "کیلوگرم", "factor": 1000})
-check("POST /standard-conversions", r.status_code == 201, r.text[:200])
+if r.status_code == 201:
-sc_id = r.json()["data"]["id"]
+    sc_id = r.json()["data"]["id"]
+    check("POST /standard-conversions", True)
+else:  # rerun — reuse the existing conversion
+    sc_id = next(x["id"] for x in c.get("/standard-conversions", params={"page_size": 100}).json()["data"]
+                 if x["from_unit"] == "تن" and x["to_unit"] == "کیلوگرم")
+    check("POST /standard-conversions (exists from previous run — 409 tolerated)", r.status_code == 409, r.text[:200])
 r = c.get("/standard-conversions")
 check("GET /standard-conversions", r.status_code == 200 and r.json()["meta"]["total"] >= 1)
 
 # ---------- nested quote creation ----------
-material2 = c.get("/materials", params={"q": "میلگرد A3 سایز ۱۴"}).json()["data"][0]
+_all_materials = c.get("/materials", params={"page_size": 100}).json()["data"]
+material2 = next(m for m in _all_materials if m["id"] != material["id"])
 r = c.post(
     "/quotes",
     json={
@@ -125,7 +169,11 @@ check("DELETE /quotes offered -> OK", r.status_code == 200 and r.json()["data"][
 r = c.post("/quotes", json={"supplier_id": sup["id"],
                             "line_items": [{"temp_id": "x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 1}],
                             "termsheets": [], "item_termsheets": []})
-check("POST /quotes empty termsheets -> 400", r.status_code == 400 and r.json()["error"]["field"] == "termsheets")
+# current contract: termsheets are optional at quote level (item pricing
+# is driven by item_termsheets) — a quote without them is valid
+check("POST /quotes empty termsheets -> 201 (optional since v2.6)", r.status_code == 201, r.text[:200])
+if r.status_code == 201:
+    c.delete(f"/quotes/{r.json()['data']['id']}")
 
 r = c.post("/quotes", json={"supplier_id": sup["id"],
                             "line_items": [{"temp_id": "x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 1}],
@@ -233,33 +281,49 @@ check("GET receipt of rejected item -> 404", r.status_code == 404)
 r = c.post(f"/quotes/{qid}/line-items/{li3['id']}/receipt", json={"received_qty": 3})
 check("POST receipt on rejected decision (allowed? decision exists)", r.status_code in (201, 409), r.text[:200])
 
-# ---------- backward transition ----------
+# ---------- backward transition (v2.6 rule: quotes WITH inventory receipts
+# are immutable — they feed the stock ledger) ----------
 r = c.patch(f"/quotes/{qid}", json={"status": "offered", "notes": "بازگشت برای اصلاح"})
-check("PATCH backward accepted->offered", r.status_code == 200 and r.json()["data"]["status"] == "offered" and r.json()["data"]["accepted_date"] is None, r.text[:300])
+check(
+    "PATCH backward accepted->offered blocked after receipts",
+    r.status_code == 409 and "رسید" in r.json()["error"]["message"], r.text[:300],
+)
 r = c.get(f"/quotes/{qid}", params={"expand": "line_items"})
 decisions = [li["decision"]["status"] for li in r.json()["data"]["line_items"]]
-check("decisions reset to pending", decisions == ["pending", "pending", "pending"], str(decisions))
+check("decisions unchanged after blocked revert", decisions == ["chosen", "chosen", "rejected"], str(decisions))
-r = c.get(f"/quotes/{qid}/termsheets")
+
+# transition tests need a quote WITHOUT receipts — q3:
+q3 = c.post("/quotes", json={
+    "supplier_id": sup["id"], "project_id": proj["id"],
+    "quote_date": "2026-08-02T10:00:00Z", "expiry_date": "2026-08-20",
+    "line_items": [{"temp_id": "li-x", "material_id": material["id"], "unit_id": unit_kg, "quantity": 2}],
+    "termsheets": [{"temp_id": "ts-x", "label": "نقدی", "schedule_steps": [{"due_date": "2026-08-10", "amount": 5000}]}],
+    "item_termsheets": [{"line_item_temp_id": "li-x", "termsheet_temp_id": "ts-x", "unit_price": 2500}],
+}).json()["data"]
+r = c.patch(f"/quotes/{q3['id']}/accept", json={
+    "accepted_termsheets": [{"id": q3["termsheets"][0]["id"],
+                             "schedule_steps": [{"step_no": 1, "due_date": "2026-08-10", "amount": 5000}]}],
+    "item_decisions": [{"line_item_id": q3["line_items"][0]["id"], "status": "chosen", "accepted_termsheet_index": 0, "adjusted_unit_price": 2500}],
+})
+check("q3 accept", r.status_code == 200, r.text[:300])
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "offered"})
+check("PATCH backward accepted->offered (no receipts) -> OK", r.status_code == 200 and r.json()["data"]["status"] == "offered" and r.json()["data"]["accepted_date"] is None, r.text[:300])
+r = c.get(f"/quotes/{q3['id']}", params={"expand": "line_items"})
+check("decisions reset to pending", [li["decision"]["status"] for li in r.json()["data"]["line_items"]] == ["pending"], r.text[:200])
+r = c.get(f"/quotes/{q3['id']}/termsheets")
 check("termsheets demoted to offered", all(t["status"] == "offered" for t in r.json()["data"]), r.text[:200])
-r = c.get(f"/quotes/{qid}", params={"expand": "line_items"})
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "accepted"})
-receipts_kept = all(li.get("receipt") is not None for li in r.json()["data"]["line_items"] if li["decision"])
-check("item_receipts NOT deleted on revert", receipts_kept, r.text[:200])
-
-r = c.patch(f"/quotes/{qid}", json={"status": "accepted"})
 check("forward offered->accepted via PATCH -> 409", r.status_code == 409, r.text[:200])
-
+r = c.patch(f"/quotes/{q3['id']}/reject", json={"reason": "قیمت بالا"})
-# ---------- reject / expire ----------
-r = c.patch(f"/quotes/{qid}/reject", json={"reason": "قیمت بالا"})
 check("PATCH reject", r.status_code == 200 and r.json()["data"]["status"] == "rejected", r.text[:200])
-r = c.get(f"/quotes/{qid}/events")
+r = c.get(f"/quotes/{q3['id']}/events")
 check("reject reason in event payload", any(e["event_type"] == "rejected" and e["payload"].get("reason") == "قیمت بالا" for e in r.json()["data"]))
-
+r = c.patch(f"/quotes/{q3['id']}", json={"status": "offered"})
-r = c.patch(f"/quotes/{qid}", json={"status": "offered"})
 check("rejected->offered reopen", r.status_code == 200 and r.json()["data"]["status"] == "offered", r.text[:200])
-r = c.patch(f"/quotes/{qid}/expire")
+r = c.patch(f"/quotes/{q3['id']}/expire")
 check("PATCH expire", r.status_code == 200 and r.json()["data"]["status"] == "expired", r.text[:200])
-r = c.delete(f"/quotes/{qid}")
+r = c.delete(f"/quotes/{q3['id']}")
-check("DELETE expired quote", r.status_code == 200 and r.json()["data"]["cascaded"]["line_items"] == 3, r.text[:300])
+check("DELETE expired quote", r.status_code == 200 and r.json()["data"]["cascaded"]["line_items"] == 1, r.text[:300])
 
 # ---------- files ----------
 q2 = c.post("/quotes", json={"supplier_id": sup["id"], "project_id": proj["id"],
@@ -269,8 +333,13 @@ q2 = c.post("/quotes", json={"supplier_id": sup["id"], "project_id": proj["id"],
 files = {"file": ("proforma.pdf", b"%PDF-1.4 test", "application/pdf")}
 r = c.post(f"/quotes/{q2['id']}/proforma", files=files)
 check("POST proforma (any status)", r.status_code == 201 and r.json()["data"]["file_name"] == "proforma.pdf", r.text[:200])
+# current contract: attachments are allowed in EVERY status (files.py) —
+# the invoice can be attached from the edit page at any time
 r = c.post(f"/quotes/{q2['id']}/invoice", files=files)
-check("POST invoice on offered -> 409", r.status_code == 409, r.text[:200])
+check("POST invoice on offered (any-status contract)", r.status_code == 201, r.text[:200])
+inv_id = r.json()["data"]["id"]
+r = c.delete(f"/quotes/{q2['id']}/invoice/{inv_id}")
+check("DELETE test invoice", r.status_code == 200, r.text[:200])
 r = c.get(f"/quotes/{q2['id']}/proforma")
 lst = r.json()["data"]
 check("GET proforma list has 1", r.status_code == 200 and len(lst) == 1, r.text[:200])
@@ -282,8 +351,8 @@ check("DELETE proforma by id", r.status_code == 200 and r.json()["data"]["delete
 r = c.get(f"/quotes/{q2['id']}/proforma")
 check("GET proforma list empty after delete", r.status_code == 200 and r.json()["data"] == [], r.text[:200])
 
-# cleanup test material + supplier + project
+# ---------- cleanup ----------
-# q2 still references supplier/project/material -> all deletes must be blocked
+# q2 (offered) is deletable; qid is a receipts-protected artifact that stays.
 r = c.delete(f"/suppliers/{sup['id']}")
 check("DELETE supplier with quotes -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/projects/{proj['id']}")
@@ -291,14 +360,15 @@ check("DELETE project with quotes -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/materials/{material['id']}")
 check("DELETE material with line_items -> 409", r.status_code == 409, r.text[:200])
 
-r = c.delete(f"/quotes/{q2['id']}")  # q2 still references the test material
+r = c.delete(f"/quotes/{q2['id']}")
 check("cleanup: DELETE q2 quote", r.status_code == 200, r.text[:200])
+# qid (arrived, receipt-protected) still references everything -> protected
 r = c.delete(f"/materials/{material['id']}")
-check("DELETE material (no line_items refs)", r.status_code == 200, r.text[:200])
+check("DELETE material (still referenced by receipt-protected quote) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/suppliers/{sup['id']}")
-check("DELETE supplier (no quotes) -> 200", r.status_code == 200, r.text[:200])
+check("DELETE supplier (still referenced) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/projects/{proj['id']}")
-check("DELETE project (no quotes) -> 200", r.status_code == 200, r.text[:200])
+check("DELETE project (still referenced) -> 409", r.status_code == 409, r.text[:200])
 r = c.delete(f"/unit-conversions/{uc['id']}")
 check("DELETE unit-conversion", r.status_code == 200)
 r = c.delete(f"/standard-conversions/{sc_id}")

docker-compose.prod.yml

@@ -1,32 +1,72 @@
 # ============================================================================
 # Production overlay — real domains + HTTPS (Let's Encrypt) + HTTP→HTTPS
-# redirect. Usage:
+# redirect + security middlewares + required secrets.
 #
-#   APP_HOST=app.example.com API_HOST=api.example.com AUTH_HOST=auth.example.com \
+# All credentials come from the git-ignored .env NEXT TO THE COMPOSE FILES
-#   S3_HOST=s3.example.com STORAGE_HOST=storage.example.com \
+# (compose loads it automatically — keep it on the VPS, never in git):
-#   TRAEFIK_ACME_EMAIL=admin@example.com \
+#
+#   cp .env.example .env   # then fill in STRONG values
 #   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
 #
 # Requirements: DNS records for every host pointing at the server, ports
-# 80 + 443 open (ACME http-challenge uses port 80), and the api's
+# 80 + 443 open (ACME http-challenge uses port 80). The api's issuer is
-# PROCUREMENT_CASDOOR_ISSUER must be updated to the public auth host
+# derived here from AUTH_HOST (see docs/casdoor-auth.md).
-# (see docs/casdoor-auth.md).
+#
+# Any `${VAR:?}` below refuses to boot when the variable is missing/empty —
+# that is deliberate: production must not run on defaults.
 # ============================================================================
 
 services:
   traefik:
     environment:
       # Certificates persist across restarts (acme.json in the traefik_certs volume).
-      TRAEFIK_ACME_EMAIL: ${TRAEFIK_ACME_EMAIL:?set TRAEFIK_ACME_EMAIL for production}
+      TRAEFIK_ACME_EMAIL: ${TRAEFIK_ACME_EMAIL:?set TRAEFIK_ACME_EMAIL in .env}
+
+  postgres:
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+
+  minio:
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:?set MINIO_ROOT_USER in .env}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?set MINIO_ROOT_PASSWORD in .env}
+    labels:
+      - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:?set S3_HOST}`)
+      - traefik.http.routers.minio-api.entrypoints=websecure
+      - traefik.http.routers.minio-api.tls=true
+      - traefik.http.routers.minio-api.tls.certresolver=letsencrypt
+      - traefik.http.routers.minio-api.middlewares=secure-headers@file
+      - traefik.http.routers.minio-api-redir.rule=Host(`${S3_HOST:?set S3_HOST}`)
+      - traefik.http.routers.minio-api-redir.entrypoints=web
+      - traefik.http.routers.minio-api-redir.middlewares=redirect-https@file
+      - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
+      - traefik.http.routers.minio-console.entrypoints=websecure
+      - traefik.http.routers.minio-console.tls=true
+      - traefik.http.routers.minio-console.tls.certresolver=letsencrypt
+      - traefik.http.routers.minio-console.middlewares=secure-headers@file
+      - traefik.http.routers.minio-console-redir.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
+      - traefik.http.routers.minio-console-redir.entrypoints=web
+      - traefik.http.routers.minio-console-redir.middlewares=redirect-https@file
 
   api:
     ports: [] # production: only reachable through Traefik
+    environment:
+      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/procurement
+      PROCUREMENT_MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:?set MINIO_ROOT_USER in .env}
+      PROCUREMENT_MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?set MINIO_ROOT_PASSWORD in .env}
+      PROCUREMENT_CASDOOR_CLIENT_SECRET: ${CASDOOR_CLIENT_SECRET:?set CASDOOR_CLIENT_SECRET in .env}
+      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: ${CASDOOR_ADMIN_PASSWORD:?set CASDOOR_ADMIN_PASSWORD in .env}
+      # Issuer must equal the browser-facing Casdoor origin (its discovery doc).
+      PROCUREMENT_CASDOOR_ISSUER: https://${AUTH_HOST:?set AUTH_HOST}
+      PROCUREMENT_CORS_ORIGINS: ${CORS_ORIGINS:?set CORS_ORIGINS in .env}
+      PROCUREMENT_ENVIRONMENT: prod
+      PROCUREMENT_DEV_LOGIN_ENABLED: "false"
     labels:
       - traefik.http.routers.api.rule=Host(`${API_HOST:?set API_HOST}`)
       - traefik.http.routers.api.entrypoints=websecure
       - traefik.http.routers.api.tls=true
       - traefik.http.routers.api.tls.certresolver=letsencrypt
-      # HTTP → HTTPS
+      - traefik.http.routers.api.middlewares=secure-headers@file,api-ratelimit@file,api-bodylimit@file
       - traefik.http.routers.api-redir.rule=Host(`${API_HOST:?set API_HOST}`)
       - traefik.http.routers.api-redir.entrypoints=web
       - traefik.http.routers.api-redir.middlewares=redirect-https@file
@@ -41,34 +81,21 @@ services:
       - traefik.http.routers.casdoor.entrypoints=websecure
       - traefik.http.routers.casdoor.tls=true
       - traefik.http.routers.casdoor.tls.certresolver=letsencrypt
+      - traefik.http.routers.casdoor.middlewares=secure-headers@file
       - traefik.http.routers.casdoor-redir.rule=Host(`${AUTH_HOST:?set AUTH_HOST}`)
       - traefik.http.routers.casdoor-redir.entrypoints=web
       - traefik.http.routers.casdoor-redir.middlewares=redirect-https@file
 
   frontend:
+    build:
+      args:
+        DEV_LOGIN_ENABLED: "false"
     labels:
       - traefik.http.routers.frontend.rule=Host(`${APP_HOST:?set APP_HOST}`)
       - traefik.http.routers.frontend.entrypoints=websecure
       - traefik.http.routers.frontend.tls=true
       - traefik.http.routers.frontend.tls.certresolver=letsencrypt
+      - traefik.http.routers.frontend.middlewares=secure-headers@file
       - traefik.http.routers.frontend-redir.rule=Host(`${APP_HOST:?set APP_HOST}`)
       - traefik.http.routers.frontend-redir.entrypoints=web
       - traefik.http.routers.frontend-redir.middlewares=redirect-https@file
-
-  minio:
-    ports: [] # production: only reachable through Traefik
-    labels:
-      - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:?set S3_HOST}`)
-      - traefik.http.routers.minio-api.entrypoints=websecure
-      - traefik.http.routers.minio-api.tls=true
-      - traefik.http.routers.minio-api.tls.certresolver=letsencrypt
-      - traefik.http.routers.minio-api-redir.rule=Host(`${S3_HOST:?set S3_HOST}`)
-      - traefik.http.routers.minio-api-redir.entrypoints=web
-      - traefik.http.routers.minio-api-redir.middlewares=redirect-https@file
-      - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
-      - traefik.http.routers.minio-console.entrypoints=websecure
-      - traefik.http.routers.minio-console.tls=true
-      - traefik.http.routers.minio-console.tls.certresolver=letsencrypt
-      - traefik.http.routers.minio-console-redir.rule=Host(`${STORAGE_HOST:?set STORAGE_HOST}`)
-      - traefik.http.routers.minio-console-redir.entrypoints=web
-      - traefik.http.routers.minio-console-redir.middlewares=redirect-https@file

docker-compose.yml

@@ -1,14 +1,21 @@
 services:
   postgres:
     image: postgres:18
+    container_name: procurement-postgres
 
     environment:
       POSTGRES_DB: procurement
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
+      # Local dev default; production overrides via .env (required by the
+      # prod overlay) — never commit real passwords.
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
 
     ports:
-      - "5435:5432"
+      - "5433:5432"
+
+    networks:
+      - default
+      - shared # monitoring stack scrapes it (postgres-exporter)
 
     volumes:
       - postgres_data:/var/lib/postgresql
@@ -22,14 +29,27 @@ services:
       retries: 10
 
     restart: unless-stopped
+    mem_limit: 1g
 
+  # ==========================================================================
+  # Traefik v3 — public reverse proxy (replaces nginx as the edge)
+  # App is served on http://localhost (port 80) instead of :3000.
+  # Production: see docker-compose.prod.yml (real domains + HTTPS via
+  # Let's Encrypt, HTTP→HTTPS redirect).
+  # ==========================================================================
   traefik:
+    # v3.6+ required: Traefik ≤3.3 fails against Docker Engine 29.x
+    # ("Error response from daemon" — Docker API version mismatch).
     image: traefik:v3.6
+    container_name: procurement-traefik
     restart: unless-stopped
+    mem_limit: 128m
     command:
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false
-      - --providers.docker.network=erp_production_network
+      # Containers are on several networks; Traefik must use the dedicated
+      # proxy network IP (otherwise it may pick the default-network IP → 504).
+      - --providers.docker.network=traefik_network
       - --providers.file.filename=/etc/traefik/dynamic.yml
       - --entrypoints.web.address=:80
       - --entrypoints.websecure.address=:443
@@ -39,9 +59,11 @@ services:
       - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
       - --log.level=INFO
     ports:
-      - "8084:80"
+      - "80:80"
-      - "8445:443"
+      - "443:443"
     volumes:
+      # NOTE: mounted read-write — Docker Desktop rejects read-only
+      # /var/run/docker.sock mounts ("Error response from daemon").
       - /var/run/docker.sock:/var/run/docker.sock
       - ./infra/traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
       - traefik_certs:/certs
@@ -50,26 +72,29 @@ services:
 
   minio:
     image: minio/minio:latest
+    container_name: procurement-minio
 
     command: server /data --console-address ":9001"
 
     environment:
-      MINIO_ROOT_USER: minioadmin
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
-      MINIO_ROOT_PASSWORD: minioadmin
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
 
     ports:
-      - "9004:9000"   # S3 API
+      - "9000:9000"   # S3 API
-      - "9005:9001"   # Web console
+      - "9001:9001"   # Web console
 
     volumes:
       - minio_data:/data
 
     labels:
       - traefik.enable=true
+      # S3 API
       - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:-s3.localhost}`)
       - traefik.http.routers.minio-api.entrypoints=web
       - traefik.http.routers.minio-api.service=minio-api-svc
       - traefik.http.services.minio-api-svc.loadbalancer.server.port=9000
+      # Web console
       - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:-storage.localhost}`)
       - traefik.http.routers.minio-console.entrypoints=web
       - traefik.http.routers.minio-console.service=minio-console-svc
@@ -80,9 +105,13 @@ services:
       - default
 
     restart: unless-stopped
+    mem_limit: 512m
 
+  # MinIO Client (mc): waits for the server, creates the bucket, exits.
+  # Use for ad-hoc ops too: docker compose run --rm minio-init ...
   minio-init:
     image: minio/mc:latest
+    container_name: procurement-minio-init
 
     depends_on:
       minio:
@@ -90,8 +119,8 @@ services:
 
     environment:
       MINIO_ENDPOINT: minio:9000
-      MINIO_ROOT_USER: minioadmin
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
-      MINIO_ROOT_PASSWORD: minioadmin
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
       MINIO_BUCKET: procurement-files
 
     entrypoint: >
@@ -105,8 +134,54 @@ services:
 
     restart: "no"
 
+  # ==========================================================================
+  # Scheduled logical backups of BOTH databases (procurement + casdoor).
+  # Writes pg_dump -Fc archives to a bind mount (default ./backups, point
+  # BACKUP_DIR at /srv/erp/backups on the VPS) and prunes archives older
+  # than BACKUP_KEEP_DAYS. Runs on the same postgres:18 image already pulled.
+  # ==========================================================================
+  db-backup:
+    image: postgres:18
+    container_name: procurement-db-backup
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      PGPASSWORD: ${POSTGRES_PASSWORD:-postgres}
+      BACKUP_INTERVAL_SECONDS: ${BACKUP_INTERVAL_SECONDS:-86400}
+      BACKUP_KEEP_DAYS: ${BACKUP_KEEP_DAYS:-14}
+    volumes:
+      - ${BACKUP_DIR:-./backups}:/backups
+    entrypoint: >
+      /bin/sh -c "
+      echo 'db-backup: dumping every $${BACKUP_INTERVAL_SECONDS}s, keeping $${BACKUP_KEEP_DAYS} days';
+      while true; do
+        STAMP=$$(date +%Y%m%d-%H%M%S);
+        pg_dump -h postgres -U postgres -d procurement -Fc -f /backups/procurement-$${STAMP}.dump &&
+          echo \"db-backup: procurement -> /backups/procurement-$${STAMP}.dump\";
+        pg_dump -h postgres -U postgres -d casdoor -Fc -f /backups/casdoor-$${STAMP}.dump &&
+          echo \"db-backup: casdoor -> /backups/casdoor-$${STAMP}.dump\";
+        find /backups -name '*.dump' -mtime +$${BACKUP_KEEP_DAYS} -delete;
+        sleep $${BACKUP_INTERVAL_SECONDS};
+      done
+      "
+    restart: unless-stopped
+    mem_limit: 256m
+
+  # ==========================================================================
+  # v2.6 — Casdoor (OIDC identity provider)
+  # Console: http://localhost:8080 (admin / 123)
+  # Application "inventory-app" (org "inventory", client inventory-app-client)
+  # is created by backend/tools/seed_casdoor.py — run it once after the
+  # first boot:
+  #   docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
+  #
+  # Casdoor uses the SAME postgres instance as the app (database `casdoor`,
+  # created by sql/02-casdoor-db.sql on a fresh volume).
+  # ==========================================================================
   casdoor:
     image: casbin/casdoor:latest
+    container_name: procurement-casdoor
     depends_on:
       postgres:
         condition: service_healthy
@@ -115,9 +190,9 @@ services:
       driverName: postgres
       dataSourceName: "user=casdoor password=casdoor host=postgres port=5432 sslmode=disable dbname=casdoor"
       dbName: casdoor
-      origin: "http://localhost:8083"
+      origin: "http://localhost:8080"
     ports:
-      - "8083:8000"
+      - "8080:8000"
 
     labels:
       - traefik.enable=true
@@ -130,31 +205,60 @@ services:
       - default
 
     restart: unless-stopped
+    mem_limit: 768m
 
   api:
     build:
       context: ./backend
       dockerfile: Dockerfile
+    container_name: procurement-api
 
     environment:
-      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:postgres@postgres:5432/procurement
+      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/procurement
       PROCUREMENT_MINIO_ENDPOINT: minio:9000
-      PROCUREMENT_MINIO_ACCESS_KEY: minioadmin
+      PROCUREMENT_MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
-      PROCUREMENT_MINIO_SECRET_KEY: minioadmin
+      PROCUREMENT_MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
       PROCUREMENT_MINIO_BUCKET: procurement-files
       PROCUREMENT_MINIO_SECURE: "false"
+      # "dev" enables the local defaults; "prod" turns on the fail-fast
+      # startup checks (no wildcard CORS, no default credentials).
+      PROCUREMENT_ENVIRONMENT: ${ENVIRONMENT:-dev}
+      PROCUREMENT_DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false}
+      # Comma-separated browser origins (JSON-free .env friendly).
+      PROCUREMENT_CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost,http://localhost:3000,http://localhost:5173}
+      # Casdoor: endpoint is the in-network service URL; the issuer must match
+      # the origin Casdoor advertises to browsers (its OIDC discovery doc).
       PROCUREMENT_CASDOOR_ENDPOINT: http://casdoor:8000
-      PROCUREMENT_CASDOOR_ISSUER: http://localhost:8083
+      PROCUREMENT_CASDOOR_ISSUER: ${CASDOOR_ISSUER:-http://localhost:8080}
       PROCUREMENT_CASDOOR_CLIENT_ID: inventory-app-client
-      PROCUREMENT_CASDOOR_CLIENT_SECRET: inventory-app-secret-2026
+      PROCUREMENT_CASDOOR_CLIENT_SECRET: ${CASDOOR_CLIENT_SECRET:-inventory-app-secret-2026}
       PROCUREMENT_CASDOOR_ORGANIZATION: inventory
       PROCUREMENT_CASDOOR_APP_NAME: inventory-app
       PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client
+      # Console admin used by POST /users/sync (identity mirroring).
       PROCUREMENT_CASDOOR_ADMIN_USER: admin
-      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: "123"
+      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: ${CASDOOR_ADMIN_PASSWORD:-123}
+      # Observability (Phase 2) — see monitoring/README.md
+      PROCUREMENT_LOG_FORMAT: ${LOG_FORMAT:-text}
+      PROCUREMENT_SENTRY_DSN: ${SENTRY_DSN_BACKEND:-}
+      PROCUREMENT_OPENPANEL_API_URL: ${OPENPANEL_API_URL:-}
+      PROCUREMENT_OPENPANEL_CLIENT_ID: ${OPENPANEL_CLIENT_ID:-}
+      PROCUREMENT_OPENPANEL_CLIENT_SECRET: ${OPENPANEL_CLIENT_SECRET:-}
 
     ports:
-      - "8001:8000"
+      - "8000:8000"
+
+    networks:
+      - traefik_network
+      - default
+      - shared # monitoring stack scrapes api:8000/metrics
+
+    healthcheck:
+      test: ["CMD-SHELL", "python -c \"import urllib.request as u; u.urlopen('http://127.0.0.1:8000/health', timeout=3)\""]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 40s
 
     labels:
       - traefik.enable=true
@@ -162,10 +266,6 @@ services:
       - traefik.http.routers.api.entrypoints=web
       - traefik.http.services.api.loadbalancer.server.port=8000
 
-    networks:
-      - traefik_network
-      - default
-
     depends_on:
       postgres:
         condition: service_healthy
@@ -173,15 +273,27 @@ services:
         condition: service_completed_successfully
 
     restart: unless-stopped
+    mem_limit: 768m
 
   frontend:
     build:
       context: ./frontend
       args:
-        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-true}
+        # Developer Mode panel on the login page — dev-only aid. Production
-
+        # builds MUST leave this false (identity comes from Casdoor tokens).
-    ports:
+        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false}
-      - "8085:80"
+        # Registry overridable for networks where npmmirror is unreachable.
+        NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com}
+        # Observability (build-time baked; empty = disabled)
+        VITE_OPENPANEL_URL: ${OPENPANEL_PUBLIC_URL:-}
+        VITE_OPENPANEL_CLIENT_ID: ${OPENPANEL_CLIENT_ID:-}
+        VITE_SENTRY_DSN: ${SENTRY_DSN_FRONTEND:-}
+    container_name: procurement-frontend
+    # از entrypoint پیش‌فرض image nginx رد می‌شویم: آن اسکریپت `apk manifest`
+    # اجرا می‌کند و اگر دسترسی به مخزن بسته‌ها نباشد بی‌نهایت معلق می‌ماند
+    # (سرویس بالا نمی‌آید و traefik خطای 502 می‌دهد). کانفیگ ما مستقل است و
+    # نیازی به آن اسکریپت‌ها ندارد.
+    entrypoint: ["nginx", "-g", "daemon off;"]
 
     labels:
       - traefik.enable=true
@@ -197,10 +309,18 @@ services:
       - api
 
     restart: unless-stopped
+    mem_limit: 128m
 
 networks:
+  # شبکه‌ی عمومی: فقط ترافیک و سرویس‌های عمومی. postgres روی شبکه‌ی
+  # پیش‌فرض می‌ماند و از بیرون قابل دسترسی نیست.
   traefik_network:
-    name: erp_production_network
+    name: traefik_network
+    driver: bridge
+  # Fixed-name network shared with the monitoring stack (monitoring compose
+  # joins it as external) — carries /metrics scrapes and postgres-exporter.
+  shared:
+    name: erp_shared
     driver: bridge
 
 volumes:

docs/OPERATIONS.md

@@ -0,0 +1,96 @@
+# Operations runbook
+
+Day-2 operations for the ERP stack: deploys, health, backups, monitoring.
+Secrets and rotation live in [`SECRET-MANAGEMENT.md`](SECRET-MANAGEMENT.md);
+Casdoor/auth details in [`casdoor-auth.md`](casdoor-auth.md).
+
+## Deploy flow (push-to-deploy)
+
+1. Work lands on `production` only via merge from a feature branch.
+2. Every push to `production` hits the webhook receiver (host port 9000),
+   which verifies the Gitea HMAC signature, rebuilds
+   `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build`
+   and then polls `/health/ready` (defaults to
+   `https://$API_HOST/health/ready` from `.env`).
+3. A failed build or a failed readiness check is a **failed deploy**:
+   `journalctl -u erp-deploy-webhook -n 200` on the VPS.
+   Rollback: `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --no-build`
+   after `git revert` + rebuild — or re-push the previous commit.
+
+## Health endpoints (unauthenticated, for probes)
+
+| Endpoint | Meaning |
+|---|---|
+| `GET /health` | liveness — process is up |
+| `GET /health/ready` | readiness — Postgres + MinIO + Casdoor all reachable (503 + per-check booleans when degraded) |
+| `GET /metrics` | Prometheus exposition (scraped by the monitoring stack) |
+
+## Backups
+
+The `db-backup` sidecar dumps BOTH databases (`procurement`, `casdoor`)
+with `pg_dump -Fc` every `BACKUP_INTERVAL_SECONDS` (default daily) into
+`BACKUP_DIR` (default `./backups` → set to `/srv/erp/backups` on the VPS),
+keeping `BACKUP_KEEP_DAYS` (default 14) days.
+
+Restore (⚠️ replaces all data — stop `api` + `casdoor` first):
+
+```bash
+cd /srv/erp && docker compose -f docker-compose.yml -f docker-compose.prod.yml stop api casdoor
+docker cp backups/procurement-<stamp>.dump procurement-postgres:/tmp/
+docker cp backups/casdoor-<stamp>.dump procurement-postgres:/tmp/
+docker exec procurement-postgres pg_restore -U postgres -d procurement --clean --if-exists /tmp/procurement-<stamp>.dump
+docker exec procurement-postgres pg_restore -U postgres -d casdoor --clean --if-exists /tmp/casdoor-<stamp>.dump
+docker compose -f docker-compose.yml -f docker-compose.prod.yml start casdoor api
+```
+
+**Test the restore quarterly** on a scratch volume — an untested backup is
+a hope, not a backup. Copy archives off-box periodically (the bind mount is
+still on the same disk as the volumes).
+
+## Audit trail
+
+`audit_log` (in the `procurement` DB) records who changed what for
+role assignments, user creation, and inventory transactions. Query recent
+activity:
+
+```bash
+docker exec procurement-postgres psql -U postgres -d procurement \
+  -c "SELECT occurred_at, actor, action, entity, entity_id FROM audit_log ORDER BY occurred_at DESC LIMIT 50;"
+```
+
+`quote_events` continues to hold the quote lifecycle history (its `actor`
+is now the verified user's display name, not a raw token).
+
+## Monitoring stack
+
+Start/update (separate compose project — app rebuilds don't touch it):
+
+```bash
+cd /srv/erp
+docker compose -f monitoring/docker-compose.monitoring.yml --env-file .env up -d
+```
+
+- **Grafana** — `127.0.0.1:3001` on the VPS (SSH tunnel), admin password in
+  `.env`; the «ERP — Stack overview» dashboard auto-provisions.
+- **GlitchTip** — public on `GLITCHTIP_HOST` (browser DSN) + loopback
+  `:8001` for administration. Create backend/frontend projects there and put
+  the DSNs in `.env` (`SENTRY_DSN_BACKEND` / `SENTRY_DSN_FRONTEND`).
+- **OpenPanel** — see `monitoring/README.md` for the self-hosting setup and
+  the event list the app emits.
+- **Alerts** — Prometheus rules surface in Grafana alerting (API down,
+  5xx rate, p95 latency, disk, RAM, DB connections). Attach a notification
+  channel in the Grafana UI.
+
+Logs: every container's stdout ships to Loki via Promtail — in Grafana:
+`{compose_project="erp", compose_service="api"}`; JSON lines carry
+`request_id`, `http_status`, `duration_ms`.
+
+## Routine checks
+
+```bash
+docker compose -f docker-compose.yml -f docker-compose.prod.yml ps   # all Up/healthy?
+docker compose logs --since 10m api | grep -i error
+ls -lh /srv/erp/backups | tail                                       # dumps fresh?
+curl -fsS https://$API_HOST/health/ready | jq                        # all checks true?
+df -h /                                                              # ≥20% free (builds need headroom)
+```

docs/SECRET-MANAGEMENT.md

@@ -0,0 +1,67 @@
+# Secret management & rotation
+
+**Policy (short):** real credentials live only in git-ignored `.env` files —
+the server-side `/srv/erp/.env` (used by the deploy webhook and compose) and
+local dev `.env` copies. Nothing secret goes into git: not in the README,
+not in dumps, not in docs. The repo is (or was) **public** — assume anything
+ever committed is compromised and rotate.
+
+`docker-compose.prod.yml` declares every production secret as
+`${VAR:?set in .env}` so the stack **refuses to boot** on defaults.
+
+## Where each secret lives
+
+| Secret | Used by | Defined in |
+|---|---|---|
+| `POSTGRES_PASSWORD` | postgres, api | server `.env` |
+| `MINIO_ROOT_USER` / `MINIO_ROOT_PASSWORD` | minio, minio-init, api | server `.env` |
+| `CASDOOR_CLIENT_SECRET` | Casdoor application record, api | server `.env` (must match the app in the Casdoor console) |
+| `CASDOOR_ADMIN_PASSWORD` | Casdoor console admin, api (`/users/sync`) | server `.env` (rotate in the Casdoor console too) |
+| `CORS_ORIGINS`, `*_HOST`, `TRAEFIK_ACME_EMAIL` | compose / Traefik | server `.env` |
+| `GITEA_WEBHOOK_SECRET` | deploy-webhook receiver (port 9000) | server `.env` + Gitea webhook config |
+| Monitoring DSNs/keys | OpenPanel, GlitchTip, Grafana | `monitoring/.env` (server-side) |
+
+## Rotation checklist — run after any leak suspicion
+
+The production branch history contained real credentials (MinIO admin,
+Casdoor passwords, server IP, DB dumps). All of the following must be
+rotated once, on the VPS:
+
+```bash
+cd /srv/erp
+
+# 1) MinIO root — then update MINIO_ROOT_* in /srv/erp/.env
+mc alias set local http://127.0.0.1:9000 <old-user> '<old-pass>'
+mc admin user add local <new-user> '<new-pass>'      # then:
+mc admin policy attach local consoleAdmin --user <new-user>
+mc admin user remove local <old-user>
+# (simplest equivalent: mc admin user svcacct or change root via env +
+#  `docker compose up -d minio` — MinIO persists root creds from env)
+
+# 2) PostgreSQL — then update POSTGRES_PASSWORD in .env
+docker exec -it procurement-postgres psql -U postgres -c \
+  "ALTER USER postgres PASSWORD '<new-strong-password>';"
+docker compose up -d api   # api re-reads the DSN from .env
+
+# 3) Casdoor console admin (console → Identity → users → admin → reset
+#    password) — then update CASDOOR_ADMIN_PASSWORD in .env
+# 4) Casdoor application client secret (console → Applications →
+#    inventory-app → edit secret) — then update CASDOOR_CLIENT_SECRET in .env
+# 5) Seeded human users: reset each password in the Casdoor console.
+# 6) Gitea webhook secret (Gitea → repo → Settings → Webhooks) — then update
+#    GITEA_WEBHOOK_SECRET in .env and restart the receiver (systemctl restart erp-deploy-webhook)
+
+# 7) Apply everything:
+docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+```
+
+- **SSH**: disable password login (`PasswordAuthentication no` in
+  `/etc/ssh/sshd_config`), use keys only, and prefer a non-root user with
+  sudo over `root` direct login.
+- **Repo hygiene**: keep the repo private until the git history is either
+  purged (BFG / `git filter-repo` on the README + `backups/` blobs) or every
+  leaked value is rotated. Deleting a file in a later commit does **not**
+  remove it from history.
+- **Verify**: after rotation, `docker compose logs api | grep -i error`,
+  log into the app, upload + download one attachment, and confirm the
+  webhook deploy still works with a test push.

docs/casdoor-auth.md

@@ -12,7 +12,7 @@ scenarios, test results, and how to manage the system yourself.
 |---|---|---|
 | App (frontend) | http://localhost (Traefik edge; production: your domain) | — |
 | API (backend) | http://localhost:8000 (Swagger: `/docs`) | — |
-| Casdoor console | http://localhost:8080 | **admin / 123** (built-in org) |
+| Casdoor console | http://localhost:8080 | admin credentials come from `CASDOOR_ADMIN_PW` when running the seeder — never committed |
 | Casdoor OIDC discovery | http://localhost:8080/.well-known/openid-configuration | — |
 | Casdoor public JWKS | http://localhost:8080/.well-known/jwks | — |
 | In-network Casdoor (from the api container) | http://casdoor:8000 | — |
@@ -22,13 +22,13 @@ scenarios, test results, and how to manage the system yourself.
 
 | Username | Password | Casdoor org | App role (our `users` table) |
 |---|---|---|---|
-| `razaei` | `123456` | inventory | `admin` (super user) |
+| `razaei` | `CASDOOR_SEED_PASSWORD` | inventory | `admin` (super user) |
-| `mousavi` | `123456` | inventory | `procurement_manager` (مدیر تدارکات) |
+| `mousavi` | `CASDOOR_SEED_PASSWORD` | inventory | `procurement_manager` (مدیر تدارکات) |
-| `mohaghegh` | `123456` | inventory | `pm` (مدیر پروژه، بدون پروژه) |
+| `mohaghegh` | `CASDOOR_SEED_PASSWORD` | inventory | `pm` (مدیر پروژه، بدون پروژه) |
-| `tester` | `123456` | inventory | `pm` (مدیر پروژه — پروژه «تست») |
+| `tester` | `CASDOOR_SEED_PASSWORD` | inventory | `pm` (مدیر پروژه — پروژه «تست») |
 
-These users are created by `backend/tools/seed_casdoor.py` (idempotent — safe
+Passwords are stored bcrypt-hashed (passwordType `bcrypt`). These users are
-to re-run).
+created by `backend/tools/seed_casdoor.py` (idempotent — safe to re-run).
 
 ---
 
@@ -95,7 +95,7 @@ identity only.** No new authorization model was introduced.
   the OIDC client. Grant types: `authorization_code`, `refresh_token`,
   `password`. Token format JWT (so the backend can verify via JWKS).
 - **Casdoor Organization** (`inventory`): the tenant; every app user belongs
-  to it. (The Casdoor console admin `admin/123` lives in the separate
+  to it. (The Casdoor console admin lives in the separate
   `built-in` org.)
 - **User — two records per person:**
   1. Casdoor user (login credential: name + password).
@@ -158,7 +158,7 @@ After that, log in as the admin and use the Organization panel
 
 | Test | Action | Result | Evidence |
 |---|---|---|---|
-| 1 | Login: `POST /api/v1/auth/login` (tester/123456) | **PASS** | 200, JWT + profile returned |
+| 1 | Login: `POST /api/v1/auth/login` (tester / CASDOOR_SEED_PASSWORD) | **PASS** | 200, JWT + profile returned |
 | 2 | Authenticated API: `GET /users/me` with token | **PASS** | 200, role `pm` + project «تست» |
 | 3 | No token: `GET /inventory/warehouses` | **PASS** | 401 `UNAUTHORIZED` |
 | 4 | Invalid token: corrupted Bearer | **PASS** | 401 `UNAUTHORIZED` «توکن نامعتبر است» |
@@ -179,7 +179,7 @@ After that, log in as the admin and use the Organization panel
 | 6 | Organization exists | ✅ `inventory` |
 | 7 | Application exists | ✅ `inventory-app` |
 | 8 | Client exists | ✅ `inventory-app-client` (grants incl. `password`) |
-| 9 | Test users exist | ✅ razaei, mousavi, mohaghegh, tester (password 123456) |
+| 9 | Test users exist | ✅ razaei, mousavi, mohaghegh, tester (password: CASDOOR_SEED_PASSWORD) |
 | 10 | Redirect URI matches | ✅ N/A for the in-page flow (redirects unused). The seeded app holds the legacy `http://localhost:3000/login`; the seeder now defaults to `http://localhost/login` |
 | 11 | OIDC works | ✅ discovery doc + token endpoint + JWT issuance verified |
 | 12 | PKCE works | ➖ **N/A** — the PKCE/redirect flow was replaced by the in-page password-grant login (per the redesign spec); nothing to verify |
@@ -270,7 +270,7 @@ After that, log in as the admin and use the Organization panel
 
 ## 9. Managing Casdoor yourself
 
-- **Console:** http://localhost:8080 — log in as **admin / 123**. From there
+- **Console:** http://localhost:8080 — log in as the admin (credentials from the seeder run). From there
   you can manage Organizations, Users, Applications, Providers, Certificates.
 - **Seeding** (org `inventory`, app `inventory-app`, the four users) —
   re-runnable at any time:

frontend/.env.example

@@ -5,6 +5,13 @@
 VITE_API_BASE_URL=
 
 # Show the "Developer Mode" panel on the login page.
-# true (default) / false — in Docker builds this is controlled by the
+# true (default in local dev) / false — in Docker builds this is controlled
-# DEV_LOGIN_ENABLED build arg (see docker-compose.yml), not this file.
+# by the DEV_LOGIN_ENABLED build arg (see docker-compose.yml), not this file.
-VITE_ENABLE_DEV_LOGIN=true
+VITE_ENABLE_DEV_LOGIN=
+
+# ---- Observability (all optional — empty = disabled, no network calls) ----
+# OpenPanel: browser origin of the self-hosted dashboard/API + project client id.
+VITE_OPENPANEL_URL=
+VITE_OPENPANEL_CLIENT_ID=
+# GlitchTip/Sentry DSN for frontend exception capture.
+VITE_SENTRY_DSN=

frontend/Dockerfile

@@ -13,11 +13,25 @@ ARG NPM_REGISTRY=https://registry.npmmirror.com
 COPY package.json package-lock.json ./
 RUN npm config set registry ${NPM_REGISTRY} && npm ci
 
-# Developer Mode panel on the login page (default enabled; set to
+# Developer Mode panel on the login page (dev-only aid). Production builds
-# "false" to build a production login without the dev panel).
+# MUST keep this "false" — identity comes from Casdoor tokens, and the
-ARG DEV_LOGIN_ENABLED=true
+# backend rejects the X-User-* header path unless DEV_LOGIN_ENABLED=true.
+ARG DEV_LOGIN_ENABLED=false
 ENV VITE_ENABLE_DEV_LOGIN=${DEV_LOGIN_ENABLED}
 
+# Observability (Phase 2) — baked into the bundle at build time.
+# Empty values disable the feature (analytics.ts is a no-op then).
+ARG VITE_OPENPANEL_URL=""
+ARG VITE_OPENPANEL_CLIENT_ID=""
+# The browser script (op1.js) lives on the dashboard origin, not under the API path,
+# so it needs its own arg — defined here or the value never reaches the bundle.
+ARG VITE_OPENPANEL_SCRIPT_URL=""
+ARG VITE_SENTRY_DSN=""
+ENV VITE_OPENPANEL_URL=${VITE_OPENPANEL_URL} \
+    VITE_OPENPANEL_CLIENT_ID=${VITE_OPENPANEL_CLIENT_ID} \
+    VITE_OPENPANEL_SCRIPT_URL=${VITE_OPENPANEL_SCRIPT_URL} \
+    VITE_SENTRY_DSN=${VITE_SENTRY_DSN}
+
 # Source code + build
 COPY . .
 RUN npm run build

frontend/nginx.conf

@@ -29,6 +29,26 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
+    # MIME types: the pdf.js worker ships as .mjs, and a browser REFUSES to
+    # start a module worker served as application/octet-stream (nginx's
+    # default for unknown extensions) — which crashes the PDF preview page.
+    # Declared explicitly rather than relying on the system mime.types.
+    types {
+        text/javascript    mjs js;
+        text/css           css;
+        text/html          html;
+        image/svg+xml      svg;
+        image/png          png;
+        image/jpeg         jpg jpeg;
+        image/webp         webp;
+        image/x-icon       ico;
+        font/woff2         woff2;
+        font/woff          woff;
+        application/json   json;
+        application/pdf    pdf;
+        application/wasm   wasm;
+    }
+
     # SPA fallback — all client-side routes go to index.html
     location / {
         try_files $uri $uri/ /index.html;

frontend/package-lock.json

@@ -11,16 +11,19 @@
         "@dnd-kit/core": "^6.3.1",
         "@dnd-kit/utilities": "^3.2.2",
         "@hookform/resolvers": "3.10",
+        "@openpanel/web": "^1.0.1",
         "@radix-ui/react-checkbox": "^1.3.11",
         "@radix-ui/react-dialog": "^1.1.23",
         "@radix-ui/react-label": "^2.1.15",
         "@radix-ui/react-select": "^2.3.7",
         "@radix-ui/react-slot": "^1.3.3",
+        "@sentry/react": "^10.0.0",
         "@tailwindcss/vite": "^4.3.3",
         "@tanstack/react-query": "^5.101.4",
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
         "lucide-react": "^1.30.0",
+        "pdfjs-dist": "^4.10.38",
         "react": "^19.2.8",
         "react-dom": "^19.2.8",
         "react-hook-form": "^7.85.0",
@@ -172,6 +175,273 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@napi-rs/canvas": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas/-/canvas-0.1.100.tgz",
+      "integrity": "sha512-xglYA6q3XO5P3BNJYxVZ1IV7DLVjp1Py6nwag88YntrS+3vKHyYcMqXVS4ZztJmwz2uGvz1FWhI/4LgbR5uQDA==",
+      "license": "MIT",
+      "optional": true,
+      "workspaces": [
+        "e2e/*"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "optionalDependencies": {
+        "@napi-rs/canvas-android-arm64": "0.1.100",
+        "@napi-rs/canvas-darwin-arm64": "0.1.100",
+        "@napi-rs/canvas-darwin-x64": "0.1.100",
+        "@napi-rs/canvas-linux-arm-gnueabihf": "0.1.100",
+        "@napi-rs/canvas-linux-arm64-gnu": "0.1.100",
+        "@napi-rs/canvas-linux-arm64-musl": "0.1.100",
+        "@napi-rs/canvas-linux-riscv64-gnu": "0.1.100",
+        "@napi-rs/canvas-linux-x64-gnu": "0.1.100",
+        "@napi-rs/canvas-linux-x64-musl": "0.1.100",
+        "@napi-rs/canvas-win32-arm64-msvc": "0.1.100",
+        "@napi-rs/canvas-win32-x64-msvc": "0.1.100"
+      }
+    },
+    "node_modules/@napi-rs/canvas-android-arm64": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-android-arm64/-/canvas-android-arm64-0.1.100.tgz",
+      "integrity": "sha512-hjhCKhntPv9+t4ckHymdx0phYNcVW+GKQR6Lzw2zE+pOVjOplSmtx9nNNknTjbEDLcuLZqA1y8ufKg1XfgftzQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-darwin-arm64": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-darwin-arm64/-/canvas-darwin-arm64-0.1.100.tgz",
+      "integrity": "sha512-2PcswRaC7Ly645DGt88///zuFDhJxJYdKAs1uU3mfk1atYkXufgcgLfBpk6Tm12nCQBaNt1wpybuPZ4qOhTo8A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-darwin-x64": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-darwin-x64/-/canvas-darwin-x64-0.1.100.tgz",
+      "integrity": "sha512-ePNZtj7pNIva/siZMg+HmbeozkIjqUIYdoymH8HaA3qK7LfzFN4WMBM8G6HQ9ZC+H3+Dnn5pqtiXpgLykaPOhw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-arm-gnueabihf": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-linux-arm-gnueabihf/-/canvas-linux-arm-gnueabihf-0.1.100.tgz",
+      "integrity": "sha512-d5cDB48oWFGU8/XPhUOFAlySgb/VAu7D+s8fi55K1Pcfg8aPplHWqMgibhVLU8ky7Pyg/fuiVLz4Nf3JrSTuUA==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-arm64-gnu": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-linux-arm64-gnu/-/canvas-linux-arm64-gnu-0.1.100.tgz",
+      "integrity": "sha512-rDxgxRu69RvDlX/bh9o22DxLsGr8EqsNgotL9+RwQE1S0b0cqeatqsw6aW45mukm0B42DIAaAacKaYQ8cqS1nw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-arm64-musl": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-linux-arm64-musl/-/canvas-linux-arm64-musl-0.1.100.tgz",
+      "integrity": "sha512-K3mDW66N+xT2/V439u1alFANiBUjdEx2gLiNYnCmUsva5jZMxWTjafBYwTzYK+EMFMHrUoabuU+T1BIP5CgbYQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-riscv64-gnu": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-linux-riscv64-gnu/-/canvas-linux-riscv64-gnu-0.1.100.tgz",
+      "integrity": "sha512-mooqUBTIsccZpnoQC4NgrC1v6C1vof39etLNMnBwCY+p0gajWJvAHLGQ6g/gGyS5YrpDW+GefSN4+Cvcr08UWw==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-x64-gnu": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-linux-x64-gnu/-/canvas-linux-x64-gnu-0.1.100.tgz",
+      "integrity": "sha512-1eCvkDCazm7FFhsT7DfGOdSaHgZVK3bt/dSBl5EWHOWmnz+I7j8tPseJqqD81NF+MH21jKUK4wQSDjN0mdhnTg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-linux-x64-musl": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-linux-x64-musl/-/canvas-linux-x64-musl-0.1.100.tgz",
+      "integrity": "sha512-20arT6lnI19S68qNlii73TSEDbECNgzMz2EpldC1V3mZFuRkeujXkcebRk0LRJe9SEUAooYiLokfMViY8IX7yA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-win32-arm64-msvc": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-win32-arm64-msvc/-/canvas-win32-arm64-msvc-0.1.100.tgz",
+      "integrity": "sha512-DZFFT1wIAg37LJw37yhMRFfjATd3vTQzjZ1Yki8u2vhO6Hi5VE6BVaGQ1aaDu7xb4iMErz+9EOwjpS7xcxFeBw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@napi-rs/canvas-win32-x64-msvc": {
+      "version": "0.1.100",
+      "resolved": "https://registry.npmmirror.com/@napi-rs/canvas-win32-x64-msvc/-/canvas-win32-x64-msvc-0.1.100.tgz",
+      "integrity": "sha512-MyT1j3mHC2+Lu4pBi9mKyMJhtP6U7k7EldY7sj/uS5gJA65gTXt8MefJQXLJo5d/vZbuWmfxzkEUNc/urV3pHA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@openpanel/sdk": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@openpanel/sdk/-/sdk-1.3.1.tgz",
+      "integrity": "sha512-mQ5xaBUGXnyRg3qYxwnbVaUYyW7w8u+munrWk/ClnqxEeR2j+FYPiA6noHbHMCFC2aZutYD5OoRzEvw3FBNFxw==",
+      "license": "MIT"
+    },
+    "node_modules/@openpanel/web": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/@openpanel/web/-/web-1.4.1.tgz",
+      "integrity": "sha512-DgUWeocZw+b57YiJjefZPg+6sceR7TdOF8x7Ut75lu3CwcwqGi5jZNPXjikNemGL37aNWXCB4buhcoNan2j7RA==",
+      "license": "MIT",
+      "dependencies": {
+        "@openpanel/sdk": "1.3.1",
+        "@rrweb/types": "2.0.0-alpha.20",
+        "rrweb": "2.0.0-alpha.20"
+      }
+    },
     "node_modules/@oxc-project/types": {
       "version": "0.143.0",
       "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.143.0.tgz",
@@ -308,9 +578,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -328,9 +595,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -348,9 +612,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -368,9 +629,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -388,9 +646,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -408,9 +663,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -428,9 +680,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -448,9 +697,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1207,9 +1453,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1226,9 +1469,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1245,9 +1485,6 @@
       "cpu": [
         "ppc64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1264,9 +1501,6 @@
       "cpu": [
         "s390x"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1283,9 +1517,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1302,9 +1533,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1368,6 +1596,124 @@
       "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
       "license": "MIT"
     },
+    "node_modules/@rrweb/types": {
+      "version": "2.0.0-alpha.20",
+      "resolved": "https://registry.npmjs.org/@rrweb/types/-/types-2.0.0-alpha.20.tgz",
+      "integrity": "sha512-RbnDgKxA/odwB1R4gF7eUUj+rdSrq6ROQJsnMw7MIsGzlbSYvJeZN8YY4XqU0G6sKJvXI6bSzk7w/G94jNwzhw==",
+      "license": "MIT"
+    },
+    "node_modules/@rrweb/utils": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/@rrweb/utils/-/utils-2.1.6.tgz",
+      "integrity": "sha512-BIRXcxiytJs5Guxw0tzsnVS7ukcMqtnxixjIGvV49VdJeOEG6NJeMU7o8efbHW1D52a12Y8QsgDjgDgblg3org==",
+      "license": "MIT"
+    },
+    "node_modules/@sentry/browser": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/browser/-/browser-10.75.0.tgz",
+      "integrity": "sha512-CKGSJLWISQ6LgMaGnMpY+XvwWQ2iiHTayUs6SGLIvYeaGo2GTjS/Z4pnbCVHb2t1VxLZksyehgcC6ZYGJeQpzQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/browser-utils": "10.75.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.75.0",
+        "@sentry/feedback": "10.75.0",
+        "@sentry/replay": "10.75.0",
+        "@sentry/replay-canvas": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/browser-utils": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/browser-utils/-/browser-utils-10.75.0.tgz",
+      "integrity": "sha512-yZfdQ87RLat/7retF8zA6Z9zCAT12IyaPvIiu+bbi1E1V1OqDpS8MKNa/6LF69Ap7DVTORi9ITEgjlAqTXF0xQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/conventions": {
+      "version": "0.16.0",
+      "resolved": "https://registry.npmjs.org/@sentry/conventions/-/conventions-0.16.0.tgz",
+      "integrity": "sha512-fO9PLmHdVURcSPUpWCItWAtgKiMwGdJHbovoSEyLplX5sxs2ugvI4CBPTrkkgqhObnZOD0CnWBKDzSVQYBKEyQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@sentry/core": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/core/-/core-10.75.0.tgz",
+      "integrity": "sha512-5wDQpQqjJ6RHdPR+z6Q+47XlwoxRKBv0yyB0LKHqL/1azPOQbR+nllyLmmQDcoJpaksuLSmLA1q6hFX7gjDT2w==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/conventions": "^0.16.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/feedback": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/feedback/-/feedback-10.75.0.tgz",
+      "integrity": "sha512-YLVAFQXELJAOg7ke4oLkd8t5l0fJUockLlTQJg/2Trh7SB5Q4mkSwlnAkEAqDQ618vnpFsG/tnYMwtfZeffHjA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/react": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/react/-/react-10.75.0.tgz",
+      "integrity": "sha512-ghWv99h7k4WgMucqBhf4jZn+G0Owm5gCBCVKOKu88UDCWUd9aVJ8FGosAkATp/x/ogcZTnqG2dcXBD+1U+BJeA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/browser": "10.75.0",
+        "@sentry/conventions": "^0.16.0",
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "react": "^16.14.0 || 17.x || 18.x || 19.x"
+      }
+    },
+    "node_modules/@sentry/replay": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/replay/-/replay-10.75.0.tgz",
+      "integrity": "sha512-p4xxEo/ayiMZG9tygr09YjqYAd52uq8Qi0EVoRRgUe70nQda0HVPVW519JLq0G+Th/5O5sKME9y1layLU3xlPg==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/browser-utils": "10.75.0",
+        "@sentry/core": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@sentry/replay-canvas": {
+      "version": "10.75.0",
+      "resolved": "https://registry.npmjs.org/@sentry/replay-canvas/-/replay-canvas-10.75.0.tgz",
+      "integrity": "sha512-LNokI5Ud22nZ/o2il/2SfbNIARupWrbS6Mh9jZroZTjD38FN0Oi9vIexj6h1HN81C6+lP2Tmpaj+fl3/wOizzA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sentry/core": "10.75.0",
+        "@sentry/replay": "10.75.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@tailwindcss/node": {
       "version": "4.3.3",
       "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
@@ -1493,9 +1839,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1512,9 +1855,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1531,9 +1871,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1550,9 +1887,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1663,6 +1997,12 @@
         "react": "^18 || ^19"
       }
     },
+    "node_modules/@types/css-font-loading-module": {
+      "version": "0.0.7",
+      "resolved": "https://registry.npmjs.org/@types/css-font-loading-module/-/css-font-loading-module-0.0.7.tgz",
+      "integrity": "sha512-nl09VhutdjINdWyXxHWN/w9zlNCfr60JUqJbd24YXUuCwgeL0TpFSdElCwb6cxfB6ybE19Gjj4g0jsgkXxKv1Q==",
+      "license": "MIT"
+    },
     "node_modules/@types/node": {
       "version": "24.13.3",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
@@ -1719,6 +2059,12 @@
         }
       }
     },
+    "node_modules/@xstate/fsm": {
+      "version": "1.6.5",
+      "resolved": "https://registry.npmjs.org/@xstate/fsm/-/fsm-1.6.5.tgz",
+      "integrity": "sha512-b5o1I6aLNeYlU/3CPlj/Z91ybk1gUsKT+5NAJI+2W4UjvS5KLG28K9v5UvNoFVjHV8PajVZ00RH3vnjyQO7ZAw==",
+      "license": "MIT"
+    },
     "node_modules/aria-hidden": {
       "version": "1.2.6",
       "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
@@ -1731,6 +2077,15 @@
         "node": ">=10"
       }
     },
+    "node_modules/base64-arraybuffer": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz",
+      "integrity": "sha512-I3yl4r9QB5ZRY3XuJVEPfc2XhZO6YweFPI+UovAzn+8/hb3oJ6lnysaFcjVpkCPfVWFUDvoZ8kmVDP7WyRtYtQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6.0"
+      }
+    },
     "node_modules/class-variance-authority": {
       "version": "0.7.1",
       "resolved": "https://registry.npmjs.org/class-variance-authority/-/class-variance-authority-0.7.1.tgz",
@@ -1991,9 +2346,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2014,9 +2366,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2037,9 +2386,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2060,9 +2406,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2134,6 +2477,12 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/mitt": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/mitt/-/mitt-3.0.1.tgz",
+      "integrity": "sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==",
+      "license": "MIT"
+    },
     "node_modules/nanoid": {
       "version": "3.3.18",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
@@ -2201,6 +2550,18 @@
         }
       }
     },
+    "node_modules/pdfjs-dist": {
+      "version": "4.10.38",
+      "resolved": "https://registry.npmmirror.com/pdfjs-dist/-/pdfjs-dist-4.10.38.tgz",
+      "integrity": "sha512-/Y3fcFrXEAsMjJXeL9J8+ZG9U01LbuWaYypvDW2ycW1jL269L3js3DVBjDJ0Up9Np1uqDXsDrRihHANhZOlwdQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=20"
+      },
+      "optionalDependencies": {
+        "@napi-rs/canvas": "^0.1.65"
+      }
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -2423,6 +2784,40 @@
         "@rolldown/binding-win32-x64-msvc": "1.2.3"
       }
     },
+    "node_modules/rrdom": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/rrdom/-/rrdom-2.1.6.tgz",
+      "integrity": "sha512-EMRrTs1GRsmb8bNyAs107wG7eRwVEOvDUBsnCyvQnVV6elrmrua/AeS0tdcA0gLW4eptr4l6bRsS/2QRICvdqQ==",
+      "license": "MIT",
+      "dependencies": {
+        "rrweb-snapshot": "^2.1.6"
+      }
+    },
+    "node_modules/rrweb": {
+      "version": "2.0.0-alpha.20",
+      "resolved": "https://registry.npmjs.org/rrweb/-/rrweb-2.0.0-alpha.20.tgz",
+      "integrity": "sha512-CZKDlm+j1VA50Ko3gnMbpvguCAleljsTNXPnVk9aeNP8o6T6kolRbISHyDZpqZ4G+bdDLlQOignPP3jEsXs8Gg==",
+      "license": "MIT",
+      "dependencies": {
+        "@rrweb/types": "^2.0.0-alpha.20",
+        "@rrweb/utils": "^2.0.0-alpha.20",
+        "@types/css-font-loading-module": "0.0.7",
+        "@xstate/fsm": "^1.4.0",
+        "base64-arraybuffer": "^1.0.1",
+        "mitt": "^3.0.0",
+        "rrdom": "^2.0.0-alpha.20",
+        "rrweb-snapshot": "^2.0.0-alpha.20"
+      }
+    },
+    "node_modules/rrweb-snapshot": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/rrweb-snapshot/-/rrweb-snapshot-2.1.6.tgz",
+      "integrity": "sha512-X03+x3AdWTbpD4Swb54CCJoEauYTv/O2ah0d3ZVv5rgr6bv0Ty5mxNjEyEEfNC1dQ8VdyjKKJgDG3A00FV0lNg==",
+      "license": "MIT",
+      "dependencies": {
+        "postcss": "^8.4.38"
+      }
+    },
     "node_modules/scheduler": {
       "version": "0.27.0",
       "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
@@ -2788,9 +3183,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2811,9 +3203,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2834,9 +3223,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2857,9 +3243,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [

frontend/package.json

@@ -13,16 +13,19 @@
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/utilities": "^3.2.2",
     "@hookform/resolvers": "3.10",
+    "@openpanel/web": "^1.0.1",
     "@radix-ui/react-checkbox": "^1.3.11",
     "@radix-ui/react-dialog": "^1.1.23",
     "@radix-ui/react-label": "^2.1.15",
     "@radix-ui/react-select": "^2.3.7",
     "@radix-ui/react-slot": "^1.3.3",
+    "@sentry/react": "^10.0.0",
     "@tailwindcss/vite": "^4.3.3",
     "@tanstack/react-query": "^5.101.4",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "lucide-react": "^1.30.0",
+    "pdfjs-dist": "^4.10.38",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "react-hook-form": "^7.85.0",

frontend/src/components/Combobox.tsx

@@ -25,6 +25,9 @@ export interface ComboboxProps {
   onAdd?: (val: string) => void;
   onInputChange?: (val: string) => void;
   onBlur?: () => void;
+  // با false، فوکوسِ برنامه‌ای (مثل فوکوسِ خودکار Dialog) منو را باز نمی‌کند —
+  // فقط کلیک یا تایپِ صریح کاربر بازش می‌کند.
+  openOnFocus?: boolean;
 }
 
 function toItem(x: ComboboxSourceItem): ComboboxItem {
@@ -49,6 +52,7 @@ export function Combobox({
   onAdd,
   onInputChange,
   onBlur,
+  openOnFocus = true,
 }: ComboboxProps) {
   const [text, setText] = useState(value ?? "");
   const [open, setOpen] = useState(false);
@@ -132,9 +136,13 @@ export function Combobox({
         onChange={(e) => {
           setText(e.target.value);
           setHighlight(-1);
+          if (!open) setOpen(true);
           onInputChange?.(e.target.value);
         }}
-        onFocus={() => setOpen(true)}
+        onFocus={() => {
+          if (openOnFocus) setOpen(true);
+        }}
+        onClick={() => setOpen(true)}
         onBlur={onBlur}
         onKeyDown={onKeyDown}
       />

frontend/src/components/ErrorBoundary.tsx

@@ -1,4 +1,5 @@
 import { Component, type ErrorInfo, type ReactNode } from "react";
+import { captureError } from "../lib/analytics";
 
 interface Props {
   children: ReactNode;
@@ -19,6 +20,8 @@ export class ErrorBoundary extends Component<Props, State> {
 
   componentDidCatch(error: Error, info: ErrorInfo) {
     console.error("ErrorBoundary caught:", error, info);
+    // GlitchTip/Sentry (no-op بدون VITE_SENTRY_DSN)
+    captureError(error);
   }
 
   private retry = () => {

frontend/src/components/FileList.tsx

@@ -1,7 +1,8 @@
 import { useRef, useState } from "react";
 import { toast } from "sonner";
-import { Eye, Download, Trash2, X, FileText, Image as ImageIcon, ExternalLink } from "lucide-react";
+import { Eye, Download, Trash2, FileText, Image as ImageIcon } from "lucide-react";
 import type { Attachment } from "../lib/types";
+import { FilePreviewModal, isImageFile, isPdfFile } from "./FilePreviewModal";
 
 export interface FileListProps {
   files: Attachment[];
@@ -10,23 +11,27 @@ export interface FileListProps {
   upload: (file: File) => Promise<Attachment>;
   // حذف سمت سرور (اختیاری — بعد از حذف محلی صدا زده می‌شود)
   onDelete?: (a: Attachment) => void;
-  // لینک دانلود؛ null یعنی هنوز آپلود نشده
+  // دانلود احراز هویت‌شده (توکن Bearer + blob — لینک خام توکن نمی‌فرستد)
-  urlOf?: (a: Attachment) => string | null;
+  onDownload?: (a: Attachment) => void | Promise<void>;
+  // آدرس blob احراز هویت‌شده برای پیش‌نمایش. مودال پیش‌نمایش با objectURL
+  // محلی کار می‌کند چون <img>/<iframe> نمی‌توانند توکن بفرستند.
+  loadPreview?: (a: Attachment) => Promise<string>;
   label?: string;
 }
 
-const isImageFile = (name: string = "") => {
-  return /\.(jpe?g|png|webp|gif|svg|bmp)$/i.test(name.toLowerCase());
-};
-
-const isPdfFile = (name: string = "") => {
-  return /\.pdf$/i.test(name.toLowerCase());
-};
-
 // مدیریت چند فاکتور: آپلود مستقیم، پیش‌نمایش آنلاین تصویر/PDF و دانلود
-export function FileList({ files, onChange, upload, onDelete, urlOf, label = "افزودن فاکتور" }: FileListProps) {
+export function FileList({
+  files,
+  onChange,
+  upload,
+  onDelete,
+  onDownload,
+  loadPreview,
+  label = "افزودن فاکتور",
+}: FileListProps) {
   const inputRef = useRef<HTMLInputElement | null>(null);
   const [previewItem, setPreviewItem] = useState<{ url: string; name: string } | null>(null);
+  const [loadingPreview, setLoadingPreview] = useState<string | null>(null);
 
   const remove = (i: number) => {
     const removed = files[i];
@@ -49,15 +54,27 @@ export function FileList({ files, onChange, upload, onDelete, urlOf, label = "ا
     if (added.length) onChange([...files, ...added]);
   };
 
-  const handleOpenPreview = (inv: Attachment) => {
+  // پیش‌نمایش: یک URL امضاشده‌ی کوتاه‌عمر می‌گیریم (نه blob) تا
-    const url = urlOf?.(inv);
+  // دانلودمنیجرها آن را شکار نکنند و <iframe>/<img> درست بارگذاری شود.
-    if (!url) {
+  const handleOpenPreview = async (inv: Attachment) => {
+    if (!loadPreview) return;
+    if (!inv.id) {
       toast.error("فایل هنوز به طور کامل در سرور ذخیره نشده است");
       return;
     }
+    setLoadingPreview(inv.id);
+    try {
+      const url = await loadPreview(inv);
       setPreviewItem({ url, name: inv.name });
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : "بارگذاری پیش‌نمایش ناموفق بود");
+    } finally {
+      setLoadingPreview(null);
+    }
   };
 
+  const closePreview = () => setPreviewItem(null);
+
   return (
     <div className="space-y-2">
       {!files.length && (
@@ -69,9 +86,8 @@ export function FileList({ files, onChange, upload, onDelete, urlOf, label = "ا
       {files.length > 0 && (
         <div className="flex flex-col gap-1.5">
           {files.map((inv, i) => {
-            const url = urlOf?.(inv);
+            const canPreview = !!loadPreview && !!inv.id;
-            const isImg = isImageFile(inv.name);
+            const isLoading = !!inv.id && loadingPreview === inv.id;
-            const isPdf = isPdfFile(inv.name);
 
             return (
               <div
@@ -80,13 +96,13 @@ export function FileList({ files, onChange, upload, onDelete, urlOf, label = "ا
               >
                 {/* نام و آیکون فایل — با قابلیت کلیک برای پیش‌نمایش */}
                 <div
-                  className={`flex items-center gap-2 min-w-0 flex-1 ${url ? "cursor-pointer group" : ""}`}
+                  className={`flex items-center gap-2 min-w-0 flex-1 ${canPreview ? "cursor-pointer group" : ""}`}
-                  onClick={() => url && handleOpenPreview(inv)}
+                  onClick={() => canPreview && void handleOpenPreview(inv)}
-                  title={url ? "مشاهده پیش‌نمایش" : inv.name}
+                  title={canPreview ? "مشاهده پیش‌نمایش" : inv.name}
                 >
-                  {isImg ? (
+                  {isImageFile(inv.name) ? (
                     <ImageIcon className="h-4 w-4 shrink-0 text-blue-600" />
-                  ) : isPdf ? (
+                  ) : isPdfFile(inv.name) ? (
                     <FileText className="h-4 w-4 shrink-0 text-rose-600" />
                   ) : (
                     <FileText className="h-4 w-4 shrink-0 text-gray-400" />
@@ -96,30 +112,33 @@ export function FileList({ files, onChange, upload, onDelete, urlOf, label = "ا
                   </span>
                 </div>
 
-                {/* دکمه‌های عملیات: پیش‌نمایش، دانلود مستقیم، حذف */}
+                {/* دکمه‌های عملیات: پیش‌نمایش، دانلود، حذف */}
                 <div className="flex items-center gap-1 shrink-0 me-1">
-                  {url && (
+                  {canPreview && (
-                    <>
                     <button
                       type="button"
-                        onClick={() => handleOpenPreview(inv)}
+                      onClick={() => void handleOpenPreview(inv)}
-                        className="flex h-7 w-7 items-center justify-center rounded-md text-gray-500 hover:bg-blue-50 hover:text-blue-600 transition-colors"
+                      disabled={isLoading}
+                      className="flex h-7 w-7 items-center justify-center rounded-md text-gray-500 hover:bg-blue-50 hover:text-blue-600 transition-colors disabled:opacity-50"
                       title="مشاهده فاکتور"
                     >
                       <Eye className="h-3.5 w-3.5" />
                     </button>
+                  )}
 
-                      <a
+                  {onDownload && (
-                        href={url}
+                    <button
-                        download={inv.name}
+                      type="button"
-                        target="_blank"
+                      onClick={() => {
-                        rel="noreferrer"
+                        Promise.resolve(onDownload(inv)).catch((err) =>
+                          toast.error(err instanceof Error ? err.message : "دانلود فایل ناموفق بود"),
+                        );
+                      }}
                       className="flex h-7 w-7 items-center justify-center rounded-md text-gray-500 hover:bg-gray-100 hover:text-gray-900 transition-colors"
                       title="دانلود فایل"
                     >
                       <Download className="h-3.5 w-3.5" />
-                      </a>
+                    </button>
-                    </>
                   )}
 
                   <button
@@ -156,94 +175,9 @@ export function FileList({ files, onChange, upload, onDelete, urlOf, label = "ا
         </button>
       </div>
 
-      {/* پنجره مودال پیش‌نمایش (Preview Modal) */}
+      {/* مودال پیش‌نمایش — کامپوننت مشترک با کارت پیشنهاد در داشبورد */}
       {previewItem && (
-        <div
+        <FilePreviewModal url={previewItem.url} name={previewItem.name} onClose={closePreview} />
-          className="fixed inset-0 z-[80] flex items-center justify-center bg-black/60 p-3 sm:p-5 backdrop-blur-xs animate-in fade-in duration-200"
-          onClick={() => setPreviewItem(null)}
-        >
-          <div
-            className="flex flex-col w-full max-w-4xl max-h-[90vh] rounded-2xl border border-gray-200 bg-white shadow-2xl overflow-hidden"
-            onClick={(e) => e.stopPropagation()}
-          >
-            {/* هدر پیش‌نمایش */}
-            <div className="flex items-center justify-between border-b border-gray-100 px-4 py-3 bg-white">
-              <div className="flex items-center gap-2 min-w-0">
-                {isImageFile(previewItem.name) ? (
-                  <ImageIcon className="h-4 w-4 shrink-0 text-blue-600" />
-                ) : (
-                  <FileText className="h-4 w-4 shrink-0 text-rose-600" />
-                )}
-                <span className="text-xs sm:text-sm font-bold text-gray-900 truncate">
-                  {previewItem.name}
-                </span>
-              </div>
-
-              <div className="flex items-center gap-1.5 shrink-0">
-                <a
-                  href={previewItem.url}
-                  download={previewItem.name}
-                  className="inline-flex items-center gap-1 rounded-lg border border-gray-200 bg-white px-2.5 py-1 text-xs font-semibold text-gray-700 hover:bg-gray-50 hover:text-gray-900 transition-colors shadow-2xs"
-                  title="دانلود فاکتور"
-                >
-                  <Download className="h-3.5 w-3.5" />
-                  <span className="hidden xs:inline">دانلود فاکتور</span>
-                </a>
-
-                <a
-                  href={previewItem.url}
-                  target="_blank"
-                  rel="noreferrer"
-                  className="flex h-7 w-7 items-center justify-center rounded-lg border border-gray-200 text-gray-600 hover:bg-gray-50 hover:text-gray-900 transition-colors shadow-2xs"
-                  title="باز کردن در برگه جدید"
-                >
-                  <ExternalLink className="h-3.5 w-3.5" />
-                </a>
-
-                <button
-                  type="button"
-                  onClick={() => setPreviewItem(null)}
-                  className="flex h-7 w-7 items-center justify-center rounded-lg text-gray-400 hover:bg-gray-100 hover:text-gray-700 transition-colors ms-1"
-                  title="بستن"
-                >
-                  <X className="h-4 w-4" />
-                </button>
-              </div>
-            </div>
-
-            {/* بدنه نمایش فایل */}
-            <div className="flex-1 overflow-auto p-3 sm:p-4 bg-gray-50/70 flex items-center justify-center min-h-[300px]">
-              {isImageFile(previewItem.name) ? (
-                <img
-                  src={previewItem.url}
-                  alt={previewItem.name}
-                  className="max-h-[75vh] w-auto max-w-full rounded-lg object-contain shadow-xs border border-gray-200 bg-white"
-                />
-              ) : isPdfFile(previewItem.name) ? (
-                <iframe
-                  src={previewItem.url}
-                  title={previewItem.name}
-                  className="h-[75vh] w-full rounded-lg border border-gray-200 bg-white shadow-xs"
-                />
-              ) : (
-                <div className="flex flex-col items-center justify-center gap-3 p-8 text-center bg-white rounded-xl border border-gray-200 shadow-xs">
-                  <FileText className="h-12 w-12 text-gray-400" />
-                  <div className="text-xs text-gray-600">
-                    امکان نمایش پیش‌نمایش زنده برای این فرمت فایل وجود ندارد.
-                  </div>
-                  <a
-                    href={previewItem.url}
-                    download={previewItem.name}
-                    className="inline-flex items-center gap-1.5 rounded-lg bg-blue-600 px-3.5 py-1.5 text-xs font-semibold text-white hover:bg-blue-700 transition-colors"
-                  >
-                    <Download className="h-3.5 w-3.5" />
-                    دانلود فایل
-                  </a>
-                </div>
-              )}
-            </div>
-          </div>
-        </div>
       )}
     </div>
   );

frontend/src/components/FilePreviewModal.tsx

@@ -0,0 +1,148 @@
+import { useState } from "react";
+import { PdfCanvas } from "./PdfCanvas";
+import { X, FileText, Image as ImageIcon, ExternalLink } from "lucide-react";
+
+export const isImageFile = (name: string = "") => {
+  return /\.(jpe?g|png|webp|gif|svg|bmp)$/i.test(name.toLowerCase());
+};
+
+export const isPdfFile = (name: string = "") => {
+  return /\.pdf$/i.test(name.toLowerCase());
+};
+
+/**
+ * آیا مرورگر می‌تواند PDF را درون‌خطی نشان دهد؟
+ *
+ * دسکتاپ: بله (نمایشگر بومی) → <iframe> کافی است و بهترین تجربه را دارد.
+ * شبیه‌سازی موبایل/اندروید: پلاگین PDF وجود ندارد؛ <iframe> به دانلود
+ * منتهی می‌شود، پس آنجا pdf.js استفاده می‌کنیم.
+ */
+export function canRenderPdfNatively(): boolean {
+  if (typeof navigator === "undefined") return true;
+  const ua = navigator.userAgent || "";
+  const mobile = /Android|iPhone|iPad|iPod|Mobile/i.test(ua);
+  // pdfViewerEnabled در Chromium/Firefox وجود دارد و دقیق‌ترین معیار است
+  const pdfViewer = (navigator as { pdfViewerEnabled?: boolean }).pdfViewerEnabled;
+  if (typeof pdfViewer === "boolean") return pdfViewer && !mobile;
+  return !mobile;
+}
+
+export interface FilePreviewModalProps {
+  // آدرس امضاشده‌ی کوتاه‌عمر — چون <img>/<iframe> نمی‌توانند هدر توکن بفرستند
+  url: string;
+  name: string;
+  onClose: () => void;
+}
+
+/**
+ * مودال پیش‌نمایش فایل — مشترک بین لیست پیوست‌ها (FileList) و کارت پیشنهاد
+ * در داشبورد. تصویر با <img> و PDF با pdf.js روی canvas رسم می‌شود (بدون
+ * وابستگی به پلاگین PDF مرورگر، که در شبیه‌سازی موبایل وجود ندارد)؛ سایر
+ * فرمت‌ها فقط دکمه‌ی دانلود دارند.
+ */
+export function FilePreviewModal({ url, name, onClose }: FilePreviewModalProps) {
+  return (
+    <div
+      className="fixed inset-0 z-[80] flex items-center justify-center bg-black/60 p-3 sm:p-5 backdrop-blur-xs animate-in fade-in duration-200"
+      onClick={onClose}
+    >
+      <div
+        className="flex flex-col w-full max-w-4xl max-h-[90vh] rounded-2xl border border-gray-200 bg-white shadow-2xl overflow-hidden"
+        onClick={(e) => e.stopPropagation()}
+      >
+        {/* هدر پیش‌نمایش */}
+        <div className="flex items-center justify-between border-b border-gray-100 px-4 py-3 bg-white">
+          <div className="flex items-center gap-2 min-w-0">
+            {isImageFile(name) ? (
+              <ImageIcon className="h-4 w-4 shrink-0 text-blue-600" />
+            ) : (
+              <FileText className="h-4 w-4 shrink-0 text-rose-600" />
+            )}
+            <span className="text-xs sm:text-sm font-bold text-gray-900 truncate">{name}</span>
+          </div>
+
+          <div className="flex items-center gap-1.5 shrink-0">
+            <a
+              href={url}
+              target="_blank"
+              rel="noreferrer"
+              className="flex h-7 w-7 items-center justify-center rounded-lg border border-gray-200 text-gray-600 hover:bg-gray-50 hover:text-gray-900 transition-colors shadow-2xs"
+              title="باز کردن در برگه جدید"
+            >
+              <ExternalLink className="h-3.5 w-3.5" />
+            </a>
+
+            <button
+              type="button"
+              onClick={onClose}
+              className="flex h-7 w-7 items-center justify-center rounded-lg text-gray-400 hover:bg-gray-100 hover:text-gray-700 transition-colors ms-1"
+              title="بستن"
+            >
+              <X className="h-4 w-4" />
+            </button>
+          </div>
+        </div>
+
+        {/* بدنه نمایش فایل */}
+        <div className="flex-1 overflow-auto p-3 sm:p-4 bg-gray-50/70 flex items-center justify-center min-h-[300px]">
+          {isImageFile(name) ? (
+            <img
+              src={url}
+              alt={name}
+              className="max-h-[75vh] w-auto max-w-full rounded-lg object-contain shadow-xs border border-gray-200 bg-white"
+            />
+          ) : isPdfFile(name) ? (
+            // روی دسکتاپ نمایشگر بومی مرورگر بهترین نتیجه را می‌دهد؛ در
+            // شبیه‌سازی موبایل پلاگین PDF وجود ندارد، پس آنجا pdf.js روی
+            // canvas رسم می‌کند. انتخاب در زمان اجرا با تشخیص قابلیت.
+            canRenderPdfNatively() ? (
+              <iframe
+                src={url}
+                title={name}
+                className="h-[75vh] w-full rounded-lg border border-gray-200 bg-white shadow-xs"
+              />
+            ) : (
+              <PdfCanvas url={url} className="w-full" />
+            )
+          ) : (
+            <div className="flex flex-col items-center justify-center gap-3 p-8 text-center bg-white rounded-xl border border-gray-200 shadow-xs">
+              <FileText className="h-12 w-12 text-gray-400" />
+              <div className="text-xs text-gray-600">
+                امکان نمایش پیش‌نمایش زنده برای این فرمت فایل وجود ندارد.
+              </div>
+            </div>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/**
+ * هوک مدیریت پیش‌نمایش: بارگذاری blob احراز هویت‌شده + آزادسازی objectURL.
+ * خروجی برای رندر <FilePreviewModal> آماده است.
+ */
+/**
+ * هوک مدیریت پیش‌نمایش: گرفتن URL امضاشده و نگه‌داشتن آن برای مودال.
+ * URL یک آدرس واقعی است (نه blob) تا دانلودمنیجرها آن را نشکنند؛ پس
+ * نیازی به آزادسازی objectURL نیست.
+ */
+export function useFilePreview(load: (id: string, name: string) => Promise<string>) {
+  const [item, setItem] = useState<{ url: string; name: string } | null>(null);
+  const [loadingId, setLoadingId] = useState<string | null>(null);
+
+  const open = async (id: string, name: string) => {
+    if (!id) return;
+    setLoadingId(id);
+    try {
+      const url = await load(id, name);
+      setItem({ url, name });
+    } finally {
+      setLoadingId(null);
+    }
+  };
+
+  const close = () => setItem(null);
+
+  return { item, loadingId, open, close };
+}

frontend/src/components/JalaliDatePicker.tsx

@@ -6,6 +6,7 @@ import {
   jalaliStrToIso,
   jalaliToGregorian,
   MONTHS,
+  toAsciiDigits,
   toFa,
   WEEKDAYS,
 } from "../lib/jalali";
@@ -29,7 +30,7 @@ function todayJalali(): [number, number, number] {
 
 function isoToJalali(iso: string | null): [number, number, number] | null {
   if (!iso) return null;
-  const m = String(iso).match(/^(\d{4})-(\d{2})-(\d{2})/);
+  const m = String(iso).match(/^(\d{4})-(\d{2})-(\d{2})$/);
   if (m) {
     const gy = parseInt(m[1], 10);
     const gm = parseInt(m[2], 10);
@@ -78,6 +79,10 @@ export function JalaliDatePicker({
 }: JalaliDatePickerProps) {
   const [open, setOpen] = useState(false);
   const [curJ, setCurJ] = useState<[number, number, number]>(() => isoToJalali(value) ?? todayJalali());
+  const initialTime = timeOf(value);
+  const [hourText, setHourText] = useState<string>(() => faNum(String(initialTime.h).padStart(2, "0")));
+  const [minuteText, setMinuteText] = useState<string>(() => faNum(String(initialTime.m).padStart(2, "0")));
+
   const [text, setText] = useState<string>(() => {
     if (!value) return "";
     const j = isoToJalaliStr(value);
@@ -92,19 +97,28 @@ export function JalaliDatePicker({
   useEffect(() => {
     if (!value) {
       setText("");
+      const now = nowTime();
+      setHourText(faNum(String(now.h).padStart(2, "0")));
+      setMinuteText(faNum(String(now.m).padStart(2, "0")));
       return;
     }
     const j = isoToJalaliStr(value);
+    const t = timeOf(value);
     if (!withTime) {
       setText(j);
     } else {
-      const d = new Date(value);
+      const hh = String(t.h).padStart(2, "0");
-      if (Number.isNaN(d.getTime())) {
+      const mm = String(t.m).padStart(2, "0");
-        setText(j);
-      } else {
-        const hh = String(d.getHours()).padStart(2, "0");
-        const mm = String(d.getMinutes()).padStart(2, "0");
       setText(`${j} ${faNum(hh + ":" + mm)}`);
+
+      // Only update local input texts if numeric values differ, to avoid wiping in-progress typing
+      const curH = parseInt(toAsciiDigits(hourText) || "0", 10);
+      if (curH !== t.h) {
+        setHourText(faNum(hh));
+      }
+      const curM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+      if (curM !== t.m) {
+        setMinuteText(faNum(mm));
       }
     }
     const jParts = isoToJalali(value);
@@ -116,14 +130,13 @@ export function JalaliDatePicker({
   // تاریخ انتخاب‌شده به صورت محلی (نه UTC) برای مقایسه با سلول‌های تقویم
   function selectedLocalDate(): string | null {
     if (!value) return null;
-    const m = String(value).match(/^(\d{4})-(\d{2})-(\d{2})/);
+    const m = String(value).match(/^(\d{4})-(\d{2})-(\d{2})$/);
     if (m) return `${m[1]}-${m[2]}-${m[3]}`;
     const d = new Date(value);
     if (Number.isNaN(d.getTime())) return null;
     return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
   }
   const selectedIso = selectedLocalDate();
-  const time = timeOf(value);
 
   const grid = useMemo(() => {
     const [jy, jm] = curJ;
@@ -163,36 +176,108 @@ export function JalaliDatePicker({
   };
 
   const selectDay = (jy: number, jm: number, jd: number) => {
-    const val = withTime ? buildIso(jy, jm, jd, time.h, time.m) : buildDateOnly(jy, jm, jd);
+    const currentH = parseInt(toAsciiDigits(hourText) || "0", 10);
+    const currentM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+    const validH = Math.min(23, Math.max(0, currentH));
+    const validM = Math.min(59, Math.max(0, currentM));
+    const val = withTime ? buildIso(jy, jm, jd, validH, validM) : buildDateOnly(jy, jm, jd);
     onChange(val);
     setText(
-      `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))}${withTime ? " " + faNum(String(time.h).padStart(2, "0") + ":" + String(time.m).padStart(2, "0")) : ""}`
+      `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))}${withTime ? " " + faNum(String(validH).padStart(2, "0") + ":" + String(validM).padStart(2, "0")) : ""}`
     );
     setOpen(false);
   };
 
-  const setTimePart = (part: "h" | "m", raw: string) => {
+  const handleHourChange = (raw: string) => {
-    const n = parseInt(raw.replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d))), 10);
+    let digits = toAsciiDigits(raw).replace(/\D/g, "");
-    if (Number.isNaN(n)) return;
+    if (digits.length === 3) {
-    const h = part === "h" ? Math.min(23, Math.max(0, n)) : time.h;
+      digits = digits.slice(-1);
-    const m = part === "m" ? Math.min(59, Math.max(0, n)) : time.m;
+    } else if (digits.length > 3) {
+      digits = digits.slice(0, 2);
+    }
+    if (!digits) {
+      setHourText("");
+      return;
+    }
+    const n = parseInt(digits, 10);
+    const clamped = Math.min(23, Math.max(0, n));
+    const textToShow = digits.length === 2 && n > 23 ? String(clamped) : digits;
+    setHourText(faNum(textToShow));
+
     const [jy, jm, jd] = curJ;
-    onChange(buildIso(jy, jm, jd, h, m));
+    const currentM = parseInt(toAsciiDigits(minuteText) || "0", 10);
-    // به‌روزرسانی نمایش
+    const validM = Math.min(59, Math.max(0, currentM));
-    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, h, m));
+    onChange(buildIso(jy, jm, jd, clamped, validM));
-    setText(`${j} ${faNum(String(h).padStart(2, "0") + ":" + String(m).padStart(2, "0"))}`);
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, clamped, validM));
+    setText(`${j} ${faNum(String(clamped).padStart(2, "0") + ":" + String(validM).padStart(2, "0"))}`);
+  };
+
+  const handleHourBlur = () => {
+    const digits = toAsciiDigits(hourText).replace(/\D/g, "");
+    const n = digits ? parseInt(digits, 10) : 0;
+    const clamped = Math.min(23, Math.max(0, n));
+    setHourText(faNum(String(clamped).padStart(2, "0")));
+
+    const [jy, jm, jd] = curJ;
+    const currentM = parseInt(toAsciiDigits(minuteText) || "0", 10);
+    const validM = Math.min(59, Math.max(0, currentM));
+    onChange(buildIso(jy, jm, jd, clamped, validM));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, clamped, validM));
+    setText(`${j} ${faNum(String(clamped).padStart(2, "0") + ":" + String(validM).padStart(2, "0"))}`);
+  };
+
+  const handleMinuteChange = (raw: string) => {
+    let digits = toAsciiDigits(raw).replace(/\D/g, "");
+    if (digits.length === 3) {
+      digits = digits.slice(-1);
+    } else if (digits.length > 3) {
+      digits = digits.slice(0, 2);
+    }
+    if (!digits) {
+      setMinuteText("");
+      return;
+    }
+    const n = parseInt(digits, 10);
+    const clamped = Math.min(59, Math.max(0, n));
+    const textToShow = digits.length === 2 && n > 59 ? String(clamped) : digits;
+    setMinuteText(faNum(textToShow));
+
+    const [jy, jm, jd] = curJ;
+    const currentH = parseInt(toAsciiDigits(hourText) || "0", 10);
+    const validH = Math.min(23, Math.max(0, currentH));
+    onChange(buildIso(jy, jm, jd, validH, clamped));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, validH, clamped));
+    setText(`${j} ${faNum(String(validH).padStart(2, "0") + ":" + String(clamped).padStart(2, "0"))}`);
+  };
+
+  const handleMinuteBlur = () => {
+    const digits = toAsciiDigits(minuteText).replace(/\D/g, "");
+    const n = digits ? parseInt(digits, 10) : 0;
+    const clamped = Math.min(59, Math.max(0, n));
+    setMinuteText(faNum(String(clamped).padStart(2, "0")));
+
+    const [jy, jm, jd] = curJ;
+    const currentH = parseInt(toAsciiDigits(hourText) || "0", 10);
+    const validH = Math.min(23, Math.max(0, currentH));
+    onChange(buildIso(jy, jm, jd, validH, clamped));
+    const j = value ? isoToJalaliStr(value) : isoToJalaliStr(buildIso(jy, jm, jd, validH, clamped));
+    setText(`${j} ${faNum(String(validH).padStart(2, "0") + ":" + String(clamped).padStart(2, "0"))}`);
   };
 
   const pickToday = () => {
     const now = new Date();
     const [jy, jm, jd] = todayJalali();
+    const nh = now.getHours();
+    const nm = now.getMinutes();
+    setHourText(faNum(String(nh).padStart(2, "0")));
+    setMinuteText(faNum(String(nm).padStart(2, "0")));
     const val = withTime
-      ? buildIso(jy, jm, jd, now.getHours(), now.getMinutes())
+      ? buildIso(jy, jm, jd, nh, nm)
       : buildDateOnly(jy, jm, jd);
     onChange(val);
     setText(
       withTime
-        ? `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))} ${faNum(String(now.getHours()).padStart(2, "0") + ":" + String(now.getMinutes()).padStart(2, "0"))}`
+        ? `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))} ${faNum(String(nh).padStart(2, "0") + ":" + String(nm).padStart(2, "0"))}`
         : `${toFa(jy)}/${toFa(String(jm).padStart(2, "0"))}/${toFa(String(jd).padStart(2, "0"))}`,
     );
     setOpen(false);
@@ -201,17 +286,24 @@ export function JalaliDatePicker({
   const clear = () => {
     onChange(null);
     setText("");
+    const now = nowTime();
+    setHourText(faNum(String(now.h).padStart(2, "0")));
+    setMinuteText(faNum(String(now.m).padStart(2, "0")));
     setOpen(false);
   };
 
   const onInputChange = (v: string) => {
     setText(v);
+    if (!v.trim()) {
+      onChange(null);
+      return;
+    }
     const iso = jalaliStrToIso(v);
     if (iso) {
       if (!withTime) {
         const nums = String(v)
           .split(/[/\-.]/)
-          .map((x) => parseInt(String(x).replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d))), 10));
+          .map((x) => parseInt(toAsciiDigits(x), 10));
         if (nums.length >= 3 && !nums.some((n) => Number.isNaN(n))) {
           const [gy, gm, gd] = jalaliToGregorian(nums[0], nums[1], nums[2]);
           onChange(`${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`);
@@ -226,6 +318,51 @@ export function JalaliDatePicker({
     }
   };
 
+  const handleInputBlur = () => {
+    if (!text.trim()) {
+      onChange(null);
+      return;
+    }
+    const iso = jalaliStrToIso(text);
+    if (iso) {
+      if (!withTime) {
+        const nums = String(text)
+          .split(/[/\-.]/)
+          .map((x) => parseInt(toAsciiDigits(x), 10));
+        if (nums.length >= 3 && !nums.some((n) => Number.isNaN(n))) {
+          const [gy, gm, gd] = jalaliToGregorian(nums[0], nums[1], nums[2]);
+          const dOnly = `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+          onChange(dOnly);
+          setText(isoToJalaliStr(dOnly));
+        } else {
+          onChange(iso.slice(0, 10));
+          setText(isoToJalaliStr(iso));
+        }
+      } else {
+        onChange(iso);
+        const j = isoToJalaliStr(iso);
+        const d = new Date(iso);
+        if (!Number.isNaN(d.getTime())) {
+          const hh = String(d.getHours()).padStart(2, "0");
+          const mm = String(d.getMinutes()).padStart(2, "0");
+          setText(`${j} ${faNum(hh + ":" + mm)}`);
+        }
+      }
+    } else if (value) {
+      const j = isoToJalaliStr(value);
+      if (!withTime) {
+        setText(j);
+      } else {
+        const d = new Date(value);
+        if (!Number.isNaN(d.getTime())) {
+          const hh = String(d.getHours()).padStart(2, "0");
+          const mm = String(d.getMinutes()).padStart(2, "0");
+          setText(`${j} ${faNum(hh + ":" + mm)}`);
+        }
+      }
+    }
+  };
+
   return (
     <div ref={ref} className={cn("relative", className)}>
       <input
@@ -238,6 +375,7 @@ export function JalaliDatePicker({
         onFocus={() => !disabled && setOpen(true)}
         onClick={() => !disabled && setOpen(true)}
         onChange={(e) => onInputChange(e.target.value)}
+        onBlur={handleInputBlur}
       />
       {open && !disabled && (
         <div
@@ -248,6 +386,7 @@ export function JalaliDatePicker({
             withTime ? "w-80 p-3" : "w-64 p-2",
           )}
         >
+          {/* 1. Header: Month / Year Navigation */}
           <div className="mb-1.5 flex items-center justify-between gap-1">
             <button type="button" className="cursor-pointer rounded px-1.5 text-sm hover:bg-slate-bg" onClick={() => nav("y+1")}>
               «
@@ -265,6 +404,8 @@ export function JalaliDatePicker({
               »
             </button>
           </div>
+
+          {/* 2. Day of Week Header & Days Grid */}
           <div className="grid grid-cols-7 gap-0.5 text-center">
             {WEEKDAYS.map((w) => (
               <div key={w} className="py-0.5 text-[10px] font-bold text-muted">
@@ -291,33 +432,40 @@ export function JalaliDatePicker({
               ),
             )}
           </div>
+
+          {/* 3. Time Inputs Row (Positioned BELOW the calendar grid) — Hour on left, Minute on right */}
           {withTime && (
-            <div className="mt-2 flex items-center justify-center gap-4 border-t border-line pt-2.5">
+            <div className="mt-2 flex items-center justify-center gap-3 rounded-md border border-line/70 bg-slate-bg/40 py-1.5">
               <div className="flex items-center gap-1.5">
-                <span className="text-[11.5px] font-semibold text-muted">ساعت</span>
                 <input
                   type="text"
-                  className="num-input h-8 w-14 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-10 max-md:w-16"
+                  className="num-input h-7 w-12 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-9 max-md:w-14"
-                  value={faNum(String(time.h).padStart(2, "0"))}
+                  value={minuteText}
                   inputMode="numeric"
-                  maxLength={2}
+                  onFocus={(e) => e.target.select()}
-                  onChange={(e) => setTimePart("h", e.target.value)}
+                  onChange={(e) => handleMinuteChange(e.target.value)}
+                  onBlur={handleMinuteBlur}
                 />
-              </div>
-              <span className="text-muted">:</span>
-              <div className="flex items-center gap-1.5">
                 <span className="text-[11.5px] font-semibold text-muted">دقیقه</span>
+              </div>
+              <span className="font-bold text-muted">:</span>
+              <div className="flex items-center gap-1.5">
                 <input
                   type="text"
-                  className="num-input h-8 w-14 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-10 max-md:w-16"
+                  className="num-input h-7 w-12 rounded-md border border-line bg-panel px-1 text-center text-[13px] tabular-nums focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 max-md:h-9 max-md:w-14"
-                  value={faNum(String(time.m).padStart(2, "0"))}
+                  value={hourText}
                   inputMode="numeric"
-                  maxLength={2}
+                  onFocus={(e) => e.target.select()}
-                  onChange={(e) => setTimePart("m", e.target.value)}
+                  onChange={(e) => handleHourChange(e.target.value)}
+                  onBlur={handleHourBlur}
                 />
+                <span className="text-[11.5px] font-semibold text-muted">ساعت</span>
               </div>
             </div>
           )}
+
+
+          {/* 4. Action Buttons Footer */}
           <div className="mt-2 flex justify-between border-t border-line pt-2">
             <button type="button" className="cursor-pointer rounded px-2 py-0.5 text-[11.5px] text-accent hover:bg-slate-bg" onClick={pickToday}>
               امروز

frontend/src/components/MilestoneRow.tsx

@@ -12,9 +12,9 @@ export interface MilestoneRowProps {
 // یک ردیف مرحله‌ی پرداخت: تاریخ + مبلغ + دکمه‌ی حذف
 export function MilestoneRow({ milestone, onChange, onRemove, disabled = false }: MilestoneRowProps) {
   return (
-    <div className="flex items-start gap-3 w-full my-2">
+    <div className="flex items-start gap-2 w-full my-2">
-      {/* کادر انتخاب تاریخ */}
+      {/* کادر انتخاب تاریخ — جمع‌وجور و دقیقاً متناسب با فرمت تاریخ */}
-      <div className="w-36 shrink-0">
+      <div className="w-28 shrink-0">
         <JalaliDatePicker
           value={milestone.when_iso}
           onChange={(iso) => onChange({ ...milestone, when_iso: iso })}
@@ -23,7 +23,7 @@ export function MilestoneRow({ milestone, onChange, onRemove, disabled = false }
         />
       </div>
 
-      {/* کادر ورود مبلغ و حروف زیر آن */}
+      {/* کادر ورود مبلغ — کشیده و پرکننده حداکثری عرض صفحه */}
       <div className="flex-1 min-w-0">
         <NumberInput
           value={milestone.amount}

frontend/src/components/NumberInput.tsx

@@ -7,9 +7,11 @@ export interface NumberInputProps {
   onChange: (n: number | null) => void;
   placeholder?: string;
   className?: string;
+  inputClassName?: string;
+  align?: "right" | "center" | "left"; // تنظیم جهت متن و اعداد (پیش‌فرض: راست‌چین)
   showWords?: boolean; // نمایش معادل فارسی زیر input
   inputMode?: "numeric" | "decimal" | undefined;
-  maxDecimals?: number; // حداکثر رقم اعشار (مثلاً ۲ برای قیمت واحد)
+  maxDecimals?: number; // حداکثر رقم اعشار
   disabled?: boolean;
 }
 
@@ -19,6 +21,8 @@ export function NumberInput({
   onChange,
   placeholder,
   className,
+  inputClassName,
+  align = "right",
   showWords = false,
   inputMode = "numeric",
   maxDecimals,
@@ -36,8 +40,6 @@ export function NumberInput({
 
   const [text, setText] = useState<string>(() => (value != null ? formatValue(value) : ""));
 
-  // همگام‌سازی وقتی value از بیرون عوض می‌شود (مثلاً محاسبه‌ی خودکار قیمت کل).
-  // null از بیرون متن کاربر را پاک نمی‌کند — تا تایپ میانی مثل «0.» از بین نرود.
   useEffect(() => {
     const cur = parseNum(text);
     if (value != null && value !== cur) {
@@ -60,19 +62,28 @@ export function NumberInput({
 
   const n = parseNum(text);
 
+  const alignClass =
+    align === "center"
+      ? "!text-center text-center"
+      : align === "left"
+        ? "!text-left text-left"
+        : "!text-right text-right";
+
   return (
-    <div className={cn("min-w-0", className)}>
+    <div className={cn("min-w-0 w-full", className)}>
       <input
         type="text"
         disabled={disabled}
-        className="num-input h-9 w-full rounded-lg border border-line bg-panel px-3 py-1 text-sm text-ink shadow-sm transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60"
+        className={cn(
+          "num-input h-9 w-full rounded-lg border border-line bg-panel px-3 py-1 text-sm text-ink shadow-xs transition-colors placeholder:text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 disabled:cursor-not-allowed disabled:opacity-60",
+          alignClass,
+          inputClassName,
+        )}
         value={text}
         placeholder={placeholder}
         inputMode={inputMode}
         onChange={(e) => {
           const raw = e.target.value;
-          // فرمت‌دهی خودکار هنگام تایپ — اما جداکننده‌ی اعشارِ وسط تایپ
-          // («0.» یا «1.») دست‌نخورده می‌ماند تا کاربر بتواند اعشار بزند
           const parsed = parseNum(raw);
           const trailingSep = /[.,،/٬٫]$/.test(raw);
           if (parsed != null && !trailingSep) {
@@ -85,16 +96,11 @@ export function NumberInput({
         }}
         onBlur={() => commit(text)}
       />
-      {showWords && (
+      {showWords && n != null && (
-        <span className={cn("num-pill", n == null && "empty")}>
+        <div className="mt-1 block text-right text-[11px] text-muted">
-          {n != null ? (
+          <span className="tabular-nums font-semibold text-ink/80">{groupCommas(n, true)}</span>{" "}
-            <>
+          <span className="text-muted">({toWords(n)})</span>
-              {groupCommas(n, true)} <span className="num-words">({toWords(n)})</span>
+        </div>
-            </>
-          ) : (
-            ""
-          )}
-        </span>
       )}
     </div>
   );

frontend/src/components/PdfCanvas.tsx

@@ -0,0 +1,125 @@
+import { useEffect, useRef, useState } from "react";
+
+/**
+ * نمایشگر PDF با pdf.js (canvas) به‌جای <iframe>.
+ *
+ * چرا: کروم در حالت شبیه‌سازی موبایل (F12) پلاگین PDF درون‌خطی ندارد، پس
+ * <iframe src="...pdf"> را به‌جای نمایش، دانلود می‌کند — که دانلودمنیجرها
+ * شکارش می‌کنند و پیش‌نمایش خالی می‌ماند. با رسم روی canvas هیچ ناوبری‌ای
+ * به آدرس فایل انجام نمی‌شود، پس نه به پلاگین مرورگر وابسته‌ایم و نه چیزی
+ * برای دانلودمنیجر باقی می‌ماند.
+ */
+interface PdfCanvasProps {
+  url: string;
+  className?: string;
+}
+
+export function PdfCanvas({ url, className }: PdfCanvasProps) {
+  const canvasRef = useRef<HTMLCanvasElement | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [pageCount, setPageCount] = useState(0);
+
+  useEffect(() => {
+    let cancelled = false;
+    let doc: { destroy: () => void } | null = null;
+
+    (async () => {
+      setLoading(true);
+      setError(null);
+      try {
+        // بارگذاری تنبل: pdf.js فقط وقتی پیش‌نمایش PDF باز می‌شود دانلود می‌شود
+        const pdfjs = await import("pdfjs-dist");
+        // فقط workerSrc ست می‌شود — ست‌کردن هم‌زمان workerPort باعث تعارض
+        // می‌شد و بارگذاری سند در حلقه گیر می‌کرد («در حال بارگذاری…»).
+        // فایل worker با پسوند .mjs سرو می‌شود و nginx آن را
+        // text/javascript اعلام می‌کند (وگرنه مرورگر worker را رد می‌کند).
+        const workerUrl = (await import("pdfjs-dist/build/pdf.worker.min.mjs?url")).default;
+        pdfjs.GlobalWorkerOptions.workerSrc = workerUrl;
+
+        // بایت‌ها را خودمان با fetch می‌گیریم و به pdf.js به‌صورت داده
+        // می‌دهیم، به‌جای اینکه pdf.js خودش آدرس را بگیرد. دلیل: دانلودمنیجر
+        // (IDM) درخواست pdf.js به آدرس PDF را می‌رباید و با 204 برمی‌گرداند
+        // («Unexpected server response (204)»). با داده‌ی درون‌حافظه هیچ
+        // درخواست قابل‌ربودنی برای دانلودمنیجر باقی نمی‌ماند.
+        const res = await fetch(url, { credentials: "omit" });
+        if (!res.ok) throw new Error(`دریافت فایل ناموفق بود (${res.status})`);
+        const bytes = new Uint8Array(await res.arrayBuffer());
+
+        const task = pdfjs.getDocument({ data: bytes });
+        // اگر worker/شبکه در دسترس نباشد، به‌جای چرخ «در حال بارگذاری…»
+        // بی‌پایان، خطای قابل‌فهم نشان بده.
+        const loaded = await Promise.race([
+          task.promise,
+          new Promise<never>((_, reject) =>
+            setTimeout(() => reject(new Error("زمان بارگذاری PDF به پایان رسید")), 20000),
+          ),
+        ]);
+        doc = loaded as unknown as { destroy: () => void };
+        if (cancelled) return;
+
+        setPageCount(loaded.numPages);
+
+        // فعلاً صفحه‌ی اول — برای پیش‌نمایشِ سریع کافی است
+        const page = await loaded.getPage(1);
+        if (cancelled) return;
+
+        const canvas = canvasRef.current;
+        if (!canvas) return;
+
+        // مقیاس بر اساس عرض ظرف، با در نظر گرفتن devicePixelRatio برای وضوح
+        const containerWidth = canvas.parentElement?.clientWidth || 800;
+        const baseViewport = page.getViewport({ scale: 1 });
+        const dpr = window.devicePixelRatio || 1;
+        const scale = Math.min((containerWidth - 2) / baseViewport.width, 2) * dpr;
+        const viewport = page.getViewport({ scale });
+
+        canvas.width = Math.floor(viewport.width);
+        canvas.height = Math.floor(viewport.height);
+        canvas.style.width = `${Math.floor(viewport.width / dpr)}px`;
+        canvas.style.height = `${Math.floor(viewport.height / dpr)}px`;
+
+        const ctx = canvas.getContext("2d");
+        if (!ctx) return;
+        await page.render({ canvasContext: ctx, viewport }).promise;
+        if (!cancelled) setLoading(false);
+      } catch (err) {
+        if (!cancelled) {
+          setLoading(false);
+          setError(err instanceof Error ? err.message : "نمایش PDF ناموفق بود");
+        }
+      }
+    })();
+
+    return () => {
+      cancelled = true;
+      try {
+        doc?.destroy();
+      } catch {
+        /* نادیده بگیر */
+      }
+    };
+  }, [url]);
+
+  return (
+    <div className={className}>
+      {loading && !error && (
+        <div className="flex items-center justify-center p-8 text-xs text-gray-500">در حال بارگذاری…</div>
+      )}
+      {error ? (
+        <div className="flex flex-col items-center justify-center gap-3 p-8 text-center">
+          <div className="text-xs text-gray-600">نمایش پیش‌نمایش ممکن نشد: {error}</div>
+        </div>
+      ) : (
+        <>
+          <canvas ref={canvasRef} className="mx-auto block max-w-full rounded-lg border border-gray-200 bg-white shadow-xs" />
+          {pageCount > 1 && (
+            <div className="mt-2 text-center text-[11px] text-gray-500">
+              صفحه ۱ از {pageCount}
+            </div>
+          )}
+        </>
+      )}
+    </div>
+  );
+}

frontend/src/hooks/index.ts

@@ -3,11 +3,4 @@ export { useQuotes, useCreateQuote, useUpdateQuote, useDeleteQuote } from "./use
 export { useSuppliers, useAddSupplier, useUpdateSupplier, useRemoveSupplier } from "./useSuppliers";
 export { useMaterials, useAddMaterial } from "./useMaterials";
 export { useProjects, useAddProject } from "./useProjects";
-export {
+export { useUnits, useSaveStandardConversion, useDeleteStandardConversion } from "./useUnits";
-  useUnits,
-  useSaveRefUnit,
-  useSaveConversion,
-  useDeleteConversion,
-  useSaveStandardConversion,
-  useDeleteStandardConversion,
-} from "./useUnits";

frontend/src/hooks/useMaterials.ts

@@ -17,7 +17,7 @@ export function useAddMaterial() {
   const invalidate = useInvalidateStore();
   return useMutation({
     mutationFn: (m: Material) => api.materials.create(m),
-    onMutate: (m) => addMaterial(m),
+    onSuccess: (created) => addMaterial(created),
     onSettled: () => invalidate(),
   });
 }

frontend/src/hooks/useUnits.ts

@@ -1,52 +1,16 @@
 // ============================================================
-// hooks واحدها — واحد مرجع، ضرایب دسته‌ای و ثابت
+// hooks واحدها — تبدیل‌های ثابت جهانی (دسته‌ای‌ها حذف شدند)
 // ============================================================
 
 import { useMutation } from "@tanstack/react-query";
-import type { CategoryUnit, StandardConversion, UnitConversion } from "../lib/types";
+import type { StandardConversion } from "../lib/types";
 import { api } from "../lib/api";
 import { useAppStore } from "../store";
 import { useInvalidateStore } from "./useStoreData";
 
-export function useUnits(): {
+export function useUnits(): { standardConversions: StandardConversion[] } {
-  categoryUnits: CategoryUnit[];
-  unitConversions: UnitConversion[];
-  standardConversions: StandardConversion[];
-} {
-  const categoryUnits = useAppStore((s) => s.categoryUnits);
-  const unitConversions = useAppStore((s) => s.unitConversions);
   const standardConversions = useAppStore((s) => s.standardConversions);
-  return { categoryUnits, unitConversions, standardConversions };
+  return { standardConversions };
-}
-
-export function useSaveRefUnit() {
-  const setCategoryUnit = useAppStore((s) => s.setCategoryUnit);
-  const invalidate = useInvalidateStore();
-  return useMutation({
-    mutationFn: (cu: CategoryUnit) => api.units.saveCategoryUnit(cu),
-    onMutate: (cu) => setCategoryUnit(cu),
-    onSettled: () => invalidate(),
-  });
-}
-
-export function useSaveConversion() {
-  const setConversion = useAppStore((s) => s.setConversion);
-  const invalidate = useInvalidateStore();
-  return useMutation({
-    mutationFn: (c: UnitConversion) => api.units.saveConversion(c),
-    onMutate: (c) => setConversion(c),
-    onSettled: () => invalidate(),
-  });
-}
-
-export function useDeleteConversion() {
-  const deleteConversion = useAppStore((s) => s.deleteConversion);
-  const invalidate = useInvalidateStore();
-  return useMutation({
-    mutationFn: (id: string) => api.units.deleteConversion(id),
-    onMutate: (id) => deleteConversion(id),
-    onSettled: () => invalidate(),
-  });
 }
 
 export function useSaveStandardConversion() {

frontend/src/lib/analytics.ts

@@ -0,0 +1,104 @@
+// ============================================================
+// Product analytics + error capture (Phase 2)
+//
+// - OpenPanel (@openpanel/web): funnels/usage — initialized only when
+//   VITE_OPENPANEL_URL and VITE_OPENPANEL_CLIENT_ID are set (build args),
+//   so local dev and air-gapped environments stay silent.
+// - GlitchTip (@sentry/react): frontend exception capture, only when
+//   VITE_SENTRY_DSN is set.
+//
+// Both are no-ops without configuration; every helper is safe to call
+// unconditionally from anywhere in the app.
+// ============================================================
+import * as Sentry from "@sentry/react";
+
+type Props = Record<string, unknown>;
+
+declare global {
+  interface Window {
+    op?: (...args: unknown[]) => void;
+  }
+}
+
+const OPENPANEL_URL = (import.meta.env?.VITE_OPENPANEL_URL as string | undefined)?.trim();
+const OPENPANEL_CLIENT_ID = (import.meta.env?.VITE_OPENPANEL_CLIENT_ID as string | undefined)?.trim();
+const OPENPANEL_SCRIPT_URL = (import.meta.env?.VITE_OPENPANEL_SCRIPT_URL as string | undefined)?.trim();
+const SENTRY_DSN = (import.meta.env?.VITE_SENTRY_DSN as string | undefined)?.trim();
+
+/**
+ * Load the OpenPanel browser script (op1.js) and its queueing shim.
+ *
+ * The shim is OpenPanel's documented snippet: `window.op` becomes a queue while the
+ * script is in flight, so `op("init", …)` can be called immediately and the real
+ * script drains the queue on load. Without it, every `window.op?.()` call here is a
+ * silent no-op — which is what happened before this loader existed.
+ */
+function loadOpenPanelScript(src: string): void {
+  if (document.querySelector("script[data-openpanel]")) return;
+  const shim = document.createElement("script");
+  shim.textContent =
+    'window.op=window.op||function(){var n=[];return new Proxy(function(){arguments.length&&n.push([].slice.call(arguments))},{get:function(t,r){return"q"===r?n:function(){n.push([r].concat([].slice.call(arguments)))}},has:function(t,r){return"q"===r}}) }();';
+  document.head.appendChild(shim);
+  const script = document.createElement("script");
+  script.src = src;
+  script.async = true;
+  script.defer = true;
+  script.dataset.openpanel = "1";
+  document.head.appendChild(script);
+}
+
+export function initAnalytics(): void {
+  if (SENTRY_DSN) {
+    Sentry.init({
+      dsn: SENTRY_DSN,
+      environment: (import.meta.env?.MODE as string | undefined) ?? "production",
+      // Frontend traces are expensive and rarely needed — errors only.
+      tracesSampleRate: 0,
+    });
+  }
+  if (OPENPANEL_URL && OPENPANEL_CLIENT_ID) {
+    try {
+      if (OPENPANEL_SCRIPT_URL) loadOpenPanelScript(OPENPANEL_SCRIPT_URL);
+      window.op?.("init", {
+        apiUrl: OPENPANEL_URL,
+        clientId: OPENPANEL_CLIENT_ID,
+        trackScreenViews: true, // pageview → which pages users visit
+      });
+    } catch {
+      /* analytics must never break the app */
+    }
+  }
+}
+
+/** Attach the ERP user identity to analytics (after login / app load). */
+export function identifyUser(profile: {
+  id?: string;
+  name?: string;
+  role?: string | null;
+}): void {
+  if (!profile.id) return;
+  try {
+    window.op?.("identify", {
+      profileId: profile.id,
+      firstName: profile.name || undefined,
+      data: { role: profile.role ?? undefined },
+    });
+    track("user_identified", { role: profile.role ?? undefined });
+  } catch {
+    /* ignore */
+  }
+}
+
+export function track(event: string, properties?: Props): void {
+  try {
+    window.op?.("track", event, properties ?? {});
+  } catch {
+    /* ignore */
+  }
+}
+
+export function captureError(err: unknown): void {
+  if (SENTRY_DSN) Sentry.captureException(err);
+}
+
+export const analyticsEnabled = Boolean(OPENPANEL_URL && OPENPANEL_CLIENT_ID);

frontend/src/lib/api.ts

@@ -14,10 +14,10 @@
 
 import { normalize } from "./normalize";
 import { buildTopics } from "./topics";
+import { jalaliToGregorian, toAsciiDigits } from "./jalali";
 import { useAuthStore } from "../store/auth";
 import type {
   Attachment,
-  CategoryUnit,
   ConfirmedReceipt,
   InventoryRow,
   InventoryTransaction,
@@ -29,11 +29,10 @@ import type {
   Store,
   Supplier,
   TransactionType,
-  UnitConversion,
   Warehouse,
 } from "./types";
 
-const BASE_URL = (import.meta.env.VITE_API_BASE_URL as string | undefined)?.trim() || "/api/v1";
+const BASE_URL = (import.meta.env?.VITE_API_BASE_URL as string | undefined)?.trim() || "/api/v1";
 const PAGE_SIZE = 100;
 
 // حذف کلیدهای خالی/undefined از پارامترهای کوئری — URLSearchParams مقدار
@@ -69,6 +68,20 @@ function authHeaders(init?: RequestInit): Record<string, string> {
   return headers;
 }
 
+// 401 سراسری — هر پاسخ 401 یعنی نشست منقضی/نامعتبر است (JWT روی همه‌ی
+// مسیرها الزامی شد). نشست را پاک می‌کنیم و به صفحه‌ی ورود می‌رویم تا به‌جای
+// «برنامه‌ی خاموش» (استور خالی، بدون هیچ خطایی) کاربر به ورود هدایت شود.
+// دخالت نمی‌کنیم در: خطای رمز خودِ لاگین، حالت توسعه (هدرهای X-User-*)،
+// و وقتی از قبل روی /login هستیم (جلوگیری از حلقه‌ی ریدایرکت).
+function handle401(path: string, res: Response): void {
+  if (res.status !== 401) return;
+  if (path.startsWith("/auth/login")) return;
+  if (useAuthStore.getState().isDev) return;
+  if (window.location.pathname === "/login") return;
+  useAuthStore.getState().logout();
+  window.location.replace("/login");
+}
+
 // پروژه‌ی فعالِ مدیر پروژه (چند-پروژه‌ای، 1:N): برای همه‌ی مسیرهای پنل انبار
 // صریحاً ارسال می‌شود تا بک‌اند داده‌های همان پروژه را برگرداند/اعتبارسنجی کند.
 // ادمین/مدیر تدارکات بدون پارامتر (همه‌ی پروژه‌ها) باقی می‌ماند.
@@ -135,22 +148,42 @@ const FIELD_FA: Record<string, string> = {
   expiry_date: "تاریخ انقضا",
   accepted_date: "تاریخ پذیرش",
   arrived_date: "تاریخ رسید",
+  due_date: "تاریخ سررسید",
+  schedule_steps: "مراحل پرداخت",
+  milestones: "مراحل پرداخت",
+  amount: "مبلغ",
+  step_no: "شماره مرحله",
 };
 
-const faField = (field: string): string => {
+export const faField = (field: string): string => {
-  const last = field.split(".").filter(Boolean).pop() || field;
+  const parts = field.split(".").filter((p) => p && !/^\d+$/.test(p));
+  const last = parts.pop() || field;
   return FIELD_FA[last] || FIELD_FA[field] || field;
 };
 
-// ترجمه‌ی خطای HTTP بر اساس کد وضعیت
+// ترجمه‌ی خطای HTTP بر اساس کد وضعیت — پیام‌های معنادار بک‌اند حفظ می‌شوند
-const faHttpError = (status: number, fallback: string): string => {
+export const faHttpError = (status: number, fallback: string): string => {
   if (status === 413) return "فایل انتخاب‌شده از حد مجاز (۵ مگابایت) بزرگ‌تر است";
-  if (status === 404) return "مورد درخواستی یافت نشد";
+  if (status === 404 && (!fallback || fallback.startsWith("خطای سرور"))) return "مورد درخواستی یافت نشد";
-  if (status === 409) return "تعارض داده — رکورد تکراری یا وضعیت نامعتبر";
+  if (status === 409 && (!fallback || fallback.startsWith("خطای سرور"))) return "تعارض داده — رکورد تکراری یا وضعیت نامعتبر";
-  if (status === 400) return "داده‌ی ارسال‌شده نامعتبر است";
+  if (status === 400 && (!fallback || fallback.startsWith("خطای سرور"))) return "داده‌ی ارسال‌شده نامعتبر است";
   return fallback;
 };
 
+export class ApiError extends Error {
+  status: number;
+  code?: string;
+  field?: string;
+
+  constructor(message: string, status: number, code?: string, field?: string) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code;
+    this.field = field;
+  }
+}
+
 // ============================================================
 // HTTP helpers — envelope بک‌اند: {"data": ..., "meta": ...}
 // ============================================================
@@ -163,27 +196,44 @@ async function request<T>(path: string, init?: RequestInit): Promise<T> {
       headers: authHeaders(init),
     });
   } catch {
-    throw new Error("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟");
+    throw new ApiError("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟", 0);
   }
+  handle401(path, res);
   if (!res.ok) {
     let msg = `خطای سرور (${res.status})`;
+    let errCode: string | undefined;
+    let errField: string | undefined;
+
     try {
       const body = await res.json();
-      if (body?.error?.message) {
+      if (body?.error) {
-        msg = body.error.message;
+        errCode = body.error.code;
+        errField = body.error.field;
+        const rawMsg = body.error.message || "";
+        const fName = errField ? faField(errField) : "";
+        if (fName && rawMsg) {
+          msg = `داده‌ی «${fName}» نامعتبر است: ${rawMsg}`;
+        } else if (rawMsg) {
+          msg = rawMsg;
+        }
       } else if (Array.isArray(body?.detail)) {
         // FastAPI 422 — آرایه‌ی خطاهای اعتبارسنجی با پیام انگلیسی
         const first = body.detail[0];
-        const field = first?.loc?.length ? String(first.loc[first.loc.length - 1]) : "";
+        const loc = first?.loc || [];
+        const filteredLoc = loc.filter((p: unknown) => p !== "body" && p !== "query" && p !== "path");
+        errField = filteredLoc.join(".");
+        const fieldName = filteredLoc.length ? String(filteredLoc[filteredLoc.length - 1]) : "";
         const fa = first?.msg ? VALIDATION_FA(String(first.msg)) : "داده‌ی ارسال‌شده نامعتبر است";
-        msg = field ? `داده‌ی «${faField(field)}» نامعتبر است: ${fa}` : fa;
+        const fName = fieldName ? faField(fieldName) : "";
+        msg = fName ? `داده‌ی «${fName}» نامعتبر است: ${fa}` : fa;
       } else if (body?.detail) {
         msg = String(body.detail);
       }
     } catch {
       /* بدنۀ خطا JSON نیست */
     }
-    throw new Error(faHttpError(res.status, msg));
+    const finalMsg = faHttpError(res.status, msg);
+    throw new ApiError(finalMsg, res.status, errCode, errField);
   }
   return (await res.json()) as T;
 }
@@ -200,10 +250,6 @@ async function patchData<T>(path: string, body: unknown): Promise<T> {
   const res = await request<{ data: T }>(path, { method: "PATCH", body: JSON.stringify(body) });
   return res.data;
 }
-async function putData<T>(path: string, body: unknown): Promise<T> {
-  const res = await request<{ data: T }>(path, { method: "PUT", body: JSON.stringify(body) });
-  return res.data;
-}
 async function deleteData<T>(path: string): Promise<T> {
   const res = await request<{ data: T }>(path, { method: "DELETE" });
   return res.data;
@@ -224,6 +270,7 @@ async function uploadFile(path: string, file: File): Promise<Attachment> {
   } catch {
     throw new Error("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟");
   }
+  handle401(path, res);
   if (!res.ok) {
     let msg = `خطای سرور (${res.status})`;
     try {
@@ -269,7 +316,9 @@ interface RawSupplier {
   phone?: string | null;
   contact_person?: string | null;
   tax_id?: string | null;
-  categories?: string[] | null; // متریال‌های تأمین‌شده
+  // v2.6: هر تأمین‌کننده دقیقاً یک دسته دارد (FK) — بک‌اند این را می‌فرستد
+  category_id?: string | null;
+  category?: { id: string; slug: string; name: string } | null;
 }
 interface RawProject {
   id: string;
@@ -346,21 +395,6 @@ interface RawQuote {
   line_items?: RawLineItem[] | null;
   termsheets?: RawTermsheet[] | null;
 }
-interface RawCategoryUnit {
-  id: string;
-  category_id: string;
-  ref_unit: string;
-  category?: RawCategory | null;
-}
-interface RawUnitConversion {
-  id: string;
-  category_id: string;
-  brand?: string | null;
-  from_unit: string;
-  to_unit: string;
-  factor: number;
-  category?: RawCategory | null;
-}
 interface RawStandardConversion {
   id: string;
   from_unit: string;
@@ -506,7 +540,6 @@ function adaptMaterial(raw: RawMaterial, lookup: Lookup): Material {
     topic:
       raw.topic ||
       (raw.category?.slug ? lookup.categorySlugToName.get(raw.category.slug) || "" : ""),
-    category: raw.category?.name || "",
     brand: raw.brands?.[0]?.name || "",
     // مشخصه‌ها از attribute های متریال خوانده می‌شوند (EAV)
     specs: (raw.attributes || [])
@@ -587,11 +620,13 @@ function adaptQuote(raw: RawQuote): Quote {
 }
 
 function adaptSupplier(raw: RawSupplier, topic: string, categories: string[]): Supplier {
+  // هر تأمین‌کننده دقیقاً یک دسته دارد (FK) و بک‌اند آن را به شکل category
+  // برمی‌گرداند — منبع اصلی همین است؛ پارامتر categories فقط پشتیبان است.
+  const own = raw.category?.name ? [raw.category.name] : [];
   return {
     id: raw.id,
     topic,
-    // دسته‌های ذخیره‌شده روی تأمین‌کننده (بک‌اند) اولویت دارند؛ وگرنه از quotes استنتاج می‌شود
+    categories: own.length ? own : categories,
-    categories: Array.isArray(raw.categories) && raw.categories.length ? raw.categories : categories,
     name: raw.name,
     location: raw.location || "",
     phone: raw.phone || "",
@@ -609,44 +644,29 @@ function deriveSupplierTopics(
   materialsById: Map<string, Material>,
 ): Supplier[] {
   const topics = new Map<string, Set<string>>();
-  const cats = new Map<string, Set<string>>();
   for (const q of quotes) {
     for (const li of q.line_items) {
       const m = materialsById.get(li.material_id);
       if (!m) continue;
       if (!topics.has(q.supplier_id)) topics.set(q.supplier_id, new Set());
-      if (!cats.has(q.supplier_id)) cats.set(q.supplier_id, new Set());
       if (m.topic) topics.get(q.supplier_id)!.add(m.topic);
-      if (m.category) cats.get(q.supplier_id)!.add(m.category);
     }
   }
   return rawSuppliers.map((s) => {
     const t = topics.get(s.id);
-    const c = cats.get(s.id);
+    const derivedTopic = t && t.size ? [...t][0] : "";
-    // اگر از quotes topic/category پیدا نشد، registry را چک کن
+    // اگر از quotes چیزی پیدا نشد، registry را چک کن
-    if (!t || t.size === 0) {
+    if (!derivedTopic) {
       const reg = supplierTopicRegistry.get(s.id);
-      if (reg) {
+      if (reg) return adaptSupplier(s, reg.topic, reg.categories);
-        return adaptSupplier(s, reg.topic, reg.categories);
     }
-    }
+    // دستهٔ ثبت‌شده روی خودِ تأمین‌کننده (FK بک‌اند) منبع اصلی است و نامش با نام
-    return adaptSupplier(s, t ? [...t][0] : "", c ? [...c].sort((a, b) => a.localeCompare(b, "fa")) : []);
+    // تاپیک‌ها یکی است؛ تاپیک از اقلام پیشنهاد استنتاج می‌شود.
+    const backendCat = s.category?.name || "";
+    return adaptSupplier(s, derivedTopic || backendCat, backendCat ? [backendCat] : []);
   });
 }
 
-function adaptCategoryUnit(raw: RawCategoryUnit): CategoryUnit {
-  return { id: raw.id, category: raw.category?.name || "", ref_unit: raw.ref_unit };
-}
-function adaptUnitConversion(raw: RawUnitConversion, lookup: Lookup): UnitConversion {
-  return {
-    id: raw.id,
-    category: raw.category?.name || lookup.categoryIdToName.get(raw.category_id) || "",
-    brand: raw.brand || "",
-    from_unit: raw.from_unit,
-    to_unit: raw.to_unit,
-    factor: raw.factor,
-  };
-}
 function adaptStandardConversion(raw: RawStandardConversion): StandardConversion {
   return { id: raw.id, from_unit: raw.from_unit, to_unit: raw.to_unit, factor: raw.factor };
 }
@@ -668,23 +688,66 @@ function adaptAttachment(raw: RawAttachment): Attachment {
 
 function toDateOnly(v: string | null | undefined): string | null {
   if (!v) return null;
-  const str = String(v).trim();
+  const str = toAsciiDigits(v).trim();
-  if (/^\d{4}-\d{2}-\d{2}$/.test(str)) return str;
+  if (!str) return null;
-  // datetime کامل → تاریخ به وقت محلی (نه UTC که یک روز عقب می‌افتد)
+
+  // ۱. فرمت جلالی با اسلش، خط تیره یا نقطه (سال‌های ۱۳۰۰ تا ۱۵۰۰)
+  const jm = str.match(/^(1[34]\d{2})[/\-.](\d{1,2})[/\-.](\d{1,2})/);
+  if (jm) {
+    const jy = parseInt(jm[1], 10);
+    const jmon = parseInt(jm[2], 10);
+    const jd = parseInt(jm[3], 10);
+    const [gy, gm, gd] = jalaliToGregorian(jy, jmon, jd);
+    return `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+  }
+
+  // ۲. فرمت میلادی استاندارد YYYY-MM-DD
+  const gm = str.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+  if (gm && parseInt(gm[1], 10) >= 1900) return str;
+
+  // ۳. رشته‌ی datetime کامل یا مقادیر دیگر
   const d = new Date(str);
   if (Number.isNaN(d.getTime())) return null;
+  if (d.getFullYear() < 1900 && d.getFullYear() >= 1300) {
+    const [gy, gm, gd] = jalaliToGregorian(d.getFullYear(), d.getMonth() + 1, d.getDate());
+    return `${gy}-${String(gm).padStart(2, "0")}-${String(gd).padStart(2, "0")}`;
+  }
   return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
 }
+
 function toDateTime(v: string | null | undefined): string | null {
-  const d = toDateOnly(v);
+  if (!v) return null;
-  if (!d) return null;
+  const str = toAsciiDigits(v).trim();
-  return /^\d{4}-\d{2}-\d{2}$/.test(v as string) ? d + "T00:00:00Z" : (v as string);
+  if (!str) return null;
+
+  // ۱. تاریخ جلالی با زمان اختیاری
+  const jm = str.match(/^(1[34]\d{2})[/\-.](\d{1,2})[/\-.](\d{1,2})(?:[ T](\d{1,2}):(\d{1,2})(?::(\d{1,2}))?)?/);
+  if (jm) {
+    const jy = parseInt(jm[1], 10);
+    const jmon = parseInt(jm[2], 10);
+    const jd = parseInt(jm[3], 10);
+    const h = jm[4] != null ? parseInt(jm[4], 10) : 0;
+    const m = jm[5] != null ? parseInt(jm[5], 10) : 0;
+    const s = jm[6] != null ? parseInt(jm[6], 10) : 0;
+    const [gy, gm, gd] = jalaliToGregorian(jy, jmon, jd);
+    return new Date(gy, gm - 1, gd, h, m, s).toISOString();
+  }
+
+  // ۲. اگر میلادی استاندارد ISO است
+  const d = new Date(str);
+  if (!Number.isNaN(d.getTime()) && d.getFullYear() >= 1900) {
+    return /^\d{4}-\d{2}-\d{2}$/.test(str) ? str + "T00:00:00Z" : str;
+  }
+
+  const dateOnly = toDateOnly(str);
+  return dateOnly ? dateOnly + "T00:00:00Z" : null;
 }
 function todayIso(): string {
   return new Date().toISOString().slice(0, 10);
 }
-function looksLikeUuid(v: string): boolean {
+export function looksLikeUuid(v: string | null | undefined): boolean {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);
+  if (!v) return false;
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(String(v).trim());
 }
 
 // ============================================================
@@ -721,16 +784,14 @@ function registerSupplierTopic(id: string, topic: string, categories: string[]):
 export const api = {
   // ---------- کل store (یک بار در ریشه) ----------
   async listAll(): Promise<Store> {
-    const [quotesRes, suppliersRes, materialsRes, projectsRes, unitsRes, categoriesRes, cruRes, ucRes, scuRes] =
+    const [quotesRes, suppliersRes, materialsRes, projectsRes, unitsRes, categoriesRes, scuRes] =
       await Promise.all([
         getData<RawQuote[]>(`/quotes?expand=supplier,project,events,line_items,termsheets,decision,receipt&page_size=${PAGE_SIZE}`),
         getData<RawSupplier[]>(`/suppliers?page_size=${PAGE_SIZE}`),
-        getData<RawMaterial[]>(`/materials?expand=category,brands,canonical_unit,attributes&page_size=${PAGE_SIZE}`),
+        getData<RawMaterial[]>(`/materials?expand=brands,canonical_unit,attributes&page_size=${PAGE_SIZE}`),
         getData<RawProject[]>(`/projects?page_size=${PAGE_SIZE}`),
         getData<RawUnit[]>(`/units?page_size=${PAGE_SIZE}`),
         getData<RawMaterialCategory[]>(`/material-categories?page_size=${PAGE_SIZE}`),
-        getData<RawCategoryUnit[]>(`/category-reference-units?expand=category&page_size=${PAGE_SIZE}`),
-        getData<RawUnitConversion[]>(`/unit-conversions?expand=category&page_size=${PAGE_SIZE}`),
         getData<RawStandardConversion[]>(`/standard-conversions?page_size=${PAGE_SIZE}`),
       ]);
 
@@ -745,8 +806,6 @@ export const api = {
       materials,
       projects: projectsRes.map((p) => ({ id: p.id, name: p.name })),
       quotes,
-      categoryUnits: cruRes.map(adaptCategoryUnit),
-      unitConversions: ucRes.map((uc) => adaptUnitConversion(uc, lookup)),
       standardConversions: scuRes.map(adaptStandardConversion),
       topics: buildTopics(categoriesRes),
     };
@@ -777,6 +836,13 @@ export const api = {
       // مقدار پیش‌فرض/واحد جادویی؛ واحد خالی یعنی خطای صریح «واحد مشخص نشده»)
       // پروژه‌های هر قلم هم به id واقعی ترجمه می‌شوند (در صورت نبودن ساخته می‌شوند)
       for (let i = 0; i < lineItems.length; i++) {
+        let matId = realMaterialId(lineItems[i].material_id);
+        if (!looksLikeUuid(matId)) {
+          const rawMats = await getData<RawMaterial[]>(`/materials?page_size=100`);
+          const found = rawMats.find((rm) => rm.id === matId) || rawMats[0];
+          if (found) matId = found.id;
+        }
+        lineItems[i].material_id = matId;
         lineItems[i].unit_id = await unitIdByNameOrCreate(lookup, q.line_items[i].unit);
         for (const p of q.line_items[i].projects || []) {
           const pid = looksLikeUuid(p.id) ? p.id : await projectIdByNameOrCreate(p.name);
@@ -870,7 +936,6 @@ export const api = {
             if (pid) targetProjByLine.set(li.id, pid);
           }
         }
-        const allProjectIds = [...new Set([...targetProjByLine.values()])];
 
         const payload = {
           accepted_termsheets: acceptedTs.map((t) => ({
@@ -899,11 +964,7 @@ export const api = {
           item_projects: [], // کاندیداهای قبلی در line_item_projects کاملاً حفظ می‌شوند
         };
         await patchData(`/quotes/${id}/accept`, payload);
-        // پروژه‌های سطح پیشنهاد با اتحاد پروژه‌های اقلام همگام می‌شوند
+        return { ...current, ...patch, projects: current.projects } as Quote;
-        if (allProjectIds.length) {
-          await patchData(`/quotes/${id}`, { project_ids: allProjectIds });
-        }
-        return { ...current, ...patch } as Quote;
       }
 
       // --- ویرایش ساده: اقلام/termsheetها (جایگزینی کامل) + فیلدهای metadata ---
@@ -1019,19 +1080,13 @@ export const api = {
 
   materials: {
     list: async (): Promise<Material[]> => {
-      const raw = await getData<RawMaterial[]>(`/materials?expand=category,brands,canonical_unit,attributes&page_size=${PAGE_SIZE}`);
+      const raw = await getData<RawMaterial[]>(`/materials?expand=brands,canonical_unit,attributes&page_size=${PAGE_SIZE}`);
       const units = await getData<RawUnit[]>(`/units?page_size=${PAGE_SIZE}`);
       const categories = await getData<RawMaterialCategory[]>(`/material-categories?page_size=${PAGE_SIZE}`);
       return raw.map((m) => adaptMaterial(m, buildLookup(units, categories)));
     },
     create: async (m: Material): Promise<Material> => {
       const lookup = await fetchLookup();
-      // v2.5: category_id اختیاری است — اگر نامِ تایپ‌شده یکی از ۸ دسته‌ی ثابت
-      // نباشد، متریال به‌صورت سراسری (بدون دسته) ساخته می‌شود و دسته‌اش بعداً
-      // از اولین تأمین‌کننده‌ی مرتبط استنتاج می‌شود (first-link-wins).
-      // دسته‌ی rogue دیگر هرگز ساخته نمی‌شود — فقط تطبیق با ۸ دسته‌ی موجود؛
-      // در صورت نبود تطبیق، خطا نمی‌دهیم و category_id را null می‌فرستیم.
-      const categoryId = m.category ? lookup.categoryNameToId.get(norm(m.category)) : undefined;
       // واحد مرجع — بدون مقدار پیش‌فرض؛ متریال بدون واحدِ صریح ساخته نمی‌شود
       // (بک‌اند canonical_unit_id را الزامی می‌داند)
       const unitName = (m.base_unit || "").trim();
@@ -1044,7 +1099,7 @@ export const api = {
       // name فقط نامِ خودِ متریال است؛ برند در brand_ids و مشخصه‌ها در
       // attributes (EAV) ذخیره می‌شوند. اگر برند/مشخصه داخل name ریخته شود،
       // در ویزارد به‌عنوان «نامِ متریال» کش می‌شود و مشخصه‌ها در نام ظاهر می‌شوند.
-      const name = (m.category || m.brand || (m.specs || []).join(" ") || "").trim() || "کالای جدید";
+      const name = (m.name || m.brand || (m.specs || []).join(" ") || "").trim() || "کالای جدید";
       // مشخصه‌ها به‌صورت attribute (EAV) ذخیره می‌شوند تا بعد از رفرش دیده شوند
       const attrs: { attribute_definition_id: string; value: string }[] = [];
       const seen = new Set<string>();
@@ -1056,7 +1111,6 @@ export const api = {
         if (defId) attrs.push({ attribute_definition_id: defId, value: spec });
       }
       const raw = await postData<RawMaterial>("/materials", {
-        category_id: categoryId ?? null,
         name,
         topic: m.topic || null,
         canonical_unit_id: unitId,
@@ -1086,46 +1140,6 @@ export const api = {
   },
 
   units: {
-    getCategoryUnits: async (): Promise<CategoryUnit[]> => {
-      const raw = await getData<RawCategoryUnit[]>(`/category-reference-units?expand=category&page_size=${PAGE_SIZE}`);
-      return raw.map(adaptCategoryUnit);
-    },
-    saveCategoryUnit: async (cu: CategoryUnit): Promise<void> => {
-      const lookup = await fetchLookup();
-      const categoryId = lookup.categoryNameToId.get(norm(cu.category));
-      if (!categoryId) throw new Error(`دسته‌بندی «${cu.category}» یافت نشد`);
-      await putData(`/category-reference-units/${categoryId}`, { ref_unit: cu.ref_unit });
-    },
-    getConversions: async (): Promise<UnitConversion[]> => {
-      const lookup = await fetchLookup();
-      const raw = await getData<RawUnitConversion[]>(`/unit-conversions?expand=category&page_size=${PAGE_SIZE}`);
-      return raw.map((uc) => adaptUnitConversion(uc, lookup));
-    },
-    saveConversion: async (c: UnitConversion): Promise<void> => {
-      const lookup = await fetchLookup();
-      const categoryId = lookup.categoryNameToId.get(norm(c.category));
-      if (!categoryId) throw new Error(`دسته‌بندی «${c.category}» یافت نشد`);
-      const body = {
-        category_id: categoryId,
-        brand: c.brand || null,
-        from_unit: c.from_unit,
-        to_unit: c.to_unit,
-        factor: c.factor,
-      };
-      if (looksLikeUuid(c.id)) {
-        await patchData(`/unit-conversions/${c.id}`, {
-          brand: c.brand || null,
-          from_unit: c.from_unit,
-          to_unit: c.to_unit,
-          factor: c.factor,
-        });
-      } else {
-        await postData("/unit-conversions", body);
-      }
-    },
-    deleteConversion: async (id: string): Promise<void> => {
-      await deleteData(`/unit-conversions/${id}`);
-    },
     getStandardConversions: async (): Promise<StandardConversion[]> => {
       const raw = await getData<RawStandardConversion[]>(`/standard-conversions?page_size=${PAGE_SIZE}`);
       return raw.map(adaptStandardConversion);
@@ -1200,8 +1214,46 @@ export const api = {
     remove: async (quoteId: string, kind: FileKind, id: string): Promise<void> => {
       await deleteData(`/quotes/${quoteId}/${kind}/${id}`);
     },
-    downloadUrl: (quoteId: string, kind: FileKind, id: string): string =>
+    // دانلود احراز هویت‌شده: <a href> توکن Authorization نمی‌فرستد، پس بایت‌ها
-      `${BASE_URL}/quotes/${quoteId}/${kind}/${id}`,
+    // را با توکن می‌گیریم و به شکل blob در مرورگر ذخیره می‌کنیم.
+    download: async (quoteId: string, kind: FileKind, id: string, fileName: string): Promise<void> => {
+      let res: Response;
+      const dlPath = `/quotes/${quoteId}/${kind}/${id}`;
+      try {
+        res = await fetch(BASE_URL + dlPath, {
+          headers: authHeaders(),
+        });
+      } catch {
+        throw new ApiError("اتصال به سرور برقرار نشد — آیا بک‌اند در دسترس است؟", 0);
+      }
+      handle401(dlPath, res);
+      if (!res.ok) throw new ApiError(faHttpError(res.status, "خطای سرور"), res.status);
+      const blob = await res.blob();
+      const url = URL.createObjectURL(blob);
+      try {
+        const a = document.createElement("a");
+        a.href = url;
+        a.download = fileName || "attachment";
+        document.body.appendChild(a);
+        a.click();
+        a.remove();
+      } finally {
+        URL.revokeObjectURL(url);
+      }
+    },
+    // آدرس blob احراز هویت‌شده برای پیش‌نمایش (تصویر/PDF در مودال).
+    // تگ‌های <img>/<iframe>/<a href> توکن نمی‌فرستند، پس بایت‌ها را با توکن
+    // آدرس پیش‌نمایش احراز هویت‌شده برای <iframe>/<img>.
+    // این‌ها نمی‌توانند هدر Authorization بفرستند، پس بک‌اند یک توکن
+    // امضاشده‌ی کوتاه‌عمر در کوئری می‌دهد. عمداً blob ساخته نمی‌شود:
+    // دانلودمنیجرها (IDM) blob را شکار می‌کنند و فایل ۰ بایتی می‌سازند،
+    // در حالی که این یک URL واقعی است و درست بارگذاری می‌شود.
+    previewUrl: async (quoteId: string, kind: FileKind, id: string): Promise<string> => {
+      const res = await getData<{ url: string; token: string }>(
+        `/quotes/${quoteId}/preview-url/${kind}/${id}`,
+      );
+      return BASE_URL + res.url;
+    },
   },
 
   // ---------- برندها (از بک‌اند) ----------
@@ -1259,6 +1311,10 @@ async function fetchProjects(): Promise<RawProject[]> {
 async function projectIdByNameOrCreate(name: string | null | undefined): Promise<string | null> {
   if (!name) return null;
   const projects = await fetchProjects();
+  if (looksLikeUuid(name)) {
+    const byId = projects.find((x) => x.id.toLowerCase() === name.toLowerCase());
+    if (byId) return byId.id;
+  }
   const pid = projectIdByName(projects, name);
   if (pid) return pid;
   const raw = await postData<RawProject>("/projects", { name });
@@ -1390,8 +1446,12 @@ async function specDefinitionId(spec: string): Promise<string | null> {
 
 // utility برای ساخت id موقت جدید (ویزارد — قبل از ذخیره در بک‌اند)
 export function nextId(prefix: string, items: { id: string }[]): string {
+  const regex = new RegExp(`^${prefix}(\\d+)$`);
   const max = items
-    .map((x) => parseInt(String(x.id).replace(/\D/g, ""), 10))
+    .map((x) => {
+      const m = String(x.id).match(regex);
+      return m ? parseInt(m[1], 10) : 0;
+    })
     .filter((n) => !Number.isNaN(n))
     .reduce((a, b) => Math.max(a, b), 0);
   return prefix + (max + 1);
@@ -1592,7 +1652,8 @@ export const apiV26 = {
       const d = await postData<Parameters<typeof rawWarehouse>[0]>(`/inventory/warehouses${projectQuery()}`, body);
       return rawWarehouse(d);
     },
-    update: async (id: string, body: { name?: string; description?: string | null; project_id?: string }): Promise<Warehouse> => {
+    // project_id عمداً در تایپ نیست — انبار برای همیشه به پروژه‌ی والدش تعلق دارد
+    update: async (id: string, body: { name?: string; description?: string | null }): Promise<Warehouse> => {
       const d = await patchData<Parameters<typeof rawWarehouse>[0]>(`/inventory/warehouses/${id}${projectQuery()}`, body);
       return rawWarehouse(d);
     },
@@ -1624,15 +1685,6 @@ export const apiV26 = {
     types: async (): Promise<{ type: TransactionType; label: string }[]> => {
       return getData<{ type: TransactionType; label: string }[]>("/inventory/meta/types");
     },
-    materialOptions: async (category_id: string, warehouse_id?: string): Promise<{ id: string; name: string; brands: { id: string; name: string }[] }[]> => {
-      const params: Record<string, string> = { category_id };
-      if (warehouse_id) params.warehouse_id = warehouse_id;
-      const pid = activeProjectId();
-      if (pid) params.project_id = pid;
-      return getData<{ id: string; name: string; brands: { id: string; name: string }[] }[]>(
-        `/inventory/materials/options?${new URLSearchParams(params).toString()}`,
-      );
-    },
   },
 
   pm: {
@@ -1670,7 +1722,6 @@ export const apiV26 = {
     }): Promise<{ id: string; name: string }> =>
       postData("/materials", {
         name: opts.name,
-        category_id: null, // دسته از اولین تأمین‌کننده‌ی مرتبط استنتاج می‌شود (v2.5)
         topic: null,
         canonical_unit_id: opts.canonical_unit_id,
         status: "active",

frontend/src/lib/jalali.ts

@@ -99,8 +99,11 @@ export const MONTHS = [
 
 export const WEEKDAYS = ["ش", "ی", "د", "س", "چ", "پ", "ج"];
 
-function toEnSafe(s: string): string {
+export function toAsciiDigits(s: string | number | null | undefined): string {
-  return String(s).replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d)));
+  if (s == null) return "";
+  return String(s)
+    .replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d)))
+    .replace(/[٠-٩]/g, (d) => String("٠١٢٣٤٥٦٧٨٩".indexOf(d)));
 }
 
 // format an ISO (gregorian) string to "۱۴۰۳/۰۵/۱۲"
@@ -121,17 +124,30 @@ export function isoToJalaliLong(iso: string | null | undefined): string {
   return `${toFa(jd)} ${MONTHS[jm - 1]} ${toFa(jy)}`;
 }
 
-// parse a jalali "yyyy/m/d" string to a JS Date (gregorian) at local midnight
+// parse a jalali "yyyy/m/d" or "yyyy/m/d h:m" string to a JS Date (gregorian) ISO string
 export function jalaliStrToIso(str: string | null | undefined): string | null {
   if (!str) return null;
-  const nums = String(str)
+  const s = toAsciiDigits(str).trim();
+  const m = s.match(/^(1[34]\d{2})[/\-.](\d{1,2})[/\-.](\d{1,2})(?:[ T](\d{1,2}):(\d{1,2})(?::(\d{1,2}))?)?/);
+  if (!m) {
+    const nums = s
       .split(/[/\-.]/)
-    .map((x) => parseInt(toEnSafe(x), 10));
+      .map((x) => parseInt(x, 10));
     if (nums.length < 3 || nums.some((n) => Number.isNaN(n))) return null;
     const [jy, jm, jd] = nums;
     const [gy, gm, gd] = jalaliToGregorian(jy, jm, jd);
     const dt = new Date(gy, gm - 1, gd);
     return Number.isNaN(dt.getTime()) ? null : dt.toISOString();
+  }
+  const jy = parseInt(m[1], 10);
+  const jm = parseInt(m[2], 10);
+  const jd = parseInt(m[3], 10);
+  const h = m[4] != null ? parseInt(m[4], 10) : 0;
+  const min = m[5] != null ? parseInt(m[5], 10) : 0;
+  const sec = m[6] != null ? parseInt(m[6], 10) : 0;
+  const [gy, gm, gd] = jalaliToGregorian(jy, jm, jd);
+  const dt = new Date(gy, gm - 1, gd, h, min, sec);
+  return Number.isNaN(dt.getTime()) ? null : dt.toISOString();
 }
 
 export function daysInMonth(jy: number, jm: number): number {

frontend/src/lib/quoteUtils.ts

@@ -2,7 +2,7 @@
 // منطق بیزنس مشترک پیشنهادها — پورت از app.js
 // ============================================================
 
-import type { LineItem, Material, Quote, StandardConversion, Store, Supplier, UnitConversion } from "./types";
+import type { LineItem, Material, Quote, Store, Supplier } from "./types";
 import { normalize } from "./normalize";
 import { groupCommas } from "./numutil";
 import { fmtDate } from "./formatters";
@@ -17,7 +17,6 @@ export function materialById(materials: Material[], id: string): Material {
       id: "",
       name: "",
       topic: "",
-      category: "؟",
       brand: "",
       specs: [],
       base_unit: "",
@@ -35,43 +34,51 @@ export function specsKey(specs: string[]): string {
   return (specs || []).map((s) => normalize(s)).filter(Boolean).sort().join("|");
 }
 
-// specها با جداکننده‌ی « · »
+// specها با جداکننده‌ی « . »
 export function specsLabel(specs: string[]): string {
-  return specs.join(" · ");
+  return specs.join(" . ");
 }
 
 /**
  * عنوان تمیز و بدون تکرار کالا:
- * ترکیب هوشمندانه‌ی نام اصلی (materials.name)، برند، و مشخصه‌ها بدون تکرار کلمات مشترک.
+ * ترتیب اکید با جداکننده‌ی نقطه:
+ * [نام برند] . [نام متریال] . [مشخصه ۱] . [مشخصه ۲]
  */
 export function formatMaterialTitle(
-  m: Pick<Material, "name" | "brand" | "specs" | "category"> | null | undefined,
+  m: Pick<Material, "name" | "brand" | "specs"> | null | undefined,
   extraSpecs?: string[],
 ): string {
   if (!m) return "کالا";
-  const rawName = (m.name || "").trim();
+  let rawName = (m.name || "").trim();
   const rawBrand = (m.brand || "").trim();
   const rawSpecs = [...(m.specs || []), ...(extraSpecs || [])]
     .map((s) => (s || "").trim())
     .filter(Boolean);
 
-  const normName = normalize(rawName);
   const normBrand = normalize(rawBrand);
 
-  if (!rawName) {
+  // اگر نام کالا با نام برند شروع شده باشد، برند را از ابتدای نام برمی‌داریم تا تکرار نشود
-    if (rawBrand && rawSpecs.length) return `${rawBrand} · ${rawSpecs.join(" · ")}`;
+  if (normBrand && rawName) {
-    if (rawBrand) return rawBrand;
+    const normName = normalize(rawName);
-    if (rawSpecs.length) return rawSpecs.join(" · ");
+    if (normName.startsWith(normBrand)) {
-    return m.category && m.category !== "؟" ? m.category : "کالا";
+      const rest = rawName.slice(rawBrand.length).trim();
+      rawName = rest.replace(/^[.\s·\-]+/, "").trim();
+    }
   }
 
-  let title = rawName;
+  // قطعات نهایی با ترتیب مشخص: [Brand Name] . [Material Name] . [Specification 1] . [Specification 2]
-  if (normBrand && !normName.includes(normBrand)) {
+  const parts: string[] = [];
-    title = `${rawBrand} ${title}`;
+  if (rawBrand) {
+    parts.push(rawBrand);
+  }
+  if (rawName) {
+    parts.push(rawName);
+  } else if (!rawBrand) {
+    parts.push("کالا");
   }
 
-  const normTitle = normalize(title);
+  // اضافه کردن مشخصه‌ها بدون تکرار
-  const distinctSpecs: string[] = [];
+  const normCurrent = normalize(parts.join(" "));
   const seenNormSpecs = new Set<string>();
 
   for (const s of rawSpecs) {
@@ -79,21 +86,75 @@ export function formatMaterialTitle(
     if (!ns || seenNormSpecs.has(ns)) continue;
     seenNormSpecs.add(ns);
 
-    // اگر مشخصه قبلاً داخل عنوان یا نام کالا آمده باشد، تکرار نمی‌کنیم
+    // اگر مشخصه قبلاً داخل نام یا برند آمده باشد، تکرار نمی‌کنیم
-    if (normTitle.includes(ns)) continue;
+    if (normCurrent.includes(ns)) continue;
-    distinctSpecs.push(s);
+    parts.push(s);
   }
 
-  if (distinctSpecs.length > 0) {
+  return parts.join(" . ");
-    return `${title} · ${distinctSpecs.join(" · ")}`;
-  }
-  return title;
 }
 
-export function materialLabel(m: Pick<Material, "name" | "brand" | "specs" | "category"> | null | undefined): string {
+export function materialLabel(m: Pick<Material, "name" | "brand" | "specs"> | null | undefined): string {
   return formatMaterialTitle(m);
 }
 
+// نام پایه‌ی متریال از نامِ ذخیره‌شده.
+// متریال‌های جدید فقط نامِ خودِ متریال را در name دارند (برند در brand و
+// مشخصه‌ها در attributes ذخیره می‌شوند) و دست‌نخورده برمی‌گردند. رکوردهای قدیمی
+// name را به شکل «برند + مشخصه» ذخیره کرده‌اند؛ آن قطعات جدا می‌شوند تا نامِ
+// پایه باقی بماند.
+export function materialBaseName(name: string, brand: string, specs: string[]): string {
+  const fallback = (name || "").trim();
+  if (!fallback) return "";
+  let base = fallback;
+  // بلندترین قطعه اول حذف می‌شود تا حذف‌های جزئی، رشته را ناقص نکنند
+  const parts = [brand, ...specs]
+    .map((p) => (p || "").trim())
+    .filter(Boolean)
+    .sort((a, b) => b.length - a.length);
+  for (const p of parts) {
+    if (!base.includes(p)) continue;
+    const next = base.split(p).join(" ").replace(/\s+/g, " ").trim();
+    // اگر حذفِ این قطعه کلِ نام را خالی کند، یعنی همان نامِ متریال بوده — نگهش دار
+    if (!next) continue;
+    base = next;
+  }
+  // شکلِ قدیمیِ خراب می‌تواند فقط یک مشخصه باقی بگذارد؛ آن دیگر نامِ متریال نیست
+  if (parts.some((p) => p === base)) return fallback;
+  return base || fallback;
+}
+
+/**
+ * یافتن متریالِ متناظر با یک ردیفِ اقلام.
+ *
+ * هویت متریال = نام + برند + مشخصه. پیش از v2.7 دسته هم در این تطبیق بود، ولی
+ * دسته دیگر روی متریال نیست؛ تکیه بر نام جلوی اشتباه‌گرفتن دو متریال با
+ * برند و مشخصه‌ی یکسان (مثل دو چمن مصنوعیِ هم‌برند) را می‌گیرد. نامِ خالی یعنی
+ * هویت نامعلوم — در آن حالت تطبیق نمی‌دهیم و متریالِ تازه ساخته می‌شود.
+ */
+export function matchMaterial(
+  materials: Material[],
+  name: string,
+  brand: string,
+  specs: string[],
+): Material | undefined {
+  const wantName = normalize(name);
+  if (!wantName) return undefined;
+  const wantBrand = normalize(brand);
+  const wantSpecs = specsKey(specs);
+  const sameIdentity = (m: Material) => normalize(m.brand) === wantBrand && specsKey(m.specs) === wantSpecs;
+  const base = normalize(materialBaseName(name, brand, specs));
+  return (
+    materials.find((m) => normalize(m.name) === wantName && sameIdentity(m)) ||
+    materials.find(
+      (m) =>
+        base &&
+        normalize(materialBaseName(m.name, m.brand, m.specs)) === base &&
+        sameIdentity(m),
+    )
+  );
+}
+
 // آرایه‌ی termsheet_ids یک قلم (هر دو فرمت قدیم/جدید)
 export function itemTermsheetIds(li: LineItem): string[] {
   if (li.termsheet_ids) return li.termsheet_ids;
@@ -147,65 +208,10 @@ export function lineItemTotal(li: LineItem): number | null {
 // - در وضعیت accepted یا arrived: فقط تک پروژه‌ی انتخاب‌شده در خرید (item_decisions.project_id)
 export function itemProjects(q: Quote, li: LineItem): string[] {
   if (q.status === "accepted" || q.status === "arrived") {
-    if (li.target_project?.name) {
+    return li.target_project?.name ? [li.target_project.name] : [];
-      return [li.target_project.name];
   }
-    // اگر target_project هنوز آبجکت نام نداشت، بررسی نام در صورت تک‌پروژه بودن
+  // For 'offered', 'rejected', 'expired': return all candidate projects
-    if (li.projects && li.projects.length === 1) {
+  return (li.projects || []).map((p) => (typeof p === "string" ? p : p.name)).filter(Boolean);
-      const p = li.projects[0];
-      return [typeof p === "string" ? p : p.name];
-    }
-    return [];
-  }
-  return (li.projects || []).map((p) => (typeof p === "string" ? p : p.name));
-}
-
-// ---------- واحد مرجع و ضریب تبدیل ----------
-
-// واحد مرجع یک دسته
-export function refUnitForCategory(store: Pick<Store, "categoryUnits">, category: string): string {
-  const cu = (store.categoryUnits || []).find((c) => normalize(c.category) === normalize(category));
-  return cu ? cu.ref_unit : "";
-}
-
-// ضریب تبدیل با اولویت: دسته‌ای (برند مشخص > همه برندها) > تبدیل ثابت جهانی
-export function findConversion(
-  store: Pick<Store, "unitConversions" | "standardConversions">,
-  category: string,
-  brand: string,
-  fromUnit: string,
-  toUnit: string,
-): UnitConversion | StandardConversion | null {
-  const list = (store.unitConversions || []).filter(
-    (c) =>
-      normalize(c.category) === normalize(category) &&
-      normalize(c.from_unit) === normalize(fromUnit) &&
-      normalize(c.to_unit) === normalize(toUnit) &&
-      (!c.brand || normalize(c.brand) === normalize(brand)),
-  );
-  list.sort((a, b) => (b.brand ? 1 : 0) - (a.brand ? 1 : 0));
-  if (list[0]) return list[0];
-  return (
-    (store.standardConversions || []).find(
-      (c) => normalize(c.from_unit) === normalize(fromUnit) && normalize(c.to_unit) === normalize(toUnit),
-    ) || null
-  );
-}
-
-// تبدیل یک قلم به واحد مرجع دسته؛ null وقتی ضریبی نیست یا واحد از قبل مرجع است
-export function refConverted(
-  store: Pick<Store, "categoryUnits" | "unitConversions" | "standardConversions" | "materials">,
-  li: LineItem,
-): { qty: number; unit: string; perRef: number | null } | null {
-  const m = materialById(store.materials, li.material_id);
-  const ref = refUnitForCategory(store, m.category);
-  if (!ref || !li.unit || normalize(ref) === normalize(li.unit)) return null;
-  const conv = findConversion(store, m.category, m.brand, li.unit, ref);
-  if (!conv) return null;
-  const qty = (li.quantity || 0) * conv.factor;
-  const total = li.total_price != null ? li.total_price : (li.unit_price || 0) * (li.quantity || 0);
-  const perRef = qty > 0 ? Math.round(total / qty) : null;
-  return { qty, unit: ref, perRef };
 }
 
 // واحدهای ناشناخته‌ی استفاده‌شده در یک quote → لینک به داشبورد واحدها
@@ -277,9 +283,8 @@ export function termsheetSummary(store: Store, q: Quote): { title: string; sub:
 // فیلترهای دفتر
 export function filterQuotes(
   store: Store,
-  filters: { category: string; supplier: string; status: string; search: string },
+  filters: { supplier: string; status: string; search: string },
 ): Quote[] {
-  const catVal = filters.category.trim();
   const supVal = filters.supplier.trim();
   const stVal = filters.status.trim();
   const q = filters.search.trim().toLowerCase();
@@ -302,12 +307,11 @@ export function filterQuotes(
     if (stKey && quote.status !== stKey) return false;
 
     const matInfo = activeItems(quote).map((li) => materialById(store.materials, li.material_id));
-    if (catVal && !matInfo.some((m) => m.category === catVal)) return false;
 
     if (q) {
       const hay =
         `${supObj.name} ${quote.project || ""} ` +
-        matInfo.map((m) => `${m.category} ${m.brand} ${materialSpecs(m).join(" ")}`).join(" ");
+        matInfo.map((m) => `${m.brand} ${materialSpecs(m).join(" ")}`).join(" ");
       if (!hay.toLowerCase().includes(q)) return false;
     }
     return true;

frontend/src/lib/types.ts

@@ -20,9 +20,8 @@ export interface Supplier {
 // ماده/کالا
 export interface Material {
   id: string; // "m1", "m2", ...
-  name: string; // نام کامل ذخیره‌شده در بک‌اند (برند + دسته + مشخصه)
+  name: string; // نامِ خودِ متریال — برند در brand و مشخصه‌ها در specs
   topic: string;
-  category: string; // مثلاً "میلگرد"
   brand: string; // مثلاً "ذوب آهن"
   specs: string[]; // آرایه‌ای از مشخصه‌ها (مثلاً ["A2"])
   base_unit: string; // واحد پایه
@@ -97,23 +96,6 @@ export interface Quote {
   termsheets: Termsheet[];
 }
 
-// واحد مرجع هر دسته
-export interface CategoryUnit {
-  id: string;
-  category: string;
-  ref_unit: string;
-}
-
-// ضریب تبدیل (دسته‌ای)
-export interface UnitConversion {
-  id: string;
-  category: string;
-  brand: string; // خالی = همه برندها
-  from_unit: string;
-  to_unit: string;
-  factor: number; // 1 from_unit = factor * to_unit
-}
-
 // ضریب تبدیل استاندارد (جهانی)
 export interface StandardConversion {
   id: string;
@@ -128,8 +110,6 @@ export interface Store {
   materials: Material[];
   projects: Project[];
   quotes: Quote[];
-  categoryUnits: CategoryUnit[];
-  unitConversions: UnitConversion[];
   standardConversions: StandardConversion[];
   topics: Topic[]; // دسته‌بندی‌های ۸گانه از /material-categories
 }

frontend/src/main.tsx

@@ -6,6 +6,7 @@ import { Toaster } from "sonner";
 import App from "./App";
 import "./styles/globals.css";
 import { queryClient } from "./lib/queryClient";
+import { initAnalytics } from "./lib/analytics";
 
 // بعد از استقرار نسخه‌ی جدید، مرورگری که index.html قدیمی را باز کرده برای
 // بارگذاری chunkهای حذف‌شده 404 می‌گیرد و صفحه خالی می‌ماند. این شنونده،
@@ -15,6 +16,9 @@ window.addEventListener("vite:preloadError", () => {
   window.location.reload();
 });
 
+// Product analytics + GlitchTip error capture — no-ops without VITE_ config.
+initAnalytics();
+
 createRoot(document.getElementById("root")!).render(
   <StrictMode>
     <QueryClientProvider client={queryClient}>

frontend/src/pages/Auth/LoginPage.tsx

@@ -3,6 +3,7 @@ import { useNavigate } from "react-router-dom";
 import { toast } from "sonner";
 import { ClipboardList, Eye, EyeOff, Loader2, Lock, ShieldCheck, Wrench, X } from "lucide-react";
 import { api, apiV26 } from "../../lib/api";
+import { identifyUser, track } from "../../lib/analytics";
 import { useAuthStore } from "../../store/auth";
 import type { Project } from "../../lib/types";
 
@@ -78,6 +79,9 @@ export function LoginPage() {
       }
       setToken(access_token);
       setUser(user);
+      // تحلیل رفتار (no-op بدون تنظیمات VITE_OPENPANEL_*)
+      identifyUser({ id: user.id, name: user.display_name, role: user.role });
+      track("login_success", { role: user.role });
       toast.success(`خوش آمدید، ${user.display_name}`);
       // مدیر پروژه → پنل انبار؛ مدیر تدارکات/ادمین → دفتر پیشنهادهای خرید
       navigate(user.role === "pm" ? "/inventory" : "/");

frontend/src/pages/Dashboard/AcceptModal.tsx

@@ -206,18 +206,14 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
       if (t.status === "accepted" && !usedIds.has(t.id)) t.status = "offered";
     });
 
-    const projUnion = new Set<string>();
+    // پروژه‌ی هر قلم (تکی هدف خرید) — فقط target_project تنظیم می‌شود؛
+    // li.projects و next.projects دست‌نخورده باقی می‌مانند تا پروژه‌های کاندیدای اولیه حفظ شوند
     next.line_items.forEach((li) => {
       if (li.rejected) return;
       const name = itemProjectsSel[li.id];
       if (name === undefined) return;
       li.target_project = name ? { id: "", name } : null;
-      if (name) projUnion.add(name);
     });
-    if (projUnion.size > 0) {
-      next.projects = [...projUnion];
-      next.project = next.projects[0] || "";
-    }
 
     const now = new Date().toISOString();
     next.accepted_date = acceptDate || now;
@@ -410,7 +406,8 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
                       toast.error(err instanceof Error ? err.message : "حذف فاکتور ناموفق بود"),
                     )
                   }
-                  urlOf={(a) => (a.id ? api.files.downloadUrl(q.id, "invoice", a.id) : null)}
+                  onDownload={(a) => api.files.download(q.id, "invoice", a.id!, a.name)}
+                  loadPreview={(a) => api.files.previewUrl(q.id, "invoice", a.id!)}
                 />
               </div>
 
@@ -428,7 +425,8 @@ export function AcceptModal({ quoteId, onClose }: AcceptModalProps) {
                       toast.error(err instanceof Error ? err.message : "حذف پیش‌فاکتور ناموفق بود"),
                     )
                   }
-                  urlOf={(a) => (a.id ? api.files.downloadUrl(q.id, "proforma", a.id) : null)}
+                  onDownload={(a) => api.files.download(q.id, "proforma", a.id!, a.name)}
+                  loadPreview={(a) => api.files.previewUrl(q.id, "proforma", a.id!)}
                   label="افزودن پیش‌فاکتور"
                 />
               </div>

frontend/src/pages/Dashboard/DashboardPage.tsx

@@ -19,7 +19,7 @@ import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
 import { AcceptModal } from "./AcceptModal";
 import { EditModal } from "./EditModal";
 
-const EMPTY_FILTERS: Filters = { category: "", supplier: "", status: "", search: "" };
+const EMPTY_FILTERS: Filters = { supplier: "", status: "", search: "" };
 
 export function DashboardPage() {
   useStoreData();
@@ -28,7 +28,7 @@ export function DashboardPage() {
   const suppliers = useSuppliers();
   const materials = useMaterials();
   const projects = useProjects();
-  const { categoryUnits, unitConversions, standardConversions } = useUnits();
+  const { standardConversions } = useUnits();
 
   const expandedQuoteIds = useAppStore((s) => s.expandedQuoteIds);
   const toggleExpand = useAppStore((s) => s.toggleExpand);
@@ -40,8 +40,8 @@ export function DashboardPage() {
   const [editId, setEditId] = useState<string | null>(null);
 
   const store = useMemo(
-    () => ({ quotes, suppliers, materials, projects, categoryUnits, unitConversions, standardConversions, topics }),
+    () => ({ quotes, suppliers, materials, projects, standardConversions, topics }),
-    [quotes, suppliers, materials, projects, categoryUnits, unitConversions, standardConversions, topics],
+    [quotes, suppliers, materials, projects, standardConversions, topics],
   );
 
   // فیلتر + مرتب‌سازی بر اساس زمان ساخت (created_at)
@@ -80,7 +80,6 @@ export function DashboardPage() {
     }));
   };
 
-  const categoryOptions = useMemo(() => [...new Set(materials.map((m) => m.category))], [materials]);
   const supplierOptions = useMemo(() => suppliers.map((s) => ({ id: s.id, name: s.name })), [suppliers]);
 
   return (
@@ -138,7 +137,6 @@ export function DashboardPage() {
         <FilterToolbar
           filters={filters}
           onChange={setFilters}
-          categories={categoryOptions}
           suppliers={supplierOptions}
           sortDir={sortDir}
           onToggleSort={() => setSortDir((d) => (d === "desc" ? "asc" : "desc"))}

frontend/src/pages/Dashboard/EditModal.tsx

@@ -14,17 +14,16 @@ import {
   useAddSupplier,
   useAddMaterial,
 } from "../../hooks";
-import { itemTermsheetIds, materialById, materialSpecs, supplierById } from "../../lib/quoteUtils";
+import { itemTermsheetIds, matchMaterial, materialById, materialSpecs, supplierById } from "../../lib/quoteUtils";
 import { STATUS_LABEL, statusOptionsFor } from "../../lib/constants";
 import { faNum } from "../../lib/formatters";
 import { normalize } from "../../lib/normalize";
-import { specsKey } from "../../lib/quoteUtils";
 import { Combobox } from "../../components/Combobox";
 import { JalaliDatePicker } from "../../components/JalaliDatePicker";
 import { NumberInput } from "../../components/NumberInput";
 import { MultiSelectCombobox } from "../../components/MultiSelectCombobox";
 import { FileList } from "../../components/FileList";
-import { MilestoneRow } from "../../components/MilestoneRow";
+import { TermsheetCard } from "../../components/TermsheetCard";
 import { Button } from "../../components/ui/button";
 import {
   Dialog,
@@ -154,7 +153,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         return {
           key: li.id,
           origLi: li,
-          cat: m.category || "",
+          cat: m.name || "",
           brand: m.brand || "",
           specs: materialSpecs(m),
           qty: li.quantity,
@@ -195,22 +194,56 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
     };
   }, [quoteId]);
 
-  if (!q || !ready) return null;
+  const itemOptions = useMemo(() => {
+    return itemRows
+      .filter((r) => !r.rejected || r.restore)
+      .map((r, idx) => ({
+        tempId: r.key,
+        label: `${faNum(idx + 1)}. ${r.cat || "قلم جدید"}${r.brand ? ` • ${r.brand}` : ""}`,
+      }));
+  }, [itemRows]);
 
-  const tsLabel = (card: EditTsCard, idx: number) => {
+  const getCoveredIds = (card: EditTsCard) => {
-    const orig = q.termsheets.find((t) => t.id === card.domId);
+    const cardId = card.domId || card.key;
-    return orig?.label || `گزینه ${faNum(idx + 1)}`;
+    const explicit = itemRows
+      .filter((r) => (!r.rejected || r.restore) && r.tsDomIds.includes(cardId))
+      .map((r) => r.key);
+
+    if (!explicit.length && tsCards[0]?.key === card.key) {
+      return itemRows.filter((r) => !r.rejected || r.restore).map((r) => r.key);
+    }
+    return explicit;
   };
 
+  const handleCoverageChange = (cardKey: string, newCoveredKeys: string[]) => {
+    const card = tsCards.find((c) => c.key === cardKey);
+    const cardId = card?.domId || cardKey;
+    setItemRows((rows) =>
+      rows.map((row) => {
+        const shouldHave = newCoveredKeys.includes(row.key);
+        const exists = row.tsDomIds.includes(cardId);
+        if (shouldHave === exists) return row;
+        const nextTsDomIds = shouldHave
+          ? [...row.tsDomIds, cardId]
+          : row.tsDomIds.filter((id) => id !== cardId);
+        return { ...row, tsDomIds: nextTsDomIds };
+      }),
+    );
+  };
+
+  if (!q || !ready) return null;
+
   const patchItem = (key: string, patch: Partial<EditItemRow>) => {
     setItemRows((rows) => rows.map((r) => (r.key === key ? { ...r, ...patch } : r)));
   };
 
   const addItemRow = () => {
+    const newKey = "new-" + Math.random().toString(36).slice(2, 9);
+    const defaultTsId = tsCards[0] ? tsCards[0].domId || tsCards[0].key : "";
     setItemRows((rows) => [
       ...rows,
       {
-        key: "new-" + Math.random().toString(36).slice(2, 9),
+        key: newKey,
         cat: "",
         brand: "",
         specs: [],
@@ -218,7 +251,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         unit: "",
         price: null,
         total: null,
-        tsDomIds: tsCards[0] ? [tsCards[0].domId || tsCards[0].key] : [],
+        tsDomIds: defaultTsId ? [defaultTsId] : [],
         acceptedTsId: null,
         rejected: false,
         restore: true,
@@ -233,12 +266,28 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
   const addTsCard = () => {
     setTsCards((cards) => [
       ...cards,
-      { key: "new-" + Math.random().toString(36).slice(2, 9), domId: "", milestones: [{ when_iso: null, amount: null }] },
+      {
+        key: "new-ts-" + Date.now() + Math.random().toString(36).slice(2, 6),
+        domId: "",
+        milestones: [{ when_iso: null, amount: null }],
+      },
     ]);
   };
 
   const removeTsCard = (key: string) => {
+    if (tsCards.length <= 1) {
+      toast.error("حداقل یک روش شرایط پرداخت باید وجود داشته باشد.");
+      return;
+    }
     setTsCards((cards) => cards.filter((c) => c.key !== key));
+    const card = tsCards.find((c) => c.key === key);
+    const cardId = card?.domId || key;
+    setItemRows((rows) =>
+      rows.map((r) => ({
+        ...r,
+        tsDomIds: r.tsDomIds.filter((id) => id !== cardId && id !== key),
+      })),
+    );
   };
 
   const confirm = async () => {
@@ -275,6 +324,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
           ? domId
           : nextDashedId("ts", newTermsheets.length ? newTermsheets : next.termsheets);
       tsIdMap[domId] = realId;
+      tsIdMap[card.key] = realId;
       const orig = next.termsheets.find((t) => t.id === realId);
       const label = orig?.label || `گزینه ${faNum(i + 1)}`;
       const st = orig?.status || "offered";
@@ -294,12 +344,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
       const total = row.total;
       if (!cat && !brand && qty == null && price == null) continue;
 
-      let material = materialsCopy.find(
+      let material = matchMaterial(materialsCopy, cat, brand, specs);
-        (m) =>
-          normalize(m.category) === normalize(cat) &&
-          normalize(m.brand) === normalize(brand) &&
-          specsKey(m.specs) === specsKey(specs),
-      );
       let materialId: string;
       if (material) {
         materialId = material.id;
@@ -308,7 +353,6 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
           id: nextId("m", materialsCopy),
           name: (cat || brand || specs.join(" ") || "").trim() || "کالای جدید",
           topic: materialById(materials, row.origLi?.material_id || "").topic || "",
-          category: cat,
           brand,
           specs,
           base_unit: unit,
@@ -326,7 +370,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
       if (!rejected) {
         row.tsDomIds.forEach((domId) => {
           const realId = tsIdMap[domId] || domId;
-          if (realId) termsheet_ids.push(realId);
+          if (realId && !termsheet_ids.includes(realId)) termsheet_ids.push(realId);
         });
         if (!termsheet_ids.length && next.termsheets.length) {
           termsheet_ids.push(next.termsheets[0].id);
@@ -363,7 +407,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
 
     const referencedTs = new Set<string>();
     next.line_items.forEach((li) => (li.termsheet_ids || []).forEach((tid) => referencedTs.add(tid)));
-    next.termsheets = next.termsheets.filter((t) => referencedTs.has(t.id));
+    next.termsheets = next.termsheets.filter((t, idx) => referencedTs.has(t.id) || idx === 0);
     next.line_items.forEach((li) => {
       if (li.accepted_ts_id && !next.termsheets.some((t) => t.id === li.accepted_ts_id)) {
         li.accepted_ts_id = null;
@@ -410,7 +454,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
     <>
       <Dialog open={!!quoteId} onOpenChange={(o) => !o && onClose()}>
         <DialogContent className="flex h-[88vh] max-h-[850px] w-[95vw] max-w-3xl flex-col p-0 overflow-hidden rounded-2xl border border-gray-200 bg-white text-gray-900 shadow-2xl">
-          {/* هدر سفید و تمیز */}
+          {/* هدر */}
           <DialogHeader className="border-b border-gray-100 bg-white px-4 py-3 sm:px-6 sm:py-4 shrink-0 text-right">
             <DialogTitle className="text-base font-bold text-gray-900 sm:text-lg">ویرایش پیشنهاد خرید</DialogTitle>
             <div className="text-[12px] text-gray-500 truncate mt-0.5">
@@ -425,7 +469,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
             </div>
           )}
 
-          {/* تب‌بار سفید و استاندارد */}
+          {/* تب‌بار */}
           <div className="flex items-center border-b border-gray-100 bg-gray-50/70 px-3 py-2 sm:px-6 gap-2 shrink-0">
             <button
               type="button"
@@ -496,12 +540,11 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
             </button>
           </div>
 
-          {/* محتوای مودال — پس‌زمینه کاملاً سفید */}
+          {/* محتوا */}
           <div className="flex-1 overflow-y-auto p-3.5 sm:p-5 space-y-4 bg-white text-gray-800">
-            {/* تب ۱: اقلام و مشخصات */}
+            {/* تب ۱: اقلام */}
             {activeTab === "items" && (
               <div className="space-y-4">
-                {/* کارت تأمین‌کننده و پروژه */}
                 <div className="rounded-xl border border-gray-200 bg-gray-50/50 p-3.5 sm:p-4 space-y-3">
                   <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
                     <div className="flex min-w-0 flex-col gap-1">
@@ -540,7 +583,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
                   </div>
                 </div>
 
-                {/* لیست اقلام */}
+                {/* لیست اقلام — چیدمان ۵ سطری هماهنگ با ویزارد */}
                 <div className="space-y-3">
                   <div className="flex items-center justify-between">
                     <span className="text-xs font-bold text-gray-800">اقلام سفارش ({faNum(itemRows.length)})</span>
@@ -577,23 +620,24 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
                       </div>
 
                       <div className="space-y-3">
-                        <div className="grid grid-cols-1 sm:grid-cols-2 gap-2.5">
+                        {/* ردیف ۱: متریال و برند */}
-                          <div className="flex flex-col gap-1">
+                        <div className="grid grid-cols-2 gap-2.5">
-                            <label className="text-[11px] font-semibold text-gray-600">متریال / دسته</label>
+                          <div className="flex flex-col gap-1 min-w-0">
+                            <label className="text-[11px] font-semibold text-gray-600 text-right">متریال</label>
                             <input
                               disabled={hasReceipts}
-                              className="h-9 w-full rounded-md border border-gray-200 bg-white px-2.5 text-xs text-gray-800 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-blue-500/30 disabled:cursor-not-allowed disabled:bg-gray-50 disabled:opacity-60"
+                              className="h-9 w-full rounded-md border border-gray-200 bg-white px-2.5 text-xs text-gray-800 text-right focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-blue-500/30 disabled:cursor-not-allowed disabled:bg-gray-50 disabled:opacity-60"
                               placeholder="نام متریال"
                               value={row.cat}
                               onChange={(e) => patchItem(row.key, { cat: e.target.value })}
                             />
                           </div>
 
-                          <div className="flex flex-col gap-1">
+                          <div className="flex flex-col gap-1 min-w-0">
-                            <label className="text-[11px] font-semibold text-gray-600">برند</label>
+                            <label className="text-[11px] font-semibold text-gray-600 text-right">برند</label>
                             <input
                               disabled={hasReceipts}
-                              className="h-9 w-full rounded-md border border-gray-200 bg-white px-2.5 text-xs text-gray-800 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-blue-500/30 disabled:cursor-not-allowed disabled:bg-gray-50 disabled:opacity-60"
+                              className="h-9 w-full rounded-md border border-gray-200 bg-white px-2.5 text-xs text-gray-800 text-right focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-blue-500/30 disabled:cursor-not-allowed disabled:bg-gray-50 disabled:opacity-60"
                               placeholder="برند"
                               value={row.brand}
                               onChange={(e) => patchItem(row.key, { brand: e.target.value })}
@@ -601,65 +645,75 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
                           </div>
                         </div>
 
-                        <div className="grid grid-cols-2 gap-2.5">
+                        {/* ردیف ۲: مشخصه فنی (تمام‌عرض با فضای کافی برای تگ‌ها) */}
-                          <div className="flex flex-col gap-1">
+                        <div className="flex flex-col gap-1 min-w-0">
-                            <label className="text-[11px] font-semibold text-gray-600">مشخصه</label>
+                          <label className="text-[11px] font-semibold text-gray-600 text-right">مشخصه فنی / ابعاد</label>
                           <MultiSelectCombobox
                             disabled={hasReceipts}
                             values={row.specs}
                             onChange={(specs) => patchItem(row.key, { specs })}
                             options={specOptions}
-                              placeholder="مشخصه"
+                            placeholder="انتخاب مشخصات..."
+                            className="min-w-0"
                           />
                         </div>
 
-                          <div className="flex flex-col gap-1">
+                        {/* بخش مقادیر و محاسبات مالی */}
-                            <label className="text-[11px] font-semibold text-gray-600">واحد</label>
+                        <div className="rounded-lg bg-gray-50/70 p-2.5 border border-gray-200 space-y-3">
-                            <input
+                          {/* ردیف ۳: تعداد + واحد سنجش */}
-                              disabled={hasReceipts}
+                          <div className="grid grid-cols-[100px_1fr] sm:grid-cols-[120px_1fr] gap-2.5">
-                              className="h-9 w-full rounded-md border border-gray-200 bg-white px-2.5 text-xs text-gray-800 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-blue-500/30 disabled:cursor-not-allowed disabled:bg-gray-50 disabled:opacity-60"
+                            <div className="flex flex-col gap-1 min-w-0">
-                              placeholder="واحد سنجش"
+                              <label className="text-[10.5px] font-semibold text-gray-600 text-right">تعداد</label>
-                              value={row.unit}
-                              onChange={(e) => patchItem(row.key, { unit: e.target.value })}
-                            />
-                          </div>
-                        </div>
-
-                        {/* جعبه ۳ عددی مقادیر */}
-                        <div className="grid grid-cols-3 gap-2 rounded-lg bg-gray-50 p-2.5 border border-gray-200">
-                          <div className="flex flex-col gap-1">
-                            <label className="text-[10.5px] font-semibold text-gray-600">تعداد</label>
                               <NumberInput
                                 disabled={hasReceipts}
                                 value={row.qty}
                                 onChange={(qty) => {
                                   patchItem(row.key, {
                                     qty,
-                                  total: qty != null && row.price != null ? Math.round(qty * row.price * 100) / 100 : row.total,
+                                    total: qty != null && row.price != null ? Math.round(qty * row.price) : row.total,
                                   });
                                 }}
-                              placeholder="تعداد"
+                                placeholder="مقدار"
+                                className="!text-right text-right"
                               />
                             </div>
 
-                          <div className="flex flex-col gap-1">
+                            <div className="flex flex-col gap-1 min-w-0">
-                            <label className="text-[10.5px] font-semibold text-gray-600">قیمت واحد</label>
+                              <label className="text-[10.5px] font-semibold text-gray-600 text-right">واحد سنجش</label>
+                              <input
+                                disabled={hasReceipts}
+                                className="h-9 w-full rounded-md border border-gray-200 bg-white px-2.5 text-xs text-gray-800 text-right focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-blue-500/30 disabled:cursor-not-allowed disabled:bg-gray-50 disabled:opacity-60"
+                                placeholder="واحد (شاخه، متر، کیلو...)"
+                                value={row.unit}
+                                onChange={(e) => patchItem(row.key, { unit: e.target.value })}
+                              />
+                            </div>
+                          </div>
+
+                          {/* ردیف ۴: قیمت هر واحد (تمام‌عرض با نمایش حروف) */}
+                          <div className="flex flex-col gap-1 min-w-0 border-t border-gray-200/80 pt-2.5">
+                            <label className="text-[10.5px] font-semibold text-gray-600 text-right">
+                              {row.unit ? `قیمت هر ${row.unit} (تومان)` : "قیمت هر واحد (تومان)"}
+                            </label>
                             <NumberInput
                               disabled={hasReceipts}
                               value={row.price}
                               onChange={(price) => {
                                 patchItem(row.key, {
                                   price,
-                                  total: row.qty != null && price != null ? Math.round(row.qty * price * 100) / 100 : row.total,
+                                  total: row.qty != null && price != null ? Math.round(row.qty * price) : row.total,
                                 });
                               }}
-                              placeholder="واحد"
+                              placeholder="قیمت هر واحد"
+                              showWords
                               maxDecimals={2}
+                              className="!text-right text-right"
                             />
                           </div>
 
-                          <div className="flex flex-col gap-1">
+                          {/* ردیف ۵: قیمت کل این قلم (تمام‌عرض با نمایش حروف) */}
-                            <label className="text-[10.5px] font-semibold text-gray-600">قیمت کل</label>
+                          <div className="flex flex-col gap-1 min-w-0 border-t border-gray-200/80 pt-2.5">
+                            <label className="text-[10.5px] font-semibold text-gray-600 text-right">قیمت کل این قلم (تومان)</label>
                             <NumberInput
                               disabled={hasReceipts}
                               value={row.total}
@@ -670,14 +724,15 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
                                     t != null && row.qty != null && row.qty > 0 ? Math.round((t / row.qty) * 100) / 100 : row.price,
                                 });
                               }}
-                              placeholder="جمع"
+                              placeholder="قیمت کل قلم"
+                              showWords
+                              className="!text-right text-right"
                             />
                           </div>
                         </div>
 
-                        {/* شرایط پرداخت برای این قلم */}
+                        {row.rejected && (
                           <div className="pt-2 border-t border-gray-100">
-                          {row.rejected ? (
                             <label className="inline-flex items-center gap-1.5 text-xs font-semibold text-blue-600 cursor-pointer">
                               <input
                                 type="checkbox"
@@ -687,46 +742,10 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
                               />
                               بازگرداندن این قلم به معامله
                             </label>
-                          ) : (
-                            <div className="flex flex-col gap-1.5">
-                              <span className="text-[10.5px] font-semibold text-gray-500">شرایط پرداخت مرتبط:</span>
-                              <div className="flex flex-wrap gap-1.5">
-                                {tsCards.map((card, cIdx) => {
-                                  const isSelected = row.tsDomIds.includes(card.domId || card.key);
-                                  return (
-                                    <label
-                                      key={card.key}
-                                      className={cn(
-                                        "inline-flex items-center gap-1 rounded-md border px-2 py-0.5 text-xs cursor-pointer select-none transition-colors",
-                                        isSelected
-                                          ? "border-blue-500 bg-blue-50 font-semibold text-blue-700"
-                                          : "border-gray-200 bg-white text-gray-600 hover:text-gray-900",
-                                        hasReceipts && "cursor-not-allowed opacity-60",
-                                      )}
-                                    >
-                                      <input
-                                        type="checkbox"
-                                        disabled={hasReceipts}
-                                        className="accent-blue-600 h-3.5 w-3.5 rounded"
-                                        checked={isSelected}
-                                        onChange={(e) => {
-                                          const next = new Set(row.tsDomIds);
-                                          const domId = card.domId || card.key;
-                                          if (e.target.checked) next.add(domId);
-                                          else next.delete(domId);
-                                          patchItem(row.key, { tsDomIds: [...next] });
-                                        }}
-                                      />
-                                      <span>{tsLabel(card, cIdx)}</span>
-                                    </label>
-                                  );
-                                })}
-                              </div>
                           </div>
                         )}
                       </div>
                     </div>
-                    </div>
                   ))}
 
                   {!hasReceipts && (
@@ -745,11 +764,16 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
               </div>
             )}
 
-            {/* تب ۲: شرایط پرداخت */}
+            {/* تب ۲: شرایط پرداخت با قالب TermsheetCard ویزارد */}
             {activeTab === "terms" && (
               <div className="space-y-3.5">
                 <div className="flex items-center justify-between">
+                  <div>
                     <div className="text-xs font-bold text-gray-800">گزینه‌های شرایط پرداخت</div>
+                    <div className="text-[11.5px] text-gray-500 mt-0.5">
+                      روش‌های پرداخت و اقلام تحت پوشش هر کدام را در کارت خودش مشخص کنید.
+                    </div>
+                  </div>
                   {!hasReceipts && (
                     <Button
                       type="button"
@@ -766,72 +790,18 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
 
                 <div className="flex flex-col gap-3">
                   {tsCards.map((card, idx) => (
-                    <div
+                    <TermsheetCard
                       key={card.key}
-                      className="rounded-xl border border-gray-200 bg-white p-3.5 sm:p-4 shadow-xs"
+                      index={idx + 1}
-                    >
+                      milestones={card.milestones}
-                      <div className="flex items-center justify-between border-b border-gray-100 pb-2 mb-2.5">
+                      onMilestonesChange={(ms) => updateTs(card.key, { milestones: ms })}
-                        <div className="flex items-center gap-1.5">
+                      items={itemOptions}
-                          <span className="flex h-5 w-5 items-center justify-center rounded-full bg-blue-50 text-[11px] font-bold text-blue-600">
+                      coveredIds={getCoveredIds(card)}
-                            {faNum(idx + 1)}
+                      onCoverageChange={(ids) => handleCoverageChange(card.key, ids)}
-                          </span>
+                      onRemove={() => removeTsCard(card.key)}
-                          <span className="text-xs font-bold text-gray-900">{tsLabel(card, idx)}</span>
-                          <span className="text-[11px] text-gray-500 font-medium">
-                            ({faNum(card.milestones.length)} مرحله)
-                          </span>
-                        </div>
-                        {!hasReceipts && tsCards.length > 1 && (
-                          <button
-                            type="button"
-                            className="inline-flex items-center gap-1 rounded-md px-2 py-0.5 text-xs text-red-600 hover:bg-red-50 transition-colors"
-                            title="حذف گزینه"
-                            onClick={() => removeTsCard(card.key)}
-                          >
-                            <Trash2 className="h-3.5 w-3.5" />
-                            <span className="text-[11px]">حذف</span>
-                          </button>
-                        )}
-                      </div>
-
-                      <div className="flex flex-col gap-2 mb-3">
-                        {card.milestones.map((ms, i) => (
-                          <MilestoneRow
-                            key={i}
-                            milestone={ms}
-                            disabled={hasReceipts}
-                            onChange={(nextMs) =>
-                              updateTs(card.key, {
-                                milestones: card.milestones.map((x, j) => (j === i ? nextMs : x)),
-                              })
-                            }
-                            onRemove={() =>
-                              updateTs(card.key, {
-                                milestones: card.milestones.filter((_, j) => j !== i),
-                              })
-                            }
                     />
                   ))}
                 </div>
-
-                      {!hasReceipts && (
-                        <Button
-                          type="button"
-                          variant="line"
-                          size="sm"
-                          className="w-full sm:w-auto text-xs text-gray-700"
-                          onClick={() =>
-                            updateTs(card.key, {
-                              milestones: [...card.milestones, { when_iso: null, amount: null }],
-                            })
-                          }
-                        >
-                          <Plus className="h-3.5 w-3.5 me-1" />
-                          افزودن مرحله پرداخت
-                        </Button>
-                      )}
-                    </div>
-                  ))}
-                </div>
               </div>
             )}
 
@@ -891,14 +861,15 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
                         toast.error(err instanceof Error ? err.message : "حذف فاکتور ناموفق بود"),
                       )
                     }
-                    urlOf={(a) => (a.id ? api.files.downloadUrl(q.id, "invoice", a.id) : null)}
+                    onDownload={(a) => api.files.download(q.id, "invoice", a.id!, a.name)}
+                    loadPreview={(a) => api.files.previewUrl(q.id, "invoice", a.id!)}
                   />
                 </div>
               </div>
             )}
           </div>
 
-          {/* فوتر سفید، محکم و چسبان */}
+          {/* فوتر */}
           <DialogFooter className="border-t border-gray-200 bg-white px-4 py-2.5 sm:px-6 sm:py-3 shrink-0 flex flex-row items-center justify-between gap-2">
             {q.status === "offered" ? (
               <Button
@@ -927,7 +898,7 @@ export function EditModal({ quoteId, onClose }: EditModalProps) {
         </DialogContent>
       </Dialog>
 
-      {/* مودال تایید حذف سفید */}
+      {/* مودال تایید حذف */}
       <Dialog open={showDeleteConfirm} onOpenChange={(open) => !deleting && setShowDeleteConfirm(open)}>
         <DialogContent className="z-[60] max-w-md p-4 sm:p-6 bg-white border border-gray-200 text-gray-900">
           <DialogHeader>

frontend/src/pages/Dashboard/FilterToolbar.tsx

@@ -3,7 +3,6 @@ import { SlidersHorizontal, X, ArrowUpDown, RotateCcw } from "lucide-react";
 import { Combobox } from "../../components/Combobox";
 
 export interface Filters {
-  category: string;
   supplier: string;
   status: string;
   search: string;
@@ -40,7 +39,6 @@ const STATUS_TO_KEY: Record<string, string> = {
 export interface FilterToolbarProps {
   filters: Filters;
   onChange: (f: Filters) => void;
-  categories: string[];
   suppliers: { id: string; name: string }[];
   sortDir: "desc" | "asc";
   onToggleSort: () => void;
@@ -49,7 +47,6 @@ export interface FilterToolbarProps {
 export function FilterToolbar({
   filters,
   onChange,
-  categories,
   suppliers,
   sortDir,
   onToggleSort,
@@ -58,10 +55,10 @@ export function FilterToolbar({
   const set = (patch: Partial<Filters>) => onChange({ ...filters, ...patch });
 
   // شمارش تعداد فیلترهای فعال به جز سرچ
-  const activeFilterCount = [filters.category, filters.supplier, filters.status].filter(Boolean).length;
+  const activeFilterCount = [filters.supplier, filters.status].filter(Boolean).length;
 
   const clearFilters = () => {
-    onChange({ ...filters, category: "", supplier: "", status: "" });
+    onChange({ ...filters, supplier: "", status: "" });
   };
 
   // تبدیل کلید انگلیسی به لیبل فارسی برای نمایش داخل کامبوباکس
@@ -153,18 +150,6 @@ export function FilterToolbar({
 
             {/* دراپ‌داون‌ها داخل کشو */}
             <div className="flex flex-col gap-3.5">
-              <div className="field">
-                <label className="mb-1 block text-xs font-semibold text-muted">دسته</label>
-                <Combobox
-                  value={filters.category}
-                  onChange={(it: { id: string; label: string }) => set({ category: it.label })}
-                  items={categories}
-                  allowAdd={false}
-                  placeholder="همه دسته‌ها"
-                  onInputChange={(v) => set({ category: v })}
-                />
-              </div>
-
               <div className="field">
                 <label className="mb-1 block text-xs font-semibold text-muted">تأمین‌کننده</label>
                 <Combobox
@@ -204,17 +189,6 @@ export function FilterToolbar({
 
       {/* ===== نمای دسکتاپ (md به بالا) ===== */}
       <div className="hidden md:flex flex-wrap items-end gap-3">
-        <div className="field min-w-[150px] flex-1">
-          <label>دسته</label>
-          <Combobox
-            value={filters.category}
-            onChange={(it: { id: string; label: string }) => set({ category: it.label })}
-            items={categories}
-            allowAdd={false}
-            placeholder="همه"
-            onInputChange={(v) => set({ category: v })}
-          />
-        </div>
         <div className="field min-w-[170px] flex-1">
           <label>تأمین‌کننده</label>
           <Combobox

frontend/src/pages/Dashboard/QuoteCard.tsx

@@ -3,7 +3,6 @@ import { AlarmClock, ChevronDown, Pencil, TriangleAlert, Building2, Package, Cre
 import type { Quote, Store } from "../../lib/types";
 import {
   isExpired,
-  itemsSummary,
   materialById,
   materialLabel,
   projectCell,
@@ -36,7 +35,6 @@ function InfoCell({ label, children, className }: { label: string; children: Rea
   );
 }
 
-// کارت پیشنهاد خرید — بهینه‌شده برای کاربری سرپا با موبایل
 export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit }: QuoteCardProps) {
   const sup = supplierById(store.suppliers, q.supplier_id);
   const expired = isExpired(q);
@@ -44,14 +42,16 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
   const pc = priceCell(total);
   const ts = termsheetSummary(store, q);
   const unitWarns = unitWarning(store, q);
-  const summary = itemsSummary(store, q);
 
   // ستون / دکمه پذیرش
   let acceptedCell: React.ReactNode;
   if (q.status === "offered") {
     acceptedCell = (
       <button
-        onClick={onAccept}
+        onClick={(e) => {
+          e.stopPropagation();
+          onAccept();
+        }}
         className="inline-flex h-7 items-center justify-center gap-1 rounded-md bg-emerald-600 px-2.5 text-xs font-bold text-white shadow-xs active:scale-95 transition-transform"
       >
         <Check className="h-3.5 w-3.5" />
@@ -136,39 +136,81 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
         expanded && "border-accent/60 ring-1 ring-accent/20",
       )}
     >
-      {/* سربرگ کارت */}
+      {/* سربرگ کارت — با کلیک روی فضای خالی اکسپند می‌شود */}
-      <div className="flex items-center gap-2.5 border-b border-line bg-bg/40 px-3 py-2 sm:gap-3 sm:px-4 sm:py-2.5">
+      <div
+        onClick={onToggleExpand}
+        className="flex cursor-pointer items-center gap-2.5 border-b border-line bg-bg/40 px-3 py-2 sm:gap-3 sm:px-4 sm:py-2.5 select-none"
+      >
         <span className="flex h-8 w-8 shrink-0 items-center justify-center rounded-lg bg-accent-bg text-xs font-bold text-accent-dark sm:h-9 sm:w-9 sm:text-sm">
           {sup.name.slice(0, 1)}
         </span>
+
         <div className="min-w-0 flex-1">
+          {/* خط ۱: فقط خود اسم تأمین‌کننده لینک است */}
+          <div className="flex items-center">
             <Link
               to={`/suppliers/${q.supplier_id}`}
-            className="block truncate text-xs font-bold text-ink no-underline hover:text-accent sm:text-[13.5px]"
+              onClick={(e) => e.stopPropagation()}
+              className="inline-block max-w-full truncate text-xs font-bold text-ink no-underline hover:text-accent hover:underline sm:text-[13.5px]"
             >
               {sup.name}
             </Link>
-          {sup.location && <div className="truncate text-[10px] text-muted sm:text-[11px]">{sup.location}</div>}
           </div>
-        <div className="ms-auto flex shrink-0 items-center gap-1 sm:gap-1.5">
+
+          {/* خط ۲: موقعیت مکانی و برچسب هشدار فاکتور رسمی */}
+          <div className="mt-0.5 flex min-w-0 items-center gap-1.5">
+            {sup.location && (
+              <span className="truncate text-[10px] text-muted sm:text-[11px]">
+                {sup.location}
+              </span>
+            )}
+
+            {q.is_official && (
+              <span
+                className="inline-flex shrink-0 items-center gap-1 rounded bg-rose-500/10 px-1.5 py-0.5 text-[9.5px] font-bold text-rose-600 dark:text-rose-400 border border-rose-500/25 select-none"
+                title="فاکتور رسمی (مشمول ارزش افزوده و مالیات)"
+              >
+                <TriangleAlert className="h-2.5 w-2.5 shrink-0 stroke-[2.2] text-rose-500 dark:text-rose-400" />
+                <span>فاکتور رسمی</span>
+              </span>
+            )}
+          </div>
+        </div>
+
+        <div className="ms-auto flex shrink-0 items-center gap-1.5">
           {fulfillmentBadge ?? (
             <Badge variant={q.status as "offered" | "accepted" | "arrived"} className="text-[10px] sm:text-xs">
               {STATUS_LABEL[q.status]}
             </Badge>
           )}
+
+          {/* دکمه ویرایش */}
           <button
-            className="chip h-7 px-2 sm:h-auto sm:px-2.5"
+            type="button"
-            onClick={onEdit}
+            className="inline-flex h-7 items-center justify-center gap-1 rounded-md border border-line bg-panel px-2 text-xs font-medium text-ink hover:bg-slate-50 dark:hover:bg-zinc-800 transition-colors sm:h-8 sm:px-2.5"
+            onClick={(e) => {
+              e.stopPropagation();
+              onEdit();
+            }}
             title="ویرایش پیشنهاد"
             aria-label="ویرایش"
           >
-            <Pencil className="h-3 w-3" />
+            <Pencil className="h-3 w-3 text-muted" />
             <span className="hidden sm:inline">ویرایش</span>
           </button>
+
+          {/* دکمه فلش اکسپند در هدر */}
           <button
-            className="chip chip-expand h-7 w-7 p-0 sm:h-auto sm:w-auto sm:p-1.5"
+            type="button"
-            onClick={onToggleExpand}
+            className={cn(
-            title={expanded ? "جمع کردن" : "نمایش جزئیات"}
+              "inline-flex h-7 w-7 items-center justify-center rounded-md border border-line bg-panel text-ink transition-colors hover:bg-slate-50 dark:hover:bg-zinc-800 sm:h-8 sm:w-8",
+              expanded && "bg-accent-bg text-accent-dark border-accent/40",
+            )}
+            onClick={(e) => {
+              e.stopPropagation();
+              onToggleExpand();
+            }}
+            title={expanded ? "جمع کردن توضیحات" : "نمایش توضیحات و جزئیات"}
             aria-expanded={expanded}
           >
             <ChevronDown className={cn("h-4 w-4 transition-transform duration-200", expanded && "rotate-180")} />
@@ -176,9 +218,12 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
         </div>
       </div>
 
-      {/* اطلاعات کلیدی — چیدمان بهینه‌شده موبایل */}
+      {/* اطلاعات کلیدی — لمس این بخش هم کارت را اکسپند می‌کند */}
-      <div className="grid grid-cols-2 gap-x-3 gap-y-3 p-3 sm:gap-x-5 sm:gap-y-3.5 sm:p-4 md:grid-cols-4">
+      <div
-        {/* ۱. پروژه — تمام‌عرض در موبایل */}
+        onClick={onToggleExpand}
+        className="cursor-pointer grid grid-cols-2 gap-x-3 gap-y-3 p-3 select-none sm:gap-x-5 sm:gap-y-3.5 sm:p-4 md:grid-cols-4"
+      >
+        {/* ۱. پروژه */}
         <InfoCell label="پروژه" className="col-span-2 md:col-span-1">
           <div className="flex items-center gap-1.5 text-xs font-semibold text-ink sm:text-[13px]">
             <Building2 className="h-3.5 w-3.5 shrink-0 text-muted" />
@@ -188,52 +233,28 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
           </div>
         </InfoCell>
 
-        {/* ۲. اقلام — تمام‌عرض زیر پروژه با شکستن متن بدون سه‌نقطه */}
+        {/* ۲. اقلام */}
         <InfoCell label="اقلام" className="col-span-2 md:col-span-1">
-          {summary.count > 1 ? (
+          <div className="flex flex-col gap-1 text-xs font-medium leading-5 text-ink sm:text-[13px]">
-            <div className="flex flex-col gap-1.5">
+            {activeItems.length > 0 ? (
-              <span className="font-bold text-xs text-ink sm:text-sm">
+              activeItems.map((li) => {
-                {fmtNum(summary.count)} قلم کالا
-              </span>
-              <div className="flex flex-col gap-1.5 rounded-lg border border-line/60 bg-bg/50 p-2.5 text-[11px] leading-5 text-muted sm:text-[11.5px]">
-                {store.quotes
-                  .find((x) => x.id === q.id)
-                  ?.line_items?.filter((li) => !li.rejected)
-                  .slice(0, 3)
-                  .map((li) => {
                 const m = materialById(store.materials, li.material_id);
                 return (
-                      <div
+                  <span key={li.id} className="break-words">
-                        key={li.id}
+                    {materialLabel(m)}
-                        className="flex items-start justify-between gap-2 border-b border-line/30 pb-1.5 last:border-0 last:pb-0"
-                      >
-                        <span className="min-w-0 flex-1 font-medium text-ink leading-snug break-words">
-                          • {materialLabel(m)}
                   </span>
-                        <span className="shrink-0 font-semibold tabular-nums text-ink text-[10.5px] pt-0.5">
-                          {fmtNum(li.quantity)}{" "}
-                          <span className="font-normal text-muted text-[9.5px]">{li.unit}</span>
-                        </span>
-                      </div>
                 );
-                  })}
+              })
-                {(q.line_items?.length || 0) > 3 && (
-                  <span className="pt-0.5 text-[10px] text-muted">
-                    و {(q.line_items?.length || 0) - 3} قلم دیگر...
-                  </span>
-                )}
-              </div>
-            </div>
             ) : (
-            <div className="flex items-start gap-1.5 text-xs font-medium leading-5 text-ink sm:text-[13px]">
+              <span>—</span>
-              <span className="break-words">{summary.text}</span>
-            </div>
             )}
+          </div>
 
           {unitWarns.map((w) => (
             <Link
               key={w.unit}
               to={`/units?cat=${encodeURIComponent(w.cat)}&unit=${encodeURIComponent(w.unit)}`}
+              onClick={(e) => e.stopPropagation()}
               className="unit-warn mt-1 inline-flex items-center gap-1 text-[10px]"
               title={`ضریب تبدیل «${esc(w.unit)}» را در داشبورد واحدها ثبت کنید`}
             >
@@ -300,8 +321,22 @@ export function QuoteCard({ store, q, expanded, onToggleExpand, onAccept, onEdit
         </span>
       </div>
 
-      {/* جزئیات تکمیلی بازشونده */}
+      {/* دکمه تمام‌عرض توضیحات بیشتر */}
-      {expanded && <QuoteDetail store={store} q={q} />}
+      <button
+        type="button"
+        onClick={onToggleExpand}
+        className="flex w-full items-center justify-center gap-1.5 border-t border-line bg-bg/20 py-2 text-xs font-semibold text-muted hover:text-accent hover:bg-bg/50 transition-colors select-none"
+      >
+        <span>{expanded ? "بستن توضیحات و جزئیات" : "توضیحات بیشتر و جزئیات پیشنهاد"}</span>
+        <ChevronDown className={cn("h-3.5 w-3.5 transition-transform duration-200", expanded && "rotate-180 text-accent")} />
+      </button>
+
+      {/* جزئیات تکمیلی بازشونده — کلیک داخل آن مانع بسته شدن ناخواسته می‌شود */}
+      {expanded && (
+        <div onClick={(e) => e.stopPropagation()}>
+          <QuoteDetail store={store} q={q} />
+        </div>
+      )}
     </div>
   );
 }

frontend/src/pages/Dashboard/QuoteDetail.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState } from "react";
-import { Package, Scale, CreditCard, CalendarDays, Paperclip, Building2, Ban } from "lucide-react";
+import { Package, CreditCard, CalendarDays, Paperclip, Building2, Ban } from "lucide-react";
 import type { Attachment, Quote, Store } from "../../lib/types";
 import { api } from "../../lib/api";
 import {
@@ -7,12 +7,12 @@ import {
   itemTermsheetIds,
   lineItemTotal,
   materialById,
-  refConverted,
 } from "../../lib/quoteUtils";
 import { fmtDate, fmtDateTime, fmtNum } from "../../lib/formatters";
 import { groupCommas } from "../../lib/numutil";
 import { FlowDiagram, type FlowRefs } from "./FlowDiagram";
 import { itemProjects } from "../../lib/quoteUtils";
+import { FilePreviewModal, useFilePreview } from "../../components/FilePreviewModal";
 
 export interface QuoteDetailProps {
   store: Store;
@@ -25,6 +25,15 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
   const [flowRefs] = useState<FlowRefs>(() => ({ items: new Map(), termsheets: new Map() }));
   const [bump, setBump] = useState(0);
 
+  // پیش‌نمایش پیوست‌ها: کلیک روی نام فایل، فایل را نشان می‌دهد (نه دانلود).
+  // بایت‌ها با توکن گرفته می‌شوند چون <img>/<iframe> نمی‌توانند هدر بفرستند.
+  // کلید با پیشوند نوع پیوست ساخته می‌شود تا نوعش گم نشود.
+  const preview = useFilePreview((key, name) => {
+    const [kind, id] = key.split(":") as ["invoice" | "proforma", string];
+    void name;
+    return api.files.previewUrl(q.id, kind, id);
+  });
+
   useEffect(() => {
     // بعد از نشستن layout (فونت/تصویر) خطوط دوباره رسم شوند
     const t = setTimeout(() => setBump((b) => b + 1), 350);
@@ -66,7 +75,6 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
     const tsIds = itemTermsheetIds(li).filter((tid) => tsList.some((t) => t.id === tid));
     const total = lineItemTotal(li);
     const projs = itemProjects(q, li);
-    const conv = isRejected ? null : refConverted(store, li);
 
     // رسید جزیی → قلم به دو بخش «رسید شده» و «در راه» شکسته می‌شود (نمایشی):
     // مجموع دو بخش همیشه با تعداد/مبلغ اصلی برابر است (عدم تغییر جمع کل پیشنهاد).
@@ -130,12 +138,6 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
             {whNames.length > 0 && <span>به انبار: {whNames.join("، ")}</span>}
           </div>
         )}
-        {conv && (
-          <div className="fb-conv">
-            <Scale className="me-1 inline h-3 w-3" /> ≈ {groupCommas(conv.qty, true)} {conv.unit}
-            {conv.perRef != null ? ` · ${groupCommas(conv.perRef, true)} تومان/${conv.unit}` : ""}
-          </div>
-        )}
       </div>
     );
   };
@@ -144,19 +146,35 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
   attachments.proformas.forEach((pf, i) => {
     if (!pf.id) return;
     attachParts.push(
-      <a key={"pf" + i} className="detail-link" href={api.files.downloadUrl(q.id, "proforma", pf.id)} download={pf.name}>
+      <span key={"pf" + i} className="inline-flex items-center">
+        <button
+          type="button"
+          className="detail-link"
+          title="مشاهده پیش‌فاکتور"
+          disabled={preview.loadingId === `proforma:${pf.id}`}
+          onClick={() => void preview.open(`proforma:${pf.id}`, pf.name)}
+        >
           <Paperclip className="me-1 inline h-3 w-3" />
           پیش‌فاکتور: {pf.name}
-      </a>,
+        </button>
+      </span>,
     );
   });
   attachments.invoices.forEach((inv, i) => {
     if (!inv.id) return;
     attachParts.push(
-      <a key={"inv" + i} className="detail-link" href={api.files.downloadUrl(q.id, "invoice", inv.id)} download={inv.name}>
+      <span key={"inv" + i} className="inline-flex items-center">
+        <button
+          type="button"
+          className="detail-link"
+          title="مشاهده فاکتور"
+          disabled={preview.loadingId === `invoice:${inv.id}`}
+          onClick={() => void preview.open(`invoice:${inv.id}`, inv.name)}
+        >
           <Paperclip className="me-1 inline h-3 w-3" />
           فاکتور اصلی: {inv.name}
-      </a>,
+        </button>
+      </span>,
     );
   });
 
@@ -239,6 +257,9 @@ export function QuoteDetail({ store, q }: QuoteDetailProps) {
           ))}
         </div>
       )}
+      {preview.item && (
+        <FilePreviewModal url={preview.item.url} name={preview.item.name} onClose={preview.close} />
+      )}
     </div>
   );
 }

frontend/src/pages/Inventory/ChangeInventoryPage.tsx

@@ -220,7 +220,7 @@ export function ChangeInventoryPage() {
       let m = matByName(matName);
       if (!m) {
         const created = await apiV26.catalog.createMaterial({ name: matName, canonical_unit_id: uid, brand_ids: bid ? [bid] : [] });
-        m = { id: created.id, name: created.name, category: null, canonical_unit: null };
+        m = { id: created.id, name: created.name, canonical_unit: null };
       }
       const op: Record<string, unknown> = {
         transaction_type: "PURCHASE", warehouse_id: whId, material_id: m.id, brand_id: bid,

frontend/src/pages/Inventory/InventoryPage.tsx

@@ -7,7 +7,7 @@ import { useAuthStore } from "../../store/auth";
 import { AppSwitcherMenu } from "../../components/AppSwitcherMenu";
 import { inventorySubheader } from "./panelMenu";
 import { InventoryTopNav } from "./InventoryTopNav";
-import { useInventoryData, brandName, catName, materialName, unitName, whName } from "./useInventoryData";
+import { useInventoryData, brandName, materialName, unitName, whName } from "./useInventoryData";
 import type { InventoryRow, InventoryTransaction, TransactionType } from "../../lib/types";
 import { faNum } from "../../lib/formatters";
 import { isoToJalaliStr } from "../../lib/jalali";
@@ -55,8 +55,7 @@ export function InventoryPage() {
   const isPM = user?.role === "pm";
   const [params] = useSearchParams();
 
-  const [filters, setFilters] = useState<{ category: string; warehouse: string; material: string; project: string }>({
+  const [filters, setFilters] = useState<{ warehouse: string; material: string; project: string }>({
-    category: "",
     warehouse: params.get("warehouse") || "",
     material: "",
     project: "",
@@ -81,7 +80,6 @@ export function InventoryPage() {
     inventory.forEach((r) => {
       const whId = r.warehouse?.id;
       if (!whId || !visibleIds.has(whId)) return;
-      if (filters.category && r.material.category?.id !== filters.category) return;
       if (filters.warehouse && whId !== filters.warehouse) return;
       if (filters.material && !r.material.name.includes(filters.material.trim())) return;
       const gk = `${whId}|${r.material.id}|${specsHash(r.specs)}`;
@@ -132,7 +130,7 @@ export function InventoryPage() {
       .slice()
       .sort((a, b) => new Date(a.transaction_date).getTime() - new Date(b.transaction_date).getTime());
 
-  const hasFilter = !!(filters.category || filters.warehouse || (isAdmin && filters.project));
+  const hasFilter = !!(filters.warehouse || (isAdmin && filters.project));
 
   if (loading) return <div className="min-h-screen" />;
   if (!user || (!isAdmin && !isPM)) {
@@ -248,40 +246,6 @@ export function InventoryPage() {
           {/* فیلترهای پیشرفته — برچسب‌های لمسی بدون سلکت و بدون بیرون‌زدگی */}
           {showMobileFilters && (
             <div className="mt-2.5 border-t border-line/60 pt-2.5 flex flex-col gap-2.5">
-              {/* دسته‌بندی‌ها */}
-              <div>
-                <div className="mb-1.5 text-[11px] font-bold text-muted">دسته‌بندی متریال:</div>
-                <div className="flex flex-wrap gap-1.5">
-                  <button
-                    type="button"
-                    onClick={() => setFilters((f) => ({ ...f, category: "" }))}
-                    className={cn(
-                      "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
-                      !filters.category
-                        ? "bg-accent text-white font-bold"
-                        : "border border-line bg-bg/40 text-ink hover:bg-panel"
-                    )}
-                  >
-                    همه دسته‌بندی‌ها
-                  </button>
-                  {lookup.categories.map((c) => (
-                    <button
-                      key={c.id}
-                      type="button"
-                      onClick={() => setFilters((f) => ({ ...f, category: f.category === c.id ? "" : c.id }))}
-                      className={cn(
-                        "rounded-lg px-2.5 py-1 text-[11.5px] transition-colors",
-                        filters.category === c.id
-                          ? "bg-accent text-white font-bold"
-                          : "border border-line bg-bg/40 text-ink hover:bg-panel"
-                      )}
-                    >
-                      {c.name}
-                    </button>
-                  ))}
-                </div>
-              </div>
-
               {/* پروژه‌ها (مخصوص ادمین) */}
               {isAdmin && lookup.projects.length > 0 && (
                 <div>
@@ -324,7 +288,7 @@ export function InventoryPage() {
                   <button
                     type="button"
                     className="text-xs text-red font-medium hover:underline inline-flex items-center gap-1"
-                    onClick={() => setFilters({ category: "", warehouse: "", material: "", project: "" })}
+                    onClick={() => setFilters({ warehouse: "", material: "", project: "" })}
                   >
                     <X className="h-3 w-3" />
                     پاک کردن فیلترها
@@ -347,7 +311,6 @@ export function InventoryPage() {
           ) : (
             groups.map((g) => {
               const isExp = expandedKey === g.key;
-              const matCat = lookup.materials.find((m) => m.id === g.matId)?.category;
               return (
                 <InventoryMobileCard
                   key={g.key}
@@ -355,7 +318,6 @@ export function InventoryPage() {
                   isExp={isExp}
                   isAdmin={isAdmin}
                   matName={materialName(lookup.materials, g.matId)}
-                  matCatName={matCat ? catName(lookup.categories, matCat.id) : "—"}
                   wh={whName(warehouses, g.whId)}
                   projName={lookup.projects.find((p) => p.id === warehouses.find((w) => w.id === g.whId)?.project_id)?.name || ""}
                   unit={unitName(lookup.units, g.unitId)}
@@ -410,7 +372,6 @@ export function InventoryPage() {
               <tbody>
                 {groups.map((g) => {
                   const isExp = expandedKey === g.key;
-                  const matCat = lookup.materials.find((m) => m.id === g.matId)?.category;
                   return (
                     <GroupRow
                       key={g.key}
@@ -418,7 +379,6 @@ export function InventoryPage() {
                       isExp={isExp}
                       isAdmin={isAdmin}
                       matName={materialName(lookup.materials, g.matId)}
-                      matCatName={matCat ? catName(lookup.categories, matCat.id) : "—"}
                       wh={whName(warehouses, g.whId)}
                       projName={lookup.projects.find((p) => p.id === warehouses.find((w) => w.id === g.whId)?.project_id)?.name || ""}
                       unit={unitName(lookup.units, g.unitId)}
@@ -475,7 +435,6 @@ function InventoryMobileCard({
   isExp,
   isAdmin,
   matName,
-  matCatName,
   wh,
   projName,
   unit,
@@ -486,7 +445,6 @@ function InventoryMobileCard({
   isExp: boolean;
   isAdmin: boolean;
   matName: string;
-  matCatName: string;
   wh: string;
   projName: string;
   unit: string;
@@ -508,11 +466,6 @@ function InventoryMobileCard({
             <h3 className="text-[13.5px] font-bold leading-snug text-ink break-words">
               {matName}
             </h3>
-            {matCatName !== "—" && (
-              <span className="mt-0.5 inline-block text-[11px] text-muted">
-                {matCatName}
-              </span>
-            )}
           </div>
           <div
             className={cn(
@@ -574,12 +527,11 @@ function InventoryMobileCard({
   );
 }
 
-function GroupRow({ g, isExp, isAdmin, matName, matCatName, wh, projName, unit, onToggle, timeline }: {
+function GroupRow({ g, isExp, isAdmin, matName, wh, projName, unit, onToggle, timeline }: {
   g: Group;
   isExp: boolean;
   isAdmin: boolean;
   matName: string;
-  matCatName: string;
   wh: string;
   projName: string;
   unit: string;
@@ -591,7 +543,6 @@ function GroupRow({ g, isExp, isAdmin, matName, matCatName, wh, projName, unit,
       <tr className={`border-b border-line/60 cursor-pointer transition-colors ${isExp ? "bg-accent/5" : "hover:bg-accent/5"}`} onClick={onToggle}>
         <td className="py-2.5 text-center text-muted">{isExp ? "▾" : "▸"}</td>
         <td className="py-2.5 pe-3 font-bold text-ink">{matName}</td>
-        <td className="py-2.5 pe-3 text-muted">{matCatName}</td>
         <td className="py-2.5 pe-3">
           <div>{wh}</div>
           {isAdmin && <span className="block text-[10.5px] text-muted">{projName}</span>}

frontend/src/pages/Inventory/OrganizationPage.tsx

@@ -148,16 +148,8 @@ export function OrganizationPage() {
     }
   };
 
-  const moveWarehouse = async (id: string, projectId: string) => {
+  // انبار برای همیشه به پروژه‌ی والدش تعلق دارد — انتقال به پروژه‌ی دیگر وجود ندارد؛
-    try {
+  // انبار فقط با حذف و ساخت دوباره زیر پروژه‌ی موردنظر جابه‌جا می‌شود.
-      await apiV26.warehouses.update(id, { project_id: projectId });
-      toast.success("انبار منتقل شد ✓");
-      await data.refresh();
-    } catch (err) {
-      toast.error(err instanceof Error ? err.message : "خطا در انتقال انبار");
-    }
-  };
-
   const removeWarehouse = async (id: string) => {
     if (!confirm("انبار حذف شود؟ (انبارهای دارای سابقه تراکنش قابل حذف نیستند)")) return;
     try {
@@ -329,16 +321,6 @@ export function OrganizationPage() {
                           >
                             📊 داشبورد
                           </button>
-                          <select
-                            className="h-7 rounded-lg border border-line bg-panel px-2 text-[11px]"
-                            value={w.project_id}
-                            onChange={(e) => void moveWarehouse(w.id, e.target.value)}
-                            title="انتقال به پروژه دیگر"
-                          >
-                            {data.lookup.projects.map((p2) => (
-                              <option key={p2.id} value={p2.id}>{p2.name}</option>
-                            ))}
-                          </select>
                           <button className="text-muted hover:text-red" onClick={() => void removeWarehouse(w.id)} title="حذف انبار">✕</button>
                         </div>
                       </div>

frontend/src/pages/Inventory/useInventoryData.ts

@@ -9,10 +9,9 @@ import { useDataChanged } from "../../lib/crossTab";
 import type { InventoryRow, InventoryTransaction, Warehouse } from "../../lib/types";
 
 export interface LookupData {
-  categories: { id: string; slug: string; name: string }[];
   units: { id: number; code: string; name_fa: string | null }[];
   brands: { id: string; name: string }[];
-  materials: { id: string; name: string; category: { id: string; name: string } | null; canonical_unit: { id: number; code: string; name_fa: string | null } | null }[];
+  materials: { id: string; name: string; canonical_unit: { id: number; code: string; name_fa: string | null } | null }[];
   projects: { id: string; name: string; pm_user_id: string | null; pm_name?: string | null }[];
 }
 
@@ -34,14 +33,13 @@ export function useInventoryData(): InventoryData {
   const [inventory, setInventory] = useState<InventoryRow[]>([]);
   const [transactions, setTransactions] = useState<InventoryTransaction[]>([]);
   const [lookup, setLookup] = useState<LookupData>({
-    categories: [], units: [], brands: [], materials: [], projects: [],
+    units: [], brands: [], materials: [], projects: [],
   });
   const [loading, setLoading] = useState(true);
 
   const load = useCallback(async () => {
     try {
-      const [cats, units, brands, mats, projs, whs, inv, txs] = await Promise.all([
+      const [units, brands, mats, projs, whs, inv, txs] = await Promise.all([
-        apiV26.lookup.categories(),
         apiV26.lookup.units(),
         apiV26.lookup.brands(),
         apiV26.lookup.materials(),
@@ -50,7 +48,7 @@ export function useInventoryData(): InventoryData {
         apiV26.inventory.list({ project_id: projectId }),
         apiV26.inventory.transactions({ project_id: projectId }),
       ]);
-      setLookup({ categories: cats, units, brands, materials: mats, projects: projs });
+      setLookup({ units, brands, materials: mats, projects: projs });
       setWarehouses(whs);
       setInventory(inv);
       setTransactions(txs);
@@ -108,11 +106,6 @@ export function materialName(materials: LookupData["materials"], id: string): st
   return m ? m.name : "—";
 }
 
-export function catName(categories: LookupData["categories"], id: string | null | undefined): string {
-  const c = categories.find((x) => x.id === id);
-  return c ? c.name : "—";
-}
-
 export function projName(projects: LookupData["projects"], id: string | null | undefined): string {
   const p = projects.find((x) => x.id === id);
   return p ? p.name : "—";

frontend/src/pages/Projects/ProjectsPage.tsx

@@ -16,11 +16,9 @@ import {
 import { normalize } from "../../lib/normalize";
 import { useAppStore } from "../../store";
 import {
-  activeItems,
   lineItemTotal,
   materialById,
   materialLabel,
-  refConverted,
   supplierById,
 } from "../../lib/quoteUtils";
 import { faNum, fmtDate } from "../../lib/formatters";
@@ -29,25 +27,45 @@ import { EmptyState } from "../../components/EmptyState";
 import { Button } from "../../components/ui/button";
 
 function projectQuotes(quotes: Quote[], name: string): Quote[] {
-  return quotes.filter((q) => (q.projects || []).includes(name) || q.project === name);
+  return quotes.filter(
+    (q) =>
+      (q.projects || []).includes(name) ||
+      q.project === name ||
+      (q.line_items || []).some(
+        (li) =>
+          li.target_project?.name === name ||
+          (li.projects || []).some((p) => (typeof p === "string" ? p : p.name) === name),
+      ),
+  );
 }
 
-// اقلام مربوط به این پروژه در یک quote
+// آیا این پیشنهاد برای «این» پروژه پذیرفته شده است؟
+// ملاک، پروژه‌ی هدفِ تصمیم خریدِ اقلام است (item_decisions.project_id) — نه
+// وضعیت سراسری پیشنهاد؛ پیشنهادی که فقط برای پروژه‌ی دیگری پذیرفته شده،
+// برای این پروژه همچنان «پیشنهاد شده» است.
+function acceptedForProject(q: Quote, name: string): boolean {
+  return (q.line_items || []).some((li) => !li.rejected && li.target_project?.name === name);
+}
+
+// آیا اصلاً برای این پیشنهاد پروژه‌ی هدفی ثبت شده؟ (پیشنهادهای قدیمیِ
+// پیش از era تصمیم‌پروژه، طبق وضعیت سراسری دسته‌بندی می‌شوند)
+function hasTargets(q: Quote): boolean {
+  return (q.line_items || []).some((li) => !!li.target_project);
+}
+
+// اقلام مربوط به این پروژه در یک quote:
+// اولویت با اقلامِ پذیرفته‌شده برای همین پروژه (تصمیم خرید)؛ سپس کاندیداهای
+// همین پروژه؛ و اگر هیچ اتصال قلم‌به‌قلمی نبود، همه‌ی اقلام فعال.
 function itemsForProject(q: Quote, name: string): Quote["line_items"] {
   const items = (q.line_items || []).filter((li) => !li.rejected);
+  const targeted = items.filter((li) => li.target_project?.name === name);
+  if (targeted.length) return targeted;
   if (items.some((li) => li.projects && li.projects.length)) {
     return items.filter((li) => (li.projects || []).some((p) => p.name === name));
   }
   return items;
 }
 
-function qTotal(q: Quote): number {
-  return activeItems(q).reduce((sum, li) => {
-    const t = lineItemTotal(li);
-    return sum + (t || 0);
-  }, 0);
-}
-
 function daysSince(iso: string | null): number | null {
   if (!iso) return null;
   const d = new Date(iso);
@@ -62,11 +80,11 @@ export function ProjectsPage() {
   const quotes = useQuotes();
   const suppliers = useSuppliers();
   const materials = useMaterials();
-  const { categoryUnits, unitConversions, standardConversions } = useUnits();
+  const { standardConversions } = useUnits();
   const addProject = useAddProject();
   const topics = useAppStore((s) => s.topics);
 
-  const store: Store = { quotes, suppliers, materials, projects, categoryUnits, unitConversions, standardConversions, topics };
+  const store: Store = { quotes, suppliers, materials, projects, standardConversions, topics };
 
   const [openProject, setOpenProject] = useState<string | null>(null);
   const [newName, setNewName] = useState("");
@@ -147,10 +165,11 @@ export function ProjectsPage() {
 // ---------- پنل جزئیات یک پروژه ----------
 function renderProjectDetail(store: Store, name: string): React.ReactElement {
   const quotes = projectQuotes(store.quotes, name);
-  const sumBy = (st: Quote["status"]) =>
+
-    quotes
+  // جمع مبلغ هر ستون فقط روی اقلامِ همین پروژه
-      .filter((q) => q.status === st)
+  const itemsTotal = (q: Quote) =>
-      .reduce((s, q) => s + qTotal(q), 0);
+    itemsForProject(q, name).reduce((s, li) => s + (lineItemTotal(li) || 0), 0);
+  const sumBy = (list: Quote[]) => list.reduce((s, q) => s + itemsTotal(q), 0);
 
   const matName = (mid: string) => {
     const m = materialById(store.materials, mid);
@@ -169,26 +188,27 @@ function renderProjectDetail(store: Store, name: string): React.ReactElement {
 
   const itemLine = (li: Quote["line_items"][number]) => {
     const total = lineItemTotal(li);
-    const conv = refConverted(store, li);
     return (
       <div key={li.id}>
         {matName(li.material_id)} — {faNum(li.quantity)} {li.unit} × {faNum(li.unit_price || 0)} ={" "}
         <b>{faNum(total || 0)} تومان</b>
-        {conv && (
-          <span className="pj-conv">
-            {" "}
-            — <span className="pj-conv">≈ {faNum(conv.qty)} {conv.unit}({faNum(conv.perRef ?? 0)} تومان/{conv.unit})</span>
-          </span>
-        )}
       </div>
     );
   };
 
+  // دسته‌بندی ایزوله per-project:
+  // - پذیرفته/رسیده فقط وقتی حداقل یک قلمِ غیرردشده برای «این» پروژه پذیرفته شده باشد؛
+  // - پیشنهادی که صرفاً کاندیداست (یا فقط برای پروژه‌ی دیگری پذیرفته شده) → پیشنهاد شده.
+  // - پیشنهادهای قدیمیِ بدون پروژه‌ی هدف، طبق وضعیت سراسری می‌مانند.
   const offered = quotes
-    .filter((q) => q.status === "offered")
+    .filter(
+      (q) =>
+        q.status === "offered" ||
+        ((q.status === "accepted" || q.status === "arrived") && hasTargets(q) && !acceptedForProject(q, name)),
+    )
     .sort((a, b) => new Date(a.expiry_date || 0).getTime() - new Date(b.expiry_date || 0).getTime());
-  const accepted = quotes.filter((q) => q.status === "accepted");
+  const accepted = quotes.filter((q) => q.status === "accepted" && acceptedForProject(q, name));
-  const arrived = quotes.filter((q) => q.status === "arrived");
+  const arrived = quotes.filter((q) => q.status === "arrived" && acceptedForProject(q, name));
 
   const offeredRow = (q: Quote) => {
     const days = q.expiry_date ? Math.ceil((new Date(q.expiry_date).getTime() - Date.now()) / 86400000) : null;
@@ -199,7 +219,7 @@ function renderProjectDetail(store: Store, name: string): React.ReactElement {
         </div>
         <div className="pj-meta">{itemsForProject(q, name).map(itemLine)}</div>
         <div className="pj-side">
-          جمع: <b>{faNum(qTotal(q))} تومان</b>
+          جمع: <b>{faNum(itemsTotal(q))} تومان</b>
         </div>
         <div className="pj-side">
           اعتبار تا {fmtDate(q.expiry_date)}<br />
@@ -240,7 +260,7 @@ function renderProjectDetail(store: Store, name: string): React.ReactElement {
       </div>
       <div className="pj-meta">{itemsForProject(q, name).map(itemLine)}</div>
       <div className="pj-side">
-        هزینه: <b>{faNum(qTotal(q))} تومان</b>
+        هزینه: <b>{faNum(itemsTotal(q))} تومان</b>
       </div>
       <div className="pj-side">رسید: {fmtDate(q.arrived_date)}</div>
     </div>
@@ -255,13 +275,13 @@ function renderProjectDetail(store: Store, name: string): React.ReactElement {
       <div className="mb-3 flex flex-wrap gap-1.5">
         <span className="pj-chip">کل پیشنهادها: {faNum(quotes.length)}</span>
         <span className="pj-chip" style={{ background: "#dbeafe", color: "#1d4ed8" }}>
-          ارزش باز: {faNum(sumBy("offered"))} تومان
+          ارزش باز: {faNum(sumBy(offered))} تومان
         </span>
         <span className="pj-chip" style={{ background: "#fef3c7", color: "#d97706" }}>
-          ارزش پذیرفته: {faNum(sumBy("accepted"))} تومان
+          ارزش پذیرفته: {faNum(sumBy(accepted))} تومان
         </span>
         <span className="pj-chip" style={{ background: "#dcfce7", color: "#16a34a" }}>
-          ارزش رسیده: {faNum(sumBy("arrived"))} تومان
+          ارزش رسیده: {faNum(sumBy(arrived))} تومان
         </span>
       </div>
       <div className="grid grid-cols-1 gap-3 md:grid-cols-3">

frontend/src/pages/Suppliers/PurchaseHistory.tsx

@@ -112,28 +112,28 @@ export function PurchaseHistory({ supplier, quotes, materials }: PurchaseHistory
               ) : (
                 <>
                   {profs.map((pf) => (
-                    <a
+                    <button
                       key={"pf-" + pf.id}
+                      type="button"
                       className="detail-link"
-                      href={api.files.downloadUrl(q.id, "proforma", pf.id!)}
-                      download={pf.name}
                       title="دانلود پیش‌فاکتور"
+                      onClick={() => api.files.download(q.id, "proforma", pf.id!, pf.name)}
                     >
                       <Paperclip className="me-1 inline h-3 w-3" />
                       پیش‌فاکتور: {pf.name}
-                    </a>
+                    </button>
                   ))}
                   {invs.map((inv) => (
-                    <a
+                    <button
                       key={"inv-" + inv.id}
+                      type="button"
                       className="detail-link"
-                      href={api.files.downloadUrl(q.id, "invoice", inv.id!)}
-                      download={inv.name}
                       title="دانلود فاکتور"
+                      onClick={() => api.files.download(q.id, "invoice", inv.id!, inv.name)}
                     >
                       <Paperclip className="me-1 inline h-3 w-3" />
                       فاکتور: {inv.name}
-                    </a>
+                    </button>
                   ))}
                   {!loading && !profs.length && !invs.length && (
                     <span className="ph-attach-loading">فاکتوری ثبت نشده</span>

frontend/src/pages/Suppliers/SupplierDetailPage.tsx

@@ -1,11 +1,12 @@
 import { useEffect, useMemo, useState } from "react";
 import { Link, useParams } from "react-router-dom";
-import { MapPin, Phone, User, Plus, Package, X } from "lucide-react";
+import { MapPin, Phone, User, Plus, Package, X, Clock } from "lucide-react";
 import { toast } from "sonner";
 import { useMaterials, useQuotes, useStoreData, useSuppliers } from "../../hooks";
 import { topicByName } from "../../lib/topics";
 import { useAppStore } from "../../store";
 import { api } from "../../lib/api";
+import { daysBetween } from "../../lib/formatters";
 import { Header, PageLayout } from "../../components/layout/Header";
 import { EmptyState } from "../../components/EmptyState";
 import { Badge } from "../../components/ui/badge";
@@ -14,6 +15,15 @@ import { ConfirmDeleteDialog } from "../../components/ConfirmDeleteDialog";
 import { normalize } from "../../lib/normalize";
 import { PurchaseHistory } from "./PurchaseHistory";
 
+// تمیزکاری و استانداردسازی شماره برای شماره‌گیر خودکار موبایل (اندروید و iOS)
+function cleanPhoneForTel(phone?: string | null): string {
+  if (!phone) return "";
+  const enDigits = phone
+    .replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d)))
+    .replace(/[٠-٩]/g, (d) => String("٠١٢٣٤٥٦٧٨٩".indexOf(d)));
+  return enDigits.replace(/(?!^\+)[^\d]/g, "");
+}
+
 // صفحه‌ی مشخصات کامل تأمین‌کننده + سابقه خرید + مدیریت متریال‌های تأمین‌شده
 export function SupplierDetailPage() {
   useStoreData();
@@ -29,6 +39,19 @@ export function SupplierDetailPage() {
   const [linked, setLinked] = useState<string[]>([]);
   const [busy, setBusy] = useState(false);
 
+  // محاسبه میانگین زمان تحویل این تأمین‌کننده بر اساس خریدهای تحویل‌شده
+  const avgLeadTime = useMemo(() => {
+    if (!s?.id) return null;
+    const supQuotes = quotes.filter(
+      (q) => q.supplier_id === s.id && q.status === "arrived" && q.accepted_date && q.arrived_date
+    );
+    const times = supQuotes
+      .map((q) => daysBetween(q.arrived_date, q.accepted_date))
+      .filter((x): x is number => x != null);
+
+    return times.length ? Math.round(times.reduce((a, b) => a + b, 0) / times.length) : null;
+  }, [quotes, s?.id]);
+
   useEffect(() => {
     if (!id) return;
     let alive = true;
@@ -48,20 +71,8 @@ export function SupplierDetailPage() {
     return [...set].sort((a, b) => a.localeCompare(b, "fa"));
   }, [materials]);
 
-  // متریال‌های خریداری‌شده از این تأمین‌کننده (از پیشنهادها)
+  // دسته‌ی این تأمین‌کننده — دسته فقط برچسبِ خودِ تأمین‌کننده است (v2.7)
-  const purchased = useMemo(() => {
+  const purchased = useMemo(() => [...(s?.categories || [])].sort((a, b) => a.localeCompare(b, "fa")), [s]);
-    const out = new Set<string>();
-    quotes.forEach((q) => {
-      if (q.supplier_id !== id) return;
-      (q.line_items || []).forEach((li) => {
-        if (li.rejected) return;
-        const m = materials.find((x) => x.id === li.material_id);
-        if (!m || !m.category) return;
-        out.add(m.category);
-      });
-    });
-    return [...out].sort((a, b) => a.localeCompare(b, "fa"));
-  }, [quotes, materials, id]);
 
   if (!s) {
     return (
@@ -80,7 +91,6 @@ export function SupplierDetailPage() {
   const breadcrumb = `${topicName ? topicName + " — " : ""}${firstCat ? firstCat + " — " : ""}${s.name}`;
 
   const saveCategories = (names: string[]) => {
-    // v2.6: اتصال واقعی تأمین‌کننده ↔ متریال (کاتالوگ) — با نام متریال
     if (!id || busy) return;
     setBusy(true);
     void (async () => {
@@ -128,21 +138,51 @@ export function SupplierDetailPage() {
       <Header title="اطلاعات تماس تأمین‌کننده" sub={breadcrumb} backTo="/suppliers" backLabel="تأمین‌کننده‌ها" />
       <PageLayout>
         <div className="max-w-xl rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div className="flex items-center justify-between gap-3">
             <div className="flex items-center gap-3">
               <div className="text-xl font-extrabold">{s.name}</div>
               <Badge variant="outline">{topicName}</Badge>
             </div>
-          <div className="mt-3 flex flex-col gap-1.5 text-[13.5px]">
+            {avgLeadTime != null && (
+              <span className="inline-flex items-center gap-1.5 rounded-md border border-emerald-800/60 bg-emerald-950 px-2.5 py-1 text-xs font-semibold text-emerald-400">
+                <Clock className="h-3.5 w-3.5 text-emerald-400" />
+                <span>{avgLeadTime} روز</span>
+              </span>
+            )}
+          </div>
+
+          <div className="mt-3 flex flex-col gap-2 text-[13.5px]">
             <span>
               <MapPin className="me-1.5 inline h-4 w-4 text-muted" /> <b>موقعیت:</b> {s.location || "—"}
             </span>
-            <span>
+
-              <Phone className="me-1.5 inline h-4 w-4 text-muted" /> <b>تلفن:</b> {s.phone || "—"}
+            {/* بخش تلفن — همراه با قابلیت تماس مستقیم با یک لمس */}
-            </span>
+            <div className="flex items-center">
+              <Phone className="me-1.5 inline h-4 w-4 text-muted" />
+              <b className="me-1">تلفن:</b>
+              {s.phone ? (
+                <a
+                  href={`tel:${cleanPhoneForTel(s.phone)}`}
+                  className="inline-flex items-center gap-1 font-semibold text-accent hover:underline active:opacity-80"
+                  dir="ltr"
+                  title="تماس مستقیم با تأمین‌کننده"
+                >
+                  <span className="tabular-nums">{s.phone}</span>
+                </a>
+              ) : (
+                <span className="text-muted">—</span>
+              )}
+            </div>
+
             <span>
               <User className="me-1.5 inline h-4 w-4 text-muted" /> <b>شخص رابط:</b> {s.contact || "—"}
             </span>
+            <span>
+              <Clock className="me-1.5 inline h-4 w-4 text-muted" /> <b>میانگین زمان تحویل:</b>{" "}
+              {avgLeadTime != null ? `${avgLeadTime} روز` : "—"}
+            </span>
           </div>
+
           <div className="mt-4 flex items-center gap-2">
             <Link
               to={`/wizard?topic=${encodeURIComponent(topicName)}&supplier=${encodeURIComponent(s.id)}`}
@@ -163,7 +203,7 @@ export function SupplierDetailPage() {
           </div>
         </div>
 
-        {/* متریال‌های این تأمین‌کننده — افزودن/حذف + مشاهده‌ی همه */}
+        {/* متریال‌های این تأمین‌کننده */}
         <div className="mt-4 max-w-xl rounded-xl border border-line bg-panel p-5 shadow-sm">
           <h4 className="mb-1 text-[13.5px] font-bold">
             <Package className="me-1 inline h-4 w-4 text-accent" /> متریال‌های تأمین‌شده
@@ -203,7 +243,7 @@ export function SupplierDetailPage() {
           )}
         </div>
 
-        {/* سابقه خرید از این تأمین‌کننده — همه‌ی پیشنهادها + فاکتور/پیش‌فاکتور */}
+        {/* سابقه خرید از این تأمین‌کننده */}
         <div className="mt-4 max-w-4xl">
           <PurchaseHistory supplier={s} quotes={quotes} materials={materials} />
         </div>

frontend/src/pages/Suppliers/supplierUtils.tsx

@@ -1,18 +1,16 @@
 import { Link } from "react-router-dom";
 import { MapPin, Phone, User, Plus, Timer } from "lucide-react";
-import type { Material, Supplier } from "../../lib/types";
+import type { Supplier } from "../../lib/types";
 import { normalize } from "../../lib/normalize";
 import { fmtNum } from "../../lib/formatters";
 
-export function topicCategories(topic: string, materials: Material[], suppliers: Supplier[]): string[] {
+// تمیزکاری و استانداردسازی شماره برای شماره‌گیر خودکار موبایل (اندروید و iOS)
-  const out = new Set<string>();
+function cleanPhoneForTel(phone?: string | null): string {
-  materials
+  if (!phone) return "";
-    .filter((m) => topic && normalize(m.topic) === normalize(topic) && m.category)
+  const enDigits = phone
-    .forEach((m) => out.add(m.category));
+    .replace(/[۰-۹]/g, (d) => String("۰۱۲۳۴۵۶۷۸۹".indexOf(d)))
-  suppliers
+    .replace(/[٠-٩]/g, (d) => String("٠١٢٣٤٥٦٧٨٩".indexOf(d)));
-    .filter((s) => topic && normalize(s.topic) === normalize(topic))
+  return enDigits.replace(/(?!^\+)[^\d]/g, "");
-    .forEach((s) => (s.categories || []).forEach((c) => c && out.add(c)));
-  return [...out].sort((a, b) => a.localeCompare(b, "fa"));
 }
 
 export function suppliersOfCategory(topic: string, cat: string, suppliers: Supplier[]): Supplier[] {
@@ -40,7 +38,11 @@ export function SupplierCard({
   return (
     <div className="sup-card">
       <div className="sc-head flex items-start justify-between gap-2">
-        <Link to={`/suppliers/${s.id}`} className="sc-name-link min-w-0 flex-1 leading-snug">
+        {/* فقط متن نام تأمین‌کننده لینک است و به کل کارت گسترش پیدا نمی‌کند */}
+        <Link
+          to={`/suppliers/${s.id}`}
+          className="min-w-0 flex-1 text-sm font-bold text-primary hover:text-accent hover:underline active:opacity-70 leading-snug py-0.5"
+        >
           {s.name}
         </Link>
         <div className="flex items-center gap-1.5 shrink-0">
@@ -60,17 +62,34 @@ export function SupplierCard({
           )}
         </div>
       </div>
+
       <div className="sc-meta">
         <span>
           <MapPin className="me-1 inline h-3 w-3" /> {s.location || "—"}
         </span>
+
+        {/* شماره تماس قابل کلیک برای تماس مستقیم در موبایل */}
+        {s.phone ? (
+          <a
+            href={`tel:${cleanPhoneForTel(s.phone)}`}
+            className="inline-flex items-center text-primary hover:text-accent hover:underline active:opacity-75 transition-colors"
+            title="تماس مستقیم با تأمین‌کننده"
+            dir="ltr"
+          >
+            <Phone className="me-1 inline h-3 w-3 text-muted shrink-0" />
+            <span className="tabular-nums">{s.phone}</span>
+          </a>
+        ) : (
           <span>
-          <Phone className="me-1 inline h-3 w-3" /> {s.phone || "—"}
+            <Phone className="me-1 inline h-3 w-3 text-muted" /> —
           </span>
+        )}
+
         <span>
           <User className="me-1 inline h-3 w-3" /> {s.contact || "—"}
         </span>
       </div>
+
       {materials.length > 0 && (
         <div className="mt-2 border-t border-line pt-1.5">
           <div className="mb-1 flex flex-wrap gap-1">
@@ -82,6 +101,7 @@ export function SupplierCard({
           </div>
         </div>
       )}
+
       <div className="sc-actions">
         <Link to={`/wizard?topic=${encodeURIComponent(topic)}&supplier=${encodeURIComponent(s.id)}`} className="btn-line-file no-underline">
           <Plus className="h-3 w-3" />

frontend/src/pages/Units/UnitsPage.tsx

@@ -496,7 +496,7 @@ export function UnitsPage() {
                               )}
                             />
                           )}
-                          <span className="truncate">{g.base}</span>
+                          <span className="whitespace-normal break-words text-start">{g.base}</span>
                         </span>
                         <span className="ut-ref">{hasChildren ? faNum(g.variants.length) : g.repRef || "—"}</span>
                       </button>
@@ -519,7 +519,7 @@ export function UnitsPage() {
                                   )}
                                   onClick={() => setMaterialId(v.id)}
                                 >
-                                  <span className="truncate">{v.label}</span>
+                                  <span className="whitespace-normal break-words text-start">{v.label}</span>
                                   <span className="ut-ref">{v.refUnit || "—"}</span>
                                 </button>
                               ))}

frontend/src/pages/Wizard/Step1TopicSupplier.tsx

@@ -1,5 +1,5 @@
 import { useMemo, useState } from "react";
-import type { Material, Supplier } from "../../lib/types";
+import type { Supplier } from "../../lib/types";
 import { normalize } from "../../lib/normalize";
 import { useSuppliers } from "../../hooks";
 import { useAppStore } from "../../store";
@@ -103,7 +103,7 @@ export function Step1TopicSupplier({
               ))
             )}
           </div>
-          <div className={cn("field max-w-md", invalid && "invalid")}>
+          <div data-field="supplier_id" className={cn("field max-w-md", invalid && "invalid")}>
             <label>یا نام تأمین‌کننده را تایپ و انتخاب کنید</label>
             <Combobox
               value={supplierName}
@@ -179,14 +179,3 @@ export function Step1TopicSupplier({
   );
 }
 
-// دسته‌های موجود داخل یک تاپیک (از materials + تأمین‌کننده‌ها)
-export function topicCategories(topic: string, suppliers: Supplier[], materials: Material[]): string[] {
-  const out = new Set<string>();
-  materials
-    .filter((m) => topic && normalize(m.topic) === normalize(topic) && m.category)
-    .forEach((m) => out.add(m.category));
-  suppliers
-    .filter((s) => topic && normalize(s.topic) === normalize(topic))
-    .forEach((s) => (s.categories || []).forEach((c) => c && out.add(c)));
-  return [...out].sort((a, b) => a.localeCompare(b, "fa"));
-}

frontend/src/pages/Wizard/Step2LineItems.tsx

@@ -1,12 +1,14 @@
 import { useEffect, useMemo, useState } from "react";
+import { Trash2, Plus } from "lucide-react";
 import type { Material } from "../../lib/types";
 import { normalize } from "../../lib/normalize";
 import { useMaterials } from "../../hooks";
-import { specsKey } from "../../lib/quoteUtils";
+import { matchMaterial, materialBaseName } from "../../lib/quoteUtils";
 import { Combobox } from "../../components/Combobox";
 import { NumberInput } from "../../components/NumberInput";
 import { MultiSelectCombobox } from "../../components/MultiSelectCombobox";
 import { api, apiV26 } from "../../lib/api";
+import { faNum } from "../../lib/formatters";
 
 export interface ItemDraft {
   tempId: string;
@@ -41,43 +43,17 @@ export function itemRowLabel(it: ItemDraft): string {
   return qtyPart ? `${name} -- ${qtyPart}` : name;
 }
 
-// نام پایه‌ی متریال از نامِ ذخیره‌شده.
+// مقادیر مجزای name/brand/spec در کاتالوگ سراسری
-// متریال‌های جدید فقط نامِ خودِ متریال را در name دارند (برند در brand_ids و
-// مشخصه‌ها در attributes ذخیره می‌شوند) و دست‌نخورده برمی‌گردند. رکوردهای قدیمی
-// name را به شکل «برند + دسته + مشخصه» ذخیره کرده‌اند؛ آن قطعات جدا می‌شوند تا
-// نامِ پایه باقی بماند.
-function materialBaseName(name: string, brand: string, specs: string[], category = ""): string {
-  const fallback = (name || "").trim();
-  if (!fallback) return "";
-  let base = fallback;
-  // بلندترین قطعه اول حذف می‌شود تا حذف‌های جزئی، رشته را ناقص نکنند
-  const parts = [brand, category, ...specs]
-    .map((p) => (p || "").trim())
-    .filter(Boolean)
-    .sort((a, b) => b.length - a.length);
-  for (const p of parts) {
-    if (!base.includes(p)) continue;
-    const next = base.split(p).join(" ").replace(/\s+/g, " ").trim();
-    // اگر حذفِ این قطعه کلِ نام را خالی کند، یعنی همان نامِ متریال بوده — نگهش دار
-    if (!next) continue;
-    base = next;
-  }
-  // شکلِ قدیمیِ خراب می‌تواند فقط یک مشخصه باقی بگذارد؛ آن دیگر نامِ متریال نیست
-  if (parts.some((p) => p === base)) return fallback;
-  return base || fallback;
-}
-
-// مقادیر مجزای category/brand/spec داخل تاپیک
 export function materialOptions(
   materials: Material[],
-  topic: string,
+  _topic: string,
   item: ItemDraft,
-  field: "cat" | "brand" | "spec",
+  field: "brand" | "spec",
   allItems: ItemDraft[] = [],
   apiBrands: string[] = [],
   apiSpecs: string[] = [],
 ): string[] {
-  let list = materials.filter((m) => topic && normalize(m.topic) === normalize(topic));
+  let list = materials;
   const cat = item.cat.trim();
 
   const fromRows = (sel: (it: ItemDraft) => string | string[]): string[] => {
@@ -91,22 +67,18 @@ export function materialOptions(
     return [...out];
   };
 
-  if (field === "cat") {
-    const base = new Set(list.map((m) => m.category).filter(Boolean));
-    fromRows((it) => it.cat).forEach((c) => base.add(c));
-    return [...base].sort((a, b) => a.localeCompare(b, "fa"));
-  }
   if (field === "brand") {
-    // برند سراسری است — مستقل از تاپیک و دسته
     const allBrands = new Set(materials.map((m) => m.brand).filter(Boolean));
     apiBrands.forEach((b) => b && allBrands.add(b));
     fromRows((it) => it.brand).forEach((b) => allBrands.add(b));
     return [...allBrands].sort((a, b) => a.localeCompare(b, "fa"));
   }
-  if (cat) list = list.filter((m) => normalize(m.category) === normalize(cat));
+
-  // مشخصه‌ها سراسری هستند: رجیستری attribute-definitions + مشخصه‌های همه‌ی
+  if (cat)
-  // متریال‌ها + مشخصه‌های تایپ‌شده در سایر ردیف‌ها. به تاپیک/دسته/برندِ قلمِ
+    list = list.filter(
-  // فعلی گره نمی‌خورند تا هنگام افزودن پیشنهاد جدید همیشه در دسترس باشند.
+      (m) => normalize(materialBaseName(m.name, m.brand, m.specs)) === normalize(cat),
+    );
+
   const base = new Set<string>();
   apiSpecs.forEach((s) => s && base.add(s));
   materials.forEach((m) => (m.specs || []).forEach((s) => s && base.add(s)));
@@ -115,7 +87,7 @@ export function materialOptions(
   return [...base].sort((a, b) => a.localeCompare(b, "fa"));
 }
 
-// مرحله ۲ — جدول پویای اقلام سفارش
+// مرحله ۲ — مدیریت اقلام سفارش
 export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember }: Step2Props) {
   const materials = useMaterials();
 
@@ -134,7 +106,7 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
   const allMaterialNames = useMemo(() => {
     const set = new Set<string>();
     materials.forEach((m) => {
-      const base = materialBaseName(m.name, m.brand, m.specs, m.category);
+      const base = materialBaseName(m.name, m.brand, m.specs);
       if (base) set.add(base);
     });
     return [...set].sort((a, b) => a.localeCompare(b, "fa"));
@@ -192,50 +164,83 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
       if (!it.specs.length) return;
       rec = { topic: selectedTopic, category: it.cat.trim(), brand: it.brand.trim(), specs: it.specs };
     }
-    const dup = materials.some(
+    const dup = !!matchMaterial(materials, rec.category, rec.brand, rec.specs);
-      (m) =>
-        normalize(m.topic) === normalize(rec.topic) &&
-        normalize(m.category) === normalize(rec.category) &&
-        normalize(m.brand) === normalize(rec.brand) &&
-        specsKey(m.specs) === specsKey(rec.specs),
-    );
     if (dup) return;
     onRemember(rec);
   };
 
   return (
-    <div>
+    <div className="space-y-4">
-      <h3 className="mb-1 text-[15px] font-bold">
+      {/* هدر */}
-        <span className="me-1 inline-flex h-6 w-6 items-center justify-center rounded-full bg-blue-600 text-[12px] font-bold text-white">۲</span>
+      <div className="space-y-1">
+        <div className="flex items-center justify-between">
+          <div className="flex items-center gap-2">
+            <span className="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-blue-600 text-xs font-bold text-white shadow-xs">
+              ۲
+            </span>
+            <h3 className="text-sm sm:text-base font-bold text-ink">
               اقلام سفارش
             </h3>
-      <div className="mb-3 text-[12px] text-gray-500" dangerouslySetInnerHTML={{ __html: 'هر سطر یک <b>قلم</b> است (متریال + برند + مشخصه + واحد + تعداد + قیمت). متریال، برند و مشخصه را می‌توان از گزینه‌ها انتخاب کرد یا تایپ کرد تا به‌عنوان گزینه‌ی جدید اضافه شود. شرایط پرداخت هر قلم را در مرحله‌ی بعد مشخص می‌کنید.' }} />
+          </div>
-
+          <span className="rounded-full bg-blue-500/10 px-2.5 py-0.5 text-[11px] font-semibold text-blue-500 border border-blue-500/20">
-      <div className="item-row wizard-item-row item-row-head mb-1 pe-7">
+            {faNum(items.length)} قلم
-        <span>متریال</span>
+          </span>
-        <span>برند</span>
+        </div>
-        <span>مشخصه</span>
+        <p className="text-[11.5px] sm:text-xs text-muted leading-relaxed">
-        <span>تعداد</span>
+          مشخصات، تعداد و قیمت هر قلم را ثبت کنید. گزینه‌های جدید با تایپ ذخیره می‌شوند.
-        <span>واحد</span>
+        </p>
-        <span>قیمت واحد</span>
-        <span>قیمت کل</span>
       </div>
 
-      <div className="flex flex-col gap-2">
+      {/* لیست کارت‌های اقلام */}
-        {items.map((it) => (
+      <div data-field="line_items" className="flex flex-col gap-3">
-          <div key={it.tempId} className="item-row wizard-item-row items-center">
+        {items.map((it, idx) => (
+          <div
+            key={it.tempId}
+            className="rounded-xl border border-line bg-panel p-3.5 sm:p-4 shadow-2xs space-y-3 transition-all"
+          >
+            {/* سربرگ قلم */}
+            <div className="flex items-center justify-between border-b border-line pb-2">
+              <div className="flex items-center gap-1.5 min-w-0">
+                <span className="flex h-5 w-5 shrink-0 items-center justify-center rounded-full bg-blue-500/10 text-[11px] font-bold text-blue-500">
+                  {faNum(idx + 1)}
+                </span>
+                <span className="text-xs font-bold text-ink truncate">
+                  {it.cat || "قلم جدید"} {it.brand ? `• ${it.brand}` : ""}
+                </span>
+              </div>
+              {items.length > 1 && (
+                <button
+                  type="button"
+                  className="inline-flex items-center gap-1 rounded-md px-2 py-0.5 text-xs text-rose-500 hover:bg-rose-500/10 transition-colors"
+                  title="حذف قلم"
+                  onClick={() => remove(it.tempId)}
+                >
+                  <Trash2 className="h-3.5 w-3.5" />
+                  <span className="text-[11px]">حذف</span>
+                </button>
+              )}
+            </div>
+
+            {/* ردیف ۱: متریال و برند */}
+            <div className="grid grid-cols-2 gap-2.5">
+              <div className="flex flex-col gap-1 min-w-0">
+                <label className="text-[11px] font-semibold text-muted text-right">متریال</label>
                 <Combobox
                   value={it.cat}
                   onChange={(x) => patch(it.tempId, { cat: x.label })}
                   items={allMaterialNames}
                   allowAdd
                   addSuffix="به عنوان متریال جدید"
-              placeholder="متریال"
+                  placeholder="نام متریال"
                   onInputChange={(v) => patch(it.tempId, { cat: v })}
                   onBlur={() => rememberField("i-cat", it)}
-              inputClassName="!text-[12px] !h-9"
+                  inputClassName="!text-xs !h-9 text-right"
                   className="min-w-0"
                 />
+              </div>
+
+              <div className="flex flex-col gap-1 min-w-0">
+                <label className="text-[11px] font-semibold text-muted text-right">برند</label>
                 <Combobox
                   value={it.brand}
                   onChange={(x) => patch(it.tempId, { brand: x.label })}
@@ -245,34 +250,52 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
                   placeholder="برند"
                   onInputChange={(v) => patch(it.tempId, { brand: v })}
                   onBlur={() => rememberField("i-brand", it)}
-              inputClassName="!text-[12px] !h-9"
+                  inputClassName="!text-xs !h-9 text-right"
                   className="min-w-0"
                 />
+              </div>
+            </div>
+
+            {/* ردیف ۲: مشخصه فنی */}
+            <div className="flex flex-col gap-1 min-w-0">
+              <label className="text-[11px] font-semibold text-muted text-right">مشخصه فنی / ابعاد</label>
               <MultiSelectCombobox
                 values={it.specs}
                 onChange={(specs) => patch(it.tempId, { specs })}
                 options={materialOptions(materials, selectedTopic, it, "spec", items, [], specOptions)}
-              placeholder="مشخصه"
+                placeholder="انتخاب مشخصات (مثلاً ضخامت، رنگ، تیپ...)"
                 className="min-w-0"
               />
+            </div>
+
+            {/* بخش مقادیر و محاسبات مالی */}
+            <div className="rounded-lg bg-bg/50 p-2.5 border border-line space-y-3">
+              {/* ردیف ۳: تعداد + واحد سنجش */}
+              <div className="grid grid-cols-[100px_1fr] sm:grid-cols-[120px_1fr] gap-2.5">
+                <div className="flex flex-col gap-1 min-w-0">
+                  <label className="text-[10.5px] font-semibold text-muted text-right">تعداد</label>
                   <NumberInput
                     value={it.qty}
                     onChange={(qty) => {
                       patch(it.tempId, {
                         qty,
-                  total: qty != null && it.price != null ? Math.round(qty * it.price * 100) / 100 : it.total,
+                        total: qty != null && it.price != null ? Math.round(qty * it.price) : it.total,
                       });
                     }}
-              placeholder="تعداد"
+                    placeholder="مقدار"
-              showWords
+                    className="!text-right text-right"
                   />
+                </div>
+
+                <div className="flex flex-col gap-1 min-w-0">
+                  <label className="text-[10.5px] font-semibold text-muted text-right">واحد سنجش</label>
                   <Combobox
                     value={it.unit}
                     onChange={(x) => patch(it.tempId, { unit: x.label })}
                     items={allUnits.filter((u) => normalize(u) !== normalize(it.unit))}
                     allowAdd
                     addSuffix="به عنوان واحد جدید"
-              placeholder="واحد"
+                    placeholder="واحد (شاخه، متر، کیلو...)"
                     onInputChange={(v) => patch(it.tempId, { unit: v })}
                     onAdd={(v) => {
                       const name = v.trim();
@@ -286,56 +309,60 @@ export function Step2LineItems({ items, onItemsChange, selectedTopic, onRemember
                         })
                         .catch(() => {});
                     }}
-              inputClassName="!text-[12px] !h-9"
+                    inputClassName="!text-xs !h-9 text-right"
                     className="min-w-0"
                   />
+                </div>
+              </div>
+
+              {/* ردیف ۴: قیمت هر واحد (راست‌چین شده) */}
+              <div className="flex flex-col gap-1 min-w-0 border-t border-line/60 pt-2.5">
+                <label className="text-[10.5px] font-semibold text-muted text-right">
+                  {it.unit ? `قیمت هر ${it.unit} (تومان)` : "قیمت هر واحد (تومان)"}
+                </label>
                 <NumberInput
                   value={it.price}
                   onChange={(price) => {
                     patch(it.tempId, {
                       price,
-                  total: it.qty != null && price != null ? Math.round(it.qty * price * 100) / 100 : it.total,
+                      total: it.qty != null && price != null ? Math.round(it.qty * price) : it.total,
                     });
                   }}
-              placeholder="قیمت واحد"
+                  placeholder="قیمت هر واحد"
                   showWords
-              maxDecimals={2}
+                  className="!text-right text-right"
                 />
+              </div>
+
+              {/* ردیف ۵: قیمت کل قلم (راست‌چین شده) */}
+              <div className="flex flex-col gap-1 min-w-0 border-t border-line/60 pt-2.5">
+                <label className="text-[10.5px] font-semibold text-muted text-right">قیمت کل این قلم (تومان)</label>
                 <NumberInput
                   value={it.total}
                   onChange={(total) => {
                     patch(it.tempId, {
                       total,
                       price:
-                    total != null && it.qty != null && it.qty > 0 ? Math.round((total / it.qty) * 100) / 100 : it.price,
+                        total != null && it.qty != null && it.qty > 0 ? Math.round(total / it.qty) : it.price,
                     });
                   }}
-              placeholder="قیمت کل"
+                  placeholder="قیمت کل قلم"
                   showWords
+                  className="!text-right text-right"
                 />
-            
+              </div>
-            {/* دکمه حذف مدرن با آیکون سطل زباله */}
+            </div>
-            <button
-              type="button"
-              className="flex h-8 w-8 items-center justify-center rounded-lg text-gray-400 hover:bg-red-50 hover:text-red-500 transition-colors"
-              title="حذف قلم"
-              onClick={() => remove(it.tempId)}
-            >
-              <svg className="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={1.8} d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
-              </svg>
-            </button>
           </div>
         ))}
       </div>
 
-      {/* دکمه افزودن قلم با استایل برجسته و خط‌چین */}
+      {/* دکمه افزودن قلم جدید */}
       <button
         type="button"
-        className="mt-3 flex w-full items-center justify-center gap-2 rounded-xl border-2 border-dashed border-blue-300 bg-blue-50/40 py-2.5 px-4 text-[13px] font-semibold text-blue-600 hover:border-blue-500 hover:bg-blue-100/70 transition-all duration-150"
+        className="flex w-full items-center justify-center gap-1.5 rounded-xl border border-dashed border-line bg-panel py-2.5 text-xs font-semibold text-ink hover:border-accent hover:text-accent active:scale-[0.99] transition-all"
         onClick={add}
       >
-        <span className="text-base font-bold leading-none">+</span>
+        <Plus className="h-4 w-4" />
         <span>افزودن قلم جدید</span>
       </button>
     </div>

frontend/src/pages/Wizard/Step3Termsheets.tsx

@@ -47,7 +47,7 @@ export function Step3Termsheets({ cards, onCardsChange, items, coverage, onCover
       </h3>
       <div className="mb-3 text-[12px] text-muted" dangerouslySetInnerHTML={{ __html: 'هر <b>termsheet</b> یک روش پرداخت است (نقد، چک، اقساط...). داخل هر termsheet مشخص کنید کدام قلم‌ها را پوشش می‌دهد — یک termsheet می‌تواند چند قلم را بگیرد، و یک قلم هم می‌تواند زیر چند termsheet مختلف (مثلاً هم نقد هم چک) پیشنهاد شود.' }} />
 
-      <div className="flex flex-col gap-3">
+      <div data-field="termsheets" className="flex flex-col gap-3">
         {cards.map((card, idx) => (
           <TermsheetCard
             key={card.key}

frontend/src/pages/Wizard/Step4Projects.tsx

@@ -155,7 +155,7 @@ export function Step4Projects({ items, projects, assignment, onAssign, onUnassig
   };
 
   return (
-    <div>
+    <div data-field="project">
       <h3 className="mb-1 text-[15px] font-bold">
         <span className="me-1 inline-flex h-6 w-6 items-center justify-center rounded-full bg-accent text-[12px] font-bold text-white">۴</span>
         پروژه‌ها

frontend/src/pages/Wizard/Step5Review.tsx

@@ -57,20 +57,20 @@ export function Step5Review({
 
       <div className="grid max-w-2xl grid-cols-12 gap-3">
         {/* تاریخ پیشنهاد: فضای بزرگتر (۷ ستون از ۱۲) به همراه ساعت */}
-        <div className="field col-span-7 [&>div]:w-full [&_input]:w-full">
+        <div className="field col-span-7 [&>div]:w-full [&_input]:w-full" data-field="quote_date">
           <label>تاریخ پیشنهاد</label>
           <JalaliDatePicker value={quoteDate} onChange={onQuoteDate} placeholder="۱۴۰۳/۰۵/۱۲" withTime />
           <div className="hint">پیش‌فرض امروز</div>
         </div>
 
         {/* تاریخ انقضای پیشنهاد: فضای کوچکتر (۵ ستون از ۱۲) */}
-        <div className="field col-span-5 [&>div]:w-full [&_input]:w-full">
+        <div className="field col-span-5 [&>div]:w-full [&_input]:w-full" data-field="expiry_date">
           <label>تاریخ انقضای پیشنهاد</label>
           <JalaliDatePicker value={expiryDate} onChange={onExpiryDate} placeholder="۱۴۰۳/۰۶/۱۲" />
           <div className="hint">تا چه زمانی این قیمت معتبر است؟</div>
         </div>
 
-        <div className="field col-span-12">
+        <div className="field col-span-12" data-field="notes">
           <label>یادداشت (اختیاری)</label>
           <textarea
             rows={2}
@@ -81,7 +81,7 @@ export function Step5Review({
           />
         </div>
 
-        <div className="field col-span-12">
+        <div className="field col-span-12" data-field="proforma">
           <label>پیش‌فاکتور (اختیاری)</label>
           {proforma ? (
             /* وضعیت فایل انتخاب‌شده با دکمه حذف تمیز */

frontend/src/pages/Wizard/Stepper.tsx

@@ -9,40 +9,58 @@ export interface StepperProps {
   onGoto: (step: number) => void;
 }
 
-const STEPS = ["تأمین‌کننده", "اقلام", "شرایط پرداخت", "پروژه", "بازبینی و ثبت"];
+const STEPS = [
+  { id: 1, label: "تأمین‌کننده" },
+  { id: 2, label: "اقلام" },
+  { id: 3, label: "شرایط پرداخت" },
+  { id: 4, label: "پروژه" },
+  { id: 5, label: "بازبینی و ثبت" },
+];
 
-// نوار ۵ مرحله‌ای ویزارد — کلیک روی مراحل بازدیدشده مجاز است
+// نوار ۵ مرحله‌ای ویزارد — واکنش‌گرا و ضدشکستگی در موبایل
-// مراحل تکمیل‌شده سبز، مرحله‌ی فعلی آبی
 export function Stepper({ current, completedSteps, onGoto }: StepperProps) {
   return (
-    <div className="mb-4 flex flex-wrap gap-2 rounded-xl border border-line bg-panel p-2 shadow-sm">
+    <div className="mb-4 flex items-center justify-between gap-1 sm:gap-2 rounded-xl border border-line bg-panel p-1.5 sm:p-2 shadow-xs select-none">
-      {STEPS.map((label, i) => {
+      {STEPS.map(({ id: step, label }) => {
-        const step = i + 1;
         const isCurrent = step === current;
         const isComplete = completedSteps.has(step);
+
         return (
           <button
             key={step}
             type="button"
             className={cn(
-              "flex flex-1 cursor-pointer items-center justify-center gap-2 rounded-lg px-3 py-2 text-[12.5px] transition-colors",
+              "flex items-center justify-center gap-1.5 rounded-lg py-1.5 px-2 sm:px-3 text-xs transition-all duration-150 cursor-pointer",
+              // در موبایل مرحله جاری فضا می‌گیرد و بقیه جمع‌وجور می‌مانند تا سطر نشکند
               isCurrent
-                ? "bg-[#2563eb] font-bold text-white"
+                ? "flex-1 sm:flex-1 bg-blue-600 font-bold text-white shadow-xs"
-                : isComplete
+                : "flex-initial sm:flex-1 text-muted hover:text-foreground hover:bg-slate-50 dark:hover:bg-zinc-800/60",
-                  ? "bg-green-bg font-medium text-green"
+              isComplete && !isCurrent && "font-medium text-emerald-600 dark:text-emerald-400",
-                  : "hover:bg-slate-bg",
             )}
             onClick={() => onGoto(step)}
           >
             <span
               className={cn(
-                "flex h-5 w-5 items-center justify-center rounded-full text-[11px] font-bold",
+                "flex h-5 w-5 shrink-0 items-center justify-center rounded-full text-[11px] font-bold transition-colors",
-                isCurrent ? "bg-white/25" : isComplete ? "bg-green-bg text-green" : "bg-slate-bg text-muted",
+                isCurrent
+                  ? "bg-white/20 text-white"
+                  : isComplete
+                    ? "bg-emerald-100 text-emerald-700 dark:bg-emerald-950/80 dark:text-emerald-300"
+                    : "bg-muted/15 text-muted",
               )}
             >
-              {isComplete ? <Check className="h-3 w-3" /> : faNum(step)}
+              {isComplete ? <Check className="h-3 w-3 stroke-[2.5]" /> : faNum(step)}
             </span>
+
+            {/* در موبایل فقط نام مرحله جاری باز است؛ در صفحه بزرگتر همه نام‌ها نمایش دارند */}
+            <span
+              className={cn(
+                "whitespace-nowrap truncate text-[11.5px] sm:text-xs",
+                !isCurrent && "hidden md:inline",
+              )}
+            >
               {label}
+            </span>
           </button>
         );
       })}

frontend/src/pages/Wizard/WizardPage.tsx

@@ -1,9 +1,10 @@
 import { useEffect, useMemo, useState } from "react";
+import { track } from "../../lib/analytics";
 import { Link, useNavigate, useSearchParams } from "react-router-dom";
 import { ChevronRight, ChevronLeft, Check } from "lucide-react";
 import { toast } from "sonner";
 import type { LineItem, Quote } from "../../lib/types";
-import { api, nextId } from "../../lib/api";
+import { api, ApiError, looksLikeUuid, nextId } from "../../lib/api";
 import {
   useAddMaterial,
   useAddProject,
@@ -19,7 +20,7 @@ import { topicByName } from "../../lib/topics";
 import { useAppStore } from "../../store";
 import { normalize } from "../../lib/normalize";
 import { faNum } from "../../lib/formatters";
-import { specsKey } from "../../lib/quoteUtils";
+import { matchMaterial } from "../../lib/quoteUtils";
 import { Header, PageLayout } from "../../components/layout/Header";
 import { Stepper } from "./Stepper";
 import { Step1TopicSupplier } from "./Step1TopicSupplier";
@@ -118,6 +119,7 @@ export function WizardPage() {
   const goToStep = (n: number) => {
     setCurrentStep(n);
     setHighestVisited((h) => Math.max(h, n));
+    track("wizard_step", { step: n, direction: n > currentStep ? "forward" : "back" });
     window.scrollTo({ top: 0, behavior: "smooth" });
   };
 
@@ -125,19 +127,9 @@ export function WizardPage() {
     goToStep(currentStep + 1);
   };
 
-  const rememberMaterial = (rec: MaterialRec) => {
+  const rememberMaterial = (_rec: MaterialRec) => {};
-    void addMaterial.mutateAsync({
-      id: nextId("m", materials),
-      name: (rec.category || rec.brand || rec.specs.join(" ") || "").trim() || "کالای جدید",
-      topic: rec.topic,
-      category: rec.category,
-      brand: rec.brand,
-      specs: rec.specs,
-      base_unit: "",
-    });
-  };
 
-  // ---------- پروژه‌ها: از مجموعه + نام‌های قدیمی quoteها ----------
+  // ---------- پروژه‌ها ----------
   const projectNames = useMemo(() => {
     const names = new Set<string>(projects.map((p) => p.name));
     quotes.forEach((q) => {
@@ -165,7 +157,7 @@ export function WizardPage() {
     });
   };
 
-  // ---------- خلاصه‌ی مرحله ۵ ----------
+  // ---------- خلاصه مرحله ۵ ----------
   const review = useMemo(() => {
     let grandTotal = 0;
     items.forEach((it) => {
@@ -193,19 +185,63 @@ export function WizardPage() {
 
   // ---------- ذخیره ----------
   const doSave = async () => {
-    const sectionError = (step: number, title: string, err: unknown) => {
+    const resolveErrorTarget = (err: unknown): { step: number; field?: string } => {
+      let field = "";
+      let msg = "";
+      if (err instanceof ApiError) {
+        field = err.field || "";
+        msg = err.message || "";
+      } else if (err instanceof Error) {
+        msg = err.message || "";
+        if ("field" in err && typeof (err as any).field === "string") {
+          field = (err as any).field;
+        }
+      }
+
+      const combined = `${field} ${msg}`.toLowerCase();
+
+      if (/supplier|تأمین|تامین/i.test(combined)) return { step: 1, field: "supplier_id" };
+      if (/line_item|material|canonical_unit|unit_id|quantity|متریال|واحد|قلم|تعداد/i.test(combined)) {
+        return { step: 2, field: field || "line_items" };
+      }
+      if (/termsheet|item_termsheet|schedule_step|due_date|milestone|ترم|پرداخت|پوشش|سررسید/i.test(combined)) {
+        return { step: 3, field: field || "termsheets" };
+      }
+      if (/project|پروژه/i.test(combined)) return { step: 4, field: "project" };
+      if (/expiry_date|تاریخ انقضا/i.test(combined)) return { step: 5, field: "expiry_date" };
+      if (/quote_date|تاریخ پیشنهاد/i.test(combined)) return { step: 5, field: "quote_date" };
+      if (/proforma|پیش‌فاکتور/i.test(combined)) return { step: 5, field: "proforma" };
+      if (/notes|یادداشت/i.test(combined)) return { step: 5, field: "notes" };
+
+      return { step: 5, field };
+    };
+
+    const sectionError = (stepOrTarget: number | { step: number; field?: string }, title: string, err: unknown) => {
+      const target = typeof stepOrTarget === "number" ? { step: stepOrTarget } : stepOrTarget;
       const msg = err instanceof Error ? err.message : "خطای ناشناخته";
       toast.error(`${title}: ${msg}`, {
-        action: { label: "رفع خطا", onClick: () => goToStep(step) },
+        duration: 8000,
+        action: {
+          label: "رفع خطا",
+          onClick: () => {
+            goToStep(target.step);
+            setTimeout(() => {
+              const targetAttr = target.field ? `[data-field="${target.field}"]` : "";
+              const el = (targetAttr ? document.querySelector(targetAttr) : null) ||
+                document.querySelector(`[data-step="${target.step}"]`);
+              if (el instanceof HTMLElement) {
+                el.scrollIntoView({ behavior: "smooth", block: "center" });
+                const input = el.querySelector("input, textarea, select") as HTMLElement | null;
+                if (input) input.focus();
+                else el.focus?.();
+                el.classList.add("ring-2", "ring-red-500", "rounded-xl");
+                setTimeout(() => el.classList.remove("ring-2", "ring-red-500", "rounded-xl"), 3500);
+              }
+            }, 150);
+          },
+        },
       });
     };
-    const guessStep = (msg: string): number => {
-      if (/تأمین|تامین|supplier/i.test(msg)) return 1;
-      if (/متریال|واحد|قلم|خط آیتم|item|دسته/i.test(msg)) return 2;
-      if (/ترم|termsheet|پرداخت|پوشش/i.test(msg)) return 3;
-      if (/پروژه|project/i.test(msg)) return 4;
-      return 5;
-    };
 
     const name = supplierName.trim();
     let supplierId = "";
@@ -244,24 +280,18 @@ export function WizardPage() {
       if (!cat && !brand && qty == null && price == null) continue;
 
       const wantName = (cat || brand || specs.join(" ") || "").trim() || "کالای جدید";
-      let material = materials.find((m) => normalize(m.name) === normalize(wantName));
+      let material = materials.find((m) => looksLikeUuid(m.id) && normalize(m.name) === normalize(wantName));
       if (!material) {
-        material = materials.find(
+        const matched = matchMaterial(
-          (m) =>
+          materials.filter((m) => looksLikeUuid(m.id)),
-            normalize(m.category) === normalize(cat) &&
+          cat,
-            normalize(m.brand) === normalize(brand) &&
+          brand,
-            specsKey(m.specs) === specsKey(specs),
+          specs,
-        );
-      }
-      // رکوردهای قدیمی name را به شکل «برند + دسته + مشخصه» ذخیره کرده‌اند؛
-      // تطبیق دوم بر اساس category/brand/specs انجام می‌شود تا آن‌ها هم پیدا شوند.
-      if (!material && cat) {
-        material = materials.find(
-          (m) => normalize(m.category) === normalize(cat) && normalize(m.brand) === normalize(brand),
         );
+        if (matched) material = matched;
       }
       let materialId: string;
-      if (material) {
+      if (material && looksLikeUuid(material.id)) {
         materialId = material.id;
       } else {
         try {
@@ -269,10 +299,9 @@ export function WizardPage() {
             id: nextId("m", materials),
             name: wantName,
             topic: selectedTopic,
-            category: cat,
             brand,
             specs,
-            base_unit: unit,
+            base_unit: unit || "عدد",
           });
           materialId = created.id;
         } catch (err) {
@@ -359,10 +388,11 @@ export function WizardPage() {
         }
       }
       toast.success("پیشنهاد ذخیره شد.");
+      track("quote_submitted", { quote_id: created.id, items: lineItems.length });
       navigate("/");
     } catch (e) {
-      const msg = e instanceof Error ? e.message : "خطا در ذخیره پیشنهاد";
+      const target = resolveErrorTarget(e);
-      sectionError(guessStep(msg), "خطا در ثبت پیشنهاد", e);
+      sectionError(target, "خطا در ثبت پیشنهاد", e);
     }
   };
 
@@ -381,7 +411,7 @@ export function WizardPage() {
   };
 
   return (
-    <div className="min-h-screen">
+    <div className="min-h-screen pb-10">
       <Header
         title="افزودن پیشنهاد جدید"
         sub="اطلاعات را از تماس با تأمین‌کننده وارد کنید"
@@ -389,10 +419,12 @@ export function WizardPage() {
         backLabel="بازگشت به دفتر"
       />
       <PageLayout>
+        {/* نوار مراحل استپر */}
         <Stepper current={currentStep} highestVisited={highestVisited} completedSteps={completedSteps} onGoto={goToStep} />
 
+        {/* محتوای مراحل با پدینگ ریسپانسیو و بهینه برای موبایل */}
         {currentStep === 1 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="1" className="rounded-xl border border-line bg-panel p-3.5 sm:p-5 shadow-xs">
             <Step1TopicSupplier
               selectedTopic={selectedTopic}
               onTopicSelect={(t) => {
@@ -416,12 +448,12 @@ export function WizardPage() {
           </div>
         )}
         {currentStep === 2 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="2" className="rounded-xl border border-line bg-panel p-3.5 sm:p-5 shadow-xs">
             <Step2LineItems items={items} onItemsChange={setItems} selectedTopic={selectedTopic} onRemember={rememberMaterial} />
           </div>
         )}
         {currentStep === 3 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="3" className="rounded-xl border border-line bg-panel p-3.5 sm:p-5 shadow-xs">
             <Step3Termsheets
               cards={cards}
               onCardsChange={setCards}
@@ -432,7 +464,7 @@ export function WizardPage() {
           </div>
         )}
         {currentStep === 4 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="4" className="rounded-xl border border-line bg-panel p-3.5 sm:p-5 shadow-xs">
             <Step4Projects
               items={items}
               projects={projectNames}
@@ -446,7 +478,7 @@ export function WizardPage() {
           </div>
         )}
         {currentStep === 5 && (
-          <div className="rounded-xl border border-line bg-panel p-5 shadow-sm">
+          <div data-step="5" className="rounded-xl border border-line bg-panel p-3.5 sm:p-5 shadow-xs">
             <Step5Review
               quoteDate={quoteDate}
               onQuoteDate={setQuoteDate}
@@ -461,15 +493,14 @@ export function WizardPage() {
           </div>
         )}
 
-        {/* پاورقی ویزارد — با آیکون‌های استاندارد و جهت‌گیری دقیق RTL */}
+        {/* پاورقی کنترل مراحل */}
-        <div className="mt-5 flex items-center justify-between rounded-xl border border-line bg-panel p-3.5 shadow-sm">
+        <div className="mt-4 flex items-center justify-between rounded-xl border border-line bg-panel p-3 sm:p-3.5 shadow-xs">
-          {/* دکمه مرحله قبلی (فلش رو به راست = بازگشت در فارسی) */}
           <div>
             {currentStep > 1 && (
               <button
                 type="button"
                 onClick={() => goToStep(currentStep - 1)}
-                className="inline-flex items-center gap-1.5 px-4 py-2 rounded-xl border border-slate-200 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-slate-700 dark:text-zinc-200 hover:bg-slate-50 dark:hover:bg-zinc-700 text-sm font-medium transition-colors shadow-xs cursor-pointer"
+                className="inline-flex items-center gap-1 px-3 sm:px-4 py-2 rounded-xl border border-slate-200 dark:border-zinc-700 bg-white dark:bg-zinc-800 text-slate-700 dark:text-zinc-200 hover:bg-slate-50 text-xs sm:text-sm font-medium transition-colors shadow-2xs"
               >
                 <ChevronRight className="h-4 w-4" />
                 <span>قبلی</span>
@@ -477,21 +508,19 @@ export function WizardPage() {
             )}
           </div>
 
-          {/* دکمه‌های اقدام (انصراف + بعدی / ذخیره) */}
+          <div className="flex items-center gap-2 sm:gap-3">
-          <div className="flex items-center gap-3">
             <Link
               to="/"
-              className="inline-flex items-center justify-center px-4 py-2 rounded-xl text-sm font-medium text-slate-500 hover:text-slate-700 hover:bg-slate-100 dark:text-zinc-400 dark:hover:text-zinc-200 dark:hover:bg-zinc-800 transition-colors no-underline"
+              className="inline-flex items-center justify-center px-3 sm:px-4 py-2 rounded-xl text-xs sm:text-sm font-medium text-slate-500 hover:text-slate-700 no-underline"
             >
               انصراف
             </Link>
 
-            {/* دکمه مرحله بعدی (فلش رو به چپ = پیشروی در فارسی) */}
             {currentStep < TOTAL_STEPS && (
               <button
                 type="button"
                 onClick={next}
-                className="inline-flex items-center gap-1.5 px-6 py-2 rounded-xl bg-blue-600 hover:bg-blue-700 active:bg-blue-800 text-white text-sm font-semibold shadow-sm hover:shadow transition-all duration-150 cursor-pointer"
+                className="inline-flex items-center gap-1 px-4 sm:px-6 py-2 rounded-xl bg-blue-600 hover:bg-blue-700 active:bg-blue-800 text-white text-xs sm:text-sm font-semibold shadow-xs transition-all"
               >
                 <span>بعدی</span>
                 <ChevronLeft className="h-4 w-4" />
@@ -502,7 +531,7 @@ export function WizardPage() {
               <button
                 type="button"
                 onClick={() => void save()}
-                className="inline-flex items-center gap-1.5 px-6 py-2 rounded-xl bg-emerald-600 hover:bg-emerald-700 active:bg-emerald-800 text-white text-sm font-semibold shadow-sm hover:shadow transition-all duration-150 cursor-pointer"
+                className="inline-flex items-center gap-1 px-4 sm:px-6 py-2 rounded-xl bg-emerald-600 hover:bg-emerald-700 active:bg-emerald-800 text-white text-xs sm:text-sm font-semibold shadow-xs transition-all"
               >
                 <span>ذخیره پیشنهاد</span>
                 <Check className="h-4 w-4" />
@@ -511,21 +540,21 @@ export function WizardPage() {
           </div>
         </div>
 
-        {/* دیالوگ ذخیره با فیلدهای خالی */}
+        {/* دیالوگ فیلدهای خالی */}
         <Dialog open={confirmOpen} onOpenChange={setConfirmOpen}>
           <DialogContent>
             <DialogHeader>
               <DialogTitle>فیلدهای خالی</DialogTitle>
             </DialogHeader>
-            <div className="text-[13.5px] leading-7">
+            <div className="text-[13.5px] leading-7 text-gray-700">
-              هنوز تعدادی از فیلد ها خالی هستند. آیا مطمئنی که می خواهید تغییرات را ذخیره کنید؟
+              هنوز تعدادی از فیلدها خالی هستند. آیا مطمئنید که می‌خواهید ادامه دهید؟
             </div>
             <div className="flex flex-wrap gap-x-3 gap-y-1 text-[13px]">
               {emptyFields.map((f) => (
                 <button
                   key={f.step}
                   type="button"
-                  className="cursor-pointer text-accent underline underline-offset-2 hover:text-accent-dark"
+                  className="cursor-pointer text-blue-600 underline underline-offset-2 hover:text-blue-800"
                   onClick={() => {
                     setConfirmOpen(false);
                     goToStep(f.step);
@@ -552,7 +581,7 @@ export function WizardPage() {
                   goToStep(emptyFields[0]?.step ?? 1);
                 }}
               >
-                تکمیل فیلد ها
+                تکمیل فیلدها
               </Button>
             </DialogFooter>
           </DialogContent>

frontend/src/store/index.ts

@@ -7,7 +7,6 @@
 
 import { create } from "zustand";
 import type {
-  CategoryUnit,
   Material,
   Project,
   Quote,
@@ -15,7 +14,6 @@ import type {
   Store,
   Supplier,
   Topic,
-  UnitConversion,
 } from "../lib/types";
 
 interface AppStore {
@@ -24,8 +22,6 @@ interface AppStore {
   materials: Material[];
   projects: Project[];
   quotes: Quote[];
-  categoryUnits: CategoryUnit[];
-  unitConversions: UnitConversion[];
   standardConversions: StandardConversion[];
   topics: Topic[]; // دسته‌بندی‌های ۸گانه — از /material-categories
 
@@ -45,9 +41,6 @@ interface AppStore {
   deleteSupplier: (id: string) => void;
   addMaterial: (m: Material) => void;
   addProject: (p: Project) => void;
-  setCategoryUnit: (cu: CategoryUnit) => void;
-  setConversion: (c: UnitConversion) => void;
-  deleteConversion: (id: string) => void;
   setStandardConversion: (sc: StandardConversion) => void;
   deleteStandardConversion: (id: string) => void;
 
@@ -62,8 +55,6 @@ export const useAppStore = create<AppStore>()((set) => ({
   materials: [],
   projects: [],
   quotes: [],
-  categoryUnits: [],
-  unitConversions: [],
   standardConversions: [],
   topics: [],
 
@@ -77,8 +68,6 @@ export const useAppStore = create<AppStore>()((set) => ({
       materials: store.materials,
       projects: store.projects,
       quotes: store.quotes,
-      categoryUnits: store.categoryUnits,
-      unitConversions: store.unitConversions,
       standardConversions: store.standardConversions,
       topics: store.topics,
     }),
@@ -96,24 +85,6 @@ export const useAppStore = create<AppStore>()((set) => ({
   deleteSupplier: (id) => set((s) => ({ suppliers: s.suppliers.filter((x) => x.id !== id) })),
   addMaterial: (m) => set((s) => ({ materials: [...s.materials, m] })),
   addProject: (p) => set((s) => ({ projects: [...s.projects, p] })),
-  setCategoryUnit: (cu) =>
-    set((s) => {
-      const idx = s.categoryUnits.findIndex((x) => x.id === cu.id);
-      const categoryUnits = [...s.categoryUnits];
-      if (idx >= 0) categoryUnits[idx] = cu;
-      else categoryUnits.push(cu);
-      return { categoryUnits };
-    }),
-  setConversion: (c) =>
-    set((s) => {
-      const idx = s.unitConversions.findIndex((x) => x.id === c.id);
-      const unitConversions = [...s.unitConversions];
-      if (idx >= 0) unitConversions[idx] = c;
-      else unitConversions.push(c);
-      return { unitConversions };
-    }),
-  deleteConversion: (id) =>
-    set((s) => ({ unitConversions: s.unitConversions.filter((x) => x.id !== id) })),
   setStandardConversion: (sc) =>
     set((s) => {
       const idx = s.standardConversions.findIndex((x) => x.id === sc.id);

frontend/src/vite-env.d.ts

@@ -1 +1,10 @@
 /// <reference types="vite/client" />
+
+// Observability build-time configuration (empty = feature disabled)
+interface ImportMetaEnv {
+  readonly VITE_OPENPANEL_URL?: string;
+  readonly VITE_OPENPANEL_CLIENT_ID?: string;
+  readonly VITE_SENTRY_DSN?: string;
+  readonly VITE_ENABLE_DEV_LOGIN?: string;
+  readonly VITE_API_BASE_URL?: string;
+}

infra/deploy-webhook/README.md

@@ -0,0 +1,42 @@
+# Deploy webhook receiver (push-to-deploy, hardened)
+
+Every push to the `production` branch triggers a rebuild on the VPS through
+this receiver (host port 9000). The receiver must **verify the Gitea
+webhook signature** — an open deploy endpoint is effectively remote code
+execution on the production server.
+
+## VPS setup (one time)
+
+```bash
+# 1) Files live here:
+sudo mkdir -p /srv/erp && sudo chown $USER /srv/erp
+#    copy the repo to /srv/erp (the receiver runs docker compose in this dir)
+
+# 2) Secrets — add to /srv/erp/.env (git-ignored):
+#    GITEA_WEBHOOK_SECRET=<long random string>
+
+# 3) Install as a systemd service:
+sudo cp infra/deploy-webhook/erp-deploy-webhook.service /etc/systemd/system/
+#    adjust User= and paths inside, then:
+sudo systemctl daemon-reload
+sudo systemctl enable --now erp-deploy-webhook
+curl http://127.0.0.1:9000/ping   # → {"status":"ok"}
+```
+
+## Gitea webhook
+
+Repo → Settings → Webhooks → Add webhook → Gitea:
+
+- Target URL: `http://<server-ip>:9000/deploy`
+- Method: `POST` — Secret: same value as `GITEA_WEBHOOK_SECRET`
+- Trigger: Push Events, Branch filter: `production`
+
+## Behavior
+
+- Verifies `X-Gitea-Signature` (HMAC-SHA256) — rejects everything else with 401.
+- Only pushes to `refs/heads/production` deploy; other branches are acknowledged and ignored.
+- Deploys are serialized with a lock (concurrent pushes don't race).
+- Runs `docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build` in `/srv/erp`.
+- After a successful build, polls the API `/health/ready` endpoint and logs
+  a failed post-deploy check (surfaced by the monitoring stack).
+- Logs to journald (`journalctl -u erp-deploy-webhook -f`).