feat: catalog read cache (api + user apps) and clearer Zarrin accounting errors

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/modules/accounting-sync/accounting-config.service.ts

@@ -18,6 +18,7 @@ import {
 import { ACCOUNTING_PROVIDERS, AccountingProvider, ProviderName, ProviderSettings, isProviderName } from './providers';
 import { openSecret, sealSecret, secretKeySource } from './secret-box';
 import { parsePemCertificates } from './accounting-http';
+import { CatalogCacheService } from '../catalog/catalog-cache.service';
 
 /** The first certificate of a pasted bundle, for display; null when none parses. */
 function describeCertificate(pem: string | null) {
@@ -59,7 +60,10 @@ export class AccountingConfigService implements OnModuleInit {
   private readonly logger = new Logger('Accounting');
   private cache: { at: number; config: AccountingConfig } | null = null;
 
-  constructor(private readonly prisma: PrismaService) {}
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly catalogCache: CatalogCacheService,
+  ) {}
 
   onModuleInit() {
     if (secretKeySource() !== 'ACCOUNTING_SECRET_KEY') {
@@ -203,6 +207,8 @@ export class AccountingConfigService implements OnModuleInit {
       create: { key: ACCOUNTING_CONFIG_KEY, value: next as unknown as Prisma.InputJsonValue },
     });
     this.cache = null;
+    // The provider and product-sync switch decide which products read as out of stock.
+    this.catalogCache.invalidate();
     return { providerChanged: current.provider !== next.provider };
   }
 

apps/api/src/modules/accounting-sync/accounting-hooks.service.ts

@@ -9,6 +9,12 @@ import { ACCOUNTING_PROVIDERS } from './providers';
 
 type Tx = Prisma.TransactionClient | PrismaService;
 
+type StockFields = {
+  accountingStockAt: Date | null;
+  accountingStockWeight: Prisma.Decimal | null;
+  accountingStockCount: Prisma.Decimal | null;
+};
+
 const OPEN: AccountingOutboxStatus[] = ['PENDING', 'SENDING'];
 
 /**
@@ -150,15 +156,21 @@ export class AccountingHooksService {
    * meaningful while the product sync is on; stock fields of products that are
    * not linked under the active provider are cleared by every product pull.
    */
-  async stockBlocked(product: {
-    accountingStockAt: Date | null;
-    accountingStockWeight: Prisma.Decimal | null;
-    accountingStockCount: Prisma.Decimal | null;
-  }) {
-    if (!product.accountingStockAt) return false;
+  async stockBlocked(product: StockFields) {
+    return (await this.stockBlocker())(product);
+  }
+
+  /**
+   * The same rule as stockBlocked, with the configuration read once — for
+   * checking a whole list without an await per product.
+   */
+  async stockBlocker(): Promise<(product: StockFields) => boolean> {
     const c = await this.config.get();
-    if (c.provider === 'none' || !c.features.products) return false;
-    const stock = product.accountingStockWeight ?? product.accountingStockCount;
-    return stock !== null && new Prisma.Decimal(stock).lte(0);
+    const active = c.provider !== 'none' && c.features.products;
+    return (product) => {
+      if (!active || !product.accountingStockAt) return false;
+      const stock = product.accountingStockWeight ?? product.accountingStockCount;
+      return stock !== null && new Prisma.Decimal(stock).lte(0);
+    };
   }
 }

apps/api/src/modules/accounting-sync/providers/zarrin.provider.spec.ts

@@ -59,6 +59,17 @@ describe('wire format', () => {
     await expect(z.listCustomerGroups(s)).rejects.toThrow('دسترسی مجاز نیست');
   });
 
+  it('shows the server reason on a non-2xx reply, without the token', async () => {
+    http.mockReturnValueOnce(reply('<html><body><h1>Server Error</h1><p>kind=listGorooheHesabha&token=SECRET failed</p></body></html>', 500));
+    const err = await z.listCustomerGroups(s).catch((e) => e);
+    expect(err.message).toContain('HTTP 500 — Server Error');
+    expect(err.message).toContain('failed');
+    expect(err.message).not.toContain('SECRET');
+
+    http.mockReturnValueOnce(reply({ state: false, msg: 'شناسه نامعتبر' }, 400));
+    await expect(z.listCustomerGroups(s)).rejects.toThrow('HTTP 400 — شناسه نامعتبر');
+  });
+
   it('lists the different envelopes Zarrin uses', () => {
     const { listOf, fullJalali } = __zarrinInternals;
     expect(listOf({ data: [1] })).toEqual([1]);
@@ -70,17 +81,76 @@ describe('wire format', () => {
 });
 
 describe('customers', () => {
-  it('pages with Get100Account and fills groups from listhesabha', async () => {
-    const page = Array.from({ length: 100 }, (_, i) => ({ code: 81 + i, name: 'n', namKhanevadegi: `f${i}`, mobile: i === 0 ? '09121112233' : '' }));
-    http
-      .mockReturnValueOnce(reply({ state: true, msg: '', date: page }))
-      .mockReturnValueOnce(reply({ data: [{ id: '81', nam: 'حسین اصغری', gorooh: 'مشتری (خریدار)', tell: '021', mobile: '09121112233', codeMeli: '' }] }));
+  it('lists every account with its group from one listhesabha call', async () => {
+    http.mockReturnValueOnce(
+      reply({
+        data: [
+          { id: '81', nam: 'حسین اصغری', gorooh: 'مشتری (خریدار)', tell: '021', mobile: '09121112233', codeMeli: '' },
+          { id: '82', nam: 'آرین یوسفی', gorooh: 'سازنده (تامین کننده)', tell: '', mobile: '', codeMeli: '' },
+        ],
+      }),
+    );
     const res = await z.listCustomers(s, null);
-    expect(url(0).searchParams.get('id')).toBe('0');
-    expect(url(1).searchParams.get('az')).toBe('81');
-    expect(url(1).searchParams.get('ta')).toBe('180');
+    expect(http).toHaveBeenCalledTimes(1);
+    expect(url(0).searchParams.get('kind')).toBe('listhesabha');
+    expect(url(0).searchParams.get('az')).toBe('1');
+    expect(res.items).toHaveLength(2);
     expect(res.items[0]).toMatchObject({ code: '81', name: 'حسین اصغری', mobile: '09121112233', groupName: 'مشتری (خریدار)', phone: '021' });
-    expect(res.next).toBe('181');
+    expect(res.items[1].mobile).toBeNull();
+    expect(res.next).toBeNull();
+  });
+
+  it('finds by mobile with searchAccount, keeping exact matches only', async () => {
+    http.mockReturnValueOnce(
+      reply({
+        state: true,
+        msg: '',
+        date: [
+          { code: 84, name: 'سعید', namKhanevadegi: 'رجایی', mobile: '09121995971' },
+          { code: 90, name: 'x', namKhanevadegi: 'y', mobile: '09121995972' },
+        ],
+      }),
+    );
+    const found = await z.findCustomersByMobile(s, '09121995971');
+    expect(url(0).searchParams.get('kind')).toBe('searchAccount');
+    expect(found.map((c) => c.code)).toEqual(['84']);
+    expect(found[0].name).toBe('سعید رجایی');
+  });
+
+  it('falls back to listhesabha when searchAccount is missing (bare 400)', async () => {
+    http
+      .mockReturnValueOnce(reply('', 400))
+      .mockReturnValueOnce(reply({ data: [{ id: '84', nam: 'رجایی * سعید', gorooh: 'مشتری (خریدار)', mobile: '09121995971' }, { id: '85', nam: 'z', mobile: '' }] }));
+    const found = await z.findCustomersByMobile(s, '09121995971');
+    expect(url(1).searchParams.get('kind')).toBe('listhesabha');
+    expect(found.map((c) => c.code)).toEqual(['84']);
+  });
+
+  it('does not hide other errors behind the fallback', async () => {
+    http.mockReturnValueOnce(reply('', 500));
+    await expect(z.findCustomersByMobile(s, '09121995971')).rejects.toThrow('HTTP 500');
+  });
+
+  it('lists karsakhte groups with goroohSakhte when the installation has it', async () => {
+    http.mockReturnValueOnce(reply({ state: true, detail: 'OK', data: [{ id: '26', name: 'النگو' }] }));
+    expect(await z.listKarSakhteGroups!(s)).toEqual([{ id: '26', name: 'النگو' }]);
+    expect(http).toHaveBeenCalledTimes(1);
+  });
+
+  it('scans karsakhte groups with infogorooh when goroohSakhte is missing, skipping ids that fail', async () => {
+    http.mockImplementation((req) => {
+      const u = new URL(req.url);
+      if (u.searchParams.get('kind') === 'goroohSakhte') return reply('', 400);
+      const id = u.searchParams.get('id');
+      if (id === '26') return reply({ data: [{ nam: 'النگو', code: 26 }] });
+      if (id === '115') return reply({ data: [{ nam: 'سکه', code: 115 }] });
+      if (id === '3') return reply('', 500);
+      return reply('{\n "data": \n ]\n}');
+    });
+    expect(await z.listKarSakhteGroups!(s)).toEqual([
+      { id: '26', name: 'النگو' },
+      { id: '115', name: 'سکه' },
+    ]);
   });
 
   it('keeps the account in its group on edit', async () => {

apps/api/src/modules/accounting-sync/providers/zarrin.provider.ts

@@ -40,11 +40,51 @@ import {
 const STATEMENT_PAGE = 250;
 const CHANGE_WINDOW = 50;
 const MAX_STATEMENT_PAGES = 20;
+const ALL_CODES = { az: 1, ta: 999999 };
+const GROUP_SCAN_MAX = 300;
+const GROUP_SCAN_CONCURRENCY = 10;
 
 function endpoint(s: ProviderSettings) {
   return s.baseUrl.trim();
 }
 
+class ZarrinHttpError extends AccountingProviderError {
+  constructor(
+    message: string,
+    body: string,
+    readonly status: number,
+  ) {
+    super(message, false, body, status === 404);
+  }
+}
+
+/**
+ * Installations lack some documented kinds (v228 has no Get100Account,
+ * goroohSakhte or getinfoByPhone) and answer them with a bare 400.
+ */
+function isMissingKind(err: unknown) {
+  return err instanceof ZarrinHttpError && err.status === 400;
+}
+
+/**
+ * What the server said on a non-2xx reply, short enough for the admin screen.
+ * Error pages may echo the request URL, so the token is scrubbed.
+ */
+function errorBodyText(body: string, token: string) {
+  let text = body;
+  try {
+    const j = parseLooseJson(body) as any;
+    const o = typeof j === 'string' && /^\s*[{[]/.test(j) ? parseLooseJson(j) : j;
+    if (o && typeof o === 'object') text = str(o.msg) ?? str(o.detail) ?? str(o.message) ?? str(o.Message) ?? str(o.title) ?? JSON.stringify(o);
+    else if (typeof o === 'string') text = o;
+  } catch {
+    text = body.replace(/<(script|style)[\s\S]*?<\/\1>/gi, ' ').replace(/<[^>]+>/g, ' ');
+  }
+  if (token) for (const t of new Set([token, encodeURIComponent(token)])) text = text.split(t).join('***');
+  text = text.replace(/\s+/g, ' ').trim();
+  return text.length > 200 ? `${text.slice(0, 200)}…` : text;
+}
+
 async function call(
   s: ProviderSettings,
   kind: string,
@@ -73,7 +113,8 @@ async function call(
   }
 
   if (res.status < 200 || res.status >= 300) {
-    throw new AccountingProviderError(`زرین (${kind}): HTTP ${res.status}`, false, res.body.slice(0, 500), res.status === 404);
+    const reason = errorBodyText(res.body, s.token);
+    throw new ZarrinHttpError(`زرین (${kind}): HTTP ${res.status}${reason ? ` — ${reason}` : ''}`, res.body.slice(0, 500), res.status);
   }
 
   let json: unknown;
@@ -96,7 +137,7 @@ async function call(
   return json as Record<string, unknown> | unknown[];
 }
 
-/** Zarrin wraps lists as `data`, once as `date` (Get100Account), or not at all. */
+/** Zarrin wraps lists as `data`, sometimes as `date` (searchAccount), or not at all. */
 function listOf(json: unknown): Record<string, unknown>[] {
   if (Array.isArray(json)) return json as Record<string, unknown>[];
   if (json && typeof json === 'object') {
@@ -128,6 +169,21 @@ function fullJalali(v: unknown): string {
   return `14${m[1]}/${m[2].padStart(2, '0')}/${m[3].padStart(2, '0')}`;
 }
 
+async function allAccounts(s: ProviderSettings): Promise<ExternalCustomer[]> {
+  return listOf(await call(s, 'listhesabha', ALL_CODES))
+    .filter((r) => r.id !== undefined)
+    .map((r) => ({
+      code: String(r.id),
+      name: str(r.nam) ?? String(r.id),
+      mobile: normalizeMobile(r.mobile),
+      phone: str(r.tell),
+      nationalCode: str(r.codeMeli),
+      address: str(r.address),
+      groupId: null,
+      groupName: str(r.gorooh),
+    }));
+}
+
 function signed(s: ProviderSettings, v: Prisma.Decimal) {
   // Until checked on a real installation (plan §9) the sign is a setting.
   return (s.balanceOwesWhen ?? 'negative') === 'negative' ? v.negated() : v;
@@ -152,35 +208,10 @@ export const zarrinProvider: AccountingProvider = {
     }));
   },
 
-  async listCustomers(s, cursor) {
-    const from = Number(cursor ?? 0) || 0;
-    // Get100Account pages by code (100 accounts from `id` on) but carries no
-    // group or address; listhesabha over the same code span fills those in.
-    const page = listOf(await call(s, 'Get100Account', { id: from }));
-    if (page.length === 0) return { items: [], next: null };
-
-    const codes = page.map((r) => Number(r.code)).filter(Number.isFinite);
-    const lo = Math.min(...codes);
-    const hi = Math.max(...codes);
-    const details = new Map<string, Record<string, unknown>>();
-    for (const r of listOf(await call(s, 'listhesabha', { az: lo, ta: hi }))) details.set(String(r.id), r);
-
-    const items: ExternalCustomer[] = page.map((r) => {
-      const code = String(r.code);
-      const d = details.get(code) ?? {};
-      return {
-        code,
-        name: str(d.nam) ?? joinName(r.name, r.namKhanevadegi),
-        mobile: normalizeMobile(d.mobile ?? r.mobile),
-        phone: str(d.tell),
-        nationalCode: str(d.codeMeli),
-        address: str(d.address),
-        groupId: null,
-        groupName: str(d.gorooh),
-      };
-    });
-    const next = page.length < 100 ? null : String(hi + 1);
-    return { items, next };
+  async listCustomers(s) {
+    // listhesabha carries everything (group, mobile, address) and returns the
+    // whole code span in one reply (~865 accounts in under 2 s).
+    return { items: await allAccounts(s), next: null };
   },
 
   async findCustomersByMobile(s, mobile) {
@@ -188,20 +219,22 @@ export const zarrinProvider: AccountingProvider = {
     if (!target) return [];
     let rows: Record<string, unknown>[];
     try {
-      rows = listOf(await call(s, 'getinfoByPhone', { number: target }));
+      // Matches on name or mobile, possibly partially; filtered exactly below.
+      rows = listOf(await call(s, 'searchAccount', { search: target }));
     } catch (err) {
       if (err instanceof AccountingProviderError && err.notFound) return [];
-      throw err;
+      if (!isMissingKind(err)) throw err;
+      return (await allAccounts(s)).filter((c) => c.mobile === target);
     }
     return rows
       .filter((r) => r.code !== undefined && normalizeMobile(r.mobile) === target)
       .map((r) => ({
         code: String(r.code),
-        name: joinName(r.nam, r.namKhanevadegi),
+        name: joinName(r.name, r.namKhanevadegi),
         mobile: target,
-        phone: str(r.tel),
+        phone: null,
         nationalCode: null,
-        address: str(r.address),
+        address: null,
         groupId: null,
         groupName: null,
       }));
@@ -333,7 +366,30 @@ export const zarrinProvider: AccountingProvider = {
   },
 
   async listKarSakhteGroups(s) {
-    return listOf(await call(s, 'goroohSakhte')).map((g) => ({ id: String(g.id), name: str(g.name) ?? String(g.id) }));
+    try {
+      return listOf(await call(s, 'goroohSakhte')).map((g) => ({ id: String(g.id), name: str(g.name) ?? String(g.id) }));
+    } catch (err) {
+      if (!isMissingKind(err)) throw err;
+    }
+    // Without goroohSakhte the only way is one infogorooh per id. Ids are
+    // sparse and unknown ids fail (some with a 500), so failures are skipped.
+    const found: { id: string; name: string }[] = [];
+    let next = 1;
+    const worker = async () => {
+      while (next <= GROUP_SCAN_MAX) {
+        const id = next++;
+        try {
+          for (const g of listOf(await call(s, 'infogorooh', { id }))) {
+            const name = str(g.nam);
+            if (name) found.push({ id: String(g.code ?? id), name });
+          }
+        } catch {
+          // not a group
+        }
+      }
+    };
+    await Promise.all(Array.from({ length: GROUP_SCAN_CONCURRENCY }, worker));
+    return found.sort((a, b) => Number(a.id) - Number(b.id));
   },
 
   async listKarSakhteTypes(s) {