migration

apps/api/src/modules/accounting-sync/accounting-sync.service.ts

@@ -1,6 +1,7 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { AccountingOutbox, Prisma } from '@prisma/client';
 import { PrismaService } from '../../prisma/prisma.service';
+import { OTP_ONLY_PASSWORD_HASH } from '../auth/password-hash';
 import { ActiveProvider, AccountingConfigService } from './accounting-config.service';
 import { AccountingConfig } from './accounting-config';
 import { JalaliDate, parseJalali, toJalali } from './jalali';
@@ -181,21 +182,17 @@ export class AccountingSyncService {
    * An account that exists only in the accounting software becomes an app
    * customer, keyed by mobile (owner: «اولویت با شماره هست نه کد ملی»). The
    * national code is the account's own when it is a real one and still free,
-   * else the mobile — the fallback admin-customers and customer-auth already use.
+   * else none (the column is optional since 2026-10-07 and holds national
+   * codes only — never the mobile or a made-up key).
    * Credit limit 0 and UNVERIFIED: everything beyond identity is the app's.
+   * OTP-only: an imported account has no app password.
    */
   private async importCustomer(provider: ProviderName, ext: ExternalCustomer): Promise<string> {
     const mobile = ext.mobile as string;
-    const candidates = [validNationalCode(ext.nationalCode), mobile, `${mobile}-${provider}-${ext.code}`].filter(
-      (v): v is string => !!v,
-    );
-    let nationalCode = candidates[candidates.length - 1];
-    for (const c of candidates) {
-      const taken = await this.prisma.customer.findUnique({ where: { nationalCode: c }, select: { id: true } });
-      if (!taken) {
-        nationalCode = c;
-        break;
-      }
+    let nationalCode = validNationalCode(ext.nationalCode);
+    if (nationalCode) {
+      const taken = await this.prisma.customer.findUnique({ where: { nationalCode }, select: { id: true } });
+      if (taken) nationalCode = null;
     }
     const { firstName, lastName } = splitName(ext.name || mobile);
 
@@ -208,7 +205,7 @@ export class AccountingSyncService {
           lastName: lastName || null,
           mobile,
           nationalCode,
-          passwordHash: '',
+          passwordHash: OTP_ONLY_PASSWORD_HASH,
           phone: ext.phone,
           address: ext.address,
         },