# Inventory — apps/api (target backend)

Evidence-based inventory. All `path:line` citations are relative to `apps/api/`.
Read-only audit; no source file was modified.

---

## 1. Stack & versions

Source: `package.json`.

| Item | Value | Cite |
|---|---|---|
| Package name / version | `api` @ `0.0.1`, private | package.json:2-4 |
| NestJS core | `@nestjs/core` ^10.4.0 | package.json:27 |
| NestJS common | `@nestjs/common` ^10.4.0 | package.json:26 |
| NestJS platform | `@nestjs/platform-express` ^10.4.0 | package.json:30 |
| NestJS JWT | `@nestjs/jwt` ^12.0.1 | package.json:28 |
| NestJS Passport | `@nestjs/passport` ^10.0.3 | package.json:29 |
| Prisma client | `@prisma/client` ^5.19.0 | package.json:31 |
| Prisma CLI (dev) | `prisma` ^5.19.0 | package.json:47 |
| bcryptjs | ^3.0.3 | package.json:32 |
| class-transformer | ^0.5.1 | package.json:33 |
| class-validator | ^0.14.1 | package.json:34 |
| passport / passport-jwt | ^0.7.0 / ^4.0.1 | package.json:35-36 |
| rxjs | ^7.8.1 | package.json:38 |
| Workspace dep | `@gold-bank/shared-types` (workspace:*) | package.json:25 |
| TypeScript | ^5.5.0 | package.json:50 |
| esbuild (release bundler) | ^0.25.0 | package.json:46 |
| ts-node | ^10.9.2 | package.json:49 |

**NOT present** (relevant negatives): no `@nestjs/config`, no `@nestjs/schedule`, no `@nestjs/websockets`/`socket.io`, no `@nestjs/swagger`, no `@nestjs/throttler`, no HTTP client (axios), no SMS/payment SDK, no `multer` types (multer ships inside platform-express; a local interface is declared instead — admin-uploads.controller.ts:21-26).

Scripts: `dev` = `nest start --watch`; `build:release` = prisma generate → clean-dist → nest build → bundle-release (package.json:7-9). Prisma seed command: `ts-node --transpile-only prisma/seed.ts` (package.json:19-21).

---

## 2. Bootstrap

### 2.1 `src/main.ts`

| Concern | Value | Cite |
|---|---|---|
| Pre-boot hook | `await prepareDatabase()` — runs SQL migrations + one-time seed BEFORE Nest is created | main.ts:19 |
| App type | `NestExpressApplication` | main.ts:21 |
| Global prefix | `api` | main.ts:22 |
| Global pipe | `ValidationPipe({ whitelist: true, transform: true })` — no `forbidNonWhitelisted`, no `transformOptions` | main.ts:23 |
| Global filter | `PrismaExceptionFilter` | main.ts:24 |
| Global interceptors | **NONE registered** | (absent in main.ts) |
| CORS | `app.enableCors()` — defaults, i.e. `origin: *`, no credentials, no allowlist | main.ts:25 |
| Static assets | `useStaticAssets(UPLOAD_DIR ?? cwd/storage/uploads, { prefix: '/uploads/', index:false, dotfiles:'deny' })` — mounted OUTSIDE the `api` prefix | main.ts:28-36 |
| Custom MIME | `.avif → image/avif` injected via `setHeaders` (serve-static's bundled mime predates avif) | main.ts:11-16, 32-35 |
| Port | `Number(process.env.PORT ?? 3000)` | main.ts:37 |
| Bind host | `0.0.0.0` (explicit, for nginx/container reachability) | main.ts:41 |
| EADDRINUSE | Logs guidance and `process.exit(1)`; explicitly does NOT fall back to another port | main.ts:42-52 |

Global guards are NOT registered in main.ts — they are registered via `APP_GUARD` in AuthModule (see §9).

### 2.2 `src/app.module.ts`

`@Module({ imports: [...] })`, no controllers/providers of its own (app.module.ts:28-57). 24 imported modules, in declared order:

| # | Module | Cite |
|---|---|---|
| 1 | PrismaModule | app.module.ts:30 |
| 2 | AuthModule | app.module.ts:31 |
| 3 | AdminTableModule | app.module.ts:32 |
| 4 | AdminOrdersModule | app.module.ts:33 |
| 5 | AdminCitiesModule | app.module.ts:34 |
| 6 | AdminPreOrdersModule | app.module.ts:35 |
| 7 | AdminWorkshopsModule | app.module.ts:36 |
| 8 | AdminCustomersModule | app.module.ts:37 |
| 9 | AdminCommentsModule | app.module.ts:38 |
| 10 | AdminProductsModule | app.module.ts:39 |
| 11 | AdminCategoriesModule | app.module.ts:40 |
| 12 | AdminDocumentsModule | app.module.ts:41 |
| 13 | AdminPromotionsModule | app.module.ts:42 |
| 14 | AdminUsersModule | app.module.ts:43 |
| 15 | AdminBranchesModule | app.module.ts:44 |
| 16 | AdminInvoicesModule | app.module.ts:45 |
| 17 | AdminMiscModule | app.module.ts:46 |
| 18 | AdminUploadsModule | app.module.ts:47 |
| 19 | AdminDashboardModule | app.module.ts:48 |
| 20 | CatalogModule | app.module.ts:49 |
| 21 | CustomersModule | app.module.ts:50 |
| 22 | SalesAgentModule | app.module.ts:51 |
| 23 | OrdersModule | app.module.ts:52 |
| 24 | AccountingModule | app.module.ts:53 |
| 25 | PricingModule | app.module.ts:54 |

(25 entries; `PrismaModule` is infrastructure, giving 24 feature/infra modules under `src/modules/` + prisma.)

---

## 3. Modules (every module under `src/`)

| Module file | Controllers | Services / Providers | Imports | Exports |
|---|---|---|---|---|
| `src/prisma/prisma.module.ts` | — | PrismaService (prisma.module.ts:6) | — | PrismaService (:7) |
| `src/modules/auth/auth.module.ts` | AuthController (:24) | AuthService, JwtStrategy, `APP_GUARD`→JwtAuthGuard, `APP_GUARD`→PermissionsGuard (:25-31) | PrismaModule, PassportModule, `JwtModule.register` (:12-23) | AuthService (:32) |
| `src/modules/admin-table/admin-table.module.ts` | — | TableService (:10) | — | TableService (:11) |
| `src/modules/admin-orders/admin-orders.module.ts` | AdminOrdersController (:9) | AdminOrdersService (:10) | PrismaModule, OrdersModule (:8) | — |
| `src/modules/admin-cities/admin-cities.module.ts` | AdminCitiesController (:7) | — (uses PrismaService directly in controller, admin-cities.controller.ts:13) | PrismaModule (:6) | — |
| `src/modules/admin-preorders/admin-preorders.module.ts` | AdminPreOrdersController (:8) | AdminPreOrdersService (:9) | PrismaModule (:7) | — |
| `src/modules/admin-workshops/admin-workshops.module.ts` | AdminWorkshopsController (:8) | — (reuses AdminBranchesService) | PrismaModule, AdminBranchesModule (:7) | — |
| `src/modules/admin-customers/admin-customers.module.ts` | AdminCustomersController (:8) | AdminCustomersService (:9) | PrismaModule (:7) | AdminCustomersService (:10) |
| `src/modules/admin-comments/admin-comments.module.ts` | AdminCommentsController (:8) | AdminCommentsService (:9) | PrismaModule (:7) | — |
| `src/modules/admin-products/admin-products.module.ts` | AdminProductsController (:8) | AdminProductsService (:9) | PrismaModule (:7) | — |
| `src/modules/admin-categories/admin-categories.module.ts` | AdminCategoriesController (:8) | AdminCategoriesService (:9) | PrismaModule (:7) | — |
| `src/modules/admin-documents/admin-documents.module.ts` | AdminDocumentsController (:9) | AdminDocumentsService (:10) | PrismaModule, AccountingModule (:8) | — |
| `src/modules/admin-promotions/admin-promotions.module.ts` | AdminPromotionsController (:8) | AdminPromotionsService (:9) | PrismaModule (:7) | — |
| `src/modules/admin-users/admin-users.module.ts` | AdminUsersController (:8) | AdminUsersService (:9) | PrismaModule (:7) | — |
| `src/modules/admin-branches/admin-branches.module.ts` | AdminBranchesController (:8) | AdminBranchesService (:9) | PrismaModule (:7) | AdminBranchesService (:12) |
| `src/modules/admin-invoices/admin-invoices.module.ts` | AdminInvoicesController (:8) | AdminInvoicesService (:9) | PrismaModule (:7) | — |
| `src/modules/admin-misc/admin-misc.module.ts` | AdminMiscController, **PublicSliderController** (:9) | AdminMiscService (:10) | PrismaModule (:8) | — |
| `src/modules/admin-uploads/admin-uploads.module.ts` | AdminUploadsController, **PublicUploadsController** (:9) | AdminUploadsService (:10) | PrismaModule (:8) | AdminUploadsService (:11) |
| `src/modules/admin-dashboard/admin-dashboard.module.ts` | AdminDashboardController (:8) | AdminDashboardService (:9) | PrismaModule (:7) | — |
| `src/modules/catalog/catalog.module.ts` | CatalogController (:6) | CatalogService (:7) | — | CatalogService (:8) |
| `src/modules/customers/customers.module.ts` | CustomersController (:6) | CustomersService (:7) | — | CustomersService (:8) |
| `src/modules/sales-agent/sales-agent.module.ts` | SalesAgentController (:6) | SalesAgentService (:7) | — | SalesAgentService (:8) |
| `src/modules/orders/orders.module.ts` | OrdersController (:9) | OrdersService (:10) | CatalogModule, AccountingModule (:8) | OrdersService (:11) |
| `src/modules/accounting/accounting.module.ts` | AccountingController (:6) | LedgerService (:7) | — | LedgerService (:8) |
| `src/modules/pricing/pricing.module.ts` | PricingController (:6) | PricingService (:7) | — | PricingService (:8) |

**Controllers: 25.** **Services: 22** (+ TableService, PrismaService).

---

## 4. Endpoints (exhaustive)

Global prefix `api` (main.ts:22) is included in every path below. `@Public()` = JwtAuthGuard bypassed (guards.ts:15). No `@RequirePermission` = authenticated but no rid check.

### 4.1 AuthController — `@Controller('admin/auth')` (auth.controller.ts:15)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/auth/login` | `login` (auth.controller.ts:22) | `@Public()`, `@HttpCode(200)` (:19,21) | `LoginDto` (:22) |
| GET | `/api/admin/auth/me` | `me` (auth.controller.ts:28) | auth required; `@CurrentAdmin()` (:28) | — |

### 4.2 AdminOrdersController — `@Controller('admin/orders')` (admin-orders.controller.ts:16)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/orders/list` | `list` (:24) | `@HttpCode(200)`, `@RequirePermission('order.list')` (:22-23), `@CurrentAdmin()` | `TableQueryDto` (:24) |
| POST | `/api/admin/orders/wholesale/list` | `listWholesale` (:46) | `@HttpCode(200)`, `@RequirePermission('order.omde')` (:44-45) | `TableQueryDto` |
| POST | `/api/admin/orders/tamin/list` | `listTamin` (:54) | `@HttpCode(200)`, `@RequirePermission('order.tamin')` (:52-53) | `TableQueryDto` |
| POST | `/api/admin/orders/delete` | `remove` (:62) | `@HttpCode(200)`, `@RequirePermission('order.omde')` (:60-61) | inline `{ id: string }` |
| POST | `/api/admin/orders/create` | `createFromAdmin` (:70) | `@HttpCode(200)`, `@RequirePermission('order.create')` (:68-69), `@CurrentAdmin()` | inline `{ customer_id, order_items[], sts?, note? }` (:72-77) |
| GET | `/api/admin/orders/type-options` | `typeOptions` (:86) | `@RequirePermission('order.create')` (:85) | — |
| GET | `/api/admin/orders/status-options` | `statusOptions` (:92) | `@RequirePermission('order.list')` (:91) | — |
| POST | `/api/admin/orders/status` | `setStatus` (:100) | `@HttpCode(200)`, `@RequirePermission('order.list')` (:98-99), `@CurrentAdmin()` | `UpdateOrderStatusDto` (admin-orders/update-status.dto.ts) |
| GET | `/api/admin/orders/:id` | `findOne` (:106) | `@RequirePermission('order.list')` (:105) | — |

### 4.3 AdminCitiesController — `@Controller('admin/cities')` (admin-cities.controller.ts:11)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/cities/list` | `list` (:17) | `@HttpCode(200)`; **no rid, but NOT `@Public()`** → JWT still required (:8-10 comment claims ungated; only the rid check is skipped) | — |

### 4.4 AdminPreOrdersController — `@Controller('admin/pre-orders')` (admin-preorders.controller.ts:13)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/pre-orders/list` | `list` (:20) | `@HttpCode(200)`, `@RequirePermission('order.makeOrder')` (:18-19) | `TableQueryDto` |
| GET | `/api/admin/pre-orders/status-options` | `statusOptions` (:26) | `@RequirePermission('order.makeOrder')` (:25) | — |
| GET | `/api/admin/pre-orders/:id` | `findOne` (:32) | `@RequirePermission('order.makeOrder')` (:31) | — |
| PUT | `/api/admin/pre-orders/:id` | `update` (:38) | `@RequirePermission('order.makeOrder')` (:37) | `Record<string, unknown>` (untyped) |
| DELETE | `/api/admin/pre-orders/:id` | `remove` (:44) | `@RequirePermission('order.makeOrder')` (:43) | — |

### 4.5 AdminWorkshopsController — `@Controller('admin/workshops')` (admin-workshops.controller.ts:18)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/workshops/list` | `list` (:24) | `@HttpCode(200)`; **no rid** (:22-23) | `TableQueryDto` |
| POST | `/api/admin/workshops` | `create` (:31) | `@HttpCode(200)`, `@RequirePermission('workshop.create')` (:29-30) | `Record<string, unknown>` |
| GET | `/api/admin/workshops/active/:id` | `toggleActive` (:37) | `@RequirePermission('workshop.list')` (:36) | — |
| GET | `/api/admin/workshops/:id` | `findOne` (:43) | `@RequirePermission('workshop.list')` (:42) | — |
| PUT | `/api/admin/workshops/:id` | `update` (:49) | `@RequirePermission('workshop.list')` (:48) | `Record<string, unknown>` |

### 4.6 AdminCustomersController — `@Controller('admin/customers-omde')` (admin-customers.controller.ts:17)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/customers-omde/list` | `listAll` (:28) | `@HttpCode(200)`, `@RequirePermission('persons.list.client.omde')` (:26-27) | `TableQueryDto` |
| POST | `/api/admin/customers-omde/banker/list` | `listBanker` (:35) | `@HttpCode(200)`, `persons.list.client.omde` (:33-34) | `TableQueryDto` |
| POST | `/api/admin/customers-omde/shopkeeper/list` | `listShopkeeper` (:42) | `@HttpCode(200)`, `persons.list.client.omde` (:40-41) | `TableQueryDto` |
| POST | `/api/admin/customers-omde/non-verified/list` | `listNonVerified` (:49) | `@HttpCode(200)`, `persons.list.client.omde` (:47-48) | `TableQueryDto` |
| POST | `/api/admin/customers-omde/archived/list` | `listArchived` (:56) | `@HttpCode(200)`, `persons.list.client.omde` (:54-55) | `TableQueryDto` |
| POST | `/api/admin/customers-omde/single/list` | `listSingle` (:64) | `@HttpCode(200)`, `persons.list.client.single` (:62-63), `@CurrentAdmin()` (branch scoping :65) | `TableQueryDto` |
| POST | `/api/admin/customers-omde/single` | `createSingle` (:72) | `@HttpCode(200)`, `persons.create` (:70-71) | `Record<string, unknown>` |
| GET | `/api/admin/customers-omde/query/reagent` | `queryReagents` (:82) | `@RequirePermission('persons.create')` (:81) | — |
| POST | `/api/admin/customers-omde/wallet/charge` | `chargeWallet` (:90) | `@HttpCode(200)`, `@RequirePermission('wallet')` (:88-89) | inline `{ customer_id, value }` |
| POST | `/api/admin/customers-omde/create` | `create` (:97) | `@HttpCode(200)`, `persons.create` (:95-96) | `Record<string, unknown>` |
| PUT | `/api/admin/customers-omde/:id` | `update` (:103) | `persons.list.client.omde.edit` (:102) | `Record<string, unknown>` |
| POST | `/api/admin/customers-omde/reagent/list` | `listReagents` (:111) | `@HttpCode(200)`, `persons.list.sellers` (:109-110) | `TableQueryDto` |
| GET | `/api/admin/customers-omde/reagent/:id` | `reagentDetail` (:118) | `persons.list.sellers.view` (:117) | — |
| GET | `/api/admin/customers-omde/:id/orders` | `customerOrders` (:125) | `persons.list.client.omde.view.orders` (:124) | — |
| GET | `/api/admin/customers-omde/:id/documents` | `customerDocuments` (:132) | `persons.list.client.omde.view.documents` (:131) | — |
| GET | `/api/admin/customers-omde/:id/wallet` | `customerWallet` (:139) | `@RequirePermission('wallet')` (:138) | — |
| GET | `/api/admin/customers-omde/dashboard/:id` | `dashboard` (:145) | `persons.list.client.omde.view` (:144) | — |
| GET | `/api/admin/customers-omde/archive/:id` | `toggleArchive` (:151) | `persons.list.client.omde.edit` (:150) | — |
| POST | `/api/admin/customers-omde/toggle-active` | `toggleActive` (:158) | `@HttpCode(200)`, `persons.list.client.omde.edit` (:156-157) | inline `{ id }` |
| POST | `/api/admin/customers-omde/toggle-sts` | `toggleSts` (:165) | `@HttpCode(200)`, `persons.list.client.omde.edit` (:163-164) | inline `{ id }` |
| POST | `/api/admin/customers-omde/verify` | `verify` (:172) | `@HttpCode(200)`, `persons.list.client.omde.edit` (:170-171) | inline `{ customer_id, sts_verify_step_one?, sts_verify_step_two? }` (:174) |
| POST | `/api/admin/customers-omde/credit` | `updateCredit` (:182) | `@HttpCode(200)`, `persons.list.client.omde.edit` (:180-181) | inline `{ id, gram_level?, percent? }` |
| GET | `/api/admin/customers-omde/:id` | `findOne` (:188) | `persons.list.client.omde.view` (:187) | — |

### 4.7 AdminCommentsController — `@Controller('admin/comments')` (admin-comments.controller.ts:15)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/comments/list` | `list` (:22) | `@HttpCode(200)`, `@RequirePermission('comment')` (:20-21) | `TableQueryDto` |
| GET | `/api/admin/comments/status-options` | `statusOptions` (:28) | `comment` (:27) | — |
| POST | `/api/admin/comments/sts` | `changeStatus` (:35) | `@HttpCode(200)`, `comment` (:33-34) | inline `{ id: string; sts: number }` |
| POST | `/api/admin/comments` | `create` (:42) | `@HttpCode(200)`, `comment` (:40-41) | inline `{ product_id, customer_id, comment, reply_to? }` (:43) |
| GET | `/api/admin/comments/:id` | `findOne` (:50) | `comment` (:49) | — |
| DELETE | `/api/admin/comments/:id` | `remove` (:56) | `comment` (:55) | — |

### 4.8 AdminProductsController — `@Controller('admin/products')` (admin-products.controller.ts:18)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/products/list` | `list` (:25) | `@HttpCode(200)`, `product.list` (:23-24) | `TableQueryDto` |
| POST | `/api/admin/products/variants/list` | `listVariants` (:32) | `@HttpCode(200)`, `product.list` (:30-31) | `TableQueryDto & { product_id? }` |
| POST | `/api/admin/products/by-ids` | `byIds` (:44) | `@HttpCode(200)`, `product.list` (:42-43) | inline `{ products_id: string[] }` |
| POST | `/api/admin/products/variants/create` | `createVariant` (:55) | `@HttpCode(200)`, **`order.create`** (:53-54) | inline `{ product_id, title, grams }` |
| GET | `/api/admin/products/show-type-options` | `showTypeOptions` (:61) | `product.list` (:60) | — |
| GET | `/api/admin/products/brands` | `brands` (:67) | `product.list` (:66) | — |
| POST | `/api/admin/products/brands-table` | `brandsTable` (:75) | `@HttpCode(200)`, `product.list` (:73-74) | `TableQueryDto` |
| GET | `/api/admin/products/collections` | `collections` (:82) | `product.list` (:81) | — |
| POST | `/api/admin/products/change-percent/count` | `changePercentCount` (:89) | `@HttpCode(200)`, `product.percent` (:87-88) | inline `{ brand_id?, category_id? }` |
| POST | `/api/admin/products/change-percent/apply` | `changePercent` (:96) | `@HttpCode(200)`, `product.percent` (:94-95) | inline `{ percent, brand_id?, category_id? }` |
| POST | `/api/admin/products/create` | `create` (:103) | `@HttpCode(200)`, `product.create` (:101-102) | `Record<string, unknown>` |
| POST | `/api/admin/products/delete/:id` | `remove` (:110) | `@HttpCode(200)`, `product.list.edit` (:108-109) | — |
| GET | `/api/admin/products/:id/variants` | `variantsOf` (:116) | `product.list` (:115) | — |
| GET | `/api/admin/products/:id` | `findOne` (:122) | `product.list` (:121) | — |
| PUT | `/api/admin/products/:id` | `update` (:128) | `product.list.edit` (:127) | `Record<string, unknown>` |

### 4.9 AdminCategoriesController — `@Controller('admin/categories')` (admin-categories.controller.ts:14)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/categories/list` | `list` (:21) | `@HttpCode(200)`, `collection.list` (:19-20) | `TableQueryDto` |
| GET | `/api/admin/categories/tree` | `tree` (:27) | `collection.list` (:26); `@Query('type')` | — |
| GET | `/api/admin/categories/type-options` | `typeOptions` (:33) | `collection.list` (:32) | — |
| POST | `/api/admin/categories/collections/list` | `listCollections` (:41) | `@HttpCode(200)`, `collection.list` (:39-40) | `TableQueryDto` |
| POST | `/api/admin/categories/collections` | `createCollection` (:48) | `@HttpCode(200)`, `collection.create` (:46-47) | inline `{ title, description?, is_active? }` |
| PUT | `/api/admin/categories/collections/:id` | `updateCollection` (:53) | `collection.list.edit` (:52) | inline `{ title?, description?, is_active? }` |
| DELETE | `/api/admin/categories/collections/:id` | `removeCollection` (:63) | `collection.list.edit` (:62) | — |
| POST | `/api/admin/categories` | `create` (:71) | `@HttpCode(200)`, `collection.create` (:69-70) | `Record<string, unknown>` |
| GET | `/api/admin/categories/:id` | `findOne` (:77) | `collection.list` (:76) | — |
| PUT | `/api/admin/categories/:id` | `update` (:83) | `collection.list.edit` (:82) | `Record<string, unknown>` |
| DELETE | `/api/admin/categories/:id` | `remove` (:89) | `collection.list.edit` (:88) | — |

### 4.10 AdminDocumentsController — `@Controller('admin/documents')` (admin-documents.controller.ts:17)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/documents/list` | `list` (:24) | `@HttpCode(200)`, `document.list` (:22-23) | `TableQueryDto` |
| GET | `/api/admin/documents/type-options` | `typeOptions` (:30) | `document.list` (:29) | — |
| GET | `/api/admin/documents/query/customer` | `queryCustomers` (:36) | `document.create` (:35) | — |
| POST | `/api/admin/documents/wallet/list` | `listWallet` (:43) | `@HttpCode(200)`, `wallet` (:41-42) | `TableQueryDto` |
| GET | `/api/admin/documents/wallet/config` | `getWalletConfig` (:50) | `config.wallet` (:49) | — |
| POST | `/api/admin/documents/wallet/config` | `setWalletConfig` (:57) | `@HttpCode(200)`, `config.wallet` (:55-56) | `Record<string, unknown>` |
| GET | `/api/admin/documents/wallet/birthday/config` | `getBirthdayConfig` (:63) | `config.wallet` (:62) | — |
| POST | `/api/admin/documents/wallet/birthday/config` | `setBirthdayConfig` (:70) | `@HttpCode(200)`, `config.wallet` (:68-69) | `Record<string, unknown>` |
| POST | `/api/admin/documents` | `create` (:77) | `@HttpCode(200)`, `document.create` (:75-76), `@CurrentAdmin()` | `Record<string, unknown>` |
| POST | `/api/admin/documents/:id/confirm` | `toggleConfirm` (:85) | `@HttpCode(200)`, `document.list.edit` (:83-84), `@CurrentAdmin()` | — |
| GET | `/api/admin/documents/:id` | `findOne` (:91) | `document.list` (:90) | — |
| PUT | `/api/admin/documents/:id` | `update` (:97) | `document.list.edit` (:96) | `Record<string, unknown>` |
| DELETE | `/api/admin/documents/:id` | `remove` (:103) | `document.list.edit` (:102) | — |

### 4.11 AdminPromotionsController — `@Controller('admin/promotions')` (admin-promotions.controller.ts:12)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/promotions/list` | `list` (:19) | `@HttpCode(200)`, `offers.list` (:17-18) | `TableQueryDto` |
| GET | `/api/admin/promotions/scope-options` | `scopeOptions` (:25) | `offers.list` (:24) | — |
| GET | `/api/admin/promotions/usage-options` | `usageOptions` (:31) | `offers.list` (:30) | — |
| GET | `/api/admin/promotions/auto` | `getAutoPromotion` (:37) | `offers.autopromotion` (:36) | — |
| POST | `/api/admin/promotions/auto` | `setAutoPromotion` (:44) | `@HttpCode(200)`, `offers.autopromotion` (:42-43) | inline `{ state?, discount_percent? }` |
| GET | `/api/admin/promotions/exclusions` | `listExclusions` (:51) | `offersIgnore` (:50) | — |
| POST | `/api/admin/promotions/exclusions` | `createExclusion` (:58) | `@HttpCode(200)`, `offersIgnore` (:56-57) | inline `{ type: number; item_id?: string[] }` |
| DELETE | `/api/admin/promotions/exclusions/:id` | `removeExclusion` (:64) | `offersIgnore` (:63) | — |
| POST | `/api/admin/promotions` | `create` (:72) | `@HttpCode(200)`, `offers.create` (:70-71) | `Record<string, unknown>` |
| GET | `/api/admin/promotions/:id` | `findOne` (:78) | `offers.list` (:77) | — |
| PUT | `/api/admin/promotions/:id` | `update` (:84) | `offers.list.edit` (:83) | `Record<string, unknown>` |
| DELETE | `/api/admin/promotions/:id` | `remove` (:90) | `offers.list.edit` (:89) | — |

### 4.12 AdminUsersController — `@Controller('admin/users')` (admin-users.controller.ts:16)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/users/list` | `list` (:23) | `@HttpCode(200)`, `user.list` (:21-22) | `TableQueryDto` |
| GET | `/api/admin/users/role-options` | `roleOptions` (:29) | `user.list` (:28) | — |
| GET | `/api/admin/users/types` | `listUserTypes` (:36) | `user.list` (:35) | — |
| POST | `/api/admin/users/types` | `createUserType` (:44) | `@HttpCode(200)`, `user.permission.create` (:42-43) | inline `{ val?, title? }` |
| GET | `/api/admin/users/types/:ut/roles` | `getRoles` (:51) | `user.permission` (:50) | — |
| POST | `/api/admin/users/roles` | `setRoles` (:59) | `@HttpCode(200)`, `user.permission.edit` (:57-58) | inline `{ ut, roles: string[] }` |
| DELETE | `/api/admin/users/types/:ut/roles/:rid` | `revokeRole` (:66) | `user.permission.edit` (:65) | — |
| GET | `/api/admin/users/me` | `myData` (:72) | auth only, **no rid**; `@CurrentAdmin()` (:71-72) | — |
| POST | `/api/admin/users` | `create` (:79) | `@HttpCode(200)`, `user.create` (:77-78) | `Record<string, unknown>` |
| GET | `/api/admin/users/:id` | `findOne` (:85) | `user.list` (:84) | — |
| PUT | `/api/admin/users/:id` | `update` (:91) | `user.list.edit` (:90) | `Record<string, unknown>` |
| DELETE | `/api/admin/users/:id` | `remove` (:97) | `user.list.remove` (:96), `@CurrentAdmin()` | — |

### 4.13 AdminBranchesController — `@Controller('admin/branches')` (admin-branches.controller.ts:14)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/branches/list` | `listBranches` (:22) | `@HttpCode(200)`, `branch.list` (:20-21) | `TableQueryDto` |
| GET | `/api/admin/branches/user-list` | `userList` (:28) | `branch.create` (:27) | — |
| POST | `/api/admin/branches` | `createBranch` (:35) | `@HttpCode(200)`, `branch.create` (:33-34) | `Record<string, unknown>` |
| GET | `/api/admin/branches/active/:id` | `toggleBranchActive` (:41) | `branch.list` (:40) | — |
| GET | `/api/admin/branches/:id` | `findBranch` (:47) | `branch.list` (:46) | — |
| PUT | `/api/admin/branches/:id` | `updateBranch` (:53) | `branch.list` (:52) | `Record<string, unknown>` |

### 4.14 AdminInvoicesController — `@Controller('admin/invoices')` (admin-invoices.controller.ts:15)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/invoices/list` | `list` (:22) | `@HttpCode(200)`, `invoice.list` (:20-21) | `TableQueryDto` |
| GET | `/api/admin/invoices/branch-list` | `branchList` (:28) | `invoice.create` (:27) | — |
| POST | `/api/admin/invoices` | `create` (:35) | `@HttpCode(200)`, `invoice.create` (:33-34), `@CurrentAdmin()` | inline `{ branch_id?, products?, note? }` |
| GET | `/api/admin/invoices/:id` | `findOne` (:44) | `invoice.list` (:43) | — |
| PUT | `/api/admin/invoices/:id` | `update` (:50) | `invoice.list` (:49) | inline `{ branch_id?, products?, note? }` |
| DELETE | `/api/admin/invoices/:id` | `remove` (:59) | `invoice.list` (:58) | — |

### 4.15 AdminMiscController — `@Controller('admin/misc')` (admin-misc.controller.ts:21)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/misc/cities/list` | `listCities` (:29) | `@HttpCode(200)`, `cities.list` (:27-28) | `TableQueryDto` |
| POST | `/api/admin/misc/cities` | `createCity` (:36) | `@HttpCode(200)`, `cities.create` (:34-35) | inline `{ title?, name?, province? }` |
| GET | `/api/admin/misc/cities/percent/:id` | `getCityPercent` (:42) | `cities.list` (:41) | — |
| GET | `/api/admin/misc/cities/percent-aux/:id` | `getCityPercentAux` (:48) | `cities.list` (:47) | — |
| PUT | `/api/admin/misc/cities/:id` | `updateCity` (:54) | `cities.list.view.edit` (:53) | `Record<string, never>` |
| DELETE | `/api/admin/misc/cities/:id` | `removeCity` (:60) | `cities.list.remove` (:59) | — |
| POST | `/api/admin/misc/sms/list` | `listSms` (:68) | `@HttpCode(200)`, `sms.list` (:66-67) | `TableQueryDto` |
| POST | `/api/admin/misc/sms` | `sendSms` (:75) | `@HttpCode(200)`, `sms.create` (:73-74), `@CurrentAdmin()` | inline `{ type?, mobile?, text? }` |
| POST | `/api/admin/misc/notify/list` | `listNotifications` (:86) | `@HttpCode(200)`, `notify.me` (:84-85) | `TableQueryDto` |
| POST | `/api/admin/misc/notify` | `createNotification` (:93) | `@HttpCode(200)`, `notify.create` (:91-92), `@CurrentAdmin()` | inline `{ title?, text?, body?, type? }` |
| POST | `/api/admin/misc/notify/customer` | `notifyCustomer` (:103) | `@HttpCode(200)`, `notify.create` (:101-102), `@CurrentAdmin()` | inline `{ customer_id?, title?, text?, body? }` |
| GET | `/api/admin/misc/notify/read/:id` | `markRead` (:112) | `notify.me` (:111) | — |
| GET | `/api/admin/misc/notify/:id` | `findNotification` (:118) | `notify.me` (:117) | — |
| POST | `/api/admin/misc/newsletter/list` | `listNewsletter` (:126) | `@HttpCode(200)`, `newsletters` (:124-125) | `TableQueryDto` |
| GET | `/api/admin/misc/log/customers` | `logCustomers` (:133) | `statics` (:132) | — |
| GET | `/api/admin/misc/log/customer/:id` | `customerLog` (:139) | `statics` (:138) | — |
| GET | `/api/admin/misc/dashboard-links` | `dashboardLinks` (:146) | `config.report` (:145) | — |
| GET | `/api/admin/misc/const` | `listConsts` (:152) | `config.statics` (:151) | — |
| POST | `/api/admin/misc/brands` | `createBrand` (:159) | `@HttpCode(200)`, `config.statics.brand.create` (:157-158) | inline `{ title }` |
| PUT | `/api/admin/misc/brands/:id` | `updateBrand` (:165) | `config.statics.brand.edit` (:164) | inline `{ title }` |
| DELETE | `/api/admin/misc/brands/:id` | `removeBrand` (:171) | `config.statics.brand.remove` (:170) | — |
| GET | `/api/admin/misc/const/slider` | `getSlider` (:186) | `custom.config.statics.slider` (:185) | — |
| PUT | `/api/admin/misc/const/slider` | `setSlider` (:192) | `custom.config.statics.slider` (:191) | `Record<string, unknown>` |
| DELETE | `/api/admin/misc/const/slider` | `removeSlider` (:198) | `custom.config.statics.slider` (:197) | — |
| GET | `/api/admin/misc/const/:key` | `getConst` (:204) | `config.statics` (:203); `assertNotSliderKey` (:205,229-233) | — |
| PUT | `/api/admin/misc/const/:key` | `setConst` (:211) | `config.statics` (:210); `assertNotSliderKey` | `Record<string, unknown>`, reads `body.val` fallback (:214) |
| DELETE | `/api/admin/misc/const/:key` | `removeConst` (:219) | `config.statics` (:218); `assertNotSliderKey` | — |

### 4.16 PublicSliderController — `@Public() @Controller('home')` (public-slider.controller.ts:16-17)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| GET | `/api/home/slider` | `getSlider` (:22) | `@Public()` class-level (:16) | — |

### 4.17 AdminUploadsController — `@Controller('admin/files')` (admin-uploads.controller.ts:45)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/admin/files/create` | `create` (:52) | `@HttpCode(200)`, `@UseInterceptors(FileInterceptor('file'))` (:50-51), `@UploadedFile()`, `@Body('purpose')`, `@CurrentAdmin()`; auth required, **no rid** (rationale :38-44) | multipart `file` + `purpose` (no DTO class) |
| GET | `/api/admin/files/:id` | `findOne` (:61) | auth only, **no rid** (:60) | — |

### 4.18 PublicUploadsController — `@Public() @Controller('uploads')` (public-uploads.controller.ts:14-15)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| GET | `/api/uploads/:filename` | `stream` (:19) | `@Public()` class-level (:14); `@Header('Cache-Control','public, max-age=86400')` (:18) | — |

### 4.19 AdminDashboardController — `@Controller('admin/dashboard')` (admin-dashboard.controller.ts:15)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| GET | `/api/admin/dashboard/overview` | `overview` (:21) | `dashboard.view` (:20) | — |
| GET | `/api/admin/dashboard/omde` | `omde` (:28) — deprecated alias | `dashboard.view` (:27) | — |
| GET | `/api/admin/dashboard/tak` | `tak` (:34) — deprecated alias | `dashboard.view` (:33) | — |
| GET | `/api/admin/dashboard/report/order-item` | `orderItemReport` (:42) | `report.order.item` (:41); `@Query('start_date'/'end_date')` | — |
| GET | `/api/admin/dashboard/report/product` | `productReport` (:49) | `report.product` (:48); `@Query(...)` | — |

### 4.20 CatalogController — `@Public() @Controller('catalog/products')` (catalog.controller.ts:5-6)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| GET | `/api/catalog/products` | `list` (:11) | `@Public()` class-level (:5) | — |

### 4.21 CustomersController — `@Public() @Controller('customers')` (customers.controller.ts:5-6)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| GET | `/api/customers` | `list` (:11) | `@Public()` class-level | — |
| GET | `/api/customers/:id` | `get` (:16) | `@Public()` | — |
| GET | `/api/customers/:id/orders` | `getOrders` (:21) | `@Public()` | — |
| GET | `/api/customers/:id/ledger-entries` | `getLedgerEntries` (:26) | `@Public()` | — |

### 4.22 SalesAgentController — `@Controller('sales-agent')` (sales-agent.controller.ts:21)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| GET | `/api/sales-agent/me` | `me` (:26) | auth required, **no rid**; identity-scoped in service (`role==='SALES_EXPERT'`, sales-agent.service.ts:36-40) | — |
| GET | `/api/sales-agent/my-customers` | `myCustomers` (:31) | auth, no rid; `@Query('search')` | — |
| POST | `/api/sales-agent/verify-acting-as` | `verifyActingAs` (:37) | `@HttpCode(200)` (:36); auth, no rid | inline `{ customerId }` |

### 4.23 OrdersController — `@Public() @Controller('orders')` (orders.controller.ts:7-8)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| POST | `/api/orders` | `create` (:13) | `@Public()` class-level | `CreateOrderDto` |
| GET | `/api/orders/:id` | `get` (:18) | `@Public()` | — |
| PATCH | `/api/orders/:id/status` | `updateStatus` (:23) | `@Public()` | `UpdateOrderStatusDto` (orders/dto) |

### 4.24 AccountingController — `@Public() @Controller('accounting')` (accounting.controller.ts:7-8)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| GET | `/api/accounting/customers/:customerId/balance` | `getBalance` (:13) | `@Public()` class-level | — |
| POST | `/api/accounting/customers/:customerId/reconcile` | `reconcile` (:18) | `@Public()` | — |
| POST | `/api/accounting/repayments/gold` | `postGoldRepayment` (:23) | `@Public()` | `PostGoldRepaymentDto` |
| POST | `/api/accounting/repayments/rial` | `postRialRepayment` (:28) | `@Public()` | `PostRialRepaymentDto` |
| POST | `/api/accounting/entries/:entryId/confirm` | `confirmEntry` (:33) | `@Public()` | — |

### 4.25 PricingController — `@Public() @Controller('pricing')` (pricing.controller.ts:5-6)

| METHOD | Full path | Handler | Guards/decorators | DTO |
|---|---|---|---|---|
| GET | `/api/pricing/latest` | `getLatest` (:11) | `@Public()`; `@Query('karatPerMille')`, defaults 750 (:12) | — |

### 4.26 Endpoint totals

| Controller | Routes |
|---|---|
| AuthController | 2 |
| AdminOrdersController | 9 |
| AdminCitiesController | 1 |
| AdminPreOrdersController | 5 |
| AdminWorkshopsController | 5 |
| AdminCustomersController | 23 |
| AdminCommentsController | 6 |
| AdminProductsController | 15 |
| AdminCategoriesController | 11 |
| AdminDocumentsController | 13 |
| AdminPromotionsController | 12 |
| AdminUsersController | 12 |
| AdminBranchesController | 6 |
| AdminInvoicesController | 6 |
| AdminMiscController | 27 |
| PublicSliderController | 1 |
| AdminUploadsController | 2 |
| PublicUploadsController | 1 |
| AdminDashboardController | 5 |
| CatalogController | 1 |
| CustomersController | 4 |
| SalesAgentController | 3 |
| OrdersController | 3 |
| AccountingController | 5 |
| PricingController | 1 |
| **TOTAL** | **179** |

**Unauthenticated (`@Public()`) surface — 15 routes**: all of AccountingController (5), OrdersController (3), CustomersController (4), CatalogController (1), PricingController (1), PublicSliderController (1), PublicUploadsController (1). Note `/api/accounting/*` writes to the ledger and `/api/orders` creates gold-debt-bearing orders while being fully public (accounting.controller.ts:7, orders.controller.ts:7).

---

## 5. DTOs (every class, fields, class-validator rules)

Only **6 DTO files / 8 DTO classes** exist. Most admin routes take untyped `Record<string, unknown>` or inline object literals (no validation beyond the global `whitelist` pipe, which strips nothing on a plain `Record` type).

### `src/modules/auth/dto/login.dto.ts` — `LoginDto`

| Field | Type | Validators | Cite |
|---|---|---|---|
| `phone` | string | `@IsString()`, `@IsNotEmpty()` | :11-13 |
| `password` | string | `@IsString()`, `@IsNotEmpty()` | :15-17 |

### `src/modules/accounting/dto/post-gold-repayment.dto.ts` — `PostGoldRepaymentDto`

| Field | Type | Validators | Cite |
|---|---|---|---|
| `customerId` | string | `@IsString()` | :4-5 |
| `instrument` | `'MELTED_GOLD'\|'TRANSFER'\|'CHEQUE'\|'CASH'` | `@IsIn([...])` | :7-8 |
| `rawValue` | number | `@IsNumber()`, `@IsPositive()` | :10-12 |
| `karatPerMille?` | number | `@IsOptional()`, `@IsNumber()` | :14-16 |
| `pricePerGramRial?` | number | `@IsOptional()`, `@IsNumber()`, `@IsPositive()` | :18-21 |
| `note?` | string | `@IsOptional()`, `@IsString()` | :23-25 |

### `src/modules/accounting/dto/post-rial-repayment.dto.ts` — `PostRialRepaymentDto`

| Field | Type | Validators | Cite |
|---|---|---|---|
| `customerId` | string | `@IsString()` | :4-5 |
| `amount` | number | `@IsNumber()`, `@IsPositive()` | :7-9 |
| `note?` | string | `@IsOptional()`, `@IsString()` | :11-13 |

### `src/modules/orders/dto/create-order.dto.ts` — `CreateOrderItemInputDto`

| Field | Type | Validators | Cite |
|---|---|---|---|
| `productVariantId` | string | `@IsString()` | :6-7 |
| `quantity` | number | `@IsInt()`, `@Min(1)` | :9-11 |
| `wagePercent` | number | `@IsNumber()` (no min/max — negative or >100 accepted) | :14-15 |
| `discountPercent?` | number | `@IsOptional()`, `@IsNumber()` | :17-19 |
| `flatRialCharge?` | number | `@IsOptional()`, `@IsNumber()` | :22-24 |

### `src/modules/orders/dto/create-order.dto.ts` — `CreateOrderDto`

| Field | Type | Validators | Cite |
|---|---|---|---|
| `customerId` | string | `@IsString()` | :28-29 |
| `branchId?` | string | `@IsOptional()`, `@IsString()` | :31-33 |
| `channel?` | `OrderChannel` | `@IsOptional()`, `@IsEnum(OrderChannel)`; defaults RETAIL in service | :40-42 |
| `items` | `CreateOrderItemInputDto[]` | `@IsArray()`, `@ArrayMinSize(1)`, `@ValidateNested({each:true})`, `@Type(()=>CreateOrderItemInputDto)` | :44-48 |

### `src/modules/orders/dto/update-order-status.dto.ts` — `UpdateOrderStatusDto`

| Field | Type | Validators | Cite |
|---|---|---|---|
| `status` | `OrderStatus` | `@IsEnum(OrderStatus)` | :5-6 |
| `note?` | string | `@IsOptional()`, `@IsString()` | :8-10 |
| `actorAdminUserId?` | string | `@IsOptional()`, `@IsString()` — **client-supplied actor id on a `@Public()` route** | :12-14 |

### `src/modules/admin-orders/update-status.dto.ts` — `UpdateOrderStatusDto` (distinct class, same name)

| Field | Type | Validators | Cite |
|---|---|---|---|
| `orderId` | string | `@IsString()` | :12-13 |
| `status` | `OrderStatus` | `@IsEnum(OrderStatus)` | :15-16 |
| `note?` | string | `@IsOptional()`, `@IsString()` | :18-20 |
| `remove?` | boolean | `@IsOptional()`, `@IsBoolean()` — true = delete that status event | :23-25 |

### `src/modules/admin-table/table-query.dto.ts` — `TableFilterDto`

| Field | Type | Validators | Cite |
|---|---|---|---|
| `id?` | number\|string | `@IsOptional()` (accepted, ignored) | :22-23 |
| `field?` | string | `@IsOptional()`, `@IsString()` | :25-27 |
| `op?` | string | `@IsOptional()`, `@IsIn(['=','!=','>','>=','<','<=','like','in','between','null','notnull'])` | :32-34 |
| `value?` | unknown | `@IsOptional()` | :36-37 |
| `value2?` | unknown | `@IsOptional()` (used by `between`) | :39-40 |

### `src/modules/admin-table/table-query.dto.ts` — `TableQueryDto`

| Field | Type | Validators | Cite |
|---|---|---|---|
| `search?` | string | `@IsOptional()`, `@IsString()` | :51-53 |
| `filters?` | `TableFilterDto[]` | `@IsOptional()`, `@IsArray()`, `@ValidateNested({each:true})`, `@Type(()=>TableFilterDto)` | :55-59 |
| `page?` | number | `@IsOptional()`, `@Type(()=>Number)`, `@IsInt()`, `@Min(1)` | :61-65 |
| `limit?` | number | `@IsOptional()`, `@Type(()=>Number)`, `@IsInt()`, `@Min(1)`, `@Max(500)` | :67-72 |
| `order?` | string | `@IsOptional()`, `@IsString()` — `'+field'` asc / `'-field'` desc | :75-77 |
| `select?` | string[] | `@IsOptional()`, `@IsArray()` | :80-82 |
| `titles?` | `Record<string,string>` | `@IsOptional()` | :85-86 |
| `report_title?` | string | `@IsOptional()`, `@IsString()` | :88-90 |
| `op?` | `'excel'\|'json'\|'print'` | `@IsOptional()`, `@IsIn([...])` — always rejected by `assertNotExport` | :97-99 |
| `total?` | number | `@IsOptional()` (echoed back) | :102-103 |

---

## 6. Prisma schema (`prisma/schema.prisma`, 911 lines)

Generator: `prisma-client-js`, `binaryTargets = ["native","debian-openssl-3.0.x"]` (schema.prisma:6-10).
Datasource: `postgresql`, url from `env("DATABASE_URL")` (schema.prisma:12-15).
Header note: *"All money/weight fields use Decimal, never Float, to avoid rounding drift in debt math"* (schema.prisma:4).

### 6.1 Enums (14)

| Enum | Values | Cite |
|---|---|---|
| `AdminRole` | SUPER_ADMIN, SYSTEM_APPROVER, SALES_EXPERT, WORKSHOP_SUPERVISOR, ACCOUNTANT | :21-27 |
| `CustomerKind` | SALES_AGENT (legacy-only), APP_SHOPKEEPER, WALK_IN_SHOPKEEPER, BANKER, WORKSHOP_SUPERVISOR, RETAIL | :45-52 |
| `VerificationStep` | UNVERIFIED, STEP_ONE_SUBMITTED, STEP_TWO_SUBMITTED, VERIFIED | :54-59 |
| `OrderChannel` | RETAIL, WHOLESALE | :64-67 |
| `OrderStatus` | SUSPENDED, PLACED, ADMIN_APPROVED, SOURCING, PREPARING, DELIVERED_TO_AGENT, DELIVERED_TO_CUSTOMER, CANCELLED | :69-78 |
| `PreOrderStatus` | PLACED, ADMIN_APPROVED, WORKSHOP_APPROVED, READY_TO_SHIP, DELIVERED, CANCELLED | :80-87 |
| `LedgerCurrency` | GOLD_GRAM, RIAL | :89-92 |
| `LedgerDirection` | DEBIT (increases owed), CREDIT (decreases owed) | :94-97 |
| `LedgerSourceType` | ORDER_STOCK, ORDER_PRE_ORDER, REPAYMENT_MELTED_GOLD, REPAYMENT_TRANSFER, REPAYMENT_CHEQUE, REPAYMENT_CASH, WALLET_BONUS, ADJUSTMENT | :99-108 |
| `ProductImageRole` | FEATURED, FEATURED_MOBILE, GALLERY, GALLERY_MOBILE | :367-372 |
| `CommentStatus` | PENDING, APPROVED, REJECTED | :655-659 |
| `PromotionScope` | PRODUCT, CATEGORY, CUSTOMER, BRAND | :704-709 |
| `PromotionUsage` | ONCE, UNTIL_END_DATE | :712-715 |
| `MessageAudience` | SINGLE_NUMBER, MULTIPLE_NUMBERS, ALL_CUSTOMERS, WHOLESALE_CUSTOMERS, RETAIL_CUSTOMERS, SALES_AGENTS | :805-812 |

### 6.2 Models (29)

#### `City` (:114-126)
| Field | Type | Default / Attrs |
|---|---|---|
| id | String | `@id @default(cuid())` |
| name | String | — |
| province | String? | — |
| percent | Decimal? | `@db.Decimal(6,3)` — per-city wage surcharge (:120) |
| percentAux | Decimal? | `@db.Decimal(6,3)` (:121) |
| customers/addresses/branches/preOrders | relations | Customer[], CustomerAddress[], Branch[], PreOrder[] (:122-125) |

#### `AdminUser` (:128-170)
| Field | Type | Default / Attrs |
|---|---|---|
| id | String | `@id @default(cuid())` |
| fullName | String | — |
| mobile | String | **`@unique`** (:131) |
| passwordHash | String | — |
| role | AdminRole | — |
| userTypeId | Int? | FK → UserType (:137-138) |
| branchId | String? | FK → Branch (:139-140) |
| wagePercent | Decimal? | `@db.Decimal(6,3)` — commission on referred orders (:141) |
| isActive | Boolean | `@default(true)` (:142) |
| createdAt | DateTime | `@default(now())` (:143) |
| avatarFileId | String? | FK → UploadedFile (relation `AdminUserAvatar`) (:150-151) |
| address, storeName, pasazhName, memberCode | String? | legacy sales-agent fields (:152-155) |
| Relations | referredCustomers (`ReferralAgent`), supervisedWorkshops, branchAllocations, postedLedgerEntries, orderStatusEvents, preOrderStatusEvents, sentSmsMessages, sentNotifications, uploadedFiles | :157-165 |
| Indexes | `@@index([role])`, `@@index([userTypeId])`, `@@index([avatarFileId])` | :167-169 |

#### `Customer` (:172-238)
| Field | Type | Default / Attrs |
|---|---|---|
| id | String | `@id @default(cuid())` |
| fullName | String | — |
| mobile | String | **`@unique`** (:175) |
| nationalCode | String | **`@unique`** (:176) |
| passwordHash | String | — |
| cityId / city | String? / City? | (:178-179) |
| kind | CustomerKind | `@default(APP_SHOPKEEPER)` (:183) |
| phone, address, storeName, pasazhName, zone, memberCode | String? | (:187-193) |
| referredByAgentId | String? | FK → AdminUser (`ReferralAgent`) (:195-196) |
| **goldCreditLimitGrams** | Decimal | `@default(0) @db.Decimal(14,4)` — legacy `gram_level` (:200) |
| **goldDebtGrams** | Decimal | `@default(0) @db.Decimal(14,4)` — legacy `remain` (cache) (:201) |
| **fiatDebtRial** | Decimal | `@default(0) @db.Decimal(20,2)` — legacy `rial_remain` (cache) (:202) |
| verificationStep | VerificationStep | `@default(UNVERIFIED)` (:204) |
| nationalIdImageUrl, businessLicenseUrl, shopImageUrl | String? | KYC docs (:205-207) |
| avatarFileId | String? | FK → UploadedFile (`CustomerAvatar`) (:212-213) |
| canPlaceOrders | Boolean | `@default(true)` — legacy `sts` (:219) |
| isActive | Boolean | `@default(true)` — legacy `active` (:221) |
| isArchived | Boolean | `@default(false)` (:223) |
| createdAt / updatedAt | DateTime | `@default(now())` / `@updatedAt` (:224-225) |
| Relations | addresses, orders, preOrders, ledgerEntries, walletBonuses, comments, promotions, notifications, activityLogs | :227-235 |
| Index | `@@index([referredByAgentId])` | :237 |

#### `CustomerAddress` (:240-248)
id (cuid PK), customerId→Customer, cityId?→City, addressLine String, isDefault Boolean `@default(false)`.

#### `Branch` (:250-263)
id (cuid PK), name, address?, phone?, isActive `@default(true)` (:257), cityId?→City, relations adminUsers/orders/allocations.

#### `Workshop` (:265-276)
id (cuid PK), name, address?, phone?, supervisorId?→AdminUser (`WorkshopSupervisor`), isActive `@default(true)`, preOrders.

#### `Category` (:282-299)
id (cuid PK), title, type Int `@default(1)` (1=site,2=mobile), imageUrl?, iconUrl?, metaTag?, description?, parentId?→self (`CategoryTree`), children, products, promotions.

#### `Brand` (:301-306)
id (cuid PK), title, products, promotions.

#### `Collection` (:310-316)
id (cuid PK), title, description?, isActive `@default(true)`, products (CollectionProduct[]).

#### `CollectionProduct` (:318-325)
collectionId→Collection, productId→Product; **`@@id([collectionId, productId])`** (:324).

#### `Product` (:327-348)
id (cuid PK), title, description?, categoryId?→Category, brandId?→Brand, productCode String? **`@unique`** (:336), showType Int `@default(3)` (1 site/2 mobile/3 both) (:338), isActive `@default(true)`, createdAt `@default(now())`; relations variants, images, collections, comments, promotions, allocationItems.

#### `ProductImage` (:350-365)
id (cuid PK), productId→Product, url String, sortOrder Int `@default(0)`, role ProductImageRole `@default(GALLERY)` (:359), variants ProductVariant[].

#### `ProductVariant` (:374-402)
| Field | Type | Default / Attrs |
|---|---|---|
| id | String | cuid PK |
| productId | String | → Product |
| title | String | — |
| sku | String? | **`@unique`** (:379) |
| **rashWeightGrams** | Decimal | `@db.Decimal(14,4)` — raw weight before making charge (:381) |
| **defaultWagePercent** | Decimal | `@db.Decimal(6,3)` (:383) |
| qty | Int | `@default(0)` (:387) |
| isPreOrder | Boolean | `@default(false)` (:389) |
| isActive | Boolean | `@default(true)` (:390) |
| imageId | String? | → ProductImage, **`onDelete: SetNull`** (:396-397) |
| Index | `@@index([imageId])` | :401 |

#### `Order` (:408-439)
| Field | Type | Default / Attrs |
|---|---|---|
| id | String | cuid PK |
| orderNumber | String | **`@unique`** (:410) |
| customerId | String | → Customer (:411-412) |
| branchId | String? | → Branch (:413-414) |
| channel | OrderChannel | `@default(RETAIL)` (:416) |
| status | OrderStatus | `@default(PLACED)` (:417) |
| **totalGoldWeightGrams** | Decimal | `@db.Decimal(14,4)` — incl. wage (:420) |
| **wageWeightGrams** | Decimal | `@db.Decimal(14,4)` — pure making-charge component (:422) |
| **flatRialCharge** | Decimal | `@default(0) @db.Decimal(20,2)` — legacy `rial_input` (:424) |
| isSuspendedOverCreditLimit | Boolean | `@default(false)` (:426) |
| deliveredAt | DateTime? | setting it triggers debt recognition (:427) |
| createdAt/updatedAt | DateTime | `@default(now())` / `@updatedAt` (:429-430) |
| Relations | items, statusEvents, ledgerEntries, convertedFromPreOrder | :432-435 |
| Indexes | `@@index([customerId])`, `@@index([status])` | :437-438 |

#### `OrderItem` (:441-456)
| Field | Type | Default / Attrs |
|---|---|---|
| id | String | cuid PK |
| orderId / productVariantId | String | → Order / ProductVariant |
| quantity | Int | — |
| rashWeightGramsSnapshot | Decimal | `@db.Decimal(14,4)` (:450) |
| wagePercentSnapshot | Decimal | `@db.Decimal(6,3)` (:451) |
| discountPercentSnapshot | Decimal | `@default(0) @db.Decimal(6,3)` (:452) |
| computedWeightGrams | Decimal | `@db.Decimal(14,4)` = `rash*(1+(wage-discount)/100)` (:453-454) |
| flatRialCharge | Decimal | `@default(0) @db.Decimal(20,2)` (:455) |

#### `OrderStatusEvent` (:458-470)
id (cuid PK), orderId→Order, fromStatus OrderStatus?, toStatus OrderStatus, note?, actorAdminUserId?→AdminUser, createdAt `@default(now())`; `@@index([orderId])` (:469).

#### `PreOrder` (:476-505)
id (cuid PK), customerId→Customer, cityId?→City, workshopId?→Workshop, status PreOrderStatus `@default(PLACED)` (:484), designImageUrl?, colorName?, sizeSpec?, stoneColor?, minaColor?, estimatedWeightGrams Decimal? `@db.Decimal(14,4)` (:491), estimatedPriceRial Decimal? `@db.Decimal(20,2)` (:492), description?, convertedOrderId String? **`@unique`** →Order (:496-497), createdAt/updatedAt, statusEvents; `@@index([customerId])` (:504).

#### `PreOrderStatusEvent` (:507-519)
id (cuid PK), preOrderId→PreOrder, **changes Json** (field-level diff, :512), actorAdminUserId?→AdminUser, ipAddress?, createdAt; `@@index([preOrderId])` (:518).

#### `LedgerEntry` (:525-571) — core accounting row
| Field | Type | Default / Attrs |
|---|---|---|
| id | String | cuid PK |
| customerId | String | → Customer (:527-528) |
| currency | LedgerCurrency | (:530) |
| direction | LedgerDirection | (:531) |
| sourceType | LedgerSourceType | (:532) |
| **amount** | Decimal | `@db.Decimal(20,4)` — always positive; sign from `direction` (:533-534) |
| karatPerMille | Int? | purity for melted gold (:537) |
| pricePerGramRialAtEntry | Decimal? | `@db.Decimal(20,2)` — for CASH (:539) |
| orderId | String? | → Order (:541-542) |
| **confirmed** | Boolean | `@default(false)` — pending entries excluded from cached balance (:545) |
| confirmedAt | DateTime? | (:546) |
| postedByAdminUserId | String? | → AdminUser (:547-548) |
| labName, hallmark, accountName, bankName, transferTo | String? | instrument metadata (:555-559) |
| originalValue | Decimal? | `@db.Decimal(14,4)` — pre-karat-normalization weight (:561) |
| priceRial | Decimal? | `@db.Decimal(20,2)` (:563) |
| receivedAt | DateTime? | (:564) |
| note | String? | (:566) |
| createdAt | DateTime | `@default(now())` (:567) |
| Indexes | `@@index([customerId, currency])`, `@@index([orderId])` | :569-570 |

#### `GoldPriceQuote` (:574-582)
id (cuid PK), karatPerMille Int, **pricePerGramRial Decimal `@db.Decimal(20,2)`** (:577), source String, quotedAt DateTime `@default(now())` (:579); `@@index([karatPerMille, quotedAt])` (:581).

#### `WalletBonus` (:585-597)
id (cuid PK), customerId→Customer, orderId String? (**no FK relation declared**, :589), goldGrams Decimal `@db.Decimal(14,4)` (:590), grantedAt `@default(now())`, **expiresAt DateTime (required)** (:592), consumedAt DateTime?, isActive Boolean `@default(true)`; `@@index([customerId, isActive])` (:596).

#### `UserType` (:620-632)
id **Int** `@id` (legacy `ut`, not cuid) (:623), title String, isActive `@default(true)`, createdAt `@default(now())`; relations permissions, adminUsers; **`@@map("user_type")`** (:631).

#### `Permission` (:634-644)
rid String (dotted id), userTypeId Int → UserType **`onDelete: Cascade`** (:638); **`@@id([rid, userTypeId])`** composite PK (:641), `@@index([userTypeId])` (:642), **`@@map("permission")`** (:643).

#### `Comment` (:661-681)
id (cuid PK), productId→Product, customerId→Customer, body String, status CommentStatus `@default(PENDING)` (:668), replyToId?→self (`CommentReplies`), replies, createdAt/updatedAt; `@@index([productId])`, `@@index([customerId])`, `@@index([status])` (:678-680).

#### `Setting` (:690-694)
**key String `@id`**, value **Json**, updatedAt `@updatedAt`. Replaces legacy `config_static`.

#### `Promotion` (:717-746)
id (cuid PK), title, description?, scope PromotionScope `@default(PRODUCT)` (:721), usage PromotionUsage `@default(ONCE)` (:722), **discountPercent Decimal `@db.Decimal(6,3)`** (:724), isActive `@default(true)`, platform Int `@default(3)` (:727), startsAt?/endsAt?, and exactly one of productId/categoryId/customerId/brandId per scope (:733-740), createdAt/updatedAt; `@@index([scope, isActive])` (:745).

#### `PromotionExclusion` (:752-760)
id (cuid PK), type Int, itemId String, createdAt; **`@@unique([type, itemId])`** (:758), `@@index([type])` (:759).

#### `BranchAllocation` (:769-784)
id (cuid PK), branchId→Branch, allocatorAdminUserId?→AdminUser (`AllocationAuthor`), note?, createdAt, items; `@@index([branchId])` (:783).

#### `BranchAllocationItem` (:786-796)
id (cuid PK), allocationId→BranchAllocation **`onDelete: Cascade`** (:789), productId→Product, weightGrams Decimal? `@db.Decimal(14,4)` (:793); **`@@unique([allocationId, productId])`** (:795).

#### `SmsMessage` (:814-829)
id (cuid PK), audience MessageAudience, recipients String? (comma-separated), body String, sentCount Int `@default(0)` (:821), sentByAdminUserId?→AdminUser (`SmsAuthor`), createdAt; `@@index([createdAt])` (:828).

#### `Notification` (:831-845)
id (cuid PK), title, body, audience MessageAudience `@default(ALL_CUSTOMERS)` (:835), sentByAdminUserId?→AdminUser (`NotificationAuthor`), createdAt, recipients; `@@index([createdAt])` (:844).

#### `NotificationRecipient` (:848-858)
id (cuid PK), notificationId→Notification **`onDelete: Cascade`** (:851), customerId→Customer, readAt DateTime?; **`@@unique([notificationId, customerId])`** (:856), `@@index([customerId, readAt])` (:857).

#### `NewsletterSubscriber` (:861-869)
id (cuid PK), email String?, mobile String?, createdAt; **`@@unique([email])`**, **`@@unique([mobile])`** (:867-868).

#### `CustomerActivityLog` (:873-883)
id (cuid PK), customerId→Customer, action String (free-form key), detail String?, createdAt; `@@index([customerId, createdAt])` (:882).

#### `UploadedFile` (:892-911)
id (cuid PK), url String, originalName, mimeType, sizeBytes Int, purpose String?, uploadedByAdminUserId?→AdminUser (`FileUploader`), createdAt, customerAvatars/adminUserAvatars back-relations; `@@index([purpose])` (:910).

### 6.3 Decimal precision map (no `Float` anywhere in the schema)

| Precision | Used for | Examples |
|---|---|---|
| `Decimal(14,4)` | gold weights in grams | Customer.goldCreditLimitGrams/goldDebtGrams (:200-201), Order.totalGoldWeightGrams/wageWeightGrams (:420,422), OrderItem.rash/computedWeight (:450,454), ProductVariant.rashWeightGrams (:381), WalletBonus.goldGrams (:590), LedgerEntry.originalValue (:561), PreOrder.estimatedWeightGrams (:491), BranchAllocationItem.weightGrams (:793) |
| `Decimal(20,2)` | Rial money | Customer.fiatDebtRial (:202), Order.flatRialCharge (:424), OrderItem.flatRialCharge (:455), GoldPriceQuote.pricePerGramRial (:577), LedgerEntry.pricePerGramRialAtEntry/priceRial (:539,563), PreOrder.estimatedPriceRial (:492) |
| `Decimal(20,4)` | ledger amount (dual-currency, so finer than money) | LedgerEntry.amount (:534) |
| `Decimal(6,3)` | percentages | City.percent/percentAux (:120-121), AdminUser.wagePercent (:141), ProductVariant.defaultWagePercent (:383), OrderItem.wagePercentSnapshot/discountPercentSnapshot (:451-452), Promotion.discountPercent (:724) |

---

## 7. Migrations & seed

### 7.1 `prisma/migrations/*` (in order)

| # | Folder / file | Note |
|---|---|---|
| — | `0002_admin_schema.sql` | bare `.sql` at the migrations root (not a folder) — sorts first lexically |
| 1 | `20260910113720_first` | initial schema |
| 2 | `20260914165255_sync_schema_drift` | |
| 3 | `20260916141751_add_retail_customer_kind` | adds `CustomerKind.RETAIL` |
| 4 | `20260917120000_customer_name_parts_and_percent` | |
| 5 | `20260918090000_customer_parent_agent_self_relation` | |
| 6 | `20260918120000_add_product_image_role` | adds `ProductImageRole` |
| 7 | `20260921090000_add_variant_image` | adds `ProductVariant.imageId` |
| 8 | `20260921120000_agent_is_admin_user` | sales agent moves Customer→AdminUser |
| — | `migration_lock.toml` | `provider = "postgresql"` |

**Custom migration runner** (not `prisma migrate deploy`): `src/prisma/migrate.ts` applies the `.sql` files itself through the Prisma client and records them in a tracking table `_goldbank_migrations` (migrate.ts:5,7-13). Reason: the release image is copy-only and has no Prisma CLI (migrate.ts:10-12). Migrations dir resolved from `MIGRATIONS_DIR` or one of 4 fallbacks (migrate.ts:20-36). SQL is split statement-by-statement because Postgres rejects multi-statement parameterised queries (migrate.ts:38-42, `splitSqlStatements`). Invoked from `prepareDatabase()` before Nest boots (bootstrap.ts:104-134, main.ts:19).

### 7.2 `prisma/seed.ts` (738 lines) — what it creates

| Entity | What | Cite |
|---|---|---|
| Dev passwords | `DEV_PASSWORD = 'admin1234'`, bcrypt cost 10; `DEV_TEST_PHONE = '09128081392'` whose password **is the phone number itself** (dev-only) | seed.ts:16-24 |
| Cities (4) | تهران / مشهد / اصفهان / تبریز, fixed ids `city-tehran` etc. | :33-38 |
| Branches (2) | Tehran, Mashhad | :41-49 |
| Workshop (1) | upsert | :51 |
| **UserTypes + Permissions (5)** | see table below | :66-110 |
| AdminUsers (6 upserts) | dev test user `09128081392` (SUPER_ADMIN, ut 85, branchId **null**); `09120000001` مدیر ارشد سیستم (SUPER_ADMIN, ut 85, branchId null — deliberately branch-less so head office is not branch-scoped, :140-143); `09121234567` رضا احمدی (SALES_EXPERT, ut 86, Tehran, wagePercent 1.5); `09129876543` سارا کریمی (SALES_EXPERT, ut 86, Mashhad, wagePercent 1.2); `09123334444` هومن یزدانی (WORKSHOP_SUPERVISOR, ut 88); `09125556666` فرزانه محمودی (ACCOUNTANT, ut 87, branchId null) | :118-194 |
| Customers | `customerData` array, upserted with `PLACEHOLDER_PASSWORD_HASH` | :197-333 |
| Categories (5) | انگشتر، دستبند، گردنبند، گوشواره، سکه و شمش | :341-347 |
| Brands (2) | Montzar, Artisan | :349-358 |
| Products + variants + images | from `productDefs`; placeholder image `/img/no-items.png` | :29, 360-462 |
| Collection | `featured` + 3 CollectionProduct rows | :465-484 |
| **GoldPriceQuote** | `{ karatPerMille: 750, pricePerGramRial: '61500000', source: 'seed-illustrative' }` — **`create`, not upsert**, so a re-seed appends another quote | :487-489 |
| Order `ORD-SEED-0002` | RETAIL, status PLACED, rash 2.400, wage 7.5% → computed via **`parseFloat(...).toFixed(4)`** (float math in the seed only) | :494-527 |
| Order `ORD-SEED-0001` | WHOLESALE, DELIVERED_TO_CUSTOMER, rash 3.100, wage 9%, flatRialCharge 500000, `deliveredAt: now`, 3 status events | :542-580 |
| Ledger entries | GOLD_GRAM DEBIT ORDER_STOCK (confirmed) + RIAL DEBIT ORDER_STOCK (confirmed) + a **pending** GOLD_GRAM CREDIT REPAYMENT_MELTED_GOLD 1.5000 @ 750‰ (`confirmed: false`) to demo the confirm flow | :582-625 |
| Cached balances | `customer1` incremented by the posted debt (:608-611); `customer2` set to goldDebt 8.2500 / fiat 2000000; `customer5` zeroed | :608-630 |
| PreOrders (2) | `preorder-0001` PLACED, `preorder-0002` ADMIN_APPROVED | :635-667 |
| Comments (3) | one APPROVED, one PENDING, one REJECTED | :672-700 |
| Variant stock | every variant gets `qty = 5 + (i%4)`, `isPreOrder = i%5===0` | :705-711 |
| Product codes | `P-0001`, `P-0002`, … by title asc | :712-718 |
| **Setting rows** | **NONE** — the seed creates no `Setting` rows at all. `wallet.config`, `wallet.birthday`, `promotion.auto`, `mobile_main_slider` are created lazily on first write (admin-documents.service.ts:421-428, admin-promotions.service.ts:261-282) and read back as `{}` / defaults until then (admin-documents.service.ts:416-419, admin-promotions.service.ts:256-259) |

Seed UserTypes and their rids (seed.ts:66-98):

| ut id | Title | rids |
|---|---|---|
| 85 | مدیر ارشد | **`ALL_RIDS`** — all 144 (seed.ts:68) |
| 86 | کارشناس فروش | order.list, order.create, order.omde, order.makeOrder, persons.list.client.omde, persons.list.client.omde.view, persons.list.client.single, persons.list.client.single.view, persons.create, product.list, dashboard.view, comment (12) (:72-77) |
| 87 | حسابدار | document.list, document.create, document.list.edit, invoice.list, invoice.create, wallet, config.wallet, report.order.item, report.product, config.report, dashboard.view (11) (:82-86) |
| 88 | سرپرست کارگاه | workshop.list, workshop.create, order.tamin, order.list, product.list (5) (:91) |
| 89 | کاربر شعبه | buy.order.list, order.create, persons.create, branch.list (4) (:96) |

Only **leaf** rids are stored; ancestors derived at runtime (seed.ts:64-65). Permissions written with `createMany({ skipDuplicates: true })` (:106-109).

Idempotency: everything uses `upsert` except `goldPriceQuote.create` (:487) and the ledger/order blocks, which are guarded by a `findUnique` on the seed order number (:494-497, :542-543).

---

## 8. Business logic

### 8.1 Gold price
- `PricingService.recordQuote(karatPerMille, pricePerGramRial, source)` → inserts a `GoldPriceQuote` (pricing.service.ts:9-13). **No caller anywhere in `src/`** — the only write path is unused; quotes only enter via the seed.
- `PricingService.getLatestQuote(karat)` → newest quote for that karat, 404 if none (pricing.service.ts:15-22).
- `GET /api/pricing/latest?karatPerMille=` defaults to **750** (pricing.controller.ts:11-12).
- **No external price feed, no scheduler, no HTTP fetch** — nothing refreshes quotes automatically.

### 8.2 Gram / weight calculation (the central formula)
`OrdersService.createOrder` (orders.service.ts:32-109):
- Per line: `netPercent = wagePercent - discountPercent`; `computedWeightGrams = rashWeight * (netPercent/100 + 1)` — all `Prisma.Decimal` arithmetic (`.sub`, `.div`, `.add`, `.mul`), **no float** (orders.service.ts:39-43).
- `rashWeight` is snapshotted from the variant at order time and never re-read (orders.service.ts:39, schema.prisma:449).
- `totalGoldWeightGrams = Σ computedWeight * qty` (orders.service.ts:57-60); `totalRashWeightGrams = Σ rash * qty` (:61-64); `wageWeightGrams = total - totalRash` (:65).
- `flatRialCharge = Σ item.flatRialCharge * qty` (:66-69).
- **No rounding / quantization is applied in code** — precision is enforced only by the column types `Decimal(14,4)` / `Decimal(20,2)` at write time (schema.prisma:420-424).
- Admin path (`AdminOrdersService.createFromAdmin`, admin-orders.service.ts:287-339) deliberately delegates to `OrdersService.createOrder` rather than recomputing; client-sent totals (`total_price`, `total_weight`, `gold_price_original`) are **ignored and recomputed server-side** (admin-orders.service.ts:283-286). Wage falls back to `variant.defaultWagePercent` when not negotiated (:316).

### 8.3 Fees / commissions / tax / spread
- **Wage (اجرت / making charge)** is the only fee: a percentage on the raw weight, expressed as extra gold weight, not money (`ProductVariant.defaultWagePercent`, `OrderItem.wagePercentSnapshot`).
- **Discount**: `OrderItem.discountPercentSnapshot`, subtracted from wage before applying.
- **Flat Rial charge**: per-unit non-gold cost, e.g. stones (`Order.flatRialCharge`, schema.prisma:423-424).
- **Agent commission**: `AdminUser.wagePercent Decimal(6,3)` (schema.prisma:141) — stored and displayed (sales-agent.service.ts:92) but **never applied to any calculation**.
- **City surcharges**: `City.percent` / `percentAux` (schema.prisma:118-121), readable via `GET admin/misc/cities/percent/:id` and `percent-aux/:id` (admin-misc.controller.ts:40-50) but **never used in pricing**.
- **Bulk wage change**: `AdminProductsService.changePercent` sets `defaultWagePercent` across a brand/category filter via `updateMany`, using `new Prisma.Decimal(String(percent))` (admin-products.service.ts:641-657); `changePercentCount` previews the affected count (:630-639).
- **Tax / VAT**: **no tax logic anywhere**.
- **Spread / buy-vs-sell price**: **none** — a single `GoldPriceQuote.pricePerGramRial` per karat, no bid/ask.

### 8.4 Rounding & precision (Decimal vs float) — exact findings
- **Schema**: zero `Float` fields; every monetary/weight/percent column is `Decimal` with explicit `@db.Decimal(p,s)` (see §6.3), per the stated design rule (schema.prisma:4).
- **Ledger math**: entirely `Prisma.Decimal` — `amount.lte(0)`, `.neg()`, `.mul()`, `.div()`, `.sub()`, `.gt()` (ledger.service.ts:34-35, 95, 131, 178, 189, 300-302).
- **Order math**: entirely `Prisma.Decimal` (orders.service.ts:39-69).
- **Float leaks found (3)**:
  1. `ledger.service.ts:189` — CASH conversion divides by `GRAMS_PER_MESGHAL`, a **JS number literal `4.331802`** (`packages/shared-types/src/index.ts:9`). `Decimal.div(number)` coerces the number, so the constant itself carries binary-float representation into an otherwise-Decimal chain. The formula is flagged in its own comment as "worth stakeholder review" (ledger.service.ts:186-187).
  2. `admin-dashboard.service.ts:148` and `:347` — sorting aggregates with `Number(b.weight) - Number(a.weight)`, i.e. Decimal→float for ordering only (display, not stored).
  3. `prisma/seed.ts:500, 509, 547, 560` — `parseFloat(...).toFixed(4)` to compute demo order weights. Seed-only; not a runtime path.
- **Explicit rounding calls**: none. No `Math.round`, `toFixed` or `Decimal.toDecimalPlaces` in `src/`. All quantization is implicit at the DB column scale.
- **Karat normalization**: `goldGrams = raw * karatPerMille / 750`, with `STANDARD_KARAT_PER_MILLE = 750` (ledger.service.ts:178, `packages/shared-types/src/index.ts:6`).

### 8.5 Wallet / balance
- **Source of truth**: `LedgerEntry` (append-only). `Customer.goldDebtGrams` / `fiatDebtRial` are **denormalized caches** (schema.prisma:198-202, ledger.service.ts:23-27).
- `applyToBalance`: `signedDelta = DEBIT ? amount : -amount`, applied with Prisma `{ increment: signedDelta }` on the matching currency field (ledger.service.ts:88-103).
- `getBalance` reads the cache + credit limit (ledger.service.ts:270-282).
- `reconcileBalance` recomputes from **confirmed** entries only: `goldDebits - goldCredits`, `rialDebits - rialCredits`, and **overwrites** the cache (ledger.service.ts:284-304); `sumConfirmed` uses `aggregate._sum` filtered on `confirmed: true` (:306-312). Documented as periodic/on-demand self-healing, unlike legacy's recompute-on-every-write (:284-288). **Nothing schedules it** — it only runs via `POST /api/accounting/customers/:customerId/reconcile`, which is `@Public()`.
- **Wallet bonus** is a separate concept from debt: `WalletBonus` in gold grams with a mandatory `expiresAt`. `chargeWallet` validates `grams > 0` and applies a **hardcoded one-year expiry** because the column is required (admin-customers.service.ts:734-749, expiry at :743-744). It does **not** post a ledger entry, so a granted bonus never touches `goldDebtGrams` despite `LedgerSourceType.WALLET_BONUS` existing (schema.prisma:106) — that enum value has no producer in `src/`.
- Wallet listings: `AdminDocumentsService.listWallet` (admin-documents.service.ts:369-409), `AdminCustomersService.customerWallet` (admin-customers.service.ts:701-714).

### 8.6 Buy / sell orders
- There is **no buy/sell gold trading flow**. "Orders" are jewelry/product orders that incur gold-weight debt. No `BUY`/`SELL` side, no order matching, no quote-locking.
- Order placement: `OrdersService.createOrder` (orders.service.ts:32-109); admin builder path `AdminOrdersService.createFromAdmin` (admin-orders.service.ts:287-339).
- Order number: `ORD-${Date.now()}-${random6}` (orders.service.ts:148-151) — **not** collision-proof by construction, relies on the `@unique` column.
- Order deletion refuses once ledger entries exist (admin-orders.service.ts:217-221); otherwise cascades events+items+order in one transaction (:223-228).

### 8.7 Deposit / withdraw / transfers
- **No customer-initiated deposit or withdrawal, and no customer-to-customer transfer.** "TRANSFER" (`REPAYMENT_TRANSFER`) means a *bank remittance repayment instrument*, not an internal transfer (ledger.service.ts:193-196, schema.prisma:104).
- The only inbound value flow is a **repayment document** filed by an admin (§8.9).

### 8.8 Order & transaction statuses and transitions

**Order status labels** (admin-orders.service.ts:16-25):

| Enum | Farsi label |
|---|---|
| SUSPENDED | معلق (سقف اعتبار) |
| PLACED | ثبت شده |
| ADMIN_APPROVED | تایید مدیر |
| SOURCING | در حال تامین |
| PREPARING | در حال آماده‌سازی |
| DELIVERED_TO_AGENT | تحویل به نماینده |
| DELIVERED_TO_CUSTOMER | تحویل به مشتری |
| CANCELLED | لغو شده |

**Declared flow** (`STATUS_FLOW`, admin-orders.service.ts:28-35): PLACED → ADMIN_APPROVED → SOURCING → PREPARING → DELIVERED_TO_AGENT → DELIVERED_TO_CUSTOMER. SUSPENDED and CANCELLED are outside the flow.

**Transition mechanics** (`OrdersService.updateStatus`, orders.service.ts:111-139):
- **No state-machine validation** — any status may be set from any status; `STATUS_FLOW` is used only to render the timeline (admin-orders.service.ts:249-258).
- `deliveredAt` is stamped on **DELIVERED_TO_CUSTOMER** (orders.service.ts:120).
- **Debt recognition fires at DELIVERED_TO_AGENT**, not at DELIVERED_TO_CUSTOMER (orders.service.ts:133-135; mirrors legacy `sts>4`).
- Idempotency guard: debt posts only `if (newStatus === DELIVERED_TO_AGENT && !order.deliveredAt)` (orders.service.ts:133). **Note the asymmetry**: `deliveredAt` is set by DELIVERED_TO_CUSTOMER but guards the DELIVERED_TO_AGENT posting — so two successive DELIVERED_TO_AGENT transitions without an intervening DELIVERED_TO_CUSTOMER would both post debt.
- Every transition writes an `OrderStatusEvent` with `fromStatus`/`toStatus`/`note`/actor (orders.service.ts:124-126).
- Status **removal** (`remove: true`): refuses DELIVERED_TO_AGENT because the debt is already posted (admin-orders.service.ts:381-386); otherwise deletes the newest matching event and rolls the order back to the latest remaining event's status, defaulting to PLACED (:388-404).
- Legacy numeric codes 1–6 map onto the enum in `statusFromLegacyCode` (admin-orders.service.ts:346-356).

**Pre-order statuses**: PLACED, ADMIN_APPROVED, WORKSHOP_APPROVED, READY_TO_SHIP, DELIVERED, CANCELLED (schema.prisma:80-87); diffs recorded as JSON in `PreOrderStatusEvent.changes` (schema.prisma:512). Conversion to a real Order is modelled by `PreOrder.convertedOrderId` (schema.prisma:496-497) but **no service method performs the conversion**.

**Ledger entry "status"**: the boolean `confirmed` is the only lifecycle. Order-debt entries are **self-confirming** (`confirmed: true`); repayments start **pending** (`confirmed: false`) — an intentional deviation from legacy, which auto-confirmed (ledger.service.ts:18-19, 113-146, 213, 65-73).

**Comment statuses**: PENDING → APPROVED/REJECTED via `POST admin/comments/sts` with legacy codes 1/2/3 (schema.prisma:655-659, admin-comments.controller.ts:35, admin-comments.service.ts:150).

### 8.9 Repayments (the real "transaction" path)
`LedgerService.postGoldRepayment` (ledger.service.ts:156-218) normalizes four instruments into **gold grams**, then posts a pending GOLD_GRAM **CREDIT**:

| Instrument | Formula | Required extra | sourceType | Cite |
|---|---|---|---|---|
| MELTED_GOLD | `raw * karatPerMille / 750` | `karatPerMille` (400 if missing) | REPAYMENT_MELTED_GOLD | :173-180 |
| CASH | `raw / (pricePerGramRial / 4.331802)` | `pricePerGramRial` (400 if missing) | REPAYMENT_CASH | :182-191 |
| TRANSFER | `raw` (1:1 grams) | — | REPAYMENT_TRANSFER | :193-196 |
| CHEQUE | `raw` (1:1 grams) | — | REPAYMENT_CHEQUE | :197-200 |

`postRialRepayment` posts a RIAL CREDIT with `sourceType: REPAYMENT_CASH`, also pending (ledger.service.ts:225-242) — explicitly noted as **not present in legacy** (:220-224).
`postAdjustment` posts an ADJUSTMENT in either currency/direction, **always `confirmed: true`**, requires `note` and `postedByAdminUserId` (ledger.service.ts:244-268) — **no caller in `src/`**.
`postEntry` rejects non-positive amounts (`amount.lte(0)` → 400, ledger.service.ts:34-36).
`confirmEntry` is idempotent (returns early if already confirmed) and then applies to the balance (ledger.service.ts:74-86).

Admin document path (`AdminDocumentsService`, admin-documents.service.ts):
- Legacy type codes 1..4 → LedgerSourceType (:26-31); instrument name mapping (:34-39); Farsi labels (:48-57).
- `create` picks the raw figure per instrument: CASH→`price`, MELTED_GOLD→`original_value ?? value`, else `value` (:226-231), delegates to `postGoldRepayment`, then patches instrument metadata (:233-249).
- `toggleConfirm` is a **bidirectional** toggle: confirm delegates to `LedgerService.confirmEntry`; un-confirm reverses the cached balance in a transaction (`CREDIT → +amount`, `DEBIT → -amount`) and clears the flag (:309-338).
- `update` **refuses to change the amount of a confirmed entry** (400, :284-288); allows metadata/note always and amount on unconfirmed entries (:290-294).
- `remove` **refuses to delete a confirmed entry** (400, :347-357).

### 8.10 Credit limit / suspension (the "limits" logic)
- Single limit: `Customer.goldCreditLimitGrams` (legacy `gram_level`).
- Check at placement: `isSuspendedOverCreditLimit = (totalGoldWeightGrams + customer.goldDebtGrams) > customer.goldCreditLimitGrams` (orders.service.ts:71-74).
- Over limit → the order is **created with status SUSPENDED**, not rejected; the flag is persisted and a status event notes "Credit limit exceeded" (orders.service.ts:75, 88, 101).
- **The check uses the cached `goldDebtGrams`**, which excludes pending repayments (ledger.service.ts:306-312) — so an unconfirmed repayment does not relax the limit.
- **`canPlaceOrders` is never enforced** in `OrdersService.createOrder` — it is toggled (admin-customers.service.ts:773-780) and exposed, but no order path reads it.
- Limit edits: `updateCredit` (requires `gram_level`, admin-customers.service.ts:852-864) and `update` (:612-614), both via `new Prisma.Decimal(String(...))`.
- **No per-order, daily, or per-customer transaction-count limits exist.**

### 8.11 KYC / verification
- `VerificationStep` enum: UNVERIFIED → STEP_ONE_SUBMITTED → STEP_TWO_SUBMITTED → VERIFIED (schema.prisma:54-59).
- Document URLs on Customer: `nationalIdImageUrl`, `businessLicenseUrl`, `shopImageUrl` (schema.prisma:205-207); persisted on create from `national_id_image`/`business_license`/`shop_image` (admin-customers.service.ts:591-593).
- `AdminCustomersService.verify` (admin-customers.service.ts:790-816) takes legacy `{ customer_id, sts_verify_step_one|sts_verify_step_two }` where **2 = accept, anything else = reject**:
  - step-one accept → `STEP_TWO_SUBMITTED`; step-one reject → `UNVERIFIED` (:801-805)
  - step-two accept → `VERIFIED`; step-two reject → `STEP_ONE_SUBMITTED` (:806-810)
  - neither key → 400 (:811-813)
- **Verification is never enforced anywhere** — no order, ledger or limit path reads `verificationStep`. The `non_verified` list scope only filters the grid (admin-customers.service.ts:170-193).
- `nationalCode` is `@unique` but falls back to the **mobile number** when not supplied (admin-customers.service.ts:530, 567) — so retail customers systematically carry a national code equal to their phone.

### 8.12 OTP / SMS
- **No OTP implementation of any kind**: no OTP model, no code generation, no verification endpoint, no expiry. (Grep for `otp` over `src/` returns nothing.)
- **SMS is persistence-only** — no provider, no HTTP call. `AdminMiscService.sendSms` validates a non-empty body, resolves the audience and recipient list, and writes an `SmsMessage` row with `sentCount = recipients.length` (admin-misc.service.ts:176-195). Nothing is actually transmitted.
- Audience codes (admin-misc.service.ts:205-221): `-1`→SINGLE_NUMBER, `0`→ALL_CUSTOMERS, `1`→SALES_AGENTS, `2`→WHOLESALE_CUSTOMERS, `9`→MULTIPLE_NUMBERS; plus name aliases single/multiple/all/omde/tak/reagent. `RETAIL_CUSTOMERS` is reachable only by name — the legacy markup had no numeric option for it (noted :202-203).
- The customer reactivation SMS legacy sent is deliberately **not** fired (admin-customers.service.ts:754-757).

### 8.13 Notifications
- `Notification` + `NotificationRecipient` (per-customer read state), schema.prisma:831-858.
- `createNotification` (broadcast by audience) / `notifyCustomer` (single) / `markNotificationRead` / `findNotification` / `listNotifications` (admin-misc.service.ts:263, 291, 388, 317, 347).
- **Delivery is in-database only** — no push, email or SMS dispatch.

### 8.14 Payment gateway + callbacks
- **None.** No gateway module, no redirect/verify endpoints, no callback route, no `zarinpal`/`sadad`/`IPG` reference, no signature verification, and no outbound HTTP client in the dependency list. Money enters the system exclusively as an admin-filed repayment document (§8.9).

### 8.15 File uploads
- `AdminUploadsService.store` (admin-uploads.service.ts:37-69):
  - 400 if no file (:42); **max 8 MB** `MAX_BYTES = 8*1024*1024` (:33, 43-45)
  - MIME allowlist: `image/(jpeg|png|gif|webp|svg+xml)` or `application/pdf` (:30, 46-48) — note **SVG is accepted**, and it is later served inline (public-uploads.controller.ts:23-26), an XSS vector
  - Stored name: `md5(Date.now() + originalname + randomUUID()) + ext` (:50-54)
  - Written to `getUploadDir()`, row created with `url = '/uploads/<stored>'` (:56-68)
- Path resolution + traversal defence: `resolveStoredUpload` takes `basename`, rejects `.`/`..`, checks the resolved path stays under the upload dir, and also probes a nested `uploads/uploads/` leftover (upload-path.ts:34-48).
- Serving: static mount at `/uploads/` (main.ts:28-36) **and** a streaming controller at `/api/uploads/:filename` with a 1-day cache header (public-uploads.controller.ts:17-27), because the user-app's axios base is `/api` (:9-13).
- Deliberately **not** ported: webp re-encoding, watermarking, thumbnailing (dead in legacy too) (admin-uploads.service.ts:20-22).

### 8.16 Settings
- One key/value table: `Setting { key @id, value Json, updatedAt }` (schema.prisma:690-694), replacing legacy `config_static`.
- Generic CRUD: `getConst` / `setConst` / `listConsts` / `removeConst` (admin-misc.service.ts:464-491), exposed at `GET|PUT|DELETE admin/misc/const/:key` under `config.statics`.
- **Known keys**: `wallet.config`, `wallet.birthday` (admin-documents.controller.ts:51,58,64,71), `promotion.auto` (admin-promotions.service.ts:257,262,275-280), `mobile_main_slider` (admin-misc.controller.ts:188,193,199).
- The slider key is **privilege-separated**: dedicated routes require `custom.config.statics.slider`, and `assertNotSliderKey` blocks reaching `mobile_main_slider` through the generic `config.statics` routes (admin-misc.controller.ts:184-200, 224-233).
- `setAutoPromotion` validates `0 ≤ discount_percent ≤ 100` (admin-promotions.service.ts:261-266).
- Settings are **read with fallbacks, never seeded** (§7.2).

### 8.17 XTable query engine (`TableService`) — shared by every admin grid
- Operators → Prisma: `=`,`!=`,`>`,`>=`,`<`,`<=`,`like`(→`contains`, `%` stripped, `mode:'insensitive'`),`in`,`between`(value+value2),`null`,`notnull` (table.service.ts:56-91).
- Field allowlist enforced per call; unknown field → 400 `Field not filterable` (table.service.ts:49-53) — also applied to sort fields (:121).
- Dotted paths nested into relation filters (`customer.fullName` → `{customer:{fullName:…}}`) (table.service.ts:42-47).
- Defaults: `page=1`, `limit=10` (table.service.ts:95-96); `limit` capped at 500 by the DTO (`@Max(500)`).
- Sort: `'+field'` asc / `'-field'` desc, default `{createdAt:'desc'}` (table.service.ts:116-124).
- Response envelope `{ rows, query:{search,filters,total,limit,page} }` (table.service.ts:137-148).
- **Exports are unimplemented and rejected loudly**: any `op` → 400 (table.service.ts:150-157), called by every list method as `assertNotExport`.

### 8.18 Branch scoping
`AdminOrdersService.list` narrows to `admin.branchId` whenever the caller has one (admin-orders.controller.ts:39, admin-orders.service.ts:75-81), faithfully reproducing legacy. The seed keeps head-office admins branch-less precisely so they are not scoped (seed.ts:140-143, admin-orders.controller.ts:33-37). Same pattern for `listSingle` (admin-customers.controller.ts:65).

---

## 9. Auth

| Concern | Implementation | Cite |
|---|---|---|
| Strategy | `passport-jwt`, named `'jwt'`, token from `Authorization: Bearer` | jwt.strategy.ts:30-37 |
| **JWT secret** | `process.env.JWT_SECRET ?? 'dev-only-insecure-secret'` — **same insecure fallback in two places** | auth.module.ts:16, jwt.strategy.ts:35 |
| **Expiry** | `process.env.JWT_EXPIRES_IN ?? '12h'`, cast to `` `${number}h` `` | auth.module.ts:20 |
| `ignoreExpiration` | `false` (expiry enforced) | jwt.strategy.ts:34 |
| **Refresh tokens** | **NONE** — no refresh endpoint, no refresh token, no rotation, no revocation/blacklist. A token is valid until it expires. | (absent) |
| Token payload | `{ sub: user.id, mobile }` only — **no roles/permissions baked in** | auth.service.ts:43, jwt.strategy.ts:7-10 |
| Per-request principal | `validate()` re-reads the AdminUser + userType.permissions on **every request**, so permission changes take effect immediately | jwt.strategy.ts:39-61, comment :49-50 |
| Inactive users | `!user \|\| !user.isActive` → 401 | jwt.strategy.ts:45-47 |
| Password hashing | bcryptjs, `bcrypt.compare` on login; cost 10 on customer create and in the seed | auth.service.ts:38, admin-customers.service.ts:572, seed.ts:17 |
| Login response | `{ id, name, fullName, mobile, role, ut, branch_id, api_token, roles:[{rid}] }` — legacy shape | auth.service.ts:45-55 |
| Enumeration defence | bad phone and bad password both return **401** (legacy returned 404/422) | auth.service.ts:24-26, 34-41 |
| `GET admin/auth/me` | returns **raw (unexpanded)** rids as `permission[]`; the frontend runs checkParent() | auth.service.ts:58-88, esp. :86 |

**Guards** — both registered globally via `APP_GUARD` in AuthModule (auth.module.ts:29-30):

| Guard | Behaviour | Cite |
|---|---|---|
| `JwtAuthGuard extends AuthGuard('jwt')` | Reads `IS_PUBLIC_KEY` via `reflector.getAllAndOverride` on handler **and class**; `@Public()` → allow; otherwise `super.canActivate`. Secure-by-default (inverse of legacy's allowlist). | guards.ts:35-49, comment :27-34 |
| `PermissionsGuard` | Reads `REQUIRED_RID_KEY`; **no rid → allow**. Otherwise requires `req.user` (else 403) and `user.permissions.includes(requiredRid)` (else 403 `Missing permission: <rid>`). | guards.ts:52-71 |

**Decorators**:

| Decorator | Key | Cite |
|---|---|---|
| `@Public()` | `SetMetadata('isPublic', true)` | guards.ts:14-15 |
| `@RequirePermission(rid)` | `SetMetadata('requiredRid', rid)` | guards.ts:18-19 |
| `@CurrentAdmin()` | `createParamDecorator` → `req.user` as `AuthenticatedAdmin` | guards.ts:22-25 |

**Permission model**:
- Permissions attach to the **UserType** (`ut`), never to an individual admin — every admin of a type shares one set (schema.prisma:600-618, Permission composite PK `[rid, userTypeId]` :641).
- `expandWithParents(rids)` derives ancestors at request time: granting `persons.list.client.omde` implicitly grants `persons.list.client`, `persons.list`, `persons` (acl.constants.ts:194-203, applied jwt.strategy.ts:60). Port of legacy `checkParent()`.
- `getParents` walks up only — **a rid never implies its children**; the resulting legacy quirk (holding `wallet` does not grant `wallet.list`) is **deliberately preserved** as a documented legacy bug (acl.constants.ts:171-192).
- `setRoles` **replaces** a user type's whole rid set inside one transaction (deleteMany + createMany skipDuplicates) — and performs **no validation against `ALL_RIDS`**, so an arbitrary string can be stored as a rid (admin-users.service.ts:317-332).
- `revokeRole` removes one rid, 404 if absent (admin-users.service.ts:335-346).
- `AdminRole` (the coarse enum) is used for business rules, not for route gating — the only enforcement is `SalesAgentService.assertIsSalesExpert` (`role !== 'SALES_EXPERT'` → 403, sales-agent.service.ts:36-40) and `queryReagents` filtering `role: 'SALES_EXPERT'` (admin-customers.service.ts:719).

### 9.1 All role names

**`AdminRole` (5)** — schema.prisma:21-27, labels admin-users.service.ts:353-361:
`SUPER_ADMIN` (مدیر ارشد), `SYSTEM_APPROVER` (تایید مدیر سیستم), `SALES_EXPERT` (کارشناس فروش), `WORKSHOP_SUPERVISOR` (سرپرست کارگاه), `ACCOUNTANT` (حسابدار).

**`UserType` rows seeded (5)** — seed.ts:66-98: 85 مدیر ارشد, 86 کارشناس فروش, 87 حسابدار, 88 سرپرست کارگاه, 89 کاربر شعبه.

### 9.2 All permission names (`ALL_RIDS`, 144 leaf rids)

Source: `src/modules/auth/acl.constants.ts:17-161`. Derived as the union of 58 route-gated (`meta.role`) + 100 in-view (`$hasPermission`) legacy rids (acl.constants.ts:4-13).

| Group | Rids |
|---|---|
| branch | `branch.create`, `branch.list` |
| buy | `buy.order.list` |
| cities | `cities.create`, `cities.list`, `cities.list.remove`, `cities.list.view`, `cities.list.view.edit` |
| collection | `collection.create`, `collection.list`, `collection.list.edit`, `collection.list.remove` |
| comment | `comment`, `comment.remove`, `comment.state`, `comment.view`, `comment.view.edit` |
| config | `config.report`, `config.statics`, `config.statics.brand`, `config.statics.brand.create`, `config.statics.brand.edit`, `config.statics.brand.remove`, `config.statics.tags`, `config.statics.tags.create`, `config.statics.tags.edit`, `config.statics.tags.remove`, `config.wallet` |
| custom | `custom.config.statics.slider`, `custom.config.statics.tags.banner.ids` |
| dashboard | `dashboard.view` |
| document | `document.create`, `document.list`, `document.list.confirm`, `document.list.deny`, `document.list.edit`, `document.list.get`, `document.list.remove` |
| invoice | `invoice.create`, `invoice.list` |
| newsletters | `newsletters` |
| notify | `notify.create`, `notify.me` |
| offers | `offers.autopromotion`, `offers.create`, `offers.create.tak`, `offers.list`, `offers.list.edit`, `offers.list.remove`, `offers.list.tak.edit`, `offers.list.tak.remove`, `offersIgnore` |
| order | `order.create`, `order.list`, `order.list.pdf`, `order.list.sts`, `order.list.sts.remove`, `order.list.sts.submit`, `order.list.view`, `order.list.view.edit`, `order.makeOrder`, `order.makeOrder.get`, `order.makeOrder.remove`, `order.makeOrder.state`, `order.makeOrder.state.remove`, `order.makeOrder.state.submit`, `order.makeOrder.view`, `order.makeOrder.view.edit`, `order.omde`, `order.omde.get`, `order.omde.remove`, `order.omde.state`, `order.omde.state.remove`, `order.omde.state.submit`, `order.omde.view`, `order.omde.view.edit`, `order.omde.view.remove`, `order.tamin`, `order.tamin.state`, `order.tamin.state.remove`, `order.tamin.state.submit`, `order.tamin.view`, `order.tamin.view.edit` |
| persons | `persons.create`, `persons.create.client`, `persons.create.customer.tak`, `persons.create.seller`, `persons.list.client.omde`, `persons.list.client.omde.able`, `persons.list.client.omde.able.order`, `persons.list.client.omde.edit`, `persons.list.client.omde.unable`, `persons.list.client.omde.unable.order`, `persons.list.client.omde.view`, `persons.list.client.omde.view.documents`, `persons.list.client.omde.view.orders`, `persons.list.client.single`, `persons.list.client.single.edit`, `persons.list.client.single.view`, `persons.list.sellers`, `persons.list.sellers.able`, `persons.list.sellers.able.order`, `persons.list.sellers.edit`, `persons.list.sellers.unable`, `persons.list.sellers.unable.order`, `persons.list.sellers.view`, `persons.list.sellers.view.documents`, `persons.list.sellers.view.orders` |
| product | `product.create`, `product.list`, `product.list.edit`, `product.list.group.edit`, `product.list.remove`, `product.list.variants`, `product.list.variants.add`, `product.list.variants.edit`, `product.list.variants.remove`, `product.list.view`, `product.percent` |
| report | `report.order.item`, `report.product` |
| sms | `sms.create`, `sms.create.all`, `sms.create.multiple`, `sms.create.omde`, `sms.create.reagent`, `sms.create.single`, `sms.list` |
| statics | `statics` |
| user | `user.create`, `user.list`, `user.list.create`, `user.list.edit`, `user.list.remove`, `user.permission`, `user.permission.create`, `user.permission.edit` |
| wallet | `wallet`, `wallet.charge`, `wallet.list`, `wallet.percent` |
| workshop | `workshop.create`, `workshop.list` |

**Rids declared but never enforced by any route** (declared-only; the panel may use them client-side): `comment.remove`, `comment.state`, `comment.view`, `comment.view.edit`, `config.statics.tags*` (4), `custom.config.statics.tags.banner.ids`, `document.list.confirm`, `document.list.deny`, `document.list.get`, `document.list.remove`, `cities.list.view`, `collection.list.remove`, `offers.create.tak`, `offers.list.remove`, `offers.list.tak.edit`, `offers.list.tak.remove`, `order.list.pdf`, `order.list.sts*`, `order.list.view*`, `order.makeOrder.get/remove/state*/view*`, `order.omde.get/remove/state*/view*`, `order.tamin.state*/view*`, `persons.create.client/customer.tak/seller`, `persons.list.*.able/unable*`, `persons.list.client.single.edit`, `persons.list.sellers.edit/able/unable*/view.documents/view.orders`, `product.list.group.edit/remove/variants*/view`, `sms.create.all/multiple/omde/reagent/single`, `user.list.create`, `wallet.charge/list/percent`, `buy.order.list`, `newsletters` is enforced, `statics` is enforced.

---

## 10. Jobs / cron / schedulers / websockets

**None of any kind.** Verified by grep over `src/`: no `@nestjs/schedule`, `ScheduleModule`, `@Cron`, `@Interval`, `setInterval`, `node-cron`, `@WebSocketGateway`, `SubscribeMessage`, `OnGatewayInit`, or `socket.io`. Confirmed absent from `package.json` dependencies too.

The only non-request-triggered work is the **boot-time** sequence in `prepareDatabase()` (bootstrap.ts:104-134), executed once before `NestFactory.create`:
1. Returns immediately if `RUN_MIGRATIONS === 'false'` (bootstrap.ts:105).
2. `runMigrations(prisma)` applies pending `.sql` files and logs which were applied (bootstrap.ts:111-117).
3. Returns if `RUN_SEED === 'false'` (bootstrap.ts:119).
4. Resolves the seed script from `SEED_SCRIPT` / `cwd/seed.js` / `../../seed.js`; warns and skips if none found (bootstrap.ts:12-19, 121-125).
5. `runOnce(prisma, 'seed:initial', ...)` spawns the seed as a child process, gated on a marker row so an interrupted seed is retried next boot (bootstrap.ts:127-131, comment :100-102).
6. Always `$disconnect()` in `finally` (bootstrap.ts:132-134).

Consequences worth noting: `reconcileBalance` (ledger.service.ts:289) is described as "run periodically" but **has no scheduler**; `WalletBonus.expiresAt` is never swept; `GoldPriceQuote` is never refreshed.

---

## 11. Env / config keys

**No `@nestjs/config` / `ConfigService` anywhere** — every value is read directly from `process.env` at module-evaluation or call time, which means `JwtModule.register` captures `JWT_SECRET` once at import (auth.module.ts:15-22).

| Key | Used at | Default / fallback | Purpose |
|---|---|---|---|
| `DATABASE_URL` | prisma/schema.prisma:14 (`env("DATABASE_URL")`) | none (required) | Postgres connection |
| `PORT` | main.ts:37 | `3000` | HTTP listen port |
| `UPLOAD_DIR` | main.ts:28, upload-path.ts:13 | `<cwd>/storage/uploads` | upload read/write root |
| `JWT_SECRET` | auth.module.ts:16, jwt.strategy.ts:35 | **`'dev-only-insecure-secret'`** | JWT signing + verification |
| `JWT_EXPIRES_IN` | auth.module.ts:20 | `'12h'` | token lifetime |
| `RUN_MIGRATIONS` | bootstrap.ts:29 | unset → migrations run; `'false'` skips | boot-time migration switch |
| `RUN_SEED` | bootstrap.ts:43 | unset → seed runs once; `'false'` skips | boot-time seed switch |
| `SEED_SCRIPT` | bootstrap.ts:13 | falls back to `cwd/seed.js`, `../../seed.js` | seed script location |
| `MIGRATIONS_DIR` | migrate.ts:22 | falls back to `cwd/migrations`, `../../migrations`, `../../prisma/migrations`, `cwd/prisma/migrations` | migrations location |

`.env.example` declares only **2 of the 9**: `DATABASE_URL` and `PORT` (.env.example:1-7). `PORT` must be kept in sync manually with the repo-root `API_PORT` because Nest/Prisma only load this app's own `.env` (.env.example:3-6). `JWT_SECRET` in particular is undocumented there, so a deployment that forgets it silently runs on the hardcoded dev secret.

---

## 12. Cross-cutting notes (evidence-backed)

| # | Observation | Cite |
|---|---|---|
| 1 | 15 routes are fully unauthenticated, including ledger writes (`POST accounting/repayments/*`, `POST accounting/entries/:id/confirm`) and order creation/status changes (`POST orders`, `PATCH orders/:id/status`) | accounting.controller.ts:7, orders.controller.ts:7 |
| 2 | `orders/dto/update-order-status.dto.ts` accepts a client-supplied `actorAdminUserId` on a `@Public()` route, so audit actor is attacker-controlled there | update-order-status.dto.ts:12-14, orders.controller.ts:22-24 |
| 3 | `JWT_SECRET` has an insecure hardcoded fallback duplicated in two files and is absent from `.env.example` | auth.module.ts:16, jwt.strategy.ts:35, .env.example |
| 4 | `enableCors()` with no options → `Access-Control-Allow-Origin: *` for every route | main.ts:25 |
| 5 | `ValidationPipe` lacks `forbidNonWhitelisted`; most admin bodies are `Record<string, unknown>`, so whitelisting has nothing to strip | main.ts:23, e.g. admin-products.controller.ts:103 |
| 6 | `setRoles` stores arbitrary strings as rids — no check against `ALL_RIDS` | admin-users.service.ts:317-332 |
| 7 | Debt idempotency guard for DELIVERED_TO_AGENT tests `deliveredAt`, which is only set by DELIVERED_TO_CUSTOMER | orders.service.ts:120, 133 |
| 8 | No status-transition validation — any `OrderStatus` reachable from any other | orders.service.ts:111-139 |
| 9 | `canPlaceOrders` and `verificationStep` are toggled/stored but never enforced on any order path | admin-customers.service.ts:773-780, 790-816 vs orders.service.ts:32-109 |
| 10 | `reconcileBalance`, `postAdjustment`, `PricingService.recordQuote`, and `LedgerSourceType.WALLET_BONUS`/`ORDER_PRE_ORDER` have no scheduled or in-app producer | ledger.service.ts:244-304, pricing.service.ts:9-13, schema.prisma:100,106 |
| 11 | SVG accepted on upload and streamed back `disposition: 'inline'` | admin-uploads.service.ts:30, public-uploads.controller.ts:23-26 |
| 12 | `nationalCode` (unique) silently defaults to the mobile number | admin-customers.service.ts:530, 567 |
| 13 | Two distinct DTO classes share the name `UpdateOrderStatusDto` with different shapes | orders/dto/update-order-status.dto.ts:4, admin-orders/update-status.dto.ts:11 |
| 14 | Grid exports (`op: excel/json/print`) are declared in the DTO but always 400 | table-query.dto.ts:97-99, table.service.ts:150-157 |
| 15 | The `Setting` table is never seeded; all config keys materialize on first write | seed.ts (no `setting.` call), admin-documents.service.ts:416-428 |
| 16 | Seed ships a dev account whose password equals its phone number (`09128081392`) with SUPER_ADMIN + all 144 rids | seed.ts:23-24, 118-129 |