tehran_taj/docs/parity/_inv-ref-server.md

Inventory — henza_server (reference backend)

Evidence-based inventory. All path:line are relative to henza_server/. Domain note: this codebase is a gold jewelry B2B/B2C e-commerce + wholesale ledger, not a "gold bank". There is no buy/sell order book, no deposit/withdraw, no KYC-level system, no transfer between users. Gold is handled as (a) a live 18-ayar price feed used in product pricing, and (b) a gram-denominated wallet (cashback/loyalty). See §7 for what exists vs. what does not.

---

1. Stack & versions

Item	Value	Evidence
Framework	laravel/framework: ^8.0	composer.json:19
PHP	^7.3	composer.json:10
App name/env	APP_NAME, APP_ENV, APP_DEBUG, APP_URL	config/app.php
Autoload PSR-4	App\ → app/, Rooyesh\Wallet\ → packages/rooyesh/wallet/src/	composer.json:41-46
Custom app version	2.2.0	config/version.php:3

Key packages (composer.json:9-27)

Package	Constraint	Line	Purpose
apility/laravel-fcm	^1.4	11	Push (FCM)
brozot/laravel-fcm	^1.3	13	Push (FCM, second impl)
barryvdh/laravel-dompdf	^0.9.0	12	PDF invoices
niklasravnsborg/laravel-pdf	^4.1	24	PDF (mPDF)
fideloper/proxy	^4.2	14	Trusted proxies
fruitcake/laravel-cors	^2.0	15	CORS
guzzlehttp/guzzle	^7.0.1	16	HTTP (SMS/price feeds)
hekmatinasser/verta	^2.1	17	Jalali dates
morilog/jalali	3.*	22	Jalali dates (primary, used in Utility)
ixudra/curl	^6.21	18	cURL (payping)
jgrossi/corcel	^5.0	19	WordPress DB bridge (config/corcel.php)
maatwebsite/excel	^3.1	21	Excel export (TableEngine)
phpoffice/phpspreadsheet	*	23	Excel
phpro/soap-client	^1.4	25	SOAP (legacy Zarinpal)
laravel/tinker	^2.0	20	—

Dev: facade/ignition ^2.3.6, fzaninotto/faker ^1.9.1, mockery/mockery ^1.3.1, nunomaduro/collision ^5.0, phpunit/phpunit ^9.3 (composer.json:29-35).

Local package: packages/rooyesh/wallet — in-repo gold/credit wallet module (see §7).

---

2. Bootstrap / Middleware / Auth

2.1 Global middleware — app/Http/Kernel.php:17-25 (order as declared)

#	Class	Line
—	App\Http\Middleware\TrustHosts	18 (commented out)
1	App\Http\Middleware\TrustProxies	19
2	Fruitcake\Cors\HandleCors	20
3	App\Http\Middleware\PreventRequestsDuringMaintenance	21
4	Illuminate\Foundation\Http\Middleware\ValidatePostSize	22
5	App\Http\Middleware\TrimStrings	23
6	Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull	24

2.2 Middleware groups — app/Http/Kernel.php:32-47

Group	Stack (in order)	Lines
web	EncryptCookies, AddQueuedCookiesToResponse, StartSession, (AuthenticateSession commented, :37), ShareErrorsFromSession, VerifyCsrfToken, SubstituteBindings	33-41
api	throttle:api, SubstituteBindings	43-46

Rate limit: Limit::perMinute(500) for the api limiter — app/Providers/RouteServiceProvider.php:76-78.

2.3 Route middleware aliases — app/Http/Kernel.php:56-68

Alias	Class	Line
auth	App\Http\Middleware\Authenticate	57
auth.basic	Illuminate\Auth\Middleware\AuthenticateWithBasicAuth	58
cache.headers	Illuminate\Http\Middleware\SetCacheHeaders	59
can	Illuminate\Auth\Middleware\Authorize	60
guest	App\Http\Middleware\RedirectIfAuthenticated	61
password.confirm	Illuminate\Auth\Middleware\RequirePassword	62
signed	Illuminate\Routing\Middleware\ValidateSignature	63
throttle	Illuminate\Routing\Middleware\ThrottleRequests	64
verified	Illuminate\Auth\Middleware\EnsureEmailIsVerified	65
version	App\Http\Middleware\VersionMiddleware	66
create_log	App\Http\Middleware\CreateLog	67

Custom middleware behavior:

• VersionMiddleware — reads config('version.version'); if request header version present and ≠ config, returns {"version": false} — app/Http/Middleware/VersionMiddleware.php:19-33.
• CreateLog — writes a RequestLog row (customer_id from auth()->id(), ip, data, user_agent, route, method) on every request in the group — app/Http/Middleware/CreateLog.php:18-30. Note bug: 'device', is a positional value, not a key (:23).
• Authenticate::redirectTo() — abort(401,'no authorised') instead of redirect — app/Http/Middleware/Authenticate.php:15-21.

2.4 Route file prefixes/middleware — app/Providers/RouteServiceProvider.php:41-66

File	Prefix	Group middleware	Lines
routes/api.php	api	api	43-46
routes/web.php	(none)	web	48-50
routes/admin.php	admin	api	52-55
routes/site.php	site	api	57-60
routes/customer.php	cu	api	62-65

HOME = '/home' (:20). $namespace is commented out (:29) so string-controller routes use FQCN strings.

2.5 Auth guards & providers — config/auth.php

Guard	Driver	Provider	hash	Line
web	session	users	—	39-42
api (default)	token	users	false	44-48
api-customer	token	customers	false	50-54
api-singleCustomer	token	singleCustomers	false	56-60

Defaults: guard api, passwords users (:16-19).

Provider	Driver	Model	Line
users	eloquent	App\Models\User	81-84
customers	eloquent	App\Models\Customer	85-88
singleCustomers	eloquent	App\Models\SingleCustomer	89-92

Password resets: table password_resets, expire 60, throttle 60 (:115-122). password_timeout: 10800 (:135).

Three-actor model: User = staff/admin (guard api), Customer = wholesale/major shopkeeper (guard api-customer), SingleCustomer = retail web customer, table login (guard api-singleCustomer).

---

3. Routes (exhaustive)

name column: no route is given a ->name() anywhere in any route file. Resource routes get Laravel's implicit names (cat.index, …) which are listed. Middleware column = group middleware from RouteServiceProvider + any explicit route middleware.

3.1 routes/admin.php — prefix admin, middleware api

⚠️ The entire file's auth wrapper Route::middleware('auth:api')->group(...) is COMMENTED OUT at routes/admin.php:12 and :264. Every admin route below is unauthenticated.

METHOD	path	name	controller@method	middleware/guards	line
POST	admin/product/create	—	Adm\ProductController@store	api	14
GET	admin/product/show/{id}	—	Adm\ProductController@show	api	15
PUT	admin/product/update/{id}	—	Adm\ProductController@update	api	16
POST	admin/product/test	—	Adm\ProductController@testSearch	api	17
POST	admin/product/report	—	Adm\ProductController@report	api	18
GET	admin/product/color	—	Adm\ProductController@color	api	19
POST	admin/product/variant	—	Adm\ProductController@getProductsVaraints	api	20
GET	admin/product/offer/{product_id}	—	Adm\ProductController@changeOffer	api	21
GET	admin/product/exist/{product_id}	—	Adm\ProductController@changeIsExist	api	22
GET	admin/product/warranty/{product_id}	—	Adm\ProductController@changeHasWarranty	api	23
GET	admin/dashboard/all	—	Adm\DashboardController@getAll	api	26
GET	admin/dashboard/change	—	Adm\DashboardController@change	api	27
GET	admin/dashboard/info	—	Adm\DashboardController@info	api	28
GET	admin/dashboard/link	—	Adm\DashboardController@link	api	29
POST	admin/admin-login	—	Adm\AdminController@login	api	33
POST	admin/products	—	Adm\AdminController@getProducts	api	34
POST	admin/single-customer	—	Adm\AdminController@getSingleCustomer	api	35
GET	admin/category	—	Adm\AdminController@queryCategory	api	36
GET	admin/get-analytics	—	Adm\AdminController@getAnalytics	api	37
GET	admin/get-analytics-tak	—	Adm\AdminController@getAnalyticsTak	api	38
POST	admin/product	—	Adm\AdminController@addProduct	api	39
POST	admin/add/variant	—	Adm\AdminController@addVariant	api	40
GET	admin/get/variant	—	Adm\AdminController@getVariant	api	41
POST	admin/get/variants	—	Adm\AdminController@getVariants	api	42
GET	admin/config/statics	—	Adm\AdminController@getConfigStatics	api	43
GET	admin/product/{id}	—	Adm\AdminController@getProduct	api	44
POST	admin/delete/product/{id}	—	Adm\AdminController@deleteProduct	api	45
POST	admin/category	—	Adm\AdminController@getCategory	api	46
POST	admin/add/category	—	Adm\AdminController@AddCategory	api	47
GET	admin/category/{id}	—	Adm\AdminController@getOneCategory	api	48
GET	admin/havale/list	—	Adm\AdminController@getHavaleList	api	49
DELETE	admin/category/{id}	—	Adm\AdminController@deleteCategory	api	50
GET	admin/price	—	Closure → WebServiceGold::getAllPrice()	api	51-53
POST	admin/change/percent	—	Adm\AdminController@changePercent	api	54
POST	admin/change/percent/count	—	Adm\AdminController@countProductForPercent	api	55
POST	admin/change/all	—	Adm\AdminController@changeAll	api	56
POST	admin/single/order-sts/edit	—	Adm\AdminController@orderStsSingle	api	59
POST	admin/single-order	—	Adm\AdminController@getSingleOrders	api	60
POST	admin/order	—	Adm\OrderController@store	api	61
PUT	admin/order/{id}	—	Adm\OrderController@update	api	62
GET	admin/order/type	—	Adm\OrderController@getType	api	63
GET	admin/order/pdf/{id}	—	Customer\OrderController@generateReportOrder	api	64
POST	admin/cat	—	Adm\CategoryController@index	api	70
GET	admin/cat	cat.index	Adm\CategoryController@index	api	71 (resource)
GET	admin/cat/create	cat.create	Adm\CategoryController@create	api	71
POST	admin/cat	cat.store	Adm\CategoryController@store	api	71
GET	admin/cat/{cat}	cat.show	Adm\CategoryController@show	api	71
GET	admin/cat/{cat}/edit	cat.edit	Adm\CategoryController@edit	api	71
PUT/PATCH	admin/cat/{cat}	cat.update	Adm\CategoryController@update	api	71
DELETE	admin/cat/{cat}	cat.destroy	Adm\CategoryController@destroy	api	71
POST	admin/major/order/table	—	Adm\MajorOrderController@index	api	78
GET	admin/major/order	major/order.index	Adm\MajorOrderController@index	api	79 (resource)
GET	admin/major/order/create	major/order.create	Adm\MajorOrderController@create	api	79
POST	admin/major/order	major/order.store	Adm\MajorOrderController@store	api	79
GET	admin/major/order/{order}	major/order.show	Adm\MajorOrderController@show	api	79
GET	admin/major/order/{order}/edit	major/order.edit	Adm\MajorOrderController@edit	api	79
PUT/PATCH	admin/major/order/{order}	major/order.update	Adm\MajorOrderController@update	api	79
DELETE	admin/major/order/{order}	major/order.destroy	Adm\MajorOrderController@destroy	api	79
DELETE	admin/major/order_item/{id}	—	Adm\MajorOrderController@deleteOrderItem	api	80
POST	admin/order-tamin	—	Adm\MajorOrderController@getTaminOrders	api	81
POST	admin/order-sts/edit	—	Adm\MajorOrderController@orderSts	api	82
POST	admin/order-item/edit	—	Adm\MajorOrderController@orderItemEdit	api	83
POST	admin/delete-order	—	Adm\MajorOrderController@deleteOrder	api	84
POST	admin/brand/create	—	Adm\BrandController@store	api	88
GET	admin/brand	—	Adm\BrandController@index	api	89
PUT	admin/brand/{id}	—	Adm\BrandController@update	api	90
DELETE	admin/brand/{id}	—	Adm\BrandController@destroy	api	91
POST	admin/report/order_item	—	Adm\ReportController@getOrderItemWithDetails	api	96
POST	admin/major/table	—	Adm\MajorCustomerController@index	api	100
GET	admin/major/dashboard/{id}	—	Adm\MajorCustomerController@dashboard	api	101
POST	admin/major/order	—	Adm\MajorCustomerController@order	api	102 (shadowed by resource at :79)
POST	admin/major/cash	—	Adm\MajorCustomerController@cash	api	103
POST	admin/major/customer	—	Adm\MajorCustomerController@shopkeeper	api	104
POST	admin/major/sms	—	Adm\MajorCustomerController@indexSms	api	105
POST	admin/major/verify	—	Adm\MajorCustomerController@verifyRegister	api	106
POST	admin/major/archive/table	—	Adm\MajorCustomerController@indexArchive	api	107
POST	admin/major/verify/table	—	Adm\MajorCustomerController@indexVerify	api	108
GET	admin/major/archive/{customer_id}	—	Adm\MajorCustomerController@archive	api	109
GET	admin/major/list_type	—	Adm\MajorCustomerController@listTypeCustomer	api	110
POST	admin/reagent	—	Adm\AdminController@getReagent	api	113
POST	admin/banker	—	Adm\AdminController@getBanker	api	114
POST	admin/shopkeeper	—	Adm\AdminController@getShopkeeper	api	115
POST	admin/customer/toggle-sts	—	Adm\AdminController@customerToggleSts	api	116
POST	admin/customer/toggle-active	—	Adm\AdminController@customerToggleActive	api	117
GET	admin/customer/{id}	—	Adm\AdminController@getCustomerById	api	118
POST	admin/customer	—	Adm\AdminController@getCustomer	api	119
GET	admin/query/customer	—	Adm\AdminController@queryCustomer	api	120
GET	admin/query/reagent	—	Adm\AdminController@queryReagent	api	121
POST	admin/major/promotion/table	—	Adm\PromotionController@index	api	125
PUT	admin/autopromotion	—	Adm\PromotionController@updateAutoPromotion	api	126
GET	admin/autopromotion	—	Adm\PromotionController@getAutoPromotion	api	127
POST	admin/brand	—	Adm\PromotionController@getBrand	api	128
GET	admin/major/promotion	major/promotion.index	Adm\PromotionController@index	api	129 (resource)
GET	admin/major/promotion/create	major/promotion.create	Adm\PromotionController@create	api	129
POST	admin/major/promotion	major/promotion.store	Adm\PromotionController@store	api	129
GET	admin/major/promotion/{promotion}	major/promotion.show	Adm\PromotionController@show	api	129
GET	admin/major/promotion/{promotion}/edit	major/promotion.edit	Adm\PromotionController@edit	api	129
PUT/PATCH	admin/major/promotion/{promotion}	major/promotion.update	Adm\PromotionController@update	api	129
DELETE	admin/major/promotion/{promotion}	major/promotion.destroy	Adm\PromotionController@destroy	api	129
GET	admin/ignore	ignore.index	Adm\IgnoreController@index	api	132 (resource)
GET	admin/ignore/create	ignore.create	Adm\IgnoreController@create (not defined)	api	132
POST	admin/ignore	ignore.store	Adm\IgnoreController@store	api	132
GET	admin/ignore/{ignore}	ignore.show	Adm\IgnoreController@show	api	132
GET	admin/ignore/{ignore}/edit	ignore.edit	Adm\IgnoreController@edit (not defined)	api	132
PUT/PATCH	admin/ignore/{ignore}	ignore.update	Adm\IgnoreController@update (not defined)	api	132
DELETE	admin/ignore/{ignore}	ignore.destroy	Adm\IgnoreController@destroy($type)	api	132
POST	admin/cash/table	—	Adm\CashController@index	api	137
GET	admin/cash	cash.index	Adm\CashController@index	api	138 (resource)
GET	admin/cash/create	cash.create	Adm\CashController@create	api	138
POST	admin/cash	cash.store	Adm\CashController@store	api	138
GET	admin/cash/{cash}	cash.show	Adm\CashController@show	api	138
GET	admin/cash/{cash}/edit	cash.edit	Adm\CashController@edit	api	138
PUT/PATCH	admin/cash/{cash}	cash.update	Adm\CashController@update	api	138
DELETE	admin/cash/{cash}	cash.destroy	Adm\CashController@destroy	api	138
POST	admin/cash/confirem/{id}	—	Adm\CashController@toggleConfiremCash	api	139
POST	admin/file/create	—	Adm\FileController@storeWithoutData	api	145
PUT	admin/file/update/{file_id}	—	Adm\FileController@updateBody	api	146
POST	admin/comment/table	—	Adm\CommentController@index	api	150
GET	admin/comment	comment.index	Adm\CommentController@index	api	151 (resource)
GET	admin/comment/create	comment.create	Adm\CommentController@create	api	151
POST	admin/comment	comment.store	Adm\CommentController@store	api	151
GET	admin/comment/{comment}	comment.show	Adm\CommentController@show	api	151
GET	admin/comment/{comment}/edit	comment.edit	Adm\CommentController@edit	api	151
PUT/PATCH	admin/comment/{comment}	comment.update	Adm\CommentController@update	api	151
DELETE	admin/comment/{comment}	comment.destroy	Adm\CommentController@destroy	api	151
POST	admin/comment/sts	—	Adm\CommentController@changeStatus	api	152
GET	admin/const	const.index	Adm\ConstController@index (not defined)	api	155 (resource)
GET	admin/const/create	const.create	Adm\ConstController@create (not defined)	api	155
POST	admin/const	const.store	Adm\ConstController@store	api	155
GET	admin/const/{const}	const.show	Adm\ConstController@show	api	155
GET	admin/const/{const}/edit	const.edit	Adm\ConstController@edit (not defined)	api	155
PUT/PATCH	admin/const/{const}	const.update	Adm\ConstController@update	api	155
DELETE	admin/const/{const}	const.destroy	Adm\ConstController@destroy	api	155
DELETE	admin/const/by-id/{id}	—	Adm\ConstController@deleteById	api	156
POST	admin/roles	—	Adm\PermissionController@store	api	160
POST	admin/roles/create	—	Adm\PermissionController@create	api	161
DELETE	admin/roles/{ut}/{rid}	—	Adm\PermissionController@destroy	api	162
GET	admin/roles/{ut}/{rid}	—	Adm\PermissionController@has	api	163
GET	admin/roles	—	Adm\PermissionController@get	api	164
GET	admin/roles/{id}	—	Adm\PermissionController@getByUt	api	165
GET	admin/cities	cities.index	Adm\CitiesController@index (not defined)	api	168 (resource)
GET	admin/cities/create	cities.create	Adm\CitiesController@create (not defined)	api	168
POST	admin/cities	cities.store	Adm\CitiesController@store	api	168
GET	admin/cities/{city}	cities.show	Adm\CitiesController@show	api	168
GET	admin/cities/{city}/edit	cities.edit	Adm\CitiesController@edit (not defined)	api	168
PUT/PATCH	admin/cities/{city}	cities.update	Adm\CitiesController@update	api	168
DELETE	admin/cities/{city}	cities.destroy	Adm\CitiesController@destroy	api	168
POST	admin/cities/list	—	Adm\CitiesController@list	api	169
GET	admin/cities/get-percent/{id}	—	Adm\CitiesController@getPercent	api	170 (shadowed by cities.show)
GET	admin/cities/get-percent-aux/{id}	—	Adm\CitiesController@getPercentAux	api	171 (shadowed)
POST	admin/customer/create	—	Adm\AdminController@createCustomer	api	175
GET	admin/report/order	—	Adm\AdminController@generateReportOrder	api	176
GET	admin/report/doc	—	Adm\AdminController@generateReportDocument	api	177
GET	admin/users/show	—	Adm\UserController@showData	api	180
POST	admin/users/list	—	Adm\UserController@index	api	181
GET	admin/users	users.index	Adm\UserController@index	api	182 (resource)
GET	admin/users/create	users.create	Adm\UserController@create (not defined)	api	182
POST	admin/users	users.store	Adm\UserController@store	api	182
GET	admin/users/{user}	users.show	Adm\UserController@show	api	182
GET	admin/users/{user}/edit	users.edit	Adm\UserController@edit (not defined)	api	182
PUT/PATCH	admin/users/{user}	users.update	Adm\UserController@update	api	182
DELETE	admin/users/{user}	users.destroy	Adm\UserController@destroy	api	182
POST	admin/wallet/percent	—	Adm\WalletController@changePercent	api	186
POST	admin/wallet/table	—	Adm\WalletController@index	api	187
POST	admin/wallet/charge	—	Adm\WalletController@charge	api	188
POST	admin/wallet/config	—	Adm\WalletController@setConst	api	189
GET	admin/wallet/config	—	Adm\WalletController@getConfig	api	190
GET	admin/wallet/birthday/config	—	Adm\WalletController@getConfigBirthday	api	191
POST	admin/single/order	—	Adm\SingleCustomerController@indexOrder	api	194
POST	admin/single/transaction	—	Adm\SingleCustomerController@indexTransaction	api	195
POST	admin/single/sms	—	Adm\SingleCustomerController@indexSms	api	196
GET	admin/single/wallet/{id}	—	Adm\SingleCustomerController@getWallet	api	197
GET	admin/single/report/{id}	—	Adm\SingleCustomerController@report	api	198
GET	admin/single	single.index	Adm\SingleCustomerController@index (not defined)	api	199 (resource)
GET	admin/single/create	single.create	@create (not defined)	api	199
POST	admin/single	single.store	Adm\SingleCustomerController@store	api	199
GET	admin/single/{single}	single.show	Adm\SingleCustomerController@show	api	199
GET	admin/single/{single}/edit	single.edit	@edit (not defined)	api	199
PUT/PATCH	admin/single/{single}	single.update	Adm\SingleCustomerController@update	api	199
DELETE	admin/single/{single}	single.destroy	@destroy (only delete($id) exists)	api	199
POST	admin/sms/table	—	Adm\SmsController@index	api	202
GET	admin/sms/customer	—	Adm\SmsController@getCustomer	api	203
POST	admin/sms/other	—	Adm\SmsController@sendSmsToOther	api	204
POST	admin/notify/customer	—	Adm\NotifyController@customer	api	207
GET	admin/notify/unread	—	Adm\NotifyController@getUnreadNotify	api	208
GET	admin/notify/read/{id}	—	Adm\NotifyController@read	api	209
POST	admin/notify/table	—	Adm\NotifyController@index	api	210
GET	admin/notify	notify.index	Adm\NotifyController@index	api	211 (resource)
GET	admin/notify/create	notify.create	@create (not defined)	api	211
POST	admin/notify	notify.store	Adm\NotifyController@store	api	211
GET	admin/notify/{notify}	notify.show	Adm\NotifyController@show	api	211
GET	admin/notify/{notify}/edit	notify.edit	@edit (not defined)	api	211
PUT/PATCH	admin/notify/{notify}	notify.update	@update (not defined)	api	211
DELETE	admin/notify/{notify}	notify.destroy	@destroy (not defined)	api	211
POST	admin/log/title	—	Adm\LogController@queryTitle	api	214
POST	admin/log/customer/all	—	Adm\LogController@queryAllCustomer	api	215
POST	admin/log/customer/{id}	—	Adm\LogController@queryCustomer	api	216
GET	admin/log/list/customer	—	Adm\LogController@listCu	api	217
GET	admin/log/ago/{id}	—	Adm\LogController@ago	api	218
POST	admin/fashion/table	—	Adm\AdminController@getListFashion	api	221
POST	admin/branch/table	—	Adm\BranchController@index	api	224
GET	admin/branch/active/{id}	—	Adm\BranchController@activeBranch	api	225
GET	admin/branch/list	—	Adm\BranchController@listBranch	api	226
GET	admin/user/list	—	Adm\BranchController@listUser	api	227 (overridden at :248)
POST	admin/branch/product	—	Adm\BranchController@addProduct	api	228
PUT	admin/branch/product/{inventory_id}	—	Adm\BranchController@updateProduct	api	229
GET	admin/branch/product/{inventory_id}	—	Adm\BranchController@getProduct	api	230
DELETE	admin/branch/product/{inventory_id}	—	Adm\BranchController@deleteProduct	api	231
POST	admin/branch/product/table	—	Adm\BranchController@productTable	api	232
GET	admin/branch/dashboard	—	Adm\BranchController@dashboard	api	233
GET	admin/branch/admin/dashboard	—	Adm\BranchController@adminDashboard	api	234
GET	admin/branch	branch.index	Adm\BranchController@index	api	235 (resource)
GET	admin/branch/create	branch.create	@create (not defined)	api	235
POST	admin/branch	branch.store	Adm\BranchController@store	api	235
GET	admin/branch/{branch}	branch.show	Adm\BranchController@show	api	235
GET	admin/branch/{branch}/edit	branch.edit	@edit (not defined)	api	235
PUT/PATCH	admin/branch/{branch}	branch.update	Adm\BranchController@update	api	235
DELETE	admin/branch/{branch}	branch.destroy	Adm\BranchController@destroy	api	235
GET	admin/get-custom-order/{id}	—	Api\CustomOrderController@getCustomOrder	api	238
PUT	admin/custom-order/{id}	—	Api\CustomOrderController@editCustomOrder	api	239
POST	admin/get-custom-orders	—	Api\CustomOrderController@getCustomOrdersAdmin	api	240
POST	admin/create-custom-order	—	Api\CustomOrderController@creatCustomOrder	api	241
POST	admin/workshop/table	—	Adm\WorkshopController@index	api	245
GET	admin/workshop/active/{id}	—	Adm\WorkshopController@activeWorkshop	api	246
GET	admin/workshop/list	—	Adm\WorkshopController@listWorkshop	api	247
GET	admin/user/list	—	Adm\WorkshopController@listUser	api	248 (duplicate path, wins over :227)
POST	admin/workshop/product	—	Adm\WorkshopController@addProduct	api	249
PUT	admin/workshop/product/{inventory_id}	—	Adm\WorkshopController@updateProduct	api	250
GET	admin/workshop/product/{inventory_id}	—	Adm\WorkshopController@getProduct	api	251
DELETE	admin/workshop/product/{inventory_id}	—	Adm\WorkshopController@deleteProduct	api	252
POST	admin/workshop/product/table	—	Adm\WorkshopController@productTable	api	253
GET	admin/workshop/dashboard	—	Adm\WorkshopController@dashboard	api	254
GET	admin/workshop/admin/dashboard	—	Adm\WorkshopController@adminDashboard	api	255
GET	admin/workshop	workshop.index	Adm\WorkshopController@index	api	256 (resource)
GET	admin/workshop/create	workshop.create	@create (not defined)	api	256
POST	admin/workshop	workshop.store	Adm\WorkshopController@store	api	256
GET	admin/workshop/{workshop}	workshop.show	Adm\WorkshopController@show	api	256
GET	admin/workshop/{workshop}/edit	workshop.edit	@edit (not defined)	api	256
PUT/PATCH	admin/workshop/{workshop}	workshop.update	Adm\WorkshopController@update	api	256
DELETE	admin/workshop/{workshop}	workshop.destroy	Adm\WorkshopController@destroy	api	256
GET	admin/ciny/list	—	Adm\CinyController@listCiny	api	261
POST	admin/ciny/table	—	Adm\CinyController@index	api	262
GET	admin/ciny	ciny.index	Adm\CinyController@index	api	263 (resource)
GET	admin/ciny/create	ciny.create	@create (not defined)	api	263
POST	admin/ciny	ciny.store	Adm\CinyController@store	api	263
GET	admin/ciny/{ciny}	ciny.show	Adm\CinyController@show	api	263
GET	admin/ciny/{ciny}/edit	ciny.edit	@edit (not defined)	api	263
PUT/PATCH	admin/ciny/{ciny}	ciny.update	Adm\CinyController@update	api	263
DELETE	admin/ciny/{ciny}	ciny.destroy	Adm\CinyController@destroy	api	263

admin.php total: 216 registered routes (77 explicit + 139 from 14 Route::resource declarations... see count table §3.6).

3.2 routes/api.php — prefix api, middleware api

Public (no auth):

METHOD	path	name	controller@method	middleware/guards	line
GET	api/user	—	Closure → $request->user()	api + auth:api	31-33
POST	api/check/version	—	Api\ApiMobileController@checkVersion	api	37
POST	api/login	—	Api\ApiMobileController@login	api	38
POST	api/user-auth	—	Api\ApiMobileController@userAuth	api	39
POST	api/user-verfiy	—	Api\ApiMobileController@userVerfiy	api	40
POST	api/sms	—	Api\ApiMobileController@sms (method not defined)	api	41
GET	api/sms	—	Api\ApiMobileController@sendSms (not defined)	api	42
GET	api/report/order	—	Adm\AdminController@generateReportOrder	api	43
GET	api/report/doc	—	Adm\AdminController@generateReportDocument	api	44
POST	api/customer/create	—	Adm\AdminController@createCustomer	api	45
POST	api/product/luxe	—	Api\ApiMobileController@getLuxeProduct	api	46
GET	api/price	—	Api\ApiMobileController@PriceFromWebService	api	47
POST	api/front	—	Api\ApiMobileController@front	api	49
GET	api/config	—	Api\ApiMobileController@getConfig	api	50
GET	api/product/{id}	—	Api\ApiMobileController@getProduct	api	51
POST	api/get-products	—	Api\ApiMobileController@getProducts	api	52
GET	api/ciny/{collection_id}	—	Api\ApiMobileController@getCinyByCollectionId	api	53
POST	api/get-products/test	—	Api\ApiMobileController@getProductsTest (not defined)	api	54
POST	api/log/create/{title}	—	Api\LogController@create	api	57
GET	api/log/update/{id}	—	Api\LogController@update	api	58
POST	api/major/register	—	Major\CustomerController@register	api	61

Authenticated group — Route::middleware('auth:api-customer') (routes/api.php:64-117); guard = api-customer → Customer model:

METHOD	path	name	controller@method	middleware/guards	line
GET	api/get-custom-order/{id}	—	Api\CustomOrderController@getCustomOrder	api + auth:api-customer	68
GET	api/get-custom-orders	—	Api\CustomOrderController@getCustomOrders	api + auth:api-customer	69
POST	api/create-custom-order	—	Api\CustomOrderController@creatCustomOrder	api + auth:api-customer	70
POST	api/update-custom-order/{id}	—	Api\CustomOrderController@updateCustomOrder	api + auth:api-customer	71
POST	api/set-order	—	Api\ApiMobileController@setOrder	api + auth:api-customer	74
POST	api/product	—	Api\ApiMobileController@setProduct	api + auth:api-customer	75
POST	api/me-data	—	Api\ApiMobileController@me	api + auth:api-customer	76
POST	api/get-notify	—	Api\ApiMobileController@getNotify	api + auth:api-customer	77
GET	api/notify/count	—	Api\ApiMobileController@getCountNotify	api + auth:api-customer	78
POST	api/get-orders	—	Api\ApiMobileController@myOrder	api + auth:api-customer	79
POST	api/get-my-findoc	—	Api\ApiMobileController@myFindoc	api + auth:api-customer	80
POST	api/update-profile	—	Api\ApiMobileController@updateProfile	api + auth:api-customer	81
POST	api/set-findoc	—	Api\ApiMobileController@setFindoc	api + auth:api-customer	82
POST	api/my-child	—	Api\ApiMobileController@myChild	api + auth:api-customer	83
POST	api/add-to-fav	—	Api\ApiMobileController@toggleFavorite	api + auth:api-customer	84
POST	api/get-favorites	—	Api\ApiMobileController@getFavorites	api + auth:api-customer	85
POST	api/tokenmobile	—	Api\ApiMobileController@updateTokenMobile	api + auth:api-customer	86
GET	api/promotion	—	Api\ApiMobileController@getPromotion	api + auth:api-customer	87
GET	api/ignore	—	Api\ApiMobileController@getIgnore	api + auth:api-customer	88
POST	api/order/child	—	Api\ApiMobileController@getChildOrder	api + auth:api-customer	89
PUT	api/order/child/{id}	—	Api\ApiMobileController@updateChildOrder	api + auth:api-customer	90
PUT	api/notify/read/{id}	—	Api\ApiMobileController@readNotify	api + auth:api-customer	91
POST	api/file/create	—	Adm\FileController@storeWithoutData	api + auth:api-customer	95
POST	api/customer/update	—	Adm\AdminController@updateCustomer	api + auth:api-customer	98
POST	api/customer/toggle-active	—	Adm\AdminController@customerToggleActive	api + auth:api-customer	99
POST	api/customer/toggle-sts	—	Adm\AdminController@customerToggleSts	api + auth:api-customer	100
POST	api/hesab_detail/table	—	Api\ApiMobileController@hesabDetail	api + auth:api-customer	103
POST	api/moshtarian	—	Api\ApiMobileController@moshtarian	api + auth:api-customer	104
GET	api/tahesab/me	—	Customer\TahesabController@mandeh	api + auth:api-customer	108
GET|POST	api/fin_tahesab/table	—	Customer\TahesabController@index	api + auth:api-customer	109
GET	api/fin_tahesab/detail/{id}	—	Customer\TahesabController@detail	api + auth:api-customer	110
GET	api/fin_tahesab/my_detail/{offset}	—	Customer\TahesabController@my_detail	api + auth:api-customer	111
POST	api/major/complete	—	Major\CustomerController@complete	api + auth:api-customer	114

Public (after group):

METHOD	path	name	controller@method	middleware/guards	line
POST	api/sms/batch	—	Adm\SmsController@batch	api	122
POST	api/sms/batch/test	—	Adm\SmsController@testNet	api	123
GET	api/send/all	—	Closure — mass-SMS to ALL customers	api	126-180
POST	api/test	—	Closure → "this is true"	api	184-220
GET	api/cities	cities.index	Adm\CitiesController@index (not defined)	api	223 (resource)
GET	api/cities/create	cities.create	@create (not defined)	api	223
POST	api/cities	cities.store	Adm\CitiesController@store	api	223
GET	api/cities/{city}	cities.show	Adm\CitiesController@show	api	223
GET	api/cities/{city}/edit	cities.edit	@edit (not defined)	api	223
PUT/PATCH	api/cities/{city}	cities.update	Adm\CitiesController@update	api	223
DELETE	api/cities/{city}	cities.destroy	Adm\CitiesController@destroy	api	223
POST	api/cities/list	—	Adm\CitiesController@list	api	224
GET	api/cities/get-percent/{id}	—	Adm\CitiesController@getPercent	api	225 (shadowed)
GET	api/cities/get-percent-aux/{id}	—	Adm\CitiesController@getPercentAux	api	226 (shadowed)
POST	api/web/auth	—	WebApp\AuthController@userAuth	api	229
GET	api/testt	—	Customer\TahesabController@test	api	235

Duplicate name collision: cities.* resource names are registered in BOTH routes/admin.php:168 and routes/api.php:223. Laravel 8 keeps the first registration for name lookup; api.php loads first (RouteServiceProvider:43), so cities.* names resolve to /api/cities/*.

3.3 routes/customer.php — prefix cu, middleware api

Whole file wrapped in Route::middleware('create_log') (routes/customer.php:3).

METHOD	path	name	controller@method	middleware/guards	line
POST	cu/register	—	Api\SingleCustomerController@register	api, create_log	5
POST	cu/login	—	Api\SingleCustomerController@login	api, create_log	6
POST	cu/verfiy/token	—	Api\SingleCustomerController@verfiy	api, create_log	7
GET	cu/order/pdf/{id}	—	Customer\OrderController@generateReportOrder	api, create_log	8

Inner group ['middleware' => ['auth:api-singleCustomer']] (:10-46) — guard api-singleCustomer → SingleCustomer:

METHOD	path	name	controller@method	middleware/guards	line
POST	cu/transaction	—	Api\SingleCustomerController@getTransaction	api, create_log, auth:api-singleCustomer	11
POST	cu/update-profile	—	Api\SingleCustomerController@updateProfile (not defined)	″	12
GET	cu/get-user	—	Api\SingleCustomerController@getUserInfo	″	13
GET	cu/comment	comment.index	Customer\CommentController@index	″	15 (resource)
GET	cu/comment/create	comment.create	Customer\CommentController@create	″	15
POST	cu/comment	comment.store	Customer\CommentController@store	″	15
GET	cu/comment/{comment}	comment.show	Customer\CommentController@show($product_id)	″	15
GET	cu/comment/{comment}/edit	comment.edit	Customer\CommentController@edit	″	15
PUT/PATCH	cu/comment/{comment}	comment.update	Customer\CommentController@update	″	15
DELETE	cu/comment/{comment}	comment.destroy	Customer\CommentController@destroy	″	15
GET|POST	cu/fin_tahesab/table	—	Customer\TahesabController@index	″	18
GET	cu/fin_tahesab/detail/{id}	—	Customer\TahesabController@detail	″	19
GET	cu/fin_tahesab/my_detail/{offset}	—	Customer\TahesabController@my_detail	″	20
GET	cu/fin_tahesab/mandeh	—	Customer\TahesabController@mandeh	″	21
POST	cu/order/table	—	Customer\OrderController@index	″	23
GET	cu/order/report	—	Customer\OrderController@report	″	24
GET	cu/order/promotion	—	Customer\OrderController@getPromotion	″	25
GET	cu/order	order.index	Customer\OrderController@index	″	26 (resource)
GET	cu/order/create	order.create	Customer\OrderController@create	″	26
POST	cu/order	order.store	Customer\OrderController@store	″	26
GET	cu/order/{order}	order.show	Customer\OrderController@show	″	26
GET	cu/order/{order}/edit	order.edit	Customer\OrderController@edit	″	26
PUT/PATCH	cu/order/{order}	order.update	Customer\OrderController@update	″	26
DELETE	cu/order/{order}	order.destroy	Customer\OrderController@destroy	″	26
GET	cu/fav	fav.index	Customer\FavController@index	″	29 (resource)
GET	cu/fav/create	fav.create	Customer\FavController@create	″	29
POST	cu/fav	fav.store	Customer\FavController@store	″	29
GET	cu/fav/{fav}	fav.show	Customer\FavController@show	″	29
GET	cu/fav/{fav}/edit	fav.edit	Customer\FavController@edit	″	29
PUT/PATCH	cu/fav/{fav}	fav.update	Customer\FavController@update	″	29
DELETE	cu/fav/{fav}	fav.destroy	Customer\FavController@destroy	″	29
GET	cu/address	address.index	Customer\AddressController@index	″	32 (resource)
GET	cu/address/create	address.create	@create (not defined)	″	32
POST	cu/address	address.store	Customer\AddressController@store	″	32
GET	cu/address/{address}	address.show	@show (not defined)	″	32
GET	cu/address/{address}/edit	address.edit	@edit (not defined)	″	32
PUT/PATCH	cu/address/{address}	address.update	Customer\AddressController@update	″	32
DELETE	cu/address/{address}	address.destroy	Customer\AddressController@destroy	″	32
POST	cu/set-default	—	Customer\AddressController@setDefaultAddress	″	33
POST	cu/transaction/gateway	—	Customer\TransactionController@gateway	″	36
POST	cu/product/variant	—	Customer\ProductController@getVariant	″	39
GET	cu/customer/wallet	—	Customer\CustomerController@getWallet	″	42
POST	cu/customer/wallet/transaction	—	Customer\CustomerController@detailWallet	″	43

3.4 routes/site.php — prefix site, middleware api

METHOD	path	name	controller@method	middleware/guards	line
GET	site/test	—	Closure → 'this is test'	api	4-6
GET	site/get-config	—	Api\SiteController@config	api	8
POST	site/config	—	Api\SiteController@newConfig	api	9
POST	site/products	—	Api\SiteController@Products	api	10
GET	site/get-product	—	Api\SiteController@getProduct	api	11
GET	site/front	—	Api\SiteController@ّFront (note leading Arabic kasra U+0651 in method name)	api	12
GET	site/counter	—	Api\SiteController@counterInstagram	api	13
GET	site/price	—	Closure → WebServiceGold::getAllPrice()	api	14-16
POST	site/get/products	—	Api\SiteController@getProductsVaraints	api	17
POST	site/get/fashion	—	Api\SiteController@setRequestFashion	api	18
GET	site/product/ready	—	Api\SiteController@readySend	api	19
GET	site/te/print/{id}	—	Closure → DB\Te\TableEngine::viewPrint($id)	api	22-24
GET	site/comment/{id}	—	Customer\CommentController@show	api	26
GET	site/app/download	—	Api\SiteController@downloadApk	api	27
GET	site/fix-cat	—	Closure — one-off category remap, dd()s	api	30-65
GET	site/const/{id}	—	Adm\ConstController@show	api	68
GET	site/body/{id}	—	Site\CollectionController@getBody	api	71
POST	site/category/product	—	Site\CollectionController@products	api	72
GET	site/product	—	Site\SiteController@getProduct	api + version	75-78
GET	site/product/random	—	Api\SiteController@getRandomProduct	api	79
GET	site/login/active	—	Api\SiteController@counterActive	api	80
GET	site/landing/page	—	Api\SiteController@counterLanding	api	81
POST	site/test	—	Site\SiteController@products	api	83
GET	site/customer	—	Site\SiteController@getCustomer	api	84
GET	site/tag	—	Site\SiteController@addTag	api	85
GET	site/birthday	—	Site\SiteController@getBirthday	api	86
GET	site/service	—	Site\SiteController@serviceGold	api	87
GET	site/test/tr	—	Site\SiteController@test123	api	88
GET	site/test/active	—	Site\SiteController@searchDeactive	api	89
GET	site/test/g	—	Site\SiteController@testG	api	90

3.5 routes/web.php — no prefix, middleware web

METHOD	path	name	controller@method	middleware/guards	line
GET|POST	/fin_tahesab/table	—	Customer\TahesabController@index	web	26
GET	/fin_tahesab/detail/{id}	—	Customer\TahesabController@detail	web	27
GET	/fin_tahesab/my_detail/{offset}	—	Customer\TahesabController@my_detail	web	28
GET	/fin_tahesab/mandeh	—	Customer\TahesabController@mandeh	web	29
GET	/	—	Closure — scrapes tgju.org and writes gold_price + gold_price_pwa ConfigStatic	web	32-124
GET	/login	—	Closure — Link::set(...) + redirect to https://henzagold.com/app	web	127-130
GET	/download	—	Closure — Link::set(...) + redirect to APK	web	131-134
GET	/totalify	—	Closure — recount category totals, dd()s	web	137-152
GET	/confirem/order	—	Adm\AdminController@confiremOrder	web	156
GET	/test2	—	Closure — mass-SMS to ALL customers	web	158-186

3.6 Route counts per file

File	Explicit routes	Route::resource blocks	Routes from resources (7 each)	Total registered
routes/admin.php	117	14	98	215
routes/api.php	63	1	7	70
routes/customer.php	16	4	28	44
routes/site.php	30	0	0	30
routes/web.php	10	0	0	10
TOTAL	236	19	133	369

Resource blocks: admin.php:71,79,129,132,138,151,155,168,182,199,211,235,256,263 (14); api.php:223 (1); customer.php:15,26,29,32 (4).

---

4. Controllers (app/Http/Controllers, recursive)

24 controllers total (excluding base Controller.php, which is listed separately as it holds shared business logic).

Controller	Public methods
Controller.php (base)	addLimit, convert, createTransactionOrder, createSingleOrderActivity, createSingleCustomerOrders, createSingleCustomerOrderItems, createPromotionForOrder, afterCreateOrder, createTransactionInterface, checkCustomer
Adm/AdminController.php	__construct, login, getProducts, queryCategory, getCustomer, getReagent, getBanker, getShopkeeper, getSingleCustomer, updateCustomer, createCustomer, queryCustomer, queryReagent, customerToggleSts, customerToggleActive, confiremOrder, getAnalytics, getAnalyticsTak, addProduct, addVariant, getVariant, getVariants, getConfigStatics, getProduct, deleteProduct, getCustomerById, getCategory, AddCategory, getOneCategory, deleteCategory, getSingleOrders, changePercent, countProductForPercent, generateReportOrder, orderStsSingle, chargeWalletAfterOrder, getHavaleList, changeAll, generateReportDocument, getListFashion
Adm/BranchController.php	index, store, show, update, destroy, activeBranch, listBranch, listUser, allocateProduct, addProduct, updateProduct, getProduct, deleteProduct, createInventoryTransaction, productTable, dashboard, adminDashboard
Adm/BrandController.php	index, store, update, destroy
Adm/CashController.php	index, create, store, show, edit, update, destroy, toggleConfiremCash
Adm/CategoryController.php	index
Adm/CinyController.php	store, update, destroy, show, listCiny, index
Adm/CitiesController.php	store, destroy, show, list, getPercent, getPercentAux, update
Adm/CommentController.php	index, create, store, show, edit, update, destroy, changeStatus
Adm/ConstController.php	store, destroy, deleteById, show, update
Adm/DashboardController.php	getAll, change, info, link
Adm/FileController.php	index, store, storeWithoutData, show, update, destroy, updateBody
Adm/IgnoreController.php	index, store, show, destroy
Adm/LogController.php	queryTitle, queryAllCustomer, queryCustomer, queryForLog, listCu, ago
Adm/MajorCustomerController.php	index, dashboard, order, cash, shopkeeper, indexSms, verifyRegister, indexArchive, indexVerify, archive, listTypeCustomer
Adm/MajorOrderController.php	index, create, store, show, edit, update, destroy, getTaminOrders, orderSts, orderItemEdit, deleteOrder, deleteOrderItem
Adm/NotifyController.php	store, customer, index, getUnreadNotify, show, read
Adm/OrderController.php	getType, store, update
Adm/PermissionController.php	create, store, destroy, has, get, getByUt
Adm/ProductController.php	createImage, store, show, update, testSearch, report, color, getProductsVaraints, changeOffer, changeIsExist, changeHasWarranty
Adm/PromotionController.php	index, create, createTablePromotionProduct, createPromotionProduct, store, show, edit, update, destroy, updateAutoPromotion, getAutoPromotion, getBrand
Adm/ReportController.php	__construct, collection, registerEvents, headings, getOrderItemWithDetails (implements Maatwebsite Excel export contracts)
Adm/SingleCustomerController.php	store, update, delete, show, indexOrder, indexTransaction, indexSms, getWallet, report
Adm/SmsController.php	batch, testNet, replaceName, index, getCustomer, sendSmsToOther
Adm/UserController.php	store, index, destroy, update, show, showData
Adm/WalletController.php	charge, changePercent, index, setConst, getConfig, getConfigBirthday
Adm/WorkshopController.php	index, store, show, update, destroy, activeWorkshop, listWorkshop, listUser, allocateProduct, addProduct, updateProduct, getProduct, deleteProduct, createInventoryTransaction, productTable, dashboard, adminDashboard
Api/ApiMobileController.php	userAuth, userVerfiy, login, me, setFindoc, updateProfile, getProduct, myChild, myOrder, getNotify, getCountNotify, myFindoc, front, getCinyByCollectionId, getProducts, setProduct, toggleFavorite, getFavorites, updateTokenMobile, getConfig, getPromotion, getIgnore, setOrder, getChildOrder, readNotify, updateChildOrder, getLuxeProduct, checkVersion, PriceFromWebService, hesabDetail, moshtarian, moshtarianFilter
Api/CustomOrderController.php	getCustomOrders, getCustomOrdersAdmin, getCustomOrder, editCustomOrder, creatCustomOrder, updateCustomOrder, acceptCustomOrder, deleteCustomOrder
Api/CustomerController.php	getVaraints
Api/LogController.php	create, update
Api/SingleCustomerController.php	register, verfiy, login, getTransaction, getUserInfo
Api/SiteController.php	getConfig, config, newConfig, getMenu, getProduct, sendDiscount, products, searchProduct, ّFront, getProductsVaraints, test, counterInstagram, getRandomProduct, counterActive, counterLanding, setRequestFashion, readySend
Customer/AddressController.php	index, store, update, destroy, setDefaultAddress
Customer/CommentController.php	index, create, store, show, edit, update, destroy
Customer/CustomerController.php	getWallet, detailWallet
Customer/FavController.php	index, create, store, show, edit, update, destroy
Customer/OrderController.php	index, create, store, cancel, show, edit, update, destroy, report, generateReportOrder, getPromotion
Customer/ProductController.php	getVariant
Customer/TahesabController.php	index, my_detail, detail, mandeh, test
Customer/TransactionController.php	gateway
Major/CustomerController.php	register, complete, sendSmsToAdmin
ProductController.php (root)	index
Site/CollectionController.php	getBody, products
Site/SiteController.php	products, getCustomer, getProduct, addTag, getBirthday, serviceGold, test123, searchDeactive, testG
WebApp/AuthController.php	userAuth

Controller count: 46 files (45 concrete controllers + base Controller.php).

---

5. Models (app/Models) — 57 files

Selector (app/DB/Selector.php) is a shared trait providing Jalali accessors (caj,uaj,eaj,daj), sts_str, type_str, sts_verify_step_one_str/two_str, type_show_str, birth_date_j, brj, expire_at_j, plus static lookups GetSts, GetTypes, GetConfirmed, GetShowType, GetStsVerifyStepOne/Two, selectWithjDate, convertColumns (app/DB/Selector.php:57-206). Duplicated at app/Te/* and app/DB/Te/* (TableEngine).

Model	Table	Key fillable	Casts	Relations	Scopes	Constants / statics	Accessors / mutators
ApkLog :14	apk_log :17	ip,version :30	—	—	—	$timestamps=false :19; boot() :21	—
Branch :10	(branches)	name,address,phone,user_id,is_active :13	is_active→bool :20	user()→User :23	—	—	—
Category :10	category_collection :32	title,parent_id_id,priority,image_id,meta,body,icon_id,disabled,type,total,is_master,header,is_active :16	disabled,is_active→bool :45	parent() hasOne self :51; childs() hasMany self :57; image()→Image :63; icon()→Image :68	scopeDesktop :74, scopeMobile :80	reloadTotal($id) :86, reloadCategory($cats,$pid) :93	$hidden :34
Ciny :9	cinies	title,icon_id,collection_id,is_active,description :12	:19	icon()→Image :22; collection()→Category :26	—	—	—
CinyProduct :9	ciny_products	product_id,ciny_id :12	—	product() :16; ciny() :20	—	—	—
City :9	cities	title,parent,level,percent,percent_aux :14	—	—	—	—	—
Collect :9	category_collect :14	collection_id_id,product_id_id :16	—	product() :21; collection() :26	—	—	—
Comment :10	(comments)	product_id,comment,reply_to,sts,customer_id :16	—	Reply() hasMany self :31; customer()→SingleCustomer :36; product() :42	—	$SELECT_CAJ (via Selector)	—
ConfigStatic :10	config_statics :15	key,val :17	(val→array commented out :21-23)	—	—	getValue($key) :25 — throws NotFoundHttpException if 0 rows	—
CustomOrder :12	(custom_orders)	customer_id,file_id,city_id,weight,color,size,sum,color_stone,color_mina,workshop_id,sts,description :17	sts→int, weight/sum→float, deleted_at→datetime :32	file()→Image :77; customer() :81; CustomOrderLog() hasMany :85	—	$appends=['sts_str_en','sts_str_fa','time_creat_fa','time_update_fa'] :15	getTimeCreatFaAttribute :59, getTimeUpdateFaAttribute :63, getStsStrEnAttribute :68, getStsStrFaAttribute :73
CustomOrderLog :10	—	:15	:23	order() :37; user() withDefault :43	—	$appends :13	getTimeCreatFa/UpdateFa :28,:32
Customer :13 (Authenticatable, guard api-customer)	customers	api_token,address,phone,fname,lname,name,mobile,rnd,ncode,notify_count,total_order,gram_level,percent,input,output,remain,city_id,new_city,rial_remain,rial_output,rial_input,reagent_id,type,open_order,child,sts,token_mobile,send_password,store_name,zone,pasazh_name,active,birth_date,marriage_date,image_id,mcode,sts_verify_step_one,sts_verify_step_two,is_archive,business_license_image_id,shop_image_id,ncode_image_id :18-72	is_archive→bool :73	reagent() :119; cash() hasMany Major\Cash :124; order() hasMany :130; orderOne() (sts=6) :135; children() hasMany Order by reagent_id :140; city() :145; image() :166; business_license_image() :170; shop_image() :174; ncode_image() :178; workshop() :182	scopeSelectify :105, scopeActive :162	$hidden=['password','send_password'] :83	setPasswordAttribute (Hash) :100; getToAttribute :110; getOrderTitleAttribute :115; getRemainAttribute :150; getGramsSellAttribute :156
CustomerTest :13	customers_test :18	mirror of Customer :20	—	same set :94-137	scopeSelectify,scopeActive	$hidden :62	same
Fav :14	fav :17	customer_id,product_id :23	—	product() (active only) :30; customer() :34	—	$timestamps=false :22; composite PK (migration)	—
Image :8	image :13	title,position,image,resize*,link,width,height,banner,original_name,ext,body :15	—	product() :42; productImage() :46; pi() :53	—	$SELECT_FULL	getFullAttribute :35, getImageAttribute :58
InventoryBranch :10	—	:13	—	allocator_user() :20; branch() :24; product() :28	—	—	—
InventoryTransaction :9	—	product_id,product_variant_id,branch_id,allocator_user_id,order_id,type :12	—	product() :25; branch() :29; product_variant() :33; allocator_user() :37	—	—	—
Kids :10	kids :15	:17	—	—	—	—	—
Link :8	(links)	:11	—	—	—	set($url) :15 — click tracker	—
Log :9	(logs)	customer_id,time_present,start_at,end_at,ip,title,data,title_fa,product_id :12	data→array :23	customer() :27; product() :31	—	—	—
Major\Cash :13	(cashes)	user_id,customer_id,input,output,remain,rial_input,rial_output,rial_remain,type,sts,title,to,note,ayar,lab,balance,value,price,confirmed,no,proceed_at,account_name,bank_name,recive_date,order_id,ang,original_value,price_per_gram,discount :19	—	customer() :86	scopeMe :74	$TYPES = [9=>سفارش, 1=>آب شده, 2=>حواله, 3=>چک, 4=>پولی] :56; $STS = [-1=>بررسی نشده, 1=>ثبت سند] :63; $CONFIRMED = [1=>تایید شده, 0=>تایید نشده] :68	getTimeAttribute :81; getValueAttribute → Utility::round() :91; getConfirmedStrAttribute :96; $appends=['time','confirmed_str'] :51
Major\Favorite :9	major_favorites :14	:16	—	—	—	—	—
Major\Promotion :14	major_promotion :21	title,description,start_at,end_at,type,type_customer,discount_percent,discount_price,is_active,use_only,show :32	is_active,use_only,show→bool :57	items() hasMany PromotionItem :86	scopeActive :24, scopeWeb :27	safeDelete($promotionID) :79	getStartAtjAttribute :69, getEndAtjAttribute :74, getItemsAttribute :91; $appends :63
Major\PromotionIgnore :11	major_promotion_ignores :17	:19	—	—	—	—	—
Major\PromotionItem :11	major_promotion_item :17	:19	—	promotion() :24	—	—	—
Major\PromotionUsed :10	major_promotion_used :16	customer_id,promotion_id,promotion_item_id,order_id,order_item_id :18	—	—	—	—	—
Notification :11	—	:13	:21	user() :24; customer() :28	—	store($token,$title,$body) :33 (FCM)	—
Notify :14	notify :17	title,customer_id,user_id,note,read,value,type,type_send,sender_id :21	read→bool :32	—	scopeMe :50	store($token,$title,$body) :57 (FCM push); sendToGroup($tokens,$title,$body) :88	—
Order :16 (major/wholesale order)	orders	customer_id,reagent_id,type,input,output,remain,w,wage,city_id,price,percent,sts,confirmed,rial_input,discount :25	(empty :144)	items() hasMany OrderItem :149; customer() :156; parent()→Customer by reagent_id :168; activity() hasMany OrderActivity :173; cashe() hasOne Major\Cash by order_id :232	scopeMe :161	$TYPES=[1=>ثبت سفارش توسط مسئول فروش, 2=>ثبت مشتری] :45; $CONFIRMED=[1=>تایید شده,2=>در انتظار تایید] :60; $STS = [0=>معلق, 1=>ثبت سفارش, 2=>تایید مدیر سیستم, 3=>درحال تامین, 4=>درحال آماده سازی, 5=>تحویل مسئول فروش, 6=>تحویل مشتری] :65; $STS_TAB :73; $STS_COLOR :105; $STS_IMG :122; $SELECT_COLOR,$SELECT_IMG :23-24; safeDelete($orderID) :211	getConfirmedStrAttribute :178, getColorAttribute :184, getImgAttribute :190, getInputAttribute :197, getPercentAttribute :202, getWageAttribute :207, getWAttribute :222, getTimeAttribute :227; $appends=['time','confirmed_str'] :121; $hidden :138
OrderActivity :10	order_activity :13	title,note,user_id,customer_id,order_id,meta,proceed,key :17	:28	order() :34; customer() :39; user() :44	—	—	—
OrderItem :10	order_items	order_id,variant_id,product_id,product_title,variant_title,percent,price,rial_pay,note,wage,qty,sts,w,rash_weight,original_rash_weight,discount,original_percent :15	—	product() :36; variants()→ProductVariant :40; order() :54	—	—	getWAttribute → Utility::round :45; getWageAttribute :49
Permission :7	permission :14	rid,ut :9	—	—	—	Composite PK ['rid','ut'] :16; $timestamps=false :17; $incrementing=false :18	—
Product :14	product :20	title,body_html,desk_note,product_code,indicator_id_id,mobile_pic_id,number_of_purchase,is_active,brand_id,disabled,file_id,show_type,delivery_type,message_long_delivery,count_fav,count_order,count_view,min_gram,max_gram,offer_day,branch_id,inventory_id,is_exist,has_warranty :22	is_active,disabled,offer_day,is_exist,has_warranty→bool :60	images() :75; ciny() :79; thumb() :90; tmobile() :96; variants() (active) :102; variantsAll() :106; variantOne() :111; variantsPromotion() :116; collect() :123; category() :128; image() :140; brand()→ProductBrand :145; gallery() hasManyThrough :153; file() :187; tags() :192; promotion()→PromotionProduct :196; inventory()→InventoryBranch :204; branch() :209	scopeCool :69, scopeMobile :173, scopeSite :178, scopeActive :182	safeDelete($productId) :165	—
ProductBrand :10	product_brand :17	:19	—	—	—	—	—
ProductImage :9	products_productimage :14	:15	—	image() :22; product() :27	scopeMobile :32, scopeDesktop :37	—	—
ProductTags :10	product_tags :16	product_id,const_id :18	—	product() :24; cnt()→ConfigStatic :28	—	$timestamps=false :15	—
ProductVariant :15	products_productvarient :20	title,qty,grams,percentage_pay,product_id_id,barcode,color,width,length,height,rial_pay,inventory,details,description,meta,position,requires_shipping,taxable,is_pre_order,is_active :24	is_pre_order,is_active→bool; rial_pay,percentage_pay,grams→double :121	product() :312; promotion() :316; inventory()→InventoryTransaction :324; inventory_branch() :328	—	$product_price_extra_percent (loaded in boot() from ConfigStatic product_price_extra_percent, default 7) :45-52; $goldPrice :132; $dis_product :133; $COLOR_STR :57; $COLORS = [0=>سفید,1=>زرد,2=>شکلاتی,3=>رزگلد] :94	getPriceAttribute :156 (core gold price formula); getPriceWithDiscountAttribute :248; getColorStrAttribute :135; $appends=['price','color_str','price_with_discount'] :115
PromotionProduct :9	promotion_products	promotion_id,promotion_item_id,product_variant_id,product_id,discount,type,active,start_at,end_at,use_only :12	active,use_only→bool :28	—	—	—	—
RequestFashion :8	—	:11	—	—	—	—	—
RequestLog :9	(request_logs)	customer_id,ip,device,data,user_agent,route,method :14	data→array :23	—	—	UPDATED_AT = null :12; $timestamps=['created_at'] :13	—
SingleCustomer :13 (Authenticatable, guard api-singleCustomer)	login :19	id,password,username,lname,fname,name,phone,email,user_type,is_active,last_login,token_sms,percent,birth_day,branch_id :21	—	transaction() :45; branch() :48	—	$hidden=['password'] :39	setPasswordAttribute (Hash) :41
SingleCustomer\OrderActivity :10	orders_histroy :17	:19	:28	—	—	—	—
SingleCustomer\PromotionUsed :10	single_promotion_used :15	:17	—	—	—	—	—
SingleCustomerAddress :13	accounts_address :19	reciver_lname,reciver_fname,reciver_phone,reciver_fixed_phone,province,city,zipcode,address,latitude,longitude,is_default,user_id_id :21	(empty :36)	—	—	—	—
SingleCustomerOrderItems :12	orders_orderitem :18	title,price,approximate_price,qty,deposit,amount_paid,approximate_gram,exact_gram,debtor_amount,is_active,supply_at,delivery_at,order_id,product_id,variant_id,grams,rial_pay,variant_title,is_preorder,promotion_id,promotion_item_id,total_discount,total_price,gold_price_in_formula,branch_id :20	is_preorder→bool :48	product() :54	—	—	—
SingleCustomerOrders :13 (retail order)	orders_orders :19	app,billing_address,browser_ip,buyer_accepts_marketing,email,phone,note,prcessing_method,processed_at,shipping_address,shipping_line,subtotal_price,discount_codes,total_discount,total_price (pre-discount),price (post-discount),total_tax,total_weight,tags,sts,is_active,canceled_at,canceled_reason,closed_at,send_time_id,user_id_id,gold_price,gold_price_original,type,reagent_id,use_wallet,payment_after_wallet,branch_id :21	shipping_address→array, use_wallet→bool :61	items() :84; customer()→SingleCustomer by user_id_id :93; user()→User by reagent_id; branch(); activity() hasMany SingleCustomer\OrderActivity	—	$STS = [1=>ثبت سفارش, 2=>تایید مدیر سیستم, 3=>در حال تامین, 4=>در حال آماده سازی, 5=>خروج از انبار, 6=>ارسال, 7=>تحویل مشتری] :66; $TYPES = [1=>تلفنی,2=>تلگرام,3=>واتس آپ,4=>اینستا,5=>حضوری] :76	getStsStrAttribute :88; $appends=['sts_str'] :57
SingleCustomerTransaction :16	transactions_transaction :22	amount,transaction_type,sts,message,receipt,gateway,is_active,order_id_id,user_id_id :24	—	—	—	createAndGetToken($order,$ip) :38 — payping/zarinpal payment init (hardcoded amount 1000, hardcoded bearer token :86)	—
Sms :12	messages :16	customer_id,mobile,massage,token,type,user_id :44	—	—	—	$TYPES=[-1=>یک شماره تلفن,0=>همه کاربران,1=>کارشناسان فروش,2=>مشتریان عمده,9=>چند شماره تفن] :53; Send($to,$msg,…) :61; SendSms(...) :89; set(...) :125	—
TransactionOrder :8	(transaction_orders)	customer_id,order_id,total_price,transaction_type,total_weight,order_date,payment :11	payment→bool :20	—	—	—	—
User :12 (Authenticatable, guard api/web)	users	name,fname,lname,mobile,ut (user type = role id),city_id,token_mobile,branch_id :22	email_verified_at→datetime :48	user_type()→ConfigStatic by ut :51	—	$hidden=['password','remember_token'] :38; SoftDeletes :15	—
Utility :6	(not a real table)	—	—	—	—	$formatJ='Y/n/j-H:i' :8; round($value) → round($value, 2) :10; convertDate() (Jalali) :15; faTOen() Persian/Arabic digit → ASCII :26; baseURLStorage() = https://henzagold.com/oapi/storage/ :30	—
WebServiceGold :13	(not a real table)	—	—	—	—	getPriceGold18Ayar() :17 — reads ConfigStatic['gold_price'], geram18.p, strips commas, intval, /10 (rial→toman); getAllPrice() :27; getAllPriceFromWebService() :33 — ratebox.ir feed, maps 4→mesghal, 5→geram18, 6→geram24, writes ConfigStatic['gold_price'] only when all three present	—
Workshop :10	(workshops)	name,address,phone,user_id,is_active :13	is_active→bool :20	user()→Customer (note: class mismatch vs. column) :23	—	SoftDeletes :12	—

Model count: 57 files under app/Models (incl. 6 in Major/, 2 in SingleCustomer/, and Selector.php which is a trait, not a model).

---

6. Database

6.1 Migrations — database/migrations (31 files)

#	File	Op	Table	Key columns
1	2014_10_12_000000_create_users_table.php	create	users	id, name, mobile unique, password, rememberToken, timestamps, softDeletes (:16-23)
2	2014_10_12_100000_create_password_resets_table.php	create	password_resets	mobile index, token, created_at nullable (:16-19)
3	2019_08_19_000000_create_failed_jobs_table.php	create	failed_jobs	id, uuid unique, connection, queue, payload, exception, failed_at useCurrent (:16-23)
4	2020_10_01_120354_order_table.php	create	orders	id, customer_id uint, reagent_id uint null, type tinyint, input/output/remain/w/wage/percent double null, sts tinyint null, timestamps, softDeletes (:16-29)
5	2020_10_01_120408_order_items_table.php	create	order_items	id, order_id, product_id, product_title, variant_title, w/wage/percent double null, timestamps (:16-25)
6	2020_10_01_120430_customers_table.php	create	customers	id, fname(50), lname(50), name(75), mobile(20), ncode(20), password, input/output double, remain double default 0, rial_input/rial_output/rial_remain bigint uint, reagent_id, type/sts tinyint, timestamps, softDeletes (:16-34)
7	2020_10_01_120914_cash_table.php	create	cashes	id, user_id, customer_id, input/output/remain double, rial_* bigint, type/sts tinyint, timestamps, softDeletes (:16-29)
8	2020_10_19_153228_customer_add.php	alter	customers	+api_token(60), rnd(60), notify_count def 0, total_order def 0, gram_level double def 0, percent double def 0, open_order def 0, child def 0 (:26-34)
9	2020_10_25_155247_customers_cols.php	alter	customers	+phone(15), address (:16-18)
10	2020_10_25_164102_order_acitvity.php	create+alter	order_activity; order_items; orders; cashes	create order_activity: id,title(50),note,user_id,customer_id,order_id,meta json,timestamps (:16-24). alter order_items: +variant_id,price double,sts tinyint,qty (:26-30). alter orders: +price double (:32-34). alter cashes: +title,to,note,ayar(20),lab,balance double,value double,price bigint (:36-44)
11	2020_10_25_170047_notify_table.php	create	notify	id,title,customer_id,user_id,note(512),type tinyint,value tinyint,read bool def false,timestamps (:16-25)
12	2020_10_27_192859_proceed_activity.php	alter	order_activity	+proceed bool def false (:16-17)
13	2021_09_18_115342_permissions_table.php	create	permission	rid string, ut int, primary(['rid','ut']) (:16-19)
14	2021_09_18_164552_file_id_product.php	alter	product	+file_id uint null (:16-17)
15	2021_09_18_171700_city_table.php	create+alter	cities; users; orders	create cities: id,title(50),parent,level,percent float,timestamps,softDeletes (:16-23). alter users: +ut uint null, city_id (:27-29). alter orders: +city_id (:32-33)
16	2021_09_18_172722_cities_p_2.php	alter	cities	+percent_aux float null (:16-17)
17	2021_09_21_160213_product_tags.php	create	product_tags	id increments, product_id, const_id (:16-19)
18	2021_09_28_173620_customer_city_id.php	alter	customers	+city_id uint null (:16-17)
19	2021_10_21_092358_fav_table.php	create	fav	customer_id, product_id, primary(['customer_id','product_id']) (:16-19)
20	2021_10_21_094849_apk_log.php	create	apk_log	id,ip(15),version,created_at (:16-20)
21	2021_11_01_155307_mobile_note.php	alter	product	+desk_note null (:16-17)
22	2021_11_01_162712_cat_image.php	alter	category_collection	+image_id null (:16-17)
23	2021_11_01_164540_cat_image_total.php	alter	category_collection	+total def 0 (:16-17)
24	2021_11_03_113752_icon_category.php	alter	category_collection	+icon_id null (:16-17); down() targets category (mismatch, :28)
25	2021_11_07_103558_product_gallery_id.php	alter	products_productimage	+w string null (:16-17)
26	2021_11_15_202459_type_category.php	alter	category_collection	+type tinyint null (:16-17)
27	2021_11_17_105202_body_category.php	alter	category_collection	+body null (:16-17)
28	2021_11_23_114049_product_disabled.php	alter	product; category_collection	+disabled bool def false (:16-17); category_collection.disabled bool nullable(false) (:20-21)
29	2021_12_18_161611_create_promotion_products.php	create	promotion_products	id,promotion_id,promotion_item_id,product_variant_id,product_id,discount_percent double,discount_price double,timestamps (:16-24)
30	2024_06_14_232311_create_cinies.php	create	cinies	id,title(150),icon_id,collection_id,is_active bool def 1,description(1024),timestamps,softDeletes (:16-24)
31	2024_06_21_203640_create_ciny_products.php	create	ciny_products	id,product_id,ciny_id,timestamps,softDeletes (:16-21)

Package migration (autoloaded via WalletServiceProvider):

File	Table	Columns
packages/rooyesh/wallet/src/migrations/2021_12_02_065938_create_wallet_moudle_table.php:16-39	wallets	id, owner_type enum(1=user,2=shop) def 1, timestamps, owner bigint, gold double (gold grams held), hash(128) null, credit bigint, unique(['owner','owner_type'])
″ :41-56	transactions	id, wallet bigint uint, transaction_type enum(1=gold,2=credit,3=expire) def 1, timestamps, value bigint, expire_at datetime null, hash(128) null, note text null, customer_id bigint uint null
″ :58-66	transaction_metas	transaction bigint uint, order_id bigint uint null, total_weight double uint null, percent int uint null, order_date timestamp null, id, timestamps

Note: transactions migration lacks a balance column, but TransactionInterface writes $_inp['balance'] (packages/rooyesh/wallet/src/interfaces/TransactionInterface.php:141) and hashes it (:110) — the column exists in the live DB but not in this migration.

6.2 Seeders — database/seeders

File	Content
database/seeders/DatabaseSeeder.php:14-17	run() is empty — the only line is a commented User::factory(10)->create() (:16). No seeders exist.

Factory: database/factories/UserFactory.php (default Laravel).

6.3 Final schema (tables referenced by models but NOT in migrations)

These tables exist in the production DB (legacy/Django-imported; names like orders_orders, accounts_address, products_productvarient indicate a Django origin) and are only known through model $table + $fillable:

Table	Model	Source
login	SingleCustomer	app/Models/SingleCustomer.php:19
orders_orders	SingleCustomerOrders	app/Models/SingleCustomerOrders.php:19
orders_orderitem	SingleCustomerOrderItems	app/Models/SingleCustomerOrderItems.php:18
orders_histroy (sic)	SingleCustomer\OrderActivity	app/Models/SingleCustomer/OrderActivity.php:17
accounts_address	SingleCustomerAddress	app/Models/SingleCustomerAddress.php:19
transactions_transaction	SingleCustomerTransaction	app/Models/SingleCustomerTransaction.php:22
products_productvarient (sic)	ProductVariant	app/Models/ProductVariant.php:20
products_productimage	ProductImage	app/Models/ProductImage.php:14
product	Product	app/Models/Product.php:20
product_brand	ProductBrand	app/Models/ProductBrand.php:17
category_collection	Category	app/Models/Category.php:32
category_collect	Collect	app/Models/Collect.php:14
image	Image	app/Models/Image.php:13
config_statics	ConfigStatic	app/Models/ConfigStatic.php:15
messages	Sms	app/Models/Sms.php:16
major_promotion	Major\Promotion	app/Models/Major/Promotion.php:21
major_promotion_item	Major\PromotionItem	:17
major_promotion_used	Major\PromotionUsed	:16
major_promotion_ignores	Major\PromotionIgnore	:17
major_favorites	Major\Favorite	:14
single_promotion_used	SingleCustomer\PromotionUsed	:15
customers_test	CustomerTest	:18
kids	Kids	:15
transaction_orders	TransactionOrder	implicit
branches, workshops, inventory_branches, inventory_transactions, custom_orders, custom_order_logs, comments, logs, request_logs, links, notifications, request_fashions	respective models	implicit (no migration)

Table count: 31 migration-created + 3 wallet package + ~28 legacy/implicit ≈ 62 tables. Only 34 have migrations.

---

7. Business logic

7.1 Gold price

Concern	Where	Detail
Price source of truth	app/Models/ConfigStatic.php:15 key gold_price	JSON blob with mesghal, geram18, geram24 (each with p price string, h, l, updated_at, uaj Jalali)
18-ayar price read	app/Models/WebServiceGold.php:17-25	getPriceGold18Ayar() = intval(str_replace(',','', $data['geram18']['p'])) / 10 — rial→toman conversion baked in
All prices	app/Models/WebServiceGold.php:27-31	getAllPrice() returns whole decoded blob
Feed #1 (ratebox.ir)	app/Models/WebServiceGold.php:85-116	Http::get('https://api.ratebox.ir/apijson.php?token='.env('WEBSERVICE_TOKEN')); maps index 4→mesghal, 5→geram18, 6→geram24; only writes gold_price if all three arrive (:109-112)
Feed #2 (tgju.org)	app/Console/Commands/GetGoldPriceForPwa.php:45-71	https://call3.tgju.org/ajax.json, whitelist of 10 slugs (geram18, silver_999, mesghal, price_dollar_rl, sekeb, rob, nim, sekee_down, rob_down, nim_down); writes both gold_price_pwa and gold_price
Feed #3 (duplicate in web route)	routes/web.php:32-124	GET / runs the same tgju scrape inline and writes both keys
Feed #4 (unused)	app/Http/Controllers/Site/SiteController.php:261	ratebox again
Live price endpoints	routes/admin.php:51, routes/site.php:14, routes/api.php:47	GET admin/price, GET site/price (closures), GET api/price → ApiMobileController@PriceFromWebService:886
No websocket / live push	—	see §10

7.2 Gram / weight calculation & pricing formula

Retail (SingleCustomer) price per variant — app/Models/ProductVariant.php:156-180 (getPriceAttribute):

G = ProductVariant::$goldPrice                 // injected per-request, = getPriceGold18Ayar()
E = static::$product_price_extra_percent       // ConfigStatic 'product_price_extra_percent', default 7  (:45-52)
p = G + G * ((percentage_pay + E) / 100)       // ساخت/اجرت  (making charge %)
p = p + p * 0.07                               // +7%  (سود / profit margin)
t = p - G                                       // isolate the non-metal portion
t = t + t * 0.09                               // +9% VAT applied ONLY to the non-metal portion
p = G + t
p = p * grams
return floor(p / 1000) * 1000                  // round DOWN to nearest 1,000 toman

Note rial_pay (stone cost) is not added in the current formula — only in the commented-out older variants (:183-206).

With promotion discount — app/Models/ProductVariant.php:248-296 (getPriceWithDiscountAttribute):

• Looks up self::$dis_product (pre-loaded PromotionProduct array) by product_id_id (:250-252)
• If use_only and a SingleCustomer\PromotionUsed row exists for auth()->id() + promotion_id → discount forced to 0 (:253-257)
• type == 1 → discount_percent; else → discount_price (a percent, applied as $price -= $price*($discount_price/100) :293)
• Discount percent is subtracted from the 7% margin: $price += $price * (0.07 - $discount_percent/100) (:289) — i.e. a discount erodes margin, not metal
• Same floor(/1000)*1000 rounding (:294)

Wholesale (major Customer) order gram math — app/Http/Controllers/Api/ApiMobileController.php:538-563 (setOrder):

percent   = item.percent_pay - item.discount
gram_item = rash_weight + rash_weight * (percent/100)
allGram   = Σ gram_item * qty                     // total gold grams owed
wage      = Σ rash_weight * qty                   // net metal weight
order.wage = allGram - wage                        // the "اجرت" portion, in grams
rial_input = Σ rial_pay * qty                      // stone/other rial charges
discount   = Σ item.discount

Per line item written at :617-634 with both rash_weight and original_rash_weight preserved, and w = rash_weight * (1 + percent/100).

Per-item implied gold price stored on retail orders — app/Http/Controllers/Controller.php:144: gold_price_in_formula = (item.total_price / item.qty) / item.grams

7.3 Fees / commissions / tax / spread / rounding

Item	Value	Where
Making-charge extra %	product_price_extra_percent ConfigStatic, default 7	app/Models/ProductVariant.php:45-52
Profit margin	hardcoded 7% (0.07)	ProductVariant.php:175, :289
VAT	hardcoded 9% (0.09), applied only to price - goldPrice	ProductVariant.php:178, :291
Rounding (price)	floor($price/1000)*1000 — round down to 1,000 toman	ProductVariant.php:180, :294
Rounding (weight display)	round($value, 2) — 2 decimals	app/Models/Utility.php:10-13; used by Order::getW/Wage, OrderItem::getW/Wage, Major\Cash::getValue
Cashback %	percent ConfigStatic (global)	app/Http/Controllers/Adm/AdminController.php:994
Cashback expiry (days)	expire ConfigStatic	AdminController.php:995, :1002
Birthday gift value	birthday_credit ConfigStatic	app/Console/Commands/birthdayCommand.php:46
Birthday gift expiry (days)	birthday_expire ConfigStatic	birthdayCommand.php:47, :64
City-level percent	cities.percent, cities.percent_aux	database/migrations/2021_09_18_171700_city_table.php:21, 2021_09_18_172722_cities_p_2.php:17
Per-customer percent	customers.percent / login.percent	migration 2020_10_19_153228:32; SingleCustomer fillable :32
No spread (buy vs sell price)	—	Not implemented. Single price per item.

7.4 Wallet / balance — packages/rooyesh/wallet

Dual-currency wallet: gold (grams, double) and credit (toman, bigint), one row per (owner, owner_type) — packages/rooyesh/wallet/src/migrations/...:16-30.

Concern	Where	Detail
Wallet open / get	WalletInterface::__construct :17-40	find-or-create by (owner_id, owner_type); validates hash on load
Hash chain (tamper detection)	WalletInterface::generate_hash :51-57	sha256(sha256(credit) + sha256(gold) + sha256(owner) + sha256(last_tx.hash) + "yhoenszeaf") — secret pepper is hardcoded
Wallet validate	WalletInterface::validate :42-49	throws UnprocessableEntityHttpException('امکان شارز این کیف پول وجود ندارد'); the package's own WalletValidateFailed is commented out (:45)
Transaction hash	TransactionInterface::generate_hash :101-114	sha256(sha256(value)+sha256(balance)+sha256(wallet)+"yhoenszeaf"+last_tx.hash)
Balance check	TransactionInterface::apply_transaction :127-135	if not deposit: type 1 (gold) requires wallet.gold >= value → NotEnoughCashBalance; type 2 (credit) requires wallet.credit >= value → NotEnoughCreditBalance
Sign convention	:136	value = abs(value) * (deposit ? 1 : -1)
Running balance	:141	balance = wallet.gold + wallet.credit + value — mixes grams and toman in one number (known modeling defect)
Validation rules	:142-153	wallet,type required; expire_at date; value integer|required (gram values are doubles — this rule is effectively bypassed because $validator->failed() is called instead of fails() at :151, which always returns an array/empty and never throws)
Apply to wallet	:159-165	type 1 → wallet.gold += value; type 2 → wallet.credit += value; then re-hash wallet
Meta rows	:157-158	TransactionMeta::create($meta) with order_id, total_weight, percent, order_date
Transaction types	migration :42-46	1=gold, 2=credit, 3=expire
Owner types	migration :27-30	1=user, 2=shop — all call sites pass 1
Read wallet (customer)	app/Http/Controllers/Customer/CustomerController.php:14-19	gold, credit, + computed gold_toman = gold * getPriceGold18Ayar()
Wallet tx list (customer)	Customer/CustomerController.php:21-30	paginated via addLimit
Wallet tx list (admin)	app/Http/Controllers/Adm/WalletController.php:49-59	TableEngine
Admin manual charge	Adm/WalletController.php:19-39	deposit = value > 0; pre-check credit sufficiency; always type 2 (credit), expire_at = now()+1 year
Wallet config get/set	Adm/WalletController.php:61-79	setConst writes arbitrary ConfigStatic keys; getConfig returns percent+expire; getConfigBirthday returns birthday_credit+birthday_expire
Global percent reset	Adm/WalletController.php:41-46	SingleCustomer::query()->update(['percent' => …]) — updates every row

Cashback on delivery — app/Http/Controllers/Adm/AdminController.php:985-1013 (chargeWalletAfterOrder):

percent = ConfigStatic['percent']; expire = ConfigStatic['expire']
value   = transaction_order.total_weight * (percent / 100)        // in GRAMS
new TransactionInterface(wallet, {value, order_id, expire_at: now()+expire days}, type=1 /*gold*/, deposit=true,
                          meta:{order_id, total_weight, percent, order_date})
transaction_order.payment = 1

Triggered from Controller::afterCreateOrder when sts == 6 (app/Http/Controllers/Controller.php:202-215), which also SMSes the customer the gram amount and "6-month validity" text (:207-214) — note the SMS says 6 months but the actual expiry is expire days from ConfigStatic.

Spending the wallet at checkout — app/Http/Controllers/Customer/OrderController.php:99-136:

if order.use_wallet:
  gold_value_toman = wallet.gold * order.gold_price_original
  all = gold_value_toman + wallet.credit
  if all <= order.price:                      // wallet cannot cover → drain it
      withdraw all gold (type 1) and all credit (type 2)
  else:                                        // wallet covers → partial
      if wallet.gold <= order.total_weight: withdraw all gold;
          if gold < total_weight: withdraw (all - order.price) credit
      else: withdraw exactly order.total_weight grams
  // recompute what is still payable
  amount = Σ |tx.value| * gold_price_original (type 1) + Σ |tx.value| (type 2)
  order.payment_after_wallet = order.price - amount

Refund on cancel — Customer/OrderController.php:150-168: re-deposits every Transaction for the order back into the wallet with the same transaction_type.

7.5 Buy / sell orders

There is no buy/sell order book, no market order, no limit order. Two distinct purchase order flows exist:

Flow	Model/table	Entry point	Status enum
Wholesale ("major") order — shopkeeper orders gold goods from the wholesaler, denominated in grams	Order / orders, OrderItem / order_items, OrderActivity / order_activity	ApiMobileController@setOrder :528-758 (guard api-customer); admin Adm\OrderController@store :32, Adm\MajorOrderController	Order::$STS 0..6 — app/Models/Order.php:65-72
Retail order — web customer buys a product, denominated in toman	SingleCustomerOrders / orders_orders, SingleCustomerOrderItems / orders_orderitem, SingleCustomer\OrderActivity / orders_histroy	Customer\OrderController@store :68-148 (guard api-singleCustomer); admin Adm\AdminController@orderStsSingle :898	SingleCustomerOrders::$STS 1..7 — app/Models/SingleCustomerOrders.php:66-74
Custom order (bespoke jewelry request)	CustomOrder, CustomOrderLog	Api\CustomOrderController	CustomOrder::$appends['sts_str_en'/'sts_str_fa'] :15, :68-76

7.6 Order & transaction status enums and transitions

Order::$STS (wholesale) — app/Models/Order.php:65-72:

key	Persian	notes
0	معلق (suspended)	set when gram limit exceeded
1	ثبت سفارش (placed)	default happy path
2	تایید مدیر سیستم (sysadmin approved)
3	درحال تامین (sourcing)
4	درحال آماده سازی (preparing)
5	تحویل مسئول فروش (handed to sales rep)
6	تحویل مشتری (delivered)	triggers wallet cashback
7	(کنسل شده — commented out :71)

Supporting statics: $STS_TAB (with -1 => همگی) :73-104; $STS_COLOR :105-113 (0 = #FF5252, 1-5 = #f5cb83, 6 = #4CAF50); $STS_IMG :122-130. $CONFIRMED = [1=>تایید شده, 2=>در انتظار تایید] :60-63. $TYPES = [1=>ثبت سفارش توسط مسئول فروش, 2=>ثبت مشتری] :45-48.

Transition mechanism (wholesale): all 7 status rows are pre-created in order_activity at order creation (ApiMobileController@setOrder:652-664), each with proceed 0/1. Advancing a status = flipping proceed=1 on that row — Adm\MajorOrderController@orderSts:121-211. On create: proceed = inValidOrder ? (key==0) : (key==1) (:662).

SingleCustomerOrders::$STS (retail) — app/Models/SingleCustomerOrders.php:66-74: 1=ثبت سفارش, 2=تایید مدیر سیستم, 3=در حال تامین, 4=در حال آماده سازی, 5=خروج از انبار, 6=ارسال, 7=تحویل مشتری. Types $TYPES = [1=تلفنی,2=تلگرام,3=واتس آپ,4=اینستا,5=حضوری] :76-82. Same pre-create-all-rows pattern: Controller::createSingleOrderActivity:81-92; afterCreateOrder flips the requested sts row (:182-186) and fires cashback at sts==6 (:202). Note the mismatch: $STS[6] = 'ارسال' (shipped) not delivered, yet cashback fires at 6.

Major\Cash::$TYPES — app/Models/Major/Cash.php:56-62: 9=سفارش (order), 1=آب شده (melted/bullion), 2=حواله (transfer note), 3=چک (cheque), 4=پولی (cash). $STS = [-1=>بررسی نشده, 1=>ثبت سند] :63-66. $CONFIRMED = [1=>تایید شده, 0=>تایید نشده] :68-71.

Wallet transaction types: 1=gold, 2=credit, 3=expire (migration :42-46).

SingleCustomerTransaction.sts is a free-text Persian string (e.g. 'پرداخت نشده' — app/Models/SingleCustomerTransaction.php:43), not an enum.

7.7 KYC levels

No KYC-level system exists. What exists is a two-step manual verification flag on wholesale customers:

Field	Where
customers.sts_verify_step_one, customers.sts_verify_step_two	app/Models/Customer.php:18 fillable
Accessors sts_verify_step_one_str, sts_verify_step_two_str + lookups GetStsVerifyStepOne, GetStsVerifyStepTwo	app/DB/Selector.php:101-127
Document images: business_license_image_id (جواز کسب), shop_image_id (سر در فروشگاه), ncode_image_id (کارت ملی)	app/Models/Customer.php:18; relations :170-181
Admin approval	Adm\MajorCustomerController@verifyRegister:97-144, @indexVerify:157, @archive:175
Activation toggles	Adm\AdminController@customerToggleSts:426, @customerToggleActive:432
National code	customers.ncode (migration 2020_10_01_120430:22)

No tiered limits are derived from verification status.

7.8 Limits (min / max / daily)

No daily limits. No min/max order amount. No withdrawal limit. The only limit is a per-customer gram ceiling on wholesale orders:

Concern	Where
Ceiling field	customers.gram_level double default 0 — database/migrations/2020_10_19_153228_customer_add.php:31; fillable app/Models/Customer.php:18
Running usage	customers.remain double default 0 — database/migrations/2020_10_01_120430_customers_table.php:26
Check	app/Http/Controllers/Api/ApiMobileController.php:566-567: $inValidOrder = ($allGram + $remain) > $gramLevel
Effect	order sts forced to 0 (معلق/suspended) instead of 1 (:577, :592); activity note "تعلیق سفارش به دلیل عبور از سقف مجاز گرمی" (:661); a Notify row explains the suspension (:669-677)
Note	The $customer->increment('remain', $allGram) on success is commented out (:604-607) — remain is maintained elsewhere (cash ledger)
Product-level gram bounds	product.min_gram, product.max_gram — app/Models/Product.php:22 (display/filter only)
Pagination limit	Controller::addLimit — default 10, hard cap 50 — app/Http/Controllers/Controller.php:31-36
Rate limit	500 req/min on api — app/Providers/RouteServiceProvider.php:77

7.9 OTP / SMS

Concern	Where	Detail
SMS gateway (active)	app/Models/Sms.php:74-84 (Send), :101-111 (SendSms)	POST https://smspanel.trez.ir/SendMessageWithCode.ashx, form fields PhoneNumber=9998882797, Username=hajiabolfath, Password=Aa@09195540836 (hardcoded), Mobile, Message; 20s timeout
SMS gateway (dead)	Sms.php:63-73, :91-99	0098sms.com/sendsmslink.aspx with USERNAME=zsms6916 — commented out
Every send is logged	Sms::set :125-134 → messages table	customer_id, mobile, massage(sic), token, type, user_id
OTP — wholesale Customer	Api\ApiMobileController@userAuth:40-50	rand(1000,9999) → stored in customers.send_password (plain text, no expiry, no attempt counter); SMS body includes <#> code is … + Android SMS Retriever hash aMo6iFyUQaY
OTP verify (wholesale)	ApiMobileController@userVerfiy:52-81	compares Utility::faTOen($request->password) != $customer->send_password → abort(422); on success issues api_token = Str::random(60) only if null (:59-61) — token never rotates
OTP — retail SingleCustomer	Api\SingleCustomerController@login:58-76	rand(1000,9999) → login.token_sms (plain, no expiry); returns {id}; SMS "کد تایید ورود"
OTP verify (retail)	Api\SingleCustomerController@verfiy:42-56	compares token_sms; sets is_active = true; issues api_token = Str::random(60) if null
Legacy password login	ApiMobileController@login:83-110 (Hash::check); Adm\AdminController@login:60-78 (staff)
Batch SMS	Adm\SmsController@batch:23-76	validates payload,type numeric,mobiles array,token; @replaceName:91-111 does %%NAME%% substitution
Ad-hoc SMS	Adm\SmsController@sendSmsToOther:150
Mass-SMS to ALL customers via GET	routes/api.php:126-180 (GET api/send/all), routes/web.php:158-186 (GET /test2)	unauthenticated closures that loop Customer::get() and SMS everyone
Hardcoded admin phones (order alerts)	ApiMobileController:601-604 (09128081392, 09124871664, 09124406015, 09120363240); Customer/OrderController:139-144 (09128081392, 09124406015 ×2, 09363366849)

7.10 Notifications (push)

Concern	Where
FCM config	config/fcm.php:4-9 — FCM_PROTOCOL (def http), FCM_SERVER_KEY, FCM_SENDER_ID
In-app notification store	Notify model / notify table — app/Models/Notify.php:14-33
Single push	Notify::store($token,$title,$body) :57-86
Group push	Notify::sendToGroup($tokens,$title,$body) :88+
Second impl	Notification::store() app/Models/Notification.php:33
Device token storage	customers.token_mobile, users.token_mobile (Customer.php:18, User.php:29); updated via POST api/tokenmobile → ApiMobileController@updateTokenMobile:477
Admin send	Adm\NotifyController@store:27, @customer:67
Read/unread	Notify.read bool; Adm\NotifyController@read:95, @getUnreadNotify:86; customer PUT api/notify/read/{id} → @readNotify:784

7.11 Payment gateway + callbacks

Concern	Where	Detail
Gateway: PayPing (init)	app/Http/Controllers/Customer/TransactionController.php:11-27	POST https://api.payping.ir/v1/pay with clientRefId, amount, returnUrl = https://henzagold.com/oapi/site/transaction/verify. No Authorization header is sent (the withHeaders call is chained after post() at :100, so it is a no-op).
Gateway: PayPing (verify, dead code)	app/Models/SingleCustomerTransaction.php:84-100	POST https://api.payping.ir/v2/pay/verify with hardcoded bearer token :86; hardcoded amount=1000, payerIdentity='09134139430', payerName='Azizan'; returnUrl = url('/bank-back')
Gateway: Zarinpal (SOAP)	SingleCustomerTransaction.php:49-82	entirely commented out
Callback route	—	The returnUrl site/transaction/verify is NOT registered in any route file. routes/site.php has no transaction/* route. /bank-back is also not registered. The payment callback is missing / dead.
Transaction record	transactions_transaction via SingleCustomerTransaction	gateway = 'paypal' (sic, hardcoded :44), sts free-text Persian
Route	POST cu/transaction/gateway — routes/customer.php:36

7.12 File uploads

Concern	Where
Primary upload	Adm\FileController@storeWithoutData:144-192 — POST admin/file/create, POST api/file/create
Filename	md5(time() . original_name) . '.' . ext (:155-156)
Destination	public_path('storage') — flat, no date directory (the createDir() path logic is commented out :150, :162-179)
Record	App\Models\Image::create($data) with original_name, ext, image (:186-190)
No validation	no mime/size/extension check, no auth on admin/file/create
WebP conversion / watermark	commented out (:162-172)
Body/caption update	@updateBody:268 — PUT admin/file/update/{file_id}
Full CRUD (legacy)	@store:58, @show:200, @update:215, @destroy:255
Product image resize	Adm\ProductController@createImage:22-29
URL base	Utility::baseURLStorage() = https://henzagold.com/oapi/storage/ — app/Models/Utility.php:30-32; Image::getFullAttribute:35, getImageAttribute:58
APK download	Api\SiteController@downloadApk — env('APK_PATH', storage_path('app/public/henza.apk')), env('APK_VERSION',0) — app/Http/Controllers/Api/SiteController.php:494-495

7.13 Settings / config table

config_statics (ConfigStatic) is the universal key/value settings table — app/Models/ConfigStatic.php:10-33. It doubles as a lookup/enum table (users.ut is an FK to it — Adm\UserController:26 validates ut exists:config_statics,id; User::user_type() :51).

Known key	Purpose	Evidence
gold_price	live price JSON (geram18/geram24/mesghal)	WebServiceGold.php:19,:28,:110
gold_price_pwa	PWA price JSON (10 instruments)	GetGoldPriceForPwa.php:70; routes/web.php:60
product_price_extra_percent	making-charge extra %, default 7	ProductVariant.php:49
percent	wallet cashback % of order weight	AdminController.php:994; Controller.php:203
expire	cashback validity, in days	AdminController.php:995,:1002
birthday_credit	birthday gift amount (toman)	birthdayCommand.php:46
birthday_expire	birthday gift validity (days)	birthdayCommand.php:47
brand	product brand list (legacy, superseded by product_brand)	ApiMobileController.php:75 (commented)
(arbitrary)	Adm\WalletController@setConst:61-70 writes any key from the request body

Accessors: ConfigStatic::getValue($key) — returns scalar if exactly 1 row, collection if >1, throws NotFoundHttpException('Const not found') if 0 (:25-33). CRUD via Adm\ConstController (admin/const/*), read via GET site/const/{id}, full list via GET admin/config/statics → AdminController@getConfigStatics:752.

7.14 What does NOT exist (explicit negatives for parity work)

Expected in a gold-banking backend	Status in henza_server
Buy / sell gold orders (market/limit)	Absent — only product purchase orders
Bid/ask spread	Absent — one price per item
Deposit (cash in)	Absent — only admin manual wallet charge (Adm\WalletController@charge)
Withdraw (cash out / physical gold delivery)	Absent
Peer-to-peer transfer	Absent (the "حواله" in Cash::$TYPES[2] and config/havaleh.php is a static list of 9 broker names, not a transfer feature)
KYC levels / tiers	Absent — only 2 manual verification booleans + 3 document images
Daily / monthly limits	Absent — only a per-customer total gram ceiling
Payment callback / verify endpoint	Route missing (§7.11)
Idempotency keys on money ops	Absent
DB transactions around wallet ops	Absent — apply_transaction does 4 unwrapped writes (TransactionInterface.php:154-164)
Audit/event sourcing	Partial — wallet hash chain + order_activity + RequestLog

---

8. Jobs / Queues / Cron

8.1 Jobs — app/Jobs (3)

Job	Constructor args	handle()	Evidence
SendSmsJob	$mobile, $message, $customer_id, $user_id	Sms::SendSms($mobile,$message,$customer_id,null,null,$user_id)	app/Jobs/SendSmsJob.php:25-41
SendSmsAfterCreate	$mobile, $message	Sms::Send($mobile,$message)	app/Jobs/SendSmsAfterCreate.php:23-37
PromotionAfterCreate	$customer_id	body fully commented out; return; — "new customer 1% promo for 5 days" disabled	app/Jobs/PromotionAfterCreate.php:33-53

All three implement ShouldQueue with Dispatchable, InteractsWithQueue, Queueable, SerializesModels.

Queue driver: config/queue.php 'default' => env('QUEUE_CONNECTION', 'sync') — defaults to sync (jobs run inline) unless env overrides. failed_jobs table exists (migration #3).

8.2 Console commands — app/Console/Commands (5)

Signature	Class	Purpose
price:get	GetGoldPrice :15	WebServiceGold::getAllPriceFromWebService() (ratebox.ir) — :39-43
pwa:price	GetGoldPriceForPwa :18	tgju.org scrape → writes gold_price_pwa and gold_price; then calls Tahesab DoListMoshtari [1,510] at https://31.7.68.147:3030/ with hardcoded bearer token :76-81
transaction:expire	ExpireCommand :18	loops all SingleCustomer; sums expired-vs-spent gold and credit; posts negative (withdraw) TransactionInterface entries for the surplus — :42-80
birthday:sms	birthdayCommand :20	finds customers whose birth_day day+month = today; SMSes a gift message; deposits birthday_credit as type 2 (credit) with expire_at = now() + birthday_expire days — :44-68
wallet:sms	SmsWalletCommand :17	finds wallets with sms_at exactly 3 months ago; if gold>0 || credit>0 SMSes the owner the literal string 'هنزا'; updates sms_at/sent — :41-57

8.3 Schedule — app/Console/Kernel.php

Item	Evidence
$commands registry	birthdayCommand, ExpireCommand, GetGoldPriceForPwa — app/Console/Kernel.php:18-22 (note: GetGoldPrice and SmsWalletCommand are not listed, but $this->load(__DIR__.'/Commands') at :42 auto-discovers them)
schedule()	EMPTY — the only line is a commented $schedule->command('inspire')->hourly(); — app/Console/Kernel.php:30-33

⇒ There is NO Laravel cron schedule. Price refresh, expiry sweeps and birthday SMS must be driven by external OS cron calling artisan pwa:price / transaction:expire / birthday:sms, or by hitting GET / (routes/web.php:32) which performs the price scrape inline.

routes/console.php:17-19 defines only the stock inspire closure command.

---

9. Permissions / roles

No Spatie, no Gates, no Policies. AuthServiceProvider::$policies is empty (app/Providers/AuthServiceProvider.php:15-17); boot() only calls registerPolicies() (:24-29). No Gate::define anywhere. The can middleware alias is registered (Kernel.php:60) but never used on any route.

9.1 Model

Piece	Detail	Evidence
Role = users.ut	integer "user type" on User; FK into config_statics	migration 2021_09_18_171700_city_table.php:28; User.php:27; User::user_type() :51
Permission = permission table	composite PK (rid, ut) — rid is a free-text permission string, ut is the role id	migration 2021_09_18_115342_permissions_table.php:16-19; app/Models/Permission.php:14-18
Validation of ut	'ut' => 'required|numeric|exists:config_statics,id'	Adm\UserController.php:26, :64

9.2 Where permissions are read

Operation	Where
Returned at login	Adm\AdminController@login:74 — $per = Permission::whereUt($user->ut)->get(); attached to the login response. The server never enforces it — enforcement is entirely client-side in the admin SPA.
Set (replace all for a role)	Adm\PermissionController@create:12-40 — diffs requested roles[] against existing, creates missing, deletes surplus
Set (additive)	@store:42-57 — firstOrCreate per role
Delete one	@destroy:59-65 — DELETE admin/roles/{ut}/{rid}
Check one	@has:67-74 — GET admin/roles/{ut}/{rid} → boolean
My permissions	@get:76-81 — Permission::where('ut', Auth::user()->ut)
Permissions of a role	@getByUt:83-88 — GET admin/roles/{id}
Attached to user detail	Adm\UserController@show:96 — Permission::where('ut',$user->ut)->pluck('rid')

9.3 Permission names found

No permission (rid) string literals exist anywhere in the codebase. rid values are created purely from client-supplied roles[] arrays (PermissionController@create:21, @store:51) and stored as-is. The catalogue of permission names lives only in the admin front-end and in the DB — it is not derivable from henza_server. Likewise there is no seeded list of ut (role) values; they are rows in config_statics.

9.4 Actual enforcement in practice

Surface	Enforcement
routes/admin.php (215 routes)	NONE — the auth:api wrapper is commented out (:12, :264). Fully public.
routes/api.php public block	none
routes/api.php:64-117	auth:api-customer only (authentication, not authorization)
routes/customer.php:10-46	auth:api-singleCustomer only
routes/site.php, routes/web.php	none (except version on one route)
Ownership checks	ad-hoc: Controller::checkCustomer($auth_id,$store_id) throws AccessDeniedHttpException (app/Http/Controllers/Controller.php:232-236); scopes Order::scopeMe:161, Notify::scopeMe:50, Major\Cash::scopeMe:74; where('customer_id', auth()->id()) in Customer\CustomerController:135 etc.

---

10. Broadcasting / sockets

Item	Detail	Evidence
Channels file	Contains exactly one channel: App.Models.User.{id}, authorized by (int)$user->id === (int)$id (Laravel's stock private-notification channel)	routes/channels.php:28-30
Provider	BroadcastServiceProvider exists	app/Providers/BroadcastServiceProvider.php
Driver default	'default' => env('BROADCAST_DRIVER', 'null') — null (disabled) unless env overrides	config/broadcasting.php:18
Available connections	pusher (:34, keys PUSHER_APP_KEY/PUSHER_APP_SECRET/PUSHER_APP_ID/PUSHER_APP_CLUSTER), redis (:45), log (:50), null (:54)	config/broadcasting.php:31-56
Events broadcast	NONE — no class implements ShouldBroadcast; app/Events/ does not exist; EventServiceProvider::$listen is stock	app/Providers/EventServiceProvider.php
Live price over socket	NOT IMPLEMENTED. Price is delivered by polling GET api/price / GET site/price / GET admin/price, all of which read ConfigStatic['gold_price']	routes/api.php:47, routes/site.php:14-16, routes/admin.php:51-53
Real-time client hint	package.json may include laravel-echo but no server-side publisher exists	—

⇒ There is no real-time/websocket layer. Live price = HTTP polling of a DB-cached JSON blob refreshed by a cron-driven command.

---

11. Env / config keys

11.1 Custom (non-stock) config files

File	Content
config/havaleh.php:5-16	Flat array of 9 hardcoded broker name+phone strings (e.g. 'مسعود آتشی | 33977786-021'). Returned verbatim by GET admin/havale/list (Adm\AdminController@getHavaleList:1018) and attached to the mobile login payload as $customer->to (ApiMobileController:66, :96).
config/version.php:2-4	['version' => '2.2.0'] — compared against the version request header by VersionMiddleware (app/Http/Middleware/VersionMiddleware.php:21-27).
config/validation.php:2-9	Single route-keyed rule set: 'admin/product/create@post' => ['cats'=>'required|array','title'=>'required','indicator_id'=>'required','mobile_pic'=>'required']. Never read by any code (no config('validation') usage) — dead config.
config/corcel.php	Corcel/WordPress bridge connection.
config/fcm.php:4-9	FCM_PROTOCOL (def http), FCM_SERVER_KEY, FCM_SENDER_ID.
config/pdf.php, config/dompdf.php	PDF rendering (invoice generation).

11.2 env() calls inside app/ and routes/ (outside config/)

Key	Default	Where
WEBSERVICE_TOKEN	—	app/Models/WebServiceGold.php:85; app/Http/Controllers/Site/SiteController.php:261; app/Console/Commands/GetGoldPriceForPwa.php:170 (commented)
APK_VERSION	0	app/Http/Controllers/Api/SiteController.php:494
APK_PATH	storage_path('app/public/henza.apk')	app/Http/Controllers/Api/SiteController.php:495
APP_NAME	—	app/DB/Te/print.blade.php:5
BASE_PATH_STORAGE	''	app/Models/Image.php:60 (commented out)

⚠️ These are runtime env() calls outside config files — they return null when php artisan config:cache is used.

11.3 Stock env keys consumed via config/*

APP_NAME, APP_ENV, APP_KEY, APP_DEBUG, APP_URL, LOG_CHANNEL; DB_CONNECTION (default 'localhost' — unusual, config/database.php:18), DB_HOST, DB_PORT, DB_DATABASE, DB_USERNAME, DB_PASSWORD, DB_SOCKET, DATABASE_URL, DB_FOREIGN_KEYS, MYSQL_ATTR_SSL_CA; REDIS_CLIENT, REDIS_CLUSTER, REDIS_PREFIX, REDIS_URL, REDIS_HOST, REDIS_PASSWORD, REDIS_PORT, REDIS_DB, REDIS_CACHE_DB; BROADCAST_DRIVER (def null), PUSHER_APP_KEY, PUSHER_APP_SECRET, PUSHER_APP_ID, PUSHER_APP_CLUSTER; CACHE_DRIVER, CACHE_PREFIX, MEMCACHED_*, DYNAMODB_CACHE_TABLE, DYNAMODB_ENDPOINT; QUEUE_CONNECTION, SESSION_DRIVER, SESSION_LIFETIME; FILESYSTEM_DRIVER, FILESYSTEM_CLOUD, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION, AWS_BUCKET; MAIL_*, MAILGUN_DOMAIN, MAILGUN_SECRET, MAILGUN_ENDPOINT, POSTMARK_TOKEN; FCM_PROTOCOL, FCM_SERVER_KEY, FCM_SENDER_ID.

11.4 Hardcoded secrets / endpoints (parity + security relevant)

Secret / endpoint	Location
SMS panel user + password hajiabolfath / Aa@09195540836	app/Models/Sms.php:80-81, :107-108
PayPing bearer 413471e0…d7b1	app/Models/SingleCustomerTransaction.php:86
Tahesab bearer S3F1P8Q4…U8 + host 31.7.68.147:3030	app/Console/Commands/GetGoldPriceForPwa.php:78-80
Wallet hash pepper "yhoenszeaf"	packages/rooyesh/wallet/src/interfaces/WalletInterface.php:56; TransactionInterface.php:112
Storage base URL https://henzagold.com/oapi/storage/	app/Models/Utility.php:31
Payment return URL https://henzagold.com/oapi/site/transaction/verify	app/Http/Controllers/Customer/TransactionController.php:99
Admin alert phone numbers	app/Http/Controllers/Api/ApiMobileController.php:601-604; app/Http/Controllers/Customer/OrderController.php:139-144
Customer-facing URLs (henzagold.com/customer/my-orders, /dashboard, /app, /download/henza.apk)	app/Http/Controllers/Controller.php:199, :213; routes/web.php:128, :132

---

12. Validation

There are ZERO FormRequest classes — app/Http/Requests/ does not exist. All validation is inline, using either $this->validate($request, [...]) (ValidatesRequests trait) or Validator::make($request->all(), [...]). config/validation.php defines one route-keyed rule set that nothing reads.

Distribution (rule-block counts per controller):

Controller	blocks
Adm/AdminController	17
Api/ApiMobileController	5
Api/SingleCustomerController	4
Adm/MajorOrderController, Adm/UserController, Api/CustomOrderController, Api/SiteController	3 each
Adm/BranchController, Adm/OrderController, Adm/PermissionController, Adm/ProductController, Adm/SmsController, Adm/WorkshopController, Major/CustomerController	2 each
Adm/CitiesController, Adm/CommentController, Adm/MajorCustomerController, Adm/SingleCustomerController, Customer/CommentController, Customer/FavController, Customer/OrderController, WebApp/AuthController	1 each

Main rule sets

Endpoint	Rules	Evidence
Admin login	phone: required, password: required	Adm/AdminController.php:62
Update customer	id: required|exists:customers,id, fname: required, lname: required	Adm/AdminController.php:264-267
Update customer (mobile uniqueness)	mobile: unique:customers,mobile,{id}	Adm/AdminController.php:303-304
Create customer (with reagent)	mobile: required|unique:customers, reagent: required	Adm/AdminController.php:321-323
Create customer (reagent path)	mobile: required|unique:customers, percent: required	Adm/AdminController.php:352-354
Confirm cash doc	id: required	Adm/AdminController.php:455-456
Set gram for fin-doc (commented)	id: required, gram: required	Adm/AdminController.php:480-482
Read SMS (commented)	FROM/TO/TEXT: required	Adm/AdminController.php:505-508
Confirm order	cId: required (customer), oId: required (order)	Adm/AdminController.php:517-519
Set fin-doc (commented)	customer_id/price/value: required	Adm/AdminController.php:583-586
Add product	cats: required|array, title: required	Adm/AdminController.php:600-602
Get variant(s)	id: required	Adm/AdminController.php:736, :745
Add category	title: required	Adm/AdminController.php:794-795
Change percent (bulk)	percentage_pay: required	Adm/AdminController.php:845-846
Report order	id: required	Adm/AdminController.php:900-901
Branch store/update	user_id: required	Adm/BranchController.php:48-49, :83-84
Cities store	title: required, parent: exists:cities,id, level: numeric|required, percent: numeric	Adm/CitiesController.php:15-19
Comment status	comment_id: required, sts: required	Adm/CommentController.php:123-124
Verify major customer	customer_id: required	Adm/MajorCustomerController.php:98-99
Major order sts	id: required	Adm/MajorOrderController.php:123-124
Major order item edit	id: required, w: required, order_id: required	Adm/MajorOrderController.php:214-217
Delete major order	id: required	Adm/MajorOrderController.php:275-276
Admin order store	order_items: required	Adm/OrderController.php:35-36
Admin order update	order_items: required, shipping_address: required	Adm/OrderController.php:66-67
Permissions (create/store)	ut: required, roles: required|array	Adm/PermissionController.php:13-15, :45-47
Product store	cats: required|array, title: required (product_code: required|unique:product,product_code is commented out :45)	Adm/ProductController.php:42-45
Product update	(rule array empty — product_code unique rule commented out)	Adm/ProductController.php:114-115
Single customer store	fname: required, lname: required, phone: required|unique:login	Adm/SingleCustomerController.php:20
SMS batch	payload: required, type: required|numeric, mobiles: array, token: required	Adm/SmsController.php:25-29
SMS to other	payload: required, mobile: required	Adm/SmsController.php:79-81
User store	fname: required, lname: required, mobile: required|unique:users, ut: required|numeric|exists:config_statics,id, city_id: exists:cities,id, password: required|min:6	Adm/UserController.php:22-28
User update	mobile: unique:users,mobile,{id}, ut: numeric|exists:config_statics,id, city_id: exists:cities,id; if password present: password: required|min:6|confirmed	Adm/UserController.php:62-72
OTP request (wholesale)	username: required	Api/ApiMobileController.php:42
OTP verify (wholesale)	username: required, password: required	Api/ApiMobileController.php:54
Legacy login (wholesale)	username: required, password: required	Api/ApiMobileController.php:85
Retail register	fname: required, lname: required, phone: required|unique:login	Api/SingleCustomerController.php:30
Retail OTP verify	token: required, id: required	Api/SingleCustomerController.php:43
Retail login (OTP request)	phone: required	Api/SingleCustomerController.php:59
Retail order store	order_items: required, shipping_address: required	Customer/OrderController.php:73-75 (returns 422 with $validator->errors())

Notable validation gaps (parity-relevant)

Gap	Evidence
setOrder (wholesale order creation) has NO validation at all — $request->items is consumed raw	Api/ApiMobileController.php:528-758
Wallet charge has NO validation — $data['value'], $data['customer_id'] taken raw	Adm/WalletController.php:19-39
setConst writes arbitrary ConfigStatic keys with no whitelist/validation	Adm/WalletController.php:61-70
File upload has no mime/size/extension validation	Adm/FileController.php:144-192
Payment gateway gateway() has no validation — amount, customer_id raw	Customer/TransactionController.php:11-27
Wallet package's own validator is never enforced — calls $validator->failed() (returns array) instead of fails() (returns bool)	packages/rooyesh/wallet/src/interfaces/TransactionInterface.php:150-153
Product::update validation array is empty	Adm/ProductController.php:114-116
No numeric/min/max on any money or weight field anywhere	—