ui and bug fixers 29/09

Backend/ERPCore/Controllers/AuthController.cs

@@ -28,14 +28,20 @@ public sealed class AuthController : ControllerBase
     private readonly IAuthAltService _alt;
     private readonly IRoleService _roles;
     private readonly IAuditService _audit;
+    private readonly IUserManagementService _userManagement;
+    private readonly ICurrentUser _currentUser;
 
-    public AuthController(IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles, IAuditService audit)
+    public AuthController(
+        IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles, IAuditService audit,
+        IUserManagementService userManagement, ICurrentUser currentUser)
     {
         _users = users;
         _recovery = recovery;
         _alt = alt;
         _roles = roles;
         _audit = audit;
+        _userManagement = userManagement;
+        _currentUser = currentUser;
     }
 
     /// <summary>
@@ -139,6 +145,8 @@ public sealed class AuthController : ControllerBase
     public async Task<IActionResult> ChangePassword([FromBody] ChangeUserPasswordRequest request, CancellationToken ct)
     {
         await _users.ChangeUserPasswordAsync(request, RequireBearerToken(), ct);
+        // AuthHex accepted the new password — release the first-login forced change.
+        await _userManagement.ClearMustChangePasswordAsync(_currentUser.AuditUserId, ct);
         AuthCookieWriter.ClearSession(Response);
         return NoContent();
     }

Backend/ERPCore/Domain/Entities/BranchConfig.cs

@@ -23,6 +23,12 @@ public class BranchConfig
     /// single-branch already).</summary>
     public bool WarehouseBranchingEnabled { get; set; } = true;
 
+    /// <summary>Independent sub-toggle for Purchase Orders. On: each PO belongs to one branch,
+    /// non-admins only see their own branch's POs, and line warehouses must be in that branch.
+    /// Off: POs form one shared pool across branches (kept on the default branch, visible to
+    /// everyone, any warehouse allowed). Meaningless when <see cref="BranchingEnabled"/> is off.</summary>
+    public bool PurchaseOrderBranchingEnabled { get; set; } = true;
+
     public DateTime? UpdatedAt { get; set; }
 
     public int? UpdatedBy { get; set; }

Backend/ERPCore/Domain/Entities/User.cs

@@ -31,6 +31,14 @@ public class User
     /// </summary>
     public string? Email { get; set; }
 
+    /// <summary>
+    /// Set when an admin creates the account with an issued (temporary) password
+    /// (<c>UserManagementService.CreateAsync</c>); surfaced via <c>GET /auth/me</c> so the
+    /// frontend forces a password change on first login. Cleared by
+    /// <c>POST /auth/change-password</c>.
+    /// </summary>
+    public bool MustChangePassword { get; set; }
+
     /// <summary>Local shadow <see cref="Role"/> assignment; null until an admin assigns one.</summary>
     public int? RoleId { get; set; }
     public Role? Role { get; set; }

Backend/ERPCore/Domain/Entities/Vendor.cs

@@ -14,6 +14,8 @@ public class Vendor
     public string Name { get; set; } = string.Empty;
     public string? Terms { get; set; }
     public string? TaxReg { get; set; }
+    public string? Address { get; set; }
+    public string? Phone { get; set; }
     public string Currency { get; set; } = "LKR";
     public EntityStatus Status { get; set; } = EntityStatus.Active;
 

Backend/ERPCore/Dtos/Config/BranchConfigDtos.cs

@@ -4,7 +4,8 @@ namespace ERPCore.Dtos.Config;
 
 /// <summary>Branch configuration resource — the singleton toggle for whether this deployment
 /// requires a branch on Employee/Warehouse records at all.</summary>
-public sealed record BranchConfigDto(bool BranchingEnabled, bool WarehouseBranchingEnabled, DateTime? UpdatedAt, int? UpdatedBy);
+public sealed record BranchConfigDto(
+    bool BranchingEnabled, bool WarehouseBranchingEnabled, bool PurchaseOrderBranchingEnabled, DateTime? UpdatedAt, int? UpdatedBy);
 
 /// <summary>
 /// Full replacement of the flag. <c>UpdatedBy</c> is derived from the token, never posted.
@@ -18,4 +19,8 @@ public sealed class UpdateBranchConfigRequest
 {
     [Required] public bool? BranchingEnabled { get; set; }
     [Required] public bool? WarehouseBranchingEnabled { get; set; }
+
+    /// <summary>Optional so existing callers that only know the first two flags keep working —
+    /// omitted means "leave as is".</summary>
+    public bool? PurchaseOrderBranchingEnabled { get; set; }
 }

Backend/ERPCore/Dtos/Dashboard/DashboardDtos.cs

@@ -18,6 +18,7 @@ public sealed record DashboardStatsDto(
     decimal StockValuationTotal,
     IReadOnlyList<WarehouseValuationDto> StockValuationByWarehouse,
     int PendingApprovalPurchaseOrders,
+    int FullyReceivedPurchaseOrders,
     int PendingGrns,
     int OpenRequisitions,
     int PendingCounts,

Backend/ERPCore/Dtos/Rbac/MeDtos.cs

@@ -8,7 +8,12 @@ namespace ERPCore.Dtos.Rbac;
 /// branch pickers client-side only (no server-side branch enforcement exists yet,
 /// see docs/BRANCH_ISOLATION_PLAN.md). <see cref="BranchingEnabled"/> mirrors the
 /// singleton <c>BranchConfig</c> toggle — when false the frontend hides branch pickers
-/// entirely rather than merely restricting them by role.</summary>
+/// entirely rather than merely restricting them by role. <see cref="MustChangePassword"/>
+/// is true for an admin-created account that hasn't replaced its issued password yet —
+/// the frontend holds the user on the change-password screen until it is false.</summary>
 public sealed record MeResponseDto(
     string? RoleCode, string? RoleName, IReadOnlyList<string> NavCodes,
-    bool IsAdmin, int? BranchId, string? BranchName, bool BranchingEnabled, bool WarehouseBranchingEnabled);
+    bool IsAdmin, int? BranchId, string? BranchName, bool BranchingEnabled, bool WarehouseBranchingEnabled,
+    bool MustChangePassword = false,
+    bool PurchaseOrderBranchingEnabled = true,
+    int? UserId = null);

Backend/ERPCore/Dtos/Vendors/VendorDtos.cs

@@ -5,7 +5,7 @@ namespace ERPCore.Dtos.Vendors;
 
 /// <summary>Vendor resource (docs/11-BACKEND-PHASE1.md §2.4).</summary>
 public sealed record VendorDto(
-    int VendorId, string Code, string Name, string? Terms, string? TaxReg,
+    int VendorId, string Code, string Name, string? Terms, string? TaxReg, string? Address, string? Phone,
     string Currency, EntityStatus Status, int BranchId, DateTime CreatedAt, DateTime? UpdatedAt);
 
 public sealed class CreateVendorRequest
@@ -14,6 +14,8 @@ public sealed class CreateVendorRequest
     [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
     [StringLength(50)] public string? Terms { get; set; }
     [StringLength(50)] public string? TaxReg { get; set; }
+    [StringLength(500)] public string? Address { get; set; }
+    [StringLength(30)] public string? Phone { get; set; }
     [Required, StringLength(3, MinimumLength = 3)] public string Currency { get; set; } = "LKR";
     /// <summary>Optional — resolved via <see cref="Services.Interfaces.IBranchConfigService.ResolveBranchIdAsync"/>
     /// when branching is enabled; ignored (defaulted) otherwise.</summary>
@@ -26,6 +28,8 @@ public sealed class UpdateVendorRequest
     [Required, StringLength(200)] public string Name { get; set; } = string.Empty;
     [StringLength(50)] public string? Terms { get; set; }
     [StringLength(50)] public string? TaxReg { get; set; }
+    [StringLength(500)] public string? Address { get; set; }
+    [StringLength(30)] public string? Phone { get; set; }
     [Required, StringLength(3, MinimumLength = 3)] public string Currency { get; set; } = "LKR";
     public int BranchId { get; set; }
 }

Backend/ERPCore/Infra/Auth/AuthHex/AuthHexClient.cs

@@ -107,11 +107,14 @@ public sealed class AuthHexClient : IAuthHexClient
 
     // ---- RecoveryManager ------------------------------------------------
 
-    public Task<ForgotPasswordResponse> ForgotPasswordAsync(ForgotPasswordRequest request, CancellationToken ct)
-        => CallAsync<ForgotPasswordResponse>("recovery", "forgotPassword", request, null, ct);
+    // RecoveryManagerService returns its own { success, message, data } object, which the
+    // function handler then wraps again as the envelope's `data` — so the payload sits one
+    // level deeper than for other AuthHex calls (ERP_Auth_Service RecoveryManager.cs).
+    public async Task<ForgotPasswordResponse> ForgotPasswordAsync(ForgotPasswordRequest request, CancellationToken ct)
+        => Unwrap(await CallAsync<AuthHexEnvelope<ForgotPasswordResponse>>("recovery", "forgotPassword", request, null, ct));
 
-    public Task<VerifyRecoveryOtpResponse> VerifyRecoveryOtpAsync(VerifyRecoveryOtpRequest request, CancellationToken ct)
-        => CallAsync<VerifyRecoveryOtpResponse>("recovery", "verifyOTP", request, null, ct);
+    public async Task<VerifyRecoveryOtpResponse> VerifyRecoveryOtpAsync(VerifyRecoveryOtpRequest request, CancellationToken ct)
+        => Unwrap(await CallAsync<AuthHexEnvelope<VerifyRecoveryOtpResponse>>("recovery", "verifyOTP", request, null, ct));
 
     public Task ResetPasswordAsync(ResetPasswordRequest request, CancellationToken ct)
         => CallVoidAsync("recovery", "resetPassword", request, null, ct);
@@ -149,6 +152,14 @@ public sealed class AuthHexClient : IAuthHexClient
 
     // ---- Transport --------------------------------------------------------
 
+    /// <summary>Unwraps the inner result object that the recovery functions nest inside the envelope's data.</summary>
+    private static T Unwrap<T>(AuthHexEnvelope<T>? inner)
+    {
+        if (inner is null || !inner.Success || inner.Data is null)
+            throw new DomainException(ErrorCodes.AuthUpstreamError, inner?.Message ?? "Authentication request failed.", 400);
+        return inner.Data;
+    }
+
     private async Task CallVoidAsync(string routeGroup, string functionName, object payload, string? bearerToken, CancellationToken ct)
         => await CallAsync<JsonElement?>(routeGroup, functionName, payload, bearerToken, ct);
 

Backend/ERPCore/Infra/Persistence/Configurations/BranchConfigConfiguration.cs

@@ -21,6 +21,8 @@ public sealed class BranchConfigConfiguration : IEntityTypeConfiguration<BranchC
         builder.Property(c => c.ConfigId).ValueGeneratedNever();
 
         builder.Property(c => c.BranchingEnabled).IsRequired().HasDefaultValue(true);
+        // Defaults on so the existing row keeps today's per-branch purchase orders.
+        builder.Property(c => c.PurchaseOrderBranchingEnabled).IsRequired().HasDefaultValue(true);
 
         // PostgreSQL xmin system column as the optimistic concurrency token (ETag).
         builder.Property(c => c.RowVersion).IsRowVersion();

Backend/ERPCore/Infra/Persistence/Configurations/VendorConfiguration.cs

@@ -18,6 +18,8 @@ public sealed class VendorConfiguration : IEntityTypeConfiguration<Vendor>
         builder.Property(v => v.Name).IsRequired().HasMaxLength(200);
         builder.Property(v => v.Terms).HasMaxLength(50);
         builder.Property(v => v.TaxReg).HasMaxLength(50);
+        builder.Property(v => v.Address).HasMaxLength(500);
+        builder.Property(v => v.Phone).HasMaxLength(30);
         builder.Property(v => v.Currency).IsRequired().HasMaxLength(3).HasDefaultValue("LKR");
 
         builder.Property(v => v.Status)

Backend/ERPCore/Infra/Persistence/ErpDbContext.cs

@@ -195,7 +195,12 @@ public class ErpDbContext : DbContext
         modelBuilder.Entity<Customer>().HasQueryFilter(e => !_currentBranch.IsActive || e.BranchId == _currentBranch.BranchId);
         modelBuilder.Entity<Requisition>().HasQueryFilter(e => !_currentBranch.IsActive || e.BranchId == _currentBranch.BranchId);
         modelBuilder.Entity<Rfq>().HasQueryFilter(e => !_currentBranch.IsActive || e.BranchId == _currentBranch.BranchId);
-        modelBuilder.Entity<PurchaseOrder>().HasQueryFilter(e => !_currentBranch.IsActive || e.BranchId == _currentBranch.BranchId);
+        // Purchase orders are only scoped while the "divide purchase orders by branch" toggle is
+        // on — off turns them into one shared pool every branch can see.
+        modelBuilder.Entity<PurchaseOrder>().HasQueryFilter(e => !_currentBranch.IsActive
+            || e.BranchId == _currentBranch.BranchId
+            || !Set<Domain.Entities.BranchConfig>().Any(c => c.ConfigId == Domain.Entities.BranchConfig.SingletonId
+                && c.BranchingEnabled && c.PurchaseOrderBranchingEnabled));
         modelBuilder.Entity<PurchaseInvoice>().HasQueryFilter(e => !_currentBranch.IsActive || e.BranchId == _currentBranch.BranchId);
 
         // Npgsql requires DateTime values written to `timestamp with time zone` columns

Backend/ERPCore/Migrations/20260929045821_AddUserMustChangePassword.cs

@@ -0,0 +1,36 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddUserMustChangePassword : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<bool>(
+                name: "MustChangePassword",
+                table: "users",
+                type: "boolean",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.UpdateData(
+                table: "users",
+                keyColumn: "UserId",
+                keyValue: 1,
+                column: "MustChangePassword",
+                value: false);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "MustChangePassword",
+                table: "users");
+        }
+    }
+}

Backend/ERPCore/Migrations/20260929060347_AddVendorAddressPhone.cs

@@ -0,0 +1,40 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddVendorAddressPhone : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "Address",
+                table: "vendors",
+                type: "character varying(500)",
+                maxLength: 500,
+                nullable: true);
+
+            migrationBuilder.AddColumn<string>(
+                name: "Phone",
+                table: "vendors",
+                type: "character varying(30)",
+                maxLength: 30,
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "Address",
+                table: "vendors");
+
+            migrationBuilder.DropColumn(
+                name: "Phone",
+                table: "vendors");
+        }
+    }
+}

Backend/ERPCore/Migrations/20260929062020_AddPurchaseOrderBranchingToggle.cs

@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ERPCore.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddPurchaseOrderBranchingToggle : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<bool>(
+                name: "PurchaseOrderBranchingEnabled",
+                table: "branch_config",
+                type: "boolean",
+                nullable: false,
+                defaultValue: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "PurchaseOrderBranchingEnabled",
+                table: "branch_config");
+        }
+    }
+}

Backend/ERPCore/Migrations/ErpDbContextModelSnapshot.cs

@@ -344,6 +344,11 @@ namespace ERPCore.Migrations
                         .HasColumnType("boolean")
                         .HasDefaultValue(true);
 
+                    b.Property<bool>("PurchaseOrderBranchingEnabled")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("boolean")
+                        .HasDefaultValue(true);
+
                     b.Property<uint>("RowVersion")
                         .IsConcurrencyToken()
                         .ValueGeneratedOnAddOrUpdate()
@@ -6394,6 +6399,9 @@ namespace ERPCore.Migrations
                         .HasMaxLength(320)
                         .HasColumnType("character varying(320)");
 
+                    b.Property<bool>("MustChangePassword")
+                        .HasColumnType("boolean");
+
                     b.Property<int?>("RoleId")
                         .HasColumnType("integer");
 
@@ -6427,6 +6435,7 @@ namespace ERPCore.Migrations
                         {
                             UserId = 1,
                             DisplayName = "System",
+                            MustChangePassword = false,
                             Status = "Active",
                             Username = "system"
                         });
@@ -6440,6 +6449,10 @@ namespace ERPCore.Migrations
 
                     NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("VendorId"));
 
+                    b.Property<string>("Address")
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)");
+
                     b.Property<int>("BranchId")
                         .HasColumnType("integer");
 
@@ -6463,6 +6476,10 @@ namespace ERPCore.Migrations
                         .HasMaxLength(200)
                         .HasColumnType("character varying(200)");
 
+                    b.Property<string>("Phone")
+                        .HasMaxLength(30)
+                        .HasColumnType("character varying(30)");
+
                     b.Property<uint>("RowVersion")
                         .IsConcurrencyToken()
                         .ValueGeneratedOnAddOrUpdate()

Backend/ERPCore/Services/Auth/AuthRecoveryService.cs

@@ -1,25 +1,54 @@
 using ERPCore.Dtos.Auth;
 using ERPCore.Infra.Auth.AuthHex;
 using ERPCore.Services.Interfaces;
+using Microsoft.Extensions.Caching.Memory;
 
 namespace ERPCore.Services.Auth;
 
 /// <inheritdoc cref="IAuthRecoveryService"/>
 public sealed class AuthRecoveryService : IAuthRecoveryService
 {
+    /// <summary>Longer than any AuthHex recovery OTP lives; only needs to outlast the flow.</summary>
+    private static readonly TimeSpan RecoveryIdentifierTtl = TimeSpan.FromMinutes(30);
+
     private readonly IAuthHexClient _authHex;
+    private readonly IUserManagementService _userManagement;
+    private readonly IMemoryCache _cache;
 
-    public AuthRecoveryService(IAuthHexClient authHex) => _authHex = authHex;
+    public AuthRecoveryService(IAuthHexClient authHex, IUserManagementService userManagement, IMemoryCache cache)
+    {
+        _authHex = authHex;
+        _userManagement = userManagement;
+        _cache = cache;
+    }
 
-    public Task<ForgotPasswordResponse> ForgotPasswordAsync(ForgotPasswordRequest request, CancellationToken ct = default)
-        => _authHex.ForgotPasswordAsync(request, ct);
+    public async Task<ForgotPasswordResponse> ForgotPasswordAsync(ForgotPasswordRequest request, CancellationToken ct = default)
+    {
+        var response = await _authHex.ForgotPasswordAsync(request, ct);
+        // The reset call only carries the reference number — remember who it was for, so a
+        // successful reset can also release a pending first-login forced password change.
+        if (!string.IsNullOrEmpty(response.ReferenceNumber))
+            _cache.Set(CacheKey(response.ReferenceNumber), request.Identifier.Trim(), RecoveryIdentifierTtl);
+        return response;
+    }
 
     public Task<VerifyRecoveryOtpResponse> VerifyOtpAsync(VerifyRecoveryOtpRequest request, CancellationToken ct = default)
         => _authHex.VerifyRecoveryOtpAsync(request, ct);
 
-    public Task ResetPasswordAsync(ResetPasswordRequest request, CancellationToken ct = default)
-        => _authHex.ResetPasswordAsync(request, ct);
+    public async Task ResetPasswordAsync(ResetPasswordRequest request, CancellationToken ct = default)
+    {
+        await _authHex.ResetPasswordAsync(request, ct);
+
+        var key = CacheKey(request.ReferenceNumber);
+        if (_cache.TryGetValue(key, out string? identifier) && !string.IsNullOrEmpty(identifier))
+        {
+            _cache.Remove(key);
+            await _userManagement.ClearMustChangePasswordByIdentifierAsync(identifier, ct);
+        }
+    }
 
     public Task ResetPasswordWithTokenAsync(ResetPasswordWithTokenRequest request, CancellationToken ct = default)
         => _authHex.ResetPasswordWithTokenAsync(request, ct);
+
+    private static string CacheKey(string referenceNumber) => $"auth-recovery:{referenceNumber}";
 }

Backend/ERPCore/Services/BranchConfigService.cs

@@ -54,6 +54,8 @@ public sealed class BranchConfigService : IBranchConfigService
 
         config.BranchingEnabled = request.BranchingEnabled!.Value;
         config.WarehouseBranchingEnabled = request.WarehouseBranchingEnabled!.Value;
+        if (request.PurchaseOrderBranchingEnabled is bool poBranching)
+            config.PurchaseOrderBranchingEnabled = poBranching;
         config.UpdatedAt = DateTime.UtcNow;
         config.UpdatedBy = _currentUser.AuditUserId;
 
@@ -110,6 +112,25 @@ public sealed class BranchConfigService : IBranchConfigService
         return await ResolveDefaultBranchIdAsync(ct);
     }
 
+    public async Task<bool> IsPurchaseOrderBranchingEnabledAsync(CancellationToken ct = default)
+    {
+        var config = await _config.Query().AsNoTracking()
+            .FirstOrDefaultAsync(c => c.ConfigId == BranchConfig.SingletonId, ct);
+        return (config?.BranchingEnabled ?? true) && (config?.PurchaseOrderBranchingEnabled ?? true);
+    }
+
+    public async Task<int> ResolvePurchaseOrderBranchIdAsync(int requestedBranchId, CancellationToken ct = default)
+    {
+        if (await IsPurchaseOrderBranchingEnabledAsync(ct))
+        {
+            if (requestedBranchId <= 0)
+                throw new DomainException(ErrorCodes.Validation, "Branch is required.", 422);
+            return requestedBranchId;
+        }
+
+        return await ResolveDefaultBranchIdAsync(ct);
+    }
+
     // Branching (or warehouse branching specifically) is off — ignore whatever was posted and
     // use the deployment's one default branch, creating it on first use (same placeholder
     // MakeEmployeeBranchRequired/AddWarehouseBranch backfill onto for pre-existing rows).
@@ -125,5 +146,6 @@ public sealed class BranchConfigService : IBranchConfigService
         return branch.BranchId;
     }
 
-    private static BranchConfigDto Map(BranchConfig c) => new(c.BranchingEnabled, c.WarehouseBranchingEnabled, c.UpdatedAt, c.UpdatedBy);
+    private static BranchConfigDto Map(BranchConfig c) => new(
+        c.BranchingEnabled, c.WarehouseBranchingEnabled, c.PurchaseOrderBranchingEnabled, c.UpdatedAt, c.UpdatedBy);
 }

Backend/ERPCore/Services/DashboardService.cs

@@ -84,6 +84,8 @@ public sealed class DashboardService : IDashboardService
         // not yet added) — these three stay global regardless of the selected branch.
         var pendingApprovalPOs = await _pos.Query().AsNoTracking()
             .CountAsync(p => p.Status == PurchaseOrderStatus.PendingApproval, ct);
+        var fullyReceivedPOs = await _pos.Query().AsNoTracking()
+            .CountAsync(p => p.Status == PurchaseOrderStatus.FullyReceived, ct);
         var openRequisitions = await _requisitions.Query().AsNoTracking()
             .CountAsync(r => r.Status == RequisitionStatus.Submitted, ct);
         var openRfqs = await _rfqs.Query().AsNoTracking().CountAsync(r => r.Status == RfqStatus.Open, ct);
@@ -105,7 +107,7 @@ public sealed class DashboardService : IDashboardService
 
         return new DashboardStatsDto(
             lowStockAlerts, onHandTotal, onHandWarehouses, stockValuationTotal, stockValuationByWarehouse,
-            pendingApprovalPOs, pendingGrns, openRequisitions, pendingCounts, openRfqs,
+            pendingApprovalPOs, fullyReceivedPOs, pendingGrns, openRequisitions, pendingCounts, openRfqs,
             pendingLeaveRequests, overdueSalesInvoices);
     }
 }

Backend/ERPCore/Services/Interfaces/IBranchConfigService.cs

@@ -29,6 +29,14 @@ public interface IBranchConfigService
     /// <see cref="IsWarehouseBranchingEnabledAsync"/> instead of the global flag.</summary>
     Task<int> ResolveWarehouseBranchIdAsync(int requestedBranchId, CancellationToken ct = default);
 
+    /// <summary>True when Purchase Orders are divided by branch. Never true when
+    /// <see cref="IsBranchingEnabledAsync"/> is false.</summary>
+    Task<bool> IsPurchaseOrderBranchingEnabledAsync(CancellationToken ct = default);
+
+    /// <summary>Same as <see cref="ResolveBranchIdAsync"/> but gated on
+    /// <see cref="IsPurchaseOrderBranchingEnabledAsync"/> — off puts every PO on the default branch.</summary>
+    Task<int> ResolvePurchaseOrderBranchIdAsync(int requestedBranchId, CancellationToken ct = default);
+
     /// <summary>The deployment's single default branch ("BR-000"/"Main Branch"), created on
     /// first use if it doesn't exist yet. Used as a fallback branch for document types that
     /// don't yet carry an explicit branch (docs/BRANCH_ISOLATION_PLAN.md).</summary>

Backend/ERPCore/Services/Interfaces/IUserManagementService.cs

@@ -27,6 +27,12 @@ public interface IUserManagementService
     /// </summary>
     Task<ManagedUserDto> SetStatusAsync(int userId, EntityStatus status, CancellationToken ct = default);
 
+    /// <summary>Clears the first-login forced password change once the user has set their own password.</summary>
+    Task ClearMustChangePasswordAsync(int userId, CancellationToken ct = default);
+
+    /// <summary>Same, for a forgot-password reset — resolves the user by email or username.</summary>
+    Task ClearMustChangePasswordByIdentifierAsync(string identifier, CancellationToken ct = default);
+
     /// <summary>AuthHex UserType options for the create-user form's select.</summary>
     Task<List<UserTypeOptionDto>> ListUserTypesAsync(CancellationToken ct = default);
 

Backend/ERPCore/Services/PurchaseOrderService.cs

@@ -88,7 +88,7 @@ public sealed class PurchaseOrderService : IPurchaseOrderService
     public async Task<ETagged<PurchaseOrderDto>> CreateAsync(CreatePurchaseOrderRequest request, CancellationToken ct = default)
     {
         await ValidateReferencesAsync(request.VendorId, request.RequisitionId, request.Lines, ct);
-        var branchId = await _branchConfig.ResolveBranchIdAsync(request.BranchId, ct);
+        var branchId = await _branchConfig.ResolvePurchaseOrderBranchIdAsync(request.BranchId, ct);
         await EnsureLinesInBranchAsync(branchId, request.Lines.Select(l => l.WarehouseId), ct);
         var actor = _currentUser.AuditUserId;
 
@@ -305,9 +305,16 @@ public sealed class PurchaseOrderService : IPurchaseOrderService
     }
 
     /// <summary>A PO is constrained to one branch (docs/BRANCH_ISOLATION_PLAN.md — Open
-    /// Question #1, decided as (a)): every line's warehouse must belong to the PO's branch.</summary>
+    /// Question #1, decided as (a)): every line's warehouse must belong to the PO's branch.
+    /// Skipped unless both purchase orders AND warehouses are divided by branch: with PO
+    /// branching off the PO sits on the default branch, and with warehouse branching off every
+    /// warehouse is parked on the default branch too (shared by all branches) — either way a
+    /// branch match is meaningless and would reject every line.</summary>
     private async Task EnsureLinesInBranchAsync(int branchId, IEnumerable<int> warehouseIds, CancellationToken ct)
     {
+        if (!await _branchConfig.IsPurchaseOrderBranchingEnabledAsync(ct)) return;
+        if (!await _branchConfig.IsWarehouseBranchingEnabledAsync(ct)) return;
+
         var ids = warehouseIds.Distinct().ToList();
         var mismatched = await _warehouses.Query().AsNoTracking()
             .Where(w => ids.Contains(w.WarehouseId) && w.BranchId != branchId)

Backend/ERPCore/Services/RoleService.cs

@@ -22,6 +22,7 @@ public sealed class RoleService : IRoleService
     private readonly IRepository<RolePermission> _rolePermissions;
     private readonly IRepository<Permission> _permissions;
     private readonly IRepository<Employee> _employees;
+    private readonly IRepository<User> _users;
     private readonly ICurrentUser _currentUser;
     private readonly IAuthHexClient _authHex;
     private readonly IBranchConfigService _branchConfig;
@@ -29,12 +30,13 @@ public sealed class RoleService : IRoleService
 
     public RoleService(
         IRepository<Role> roles, IRepository<RolePermission> rolePermissions, IRepository<Permission> permissions,
-        IRepository<Employee> employees, ICurrentUser currentUser, IAuthHexClient authHex, IBranchConfigService branchConfig, IUnitOfWork uow)
+        IRepository<Employee> employees, IRepository<User> users, ICurrentUser currentUser, IAuthHexClient authHex, IBranchConfigService branchConfig, IUnitOfWork uow)
     {
         _roles = roles;
         _rolePermissions = rolePermissions;
         _permissions = permissions;
         _employees = employees;
+        _users = users;
         _currentUser = currentUser;
         _authHex = authHex;
         _branchConfig = branchConfig;
@@ -202,6 +204,22 @@ public sealed class RoleService : IRoleService
     }
 
     public async Task<MeResponseDto> GetMeAsync(string? roleCode, CancellationToken ct = default)
+    {
+        var me = await BuildMeAsync(roleCode, ct) with
+        {
+            PurchaseOrderBranchingEnabled = await _branchConfig.IsPurchaseOrderBranchingEnabledAsync(ct)
+        };
+        if (!_currentUser.IsAuthenticated) return me;
+
+        var mustChangePassword = await _users.Query().AsNoTracking()
+            .Where(u => u.UserId == _currentUser.AuditUserId)
+            .Select(u => u.MustChangePassword)
+            .FirstOrDefaultAsync(ct);
+        // Local user id lets the frontend spot records the caller created (e.g. self-approval of a PO).
+        return me with { MustChangePassword = mustChangePassword, UserId = _currentUser.AuditUserId };
+    }
+
+    private async Task<MeResponseDto> BuildMeAsync(string? roleCode, CancellationToken ct)
     {
         // The caller's branch, via their optional Employee link — independent of role,
         // since even an Admin's own "home" branch may be worth surfacing later. Null

Backend/ERPCore/Services/UserManagementService.cs

@@ -124,7 +124,9 @@ public sealed class UserManagementService : IUserManagementService
             DisplayName = request.FullName.Trim(),
             Email = request.Email.Trim(),
             RoleId = role.RoleId,
-            Status = EntityStatus.Active
+            Status = EntityStatus.Active,
+            // The admin chose (or AuthHex generated) this password — the owner must replace it on first login.
+            MustChangePassword = true
         };
 
         await _users.AddAsync(user, ct);
@@ -183,6 +185,27 @@ public sealed class UserManagementService : IUserManagementService
         return Map(user);
     }
 
+    public async Task ClearMustChangePasswordAsync(int userId, CancellationToken ct = default)
+    {
+        var user = await _users.GetByIdAsync(userId, ct);
+        if (user is null || !user.MustChangePassword) return;
+
+        user.MustChangePassword = false;
+        await _uow.SaveChangesAsync(ct);
+    }
+
+    public async Task ClearMustChangePasswordByIdentifierAsync(string identifier, CancellationToken ct = default)
+    {
+        var term = identifier.Trim();
+        var user = await _users.Query()
+            .FirstOrDefaultAsync(u => u.MustChangePassword
+                && ((u.Email != null && EF.Functions.ILike(u.Email, term)) || u.Username == term), ct);
+        if (user is null) return;
+
+        user.MustChangePassword = false;
+        await _uow.SaveChangesAsync(ct);
+    }
+
     public async Task<List<UserTypeOptionDto>> ListUserTypesAsync(CancellationToken ct = default)
     {
         var userTypes = await _authHex.ListUserTypesAsync(ct);

Backend/ERPCore/Services/VendorService.cs

@@ -62,6 +62,8 @@ public sealed class VendorService : IVendorService
             Name = request.Name.Trim(),
             Terms = request.Terms,
             TaxReg = request.TaxReg,
+            Address = Normalize(request.Address),
+            Phone = Normalize(request.Phone),
             Currency = request.Currency.Trim().ToUpperInvariant(),
             Status = EntityStatus.Active,
             BranchId = branchId,
@@ -94,6 +96,8 @@ public sealed class VendorService : IVendorService
         vendor.Name = request.Name.Trim();
         vendor.Terms = request.Terms;
         vendor.TaxReg = request.TaxReg;
+        vendor.Address = Normalize(request.Address);
+        vendor.Phone = Normalize(request.Phone);
         vendor.Currency = request.Currency.Trim().ToUpperInvariant();
         vendor.BranchId = branchId;
         vendor.UpdatedAt = DateTime.UtcNow;
@@ -120,6 +124,8 @@ public sealed class VendorService : IVendorService
         await _uow.SaveChangesAsync(ct);
     }
 
+    private static string? Normalize(string? value) => string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+
     private static VendorDto Map(Vendor v) => new(
-        v.VendorId, v.Code, v.Name, v.Terms, v.TaxReg, v.Currency, v.Status, v.BranchId, v.CreatedAt, v.UpdatedAt);
+        v.VendorId, v.Code, v.Name, v.Terms, v.TaxReg, v.Address, v.Phone, v.Currency, v.Status, v.BranchId, v.CreatedAt, v.UpdatedAt);
 }