ui and bug fixers 29/09

Reviewed-on: #88

.gitea/workflows/ci-cd.yml

@@ -0,0 +1,92 @@
+name: CI/CD - ERP Core Monorepo
+
+on:
+  pull_request:
+    branches:
+      - production
+    types:
+      - closed
+
+jobs:
+  build-and-deploy-backend:
+    name: Build & Deploy Backend
+    runs-on: linux
+    if: github.event.pull_request.merged == true
+    steps:
+      - name: Checkout code
+        run: |
+          git clone \
+            --depth 1 \
+            --branch production \
+            https://oauth2:${{ secrets.ERPCORE }}@gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git \
+            .
+      - name: Restore
+        run: dotnet restore Backend/ERPCore.sln
+      - name: Publish
+        run: |
+          rm -rf /tmp/erpcore-deploy
+          mkdir -p /tmp/erpcore-deploy
+          dotnet publish Backend/ERPCore/ERPCore.csproj \
+            -c Release \
+            -r linux-x64 \
+            --self-contained true \
+            -o /tmp/erpcore-deploy
+      - name: Stop service
+        run: systemctl stop erpcore.service
+      - name: Copy to deploy folder
+        run: |
+          mkdir -p /home/erp/core/publish
+          rm -rf /home/erp/core/publish/*
+          cp -r /tmp/erpcore-deploy/* /home/erp/core/publish/
+      - name: Fix ownership and permissions
+        run: |
+          chown -R erpuser:erpuser /home/erp/core/publish
+          find /home/erp/core/publish -type d -exec chmod 755 {} +
+          find /home/erp/core/publish -type f -exec chmod 644 {} +
+          chmod +x /home/erp/core/publish/ERPCore
+      - name: Restart service
+        run: systemctl restart erpcore.service
+      - name: Verify
+        run: |
+          systemctl is-active erpcore.service && echo "✅ Service running" || echo "❌ Service failed"
+
+  build-and-deploy-frontend:
+    name: Build & Deploy Frontend
+    runs-on: linux
+    if: github.event.pull_request.merged == true
+    steps:
+      - name: Checkout code
+        run: |
+          git clone \
+            --depth 1 \
+            --branch production \
+            https://oauth2:${{ secrets.ERPCORE }}@gitea.hexdive.com/New_REP_SYSTEM/ERP-core.git \
+            .
+      - name: Build Docker image
+        run: |
+          docker build --progress=plain --no-cache \
+            -t erpcore-frontend:latest \
+            ./Frontend/erp-system
+      - name: Stop & remove existing container
+        run: |
+          docker stop erpcore-frontend 2>/dev/null || true
+          docker rm erpcore-frontend 2>/dev/null || true
+      - name: Start container
+        run: |
+          docker run -d \
+            --name erpcore-frontend \
+            -p 6702:6702 \
+            --add-host=host.docker.internal:host-gateway \
+            -e BACKEND_ORIGIN=http://host.docker.internal:6701 \
+            --restart unless-stopped \
+            --memory="512m" \
+            --cpus="1.0" \
+            --cap-drop ALL \
+            --security-opt no-new-privileges \
+            erpcore-frontend:latest
+      - name: Remove old images
+        run: docker image prune -f
+      - name: Verify
+        run: |
+          docker ps --filter name=erpcore-frontend --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}" \
+            | grep erpcore-frontend && echo "✅ Container running" || echo "❌ Container failed"

Backend/ERPCore.Tests/ERPCore.Tests.csproj

@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.9" />
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\ERPCore\ERPCore.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+</Project>

Backend/ERPCore.Tests/NotificationConfigServiceTests.cs

@@ -0,0 +1,152 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Notifications;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+
+namespace ERPCore.Tests;
+
+public class NotificationConfigServiceTests
+{
+    [Fact]
+    public async Task GetAsync_MergesSavedValuesWithDiscoveredModules()
+    {
+        var dbName = Guid.NewGuid().ToString("N");
+        await using var db = NotificationConfigTestSupport.CreateContext(dbName);
+        await NotificationConfigTestSupport.SeedAsync(db, new[]
+        {
+            new NotificationConfigModule
+            {
+                ModuleKey = "sale.create",
+                EmailEnabled = true,
+                SmsEnabled = false,
+                InAppEnabled = true
+            }
+        });
+
+        var service = CreateService(db);
+
+        var result = await service.GetAsync();
+
+        Assert.Equal(7u, result.RowVersion);
+        Assert.Contains(result.Value.Modules, m => m.ModuleKey == "sale.create" && m.EmailEnabled && !m.SmsEnabled && m.InAppEnabled);
+        Assert.Contains(result.Value.Modules, m => m.ModuleKey == "grn.confirmed" && !m.EmailEnabled && !m.SmsEnabled && !m.InAppEnabled);
+    }
+
+    [Fact]
+    public async Task UpdateAsync_PersistsEmptyAndMultiChannelSelections()
+    {
+        var dbName = Guid.NewGuid().ToString("N");
+        await using var db = NotificationConfigTestSupport.CreateContext(dbName);
+        await NotificationConfigTestSupport.SeedAsync(db);
+
+        var service = CreateService(db);
+        var catalog = new NotificationModuleCatalog();
+        var request = new ERPCore.Dtos.Notifications.UpdateNotificationConfigRequest
+        {
+            Modules = catalog.GetAll().Select((module, index) => new ERPCore.Dtos.Notifications.UpdateNotificationModuleRequest
+            {
+                ModuleKey = module.Key,
+                EmailEnabled = index == 0,
+                SmsEnabled = index == 1,
+                InAppEnabled = index == 1
+            }).ToList()
+        };
+
+        var updated = await service.UpdateAsync(request, 7);
+
+        Assert.Equal(7u, updated.RowVersion);
+        Assert.Contains(updated.Value.Modules, m => m.ModuleKey == catalog.GetAll()[0].Key && m.EmailEnabled && !m.SmsEnabled && !m.InAppEnabled);
+        Assert.Contains(updated.Value.Modules, m => m.ModuleKey == catalog.GetAll()[1].Key && !m.EmailEnabled && m.SmsEnabled && m.InAppEnabled);
+
+        await using var verifyDb = NotificationConfigTestSupport.CreateContext(dbName);
+        var persisted = await verifyDb.NotificationConfigModules.AsNoTracking().ToListAsync();
+        Assert.Contains(persisted, m => m.ModuleKey == catalog.GetAll()[0].Key && m.EmailEnabled && !m.SmsEnabled && !m.InAppEnabled);
+        Assert.Contains(persisted, m => m.ModuleKey == catalog.GetAll()[1].Key && !m.EmailEnabled && m.SmsEnabled && m.InAppEnabled);
+    }
+
+    [Fact]
+    public async Task ResolveEnabledChannelsAsync_ReturnsEmptyWhenNothingEnabled()
+    {
+        var dbName = Guid.NewGuid().ToString("N");
+        await using var db = NotificationConfigTestSupport.CreateContext(dbName);
+        await NotificationConfigTestSupport.SeedAsync(db, new[]
+        {
+            new NotificationConfigModule
+            {
+                ModuleKey = "sale.create",
+                EmailEnabled = false,
+                SmsEnabled = false,
+                InAppEnabled = false
+            }
+        });
+
+        var service = CreateService(db);
+
+        var channels = await service.ResolveEnabledChannelsAsync("sale.create");
+
+        Assert.Empty(channels);
+    }
+
+    [Fact]
+    public async Task ResolveEnabledChannelsAsync_ReturnsMultipleChannels()
+    {
+        var dbName = Guid.NewGuid().ToString("N");
+        await using var db = NotificationConfigTestSupport.CreateContext(dbName);
+        await NotificationConfigTestSupport.SeedAsync(db, new[]
+        {
+            new NotificationConfigModule
+            {
+                ModuleKey = "sale.create",
+                EmailEnabled = true,
+                SmsEnabled = true,
+                InAppEnabled = false
+            }
+        });
+
+        var service = CreateService(db);
+
+        var channels = await service.ResolveEnabledChannelsAsync("sale.create");
+
+        Assert.Equal(new[] { NotificationChannel.Email, NotificationChannel.Sms }, channels);
+    }
+
+    [Fact]
+    public async Task UpdateAsync_MapsConcurrencyFailuresToDomainException()
+    {
+        var dbName = Guid.NewGuid().ToString("N");
+        await using var db = NotificationConfigTestSupport.CreateContext(dbName);
+        await NotificationConfigTestSupport.SeedAsync(db);
+
+        var service = CreateService(db, new ThrowingUnitOfWork());
+        var catalog = new NotificationModuleCatalog();
+        var request = new ERPCore.Dtos.Notifications.UpdateNotificationConfigRequest
+        {
+            Modules = catalog.GetAll().Select(module => new ERPCore.Dtos.Notifications.UpdateNotificationModuleRequest
+            {
+                ModuleKey = module.Key,
+                EmailEnabled = false,
+                SmsEnabled = false,
+                InAppEnabled = false
+            }).ToList()
+        };
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(request, 7));
+        Assert.Equal(ErrorCodes.ConcurrencyConflict, ex.Code);
+        Assert.Equal(412, ex.StatusCode);
+    }
+
+    private static NotificationConfigService CreateService(ERPCore.Infra.Persistence.ErpDbContext db, ERPCore.Infra.UoW.IUnitOfWork? uow = null)
+    {
+        var configRepo = new Repository<NotificationConfig>(db);
+        var moduleRepo = new Repository<NotificationConfigModule>(db);
+        return new NotificationConfigService(
+            configRepo,
+            moduleRepo,
+            new NotificationModuleCatalog(),
+            new TestCurrentUser(),
+            uow ?? new ERPCore.Infra.UoW.UnitOfWork(db));
+    }
+}

Backend/ERPCore.Tests/NotificationModuleCatalogTests.cs

@@ -0,0 +1,17 @@
+using ERPCore.Services;
+
+namespace ERPCore.Tests;
+
+public class NotificationModuleCatalogTests
+{
+    [Fact]
+    public void GetAll_ReturnsStableUniqueModuleKeys()
+    {
+        var catalog = new NotificationModuleCatalog();
+
+        Assert.NotEmpty(catalog.GetAll());
+        Assert.Contains(catalog.GetAll(), m => m.Key == "sale.create");
+        Assert.Contains(catalog.GetAll(), m => m.Key == "grn.confirmed");
+        Assert.Equal(catalog.GetAll().Count, catalog.GetAll().Select(m => m.Key).Distinct(StringComparer.OrdinalIgnoreCase).Count());
+    }
+}

Backend/ERPCore.Tests/TestSupport/NotificationConfigTestSupport.cs

@@ -0,0 +1,70 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+
+namespace ERPCore.Tests.TestSupport;
+
+internal sealed class TestCurrentUser : ICurrentUser
+{
+    public string UserId => "system";
+    public int AuditUserId => User.SystemUserId;
+    public bool IsAuthenticated => false;
+}
+
+internal sealed class ThrowingUnitOfWork : ERPCore.Infra.UoW.IUnitOfWork
+{
+    public Task<int> SaveChangesAsync(CancellationToken ct = default)
+        => throw new DbUpdateConcurrencyException("Test concurrency conflict.");
+
+    public Task ExecuteInTransactionAsync(Func<CancellationToken, Task> action, CancellationToken ct = default)
+        => throw new NotSupportedException();
+
+    public Task<T> ExecuteInTransactionAsync<T>(Func<CancellationToken, Task<T>> action, CancellationToken ct = default)
+        => throw new NotSupportedException();
+}
+
+internal static class NotificationConfigTestSupport
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    public static ErpDbContext CreateContext(string name)
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(name, Root)
+            .Options;
+
+        return new ErpDbContext(options, new TestCurrentUser());
+    }
+
+    public static async Task SeedAsync(ErpDbContext db, IEnumerable<NotificationConfigModule>? modules = null)
+    {
+        db.Users.Add(new User
+        {
+            UserId = User.SystemUserId,
+            Username = "system",
+            DisplayName = "System"
+        });
+
+        var config = new NotificationConfig
+        {
+            NotificationConfigId = NotificationConfig.SingletonId,
+            UpdatedBy = User.SystemUserId,
+            UpdatedAt = DateTime.UtcNow,
+            RowVersion = 7,
+        };
+
+        if (modules is not null)
+        {
+            foreach (var module in modules)
+            {
+                module.NotificationConfigId = NotificationConfig.SingletonId;
+                config.Modules.Add(module);
+            }
+        }
+
+        db.NotificationConfig.Add(config);
+        await db.SaveChangesAsync();
+    }
+}

Backend/ERPCore/Controllers/AuthController.cs

@@ -27,13 +27,21 @@ public sealed class AuthController : ControllerBase
     private readonly IAuthRecoveryService _recovery;
     private readonly IAuthAltService _alt;
     private readonly IRoleService _roles;
+    private readonly IAuditService _audit;
+    private readonly IUserManagementService _userManagement;
+    private readonly ICurrentUser _currentUser;
 
-    public AuthController(IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles)
+    public AuthController(
+        IAuthUserService users, IAuthRecoveryService recovery, IAuthAltService alt, IRoleService roles, IAuditService audit,
+        IUserManagementService userManagement, ICurrentUser currentUser)
     {
         _users = users;
         _recovery = recovery;
         _alt = alt;
         _roles = roles;
+        _audit = audit;
+        _userManagement = userManagement;
+        _currentUser = currentUser;
     }
 
     /// <summary>
@@ -68,6 +76,7 @@ public sealed class AuthController : ControllerBase
     {
         var result = await _users.LoginAsync(request, ct);
         AuthCookieWriter.WriteSession(Response, result.AccessToken, result.RefreshToken, result.Body.ExpiresIn);
+        if (result.Body.User?.UserId is Guid authUserId) await _audit.RecordLoginAsync(authUserId, ClientIp(), ClientUserAgent(), ct);
         return Ok(result.Body);
     }
 
@@ -78,9 +87,13 @@ public sealed class AuthController : ControllerBase
     {
         var result = await _users.VerifyOtpForLoginAsync(request, ct);
         AuthCookieWriter.WriteSession(Response, result.AccessToken, result.RefreshToken, result.Body.ExpiresIn);
+        if (result.Body.User?.UserId is Guid authUserId) await _audit.RecordLoginAsync(authUserId, ClientIp(), ClientUserAgent(), ct);
         return Ok(result.Body);
     }
 
+    private string? ClientIp() => HttpContext.Connection.RemoteIpAddress?.ToString();
+    private string? ClientUserAgent() => Request.Headers.UserAgent.ToString() is { Length: > 0 } ua ? ua : null;
+
     [HttpPost("refresh-token")]
     [AllowAnonymous]
     [ProducesResponseType(typeof(AuthSessionResponse), StatusCodes.Status200OK)]
@@ -132,6 +145,8 @@ public sealed class AuthController : ControllerBase
     public async Task<IActionResult> ChangePassword([FromBody] ChangeUserPasswordRequest request, CancellationToken ct)
     {
         await _users.ChangeUserPasswordAsync(request, RequireBearerToken(), ct);
+        // AuthHex accepted the new password — release the first-login forced change.
+        await _userManagement.ClearMustChangePasswordAsync(_currentUser.AuditUserId, ct);
         AuthCookieWriter.ClearSession(Response);
         return NoContent();
     }

Backend/ERPCore/Controllers/BranchConfigController.cs

@@ -0,0 +1,47 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
+using ERPCore.Dtos.Config;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Branch configuration endpoints — the singleton toggle for whether this deployment
+/// requires a branch on Employee/Warehouse records at all.
+/// <para>
+/// <b>Authorization:</b> writes are admitted by the inherited ERP door policy only, same
+/// Phase-1 posture as <see cref="ProductConfigController"/> — any ERP-admitted user can
+/// flip this flag until per-endpoint RBAC lands.
+/// </para>
+/// </summary>
+[Route("api/v1/branch-config")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
+public sealed class BranchConfigController : ApiControllerBase
+{
+    private readonly IBranchConfigService _config;
+
+    public BranchConfigController(IBranchConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(BranchConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<BranchConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut]
+    [ProducesResponseType(typeof(BranchConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<BranchConfigDto>> Update(
+        [FromBody] UpdateBranchConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}

Backend/ERPCore/Controllers/BrandsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Brands;
 using ERPCore.Dtos.Common;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Brand master endpoints (docs/11-BACKEND-PHASE1.md §2.6).</summary>
 [Route("api/v1/brands")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class BrandsController : ApiControllerBase
 {
     private readonly IBrandService _brands;

Backend/ERPCore/Controllers/BundleSalesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -7,6 +9,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/bundle-sales")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class BundleSalesController : ApiControllerBase
 {
     private readonly IBundleSaleService _bundles;
@@ -29,6 +32,14 @@ public sealed class BundleSalesController : ApiControllerBase
         return result is null ? NotFound() : Ok(result);
     }
 
+    [HttpPost("templates")]
+    [ProducesResponseType(typeof(BundleSaleTemplateDto), StatusCodes.Status201Created)]
+    public async Task<ActionResult<BundleSaleTemplateDto>> CreateTemplate([FromBody] CreateBundleSaleTemplateRequest request, CancellationToken ct)
+    {
+        var result = await _bundles.CreateTemplateAsync(request, ct);
+        return Created($"/api/v1/bundle-sales/templates/{result.BundleSaleTemplateId}", result);
+    }
+
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<BundleSaleSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<BundleSaleSummaryDto>>> List(

Backend/ERPCore/Controllers/CategoriesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Categories;
 using ERPCore.Dtos.Common;
@@ -12,6 +14,7 @@ namespace ERPCore.Controllers;
 /// <c>?tree=true</c> parameter is gone along with the self-nesting model.
 /// </summary>
 [Route("api/v1/categories")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class CategoriesController : ApiControllerBase
 {
     private readonly ICategoryService _categories;

Backend/ERPCore/Controllers/CustomersController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Customers;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Customer master endpoints for Phase 1 sales.</summary>
 [Route("api/v1/customers")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class CustomersController : ApiControllerBase
 {
     private readonly ICustomerService _customers;

Backend/ERPCore/Controllers/DashboardController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Dashboard;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -6,6 +8,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Dashboard overview stats — cross-domain counts, not a stored entity.</summary>
 [Route("api/v1/dashboard")]
+[Authorize(Policy = NavPolicies.Prefix + "dashboard")]
 public sealed class DashboardController : ApiControllerBase
 {
     private readonly IDashboardService _dashboard;
@@ -15,6 +18,6 @@ public sealed class DashboardController : ApiControllerBase
     /// <summary>Aggregate counts for stock, GRN, and procurement.</summary>
     [HttpGet("stats")]
     [ProducesResponseType(typeof(DashboardStatsDto), StatusCodes.Status200OK)]
-    public async Task<ActionResult<DashboardStatsDto>> GetStats(CancellationToken ct)
-        => Ok(await _dashboard.GetStatsAsync(ct));
+    public async Task<ActionResult<DashboardStatsDto>> GetStats([FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _dashboard.GetStatsAsync(branchId, ct));
 }

Backend/ERPCore/Controllers/FreeIssuesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -12,6 +14,7 @@ namespace ERPCore.Controllers;
 /// the existing sales-slip CRUD surface under a more business-friendly route.
 /// </summary>
 [Route("api/v1/free-issues")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class FreeIssuesController : ApiControllerBase
 {
     private readonly ISalesSlipService _slips;

Backend/ERPCore/Controllers/GeneralLedgerController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
 
@@ -14,6 +16,7 @@ namespace ERPCore.Controllers;
 /// only and is never exposed to the frontend.
 /// </summary>
 [Route("api/v1/gl")]
+[Authorize(Policy = NavPolicies.Prefix + "ledgers")]
 public sealed class GeneralLedgerController : ApiControllerBase
 {
     private readonly IGeneralLedgerService _gl;

Backend/ERPCore/Controllers/GrnsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Grn;
@@ -8,19 +10,23 @@ namespace ERPCore.Controllers;
 
 /// <summary>Goods-receipt endpoints (docs/11 §4).</summary>
 [Route("api/v1/grns")]
+[Authorize(Policy = NavPolicies.Prefix + "receiving")]
 public sealed class GrnsController : ApiControllerBase
 {
     private readonly IGrnService _grns;
 
-    public GrnsController(IGrnService grns) => _grns = grns;
+    public GrnsController(IGrnService grns)
+    {
+        _grns = grns;
+    }
 
     /// <summary>List GRNs, newest first.</summary>
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<GrnSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<GrnSummaryDto>>> List(
         [FromQuery] PageQuery query, [FromQuery] GrnStatus? status, [FromQuery] int? poId,
-        [FromQuery] int? vendorId, [FromQuery] int? warehouseId, CancellationToken ct)
-        => Ok(await _grns.ListAsync(query, status, poId, vendorId, warehouseId, ct));
+        [FromQuery] int? vendorId, [FromQuery] int? warehouseId, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _grns.ListAsync(query, status, poId, vendorId, warehouseId, branchId, ct));
 
     [HttpGet("{grnId:int}")]
     [ProducesResponseType(typeof(GrnDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/Hrm/BranchesController.cs

@@ -61,4 +61,14 @@ public sealed class BranchesController : ApiControllerBase
         await _branches.SetStatusAsync(branchId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{branchId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int branchId, CancellationToken ct)
+    {
+        await _branches.DeleteAsync(branchId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/DepartmentsController.cs

@@ -62,4 +62,14 @@ public sealed class DepartmentsController : ApiControllerBase
         await _departments.SetStatusAsync(departmentId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{departmentId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int departmentId, CancellationToken ct)
+    {
+        await _departments.DeleteAsync(departmentId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/DesignationsController.cs

@@ -61,4 +61,14 @@ public sealed class DesignationsController : ApiControllerBase
         await _designations.SetStatusAsync(designationId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{designationId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int designationId, CancellationToken ct)
+    {
+        await _designations.DeleteAsync(designationId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/EmployeesController.cs

@@ -83,7 +83,6 @@ public sealed class EmployeesController : ApiControllerBase
         return Ok(result.Value);
     }
 
-    /// <summary>Never a hard delete — Employee is retained forever (docs/12-BACKEND-HRM.md C.2).</summary>
     [HttpPatch("{employeeId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -93,6 +92,17 @@ public sealed class EmployeesController : ApiControllerBase
         return NoContent();
     }
 
+    /// <summary>Permanently deletes the employee and all dependent HR records. Blocked (409) if payroll history exists.</summary>
+    [HttpDelete("{employeeId:int}")]
+    [ProducesResponseType(typeof(EmployeeDeleteResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<EmployeeDeleteResultDto>> Delete(int employeeId, [FromQuery] bool deleteUserAccount, CancellationToken ct)
+    {
+        var result = await _employees.DeleteAsync(employeeId, deleteUserAccount, ct);
+        return Ok(result);
+    }
+
     [HttpPost("{employeeId:int}/link-user")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/EmploymentTypesController.cs

@@ -61,4 +61,14 @@ public sealed class EmploymentTypesController : ApiControllerBase
         await _employmentTypes.SetStatusAsync(employmentTypeId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{employmentTypeId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int employmentTypeId, CancellationToken ct)
+    {
+        await _employmentTypes.DeleteAsync(employmentTypeId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/HrDocumentTypesController.cs

@@ -61,4 +61,14 @@ public sealed class HrDocumentTypesController : ApiControllerBase
         await _types.SetStatusAsync(hrDocumentTypeId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{hrDocumentTypeId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int hrDocumentTypeId, CancellationToken ct)
+    {
+        await _types.DeleteAsync(hrDocumentTypeId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/LeaveTypesController.cs

@@ -61,4 +61,14 @@ public sealed class LeaveTypesController : ApiControllerBase
         await _leaveTypes.SetStatusAsync(leaveTypeId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{leaveTypeId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int leaveTypeId, CancellationToken ct)
+    {
+        await _leaveTypes.DeleteAsync(leaveTypeId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/SalaryComponentsController.cs

@@ -61,4 +61,14 @@ public sealed class SalaryComponentsController : ApiControllerBase
         await _components.SetStatusAsync(salaryComponentId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{salaryComponentId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int salaryComponentId, CancellationToken ct)
+    {
+        await _components.DeleteAsync(salaryComponentId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/Hrm/WorkShiftsController.cs

@@ -61,4 +61,14 @@ public sealed class WorkShiftsController : ApiControllerBase
         await _shifts.SetStatusAsync(workShiftId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{workShiftId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int workShiftId, CancellationToken ct)
+    {
+        await _shifts.DeleteAsync(workShiftId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/ItemTypesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.ItemTypes;
@@ -13,6 +15,7 @@ namespace ERPCore.Controllers;
 /// into the client-generated SKU (docs/10 Part C.9).
 /// </summary>
 [Route("api/v1/item-types")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class ItemTypesController : ApiControllerBase
 {
     private readonly IItemTypeService _itemTypes;

Backend/ERPCore/Controllers/ItemsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Items;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Item master endpoints (docs/11-BACKEND-PHASE1.md §2.1–2.2).</summary>
 [Route("api/v1/items")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class ItemsController : ApiControllerBase
 {
     private readonly IItemService _items;
@@ -27,6 +30,30 @@ public sealed class ItemsController : ApiControllerBase
         CancellationToken ct)
         => Ok(await _items.ListAsync(query, status, categoryId, subCategoryId, brandId, trackingMode, ct));
 
+    /// <summary>Items list enriched with stock value, low-stock, last-purchase and
+    /// trailing-30-day sales aggregates, for the Items overview table.</summary>
+    [HttpGet("overview")]
+    [ProducesResponseType(typeof(PagedResponse<ItemOverviewDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<ItemOverviewDto>>> Overview(
+        [FromQuery] PageQuery query,
+        [FromQuery] EntityStatus? status,
+        [FromQuery] int? categoryId,
+        [FromQuery] int? subCategoryId,
+        [FromQuery] int? brandId,
+        CancellationToken ct)
+        => Ok(await _items.GetOverviewAsync(query, status, categoryId, subCategoryId, brandId, ct));
+
+    /// <summary>Barcode/RFID lookup — matches an item's barcode/SKU, or a batch/serial
+    /// barcode/no (optionally scoped to <paramref name="itemId"/> first).</summary>
+    [HttpGet("scan")]
+    [ProducesResponseType(typeof(ItemScanResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ItemScanResultDto>> Scan([FromQuery] string code, [FromQuery] int? itemId, CancellationToken ct)
+    {
+        var result = await _items.ScanAsync(code, itemId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
     /// <summary>Get a single item; returns an <c>ETag</c> for optimistic concurrency.</summary>
     [HttpGet("{itemId:int}")]
     [ProducesResponseType(typeof(ItemDetailDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/JournalEntriesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Audit;
 using ERPCore.Dtos.Common;
 using ERPCore.Services.Interfaces;
@@ -10,6 +12,7 @@ namespace ERPCore.Controllers;
 /// Data only — no posting in Phase 1.
 /// </summary>
 [Route("api/v1/journal-entries")]
+[Authorize(Policy = NavPolicies.Prefix + "ledgers")]
 public sealed class JournalEntriesController : ApiControllerBase
 {
     private readonly IAuditService _audit;

Backend/ERPCore/Controllers/NotificationConfigController.cs

@@ -0,0 +1,37 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
+using ERPCore.Dtos.Notifications;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/notification-config")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
+public sealed class NotificationConfigController : ApiControllerBase
+{
+    private readonly INotificationConfigService _config;
+
+    public NotificationConfigController(INotificationConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(NotificationConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<NotificationConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut]
+    [ProducesResponseType(typeof(NotificationConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<NotificationConfigDto>> Update([FromBody] UpdateNotificationConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}

Backend/ERPCore/Controllers/NotificationsController.cs

@@ -0,0 +1,32 @@
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/notifications")]
+public sealed class NotificationsController : ApiControllerBase
+{
+    private readonly INotificationService _notifications;
+    private readonly ICurrentUser _currentUser;
+
+    public NotificationsController(INotificationService notifications, ICurrentUser currentUser)
+    {
+        _notifications = notifications;
+        _currentUser = currentUser;
+    }
+
+    [HttpGet]
+    public async Task<ActionResult> Get([FromQuery] int take = 20, CancellationToken ct = default)
+    {
+        var feed = await _notifications.GetFeedAsync(_currentUser.AuditUserId, take, ct);
+        return Ok(feed);
+    }
+
+    [HttpPost("mark-all-read")]
+    public async Task<ActionResult> MarkAllRead(CancellationToken ct)
+    {
+        await _notifications.MarkAllReadAsync(_currentUser.AuditUserId, ct);
+        return NoContent();
+    }
+}

Backend/ERPCore/Controllers/ProductConfigController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Config;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -16,6 +18,7 @@ namespace ERPCore.Controllers;
 /// </para>
 /// </summary>
 [Route("api/v1/product-config")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class ProductConfigController : ApiControllerBase
 {
     private readonly IProductConfigService _config;

Backend/ERPCore/Controllers/ProductionRunsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Production;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Production run endpoints (docs/30-BACKEND-PHASE2.md §D.2–D.3).</summary>
 [Route("api/v1/production-runs")]
+[Authorize(Policy = NavPolicies.Prefix + "production")]
 public sealed class ProductionRunsController : ApiControllerBase
 {
     private readonly IProductionRunService _runs;
@@ -24,6 +27,19 @@ public sealed class ProductionRunsController : ApiControllerBase
         CancellationToken ct)
         => Ok(await _runs.ListAsync(query, status, templateId, warehouseId, ct));
 
+    /// <summary>Produced-items report (FR-MFG-13): one row per run that has produced
+    /// something, plus a summary total over every filtered row.</summary>
+    [HttpGet("produced")]
+    [ProducesResponseType(typeof(ProducedListResponseDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ProducedListResponseDto>> ListProduced(
+        [FromQuery] DateOnly? from,
+        [FromQuery] DateOnly? to,
+        [FromQuery] int? templateId,
+        [FromQuery] int? warehouseId,
+        [FromQuery] ProductionRunStatus? status,
+        CancellationToken ct)
+        => Ok(await _runs.ListProducedAsync(from, to, templateId, warehouseId, status, ct));
+
     [HttpGet("{runId:int}")]
     [ProducesResponseType(typeof(RunGraphDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/ProductionTemplatesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Production;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Production template endpoints (docs/30-BACKEND-PHASE2.md §D.1).</summary>
 [Route("api/v1/production-templates")]
+[Authorize(Policy = NavPolicies.Prefix + "production")]
 public sealed class ProductionTemplatesController : ApiControllerBase
 {
     private readonly IProductionTemplateService _templates;

Backend/ERPCore/Controllers/PurchaseInvoicesController.cs

@@ -0,0 +1,105 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Grn;
+using ERPCore.Dtos.Procurement;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Purchase invoice endpoints — vendor invoices consolidating Confirmed GRNs.</summary>
+[Route("api/v1/purchase-invoices")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
+public sealed class PurchaseInvoicesController : ApiControllerBase
+{
+    private readonly IPurchaseInvoiceService _invoices;
+    private readonly IPurchaseInvoicePaymentService _payments;
+
+    public PurchaseInvoicesController(IPurchaseInvoiceService invoices, IPurchaseInvoicePaymentService payments)
+    {
+        _invoices = invoices;
+        _payments = payments;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<PurchaseInvoiceSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<PurchaseInvoiceSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] PurchaseInvoiceStatus? status, [FromQuery] int? vendorId, CancellationToken ct)
+        => Ok(await _invoices.ListAsync(query, status, vendorId, ct));
+
+    /// <summary>Confirmed, not-yet-invoiced GRNs for a vendor — candidates for a new/edited invoice.</summary>
+    [HttpGet("eligible-grns")]
+    [ProducesResponseType(typeof(IReadOnlyList<GrnEligibleForInvoiceDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<GrnEligibleForInvoiceDto>>> EligibleGrns([FromQuery] int vendorId, CancellationToken ct)
+        => Ok(await _invoices.ListEligibleGrnsAsync(vendorId, ct));
+
+    [HttpGet("{purchaseInvoiceId:int}")]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> GetById(int purchaseInvoiceId, CancellationToken ct)
+    {
+        var result = await _invoices.GetAsync(purchaseInvoiceId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> Create([FromBody] CreatePurchaseInvoiceRequest request, CancellationToken ct)
+    {
+        var result = await _invoices.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/purchase-invoices/{result.Value.PurchaseInvoiceId}", result.Value);
+    }
+
+    [HttpPut("{purchaseInvoiceId:int}")]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> Update(int purchaseInvoiceId, [FromBody] UpdatePurchaseInvoiceRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _invoices.UpdateAsync(purchaseInvoiceId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost("{purchaseInvoiceId:int}/post")]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> Post(int purchaseInvoiceId, CancellationToken ct)
+        => Ok(await _invoices.PostAsync(purchaseInvoiceId, ct));
+
+    [HttpPost("{purchaseInvoiceId:int}/cancel")]
+    [ProducesResponseType(typeof(PurchaseInvoiceDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseInvoiceDto>> Cancel(int purchaseInvoiceId, CancellationToken ct)
+        => Ok(await _invoices.CancelAsync(purchaseInvoiceId, ct));
+
+    /// <summary>Pay the vendor against this invoice's balance, in full or in installments; posts a real GL journal entry.</summary>
+    [HttpPost("{purchaseInvoiceId:int}/payments")]
+    [ProducesResponseType(typeof(PurchaseInvoicePaymentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseInvoicePaymentDto>> Pay(int purchaseInvoiceId, [FromBody] CreatePurchaseInvoicePaymentRequest request, CancellationToken ct)
+    {
+        var dto = await _payments.PayAsync(purchaseInvoiceId, request, ct);
+        return Created($"/api/v1/purchase-invoices/{purchaseInvoiceId}/payments/{dto.PurchaseInvoicePaymentId}", dto);
+    }
+
+    /// <summary>Payment history for this invoice, newest first.</summary>
+    [HttpGet("{purchaseInvoiceId:int}/payments")]
+    [ProducesResponseType(typeof(IReadOnlyList<PurchaseInvoicePaymentDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<IReadOnlyList<PurchaseInvoicePaymentDto>>> ListPayments(int purchaseInvoiceId, CancellationToken ct)
+        => Ok(await _payments.ListAsync(purchaseInvoiceId, ct));
+}

Backend/ERPCore/Controllers/PurchaseOrdersController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Purchase-order endpoints (docs/11 §3.3).</summary>
 [Route("api/v1/purchase-orders")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class PurchaseOrdersController : ApiControllerBase
 {
     private readonly IPurchaseOrderService _pos;
@@ -32,7 +35,7 @@ public sealed class PurchaseOrdersController : ApiControllerBase
         return Ok(result.Value);
     }
 
-    /// <summary>Create a PO — auto-approved on creation in Phase 1 (FR-PROC-04). Totals computed server-side.</summary>
+    /// <summary>Create a PO — non-draft is issued straight into PendingApproval (FR-PROC-04). Totals computed server-side.</summary>
     [HttpPost]
     [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
@@ -57,7 +60,7 @@ public sealed class PurchaseOrdersController : ApiControllerBase
         return Ok(result.Value);
     }
 
-    /// <summary>Submit a Draft PO (Draft → Approved). 409 PO_NOT_EDITABLE if not Draft.</summary>
+    /// <summary>Submit a Draft PO (Draft → PendingApproval). 409 PO_NOT_EDITABLE if not Draft.</summary>
     [HttpPost("{poId:int}/submit")]
     [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -67,6 +70,7 @@ public sealed class PurchaseOrdersController : ApiControllerBase
 
     /// <summary>Delete a PO — permitted only while Draft (409 PO_NOT_EDITABLE otherwise).</summary>
     [HttpDelete("{poId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -76,13 +80,28 @@ public sealed class PurchaseOrdersController : ApiControllerBase
         return NoContent();
     }
 
-    /// <summary>Approve — no-op in Phase 1 (POs auto-approve); transitions PendingApproval→Approved when enabled.</summary>
+    /// <summary>Approve — PendingApproval → Approved. 403 PO_APPROVAL_FORBIDDEN if the caller
+    /// isn't an Admin or is the PO's own creator; 409 PO_NOT_PENDING_APPROVAL otherwise.</summary>
     [HttpPost("{poId:int}/approve")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
     [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<PurchaseOrderDto>> Approve(int poId, CancellationToken ct)
         => Ok(await _pos.ApproveAsync(poId, ct));
 
+    /// <summary>Reject — PendingApproval → Draft, so the requester can revise and resubmit.
+    /// Same caller restrictions as <see cref="Approve"/>.</summary>
+    [HttpPost("{poId:int}/reject")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
+    [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PurchaseOrderDto>> Reject(int poId, [FromBody] RejectPurchaseOrderRequest request, CancellationToken ct)
+        => Ok(await _pos.RejectAsync(poId, request.Reason, ct));
+
     /// <summary>Cancel — 409 if any goods have been received against the PO.</summary>
     [HttpPost("{poId:int}/cancel")]
     [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/PurchaseReturnsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Purchase-return endpoints (docs/11 §3.4).</summary>
 [Route("api/v1/purchase-returns")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class PurchaseReturnsController : ApiControllerBase
 {
     private readonly IPurchaseReturnService _returns;

Backend/ERPCore/Controllers/RequisitionsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Purchase-requisition endpoints (docs/11 §3.1).</summary>
 [Route("api/v1/requisitions")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class RequisitionsController : ApiControllerBase
 {
     private readonly IRequisitionService _requisitions;

Backend/ERPCore/Controllers/RfqsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>RFQ &amp; quotation endpoints (docs/11 §3.2).</summary>
 [Route("api/v1/rfqs")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class RfqsController : ApiControllerBase
 {
     private readonly IRfqService _rfqs;

Backend/ERPCore/Controllers/RolesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Rbac;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Role CRUD + permission assignment (mirrors AuthHex's Role; see docs/10 C.9).</summary>
 [Route("api/v1/roles")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class RolesController : ApiControllerBase
 {
     private readonly IRoleService _roles;
@@ -64,6 +67,7 @@ public sealed class RolesController : ApiControllerBase
     }
 
     [HttpDelete("{roleId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "settings" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]

Backend/ERPCore/Controllers/SalesDayEndController.cs

@@ -0,0 +1,53 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Sales;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Cashier day-end close-out — locks a cashier's Posted sales slips for a business
+/// date and posts one consolidated GL journal entry for the day (docs/14 Sales API).</summary>
+[Route("api/v1/sales-day-end")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
+public sealed class SalesDayEndController : ApiControllerBase
+{
+    private readonly ISalesDayEndService _dayEnds;
+
+    public SalesDayEndController(ISalesDayEndService dayEnds) => _dayEnds = dayEnds;
+
+    /// <summary>List day-end closes, newest first.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<SalesDayEndSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<SalesDayEndSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] int? cashierUserId, CancellationToken ct)
+        => Ok(await _dayEnds.ListAsync(query, cashierUserId, ct));
+
+    /// <summary>What closing this cashier/date right now would include (or the existing close's totals, if already closed).</summary>
+    [HttpGet("preview")]
+    [ProducesResponseType(typeof(SalesDayEndPreviewDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SalesDayEndPreviewDto>> Preview(
+        [FromQuery] int cashierUserId, [FromQuery] DateOnly? businessDate, CancellationToken ct)
+        => Ok(await _dayEnds.PreviewAsync(cashierUserId, businessDate ?? DateOnly.FromDateTime(DateTime.UtcNow), ct));
+
+    [HttpGet("{salesDayEndId:int}")]
+    [ProducesResponseType(typeof(SalesDayEndDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SalesDayEndDto>> GetById(int salesDayEndId, CancellationToken ct)
+    {
+        var dto = await _dayEnds.GetAsync(salesDayEndId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    /// <summary>Close the day: lock every Posted slip for (CashierUserId, BusinessDate) and post the
+    /// consolidated GL journal entry. Idempotent — closing an already-closed date replays it.</summary>
+    [HttpPost]
+    [ProducesResponseType(typeof(SalesDayEndDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<SalesDayEndDto>> Close([FromBody] CreateSalesDayEndRequest request, CancellationToken ct)
+    {
+        var dto = await _dayEnds.CloseAsync(request, ct);
+        return Created($"/api/v1/sales-day-end/{dto.SalesDayEndId}", dto);
+    }
+}

Backend/ERPCore/Controllers/SalesInvoicesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -7,11 +9,17 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/sales-invoices")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesInvoicesController : ApiControllerBase
 {
     private readonly ISalesInvoiceService _invoices;
+    private readonly ISalesInvoicePaymentService _payments;
 
-    public SalesInvoicesController(ISalesInvoiceService invoices) => _invoices = invoices;
+    public SalesInvoicesController(ISalesInvoiceService invoices, ISalesInvoicePaymentService payments)
+    {
+        _invoices = invoices;
+        _payments = payments;
+    }
 
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<SalesInvoiceSummaryDto>), StatusCodes.Status200OK)]
@@ -20,8 +28,11 @@ public sealed class SalesInvoicesController : ApiControllerBase
         [FromQuery] SalesInvoiceStatus? status,
         [FromQuery] int? customerId,
         [FromQuery] int? warehouseId,
+        [FromQuery] int? branchId,
+        [FromQuery] DateOnly? from,
+        [FromQuery] DateOnly? to,
         CancellationToken ct)
-        => Ok(await _invoices.ListAsync(query, status, customerId, warehouseId, ct));
+        => Ok(await _invoices.ListAsync(query, status, customerId, warehouseId, branchId, from, to, ct));
 
     [HttpGet("{salesInvoiceId:int}")]
     [ProducesResponseType(typeof(SalesInvoiceDto), StatusCodes.Status200OK)]
@@ -70,4 +81,23 @@ public sealed class SalesInvoicesController : ApiControllerBase
     [ProducesResponseType(typeof(SalesInvoiceDto), StatusCodes.Status200OK)]
     public async Task<ActionResult<SalesInvoiceDto>> Cancel(int salesInvoiceId, CancellationToken ct)
         => Ok(await _invoices.CancelAsync(salesInvoiceId, ct));
+
+    /// <summary>Pay the customer's balance against this invoice, in full or in installments; posts a real GL journal entry.</summary>
+    [HttpPost("{salesInvoiceId:int}/payments")]
+    [ProducesResponseType(typeof(SalesInvoicePaymentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<SalesInvoicePaymentDto>> Pay(int salesInvoiceId, [FromBody] CreateSalesInvoicePaymentRequest request, CancellationToken ct)
+    {
+        var dto = await _payments.PayAsync(salesInvoiceId, request, ct);
+        return Created($"/api/v1/sales-invoices/{salesInvoiceId}/payments/{dto.SalesInvoicePaymentId}", dto);
+    }
+
+    /// <summary>Payment history for this invoice, newest first.</summary>
+    [HttpGet("{salesInvoiceId:int}/payments")]
+    [ProducesResponseType(typeof(IReadOnlyList<SalesInvoicePaymentDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<IReadOnlyList<SalesInvoicePaymentDto>>> ListPayments(int salesInvoiceId, CancellationToken ct)
+        => Ok(await _payments.ListAsync(salesInvoiceId, ct));
 }

Backend/ERPCore/Controllers/SalesReportsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -5,6 +7,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/reports/sales")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesReportsController : ApiControllerBase
 {
     private readonly ISalesReportService _reports;

Backend/ERPCore/Controllers/SalesReturnsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Sales-return endpoints — customer returns of previously sold goods.</summary>
 [Route("api/v1/sales-returns")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesReturnsController : ApiControllerBase
 {
     private readonly ISalesReturnService _returns;

Backend/ERPCore/Controllers/SalesSlipPromotionsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Sales;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -5,6 +7,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/sales-slips/{salesSlipId:int}/free-issue-suggestions")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesSlipPromotionsController : ApiControllerBase
 {
     private readonly ISalesPromotionSuggestionService _suggestions;

Backend/ERPCore/Controllers/SalesSlipsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
@@ -7,6 +9,7 @@ using Microsoft.AspNetCore.Mvc;
 namespace ERPCore.Controllers;
 
 [Route("api/v1/sales-slips")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
 public sealed class SalesSlipsController : ApiControllerBase
 {
     private readonly ISalesSlipService _slips;

Backend/ERPCore/Controllers/SearchController.cs

@@ -0,0 +1,20 @@
+using ERPCore.Dtos.Search;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/search")]
+public sealed class SearchController : ApiControllerBase
+{
+    private readonly IGlobalSearchService _search;
+
+    public SearchController(IGlobalSearchService search) => _search = search;
+
+    [HttpGet]
+    public async Task<ActionResult<IReadOnlyList<GlobalSearchResultDto>>> Get([FromQuery] string q, CancellationToken ct)
+    {
+        var results = await _search.SearchAsync(q, 6, ct);
+        return Ok(results);
+    }
+}

Backend/ERPCore/Controllers/StockAdjustmentsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Stock-adjustment endpoints (docs/11 §5.5).</summary>
 [Route("api/v1/stock-adjustments")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockAdjustmentsController : ApiControllerBase
 {
     private readonly IAdjustmentService _adjustments;
@@ -17,8 +20,8 @@ public sealed class StockAdjustmentsController : ApiControllerBase
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<AdjustmentSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<AdjustmentSummaryDto>>> List(
-        [FromQuery] PageQuery query, [FromQuery] int? warehouseId, [FromQuery] int? reasonCodeId, CancellationToken ct)
-        => Ok(await _adjustments.ListAsync(query, warehouseId, reasonCodeId, ct));
+        [FromQuery] PageQuery query, [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] int? reasonCodeId, CancellationToken ct)
+        => Ok(await _adjustments.ListAsync(query, warehouseId, branchId, reasonCodeId, ct));
 
     /// <summary>Get one adjustment with its lines and the ledger entries it posted.</summary>
     [HttpGet("{adjustmentId:int}")]

Backend/ERPCore/Controllers/StockController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Procurement;
 using ERPCore.Dtos.Stock;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Stock enquiry, ledger, valuation and reorder-alert endpoints (docs/11 §5.1–5.3, §5.7).</summary>
 [Route("api/v1/stock")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockController : ApiControllerBase
 {
     private readonly IStockService _stock;
@@ -28,8 +31,8 @@ public sealed class StockController : ApiControllerBase
     [HttpGet("on-hand/list")]
     [ProducesResponseType(typeof(PagedResponse<StockOnHandDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<StockOnHandDto>>> OnHandList(
-        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _stock.GetOnHandListAsync(itemId, warehouseId, query, ct));
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _stock.GetOnHandListAsync(itemId, warehouseId, branchId, query, ct));
 
     /// <summary>
     /// Immutable movement history. <c>sourceDocType</c>/<c>sourceDocId</c> answer "what did
@@ -39,11 +42,11 @@ public sealed class StockController : ApiControllerBase
     [HttpGet("ledger")]
     [ProducesResponseType(typeof(PagedResponse<StockLedgerRowDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<StockLedgerRowDto>>> Ledger(
-        [FromQuery] int? itemId, [FromQuery] int? warehouseId,
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] int? branchId,
         [FromQuery] DateOnly? from, [FromQuery] DateOnly? to,
         [FromQuery] string? sourceDocType, [FromQuery] int? sourceDocId,
         [FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _stock.GetLedgerAsync(itemId, warehouseId, from, to, sourceDocType, sourceDocId, query, ct));
+        => Ok(await _stock.GetLedgerAsync(itemId, warehouseId, branchId, from, to, sourceDocType, sourceDocId, query, ct));
 
     [HttpGet("valuation")]
     [ProducesResponseType(typeof(StockValuationDto), StatusCodes.Status200OK)]
@@ -54,8 +57,8 @@ public sealed class StockController : ApiControllerBase
     [HttpGet("reorder-alerts")]
     [ProducesResponseType(typeof(PagedResponse<ReorderAlertDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<ReorderAlertDto>>> ReorderAlerts(
-        [FromQuery] int? warehouseId, [FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _reorder.GetAlertsAsync(warehouseId, query, ct));
+        [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _reorder.GetAlertsAsync(warehouseId, branchId, query, ct));
 
     /// <summary>Create a draft requisition for an item's suggested reorder quantity.</summary>
     [HttpPost("reorder-alerts/{itemId:int}/requisition")]

Backend/ERPCore/Controllers/StockCountsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Stock-count endpoints (docs/11 §5.6).</summary>
 [Route("api/v1/stock-counts")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockCountsController : ApiControllerBase
 {
     private readonly ICountService _counts;
@@ -18,8 +21,8 @@ public sealed class StockCountsController : ApiControllerBase
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<CountSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<CountSummaryDto>>> List(
-        [FromQuery] PageQuery query, [FromQuery] CountStatus? status, [FromQuery] int? warehouseId, CancellationToken ct)
-        => Ok(await _counts.ListAsync(query, status, warehouseId, ct));
+        [FromQuery] PageQuery query, [FromQuery] CountStatus? status, [FromQuery] int? warehouseId, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _counts.ListAsync(query, status, warehouseId, branchId, ct));
 
     [HttpGet("{countId:int}")]
     [ProducesResponseType(typeof(CountDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/StockTransfersController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Stock-transfer endpoints (docs/11 §5.4).</summary>
 [Route("api/v1/stock-transfers")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockTransfersController : ApiControllerBase
 {
     private readonly ITransferService _transfers;
@@ -19,8 +22,8 @@ public sealed class StockTransfersController : ApiControllerBase
     [ProducesResponseType(typeof(PagedResponse<TransferSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<TransferSummaryDto>>> List(
         [FromQuery] PageQuery query, [FromQuery] TransferStatus? status,
-        [FromQuery] int? srcWarehouseId, [FromQuery] int? destWarehouseId, CancellationToken ct)
-        => Ok(await _transfers.ListAsync(query, status, srcWarehouseId, destWarehouseId, ct));
+        [FromQuery] int? srcWarehouseId, [FromQuery] int? destWarehouseId, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _transfers.ListAsync(query, status, srcWarehouseId, destWarehouseId, branchId, ct));
 
     [HttpGet("{transferId:int}")]
     [ProducesResponseType(typeof(TransferDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/SubCategoriesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Categories;
 using ERPCore.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;
@@ -10,6 +12,7 @@ namespace ERPCore.Controllers;
 /// since a subcategory only exists in the context of one.
 /// </summary>
 [Route("api/v1/subcategories")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class SubCategoriesController : ApiControllerBase
 {
     private readonly ICategoryService _categories;

Backend/ERPCore/Controllers/SupportTicketsController.cs

@@ -0,0 +1,70 @@
+using ERPCore.Dtos.Support;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+[Route("api/v1/support-tickets")]
+public sealed class SupportTicketsController : ApiControllerBase
+{
+    private readonly ISupportTicketService _tickets;
+    private readonly ICurrentUser _currentUser;
+
+    public SupportTicketsController(ISupportTicketService tickets, ICurrentUser currentUser)
+    {
+        _tickets = tickets;
+        _currentUser = currentUser;
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status201Created)]
+    public async Task<ActionResult<SupportTicketDto>> Create([FromBody] CreateSupportTicketRequest request, CancellationToken ct)
+    {
+        var result = await _tickets.CreateAsync(_currentUser.AuditUserId, request, ct);
+        SetETag(result.RowVersion);
+        return CreatedAtAction(nameof(GetById), new { id = result.Value.TicketId }, result.Value);
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(IReadOnlyList<SupportTicketSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<SupportTicketSummaryDto>>> GetList(CancellationToken ct)
+    {
+        var list = await _tickets.GetListAsync(_currentUser.AuditUserId, _currentUser.IsAdmin, ct);
+        return Ok(list);
+    }
+
+    [HttpGet("{id:int}")]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SupportTicketDto>> GetById(int id, CancellationToken ct)
+    {
+        var result = await _tickets.GetByIdAsync(id, _currentUser.AuditUserId, _currentUser.IsAdmin, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost("{id:int}/messages")]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SupportTicketDto>> AddMessage(int id, [FromBody] AddSupportTicketMessageRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _tickets.AddMessageAsync(id, _currentUser.AuditUserId, _currentUser.IsAdmin, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut("{id:int}/status")]
+    [ProducesResponseType(typeof(SupportTicketDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<SupportTicketDto>> UpdateStatus(int id, [FromBody] UpdateSupportTicketStatusRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _tickets.UpdateStatusAsync(id, _currentUser.AuditUserId, _currentUser.IsAdmin, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}

Backend/ERPCore/Controllers/TaxRatesController.cs

@@ -0,0 +1,70 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.TaxRates;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Tax rate master endpoints — see <see cref="Domain.Entities.TaxRate"/>.</summary>
+[Route("api/v1/tax-rates")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
+public sealed class TaxRatesController : ApiControllerBase
+{
+    private readonly ITaxRateService _taxRates;
+
+    public TaxRatesController(ITaxRateService taxRates) => _taxRates = taxRates;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<TaxRateDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<TaxRateDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _taxRates.ListAsync(query, status, ct));
+
+    [HttpGet("{taxRateId:int}")]
+    [ProducesResponseType(typeof(TaxRateDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<TaxRateDto>> GetById(int taxRateId, CancellationToken ct)
+    {
+        var result = await _taxRates.GetAsync(taxRateId, ct);
+        if (result is null) return NotFound();
+
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(TaxRateDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<TaxRateDto>> Create([FromBody] CreateTaxRateRequest request, CancellationToken ct)
+    {
+        var result = await _taxRates.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/tax-rates/{result.Value.TaxRateId}", result.Value);
+    }
+
+    [HttpPut("{taxRateId:int}")]
+    [ProducesResponseType(typeof(TaxRateDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<TaxRateDto>> Update(int taxRateId, [FromBody] UpdateTaxRateRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _taxRates.UpdateAsync(taxRateId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Deactivate/reactivate. Masters are never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{taxRateId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int taxRateId, [FromBody] UpdateTaxRateStatusRequest request, CancellationToken ct)
+    {
+        await _taxRates.SetStatusAsync(taxRateId, request.Status, ct);
+        return NoContent();
+    }
+}

Backend/ERPCore/Controllers/UomsController.cs

@@ -1,3 +1,6 @@
+using ERPCore.Domain.Enums;
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Uoms;
 using ERPCore.Services.Interfaces;
@@ -7,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Unit-of-measure endpoints (docs/11-BACKEND-PHASE1.md §2.2).</summary>
 [Route("api/v1/uoms")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
 public sealed class UomsController : ApiControllerBase
 {
     private readonly IUomService _uoms;
@@ -15,8 +19,9 @@ public sealed class UomsController : ApiControllerBase
 
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<UomDto>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedResponse<UomDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _uoms.ListAsync(query, ct));
+    public async Task<ActionResult<PagedResponse<UomDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] EntityStatus? status, CancellationToken ct)
+        => Ok(await _uoms.ListAsync(query, status, ct));
 
     [HttpPost]
     [ProducesResponseType(typeof(UomDto), StatusCodes.Status201Created)]
@@ -26,4 +31,14 @@ public sealed class UomsController : ApiControllerBase
         var dto = await _uoms.CreateAsync(request, ct);
         return Created($"/api/v1/uoms/{dto.UomId}", dto);
     }
+
+    /// <summary>Deactivate/reactivate. Masters are never hard-deleted (FR-MD-08).</summary>
+    [HttpPatch("{uomId:int}/status")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> SetStatus(int uomId, [FromBody] UpdateUomStatusRequest request, CancellationToken ct)
+    {
+        await _uoms.SetStatusAsync(uomId, request.Status, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/UsersController.cs

@@ -1,7 +1,13 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Audit;
+using ERPCore.Dtos.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
 using ERPCore.Dtos.Users;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers;
@@ -11,15 +17,20 @@ namespace ERPCore.Controllers;
 /// account creation orchestrated against AuthHex (see <see cref="IUserManagementService.CreateAsync"/>).
 /// </summary>
 [Route("api/v1/users")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
 public sealed class UsersController : ApiControllerBase
 {
     private readonly IUserManagementService _users;
     private readonly IEmployeeUserLinkService _links;
+    private readonly IAuditService _audit;
+    private readonly ICurrentUser _currentUser;
 
-    public UsersController(IUserManagementService users, IEmployeeUserLinkService links)
+    public UsersController(IUserManagementService users, IEmployeeUserLinkService links, IAuditService audit, ICurrentUser currentUser)
     {
         _users = users;
         _links = links;
+        _audit = audit;
+        _currentUser = currentUser;
     }
 
     /// <summary>Advisory forward-direction lookup: does a Staff record already exist with this email? (docs/12-BACKEND-HRM.md A.5)</summary>
@@ -30,8 +41,8 @@ public sealed class UsersController : ApiControllerBase
 
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<ManagedUserDto>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedResponse<ManagedUserDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _users.ListAsync(query, ct));
+    public async Task<ActionResult<PagedResponse<ManagedUserDto>>> List([FromQuery] PageQuery query, [FromQuery] EntityStatus? status, [FromQuery] string? roleCode, CancellationToken ct)
+        => Ok(await _users.ListAsync(query, status, roleCode, ct));
 
     /// <summary>AuthHex UserType options for the create-user form's select.</summary>
     [HttpGet("user-types")]
@@ -53,7 +64,7 @@ public sealed class UsersController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<ManagedUserDto>> Create([FromBody] CreateUserRequest request, CancellationToken ct)
     {
-        var result = await _users.CreateAsync(request, ct);
+        var result = await _users.CreateAsync(request, _currentUser.AuditUserId, ct);
         return Created($"/api/v1/users/{result.UserId}", result);
     }
 
@@ -62,4 +73,34 @@ public sealed class UsersController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     public async Task<ActionResult<ManagedUserDto>> UpdateRole(int userId, [FromBody] UpdateUserRoleRequest request, CancellationToken ct)
         => Ok(await _users.UpdateRoleAsync(userId, request, ct));
+
+    /// <summary>Revokes/restores standing inside ERPCore only — see <see cref="IUserManagementService.SetStatusAsync"/>.</summary>
+    [HttpPatch("{userId:int}/status")]
+    [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ManagedUserDto>> UpdateStatus(int userId, [FromBody] UpdateUserStatusRequest request, CancellationToken ct)
+        => Ok(await _users.SetStatusAsync(userId, request.Status, ct));
+
+    /// <summary>Device/login history ERPCore captures itself — not AuthHex's "currently active sessions"
+    /// (which only ever reports the caller's own). See <see cref="IAuditService.ListLoginDevicesAsync"/>.</summary>
+    [HttpGet("{userId:int}/login-devices")]
+    [ProducesResponseType(typeof(PagedResponse<LoginActivityDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<LoginActivityDto>>> ListLoginDevices(int userId, [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _audit.ListLoginDevicesAsync(userId, query, ct));
+
+    /// <summary>
+    /// Admin-only escape hatch: permanently deletes a stale AuthHex identity (by email/mobile/NIC/
+    /// username) that is blocking new registrations. Does not touch ERPCore's own `users` table.
+    /// See <see cref="IUserManagementService.PurgeAuthHexIdentityAsync"/>.
+    /// </summary>
+    [HttpPost("purge-authhex-identity")]
+    [ProducesResponseType(typeof(DeleteAuthHexUserResult), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<ActionResult<DeleteAuthHexUserResult>> PurgeAuthHexIdentity([FromBody] PurgeAuthHexIdentityRequest request, CancellationToken ct)
+    {
+        if (!_currentUser.IsAdmin)
+            throw new DomainException("FORBIDDEN", "Only an administrator can purge an AuthHex identity.", 403);
+
+        return Ok(await _users.PurgeAuthHexIdentityAsync(request, ct));
+    }
 }

Backend/ERPCore/Controllers/VendorsController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Vendors;
@@ -8,6 +10,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Vendor master endpoints (docs/11-BACKEND-PHASE1.md §2.4).</summary>
 [Route("api/v1/vendors")]
+[Authorize(Policy = NavPolicies.Prefix + "vendors")]
 public sealed class VendorsController : ApiControllerBase
 {
     private readonly IVendorService _vendors;

Backend/ERPCore/Controllers/WarehousesController.cs

@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Warehouses;
 using ERPCore.Services.Interfaces;
@@ -7,6 +9,7 @@ namespace ERPCore.Controllers;
 
 /// <summary>Warehouse &amp; bin endpoints (docs/11-BACKEND-PHASE1.md §2.5).</summary>
 [Route("api/v1/warehouses")]
+[Authorize(Policy = NavPolicies.Prefix + "warehouses")]
 public sealed class WarehousesController : ApiControllerBase
 {
     private readonly IWarehouseService _warehouses;
@@ -15,8 +18,9 @@ public sealed class WarehousesController : ApiControllerBase
 
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<WarehouseDto>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedResponse<WarehouseDto>>> List([FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _warehouses.ListAsync(query, ct));
+    public async Task<ActionResult<PagedResponse<WarehouseDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _warehouses.ListAsync(query, branchId, ct));
 
     [HttpGet("{warehouseId:int}")]
     [ProducesResponseType(typeof(WarehouseDto), StatusCodes.Status200OK)]
@@ -36,6 +40,24 @@ public sealed class WarehousesController : ApiControllerBase
         return Created($"/api/v1/warehouses/{dto.WarehouseId}", dto);
     }
 
+    [HttpPut("{warehouseId:int}")]
+    [ProducesResponseType(typeof(WarehouseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<WarehouseDto>> Update(int warehouseId, [FromBody] UpdateWarehouseRequest request, CancellationToken ct)
+        => Ok(await _warehouses.UpdateAsync(warehouseId, request, ct));
+
+    [HttpDelete("{warehouseId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "warehouses" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int warehouseId, CancellationToken ct)
+    {
+        await _warehouses.DeleteAsync(warehouseId, ct);
+        return NoContent();
+    }
+
     [HttpGet("{warehouseId:int}/bins")]
     [ProducesResponseType(typeof(IReadOnlyList<BinDto>), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Domain/DocumentTypes.cs

@@ -10,6 +10,7 @@ public static class DocumentTypes
     public const string Rfq = "RFQ";
     public const string PurchaseOrder = "PO";
     public const string Grn = "GRN";
+    public const string PurchaseInvoice = "PINV";
     public const string Transfer = "TRF";
     public const string Adjustment = "ADJ";
     public const string Count = "CNT";
@@ -20,5 +21,9 @@ public static class DocumentTypes
     public const string SalesInvoice = "SI";
     public const string SalesSlip = "SSL";
     public const string BundleSale = "BND";
+    public const string BundleSaleTemplate = "TPL";
     public const string SalesReturn = "SRET";
+
+    /// <summary>Cashier day-end close-out (Sales) — <c>DEND-2026-00001</c>.</summary>
+    public const string SalesDayEnd = "DEND";
 }

Backend/ERPCore/Domain/Entities/Batch.cs

@@ -13,4 +13,7 @@ public class Batch
 
     public string BatchNo { get; set; } = string.Empty;
     public DateOnly? ExpiryDate { get; set; }
+
+    /// <summary>Optional scan code for barcode/RFID lookup (unique when set).</summary>
+    public string? Barcode { get; set; }
 }

Backend/ERPCore/Domain/Entities/Branch.cs

@@ -3,16 +3,19 @@ using ERPCore.Domain.Enums;
 namespace ERPCore.Domain.Entities;
 
 /// <summary>
-/// Branch/location master (FR-HR-MD-01) — multi-branch readiness. Referenced
-/// optionally by <see cref="Employee.BranchId"/> and <see cref="PayrollRun.BranchId"/>.
+/// Branch/location master (FR-HR-MD-01) — multi-branch readiness. Required by
+/// <see cref="Employee.BranchId"/>, optionally referenced by <see cref="PayrollRun.BranchId"/>.
 /// Deactivated, not deleted, when referenced. Model: docs/12-BACKEND-HRM.md Part C.1.
 /// </summary>
 public class Branch
 {
     public int BranchId { get; set; }
+
+    /// <summary>Server-generated on create ("BR-001", "BR-002", ...) — never accepted from the client.</summary>
     public string Code { get; set; } = string.Empty;
     public string Name { get; set; } = string.Empty;
     public string? Address { get; set; }
+    public string? PhoneNumber { get; set; }
     public EntityStatus Status { get; set; } = EntityStatus.Active;
 
     public DateTime CreatedAt { get; set; }

Backend/ERPCore/Domain/Entities/BranchConfig.cs

@@ -0,0 +1,39 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Branch configuration — a singleton row (single-tenant, docs/00-CORE §1) gating whether
+/// this deployment uses branches at all. When <see cref="BranchingEnabled"/> is off, the
+/// Employee/Warehouse create forms stop asking for a branch and every new record is
+/// silently assigned to the deployment's one default branch instead — schema-wise
+/// <c>Employee.BranchId</c>/<c>Warehouse.BranchId</c> stay <c>NOT NULL</c> either way, only
+/// the UI/UX requirement toggles. See <see cref="Services.BranchConfigService.ResolveBranchIdAsync"/>.
+/// </summary>
+public class BranchConfig
+{
+    /// <summary>Always 1 - the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    public int ConfigId { get; set; }
+
+    public bool BranchingEnabled { get; set; } = true;
+
+    /// <summary>Independent sub-toggle: when the global <see cref="BranchingEnabled"/> is on
+    /// but this is off, Warehouses stop asking for/showing a branch while Employees etc.
+    /// still do. Meaningless when <see cref="BranchingEnabled"/> is off (everything is
+    /// single-branch already).</summary>
+    public bool WarehouseBranchingEnabled { get; set; } = true;
+
+    /// <summary>Independent sub-toggle for Purchase Orders. On: each PO belongs to one branch,
+    /// non-admins only see their own branch's POs, and line warehouses must be in that branch.
+    /// Off: POs form one shared pool across branches (kept on the default branch, visible to
+    /// everyone, any warehouse allowed). Meaningless when <see cref="BranchingEnabled"/> is off.</summary>
+    public bool PurchaseOrderBranchingEnabled { get; set; } = true;
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}

Backend/ERPCore/Domain/Entities/BundleSale.cs

@@ -29,5 +29,11 @@ public class BundleSale
     public DateTime? UpdatedAt { get; set; }
     public int ConcurrencyStamp { get; set; }
 
+    /// <summary>Set once this bundle's business date is closed by <see cref="SalesDayEnd"/> — a
+    /// closed bundle sale is frozen (no further edits). Same role as <see cref="SalesSlip.DayEndId"/>;
+    /// a bundle sale is a cashier document exactly like a sales slip, just priced as a set.</summary>
+    public int? DayEndId { get; set; }
+    public SalesDayEnd? DayEnd { get; set; }
+
     public ICollection<BundleSaleLine> Lines { get; set; } = new List<BundleSaleLine>();
 }

Backend/ERPCore/Domain/Entities/Customer.cs

@@ -29,6 +29,9 @@ public class Customer
     public int? DefaultWarehouseId { get; set; }
     public Warehouse? DefaultWarehouse { get; set; }
 
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public EntityStatus Status { get; set; } = EntityStatus.Active;
     public DateTime CreatedAt { get; set; }
     public DateTime? UpdatedAt { get; set; }

Backend/ERPCore/Domain/Entities/Employee.cs

@@ -6,8 +6,10 @@ namespace ERPCore.Domain.Entities;
 /// Staff record (FR-HR-MD-02) — distinct from <see cref="User"/> (the system login
 /// account): not every employee has a login, and not every login belongs to an
 /// employee. <see cref="UserId"/> is the optional, explicit, human-confirmed link
-/// between the two (docs/12-BACKEND-HRM.md A.5/C.2, Part B.3.2). Never hard-deleted —
-/// separation is recorded via <see cref="Status"/> + <see cref="LastWorkingDate"/>.
+/// between the two (docs/12-BACKEND-HRM.md A.5/C.2, Part B.3.2). Normal separation is
+/// recorded via <see cref="Status"/> + <see cref="LastWorkingDate"/> rather than deletion;
+/// an explicit hard delete is also available (<see cref="Services.Interfaces.IEmployeeService.DeleteAsync"/>)
+/// and cascades to every dependent HR record, blocked only if payroll history exists.
 /// <see cref="EmployeeCode"/> is user-entered (not <see cref="NumberSequence"/>-issued):
 /// HR departments keep their own legacy numbering scheme, and NumberSequence's
 /// year-scoping is the wrong shape for an identifier that must never look "reset".
@@ -50,7 +52,7 @@ public class Employee
     public Designation? Designation { get; set; }
     public int EmploymentTypeId { get; set; }
     public EmploymentType? EmploymentType { get; set; }
-    public int? BranchId { get; set; }
+    public int BranchId { get; set; }
     public Branch? Branch { get; set; }
     public int WorkShiftId { get; set; }
     public WorkShift? WorkShift { get; set; }

Backend/ERPCore/Domain/Entities/Grn.cs

@@ -22,6 +22,11 @@ public class Grn
     public int WarehouseId { get; set; }
     public Warehouse? Warehouse { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from <see cref="Warehouse"/>.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public GrnStatus Status { get; set; } = GrnStatus.Draft;
 
     public int CreatedBy { get; set; }
@@ -30,6 +35,16 @@ public class Grn
     public DateTime CreatedAt { get; set; }
     public DateTime? PostedAt { get; set; }
 
+    /// <summary>Journal number of the real GL journal entry posted for this GRN's receipt (set on confirm).</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
+    /// <summary>The Purchase Invoice this GRN has been consolidated into, if any (null until
+    /// invoiced). Vendor settlement is tracked on the invoice, not per-GRN — see
+    /// <see cref="PurchaseInvoice"/>.</summary>
+    public int? PurchaseInvoiceId { get; set; }
+    public PurchaseInvoice? PurchaseInvoice { get; set; }
+
     /// <summary>PostgreSQL xmin-backed optimistic concurrency token.</summary>
     public uint RowVersion { get; set; }
 

Backend/ERPCore/Domain/Entities/Item.cs

@@ -14,6 +14,9 @@ public class Item
     public string Name { get; set; } = string.Empty;
     public string? Description { get; set; }
 
+    /// <summary>Optional scan code for barcode/RFID lookup (unique when set).</summary>
+    public string? Barcode { get; set; }
+
     public int CategoryId { get; set; }
     public Category? Category { get; set; }
 
@@ -41,14 +44,22 @@ public class Item
     public Warranty Warranty { get; set; } = Warranty.NonWarranty;
     /// <summary>Coverage length in months (see <see cref="Enums.WarrantyPeriods.AllowedMonths"/>) when <see cref="Warranty"/> is Warranty; null otherwise.</summary>
     public int? WarrantyPeriodMonths { get; set; }
-    public string? TaxClass { get; set; }
 
     /// <summary>
-    /// Optional fixed selling price used by Sales only. <c>null</c> means "use stock value"
-    /// (the item is sold at its FIFO stock cost at sale time); a value is the fixed sale price.
-    /// Never enters costing/GRN/FIFO (docs/10 Part C.1, C.9).
+    /// The tax rate a sales/purchase line for this item defaults to (see
+    /// <see cref="TaxRate"/>) — replaces the old free-text "tax class" label that nothing
+    /// ever read. Null means no default; a line must be given an explicit tax percentage.
     /// </summary>
-    public decimal? SalePrice { get; set; }
+    public int? TaxRateId { get; set; }
+    public TaxRate? TaxRate { get; set; }
+
+    /// <summary>
+    /// Optional selling price range and flat price used by Sales only.
+    /// <c>null</c> values mean the field is not set. These values never enter costing/GRN/FIFO.
+    /// </summary>
+    public decimal? SellingMinPrice { get; set; }
+    public decimal? SellingMaxPrice { get; set; }
+    public decimal? SellingFlatPrice { get; set; }
 
     /// <summary>
     /// How much one pack holds, as the user entered it — <c>500</c> with

Backend/ERPCore/Domain/Entities/LoginActivity.cs

@@ -0,0 +1,22 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// One row per successful sign-in, captured directly by ERPCore (not AuthHex) so an
+/// admin can see a user's device/login history — AuthHex's own session listing only
+/// ever reports the currently-authenticated caller's own sessions, with no admin-scoped
+/// call to inspect anyone else's. This is a history of past logins, not a live "currently
+/// active sessions" view (that would need AuthHex to expose one).
+/// </summary>
+public class LoginActivity
+{
+    public int LoginActivityId { get; set; }
+    public int UserId { get; set; }
+    public User? User { get; set; }
+
+    public string? IpAddress { get; set; }
+    public string? UserAgent { get; set; }
+    /// <summary>Best-effort "Browser on OS" label parsed from <see cref="UserAgent"/> for display.</summary>
+    public string? DeviceLabel { get; set; }
+
+    public DateTime LoginAt { get; set; }
+}

Backend/ERPCore/Domain/Entities/Notification.cs

@@ -0,0 +1,22 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A single raised notification event (e.g. "GRN Confirmed"). Broadcast to
+/// active users via <see cref="NotificationRecipient"/> rows, gated by
+/// whether the module's InApp channel is enabled in <see cref="NotificationConfig"/>.
+/// </summary>
+public class Notification
+{
+    public int NotificationId { get; set; }
+
+    public string ModuleKey { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+    public string Message { get; set; } = string.Empty;
+
+    public string? RelatedEntityType { get; set; }
+    public int? RelatedEntityId { get; set; }
+
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+
+    public ICollection<NotificationRecipient> Recipients { get; set; } = new List<NotificationRecipient>();
+}

Backend/ERPCore/Domain/Entities/NotificationConfig.cs

@@ -0,0 +1,19 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Notification configuration (new settings module) - singleton root row.
+/// </summary>
+public class NotificationConfig
+{
+    public const int SingletonId = 1;
+
+    public int NotificationConfigId { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public ICollection<NotificationConfigModule> Modules { get; set; } = new List<NotificationConfigModule>();
+}

Backend/ERPCore/Domain/Entities/NotificationConfigModule.cs

@@ -0,0 +1,14 @@
+namespace ERPCore.Domain.Entities;
+
+public class NotificationConfigModule
+{
+    public int NotificationConfigModuleId { get; set; }
+
+    public int NotificationConfigId { get; set; }
+    public NotificationConfig? NotificationConfig { get; set; }
+
+    public string ModuleKey { get; set; } = string.Empty;
+    public bool EmailEnabled { get; set; }
+    public bool SmsEnabled { get; set; }
+    public bool InAppEnabled { get; set; }
+}

Backend/ERPCore/Domain/Entities/NotificationRecipient.cs

@@ -0,0 +1,18 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Per-user read state for a broadcast <see cref="Notification"/>.
+/// </summary>
+public class NotificationRecipient
+{
+    public int NotificationRecipientId { get; set; }
+
+    public int NotificationId { get; set; }
+    public Notification? Notification { get; set; }
+
+    public int UserId { get; set; }
+    public User? User { get; set; }
+
+    public bool IsRead { get; set; }
+    public DateTime? ReadAt { get; set; }
+}

Backend/ERPCore/Domain/Entities/NumberSequence.cs

@@ -10,6 +10,10 @@ public class NumberSequence
 {
     public int SequenceId { get; set; }
     public string DocType { get; set; } = string.Empty;
+    /// <summary>Per-branch counter key (docs/BRANCH_ISOLATION_PLAN.md §5) — backfilled to the
+    /// deployment's default branch for rows that predate per-branch numbering.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
     public int Year { get; set; }
     public int LastNumber { get; set; }
 }

Backend/ERPCore/Domain/Entities/ProductConfig.cs

@@ -1,22 +1,24 @@
 namespace ERPCore.Domain.Entities;
 
 /// <summary>
-/// Product configuration (FR-MD-11) — a <b>singleton row</b> (single-tenant, docs/00-CORE §1)
+/// Product configuration (FR-MD-11) - a singleton row (single-tenant, docs/00-CORE §1)
 /// gating optional product master-data features.
 /// <para>
 /// <see cref="SubcategoriesEnabled"/> and <see cref="BrandsEnabled"/> are enforced
 /// server-side: an Item write carrying a subcategory/brand while the flag is off is
-/// rejected with <c>CONFIG_DISABLED</c>. <see cref="ItemTypesEnabled"/> is
-/// <b>advisory only</b> — items carry no item-type reference (see <see cref="ItemType"/>),
-/// so there is nothing on a write to reject; the frontend honours it by hiding the
-/// builder's type section. Reads are never gated, so existing data stays visible after a
-/// flag is switched off.
+/// rejected with <c>CONFIG_DISABLED</c>. <see cref="ItemTypesEnabled"/> is advisory only
+/// - items carry no item-type reference (see <see cref="ItemType"/>), so there is nothing
+/// on a write to reject; the frontend honours it by hiding the variant builder.
+/// <see cref="SellingPricesEnabled"/>, <see cref="SerialNumbersEnabled"/>,
+/// <see cref="BatchListsEnabled"/> and <see cref="WarrantyPeriodsEnabled"/> are enforced
+/// on item writes and drive the create/edit screens. Reads are never gated, so existing
+/// data stays visible after a flag is switched off.
 /// </para>
 /// Model: docs/10-BACKEND-PHASE1.md Part C.1.
 /// </summary>
 public class ProductConfig
 {
-    /// <summary>Always 1 — the singleton row's id.</summary>
+    /// <summary>Always 1 - the singleton row's id.</summary>
     public const int SingletonId = 1;
 
     public int ConfigId { get; set; }
@@ -24,6 +26,10 @@ public class ProductConfig
     public bool SubcategoriesEnabled { get; set; } = true;
     public bool BrandsEnabled { get; set; } = true;
     public bool ItemTypesEnabled { get; set; } = true;
+    public bool SellingPricesEnabled { get; set; } = true;
+    public bool SerialNumbersEnabled { get; set; } = true;
+    public bool BatchListsEnabled { get; set; } = true;
+    public bool WarrantyPeriodsEnabled { get; set; } = true;
 
     public DateTime? UpdatedAt { get; set; }
 

Backend/ERPCore/Domain/Entities/PurchaseInvoice.cs

@@ -0,0 +1,53 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Vendor invoice consolidating one or more Confirmed GRNs for the same vendor
+/// (each linked GRN becomes one <see cref="PurchaseInvoiceLine"/>, not re-itemized).
+/// Draft is editable (GRNs can be re-selected); Posted reclassifies the GRN clearing
+/// balance to Accounts Payable (see PurchaseInvoiceService.PostAsync); vendor payments
+/// are then recorded against this aggregate rather than against the individual GRNs.
+/// </summary>
+public class PurchaseInvoice
+{
+    public int PurchaseInvoiceId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public string VendorInvoiceNo { get; set; } = string.Empty;
+    public DateTime VendorInvoiceDate { get; set; }
+
+    public int VendorId { get; set; }
+    public Vendor? Vendor { get; set; }
+
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
+    public string VendorSnapshotName { get; set; } = string.Empty;
+    public string? VendorSnapshotTaxNo { get; set; }
+
+    public PurchaseInvoiceStatus Status { get; set; } = PurchaseInvoiceStatus.Draft;
+
+    public decimal Subtotal { get; set; }
+    public decimal VatTotal { get; set; }
+    public decimal GrandTotal { get; set; }
+    public decimal PaidAmount { get; set; }
+    public decimal BalanceAmount { get; set; }
+
+    /// <summary>Journal number of the AP-recognition GL journal entry posted when this
+    /// invoice is Posted (Debit GRN Clearing / Credit Accounts Payable) — see
+    /// PurchaseInvoiceService.PostAsync.</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public ICollection<PurchaseInvoiceLine> Lines { get; set; } = new List<PurchaseInvoiceLine>();
+    public ICollection<PurchaseInvoicePayment> Payments { get; set; } = new List<PurchaseInvoicePayment>();
+}

Backend/ERPCore/Domain/Entities/PurchaseInvoiceLine.cs

@@ -0,0 +1,21 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// One row per consolidated GRN on a <see cref="PurchaseInvoice"/> — a straight
+/// consolidation of that GRN's line totals, not a re-itemization (docs: Purchase
+/// Invoice consolidates GRNs, it does not re-enter item lines).
+/// </summary>
+public class PurchaseInvoiceLine
+{
+    public int PurchaseInvoiceLineId { get; set; }
+
+    public int PurchaseInvoiceId { get; set; }
+    public PurchaseInvoice? PurchaseInvoice { get; set; }
+
+    public int GrnId { get; set; }
+    public Grn? Grn { get; set; }
+
+    public decimal Subtotal { get; set; }
+    public decimal VatTotal { get; set; }
+    public decimal LineTotal { get; set; }
+}

Backend/ERPCore/Domain/Entities/PurchaseInvoicePayment.cs

@@ -0,0 +1,32 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A vendor payment made against a Posted purchase invoice's balance (installments
+/// allowed — see PurchaseInvoicePaymentService.PayAsync). Posts its own real GL
+/// journal entry (Debit Accounts Payable / Credit the selected bank-or-cash account)
+/// before being recorded here.
+/// </summary>
+public class PurchaseInvoicePayment
+{
+    public int PurchaseInvoicePaymentId { get; set; }
+
+    public int PurchaseInvoiceId { get; set; }
+    public PurchaseInvoice? PurchaseInvoice { get; set; }
+
+    public decimal Amount { get; set; }
+    public DateTime PaymentDate { get; set; }
+
+    /// <summary>GL's numeric id for the bank/cash account the payment was made from.</summary>
+    public long GlBankAccountId { get; set; }
+    /// <summary>Snapshot of the account's display name at payment time (GL account lists have no local FK).</summary>
+    public string BankAccountName { get; set; } = string.Empty;
+
+    public string? Reference { get; set; }
+
+    /// <summary>Journal number of the real GL journal entry this payment posted.</summary>
+    public string? GlJournalNo { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+}

Backend/ERPCore/Domain/Entities/PurchaseOrder.cs

@@ -5,9 +5,10 @@ namespace ERPCore.Domain.Entities;
 /// <summary>
 /// Purchase order header (FR-PROC-03..06). Mutable aggregate with a
 /// <see cref="RowVersion"/> ETag token; editable while open (FR-PROC-05).
-/// Phase 1 auto-approves on creation; <see cref="ApprovalRequired"/> is retained
-/// for the future approval workflow. Totals are computed server-side from lines
-/// (not stored). Model: docs/10 Part C.2.
+/// A submitted/issued PO goes to <see cref="PurchaseOrderStatus.PendingApproval"/> and
+/// needs a separate Approve action (an Admin who isn't <see cref="CreatedBy"/>) before it
+/// reaches <see cref="PurchaseOrderStatus.Approved"/>. Totals are computed server-side
+/// from lines (not stored). Model: docs/10 Part C.2.
 /// </summary>
 public class PurchaseOrder
 {
@@ -17,15 +18,25 @@ public class PurchaseOrder
     public int VendorId { get; set; }
     public Vendor? Vendor { get; set; }
 
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public int? RequisitionId { get; set; }
     public Requisition? Requisition { get; set; }
 
     public PurchaseOrderStatus Status { get; set; } = PurchaseOrderStatus.Draft;
+    /// <summary>True once the PO has been (or needs to be) routed through approval —
+    /// i.e. it is not a still-editable Draft.</summary>
     public bool ApprovalRequired { get; set; }
 
     public int CreatedBy { get; set; }
     public User? Creator { get; set; }
 
+    /// <summary>Who approved this PO — set only when <see cref="Status"/> reaches Approved.</summary>
+    public int? ApprovedBy { get; set; }
+    public User? Approver { get; set; }
+    public DateTime? ApprovedAt { get; set; }
+
     public DateTime CreatedAt { get; set; }
     public DateTime? UpdatedAt { get; set; }
 

Backend/ERPCore/Domain/Entities/PurchaseReturn.cs

@@ -28,5 +28,12 @@ public class PurchaseReturn
 
     public DateTime CreatedAt { get; set; }
 
+    /// <summary>Journal number of the real GL journal entry posted for this return (set on create — it auto-posts).
+    /// Reverses the Inventory/Clearing lines a Grn posts — <see cref="PurchaseReturnLine"/> carries no unit
+    /// price/VAT of its own, so it can't reverse a VAT-recoverable line the way a real credit note would.</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
     public ICollection<PurchaseReturnLine> Lines { get; set; } = new List<PurchaseReturnLine>();
 }
+

Backend/ERPCore/Domain/Entities/Requisition.cs

@@ -14,6 +14,9 @@ public class Requisition
     public int RequestedBy { get; set; }
     public User? Requester { get; set; }
 
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public RequisitionStatus Status { get; set; } = RequisitionStatus.Draft;
     public DateTime CreatedAt { get; set; }
 

Backend/ERPCore/Domain/Entities/Rfq.cs

@@ -14,6 +14,9 @@ public class Rfq
     public int RequisitionId { get; set; }
     public Requisition? Requisition { get; set; }
 
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public RfqStatus Status { get; set; } = RfqStatus.Open;
     public DateTime CreatedAt { get; set; }
 

Backend/ERPCore/Domain/Entities/RolePermission.cs

@@ -1,3 +1,5 @@
+using ERPCore.Domain.Enums;
+
 namespace ERPCore.Domain.Entities;
 
 /// <summary>Join row granting a <see cref="Role"/> visibility of a <see cref="Permission"/> (nav node).</summary>
@@ -6,6 +8,13 @@ public class RolePermission
     public int RoleId { get; set; }
     public int PermissionId { get; set; }
 
+    /// <summary>
+    /// Which mutating actions the role may perform within this permission's module
+    /// (see <see cref="RolePermissionAction"/>); defaults to <see cref="RolePermissionAction.All"/>
+    /// so existing grants keep today's behavior until an admin narrows them.
+    /// </summary>
+    public RolePermissionAction Actions { get; set; } = RolePermissionAction.All;
+
     public Role? Role { get; set; }
     public Permission? Permission { get; set; }
 }

Backend/ERPCore/Domain/Entities/SalesDayEnd.cs

@@ -0,0 +1,56 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A cashier's end-of-day close-out. Aggregates every <see cref="SalesSlip"/> the
+/// cashier posted on <see cref="BusinessDate"/>, freezes them against this record
+/// (<see cref="SalesSlip.DayEndId"/>) so a slip can only ever belong to one day-end,
+/// and posts one consolidated GL journal entry for the day's revenue/tax/COGS —
+/// the sales-side equivalent of how <see cref="Grn"/> posts per receipt. Unique per
+/// (CashierUserId, BusinessDate): closing twice replays the existing record instead
+/// of creating a second one (same idempotent-replay pattern as Grn.ConfirmAsync).
+/// </summary>
+public class SalesDayEnd
+{
+    public int SalesDayEndId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int CashierUserId { get; set; }
+    public User? CashierUser { get; set; }
+
+    /// <summary>The calendar date being closed (matched against each slip's <see cref="SalesSlip.SlipDate"/>, UTC).</summary>
+    public DateOnly BusinessDate { get; set; }
+
+    public int SlipCount { get; set; }
+    public int BundleCount { get; set; }
+    public decimal Subtotal { get; set; }
+    public decimal DiscountTotal { get; set; }
+    public decimal TaxTotal { get; set; }
+    public decimal GrandTotal { get; set; }
+
+    /// <summary>
+    /// Sum of <see cref="SalesSlip.PaidAmount"/> across the day's slips (bundle sales have no
+    /// partial-payment field and are always counted as fully paid) — what actually gets debited
+    /// to Cash on close. <see cref="BalanceTotal"/> is the rest (<c>GrandTotal - PaidTotal</c>),
+    /// debited to Accounts Receivable instead. Before partial payments existed these were always
+    /// equal to GrandTotal/0 respectively (every sale was assumed fully cash).
+    /// </summary>
+    public decimal PaidTotal { get; set; }
+    public decimal BalanceTotal { get; set; }
+
+    /// <summary>Sum of the FIFO cost consumed for these slips (from <see cref="StockLedger"/>), for the COGS GL lines.</summary>
+    public decimal CostOfGoodsSold { get; set; }
+
+    /// <summary>Journal number of the real GL journal entry posted for this close (null when there was nothing to post).</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
+    public int ClosedBy { get; set; }
+    public User? ClosedByUser { get; set; }
+    public DateTime ClosedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token.</summary>
+    public uint RowVersion { get; set; }
+
+    public ICollection<SalesSlip> Slips { get; set; } = new List<SalesSlip>();
+    public ICollection<BundleSale> BundleSales { get; set; } = new List<BundleSale>();
+}

Backend/ERPCore/Domain/Entities/SalesInvoice.cs

@@ -17,6 +17,11 @@ public class SalesInvoice
     public int WarehouseId { get; set; }
     public Warehouse? Warehouse { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from <see cref="Warehouse"/>.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public SalesInvoiceType InvoiceType { get; set; } = SalesInvoiceType.B2C;
     public SalesInvoiceStatus Status { get; set; } = SalesInvoiceStatus.Draft;
 
@@ -29,6 +34,14 @@ public class SalesInvoice
     public decimal PaidAmount { get; set; }
     public decimal BalanceAmount { get; set; }
 
+    /// <summary>Journal number of the revenue-recognition GL journal entry posted when this
+    /// invoice is Posted (Debit Accounts Receivable / Credit Sales Revenue + Tax, plus COGS —
+    /// see SalesPostingService.PostInvoiceAsync). Unlike a SalesSlip, an invoice posts its own
+    /// GL entry immediately rather than waiting for Sales Day End, since invoices aren't a
+    /// cashier document and don't go through that close-out.</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
     public int CreatedBy { get; set; }
     public User? Creator { get; set; }
 
@@ -38,4 +51,5 @@ public class SalesInvoice
     public uint RowVersion { get; set; }
 
     public ICollection<SalesInvoiceLine> Lines { get; set; } = new List<SalesInvoiceLine>();
+    public ICollection<SalesInvoicePayment> Payments { get; set; } = new List<SalesInvoicePayment>();
 }

Backend/ERPCore/Domain/Entities/SalesInvoicePayment.cs

@@ -0,0 +1,32 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A customer payment made against a Posted sales invoice's balance (installments
+/// allowed — see SalesInvoicePaymentService.PayAsync). Posts its own real GL journal
+/// entry (Debit the selected bank-or-cash account / Credit Accounts Receivable) before
+/// being recorded here — the mirror image of <see cref="PurchaseInvoicePayment"/>.
+/// </summary>
+public class SalesInvoicePayment
+{
+    public int SalesInvoicePaymentId { get; set; }
+
+    public int SalesInvoiceId { get; set; }
+    public SalesInvoice? SalesInvoice { get; set; }
+
+    public decimal Amount { get; set; }
+    public DateTime PaymentDate { get; set; }
+
+    /// <summary>GL's numeric id for the bank/cash account the payment was received into.</summary>
+    public long GlBankAccountId { get; set; }
+    /// <summary>Snapshot of the account's display name at payment time (GL account lists have no local FK).</summary>
+    public string BankAccountName { get; set; } = string.Empty;
+
+    public string? Reference { get; set; }
+
+    /// <summary>Journal number of the real GL journal entry this payment posted.</summary>
+    public string? GlJournalNo { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+}

Backend/ERPCore/Domain/Entities/SalesReturn.cs

@@ -28,5 +28,11 @@ public class SalesReturn
 
     public DateTime CreatedAt { get; set; }
 
+    /// <summary>Journal number of the real GL journal entry posted for this return (set on create — it auto-posts).
+    /// Reverses Inventory/COGS only — <see cref="SalesReturnLine"/> carries no unit price, so revenue/tax aren't
+    /// reversed here (they'd need a per-line price this document doesn't capture).</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
     public ICollection<SalesReturnLine> Lines { get; set; } = new List<SalesReturnLine>();
 }

Backend/ERPCore/Domain/Entities/SalesSlip.cs

@@ -27,6 +27,10 @@ public class SalesSlip
     public decimal PaidAmount { get; set; }
     public decimal BalanceAmount { get; set; }
 
+    /// <summary>Set once this slip's business date is closed by <see cref="SalesDayEnd"/> — a closed slip is frozen (no further edits).</summary>
+    public int? DayEndId { get; set; }
+    public SalesDayEnd? DayEnd { get; set; }
+
     public DateTime CreatedAt { get; set; }
     public DateTime? UpdatedAt { get; set; }
 

Backend/ERPCore/Domain/Entities/SalesSlipLine.cs

@@ -19,6 +19,12 @@ public class SalesSlipLine
     public int WarehouseId { get; set; }
     public Warehouse? Warehouse { get; set; }
 
+    public int? BatchId { get; set; }
+    public Batch? Batch { get; set; }
+
+    public int? SerialId { get; set; }
+    public Serial? Serial { get; set; }
+
     public decimal UnitPrice { get; set; }
     public decimal BaseCost { get; set; }
     public string PriceSource { get; set; } = string.Empty;

Backend/ERPCore/Domain/Entities/Serial.cs

@@ -13,4 +13,7 @@ public class Serial
 
     public string SerialNo { get; set; } = string.Empty;
     public string Status { get; set; } = "InStock";
+
+    /// <summary>Optional scan code for barcode/RFID lookup (unique when set).</summary>
+    public string? Barcode { get; set; }
 }

Backend/ERPCore/Domain/Entities/StockAdjustment.cs

@@ -19,6 +19,11 @@ public class StockAdjustment
     public int ReasonCodeId { get; set; }
     public ReasonCode? ReasonCode { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from <see cref="Warehouse"/>.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public AdjustmentStatus Status { get; set; } = AdjustmentStatus.Posted;
 
     public int CreatedBy { get; set; }
@@ -27,5 +32,10 @@ public class StockAdjustment
     public DateTime CreatedAt { get; set; }
     public uint RowVersion { get; set; }
 
+    /// <summary>Journal number of the real GL journal entry posted for this adjustment (set on create — it
+    /// auto-posts). Increases and decreases post separately (never netted) so gains/losses stay visible.</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
     public ICollection<StockAdjustmentLine> Lines { get; set; } = new List<StockAdjustmentLine>();
 }

Backend/ERPCore/Domain/Entities/StockCount.cs

@@ -16,6 +16,11 @@ public class StockCount
     public int WarehouseId { get; set; }
     public Warehouse? Warehouse { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from <see cref="Warehouse"/>.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public CountType CountType { get; set; }
     public CountStatus Status { get; set; } = CountStatus.Draft;
 

Backend/ERPCore/Domain/Entities/StockCountLine.cs

@@ -16,6 +16,12 @@ public class StockCountLine
 
     public int? BinId { get; set; }
 
+    public int? BatchId { get; set; }
+    public Batch? Batch { get; set; }
+
+    public int? SerialId { get; set; }
+    public Serial? Serial { get; set; }
+
     public decimal SystemQty { get; set; }
     public decimal? CountedQty { get; set; }
     public decimal? Variance { get; set; }

Backend/ERPCore/Domain/Entities/StockTransfer.cs

@@ -19,6 +19,11 @@ public class StockTransfer
     public int DestWarehouseId { get; set; }
     public Warehouse? DestWarehouse { get; set; }
 
+    /// <summary>Owning branch, set explicitly at creation — warehouses are shared across
+    /// branches, so branch scope can no longer be derived from src/dest warehouse.</summary>
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public TransferStatus Status { get; set; } = TransferStatus.Draft;
 
     public int CreatedBy { get; set; }

Backend/ERPCore/Domain/Entities/SupportTicket.cs

@@ -0,0 +1,25 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A help-desk ticket raised by a user from the Help page. Status is
+/// admin-managed; the conversation is a flat thread of <see cref="SupportTicketMessage"/> rows.
+/// Field/concurrency shape follows the same conventions as <see cref="Employee"/>
+/// (CreatedBy/UpdatedBy actor stamps, RowVersion for optimistic concurrency).
+/// </summary>
+public class SupportTicket
+{
+    public int TicketId { get; set; }
+
+    public string Subject { get; set; } = string.Empty;
+    public TicketStatus Status { get; set; } = TicketStatus.Open;
+
+    public int CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+    public int? UpdatedBy { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public ICollection<SupportTicketMessage> Messages { get; set; } = new List<SupportTicketMessage>();
+}

Backend/ERPCore/Domain/Entities/SupportTicketMessage.cs

@@ -0,0 +1,16 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>One message in a <see cref="SupportTicket"/> thread — from the submitter or an admin.</summary>
+public class SupportTicketMessage
+{
+    public int MessageId { get; set; }
+
+    public int TicketId { get; set; }
+    public SupportTicket? Ticket { get; set; }
+
+    public int SenderUserId { get; set; }
+    public bool IsFromAdmin { get; set; }
+    public string Message { get; set; } = string.Empty;
+
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+}

Backend/ERPCore/Domain/Entities/TaxRate.cs

@@ -0,0 +1,27 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A named tax rate (e.g. "Standard" 15%, "Zero-Rated" 0%, "Exempt" 0%) — the real backing
+/// for <see cref="Item.TaxRateId"/>. Before this existed, <c>Item.TaxClass</c> was a free-text
+/// label nothing ever read, and every sales/purchase line carried its own hand-typed tax
+/// percentage with no link back to the item at all. Now a line's tax defaults to whatever
+/// percentage the item's assigned TaxRate carries at the moment the line is created — change
+/// the rate here and every new document picks it up; a line already created keeps the percentage
+/// it was given (SalesSlipLine.TaxPct etc. are snapshots, never recomputed from this table).
+/// </summary>
+public class TaxRate
+{
+    public int TaxRateId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public decimal Percentage { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}

Backend/ERPCore/Domain/Entities/Uom.cs

@@ -1,3 +1,5 @@
+using ERPCore.Domain.Enums;
+
 namespace ERPCore.Domain.Entities;
 
 /// <summary>
@@ -10,4 +12,8 @@ public class Uom
 {
     public int UomId { get; set; }
     public string Name { get; set; } = string.Empty;
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
 }

Backend/ERPCore/Domain/Entities/User.cs

@@ -31,6 +31,14 @@ public class User
     /// </summary>
     public string? Email { get; set; }
 
+    /// <summary>
+    /// Set when an admin creates the account with an issued (temporary) password
+    /// (<c>UserManagementService.CreateAsync</c>); surfaced via <c>GET /auth/me</c> so the
+    /// frontend forces a password change on first login. Cleared by
+    /// <c>POST /auth/change-password</c>.
+    /// </summary>
+    public bool MustChangePassword { get; set; }
+
     /// <summary>Local shadow <see cref="Role"/> assignment; null until an admin assigns one.</summary>
     public int? RoleId { get; set; }
     public Role? Role { get; set; }

Backend/ERPCore/Domain/Entities/Vendor.cs

@@ -14,9 +14,14 @@ public class Vendor
     public string Name { get; set; } = string.Empty;
     public string? Terms { get; set; }
     public string? TaxReg { get; set; }
+    public string? Address { get; set; }
+    public string? Phone { get; set; }
     public string Currency { get; set; } = "LKR";
     public EntityStatus Status { get; set; } = EntityStatus.Active;
 
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
     public DateTime CreatedAt { get; set; }
     public DateTime? UpdatedAt { get; set; }
 

Backend/ERPCore/Domain/Entities/Warehouse.cs

@@ -9,6 +9,10 @@ public class Warehouse
     public int WarehouseId { get; set; }
     public string Code { get; set; } = string.Empty;
     public string Name { get; set; } = string.Empty;
+    public string? Address { get; set; }
+    public string? Phone { get; set; }
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
 
     public ICollection<Bin> Bins { get; set; } = new List<Bin>();
 }

Backend/ERPCore/Domain/Enums/AuditAction.cs

@@ -5,5 +5,8 @@ public enum AuditAction
 {
     Create,
     Update,
-    Delete
+    Delete,
+    /// <summary>A successful sign-in — written explicitly (not via ErpDbContext's automatic
+    /// entity-change capture, since a login mutates nothing) by AuthController.</summary>
+    Login
 }