Merge branch 'Dev' of https://gitea.hexdive.com/New_REP_SYSTEM/ERP-core into Dev

- Implemented DashboardDateFilter component for selecting date ranges including custom options.
- Created DashboardStatGroups component to display various statistical cards grouped by categories.
- Added dashboard-chart-data module to handle chart specifications and data processing for dashboard charts.
- Introduced Chart component with tooltip and legend functionalities for better data visualization.

.gitea/workflows/ci-cd.yml

@@ -45,10 +45,24 @@ jobs:
           find /home/erp/core/publish -type f -exec chmod 644 {} +
           chmod +x /home/erp/core/publish/ERPCore
       - name: Restart service
+        # ConnectionStrings__DefaultConnection is supplied by the systemd unit on the host
+        # (Environment= or EnvironmentFile=), deliberately not committed: appsettings.json ships
+        # the key empty and appsettings.Production.json carries no ConnectionStrings section at
+        # all. If the unit does not set it, startup throws before serving and the Verify step
+        # below fails the job.
         run: systemctl restart erpcore.service
       - name: Verify
         run: |
-          systemctl is-active erpcore.service && echo "✅ Service running" || echo "❌ Service failed"
+          # `is-active ... || echo` always exited 0, so a crashed service still reported success.
+          # Wait a few seconds first: a startup failure (bad or missing connection string) happens
+          # during MigrateAsync, after systemctl restart has already returned.
+          sleep 5
+          if ! systemctl is-active --quiet erpcore.service; then
+            echo "❌ erpcore.service is not running:"
+            journalctl -u erpcore.service -n 50 --no-pager
+            exit 1
+          fi
+          echo "✅ Service running"
 
   build-and-deploy-frontend:
     name: Build & Deploy Frontend

Backend/ERPCore.Tests/AccessControlTests.cs

@@ -0,0 +1,512 @@
+using System.Security.Claims;
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Config;
+using ERPCore.Dtos.Users;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Configuration;
+using static ERPCore.Tests.TestSupport.BankDepositTestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// The ERP-owned role model: AuthHex proves who someone is; the role, its permissions and "is admin" come from the
+/// ERP's own users/roles tables, are read on every request, and a change applies on the very next one.
+/// </summary>
+public class AccessControlTests
+{
+    private const int AdminRole = 1, ApproverRole = 2, ViewerRole = 3, NoAccessRole = 4, InactiveRole = 5;
+
+    // ---------------------------------------------------------------- helpers
+
+    private sealed class FakeUser(int userId = 10, int? roleId = null, bool isAdmin = false) : ICurrentUser
+    {
+        public int AuditUserId { get; set; } = userId;
+        public int? RoleId { get; set; } = roleId;
+        public string? RoleCode { get; set; }
+        public bool IsAdmin { get; set; } = isAdmin;
+        public string UserId => AuditUserId.ToString();
+        public bool IsAuthenticated => true;
+        public int? BranchId => null;
+    }
+
+    private static async Task<ErpDbContext> SeedAsync(bool withDefault = true)
+    {
+        var db = CreateContext();
+        db.Roles.AddRange(
+            new Role { RoleId = AdminRole, Code = "Admin", Name = "Administrator", IsAdmin = true, IsSystemRole = true, CreatedAt = DateTime.UtcNow },
+            new Role { RoleId = ApproverRole, Code = "Approver", Name = "Approver", CreatedAt = DateTime.UtcNow },
+            new Role { RoleId = ViewerRole, Code = "Viewer", Name = "Viewer", CreatedAt = DateTime.UtcNow },
+            new Role { RoleId = NoAccessRole, Code = "NoAccess", Name = "No access", IsSystemRole = true, CreatedAt = DateTime.UtcNow },
+            new Role { RoleId = InactiveRole, Code = "Retired", Name = "Retired", Status = EntityStatus.Inactive, CreatedAt = DateTime.UtcNow });
+
+        db.NavItems.Add(new NavItem { NavItemId = 100, Code = "procurement", Label = "Procurement" });
+        db.SubNavItems.Add(new SubNavItem { SubNavItemId = 101, NavItemId = 100, Code = "procurement.vendors", Label = "Vendors" });
+        db.NavItems.Add(new NavItem { NavItemId = 102, Code = "stock", Label = "Stock" });
+        db.Permissions.AddRange(
+            new Permission { PermissionId = 200, Code = "NAV:procurement", NavItemId = 100 },
+            new Permission { PermissionId = 201, Code = "NAV:procurement.vendors", SubNavItemId = 101 },
+            new Permission { PermissionId = 202, Code = "NAV:stock", NavItemId = 102 });
+        db.RolePermissions.AddRange(
+            new RolePermission { RoleId = ApproverRole, PermissionId = 200, Actions = RolePermissionAction.View | RolePermissionAction.Approve },
+            new RolePermission { RoleId = ViewerRole, PermissionId = 201, Actions = RolePermissionAction.View },
+            new RolePermission { RoleId = InactiveRole, PermissionId = 202, Actions = RolePermissionAction.All });
+
+        if (withDefault) db.AccessConfig.Add(new AccessConfig { ConfigId = AccessConfig.SingletonId, DefaultRoleId = NoAccessRole });
+        await db.SaveChangesAsync();
+        return db;
+    }
+
+    private static ClaimsPrincipal Principal(Guid authUserId, string? tokenRoleCode = null)
+    {
+        var claims = new List<Claim> { new("UserId", authUserId.ToString()), new("NIC", "N-1") };
+        if (tokenRoleCode is not null) claims.Add(new Claim("RoleCode", tokenRoleCode));
+        return new ClaimsPrincipal(new ClaimsIdentity(claims, "test"));
+    }
+
+    private static ShadowUserClaimsTransformation Transformer(ErpDbContext db, bool legacyFallback = true) =>
+        new(db, new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["Auth:LegacyRoleClaimFallback"] = legacyFallback.ToString() })
+            .Build());
+
+    private static string? Claim(ClaimsPrincipal p, string type) => p.FindFirstValue(type);
+
+    private static User NewUser(Guid authId, int? roleId, EntityStatus status = EntityStatus.Active, int id = 0) => new()
+    {
+        UserId = id == 0 ? Random.Shared.Next(100, 100000) : id,
+        AuthUserId = authId, Username = $"u-{authId:N}", DisplayName = "Someone", RoleId = roleId, Status = status
+    };
+
+    private static NavPermissionService NavService(ErpDbContext db) =>
+        new(new Repository<Role>(db), new Repository<RolePermission>(db), new MemoryCache(new MemoryCacheOptions()));
+
+    private static RoleService RoleSvc(ErpDbContext db, ICurrentUser user, NavPermissionService nav) =>
+        new(new Repository<Role>(db), new Repository<RolePermission>(db), new Repository<Permission>(db), new Repository<Employee>(db),
+            new Repository<User>(db), new Repository<AccessConfig>(db), user, nav, new FakeBranchConfig(), new PassThroughUnitOfWork(db));
+
+    // The AuthHex client, link and employee services are not touched by role/status changes (users here have no AuthUserId).
+    private static UserManagementService UserSvc(ErpDbContext db, ICurrentUser user) =>
+        new(new Repository<User>(db), new Repository<Role>(db), new Repository<Employee>(db), null!, null!, null!, user, new PassThroughUnitOfWork(db));
+
+    // ---------------------------------------------------------------- claims: the role comes from the ERP
+
+    [Fact]
+    public async Task Role_IsReadFromTheErpTable_NotFromTheTokensRoleClaim()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+        db.Users.Add(NewUser(auth, ApproverRole));
+        await db.SaveChangesAsync();
+
+        // The token still says "Admin" (an old AuthHex token). The ERP says Approver, and the ERP wins.
+        var principal = await Transformer(db).TransformAsync(Principal(auth, tokenRoleCode: "Admin"));
+
+        Assert.Equal(ApproverRole.ToString(), Claim(principal, AuthHexClaims.ErpRoleId));
+        Assert.Equal("Approver", Claim(principal, AuthHexClaims.ErpRoleCode));
+        Assert.Equal("false", Claim(principal, AuthHexClaims.ErpIsAdmin));
+    }
+
+    [Fact]
+    public async Task Admin_IsTheRoleFlag_NotTheRoleName()
+    {
+        await using var db = await SeedAsync();
+        var boss = Guid.NewGuid();
+        var impostor = Guid.NewGuid();
+        db.Roles.Add(new Role { RoleId = 20, Code = "Boss", Name = "The boss", IsAdmin = true, CreatedAt = DateTime.UtcNow });
+        db.Roles.Add(new Role { RoleId = 21, Code = "ADMIN2", Name = "admin", CreatedAt = DateTime.UtcNow }); // named like an admin, is not
+        db.Users.AddRange(NewUser(boss, 20), NewUser(impostor, 21));
+        await db.SaveChangesAsync();
+
+        Assert.Equal("true", Claim(await Transformer(db).TransformAsync(Principal(boss)), AuthHexClaims.ErpIsAdmin));
+        Assert.Equal("false", Claim(await Transformer(db).TransformAsync(Principal(impostor)), AuthHexClaims.ErpIsAdmin));
+    }
+
+    [Fact]
+    public async Task RenamingTheAdminRole_DoesNotCostAnyoneTheirAdminRights()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+        db.Users.Add(NewUser(auth, AdminRole));
+        await db.SaveChangesAsync();
+
+        db.Roles.Single(r => r.RoleId == AdminRole).Code = "Owners";
+        await db.SaveChangesAsync();
+
+        var principal = await Transformer(db).TransformAsync(Principal(auth));
+        Assert.Equal("true", Claim(principal, AuthHexClaims.ErpIsAdmin));
+        Assert.Equal("Owners", Claim(principal, AuthHexClaims.ErpRoleCode));
+    }
+
+    [Fact]
+    public async Task FirstSignIn_CreatesTheUser_AndGivesItTheDefaultRole()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+
+        var principal = await Transformer(db).TransformAsync(Principal(auth));
+
+        var user = Assert.Single(db.Users.Where(u => u.AuthUserId == auth));
+        Assert.Equal(NoAccessRole, user.RoleId);                       // saved, so the Users screen shows it
+        Assert.Equal(NoAccessRole.ToString(), Claim(principal, AuthHexClaims.ErpRoleId));
+        Assert.Equal("false", Claim(principal, AuthHexClaims.ErpIsAdmin));
+        Assert.Equal(user.UserId.ToString(), Claim(principal, ClaimTypes.NameIdentifier));
+    }
+
+    [Fact]
+    public async Task WithNoDefaultRole_APersonWithoutARoleHasNoRoleClaims()
+    {
+        await using var db = await SeedAsync(withDefault: false);
+        var principal = await Transformer(db).TransformAsync(Principal(Guid.NewGuid()));
+
+        Assert.Null(Claim(principal, AuthHexClaims.ErpRoleId));
+        Assert.Null(Claim(principal, AuthHexClaims.ErpIsAdmin));
+        Assert.NotNull(Claim(principal, ClaimTypes.NameIdentifier)); // still a known user
+    }
+
+    [Fact]
+    public async Task LegacyFallback_UsesTheTokensRole_ForARolelessUser_AndSavesIt()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+        db.Users.Add(NewUser(auth, roleId: null));
+        await db.SaveChangesAsync();
+
+        var principal = await Transformer(db, legacyFallback: true).TransformAsync(Principal(auth, "Approver"));
+
+        Assert.Equal(ApproverRole.ToString(), Claim(principal, AuthHexClaims.ErpRoleId));
+        Assert.Equal(ApproverRole, db.Users.Single(u => u.AuthUserId == auth).RoleId);
+    }
+
+    [Fact]
+    public async Task LegacyFallbackOff_IgnoresTheTokenAndUsesTheDefault()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+        db.Users.Add(NewUser(auth, roleId: null));
+        await db.SaveChangesAsync();
+
+        var principal = await Transformer(db, legacyFallback: false).TransformAsync(Principal(auth, "Admin"));
+
+        Assert.Equal(NoAccessRole.ToString(), Claim(principal, AuthHexClaims.ErpRoleId));
+        Assert.Equal("false", Claim(principal, AuthHexClaims.ErpIsAdmin));
+    }
+
+    [Fact]
+    public async Task AnAssignedRole_IsNeverOverwrittenByTheFallbackOrTheDefault()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+        db.Users.Add(NewUser(auth, ViewerRole));
+        await db.SaveChangesAsync();
+
+        var principal = await Transformer(db).TransformAsync(Principal(auth, "Admin"));
+
+        Assert.Equal(ViewerRole.ToString(), Claim(principal, AuthHexClaims.ErpRoleId));
+        Assert.Equal(ViewerRole, db.Users.Single(u => u.AuthUserId == auth).RoleId);
+    }
+
+    [Fact]
+    public async Task InactiveUser_IsBlocked_AndGetsNoRole()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+        db.Users.Add(NewUser(auth, AdminRole, EntityStatus.Inactive));
+        await db.SaveChangesAsync();
+
+        var principal = await Transformer(db).TransformAsync(Principal(auth));
+
+        Assert.Equal("1", Claim(principal, AuthHexClaims.ErpBlocked));
+        Assert.Null(Claim(principal, AuthHexClaims.ErpRoleId));
+        Assert.Null(Claim(principal, AuthHexClaims.ErpIsAdmin));
+    }
+
+    [Fact]
+    public async Task InactiveRole_GrantsNothing()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+        db.Users.Add(NewUser(auth, InactiveRole));
+        await db.SaveChangesAsync();
+
+        var principal = await Transformer(db).TransformAsync(Principal(auth));
+
+        Assert.Null(Claim(principal, AuthHexClaims.ErpRoleId));
+        Assert.Null(Claim(principal, AuthHexClaims.ErpBlocked)); // not blocked — just no permissions
+    }
+
+    [Fact]
+    public async Task Branch_ComesFromTheLinkedEmployee_AndTransformingTwiceAddsNothingNew()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+        var user = NewUser(auth, ViewerRole, id: 500);
+        db.Users.Add(user);
+        db.Employees.Add(new Employee { EmployeeId = 1, EmployeeCode = "E1", FullName = "Emp", UserId = 500, BranchId = Branch2 });
+        await db.SaveChangesAsync();
+
+        var transformer = Transformer(db);
+        var principal = await transformer.TransformAsync(Principal(auth));
+        var claimsAfterFirst = principal.Claims.Count();
+        principal = await transformer.TransformAsync(principal);
+
+        Assert.Equal(Branch2.ToString(), Claim(principal, AuthHexClaims.BranchId));
+        Assert.Equal(claimsAfterFirst, principal.Claims.Count());
+    }
+
+    // ---------------------------------------------------------------- permissions by role id
+
+    [Fact]
+    public async Task Nav_AccessAndActions_AreDecidedByTheRolesPermissions()
+    {
+        await using var db = await SeedAsync();
+        var nav = NavService(db);
+
+        Assert.True(await nav.HasAccessAsync(ApproverRole, "procurement"));
+        Assert.True(await nav.HasActionAsync(ApproverRole, "procurement", RolePermissionAction.Approve));
+        Assert.False(await nav.HasActionAsync(ApproverRole, "procurement", RolePermissionAction.Delete));
+        Assert.False(await nav.HasAccessAsync(ApproverRole, "stock"));
+
+        // A parent module is reachable through a child grant; an action is exact.
+        Assert.True(await nav.HasAccessAsync(ViewerRole, "procurement"));
+        Assert.False(await nav.HasActionAsync(ViewerRole, "procurement", RolePermissionAction.View));
+        Assert.True(await nav.HasActionAsync(ViewerRole, "procurement.vendors", RolePermissionAction.View));
+
+        Assert.False(await nav.HasAccessAsync(null, "procurement"));
+        Assert.False(await nav.HasAccessAsync(999, "procurement"));
+    }
+
+    [Fact]
+    public async Task Nav_InactiveRole_HasNoAccess()
+    {
+        await using var db = await SeedAsync();
+        Assert.False(await NavService(db).HasAccessAsync(InactiveRole, "stock"));
+    }
+
+    [Fact]
+    public async Task EditingARolesPermissions_AppliesImmediately_NotAfterACacheTimeout()
+    {
+        await using var db = await SeedAsync();
+        var nav = NavService(db);
+        var roles = RoleSvc(db, new FakeUser(roleId: AdminRole, isAdmin: true), nav);
+
+        Assert.False(await nav.HasAccessAsync(ViewerRole, "stock")); // cached as "no"
+        await roles.AssignPermissionsAsync(ViewerRole, new Dtos.Rbac.AssignRolePermissionsRequest { NavItemIds = [102] });
+
+        Assert.True(await nav.HasAccessAsync(ViewerRole, "stock"));  // visible straight away
+    }
+
+    // ---------------------------------------------------------------- /auth/me
+
+    [Fact]
+    public async Task Me_ForAnAdministrator_ListsEveryPermission_EvenOnesNeverGranted()
+    {
+        await using var db = await SeedAsync();
+        var me = await RoleSvc(db, new FakeUser(roleId: AdminRole, isAdmin: true), NavService(db)).GetMeAsync();
+
+        Assert.True(me.HasRole);
+        Assert.True(me.IsAdmin);
+        Assert.Equal(AdminRole, me.RoleId);
+        Assert.Contains("procurement.vendors", me.NavCodes);
+        Assert.Contains("stock", me.NavCodes);
+        Assert.Equal((int)RolePermissionAction.All, me.Permissions!["stock"]);
+    }
+
+    [Fact]
+    public async Task Me_ForAnOrdinaryRole_ListsOnlyItsGrants_WithTheirActions()
+    {
+        await using var db = await SeedAsync();
+        var me = await RoleSvc(db, new FakeUser(roleId: ApproverRole), NavService(db)).GetMeAsync();
+
+        Assert.True(me.HasRole);
+        Assert.False(me.IsAdmin);
+        Assert.Equal(["procurement"], me.NavCodes);
+        Assert.Equal((int)(RolePermissionAction.View | RolePermissionAction.Approve), me.Permissions!["procurement"]);
+    }
+
+    [Fact]
+    public async Task Me_WithoutARole_SaysSo_InsteadOfReturningAnEmptyMenu()
+    {
+        await using var db = await SeedAsync();
+        var me = await RoleSvc(db, new FakeUser(roleId: null), NavService(db)).GetMeAsync();
+
+        Assert.False(me.HasRole);
+        Assert.Empty(me.NavCodes);
+        Assert.Empty(me.Permissions!);
+    }
+
+    // ---------------------------------------------------------------- role management guards
+
+    [Fact]
+    public async Task TheAdministratorSystemAndDefaultRoles_CannotBeDeactivatedOrDeleted()
+    {
+        await using var db = await SeedAsync();
+        var roles = RoleSvc(db, new FakeUser(roleId: AdminRole, isAdmin: true), NavService(db));
+
+        await Assert.ThrowsAsync<DomainException>(() => roles.SetStatusAsync(AdminRole, EntityStatus.Inactive));
+        await Assert.ThrowsAsync<DomainException>(() => roles.DeleteAsync(AdminRole));
+        await Assert.ThrowsAsync<DomainException>(() => roles.DeleteAsync(NoAccessRole));   // system role and the default
+        await Assert.ThrowsAsync<DomainException>(() => roles.SetStatusAsync(NoAccessRole, EntityStatus.Inactive));
+    }
+
+    [Fact]
+    public async Task ARoleInUse_CannotBeDeactivated_ButAnUnusedOneCanBeDeleted()
+    {
+        await using var db = await SeedAsync();
+        db.Users.Add(NewUser(Guid.NewGuid(), ViewerRole));
+        await db.SaveChangesAsync();
+        var roles = RoleSvc(db, new FakeUser(roleId: AdminRole, isAdmin: true), NavService(db));
+
+        await Assert.ThrowsAsync<DomainException>(() => roles.SetStatusAsync(ViewerRole, EntityStatus.Inactive));
+        await roles.DeleteAsync(ApproverRole);
+        Assert.False(db.Roles.Any(r => r.RoleId == ApproverRole));
+    }
+
+    [Fact]
+    public async Task CreatedRoles_NeverCarryTheAdminFlag()
+    {
+        await using var db = await SeedAsync();
+        var roles = RoleSvc(db, new FakeUser(roleId: AdminRole, isAdmin: true), NavService(db));
+
+        var created = (await roles.CreateAsync(new Dtos.Rbac.CreateRoleRequest { Code = "Clerk", Name = "Clerk" })).Value;
+
+        Assert.False(created.IsAdmin);
+        Assert.False(created.IsSystemRole);
+        Assert.Null(db.Roles.Single(r => r.RoleId == created.RoleId).AuthRoleId);
+    }
+
+    // ---------------------------------------------------------------- user management guards
+
+    [Fact]
+    public async Task ChangingAUsersRole_TakesEffectOnTheirNextRequest_WithNoRelogin()
+    {
+        await using var db = await SeedAsync();
+        var auth = Guid.NewGuid();
+        var user = NewUser(auth, ViewerRole, id: 700);
+        db.Users.Add(user);
+        await db.SaveChangesAsync();
+        Assert.Equal(ViewerRole.ToString(), Claim(await Transformer(db).TransformAsync(Principal(auth)), AuthHexClaims.ErpRoleId));
+
+        await UserSvc(db, new FakeUser(1, AdminRole, true)).UpdateRoleAsync(700, new UpdateUserRoleRequest { RoleId = ApproverRole });
+
+        // A fresh request for the same login now carries the new role.
+        Assert.Equal(ApproverRole.ToString(), Claim(await Transformer(db).TransformAsync(Principal(auth)), AuthHexClaims.ErpRoleId));
+    }
+
+    [Fact]
+    public async Task TheLastActiveAdministrator_CannotBeDemotedOrDeactivated()
+    {
+        await using var db = await SeedAsync();
+        db.Users.Add(NewUser(Guid.NewGuid(), AdminRole, id: 801));
+        await db.SaveChangesAsync();
+        var svc = UserSvc(db, new FakeUser(userId: 1, roleId: AdminRole, isAdmin: true));
+
+        var demote = await Assert.ThrowsAsync<DomainException>(() => svc.UpdateRoleAsync(801, new UpdateUserRoleRequest { RoleId = ViewerRole }));
+        var deactivate = await Assert.ThrowsAsync<DomainException>(() => svc.SetStatusAsync(801, EntityStatus.Inactive));
+
+        Assert.Equal(409, demote.StatusCode);
+        Assert.Equal(409, deactivate.StatusCode);
+        Assert.Equal(AdminRole, db.Users.Single(u => u.UserId == 801).RoleId);
+    }
+
+    [Fact]
+    public async Task AnAdministrator_CanBeDemoted_WhenAnotherActiveAdminRemains()
+    {
+        await using var db = await SeedAsync();
+        db.Users.AddRange(NewUser(Guid.NewGuid(), AdminRole, id: 801), NewUser(Guid.NewGuid(), AdminRole, id: 802));
+        await db.SaveChangesAsync();
+
+        await UserSvc(db, new FakeUser(userId: 802, roleId: AdminRole, isAdmin: true))
+            .UpdateRoleAsync(801, new UpdateUserRoleRequest { RoleId = ViewerRole });
+
+        Assert.Equal(ViewerRole, db.Users.Single(u => u.UserId == 801).RoleId);
+    }
+
+    [Fact]
+    public async Task Nobody_CanRemoveTheirOwnAdminAccess_OrDeactivateThemselves()
+    {
+        await using var db = await SeedAsync();
+        db.Users.AddRange(NewUser(Guid.NewGuid(), AdminRole, id: 801), NewUser(Guid.NewGuid(), AdminRole, id: 802));
+        await db.SaveChangesAsync();
+        var svc = UserSvc(db, new FakeUser(userId: 801, roleId: AdminRole, isAdmin: true));
+
+        await Assert.ThrowsAsync<DomainException>(() => svc.UpdateRoleAsync(801, new UpdateUserRoleRequest { RoleId = ViewerRole }));
+        await Assert.ThrowsAsync<DomainException>(() => svc.SetStatusAsync(801, EntityStatus.Inactive));
+    }
+
+    [Fact]
+    public async Task AUser_CannotBeGivenAnInactiveRole()
+    {
+        await using var db = await SeedAsync();
+        db.Users.Add(NewUser(Guid.NewGuid(), ViewerRole, id: 900));
+        await db.SaveChangesAsync();
+
+        await Assert.ThrowsAsync<DomainException>(
+            () => UserSvc(db, new FakeUser(1, AdminRole, true)).UpdateRoleAsync(900, new UpdateUserRoleRequest { RoleId = InactiveRole }));
+    }
+
+    // ---------------------------------------------------------------- access config (default role)
+
+    private static AccessConfigService AccessSvc(ErpDbContext db) =>
+        new(new Repository<AccessConfig>(db), new Repository<Role>(db), new FakeUser(), new PassThroughUnitOfWork(db));
+
+    [Fact]
+    public async Task TheDefaultRole_CanNeverBeAnAdministratorOrAnInactiveRole()
+    {
+        await using var db = await SeedAsync();
+        var svc = AccessSvc(db);
+        var etag = db.AccessConfig.Single().RowVersion;
+
+        await Assert.ThrowsAsync<DomainException>(() => svc.UpdateAsync(new UpdateAccessConfigRequest { DefaultRoleId = AdminRole }, etag));
+        await Assert.ThrowsAsync<DomainException>(() => svc.UpdateAsync(new UpdateAccessConfigRequest { DefaultRoleId = InactiveRole }, etag));
+        await Assert.ThrowsAsync<NotFoundException>(() => svc.UpdateAsync(new UpdateAccessConfigRequest { DefaultRoleId = 999 }, etag));
+        Assert.Equal(NoAccessRole, db.AccessConfig.Single().DefaultRoleId);
+
+        var changed = (await svc.UpdateAsync(new UpdateAccessConfigRequest { DefaultRoleId = ViewerRole }, etag)).Value;
+        Assert.Equal(("Viewer", ViewerRole), (changed.DefaultRoleName, changed.DefaultRoleId));
+    }
+
+    // ---------------------------------------------------------------- seeding
+
+    [Fact]
+    public async Task Seeder_EnsuresAnAdminRoleAndALeastPrivilegeDefault_AndIsIdempotent()
+    {
+        await using var db = CreateContext();
+        db.Database.EnsureCreated();
+
+        await DataSeeder.SeedAsync(db);
+        await DataSeeder.SeedAsync(db);
+
+        var admin = Assert.Single(db.Roles.Where(r => r.IsAdmin));
+        Assert.True(admin.IsSystemRole);
+        Assert.Equal(db.Permissions.Count(), db.RolePermissions.Count(rp => rp.RoleId == admin.RoleId));
+        var noAccess = Assert.Single(db.Roles.Where(r => r.Code == DataSeeder.DefaultNoAccessRoleCode));
+        Assert.Empty(db.RolePermissions.Where(rp => rp.RoleId == noAccess.RoleId));
+        Assert.Equal(noAccess.RoleId, Assert.Single(db.AccessConfig).DefaultRoleId);
+    }
+
+    [Fact]
+    public async Task Seeder_FlagsAnExistingRoleCalledAdmin_InsteadOfAddingASecond_AndKeepsAChosenDefault()
+    {
+        await using var db = CreateContext();
+        db.Database.EnsureCreated();
+        db.Roles.Add(new Role { RoleId = 50, Code = "ADMIN", Name = "Old admin", CreatedAt = DateTime.UtcNow });
+        db.Roles.Add(new Role { RoleId = 51, Code = "Reader", Name = "Reader", CreatedAt = DateTime.UtcNow });
+        await db.SaveChangesAsync();
+
+        await DataSeeder.SeedAsync(db);
+        db.AccessConfig.Single().DefaultRoleId = 51; // an administrator's own choice
+        await db.SaveChangesAsync();
+        await DataSeeder.SeedAsync(db);
+
+        Assert.True(db.Roles.Single(r => r.RoleId == 50).IsAdmin);
+        Assert.Equal(1, db.Roles.Count(r => r.IsAdmin));
+        Assert.Equal(51, db.AccessConfig.Single().DefaultRoleId);
+    }
+}

Backend/ERPCore.Tests/BankDepositServiceTests.cs

@@ -0,0 +1,211 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Accounts;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using static ERPCore.Tests.TestSupport.BankDepositTestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>Recording and cancelling bank deposits (docs/BANK_DEPOSIT_MODULE_PLAN.md §7.2, §11).</summary>
+public class BankDepositServiceTests
+{
+    private static readonly DateOnly Today = Clock.Today;
+    private static readonly DateOnly Start = Today.AddDays(-10);
+    private static readonly DateOnly Day = Today.AddDays(-2);
+
+    [Fact]
+    public async Task Create_PostsBankDebitCashCredit_AndLowersCashInHand()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+        var gl = new FakeGeneralLedger();
+
+        var dto = await DepositService(db, Start, gl).CreateAsync(Request(600, depositDate: Day.AddDays(1)));
+
+        Assert.Equal(BankDepositStatus.Posted, dto.Status);
+        Assert.Equal(("BOC Current", "Bank of Ceylon", "0001234567"), (dto.ToBankAccountName, dto.ToBankName, dto.ToAccountNumber));
+        Assert.Equal("JE-1", dto.GlJournalNo);
+
+        var entry = Assert.Single(gl.Posted);
+        Assert.Equal(Day.AddDays(1), entry.EntryDate);
+        Assert.Equal("BANK_DEPOSIT", entry.SourceModule);
+        Assert.Collection(entry.Lines,
+            l => Assert.Equal(("1010-01", 600m, 0m), (l.AccountCode, l.DebitAmount, l.CreditAmount)),
+            l => Assert.Equal(("1000-01", 0m, 600m), (l.AccountCode, l.DebitAmount, l.CreditAmount)));
+
+        var position = await CashService(db, Start).GetPositionAsync(Day, Branch1);
+        Assert.Equal((600m, 400m), (position.Position.Deposited, position.Position.Closing));
+    }
+
+    [Fact]
+    public async Task Create_MoreThanCashInHand_IsRejected()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000, card: 5000));
+        await db.SaveChangesAsync();
+        var gl = new FakeGeneralLedger();
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => DepositService(db, Start, gl).CreateAsync(Request(1000.01m)));
+
+        Assert.Equal(ErrorCodes.BankDepositExceedsCashInHand, ex.Code);
+        Assert.Empty(gl.Posted);
+    }
+
+    [Fact]
+    public async Task Create_BackDatedDepositThatOverdrawsALaterDay_IsRejected()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        db.BankDeposits.Add(Deposit(Day.AddDays(1), 900));     // the next day already banked most of it
+        await db.SaveChangesAsync();
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            DepositService(db, Start, new FakeGeneralLedger()).CreateAsync(Request(500)));
+
+        Assert.Equal(ErrorCodes.BankDepositExceedsCashInHand, ex.Code);
+        Assert.Contains("100.00", ex.Message);
+    }
+
+    [Fact]
+    public async Task Cancel_ReversesGl_AndPutsTheCashBack()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+        var gl = new FakeGeneralLedger();
+        var service = DepositService(db, Start, gl);
+        var created = await service.CreateAsync(Request(1000));
+
+        var cancelled = await service.CancelAsync(created.BankDepositId, new CancelBankDepositRequest { Reason = " wrong bank " });
+
+        Assert.Equal(BankDepositStatus.Cancelled, cancelled.Status);
+        Assert.Equal("wrong bank", cancelled.CancelReason);
+        Assert.Equal("JE-2", cancelled.GlReversalJournalNo);
+        Assert.Collection(gl.Posted[1].Lines,
+            l => Assert.Equal(("1000-01", 1000m, 0m), (l.AccountCode, l.DebitAmount, l.CreditAmount)),
+            l => Assert.Equal(("1010-01", 0m, 1000m), (l.AccountCode, l.DebitAmount, l.CreditAmount)));
+        Assert.Equal(1000m, (await CashService(db, Start).GetPositionAsync(Day, Branch1)).Position.Closing);
+
+        var again = await Assert.ThrowsAsync<DomainException>(() =>
+            service.CancelAsync(created.BankDepositId, new CancelBankDepositRequest { Reason = "again" }));
+        Assert.Equal(ErrorCodes.BankDepositNotCancellable, again.Code);
+    }
+
+    [Theory]
+    [InlineData(FakeGeneralLedger.BankAccountId, FakeGeneralLedger.BankAccountId, ErrorCodes.BankDepositCashAccountInvalid)]
+    [InlineData(FakeGeneralLedger.CashAccountId, FakeGeneralLedger.CashAccountId, ErrorCodes.BankDepositBankAccountInvalid)]
+    [InlineData(99L, FakeGeneralLedger.BankAccountId, ErrorCodes.BankDepositCashAccountInvalid)]
+    public async Task Create_WrongAccountTypes_AreRejected(long from, long to, string code)
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+
+        var request = Request(100);
+        request.FromGlCashAccountId = from;
+        request.ToGlBankAccountId = to;
+        var ex = await Assert.ThrowsAsync<DomainException>(() => DepositService(db, Start, new FakeGeneralLedger()).CreateAsync(request));
+
+        Assert.Equal(code, ex.Code);
+    }
+
+    [Fact]
+    public async Task Create_CashAndBankAccountsSharingAnId_AreToldApartByType()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+        // GL numbers cash and bank accounts in separate tables, so both can be account 1.
+        var gl = new FakeGeneralLedger
+        {
+            Accounts =
+            [
+                new("Cash", 1, "main", null, "Cash in Transit", "CASH-000001", 22, "1400-01-01", "LKR"),
+                new("Bank", 1, "Main - 01", "Commercial Bank", null, "2032434543", 2, "1000-01", "LKR")
+            ]
+        };
+        var request = Request(400);
+        request.FromGlCashAccountId = 1;
+        request.ToGlBankAccountId = 1;
+
+        var dto = await DepositService(db, Start, gl).CreateAsync(request);
+
+        Assert.Equal(("main", "Main - 01"), (dto.FromCashAccountName, dto.ToBankAccountName));
+        Assert.Collection(Assert.Single(gl.Posted).Lines,
+            l => Assert.Equal(("1000-01", 400m), (l.AccountCode, l.DebitAmount)),
+            l => Assert.Equal(("1400-01-01", 400m), (l.AccountCode, l.CreditAmount)));
+    }
+
+    [Fact]
+    public async Task Create_CannotUseAnotherBranchsCash()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000, warehouseId: Warehouse2));
+        await db.SaveChangesAsync();
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            DepositService(db, Start, new FakeGeneralLedger()).CreateAsync(Request(100, branchId: Branch1)));
+
+        Assert.Equal(ErrorCodes.BankDepositExceedsCashInHand, ex.Code);
+    }
+
+    [Theory]
+    [InlineData(-11, null)]   // before tracking starts
+    [InlineData(1, null)]     // business date in the future
+    [InlineData(-2, -3)]      // deposited before the business day
+    [InlineData(-2, 2)]       // deposit date beyond tomorrow
+    public async Task Create_InvalidDates_AreRejected(int businessOffset, int? depositOffset)
+    {
+        await using var db = CreateContext();
+        var request = Request(100);
+        request.BusinessDate = Today.AddDays(businessOffset);
+        request.DepositDate = depositOffset is { } d ? Today.AddDays(d) : null;
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => DepositService(db, Start, new FakeGeneralLedger()).CreateAsync(request));
+
+        Assert.Equal(ErrorCodes.BankDepositDateInvalid, ex.Code);
+    }
+
+    [Fact]
+    public async Task Create_GlRejection_LeavesNoDeposit()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.Add(CashSlip(Day, 1000));
+        await db.SaveChangesAsync();
+
+        await Assert.ThrowsAsync<DomainException>(() =>
+            DepositService(db, Start, new FakeGeneralLedger { Reject = true }).CreateAsync(Request(500)));
+
+        Assert.Equal(0, await db.BankDeposits.CountAsync());
+    }
+
+    [Fact]
+    public async Task List_FiltersAndTotalsEveryMatchingRow()
+    {
+        await using var db = CreateContext();
+        db.BankDeposits.AddRange(
+            Deposit(Day, 100), Deposit(Day, 200), Deposit(Day.AddDays(-1), 400),
+            Deposit(Day, 800, branchId: Branch2), Deposit(Day, 1600, status: BankDepositStatus.Cancelled));
+        await db.SaveChangesAsync();
+
+        var result = await DepositService(db, Start, new FakeGeneralLedger()).ListAsync(
+            new() { PageSize = 1 }, new BankDepositListFilter(Day, Day, Branch1, null, BankDepositStatus.Posted));
+
+        Assert.Single(result.Items);
+        Assert.Equal(2, result.Pagination.TotalItems);
+        Assert.Equal(300m, result.TotalAmount);
+    }
+
+    private static CreateBankDepositRequest Request(decimal amount, int branchId = Branch1, DateOnly? depositDate = null) => new()
+    {
+        BranchId = branchId,
+        BusinessDate = Day,
+        DepositDate = depositDate,
+        Amount = amount,
+        FromGlCashAccountId = FakeGeneralLedger.CashAccountId,
+        ToGlBankAccountId = FakeGeneralLedger.BankAccountId,
+        DepositSlipNo = "SLIP-1"
+    };
+}

Backend/ERPCore.Tests/CashInHandServiceTests.cs

@@ -0,0 +1,134 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using static ERPCore.Tests.TestSupport.BankDepositTestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>Till cash in hand (docs/BANK_DEPOSIT_MODULE_PLAN.md §2, §11).</summary>
+public class CashInHandServiceTests
+{
+    private static readonly DateOnly Today = Clock.Today;
+    private static readonly DateOnly Start = Today.AddDays(-10);
+
+    [Fact]
+    public async Task OnlyCashIsCounted()
+    {
+        await using var db = CreateContext();
+        var day = Today.AddDays(-2);
+        db.SalesSlips.AddRange(
+            CashSlip(day, cash: 300, card: 200),   // only the 300 is till cash
+            CashSlip(day, cash: 0, card: 900));
+        db.SalesInvoices.Add(new SalesInvoice
+        {
+            SalesInvoiceId = 1, InvoiceNo = "INV-1", InvoiceDate = At(day.AddDays(-5)), Status = SalesInvoiceStatus.Posted, BranchId = Branch1
+        });
+        db.SalesInvoicePayments.AddRange(
+            new SalesInvoicePayment { SalesInvoicePaymentId = 1, SalesInvoiceId = 1, PaymentDate = At(day), PaymentMethod = SalesPaymentMethod.Cash, Amount = 150 },
+            new SalesInvoicePayment { SalesInvoicePaymentId = 2, SalesInvoiceId = 1, PaymentDate = At(day), PaymentMethod = SalesPaymentMethod.Card, Amount = 500 },
+            new SalesInvoicePayment { SalesInvoicePaymentId = 3, SalesInvoiceId = 1, PaymentDate = At(day), PaymentMethod = SalesPaymentMethod.Cheque, Amount = 70 });
+        db.Expenses.Add(new Expense { ExpenseId = 1, DocNo = "EXP-1", BranchId = Branch1, ExpenseDate = day, Amount = 100, Status = ExpenseStatus.Posted });
+        db.ExpensePayments.AddRange(
+            new ExpensePayment { ExpensePaymentId = 1, ExpenseId = 1, PaymentDate = At(day), PaymentMethod = ExpensePaymentMethod.Cash, Amount = 40 },
+            new ExpensePayment { ExpensePaymentId = 2, ExpenseId = 1, PaymentDate = At(day), PaymentMethod = ExpensePaymentMethod.BankTransfer, Amount = 60 });
+        await db.SaveChangesAsync();
+
+        var p = (await CashService(db, Start).GetPositionAsync(day, Branch1)).Position;
+
+        Assert.Equal(450m, p.CashIn);
+        Assert.Equal(40m, p.CashOut);
+        Assert.Equal(410m, p.NetCash);
+        Assert.Equal(410m, p.Closing);
+    }
+
+    [Fact]
+    public async Task UndepositedCash_CarriesToTheNextDay_AndDepositsReduceIt()
+    {
+        await using var db = CreateContext();
+        var d1 = Today.AddDays(-3);
+        var d2 = Today.AddDays(-2);
+        db.SalesSlips.AddRange(CashSlip(d1, 1000), CashSlip(d2, 500));
+        db.BankDeposits.AddRange(
+            Deposit(d1, 600),
+            Deposit(d1, 999, status: BankDepositStatus.Cancelled));   // ignored
+        await db.SaveChangesAsync();
+
+        var days = (await CashService(db, Start).GetDailyAsync(d1, d2, Branch1)).Days;
+
+        Assert.Equal((0m, 1000m, 600m, 400m), (days[0].Opening, days[0].NetCash, days[0].Deposited, days[0].Closing));
+        Assert.Equal((400m, 500m, 0m, 900m), (days[1].Opening, days[1].NetCash, days[1].Deposited, days[1].Closing));
+    }
+
+    [Fact]
+    public async Task Opening_IsCarriedInFromBeforeTheWindow()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.AddRange(CashSlip(Today.AddDays(-6), 700), CashSlip(Today.AddDays(-5), 300));
+        db.BankDeposits.Add(Deposit(Today.AddDays(-5), 200));
+        await db.SaveChangesAsync();
+
+        var day = (await CashService(db, Start).GetPositionAsync(Today.AddDays(-1), Branch1)).Position;
+
+        Assert.Equal(800m, day.Opening);
+        Assert.Equal(800m, day.Closing);
+    }
+
+    [Fact]
+    public async Task CashBeforeTheTrackingStart_IsNotCarried()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.AddRange(CashSlip(Start.AddDays(-1), 5000), CashSlip(Start, 100));
+        await db.SaveChangesAsync();
+
+        var days = (await CashService(db, Start).GetDailyAsync(Start.AddDays(-1), Start, Branch1)).Days;
+
+        Assert.Equal(5000m, days[0].NetCash);      // still reported for the day itself
+        Assert.Equal(0m, days[1].Opening);         // but not carried into tracking
+        Assert.Equal(100m, days[1].Closing);
+    }
+
+    [Fact]
+    public async Task Available_IsTheLowestClosingFromThatDayToToday()
+    {
+        await using var db = CreateContext();
+        var d1 = Today.AddDays(-2);
+        db.SalesSlips.Add(CashSlip(d1, 1000));
+        db.BankDeposits.Add(Deposit(Today.AddDays(-1), 800));      // already took most of it the next day
+        await db.SaveChangesAsync();
+
+        var position = await CashService(db, Start).GetPositionAsync(d1, Branch1);
+
+        Assert.Equal(1000m, position.Position.Closing);
+        Assert.Equal(200m, position.AvailableToDeposit);
+    }
+
+    [Fact]
+    public async Task Branches_AreKeptApart()
+    {
+        await using var db = CreateContext();
+        var day = Today.AddDays(-1);
+        db.SalesSlips.AddRange(CashSlip(day, 100, warehouseId: Warehouse1), CashSlip(day, 900, warehouseId: Warehouse2));
+        await db.SaveChangesAsync();
+
+        var service = CashService(db, Start);
+
+        Assert.Equal(100m, (await service.GetPositionAsync(day, Branch1)).Position.Closing);
+        Assert.Equal(900m, (await service.GetPositionAsync(day, Branch2)).Position.Closing);
+        Assert.Equal(1000m, (await service.GetPositionAsync(day, null)).Position.Closing);
+    }
+
+    [Fact]
+    public async Task LateEveningSale_CountsOnTheLocalDay()
+    {
+        await using var db = CreateContext();
+        var day = Today.AddDays(-1);
+        var slip = CashSlip(day, 250);
+        slip.SlipDate = Clock.ToUtc(day.AddDays(1)).AddMinutes(-30);    // 23:30 local
+        db.SalesSlips.Add(slip);
+        await db.SaveChangesAsync();
+
+        var days = (await CashService(db, Start).GetDailyAsync(day, day.AddDays(1), Branch1)).Days;
+
+        Assert.Equal(250m, days[0].CashIn);
+        Assert.Equal(0m, days[1].CashIn);
+    }
+}

Backend/ERPCore.Tests/CustomerFieldSwitchTests.cs

@@ -0,0 +1,156 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Dtos.Customers;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using static ERPCore.Tests.TestSupport.BankDepositTestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// Sales Configuration decides which optional customer fields exist (phone, email, address, city, country, credit limit,
+/// credit days). The forms hide a switched-off field; the server refuses a new value for it and keeps what is stored.
+/// </summary>
+public class CustomerFieldSwitchTests
+{
+    private static CustomerService Svc(ErpDbContext db) =>
+        new(new CustomerRepository(db), new FakeBranchConfig(), new PassThroughUnitOfWork(db));
+
+    private static async Task SwitchesAsync(ErpDbContext db, Action<SalesConfig> tweak)
+    {
+        var config = new SalesConfig { ConfigId = SalesConfig.SingletonId };
+        tweak(config);
+        db.SalesConfig.Add(config);
+        await db.SaveChangesAsync();
+    }
+
+    private static CreateCustomerRequest NewCustomer(Action<CreateCustomerRequest>? tweak = null)
+    {
+        var request = new CreateCustomerRequest { CustomerCode = "C-1", Name = "Nimal Perera", BranchId = Branch1 };
+        tweak?.Invoke(request);
+        return request;
+    }
+
+    private static UpdateCustomerRequest Same(Customer c, Action<UpdateCustomerRequest>? tweak = null)
+    {
+        var request = new UpdateCustomerRequest
+        {
+            CustomerCode = c.CustomerCode, CustomerType = c.CustomerType, Name = c.Name, DisplayName = c.DisplayName,
+            Phone = c.Phone, Email = c.Email, AddressLine1 = c.AddressLine1, AddressLine2 = c.AddressLine2,
+            City = c.City, Country = c.Country, TaxRegistrationNo = c.TaxRegistrationNo,
+            CreditLimit = c.CreditLimit, CreditDays = c.CreditDays, BranchId = c.BranchId
+        };
+        tweak?.Invoke(request);
+        return request;
+    }
+
+    [Fact]
+    public async Task EveryFieldIsOn_WhenNothingIsConfigured_SoExistingBehaviourIsUnchanged()
+    {
+        await using var db = CreateContext(); // no sales_config row at all
+
+        var created = (await Svc(db).CreateAsync(NewCustomer(r =>
+        {
+            r.Phone = "0771234567"; r.Email = "a@b.lk"; r.AddressLine1 = "No. 12"; r.City = "Colombo";
+            r.Country = "Sri Lanka"; r.CreditLimit = 5000m; r.CreditDays = 30;
+        }))).Value;
+
+        Assert.Equal(("0771234567", "a@b.lk", "No. 12", "Colombo", "Sri Lanka"), (created.Phone, created.Email, created.AddressLine1, created.City, created.Country));
+        Assert.Equal((5000m, 30), (created.CreditLimit, created.CreditDays));
+    }
+
+    [Theory]
+    [InlineData("phone")]
+    [InlineData("email")]
+    [InlineData("address")]
+    [InlineData("city")]
+    [InlineData("country")]
+    [InlineData("creditLimit")]
+    [InlineData("creditDays")]
+    public async Task Create_ANewValueForASwitchedOffField_IsRefused(string field)
+    {
+        await using var db = CreateContext();
+        await SwitchesAsync(db, c =>
+        {
+            c.CustomerPhoneEnabled = field != "phone";
+            c.CustomerEmailEnabled = field != "email";
+            c.CustomerAddressEnabled = field != "address";
+            c.CustomerCityEnabled = field != "city";
+            c.CustomerCountryEnabled = field != "country";
+            c.CustomerCreditLimitEnabled = field != "creditLimit";
+            c.CustomerCreditDaysEnabled = field != "creditDays";
+        });
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => Svc(db).CreateAsync(NewCustomer(r =>
+        {
+            switch (field)
+            {
+                case "phone": r.Phone = "0771234567"; break;
+                case "email": r.Email = "a@b.lk"; break;
+                case "address": r.AddressLine2 = "Wellawatte"; break;
+                case "city": r.City = "Colombo"; break;
+                case "country": r.Country = "Sri Lanka"; break;
+                case "creditLimit": r.CreditLimit = 100m; break;
+                default: r.CreditDays = 7; break;
+            }
+        })));
+
+        Assert.Equal(ErrorCodes.ConfigDisabled, ex.Code);
+        Assert.Equal(422, ex.StatusCode);
+        Assert.Empty(db.Customers.Where(c => c.CustomerCode == "C-1"));
+    }
+
+    [Fact]
+    public async Task Create_WithTheSwitchedOffFieldsLeftBlank_Works()
+    {
+        await using var db = CreateContext();
+        await SwitchesAsync(db, c =>
+        {
+            c.CustomerPhoneEnabled = c.CustomerEmailEnabled = c.CustomerAddressEnabled = false;
+            c.CustomerCityEnabled = c.CustomerCountryEnabled = false;
+            c.CustomerCreditLimitEnabled = c.CustomerCreditDaysEnabled = false;
+        });
+
+        var created = (await Svc(db).CreateAsync(NewCustomer())).Value;
+
+        Assert.Equal("Nimal Perera", created.Name);
+        Assert.Null(created.Phone);
+        Assert.Equal((0m, 0), (created.CreditLimit, created.CreditDays));
+    }
+
+    [Fact]
+    public async Task Update_KeepsAStoredValueWhoseFieldWasSwitchedOff_EvenWhenTheFormSendsItBlank()
+    {
+        await using var db = CreateContext();
+        var svc = Svc(db);
+        var created = (await svc.CreateAsync(NewCustomer(r => { r.Phone = "0771234567"; r.CreditLimit = 5000m; r.CreditDays = 30; }))).Value;
+
+        await SwitchesAsync(db, c => { c.CustomerPhoneEnabled = false; c.CustomerCreditLimitEnabled = false; c.CustomerCreditDaysEnabled = false; });
+        var stored = db.Customers.Single(c => c.CustomerId == created.CustomerId);
+
+        // The edit form no longer has the fields, so it sends blanks / zeros.
+        var updated = (await svc.UpdateAsync(created.CustomerId,
+            Same(stored, r => { r.Name = "Nimal P."; r.Phone = null; r.CreditLimit = 0m; r.CreditDays = 0; }), stored.RowVersion)).Value;
+
+        Assert.Equal("Nimal P.", updated.Name);
+        Assert.Equal("0771234567", updated.Phone);
+        Assert.Equal((5000m, 30), (updated.CreditLimit, updated.CreditDays));
+    }
+
+    [Fact]
+    public async Task Update_ADifferentValueForASwitchedOffField_IsRefused()
+    {
+        await using var db = CreateContext();
+        var svc = Svc(db);
+        var created = (await svc.CreateAsync(NewCustomer(r => r.CreditLimit = 5000m))).Value;
+        await SwitchesAsync(db, c => c.CustomerCreditLimitEnabled = false);
+        var stored = db.Customers.Single(c => c.CustomerId == created.CustomerId);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => svc.UpdateAsync(created.CustomerId, Same(stored, r => r.CreditLimit = 9999m), stored.RowVersion));
+
+        Assert.Equal(ErrorCodes.ConfigDisabled, ex.Code);
+    }
+}

Backend/ERPCore.Tests/DayEndReportServiceTests.cs

@@ -0,0 +1,252 @@
+using ERPCore.Domain;
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+using Microsoft.Extensions.Configuration;
+
+namespace ERPCore.Tests;
+
+/// <summary>Aggregates of the Day-End Sales Report (docs/DAY_END_SALES_REPORT_PLAN.md §7).</summary>
+public class DayEndReportServiceTests
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    // Asia/Colombo is UTC+05:30 all year (no DST), so local midnight is 18:30 UTC the day before.
+    private static readonly DateOnly Day = new(2026, 10, 8);
+    private static DateTime UtcAt(int hour, int minute = 0) => new(2026, 10, 8, hour, minute, 0, DateTimeKind.Utc);
+
+    [Fact]
+    public async Task Day_MixOfSlipsBundlesAndInvoices_TotalsAndSplitsByMethod()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.AddRange(
+            Slip(1, UtcAt(5), total: 1000, paid: 600, cash: 400, card: 200),   // partial, mixed
+            Slip(2, UtcAt(6), total: 200, paid: 200, cash: 200, card: 0),      // all cash
+            Slip(3, UtcAt(7), total: 999, paid: 999, cash: 999, card: 0, status: SalesSlipStatus.Draft));
+        db.BundleSales.Add(new BundleSale { BundleSaleId = 1, BundleDate = UtcAt(8), Status = BundleSaleStatus.Posted, GrandTotal = 500, CashAmount = 0, CardAmount = 500 });
+        db.SalesInvoices.Add(Invoice(1, UtcAt(9), netPayable: 2000, paid: 1500));
+        db.SalesInvoicePayments.AddRange(
+            Payment(1, invoiceId: 1, UtcAt(9), SalesPaymentMethod.Cash, 500),
+            Payment(2, invoiceId: 1, UtcAt(10), SalesPaymentMethod.Card, 1000));
+        SeedExpenseSetup(db);
+        db.Expenses.AddRange(
+            Expense(1, Day, 300, ExpenseStatus.Posted),
+            Expense(2, Day, 700, ExpenseStatus.Cancelled),
+            Expense(3, Day.AddDays(1), 50, ExpenseStatus.Posted));
+        await db.SaveChangesAsync();
+
+        var report = await CreateService(db).GetDayAsync(Day, null);
+        var s = report.Summary;
+
+        Assert.Equal(3700m, s.TotalSales);
+        Assert.Equal(2800m, s.PaidAmount);
+        Assert.Equal(900m, s.DueAmount);
+        Assert.Equal(1100m, s.PaidByCash);
+        Assert.Equal(1700m, s.PaidByCard);
+        Assert.Equal(0m, s.PaidByOther);
+        Assert.Equal(4, s.SalesCount);
+        Assert.Equal(1, s.CashSalesCount);
+        Assert.Equal(1, s.CardSalesCount);
+        Assert.Equal(2, s.MixedSalesCount);
+        Assert.Equal(0, s.UnpaidSalesCount);
+        Assert.Equal(300m, s.ExpenseTotal);
+        Assert.Equal(3400m, s.Income);
+        Assert.Single(report.Expenses);
+        Assert.Equal("Electricity", report.Expenses[0].TitleName);
+    }
+
+    [Fact]
+    public async Task Day_SaleLateInTheLocalEvening_CountsOnTheLocalDay()
+    {
+        await using var db = CreateContext();
+        // 19:00 UTC on Oct 7 is 00:30 on Oct 8 in Colombo; 18:00 UTC on Oct 8 is 23:30 on Oct 8.
+        db.SalesSlips.AddRange(
+            Slip(1, new DateTime(2026, 10, 7, 19, 0, 0, DateTimeKind.Utc), total: 100, paid: 100, cash: 100, card: 0),
+            Slip(2, new DateTime(2026, 10, 8, 18, 0, 0, DateTimeKind.Utc), total: 40, paid: 40, cash: 40, card: 0),
+            Slip(3, new DateTime(2026, 10, 8, 19, 0, 0, DateTimeKind.Utc), total: 7, paid: 7, cash: 7, card: 0));
+        await db.SaveChangesAsync();
+
+        var report = await CreateService(db).GetDailyAsync(Day.AddDays(-1), Day.AddDays(1), null);
+
+        Assert.Equal([0m, 140m, 7m], report.Days.Select(d => d.TotalSales));
+        Assert.Equal(147m, report.Totals.TotalSales);
+    }
+
+    [Fact]
+    public async Task Day_PaymentOnAnEarlierInvoice_IsACollectionAndCountsInNetCash()
+    {
+        await using var db = CreateContext();
+        db.SalesInvoices.Add(Invoice(1, UtcAt(5).AddDays(-3), netPayable: 800, paid: 250));
+        db.SalesInvoicePayments.Add(Payment(1, invoiceId: 1, UtcAt(6), SalesPaymentMethod.Cash, 250));
+        db.SalesSlips.Add(Slip(1, UtcAt(7), total: 60, paid: 60, cash: 60, card: 0));
+        SeedExpenseSetup(db);
+        db.Expenses.Add(Expense(1, Day, 30, ExpenseStatus.Posted));
+        db.ExpensePayments.Add(new ExpensePayment { ExpensePaymentId = 1, ExpenseId = 1, Amount = 30, PaymentDate = UtcAt(8), PaymentMethod = ExpensePaymentMethod.Cash });
+        await db.SaveChangesAsync();
+
+        var s = (await CreateService(db).GetDayAsync(Day, null)).Summary;
+
+        Assert.Equal(60m, s.TotalSales);
+        Assert.Equal(60m, s.PaidAmount);
+        Assert.Equal(250m, s.EarlierInvoiceCollections);
+        Assert.Equal(60m + 250m - 30m, s.NetCash);
+    }
+
+    [Fact]
+    public async Task Day_ShowsBankDepositsAndTheCashLeftInHand()
+    {
+        await using var db = CreateContext();
+        db.SalesSlips.AddRange(
+            Slip(1, UtcAt(5).AddDays(-1), total: 300, paid: 300, cash: 300, card: 0),   // yesterday, never banked
+            Slip(2, UtcAt(6), total: 1000, paid: 1000, cash: 1000, card: 0));
+        db.BankDeposits.AddRange(
+            BankDeposit(1, Day, 800, BankDepositStatus.Posted),
+            BankDeposit(2, Day, 5000, BankDepositStatus.Cancelled));
+        await db.SaveChangesAsync();
+
+        var report = await CreateService(db).GetDayAsync(Day, null);
+        var s = report.Summary;
+
+        Assert.Equal((300m, 1000m, 800m, 500m), (s.OpeningCashInHand, s.NetCash, s.CashDeposited, s.ClosingCashInHand));
+        var deposit = Assert.Single(report.Deposits);
+        Assert.Equal(("BD-1", "BOC Current", 800m), (deposit.DocNo, deposit.BankAccountName, deposit.Amount));
+
+        var range = await CreateService(db).GetDailyAsync(Day.AddDays(-1), Day, null);
+        Assert.Equal((0m, 800m, 500m), (range.Totals.OpeningCashInHand, range.Totals.CashDeposited, range.Totals.ClosingCashInHand));
+    }
+
+    [Fact]
+    public async Task Day_Profit_IsSalesLessStockCostLessExpenses_AndCanBeALoss()
+    {
+        await using var db = CreateContext();
+        db.SalesInvoices.Add(Invoice(1, UtcAt(5), netPayable: 1000, paid: 1000));
+        db.SalesInvoicePayments.Add(Payment(1, invoiceId: 1, UtcAt(5), SalesPaymentMethod.Card, 1000));
+        db.SalesSlips.Add(Slip(1, UtcAt(6), total: 200, paid: 0, cash: 0, card: 0));
+        db.StockLedger.AddRange(
+            Ledger(1, DocumentTypes.SalesInvoice, 1, Direction.Out, 600),
+            Ledger(2, DocumentTypes.SalesInvoice, 1, Direction.Out, 100),
+            Ledger(3, DocumentTypes.SalesSlip, 1, Direction.Out, 150),
+            Ledger(4, DocumentTypes.SalesInvoice, 1, Direction.In, 999));   // not a sale's cost
+        SeedExpenseSetup(db);
+        db.Expenses.Add(Expense(1, Day, 900, ExpenseStatus.Posted));
+        await db.SaveChangesAsync();
+
+        var report = await CreateService(db).GetDayAsync(Day, null);
+        var s = report.Summary;
+
+        Assert.Equal(850m, s.CostOfGoodsSold);
+        Assert.Equal(350m, s.GrossProfit);
+        Assert.Equal(-550m, s.NetProfit);
+        Assert.Equal(2, report.Sales.Count);
+        var invoice = report.Sales.Single(x => x.DocType == "Invoice");
+        Assert.Equal(("Card", 700m, 300m), (invoice.PaidBy, invoice.Cost, invoice.GrossProfit));
+        Assert.Equal("Unpaid", report.Sales.Single(x => x.DocType == "Slip").PaidBy);
+    }
+
+    [Fact]
+    public async Task Day_UnpaidInvoice_CountsAsUnpaidAndDue()
+    {
+        await using var db = CreateContext();
+        db.SalesInvoices.Add(Invoice(1, UtcAt(5), netPayable: 450, paid: 0));
+        await db.SaveChangesAsync();
+
+        var s = (await CreateService(db).GetDayAsync(Day, null)).Summary;
+
+        Assert.Equal(1, s.UnpaidSalesCount);
+        Assert.Equal(450m, s.DueAmount);
+    }
+
+    [Fact]
+    public async Task Daily_FillsQuietDaysWithZeros()
+    {
+        await using var db = CreateContext();
+        var report = await CreateService(db).GetDailyAsync(Day, Day.AddDays(4), null);
+
+        Assert.Equal(5, report.Days.Count);
+        Assert.All(report.Days, d => Assert.Equal(0m, d.Income));
+        Assert.Equal(Day.AddDays(4), report.Days[^1].Date);
+    }
+
+    [Theory]
+    [InlineData(1, 0)]   // to before from
+    [InlineData(0, 92)]  // 93 days
+    public async Task Daily_InvalidRange_IsRejected(int fromOffset, int toOffset)
+    {
+        await using var db = CreateContext();
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            CreateService(db).GetDailyAsync(Day.AddDays(fromOffset), Day.AddDays(toOffset), null));
+
+        Assert.Equal(ErrorCodes.DayEndReportRangeInvalid, ex.Code);
+    }
+
+    // --- helpers ------------------------------------------------------------------------------
+
+    private static SalesSlip Slip(int id, DateTime at, decimal total, decimal paid, decimal cash, decimal card,
+        SalesSlipStatus status = SalesSlipStatus.Posted) => new()
+    {
+        SalesSlipId = id, SlipNo = $"SL-{id}", SlipDate = at, Status = status,
+        GrandTotal = total, PaidAmount = paid, BalanceAmount = total - paid, CashAmount = cash, CardAmount = card
+    };
+
+    private static SalesInvoice Invoice(int id, DateTime at, decimal netPayable, decimal paid) => new()
+    {
+        SalesInvoiceId = id, InvoiceNo = $"INV-{id}", InvoiceDate = at, Status = SalesInvoiceStatus.Posted,
+        GrandTotal = netPayable, NetPayable = netPayable, PaidAmount = paid, BalanceAmount = netPayable - paid
+    };
+
+    private static SalesInvoicePayment Payment(int id, int invoiceId, DateTime at, SalesPaymentMethod method, decimal amount) => new()
+    {
+        SalesInvoicePaymentId = id, SalesInvoiceId = invoiceId, PaymentDate = at, PaymentMethod = method, Amount = amount
+    };
+
+    private static StockLedger Ledger(int id, string docType, int docId, Direction direction, decimal value) => new()
+    {
+        LedgerId = id, SourceDocType = docType, SourceDocId = docId, Direction = direction, Value = value, QtyBase = 1, ItemId = 1, WarehouseId = 1
+    };
+
+    private static Expense Expense(int id, DateOnly date, decimal amount, ExpenseStatus status) => new()
+    {
+        ExpenseId = id, DocNo = $"EXP-{id}", ExpenseDate = date, Amount = amount, Status = status,
+        ExpenseCategoryId = 1, ExpenseTitleId = 1
+    };
+
+    private static BankDeposit BankDeposit(int id, DateOnly businessDate, decimal amount, BankDepositStatus status) => new()
+    {
+        BankDepositId = id, DocNo = $"BD-{id}", BranchId = 1, BusinessDate = businessDate, DepositDate = businessDate, Amount = amount,
+        Status = status, FromCashAccountCode = "1000-01", FromCashAccountName = "Main Till",
+        ToBankAccountCode = "1010-01", ToBankAccountName = "BOC Current"
+    };
+
+    private static void SeedExpenseSetup(ErpDbContext db)
+    {
+        db.ExpenseCategories.Add(new ExpenseCategory { ExpenseCategoryId = 1, Code = "UTILITY", Name = "Utility" });
+        db.ExpenseTitles.Add(new ExpenseTitle { ExpenseTitleId = 1, ExpenseCategoryId = 1, Name = "Electricity", GlExpenseAccountCode = "5200-01" });
+    }
+
+    private static DayEndReportService CreateService(ErpDbContext db)
+    {
+        var config = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?> { ["DayEndReport:TimeZone"] = "Asia/Colombo" })
+            .Build();
+        var clock = new BusinessDayClock(config);
+        var branch = new CurrentBranchContext(new TestCurrentUser());
+        var cash = new CashInHandService(new CashInHandRepository(db), branch, clock, config);
+        return new DayEndReportService(new DayEndReportRepository(db), cash, branch, clock);
+    }
+
+    private static ErpDbContext CreateContext()
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root)
+            .Options;
+        var currentUser = new TestCurrentUser();
+        return new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
+    }
+}

Backend/ERPCore.Tests/DualApprovalTests.cs

@@ -0,0 +1,486 @@
+using ERPCore.Domain;
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Approvals;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Notifications;
+using ERPCore.Dtos.Products;
+using ERPCore.Dtos.Stock;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.Services.Stock;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+using Microsoft.Extensions.Configuration;
+
+namespace ERPCore.Tests;
+
+/// <summary>Dual approval of stock and price adjustments (docs/DUAL_APPROVAL_PLAN.md §13).</summary>
+public class DualApprovalTests
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    // Requester, two approvers, and a clerk who can approve but isn't a manager.
+    private const int Requester = 10, ApproverA = 11, ApproverB = 12, Clerk = 13;
+    private const int ApproverRoleId = 2, ClerkRoleId = 3;
+    // ReasonId is an ordinary adjustment reason (VAR); WastageReasonId is a wastage one (DMG), which has its own approval switch.
+    private const int ItemId = 1, WarehouseId = 1, ReasonId = 1, WastageReasonId = 2;
+
+    // --- Stock adjustments ------------------------------------------------------------------
+
+    [Fact]
+    public async Task StockAdjustment_IsARequest_NothingMovesUntilApproved()
+    {
+        var h = await Harness.CreateAsync();
+
+        var dto = await h.Stock.CreateAsync(Request(-3));
+
+        Assert.Equal(AdjustmentStatus.PendingApproval, dto.Status);
+        Assert.Equal(2, dto.RequiredApprovals);
+        Assert.Equal(1, dto.PendingLevel);
+        Assert.Empty(h.Mutator.Calls);
+        Assert.Empty(h.Gl.Posted);
+        var pending = Assert.Single(h.Notifications.Targeted, n => n.ModuleKey == "approval.pending");
+        Assert.Equal([ApproverA, ApproverB, Clerk], pending.UserIds.Order());   // never the requester
+    }
+
+    [Fact]
+    public async Task StockAdjustment_TwoDifferentApprovers_ThenItPosts()
+    {
+        var h = await Harness.CreateAsync();
+        var id = (await h.Stock.CreateAsync(Request(-3))).AdjustmentId;
+
+        h.User.Be(Requester);
+        var own = await Assert.ThrowsAsync<DomainException>(() => h.Stock.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.ApprovalForbidden, own.Code);
+
+        h.User.Be(ApproverA);
+        var first = await h.Stock.ApproveAsync(id, "counted twice");
+        Assert.Equal(AdjustmentStatus.PendingSecondApproval, first.Status);
+        Assert.Empty(h.Mutator.Calls);
+
+        var twice = await Assert.ThrowsAsync<DomainException>(() => h.Stock.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.ApprovalSamePerson, twice.Code);
+
+        h.User.Be(ApproverB);
+        var posted = await h.Stock.ApproveAsync(id, null);
+
+        Assert.Equal(AdjustmentStatus.Posted, posted.Status);
+        Assert.Equal((ApproverA, ApproverB), (posted.ApprovedLevel1By, posted.ApprovedLevel2By));
+        var call = Assert.Single(h.Mutator.Calls);
+        Assert.Equal(-3m, Assert.Single(call).QtyDelta);
+        Assert.Single(h.Gl.Posted);
+        Assert.NotNull(posted.PostedAt);
+        Assert.Equal([1, 2], posted.ApprovalHistory!.Select(s => s.Level));
+        Assert.Contains(h.Notifications.Targeted, n => n.ModuleKey == "approval.approved" && n.UserIds.SequenceEqual([Requester]));
+    }
+
+    [Fact]
+    public async Task StockAdjustment_Rejected_NeedsAReason_AndNeverPosts()
+    {
+        var h = await Harness.CreateAsync();
+        var id = (await h.Stock.CreateAsync(Request(5))).AdjustmentId;
+        h.User.Be(ApproverA);
+
+        var noReason = await Assert.ThrowsAsync<DomainException>(() => h.Stock.RejectAsync(id, " "));
+        Assert.Equal(ErrorCodes.ApprovalReasonRequired, noReason.Code);
+
+        var rejected = await h.Stock.RejectAsync(id, "wrong warehouse");
+        Assert.Equal((AdjustmentStatus.Rejected, "wrong warehouse"), (rejected.Status, rejected.RejectReason));
+
+        h.User.Be(ApproverB);
+        var late = await Assert.ThrowsAsync<DomainException>(() => h.Stock.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.ApprovalNotPending, late.Code);
+        Assert.Empty(h.Mutator.Calls);
+        Assert.Contains(h.Notifications.Targeted, n => n.ModuleKey == "approval.rejected");
+    }
+
+    [Fact]
+    public async Task StockAdjustment_ApprovalsOff_PostsOnCreate()
+    {
+        var h = await Harness.CreateAsync(stockLevels: 0);
+
+        var dto = await h.Stock.CreateAsync(Request(2));
+
+        Assert.Equal((AdjustmentStatus.Posted, 0), (dto.Status, dto.RequiredApprovals));
+        Assert.Single(h.Mutator.Calls);
+    }
+
+    [Fact]
+    public async Task StockAdjustment_BelowTheValueThreshold_NeedsOneApproval()
+    {
+        // 3 units at 10.00 each = 30.00, below the 1,000 threshold.
+        var h = await Harness.CreateAsync(stockThreshold: 1000);
+        var id = (await h.Stock.CreateAsync(Request(-3))).AdjustmentId;
+
+        h.User.Be(ApproverA);
+        var posted = await h.Stock.ApproveAsync(id, null);
+
+        Assert.Equal((AdjustmentStatus.Posted, 1), (posted.Status, posted.RequiredApprovals));
+        Assert.Single(h.Mutator.Calls);
+    }
+
+    [Fact]
+    public async Task StockAdjustment_OnlyTheRequesterCanWithdraw()
+    {
+        var h = await Harness.CreateAsync();
+        var id = (await h.Stock.CreateAsync(Request(-1))).AdjustmentId;
+
+        h.User.Be(ApproverA);
+        var other = await Assert.ThrowsAsync<DomainException>(() => h.Stock.CancelAsync(id));
+        Assert.Equal(ErrorCodes.ApprovalForbidden, other.Code);
+
+        h.User.Be(Requester);
+        Assert.Equal(AdjustmentStatus.Cancelled, (await h.Stock.CancelAsync(id)).Status);
+    }
+
+    [Fact]
+    public async Task SecondApproval_CanBeLimitedToRoles()
+    {
+        var h = await Harness.CreateAsync(level2RoleIds: ApproverRoleId.ToString());
+        var id = (await h.Stock.CreateAsync(Request(-1))).AdjustmentId;
+        h.User.Be(ApproverA);
+        await h.Stock.ApproveAsync(id, null);
+
+        h.User.Be(Clerk);
+        var clerk = await Assert.ThrowsAsync<DomainException>(() => h.Stock.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.ApprovalRoleRequired, clerk.Code);
+
+        h.User.Be(ApproverB);
+        Assert.Equal(AdjustmentStatus.Posted, (await h.Stock.ApproveAsync(id, null)).Status);
+    }
+
+    // --- Price adjustments ------------------------------------------------------------------
+
+    [Fact]
+    public async Task PriceAdjustment_AppliesOnlyAfterTheSecondApproval_AndKeepsHistory()
+    {
+        var h = await Harness.CreateAsync();
+        var dto = await h.Prices.CreateAsync(PriceRequest(flat: 120m));
+        Assert.Equal(PriceAdjustmentStatus.PendingApproval, dto.Status);
+        Assert.Equal(100m, (await h.Db.Items.AsNoTracking().FirstAsync()).SellingFlatPrice);
+
+        h.User.Be(ApproverA);
+        await h.Prices.ApproveAsync(dto.PriceAdjustmentId, null);
+        Assert.Equal(100m, (await h.Db.Items.AsNoTracking().FirstAsync()).SellingFlatPrice);
+
+        h.User.Be(ApproverB);
+        var applied = await h.Prices.ApproveAsync(dto.PriceAdjustmentId, null);
+
+        Assert.Equal(PriceAdjustmentStatus.Approved, applied.Status);
+        Assert.Equal(120m, (await h.Db.Items.AsNoTracking().FirstAsync()).SellingFlatPrice);
+        var history = Assert.Single(await h.Prices.ItemHistoryAsync(ItemId));
+        Assert.Equal((100m, 120m, ApproverA, ApproverB, dto.DocNo), (history.OldFlatPrice, history.NewFlatPrice, history.ApprovedLevel1By, history.ApprovedLevel2By, history.DocNo));
+    }
+
+    [Fact]
+    public async Task PriceAdjustment_ItemRepricedSinceTheRequest_IsRefusedAsStale()
+    {
+        var h = await Harness.CreateAsync();
+        var id = (await h.Prices.CreateAsync(PriceRequest(flat: 120m))).PriceAdjustmentId;
+        h.User.Be(ApproverA);
+        await h.Prices.ApproveAsync(id, null);
+
+        var item = await h.Db.Items.FirstAsync();
+        item.SellingFlatPrice = 105m;            // someone changed it in between
+        await h.Db.SaveChangesAsync();
+
+        h.User.Be(ApproverB);
+        var stale = await Assert.ThrowsAsync<DomainException>(() => h.Prices.ApproveAsync(id, null));
+        Assert.Equal(ErrorCodes.PriceAdjustmentStale, stale.Code);
+        Assert.Empty(await h.Prices.ItemHistoryAsync(ItemId));
+    }
+
+    [Fact]
+    public async Task PriceAdjustment_OnePendingRequestPerItem()
+    {
+        var h = await Harness.CreateAsync();
+        await h.Prices.CreateAsync(PriceRequest(flat: 120m));
+
+        var second = await Assert.ThrowsAsync<DomainException>(() => h.Prices.CreateAsync(PriceRequest(flat: 130m)));
+        Assert.Equal(ErrorCodes.PriceAdjustmentItemPending, second.Code);
+    }
+
+    [Theory]
+    [InlineData(100, 120, 20)]
+    [InlineData(100, 80, 20)]
+    [InlineData(-1, 50, 100)]     // setting a price where there was none (-1 = no price)
+    [InlineData(50, -1, 100)]     // clearing one
+    [InlineData(40, 40, 0)]
+    public void ChangePercent_MeasuresTheSizeOfAPriceChange(int oldPrice, int newPrice, int expected)
+    {
+        decimal? Price(int v) => v < 0 ? null : v;
+        Assert.Equal(expected, PriceAdjustmentService.ChangePercent(Price(oldPrice), Price(newPrice)));
+    }
+
+    [Theory]
+    [InlineData(2, 0, 5000, 2)]     // no threshold: always two
+    [InlineData(2, 1000, 50, 1)]    // below threshold: one
+    [InlineData(2, 1000, 1000, 2)]  // at threshold: two
+    [InlineData(1, 1000, 5000, 1)]
+    [InlineData(0, 0, 5000, 0)]
+    public void RequiredLevels_FollowTheSettings(int configured, double threshold, double measure, int expected)
+        => Assert.Equal(expected, ApprovalService.Levels(configured, (decimal)threshold, (decimal)measure));
+
+    // --- Wastage: its own approval switch ------------------------------------------------------
+
+    [Fact]
+    public async Task Wastage_WithTheSwitchOff_ReducesStockAtOnce_EvenWhenAdjustmentsNeedTwoApprovals()
+    {
+        var h = await Harness.CreateAsync(stockLevels: 2, wastageLevels: 0);
+
+        var dto = await h.Stock.CreateAsync(Request(-3, WastageReasonId));
+
+        Assert.Equal(AdjustmentStatus.Posted, dto.Status);
+        Assert.Equal(0, dto.RequiredApprovals);
+        Assert.Single(h.Mutator.Calls);
+    }
+
+    [Fact]
+    public async Task Wastage_WithTheSwitchOn_IsARequest_AndMovesNothingUntilApproved()
+    {
+        var h = await Harness.CreateAsync(stockLevels: 0, wastageLevels: 2);
+
+        var dto = await h.Stock.CreateAsync(Request(-3, WastageReasonId));
+
+        Assert.Equal(AdjustmentStatus.PendingApproval, dto.Status);
+        Assert.Equal(2, dto.RequiredApprovals);
+        Assert.Empty(h.Mutator.Calls);
+
+        h.User.Be(ApproverA);
+        await h.Stock.ApproveAsync(dto.AdjustmentId, null);
+        Assert.Empty(h.Mutator.Calls);                         // one of two: still nothing
+        h.User.Be(ApproverB);
+        var posted = await h.Stock.ApproveAsync(dto.AdjustmentId, null);
+        Assert.Equal(AdjustmentStatus.Posted, posted.Status);
+        Assert.Single(h.Mutator.Calls);
+    }
+
+    [Fact]
+    public async Task TheWastageSwitch_DoesNotLoosenOrdinaryAdjustments_AndTheirLevelsDoNotTouchWastage()
+    {
+        var h = await Harness.CreateAsync(stockLevels: 2, wastageLevels: 0);
+
+        // An ordinary adjustment (not a wastage reason) still needs two approvals.
+        var ordinary = await h.Stock.CreateAsync(Request(-3));
+        Assert.Equal(AdjustmentStatus.PendingApproval, ordinary.Status);
+
+        // A stock GAIN with a wastage reason is not wastage, so it follows the adjustment levels too.
+        var gain = await h.Stock.CreateAsync(Request(+3, WastageReasonId));
+        Assert.Equal(AdjustmentStatus.PendingApproval, gain.Status);
+    }
+
+    [Fact]
+    public async Task WastageList_ReturnsOnlyAdjustmentsWithAWastageReason()
+    {
+        var h = await Harness.CreateAsync(stockLevels: 0, wastageLevels: 0);
+        await h.Stock.CreateAsync(Request(-1, WastageReasonId));
+        await h.Stock.CreateAsync(Request(-2));
+
+        var all = await h.Stock.ListAsync(new PageQuery { Page = 1, PageSize = 50 }, null, null, null);
+        var wastage = await h.Stock.ListAsync(new PageQuery { Page = 1, PageSize = 50 }, null, null, null, null, CancellationToken.None, wastageOnly: true);
+
+        Assert.Equal(2, all.Items.Count);
+        var only = Assert.Single(wastage.Items);
+        Assert.Equal(WastageReasonId, only.ReasonCodeId);
+    }
+
+    [Fact]
+    public async Task WastageList_CanBeNarrowedToOneItem()
+    {
+        var h = await Harness.CreateAsync(stockLevels: 0, wastageLevels: 0);
+        await h.Stock.CreateAsync(Request(-1, WastageReasonId));
+
+        var forItem = await h.Stock.ListAsync(new PageQuery { Page = 1, PageSize = 50 }, null, null, null, null, CancellationToken.None, wastageOnly: true, itemId: ItemId);
+        var otherItem = await h.Stock.ListAsync(new PageQuery { Page = 1, PageSize = 50 }, null, null, null, null, CancellationToken.None, wastageOnly: true, itemId: 999);
+
+        Assert.Single(forItem.Items);
+        Assert.Empty(otherItem.Items);
+    }
+
+    [Fact]
+    public void WastageApproval_IsOffByDefault_AndTheSettingIsReadBack()
+    {
+        Assert.Equal(0, new ApprovalConfig().WastageLevels);
+        Assert.True(ERPCore.Domain.WastageReasonCodes.IsWastage("dmg"));
+        Assert.False(ERPCore.Domain.WastageReasonCodes.IsWastage("VAR"));
+    }
+
+    // --- helpers ------------------------------------------------------------------------------
+
+    private static CreateAdjustmentRequest Request(decimal qty, int reasonId = ReasonId) => new()
+    {
+        WarehouseId = WarehouseId, BranchId = 1, ReasonCodeId = reasonId,
+        Lines = [new CreateAdjustmentLineInput { ItemId = ItemId, QtyDelta = qty }]
+    };
+
+    private static CreatePriceAdjustmentRequest PriceRequest(decimal flat) => new()
+    {
+        Reason = "Supplier price rise",
+        Lines = [new PriceAdjustmentLineInput { ItemId = ItemId, NewMinPrice = 90m, NewMaxPrice = 150m, NewFlatPrice = flat }]
+    };
+
+    private sealed class Harness
+    {
+        public required ErpDbContext Db { get; init; }
+        public required SwitchableUser User { get; init; }
+        public required RecordingMutator Mutator { get; init; }
+        public required FakeGeneralLedger Gl { get; init; }
+        public required RecordingNotifications Notifications { get; init; }
+        public required AdjustmentService Stock { get; init; }
+        public required PriceAdjustmentService Prices { get; init; }
+
+        public static async Task<Harness> CreateAsync(int stockLevels = 2, decimal stockThreshold = 0, string? level2RoleIds = null, int wastageLevels = 0)
+        {
+            var db = new ErpDbContext(
+                new DbContextOptionsBuilder<ErpDbContext>().UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root).Options,
+                new TestCurrentUser(), new CurrentBranchContext(new TestCurrentUser()));
+
+            db.Roles.AddRange(
+                new Role { RoleId = 1, Code = "Requester", Name = "Requester" },
+                new Role { RoleId = ApproverRoleId, Code = "Approver", Name = "Approver" },
+                new Role { RoleId = ClerkRoleId, Code = "Clerk", Name = "Clerk" });
+            db.Users.AddRange(
+                new User { UserId = ERPCore.Domain.Entities.User.SystemUserId, Username = "system", DisplayName = "System" },
+                new User { UserId = Requester, Username = "req", DisplayName = "Requester", RoleId = 1 },
+                new User { UserId = ApproverA, Username = "a", DisplayName = "Approver A", RoleId = ApproverRoleId },
+                new User { UserId = ApproverB, Username = "b", DisplayName = "Approver B", RoleId = ApproverRoleId },
+                new User { UserId = Clerk, Username = "c", DisplayName = "Clerk", RoleId = ClerkRoleId });
+            db.Permissions.AddRange(
+                new Permission { PermissionId = 45, Code = "NAV:stock.adjustments" },
+                new Permission { PermissionId = 58, Code = "NAV:products.price-adjustments" });
+            foreach (var roleId in new[] { ApproverRoleId, ClerkRoleId })
+            foreach (var permissionId in new[] { 45, 58 })
+                db.RolePermissions.Add(new RolePermission { RoleId = roleId, PermissionId = permissionId, Actions = RolePermissionAction.All });
+            db.RolePermissions.Add(new RolePermission { RoleId = 1, PermissionId = 45, Actions = RolePermissionAction.View | RolePermissionAction.Create });
+
+            db.Branches.Add(new Branch { BranchId = 1, Code = "BR-001", Name = "Main" });
+            db.Warehouses.Add(new Warehouse { WarehouseId = WarehouseId, Code = "WH-1", Name = "Main Store", BranchId = 1 });
+            db.Uoms.Add(new Uom { UomId = 1, Name = "pcs" });
+            db.Items.Add(new Item { ItemId = ItemId, Sku = "SKU-1", Name = "Cola", BaseUomId = 1, CategoryId = 1,
+                SellingMinPrice = 90m, SellingMaxPrice = 150m, SellingFlatPrice = 100m });
+            db.ReasonCodes.AddRange(
+                new ReasonCode { ReasonCodeId = ReasonId, Code = "VAR", Description = "Variance", Context = ReasonContext.Adjustment },
+                new ReasonCode { ReasonCodeId = WastageReasonId, Code = "DMG", Description = "Damage", Context = ReasonContext.Adjustment });
+            db.ApprovalConfig.Add(new ApprovalConfig
+            {
+                ApprovalConfigId = ApprovalConfig.SingletonId, StockAdjustmentLevels = stockLevels,
+                StockAdjustmentLevel2ThresholdValue = stockThreshold, PriceAdjustmentLevels = 2, Level2RoleIds = level2RoleIds,
+                WastageLevels = wastageLevels
+            });
+            await db.SaveChangesAsync();
+
+            var user = new SwitchableUser(Requester, "Requester");
+            var uow = new PassThroughUnitOfWork(db);
+            var notifications = new RecordingNotifications();
+            var approvals = new ApprovalService(
+                new Repository<ApprovalConfig>(db), new Repository<DocumentApproval>(db), new Repository<User>(db),
+                new Repository<RolePermission>(db), new Repository<Role>(db), user, notifications, uow);
+            var gl = new FakeGeneralLedger();
+            var mutator = new RecordingMutator();
+            var numbers = new FakeNumberSequence();
+
+            var stock = new AdjustmentService(
+                new Repository<StockAdjustment>(db), new Repository<Warehouse>(db), new Repository<Item>(db),
+                new Repository<ReasonCode>(db), new Repository<StockLedger>(db), mutator, new FixedValuation(),
+                numbers, user, new FakeBranchConfig(), notifications, approvals, uow, db, gl,
+                new StubGlAccountConfigService(
+                    (GlAccountRole.Inventory, "1200"),
+                    (GlAccountRole.InventoryGain, "4900"),
+                    (GlAccountRole.InventoryLoss, "5900")),
+                new SerialTrackingService(new Repository<Serial>(db), new Repository<SerialMovement>(db), new Repository<StockLayer>(db),
+                    new Repository<ProductConfig>(db), user));
+            var prices = new PriceAdjustmentService(new PriceAdjustmentRepository(db), approvals, notifications, numbers, user, uow);
+
+            return new Harness { Db = db, User = user, Mutator = mutator, Gl = gl, Notifications = notifications, Stock = stock, Prices = prices };
+        }
+    }
+
+    /// <summary>A signed-in user whose identity the test switches between steps.</summary>
+    private sealed class SwitchableUser(int userId, string roleCode) : ICurrentUser
+    {
+        private static readonly Dictionary<int, string> Roles = new()
+        {
+            [Requester] = "Requester", [ApproverA] = "Approver", [ApproverB] = "Approver", [Clerk] = "Clerk"
+        };
+
+        private static readonly Dictionary<int, int> RoleIds = new()
+        {
+            [Requester] = 1, [ApproverA] = ApproverRoleId, [ApproverB] = ApproverRoleId, [Clerk] = ClerkRoleId
+        };
+
+        public int AuditUserId { get; private set; } = userId;
+        public int? RoleId { get; private set; } = RoleIds[userId];
+        public string? RoleCode { get; private set; } = roleCode;
+        public string UserId => AuditUserId.ToString();
+        public bool IsAuthenticated => true;
+        public bool IsAdmin => false;
+        public int? BranchId => null;
+
+        public void Be(int userId)
+        {
+            AuditUserId = userId;
+            RoleId = RoleIds[userId];
+            RoleCode = Roles[userId];
+        }
+    }
+
+    /// <summary>Records what would be posted to stock; every unit is worth 10.00.</summary>
+    private sealed class RecordingMutator : IStockMutator
+    {
+        public List<IReadOnlyList<StockDelta>> Calls { get; } = new();
+
+        public Task<IReadOnlyList<StockLedger>> ApplyAsync(int warehouseId, string sourceDocType, int sourceDocId, DateTime now,
+            IReadOnlyList<StockDelta> deltas, CancellationToken ct = default)
+        {
+            Calls.Add(deltas);
+            IReadOnlyList<StockLedger> refs = deltas.Select(d => new StockLedger
+            {
+                ItemId = d.ItemId, WarehouseId = warehouseId, QtyBase = Math.Abs(d.QtyDelta), UnitCost = 10m, Value = Math.Abs(d.QtyDelta) * 10m,
+                Direction = d.QtyDelta < 0 ? Direction.Out : Direction.In, SourceDocType = sourceDocType, SourceDocId = sourceDocId, CreatedAt = now
+            }).ToList();
+            return Task.FromResult(refs);
+        }
+    }
+
+    /// <summary>10 units on hand worth 100.00 — 10.00 each, which prices requests for the threshold.</summary>
+    private sealed class FixedValuation : IFifoCostingService
+    {
+        public Task<StockValuationDto> GetValuationAsync(int itemId, int warehouseId, CancellationToken ct = default)
+            => Task.FromResult(new StockValuationDto(itemId, warehouseId, [], 10m, 100m, "LKR", "FIFO"));
+        public Task<StockLayer> CreateInboundLayerAsync(int itemId, int warehouseId, int? batchId, int? serialId, int? grnLineId,
+            decimal qtyBase, decimal unitCost, DateTime receiptDate, CancellationToken ct = default) => throw new NotSupportedException();
+        public Task<IReadOnlyList<ConsumedSegment>> ConsumeAsync(int itemId, int warehouseId, int? batchId, decimal qtyBase, CancellationToken ct = default,
+            bool allowShortfall = false, IReadOnlyCollection<int>? serialIds = null) => throw new NotSupportedException();
+        public Task<IReadOnlyList<BatchAllocation>> SuggestBatchesAsync(int itemId, int warehouseId, decimal qtyBase, CancellationToken ct = default)
+            => throw new NotSupportedException();
+        public Task<StockLedger> PostLedgerAsync(int itemId, int warehouseId, int? binId, int? batchId, int? serialId, int userId,
+            Direction direction, decimal qtyBase, decimal unitCost, decimal runningBalance, string sourceDocType, int sourceDocId,
+            DateTime createdAt, CancellationToken ct = default, decimal? valueOverride = null, bool postGlJournal = true) => throw new NotSupportedException();
+        public Task<decimal> GetOnHandAsync(int itemId, int warehouseId, CancellationToken ct = default) => Task.FromResult(10m);
+    }
+
+    private sealed class RecordingNotifications : INotificationService
+    {
+        public List<(IReadOnlyList<int> UserIds, string ModuleKey, string Message)> Targeted { get; } = new();
+
+        public Task RaiseAsync(string moduleKey, string title, string message, string? relatedEntityType = null, int? relatedEntityId = null,
+            CancellationToken ct = default) => Task.CompletedTask;
+
+        public Task NotifyUsersAsync(IEnumerable<int> userIds, string moduleKey, string title, string message,
+            string? relatedEntityType = null, int? relatedEntityId = null, CancellationToken ct = default)
+        {
+            Targeted.Add((userIds.ToList(), moduleKey, message));
+            return Task.CompletedTask;
+        }
+
+        public Task<NotificationFeedDto> GetFeedAsync(int userId, int take = 20, CancellationToken ct = default) => throw new NotSupportedException();
+        public Task MarkAllReadAsync(int userId, CancellationToken ct = default) => throw new NotSupportedException();
+    }
+}

Backend/ERPCore.Tests/ERPCore.Tests.csproj

@@ -8,7 +8,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="9.0.20" />
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageReference Include="xunit" Version="2.9.3" />

Backend/ERPCore.Tests/GlAccountCodeValidatorTests.cs

@@ -0,0 +1,151 @@
+using ERPCore.Infra.Gl;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.System.Time;
+using ERPCore.Tests.TestSupport;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// The validator is advisory: enforcement lives in <see cref="ERPCore.Services.GlAccountConfigService"/>,
+/// which refuses to store a bad mapping in the first place. So the behaviour that matters here is that
+/// it <b>cannot abort startup</b>. An earlier revision threw on a missing code and core-dumped
+/// erpcore.service on deploy (2026-10-07), turning a long-standing data mismatch into an outage.
+/// </summary>
+public class GlAccountCodeValidatorTests
+{
+    [Fact]
+    public async Task StartAsync_Succeeds_WhenEveryMappedCodeExistsInGl()
+    {
+        var validator = CreateValidator(
+            new(),
+            new StubGeneralLedgerService([
+                StubGeneralLedgerService.Postable("1100"),
+                StubGeneralLedgerService.Postable("2000")
+            ]),
+            (GlAccountRole.Inventory, "1100"), (GlAccountRole.Clearing, "2000"));
+
+        await validator.StartAsync(CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task StartAsync_DoesNotThrow_WhenMappedCodesAreMissingFromGl()
+    {
+        var validator = CreateValidator(
+            new(),
+            new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1000-01")]),
+            (GlAccountRole.Inventory, "1100"), (GlAccountRole.Cash, "1000-01"));
+
+        await validator.StartAsync(CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task StartAsync_Throws_AndNamesEveryMissingCode_WhenConfiguredToFail()
+    {
+        var validator = CreateValidator(
+            new() { ["GeneralLedgerService:FailOnMissingAccountCodes"] = "true" },
+            new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]),
+            (GlAccountRole.Inventory, "1100"),
+            (GlAccountRole.Cash, "1000-01"),
+            (GlAccountRole.InventoryLoss, "5100"));
+
+        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => validator.StartAsync(CancellationToken.None));
+
+        Assert.Contains("1000-01", ex.Message);
+        Assert.Contains("5100", ex.Message);
+        Assert.Contains("2 of 3", ex.Message);
+    }
+
+    /// <summary>
+    /// If GL's /accounts shape ever changes, the reader yields nothing. Treating that as
+    /// "everything is missing" would refuse to start on a contract change.
+    /// </summary>
+    [Fact]
+    public async Task StartAsync_DoesNotThrow_WhenGlReturnsNoAccountsAtAll()
+    {
+        var validator = CreateValidator(
+            new() { ["GeneralLedgerService:FailOnMissingAccountCodes"] = "true" },
+            new StubGeneralLedgerService([]),
+            (GlAccountRole.Inventory, "1100"));
+
+        await validator.StartAsync(CancellationToken.None);
+    }
+
+    /// <summary>
+    /// The catch filter once matched only DomainException/OperationCanceledException, so anything
+    /// else — a parse failure, a null-items NRE in the reader, a database hiccup reading the
+    /// mapping — escaped a hosted service and aborted the host.
+    /// </summary>
+    [Theory]
+    [MemberData(nameof(UnexpectedFailures))]
+    public async Task StartAsync_DoesNotThrow_OnAnyUnexpectedFailure(Exception failure)
+    {
+        var validator = CreateValidator(
+            new() { ["GeneralLedgerService:FailOnMissingAccountCodes"] = "true" },
+            new StubGeneralLedgerService(failure),
+            (GlAccountRole.Inventory, "1100"));
+
+        await validator.StartAsync(CancellationToken.None);
+    }
+
+    public static TheoryData<Exception> UnexpectedFailures() =>
+    [
+        StubGeneralLedgerService.Unreachable(),
+        new NullReferenceException("items was null"),
+        new global::System.Text.Json.JsonException("unexpected shape"),
+        new InvalidOperationException("something else entirely"),
+        new HttpRequestException("connection reset"),
+        new OperationCanceledException(),
+    ];
+
+    [Fact]
+    public async Task StartAsync_SkipsTheGlCall_WhenNothingIsMapped()
+    {
+        var gl = new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]);
+
+        var validator = CreateValidator(new(), gl);
+        await validator.StartAsync(CancellationToken.None);
+
+        Assert.Equal(0, gl.Calls);
+    }
+
+    /// <summary>Duplicate codes across roles are one account to verify, not several.</summary>
+    [Fact]
+    public async Task StartAsync_DeduplicatesCodesSharedBySeveralRoles()
+    {
+        var gl = new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]);
+
+        var validator = CreateValidator(
+            new() { ["GeneralLedgerService:FailOnMissingAccountCodes"] = "true" },
+            gl,
+            (GlAccountRole.Inventory, "1100"), (GlAccountRole.InventoryGain, "1100"));
+
+        await validator.StartAsync(CancellationToken.None);
+        Assert.Equal(1, gl.Calls);
+    }
+
+    /// <summary>Asia/Colombo is UTC+05:30, so 20:00 UTC on the 31st is already the 1st locally.</summary>
+    [Fact]
+    public void BusinessClock_MapsAUtcInstantToTheLocalBusinessDay()
+    {
+        Assert.Equal(new DateOnly(2026, 11, 1), BusinessClock.ToBusinessDate(new DateTime(2026, 10, 31, 20, 0, 0, DateTimeKind.Utc)));
+        Assert.Equal(new DateOnly(2026, 10, 31), BusinessClock.ToBusinessDate(new DateTime(2026, 10, 31, 18, 0, 0, DateTimeKind.Utc)));
+        Assert.Equal(new DateOnly(2026, 10, 31), BusinessClock.ToBusinessDate(new DateTime(2026, 10, 31, 18, 29, 59, DateTimeKind.Utc)));
+        Assert.Equal(new DateOnly(2026, 11, 1), BusinessClock.ToBusinessDate(new DateTime(2026, 10, 31, 18, 30, 0, DateTimeKind.Utc)));
+    }
+
+    private static GlAccountCodeValidator CreateValidator(
+        Dictionary<string, string?> settings, StubGeneralLedgerService gl, params (GlAccountRole, string?)[] mapping)
+    {
+        var configuration = new ConfigurationBuilder().AddInMemoryCollection(settings).Build();
+        var services = new ServiceCollection()
+            .AddScoped<IGeneralLedgerService>(_ => gl)
+            .AddScoped<IGlAccountConfigService>(_ => new StubGlAccountConfigService(mapping))
+            .BuildServiceProvider();
+        return new GlAccountCodeValidator(services, configuration, NullLogger<GlAccountCodeValidator>.Instance);
+    }
+}

Backend/ERPCore.Tests/GlAccountConfigServiceTests.cs

@@ -0,0 +1,234 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Dtos.Config;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// The point of this service is that a mapping GL cannot post to never reaches the database.
+/// Validation at the point of entry is what the old appsettings approach could not do: those codes
+/// were only ever checked at boot, and on 2026-10-07 eleven of twelve turned out never to have
+/// existed in GL at all.
+/// </summary>
+public class GlAccountConfigServiceTests
+{
+    [Fact]
+    public async Task UpdateAsync_PersistsAMappingGlCanPostTo()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var gl = new StubGeneralLedgerService([
+            StubGeneralLedgerService.Postable("1100", "Inventory"),
+            StubGeneralLedgerService.Postable("2000", "GRNI")
+        ]);
+        var service = CreateService(db, gl);
+        var before = (await service.GetAsync()).RowVersion;
+
+        var result = await service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100", ClearingAccountCode = "2000" }, before);
+
+        Assert.True(result.RowVersion > before);
+        var codes = await CreateService(db, gl).GetCodesAsync();
+        Assert.Equal("1100", codes[GlAccountRole.Inventory]);
+        Assert.Equal("2000", codes[GlAccountRole.Clearing]);
+    }
+
+    [Fact]
+    public async Task UpdateAsync_RejectsACodeGlDoesNotHave_AndNamesIt()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]));
+        var rowVersion = (await service.GetAsync()).RowVersion;
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100", ClearingAccountCode = "9999" }, rowVersion));
+
+        Assert.Equal(ErrorCodes.GlAccountInvalid, ex.Code);
+        Assert.Equal(422, ex.StatusCode);
+        Assert.Contains("9999", ex.Message);
+        Assert.Contains("Clearing", ex.Message);
+        await AssertNothingStoredAsync(db);
+    }
+
+    /// <summary>
+    /// GL rejects a journal line against a non-postable account, so storing one only defers the
+    /// failure to posting time. The auto-created <c>1000</c> Bank/Cash header is exactly this trap.
+    /// </summary>
+    [Fact]
+    public async Task UpdateAsync_RejectsANonPostableAccount()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([
+            StubGeneralLedgerService.NotPostable("1000", "Bank and Cash")
+        ]));
+        var rowVersion = (await service.GetAsync()).RowVersion;
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { CashAccountCode = "1000" }, rowVersion));
+
+        Assert.Equal(ErrorCodes.GlAccountInvalid, ex.Code);
+        Assert.Contains("not postable", ex.Message);
+        await AssertNothingStoredAsync(db);
+    }
+
+    /// <summary>Fails closed, deliberately opposite to the startup validator: an unverified mapping is not a valid one.</summary>
+    [Fact]
+    public async Task UpdateAsync_RefusesToSaveWhenGlIsUnreachable()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService(StubGeneralLedgerService.Unreachable()));
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100" }, 1));
+
+        Assert.Equal(ErrorCodes.GlServiceUnavailable, ex.Code);
+        await AssertNothingStoredAsync(db);
+    }
+
+    [Fact]
+    public async Task UpdateAsync_RefusesToSaveAgainstAnEmptyChartOfAccounts()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([]));
+        var rowVersion = (await service.GetAsync()).RowVersion;
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100" }, rowVersion));
+
+        Assert.Equal(ErrorCodes.GlAccountInvalid, ex.Code);
+        Assert.Equal(503, ex.StatusCode);
+    }
+
+    [Fact]
+    public async Task UpdateAsync_RejectsAStaleIfMatch()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]));
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(
+            new UpdateGlAccountConfigRequest { InventoryAccountCode = "1100" }, expectedRowVersion: 9999));
+
+        Assert.Equal(ErrorCodes.ConcurrencyConflict, ex.Code);
+        Assert.Equal(412, ex.StatusCode);
+    }
+
+    /// <summary>An empty string clears a role rather than storing "" and posting it to GL.</summary>
+    [Fact]
+    public async Task UpdateAsync_TreatsBlankAsCleared()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var gl = new StubGeneralLedgerService([StubGeneralLedgerService.Postable("1100")]);
+        var service = CreateService(db, gl);
+        var rowVersion = (await service.GetAsync()).RowVersion;
+
+        await service.UpdateAsync(new UpdateGlAccountConfigRequest { InventoryAccountCode = "   " }, rowVersion);
+
+        var codes = await CreateService(db, gl).GetCodesAsync();
+        Assert.Null(codes.GetOrNull(GlAccountRole.Inventory));
+    }
+
+    /// <summary>Reading an unmapped role names the role, instead of posting "" and letting GL 404.</summary>
+    [Fact]
+    public async Task GetCodesAsync_ThrowsNamingTheRole_WhenUnmapped()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([]));
+
+        var codes = await service.GetCodesAsync();
+        var ex = Assert.Throws<DomainException>(() => codes[GlAccountRole.Cogs]);
+
+        Assert.Equal(ErrorCodes.GlAccountNotConfigured, ex.Code);
+        Assert.Contains("Cogs", ex.Message);
+    }
+
+    /// <summary>One request can post through several services; they should not each re-read the row.</summary>
+    [Fact]
+    public async Task GetCodesAsync_ReadsOncePerScope()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([]));
+
+        var first = await service.GetCodesAsync();
+        var second = await service.GetCodesAsync();
+
+        Assert.Same(first, second);
+    }
+
+    /// <summary>GL being down must not stop the saved mapping from rendering on the settings screen.</summary>
+    [Fact]
+    public async Task GetAsync_StillReturnsTheMapping_WhenGlIsUnreachable()
+    {
+        await using var db = await CreateSeededContextAsync(c => c.InventoryAccountCode = "1100");
+        var service = CreateService(db, new StubGeneralLedgerService(StubGeneralLedgerService.Unreachable()));
+
+        var result = await service.GetAsync();
+
+        Assert.True(result.Value.GlUnavailable);
+        Assert.Empty(result.Value.Options);
+        var inventory = result.Value.Mappings.Single(m => m.Role == nameof(GlAccountRole.Inventory));
+        Assert.Equal("1100", inventory.AccountCode);
+    }
+
+    /// <summary>The 2026-10-07 state: a stored code GL does not have is shown flagged, not blank.</summary>
+    [Fact]
+    public async Task GetAsync_FlagsAStoredCodeThatGlDoesNotHave()
+    {
+        await using var db = await CreateSeededContextAsync(c =>
+        {
+            c.InventoryAccountCode = "1100";
+            c.CashAccountCode = "1000-01";
+        });
+        var service = CreateService(db, new StubGeneralLedgerService([
+            StubGeneralLedgerService.Postable("1000-01", "Cash in Hand")
+        ]));
+
+        var result = await service.GetAsync();
+
+        Assert.False(result.Value.Mappings.Single(m => m.Role == nameof(GlAccountRole.Inventory)).ExistsInGl);
+        Assert.True(result.Value.Mappings.Single(m => m.Role == nameof(GlAccountRole.Cash)).ExistsInGl);
+    }
+
+    /// <summary>The picker must only offer what validation will accept.</summary>
+    [Fact]
+    public async Task GetAsync_OffersOnlyPostableActiveAccounts()
+    {
+        await using var db = await CreateSeededContextAsync();
+        var service = CreateService(db, new StubGeneralLedgerService([
+            StubGeneralLedgerService.Postable("1100", "Inventory"),
+            StubGeneralLedgerService.NotPostable("1000", "Bank and Cash"),
+            new GlAccount("1200", "Retired", 1, true, false)
+        ]));
+
+        var options = (await service.GetAsync()).Value.Options;
+
+        Assert.Equal(["1100"], options.Select(o => o.AccountCode));
+    }
+
+    private static async Task AssertNothingStoredAsync(ErpDbContext db)
+    {
+        var row = await new Repository<GlAccountConfig>(db).GetByIdAsync(GlAccountConfig.SingletonId);
+        Assert.Null(row!.InventoryAccountCode);
+        Assert.Null(row.ClearingAccountCode);
+        Assert.Null(row.CashAccountCode);
+    }
+
+    private static async Task<ErpDbContext> CreateSeededContextAsync(Action<GlAccountConfig>? configure = null)
+    {
+        var db = NotificationConfigTestSupport.CreateContext(Guid.NewGuid().ToString("N"));
+        db.Users.Add(new User { UserId = User.SystemUserId, Username = "system", DisplayName = "System" });
+
+        var config = new GlAccountConfig { ConfigId = GlAccountConfig.SingletonId };
+        configure?.Invoke(config);
+        db.GlAccountConfig.Add(config);
+        await db.SaveChangesAsync();
+        return db;
+    }
+
+    private static GlAccountConfigService CreateService(ErpDbContext db, IGeneralLedgerService gl) =>
+        new(new Repository<GlAccountConfig>(db), gl, new TestCurrentUser(), new ERPCore.Infra.UoW.UnitOfWork(db));
+}

Backend/ERPCore.Tests/ItemTrackingTests.cs

@@ -0,0 +1,366 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.Services.Stock;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// Serial/batch rules from docs/ITEM_TRACKING_PLAN.md that live outside the MariaDB-only FIFO
+/// SQL: the sales-line check (<see cref="SalesDomainService.ValidateLineTrackingAsync"/>) and the
+/// shared stock-document rules (<see cref="SerialTrackingService"/>).
+/// </summary>
+public class ItemTrackingTests
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    private const int Wh1 = 1;
+    private const int Wh2 = 2;
+    private const int SerialItemId = 10;
+    private const int BatchItemId = 20;
+    private const int PlainItemId = 30;
+
+    // --- sales line validation --------------------------------------------------------------
+
+    [Fact]
+    public async Task SalesLine_SerialItem_RequiresOneSerialPerUnit()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 2, null, new[] { 1 }, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.TrackingRequired, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_SerialItem_WithoutSerials_IsRejected_WhenNoPreTrackingStockIsLeft()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, null, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.TrackingRequired, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_SerialItem_WithoutSerials_IsAllowed_FromPreTrackingStock()
+    {
+        await using var db = await SeedAsync();
+        // D6: stock received before serial capture — a layer with no serial.
+        db.StockLayers.Add(new StockLayer { ItemId = SerialItemId, WarehouseId = Wh1, QtyReceived = 3, QtyRemaining = 3, UnitCost = 10, ReceiptDate = DateTime.UtcNow });
+        await db.SaveChangesAsync();
+        var sales = CreateSalesDomain(db);
+
+        var serials = await sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 2, null, null, new HashSet<int>());
+
+        Assert.Empty(serials);
+    }
+
+    [Fact]
+    public async Task SalesLine_Serial_AtAnotherWarehouse_IsNotAvailable()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        // Serial 3 is in stock at warehouse 2.
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 3 }, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.SerialNotAvailable, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_SoldSerial_IsNotAvailable()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 4 }, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.SerialNotAvailable, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_SameSerialOnTwoLines_IsADuplicate()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+        var documentSerials = new HashSet<int>();
+
+        await sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 1 }, documentSerials);
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 1 }, documentSerials));
+
+        Assert.Equal(ErrorCodes.SerialDuplicate, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_ValidSerials_AreReturned()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var serials = await sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 2, null, new[] { 1, 2 }, new HashSet<int>());
+
+        Assert.Equal(new[] { 1, 2 }, serials.Select(s => s.SerialId).OrderBy(i => i));
+    }
+
+    [Fact]
+    public async Task SalesLine_UntrackedItem_RejectsSerials()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(PlainItemId, Wh1, 1, null, new[] { 1 }, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_ExpiredBatch_IsBlocked()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(BatchItemId, Wh1, 1, 101, null, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.ExpiredBatchBlocked, ex.Code);
+    }
+
+    [Fact]
+    public async Task SalesLine_BatchOfAnotherItem_IsRejected()
+    {
+        await using var db = await SeedAsync();
+        var sales = CreateSalesDomain(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(PlainItemId, Wh1, 1, 100, null, new HashSet<int>()));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+    }
+
+    // --- stock documents (transfers / adjustments / purchase returns) ------------------------
+
+    [Fact]
+    public async Task Outbound_DamagedSerial_OnlyWhenAllowed()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        // Serial 5 is Damaged at warehouse 1: a transfer (InStock only) refuses it...
+        var ex = await Assert.ThrowsAsync<DomainException>(() => tracking.ResolveOutboundAsync(
+            item, Wh1, 1, new[] { 5 }, new HashSet<int>(), new[] { SerialStatus.InStock }));
+        Assert.Equal(ErrorCodes.SerialNotAvailable, ex.Code);
+
+        // ...a write-off or purchase return (InStock or Damaged) takes it.
+        var serials = await tracking.ResolveOutboundAsync(
+            item, Wh1, 1, new[] { 5 }, new HashSet<int>(), new[] { SerialStatus.InStock, SerialStatus.Damaged });
+        Assert.Single(serials);
+    }
+
+    [Fact]
+    public async Task Inbound_SerialAlreadyInStock_IsADuplicate()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => tracking.ResolveInboundAsync(
+            item, Wh1, 1, new[] { "SN-1" }, new HashSet<string>()));
+
+        Assert.Equal(ErrorCodes.SerialDuplicate, ex.Code);
+    }
+
+    [Fact]
+    public async Task Inbound_FractionalQty_IsRejected_ForSerialItems()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => tracking.ResolveInboundAsync(
+            item, Wh1, 1.5m, new[] { "SN-NEW" }, new HashSet<string>()));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+    }
+
+    [Fact]
+    public async Task Inbound_NewAndSoldSerials_AreCreatedOrBroughtBack()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        // SN-4 is Sold (out of stock) — it comes back; SN-NEW does not exist — it is created.
+        var serials = await tracking.ResolveInboundAsync(item, Wh1, 2, new[] { "SN-4", "SN-NEW" }, new HashSet<string>());
+        await tracking.MoveAsync(serials, SerialStatus.InStock, Wh1, null, "ADJ", 1, DateTime.UtcNow);
+        await db.SaveChangesAsync();
+
+        var all = await db.Serials.Where(s => s.ItemId == SerialItemId && (s.SerialNo == "SN-4" || s.SerialNo == "SN-NEW")).ToListAsync();
+        Assert.All(all, s => Assert.Equal(SerialStatus.InStock, s.Status));
+        Assert.All(all, s => Assert.Equal(Wh1, s.WarehouseId));
+        Assert.Equal(2, await db.SerialMovements.CountAsync(m => m.SourceDocType == "ADJ"));
+    }
+
+    [Fact]
+    public async Task Move_RecordsHistory_WithPreviousWarehouse()
+    {
+        await using var db = await SeedAsync();
+        var tracking = CreateSerialTracking(db);
+        var serial = await db.Serials.FirstAsync(s => s.SerialId == 1);
+
+        await tracking.MoveAsync(new[] { serial }, SerialStatus.InTransit, null, null, "TRF", 7, DateTime.UtcNow);
+        await db.SaveChangesAsync();
+
+        var movement = await db.SerialMovements.SingleAsync(m => m.SerialId == 1);
+        Assert.Equal(SerialStatus.InTransit, movement.Status);
+        Assert.Equal(Wh1, movement.FromWarehouseId);
+        Assert.Null(movement.WarehouseId);
+        Assert.Null(serial.WarehouseId);
+    }
+
+    // --- auto-generated serial numbers -------------------------------------------------------
+
+    [Fact]
+    public async Task NextNumbers_ContinueAfterHighestUsed_AndSkipDraftGrnNumbers()
+    {
+        await using var db = await SeedAsync();
+        db.Serials.Add(new Serial { SerialId = 50, ItemId = SerialItemId, SerialNo = "PH-0041", Status = SerialStatus.Sold });
+        // A draft GRN line already holds PH-0042 (not yet a Serial).
+        db.GrnLines.Add(new GrnLine { GrnLineId = 900, GrnId = 1, ItemId = SerialItemId, Qty = 1,
+            Serials = { new GrnLineSerial { SerialNo = "PH-0042" } } });
+        await db.SaveChangesAsync();
+        var tracking = new ItemTrackingService(db, null!);
+
+        var next = await tracking.NextSerialNumbersAsync(SerialItemId, "PH-", 3);
+
+        Assert.Equal(new[] { "PH-0043", "PH-0044", "PH-0045" }, next);
+    }
+
+    [Fact]
+    public async Task NextNumbers_StartAtOne_ForANewPrefix_AndIgnoreOtherItems()
+    {
+        await using var db = await SeedAsync();
+        db.Serials.Add(new Serial { SerialId = 51, ItemId = PlainItemId, SerialNo = "NEW-0099", Status = SerialStatus.InStock });
+        await db.SaveChangesAsync();
+        var tracking = new ItemTrackingService(db, null!);
+
+        var next = await tracking.NextSerialNumbersAsync(SerialItemId, "NEW-", 2);
+
+        Assert.Equal(new[] { "NEW-0001", "NEW-0002" }, next);
+    }
+
+    [Fact]
+    public async Task NextNumbers_RejectsTooMany()
+    {
+        await using var db = await SeedAsync();
+        var tracking = new ItemTrackingService(db, null!);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => tracking.NextSerialNumbersAsync(SerialItemId, "X-", 5000));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+    }
+
+    // --- fixtures ---------------------------------------------------------------------------
+
+    private static async Task<ErpDbContext> SeedAsync()
+    {
+        var db = CreateContext();
+        db.Items.AddRange(
+            new Item { ItemId = SerialItemId, Sku = "SER-1", Name = "Phone", CategoryId = 1, BaseUomId = 1, StockNature = StockNature.Stocked, TrackingMode = TrackingMode.Serial },
+            new Item { ItemId = BatchItemId, Sku = "BAT-1", Name = "Milk", CategoryId = 1, BaseUomId = 1, StockNature = StockNature.Stocked, TrackingMode = TrackingMode.Batch },
+            new Item { ItemId = PlainItemId, Sku = "PLN-1", Name = "Bolt", CategoryId = 1, BaseUomId = 1, StockNature = StockNature.Stocked, TrackingMode = TrackingMode.None });
+        db.Batches.AddRange(
+            new Batch { BatchId = 100, ItemId = BatchItemId, BatchNo = "B-OK", ExpiryDate = DateOnly.FromDateTime(DateTime.UtcNow).AddDays(30) },
+            new Batch { BatchId = 101, ItemId = BatchItemId, BatchNo = "B-EXP", ExpiryDate = DateOnly.FromDateTime(DateTime.UtcNow).AddDays(-1) });
+        db.Serials.AddRange(
+            new Serial { SerialId = 1, ItemId = SerialItemId, SerialNo = "SN-1", Status = SerialStatus.InStock, WarehouseId = Wh1 },
+            new Serial { SerialId = 2, ItemId = SerialItemId, SerialNo = "SN-2", Status = SerialStatus.InStock, WarehouseId = Wh1 },
+            new Serial { SerialId = 3, ItemId = SerialItemId, SerialNo = "SN-3", Status = SerialStatus.InStock, WarehouseId = Wh2 },
+            new Serial { SerialId = 4, ItemId = SerialItemId, SerialNo = "SN-4", Status = SerialStatus.Sold, WarehouseId = null },
+            new Serial { SerialId = 5, ItemId = SerialItemId, SerialNo = "SN-5", Status = SerialStatus.Damaged, WarehouseId = Wh1 });
+        await db.SaveChangesAsync();
+        return db;
+    }
+
+    private static ErpDbContext CreateContext()
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root)
+            .Options;
+        var currentUser = new TestCurrentUser();
+        return new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
+    }
+
+    // Pricing is never touched by the tracking check, so it is not wired.
+    private static SalesDomainService CreateSalesDomain(ErpDbContext db) => new(
+        new Repository<Customer>(db), new Repository<Warehouse>(db), new Repository<User>(db),
+        new Repository<Item>(db), new Repository<TaxRate>(db), null!, new Repository<SalesConfig>(db),
+        new Repository<Batch>(db), new Repository<Serial>(db), new Repository<StockLayer>(db),
+        CreateSerialTracking(db));
+
+    private static SerialTrackingService CreateSerialTracking(ErpDbContext db) => new(
+        new Repository<Serial>(db), new Repository<SerialMovement>(db), new Repository<StockLayer>(db),
+        new Repository<ProductConfig>(db), new TestCurrentUser());
+
+    private static async Task SwitchSerialNumbersAsync(ErpDbContext db, bool enabled)
+    {
+        db.ProductConfig.Add(new ProductConfig { ConfigId = ProductConfig.SingletonId, SerialNumbersEnabled = enabled });
+        await db.SaveChangesAsync();
+    }
+
+    // --- Product Configuration "Serial numbers" switch ---------------------------------------
+
+    [Fact]
+    public async Task SwitchOff_SerialItemSells_WithoutSerials()
+    {
+        await using var db = await SeedAsync();
+        await SwitchSerialNumbersAsync(db, enabled: false);
+        var sales = CreateSalesDomain(db);
+
+        // No pre-tracking stock exists, yet nothing is asked: the item is plain stock now.
+        var serials = await sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 5, null, null, new HashSet<int>());
+
+        Assert.Empty(serials);
+    }
+
+    [Fact]
+    public async Task SwitchOff_SerialsSent_AreRefused()
+    {
+        await using var db = await SeedAsync();
+        await SwitchSerialNumbersAsync(db, enabled: false);
+        var sales = CreateSalesDomain(db);
+        var tracking = CreateSerialTracking(db);
+        var item = await db.Items.FirstAsync(i => i.ItemId == SerialItemId);
+
+        var sale = await Assert.ThrowsAsync<DomainException>(() =>
+            sales.ValidateLineTrackingAsync(SerialItemId, Wh1, 1, null, new[] { 1 }, new HashSet<int>()));
+        var adjustment = await Assert.ThrowsAsync<DomainException>(() =>
+            tracking.ResolveInboundAsync(item, Wh1, 1, new[] { "SN-X" }, new HashSet<string>()));
+
+        Assert.Equal(ErrorCodes.ConfigDisabled, sale.Code);
+        Assert.Equal(ErrorCodes.ConfigDisabled, adjustment.Code);
+    }
+
+    [Fact]
+    public async Task SwitchOn_IsTheDefault_WhenConfigRowIsMissing()
+    {
+        await using var db = await SeedAsync();
+        Assert.True(await CreateSerialTracking(db).IsEnabledAsync());
+    }
+}

Backend/ERPCore.Tests/LowStockAlertServiceTests.cs

@@ -0,0 +1,117 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Notifications;
+using ERPCore.Dtos.Stock;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services.Interfaces;
+using ERPCore.Services.Stock;
+using ERPCore.Tests.TestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>Low-stock / reorder alerts raised after stock issues.</summary>
+public class LowStockAlertServiceTests
+{
+    private const int ItemId = 1, WarehouseId = 1;
+
+    [Theory]
+    [InlineData(12, 4, 8, true)]    // 12 → 8 crosses the alert level of 10
+    [InlineData(12, 2, 10, true)]   // landing exactly on the level counts
+    [InlineData(20, 5, 15, false)]  // still above the level
+    [InlineData(9, 3, 6, false)]    // was already low — no repeat alert on every sale
+    public async Task Alerts_OnlyWhenAnIssueCrossesTheReorderPoint(decimal before, decimal issued, decimal after, bool alerts)
+    {
+        Assert.Equal(before - issued, after);
+        await using var db = Seed();
+        var tracker = new LowStockTracker();
+        tracker.Track(ItemId, WarehouseId, issued);
+        var notifications = new RecordingNotifications();
+
+        await Service(db, tracker, after, notifications).CheckAsync();
+
+        if (!alerts)
+        {
+            Assert.Empty(notifications.Raised);
+            return;
+        }
+        var raised = Assert.Single(notifications.Raised);
+        Assert.Equal(LowStockAlertService.ModuleKey, raised.ModuleKey);
+        Assert.Contains("SKU-1", raised.Message);
+        Assert.Contains($"down to {after:0.####} pcs at WH-1", raised.Message);
+        Assert.Contains("Suggested reorder: 50 pcs", raised.Message);
+    }
+
+    [Fact]
+    public async Task ItemsWithoutARule_OrUntouched_AreIgnored()
+    {
+        await using var db = Seed();
+        var tracker = new LowStockTracker();
+        tracker.Track(itemId: 99, WarehouseId, 100);     // no rule for this item
+        var notifications = new RecordingNotifications();
+
+        await Service(db, tracker, available: 0, notifications).CheckAsync();
+        await Service(db, new LowStockTracker(), available: 0, notifications).CheckAsync();  // nothing issued
+
+        Assert.Empty(notifications.Raised);
+    }
+
+    [Fact]
+    public async Task Tracker_SumsIssuesWithinARequest_AndEmptiesWhenDrained()
+    {
+        var tracker = new LowStockTracker();
+        tracker.Track(ItemId, WarehouseId, 3);
+        tracker.Track(ItemId, WarehouseId, 4);
+        tracker.Track(ItemId, WarehouseId, 0);
+
+        Assert.Equal(7m, tracker.Drain()[(ItemId, WarehouseId)]);
+        Assert.Empty(tracker.Drain());
+    }
+
+    private static LowStockAlertService Service(ErpDbContext db, LowStockTracker tracker, decimal available, INotificationService notifications)
+        => new(tracker, new Repository<ItemReorder>(db), new FixedStock(available), notifications);
+
+    private static ErpDbContext Seed()
+    {
+        var db = BankDepositTestSupport.CreateContext();   // users, branches, warehouses WH-1 / WH-2
+        db.Uoms.Add(new Uom { UomId = 1, Name = "pcs" });
+        db.Items.Add(new Item { ItemId = ItemId, Sku = "SKU-1", Name = "Cola 500ml", BaseUomId = 1, CategoryId = 1 });
+        db.ItemReorders.Add(new ItemReorder { ReorderId = 1, ItemId = ItemId, WarehouseId = WarehouseId, ReorderPoint = 10, ReorderQty = 50 });
+        db.SaveChanges();
+        return db;
+    }
+
+    private sealed class FixedStock(decimal available) : IStockService
+    {
+        public Task<StockOnHandDto> GetOnHandAsync(int itemId, int warehouseId, CancellationToken ct = default)
+            => Task.FromResult(new StockOnHandDto(itemId, warehouseId, available, available, 0, 0, 0, DateTime.UtcNow));
+        public Task<PagedResponse<StockOnHandDto>> GetOnHandListAsync(int? itemId, int? warehouseId, int? branchId, PageQuery query, CancellationToken ct = default)
+            => throw new NotSupportedException();
+        public Task<IReadOnlyDictionary<int, decimal>> GetAvailableByItemAsync(int warehouseId, CancellationToken ct = default)
+            => throw new NotSupportedException();
+        public Task<PagedResponse<StockLedgerRowDto>> GetLedgerAsync(int? itemId, int? warehouseId, int? branchId, DateOnly? from, DateOnly? to,
+            string? sourceDocType, int? sourceDocId, PageQuery query, CancellationToken ct = default,
+            int? categoryId = null, int? brandId = null) => throw new NotSupportedException();
+        public Task<StockValuationDto> GetValuationAsync(int itemId, int warehouseId, CancellationToken ct = default)
+            => throw new NotSupportedException();
+    }
+
+    private sealed class RecordingNotifications : INotificationService
+    {
+        public List<(string ModuleKey, string Title, string Message)> Raised { get; } = new();
+
+        public Task RaiseAsync(string moduleKey, string title, string message, string? relatedEntityType = null,
+            int? relatedEntityId = null, CancellationToken ct = default)
+        {
+            Raised.Add((moduleKey, title, message));
+            return Task.CompletedTask;
+        }
+
+        public Task NotifyUsersAsync(IEnumerable<int> userIds, string moduleKey, string title, string message,
+            string? relatedEntityType = null, int? relatedEntityId = null, CancellationToken ct = default) => throw new NotSupportedException();
+
+        public Task<NotificationFeedDto> GetFeedAsync(int userId, int take = 20, CancellationToken ct = default) => throw new NotSupportedException();
+        public Task MarkAllReadAsync(int userId, CancellationToken ct = default) => throw new NotSupportedException();
+    }
+}

Backend/ERPCore.Tests/NotificationConfigServiceTests.cs

@@ -30,7 +30,7 @@ public class NotificationConfigServiceTests
 
         var result = await service.GetAsync();
 
-        Assert.Equal(7u, result.RowVersion);
+        Assert.Equal(1u, result.RowVersion);
         Assert.Contains(result.Value.Modules, m => m.ModuleKey == "sale.create" && m.EmailEnabled && !m.SmsEnabled && m.InAppEnabled);
         Assert.Contains(result.Value.Modules, m => m.ModuleKey == "grn.confirmed" && !m.EmailEnabled && !m.SmsEnabled && !m.InAppEnabled);
     }
@@ -55,9 +55,9 @@ public class NotificationConfigServiceTests
             }).ToList()
         };
 
-        var updated = await service.UpdateAsync(request, 7);
+        var updated = await service.UpdateAsync(request, 1);
 
-        Assert.Equal(7u, updated.RowVersion);
+        Assert.Equal(2u, updated.RowVersion);
         Assert.Contains(updated.Value.Modules, m => m.ModuleKey == catalog.GetAll()[0].Key && m.EmailEnabled && !m.SmsEnabled && !m.InAppEnabled);
         Assert.Contains(updated.Value.Modules, m => m.ModuleKey == catalog.GetAll()[1].Key && !m.EmailEnabled && m.SmsEnabled && m.InAppEnabled);
 
@@ -133,7 +133,7 @@ public class NotificationConfigServiceTests
             }).ToList()
         };
 
-        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(request, 7));
+        var ex = await Assert.ThrowsAsync<DomainException>(() => service.UpdateAsync(request, 1));
         Assert.Equal(ErrorCodes.ConcurrencyConflict, ex.Code);
         Assert.Equal(412, ex.StatusCode);
     }

Backend/ERPCore.Tests/PermissionCoverageTests.cs

@@ -0,0 +1,428 @@
+using System.Reflection;
+using System.Security.Claims;
+using ERPCore.Controllers;
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Search;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.System.Errors;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Abstractions;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata;
+using Microsoft.Extensions.Caching.Memory;
+using static ERPCore.Tests.TestSupport.BankDepositTestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// Permission coverage (Phase B): every API endpoint that changes data sits behind a permission, every permission the
+/// controllers name actually exists in the seeded catalogue, HR data is gated, global search respects the role,
+/// state-changing cookie requests need the CSRF token, and a branch-less person can't read every branch.
+/// </summary>
+public class PermissionCoverageTests
+{
+    // The seeded (HasData) rows live in the design-time model; the runtime model drops them.
+    private static IEnumerable<IDictionary<string, object?>> Seed<T>(ErpDbContext db) =>
+        Microsoft.EntityFrameworkCore.Infrastructure.AccessorExtensions.GetService<IDesignTimeModel>(db)
+            .Model.FindEntityType(typeof(T))!.GetSeedData();
+
+    // ---------------------------------------------------------------- controllers <-> permissions
+
+    private static IEnumerable<Type> ApiControllers() =>
+        typeof(ApiControllerBase).Assembly.GetTypes()
+            .Where(t => !t.IsAbstract && typeof(ApiControllerBase).IsAssignableFrom(t));
+
+    private static IEnumerable<string> NavPolicyNames(MemberInfo member) =>
+        member.GetCustomAttributes<AuthorizeAttribute>(inherit: true)
+            .Select(a => a.Policy)
+            .Where(p => p is not null && p.StartsWith(NavPolicies.Prefix, StringComparison.Ordinal))!;
+
+    private static bool IsReadOnly(MethodInfo m) =>
+        m.GetCustomAttributes<HttpGetAttribute>().Any() && !m.GetCustomAttributes().OfType<Microsoft.AspNetCore.Mvc.Routing.HttpMethodAttribute>().Any(a => a is not HttpGetAttribute);
+
+    /// <summary>Endpoints that deliberately sit behind the login door only: personal, or checked inside the service.</summary>
+    private static readonly HashSet<string> OpenByDesign = new()
+    {
+        nameof(AuthController),            // sign-in, sessions, password: the person's own
+        nameof(NavController),             // "what may I see": the person's own permissions
+        nameof(NotificationsController),   // the person's own inbox
+        nameof(SupportTicketsController),  // anyone may raise a ticket; the service scopes by owner/admin
+        nameof(TrackingController),        // read-only serial/batch pickers used inside sales and stock screens
+        nameof(SearchController),          // gated per result type inside GlobalSearchService
+        nameof(MetaController),
+    };
+
+    [Fact]
+    public void EveryDataChangingEndpoint_IsBehindAPermission()
+    {
+        var uncovered = new List<string>();
+        foreach (var controller in ApiControllers().Where(c => !OpenByDesign.Contains(c.Name)))
+        {
+            var classCovered = NavPolicyNames(controller).Any();
+            foreach (var action in controller.GetMethods(BindingFlags.Public | BindingFlags.Instance | BindingFlags.DeclaredOnly)
+                         .Where(m => m.GetCustomAttributes().OfType<Microsoft.AspNetCore.Mvc.Routing.HttpMethodAttribute>().Any()))
+            {
+                if (IsReadOnly(action)) continue;
+                if (action.GetCustomAttributes<AllowAnonymousAttribute>().Any()) continue;
+                if (!classCovered && !NavPolicyNames(action).Any()) uncovered.Add($"{controller.Name}.{action.Name}");
+            }
+        }
+
+        Assert.True(uncovered.Count == 0, "Data-changing endpoints with no Nav permission: " + string.Join(", ", uncovered));
+    }
+
+    [Fact]
+    public void EveryControllerAboutSensitiveData_IsGatedAsAWhole()
+    {
+        // HR (salaries, bank accounts, loans, payslips) and the audit trail used to be open to every signed-in person.
+        foreach (var name in new[]
+                 {
+                     "AttendanceBatchesController", "LeaveRequestsController", "PayrollRunsController", "PayslipsController",
+                     "HrReportsController", "EmployeesController", "SalaryComponentsController", "TaxSlabsController",
+                     "PayrollStatutorySettingsController", "AuditLogsController",
+                 })
+        {
+            var type = typeof(ApiControllerBase).Assembly.GetTypes().Single(t => t.Name == name);
+            Assert.True(NavPolicyNames(type).Any(), $"{name} has no class-level Nav permission.");
+        }
+    }
+
+    [Fact]
+    public void PayData_NeedsThePayrollPermission_OnTopOfEmployees()
+    {
+        var employees = typeof(ApiControllerBase).Assembly.GetTypes().Single(t => t.Name == "EmployeesController");
+        foreach (var action in new[] { "ListBankDetails", "GetSalaryStructureHistory", "ListLoans", "GetLoan", "CreateLoan", "CreateSalaryStructure", "ReplaceBankDetails" })
+        {
+            var method = employees.GetMethod(action)!;
+            Assert.Contains(NavPolicyNames(method), p => p.StartsWith(NavPolicies.Prefix + "hrm.payroll", StringComparison.Ordinal));
+        }
+
+        var reports = typeof(ApiControllerBase).Assembly.GetTypes().Single(t => t.Name == "HrReportsController");
+        foreach (var action in new[] { "PayrollRegister", "SalaryHistory" })
+            Assert.Contains(NavPolicyNames(reports.GetMethod(action)!), p => p == NavPolicies.Prefix + "hrm.payroll");
+    }
+
+    [Fact]
+    public void EveryNavCodeTheControllersName_ExistsInTheSeededCatalogue()
+    {
+        // The old Nav:vendors policy named a code that no longer existed, so only administrators got through.
+        using var db = CreateContext();
+        var seeded = Seed<Permission>(db)
+            .Select(d => ((string)d[nameof(Permission.Code)]!).Substring("NAV:".Length))
+            .ToHashSet(StringComparer.Ordinal);
+
+        var missing = new SortedSet<string>();
+        foreach (var controller in ApiControllers())
+        {
+            var names = NavPolicyNames(controller).Concat(
+                controller.GetMethods(BindingFlags.Public | BindingFlags.Instance | BindingFlags.DeclaredOnly).SelectMany(NavPolicyNames));
+            foreach (var name in names)
+            {
+                var rest = name[NavPolicies.Prefix.Length..];
+                var sep = rest.LastIndexOf(NavPolicies.ActionSeparator, StringComparison.Ordinal);
+                var code = sep >= 0 && Enum.TryParse<RolePermissionAction>(rest[(sep + 1)..], out _) ? rest[..sep] : rest;
+                // A module code is satisfied by the module itself or any screen inside it (HasAccessAsync does the same).
+                if (!seeded.Contains(code) && !seeded.Any(s => s.StartsWith(code + ".", StringComparison.Ordinal))) missing.Add($"{controller.Name}: {code}");
+            }
+        }
+
+        Assert.True(missing.Count == 0, "Controllers name permissions that are not seeded: " + string.Join("; ", missing));
+    }
+
+    [Fact]
+    public void SeededCatalogue_HasNoDuplicateCodes_AndEverySubItemHasAPermission()
+    {
+        using var db = CreateContext();
+        var permissions = Seed<Permission>(db).ToList();
+        var codes = permissions.Select(p => (string)p[nameof(Permission.Code)]!).ToList();
+        Assert.Equal(codes.Count, codes.Distinct().Count());
+
+        var subItems = Seed<SubNavItem>(db);
+        var granted = permissions.Where(p => p[nameof(Permission.SubNavItemId)] is not null).Select(p => (int)p[nameof(Permission.SubNavItemId)]!).ToHashSet();
+        foreach (var sub in subItems)
+            Assert.True(granted.Contains((int)sub[nameof(SubNavItem.SubNavItemId)]!), $"No permission row for sub item {sub[nameof(SubNavItem.Code)]}.");
+    }
+
+    [Theory]
+    [InlineData("hrm")]
+    [InlineData("hrm.employees")]
+    [InlineData("hrm.payroll")]
+    [InlineData("sales-returns")]
+    [InlineData("settings.audit-logs")]
+    [InlineData("dashboard.stock")]
+    [InlineData("dashboard.procurement")]
+    [InlineData("dashboard.approvals")]
+    [InlineData("dashboard.sales")]
+    [InlineData("dashboard.accounts")]
+    [InlineData("dashboard.hrm")]
+    [InlineData("dashboard.production")]
+    [InlineData("dashboard.service")]
+    public void NewPermissions_AreSeeded(string code)
+    {
+        using var db = CreateContext();
+        var codes = Seed<Permission>(db).Select(d => (string)d[nameof(Permission.Code)]!);
+        Assert.Contains("NAV:" + code, codes);
+    }
+
+    // ---------------------------------------------------------------- the policies actually decide
+
+    private sealed class FakeUser(int? roleId, bool isAdmin = false, int? branchId = null, bool branching = true) : ICurrentUser
+    {
+        public int AuditUserId => 10;
+        public int? RoleId => roleId;
+        public string? RoleCode => null;
+        public bool IsAdmin => isAdmin;
+        public string UserId => "10";
+        public bool IsAuthenticated => true;
+        public int? BranchId => branchId;
+        public bool BranchingEnabled => branching;
+    }
+
+    private static async Task<(ErpDbContext Db, NavPermissionService Nav)> RolesAsync()
+    {
+        var db = CreateContext();
+        db.Roles.AddRange(
+            new Role { RoleId = 1, Code = "Hr", Name = "HR officer", CreatedAt = DateTime.UtcNow },
+            new Role { RoleId = 2, Code = "Clerk", Name = "Clerk", CreatedAt = DateTime.UtcNow });
+        db.NavItems.Add(new NavItem { NavItemId = 100, Code = "hrm", Label = "HR" });
+        db.SubNavItems.AddRange(
+            new SubNavItem { SubNavItemId = 101, NavItemId = 100, Code = "hrm.employees", Label = "Employees" },
+            new SubNavItem { SubNavItemId = 102, NavItemId = 100, Code = "hrm.payroll", Label = "Payroll" });
+        db.Permissions.AddRange(
+            new Permission { PermissionId = 200, Code = "NAV:hrm.employees", SubNavItemId = 101 },
+            new Permission { PermissionId = 201, Code = "NAV:hrm.payroll", SubNavItemId = 102 });
+        db.RolePermissions.Add(new RolePermission { RoleId = 1, PermissionId = 200, Actions = RolePermissionAction.View | RolePermissionAction.Edit });
+        await db.SaveChangesAsync();
+        return (db, new NavPermissionService(new Repository<Role>(db), new Repository<RolePermission>(db), new MemoryCache(new MemoryCacheOptions())));
+    }
+
+    private static async Task<bool> PassesAsync(NavPermissionService nav, ICurrentUser user, string policyName)
+    {
+        var provider = new NavPolicyProvider(Microsoft.Extensions.Options.Options.Create(new AuthorizationOptions()));
+        var policy = (await provider.GetPolicyAsync(policyName))!;
+        var requirement = policy.Requirements.OfType<NavRequirement>().Single();
+        var context = new AuthorizationHandlerContext(new[] { requirement }, new ClaimsPrincipal(new ClaimsIdentity("test")), null);
+        await new NavAuthorizationHandler(user, nav).HandleAsync(context);
+        return context.HasSucceeded;
+    }
+
+    [Fact]
+    public async Task HrOfficer_ReachesEmployees_ButNotPayData_AndAnAdministratorReachesAll()
+    {
+        var (db, nav) = await RolesAsync();
+        await using var _ = db;
+        var hr = new FakeUser(roleId: 1);
+
+        Assert.True(await PassesAsync(nav, hr, "Nav:hrm"));                    // the module, via a screen inside it
+        Assert.True(await PassesAsync(nav, hr, "Nav:hrm.employees"));
+        Assert.True(await PassesAsync(nav, hr, "Nav:hrm.employees:Edit"));
+        Assert.False(await PassesAsync(nav, hr, "Nav:hrm.employees:Delete"));  // not granted
+        Assert.False(await PassesAsync(nav, hr, "Nav:hrm.payroll"));           // salaries, loans, bank accounts
+        Assert.False(await PassesAsync(nav, hr, "Nav:settings.audit-logs"));
+
+        Assert.False(await PassesAsync(nav, new FakeUser(roleId: 2), "Nav:hrm"));
+        Assert.False(await PassesAsync(nav, new FakeUser(roleId: null), "Nav:hrm"));
+
+        Assert.True(await PassesAsync(nav, new FakeUser(roleId: 2, isAdmin: true), "Nav:hrm.payroll:Approve"));
+    }
+
+    // ---------------------------------------------------------------- global search follows the role
+
+    [Fact]
+    public async Task Search_OnlyReturnsKindsTheRoleMayOpen()
+    {
+        var (db, nav) = await RolesAsync();
+        await using var _ = db;
+        db.Employees.Add(new Employee { EmployeeId = 1, EmployeeCode = "E-1", FullName = "Alice Perera", BranchId = Branch1 });
+        await db.SaveChangesAsync();
+
+        GlobalSearchService Search(ICurrentUser u) => new(
+            new Repository<Item>(db), new Repository<PurchaseOrder>(db), new Repository<SalesSlip>(db), new Repository<Employee>(db), u, nav);
+
+        var hr = await Search(new FakeUser(roleId: 1)).SearchAsync("Alice");
+        Assert.Contains(hr, r => r.Type == GlobalSearchResultType.Employee);
+
+        var clerk = await Search(new FakeUser(roleId: 2)).SearchAsync("Alice");
+        Assert.DoesNotContain(clerk, r => r.Type == GlobalSearchResultType.Employee);
+
+        var admin = await Search(new FakeUser(roleId: 2, isAdmin: true)).SearchAsync("Alice");
+        Assert.Contains(admin, r => r.Type == GlobalSearchResultType.Employee);
+    }
+
+    // ---------------------------------------------------------------- CSRF on every cookie-authenticated mutation
+
+    private static (CsrfProtectionFilter Filter, ActionExecutingContext Context) CsrfCall(
+        string method, string? cookie = "token", string? header = null, bool sessionCookie = true,
+        bool bearer = false, bool anonymousEndpoint = false, bool hasCsrfAttribute = false)
+    {
+        var http = new DefaultHttpContext();
+        http.Request.Method = method;
+        var cookies = new List<string>();
+        if (sessionCookie) cookies.Add("erp_at=jwt");
+        if (cookie is not null) cookies.Add($"XSRF-TOKEN={cookie}");
+        if (cookies.Count > 0) http.Request.Headers.Cookie = string.Join("; ", cookies);
+        if (header is not null) http.Request.Headers["X-XSRF-TOKEN"] = header;
+        if (bearer) http.Request.Headers.Authorization = "Bearer abc";
+
+        var metadata = new List<object>();
+        if (anonymousEndpoint) metadata.Add(new AllowAnonymousAttribute());
+        if (hasCsrfAttribute) metadata.Add(new ValidateCsrfAttribute());
+        http.SetEndpoint(new Endpoint(null, new EndpointMetadataCollection(metadata), "test"));
+
+        var actionContext = new ActionContext(http, new RouteData(), new ActionDescriptor());
+        var context = new ActionExecutingContext(actionContext, new List<IFilterMetadata>(), new Dictionary<string, object?>(), new object());
+        return (new CsrfProtectionFilter(), context);
+    }
+
+    private static async Task<bool> RunAsync(CsrfProtectionFilter filter, ActionExecutingContext context)
+    {
+        var ran = false;
+        await filter.OnActionExecutionAsync(context, () =>
+        {
+            ran = true;
+            return Task.FromResult(new ActionExecutedContext(context, context.Filters, context.Controller));
+        });
+        return ran;
+    }
+
+    [Theory]
+    [InlineData("POST")]
+    [InlineData("PUT")]
+    [InlineData("PATCH")]
+    [InlineData("DELETE")]
+    public async Task CookieRequest_WithoutTheCsrfHeader_IsRefused(string method)
+    {
+        var (filter, context) = CsrfCall(method, cookie: "token", header: null);
+        var ex = await Assert.ThrowsAsync<DomainException>(() => RunAsync(filter, context));
+        Assert.Equal(ErrorCodes.CsrfTokenMismatch, ex.Code);
+        Assert.Equal(403, ex.StatusCode);
+    }
+
+    [Fact]
+    public async Task CookieRequest_WithAWrongOrMissingCsrfCookie_IsRefused()
+    {
+        var (f1, c1) = CsrfCall("POST", cookie: "token", header: "other");
+        await Assert.ThrowsAsync<DomainException>(() => RunAsync(f1, c1));
+
+        var (f2, c2) = CsrfCall("POST", cookie: null, header: "token");
+        await Assert.ThrowsAsync<DomainException>(() => RunAsync(f2, c2));
+    }
+
+    [Fact]
+    public async Task CookieRequest_WithMatchingCsrfHeader_Runs()
+    {
+        var (filter, context) = CsrfCall("DELETE", cookie: "token", header: "token");
+        Assert.True(await RunAsync(filter, context));
+    }
+
+    [Theory]
+    [InlineData("GET")]
+    [InlineData("HEAD")]
+    [InlineData("OPTIONS")]
+    public async Task SafeMethods_AreNotChecked(string method)
+    {
+        var (filter, context) = CsrfCall(method, cookie: null);
+        Assert.True(await RunAsync(filter, context));
+    }
+
+    [Fact]
+    public async Task BearerCallers_AnonymousEndpoints_AndRequestsWithoutASessionCookie_AreNotChecked()
+    {
+        var (f1, c1) = CsrfCall("POST", cookie: null, bearer: true);
+        Assert.True(await RunAsync(f1, c1));
+
+        var (f2, c2) = CsrfCall("POST", cookie: null, anonymousEndpoint: true);
+        Assert.True(await RunAsync(f2, c2));
+
+        var (f3, c3) = CsrfCall("POST", cookie: null, sessionCookie: false);
+        Assert.True(await RunAsync(f3, c3));
+    }
+
+    [Fact]
+    public async Task ActionsThatCarryTheirOwnCsrfAttribute_AreNotCheckedTwice()
+    {
+        var (filter, context) = CsrfCall("POST", cookie: null, hasCsrfAttribute: true);
+        Assert.True(await RunAsync(filter, context)); // the attribute itself enforces it
+    }
+
+    [Fact]
+    public void TheCsrfFilter_IsRegisteredGlobally()
+    {
+        var program = File.ReadAllText(Path.Combine(FindBackendRoot(), "ERPCore", "Program.cs"));
+        Assert.Contains("Filters.Add<ERPCore.Infra.Auth.CsrfProtectionFilter>()", program);
+    }
+
+    private static string FindBackendRoot()
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir is not null && !Directory.Exists(Path.Combine(dir.FullName, "ERPCore"))) dir = dir.Parent;
+        return dir?.FullName ?? throw new DirectoryNotFoundException("Backend root not found.");
+    }
+
+    // ---------------------------------------------------------------- a branch-less person can't read every branch
+
+    [Fact]
+    public void BranchContext_AdministratorsAreNeverScoped()
+    {
+        var ctx = new CurrentBranchContext(new FakeUser(roleId: 1, isAdmin: true, branchId: 5));
+        Assert.False(ctx.IsActive);
+        Assert.Null(ctx.BranchId);
+    }
+
+    [Fact]
+    public void BranchContext_AnEmployeeIsScopedToTheirOwnBranch()
+    {
+        var ctx = new CurrentBranchContext(new FakeUser(roleId: 1, branchId: 5));
+        Assert.True(ctx.IsActive);
+        Assert.Equal(5, ctx.BranchId);
+    }
+
+    [Fact]
+    public void BranchContext_APersonWithNoBranch_InABranchingDeployment_SeesNoBranchAtAll()
+    {
+        var ctx = new CurrentBranchContext(new FakeUser(roleId: 1, branchId: null, branching: true));
+        Assert.True(ctx.IsActive);
+        Assert.Equal(CurrentBranchContext.NoBranchId, ctx.BranchId);
+    }
+
+    [Fact]
+    public void BranchContext_APersonWithNoBranch_WhenBranchingIsOff_IsNotScoped()
+    {
+        var ctx = new CurrentBranchContext(new FakeUser(roleId: 1, branchId: null, branching: false));
+        Assert.False(ctx.IsActive);
+        Assert.Null(ctx.BranchId);
+    }
+
+    [Fact]
+    public async Task QueryFilters_HideEveryWarehouse_FromABranchlessNonAdmin_ButNotFromAnAdminOrWhenBranchingIsOff()
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString("N")).Options;
+
+        async Task<int> CountFor(ICurrentUser user, bool seed)
+        {
+            await using var db = new ErpDbContext(options, user, new CurrentBranchContext(user));
+            if (seed)
+            {
+                db.Warehouses.AddRange(
+                    new Warehouse { WarehouseId = 1, Code = "W1", Name = "One", BranchId = 1 },
+                    new Warehouse { WarehouseId = 2, Code = "W2", Name = "Two", BranchId = 2 });
+                await db.SaveChangesAsync();
+            }
+            return db.Warehouses.Count();
+        }
+
+        Assert.Equal(2, await CountFor(new FakeUser(1, isAdmin: true), seed: true));
+        Assert.Equal(1, await CountFor(new FakeUser(1, branchId: 2), seed: false));
+        Assert.Equal(0, await CountFor(new FakeUser(1, branchId: null, branching: true), seed: false));
+        Assert.Equal(2, await CountFor(new FakeUser(1, branchId: null, branching: false), seed: false));
+    }
+}

Backend/ERPCore.Tests/ProcurementAndOpeningBalanceTests.cs

@@ -0,0 +1,837 @@
+using System.Text.Json;
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Notifications;
+using ERPCore.Dtos.OpeningBalances;
+using ERPCore.Dtos.Procurement;
+using ERPCore.Dtos.Vendors;
+using ERPCore.Infra.Gl;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.Services.Stock;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using static ERPCore.Tests.TestSupport.BankDepositTestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// Procurement configuration (vendor contact / address, PO tax) and the one-time opening balances.
+/// Every rule here is also enforced by the UI, so these tests are about the server refusing what a stale
+/// or hand-built request sends.
+/// </summary>
+public class ProcurementAndOpeningBalanceTests
+{
+    // ---------------------------------------------------------------- helpers
+
+    private static async Task SeedProcurementConfigAsync(
+        ErpDbContext db, VendorContactMode mode = VendorContactMode.None, bool address = false, bool tax = false,
+        bool terms = true, bool taxReg = true)
+    {
+        db.ProcurementConfig.Add(new ProcurementConfig
+        {
+            ConfigId = ProcurementConfig.SingletonId,
+            VendorContactMode = mode,
+            VendorAddressEnabled = address,
+            PoTaxEnabled = tax,
+            VendorPaymentTermsEnabled = terms,
+            VendorTaxRegEnabled = taxReg
+        });
+        await db.SaveChangesAsync();
+    }
+
+    private static ProcurementConfigService ConfigService(ErpDbContext db) =>
+        new(new ProcurementConfigRepository(db), new TestCurrentUser(), new PassThroughUnitOfWork(db));
+
+    private static VendorService VendorSvc(ErpDbContext db) =>
+        new(new Repository<Vendor>(db), new FakeBranchConfig(), ConfigService(db), new PassThroughUnitOfWork(db));
+
+    private static CreateVendorRequest NewVendor(string code, Action<CreateVendorRequest>? tweak = null)
+    {
+        var request = new CreateVendorRequest { Code = code, Name = $"Vendor {code}", Currency = "LKR", BranchId = Branch1 };
+        tweak?.Invoke(request);
+        return request;
+    }
+
+    private sealed class NullNotifications : INotificationService
+    {
+        public Task RaiseAsync(string moduleKey, string title, string message, string? relatedEntityType = null, int? relatedEntityId = null, CancellationToken ct = default) => Task.CompletedTask;
+        public Task NotifyUsersAsync(IEnumerable<int> userIds, string moduleKey, string title, string message, string? relatedEntityType = null, int? relatedEntityId = null, CancellationToken ct = default) => Task.CompletedTask;
+        public Task<NotificationFeedDto> GetFeedAsync(int userId, int take = 20, CancellationToken ct = default) => throw new NotSupportedException();
+        public Task MarkAllReadAsync(int userId, CancellationToken ct = default) => Task.CompletedTask;
+    }
+
+    // ---------------------------------------------------------------- vendors
+
+    [Fact]
+    public async Task Vendor_Mobile_IsRejected_WhileContactModeIsNone()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, VendorContactMode.None);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => VendorSvc(db).CreateAsync(NewVendor("V1", r => r.Mobile = "0771234567")));
+
+        Assert.Equal(ErrorCodes.ConfigDisabled, ex.Code);
+        Assert.Empty(db.Vendors);
+    }
+
+    [Fact]
+    public async Task Vendor_Mobile_IsSaved_WhenContactModeIsMobile_AndEmailIsStillRefused()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, VendorContactMode.Mobile);
+
+        var created = (await VendorSvc(db).CreateAsync(NewVendor("V2", r => r.Mobile = " +94 77 123 4567 "))).Value;
+        Assert.Equal("+94 77 123 4567", created.Mobile);
+        Assert.Null(created.Email);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => VendorSvc(db).CreateAsync(NewVendor("V3", r => r.Email = "a@b.lk")));
+        Assert.Equal(ErrorCodes.ConfigDisabled, ex.Code);
+    }
+
+    [Theory]
+    [InlineData("abc")]
+    [InlineData("12")]
+    public async Task Vendor_InvalidMobile_IsRejected(string mobile)
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, VendorContactMode.Mobile);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => VendorSvc(db).CreateAsync(NewVendor("V4", r => r.Mobile = mobile)));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+    }
+
+    [Fact]
+    public async Task Vendor_Address_NeedsTheSwitchOn()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, address: false);
+
+        var off = await Assert.ThrowsAsync<DomainException>(
+            () => VendorSvc(db).CreateAsync(NewVendor("V5", r => r.Address = "12 Galle Road")));
+        Assert.Equal(ErrorCodes.ConfigDisabled, off.Code);
+
+        db.ProcurementConfig.Single().VendorAddressEnabled = true;
+        await db.SaveChangesAsync();
+
+        var created = (await VendorSvc(db).CreateAsync(NewVendor("V6", r => r.Address = "12 Galle Road"))).Value;
+        Assert.Equal("12 Galle Road", created.Address);
+    }
+
+    [Fact]
+    public async Task Vendor_Update_KeepsStoredContact_WhenTheSwitchIsOff()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, VendorContactMode.Email, address: true);
+        var created = (await VendorSvc(db).CreateAsync(NewVendor("V7", r =>
+        {
+            r.Email = "accounts@supplier.lk";
+            r.Address = "Colombo";
+        }))).Value;
+
+        // Contact mode switched off later: an update must not erase what was recorded.
+        db.ProcurementConfig.Single().VendorContactMode = VendorContactMode.None;
+        await db.SaveChangesAsync();
+
+        var tracked = db.Vendors.Single(v => v.VendorId == created.VendorId);
+        var updated = (await VendorSvc(db).UpdateAsync(
+            created.VendorId,
+            new UpdateVendorRequest { Code = "V7", Name = "Renamed", Currency = "LKR", BranchId = Branch1 },
+            tracked.RowVersion)).Value;
+
+        Assert.Equal("Renamed", updated.Name);
+        Assert.Equal("accounts@supplier.lk", db.Vendors.Single().Email);
+    }
+
+    [Fact]
+    public async Task Vendor_TermsAndTaxReg_AreOnByDefault_AndSaved()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db); // defaults: terms + tax registration on
+
+        var created = (await VendorSvc(db).CreateAsync(NewVendor("V8", r =>
+        {
+            r.Terms = " NET30 ";
+            r.TaxReg = "134567890-7000";
+        }))).Value;
+
+        Assert.Equal("NET30", created.Terms);
+        Assert.Equal("134567890-7000", created.TaxReg);
+    }
+
+    [Fact]
+    public async Task Vendor_TermsAndTaxReg_AreRejectedWhenTheirSwitchesAreOff()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, terms: false, taxReg: false);
+
+        var terms = await Assert.ThrowsAsync<DomainException>(() => VendorSvc(db).CreateAsync(NewVendor("V9", r => r.Terms = "NET30")));
+        var taxReg = await Assert.ThrowsAsync<DomainException>(() => VendorSvc(db).CreateAsync(NewVendor("V10", r => r.TaxReg = "123")));
+
+        Assert.Equal(ErrorCodes.ConfigDisabled, terms.Code);
+        Assert.Equal(ErrorCodes.ConfigDisabled, taxReg.Code);
+        Assert.Empty(db.Vendors);
+
+        // Blank is fine: the form simply doesn't send them.
+        var ok = (await VendorSvc(db).CreateAsync(NewVendor("V11"))).Value;
+        Assert.Null(ok.Terms);
+    }
+
+    [Fact]
+    public async Task Vendor_Update_KeepsStoredTermsAndTaxReg_WhenSwitchedOff()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db);
+        var created = (await VendorSvc(db).CreateAsync(NewVendor("V12", r =>
+        {
+            r.Terms = "NET45";
+            r.TaxReg = "TRN-1";
+        }))).Value;
+
+        var cfg = db.ProcurementConfig.Single();
+        cfg.VendorPaymentTermsEnabled = false;
+        cfg.VendorTaxRegEnabled = false;
+        await db.SaveChangesAsync();
+
+        var tracked = db.Vendors.Single(v => v.VendorId == created.VendorId);
+        var updated = (await VendorSvc(db).UpdateAsync(
+            created.VendorId,
+            new UpdateVendorRequest { Code = "V12", Name = "Renamed", Currency = "LKR", BranchId = Branch1 },
+            tracked.RowVersion)).Value;
+
+        Assert.Equal("Renamed", updated.Name);
+        Assert.Equal(("NET45", "TRN-1"), (db.Vendors.Single().Terms, db.Vendors.Single().TaxReg));
+    }
+
+    // ---------------------------------------------------------------- purchase-order tax
+
+    private static PurchaseOrderService PoSvc(ErpDbContext db) =>
+        new(new PurchaseOrderRepository(db),
+            new FakeNumberSequence(), new TestCurrentUser(), new NullNotifications(), new FakeBranchConfig(),
+            ConfigService(db), new PassThroughUnitOfWork(db));
+
+    private static async Task<int> SeedVendorAndItemAsync(ErpDbContext db)
+    {
+        db.Vendors.Add(new Vendor { VendorId = 1, Code = "V-PO", Name = "PO Vendor", BranchId = Branch1, Status = EntityStatus.Active });
+        db.Items.Add(new Item { ItemId = 1, Sku = "SKU-1", Name = "Cola 500ml", CategoryId = 1, BaseUomId = 1 });
+        await db.SaveChangesAsync();
+        return 1;
+    }
+
+    private static CreatePurchaseOrderRequest PoRequest(decimal taxRate) => new()
+    {
+        VendorId = 1,
+        BranchId = Branch1,
+        SaveAsDraft = true,
+        Lines = [new CreatePoLineInput { ItemId = 1, WarehouseId = Warehouse1, Qty = 10, UnitPrice = 100m, Tax = taxRate }]
+    };
+
+    [Fact]
+    public async Task Po_TaxOn_StoresTheLineTaxAmount_AndTotalsIncludeIt()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, tax: true);
+        await SeedVendorAndItemAsync(db);
+
+        var po = (await PoSvc(db).CreateAsync(PoRequest(0.18m))).Value;
+
+        var line = Assert.Single(po.Lines);
+        Assert.Equal(180m, line.TaxAmount);
+        Assert.Equal((1000m, 180m, 1180m), (po.Totals.SubTotal, po.Totals.Tax, po.Totals.GrandTotal));
+        Assert.Equal(180m, db.PoLines.Single().TaxAmount);
+    }
+
+    [Fact]
+    public async Task Po_TaxAmount_RoundsHalfUp_ToTwoDecimals()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, tax: true);
+        await SeedVendorAndItemAsync(db);
+
+        // 3 x 33.5 = 100.5; at 5% the tax is 5.025 -> 5.03 (half away from zero, not banker's rounding).
+        var request = PoRequest(0.05m);
+        request.Lines[0].Qty = 3;
+        request.Lines[0].UnitPrice = 33.5m;
+
+        var po = (await PoSvc(db).CreateAsync(request)).Value;
+
+        Assert.Equal(5.03m, Assert.Single(po.Lines).TaxAmount);
+    }
+
+    [Fact]
+    public async Task Po_TaxOff_RejectsANonZeroRate_ButAcceptsZero()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, tax: false);
+        await SeedVendorAndItemAsync(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => PoSvc(db).CreateAsync(PoRequest(0.18m)));
+        Assert.Equal(ErrorCodes.ConfigDisabled, ex.Code);
+        Assert.Empty(db.PurchaseOrders);
+
+        var po = (await PoSvc(db).CreateAsync(PoRequest(0m))).Value;
+        Assert.Equal(0m, po.Totals.Tax);
+    }
+
+    [Fact]
+    public async Task Po_CarriesVendorDetails_OnlyForTheEnabledFields()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db, VendorContactMode.Email, address: false);
+        await SeedVendorAndItemAsync(db);
+        var vendor = db.Vendors.Single();
+        vendor.Mobile = "0771234567";
+        vendor.Email = "po@vendor.lk";
+        vendor.Address = "Colombo";
+        await db.SaveChangesAsync();
+
+        var po = (await PoSvc(db).CreateAsync(PoRequest(0m))).Value;
+
+        Assert.NotNull(po.Vendor);
+        Assert.Equal("PO Vendor", po.Vendor!.Name);
+        Assert.Equal("po@vendor.lk", po.Vendor.Email);
+        Assert.Null(po.Vendor.Mobile);   // contact mode is Email
+        Assert.Null(po.Vendor.Address);  // address switched off
+    }
+
+    // ---------------------------------------------------------------- purchase-order list: date filter + sort
+
+    /// <summary>Three POs from two vendors, created on known business days; returns their ids in creation order.</summary>
+    private static async Task<int[]> SeedListAsync(ErpDbContext db)
+    {
+        db.Vendors.AddRange(
+            new Vendor { VendorId = 1, Code = "V-B", Name = "Beta Traders", BranchId = Branch1, Status = EntityStatus.Active },
+            new Vendor { VendorId = 2, Code = "V-A", Name = "Alpha Foods", BranchId = Branch1, Status = EntityStatus.Active });
+        db.Items.Add(new Item { ItemId = 1, Sku = "SKU-1", Name = "Cola", CategoryId = 1, BaseUomId = 1 });
+
+        PurchaseOrder Po(int id, int vendor, DateTime createdUtc, decimal qty) => new()
+        {
+            PoId = id, DocNo = $"PO-{id}", VendorId = vendor, BranchId = Branch1, Status = PurchaseOrderStatus.Draft,
+            CreatedAt = createdUtc,
+            Lines = [new PoLine { ItemId = 1, WarehouseId = Warehouse1, Qty = qty, UnitPrice = 10m }]
+        };
+        db.PurchaseOrders.AddRange(
+            Po(1, 1, new DateTime(2026, 4, 1, 4, 0, 0, DateTimeKind.Utc), 5),    // 1 Apr (Colombo 09:30), total 50
+            Po(2, 2, new DateTime(2026, 4, 1, 20, 0, 0, DateTimeKind.Utc), 30),  // 2 Apr in Colombo (01:30), total 300
+            Po(3, 1, new DateTime(2026, 4, 10, 6, 0, 0, DateTimeKind.Utc), 10)); // 10 Apr, total 100
+        await db.SaveChangesAsync();
+        return [1, 2, 3];
+    }
+
+    private static async Task<List<int>> ListIds(PurchaseOrderService svc, string? sort = null, DateOnly? from = null, DateOnly? to = null)
+    {
+        var page = await svc.ListAsync(new ERPCore.Dtos.Common.PageQuery { Sort = sort, PageSize = 50 }, null, null, from, to);
+        return page.Items.Select(i => i.PoId).ToList();
+    }
+
+    [Fact]
+    public async Task PoList_DateRange_UsesTheBusinessDayOfTheCreatedTime_AndIsInclusive()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db);
+        await SeedListAsync(db);
+        var svc = PoSvc(db);
+
+        // PO 2 was created 20:00 UTC on 1 Apr = 2 Apr in Colombo, so a "1 Apr only" filter must not include it.
+        Assert.Equal([1], await ListIds(svc, from: new DateOnly(2026, 4, 1), to: new DateOnly(2026, 4, 1)));
+        Assert.Equal([2], await ListIds(svc, from: new DateOnly(2026, 4, 2), to: new DateOnly(2026, 4, 2)));
+        Assert.Equal([3, 2], await ListIds(svc, from: new DateOnly(2026, 4, 2), to: new DateOnly(2026, 4, 10)));
+        Assert.Equal([3, 2, 1], await ListIds(svc, to: new DateOnly(2026, 4, 30)));
+        Assert.Equal([3], await ListIds(svc, from: new DateOnly(2026, 4, 3)));
+    }
+
+    [Fact]
+    public async Task PoList_Sorts_ByCreatedVendorAndTotal_BothWays()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db);
+        await SeedListAsync(db);
+        var svc = PoSvc(db);
+
+        Assert.Equal([3, 2, 1], await ListIds(svc));                 // default: newest first
+        Assert.Equal([1, 2, 3], await ListIds(svc, "created"));      // oldest first
+        Assert.Equal([2, 3, 1], await ListIds(svc, "vendor"));       // Alpha, then Beta (ties: newest first)
+        Assert.Equal([3, 1, 2], await ListIds(svc, "-vendor"));
+        Assert.Equal([2, 3, 1], await ListIds(svc, "-total"));       // 300, 100, 50
+        Assert.Equal([1, 3, 2], await ListIds(svc, "total"));
+        Assert.Equal([3, 2, 1], await ListIds(svc, "nonsense"));     // unknown key falls back to the default
+    }
+
+    [Fact]
+    public async Task PoList_Search_MatchesVendorNameAndCode()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db);
+        await SeedListAsync(db);
+        var svc = PoSvc(db);
+
+        var byName = await svc.ListAsync(new ERPCore.Dtos.Common.PageQuery { Q = "alpha", PageSize = 50 }, null, null);
+        var byCode = await svc.ListAsync(new ERPCore.Dtos.Common.PageQuery { Q = "V-B", PageSize = 50 }, null, null);
+
+        Assert.Equal([2], byName.Items.Select(i => i.PoId));
+        Assert.Equal([3, 1], byCode.Items.Select(i => i.PoId));
+    }
+
+    // ---------------------------------------------------------------- opening balances
+
+    /// <summary>A GL that knows two LKR cash/bank accounts, optionally the equity account, and can create it.</summary>
+    private sealed class OpeningGl : IGeneralLedgerService
+    {
+        public List<GlJournalEntryRequest> Posted { get; } = new();
+        public int AccountCreates { get; private set; }
+        public bool EquityExists { get; init; } = true;
+        public string BankCurrency { get; init; } = "LKR";
+
+        public Task<GeneralLedgerResponse> ForwardAsync(HttpMethod method, string path, string? queryString, string? contentType, Stream? body, CancellationToken ct)
+        {
+            AccountCreates++;
+            return Task.FromResult(new GeneralLedgerResponse
+            {
+                StatusCode = 201,
+                Body = """{"statusCode":201,"success":true,"message":"Account created successfully","data":{"accountCode":"3000"}}"""
+            });
+        }
+
+        public Task<GlJournalEntryResult> PostJournalEntryAsync(GlJournalEntryRequest request, CancellationToken ct)
+        {
+            Posted.Add(request);
+            return Task.FromResult(new GlJournalEntryResult($"JV-2026-{Posted.Count:000000}", true));
+        }
+
+        public Task<GlPeriod> GetPeriodByDateAsync(DateOnly date, CancellationToken ct) => Task.FromResult(new GlPeriod(1, 1));
+
+        public Task<IReadOnlyList<GlBankAccount>> ListBankAccountsAsync(CancellationToken ct) =>
+            Task.FromResult<IReadOnlyList<GlBankAccount>>(
+            [
+                new("Cash", 1, "Main Cash Account", null, "Petty Cash", "CASH-000001", 17, "1400-01-01", "LKR"),
+                new("Bank", 2, "BOC Current", "Bank of Ceylon", null, "0001234567", 18, "1000-01", BankCurrency)
+            ]);
+
+        public Task<IReadOnlyList<GlAccount>> ListAccountsAsync(CancellationToken ct) =>
+            Task.FromResult<IReadOnlyList<GlAccount>>(EquityExists
+                ? [new("3000", "Opening Balance Equity", 3, true, true)]
+                : [new("1000", "Bank", 1, false, true)]);
+    }
+
+    private static OpeningBalanceService OpeningSvc(ErpDbContext db, OpeningGl gl) =>
+        new(new Repository<OpeningBalanceRun>(db), gl, new TestCurrentUser(), new PassThroughUnitOfWork(db));
+
+    private static PostCashBankOpeningRequest Opening(DateOnly date, params (string Code, decimal Amount)[] lines) => new()
+    {
+        CutoverDate = date,
+        Lines = lines.Select(l => new OpeningBalanceLineInput { GlAccountCode = l.Code, Amount = l.Amount }).ToList()
+    };
+
+    private static readonly DateOnly OpeningDate = new(2026, 4, 1);
+
+    [Fact]
+    public async Task Opening_PostsOneBalancedJournal_DebitingEachAccount_AndCreditingEquity()
+    {
+        await using var db = CreateContext();
+        var gl = new OpeningGl();
+
+        var run = await OpeningSvc(db, gl).PostCashBankAsync(Opening(OpeningDate, ("1400-01-01", 500m), ("1000-01", 1500m)));
+
+        var entry = Assert.Single(gl.Posted);
+        Assert.Equal("OPENING_BALANCE", entry.JournalType);
+        Assert.Equal("OPENING", entry.SourceModule);
+        Assert.Equal(OpeningDate, entry.EntryDate);
+        Assert.Equal(entry.Lines.Sum(l => l.DebitAmount), entry.Lines.Sum(l => l.CreditAmount));
+        Assert.Contains(entry.Lines, l => l is { AccountCode: "1400-01-01", DebitAmount: 500m, CreditAmount: 0m });
+        Assert.Contains(entry.Lines, l => l is { AccountCode: "1000-01", DebitAmount: 1500m, CreditAmount: 0m });
+        Assert.Contains(entry.Lines, l => l is { AccountCode: "3000", DebitAmount: 0m, CreditAmount: 2000m });
+
+        Assert.Equal(2000m, run.TotalAmount);
+        Assert.Equal("JV-2026-000001", run.GlJournalNo);
+        Assert.Equal(2, run.Lines.Count);
+        Assert.Equal(0, gl.AccountCreates); // the equity account already existed
+    }
+
+    [Fact]
+    public async Task Opening_CreatesTheEquityAccount_WhenTheChartHasNone()
+    {
+        await using var db = CreateContext();
+        var gl = new OpeningGl { EquityExists = false };
+
+        await OpeningSvc(db, gl).PostCashBankAsync(Opening(OpeningDate, ("1400-01-01", 100m)));
+
+        Assert.Equal(1, gl.AccountCreates);
+        Assert.Contains(Assert.Single(gl.Posted).Lines, l => l.AccountCode == "3000" && l.CreditAmount == 100m);
+    }
+
+    [Fact]
+    public async Task Opening_SecondPosting_IsRefused_AndPostsNothingMore()
+    {
+        await using var db = CreateContext();
+        var gl = new OpeningGl();
+        var svc = OpeningSvc(db, gl);
+        await svc.PostCashBankAsync(Opening(OpeningDate, ("1400-01-01", 100m)));
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => svc.PostCashBankAsync(Opening(OpeningDate, ("1400-01-01", 999m))));
+
+        Assert.Equal(ErrorCodes.OpeningBalanceAlreadyPosted, ex.Code);
+        Assert.Equal(409, ex.StatusCode);
+        Assert.Single(gl.Posted);
+        Assert.Equal(100m, Assert.Single(db.OpeningBalanceRuns.Include(r => r.Lines)).Lines.Single().Amount);
+    }
+
+    [Fact]
+    public async Task Opening_Overdraft_IsCreditedToTheAccount_AndEquityTakesTheNet()
+    {
+        await using var db = CreateContext();
+        var gl = new OpeningGl();
+
+        var run = await OpeningSvc(db, gl).PostCashBankAsync(Opening(OpeningDate, ("1400-01-01", 300m), ("1000-01", -100m)));
+
+        var entry = Assert.Single(gl.Posted);
+        Assert.Contains(entry.Lines, l => l is { AccountCode: "1000-01", DebitAmount: 0m, CreditAmount: 100m });
+        Assert.Contains(entry.Lines, l => l is { AccountCode: "3000", DebitAmount: 0m, CreditAmount: 200m });
+        Assert.Equal(entry.Lines.Sum(l => l.DebitAmount), entry.Lines.Sum(l => l.CreditAmount));
+        Assert.Equal(200m, run.TotalAmount);
+    }
+
+    [Fact]
+    public async Task Opening_ShowsPostedAmounts_OnTheStateEndpoint()
+    {
+        await using var db = CreateContext();
+        var svc = OpeningSvc(db, new OpeningGl());
+
+        var before = await svc.GetCashBankAsync();
+        Assert.Null(before.Posted);
+        Assert.All(before.Accounts, a => Assert.Null(a.Amount));
+
+        await svc.PostCashBankAsync(Opening(OpeningDate, ("1400-01-01", 250m)));
+        var after = await svc.GetCashBankAsync();
+
+        Assert.NotNull(after.Posted);
+        Assert.Equal(250m, after.Accounts.Single(a => a.GlAccountCode == "1400-01-01").Amount);
+        Assert.Null(after.Accounts.Single(a => a.GlAccountCode == "1000-01").Amount);
+    }
+
+    [Fact]
+    public async Task Opening_RejectsBadInput_WithoutPostingAnything()
+    {
+        await using var db = CreateContext();
+        var gl = new OpeningGl();
+        var svc = OpeningSvc(db, gl);
+
+        // not a cash/bank account
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostCashBankAsync(Opening(OpeningDate, ("9999", 10m))));
+        // more than 2 decimals
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostCashBankAsync(Opening(OpeningDate, ("1400-01-01", 10.005m))));
+        // nothing but zeros
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostCashBankAsync(Opening(OpeningDate, ("1400-01-01", 0m))));
+        // the same account twice
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostCashBankAsync(Opening(OpeningDate, ("1400-01-01", 5m), ("1400-01-01", 6m))));
+        // in the future
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostCashBankAsync(Opening(DateOnly.FromDateTime(DateTime.UtcNow).AddDays(30), ("1400-01-01", 5m))));
+
+        Assert.Empty(gl.Posted);
+        Assert.Empty(db.OpeningBalanceRuns);
+    }
+
+    [Fact]
+    public async Task Opening_RefusesANonBaseCurrencyAccount()
+    {
+        await using var db = CreateContext();
+        var gl = new OpeningGl { BankCurrency = "USD" };
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => OpeningSvc(db, gl).PostCashBankAsync(Opening(OpeningDate, ("1000-01", 100m))));
+
+        Assert.Equal(ErrorCodes.Validation, ex.Code);
+        Assert.Empty(gl.Posted);
+    }
+
+    // ---------------------------------------------------------------- opening stock
+
+    private static OpeningStockService StockSvc(ErpDbContext db, OpeningGl gl)
+    {
+        var glAccounts = new StubGlAccountConfigService((GlAccountRole.Inventory, "1100"), (GlAccountRole.Clearing, "2000"));
+        var fifo = new FifoCostingService(
+            new Repository<StockLayer>(db), new Repository<StockLedger>(db), new Repository<JournalEntryStub>(db), db, gl, glAccounts);
+        return new OpeningStockService(
+            new OpeningStockRepository(db), fifo, gl, glAccounts, new TestCurrentUser(), new PassThroughUnitOfWork(db));
+    }
+
+    private static Item StockedItem(int id, Action<Item>? tweak = null)
+    {
+        var item = new Item
+        {
+            ItemId = id, Sku = $"SKU-{id}", Name = $"Item {id}", CategoryId = 1, BaseUomId = 1,
+            StockNature = StockNature.Stocked, TrackingMode = TrackingMode.None, Status = EntityStatus.Active
+        };
+        tweak?.Invoke(item);
+        return item;
+    }
+
+    private static PostOpeningStockRequest StockRequest(params (int Item, decimal Qty, decimal Cost)[] lines) => new()
+    {
+        CutoverDate = OpeningDate,
+        Lines = lines.Select(l => new OpeningStockLineInput { ItemId = l.Item, WarehouseId = Warehouse1, Qty = l.Qty, UnitCost = l.Cost }).ToList()
+    };
+
+    [Fact]
+    public async Task OpeningStock_CreatesLayerAndLedgerRow_AndPostsExactlyOneJournal()
+    {
+        await using var db = CreateContext();
+        db.Items.AddRange(StockedItem(1), StockedItem(2));
+        await db.SaveChangesAsync();
+        var gl = new OpeningGl();
+
+        var run = await StockSvc(db, gl).PostAsync(StockRequest((1, 24m, 12.5m), (2, 10m, 3m)));
+
+        Assert.Equal(330m, run.TotalValue);
+        Assert.Equal(2, run.LineCount);
+
+        var layer = db.StockLayers.Single(l => l.ItemId == 1);
+        Assert.Equal((24m, 24m, 12.5m), (layer.QtyReceived, layer.QtyRemaining, layer.UnitCost));
+        var row = db.StockLedger.Single(l => l.ItemId == 1);
+        Assert.Equal(("OPN", Direction.In, 24m, 300m, 24m), (row.SourceDocType, row.Direction, row.QtyBase, row.Value, row.RunningBalance));
+        Assert.Equal(run.OpeningBalanceRunId, row.SourceDocId);
+
+        // One journal in total — the regular stock path would have added a STOCK journal (Dr Inventory / Cr Clearing) per row.
+        var entry = Assert.Single(gl.Posted);
+        Assert.Equal(("OPENING", "OPENING_BALANCE"), (entry.SourceModule, entry.JournalType));
+        Assert.Collection(entry.Lines,
+            l => Assert.Equal(("1100", 330m, 0m), (l.AccountCode, l.DebitAmount, l.CreditAmount)),
+            l => Assert.Equal(("3000", 0m, 330m), (l.AccountCode, l.DebitAmount, l.CreditAmount)));
+        Assert.Equal(2, db.JournalEntryStubs.Count(j => j.SourceDocType == "OPN"));
+    }
+
+    [Fact]
+    public async Task OpeningStock_RefusesAnItemThatAlreadyHasMovements_InThatWarehouse()
+    {
+        await using var db = CreateContext();
+        db.Items.AddRange(StockedItem(1), StockedItem(2));
+        db.StockLedger.Add(new StockLedger { ItemId = 1, WarehouseId = Warehouse1, Direction = Direction.In, QtyBase = 5, UnitCost = 1, Value = 5, RunningBalance = 5, SourceDocType = "GRN", SourceDocId = 1 });
+        await db.SaveChangesAsync();
+        var gl = new OpeningGl();
+
+        var ex = await Assert.ThrowsAsync<DomainException>(() => StockSvc(db, gl).PostAsync(StockRequest((1, 3m, 2m), (2, 3m, 2m))));
+
+        Assert.Equal(409, ex.StatusCode);
+        Assert.Contains("SKU-1", ex.Message);
+        Assert.Empty(gl.Posted);
+        Assert.Empty(db.OpeningBalanceRuns);
+        Assert.Empty(db.StockLayers); // nothing at all was written, not even for the clean item
+    }
+
+    [Fact]
+    public async Task OpeningStock_CanBeLoadedInSeveralRuns_ForDifferentItems()
+    {
+        await using var db = CreateContext();
+        db.Items.AddRange(StockedItem(1), StockedItem(2));
+        await db.SaveChangesAsync();
+        var gl = new OpeningGl();
+        var svc = StockSvc(db, gl);
+
+        await svc.PostAsync(StockRequest((1, 5m, 2m)));
+        await svc.PostAsync(StockRequest((2, 7m, 4m)));
+
+        Assert.Equal(2, gl.Posted.Count);
+        Assert.Equal(2, (await svc.ListAsync()).Count);
+        // ...but the same item cannot be opened a second time.
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((1, 1m, 1m))));
+    }
+
+    [Fact]
+    public async Task OpeningStock_RefusesUnsuitableItemsAndBadNumbers()
+    {
+        await using var db = CreateContext();
+        db.Items.AddRange(
+            StockedItem(1, i => i.TrackingMode = TrackingMode.Serial),
+            StockedItem(2, i => i.TrackingMode = TrackingMode.Batch),
+            StockedItem(3, i => i.StockNature = StockNature.Service),
+            StockedItem(4, i => i.Status = EntityStatus.Inactive),
+            StockedItem(5));
+        await db.SaveChangesAsync();
+        var gl = new OpeningGl();
+        var svc = StockSvc(db, gl);
+
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((1, 1m, 1m))));   // serial
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((2, 1m, 1m))));   // batch
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((3, 1m, 1m))));   // service
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((4, 1m, 1m))));   // inactive
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((99, 1m, 1m))));  // unknown
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((5, 0m, 1m))));   // zero qty
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((5, 1m, -1m))));  // negative cost
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((5, 1.00001m, 1m)))); // > 4 decimals
+        await Assert.ThrowsAsync<DomainException>(() => svc.PostAsync(StockRequest((5, 1m, 1m), (5, 2m, 1m)))); // duplicate
+
+        Assert.Empty(gl.Posted);
+        Assert.Empty(db.StockLayers);
+    }
+
+    [Fact]
+    public async Task OpeningStock_ZeroCostRun_PostsNoJournal()
+    {
+        await using var db = CreateContext();
+        db.Items.Add(StockedItem(1));
+        await db.SaveChangesAsync();
+        var gl = new OpeningGl();
+
+        var run = await StockSvc(db, gl).PostAsync(StockRequest((1, 10m, 0m)));
+
+        Assert.Equal(0m, run.TotalValue);
+        Assert.Null(run.GlJournalNo);
+        Assert.Empty(gl.Posted);
+        Assert.Equal(10m, db.StockLayers.Single().QtyRemaining);
+    }
+
+    // ---------------------------------------------------------------- purchase-order rejection
+
+    [Fact]
+    public async Task Po_Reject_ShowsRejected_NotDraftOrPending_AndCanBeRevisedAndResubmitted()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db);
+        await SeedVendorAndItemAsync(db);
+        var svc = PoSvc(db);
+
+        var po = (await svc.CreateAsync(PoRequest(0m))).Value;
+        await svc.SubmitAsync(po.PoId);
+        // Somebody else raised it: the approver can't be its creator.
+        db.PurchaseOrders.Single().CreatedBy = 999;
+        await db.SaveChangesAsync();
+
+        var rejected = await svc.RejectAsync(po.PoId, "Wrong price");
+        Assert.Equal(PurchaseOrderStatus.Rejected, rejected.Status);
+
+        // A rejected order is reopened like a draft: it can be sent for approval again...
+        var resubmitted = await svc.SubmitAsync(po.PoId);
+        Assert.Equal(PurchaseOrderStatus.PendingApproval, resubmitted.Status);
+    }
+
+    [Fact]
+    public async Task Po_Rejected_CanBeDeleted_ButAnApprovedOneCannot()
+    {
+        await using var db = CreateContext();
+        await SeedProcurementConfigAsync(db);
+        await SeedVendorAndItemAsync(db);
+        var svc = PoSvc(db);
+
+        var po = (await svc.CreateAsync(PoRequest(0m))).Value;
+        await svc.SubmitAsync(po.PoId);
+        db.PurchaseOrders.Single().CreatedBy = 999;
+        await db.SaveChangesAsync();
+        await svc.RejectAsync(po.PoId, null);
+
+        await svc.DeleteAsync(po.PoId);
+        Assert.Empty(db.PurchaseOrders);
+    }
+
+    // ---------------------------------------------------------------- General Ledger payload
+
+    private sealed class CapturingGlClient(int status, string body) : IGeneralLedgerClient
+    {
+        public string? SentBody { get; private set; }
+
+        public async Task<GeneralLedgerResponse> SendAsync(
+            HttpMethod method, string path, string? queryString, string? contentType, Stream? requestBody, CancellationToken ct)
+        {
+            if (requestBody is not null)
+            {
+                using var reader = new StreamReader(requestBody);
+                SentBody = await reader.ReadToEndAsync(ct);
+            }
+            return new GeneralLedgerResponse { StatusCode = status, ContentType = "application/json", Body = body };
+        }
+    }
+
+    private static GlJournalEntryRequest GrnJournal() => new()
+    {
+        PeriodId = 1,
+        EntryDate = new DateOnly(2026, 10, 18),
+        SourceModule = "GRN",
+        Reference = "GRN-1",
+        Lines = [new GlJournalEntryLineRequest("1100", 10m, 0m, "x"), new GlJournalEntryLineRequest("2100", 0m, 10m)]
+    };
+
+    [Fact]
+    public async Task GlPost_NeverSendsNulls_BecauseGlTreatsANullJournalTypeAsMissing()
+    {
+        // GL's request DTO has a non-nullable JournalType; an explicit "journalType": null is a 400 from its model
+        // validation. Only opening balances set one, so every other posting (GRN, sales, ...) must leave it out.
+        var client = new CapturingGlClient(201, "{\"statusCode\":201,\"success\":true,\"message\":\"ok\",\"data\":{\"journalNo\":\"J-1\",\"isPosted\":true}}");
+
+        var result = await new GeneralLedgerService(client).PostJournalEntryAsync(GrnJournal(), CancellationToken.None);
+
+        Assert.Equal("J-1", result.JournalNo);
+        Assert.DoesNotContain("journalType", client.SentBody!);
+        Assert.DoesNotContain("null", client.SentBody!);
+    }
+
+    [Fact]
+    public async Task GlPost_KeepsAJournalTypeWhenOneIsSet()
+    {
+        var client = new CapturingGlClient(201, "{\"statusCode\":201,\"success\":true,\"message\":\"ok\",\"data\":{\"journalNo\":\"J-1\",\"isPosted\":true}}");
+        var request = GrnJournal();
+        request.JournalType = "OPENING_BALANCE";
+
+        await new GeneralLedgerService(client).PostJournalEntryAsync(request, CancellationToken.None);
+
+        Assert.Contains("\"journalType\":\"OPENING_BALANCE\"", client.SentBody!);
+    }
+
+    [Fact]
+    public async Task GlPost_AValidationFailureFromGl_IsReportedWithItsReason_NotAsAGenericRejection()
+    {
+        var problem = "{\"title\":\"One or more validation errors occurred.\",\"status\":400,\"errors\":{\"JournalType\":[\"The JournalType field is required.\"]}}";
+        var client = new CapturingGlClient(400, problem);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => new GeneralLedgerService(client).PostJournalEntryAsync(GrnJournal(), CancellationToken.None));
+
+        Assert.Equal(ErrorCodes.GlRequestFailed, ex.Code);
+        Assert.Contains("JournalType", ex.Message);
+        Assert.Contains("required", ex.Message);
+    }
+
+    [Fact]
+    public async Task GlPost_GlsOwnMessage_StillWins()
+    {
+        var client = new CapturingGlClient(400, "{\"StatusCode\":400,\"Success\":false,\"Message\":\"Period is locked\",\"Data\":null}");
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => new GeneralLedgerService(client).PostJournalEntryAsync(GrnJournal(), CancellationToken.None));
+
+        Assert.Equal("Period is locked", ex.Message);
+    }
+
+    // ---------------------------------------------------------------- stock movement vs. document journal
+
+    [Fact]
+    public async Task StockLedgerPost_AddsTheGenericStockJournal_OnlyWhenTheDocumentHasNoJournalOfItsOwn()
+    {
+        await using var db = CreateContext();
+        var gl = new OpeningGl();
+        var glAccounts = new StubGlAccountConfigService((GlAccountRole.Inventory, "1100"), (GlAccountRole.Clearing, "2000"));
+        var fifo = new FifoCostingService(
+            new Repository<StockLayer>(db), new Repository<StockLedger>(db), new Repository<JournalEntryStub>(db), db, gl, glAccounts);
+        var now = DateTime.UtcNow;
+
+        // A GRN / sales invoice / adjustment posts its own balanced journal: the ledger row must not add a second one,
+        // or the movement is counted twice in the General Ledger.
+        await fifo.PostLedgerAsync(1, Warehouse1, null, null, null, 1, Direction.In, 100m, 200m, 100m, "GRN", 1, now,
+            CancellationToken.None, postGlJournal: false);
+        await db.SaveChangesAsync();
+        Assert.Empty(gl.Posted);
+        Assert.Single(db.StockLedger);
+
+        // Production and transfers have no document journal, so they keep the generic one.
+        await fifo.PostLedgerAsync(1, Warehouse1, null, null, null, 1, Direction.In, 5m, 10m, 105m, "TRF", 1, now,
+            CancellationToken.None);
+        var journal = Assert.Single(gl.Posted);
+        Assert.Equal("STOCK", journal.SourceModule);
+    }
+}

Backend/ERPCore.Tests/ProductionConcurrencyTests.cs

@@ -0,0 +1,124 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Production;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services.Production;
+using ERPCore.System.Errors;
+using ERPCore.Tests.TestSupport;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+
+namespace ERPCore.Tests;
+
+/// <summary>
+/// Covers the 412 translation on the two production services, which save through
+/// <c>ExecuteInTransactionAsync</c> rather than a bare <c>SaveChangesAsync</c> and so guard
+/// concurrency differently from the inline pattern the other services use.
+/// </summary>
+public class ProductionConcurrencyTests
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    [Fact]
+    public async Task TemplateUpdateAsync_MapsConcurrencyFailuresToDomainException()
+    {
+        await using var db = CreateContext();
+
+        // Validation runs before the transaction opens, so the referenced item has to exist.
+        db.Items.Add(new Item
+        {
+            ItemId = 1,
+            Sku = "FG-1",
+            Name = "Finished good",
+            CategoryId = 1,
+            BaseUomId = 1,
+            Status = EntityStatus.Active
+        });
+        await db.SaveChangesAsync();
+
+        var service = CreateTemplateService(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => service.UpdateAsync(1, SingleStageTemplate(), expectedRowVersion: 1));
+
+        Assert.Equal(ErrorCodes.ConcurrencyConflict, ex.Code);
+        Assert.Equal(412, ex.StatusCode);
+    }
+
+    [Fact]
+    public async Task RunUpdateStageQuantitiesAsync_MapsConcurrencyFailuresToDomainException()
+    {
+        await using var db = CreateContext();
+        var service = CreateRunService(db);
+
+        var ex = await Assert.ThrowsAsync<DomainException>(
+            () => service.UpdateStageQuantitiesAsync(1, 1, new UpdateStageQuantitiesRequest()));
+
+        Assert.Equal(ErrorCodes.ConcurrencyConflict, ex.Code);
+        Assert.Equal(412, ex.StatusCode);
+    }
+
+    /// <summary>
+    /// The smallest graph the validator accepts: one stage (both entry and terminal) with a
+    /// stock input and a single item-bearing output, and no edges.
+    /// </summary>
+    private static SaveTemplateRequest SingleStageTemplate() => new()
+    {
+        Code = "TPL-1",
+        Name = "Template 1",
+        Stages =
+        [
+            new SaveStageRequest
+            {
+                Key = "tmp-1",
+                Name = "Mix",
+                Inputs =
+                [
+                    new SaveInputRequest
+                    {
+                        Source = StageInputSource.Stock,
+                        ItemId = 1,
+                        QtyUnit = StageQtyUnit.Pack,
+                        QtyPerBatch = 1m
+                    }
+                ],
+                Outputs =
+                [
+                    new SaveOutputRequest { Key = "tmp-o1", Name = "Output", ItemId = 1, QtyPerBatch = 1m }
+                ]
+            }
+        ]
+    };
+
+    private static ErpDbContext CreateContext()
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root)
+            .Options;
+
+        // The real CurrentBranchContext over an unauthenticated user yields IsActive=false,
+        // which leaves the branch query filters off: what a unit test wants.
+        var currentUser = new TestCurrentUser();
+        return new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
+    }
+
+    private static ProductionTemplateService CreateTemplateService(ErpDbContext db)
+        => new(
+            new Repository<ProductionTemplate>(db), new Repository<TemplateStage>(db),
+            new Repository<StageInput>(db), new Repository<StageOutput>(db),
+            new Repository<StageEdge>(db), new Repository<Item>(db),
+            new Repository<Uom>(db), new Repository<ProductionRun>(db),
+            new ThrowingTransactionUnitOfWork(), new TestCurrentUser());
+
+    // The costing, measurement and numbering collaborators are only ever touched inside the
+    // transaction lambda, which ThrowingTransactionUnitOfWork never invokes.
+    private static ProductionRunService CreateRunService(ErpDbContext db)
+        => new(
+            new Repository<ProductionRun>(db), new Repository<ProductionTemplate>(db),
+            new Repository<Warehouse>(db), new Repository<Bin>(db),
+            new Repository<Item>(db), new Repository<ReasonCode>(db),
+            fifo: null!, measure: null!, numbers: null!,
+            new ThrowingTransactionUnitOfWork(), new TestCurrentUser());
+}

Backend/ERPCore.Tests/StockLedgerTests.cs

@@ -0,0 +1,97 @@
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Infra.Persistence;
+using ERPCore.Repositories;
+using ERPCore.Services.Stock;
+using static ERPCore.Tests.TestSupport.BankDepositTestSupport;
+
+namespace ERPCore.Tests;
+
+/// <summary>The Stock Ledger screen: item name/SKU/category/brand on every row, category and brand filters, and a running
+/// balance that is the real balance after each movement (not whatever a posting stored).</summary>
+public class StockLedgerTests
+{
+    private static StockService Svc(ErpDbContext db) =>
+        new(null!, new Repository<StockLayer>(db), new Repository<StockLedger>(db), new Repository<StockTransferLine>(db),
+            new Repository<Warehouse>(db), new Repository<Item>(db));
+
+    private static StockLedger Row(int id, int item, int warehouse, Direction dir, decimal qty, decimal unitCost, decimal storedBalance = 0m) => new()
+    {
+        LedgerId = id, ItemId = item, WarehouseId = warehouse, Direction = dir, QtyBase = qty, UnitCost = unitCost,
+        Value = qty * unitCost, RunningBalance = storedBalance, SourceDocType = "T", SourceDocId = id, UserId = 1,
+        CreatedAt = new DateTime(2026, 10, 18, 4, 0, 0, DateTimeKind.Utc).AddMinutes(id)
+    };
+
+    private static async Task<ErpDbContext> SeedAsync()
+    {
+        var db = CreateContext();
+        db.Categories.AddRange(new Category { CategoryId = 1, Name = "Beverages" }, new Category { CategoryId = 2, Name = "Snacks" });
+        db.Brands.AddRange(new Brand { BrandId = 1, Name = "Milo" }, new Brand { BrandId = 2, Name = "Munchee" });
+        db.Items.AddRange(
+            new Item { ItemId = 1, Sku = "MILO-240", Name = "Milo 240ml", CategoryId = 1, BrandId = 1, BaseUomId = 1 },
+            new Item { ItemId = 2, Sku = "BISC-1", Name = "Biscuit", CategoryId = 2, BrandId = 2, BaseUomId = 1 });
+        db.StockLedger.AddRange(
+            Row(1, 1, Warehouse1, Direction.In, 100m, 200m, storedBalance: 100m),
+            Row(2, 1, Warehouse1, Direction.Out, 30m, 200m, storedBalance: 0m),     // a sales issue: stored balance was never filled in
+            Row(3, 1, Warehouse1, Direction.In, 50m, 210m, storedBalance: 120m),
+            Row(4, 1, Warehouse2, Direction.In, 10m, 200m, storedBalance: 10m),
+            Row(5, 2, Warehouse1, Direction.In, 5m, 40m, storedBalance: 5m));
+        await db.SaveChangesAsync();
+        return db;
+    }
+
+    private static Task<PagedResponse<ERPCore.Dtos.Stock.StockLedgerRowDto>> Ledger(
+        ErpDbContext db, int page = 1, int pageSize = 50, int? itemId = null, int? warehouseId = null, int? categoryId = null, int? brandId = null) =>
+        Svc(db).GetLedgerAsync(itemId, warehouseId, null, null, null, null, null,
+            new PageQuery { Page = page, PageSize = pageSize }, CancellationToken.None, categoryId, brandId);
+
+    [Fact]
+    public async Task RunningBalance_IsTheRealBalanceAfterEachMovement_PerItemAndWarehouse()
+    {
+        await using var db = await SeedAsync();
+
+        var rows = (await Ledger(db)).Items.ToDictionary(r => r.LedgerId);
+
+        Assert.Equal(100m, rows[1].RunningBalance);
+        Assert.Equal(70m, rows[2].RunningBalance);   // the stored 0 is ignored
+        Assert.Equal(120m, rows[3].RunningBalance);
+        Assert.Equal(10m, rows[4].RunningBalance);   // another warehouse starts from its own zero
+        Assert.Equal(5m, rows[5].RunningBalance);    // another item too
+    }
+
+    [Fact]
+    public async Task RunningBalance_IsStillRight_OnALaterPage_AndWithFiltersApplied()
+    {
+        await using var db = await SeedAsync();
+
+        // Newest first, 2 per page: page 2 holds ledger 3 and 2, whose balances depend on rows before and after it.
+        var page2 = (await Ledger(db, page: 2, pageSize: 2)).Items;
+        Assert.Equal(new long[] { 3, 2 }, page2.Select(r => (long)r.LedgerId));
+        Assert.Equal(new[] { 120m, 70m }, page2.Select(r => r.RunningBalance));
+
+        // Filtering to one warehouse and item changes which rows show, not what the balance is.
+        var only = (await Ledger(db, itemId: 1, warehouseId: Warehouse1)).Items.OrderBy(r => r.LedgerId).ToList();
+        Assert.Equal(new[] { 100m, 70m, 120m }, only.Select(r => r.RunningBalance));
+    }
+
+    [Fact]
+    public async Task EveryRow_CarriesTheItemsSkuNameCategoryAndBrand()
+    {
+        await using var db = await SeedAsync();
+
+        var row = (await Ledger(db, itemId: 1)).Items.First();
+
+        Assert.Equal(("MILO-240", "Milo 240ml", "Beverages", "Milo"), (row.ItemSku, row.ItemName, row.CategoryName, row.BrandName));
+    }
+
+    [Fact]
+    public async Task CategoryAndBrandFilters_NarrowTheLedgerToThoseItems()
+    {
+        await using var db = await SeedAsync();
+
+        Assert.All((await Ledger(db, categoryId: 2)).Items, r => Assert.Equal(2, r.ItemId));
+        Assert.Equal(4, (await Ledger(db, brandId: 1)).Items.Count);
+        Assert.Empty((await Ledger(db, categoryId: 2, brandId: 1)).Items);
+    }
+}

Backend/ERPCore.Tests/TestSupport/BankDepositTestSupport.cs

@@ -0,0 +1,170 @@
+using ERPCore.Common.Http;
+using ERPCore.Domain.Entities;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Config;
+using ERPCore.Infra.Auth;
+using ERPCore.Infra.Gl;
+using ERPCore.Infra.Persistence;
+using ERPCore.Infra.UoW;
+using ERPCore.Repositories;
+using ERPCore.Services;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Storage;
+using Microsoft.Extensions.Configuration;
+
+namespace ERPCore.Tests.TestSupport;
+
+/// <summary>Records every journal it is asked to post; can be told to reject them instead.</summary>
+internal sealed class FakeGeneralLedger : IGeneralLedgerService
+{
+    public const long CashAccountId = 1, BankAccountId = 2, OtherBankAccountId = 3;
+
+    public List<GlJournalEntryRequest> Posted { get; } = new();
+    public bool Reject { get; set; }
+
+    public IReadOnlyList<GlBankAccount> Accounts { get; init; } =
+    [
+        new("Cash", CashAccountId, "Main Till", null, "Petty", null, 101, "1000-01", "LKR"),
+        new("Bank", BankAccountId, "BOC Current", "Bank of Ceylon", null, "0001234567", 102, "1010-01", "LKR"),
+        new("Bank", OtherBankAccountId, "HNB Savings", "Hatton National Bank", null, "9876543210", 103, "1010-02", "LKR")
+    ];
+
+    public Task<GeneralLedgerResponse> ForwardAsync(HttpMethod method, string path, string? queryString, string? contentType, Stream? body, CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public Task<GlJournalEntryResult> PostJournalEntryAsync(GlJournalEntryRequest request, CancellationToken ct)
+    {
+        if (Reject) throw new DomainException(ErrorCodes.Validation, "GL rejected the entry.", 502);
+        Posted.Add(request);
+        return Task.FromResult(new GlJournalEntryResult($"JE-{Posted.Count}", true));
+    }
+
+    public Task<GlPeriod> GetPeriodByDateAsync(DateOnly date, CancellationToken ct) => Task.FromResult(new GlPeriod(1, 1));
+
+    public Task<IReadOnlyList<GlBankAccount>> ListBankAccountsAsync(CancellationToken ct) => Task.FromResult(Accounts);
+
+    /// <summary>Not implemented on purpose — nothing here picks a GL account by code; see
+    /// <see cref="StubGeneralLedgerService"/> for the fake that does.</summary>
+    public Task<IReadOnlyList<GlAccount>> ListAccountsAsync(CancellationToken ct) => throw new NotSupportedException();
+}
+
+/// <summary>The in-memory provider has no transactions: run the work, then save — what the real one commits.</summary>
+internal sealed class PassThroughUnitOfWork(ErpDbContext db) : IUnitOfWork
+{
+    public Task<int> SaveChangesAsync(CancellationToken ct = default) => db.SaveChangesAsync(ct);
+
+    public async Task ExecuteInTransactionAsync(Func<CancellationToken, Task> action, CancellationToken ct = default)
+    {
+        await action(ct);
+        await db.SaveChangesAsync(ct);
+    }
+
+    public async Task<T> ExecuteInTransactionAsync<T>(Func<CancellationToken, Task<T>> action, CancellationToken ct = default)
+    {
+        var result = await action(ct);
+        await db.SaveChangesAsync(ct);
+        return result;
+    }
+}
+
+internal sealed class FakeNumberSequence : INumberSequenceService
+{
+    private int _next;
+    public Task<string> NextAsync(string docType, int branchId, CancellationToken ct = default) => Task.FromResult($"{docType}-{++_next:00000}");
+    public Task<string> NextAsync(string docType, CancellationToken ct = default) => Task.FromResult($"{docType}-{++_next:00000}");
+}
+
+/// <summary>Branching on: the requested branch is used as-is.</summary>
+internal sealed class FakeBranchConfig : IBranchConfigService
+{
+    public Task<ETagged<BranchConfigDto>> GetAsync(CancellationToken ct = default) => throw new NotSupportedException();
+    public Task<ETagged<BranchConfigDto>> UpdateAsync(UpdateBranchConfigRequest request, uint expectedRowVersion, CancellationToken ct = default)
+        => throw new NotSupportedException();
+    public Task<bool> IsBranchingEnabledAsync(CancellationToken ct = default) => Task.FromResult(true);
+    public Task<int> ResolveBranchIdAsync(int requestedBranchId, CancellationToken ct = default)
+        => requestedBranchId > 0 ? Task.FromResult(requestedBranchId) : throw new DomainException(ErrorCodes.Validation, "Branch is required.", 422);
+    public Task<bool> IsWarehouseBranchingEnabledAsync(CancellationToken ct = default) => Task.FromResult(true);
+    public Task<int> ResolveWarehouseBranchIdAsync(int requestedBranchId, CancellationToken ct = default) => Task.FromResult(requestedBranchId);
+    public Task<int> ResolveDefaultBranchIdAsync(CancellationToken ct = default) => Task.FromResult(1);
+}
+
+/// <summary>Seeds and services for the cash-in-hand / bank-deposit tests. Two branches, one warehouse each.</summary>
+internal static class BankDepositTestSupport
+{
+    private static readonly InMemoryDatabaseRoot Root = new();
+
+    public const int Branch1 = 1, Branch2 = 2;
+    public const int Warehouse1 = 1, Warehouse2 = 2;
+
+    public static BusinessDayClock Clock { get; } = new(Config());
+
+    public static IConfiguration Config(DateOnly? trackingStart = null) => new ConfigurationBuilder()
+        .AddInMemoryCollection(new Dictionary<string, string?>
+        {
+            ["DayEndReport:TimeZone"] = "Asia/Colombo",
+            ["BankDeposit:DefaultCashAccountCode"] = "1000-01",
+            ["BankDeposit:CashTrackingStartDate"] = trackingStart?.ToString("yyyy-MM-dd")
+        })
+        .Build();
+
+    /// <summary>Midday on a local business day, as the UTC instant documents are stamped with.</summary>
+    public static DateTime At(DateOnly day) => Clock.ToUtc(day).AddHours(6);
+
+    public static ErpDbContext CreateContext()
+    {
+        var options = new DbContextOptionsBuilder<ErpDbContext>()
+            .UseInMemoryDatabase(Guid.NewGuid().ToString("N"), Root)
+            .Options;
+        var currentUser = new TestCurrentUser();
+        var db = new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
+
+        db.Users.Add(new User { UserId = User.SystemUserId, Username = "system", DisplayName = "System" });
+        db.Branches.AddRange(
+            new Branch { BranchId = Branch1, Code = "BR-001", Name = "Colombo" },
+            new Branch { BranchId = Branch2, Code = "BR-002", Name = "Kandy" });
+        db.Warehouses.AddRange(
+            new Warehouse { WarehouseId = Warehouse1, Code = "WH-1", Name = "Colombo Store", BranchId = Branch1 },
+            new Warehouse { WarehouseId = Warehouse2, Code = "WH-2", Name = "Kandy Store", BranchId = Branch2 });
+        db.SaveChanges();
+        return db;
+    }
+
+    private static int _id;
+
+    public static SalesSlip CashSlip(DateOnly day, decimal cash, decimal card = 0m, int warehouseId = Warehouse1)
+    {
+        var id = Interlocked.Increment(ref _id);
+        return new SalesSlip
+        {
+            SalesSlipId = id, SlipNo = $"SL-{id}", SlipDate = At(day), Status = SalesSlipStatus.Posted, WarehouseId = warehouseId,
+            GrandTotal = cash + card, PaidAmount = cash + card, CashAmount = cash, CardAmount = card
+        };
+    }
+
+    public static CashInHandService CashService(ErpDbContext db, DateOnly? trackingStart)
+        => new(new CashInHandRepository(db), new CurrentBranchContext(new TestCurrentUser()), Clock, Config(trackingStart));
+
+    public static BankDepositService DepositService(ErpDbContext db, DateOnly? trackingStart, FakeGeneralLedger gl)
+    {
+        var currentUser = new TestCurrentUser();
+        return new BankDepositService(
+            new Repository<BankDeposit>(db), new Repository<Branch>(db), CashService(db, trackingStart), gl,
+            currentUser, new CurrentBranchContext(currentUser), new FakeNumberSequence(), new FakeBranchConfig(),
+            new PassThroughUnitOfWork(db), db, Clock);
+    }
+
+    public static BankDeposit Deposit(DateOnly businessDate, decimal amount, int branchId = Branch1,
+        BankDepositStatus status = BankDepositStatus.Posted)
+    {
+        var id = Interlocked.Increment(ref _id);
+        return new BankDeposit
+        {
+            BankDepositId = id, DocNo = $"BD-{id}", BranchId = branchId, BusinessDate = businessDate, DepositDate = businessDate,
+            Amount = amount, Status = status, FromCashAccountCode = "1000-01", FromCashAccountName = "Main Till",
+            ToBankAccountCode = "1010-01", ToBankAccountName = "BOC Current", CreatedBy = User.SystemUserId
+        };
+    }
+}

Backend/ERPCore.Tests/TestSupport/GlTestSupport.cs

@@ -0,0 +1,66 @@
+using ERPCore.Infra.Gl;
+using ERPCore.Services.Gl;
+using ERPCore.Services.Interfaces;
+using ERPCore.System.Errors;
+
+namespace ERPCore.Tests.TestSupport;
+
+/// <summary>
+/// Stands in for the external GL service. Only <see cref="ListAccountsAsync"/> is implemented —
+/// nothing under test here posts a journal, and leaving the rest throwing means a test that starts
+/// doing so fails loudly rather than against a silently empty fake.
+/// </summary>
+internal sealed class StubGeneralLedgerService : IGeneralLedgerService
+{
+    private readonly IReadOnlyList<GlAccount> _accounts;
+    private readonly Exception? _throws;
+
+    public StubGeneralLedgerService(IReadOnlyList<GlAccount> accounts) => _accounts = accounts;
+    public StubGeneralLedgerService(Exception throws) { _accounts = []; _throws = throws; }
+
+    public int Calls { get; private set; }
+
+    /// <summary>A postable, active account — the ordinary case.</summary>
+    public static GlAccount Postable(string code, string name = "Account", short type = 1) => new(code, name, type, true, true);
+
+    /// <summary>A header/control account. GL rejects journal lines against these.</summary>
+    public static GlAccount NotPostable(string code, string name = "Header", short type = 1) => new(code, name, type, false, true);
+
+    public Task<IReadOnlyList<GlAccount>> ListAccountsAsync(CancellationToken ct)
+    {
+        Calls++;
+        return _throws is not null
+            ? Task.FromException<IReadOnlyList<GlAccount>>(_throws)
+            : Task.FromResult(_accounts);
+    }
+
+    public Task<GeneralLedgerResponse> ForwardAsync(
+        HttpMethod method, string path, string? queryString, string? contentType, Stream? body, CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public Task<GlJournalEntryResult> PostJournalEntryAsync(GlJournalEntryRequest request, CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public Task<GlPeriod> GetPeriodByDateAsync(DateOnly date, CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public Task<IReadOnlyList<GlBankAccount>> ListBankAccountsAsync(CancellationToken ct)
+        => throw new NotSupportedException();
+
+    public static DomainException Unreachable() =>
+        new(ErrorCodes.GlServiceUnavailable, "The General Ledger service is unreachable.", 503);
+}
+
+/// <summary>Returns a fixed mapping, for exercising the startup validator without a database.</summary>
+internal sealed class StubGlAccountConfigService(params (GlAccountRole Role, string? Code)[] mappings) : IGlAccountConfigService
+{
+    public Task<GlAccountCodes> GetCodesAsync(CancellationToken ct = default) =>
+        Task.FromResult(new GlAccountCodes(mappings.ToDictionary(m => m.Role, m => m.Code)));
+
+    public Task<ERPCore.Common.Http.ETagged<ERPCore.Dtos.Config.GlAccountConfigDto>> GetAsync(CancellationToken ct = default)
+        => throw new NotSupportedException();
+
+    public Task<ERPCore.Common.Http.ETagged<ERPCore.Dtos.Config.GlAccountConfigDto>> UpdateAsync(
+        ERPCore.Dtos.Config.UpdateGlAccountConfigRequest request, uint expectedRowVersion, CancellationToken ct = default)
+        => throw new NotSupportedException();
+}

Backend/ERPCore.Tests/TestSupport/NotificationConfigTestSupport.cs

@@ -11,6 +11,13 @@ internal sealed class TestCurrentUser : ICurrentUser
     public string UserId => "system";
     public int AuditUserId => User.SystemUserId;
     public bool IsAuthenticated => false;
+
+    // Unauthenticated, so no role claim and no branch scoping: the three members the
+    // AuthHex integration added to ICurrentUser.
+    public int? RoleId => null;
+    public string? RoleCode => null;
+    public bool IsAdmin => false;
+    public int? BranchId => null;
 }
 
 internal sealed class ThrowingUnitOfWork : ERPCore.Infra.UoW.IUnitOfWork
@@ -25,6 +32,25 @@ internal sealed class ThrowingUnitOfWork : ERPCore.Infra.UoW.IUnitOfWork
         => throw new NotSupportedException();
 }
 
+/// <summary>
+/// Fails the transactional path the way a lost optimistic-concurrency race does, so the
+/// services that save through <c>ExecuteInTransactionAsync</c> can be covered too. The
+/// lambda is never invoked, which is the point: the real <c>UnitOfWork</c> issues its own
+/// <c>SaveChangesAsync</c> after the lambda returns, so the catch under test has to sit
+/// outside it.
+/// </summary>
+internal sealed class ThrowingTransactionUnitOfWork : ERPCore.Infra.UoW.IUnitOfWork
+{
+    public Task<int> SaveChangesAsync(CancellationToken ct = default)
+        => throw new DbUpdateConcurrencyException("Test concurrency conflict.");
+
+    public Task ExecuteInTransactionAsync(Func<CancellationToken, Task> action, CancellationToken ct = default)
+        => throw new DbUpdateConcurrencyException("Test concurrency conflict.");
+
+    public Task<T> ExecuteInTransactionAsync<T>(Func<CancellationToken, Task<T>> action, CancellationToken ct = default)
+        => throw new DbUpdateConcurrencyException("Test concurrency conflict.");
+}
+
 internal static class NotificationConfigTestSupport
 {
     private static readonly InMemoryDatabaseRoot Root = new();
@@ -35,7 +61,10 @@ internal static class NotificationConfigTestSupport
             .UseInMemoryDatabase(name, Root)
             .Options;
 
-        return new ErpDbContext(options, new TestCurrentUser());
+        // The real CurrentBranchContext over an unauthenticated user yields IsActive=false,
+        // which leaves the branch query filters off: what a unit test wants.
+        var currentUser = new TestCurrentUser();
+        return new ErpDbContext(options, currentUser, new CurrentBranchContext(currentUser));
     }
 
     public static async Task SeedAsync(ErpDbContext db, IEnumerable<NotificationConfigModule>? modules = null)
@@ -52,7 +81,8 @@ internal static class NotificationConfigTestSupport
             NotificationConfigId = NotificationConfig.SingletonId,
             UpdatedBy = User.SystemUserId,
             UpdatedAt = DateTime.UtcNow,
-            RowVersion = 7,
+            // No RowVersion here on purpose: ErpDbContext.BumpRowVersions stamps every
+            // inserted row with 1, so any seeded value is overwritten on save.
         };
 
         if (modules is not null)

Backend/ERPCore/Controllers/AccessConfigController.cs

@@ -0,0 +1,40 @@
+using ERPCore.Dtos.Config;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Access configuration — the default role for people who have none. Both reading and changing it need the
+/// <c>settings</c> nav permission (it decides what a brand-new sign-in can do).
+/// </summary>
+[Route("api/v1/access-config")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
+public sealed class AccessConfigController : ApiControllerBase
+{
+    private readonly IAccessConfigService _config;
+
+    public AccessConfigController(IAccessConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(AccessConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<AccessConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut]
+    [ProducesResponseType(typeof(AccessConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<AccessConfigDto>> Update([FromBody] UpdateAccessConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}

Backend/ERPCore/Controllers/ApprovalsController.cs

@@ -0,0 +1,43 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Dtos.Approvals;
+using ERPCore.Infra.Auth;
+using ERPCore.Services;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Approvals inbox and settings (docs/DUAL_APPROVAL_PLAN.md §7, §10). The inbox is open to every
+/// signed-in user — it only lists what they may approve and their own requests. Reading the
+/// settings is open too (screens need to know whether prices are locked); changing them needs
+/// <c>settings.approvals</c>.
+/// </summary>
+[Route("api/v1/approvals")]
+public sealed class ApprovalsController : ApiControllerBase
+{
+    private readonly ApprovalInboxService _inbox;
+    private readonly IApprovalService _approvals;
+
+    public ApprovalsController(ApprovalInboxService inbox, IApprovalService approvals)
+    {
+        _inbox = inbox;
+        _approvals = approvals;
+    }
+
+    [HttpGet("pending")]
+    [ProducesResponseType(typeof(PendingApprovalsDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PendingApprovalsDto>> Pending(CancellationToken ct)
+        => Ok(await _inbox.PendingAsync(ct));
+
+    [HttpGet("config")]
+    [ProducesResponseType(typeof(ApprovalConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ApprovalConfigDto>> GetConfig(CancellationToken ct)
+        => Ok(await _approvals.GetConfigAsync(ct));
+
+    [HttpPut("config")]
+    [Authorize(Policy = NavPolicies.Prefix + "settings.approvals")]
+    [ProducesResponseType(typeof(ApprovalConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ApprovalConfigDto>> UpdateConfig([FromBody] UpdateApprovalConfigRequest request, CancellationToken ct)
+        => Ok(await _approvals.UpdateConfigAsync(request, ct));
+}

Backend/ERPCore/Controllers/AuditLogsController.cs

@@ -1,6 +1,8 @@
 using ERPCore.Dtos.Audit;
 using ERPCore.Dtos.Common;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers;
@@ -10,6 +12,7 @@ namespace ERPCore.Controllers;
 /// the audit trail is required (AR-01 compensating control) and read access is the
 /// only way to consume it.
 /// </summary>
+[Authorize(Policy = NavPolicies.Prefix + "settings.audit-logs")]
 [Route("api/v1/audit-logs")]
 public sealed class AuditLogsController : ApiControllerBase
 {

Backend/ERPCore/Controllers/AuthController.cs

@@ -47,8 +47,7 @@ public sealed class AuthController : ControllerBase
     [ProducesResponseType(typeof(MeResponseDto), StatusCodes.Status200OK)]
     public async Task<ActionResult<MeResponseDto>> Me(CancellationToken ct)
     {
-        var roleCode = User.FindFirst(AuthHexClaims.RoleCode)?.Value;
-        return Ok(await _roles.GetMeAsync(roleCode, ct));
+        return Ok(await _roles.GetMeAsync(ct));
     }
 
     // ---- Session-issuing (UserManager) ------------------------------------

Backend/ERPCore/Controllers/BankDepositsController.cs

@@ -0,0 +1,78 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Accounts;
+using ERPCore.Dtos.Common;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Till cash deposited to the bank, and the cash in hand behind it (docs/BANK_DEPOSIT_MODULE_PLAN.md §7.3).
+/// Recording needs the Create action on <c>accounts.bank-deposits</c>; cancelling needs Delete.
+/// </summary>
+[Route("api/v1/bank-deposits")]
+[Authorize(Policy = NavPolicies.Prefix + "accounts.bank-deposits")]
+public sealed class BankDepositsController : ApiControllerBase
+{
+    private readonly IBankDepositService _deposits;
+    private readonly ICashInHandService _cash;
+
+    public BankDepositsController(IBankDepositService deposits, ICashInHandService cash)
+    {
+        _deposits = deposits;
+        _cash = cash;
+    }
+
+    /// <summary>Deposits filtered by business date range, branch, bank account and status, plus their total.</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(BankDepositListDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<BankDepositListDto>> List(
+        [FromQuery] PageQuery query, [FromQuery] DateOnly? from, [FromQuery] DateOnly? to, [FromQuery] int? branchId,
+        [FromQuery] long? bankAccountId, [FromQuery] BankDepositStatus? status, CancellationToken ct)
+        => Ok(await _deposits.ListAsync(query, new BankDepositListFilter(from, to, branchId, bankAccountId, status), ct));
+
+    [HttpGet("{bankDepositId:int}")]
+    [ProducesResponseType(typeof(BankDepositDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<BankDepositDto>> GetById(int bankDepositId, CancellationToken ct)
+    {
+        var result = await _deposits.GetAsync(bankDepositId, ct);
+        return result is null ? NotFound() : Ok(result);
+    }
+
+    /// <summary>One business day's cash position (defaults to today) and how much of it can still be deposited.</summary>
+    [HttpGet("cash-in-hand")]
+    [ProducesResponseType(typeof(CashInHandDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<CashInHandDto>> CashInHand([FromQuery] DateOnly? date, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _cash.GetPositionAsync(date, branchId, ct));
+
+    /// <summary>Day-wise cash position for <c>from</c>..<c>to</c> inclusive (at most 92 days).</summary>
+    [HttpGet("cash-in-hand/daily")]
+    [ProducesResponseType(typeof(CashInHandDailyDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<ActionResult<CashInHandDailyDto>> CashInHandDaily(
+        [FromQuery] DateOnly from, [FromQuery] DateOnly to, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _cash.GetDailyAsync(from, to, branchId, ct));
+
+    /// <summary>Record a deposit; posts GL (Debit bank / Credit cash). Rejected above the cash in hand.</summary>
+    [HttpPost]
+    [Authorize(Policy = NavPolicies.Prefix + "accounts.bank-deposits" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
+    [ProducesResponseType(typeof(BankDepositDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<ActionResult<BankDepositDto>> Create([FromBody] CreateBankDepositRequest request, CancellationToken ct)
+    {
+        var result = await _deposits.CreateAsync(request, ct);
+        return Created($"/api/v1/bank-deposits/{result.BankDepositId}", result);
+    }
+
+    /// <summary>Cancel a Posted deposit; posts the reversing GL entry and puts the cash back in hand.</summary>
+    [HttpPost("{bankDepositId:int}/cancel")]
+    [Authorize(Policy = NavPolicies.Prefix + "accounts.bank-deposits" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
+    [ProducesResponseType(typeof(BankDepositDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<BankDepositDto>> Cancel(int bankDepositId, [FromBody] CancelBankDepositRequest request, CancellationToken ct)
+        => Ok(await _deposits.CancelAsync(bankDepositId, request, ct));
+}

Backend/ERPCore/Controllers/DashboardController.cs

@@ -12,12 +12,25 @@ namespace ERPCore.Controllers;
 public sealed class DashboardController : ApiControllerBase
 {
     private readonly IDashboardService _dashboard;
+    private readonly IDashboardChartsService _charts;
 
-    public DashboardController(IDashboardService dashboard) => _dashboard = dashboard;
+    public DashboardController(IDashboardService dashboard, IDashboardChartsService charts)
+    {
+        _dashboard = dashboard;
+        _charts = charts;
+    }
 
-    /// <summary>Aggregate counts for stock, GRN, and procurement.</summary>
+    /// <summary>Aggregate counts for stock, GRN, procurement, sales, accounts, service, production and HR.</summary>
     [HttpGet("stats")]
     [ProducesResponseType(typeof(DashboardStatsDto), StatusCodes.Status200OK)]
-    public async Task<ActionResult<DashboardStatsDto>> GetStats([FromQuery] int? branchId, CancellationToken ct)
-        => Ok(await _dashboard.GetStatsAsync(branchId, ct));
+    public async Task<ActionResult<DashboardStatsDto>> GetStats(
+        [FromQuery] int? branchId, [FromQuery] DateOnly? from, [FromQuery] DateOnly? to, CancellationToken ct)
+        => Ok(await _dashboard.GetStatsAsync(branchId, from, to, ct));
+
+    /// <summary>Datasets for the dashboard graphs; the time-based ones follow the optional from / to period.</summary>
+    [HttpGet("charts")]
+    [ProducesResponseType(typeof(DashboardChartsDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<DashboardChartsDto>> GetCharts(
+        [FromQuery] int? branchId, [FromQuery] DateOnly? from, [FromQuery] DateOnly? to, CancellationToken ct)
+        => Ok(await _charts.GetChartsAsync(branchId, from, to, ct));
 }

Backend/ERPCore/Controllers/DayEndReportController.cs

@@ -0,0 +1,31 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Dtos.Reports;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Day-End Sales Report — a day's sales, payments by method, expenses and income, and the
+/// same day-wise over a range for the income chart/PDF (docs/DAY_END_SALES_REPORT_PLAN.md §4).</summary>
+[Route("api/v1/day-end-report")]
+[Authorize(Policy = NavPolicies.Prefix + "sales.day-end-report")]
+public sealed class DayEndReportController : ApiControllerBase
+{
+    private readonly IDayEndReportService _reports;
+
+    public DayEndReportController(IDayEndReportService reports) => _reports = reports;
+
+    /// <summary>One business day (defaults to today in the report's time zone).</summary>
+    [HttpGet]
+    [ProducesResponseType(typeof(DayEndReportDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<DayEndReportDto>> GetDay([FromQuery] DateOnly? date, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _reports.GetDayAsync(date, branchId, ct));
+
+    /// <summary>Day-wise figures for <c>from</c>..<c>to</c> inclusive (at most 92 days).</summary>
+    [HttpGet("daily")]
+    [ProducesResponseType(typeof(DayEndDailyReportDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<ActionResult<DayEndDailyReportDto>> GetDaily([FromQuery] DateOnly from, [FromQuery] DateOnly to, [FromQuery] int? branchId, CancellationToken ct)
+        => Ok(await _reports.GetDailyAsync(from, to, branchId, ct));
+}

Backend/ERPCore/Controllers/ExpenseSetupController.cs

@@ -0,0 +1,57 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Dtos.Expenses;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Expense categories and titles (docs/EXPENSE_MODULE_PLAN.md §6 "Setup"). Reading is open to
+/// anyone with Accounts access (the expense form needs the lists); changes need the
+/// Expense Setup permission. Categories are the fixed seeded four — there is no create
+/// endpoint; only their active flag can change. Titles can be added under them.
+/// </summary>
+[Route("api/v1")]
+[Authorize(Policy = NavPolicies.Prefix + "accounts")]
+public sealed class ExpenseSetupController : ApiControllerBase
+{
+    private const string SetupPolicy = NavPolicies.Prefix + "accounts.expense-setup";
+
+    private readonly IExpenseSetupService _setup;
+
+    public ExpenseSetupController(IExpenseSetupService setup) => _setup = setup;
+
+    /// <summary>Categories, each with its titles, in display order.</summary>
+    [HttpGet("expense-categories")]
+    [ProducesResponseType(typeof(IReadOnlyList<ExpenseCategoryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<ExpenseCategoryDto>>> List([FromQuery] bool includeInactive, CancellationToken ct)
+        => Ok(await _setup.ListAsync(includeInactive, ct));
+
+    [HttpPut("expense-categories/{expenseCategoryId:int}")]
+    [Authorize(Policy = SetupPolicy)]
+    [ProducesResponseType(typeof(ExpenseCategoryDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseCategoryDto>> UpdateCategory(int expenseCategoryId, [FromBody] UpdateExpenseCategoryRequest request, CancellationToken ct)
+        => Ok(await _setup.UpdateCategoryAsync(expenseCategoryId, request, ct));
+
+    [HttpPost("expense-categories/{expenseCategoryId:int}/titles")]
+    [Authorize(Policy = SetupPolicy)]
+    [ProducesResponseType(typeof(ExpenseTitleDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseTitleDto>> CreateTitle(int expenseCategoryId, [FromBody] CreateExpenseTitleRequest request, CancellationToken ct)
+    {
+        var dto = await _setup.CreateTitleAsync(expenseCategoryId, request, ct);
+        return Created($"/api/v1/expense-titles/{dto.ExpenseTitleId}", dto);
+    }
+
+    [HttpPut("expense-titles/{expenseTitleId:int}")]
+    [Authorize(Policy = SetupPolicy)]
+    [ProducesResponseType(typeof(ExpenseTitleDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseTitleDto>> UpdateTitle(int expenseTitleId, [FromBody] UpdateExpenseTitleRequest request, CancellationToken ct)
+        => Ok(await _setup.UpdateTitleAsync(expenseTitleId, request, ct));
+}

Backend/ERPCore/Controllers/ExpensesController.cs

@@ -0,0 +1,127 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Expenses;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Business expense bills — draft, post (GL accrual), pay, cancel (docs/EXPENSE_MODULE_PLAN.md §6).</summary>
+[Route("api/v1/expenses")]
+[Authorize(Policy = NavPolicies.Prefix + "accounts.expenses")]
+public sealed class ExpensesController : ApiControllerBase
+{
+    private readonly IExpenseService _expenses;
+    private readonly IExpensePaymentService _payments;
+
+    public ExpensesController(IExpenseService expenses, IExpensePaymentService payments)
+    {
+        _expenses = expenses;
+        _payments = payments;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<ExpenseSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<ExpenseSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] ExpenseStatus? status, [FromQuery] ExpensePaymentStatus? paymentStatus,
+        [FromQuery] int? categoryId, [FromQuery] int? titleId, [FromQuery] DateOnly? from, [FromQuery] DateOnly? to,
+        [FromQuery] bool overdueOnly, CancellationToken ct)
+        => Ok(await _expenses.ListAsync(query, new ExpenseListFilter(status, paymentStatus, categoryId, titleId, from, to, overdueOnly), ct));
+
+    /// <summary>Totals by category → title for Posted expenses dated in [from, to] (default: this month), plus unpaid/overdue position.</summary>
+    [HttpGet("summary")]
+    [ProducesResponseType(typeof(ExpenseSummaryReportDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ExpenseSummaryReportDto>> Summary([FromQuery] DateOnly? from, [FromQuery] DateOnly? to, CancellationToken ct)
+        => Ok(await _expenses.GetSummaryAsync(from, to, ct));
+
+    [HttpGet("{expenseId:int}")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ExpenseDto>> GetById(int expenseId, CancellationToken ct)
+    {
+        var result = await _expenses.GetAsync(expenseId, ct);
+        if (result is null) return NotFound();
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPost]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<ExpenseDto>> Create([FromBody] CreateExpenseRequest request, CancellationToken ct)
+    {
+        var result = await _expenses.CreateAsync(request, ct);
+        SetETag(result.RowVersion);
+        return Created($"/api/v1/expenses/{result.Value.ExpenseId}", result.Value);
+    }
+
+    [HttpPut("{expenseId:int}")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<ExpenseDto>> Update(int expenseId, [FromBody] UpdateExpenseRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _expenses.UpdateAsync(expenseId, request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>Draft only.</summary>
+    [HttpDelete("{expenseId:int}")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int expenseId, CancellationToken ct)
+    {
+        await _expenses.DeleteAsync(expenseId, ct);
+        return NoContent();
+    }
+
+    /// <summary>Accrue the expense to GL (Debit expense account / Credit Accrued Expenses).</summary>
+    [HttpPost("{expenseId:int}/post")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseDto>> Post(int expenseId, CancellationToken ct)
+        => Ok(await _expenses.PostAsync(expenseId, ct));
+
+    /// <summary>Post a Draft and pay it, in full or partially, in one transaction; any remainder stays as the balance.</summary>
+    [HttpPost("{expenseId:int}/post-and-pay")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseDto>> PostAndPay(int expenseId, [FromBody] CreateExpensePaymentRequest request, CancellationToken ct)
+        => Ok(await _payments.PostAndPayAsync(expenseId, request, ct));
+
+    /// <summary>Draft, or Posted with no payments (posts the reversing GL entry).</summary>
+    [HttpPost("{expenseId:int}/cancel")]
+    [ProducesResponseType(typeof(ExpenseDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<ExpenseDto>> Cancel(int expenseId, [FromBody] CancelExpenseRequest request, CancellationToken ct)
+        => Ok(await _expenses.CancelAsync(expenseId, request, ct));
+
+    /// <summary>Pay against the balance, in full or in installments; one GL entry per submission.</summary>
+    [HttpPost("{expenseId:int}/payments")]
+    [ProducesResponseType(typeof(IReadOnlyList<ExpensePaymentDto>), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<IReadOnlyList<ExpensePaymentDto>>> Pay(int expenseId, [FromBody] CreateExpensePaymentRequest request, CancellationToken ct)
+    {
+        var rows = await _payments.PayAsync(expenseId, request, ct);
+        return Created($"/api/v1/expenses/{expenseId}/payments", rows);
+    }
+
+    /// <summary>Payment history, newest first.</summary>
+    [HttpGet("{expenseId:int}/payments")]
+    [ProducesResponseType(typeof(IReadOnlyList<ExpensePaymentDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<IReadOnlyList<ExpensePaymentDto>>> ListPayments(int expenseId, CancellationToken ct)
+        => Ok(await _payments.ListAsync(expenseId, ct));
+}

Backend/ERPCore/Controllers/GeneralLedgerController.cs

@@ -32,9 +32,15 @@ public sealed class GeneralLedgerController : ApiControllerBase
     [HttpPut("{**path}")]
     public Task<IActionResult> Put(string path, CancellationToken ct) => ForwardAsync(HttpMethod.Put, path, ct);
 
+    [HttpPatch("{**path}")]
+    public Task<IActionResult> Patch(string path, CancellationToken ct) => ForwardAsync(HttpMethod.Patch, path, ct);
+
+    [HttpDelete("{**path}")]
+    public Task<IActionResult> Delete(string path, CancellationToken ct) => ForwardAsync(HttpMethod.Delete, path, ct);
+
     private async Task<IActionResult> ForwardAsync(HttpMethod method, string path, CancellationToken ct)
     {
-        var body = method == HttpMethod.Get ? null : Request.Body;
+        var body = method == HttpMethod.Get || method == HttpMethod.Delete ? null : Request.Body;
         var result = await _gl.ForwardAsync(method, path, Request.QueryString.Value, Request.ContentType, body, ct);
         return new ContentResult
         {

Backend/ERPCore/Controllers/GlAccountConfigController.cs

@@ -0,0 +1,53 @@
+using ERPCore.Dtos.Config;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Role → GL account mapping endpoints.
+/// <para>
+/// <b>Authorization:</b> the <c>settings</c> nav policy, like <see cref="BranchConfigController"/>.
+/// Note this endpoint also serves the selectable accounts, rather than the screen calling the GL
+/// proxy directly: <see cref="GeneralLedgerController"/> is gated on <c>ledgers</c>, so a
+/// settings-only user would get a 403 from it — and serving both from here guarantees the picker
+/// and the server-side validation work from the same list.
+/// </para>
+/// </summary>
+[Route("api/v1/gl-account-config")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
+public sealed class GlAccountConfigController : ApiControllerBase
+{
+    private readonly IGlAccountConfigService _config;
+
+    public GlAccountConfigController(IGlAccountConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(GlAccountConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<GlAccountConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    /// <summary>
+    /// Replaces the mapping. 422 when a code is unknown to GL or not postable; 503 when GL could
+    /// not be reached, since a mapping that could not be verified is not stored.
+    /// </summary>
+    [HttpPut]
+    [ProducesResponseType(typeof(GlAccountConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status503ServiceUnavailable)]
+    public async Task<ActionResult<GlAccountConfigDto>> Update(
+        [FromBody] UpdateGlAccountConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}

Backend/ERPCore/Controllers/GrnsController.cs

@@ -25,8 +25,9 @@ public sealed class GrnsController : ApiControllerBase
     [ProducesResponseType(typeof(PagedResponse<GrnSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<GrnSummaryDto>>> List(
         [FromQuery] PageQuery query, [FromQuery] GrnStatus? status, [FromQuery] int? poId,
-        [FromQuery] int? vendorId, [FromQuery] int? warehouseId, [FromQuery] int? branchId, CancellationToken ct)
-        => Ok(await _grns.ListAsync(query, status, poId, vendorId, warehouseId, branchId, ct));
+        [FromQuery] int? vendorId, [FromQuery] int? warehouseId, [FromQuery] int? branchId,
+        [FromQuery] DateOnly? from, [FromQuery] DateOnly? to, CancellationToken ct)
+        => Ok(await _grns.ListAsync(query, status, poId, vendorId, warehouseId, branchId, from, to, ct));
 
     [HttpGet("{grnId:int}")]
     [ProducesResponseType(typeof(GrnDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/Hrm/AttendanceBatchesController.cs

@@ -3,11 +3,13 @@ using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
 using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Attendance upload batch endpoints (docs/13-BACKEND-HRM-API.md §4).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm.attendance")]
 [Route("api/v1/attendance-batches")]
 public sealed class AttendanceBatchesController : ApiControllerBase
 {
@@ -44,6 +46,7 @@ public sealed class AttendanceBatchesController : ApiControllerBase
         return result is null ? NotFound() : Ok(result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.attendance" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
     [HttpPost]
     [RequestSizeLimit(20 * 1024 * 1024)]
     [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status201Created)]
@@ -62,6 +65,7 @@ public sealed class AttendanceBatchesController : ApiControllerBase
         int batchId, [FromQuery] RowValidationStatus? status, CancellationToken ct)
         => Ok(await _attendance.ListRecordsAsync(batchId, status, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.attendance" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPut("{batchId:int}/records/{recordId:int}")]
     [ProducesResponseType(typeof(AttendanceRecordDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -70,6 +74,7 @@ public sealed class AttendanceBatchesController : ApiControllerBase
         int batchId, int recordId, [FromBody] UpdateAttendanceRecordRequest request, CancellationToken ct)
         => Ok(await _attendance.UpdateRecordAsync(batchId, recordId, request, _currentUser.AuditUserId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.attendance" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPost("{batchId:int}/resolve-duplicate")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -79,18 +84,21 @@ public sealed class AttendanceBatchesController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.attendance" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPost("{batchId:int}/validate")]
     [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
     public async Task<ActionResult<AttendanceUploadBatchDto>> Validate(int batchId, CancellationToken ct)
         => Ok(await _attendance.ValidateAsync(batchId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.attendance" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
     [HttpPost("{batchId:int}/confirm")]
     [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<AttendanceUploadBatchDto>> Confirm(int batchId, CancellationToken ct)
         => Ok(await _attendance.ConfirmAsync(batchId, _currentUser.AuditUserId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.attendance" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
     [HttpPost("{batchId:int}/unlock")]
     [ProducesResponseType(typeof(AttendanceUploadBatchDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]

Backend/ERPCore/Controllers/Hrm/BranchesController.cs

@@ -1,7 +1,9 @@
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
@@ -31,6 +33,7 @@ public sealed class BranchesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "settings.branches")]
     [HttpPost]
     [ProducesResponseType(typeof(BranchDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -41,6 +44,7 @@ public sealed class BranchesController : ApiControllerBase
         return Created($"/api/v1/branches/{result.Value.BranchId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "settings.branches")]
     [HttpPut("{branchId:int}")]
     [ProducesResponseType(typeof(BranchDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -53,6 +57,7 @@ public sealed class BranchesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "settings.branches")]
     [HttpPatch("{branchId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -62,6 +67,7 @@ public sealed class BranchesController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "settings.branches")]
     [HttpDelete("{branchId:int}")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/DepartmentsController.cs

@@ -1,12 +1,15 @@
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Department master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/departments")]
 public sealed class DepartmentsController : ApiControllerBase
 {
@@ -31,6 +34,7 @@ public sealed class DepartmentsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPost]
     [ProducesResponseType(typeof(DepartmentDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -41,6 +45,7 @@ public sealed class DepartmentsController : ApiControllerBase
         return Created($"/api/v1/departments/{result.Value.DepartmentId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPut("{departmentId:int}")]
     [ProducesResponseType(typeof(DepartmentDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -54,6 +59,7 @@ public sealed class DepartmentsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPatch("{departmentId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -63,6 +69,7 @@ public sealed class DepartmentsController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpDelete("{departmentId:int}")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/DesignationsController.cs

@@ -1,12 +1,15 @@
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Designation (job title) master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/designations")]
 public sealed class DesignationsController : ApiControllerBase
 {
@@ -31,6 +34,7 @@ public sealed class DesignationsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPost]
     [ProducesResponseType(typeof(DesignationDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -41,6 +45,7 @@ public sealed class DesignationsController : ApiControllerBase
         return Created($"/api/v1/designations/{result.Value.DesignationId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPut("{designationId:int}")]
     [ProducesResponseType(typeof(DesignationDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -53,6 +58,7 @@ public sealed class DesignationsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPatch("{designationId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -62,6 +68,7 @@ public sealed class DesignationsController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpDelete("{designationId:int}")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/EmployeesController.cs

@@ -3,6 +3,7 @@ using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
 using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
@@ -11,6 +12,9 @@ namespace ERPCore.Controllers.Hrm;
 /// Employee (staff) endpoints, incl. the Employee<->User cross-link and staff
 /// document sub-resources (docs/13-BACKEND-HRM-API.md §3).
 /// </summary>
+// Any HR role may list employees (the leave and payroll screens pick from it); everything else about a person
+// - the record itself, documents, pay data - is behind the Employees (or Payroll) permission, endpoint by endpoint.
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/employees")]
 public sealed class EmployeesController : ApiControllerBase
 {
@@ -44,11 +48,13 @@ public sealed class EmployeesController : ApiControllerBase
         => Ok(await _employees.ListAsync(query, status, departmentId, designationId, branchId, ct));
 
     /// <summary>Advisory reverse-direction lookup: does a System User already exist with this email? (docs/12-BACKEND-HRM.md A.5)</summary>
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees")]
     [HttpGet("email-lookup")]
     [ProducesResponseType(typeof(UserMatchResponse), StatusCodes.Status200OK)]
     public async Task<ActionResult<UserMatchResponse>> EmailLookup([FromQuery] string email, CancellationToken ct)
         => Ok(new UserMatchResponse(await _links.FindUserCandidateByEmailAsync(email, ct)));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees")]
     [HttpGet("{employeeId:int}")]
     [ProducesResponseType(typeof(EmployeeDetailDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -60,6 +66,7 @@ public sealed class EmployeesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
     [HttpPost]
     [ProducesResponseType(typeof(EmployeeDetailDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
@@ -71,6 +78,7 @@ public sealed class EmployeesController : ApiControllerBase
         return Created($"/api/v1/employees/{result.Value.EmployeeId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPut("{employeeId:int}")]
     [ProducesResponseType(typeof(EmployeeDetailDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -83,6 +91,7 @@ public sealed class EmployeesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPatch("{employeeId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -93,6 +102,7 @@ public sealed class EmployeesController : ApiControllerBase
     }
 
     /// <summary>Permanently deletes the employee and all dependent HR records. Blocked (409) if payroll history exists.</summary>
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
     [HttpDelete("{employeeId:int}")]
     [ProducesResponseType(typeof(EmployeeDeleteResultDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -103,6 +113,7 @@ public sealed class EmployeesController : ApiControllerBase
         return Ok(result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPost("{employeeId:int}/link-user")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -113,6 +124,7 @@ public sealed class EmployeesController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpDelete("{employeeId:int}/link-user")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -122,11 +134,13 @@ public sealed class EmployeesController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll")]
     [HttpGet("{employeeId:int}/bank-details")]
     [ProducesResponseType(typeof(List<EmployeeBankDetailDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<List<EmployeeBankDetailDto>>> ListBankDetails(int employeeId, CancellationToken ct)
         => Ok(await _employees.ListBankDetailsAsync(employeeId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPut("{employeeId:int}/bank-details")]
     [ProducesResponseType(typeof(List<EmployeeBankDetailDto>), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -140,6 +154,7 @@ public sealed class EmployeesController : ApiControllerBase
     public async Task<ActionResult<List<LeaveBalanceDto>>> ListLeaveBalances(int employeeId, [FromQuery] int? year, CancellationToken ct)
         => Ok(await _leaveBalances.ListAsync(employeeId, year, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPut("{employeeId:int}/leave-balances")]
     [ProducesResponseType(typeof(List<LeaveBalanceDto>), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -147,11 +162,13 @@ public sealed class EmployeesController : ApiControllerBase
         int employeeId, [FromBody] UpdateLeaveBalancesRequest request, CancellationToken ct)
         => Ok(await _leaveBalances.ApplyAdjustmentsAsync(employeeId, request, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll")]
     [HttpGet("{employeeId:int}/salary-structure")]
     [ProducesResponseType(typeof(List<EmployeeSalaryStructureDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<List<EmployeeSalaryStructureDto>>> GetSalaryStructureHistory(int employeeId, CancellationToken ct)
         => Ok(await _salaryStructures.ListHistoryAsync(employeeId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPost("{employeeId:int}/salary-structure")]
     [ProducesResponseType(typeof(EmployeeSalaryStructureDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -163,11 +180,13 @@ public sealed class EmployeesController : ApiControllerBase
         return Created($"/api/v1/employees/{employeeId}/salary-structure", result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll")]
     [HttpGet("{employeeId:int}/loans")]
     [ProducesResponseType(typeof(List<EmployeeLoanDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<List<EmployeeLoanDto>>> ListLoans(int employeeId, CancellationToken ct)
         => Ok(await _loans.ListAsync(employeeId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll")]
     [HttpGet("{employeeId:int}/loans/{loanId:int}")]
     [ProducesResponseType(typeof(EmployeeLoanDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -177,6 +196,7 @@ public sealed class EmployeesController : ApiControllerBase
         return result is null ? NotFound() : Ok(result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
     [HttpPost("{employeeId:int}/loans")]
     [ProducesResponseType(typeof(EmployeeLoanDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -186,11 +206,13 @@ public sealed class EmployeesController : ApiControllerBase
         return Created($"/api/v1/employees/{employeeId}/loans/{result.EmployeeLoanId}", result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees")]
     [HttpGet("{employeeId:int}/documents")]
     [ProducesResponseType(typeof(List<EmployeeDocumentDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<List<EmployeeDocumentDto>>> ListDocuments(int employeeId, CancellationToken ct)
         => Ok(await _documents.ListAsync(employeeId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPost("{employeeId:int}/documents")]
     [RequestSizeLimit(20 * 1024 * 1024)]
     [ProducesResponseType(typeof(EmployeeDocumentDto), StatusCodes.Status201Created)]
@@ -206,6 +228,7 @@ public sealed class EmployeesController : ApiControllerBase
         return Created($"/api/v1/employees/{employeeId}/documents/{result.EmployeeDocumentId}", result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees")]
     [HttpGet("{employeeId:int}/documents/{documentId:int}/download")]
     [ProducesResponseType(StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -215,6 +238,7 @@ public sealed class EmployeesController : ApiControllerBase
         return File(content, contentType, fileName);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.employees" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPatch("{employeeId:int}/documents/{documentId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/EmploymentTypesController.cs

@@ -1,12 +1,15 @@
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>EmploymentType master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/employment-types")]
 public sealed class EmploymentTypesController : ApiControllerBase
 {
@@ -31,6 +34,7 @@ public sealed class EmploymentTypesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPost]
     [ProducesResponseType(typeof(EmploymentTypeDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -41,6 +45,7 @@ public sealed class EmploymentTypesController : ApiControllerBase
         return Created($"/api/v1/employment-types/{result.Value.EmploymentTypeId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPut("{employmentTypeId:int}")]
     [ProducesResponseType(typeof(EmploymentTypeDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -53,6 +58,7 @@ public sealed class EmploymentTypesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPatch("{employmentTypeId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -62,6 +68,7 @@ public sealed class EmploymentTypesController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpDelete("{employmentTypeId:int}")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/HrDocumentTypesController.cs

@@ -1,12 +1,15 @@
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Staff document-type catalog ("DocType") endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/hr-document-types")]
 public sealed class HrDocumentTypesController : ApiControllerBase
 {
@@ -31,6 +34,7 @@ public sealed class HrDocumentTypesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPost]
     [ProducesResponseType(typeof(HrDocumentTypeDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -41,6 +45,7 @@ public sealed class HrDocumentTypesController : ApiControllerBase
         return Created($"/api/v1/hr-document-types/{result.Value.HrDocumentTypeId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPut("{hrDocumentTypeId:int}")]
     [ProducesResponseType(typeof(HrDocumentTypeDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -53,6 +58,7 @@ public sealed class HrDocumentTypesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPatch("{hrDocumentTypeId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -62,6 +68,7 @@ public sealed class HrDocumentTypesController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpDelete("{hrDocumentTypeId:int}")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/HrReportsController.cs

@@ -1,10 +1,13 @@
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Read-only HRM reports (FR-HR-RPT, docs/13-BACKEND-HRM-API.md §6). No new entities — aggregation over existing tables.</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm.reports")]
 [Route("api/v1/reports/hrm")]
 public sealed class HrReportsController : ApiControllerBase
 {
@@ -30,11 +33,13 @@ public sealed class HrReportsController : ApiControllerBase
         [FromQuery] int periodYear, [FromQuery] int periodMonth, CancellationToken ct)
         => Ok(await _reports.LateArrivalReportAsync(periodYear, periodMonth, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll")]
     [HttpGet("payroll-register")]
     [ProducesResponseType(typeof(List<PayrollRegisterRowDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<List<PayrollRegisterRowDto>>> PayrollRegister([FromQuery] int payrollRunId, CancellationToken ct)
         => Ok(await _reports.PayrollRegisterAsync(payrollRunId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll")]
     [HttpGet("salary-history")]
     [ProducesResponseType(typeof(List<SalaryHistoryRowDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<List<SalaryHistoryRowDto>>> SalaryHistory([FromQuery] int employeeId, CancellationToken ct)

Backend/ERPCore/Controllers/Hrm/LeaveRequestsController.cs

@@ -3,11 +3,13 @@ using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
 using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Leave request endpoints (docs/13-BACKEND-HRM-API.md §5).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm.leave")]
 [Route("api/v1/leave-requests")]
 public sealed class LeaveRequestsController : ApiControllerBase
 {
@@ -35,6 +37,7 @@ public sealed class LeaveRequestsController : ApiControllerBase
         return result is null ? NotFound() : Ok(result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.leave" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
     [HttpPost]
     [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -45,24 +48,28 @@ public sealed class LeaveRequestsController : ApiControllerBase
         return Created($"/api/v1/leave-requests/{result.LeaveRequestId}", result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.leave" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
     [HttpPost("{leaveRequestId:int}/submit")]
     [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<LeaveRequestDto>> Submit(int leaveRequestId, CancellationToken ct)
         => Ok(await _requests.SubmitAsync(leaveRequestId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.leave" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
     [HttpPost("{leaveRequestId:int}/approve")]
     [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<LeaveRequestDto>> Approve(int leaveRequestId, CancellationToken ct)
         => Ok(await _requests.ApproveAsync(leaveRequestId, _currentUser.AuditUserId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.leave" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
     [HttpPost("{leaveRequestId:int}/reject")]
     [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<LeaveRequestDto>> Reject(int leaveRequestId, [FromBody] RejectLeaveRequestRequest request, CancellationToken ct)
         => Ok(await _requests.RejectAsync(leaveRequestId, request.Reason, _currentUser.AuditUserId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.leave" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
     [HttpPost("{leaveRequestId:int}/cancel")]
     [ProducesResponseType(typeof(LeaveRequestDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]

Backend/ERPCore/Controllers/Hrm/LeaveTypesController.cs

@@ -1,12 +1,15 @@
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Leave type master endpoints (docs/13-BACKEND-HRM-API.md §5).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/leave-types")]
 public sealed class LeaveTypesController : ApiControllerBase
 {
@@ -31,6 +34,7 @@ public sealed class LeaveTypesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPost]
     [ProducesResponseType(typeof(LeaveTypeDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -41,6 +45,7 @@ public sealed class LeaveTypesController : ApiControllerBase
         return Created($"/api/v1/leave-types/{result.Value.LeaveTypeId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPut("{leaveTypeId:int}")]
     [ProducesResponseType(typeof(LeaveTypeDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -53,6 +58,7 @@ public sealed class LeaveTypesController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPatch("{leaveTypeId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -62,6 +68,7 @@ public sealed class LeaveTypesController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpDelete("{leaveTypeId:int}")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/PayrollRunsController.cs

@@ -3,11 +3,13 @@ using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
 using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Payroll run endpoints (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm.payroll")]
 [Route("api/v1/payroll-runs")]
 public sealed class PayrollRunsController : ApiControllerBase
 {
@@ -50,6 +52,7 @@ public sealed class PayrollRunsController : ApiControllerBase
         return result is null ? NotFound() : Ok(result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
     [HttpPost]
     [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
@@ -59,24 +62,28 @@ public sealed class PayrollRunsController : ApiControllerBase
         return Created($"/api/v1/payroll-runs/{result.PayrollRunId}", result);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
     [HttpPost("{payrollRunId:int}/approve")]
     [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<PayrollRunDto>> Approve(int payrollRunId, CancellationToken ct)
         => Ok(await _payrollRuns.ApproveAsync(payrollRunId, _currentUser.AuditUserId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
     [HttpPost("{payrollRunId:int}/lock")]
     [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<PayrollRunDto>> Lock(int payrollRunId, CancellationToken ct)
         => Ok(await _payrollRuns.LockAsync(payrollRunId, _currentUser.AuditUserId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction)]
     [HttpPost("{payrollRunId:int}/unlock")]
     [ProducesResponseType(typeof(PayrollRunDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     public async Task<ActionResult<PayrollRunDto>> Unlock(int payrollRunId, [FromBody] UnlockPayrollRunRequest request, CancellationToken ct)
         => Ok(await _payrollRuns.UnlockAsync(payrollRunId, request.Reason, _currentUser.AuditUserId, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.payroll" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
     [HttpPost("{payrollRunId:int}/generate-payslips")]
     [ProducesResponseType(typeof(List<PayslipDto>), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]

Backend/ERPCore/Controllers/Hrm/PayrollStatutorySettingsController.cs

@@ -1,11 +1,13 @@
 using ERPCore.Dtos.Hrm;
 using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Effective-dated EPF/ETF settings (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/payroll-statutory-settings")]
 public sealed class PayrollStatutorySettingsController : ApiControllerBase
 {
@@ -23,6 +25,7 @@ public sealed class PayrollStatutorySettingsController : ApiControllerBase
     public async Task<ActionResult<List<PayrollStatutorySettingDto>>> List(CancellationToken ct)
         => Ok(await _settings.ListAsync(ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPost]
     [ProducesResponseType(typeof(PayrollStatutorySettingDto), StatusCodes.Status201Created)]
     public async Task<ActionResult<PayrollStatutorySettingDto>> Create([FromBody] UpsertPayrollStatutorySettingRequest request, CancellationToken ct)

Backend/ERPCore/Controllers/Hrm/PayslipsController.cs

@@ -1,10 +1,13 @@
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Payslip retrieval + HTML print view (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm.payroll")]
 [Route("api/v1/payslips")]
 public sealed class PayslipsController : ApiControllerBase
 {

Backend/ERPCore/Controllers/Hrm/SalaryComponentsController.cs

@@ -1,12 +1,15 @@
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>SalaryComponent master endpoints (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/salary-components")]
 public sealed class SalaryComponentsController : ApiControllerBase
 {
@@ -31,6 +34,7 @@ public sealed class SalaryComponentsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPost]
     [ProducesResponseType(typeof(SalaryComponentDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -41,6 +45,7 @@ public sealed class SalaryComponentsController : ApiControllerBase
         return Created($"/api/v1/salary-components/{result.Value.SalaryComponentId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPut("{salaryComponentId:int}")]
     [ProducesResponseType(typeof(SalaryComponentDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -53,6 +58,7 @@ public sealed class SalaryComponentsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPatch("{salaryComponentId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -62,6 +68,7 @@ public sealed class SalaryComponentsController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpDelete("{salaryComponentId:int}")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/Hrm/TaxSlabsController.cs

@@ -1,10 +1,13 @@
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>Configurable APIT-style tax slabs (docs/13-BACKEND-HRM-API.md §6).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/tax-slabs")]
 public sealed class TaxSlabsController : ApiControllerBase
 {
@@ -17,6 +20,7 @@ public sealed class TaxSlabsController : ApiControllerBase
     public async Task<ActionResult<List<TaxSlabDto>>> List(CancellationToken ct)
         => Ok(await _taxSlabs.ListAsync(ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPost]
     [ProducesResponseType(typeof(TaxSlabDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]

Backend/ERPCore/Controllers/Hrm/WorkShiftsController.cs

@@ -1,12 +1,15 @@
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Hrm;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers.Hrm;
 
 /// <summary>WorkShift master endpoints (docs/13-BACKEND-HRM-API.md §2).</summary>
+[Authorize(Policy = NavPolicies.Prefix + "hrm")]
 [Route("api/v1/work-shifts")]
 public sealed class WorkShiftsController : ApiControllerBase
 {
@@ -31,6 +34,7 @@ public sealed class WorkShiftsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPost]
     [ProducesResponseType(typeof(WorkShiftDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -41,6 +45,7 @@ public sealed class WorkShiftsController : ApiControllerBase
         return Created($"/api/v1/work-shifts/{result.Value.WorkShiftId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPut("{workShiftId:int}")]
     [ProducesResponseType(typeof(WorkShiftDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -53,6 +58,7 @@ public sealed class WorkShiftsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpPatch("{workShiftId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -62,6 +68,7 @@ public sealed class WorkShiftsController : ApiControllerBase
         return NoContent();
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "hrm.settings")]
     [HttpDelete("{workShiftId:int}")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]

Backend/ERPCore/Controllers/ItemsController.cs

@@ -57,6 +57,13 @@ public sealed class ItemsController : ApiControllerBase
         return result is null ? NotFound() : Ok(result);
     }
 
+    /// <summary>The item's latest posted GRN receipts (default 5, newest first): unit cost, discount, net cost, vendor.</summary>
+    [HttpGet("{itemId:int}/purchase-prices")]
+    [ProducesResponseType(typeof(IReadOnlyList<ItemPurchasePriceDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<IReadOnlyList<ItemPurchasePriceDto>>> PurchasePrices(int itemId, [FromQuery] int take, CancellationToken ct)
+        => Ok(await _items.GetPurchasePricesAsync(itemId, take <= 0 ? 5 : take, ct));
+
     /// <summary>Get a single item; returns an <c>ETag</c> for optimistic concurrency.</summary>
     [HttpGet("{itemId:int}")]
     [ProducesResponseType(typeof(ItemDetailDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/OpeningBalancesController.cs

@@ -0,0 +1,71 @@
+using ERPCore.Dtos.OpeningBalances;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// One-time opening balances. Gated on the <c>accounts.opening-balances</c> nav code (Admin always passes;
+/// other roles need it granted under Settings → Roles).
+/// </summary>
+[Route("api/v1/opening-balances")]
+[Authorize(Policy = NavPolicies.Prefix + "accounts.opening-balances")]
+public sealed class OpeningBalancesController : ApiControllerBase
+{
+    private readonly IOpeningBalanceService _openingBalances;
+    private readonly IOpeningStockService _openingStock;
+
+    public OpeningBalancesController(IOpeningBalanceService openingBalances, IOpeningStockService openingStock)
+    {
+        _openingBalances = openingBalances;
+        _openingStock = openingStock;
+    }
+
+    /// <summary>The cash and bank accounts to enter opening amounts for — or the posted record, once done.</summary>
+    [HttpGet("cash-bank")]
+    [ProducesResponseType(typeof(CashBankOpeningStateDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<CashBankOpeningStateDto>> GetCashBank(CancellationToken ct) =>
+        Ok(await _openingBalances.GetCashBankAsync(ct));
+
+    /// <summary>Posts the cash and bank opening balances as one journal. Allowed once; later calls get 409.</summary>
+    [HttpPost("cash-bank")]
+    [ProducesResponseType(typeof(OpeningBalanceRunDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<OpeningBalanceRunDto>> PostCashBank(
+        [FromBody] PostCashBankOpeningRequest request, CancellationToken ct)
+    {
+        var run = await _openingBalances.PostCashBankAsync(request, ct);
+        return StatusCode(StatusCodes.Status201Created, run);
+    }
+
+    /// <summary>Opening-stock runs posted so far, newest first.</summary>
+    [HttpGet("stock")]
+    [ProducesResponseType(typeof(IReadOnlyList<OpeningStockRunSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<OpeningStockRunSummaryDto>>> ListStock(CancellationToken ct) =>
+        Ok(await _openingStock.ListAsync(ct));
+
+    /// <summary>One opening-stock run with its lines.</summary>
+    [HttpGet("stock/{runId:int}")]
+    [ProducesResponseType(typeof(OpeningStockRunDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<OpeningStockRunDto>> GetStock(int runId, CancellationToken ct)
+    {
+        var run = await _openingStock.GetAsync(runId, ct);
+        return run is null ? NotFound() : Ok(run);
+    }
+
+    /// <summary>
+    /// Posts opening stock: a FIFO layer per line and one journal (Dr Inventory / Cr Opening Balance Equity).
+    /// An item that already has stock movements in that warehouse is refused with 409.
+    /// </summary>
+    [HttpPost("stock")]
+    [ProducesResponseType(typeof(OpeningStockRunDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<OpeningStockRunDto>> PostStock([FromBody] PostOpeningStockRequest request, CancellationToken ct)
+    {
+        var run = await _openingStock.PostAsync(request, ct);
+        return StatusCode(StatusCodes.Status201Created, run);
+    }
+}

Backend/ERPCore/Controllers/OwnerReportController.cs

@@ -0,0 +1,77 @@
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Config;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.OwnerReport;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Day-end owner report settings (docs/DAY_END_OWNER_REPORT_PLAN.md §3.5) — recipients, schedule,
+/// preview, "send test now" and the send log. Gated on the Settings nav policy like the other
+/// configuration screens (BranchConfigController, GlAccountConfigController).
+/// </summary>
+[Route("api/v1/settings/owner-report")]
+[Authorize(Policy = NavPolicies.Prefix + "settings")]
+public sealed class OwnerReportController : ApiControllerBase
+{
+    // One test send per minute (whole deployment) so the button can't be used to spam the owner.
+    private static readonly SemaphoreSlim TestGate = new(1, 1);
+    private static DateTime _lastTestUtc = DateTime.MinValue;
+
+    private readonly IOwnerReportService _service;
+
+    public OwnerReportController(IOwnerReportService service) => _service = service;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(OwnerReportConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<OwnerReportConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _service.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut]
+    [ProducesResponseType(typeof(OwnerReportConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    public async Task<ActionResult<OwnerReportConfigDto>> Update([FromBody] UpdateOwnerReportConfigRequest request, CancellationToken ct)
+    {
+        var result = await _service.UpdateAsync(request, RequireIfMatch(), ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpGet("preview")]
+    [ProducesResponseType(typeof(OwnerReportPreviewDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<OwnerReportPreviewDto>> Preview([FromQuery] DateOnly? date, CancellationToken ct)
+        => Ok(await _service.PreviewAsync(date, ct));
+
+    [HttpPost("test")]
+    [ProducesResponseType(typeof(IReadOnlyList<OwnerReportSendResultDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status429TooManyRequests)]
+    public async Task<ActionResult<IReadOnlyList<OwnerReportSendResultDto>>> SendTest([FromBody] OwnerReportTestRequest? request, CancellationToken ct)
+    {
+        await TestGate.WaitAsync(ct);
+        try
+        {
+            if (DateTime.UtcNow - _lastTestUtc < TimeSpan.FromMinutes(1))
+                return StatusCode(StatusCodes.Status429TooManyRequests,
+                    new { title = "A test was sent less than a minute ago — wait a moment before sending another." });
+            _lastTestUtc = DateTime.UtcNow;
+        }
+        finally
+        {
+            TestGate.Release();
+        }
+
+        return Ok(await _service.SendTestAsync(request?.Date, ct));
+    }
+
+    [HttpGet("dispatches")]
+    [ProducesResponseType(typeof(PagedResponse<OwnerReportDispatchDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<OwnerReportDispatchDto>>> Dispatches([FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _service.ListDispatchesAsync(query, ct));
+}

Backend/ERPCore/Controllers/PriceAdjustmentsController.cs

@@ -0,0 +1,89 @@
+using Microsoft.AspNetCore.Authorization;
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Approvals;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Products;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Selling-price change requests (docs/DUAL_APPROVAL_PLAN.md §6.4). Requesting needs Create on
+/// <c>products.price-adjustments</c>, deciding needs Approve; an item's applied price history is
+/// readable by anyone who can see Products.
+/// </summary>
+[Route("api/v1/price-adjustments")]
+[Authorize(Policy = NavPolicies.Prefix + "products")]
+public sealed class PriceAdjustmentsController : ApiControllerBase
+{
+    private const string Screen = NavPolicies.Prefix + "products.price-adjustments";
+    private const string CreatePolicy = Screen + NavPolicies.ActionSeparator + NavPolicies.CreateAction;
+    private const string ApprovePolicy = Screen + NavPolicies.ActionSeparator + NavPolicies.ApproveAction;
+
+    private readonly IPriceAdjustmentService _prices;
+
+    public PriceAdjustmentsController(IPriceAdjustmentService prices) => _prices = prices;
+
+    [HttpGet]
+    [Authorize(Policy = Screen)]
+    [ProducesResponseType(typeof(PagedResponse<PriceAdjustmentSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<PriceAdjustmentSummaryDto>>> List(
+        [FromQuery] PageQuery query, [FromQuery] PriceAdjustmentStatus? status, [FromQuery] int? itemId, CancellationToken ct)
+        => Ok(await _prices.ListAsync(query, status, itemId, ct));
+
+    [HttpGet("{priceAdjustmentId:int}")]
+    [Authorize(Policy = Screen)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<PriceAdjustmentDto>> GetById(int priceAdjustmentId, CancellationToken ct)
+    {
+        var dto = await _prices.GetAsync(priceAdjustmentId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    /// <summary>Request new selling prices for one or more items.</summary>
+    [HttpPost]
+    [Authorize(Policy = CreatePolicy)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PriceAdjustmentDto>> Create([FromBody] CreatePriceAdjustmentRequest request, CancellationToken ct)
+    {
+        var dto = await _prices.CreateAsync(request, ct);
+        return Created($"/api/v1/price-adjustments/{dto.PriceAdjustmentId}", dto);
+    }
+
+    /// <summary>Give the next approval; the final one applies the prices.</summary>
+    [HttpPost("{priceAdjustmentId:int}/approve")]
+    [Authorize(Policy = ApprovePolicy)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PriceAdjustmentDto>> Approve(int priceAdjustmentId, [FromBody] ApproveRequest? request, CancellationToken ct)
+        => Ok(await _prices.ApproveAsync(priceAdjustmentId, request?.Comment, ct));
+
+    [HttpPost("{priceAdjustmentId:int}/reject")]
+    [Authorize(Policy = ApprovePolicy)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PriceAdjustmentDto>> Reject(int priceAdjustmentId, [FromBody] RejectRequest request, CancellationToken ct)
+        => Ok(await _prices.RejectAsync(priceAdjustmentId, request.Reason, ct));
+
+    /// <summary>The requester withdraws a pending request.</summary>
+    [HttpPost("{priceAdjustmentId:int}/cancel")]
+    [Authorize(Policy = Screen)]
+    [ProducesResponseType(typeof(PriceAdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<PriceAdjustmentDto>> Cancel(int priceAdjustmentId, CancellationToken ct)
+        => Ok(await _prices.CancelAsync(priceAdjustmentId, ct));
+
+    /// <summary>Every applied price change for an item, newest first, with who approved it.</summary>
+    [HttpGet("/api/v1/items/{itemId:int}/price-history")]
+    [ProducesResponseType(typeof(IReadOnlyList<ItemPriceHistoryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<ItemPriceHistoryDto>>> ItemHistory(int itemId, CancellationToken ct)
+        => Ok(await _prices.ItemHistoryAsync(itemId, ct));
+}

Backend/ERPCore/Controllers/ProcurementConfigController.cs

@@ -0,0 +1,46 @@
+using ERPCore.Dtos.Config;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Procurement configuration endpoints — optional vendor fields and PO tax.
+/// <para>
+/// <b>Authorization:</b> reading is open to any signed-in ERP user, because the vendor and purchase-order
+/// forms must read the flags and those screens sit under different nav codes. The flags are not
+/// sensitive. Changing them needs the <c>settings</c> nav policy, like <see cref="BranchConfigController"/>.
+/// </para>
+/// </summary>
+[Route("api/v1/procurement-config")]
+public sealed class ProcurementConfigController : ApiControllerBase
+{
+    private readonly IProcurementConfigService _config;
+
+    public ProcurementConfigController(IProcurementConfigService config) => _config = config;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(ProcurementConfigDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<ProcurementConfigDto>> Get(CancellationToken ct)
+    {
+        var result = await _config.GetAsync(ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+
+    [HttpPut]
+    [Authorize(Policy = NavPolicies.Prefix + "settings")]
+    [ProducesResponseType(typeof(ProcurementConfigDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
+    public async Task<ActionResult<ProcurementConfigDto>> Update(
+        [FromBody] UpdateProcurementConfigRequest request, CancellationToken ct)
+    {
+        var expected = RequireIfMatch();
+        var result = await _config.UpdateAsync(request, expected, ct);
+        SetETag(result.RowVersion);
+        return Ok(result.Value);
+    }
+}

Backend/ERPCore/Controllers/ProductionRunsController.cs

@@ -56,6 +56,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(typeof(RunGraphDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<RunGraphDto>> Create([FromBody] CreateRunRequest request, CancellationToken ct)
     {
         var result = await _runs.CreateAsync(request, ct);
@@ -69,6 +70,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<RunStageDto>> UpdateQuantities(
         int runId, int runStageId, [FromBody] UpdateStageQuantitiesRequest request, CancellationToken ct)
         => Ok(await _runs.UpdateStageQuantitiesAsync(runId, runStageId, request, ct));
@@ -86,6 +88,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<StartStageResultDto>> Start(
         int runId, int runStageId,
         [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -98,6 +101,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<RunStageDto>> Complete(
         int runId, int runStageId, [FromBody] CompleteStageRequest request,
         [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -109,6 +113,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<ApproveStageResultDto>> Approve(
         int runId, int runStageId, [FromBody] ApproveStageRequest? request,
         [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -120,6 +125,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<TransferResultDto>> Transfer(
         int runId, int runStageId, [FromBody] TransferRemainderRequest request,
         [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -132,6 +138,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<ReturnLeftoverResultDto>> ReturnLeftover(
         int runId, int runInputId, [FromBody] ReturnLeftoverRequest request,
         [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -142,6 +149,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(typeof(RejectIntakeResultDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<RejectIntakeResultDto>> RejectIntake(
         int runId, int runStageId, [FromBody] RejectRequest? request,
         [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -153,6 +161,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(typeof(TerminalRejectResultDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<TerminalRejectResultDto>> Reject(
         int runId, int runStageId, [FromBody] RejectRequest? request,
         [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,
@@ -165,6 +174,7 @@ public sealed class ProductionRunsController : ApiControllerBase
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
     [ProducesResponseType(StatusCodes.Status422UnprocessableEntity)]
+    [ProducesResponseType(StatusCodes.Status412PreconditionFailed)]
     public async Task<ActionResult<CancelRunResultDto>> Cancel(
         int runId, [FromBody] CancelRunRequest request,
         [FromHeader(Name = "Idempotency-Key")] string? idempotencyKey,

Backend/ERPCore/Controllers/PurchaseOrdersController.cs

@@ -20,8 +20,9 @@ public sealed class PurchaseOrdersController : ApiControllerBase
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<PurchaseOrderSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<PurchaseOrderSummaryDto>>> List(
-        [FromQuery] PageQuery query, [FromQuery] PurchaseOrderStatus? status, [FromQuery] int? vendorId, CancellationToken ct)
-        => Ok(await _pos.ListAsync(query, status, vendorId, ct));
+        [FromQuery] PageQuery query, [FromQuery] PurchaseOrderStatus? status, [FromQuery] int? vendorId,
+        [FromQuery] DateOnly? from, [FromQuery] DateOnly? to, CancellationToken ct)
+        => Ok(await _pos.ListAsync(query, status, vendorId, from, to, ct));
 
     [HttpGet("{poId:int}")]
     [ProducesResponseType(typeof(PurchaseOrderDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/ReasonCodesController.cs

@@ -1,7 +1,9 @@
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Reference;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers;
@@ -20,6 +22,7 @@ public sealed class ReasonCodesController : ApiControllerBase
         [FromQuery] ReasonContext? context, [FromQuery] PageQuery query, CancellationToken ct)
         => Ok(await _codes.ListAsync(context, query, ct));
 
+    [Authorize(Policy = NavPolicies.Prefix + "settings")]
     [HttpPost]
     [ProducesResponseType(typeof(ReasonCodeDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]

Backend/ERPCore/Controllers/SalesInvoicesController.cs

@@ -92,8 +92,26 @@ public sealed class SalesInvoicesController : ApiControllerBase
         [FromQuery] DateOnly? to,
         [FromQuery] int? createdBy,
         [FromQuery] bool? paid,
+        [FromQuery] bool? overdue,
         CancellationToken ct)
-        => Ok(await _invoices.ListAsync(query, status, customerId, warehouseId, branchId, from, to, createdBy, paid, ct));
+        => Ok(await _invoices.ListAsync(query, status, customerId, warehouseId, branchId, from, to, createdBy, paid, overdue, ct));
+
+    // Totals for the list's stat cards: same filters as List, but over every match rather than one page.
+    [HttpGet("totals")]
+    [ProducesResponseType(typeof(SalesInvoiceListTotalsDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<SalesInvoiceListTotalsDto>> Totals(
+        [FromQuery] string? q,
+        [FromQuery] SalesInvoiceStatus? status,
+        [FromQuery] int? customerId,
+        [FromQuery] int? warehouseId,
+        [FromQuery] int? branchId,
+        [FromQuery] DateOnly? from,
+        [FromQuery] DateOnly? to,
+        [FromQuery] int? createdBy,
+        [FromQuery] bool? paid,
+        [FromQuery] bool? overdue,
+        CancellationToken ct)
+        => Ok(await _invoices.TotalsAsync(q, status, customerId, warehouseId, branchId, from, to, createdBy, paid, overdue, ct));
 
     [HttpGet("{salesInvoiceId:int}")]
     [ProducesResponseType(typeof(SalesInvoiceDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/SalesReturnsController.cs

@@ -1,15 +1,15 @@
-using Microsoft.AspNetCore.Authorization;
-using ERPCore.Infra.Auth;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Sales;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers;
 
 /// <summary>Sales-return endpoints — customer returns of previously sold goods.</summary>
 [Route("api/v1/sales-returns")]
-[Authorize(Policy = NavPolicies.Prefix + "sales")]
+[Authorize(Policy = NavPolicies.Prefix + "sales-returns")]
 public sealed class SalesReturnsController : ApiControllerBase
 {
     private readonly ISalesReturnService _returns;

Backend/ERPCore/Controllers/SerialsController.cs

@@ -0,0 +1,41 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Stock;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>Serial register and per-serial history (docs/ITEM_TRACKING_PLAN.md Phase 9).</summary>
+[Route("api/v1/serials")]
+[Authorize(Policy = NavPolicies.Prefix + "stock")]
+public sealed class SerialsController : ApiControllerBase
+{
+    private readonly IItemTrackingService _tracking;
+
+    public SerialsController(IItemTrackingService tracking) => _tracking = tracking;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<SerialSummaryDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<SerialSummaryDto>>> List(
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] SerialStatus? status,
+        [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _tracking.ListSerialsAsync(query, itemId, warehouseId, status, ct));
+
+    /// <summary>Exact lookup by serial number or barcode, across items.</summary>
+    [HttpGet("lookup")]
+    [ProducesResponseType(typeof(IReadOnlyList<SerialDetailDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<SerialDetailDto>>> Lookup([FromQuery] string serialNo, CancellationToken ct)
+        => Ok(await _tracking.FindSerialAsync(serialNo, ct));
+
+    [HttpGet("{serialId:int}")]
+    [ProducesResponseType(typeof(SerialDetailDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SerialDetailDto>> Get(int serialId, CancellationToken ct)
+    {
+        var dto = await _tracking.GetSerialAsync(serialId, ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+}

Backend/ERPCore/Controllers/StockAdjustmentsController.cs

@@ -1,5 +1,7 @@
 using Microsoft.AspNetCore.Authorization;
+using ERPCore.Domain.Enums;
 using ERPCore.Infra.Auth;
+using ERPCore.Dtos.Approvals;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Stock;
 using ERPCore.Services.Interfaces;
@@ -7,23 +9,30 @@ using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers;
 
-/// <summary>Stock-adjustment endpoints (docs/11 §5.5).</summary>
+/// <summary>
+/// Stock-adjustment endpoints (docs/11 §5.5). Creating submits a request; it moves stock once
+/// approved (docs/DUAL_APPROVAL_PLAN.md §5.4). Approving or rejecting needs the Approve action on
+/// <c>stock.adjustments</c>; the two-person rules are enforced by the service.
+/// </summary>
 [Route("api/v1/stock-adjustments")]
 [Authorize(Policy = NavPolicies.Prefix + "stock")]
 public sealed class StockAdjustmentsController : ApiControllerBase
 {
+    private const string ApprovePolicy = NavPolicies.Prefix + "stock.adjustments" + NavPolicies.ActionSeparator + NavPolicies.ApproveAction;
+
     private readonly IAdjustmentService _adjustments;
 
     public StockAdjustmentsController(IAdjustmentService adjustments) => _adjustments = adjustments;
 
-    /// <summary>List posted adjustments, newest first.</summary>
+    /// <summary>List adjustments (posted and requests), newest first.</summary>
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<AdjustmentSummaryDto>), StatusCodes.Status200OK)]
     public async Task<ActionResult<PagedResponse<AdjustmentSummaryDto>>> List(
-        [FromQuery] PageQuery query, [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] int? reasonCodeId, CancellationToken ct)
-        => Ok(await _adjustments.ListAsync(query, warehouseId, branchId, reasonCodeId, ct));
+        [FromQuery] PageQuery query, [FromQuery] int? warehouseId, [FromQuery] int? branchId, [FromQuery] int? reasonCodeId,
+        [FromQuery] AdjustmentStatus? status, CancellationToken ct, [FromQuery] bool wastage = false, [FromQuery] int? itemId = null)
+        => Ok(await _adjustments.ListAsync(query, warehouseId, branchId, reasonCodeId, status, ct, wastage, itemId));
 
-    /// <summary>Get one adjustment with its lines and the ledger entries it posted.</summary>
+    /// <summary>Get one adjustment with its lines, approval trail and the ledger entries it posted.</summary>
     [HttpGet("{adjustmentId:int}")]
     [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -33,7 +42,7 @@ public sealed class StockAdjustmentsController : ApiControllerBase
         return dto is null ? NotFound() : Ok(dto);
     }
 
-    /// <summary>Create + auto-post an adjustment (mandatory reason code; decrease FIFO-consumes).</summary>
+    /// <summary>Submit an adjustment (mandatory reason code). Posts at once only when approvals are off.</summary>
     [HttpPost]
     [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
@@ -44,4 +53,29 @@ public sealed class StockAdjustmentsController : ApiControllerBase
         var dto = await _adjustments.CreateAsync(request, ct);
         return Created($"/api/v1/stock-adjustments/{dto.AdjustmentId}", dto);
     }
+
+    /// <summary>Give the next approval. The final one posts the stock movement and GL.</summary>
+    [HttpPost("{adjustmentId:int}/approve")]
+    [Authorize(Policy = ApprovePolicy)]
+    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AdjustmentDto>> Approve(int adjustmentId, [FromBody] ApproveRequest? request, CancellationToken ct)
+        => Ok(await _adjustments.ApproveAsync(adjustmentId, request?.Comment, ct));
+
+    [HttpPost("{adjustmentId:int}/reject")]
+    [Authorize(Policy = ApprovePolicy)]
+    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AdjustmentDto>> Reject(int adjustmentId, [FromBody] RejectRequest request, CancellationToken ct)
+        => Ok(await _adjustments.RejectAsync(adjustmentId, request.Reason, ct));
+
+    /// <summary>The requester withdraws a pending request.</summary>
+    [HttpPost("{adjustmentId:int}/cancel")]
+    [ProducesResponseType(typeof(AdjustmentDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<ActionResult<AdjustmentDto>> Cancel(int adjustmentId, CancellationToken ct)
+        => Ok(await _adjustments.CancelAsync(adjustmentId, ct));
 }

Backend/ERPCore/Controllers/StockController.cs

@@ -15,13 +15,26 @@ public sealed class StockController : ApiControllerBase
 {
     private readonly IStockService _stock;
     private readonly IReorderService _reorder;
+    private readonly IItemTrackingService _tracking;
 
-    public StockController(IStockService stock, IReorderService reorder)
+    public StockController(IStockService stock, IReorderService reorder, IItemTrackingService tracking)
     {
         _stock = stock;
         _reorder = reorder;
+        _tracking = tracking;
     }
 
+    /// <summary>
+    /// Stock on hand per batch with expiry (docs/ITEM_TRACKING_PLAN.md Phase 9), soonest expiry
+    /// first. <c>expiringWithinDays</c> keeps batches expiring within that window, expired included.
+    /// </summary>
+    [HttpGet("batches")]
+    [ProducesResponseType(typeof(PagedResponse<BatchStockDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<BatchStockDto>>> Batches(
+        [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] int? expiringWithinDays,
+        [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _tracking.ListBatchStockAsync(query, itemId, warehouseId, expiringWithinDays, ct));
+
     [HttpGet("on-hand")]
     [ProducesResponseType(typeof(StockOnHandDto), StatusCodes.Status200OK)]
     public async Task<ActionResult<StockOnHandDto>> OnHand([FromQuery] int itemId, [FromQuery] int warehouseId, CancellationToken ct)
@@ -45,8 +58,9 @@ public sealed class StockController : ApiControllerBase
         [FromQuery] int? itemId, [FromQuery] int? warehouseId, [FromQuery] int? branchId,
         [FromQuery] DateOnly? from, [FromQuery] DateOnly? to,
         [FromQuery] string? sourceDocType, [FromQuery] int? sourceDocId,
-        [FromQuery] PageQuery query, CancellationToken ct)
-        => Ok(await _stock.GetLedgerAsync(itemId, warehouseId, branchId, from, to, sourceDocType, sourceDocId, query, ct));
+        [FromQuery] PageQuery query, CancellationToken ct,
+        [FromQuery] int? categoryId = null, [FromQuery] int? brandId = null)
+        => Ok(await _stock.GetLedgerAsync(itemId, warehouseId, branchId, from, to, sourceDocType, sourceDocId, query, ct, categoryId, brandId));
 
     [HttpGet("valuation")]
     [ProducesResponseType(typeof(StockValuationDto), StatusCodes.Status200OK)]

Backend/ERPCore/Controllers/TrackingController.cs

@@ -0,0 +1,64 @@
+using ERPCore.Dtos.Stock;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Serial/batch pickers used across GRN, sales, returns and stock screens
+/// (docs/ITEM_TRACKING_PLAN.md Phase 8). Read-only lookups like the item scan, so they need
+/// only ERP access — not one module's nav permission — as every one of those screens calls them.
+/// </summary>
+[Route("api/v1/tracking")]
+public sealed class TrackingController : ApiControllerBase
+{
+    private readonly IItemTrackingService _tracking;
+    private readonly ISerialTrackingService _serialTracking;
+
+    public TrackingController(IItemTrackingService tracking, ISerialTrackingService serialTracking)
+    {
+        _tracking = tracking;
+        _serialTracking = serialTracking;
+    }
+
+    /// <summary>
+    /// Which tracking features are switched on (Product Configuration) — readable by every
+    /// screen, unlike <c>/product-config</c> which needs the Products permission.
+    /// </summary>
+    [HttpGet("settings")]
+    [ProducesResponseType(typeof(TrackingSettingsDto), StatusCodes.Status200OK)]
+    public async Task<ActionResult<TrackingSettingsDto>> Settings(CancellationToken ct)
+        => Ok(new TrackingSettingsDto(await _serialTracking.IsEnabledAsync(ct)));
+
+    /// <summary>
+    /// Auto-generate: the next <c>count</c> free serial numbers for an item under <c>prefix</c>
+    /// (continues the highest number already used). Nothing is reserved — the GRN still checks
+    /// uniqueness when it is saved and confirmed.
+    /// </summary>
+    [HttpGet("serials/next-numbers")]
+    [ProducesResponseType(typeof(IReadOnlyList<string>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<string>>> NextSerialNumbers(
+        [FromQuery] int itemId, [FromQuery] string? prefix, [FromQuery] int count = 1, CancellationToken ct = default)
+        => Ok(await _tracking.NextSerialNumbersAsync(itemId, prefix ?? string.Empty, count, ct));
+
+    /// <summary>Issuable serials of an item at a warehouse (search by number/barcode with <c>q</c>).</summary>
+    [HttpGet("serials/available")]
+    [ProducesResponseType(typeof(IReadOnlyList<AvailableSerialDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<AvailableSerialDto>>> AvailableSerials(
+        [FromQuery] int itemId, [FromQuery] int warehouseId, [FromQuery] string? q, [FromQuery] int take = 200, CancellationToken ct = default)
+        => Ok(await _tracking.GetAvailableSerialsAsync(itemId, warehouseId, q, take, ct));
+
+    /// <summary>Issuable stock per batch with expiry, soonest expiry first.</summary>
+    [HttpGet("batches/available")]
+    [ProducesResponseType(typeof(IReadOnlyList<AvailableBatchDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<AvailableBatchDto>>> AvailableBatches(
+        [FromQuery] int itemId, [FromQuery] int warehouseId, CancellationToken ct)
+        => Ok(await _tracking.GetAvailableBatchesAsync(itemId, warehouseId, ct));
+
+    /// <summary>The FEFO pick posting would make for <c>qty</c> when no batch is chosen.</summary>
+    [HttpGet("batches/suggest")]
+    [ProducesResponseType(typeof(IReadOnlyList<BatchSuggestionDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<IReadOnlyList<BatchSuggestionDto>>> SuggestBatches(
+        [FromQuery] int itemId, [FromQuery] int warehouseId, [FromQuery] decimal qty, CancellationToken ct)
+        => Ok(await _tracking.SuggestBatchesAsync(itemId, warehouseId, qty, ct));
+}

Backend/ERPCore/Controllers/UsersController.cs

@@ -41,8 +41,8 @@ public sealed class UsersController : ApiControllerBase
 
     [HttpGet]
     [ProducesResponseType(typeof(PagedResponse<ManagedUserDto>), StatusCodes.Status200OK)]
-    public async Task<ActionResult<PagedResponse<ManagedUserDto>>> List([FromQuery] PageQuery query, [FromQuery] EntityStatus? status, [FromQuery] string? roleCode, CancellationToken ct)
-        => Ok(await _users.ListAsync(query, status, roleCode, ct));
+    public async Task<ActionResult<PagedResponse<ManagedUserDto>>> List([FromQuery] PageQuery query, [FromQuery] EntityStatus? status, [FromQuery] string? roleCode, [FromQuery] bool? isAdmin, CancellationToken ct)
+        => Ok(await _users.ListAsync(query, status, roleCode, isAdmin, ct));
 
     /// <summary>AuthHex UserType options for the create-user form's select.</summary>
     [HttpGet("user-types")]
@@ -74,13 +74,27 @@ public sealed class UsersController : ApiControllerBase
     public async Task<ActionResult<ManagedUserDto>> UpdateRole(int userId, [FromBody] UpdateUserRoleRequest request, CancellationToken ct)
         => Ok(await _users.UpdateRoleAsync(userId, request, ct));
 
-    /// <summary>Revokes/restores standing inside ERPCore only — see <see cref="IUserManagementService.SetStatusAsync"/>.</summary>
+    /// <summary>Edits DisplayName/Email/MobileNumber on both backends — see <see cref="IUserManagementService.UpdateAsync"/>.</summary>
+    [HttpPut("{userId:int}")]
+    [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ManagedUserDto>> Update(int userId, [FromBody] UpdateManagedUserRequest request, CancellationToken ct)
+        => Ok(await _users.UpdateAsync(userId, request, ct));
+
+    /// <summary>Revokes/restores standing in both ERPCore and AuthHex — see <see cref="IUserManagementService.SetStatusAsync"/>.</summary>
     [HttpPatch("{userId:int}/status")]
     [ProducesResponseType(typeof(ManagedUserDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
     public async Task<ActionResult<ManagedUserDto>> UpdateStatus(int userId, [FromBody] UpdateUserStatusRequest request, CancellationToken ct)
         => Ok(await _users.SetStatusAsync(userId, request.Status, ct));
 
+    /// <summary>Emails the user a 15-minute password-reset link — see <see cref="IUserManagementService.SendResetLinkAsync"/>.</summary>
+    [HttpPost("{userId:int}/send-reset-link")]
+    [ProducesResponseType(typeof(SendResetLinkResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<SendResetLinkResponse>> SendResetLink(int userId, CancellationToken ct)
+        => Ok(await _users.SendResetLinkAsync(userId, ct));
+
     /// <summary>Device/login history ERPCore captures itself — not AuthHex's "currently active sessions"
     /// (which only ever reports the caller's own). See <see cref="IAuditService.ListLoginDevicesAsync"/>.</summary>
     [HttpGet("{userId:int}/login-devices")]
@@ -103,4 +117,20 @@ public sealed class UsersController : ApiControllerBase
 
         return Ok(await _users.PurgeAuthHexIdentityAsync(request, ct));
     }
+
+    /// <summary>
+    /// One-time migration helper (administrators only): copies each role-less user's role from AuthHex into the ERP.
+    /// Safe to repeat — users that already have a role are left alone. See
+    /// <see cref="IUserManagementService.BackfillRolesFromAuthHexAsync"/>.
+    /// </summary>
+    [HttpPost("backfill-roles")]
+    [ProducesResponseType(typeof(BackfillRolesResultDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<ActionResult<BackfillRolesResultDto>> BackfillRoles(CancellationToken ct)
+    {
+        if (!_currentUser.IsAdmin)
+            throw new DomainException("FORBIDDEN", "Only an administrator can run the role backfill.", 403);
+
+        return Ok(await _users.BackfillRolesFromAuthHexAsync(ct));
+    }
 }

Backend/ERPCore/Controllers/VendorsController.cs

@@ -1,16 +1,16 @@
-using Microsoft.AspNetCore.Authorization;
-using ERPCore.Infra.Auth;
 using ERPCore.Domain.Enums;
 using ERPCore.Dtos.Common;
 using ERPCore.Dtos.Vendors;
+using ERPCore.Infra.Auth;
 using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ERPCore.Controllers;
 
 /// <summary>Vendor master endpoints (docs/11-BACKEND-PHASE1.md §2.4).</summary>
 [Route("api/v1/vendors")]
-[Authorize(Policy = NavPolicies.Prefix + "vendors")]
+[Authorize(Policy = NavPolicies.Prefix + "procurement")]
 public sealed class VendorsController : ApiControllerBase
 {
     private readonly IVendorService _vendors;
@@ -35,6 +35,7 @@ public sealed class VendorsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "procurement.vendors" + NavPolicies.ActionSeparator + NavPolicies.CreateAction)]
     [HttpPost]
     [ProducesResponseType(typeof(VendorDto), StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status409Conflict)]
@@ -45,6 +46,7 @@ public sealed class VendorsController : ApiControllerBase
         return Created($"/api/v1/vendors/{result.Value.VendorId}", result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "procurement.vendors" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPut("{vendorId:int}")]
     [ProducesResponseType(typeof(VendorDto), StatusCodes.Status200OK)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -57,6 +59,7 @@ public sealed class VendorsController : ApiControllerBase
         return Ok(result.Value);
     }
 
+    [Authorize(Policy = NavPolicies.Prefix + "procurement.vendors" + NavPolicies.ActionSeparator + NavPolicies.EditAction)]
     [HttpPatch("{vendorId:int}/status")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     [ProducesResponseType(StatusCodes.Status404NotFound)]
@@ -65,4 +68,15 @@ public sealed class VendorsController : ApiControllerBase
         await _vendors.SetStatusAsync(vendorId, request.Status, ct);
         return NoContent();
     }
+
+    [HttpDelete("{vendorId:int}")]
+    [Authorize(Policy = NavPolicies.Prefix + "procurement.vendors" + NavPolicies.ActionSeparator + NavPolicies.DeleteAction)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status409Conflict)]
+    public async Task<IActionResult> Delete(int vendorId, CancellationToken ct)
+    {
+        await _vendors.DeleteAsync(vendorId, ct);
+        return NoContent();
+    }
 }

Backend/ERPCore/Controllers/WarrantiesController.cs

@@ -0,0 +1,30 @@
+using ERPCore.Domain.Enums;
+using ERPCore.Dtos.Common;
+using ERPCore.Dtos.Stock;
+using ERPCore.Infra.Auth;
+using ERPCore.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace ERPCore.Controllers;
+
+/// <summary>
+/// Customer warranty register (docs/ITEM_TRACKING_PLAN.md Phase 5). Warranties are created by
+/// posting a sale, never directly — this controller only reads.
+/// </summary>
+[Route("api/v1/warranties")]
+[Authorize(Policy = NavPolicies.Prefix + "sales")]
+public sealed class WarrantiesController : ApiControllerBase
+{
+    private readonly IItemTrackingService _tracking;
+
+    public WarrantiesController(IItemTrackingService tracking) => _tracking = tracking;
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<WarrantyRegistrationDto>), StatusCodes.Status200OK)]
+    public async Task<ActionResult<PagedResponse<WarrantyRegistrationDto>>> List(
+        [FromQuery] int? customerId, [FromQuery] int? itemId, [FromQuery] string? serialNo,
+        [FromQuery] WarrantyStatus? status, [FromQuery] int? expiringWithinDays, [FromQuery] bool? expired,
+        [FromQuery] PageQuery query, CancellationToken ct)
+        => Ok(await _tracking.ListWarrantiesAsync(query, customerId, itemId, serialNo, status, expiringWithinDays, expired, ct));
+}

Backend/ERPCore/Domain/DocumentTypes.cs

@@ -26,4 +26,13 @@ public static class DocumentTypes
 
     /// <summary>Cashier day-end close-out (Sales) — <c>DEND-2026-00001</c>.</summary>
     public const string SalesDayEnd = "DEND";
+
+    /// <summary>Business expense bill (Accounts) — <c>EXP-BR-001-2026-00001</c>.</summary>
+    public const string Expense = "EXP";
+
+    /// <summary>Till cash deposited to a bank account (Accounts) — <c>BD-BR-001-2026-00001</c>.</summary>
+    public const string BankDeposit = "BD";
+
+    /// <summary>Selling-price change request (Products) — <c>PADJ-2026-00001</c>.</summary>
+    public const string PriceAdjustment = "PADJ";
 }

Backend/ERPCore/Domain/Entities/AccessConfig.cs

@@ -0,0 +1,26 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Access configuration — a singleton row (same shape as <see cref="GrnConfig"/>).
+/// <see cref="DefaultRoleId"/> is the role a person gets on their first sign-in, and when they have none:
+/// without it they would have no permissions at all. It must be a least-privilege role and can never be the
+/// administrator role (enforced when it is saved).
+/// </summary>
+public class AccessConfig
+{
+    /// <summary>Always 1 - the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    public int ConfigId { get; set; }
+
+    public int? DefaultRoleId { get; set; }
+    public Role? DefaultRole { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    /// <summary>Optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}

Backend/ERPCore/Domain/Entities/BankDeposit.cs

@@ -0,0 +1,55 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Till cash taken to the bank (docs/BANK_DEPOSIT_MODULE_PLAN.md §4). Saving it posts a GL entry
+/// (Debit the bank account / Credit the cash account) and lowers the branch's cash in hand for
+/// <see cref="BusinessDate"/>. There is no draft: a wrong deposit is cancelled (the entry is
+/// reversed) and entered again. GL accounts have no local FK, so the account details are snapshots.
+/// </summary>
+public class BankDeposit
+{
+    public int BankDepositId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
+    /// <summary>The day whose cash is deposited — cash in hand and the day-end report group by this.</summary>
+    public DateOnly BusinessDate { get; set; }
+    /// <summary>The day the bank received it; the GL entry date.</summary>
+    public DateOnly DepositDate { get; set; }
+
+    public decimal Amount { get; set; }
+
+    public long FromGlCashAccountId { get; set; }
+    public string FromCashAccountCode { get; set; } = string.Empty;
+    public string FromCashAccountName { get; set; } = string.Empty;
+
+    public long ToGlBankAccountId { get; set; }
+    public string ToBankAccountCode { get; set; } = string.Empty;
+    public string ToBankAccountName { get; set; } = string.Empty;
+    public string? ToBankName { get; set; }
+    public string? ToAccountNumber { get; set; }
+
+    public string? DepositSlipNo { get; set; }
+    public string? DepositedBy { get; set; }
+    public string? Remarks { get; set; }
+
+    public BankDepositStatus Status { get; set; } = BankDepositStatus.Posted;
+
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+
+    public string? GlReversalJournalNo { get; set; }
+    public string? CancelReason { get; set; }
+    public int? CancelledBy { get; set; }
+    public DateTime? CancelledAt { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+}

Backend/ERPCore/Domain/Entities/Branch.cs

@@ -9,6 +9,18 @@ namespace ERPCore.Domain.Entities;
 /// </summary>
 public class Branch
 {
+    /// <summary>
+    /// Code of the deployment's default branch. Every branch-scoped entity has a
+    /// non-nullable <c>BranchId</c> with a Restrict FK, so this row must exist before any
+    /// of them can be written — see <c>DataSeeder.EnsureDefaultBranchAsync</c>, which
+    /// creates it at startup, and <c>BranchConfigService.ResolveDefaultBranchIdAsync</c>,
+    /// which is the lazy runtime fallback.
+    /// </summary>
+    public const string DefaultCode = "BR-000";
+
+    /// <summary>Display name paired with <see cref="DefaultCode"/>.</summary>
+    public const string DefaultName = "Main Branch";
+
     public int BranchId { get; set; }
 
     /// <summary>Server-generated on create ("BR-001", "BR-002", ...) — never accepted from the client.</summary>

Backend/ERPCore/Domain/Entities/BundleSale.cs

@@ -25,9 +25,14 @@ public class BundleSale
     public decimal DiscountTotal { get; set; }
     public decimal TaxTotal { get; set; }
     public decimal GrandTotal { get; set; }
+
+    /// <summary>How the (always fully paid) <see cref="GrandTotal"/> was tendered:
+    /// <c>CashAmount + CardAmount == GrandTotal</c>. Backfilled as all cash.</summary>
+    public decimal CashAmount { get; set; }
+    public decimal CardAmount { get; set; }
     public DateTime CreatedAt { get; set; }
     public DateTime? UpdatedAt { get; set; }
-    public int ConcurrencyStamp { get; set; }
+    public uint RowVersion { get; set; }
 
     /// <summary>Set once this bundle's business date is closed by <see cref="SalesDayEnd"/> — a
     /// closed bundle sale is frozen (no further edits). Same role as <see cref="SalesSlip.DayEndId"/>;

Backend/ERPCore/Domain/Entities/BundleSaleTemplate.cs

@@ -8,10 +8,16 @@ public class BundleSaleTemplate
     public string TemplateCode { get; set; } = string.Empty;
     public string TemplateName { get; set; } = string.Empty;
     public string? Description { get; set; }
+    /// <summary>
+    /// What the whole bundle sells for. On save it is split across the included lines' unit prices
+    /// (see BundleSaleService.AllocateBundlePrice), so selling the template still yields per-component prices.
+    /// 0 on templates created before bundle prices existed — their line prices stand as entered.
+    /// </summary>
+    public decimal BundlePrice { get; set; }
     public EntityStatus Status { get; set; } = EntityStatus.Active;
     public DateTime CreatedAt { get; set; }
     public DateTime? UpdatedAt { get; set; }
-    public int ConcurrencyStamp { get; set; }
+    public uint RowVersion { get; set; }
 
     public ICollection<BundleSaleTemplateLine> Lines { get; set; } = new List<BundleSaleTemplateLine>();
 }

Backend/ERPCore/Domain/Entities/DocumentApproval.cs

@@ -0,0 +1,53 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// One approval decision on a document (docs/DUAL_APPROVAL_PLAN.md §4.1) — a row per decision, so
+/// the full trail survives. Polymorphic like the stock ledger: <see cref="DocType"/> +
+/// <see cref="DocId"/>, no FK. Doc types: <c>ADJ</c> (stock adjustment), <c>PADJ</c> (price adjustment).
+/// </summary>
+public class DocumentApproval
+{
+    public int DocumentApprovalId { get; set; }
+    public string DocType { get; set; } = string.Empty;
+    public int DocId { get; set; }
+    /// <summary>1 or 2.</summary>
+    public int Level { get; set; }
+    public ApprovalDecision Decision { get; set; }
+    public int DecidedBy { get; set; }
+    public User? Decider { get; set; }
+    public DateTime DecidedAt { get; set; }
+    public string? Comment { get; set; }
+}
+
+/// <summary>
+/// Approval rules (docs/DUAL_APPROVAL_PLAN.md §7). Singleton row, edited under Settings → Approvals.
+/// Levels: 0 = no approval (applies on create), 1 = one approver, 2 = two different approvers.
+/// </summary>
+public class ApprovalConfig
+{
+    public const int SingletonId = 1;
+
+    public int ApprovalConfigId { get; set; }
+
+    public int StockAdjustmentLevels { get; set; } = 2;
+    /// <summary>With 2 levels: an adjustment whose stock value is below this needs only one approval. 0 = always two.</summary>
+    public decimal StockAdjustmentLevel2ThresholdValue { get; set; }
+
+    /// <summary>Approvals wastage (damage / theft / expiry write-offs) needs: 0 = none, stock reduces on save (default);
+    /// 2 = two different approvers first. Separate from <see cref="StockAdjustmentLevels"/>, which governs every other adjustment.</summary>
+    public int WastageLevels { get; set; }
+
+    public int PriceAdjustmentLevels { get; set; } = 2;
+    /// <summary>With 2 levels: a change smaller than this percent (largest across its lines) needs only one approval. 0 = always two.</summary>
+    public decimal PriceAdjustmentLevel2ThresholdPercent { get; set; }
+
+    /// <summary>Comma-separated role IDS allowed to give the second approval; empty = anyone with the Approve action.
+    /// (Ids, not codes: a role can be renamed without breaking this rule.)</summary>
+    public string? Level2RoleIds { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+    public int? UpdatedBy { get; set; }
+    public uint RowVersion { get; set; }
+}

Backend/ERPCore/Domain/Entities/Expense.cs

@@ -0,0 +1,92 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// One business expense bill (electricity, rent, …) outside procurement. Draft is editable;
+/// Post accrues it to GL (Debit the title's expense account / Credit Accrued Expenses);
+/// payments then settle the accrual in one or more installments (see
+/// ExpensePaymentService). Model: docs/EXPENSE_MODULE_PLAN.md §3.3.
+/// </summary>
+public class Expense
+{
+    public int ExpenseId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+
+    public int BranchId { get; set; }
+    public Branch? Branch { get; set; }
+
+    public DateOnly ExpenseDate { get; set; }
+    public DateOnly? DueDate { get; set; }
+
+    public int ExpenseCategoryId { get; set; }
+    public ExpenseCategory? Category { get; set; }
+
+    public int ExpenseTitleId { get; set; }
+    public ExpenseTitle? Title { get; set; }
+
+    public string? Payee { get; set; }
+    public int? VendorId { get; set; }
+    public Vendor? Vendor { get; set; }
+
+    public string? BillReference { get; set; }
+    public string? Description { get; set; }
+    /// <summary>Optional month the bill covers, as <c>yyyy-MM</c> (e.g. September's electricity).</summary>
+    public string? PeriodMonth { get; set; }
+
+    public decimal Amount { get; set; }
+    public decimal PaidAmount { get; set; }
+    public decimal BalanceAmount { get; set; }
+
+    public ExpenseStatus Status { get; set; } = ExpenseStatus.Draft;
+    public ExpensePaymentStatus PaymentStatus { get; set; } = ExpensePaymentStatus.Unpaid;
+
+    /// <summary>Snapshot of the title's GL expense account at post time.</summary>
+    public string? GlExpenseAccountCode { get; set; }
+    /// <summary>Journal number of the accrual entry posted on Post.</summary>
+    public string? GlJournalNo { get; set; }
+    public DateTime? GlPostedAt { get; set; }
+    /// <summary>Journal number of the reversing entry posted on Cancel (Posted expenses only).</summary>
+    public string? GlReversalJournalNo { get; set; }
+    public string? CancelReason { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public ICollection<ExpensePayment> Payments { get; set; } = new List<ExpensePayment>();
+}
+
+/// <summary>
+/// A payment against a Posted expense's balance (installments allowed). Every line of one
+/// payment submission shares the single GL journal entry that submission posted (Debit
+/// Accrued Expenses / Credit each selected cash-or-bank account). Mirrors
+/// <see cref="PurchaseInvoicePayment"/>.
+/// </summary>
+public class ExpensePayment
+{
+    public int ExpensePaymentId { get; set; }
+
+    public int ExpenseId { get; set; }
+    public Expense? Expense { get; set; }
+
+    public decimal Amount { get; set; }
+    public DateTime PaymentDate { get; set; }
+    public ExpensePaymentMethod PaymentMethod { get; set; }
+
+    /// <summary>GL's numeric id for the bank/cash account the payment was made from.</summary>
+    public long GlBankAccountId { get; set; }
+    /// <summary>Snapshot of the account's display name at payment time (GL account lists have no local FK).</summary>
+    public string BankAccountName { get; set; } = string.Empty;
+
+    public string? ChequeNo { get; set; }
+    public string? Reference { get; set; }
+    public string? GlJournalNo { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+}

Backend/ERPCore/Domain/Entities/ExpenseCategory.cs

@@ -0,0 +1,48 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Top-level expense grouping (Utility, Rental, Salaries, Other). The four seeded rows are
+/// <see cref="IsSystem"/> — they can be deactivated but not renamed; admins can add more.
+/// Each category owns its <see cref="ExpenseTitle"/>s. Model: docs/EXPENSE_MODULE_PLAN.md §3.1.
+/// </summary>
+public class ExpenseCategory
+{
+    public int ExpenseCategoryId { get; set; }
+    public string Code { get; set; } = string.Empty;
+    public string Name { get; set; } = string.Empty;
+    public bool IsSystem { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+    public int SortOrder { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+
+    public ICollection<ExpenseTitle> Titles { get; set; } = new List<ExpenseTitle>();
+}
+
+/// <summary>
+/// A specific expense under a category (Utility → Electricity, Water, …). Carries the GL
+/// expense account debited when an expense with this title is posted — snapshotted onto the
+/// expense at post time, so changing it later does not touch already-posted expenses.
+/// Model: docs/EXPENSE_MODULE_PLAN.md §3.2.
+/// </summary>
+public class ExpenseTitle
+{
+    public int ExpenseTitleId { get; set; }
+
+    public int ExpenseCategoryId { get; set; }
+    public ExpenseCategory? Category { get; set; }
+
+    public string Name { get; set; } = string.Empty;
+    public string GlExpenseAccountCode { get; set; } = string.Empty;
+    public bool IsSystem { get; set; }
+    public EntityStatus Status { get; set; } = EntityStatus.Active;
+    public int SortOrder { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+    public uint RowVersion { get; set; }
+}

Backend/ERPCore/Domain/Entities/GlAccountConfig.cs

@@ -0,0 +1,72 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Role → GL account code mapping — a singleton row, same shape as <see cref="GrnConfig"/>.
+/// <para>
+/// This is master data, not deployment config. It used to live in <c>appsettings.json</c> as
+/// per-module <c>Gl*Code</c> keys, which meant (a) only a redeploy could correct a mapping, and
+/// (b) nothing checked the codes existed in GL until something tried to post. Held here it is
+/// validated against GL's live chart of accounts on every save, so an unknown or non-postable
+/// account cannot be stored in the first place — see <c>GlAccountConfigService.UpdateAsync</c>.
+/// </para>
+/// <para>
+/// Codes are nullable: a fresh install has nothing mapped, and a posting flow that needs an
+/// unmapped role fails with <c>GL_ACCOUNT_NOT_CONFIGURED</c> naming that role. Width matches
+/// GL's own <c>accounts.account_code varchar(20)</c>.
+/// </para>
+/// </summary>
+public class GlAccountConfig
+{
+    /// <summary>Always 1 - the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    /// <summary>Matches GL's <c>accounts.account_code</c> column width.</summary>
+    public const int CodeMaxLength = 20;
+
+    public int ConfigId { get; set; }
+
+    /// <summary>Stock on hand (was <c>Grn|Adjustment|SalesDayEnd|Fifo:GlInventoryAccountCode</c>).</summary>
+    public string? InventoryAccountCode { get; set; }
+
+    /// <summary>Recoverable input VAT (was <c>Grn:GlVatRecoverableAccountCode</c>).</summary>
+    public string? VatRecoverableAccountCode { get; set; }
+
+    /// <summary>Trade debtors (was <c>SalesDayEnd|SalesInvoice:GlAccountsReceivableCode</c>).</summary>
+    public string? AccountsReceivableCode { get; set; }
+
+    /// <summary>Goods received not invoiced (was <c>Grn|PurchaseInvoice|Fifo:GlClearingAccountCode</c>).</summary>
+    public string? ClearingAccountCode { get; set; }
+
+    /// <summary>Output tax payable (was <c>SalesDayEnd:GlTaxPayableAccountCode</c>).</summary>
+    public string? TaxPayableAccountCode { get; set; }
+
+    /// <summary>Trade creditors (was <c>PurchaseInvoice:GlAccountsPayableCode</c>).</summary>
+    public string? AccountsPayableCode { get; set; }
+
+    /// <summary>Sales revenue (was <c>SalesDayEnd:GlSalesRevenueAccountCode</c>).</summary>
+    public string? SalesRevenueAccountCode { get; set; }
+
+    /// <summary>Sales discount given (was <c>SalesDayEnd:GlSalesDiscountAccountCode</c>).</summary>
+    public string? SalesDiscountAccountCode { get; set; }
+
+    /// <summary>Inventory gain on adjustment/count (was <c>Adjustment:GlGainAccountCode</c>).</summary>
+    public string? InventoryGainAccountCode { get; set; }
+
+    /// <summary>Cost of goods sold (was <c>SalesDayEnd:GlCogsAccountCode</c>).</summary>
+    public string? CogsAccountCode { get; set; }
+
+    /// <summary>Inventory loss on adjustment/count (was <c>Adjustment:GlLossAccountCode</c>).</summary>
+    public string? InventoryLossAccountCode { get; set; }
+
+    /// <summary>Cash takings at day-end (was <c>SalesDayEnd:GlCashAccountCode</c>).</summary>
+    public string? CashAccountCode { get; set; }
+    public string? AccruedExpensesCode { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    /// <summary>Optimistic concurrency token (ETag source); bumped by ErpDbContext.BumpRowVersions.</summary>
+    public uint RowVersion { get; set; }
+}

Backend/ERPCore/Domain/Entities/GrnLine.cs

@@ -65,4 +65,12 @@ public class GrnLine
     /// Empty for a non-warranty item.
     /// </summary>
     public ICollection<GrnLineWarrantyNumber> WarrantyNumbers { get; set; } = new List<GrnLineWarrantyNumber>();
+
+    /// <summary>
+    /// One row per received unit when <see cref="Item.TrackingMode"/> is
+    /// <see cref="TrackingMode.Serial"/> — count must equal <see cref="Qty"/>. For a serial item
+    /// under warranty the serial is the warranty identity, so it carries no
+    /// <see cref="WarrantyNumbers"/>. Empty otherwise.
+    /// </summary>
+    public ICollection<GrnLineSerial> Serials { get; set; } = new List<GrnLineSerial>();
 }

Backend/ERPCore/Domain/Entities/GrnLineSerial.cs

@@ -0,0 +1,22 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A serial number captured on a Draft GRN line for a serial-tracked item
+/// (<see cref="Item.TrackingMode"/> = <see cref="Enums.TrackingMode.Serial"/>). The line must
+/// carry exactly <see cref="GrnLine.Qty"/> of these. The draft holds the numbers only — the
+/// <see cref="Serial"/> rows (and their qty-1 FIFO layers) are created when the GRN is
+/// confirmed, so a draft that is never confirmed reserves nothing (docs/ITEM_TRACKING_PLAN.md Phase 2).
+/// </summary>
+public class GrnLineSerial
+{
+    public int GrnLineSerialId { get; set; }
+
+    public int GrnLineId { get; set; }
+    public GrnLine? GrnLine { get; set; }
+
+    public string SerialNo { get; set; } = string.Empty;
+
+    /// <summary>Set on confirm — the <see cref="Serial"/> created for this number.</summary>
+    public int? SerialId { get; set; }
+    public Serial? Serial { get; set; }
+}

Backend/ERPCore/Domain/Entities/OpeningBalanceRun.cs

@@ -0,0 +1,74 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// One posted opening balance (cash and bank, or stock) — the record that the opening entry was made, when,
+/// by whom, and which General Ledger journal carries it. The General Ledger has no "opening posted" notion, so
+/// this table is what refuses a second posting: cash/bank sets <see cref="OnceKey"/> (unique index), so it can
+/// be posted once. Stock leaves it null and can be loaded in several runs; each item in a warehouse can be
+/// opened only once (an item that already has stock movements there is refused).
+/// </summary>
+public class OpeningBalanceRun
+{
+    public int OpeningBalanceRunId { get; set; }
+
+    public OpeningBalanceKind Kind { get; set; }
+
+    /// <summary>Set (to the kind's name) only for kinds that may be posted once; a unique index on it is the
+    /// once-only guard. Null for stock, which may be loaded in batches (MySQL allows many NULLs under a unique index).</summary>
+    public string? OnceKey { get; set; }
+
+    /// <summary>The opening date — the GL journal's entry date. Reports starting after it show these amounts as opening.</summary>
+    public DateOnly CutoverDate { get; set; }
+
+    /// <summary>The GL journal number (JV-…). Null only for the instant between claiming the run and the GL
+    /// confirming the posting, inside one transaction; never null on a committed row.</summary>
+    public string? GlJournalNo { get; set; }
+
+    /// <summary>Sum of the debit amounts (what the Opening Balance Equity account is credited with).</summary>
+    public decimal TotalAmount { get; set; }
+
+    public string Currency { get; set; } = "LKR";
+
+    public int PostedBy { get; set; }
+    public DateTime PostedAt { get; set; }
+
+    public ICollection<OpeningBalanceLine> Lines { get; set; } = new List<OpeningBalanceLine>();
+    public ICollection<OpeningStockLine> StockLines { get; set; } = new List<OpeningStockLine>();
+}
+
+/// <summary>One cash or bank account's opening amount within an <see cref="OpeningBalanceRun"/>.
+/// Positive = a debit balance (money held); negative = a credit balance (an overdraft).</summary>
+public class OpeningBalanceLine
+{
+    public int OpeningBalanceLineId { get; set; }
+
+    public int OpeningBalanceRunId { get; set; }
+    public OpeningBalanceRun? Run { get; set; }
+
+    public string AccountCode { get; set; } = string.Empty;
+    public string AccountName { get; set; } = string.Empty;
+    public decimal Amount { get; set; }
+}
+
+/// <summary>One item's opening stock in one warehouse within a stock <see cref="OpeningBalanceRun"/>.</summary>
+public class OpeningStockLine
+{
+    public int OpeningStockLineId { get; set; }
+
+    public int OpeningBalanceRunId { get; set; }
+    public OpeningBalanceRun? Run { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public int WarehouseId { get; set; }
+    public Warehouse? Warehouse { get; set; }
+
+    /// <summary>Quantity in the item's base UOM.</summary>
+    public decimal Qty { get; set; }
+    public decimal UnitCost { get; set; }
+    /// <summary>Qty x UnitCost, rounded to 4 dp — what the inventory account is debited with.</summary>
+    public decimal Value { get; set; }
+}

Backend/ERPCore/Domain/Entities/OwnerReport.cs

@@ -0,0 +1,79 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Day-end owner report settings — a singleton row, same shape as <see cref="SalesConfig"/>
+/// (docs/DAY_END_OWNER_REPORT_PLAN.md §3.1). When <see cref="Enabled"/>, OwnerReportJob sends the
+/// day's figures to every active <see cref="OwnerReportRecipient"/> at <see cref="SendAtLocalTime"/>.
+/// </summary>
+public class OwnerReportConfig
+{
+    /// <summary>Always 1 - the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    public int ConfigId { get; set; }
+
+    /// <summary>Master switch — nothing is sent automatically while off ("Send test now" still works).</summary>
+    public bool Enabled { get; set; }
+
+    public bool SmsEnabled { get; set; } = true;
+    public bool EmailEnabled { get; set; } = true;
+
+    /// <summary>Local time of day (DayEndReport:TimeZone) after which the day's report goes out.</summary>
+    public TimeOnly SendAtLocalTime { get; set; } = new(21, 0);
+
+    /// <summary>Adds one summary row per active branch when branching is switched on.</summary>
+    public bool IncludeBranchBreakdown { get; set; } = true;
+
+    public DateTime? UpdatedAt { get; set; }
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    public uint RowVersion { get; set; }
+}
+
+/// <summary>Someone who receives the day-end report — by SMS, email or both.</summary>
+public class OwnerReportRecipient
+{
+    public int RecipientId { get; set; }
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Normalised to +94XXXXXXXXX (Sri Lankan rule, see PhoneRules).</summary>
+    public string? Mobile { get; set; }
+    public string? Email { get; set; }
+    public bool IsActive { get; set; } = true;
+}
+
+/// <summary>
+/// One send of one day's report on one channel to one recipient — the send log, and the guard
+/// against sending twice: (BusinessDate, Channel, RecipientId, IsTest) is unique for automatic
+/// sends, so a restart or a second server instance can't send the same day again.
+/// </summary>
+public class OwnerReportDispatch
+{
+    public long DispatchId { get; set; }
+    public DateOnly BusinessDate { get; set; }
+    public OwnerReportChannel Channel { get; set; }
+
+    public int? RecipientId { get; set; }
+    public OwnerReportRecipient? Recipient { get; set; }
+
+    /// <summary>Number / email address at send time — kept even if the recipient is edited later.</summary>
+    public string Destination { get; set; } = string.Empty;
+    public string RecipientName { get; set; } = string.Empty;
+
+    public OwnerReportDispatchStatus Status { get; set; }
+    public int Attempts { get; set; }
+    public string? Error { get; set; }
+
+    /// <summary>Test sends ("Send test now") — never block or count as the day's automatic send.</summary>
+    public bool IsTest { get; set; }
+
+    /// <summary>For tests: a unique token so repeated tests don't collide on the unique index.</summary>
+    public string DedupeKey { get; set; } = string.Empty;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? SentAt { get; set; }
+    public DateTime? NextAttemptAt { get; set; }
+}

Backend/ERPCore/Domain/Entities/PoLine.cs

@@ -21,5 +21,10 @@ public class PoLine
     public decimal Qty { get; set; }
     public decimal UnitPrice { get; set; }//
     public decimal Tax { get; set; }
+
+    /// <summary>Tax amount for this line = round(Qty x UnitPrice x <see cref="Tax"/>, 2). Stored so the
+    /// figure on the PO, its PDF and the totals never drifts from what was approved. Always 0 while
+    /// Procurement configuration's PO tax switch is off.</summary>
+    public decimal TaxAmount { get; set; }
     public decimal QtyReceived { get; set; }
 }

Backend/ERPCore/Domain/Entities/PriceAdjustment.cs

@@ -0,0 +1,78 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A request to change items' selling prices (docs/DUAL_APPROVAL_PLAN.md §6). Nothing changes on the
+/// items until it is fully approved; then each line's new prices are written to its item and an
+/// <see cref="ItemPriceHistory"/> row is kept. <see cref="CreatedBy"/> is the requester.
+/// </summary>
+public class PriceAdjustment
+{
+    public int PriceAdjustmentId { get; set; }
+    public string DocNo { get; set; } = string.Empty;
+    public string Reason { get; set; } = string.Empty;
+
+    public PriceAdjustmentStatus Status { get; set; } = PriceAdjustmentStatus.PendingApproval;
+    public int RequiredApprovals { get; set; }
+
+    public int CreatedBy { get; set; }
+    public User? Creator { get; set; }
+    public DateTime CreatedAt { get; set; }
+
+    public int? ApprovedLevel1By { get; set; }
+    public DateTime? ApprovedLevel1At { get; set; }
+    public int? ApprovedLevel2By { get; set; }
+    public DateTime? ApprovedLevel2At { get; set; }
+    public int? RejectedBy { get; set; }
+    public DateTime? RejectedAt { get; set; }
+    public string? RejectReason { get; set; }
+    public DateTime? CancelledAt { get; set; }
+    /// <summary>When the new prices were written to the items.</summary>
+    public DateTime? AppliedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+
+    public ICollection<PriceAdjustmentLine> Lines { get; set; } = new List<PriceAdjustmentLine>();
+}
+
+/// <summary>One item's change. The Old* values are the item's prices when the request was made —
+/// approval fails if the item has been repriced since (stale request).</summary>
+public class PriceAdjustmentLine
+{
+    public int PriceAdjustmentLineId { get; set; }
+    public int PriceAdjustmentId { get; set; }
+    public PriceAdjustment? PriceAdjustment { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public decimal? OldMinPrice { get; set; }
+    public decimal? OldMaxPrice { get; set; }
+    public decimal? OldFlatPrice { get; set; }
+    public decimal? NewMinPrice { get; set; }
+    public decimal? NewMaxPrice { get; set; }
+    public decimal? NewFlatPrice { get; set; }
+}
+
+/// <summary>An applied selling-price change: what it was, what it became, and who approved it.</summary>
+public class ItemPriceHistory
+{
+    public int ItemPriceHistoryId { get; set; }
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+    public int? PriceAdjustmentId { get; set; }
+    public PriceAdjustment? PriceAdjustment { get; set; }
+
+    public decimal? OldMinPrice { get; set; }
+    public decimal? OldMaxPrice { get; set; }
+    public decimal? OldFlatPrice { get; set; }
+    public decimal? NewMinPrice { get; set; }
+    public decimal? NewMaxPrice { get; set; }
+    public decimal? NewFlatPrice { get; set; }
+
+    public int RequestedBy { get; set; }
+    public int? ApprovedLevel1By { get; set; }
+    public int? ApprovedLevel2By { get; set; }
+    public DateTime AppliedAt { get; set; }
+}

Backend/ERPCore/Domain/Entities/ProcurementConfig.cs

@@ -0,0 +1,42 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Procurement configuration — a singleton row, same shape as <see cref="GrnConfig"/>.
+/// Controls the optional vendor fields and whether purchase orders carry tax.
+/// </summary>
+public class ProcurementConfig
+{
+    /// <summary>Always 1 - the singleton row's id.</summary>
+    public const int SingletonId = 1;
+
+    public int ConfigId { get; set; }
+
+    /// <summary>Which contact detail vendors carry: none (default), a mobile number or an email.
+    /// A value sent for a field that is not selected is rejected server-side (CONFIG_DISABLED).</summary>
+    public VendorContactMode VendorContactMode { get; set; } = VendorContactMode.None;
+
+    /// <summary>When on, vendors carry an optional company address.</summary>
+    public bool VendorAddressEnabled { get; set; }
+
+    /// <summary>When on (default — the field existed before it became optional), vendors carry optional payment terms.
+    /// When off the field is hidden and a value for it is rejected (CONFIG_DISABLED); stored values are kept.</summary>
+    public bool VendorPaymentTermsEnabled { get; set; } = true;
+
+    /// <summary>When on (default), vendors carry an optional tax registration number. Same rules as payment terms.
+    /// Purchase invoices still snapshot a vendor's stored number either way.</summary>
+    public bool VendorTaxRegEnabled { get; set; } = true;
+
+    /// <summary>When on, purchase-order lines carry a tax rate (prefilled from the item) and tax amount;
+    /// when off, tax is hidden everywhere on POs and a non-zero tax is rejected server-side.</summary>
+    public bool PoTaxEnabled { get; set; }
+
+    public DateTime? UpdatedAt { get; set; }
+
+    public int? UpdatedBy { get; set; }
+    public User? UpdatedByUser { get; set; }
+
+    /// <summary>Optimistic concurrency token (ETag source).</summary>
+    public uint RowVersion { get; set; }
+}

Backend/ERPCore/Domain/Entities/ProductConfig.cs

@@ -51,6 +51,31 @@ public class ProductConfig
     /// </summary>
     public bool CustomWarrantyPeriodsEnabled { get; set; }
 
+    /// <summary>
+    /// Shows the stock-nature choice (Stocked / Non-stocked / Service) on item screens. Off:
+    /// new items are Stocked. Enforced on item writes - an item keeps the nature it already
+    /// has, only a change <em>to</em> a non-Stocked nature is refused.
+    /// </summary>
+    public bool StockNatureEnabled { get; set; } = true;
+
+    /// <summary>
+    /// Shows the tracking-mode choice on item screens. Off: new items are untracked (None).
+    /// Enforced on item writes like <see cref="StockNatureEnabled"/> - existing modes are kept.
+    /// </summary>
+    public bool TrackingModeEnabled { get; set; } = true;
+
+    /// <summary>
+    /// Shows the low-stock alert (reorder point / qty) section on item create and the item page.
+    /// Advisory: it gates the item screens; reorder rules already saved keep working.
+    /// </summary>
+    public bool LowStockAlertsEnabled { get; set; } = true;
+
+    /// <summary>
+    /// Lets the low-stock alert be pinned to one warehouse. Off: the alert watches every
+    /// warehouse. Depends on <see cref="LowStockAlertsEnabled"/>; advisory like it.
+    /// </summary>
+    public bool AlertWarehouseEnabled { get; set; } = true;
+
     public DateTime? UpdatedAt { get; set; }
 
     public int? UpdatedBy { get; set; }

Backend/ERPCore/Domain/Entities/Role.cs

@@ -3,25 +3,30 @@ using ERPCore.Domain.Enums;
 namespace ERPCore.Domain.Entities;
 
 /// <summary>
-/// Local shadow/projection of an AuthHex <c>Role</c> row, mirroring the same
-/// pattern <see cref="User"/> uses for AuthHex identities: <see cref="AuthRoleId"/>
-/// maps to AuthHex's Guid <c>RoleId</c>, while the local <see cref="RoleId"/> (int)
-/// is what <see cref="Permission"/>/<see cref="RolePermission"/>/<see cref="User.RoleId"/>
-/// FKs reference. AuthHex remains the source of truth; writes are forwarded there
-/// first (<c>IAuthHexClient</c>) and mirrored here on success.
+/// An ERP role. The ERP owns roles and what they may do: <see cref="User.RoleId"/> points here and
+/// <see cref="RolePermission"/> holds the permissions. AuthHex only authenticates people and knows nothing about roles.
 /// </summary>
 public class Role
 {
     public int RoleId { get; set; }
-    public Guid AuthRoleId { get; set; }
+
+    /// <summary>Legacy link to the AuthHex role this one used to mirror. Unused now; kept (nullable) until the AuthHex
+    /// role table is retired, then dropped.</summary>
+    public Guid? AuthRoleId { get; set; }
+
     public string Code { get; set; } = string.Empty;
     public string Name { get; set; } = string.Empty;
     public bool IsSystemRole { get; set; }
+
+    /// <summary>True for the administrator role: its holders pass every permission check, bypass branch scoping and can
+    /// manage users and roles. This flag — never the role's code or name — is what "admin" means, so the role can be
+    /// renamed freely. Not settable through the API; only the seeded Admin role carries it.</summary>
+    public bool IsAdmin { get; set; }
+
     public EntityStatus Status { get; set; } = EntityStatus.Active;
 
     public DateTime CreatedAt { get; set; }
     public DateTime? UpdatedAt { get; set; }
 
-    /// <summary>PostgreSQL xmin-backed optimistic concurrency token (ETag source).</summary>
     public uint RowVersion { get; set; }
 }

Backend/ERPCore/Domain/Entities/SalesConfig.cs

@@ -51,6 +51,31 @@ public class SalesConfig
     public int? DefaultWarehouseId { get; set; }
     public Warehouse? DefaultWarehouse { get; set; }
 
+// ---- Optional customer fields. Each is on by default (the field existed before it became optional). When off the
+    // field is hidden on the customer forms and a new value for it is rejected server-side (CONFIG_DISABLED); values
+    // already stored are kept.
+
+    /// <summary>Customers carry an optional phone number.</summary>
+    public bool CustomerPhoneEnabled { get; set; } = true;
+
+    /// <summary>Customers carry an optional email address.</summary>
+    public bool CustomerEmailEnabled { get; set; } = true;
+
+    /// <summary>Customers carry an optional address (lines 1 and 2).</summary>
+    public bool CustomerAddressEnabled { get; set; } = true;
+
+    /// <summary>Customers carry an optional city.</summary>
+    public bool CustomerCityEnabled { get; set; } = true;
+
+    /// <summary>Customers carry an optional country.</summary>
+    public bool CustomerCountryEnabled { get; set; } = true;
+
+    /// <summary>Customers have a credit limit.</summary>
+    public bool CustomerCreditLimitEnabled { get; set; } = true;
+
+    /// <summary>Customers have credit days (how long an invoice may stay unpaid — the customer's "age").</summary>
+    public bool CustomerCreditDaysEnabled { get; set; } = true;
+
     public DateTime? UpdatedAt { get; set; }
 
     public int? UpdatedBy { get; set; }

Backend/ERPCore/Domain/Entities/SalesInvoiceLine.cs

@@ -19,6 +19,13 @@ public class SalesInvoiceLine
     public int WarehouseId { get; set; }
     public Warehouse? Warehouse { get; set; }
 
+    /// <summary>Pins the line to one batch; null lets posting pick batches FEFO.</summary>
+    public int? BatchId { get; set; }
+    public Batch? Batch { get; set; }
+
+    /// <summary>Chosen serials for a serial-tracked item (one per unit of Qty + FreeQty).</summary>
+    public ICollection<SalesInvoiceLineSerial> Serials { get; set; } = new List<SalesInvoiceLineSerial>();
+
     public decimal UnitPrice { get; set; }
     public decimal BaseCost { get; set; }
     public string PriceSource { get; set; } = string.Empty;

Backend/ERPCore/Domain/Entities/SalesInvoicePayment.cs

@@ -1,3 +1,5 @@
+using ERPCore.Domain.Enums;
+
 namespace ERPCore.Domain.Entities;
 
 /// <summary>
@@ -21,6 +23,9 @@ public class SalesInvoicePayment
     /// <summary>Snapshot of the account's display name at payment time (GL account lists have no local FK).</summary>
     public string BankAccountName { get; set; } = string.Empty;
 
+    /// <summary>How the customer paid. Payments recorded before this existed were backfilled as Cash.</summary>
+    public SalesPaymentMethod PaymentMethod { get; set; } = SalesPaymentMethod.Cash;
+
     public string? Reference { get; set; }
 
     /// <summary>Journal number of the real GL journal entry this payment posted.</summary>

Backend/ERPCore/Domain/Entities/SalesLineAllocation.cs

@@ -0,0 +1,35 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// What a posted sales line actually issued: one row per consumed FIFO segment, carrying the
+/// batch (FEFO-picked when the line named none) and, for serial items, the serial. The source
+/// line is referenced polymorphically (<see cref="SourceDocType"/> is a
+/// <see cref="Domain.DocumentTypes"/> value) — same convention as <see cref="StockLedger"/> —
+/// so invoices, slips and bundles share one table. Returns read it to restock into the same
+/// batch/serial (docs/ITEM_TRACKING_PLAN.md Phases 4 and 6).
+/// </summary>
+public class SalesLineAllocation
+{
+    public int SalesLineAllocationId { get; set; }
+
+    public string SourceDocType { get; set; } = string.Empty;
+    public int SourceDocId { get; set; }
+    public int SourceLineId { get; set; }
+
+    public int ItemId { get; set; }
+    public int WarehouseId { get; set; }
+
+    public int? BatchId { get; set; }
+    public Batch? Batch { get; set; }
+
+    public int? SerialId { get; set; }
+    public Serial? Serial { get; set; }
+
+    public decimal Qty { get; set; }
+    public decimal UnitCost { get; set; }
+
+    /// <summary>Quantity of this allocation already taken back by sales returns.</summary>
+    public decimal QtyReturned { get; set; }
+
+    public DateTime CreatedAt { get; set; }
+}

Backend/ERPCore/Domain/Entities/SalesLineSerial.cs

@@ -0,0 +1,29 @@
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A serial chosen on a Draft sales-invoice line for a serial-tracked item — one row per unit
+/// (count = Qty + FreeQty). Choosing does not reserve: posting re-checks each serial is still
+/// in stock and consumes exactly its layer (docs/ITEM_TRACKING_PLAN.md Phase 4, D4).
+/// </summary>
+public class SalesInvoiceLineSerial
+{
+    public int SalesInvoiceLineSerialId { get; set; }
+
+    public int SalesInvoiceLineId { get; set; }
+    public SalesInvoiceLine? SalesInvoiceLine { get; set; }
+
+    public int SerialId { get; set; }
+    public Serial? Serial { get; set; }
+}
+
+/// <summary>Sales-slip counterpart of <see cref="SalesInvoiceLineSerial"/>.</summary>
+public class SalesSlipLineSerial
+{
+    public int SalesSlipLineSerialId { get; set; }
+
+    public int SalesSlipLineId { get; set; }
+    public SalesSlipLine? SalesSlipLine { get; set; }
+
+    public int SerialId { get; set; }
+    public Serial? Serial { get; set; }
+}

Backend/ERPCore/Domain/Entities/SalesReturnLine.cs

@@ -2,7 +2,9 @@ namespace ERPCore.Domain.Entities;
 
 /// <summary>
 /// Sales-return line referencing the original sales invoice line for traceability.
-/// <see cref="Qty"/> is in base UOM.
+/// <see cref="Qty"/> is in base UOM. <see cref="BatchId"/> is the batch the goods are restocked
+/// into — the batch they were sold from (docs/ITEM_TRACKING_PLAN.md Phase 6); <see cref="Serials"/>
+/// lists the returned units of a serial-tracked item.
 /// </summary>
 public class SalesReturnLine
 {
@@ -18,4 +20,21 @@ public class SalesReturnLine
     public Item? Item { get; set; }
 
     public decimal Qty { get; set; }
+
+    public int? BatchId { get; set; }
+    public Batch? Batch { get; set; }
+
+    public ICollection<SalesReturnLineSerial> Serials { get; set; } = new List<SalesReturnLineSerial>();
+}
+
+/// <summary>One serial taken back on a <see cref="SalesReturnLine"/>.</summary>
+public class SalesReturnLineSerial
+{
+    public int SalesReturnLineSerialId { get; set; }
+
+    public int ReturnLineId { get; set; }
+    public SalesReturnLine? ReturnLine { get; set; }
+
+    public int SerialId { get; set; }
+    public Serial? Serial { get; set; }
 }

Backend/ERPCore/Domain/Entities/SalesSlip.cs

@@ -27,6 +27,11 @@ public class SalesSlip
     public decimal PaidAmount { get; set; }
     public decimal BalanceAmount { get; set; }
 
+    /// <summary>How <see cref="PaidAmount"/> was tendered: <c>CashAmount + CardAmount == PaidAmount</c>.
+    /// Slips from before the split existed were backfilled as all cash.</summary>
+    public decimal CashAmount { get; set; }
+    public decimal CardAmount { get; set; }
+
     /// <summary>Set once this slip's business date is closed by <see cref="SalesDayEnd"/> — a closed slip is frozen (no further edits).</summary>
     public int? DayEndId { get; set; }
     public SalesDayEnd? DayEnd { get; set; }

Backend/ERPCore/Domain/Entities/SalesSlipLine.cs

@@ -22,9 +22,16 @@ public class SalesSlipLine
     public int? BatchId { get; set; }
     public Batch? Batch { get; set; }
 
+    /// <summary>
+    /// Legacy single-serial pin, from before a line could carry several. Kept for old drafts and
+    /// still set when exactly one serial is chosen; <see cref="Serials"/> is authoritative.
+    /// </summary>
     public int? SerialId { get; set; }
     public Serial? Serial { get; set; }
 
+    /// <summary>Chosen serials for a serial-tracked item (one per unit of Qty + FreeQty).</summary>
+    public ICollection<SalesSlipLineSerial> Serials { get; set; } = new List<SalesSlipLineSerial>();
+
     public decimal UnitPrice { get; set; }
     public decimal BaseCost { get; set; }
     public string PriceSource { get; set; } = string.Empty;

Backend/ERPCore/Domain/Entities/Serial.cs

@@ -1,8 +1,13 @@
+using ERPCore.Domain.Enums;
+
 namespace ERPCore.Domain.Entities;
 
 /// <summary>
 /// Serial number for a serial-tracked item across its lifecycle (FR-WH-04).
-/// Model: docs/10 Part C.4.
+/// Created when the GRN that received it is confirmed; each in-stock serial owns exactly one
+/// FIFO layer of qty 1 (<see cref="StockLayer.SerialId"/>), so issuing a serial consumes that
+/// layer. <see cref="WarehouseId"/>/<see cref="BinId"/> are its current location and are
+/// cleared once it leaves stock. Model: docs/10 Part C.4, docs/ITEM_TRACKING_PLAN.md Phase 1.
 /// </summary>
 public class Serial
 {
@@ -12,8 +17,33 @@ public class Serial
     public Item? Item { get; set; }
 
     public string SerialNo { get; set; } = string.Empty;
-    public string Status { get; set; } = "InStock";
+    public SerialStatus Status { get; set; } = SerialStatus.InStock;
 
     /// <summary>Optional scan code for barcode/RFID lookup (unique when set).</summary>
     public string? Barcode { get; set; }
+
+    /// <summary>Current warehouse while in stock; null once sold/returned to vendor/scrapped.</summary>
+    public int? WarehouseId { get; set; }
+    public Warehouse? Warehouse { get; set; }
+
+    public int? BinId { get; set; }
+    public Bin? Bin { get; set; }
+
+    /// <summary>The GRN line that received this unit (provenance); null for count/adjustment finds.</summary>
+    public int? GrnLineId { get; set; }
+    public GrnLine? GrnLine { get; set; }
+
+    public DateTime? ReceivedAt { get; set; }
+
+    /// <summary>
+    /// Warranty coverage snapshotted from <see cref="Item.WarrantyPeriodMonths"/> at receipt
+    /// (same rule as <see cref="GrnLineWarrantyNumber.WarrantyPeriodMonths"/>); null for a
+    /// non-warranty item. The clock does not start here — it starts at sale
+    /// (<see cref="WarrantyRegistration"/>).
+    /// </summary>
+    public int? WarrantyPeriodMonths { get; set; }
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    public uint RowVersion { get; set; }
 }

Backend/ERPCore/Domain/Entities/SerialMovement.cs

@@ -0,0 +1,46 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// Append-only history of one serial: a row each time a document changes its status or
+/// location (receipt, sale, return, transfer, adjustment, count). <see cref="Status"/> and
+/// <see cref="WarehouseId"/> are the serial's state <em>after</em> the movement. The source
+/// document is referenced polymorphically, as on <see cref="StockLedger"/>. This is where serial
+/// history is read from — the stock ledger keeps one row per document line, not per unit
+/// (docs/ITEM_TRACKING_PLAN.md Phases 2 and 9).
+/// </summary>
+public class SerialMovement
+{
+    public int SerialMovementId { get; set; }
+
+    public int SerialId { get; set; }
+    public Serial? Serial { get; set; }
+
+    public string SourceDocType { get; set; } = string.Empty;
+    public int SourceDocId { get; set; }
+
+    public SerialStatus Status { get; set; }
+    public int? FromWarehouseId { get; set; }
+    public int? WarehouseId { get; set; }
+
+    public int UserId { get; set; }
+    public DateTime CreatedAt { get; set; }
+
+    /// <summary>
+    /// Records <paramref name="serial"/>'s current state — call after updating it. Linked by
+    /// navigation, so it works for a serial inserted in the same save.
+    /// </summary>
+    public static SerialMovement Of(Serial serial, int? fromWarehouseId, string sourceDocType, int sourceDocId, int userId, DateTime at) => new()
+    {
+        Serial = serial,
+        SerialId = serial.SerialId,
+        SourceDocType = sourceDocType,
+        SourceDocId = sourceDocId,
+        Status = serial.Status,
+        FromWarehouseId = fromWarehouseId,
+        WarehouseId = serial.WarehouseId,
+        UserId = userId,
+        CreatedAt = at
+    };
+}

Backend/ERPCore/Domain/Entities/StockAdjustment.cs

@@ -37,5 +37,20 @@ public class StockAdjustment
     public string? GlJournalNo { get; set; }
     public DateTime? GlPostedAt { get; set; }
 
+    // --- Approval (docs/DUAL_APPROVAL_PLAN.md §5). CreatedBy is the requester. ---
+
+    /// <summary>Approvals this request needs (0 = posted on create, 1 or 2), fixed when it is made.</summary>
+    public int RequiredApprovals { get; set; }
+    public int? ApprovedLevel1By { get; set; }
+    public DateTime? ApprovedLevel1At { get; set; }
+    public int? ApprovedLevel2By { get; set; }
+    public DateTime? ApprovedLevel2At { get; set; }
+    public int? RejectedBy { get; set; }
+    public DateTime? RejectedAt { get; set; }
+    public string? RejectReason { get; set; }
+    public DateTime? CancelledAt { get; set; }
+    /// <summary>When stock actually moved — the ledger and GL use this, not <see cref="CreatedAt"/>.</summary>
+    public DateTime? PostedAt { get; set; }
+
     public ICollection<StockAdjustmentLine> Lines { get; set; } = new List<StockAdjustmentLine>();
 }

Backend/ERPCore/Domain/Entities/StockAdjustmentLine.cs

@@ -18,6 +18,15 @@ public class StockAdjustmentLine
     public int? BinId { get; set; }
     public int? BatchId { get; set; }
     public int? SerialId { get; set; }
+    public Serial? Serial { get; set; }
 
     public decimal QtyDelta { get; set; }
+
+    /// <summary>
+    /// The serials named on the request, kept until it posts (JSON arrays): outbound serial ids
+    /// to write off, inbound serial numbers found. Re-validated at posting, because a pending
+    /// request moves nothing and the serials may have moved in the meantime.
+    /// </summary>
+    public string? RequestedSerialIds { get; set; }
+    public string? RequestedSerialNos { get; set; }
 }

Backend/ERPCore/Domain/Entities/StockTransferLine.cs

@@ -32,4 +32,27 @@ public class StockTransferLine
 
     /// <summary>Quantity already received at the destination (partial-receive support).</summary>
     public decimal QtyReceived { get; set; }
+
+    /// <summary>The units moved, for a serial-tracked item (one per unit of <see cref="Qty"/>).</summary>
+    public ICollection<StockTransferLineSerial> Serials { get; set; } = new List<StockTransferLineSerial>();
+}
+
+/// <summary>
+/// One serial on a transfer line. <see cref="UnitCost"/>/<see cref="BatchId"/> are captured from
+/// its own source layer at dispatch, so the destination layer is recreated exactly;
+/// <see cref="ReceivedAt"/> is set when it arrives (partial receive names which serials).
+/// </summary>
+public class StockTransferLineSerial
+{
+    public int StockTransferLineSerialId { get; set; }
+
+    public int TransferLineId { get; set; }
+    public StockTransferLine? TransferLine { get; set; }
+
+    public int SerialId { get; set; }
+    public Serial? Serial { get; set; }
+
+    public int? BatchId { get; set; }
+    public decimal? UnitCost { get; set; }
+    public DateTime? ReceivedAt { get; set; }
 }

Backend/ERPCore/Domain/Entities/Vendor.cs

@@ -15,6 +15,13 @@ public class Vendor
     public string? Terms { get; set; }
     public string? TaxReg { get; set; }
     public string Currency { get; set; } = "LKR";
+
+    /// <summary>Mobile number — only recorded while Procurement configuration's vendor contact mode is Mobile.</summary>
+    public string? Mobile { get; set; }
+    /// <summary>Email — only recorded while the vendor contact mode is Email.</summary>
+    public string? Email { get; set; }
+    /// <summary>Company address — only recorded while vendor address is enabled.</summary>
+    public string? Address { get; set; }
     public EntityStatus Status { get; set; } = EntityStatus.Active;
 
     public int BranchId { get; set; }

Backend/ERPCore/Domain/Entities/WarrantyRegistration.cs

@@ -0,0 +1,42 @@
+using ERPCore.Domain.Enums;
+
+namespace ERPCore.Domain.Entities;
+
+/// <summary>
+/// A customer's warranty, started when the sale that issued the goods is posted
+/// (docs/ITEM_TRACKING_PLAN.md Phase 5, D3/D7) — stock waiting in a warehouse never consumes
+/// warranty. For a serial item there is one row per serial (<see cref="SerialId"/> set,
+/// <see cref="Qty"/> = 1); for a warranty item that is not serial-tracked there is one row per
+/// sales line covering its <see cref="Qty"/>. <see cref="PeriodMonths"/> is the coverage
+/// snapshotted at receipt (<see cref="Serial.WarrantyPeriodMonths"/>), else the item's period.
+/// </summary>
+public class WarrantyRegistration
+{
+    public int WarrantyRegistrationId { get; set; }
+
+    public int ItemId { get; set; }
+    public Item? Item { get; set; }
+
+    public int? SerialId { get; set; }
+    public Serial? Serial { get; set; }
+
+    public int CustomerId { get; set; }
+    public Customer? Customer { get; set; }
+
+    public string SourceDocType { get; set; } = string.Empty;
+    public int SourceDocId { get; set; }
+    public int SourceLineId { get; set; }
+
+    public decimal Qty { get; set; }
+
+    public DateOnly StartDate { get; set; }
+    public int PeriodMonths { get; set; }
+    public DateOnly EndDate { get; set; }
+
+    public WarrantyStatus Status { get; set; } = WarrantyStatus.Active;
+
+    public DateTime CreatedAt { get; set; }
+    public DateTime? UpdatedAt { get; set; }
+
+    public uint RowVersion { get; set; }
+}