Add testbug.md

.claude/settings.local.json

@@ -1,9 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(dotnet build *)",
-      "PowerShell(Get-Command mysql -ErrorAction SilentlyContinue)",
-      "PowerShell(Get-Command mysql.exe -ErrorAction SilentlyContinue)"
-    ]
-  }
-}

Distribution.Tests/obj/Debug/net9.0/Distribution.Tests.AssemblyInfo.cs

@@ -13,7 +13,7 @@ using System.Reflection;
 [assembly: System.Reflection.AssemblyCompanyAttribute("Distribution.Tests")]
 [assembly: System.Reflection.AssemblyConfigurationAttribute("Debug")]
 [assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.0.0")]
-[assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.0+6c40421b2d23630d4249841425ec7906d93d5985")]
+[assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0.0+aa7ea37ab61a149a38d83283c5dabd76bf5a39b3")]
 [assembly: System.Reflection.AssemblyProductAttribute("Distribution.Tests")]
 [assembly: System.Reflection.AssemblyTitleAttribute("Distribution.Tests")]
 [assembly: System.Reflection.AssemblyVersionAttribute("1.0.0.0")]

Distribution.Tests/obj/Debug/net9.0/Distribution.Tests.AssemblyInfoInputs.cache

@@ -1 +1 @@
-00c7acd66c7d7d5bdbb8d4468924c7202fbdc15259175676556b482252622db8
+5c052f1f25bc37b6a51a3abe0e2b79d99d21422d5ab89151faea450c0ddb9cc0

Distribution.Tests/obj/Debug/net9.0/Distribution.Tests.GeneratedMSBuildEditorConfig.editorconfig

@@ -11,7 +11,7 @@ build_property.EnforceExtendedAnalyzerRules =
 build_property.EntryPointFilePath = 
 build_property._SupportedPlatformList = Linux,macOS,Windows
 build_property.RootNamespace = Distribution.Tests
-build_property.ProjectDir = D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\
+build_property.ProjectDir = C:\Users\lenovo\Desktop\NEWGITEA\ERP_Distribution\Distribution.Tests\
 build_property.EnableComHosting = 
 build_property.EnableGeneratedComInterfaceComImportInterop = 
 build_property.EffectiveAnalysisLevelStyle = 9.0

Distribution.Tests/obj/Debug/net9.0/Distribution.Tests.csproj.CoreCompileInputs.cache

@@ -1 +1 @@
-b5689108dc90f1afbeded25902110c1295d20ccadf0aaae3dfd42fcd421eba23
+ce3b0b0b2776e1f5cfcf61d517b9f6ce1c89ed303e7e35ab0b7261f5686d0ddb

Distribution.Tests/obj/Debug/net9.0/Distribution.Tests.csproj.FileListAbsolute.txt

@@ -125,13 +125,3 @@ C:\Users\lenovo\Desktop\NEWGITEA\ERP_Distribution\Distribution.Tests\obj\Debug\n
 C:\Users\lenovo\Desktop\NEWGITEA\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\Distribution.Tests.pdb
 C:\Users\lenovo\Desktop\NEWGITEA\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\Distribution.Tests.genruntimeconfig.cache
 C:\Users\lenovo\Desktop\NEWGITEA\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\ref\Distribution.Tests.dll
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\bin\Debug\net9.0\.msCoverageSourceRootsMapping_Distribution.Tests
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\bin\Debug\net9.0\CoverletSourceRootsMapping_Distribution.Tests
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\Distribution.Tests.csproj.AssemblyReference.cache
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\Distribution.Tests.GeneratedMSBuildEditorConfig.editorconfig
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\Distribution.Tests.AssemblyInfoInputs.cache
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\Distribution.Tests.AssemblyInfo.cs
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\Distribution.Tests.csproj.CoreCompileInputs.cache
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\Distribution.Tests.dll
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\refint\Distribution.Tests.dll
-D:\HexDrive Projects\Distribution\ERP_Distribution\Distribution.Tests\obj\Debug\net9.0\Distribution.Tests.pdb

Distribution.Tests/obj/Distribution.Tests.csproj.nuget.dgspec.json

@@ -1,23 +1,23 @@
 {
   "format": 1,
   "restore": {
-    "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj": {}
+    "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj": {}
   },
   "projects": {
-    "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj": {
+    "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj": {
       "version": "1.0.0",
       "restore": {
-        "projectUniqueName": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
+        "projectUniqueName": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
         "projectName": "Distribution.Tests",
-        "projectPath": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
-        "packagesPath": "C:\\Users\\dell\\.nuget\\packages\\",
-        "outputPath": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution.Tests\\obj\\",
+        "projectPath": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
+        "packagesPath": "C:\\Users\\lenovo\\.nuget\\packages\\",
+        "outputPath": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution.Tests\\obj\\",
         "projectStyle": "PackageReference",
         "fallbackFolders": [
           "C:\\Program Files (x86)\\Microsoft Visual Studio\\Shared\\NuGetPackages"
         ],
         "configFilePaths": [
-          "C:\\Users\\dell\\AppData\\Roaming\\NuGet\\NuGet.Config",
+          "C:\\Users\\lenovo\\AppData\\Roaming\\NuGet\\NuGet.Config",
           "C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.FallbackLocation.config",
           "C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.Offline.config"
         ],
@@ -26,7 +26,6 @@
         ],
         "sources": {
           "C:\\Program Files (x86)\\Microsoft SDKs\\NuGetPackages\\": {},
-          "C:\\Program Files\\dotnet\\library-packs": {},
           "https://api.nuget.org/v3/index.json": {}
         },
         "frameworks": {
@@ -34,8 +33,8 @@
             "framework": "net9.0",
             "targetAlias": "net9.0",
             "projectReferences": {
-              "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution\\Distribution.csproj": {
-                "projectPath": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution\\Distribution.csproj"
+              "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution\\Distribution.csproj": {
+                "projectPath": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution\\Distribution.csproj"
               }
             }
           }
@@ -50,7 +49,7 @@
           "auditLevel": "low",
           "auditMode": "direct"
         },
-        "SdkAnalysisLevel": "10.0.400"
+        "SdkAnalysisLevel": "10.0.300"
       },
       "frameworks": {
         "net9.0": {
@@ -98,24 +97,24 @@
               "privateAssets": "all"
             }
           },
-          "runtimeIdentifierGraphPath": "C:\\Program Files\\dotnet\\sdk\\10.0.400/PortableRuntimeIdentifierGraph.json"
+          "runtimeIdentifierGraphPath": "C:\\Program Files\\dotnet\\sdk\\10.0.302/PortableRuntimeIdentifierGraph.json"
         }
       }
     },
-    "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution\\Distribution.csproj": {
+    "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution\\Distribution.csproj": {
       "version": "1.0.0",
       "restore": {
-        "projectUniqueName": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution\\Distribution.csproj",
+        "projectUniqueName": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution\\Distribution.csproj",
         "projectName": "Distribution",
-        "projectPath": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution\\Distribution.csproj",
-        "packagesPath": "C:\\Users\\dell\\.nuget\\packages\\",
-        "outputPath": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution\\obj\\",
+        "projectPath": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution\\Distribution.csproj",
+        "packagesPath": "C:\\Users\\lenovo\\.nuget\\packages\\",
+        "outputPath": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution\\obj\\",
         "projectStyle": "PackageReference",
         "fallbackFolders": [
           "C:\\Program Files (x86)\\Microsoft Visual Studio\\Shared\\NuGetPackages"
         ],
         "configFilePaths": [
-          "C:\\Users\\dell\\AppData\\Roaming\\NuGet\\NuGet.Config",
+          "C:\\Users\\lenovo\\AppData\\Roaming\\NuGet\\NuGet.Config",
           "C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.FallbackLocation.config",
           "C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.Offline.config"
         ],
@@ -124,7 +123,6 @@
         ],
         "sources": {
           "C:\\Program Files (x86)\\Microsoft SDKs\\NuGetPackages\\": {},
-          "C:\\Program Files\\dotnet\\library-packs": {},
           "https://api.nuget.org/v3/index.json": {}
         },
         "frameworks": {
@@ -144,7 +142,7 @@
           "auditLevel": "low",
           "auditMode": "direct"
         },
-        "SdkAnalysisLevel": "10.0.400"
+        "SdkAnalysisLevel": "10.0.300"
       },
       "frameworks": {
         "net9.0": {
@@ -193,7 +191,7 @@
               "privateAssets": "all"
             }
           },
-          "runtimeIdentifierGraphPath": "C:\\Program Files\\dotnet\\sdk\\10.0.400/PortableRuntimeIdentifierGraph.json"
+          "runtimeIdentifierGraphPath": "C:\\Program Files\\dotnet\\sdk\\10.0.302/PortableRuntimeIdentifierGraph.json"
         }
       }
     }

Distribution.Tests/obj/Distribution.Tests.csproj.nuget.g.props

@@ -5,12 +5,12 @@
     <RestoreTool Condition=" '$(RestoreTool)' == '' ">NuGet</RestoreTool>
     <ProjectAssetsFile Condition=" '$(ProjectAssetsFile)' == '' ">$(MSBuildThisFileDirectory)project.assets.json</ProjectAssetsFile>
     <NuGetPackageRoot Condition=" '$(NuGetPackageRoot)' == '' ">$(UserProfile)\.nuget\packages\</NuGetPackageRoot>
-    <NuGetPackageFolders Condition=" '$(NuGetPackageFolders)' == '' ">C:\Users\dell\.nuget\packages\;C:\Program Files (x86)\Microsoft Visual Studio\Shared\NuGetPackages</NuGetPackageFolders>
+    <NuGetPackageFolders Condition=" '$(NuGetPackageFolders)' == '' ">C:\Users\lenovo\.nuget\packages\;C:\Program Files (x86)\Microsoft Visual Studio\Shared\NuGetPackages</NuGetPackageFolders>
     <NuGetProjectStyle Condition=" '$(NuGetProjectStyle)' == '' ">PackageReference</NuGetProjectStyle>
     <NuGetToolVersion Condition=" '$(NuGetToolVersion)' == '' ">7.0.0</NuGetToolVersion>
   </PropertyGroup>
   <ItemGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
-    <SourceRoot Include="C:\Users\dell\.nuget\packages\" />
+    <SourceRoot Include="C:\Users\lenovo\.nuget\packages\" />
     <SourceRoot Include="C:\Program Files (x86)\Microsoft Visual Studio\Shared\NuGetPackages\" />
   </ItemGroup>
   <ImportGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
@@ -22,7 +22,7 @@
     <Import Project="$(NuGetPackageRoot)microsoft.net.test.sdk\17.12.0\build\netcoreapp3.1\Microsoft.NET.Test.Sdk.props" Condition="Exists('$(NuGetPackageRoot)microsoft.net.test.sdk\17.12.0\build\netcoreapp3.1\Microsoft.NET.Test.Sdk.props')" />
   </ImportGroup>
   <PropertyGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
-    <Pkgxunit_analyzers Condition=" '$(Pkgxunit_analyzers)' == '' ">C:\Users\dell\.nuget\packages\xunit.analyzers\1.18.0</Pkgxunit_analyzers>
-    <PkgMicrosoft_Extensions_ApiDescription_Server Condition=" '$(PkgMicrosoft_Extensions_ApiDescription_Server)' == '' ">C:\Users\dell\.nuget\packages\microsoft.extensions.apidescription.server\6.0.5</PkgMicrosoft_Extensions_ApiDescription_Server>
+    <Pkgxunit_analyzers Condition=" '$(Pkgxunit_analyzers)' == '' ">C:\Users\lenovo\.nuget\packages\xunit.analyzers\1.18.0</Pkgxunit_analyzers>
+    <PkgMicrosoft_Extensions_ApiDescription_Server Condition=" '$(PkgMicrosoft_Extensions_ApiDescription_Server)' == '' ">C:\Users\lenovo\.nuget\packages\microsoft.extensions.apidescription.server\6.0.5</PkgMicrosoft_Extensions_ApiDescription_Server>
   </PropertyGroup>
 </Project>

Distribution.Tests/obj/project.assets.json

@@ -2542,23 +2542,23 @@
     ]
   },
   "packageFolders": {
-    "C:\\Users\\dell\\.nuget\\packages\\": {},
+    "C:\\Users\\lenovo\\.nuget\\packages\\": {},
     "C:\\Program Files (x86)\\Microsoft Visual Studio\\Shared\\NuGetPackages": {}
   },
   "project": {
     "version": "1.0.0",
     "restore": {
-      "projectUniqueName": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
+      "projectUniqueName": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
       "projectName": "Distribution.Tests",
-      "projectPath": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
-      "packagesPath": "C:\\Users\\dell\\.nuget\\packages\\",
-      "outputPath": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution.Tests\\obj\\",
+      "projectPath": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
+      "packagesPath": "C:\\Users\\lenovo\\.nuget\\packages\\",
+      "outputPath": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution.Tests\\obj\\",
       "projectStyle": "PackageReference",
       "fallbackFolders": [
         "C:\\Program Files (x86)\\Microsoft Visual Studio\\Shared\\NuGetPackages"
       ],
       "configFilePaths": [
-        "C:\\Users\\dell\\AppData\\Roaming\\NuGet\\NuGet.Config",
+        "C:\\Users\\lenovo\\AppData\\Roaming\\NuGet\\NuGet.Config",
         "C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.FallbackLocation.config",
         "C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.Offline.config"
       ],
@@ -2567,7 +2567,6 @@
       ],
       "sources": {
         "C:\\Program Files (x86)\\Microsoft SDKs\\NuGetPackages\\": {},
-        "C:\\Program Files\\dotnet\\library-packs": {},
         "https://api.nuget.org/v3/index.json": {}
       },
       "frameworks": {
@@ -2575,8 +2574,8 @@
           "framework": "net9.0",
           "targetAlias": "net9.0",
           "projectReferences": {
-            "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution\\Distribution.csproj": {
-              "projectPath": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution\\Distribution.csproj"
+            "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution\\Distribution.csproj": {
+              "projectPath": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution\\Distribution.csproj"
             }
           }
         }
@@ -2591,7 +2590,7 @@
         "auditLevel": "low",
         "auditMode": "direct"
       },
-      "SdkAnalysisLevel": "10.0.400"
+      "SdkAnalysisLevel": "10.0.300"
     },
     "frameworks": {
       "net9.0": {
@@ -2639,7 +2638,7 @@
             "privateAssets": "all"
           }
         },
-        "runtimeIdentifierGraphPath": "C:\\Program Files\\dotnet\\sdk\\10.0.400/PortableRuntimeIdentifierGraph.json"
+        "runtimeIdentifierGraphPath": "C:\\Program Files\\dotnet\\sdk\\10.0.302/PortableRuntimeIdentifierGraph.json"
       }
     }
   }

Distribution.Tests/obj/project.nuget.cache

@@ -1,57 +1,57 @@
 {
   "version": 2,
-  "dgSpecHash": "JPCR3IFZHKY=",
+  "dgSpecHash": "XdH8cqlThLk=",
   "success": true,
-  "projectFilePath": "D:\\HexDrive Projects\\Distribution\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
+  "projectFilePath": "C:\\Users\\lenovo\\Desktop\\NEWGITEA\\ERP_Distribution\\Distribution.Tests\\Distribution.Tests.csproj",
   "expectedPackageFiles": [
-    "C:\\Users\\dell\\.nuget\\packages\\castle.core\\5.1.1\\castle.core.5.1.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\coverlet.collector\\6.0.2\\coverlet.collector.6.0.2.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.aspnetcore.authentication.jwtbearer\\9.0.0\\microsoft.aspnetcore.authentication.jwtbearer.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.aspnetcore.openapi\\9.0.0\\microsoft.aspnetcore.openapi.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.codecoverage\\17.12.0\\microsoft.codecoverage.17.12.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.entityframeworkcore\\9.0.0\\microsoft.entityframeworkcore.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.entityframeworkcore.abstractions\\9.0.0\\microsoft.entityframeworkcore.abstractions.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.entityframeworkcore.analyzers\\9.0.0\\microsoft.entityframeworkcore.analyzers.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.entityframeworkcore.relational\\9.0.0\\microsoft.entityframeworkcore.relational.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.apidescription.server\\6.0.5\\microsoft.extensions.apidescription.server.6.0.5.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.caching.abstractions\\9.0.0\\microsoft.extensions.caching.abstractions.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.caching.memory\\9.0.0\\microsoft.extensions.caching.memory.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.configuration.abstractions\\9.0.0\\microsoft.extensions.configuration.abstractions.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.dependencyinjection\\9.0.0\\microsoft.extensions.dependencyinjection.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.dependencyinjection.abstractions\\9.0.0\\microsoft.extensions.dependencyinjection.abstractions.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.logging\\9.0.0\\microsoft.extensions.logging.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.logging.abstractions\\9.0.0\\microsoft.extensions.logging.abstractions.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.options\\9.0.0\\microsoft.extensions.options.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.extensions.primitives\\9.0.0\\microsoft.extensions.primitives.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.identitymodel.abstractions\\8.0.1\\microsoft.identitymodel.abstractions.8.0.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.identitymodel.jsonwebtokens\\8.0.1\\microsoft.identitymodel.jsonwebtokens.8.0.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.identitymodel.logging\\8.0.1\\microsoft.identitymodel.logging.8.0.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.identitymodel.protocols\\8.0.1\\microsoft.identitymodel.protocols.8.0.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.identitymodel.protocols.openidconnect\\8.0.1\\microsoft.identitymodel.protocols.openidconnect.8.0.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.identitymodel.tokens\\8.0.1\\microsoft.identitymodel.tokens.8.0.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.net.test.sdk\\17.12.0\\microsoft.net.test.sdk.17.12.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.openapi\\1.6.22\\microsoft.openapi.1.6.22.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.testplatform.objectmodel\\17.12.0\\microsoft.testplatform.objectmodel.17.12.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\microsoft.testplatform.testhost\\17.12.0\\microsoft.testplatform.testhost.17.12.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\moq\\4.20.72\\moq.4.20.72.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\mysqlconnector\\2.4.0\\mysqlconnector.2.4.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\newtonsoft.json\\13.0.1\\newtonsoft.json.13.0.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\pomelo.entityframeworkcore.mysql\\9.0.0\\pomelo.entityframeworkcore.mysql.9.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\swashbuckle.aspnetcore\\7.3.1\\swashbuckle.aspnetcore.7.3.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\swashbuckle.aspnetcore.swagger\\7.3.1\\swashbuckle.aspnetcore.swagger.7.3.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\swashbuckle.aspnetcore.swaggergen\\7.3.1\\swashbuckle.aspnetcore.swaggergen.7.3.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\swashbuckle.aspnetcore.swaggerui\\7.3.1\\swashbuckle.aspnetcore.swaggerui.7.3.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\system.diagnostics.eventlog\\6.0.0\\system.diagnostics.eventlog.6.0.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\system.identitymodel.tokens.jwt\\8.0.1\\system.identitymodel.tokens.jwt.8.0.1.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\system.reflection.metadata\\1.6.0\\system.reflection.metadata.1.6.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\xunit\\2.9.3\\xunit.2.9.3.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\xunit.abstractions\\2.0.3\\xunit.abstractions.2.0.3.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\xunit.analyzers\\1.18.0\\xunit.analyzers.1.18.0.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\xunit.assert\\2.9.3\\xunit.assert.2.9.3.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\xunit.core\\2.9.3\\xunit.core.2.9.3.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\xunit.extensibility.core\\2.9.3\\xunit.extensibility.core.2.9.3.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\xunit.extensibility.execution\\2.9.3\\xunit.extensibility.execution.2.9.3.nupkg.sha512",
-    "C:\\Users\\dell\\.nuget\\packages\\xunit.runner.visualstudio\\2.8.2\\xunit.runner.visualstudio.2.8.2.nupkg.sha512"
+    "C:\\Users\\lenovo\\.nuget\\packages\\castle.core\\5.1.1\\castle.core.5.1.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\coverlet.collector\\6.0.2\\coverlet.collector.6.0.2.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.aspnetcore.authentication.jwtbearer\\9.0.0\\microsoft.aspnetcore.authentication.jwtbearer.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.aspnetcore.openapi\\9.0.0\\microsoft.aspnetcore.openapi.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.codecoverage\\17.12.0\\microsoft.codecoverage.17.12.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.entityframeworkcore\\9.0.0\\microsoft.entityframeworkcore.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.entityframeworkcore.abstractions\\9.0.0\\microsoft.entityframeworkcore.abstractions.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.entityframeworkcore.analyzers\\9.0.0\\microsoft.entityframeworkcore.analyzers.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.entityframeworkcore.relational\\9.0.0\\microsoft.entityframeworkcore.relational.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.apidescription.server\\6.0.5\\microsoft.extensions.apidescription.server.6.0.5.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.caching.abstractions\\9.0.0\\microsoft.extensions.caching.abstractions.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.caching.memory\\9.0.0\\microsoft.extensions.caching.memory.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.configuration.abstractions\\9.0.0\\microsoft.extensions.configuration.abstractions.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.dependencyinjection\\9.0.0\\microsoft.extensions.dependencyinjection.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.dependencyinjection.abstractions\\9.0.0\\microsoft.extensions.dependencyinjection.abstractions.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.logging\\9.0.0\\microsoft.extensions.logging.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.logging.abstractions\\9.0.0\\microsoft.extensions.logging.abstractions.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.options\\9.0.0\\microsoft.extensions.options.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.extensions.primitives\\9.0.0\\microsoft.extensions.primitives.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.identitymodel.abstractions\\8.0.1\\microsoft.identitymodel.abstractions.8.0.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.identitymodel.jsonwebtokens\\8.0.1\\microsoft.identitymodel.jsonwebtokens.8.0.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.identitymodel.logging\\8.0.1\\microsoft.identitymodel.logging.8.0.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.identitymodel.protocols\\8.0.1\\microsoft.identitymodel.protocols.8.0.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.identitymodel.protocols.openidconnect\\8.0.1\\microsoft.identitymodel.protocols.openidconnect.8.0.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.identitymodel.tokens\\8.0.1\\microsoft.identitymodel.tokens.8.0.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.net.test.sdk\\17.12.0\\microsoft.net.test.sdk.17.12.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.openapi\\1.6.22\\microsoft.openapi.1.6.22.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.testplatform.objectmodel\\17.12.0\\microsoft.testplatform.objectmodel.17.12.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\microsoft.testplatform.testhost\\17.12.0\\microsoft.testplatform.testhost.17.12.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\moq\\4.20.72\\moq.4.20.72.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\mysqlconnector\\2.4.0\\mysqlconnector.2.4.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\newtonsoft.json\\13.0.1\\newtonsoft.json.13.0.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\pomelo.entityframeworkcore.mysql\\9.0.0\\pomelo.entityframeworkcore.mysql.9.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\swashbuckle.aspnetcore\\7.3.1\\swashbuckle.aspnetcore.7.3.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\swashbuckle.aspnetcore.swagger\\7.3.1\\swashbuckle.aspnetcore.swagger.7.3.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\swashbuckle.aspnetcore.swaggergen\\7.3.1\\swashbuckle.aspnetcore.swaggergen.7.3.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\swashbuckle.aspnetcore.swaggerui\\7.3.1\\swashbuckle.aspnetcore.swaggerui.7.3.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\system.diagnostics.eventlog\\6.0.0\\system.diagnostics.eventlog.6.0.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\system.identitymodel.tokens.jwt\\8.0.1\\system.identitymodel.tokens.jwt.8.0.1.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\system.reflection.metadata\\1.6.0\\system.reflection.metadata.1.6.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\xunit\\2.9.3\\xunit.2.9.3.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\xunit.abstractions\\2.0.3\\xunit.abstractions.2.0.3.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\xunit.analyzers\\1.18.0\\xunit.analyzers.1.18.0.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\xunit.assert\\2.9.3\\xunit.assert.2.9.3.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\xunit.core\\2.9.3\\xunit.core.2.9.3.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\xunit.extensibility.core\\2.9.3\\xunit.extensibility.core.2.9.3.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\xunit.extensibility.execution\\2.9.3\\xunit.extensibility.execution.2.9.3.nupkg.sha512",
+    "C:\\Users\\lenovo\\.nuget\\packages\\xunit.runner.visualstudio\\2.8.2\\xunit.runner.visualstudio.2.8.2.nupkg.sha512"
   ],
   "logs": []
 }

Distribution/Data/AppDBContext.cs

@@ -20,7 +20,6 @@ public class AppDBContext(DbContextOptions<AppDBContext> options) : DbContext(op
     public DbSet<Sale> Sales { get; set; }
     public DbSet<Order> Orders { get; set; }
     public DbSet<OrderItem> OrderItems { get; set; }
-    public DbSet<Invoice> Invoices { get; set; }
     public DbSet<DeliveryRun> DeliveryRuns { get; set; }
     public DbSet<User> Users { get; set; }
     public DbSet<Role> Roles { get; set; }
@@ -65,11 +64,8 @@ public class AppDBContext(DbContextOptions<AppDBContext> options) : DbContext(op
 
     protected override void OnModelCreating(ModelBuilder modelBuilder)
     {
-        // OrderItem uses its inherited Template.Id as PK (no composite key on
-        // {FK_OrderId, FK_ItemId}) so that editing a PO's items can soft-delete the current
-        // row and insert a fresh one for the same item — versioning per order_invoice_lifecycle.md.
         modelBuilder.Entity<OrderItem>()
-            .HasIndex(oi => oi.FK_OrderId);
+            .HasKey(oi => new { oi.FK_OrderId, oi.FK_ItemId });
 
         modelBuilder.Entity<RolePermission>()
             .HasKey(rp => new { rp.FK_RoleId, rp.FK_PermissionId });
@@ -147,54 +143,8 @@ public class AppDBContext(DbContextOptions<AppDBContext> options) : DbContext(op
             .HasOne(o => o.Sale)
             .WithMany()
             .HasForeignKey(o => o.FK_SaleId)
-            .OnDelete(DeleteBehavior.Restrict)
-            .IsRequired(false);
-
-        modelBuilder.Entity<Order>()
-            .HasOne(o => o.CreatedByUser)
-            .WithMany()
-            .HasForeignKey(o => o.CreatedByUserId)
             .OnDelete(DeleteBehavior.Restrict);
 
-        modelBuilder.Entity<Order>()
-            .HasOne(o => o.ConfirmedByUser)
-            .WithMany()
-            .HasForeignKey(o => o.ConfirmedByUserId)
-            .OnDelete(DeleteBehavior.Restrict)
-            .IsRequired(false);
-
-        // Order.InvoiceId is a plain column with no DB-level FK constraint — deliberately
-        // unmapped as a relationship, per order_invoice_lifecycle.md.
-        modelBuilder.Entity<Order>()
-            .Property(o => o.InvoiceId)
-            .HasColumnName("InvoiceId");
-
-        modelBuilder.Entity<Invoice>()
-            .HasOne(i => i.Order)
-            .WithMany()
-            .HasForeignKey(i => i.FK_OrderId)
-            .OnDelete(DeleteBehavior.Restrict);
-
-        modelBuilder.Entity<Invoice>()
-            .HasOne(i => i.CreatedByUser)
-            .WithMany()
-            .HasForeignKey(i => i.CreatedByUserId)
-            .OnDelete(DeleteBehavior.Restrict);
-
-        modelBuilder.Entity<Invoice>()
-            .HasOne(i => i.PrintedByUser)
-            .WithMany()
-            .HasForeignKey(i => i.PrintedByUserId)
-            .OnDelete(DeleteBehavior.Restrict)
-            .IsRequired(false);
-
-        modelBuilder.Entity<Invoice>()
-            .HasOne(i => i.FinalizedByUser)
-            .WithMany()
-            .HasForeignKey(i => i.FinalizedByUserId)
-            .OnDelete(DeleteBehavior.Restrict)
-            .IsRequired(false);
-
         modelBuilder.Entity<SchemeRedemption>()
             .HasOne(r => r.Scheme)
             .WithMany(s => s.Redemptions)

Distribution/Data/Seed/OperationsDataSeed.cs

@@ -104,7 +104,6 @@ public static class OperationsDataSeed
                 FK_SaleId = Sale1Id,
                 OrderDate = new DateTime(2026, 8, 25, 9, 0, 0),
                 FK_StoreId = MasterDataSeed.FortStoreId,
-                CreatedByUserId = MasterDataSeed.SalesRep1UserId,
                 TotalAmount = 3000m,
                 Status = OrderStatus.Fulfilled,
                 FulfilledAt = new DateTime(2026, 8, 25, 13, 0, 0),
@@ -117,7 +116,6 @@ public static class OperationsDataSeed
                 FK_SaleId = Sale2Id,
                 OrderDate = new DateTime(2026, 8, 30, 10, 0, 0),
                 FK_StoreId = MasterDataSeed.KandyStoreId,
-                CreatedByUserId = MasterDataSeed.SalesRep2UserId,
                 TotalAmount = 1200m,
                 Status = OrderStatus.Pending,
                 FulfilledAt = null,

Distribution/Data/Seed/OperationsExtrasSeed.cs

@@ -1,4 +1,3 @@
-using Distribution.Features.Stock;
 using Distribution.Models;
 using Microsoft.EntityFrameworkCore;
 
@@ -81,9 +80,9 @@ public static class OperationsExtrasSeed
         );
 
         modelBuilder.Entity<StockMovement>().HasData(
-            new StockMovement { Id = StockMovement1Id, FK_ItemId = MasterDataSeed.Coke500ItemId, FromLocationId = StockService.ExternalLocationId, FromLocationType = LocationType.External, ToLocationId = MasterDataSeed.ColomboWarehouseId, ToLocationType = LocationType.Warehouse, Quantity = 200m, Type = MovementType.PurchaseReceipt, ReasonCode = null, ReferenceId = ProcurementSeed.GoodsReceipt1Id, CreatedAt = new DateTime(2026, 8, 15), CreatedBy = MasterDataSeed.Supervisor1UserId },
+            new StockMovement { Id = StockMovement1Id, FK_ItemId = MasterDataSeed.Coke500ItemId, FromLocationId = null, FromLocationType = null, ToLocationId = MasterDataSeed.ColomboWarehouseId, ToLocationType = LocationType.Warehouse, Quantity = 200m, Type = MovementType.PurchaseReceipt, ReasonCode = null, ReferenceId = ProcurementSeed.GoodsReceipt1Id, CreatedAt = new DateTime(2026, 8, 15), CreatedBy = MasterDataSeed.Supervisor1UserId },
             new StockMovement { Id = StockMovement2Id, FK_ItemId = MasterDataSeed.Coke500ItemId, FromLocationId = MasterDataSeed.ColomboWarehouseId, FromLocationType = LocationType.Warehouse, ToLocationId = MasterDataSeed.VanVehicleId, ToLocationType = LocationType.Vehicle, Quantity = 50m, Type = MovementType.Load, ReasonCode = null, ReferenceId = OperationsDataSeed.LoadingSheet1Id, CreatedAt = new DateTime(2026, 8, 25, 7, 30, 0), CreatedBy = MasterDataSeed.Supervisor1UserId },
-            new StockMovement { Id = StockMovement3Id, FK_ItemId = MasterDataSeed.Coke500ItemId, FromLocationId = MasterDataSeed.VanVehicleId, FromLocationType = LocationType.Vehicle, ToLocationId = StockService.ExternalLocationId, ToLocationType = LocationType.External, Quantity = 30m, Type = MovementType.Sale, ReasonCode = null, ReferenceId = OperationsDataSeed.Sale1Id, CreatedAt = new DateTime(2026, 8, 25, 9, 30, 0), CreatedBy = MasterDataSeed.SalesRep1UserId }
+            new StockMovement { Id = StockMovement3Id, FK_ItemId = MasterDataSeed.Coke500ItemId, FromLocationId = MasterDataSeed.VanVehicleId, FromLocationType = LocationType.Vehicle, ToLocationId = null, ToLocationType = null, Quantity = 30m, Type = MovementType.Sale, ReasonCode = null, ReferenceId = OperationsDataSeed.Sale1Id, CreatedAt = new DateTime(2026, 8, 25, 9, 30, 0), CreatedBy = MasterDataSeed.SalesRep1UserId }
         );
 
         modelBuilder.Entity<StoreKycDocument>().HasData(

Distribution/Features/Brand/BrandDTOs.cs

@@ -1,5 +1,5 @@
 namespace Distribution.Features.Brand;
 
 public record CreateBrandRequest(string Name);
-public record UpdateBrandRequest(string Name, bool IsActive = true);
+public record UpdateBrandRequest(string Name);
 public record BrandResponse(Guid Id, string Name, bool IsActive, DateTime CreatedAt);

Distribution/Features/Brand/BrandService.cs

@@ -5,16 +5,15 @@ namespace Distribution.Features.Brand;
 public class BrandService(IBrandRepository repo, IUnitOfWork uow)
 {
     public async Task<List<BrandResponse>> GetAllAsync() =>
-        // Deleted brands stay IsActive=false but remain visible showing Inactive — delete
-        // never removes the row, only marks it (same rule as Items/Stores/Categories).
         (await repo.GetAllAsync())
+            .Where(b => b.IsActive)
             .Select(b => new BrandResponse(b.Id, b.Name, b.IsActive, b.CreatedAt))
             .ToList();
 
     public async Task<BrandResponse?> GetByIdAsync(Guid id)
     {
         var brand = await repo.GetByIdAsync(id);
-        if (brand is null) return null;
+        if (brand is null || !brand.IsActive) return null;
         return new BrandResponse(brand.Id, brand.Name, brand.IsActive, brand.CreatedAt);
     }
 
@@ -30,10 +29,9 @@ public class BrandService(IBrandRepository repo, IUnitOfWork uow)
     public async Task<BrandResponse?> UpdateAsync(Guid id, UpdateBrandRequest request, CancellationToken ct = default)
     {
         var brand = await repo.GetByIdAsync(id);
-        if (brand is null) return null;
+        if (brand is null || !brand.IsActive) return null;
         if (brand.ExternalErpId.HasValue) return null;
         brand.Name = request.Name;
-        brand.IsActive = request.IsActive;
         await uow.BeginAsync(ct);
         try { repo.Update(brand); await uow.CommitAsync(ct); }
         catch { await uow.RollbackAsync(ct); throw; }
@@ -42,11 +40,10 @@ public class BrandService(IBrandRepository repo, IUnitOfWork uow)
 
     public async Task<bool> DeleteAsync(Guid id, CancellationToken ct = default)
     {
-        // Soft-delete only — never blocked by items still referencing this brand, same rule
-        // as Categories.
         var brand = await repo.GetByIdAsync(id);
         if (brand is null || !brand.IsActive) return false;
         if (brand.ExternalErpId.HasValue) return false;
+        if (await repo.HasActiveItemsAsync(id)) return false;
         await uow.BeginAsync(ct);
         try { repo.Remove(brand); await uow.CommitAsync(ct); }
         catch { await uow.RollbackAsync(ct); throw; }

Distribution/Features/Category/CategoryDTOs.cs

@@ -1,9 +1,9 @@
 namespace Distribution.Features.Category;
 
 public record CreateCategoryRequest(string Name);
-public record UpdateCategoryRequest(string Name, bool IsActive = true);
+public record UpdateCategoryRequest(string Name);
 public record CreateSubCategoryRequest(string Name);
-public record UpdateSubCategoryRequest(string Name, bool IsActive = true);
+public record UpdateSubCategoryRequest(string Name);
 
 public record SubCategoryResponse(Guid Id, string Name, bool IsActive, DateTime CreatedAt);
 public record CategorySummaryResponse(Guid Id, string Name, bool IsActive, DateTime CreatedAt);

Distribution/Features/Category/CategoryService.cs

@@ -4,27 +4,18 @@ namespace Distribution.Features.Category;
 
 public class CategoryService(ICategoryRepository categoryRepo, ISubCategoryRepository subCategoryRepo, IUnitOfWork uow)
 {
-    public async Task<List<CategoryResponse>> GetAllAsync()
-    {
-        // Deleted categories/sub-categories stay IsActive=false but remain visible showing
-        // Inactive — delete never removes the row, only marks it (same rule as Orders/Stores/Items).
-        var categoryList = await categoryRepo.GetAllAsync();
-        var result = new List<CategoryResponse>();
-        foreach (var category in categoryList)
-        {
-            var subs = (await subCategoryRepo.GetByCategoryIdAsync(category.Id))
-                .Select(s => new SubCategoryResponse(s.Id, s.Name, s.IsActive, s.CreatedAt))
-                .ToList();
-            result.Add(new CategoryResponse(category.Id, category.Name, category.IsActive, category.CreatedAt, subs));
-        }
-        return result;
-    }
+    public async Task<List<CategorySummaryResponse>> GetAllAsync() =>
+        (await categoryRepo.GetAllAsync())
+            .Where(c => c.IsActive)
+            .Select(c => new CategorySummaryResponse(c.Id, c.Name, c.IsActive, c.CreatedAt))
+            .ToList();
 
     public async Task<CategoryResponse?> GetByIdAsync(Guid id)
     {
         var category = await categoryRepo.GetByIdAsync(id);
-        if (category is null) return null;
+        if (category is null || !category.IsActive) return null;
         var subs = (await subCategoryRepo.GetByCategoryIdAsync(id))
+            .Where(s => s.IsActive)
             .Select(s => new SubCategoryResponse(s.Id, s.Name, s.IsActive, s.CreatedAt))
             .ToList();
         return new CategoryResponse(category.Id, category.Name, category.IsActive, category.CreatedAt, subs);
@@ -42,10 +33,9 @@ public class CategoryService(ICategoryRepository categoryRepo, ISubCategoryRepos
     public async Task<CategorySummaryResponse?> UpdateAsync(Guid id, UpdateCategoryRequest request, CancellationToken ct = default)
     {
         var category = await categoryRepo.GetByIdAsync(id);
-        if (category is null) return null;
+        if (category is null || !category.IsActive) return null;
         if (category.ExternalErpId.HasValue) return null;
         category.Name = request.Name;
-        category.IsActive = request.IsActive;
         await uow.BeginAsync(ct);
         try { categoryRepo.Update(category); await uow.CommitAsync(ct); }
         catch { await uow.RollbackAsync(ct); throw; }
@@ -54,11 +44,11 @@ public class CategoryService(ICategoryRepository categoryRepo, ISubCategoryRepos
 
     public async Task<bool> DeleteAsync(Guid id, CancellationToken ct = default)
     {
-        // Soft-delete only — never blocked by child sub-categories/items, same rule as
-        // Items/Stores/Orders. The row stays visible showing Inactive.
         var category = await categoryRepo.GetByIdAsync(id);
         if (category is null || !category.IsActive) return false;
         if (category.ExternalErpId.HasValue) return false;
+        if (await categoryRepo.HasActiveSubCategoriesAsync(id)) return false;
+        if (await categoryRepo.HasActiveItemsAsync(id)) return false;
         await uow.BeginAsync(ct);
         try { categoryRepo.Remove(category); await uow.CommitAsync(ct); }
         catch { await uow.RollbackAsync(ct); throw; }
@@ -79,10 +69,9 @@ public class CategoryService(ICategoryRepository categoryRepo, ISubCategoryRepos
     public async Task<SubCategoryResponse?> UpdateSubCategoryAsync(Guid id, UpdateSubCategoryRequest request, CancellationToken ct = default)
     {
         var sub = await subCategoryRepo.GetByIdAsync(id);
-        if (sub is null) return null;
+        if (sub is null || !sub.IsActive) return null;
         if (sub.ExternalErpId.HasValue) return null;
         sub.Name = request.Name;
-        sub.IsActive = request.IsActive;
         await uow.BeginAsync(ct);
         try { subCategoryRepo.Update(sub); await uow.CommitAsync(ct); }
         catch { await uow.RollbackAsync(ct); throw; }
@@ -91,10 +80,10 @@ public class CategoryService(ICategoryRepository categoryRepo, ISubCategoryRepos
 
     public async Task<bool> DeleteSubCategoryAsync(Guid id, CancellationToken ct = default)
     {
-        // Soft-delete only — never blocked by child items, same rule as the parent category.
         var sub = await subCategoryRepo.GetByIdAsync(id);
         if (sub is null || !sub.IsActive) return false;
         if (sub.ExternalErpId.HasValue) return false;
+        if (await subCategoryRepo.HasActiveItemsAsync(id)) return false;
         await uow.BeginAsync(ct);
         try { subCategoryRepo.Remove(sub); await uow.CommitAsync(ct); }
         catch { await uow.RollbackAsync(ct); throw; }

Distribution/Features/Claims/ClaimController.cs

@@ -6,10 +6,6 @@ namespace Distribution.Features.Claims;
 [ApiController]
 public class ClaimController(ClaimService service, ICurrentUserService currentUser) : ControllerBase
 {
-    [HttpGet("api/claims")]
-    public async Task<IActionResult> GetAll() =>
-        Ok(await service.GetAllAsync());
-
     [HttpGet("api/claims/{id:guid}")]
     public async Task<IActionResult> GetById(Guid id)
     {
@@ -28,25 +24,13 @@ public class ClaimController(ClaimService service, ICurrentUserService currentUs
         catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
     }
 
-    [HttpPut("api/claims/{id:guid}")]
-    public async Task<IActionResult> Update(Guid id, UpdateClaimRequest request, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.UpdateAsync(id, request, ct);
-            return Ok(result);
-        }
-        catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
-    }
-
     [HttpPost("api/claims/{id:guid}/settle")]
     public async Task<IActionResult> Settle(Guid id, SettleClaimRequest request, CancellationToken ct)
     {
-        var userId = currentUser.UserId ?? request.SettledByUserId;
-        if (userId is null) return BadRequest(new { error = "SettledByUserId is required while auth is unavailable" });
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
         try
         {
-            var result = await service.SettleAsync(id, request, userId.Value, ct);
+            var result = await service.SettleAsync(id, request, userId, ct);
             return Ok(result);
         }
         catch (KeyNotFoundException) { return NotFound(); }

Distribution/Features/Claims/ClaimDTOs.cs

@@ -4,14 +4,7 @@ namespace Distribution.Features.Claims;
 
 public record CreateClaimRequest(Guid AgencyUserId, string Details);
 
-// Only editable while the claim is still Open — once settled, the settlement amount is a
-// financial record and the claim details it was settled against should not silently change.
-public record UpdateClaimRequest(Guid AgencyUserId, string Details);
-
-public record SettleClaimRequest(
-    decimal SettlementAmount,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? SettledByUserId = null);
+public record SettleClaimRequest(decimal SettlementAmount);
 
 public record ClaimResponse(
     Guid Id,

Distribution/Features/Claims/ClaimRepository.cs

@@ -8,12 +8,6 @@ public class ClaimRepository(AppDBContext context) : IClaimRepository
     public async Task<Models.Claim?> GetByIdAsync(Guid id) =>
         await context.Claims.FirstOrDefaultAsync(c => c.Id == id);
 
-    public async Task<List<Models.Claim>> GetAllAsync() =>
-        await context.Claims
-            .Where(c => c.IsActive)
-            .OrderByDescending(c => c.CreatedAt)
-            .ToListAsync();
-
     public async Task<List<Models.Claim>> GetByAgencyUserIdAsync(Guid agencyUserId) =>
         await context.Claims
             .Where(c => c.FK_AgencyUserId == agencyUserId && c.IsActive)

Distribution/Features/Claims/ClaimService.cs

@@ -15,9 +15,6 @@ public class ClaimService(IClaimRepository repo, IUnitOfWork uow)
         return Map(c);
     }
 
-    public async Task<List<ClaimResponse>> GetAllAsync() =>
-        (await repo.GetAllAsync()).Select(Map).ToList();
-
     public async Task<List<ClaimResponse>> GetByAgencyUserIdAsync(Guid agencyUserId) =>
         (await repo.GetByAgencyUserIdAsync(agencyUserId)).Select(Map).ToList();
 
@@ -43,26 +40,6 @@ public class ClaimService(IClaimRepository repo, IUnitOfWork uow)
         return Map(claim);
     }
 
-    public async Task<ClaimResponse> UpdateAsync(Guid id, UpdateClaimRequest request, CancellationToken ct = default)
-    {
-        var claim = await repo.GetByIdAsync(id);
-        if (claim is null || !claim.IsActive)
-            throw new InvalidOperationException("Claim not found.");
-        if (claim.Status == ClaimStatus.Settled)
-            throw new InvalidOperationException("Cannot edit a claim that has already been settled.");
-        if (string.IsNullOrWhiteSpace(request.Details))
-            throw new InvalidOperationException("Claim details are required.");
-
-        claim.FK_AgencyUserId = request.AgencyUserId;
-        claim.Details = request.Details;
-
-        await uow.BeginAsync(ct);
-        try { repo.Update(claim); await uow.CommitAsync(ct); }
-        catch { await uow.RollbackAsync(ct); throw; }
-
-        return Map(claim);
-    }
-
     public async Task<ClaimResponse> SettleAsync(Guid id, SettleClaimRequest request, Guid approverId, CancellationToken ct = default)
     {
         var claim = await repo.GetByIdAsync(id);

Distribution/Features/Claims/IClaimRepository.cs

@@ -3,7 +3,6 @@ namespace Distribution.Features.Claims;
 public interface IClaimRepository
 {
     Task<Models.Claim?> GetByIdAsync(Guid id);
-    Task<List<Models.Claim>> GetAllAsync();
     Task<List<Models.Claim>> GetByAgencyUserIdAsync(Guid agencyUserId);
     Task AddAsync(Models.Claim entity);
     void Update(Models.Claim entity);

Distribution/Features/DeliveryRide/DeliveryTaskService.cs

@@ -159,15 +159,13 @@ public class DeliveryTaskService(
         {
             foreach (var item in task.Order.OrderItems.Where(i => i.QuantityFulfilled > 0))
             {
-                var vehicleBalance = await stockRepo.GetBalanceAsync(item.FK_ItemId, vehicleId);
-                var availableQuantity = vehicleBalance?.Quantity ?? 0;
-                var itemName = item.Item?.Name ?? item.FK_ItemId.ToString();
+                var vehicleBalance = await stockRepo.GetBalanceAsync(item.FK_ItemId, vehicleId)
+                    ?? throw new InvalidOperationException($"No vehicle stock found for item {item.FK_ItemId}");
 
-                if (availableQuantity < item.QuantityFulfilled)
-                    throw new InvalidOperationException(
-                        $"Insufficient vehicle stock for item '{itemName}': available {availableQuantity}, required {item.QuantityFulfilled}");
+                if (vehicleBalance.Quantity < item.QuantityFulfilled)
+                    throw new InvalidOperationException($"Insufficient vehicle stock for item {item.FK_ItemId}");
 
-                vehicleBalance!.Quantity -= item.QuantityFulfilled;
+                vehicleBalance.Quantity -= item.QuantityFulfilled;
                 vehicleBalance.UpdatedAt = DateTime.Now;
                 stockRepo.UpdateBalance(vehicleBalance);
 
@@ -176,8 +174,6 @@ public class DeliveryTaskService(
                     FK_ItemId = item.FK_ItemId,
                     FromLocationId = vehicleId,
                     FromLocationType = LocationType.Vehicle,
-                    ToLocationId = StockService.ExternalLocationId,
-                    ToLocationType = LocationType.External,
                     Quantity = item.QuantityFulfilled,
                     Type = MovementType.Sale,
                     ReferenceId = task.FK_OrderId
@@ -187,9 +183,9 @@ public class DeliveryTaskService(
             repo.Update(task);
             orderRepo.Update(order);
 
-            if (fullyDelivered && order.FK_SaleId is Guid saleId)
+            if (fullyDelivered)
             {
-                var sale = await saleRepo.GetByIdAsync(saleId)
+                var sale = await saleRepo.GetByIdAsync(order.FK_SaleId)
                     ?? throw new KeyNotFoundException("Sale not found");
                 sale.Status = SaleStatus.Completed;
                 sale.CompletedAt = DateTime.Now;

Distribution/Features/Grn/GrnController.cs

@@ -26,14 +26,11 @@ public class GrnController(GrnService service, ICurrentUserService currentUser)
     [HttpPost("api/goods-receipts")]
     public async Task<IActionResult> CreateFlat(CreateFlatGrnRequest request, CancellationToken ct)
     {
-        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
-        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
-        var userId = currentUser.UserId ?? request.ReceivedByUserId;
-        if (userId is null) return BadRequest(new { error = "ReceivedByUserId is required while auth is unavailable" });
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
         try
         {
             var inner = new CreateGrnRequest(request.WarehouseId, request.Items);
-            var result = await service.CreateAsync(request.PurchaseOrderId, inner, userId.Value, ct);
+            var result = await service.CreateAsync(request.PurchaseOrderId, inner, userId, ct);
             return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
         }
         catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
@@ -46,11 +43,10 @@ public class GrnController(GrnService service, ICurrentUserService currentUser)
     [HttpPost("api/purchase-orders/{id:guid}/goods-receipts")]
     public async Task<IActionResult> Create(Guid id, CreateGrnRequest request, CancellationToken ct)
     {
-        var userId = currentUser.UserId ?? request.ReceivedByUserId;
-        if (userId is null) return BadRequest(new { error = "ReceivedByUserId is required while auth is unavailable" });
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
         try
         {
-            var result = await service.CreateAsync(id, request, userId.Value, ct);
+            var result = await service.CreateAsync(id, request, userId, ct);
             return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
         }
         catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }

Distribution/Features/Grn/GrnDTOs.cs

@@ -2,18 +2,9 @@ namespace Distribution.Features.Grn;
 
 public record GrnItemRequest(Guid PurchaseOrderItemId, int AcceptedQuantity, int RejectedQuantity);
 
-public record CreateGrnRequest(
-    Guid WarehouseId,
-    List<GrnItemRequest> Items,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? ReceivedByUserId = null);
+public record CreateGrnRequest(Guid WarehouseId, List<GrnItemRequest> Items);
 
-public record CreateFlatGrnRequest(
-    Guid PurchaseOrderId,
-    Guid WarehouseId,
-    List<GrnItemRequest> Items,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? ReceivedByUserId = null);
+public record CreateFlatGrnRequest(Guid PurchaseOrderId, Guid WarehouseId, List<GrnItemRequest> Items);
 
 public record GrnItemResponse(
     Guid Id,

Distribution/Features/Grn/GrnService.cs

@@ -124,8 +124,6 @@ public class GrnService(
                 await stockRepo.AddMovementAsync(new StockMovement
                 {
                     FK_ItemId = poItem.FK_ItemId,
-                    FromLocationId = StockService.ExternalLocationId,
-                    FromLocationType = LocationType.External,
                     ToLocationId = request.WarehouseId,
                     ToLocationType = LocationType.Warehouse,
                     Quantity = line.AcceptedQuantity,

Distribution/Features/Invoice/IInvoiceRepository.cs

@@ -1,9 +0,0 @@
-namespace Distribution.Features.Invoice;
-
-public interface IInvoiceRepository
-{
-    Task<Models.Invoice?> GetByIdAsync(Guid id);
-    Task<Models.Invoice?> GetByOrderIdAsync(Guid orderId);
-    Task AddAsync(Models.Invoice entity);
-    void Update(Models.Invoice entity);
-}

Distribution/Features/Invoice/InvoiceController.cs

@@ -1,48 +0,0 @@
-using Microsoft.AspNetCore.Mvc;
-
-namespace Distribution.Features.Invoice;
-
-[ApiController]
-[Route("api/invoices")]
-public class InvoiceController(InvoiceService service) : ControllerBase
-{
-    [HttpGet("{id:guid}")]
-    public async Task<IActionResult> GetById(Guid id)
-    {
-        var result = await service.GetByIdAsync(id);
-        return result is null ? NotFound() : Ok(result);
-    }
-
-    [HttpPost]
-    public async Task<IActionResult> Create(CreateInvoiceRequest request, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.CreateAsync(request, ct);
-            return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
-        }
-        catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
-    }
-
-    [HttpPost("{id:guid}/print")]
-    public async Task<IActionResult> Print(Guid id, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.PrintAsync(id, ct);
-            return result is null ? NotFound() : Ok(result);
-        }
-        catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
-    }
-
-    [HttpPost("{id:guid}/finalize")]
-    public async Task<IActionResult> Finalize(Guid id, FinalizeInvoiceRequest request, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.FinalizeAsync(id, request, ct);
-            return result is null ? NotFound() : Ok(result);
-        }
-        catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
-    }
-}

Distribution/Features/Invoice/InvoiceDTOs.cs

@@ -1,29 +0,0 @@
-using Distribution.Models;
-
-namespace Distribution.Features.Invoice;
-
-public record CreateInvoiceRequest(Guid OrderId);
-
-public record FinalizeInvoiceItemRequest(Guid OrderItemId, decimal DeliveredQuantity, decimal FreeQuantity);
-
-public record FinalizeInvoiceReturnRequest(Guid ItemId, decimal Quantity, ReturnReasonCode ReasonCode);
-
-public record FinalizeInvoiceDiscountRequest(DiscountType Type, decimal Value, string? Reason);
-
-public record FinalizeInvoiceRequest(
-    List<FinalizeInvoiceItemRequest> Items,
-    List<FinalizeInvoiceReturnRequest>? Returns,
-    FinalizeInvoiceDiscountRequest? Discount);
-
-public record InvoiceResponse(
-    Guid Id,
-    Guid OrderId,
-    InvoiceStatus Status,
-    Guid CreatedByUserId,
-    DateTime? PrintedAt,
-    Guid? PrintedByUserId,
-    DateTime? FinalizedAt,
-    Guid? FinalizedByUserId,
-    decimal TotalAmount,
-    bool IsActive,
-    DateTime CreatedAt);

Distribution/Features/Invoice/InvoiceRepository.cs

@@ -1,19 +0,0 @@
-using Distribution.Data;
-using Microsoft.EntityFrameworkCore;
-
-namespace Distribution.Features.Invoice;
-
-public class InvoiceRepository(AppDBContext context) : IInvoiceRepository
-{
-    public async Task<Models.Invoice?> GetByIdAsync(Guid id) =>
-        await context.Invoices.FindAsync(id);
-
-    public async Task<Models.Invoice?> GetByOrderIdAsync(Guid orderId) =>
-        await context.Invoices.FirstOrDefaultAsync(i => i.FK_OrderId == orderId && i.IsActive);
-
-    public async Task AddAsync(Models.Invoice entity) =>
-        await context.Invoices.AddAsync(entity);
-
-    public void Update(Models.Invoice entity) =>
-        context.Invoices.Update(entity);
-}

Distribution/Features/Invoice/InvoiceService.cs

@@ -1,203 +0,0 @@
-using Distribution.Features.Item;
-using Distribution.Features.Order;
-using Distribution.Features.Returns;
-using Distribution.Infra.Authorization;
-using Distribution.Infra.UoW;
-using Distribution.Models;
-using Microsoft.Extensions.Configuration;
-
-namespace Distribution.Features.Invoice;
-
-public class InvoiceService(
-    IInvoiceRepository repo,
-    IOrderRepository orderRepo,
-    IReturnRepository returnRepo,
-    IItemRepository itemRepo,
-    IUnitOfWork uow,
-    ICurrentUserService currentUser,
-    IConfiguration configuration)
-{
-    private static InvoiceResponse ToResponse(Models.Invoice i) =>
-        new(i.Id, i.FK_OrderId, i.Status, i.CreatedByUserId, i.PrintedAt, i.PrintedByUserId,
-            i.FinalizedAt, i.FinalizedByUserId, i.TotalAmount, i.IsActive, i.CreatedAt);
-
-    private bool IsModeB =>
-        configuration.GetValue<string>("OrderInvoice:InvoiceCreationMode") != "A";
-
-    public async Task<InvoiceResponse?> GetByIdAsync(Guid id)
-    {
-        var invoice = await repo.GetByIdAsync(id);
-        return invoice is null || !invoice.IsActive ? null : ToResponse(invoice);
-    }
-
-    /// <summary>Mode B only — creates the Invoice (Draft) for an already-Confirmed PO as a
-    /// separate action. Mode A creates the Invoice atomically via
-    /// OrderService.ConfirmAndCreateInvoiceAsync instead.</summary>
-    public async Task<InvoiceResponse> CreateAsync(CreateInvoiceRequest request, CancellationToken ct = default)
-    {
-        if (!IsModeB)
-            throw new InvalidOperationException("POST /api/invoices is not enabled — this system uses InvoiceCreationMode A, which creates the Invoice as part of PO confirmation.");
-
-        var order = await orderRepo.GetByIdAsync(request.OrderId);
-        if (order is null || !order.IsActive)
-            throw new InvalidOperationException("Order not found.");
-        if (order.ConfirmedAt is null)
-            throw new InvalidOperationException("Only a Confirmed PO can have an Invoice created for it.");
-        if (order.InvoiceId is not null)
-            throw new InvalidOperationException("An Invoice already exists for this PO.");
-
-        var invoice = new Models.Invoice
-        {
-            FK_OrderId = order.Id,
-            Status = InvoiceStatus.Draft,
-            CreatedByUserId = currentUser.UserId ?? throw new InvalidOperationException("No authenticated user."),
-            TotalAmount = order.TotalAmount,
-        };
-        order.InvoiceId = invoice.Id;
-
-        await uow.BeginAsync(ct);
-        try
-        {
-            await repo.AddAsync(invoice);
-            orderRepo.Update(order);
-            await uow.CommitAsync(ct);
-        }
-        catch
-        {
-            await uow.RollbackAsync(ct);
-            throw;
-        }
-
-        return ToResponse(invoice);
-    }
-
-    /// <summary>Draft → Printed. The agent takes the physical copy to the field and may make
-    /// handwritten edits during the ride.</summary>
-    public async Task<InvoiceResponse?> PrintAsync(Guid id, CancellationToken ct = default)
-    {
-        var invoice = await repo.GetByIdAsync(id);
-        if (invoice is null || !invoice.IsActive) return null;
-        if (invoice.Status != InvoiceStatus.Draft)
-            throw new InvalidOperationException("Only a Draft invoice can be printed.");
-
-        invoice.Status = InvoiceStatus.Printed;
-        invoice.PrintedAt = DateTime.Now;
-        invoice.PrintedByUserId = currentUser.UserId;
-
-        await uow.BeginAsync(ct);
-        try
-        {
-            repo.Update(invoice);
-            await uow.CommitAsync(ct);
-        }
-        catch
-        {
-            await uow.RollbackAsync(ct);
-            throw;
-        }
-
-        return ToResponse(invoice);
-    }
-
-    /// <summary>Printed → Finalized. The office worker enters whatever the agent handwrote on the
-    /// returned printed copy — delivered/free quantities per line, returns/damage (reusing the
-    /// SaleReturn/CreditNote shape from 18_returns_claims.md), and an optional invoice-level
-    /// discount. Payload shape resolved in order_invoice_lifecycle.md Open Question 6.</summary>
-    public async Task<InvoiceResponse?> FinalizeAsync(Guid id, FinalizeInvoiceRequest request, CancellationToken ct = default)
-    {
-        var invoice = await repo.GetByIdAsync(id);
-        if (invoice is null || !invoice.IsActive) return null;
-        if (invoice.Status != InvoiceStatus.Printed)
-            throw new InvalidOperationException("An invoice can only be finalized from Printed — Draft → Finalized directly is not a valid transition.");
-        if (request.Items is null || request.Items.Count == 0)
-            throw new InvalidOperationException("Finalize must include at least one line item.");
-
-        var order = await orderRepo.GetByIdAsync(invoice.FK_OrderId)
-            ?? throw new InvalidOperationException("Order not found for this Invoice.");
-        var orderItems = (await orderRepo.GetItemsByOrderIdAsync(order.Id)).ToDictionary(oi => oi.Id);
-
-        decimal subtotal = 0;
-        foreach (var line in request.Items)
-        {
-            if (!orderItems.TryGetValue(line.OrderItemId, out var orderItem))
-                throw new InvalidOperationException($"OrderItem {line.OrderItemId} does not belong to this Invoice's PO.");
-            if (line.DeliveredQuantity < 0 || line.FreeQuantity < 0)
-                throw new InvalidOperationException("Delivered/free quantity cannot be negative.");
-
-            subtotal += line.DeliveredQuantity * orderItem.UnitPrice; // freeQuantity never bills
-            orderItem.QuantityFulfilled = (int)(line.DeliveredQuantity + line.FreeQuantity);
-        }
-
-        Models.SaleReturn? saleReturn = null;
-        decimal creditNoteAmount = 0;
-        if (request.Returns is { Count: > 0 })
-        {
-            saleReturn = new Models.SaleReturn
-            {
-                FK_OrderId = order.Id,
-                Mode = ReturnMode.CreditDeduction,
-                CreatedByUserId = currentUser.UserId ?? throw new InvalidOperationException("No authenticated user."),
-            };
-
-            foreach (var line in request.Returns)
-            {
-                if (line.Quantity <= 0)
-                    throw new InvalidOperationException("Return quantity must be greater than zero.");
-
-                var matchingOrderItem = orderItems.Values.FirstOrDefault(oi => oi.FK_ItemId == line.ItemId);
-                var unitPrice = matchingOrderItem?.UnitPrice
-                    ?? (await itemRepo.GetByIdAsync(line.ItemId))?.SalePrice
-                    ?? 0;
-
-                saleReturn.Items.Add(new SaleReturnItem
-                {
-                    FK_ItemId = line.ItemId,
-                    Quantity = line.Quantity,
-                    ReasonCode = line.ReasonCode,
-                    UnitPrice = unitPrice,
-                });
-            }
-
-            creditNoteAmount = saleReturn.Items.Sum(i => i.Quantity * i.UnitPrice);
-            saleReturn.TotalCreditAmount = creditNoteAmount;
-        }
-
-        decimal discountAmount = request.Discount switch
-        {
-            { Type: DiscountType.Amount } d => d.Value,
-            { Type: DiscountType.Percentage } d => subtotal * d.Value / 100m,
-            null => 0,
-            _ => 0,
-        };
-
-        invoice.TotalAmount = Math.Max(0, subtotal - discountAmount - creditNoteAmount);
-        invoice.Status = InvoiceStatus.Finalized;
-        invoice.FinalizedAt = DateTime.Now;
-        invoice.FinalizedByUserId = currentUser.UserId;
-        order.TotalAmount = invoice.TotalAmount;
-
-        await uow.BeginAsync(ct);
-        try
-        {
-            repo.Update(invoice);
-            orderRepo.Update(order);
-            if (saleReturn is not null)
-            {
-                await returnRepo.AddAsync(saleReturn);
-                await returnRepo.AddCreditNoteAsync(new CreditNote
-                {
-                    FK_SaleReturnId = saleReturn.Id,
-                    Amount = creditNoteAmount,
-                });
-            }
-            await uow.CommitAsync(ct);
-        }
-        catch
-        {
-            await uow.RollbackAsync(ct);
-            throw;
-        }
-
-        return ToResponse(invoice);
-    }
-}

Distribution/Features/Item/ItemDTOs.cs

@@ -20,8 +20,7 @@ public record UpdateItemRequest(
     Guid? SubCategoryId,
     Guid? BrandId,
     Guid BaseUomId,
-    decimal? SalePrice,
-    bool IsActive = true);
+    decimal? SalePrice);
 
 public record ReplaceConversionsRequest(List<UomConversionRequest> Conversions);
 

Distribution/Features/Item/ItemRepository.cs

@@ -20,14 +20,12 @@ public class ItemRepository(AppDBContext context) : IItemRepository
 
     public async Task<List<Models.Item>> GetAllAsync(Guid? categoryId = null, Guid? subCategoryId = null, Guid? brandId = null)
     {
-        // Deleted items stay IsActive=false but remain visible with an Inactive status —
-        // Delete never removes the row, only marks it (same rule as Orders/Stores).
         var query = context.Items
             .Include(i => i.Category)
             .Include(i => i.SubCategory)
             .Include(i => i.Brand)
             .Include(i => i.BaseUom)
-            .AsQueryable();
+            .Where(i => i.IsActive);
 
         if (categoryId.HasValue) query = query.Where(i => i.FK_CategoryId == categoryId);
         if (subCategoryId.HasValue) query = query.Where(i => i.FK_SubCategoryId == subCategoryId);

Distribution/Features/Item/ItemService.cs

@@ -32,7 +32,7 @@ public class ItemService(IItemRepository repo, IUnitOfWork uow)
     public async Task<ItemDetailResponse?> GetByIdAsync(Guid id)
     {
         var item = await repo.GetByIdAsync(id);
-        if (item is null) return null;
+        if (item is null || !item.IsActive) return null;
         return MapDetail(item);
     }
 
@@ -74,7 +74,7 @@ public class ItemService(IItemRepository repo, IUnitOfWork uow)
     public async Task<ItemDetailResponse?> UpdateAsync(Guid id, UpdateItemRequest request, CancellationToken ct = default)
     {
         var item = await repo.GetByIdAsync(id);
-        if (item is null) return null;
+        if (item is null || !item.IsActive) return null;
         if (item.SyncSource == Models.SyncSource.Erp) return null;
 
         item.Name = request.Name;
@@ -84,7 +84,6 @@ public class ItemService(IItemRepository repo, IUnitOfWork uow)
         item.FK_BrandId = request.BrandId;
         item.FK_BaseUomId = request.BaseUomId;
         item.SalePrice = request.SalePrice;
-        item.IsActive = request.IsActive;
 
         await uow.BeginAsync(ct);
         try { repo.Update(item); await uow.CommitAsync(ct); }

Distribution/Features/Order/IOrderRepository.cs

@@ -8,12 +8,8 @@ public interface IOrderRepository
     Task AddAsync(Models.Order entity);
     void Update(Models.Order entity);
     void Remove(Models.Order entity);
-    Task<List<Models.OrderItem>> GetItemsByOrderIdAsync(Guid orderId, bool includeHistory = false);
+    Task<List<Models.OrderItem>> GetItemsByOrderIdAsync(Guid orderId);
     Task<List<Models.Order>> GetByStoreIdAsync(Guid storeId);
     Task AddItemsAsync(IEnumerable<Models.OrderItem> items);
     Task<List<Models.Order>> GetPendingByRouteIdAsync(Guid routeId);
-
-    /// <summary>Confirmed POs (ConfirmedAt set, not cancelled) matching the optional filters —
-    /// backs Mode B's "office browses Confirmed POs" step per order_invoice_lifecycle.md.</summary>
-    Task<List<Models.Order>> GetConfirmedAsync(Guid? agentId, Guid? routeId, Guid? storeId);
 }

Distribution/Features/Order/OrderController.cs

@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Order;
 
@@ -10,10 +10,6 @@ public class OrderController(OrderService service) : ControllerBase
     public async Task<IActionResult> GetAll() =>
         Ok(await service.GetAllAsync());
 
-    [HttpGet("confirmed")]
-    public async Task<IActionResult> GetConfirmed([FromQuery] Guid? agentId, [FromQuery] Guid? routeId, [FromQuery] Guid? shopId) =>
-        Ok(await service.GetConfirmedAsync(agentId, routeId, shopId));
-
     [HttpGet("{id:guid}")]
     public async Task<IActionResult> GetById(Guid id)
     {
@@ -25,7 +21,7 @@ public class OrderController(OrderService service) : ControllerBase
     public async Task<IActionResult> GetByStore(Guid storeId)
     {
         var result = await service.GetByStoreIdAsync(storeId);
-        return result is null ? StatusCode(StatusCodes.Status403Forbidden) : Ok(result);
+        return result is null ? Forbid() : Ok(result);
     }
 
     [HttpPost]
@@ -34,40 +30,7 @@ public class OrderController(OrderService service) : ControllerBase
         try
         {
             var result = await service.CreateAsync(request, ct);
-            return result is null ? StatusCode(StatusCodes.Status403Forbidden) : CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
-        }
-        catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
-    }
-
-    [HttpPut("{id:guid}/items")]
-    public async Task<IActionResult> ReplaceItems(Guid id, UpdateOrderItemsRequest request, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.ReplaceItemsAsync(id, request, ct);
-            return result is null ? NotFound() : Ok(result);
-        }
-        catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
-    }
-
-    [HttpPost("{id:guid}/confirm")]
-    public async Task<IActionResult> Confirm(Guid id, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.ConfirmAsync(id, ct);
-            return result is null ? NotFound() : Ok(result);
-        }
-        catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
-    }
-
-    [HttpPost("{id:guid}/confirm-and-create-invoice")]
-    public async Task<IActionResult> ConfirmAndCreateInvoice(Guid id, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.ConfirmAndCreateInvoiceAsync(id, ct);
-            return result is null ? NotFound() : Ok(result);
+            return result is null ? Forbid() : CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
         }
         catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
     }
@@ -83,13 +46,6 @@ public class OrderController(OrderService service) : ControllerBase
         catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
     }
 
-    [HttpPost("{id:guid}/cancel")]
-    public async Task<IActionResult> Cancel(Guid id, CancellationToken ct)
-    {
-        var cancelled = await service.DeleteAsync(id, ct);
-        return cancelled ? NoContent() : NotFound();
-    }
-
     [HttpDelete("{id:guid}")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {

Distribution/Features/Order/OrderDTOs.cs

@@ -2,26 +2,19 @@ using Distribution.Models;
 
 namespace Distribution.Features.Order;
 
-public record CreateOrderItemRequest(Guid ItemId, int Quantity, decimal? UnitPrice);
-
-public record CreateOrderRequest(Guid StoreId, List<CreateOrderItemRequest> Items);
-
-public record UpdateOrderItemsRequest(List<CreateOrderItemRequest> Items);
+public record CreateOrderRequest(Guid SaleId);
 
 public record UpdateOrderRequest(OrderStatus Status);
 
-public record OrderItemResponse(Guid Id, Guid ItemId, int Quantity, int QuantityFulfilled, decimal UnitPrice);
+public record OrderItemResponse(Guid ItemId, int Quantity, int QuantityFulfilled, decimal UnitPrice);
 
 public record OrderResponse(
     Guid Id,
-    Guid? SaleId,
-    Guid? InvoiceId,
+    Guid SaleId,
     DateTime OrderDate,
     Guid StoreId,
-    Guid CreatedByUserId,
     decimal TotalAmount,
     OrderStatus Status,
-    DateTime? ConfirmedAt,
     DateTime? FulfilledAt,
     List<OrderItemResponse> Items,
     bool IsActive,

Distribution/Features/Order/OrderRepository.cs

@@ -28,10 +28,8 @@ public class OrderRepository(AppDBContext context) : IOrderRepository
         context.Orders.Update(entity);
     }
 
-    public async Task<List<Models.OrderItem>> GetItemsByOrderIdAsync(Guid orderId, bool includeHistory = false) =>
-        await context.OrderItems
-            .Where(oi => oi.FK_OrderId == orderId && (includeHistory || oi.IsActive))
-            .ToListAsync();
+    public async Task<List<Models.OrderItem>> GetItemsByOrderIdAsync(Guid orderId) =>
+        await context.OrderItems.Where(oi => oi.FK_OrderId == orderId).ToListAsync();
 
     public async Task<List<Models.Order>> GetByStoreIdAsync(Guid storeId) =>
         await context.Orders.Where(o => o.FK_StoreId == storeId && o.IsActive).ToListAsync();
@@ -42,21 +40,10 @@ public class OrderRepository(AppDBContext context) : IOrderRepository
     public async Task<List<Models.Order>> GetPendingByRouteIdAsync(Guid routeId) =>
         await context.Orders
             .Include(o => o.Store)
-            .Include(o => o.OrderItems.Where(i => i.IsActive))
+            .Include(o => o.OrderItems)
                 .ThenInclude(i => i.Item)
             .Where(o => o.IsActive
                 && o.Store.FK_RouteId == routeId
                 && (o.Status == OrderStatus.Pending || o.Status == OrderStatus.PartiallyFulfilled))
             .ToListAsync();
-
-    public async Task<List<Models.Order>> GetConfirmedAsync(Guid? agentId, Guid? routeId, Guid? storeId) =>
-        await context.Orders
-            .Include(o => o.Store)
-            .Where(o => o.IsActive
-                && o.ConfirmedAt != null
-                && o.Status != OrderStatus.Cancelled
-                && (agentId == null || o.CreatedByUserId == agentId)
-                && (routeId == null || o.Store.FK_RouteId == routeId)
-                && (storeId == null || o.FK_StoreId == storeId))
-            .ToListAsync();
 }

Distribution/Features/Order/OrderService.cs

@@ -1,13 +1,11 @@
-using Distribution.Features.Invoice;
+using Distribution.Features.Sale;
 using Distribution.Features.Item;
 using Distribution.Features.PriceList;
-using Distribution.Features.Sale;
 using Distribution.Features.Store;
 using Distribution.Features.Stock;
 using Distribution.Infra.Authorization;
 using Distribution.Infra.UoW;
 using Distribution.Models;
-using Microsoft.Extensions.Configuration;
 
 namespace Distribution.Features.Order;
 
@@ -18,30 +16,19 @@ public class OrderService(
     IStockRepository stockRepo,
     PriceListService priceListService,
     ISaleRepository saleRepo,
-    IInvoiceRepository invoiceRepo,
     IUnitOfWork uow,
     ICurrentUserService currentUser,
-    IScopeAccessService scopeAccess,
-    IConfiguration configuration)
+    IScopeAccessService scopeAccess)
 {
     private const int GlobalScopeRoleLevel = 50;
 
     private static OrderResponse ToResponse(Models.Order o, List<Models.OrderItem> items) =>
-        new(o.Id, o.FK_SaleId, o.InvoiceId, o.OrderDate, o.FK_StoreId, o.CreatedByUserId, o.TotalAmount, o.Status,
-            o.ConfirmedAt, o.FulfilledAt,
-            items.Select(i => new OrderItemResponse(i.Id, i.FK_ItemId, i.Quantity, i.QuantityFulfilled, i.UnitPrice)).ToList(),
+        new(o.Id, o.FK_SaleId, o.OrderDate, o.FK_StoreId, o.TotalAmount, o.Status, o.FulfilledAt,
+            items.Select(i => new OrderItemResponse(i.FK_ItemId, i.Quantity, i.QuantityFulfilled, i.UnitPrice)).ToList(),
             o.IsActive, o.CreatedAt);
 
     private bool HasGlobalScope => currentUser.RoleLevel >= GlobalScopeRoleLevel;
 
-    /// <summary>The active InvoiceCreationMode ("A" = combined confirm+create-invoice,
-    /// "B" = separate confirm then create-invoice) per order_invoice_lifecycle.md. Exactly one is
-    /// reachable at a time.</summary>
-    private InvoiceCreationMode ActiveMode =>
-        configuration.GetValue<string>("OrderInvoice:InvoiceCreationMode") == "A"
-            ? InvoiceCreationMode.A
-            : InvoiceCreationMode.B;
-
     private async Task<bool> HasStoreScopeAsync(Guid storeId)
     {
         if (HasGlobalScope || currentUser.UserId is null) return HasGlobalScope;
@@ -50,9 +37,7 @@ public class OrderService(
 
     public async Task<List<OrderResponse>> GetAllAsync()
     {
-        // Deleted orders stay IsActive=false but remain visible with a Cancelled status —
-        // Delete never removes the row from the list, only marks it cancelled.
-        var orders = (await repo.GetAllAsync()).ToList();
+        var orders = (await repo.GetAllAsync()).Where(o => o.IsActive).ToList();
         if (!HasGlobalScope && currentUser.UserId is not null)
         {
             var accessibleStoreIds = (await scopeAccess.GetAccessibleStoreIdsAsync(currentUser.UserId.Value)).ToHashSet();
@@ -89,273 +74,63 @@ public class OrderService(
         return result;
     }
 
-    /// <summary>Confirmed POs matching the given filters — Mode B's "office browses Confirmed POs"
-    /// step. Also usable as a general Confirmed-PO listing regardless of active mode.</summary>
-    public async Task<List<OrderResponse>> GetConfirmedAsync(Guid? agentId, Guid? routeId, Guid? storeId)
-    {
-        var orders = await repo.GetConfirmedAsync(agentId, routeId, storeId);
-        var result = new List<OrderResponse>();
-        foreach (var order in orders)
-        {
-            var items = await repo.GetItemsByOrderIdAsync(order.Id);
-            result.Add(ToResponse(order, items));
-        }
-        return result;
-    }
-
-    private async Task<decimal> ResolveUnitPriceAsync(Guid itemId, decimal? requestedUnitPrice, Guid storeId, DateTime orderDate)
-    {
-        if (requestedUnitPrice.HasValue) return requestedUnitPrice.Value;
-        var resolution = await priceListService.ResolveByStoreAsync(itemId, storeId, orderDate);
-        if (resolution is not null) return resolution.Price;
-        var item = await itemRepo.GetByIdAsync(itemId)
-            ?? throw new InvalidOperationException($"Item {itemId} not found");
-        return item.SalePrice
-            ?? throw new InvalidOperationException($"Could not resolve a price for item {itemId} — no price list covers it and it has no catalogue SalePrice");
-    }
-
-    /// <summary>Creates a Shop PO independent of any Sale — the entry point to the pipeline per
-    /// order_invoice_lifecycle.md. Items are freely editable until Confirm.</summary>
     public async Task<OrderResponse?> CreateAsync(CreateOrderRequest request, CancellationToken ct = default)
     {
-        var store = await storeRepo.GetByIdAsync(request.StoreId);
-        if (store is null || !store.IsActive) return null;
-        if (!await HasStoreScopeAsync(request.StoreId)) return null;
-        if (request.Items is null || request.Items.Count == 0)
-            throw new InvalidOperationException("A PO must have at least one line item.");
+        var sale = await saleRepo.GetByIdAsync(request.SaleId);
+        if (sale is null || !sale.IsActive) return null;
+        if (!await HasStoreScopeAsync(sale.FK_StoreId)) return null;
 
-        var order = new Models.Order
-        {
-            FK_StoreId = request.StoreId,
-            OrderDate = DateTime.Now,
-            CreatedByUserId = currentUser.UserId ?? throw new InvalidOperationException("No authenticated user."),
-            Status = OrderStatus.Pending,
-        };
+        var existingOrder = await repo.GetBySaleIdAsync(request.SaleId)
+            ?? throw new InvalidOperationException("Orders are created automatically from sales");
 
-        var items = new List<Models.OrderItem>();
-        foreach (var line in request.Items)
-        {
-            var unitPrice = await ResolveUnitPriceAsync(line.ItemId, line.UnitPrice, request.StoreId, order.OrderDate);
-            items.Add(new Models.OrderItem
-            {
-                FK_OrderId = order.Id,
-                FK_ItemId = line.ItemId,
-                Quantity = line.Quantity,
-                UnitPrice = unitPrice,
-                IsActive = true,
-            });
-        }
-        order.TotalAmount = items.Sum(i => i.Quantity * i.UnitPrice);
-
-        await uow.BeginAsync(ct);
-        try
-        {
-            await repo.AddAsync(order);
-            await repo.AddItemsAsync(items);
-            await uow.CommitAsync(ct);
-        }
-        catch
-        {
-            await uow.RollbackAsync(ct);
-            throw;
-        }
-
-        return ToResponse(order, items);
-    }
-
-    /// <summary>Rewrites a Shop PO's line items — every edit soft-deletes the current active rows
-    /// and writes a fresh set (active = latest version, soft-deleted = history). Only allowed before
-    /// confirmation.</summary>
-    public async Task<OrderResponse?> ReplaceItemsAsync(Guid id, UpdateOrderItemsRequest request, CancellationToken ct = default)
-    {
-        var order = await repo.GetByIdAsync(id);
-        if (order is null || !order.IsActive) return null;
-        if (!await HasStoreScopeAsync(order.FK_StoreId)) return null;
-        if (order.ConfirmedAt is not null)
-            throw new InvalidOperationException("Items are locked once the PO is confirmed.");
-        if (request.Items is null || request.Items.Count == 0)
-            throw new InvalidOperationException("A PO must have at least one line item.");
-
-        var currentItems = await repo.GetItemsByOrderIdAsync(id);
-        foreach (var item in currentItems)
-            item.IsActive = false;
-
-        var newItems = new List<Models.OrderItem>();
-        foreach (var line in request.Items)
-        {
-            var unitPrice = await ResolveUnitPriceAsync(line.ItemId, line.UnitPrice, order.FK_StoreId, order.OrderDate);
-            newItems.Add(new Models.OrderItem
-            {
-                FK_OrderId = order.Id,
-                FK_ItemId = line.ItemId,
-                Quantity = line.Quantity,
-                UnitPrice = unitPrice,
-                IsActive = true,
-            });
-        }
-        order.TotalAmount = newItems.Sum(i => i.Quantity * i.UnitPrice);
-
-        await uow.BeginAsync(ct);
-        try
-        {
-            // currentItems came from the tracked DbContext (OrderRepository does not use
-            // AsNoTracking), so flipping IsActive above is enough for SaveChanges to persist it —
-            // no explicit repo.Update call needed for the soft-deleted rows.
-            await repo.AddItemsAsync(newItems);
-            repo.Update(order);
-            await uow.CommitAsync(ct);
-        }
-        catch
-        {
-            await uow.RollbackAsync(ct);
-            throw;
-        }
-
-        return ToResponse(order, newItems);
-    }
-
-    /// <summary>Mode B — confirms the PO (locks items) without creating an Invoice. The Invoice is
-    /// created separately later via InvoiceService.CreateAsync.</summary>
-    public async Task<OrderResponse?> ConfirmAsync(Guid id, CancellationToken ct = default)
-    {
-        if (ActiveMode != InvoiceCreationMode.B)
-            throw new InvalidOperationException("Separate confirm is not enabled — this system uses InvoiceCreationMode A.");
-
-        var order = await repo.GetByIdAsync(id);
-        if (order is null || !order.IsActive) return null;
-        if (!await HasStoreScopeAsync(order.FK_StoreId)) return null;
-        if (order.Status == OrderStatus.Cancelled)
-            throw new InvalidOperationException("Cannot confirm a cancelled PO.");
-        if (order.ConfirmedAt is not null) return ToResponse(order, await repo.GetItemsByOrderIdAsync(id));
-
-        order.ConfirmedAt = DateTime.Now;
-        order.ConfirmedByUserId = currentUser.UserId;
-
-        await uow.BeginAsync(ct);
-        try
-        {
-            repo.Update(order);
-            await uow.CommitAsync(ct);
-        }
-        catch
-        {
-            await uow.RollbackAsync(ct);
-            throw;
-        }
-
-        var items = await repo.GetItemsByOrderIdAsync(id);
-        return ToResponse(order, items);
-    }
-
-    /// <summary>Mode A — confirms the PO and creates its Invoice (Draft) atomically in one
-    /// transaction.</summary>
-    public async Task<OrderResponse?> ConfirmAndCreateInvoiceAsync(Guid id, CancellationToken ct = default)
-    {
-        if (ActiveMode != InvoiceCreationMode.A)
-            throw new InvalidOperationException("Combined confirm-and-create-invoice is not enabled — this system uses InvoiceCreationMode B.");
-
-        var order = await repo.GetByIdAsync(id);
-        if (order is null || !order.IsActive) return null;
-        if (!await HasStoreScopeAsync(order.FK_StoreId)) return null;
-        if (order.Status == OrderStatus.Cancelled)
-            throw new InvalidOperationException("Cannot confirm a cancelled PO.");
-        if (order.InvoiceId is not null)
-            throw new InvalidOperationException("An Invoice already exists for this PO.");
-
-        var items = await repo.GetItemsByOrderIdAsync(id);
-        var invoice = new Models.Invoice
-        {
-            FK_OrderId = order.Id,
-            Status = InvoiceStatus.Draft,
-            CreatedByUserId = currentUser.UserId ?? throw new InvalidOperationException("No authenticated user."),
-            TotalAmount = order.TotalAmount,
-        };
-
-        order.ConfirmedAt ??= DateTime.Now;
-        order.ConfirmedByUserId ??= currentUser.UserId;
-        order.InvoiceId = invoice.Id;
-
-        await uow.BeginAsync(ct);
-        try
-        {
-            await invoiceRepo.AddAsync(invoice);
-            repo.Update(order);
-            await uow.CommitAsync(ct);
-        }
-        catch
-        {
-            await uow.RollbackAsync(ct);
-            throw;
-        }
-
-        return ToResponse(order, items);
+        var items = await repo.GetItemsByOrderIdAsync(existingOrder.Id);
+        return ToResponse(existingOrder, items);
     }
 
     public async Task<OrderResponse?> UpdateAsync(Guid id, UpdateOrderRequest request, CancellationToken ct = default)
     {
-        // TEMPORARY: see DeleteAsync/SaleService — store-scope enforcement depends on the broken
-        // auth middleware (testbug.md #28) and would reject every update. Skipped for now.
         var order = await repo.GetByIdAsync(id);
         if (order is null || !order.IsActive) return null;
+        if (!await HasStoreScopeAsync(order.FK_StoreId)) return null;
+
+        var sale = await saleRepo.GetByIdAsync(order.FK_SaleId)
+            ?? throw new InvalidOperationException("Sale not found for this order");
 
         order.Status = request.Status;
         order.FulfilledAt = request.Status == OrderStatus.Fulfilled ? DateTime.Now : null;
 
-        if (order.FK_SaleId is Guid saleId)
+        sale.Status = request.Status switch
         {
-            var sale = await saleRepo.GetByIdAsync(saleId)
-                ?? throw new InvalidOperationException("Sale not found for this order");
-            sale.Status = request.Status switch
-            {
-                OrderStatus.Fulfilled => SaleStatus.Completed,
-                OrderStatus.Cancelled => SaleStatus.Cancelled,
-                _ => SaleStatus.Pending
-            };
-            sale.CompletedAt = request.Status == OrderStatus.Fulfilled ? DateTime.Now : null;
+            OrderStatus.Fulfilled => SaleStatus.Completed,
+            OrderStatus.Cancelled => SaleStatus.Cancelled,
+            _ => SaleStatus.Pending
+        };
+        sale.CompletedAt = request.Status == OrderStatus.Fulfilled ? DateTime.Now : null;
 
-            await uow.BeginAsync(ct);
-            try
-            {
-                repo.Update(order);
-                saleRepo.Update(sale);
-                await uow.CommitAsync(ct);
-            }
-            catch
-            {
-                await uow.RollbackAsync(ct);
-                throw;
-            }
-        }
-        else
+        await uow.BeginAsync(ct);
+        try
         {
-            await uow.BeginAsync(ct);
-            try
-            {
-                repo.Update(order);
-                await uow.CommitAsync(ct);
-            }
-            catch
-            {
-                await uow.RollbackAsync(ct);
-                throw;
-            }
+            repo.Update(order);
+            saleRepo.Update(sale);
+            await uow.CommitAsync(ct);
+        }
+        catch
+        {
+            await uow.RollbackAsync(ct);
+            throw;
         }
 
         var items = await repo.GetItemsByOrderIdAsync(id);
         return ToResponse(order, items);
     }
 
-    /// <summary>Cancels a Shop PO or Confirmed PO. If an Invoice was already created for this PO,
-    /// the Invoice/loading-sheet cascade is an explicitly unresolved open question in
-    /// order_invoice_lifecycle.md (Open Question 5) — the Invoice is left untouched here.</summary>
     public async Task<bool> DeleteAsync(Guid id, CancellationToken ct = default)
     {
-        // TEMPORARY: see SaleService — store-scope enforcement depends on the broken auth
-        // middleware (testbug.md #28) and would reject every delete. Skipped for now.
         var order = await repo.GetByIdAsync(id);
         if (order is null || !order.IsActive) return false;
+        if (!await HasStoreScopeAsync(order.FK_StoreId)) return false;
 
-        var sale = order.FK_SaleId is Guid saleId ? await saleRepo.GetByIdAsync(saleId) : null;
+        var sale = await saleRepo.GetByIdAsync(order.FK_SaleId);
 
         await uow.BeginAsync(ct);
         try

Distribution/Features/Payment/FlatPaymentController.cs

@@ -29,7 +29,7 @@ public class FlatPaymentController(PaymentService service) : ControllerBase
     {
         try
         {
-            var inner = new CreatePaymentRequest(request.Amount, request.Method, request.CollectedByUserId);
+            var inner = new CreatePaymentRequest(request.Amount, request.Method);
             var result = await service.CreateAsync(request.SaleId, inner, ct);
             return result is null ? NotFound(new { error = "Sale not found or access denied" }) : Ok(result);
         }

Distribution/Features/Payment/PaymentDTOs.cs

@@ -2,17 +2,9 @@ using Distribution.Models;
 
 namespace Distribution.Features.Payment;
 
-public record CreatePaymentRequest(
-    decimal Amount,
-    PaymentMethod Method,
-    // TEMPORARY: auth middleware doesn't resolve a logged-in user yet — see testbug.md #28.
-    Guid? CollectedByUserId = null);
+public record CreatePaymentRequest(decimal Amount, PaymentMethod Method);
 
-public record CreateFlatPaymentRequest(
-    Guid SaleId,
-    decimal Amount,
-    PaymentMethod Method,
-    Guid? CollectedByUserId = null);
+public record CreateFlatPaymentRequest(Guid SaleId, decimal Amount, PaymentMethod Method);
 
 public record PaymentResponse(
     Guid Id,

Distribution/Features/Payment/PaymentService.cs

@@ -44,10 +44,7 @@ public class PaymentService(
         if (sale.Status == SaleStatus.Cancelled)
             throw new InvalidOperationException("Cannot record a payment against a cancelled sale");
 
-        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
-        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
-        var userId = currentUser.UserId ?? request.CollectedByUserId
-            ?? throw new InvalidOperationException("CollectedByUserId is required while auth is unavailable");
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
 
         var payment = new Models.Payment
         {

Distribution/Features/PriceList/PriceListController.cs

@@ -10,13 +10,6 @@ public class PriceListController(PriceListService service) : ControllerBase
     public async Task<IActionResult> GetAll([FromQuery] Guid? regionId) =>
         Ok(await service.GetAllAsync(regionId));
 
-    [HttpGet("resolve")]
-    public async Task<IActionResult> Resolve([FromQuery] Guid itemId, [FromQuery] Guid storeId, [FromQuery] DateTime saleDate)
-    {
-        var result = await service.ResolveByStoreAsync(itemId, storeId, saleDate);
-        return result is null ? NotFound() : Ok(result);
-    }
-
     [HttpGet("{id:guid}")]
     public async Task<IActionResult> GetById(Guid id)
     {
@@ -69,14 +62,7 @@ public class PriceListController(PriceListService service) : ControllerBase
     [HttpDelete("{id:guid}/items/{sku}")]
     public async Task<IActionResult> RemoveItem(Guid id, string sku, CancellationToken ct)
     {
-        try
-        {
-            var result = await service.RemoveItemAsync(id, sku, ct);
-            return result is null ? NotFound() : Ok(result);
-        }
-        catch (InvalidOperationException ex)
-        {
-            return Conflict(new { error = ex.Message });
-        }
+        var result = await service.RemoveItemAsync(id, sku, ct);
+        return result is null ? NotFound() : Ok(result);
     }
 }

Distribution/Features/PriceList/PriceListDTOs.cs

@@ -2,30 +2,16 @@ namespace Distribution.Features.PriceList;
 
 public record CreatePriceListRequest(string Name, Guid? RegionId, DateTime EffectiveFrom, DateTime EffectiveTo);
 
-public record UpdatePriceListRequest(string Name, Guid? RegionId, DateTime EffectiveFrom, DateTime EffectiveTo, bool IsActive);
+public record UpdatePriceListRequest(string Name, Guid? RegionId, DateTime EffectiveFrom, DateTime EffectiveTo);
 
-public record UpsertPriceListItemRequest(
-    decimal Price,
-    decimal? MinPrice = null,
-    decimal? RetailPrice = null,
-    decimal? AgencyMarginPercent = null);
+public record UpsertPriceListItemRequest(decimal Price, decimal? MinPrice = null);
 
-public record PriceListItemResponse(
-    Guid Id,
-    Guid ItemId,
-    string Sku,
-    string ItemName,
-    decimal Price,
-    decimal? MinPrice,
-    decimal? RetailPrice,
-    decimal? AgencyMarginPercent);
+public record PriceListItemResponse(Guid Id, Guid ItemId, string Sku, string ItemName, decimal Price, decimal? MinPrice);
 
 /// <summary>
-/// A resolved price with its negotiable floor, plus the informational retail price and agency
-/// margin when the resolution came from an actual PriceListItem (both null on the Item.SalePrice
-/// fallback, since neither is tracked at the item level).
+/// A resolved price with its negotiable floor. MinPrice null = no negotiation, Price is fixed.
 /// </summary>
-public record PriceResolution(decimal Price, decimal? MinPrice, decimal? RetailPrice, decimal? AgencyMarginPercent);
+public record PriceResolution(decimal Price, decimal? MinPrice);
 
 public record PriceListResponse(
     Guid Id,

Distribution/Features/PriceList/PriceListRepository.cs

@@ -13,7 +13,9 @@ public class PriceListRepository(AppDBContext context) : IPriceListRepository
 
     public async Task<List<Models.PriceList>> GetAllAsync(Guid? regionId = null)
     {
-        var query = context.PriceLists.Include(pl => pl.Region).AsQueryable();
+        var query = context.PriceLists
+            .Include(pl => pl.Region)
+            .Where(pl => pl.IsActive);
 
         if (regionId.HasValue) query = query.Where(pl => pl.FK_RegionId == regionId);
 

Distribution/Features/PriceList/PriceListService.cs

@@ -1,13 +1,12 @@
 using Distribution.Features.Item;
-using Distribution.Features.Store;
 using Distribution.Infra.UoW;
 
 namespace Distribution.Features.PriceList;
 
-public class PriceListService(IPriceListRepository repo, IItemRepository itemRepo, IStoreRepository storeRepo, IUnitOfWork uow)
+public class PriceListService(IPriceListRepository repo, IItemRepository itemRepo, IUnitOfWork uow)
 {
     private static PriceListItemResponse MapItem(Models.PriceListItem i) =>
-        new(i.Id, i.FK_ItemId, i.Item.Sku, i.Item.Name, i.Price, i.MinPrice, i.RetailPrice, i.AgencyMarginPercent);
+        new(i.Id, i.FK_ItemId, i.Item.Sku, i.Item.Name, i.Price, i.MinPrice);
 
     private static PriceListResponse MapDetail(Models.PriceList pl) =>
         new(pl.Id, pl.Name, pl.FK_RegionId, pl.Region?.Name,
@@ -25,7 +24,7 @@ public class PriceListService(IPriceListRepository repo, IItemRepository itemRep
     public async Task<PriceListResponse?> GetByIdAsync(Guid id)
     {
         var pl = await repo.GetByIdAsync(id);
-        if (pl is null) return null;
+        if (pl is null || !pl.IsActive) return null;
         return MapDetail(pl);
     }
 
@@ -49,7 +48,7 @@ public class PriceListService(IPriceListRepository repo, IItemRepository itemRep
     public async Task<PriceListResponse?> UpdateAsync(Guid id, UpdatePriceListRequest request, CancellationToken ct = default)
     {
         var priceList = await repo.GetByIdAsync(id);
-        if (priceList is null) return null;
+        if (priceList is null || !priceList.IsActive) return null;
 
         foreach (var item in priceList.Items.Where(i => i.IsActive))
         {
@@ -62,7 +61,6 @@ public class PriceListService(IPriceListRepository repo, IItemRepository itemRep
         priceList.FK_RegionId = request.RegionId;
         priceList.EffectiveFrom = request.EffectiveFrom;
         priceList.EffectiveTo = request.EffectiveTo;
-        priceList.IsActive = request.IsActive;
 
         await uow.BeginAsync(ct);
         try { repo.Update(priceList); await uow.CommitAsync(ct); }
@@ -92,9 +90,7 @@ public class PriceListService(IPriceListRepository repo, IItemRepository itemRep
     public async Task<PriceListResponse?> UpsertItemAsync(Guid priceListId, string sku, UpsertPriceListItemRequest request, CancellationToken ct = default)
     {
         var priceList = await repo.GetByIdAsync(priceListId);
-        if (priceList is null) return null;
-        if (!priceList.IsActive)
-            throw new InvalidOperationException("Cannot price items on an inactive price list. Reactivate it first.");
+        if (priceList is null || !priceList.IsActive) return null;
 
         var item = await itemRepo.GetBySkuAsync(sku);
         if (item is null) return null;
@@ -103,13 +99,6 @@ public class PriceListService(IPriceListRepository repo, IItemRepository itemRep
             throw new InvalidOperationException(
                 $"MinPrice ({request.MinPrice}) cannot exceed Price ({request.Price}) for item '{sku}'.");
 
-        if (request.RetailPrice.HasValue && request.RetailPrice.Value < request.Price)
-            throw new InvalidOperationException(
-                $"RetailPrice ({request.RetailPrice}) cannot be less than Price ({request.Price}) for item '{sku}' — the store would sell at a loss.");
-
-        if (request.AgencyMarginPercent is < 0 or > 100)
-            throw new InvalidOperationException("AgencyMarginPercent must be between 0 and 100.");
-
         if (await repo.HasOverlapAsync(item.Id, priceList.FK_RegionId, priceList.EffectiveFrom, priceList.EffectiveTo, priceListId))
             throw new InvalidOperationException(
                 $"Overlapping price list already exists for item '{sku}' in the same region for this date range.");
@@ -126,17 +115,13 @@ public class PriceListService(IPriceListRepository repo, IItemRepository itemRep
                     FK_PriceListId = priceListId,
                     FK_ItemId = item.Id,
                     Price = request.Price,
-                    MinPrice = request.MinPrice,
-                    RetailPrice = request.RetailPrice,
-                    AgencyMarginPercent = request.AgencyMarginPercent
+                    MinPrice = request.MinPrice
                 });
             }
             else
             {
                 existing.Price = request.Price;
                 existing.MinPrice = request.MinPrice;
-                existing.RetailPrice = request.RetailPrice;
-                existing.AgencyMarginPercent = request.AgencyMarginPercent;
                 repo.UpdateItem(existing);
             }
             await uow.CommitAsync(ct);
@@ -149,9 +134,7 @@ public class PriceListService(IPriceListRepository repo, IItemRepository itemRep
     public async Task<PriceListResponse?> RemoveItemAsync(Guid priceListId, string sku, CancellationToken ct = default)
     {
         var priceList = await repo.GetByIdAsync(priceListId);
-        if (priceList is null) return null;
-        if (!priceList.IsActive)
-            throw new InvalidOperationException("Cannot remove items from an inactive price list. Reactivate it first.");
+        if (priceList is null || !priceList.IsActive) return null;
 
         var item = await itemRepo.GetBySkuAsync(sku);
         if (item is null) return null;
@@ -177,36 +160,12 @@ public class PriceListService(IPriceListRepository repo, IItemRepository itemRep
         if (regionId.HasValue)
         {
             var regionMatches = await repo.GetActiveItemsAsync(itemId, regionId, orderDate);
-            if (regionMatches.Count > 0)
-            {
-                var m = regionMatches[0];
-                return new PriceResolution(m.Price, m.MinPrice, m.RetailPrice, m.AgencyMarginPercent);
-            }
+            if (regionMatches.Count > 0) return new PriceResolution(regionMatches[0].Price, regionMatches[0].MinPrice);
         }
 
         var globalMatches = await repo.GetActiveItemsAsync(itemId, null, orderDate);
-        if (globalMatches.Count > 0)
-        {
-            var m = globalMatches[0];
-            return new PriceResolution(m.Price, m.MinPrice, m.RetailPrice, m.AgencyMarginPercent);
-        }
+        if (globalMatches.Count > 0) return new PriceResolution(globalMatches[0].Price, globalMatches[0].MinPrice);
 
-        return itemSalePrice.HasValue ? new PriceResolution(itemSalePrice.Value, null, null, null) : null;
-    }
-
-    /// <summary>
-    /// Same resolution `SaleService.ResolveUnitPriceAsync` uses internally, exposed read-only so
-    /// the frontend can show the real price (region/date-scoped price list, else Item.SalePrice)
-    /// before a sale is ever submitted, instead of guessing from the flat catalogue price.
-    /// </summary>
-    public async Task<PriceResolution?> ResolveByStoreAsync(Guid itemId, Guid storeId, DateTime saleDate)
-    {
-        var item = await itemRepo.GetByIdAsync(itemId);
-        if (item is null) return null;
-
-        var store = await storeRepo.GetByIdWithRegionAsync(storeId);
-        if (store is null) return null;
-
-        return await ResolvePriceAsync(itemId, store.Route?.FK_RegionId, item.SalePrice, saleDate);
+        return itemSalePrice.HasValue ? new PriceResolution(itemSalePrice.Value, null) : null;
     }
 }

Distribution/Features/PurchaseOrder/PoController.cs

@@ -22,13 +22,10 @@ public class PoController(PoService service, ICurrentUserService currentUser) :
     [HttpPost]
     public async Task<IActionResult> Create(CreatePoRequest request, CancellationToken ct)
     {
-        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
-        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
-        var userId = currentUser.UserId ?? request.CreatedByUserId;
-        if (userId is null) return BadRequest(new { error = "CreatedByUserId is required while auth is unavailable" });
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
         try
         {
-            var result = await service.CreateAsync(request, userId.Value, ct);
+            var result = await service.CreateAsync(request, userId, ct);
             return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
         }
         catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }

Distribution/Features/PurchaseOrder/PoDTOs.cs

@@ -4,11 +4,7 @@ namespace Distribution.Features.Po;
 
 public record PoItemRequest(Guid ItemId, int Quantity, decimal UnitCost);
 
-public record CreatePoRequest(
-    Guid SupplierId,
-    List<PoItemRequest> Items,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? CreatedByUserId = null);
+public record CreatePoRequest(Guid SupplierId, List<PoItemRequest> Items);
 
 /// <summary>
 /// Update line: PurchaseOrderItemId set = update an existing unreceived line (Quantity/UnitCost),

Distribution/Features/PurchaseReturn/PurchaseReturnController.cs

@@ -20,13 +20,10 @@ public class PurchaseReturnController(PurchaseReturnService service, ICurrentUse
     [HttpPost("api/purchase-orders/{id:guid}/returns")]
     public async Task<IActionResult> Create(Guid id, CreatePurchaseReturnRequest request, CancellationToken ct)
     {
-        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
-        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
-        var userId = currentUser.UserId ?? request.CreatedByUserId;
-        if (userId is null) return BadRequest(new { error = "CreatedByUserId is required while auth is unavailable" });
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
         try
         {
-            var result = await service.CreateAsync(id, request, userId.Value, ct);
+            var result = await service.CreateAsync(id, request, userId, ct);
             return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
         }
         catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }

Distribution/Features/PurchaseReturn/PurchaseReturnDTOs.cs

@@ -2,11 +2,7 @@ namespace Distribution.Features.PurchaseReturn;
 
 public record PurchaseReturnItemRequest(Guid ItemId, int Quantity);
 
-public record CreatePurchaseReturnRequest(
-    string Reason,
-    List<PurchaseReturnItemRequest> Items,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? CreatedByUserId = null);
+public record CreatePurchaseReturnRequest(string Reason, List<PurchaseReturnItemRequest> Items);
 
 public record PurchaseReturnItemResponse(Guid Id, Guid ItemId, string Sku, string ItemName, int Quantity);
 

Distribution/Features/PurchaseReturn/PurchaseReturnService.cs

@@ -104,8 +104,6 @@ public class PurchaseReturnService(
                     FK_ItemId = line.FK_ItemId,
                     FromLocationId = warehouseId,
                     FromLocationType = LocationType.Warehouse,
-                    ToLocationId = StockService.ExternalLocationId,
-                    ToLocationType = LocationType.External,
                     Quantity = line.Quantity,
                     Type = MovementType.PurchaseReturn,
                     ReasonCode = request.Reason,

Distribution/Features/Returns/IReturnRepository.cs

@@ -3,10 +3,8 @@ namespace Distribution.Features.Returns;
 public interface IReturnRepository
 {
     Task<Models.SaleReturn?> GetByIdAsync(Guid id);
-    Task<List<Models.SaleReturn>> GetAllAsync();
     Task<List<Models.SaleReturn>> GetByOrderIdAsync(Guid orderId);
     Task AddAsync(Models.SaleReturn entity);
-    void Update(Models.SaleReturn entity);
     Task AddCreditNoteAsync(Models.CreditNote entity);
 
     /// <summary>Whether this store has ever had this item on any of its (active) orders.</summary>

Distribution/Features/Returns/ReturnController.cs

@@ -6,10 +6,6 @@ namespace Distribution.Features.Returns;
 [ApiController]
 public class ReturnController(ReturnService service, ICurrentUserService currentUser) : ControllerBase
 {
-    [HttpGet("api/returns")]
-    public async Task<IActionResult> GetAll() =>
-        Ok(await service.GetAllAsync());
-
     [HttpGet("api/returns/{id:guid}")]
     public async Task<IActionResult> GetById(Guid id)
     {
@@ -17,17 +13,6 @@ public class ReturnController(ReturnService service, ICurrentUserService current
         return result is null ? NotFound() : Ok(result);
     }
 
-    [HttpPatch("api/returns/{id:guid}/reasons")]
-    public async Task<IActionResult> UpdateReasons(Guid id, UpdateSaleReturnReasonsRequest request, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.UpdateReasonsAsync(id, request, ct);
-            return Ok(result);
-        }
-        catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
-    }
-
     [HttpGet("api/orders/{id:guid}/returns")]
     public async Task<IActionResult> GetByOrder(Guid id) =>
         Ok(await service.GetByOrderIdAsync(id));
@@ -35,13 +20,10 @@ public class ReturnController(ReturnService service, ICurrentUserService current
     [HttpPost("api/orders/{id:guid}/returns")]
     public async Task<IActionResult> Create(Guid id, CreateSaleReturnRequest request, CancellationToken ct)
     {
-        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
-        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
-        var userId = currentUser.UserId ?? request.CreatedByUserId;
-        if (userId is null) return BadRequest(new { error = "CreatedByUserId is required while auth is unavailable" });
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
         try
         {
-            var result = await service.CreateAsync(id, request, userId.Value, ct);
+            var result = await service.CreateAsync(id, request, userId, ct);
             return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
         }
         catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }

Distribution/Features/Returns/ReturnDTOs.cs

@@ -4,17 +4,7 @@ namespace Distribution.Features.Returns;
 
 public record ReturnItemRequest(Guid ItemId, decimal Quantity, ReturnReasonCode ReasonCode);
 
-public record CreateSaleReturnRequest(
-    ReturnMode Mode,
-    List<ReturnItemRequest> Items,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? CreatedByUserId = null);
-
-// The return's financial/stock effect (credit, order total, vehicle stock credit) is applied
-// immediately on create with no separate approval step, so quantities/mode can never be edited
-// after the fact without desyncing stock and order totals. Only each line's reason code is editable.
-public record UpdateReturnReasonItem(Guid ItemId, ReturnReasonCode ReasonCode);
-public record UpdateSaleReturnReasonsRequest(List<UpdateReturnReasonItem> Items);
+public record CreateSaleReturnRequest(ReturnMode Mode, List<ReturnItemRequest> Items);
 
 public record SaleReturnItemResponse(
     Guid Id,

Distribution/Features/Returns/ReturnRepository.cs

@@ -11,14 +11,6 @@ public class ReturnRepository(AppDBContext context) : IReturnRepository
             .Include(r => r.Items).ThenInclude(i => i.Item)
             .FirstOrDefaultAsync(r => r.Id == id);
 
-    public async Task<List<Models.SaleReturn>> GetAllAsync() =>
-        await context.SaleReturns
-            .Include(r => r.Order)
-            .Include(r => r.Items).ThenInclude(i => i.Item)
-            .Where(r => r.IsActive)
-            .OrderByDescending(r => r.CreatedAt)
-            .ToListAsync();
-
     public async Task<List<Models.SaleReturn>> GetByOrderIdAsync(Guid orderId) =>
         await context.SaleReturns
             .Include(r => r.Order)
@@ -30,9 +22,6 @@ public class ReturnRepository(AppDBContext context) : IReturnRepository
     public async Task AddAsync(Models.SaleReturn entity) =>
         await context.SaleReturns.AddAsync(entity);
 
-    public void Update(Models.SaleReturn entity) =>
-        context.SaleReturns.Update(entity);
-
     public async Task AddCreditNoteAsync(Models.CreditNote entity) =>
         await context.CreditNotes.AddAsync(entity);
 

Distribution/Features/Returns/ReturnService.cs

@@ -31,33 +31,6 @@ public class ReturnService(
         return Map(r);
     }
 
-    public async Task<List<SaleReturnResponse>> GetAllAsync() =>
-        (await repo.GetAllAsync()).Select(Map).ToList();
-
-    /// <summary>
-    /// Quantities/mode are immutable once created (the stock/order effect already happened) —
-    /// only each line's reason code can be corrected after the fact.
-    /// </summary>
-    public async Task<SaleReturnResponse> UpdateReasonsAsync(Guid id, UpdateSaleReturnReasonsRequest request, CancellationToken ct = default)
-    {
-        var r = await repo.GetByIdAsync(id);
-        if (r is null || !r.IsActive)
-            throw new InvalidOperationException("Return not found.");
-
-        foreach (var line in request.Items)
-        {
-            var item = r.Items.FirstOrDefault(i => i.FK_ItemId == line.ItemId && i.IsActive)
-                ?? throw new InvalidOperationException($"Item {line.ItemId} not found on this return.");
-            item.ReasonCode = line.ReasonCode;
-        }
-
-        await uow.BeginAsync(ct);
-        try { repo.Update(r); await uow.CommitAsync(ct); }
-        catch { await uow.RollbackAsync(ct); throw; }
-
-        return Map(r);
-    }
-
     public async Task<List<SaleReturnResponse>> GetByOrderIdAsync(Guid orderId) =>
         (await repo.GetByOrderIdAsync(orderId)).Select(Map).ToList();
 
@@ -78,9 +51,7 @@ public class ReturnService(
         if (request.Items is null || request.Items.Count == 0)
             throw new InvalidOperationException("A return must have at least one line item.");
 
-        if (order.FK_SaleId is null)
-            throw new InvalidOperationException("Sale not found for this order.");
-        var sale = await saleRepo.GetByIdAsync(order.FK_SaleId.Value)
+        var sale = await saleRepo.GetByIdAsync(order.FK_SaleId)
             ?? throw new InvalidOperationException("Sale not found for this order.");
         if (sale.FK_RideId is null)
             throw new InvalidOperationException("A return can only be recorded for an order created during an active ride.");
@@ -149,8 +120,6 @@ public class ReturnService(
                 await stockRepo.AddMovementAsync(new StockMovement
                 {
                     FK_ItemId = line.FK_ItemId,
-                    FromLocationId = StockService.ExternalLocationId,
-                    FromLocationType = LocationType.External,
                     ToLocationId = vehicleId,
                     ToLocationType = LocationType.Vehicle,
                     Quantity = line.Quantity,

Distribution/Features/Ride/RideController.cs

@@ -40,7 +40,7 @@ public class RideController(RideService service, ICurrentUserService currentUser
     {
         try
         {
-            var result = await service.AssignDriverAsync(id, request.DriverProfileId, ct);
+            var result = await service.AssignDriverAsync(id, request.FK_DriverProfileId, ct);
             return Ok(result);
         }
         catch (KeyNotFoundException) { return NotFound(); }

Distribution/Features/Ride/RideDTOs.cs

@@ -25,12 +25,12 @@ public record RideResponse(
 
 public record CreateRideRequest(
     RideType RideType,
-    Guid VehicleId,
-    Guid DriverProfileId,
-    Guid RouteId,
-    Guid? SourceWarehouseId);
+    Guid FK_VehicleId,
+    Guid FK_DriverProfileId,
+    Guid FK_RouteId,
+    Guid? FK_SourceWarehouseId);
 
-public record AssignRideDriverRequest(Guid DriverProfileId);
+public record AssignRideDriverRequest(Guid FK_DriverProfileId);
 
 public record ActivateRideRequest(int Meterstart);
 

Distribution/Features/Ride/RideService.cs

@@ -36,19 +36,19 @@ public class RideService(
 
     public async Task<RideResponse> CreateAsync(CreateRideRequest request, CancellationToken ct = default)
     {
-        var vehicle = await vehicleRepo.GetByIdAsync(request.VehicleId)
+        var vehicle = await vehicleRepo.GetByIdAsync(request.FK_VehicleId)
             ?? throw new InvalidOperationException("Vehicle not found");
 
-        var sourceWarehouseId = vehicle.DefaultWarehouseId ?? request.SourceWarehouseId;
+        var sourceWarehouseId = vehicle.DefaultWarehouseId ?? request.FK_SourceWarehouseId;
         if (!sourceWarehouseId.HasValue)
             throw new InvalidOperationException("Source warehouse is required for this vehicle");
 
         var ride = new DeliveryRun
         {
             RideType = request.RideType,
-            FK_VehicleId = request.VehicleId,
-            FK_DriverProfileId = request.DriverProfileId,
-            FK_RouteId = request.RouteId,
+            FK_VehicleId = request.FK_VehicleId,
+            FK_DriverProfileId = request.FK_DriverProfileId,
+            FK_RouteId = request.FK_RouteId,
             FK_SourceWarehouseId = sourceWarehouseId.Value,
             Status = RideStatus.Draft
         };
@@ -141,9 +141,6 @@ public class RideService(
         if (ride.Status != RideStatus.Active)
             throw new InvalidOperationException($"Cannot close a ride in {ride.Status} status");
 
-        if (request.Meterend < ride.Meterstart)
-            throw new InvalidOperationException($"Meter end ({request.Meterend}) cannot be less than meter start ({ride.Meterstart})");
-
         await EnsureVehicleStockClearedAsync(ride.FK_VehicleId);
 
         ride.Status = RideStatus.Closed;
@@ -298,8 +295,7 @@ public class RideService(
                     b.LocationId,
                     b.LocationType,
                     b.Quantity,
-                    b.UpdatedAt,
-                    ride.Vehicle?.NumberPlate ?? string.Empty)).ToList()));
+                    b.UpdatedAt)).ToList()));
         }
 
         var openOrders = await rideRepo.GetActiveOrdersByRouteIdAsync(strandedRide.FK_RouteId);

Distribution/Features/Route/RouteController.cs

@@ -66,12 +66,8 @@ public class RouteController(RouteService service) : ControllerBase
     [HttpPost("{id:guid}/visits/check-in")]
     public async Task<IActionResult> CheckIn(Guid id, RecordCheckInRequest request, CancellationToken ct)
     {
-        try
-        {
-            var result = await service.RecordCheckInAsync(id, request, ct);
-            return result is null ? NotFound() : Ok(result);
-        }
-        catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
+        var result = await service.RecordCheckInAsync(id, request, ct);
+        return result is null ? NotFound() : Ok(result);
     }
 
     [HttpPost("{id:guid}/visits/check-out")]

Distribution/Features/Route/RouteDTOs.cs

@@ -12,13 +12,7 @@ public record AssignStoresToRouteRequest(List<Guid> StoreIds);
 
 public record AssignRouteOwnerRequest(Guid SalesRepId);
 
-public record RecordCheckInRequest(
-    Guid StoreId,
-    decimal Latitude,
-    decimal Longitude,
-    DateTime? Timestamp,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? CheckedInByUserId = null);
+public record RecordCheckInRequest(Guid StoreId, decimal Latitude, decimal Longitude, DateTime? Timestamp);
 
 public record RecordCheckOutRequest(Guid StoreId, DateTime? Timestamp);
 

Distribution/Features/Route/RouteService.cs

@@ -188,14 +188,11 @@ public class RouteService(IRouteRepository repo, Region.IRegionRepository region
 
     public async Task<RouteVisitResponse?> RecordCheckInAsync(Guid id, RecordCheckInRequest request, CancellationToken ct = default)
     {
-        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
-        // (testbug.md #28) — fall back to the explicitly supplied user, and skip the route-scope
-        // check (which also depends on a resolved user) until that's fixed.
-        var userId = currentUser.UserId ?? request.CheckedInByUserId
-            ?? throw new InvalidOperationException("CheckedInByUserId is required while auth is unavailable");
+        if (currentUser.UserId is null) return null;
 
         var route = await repo.GetByIdAsync(id);
         if (route is null || !route.IsActive) return null;
+        if (!await scopeAccess.HasRouteScopeAsync(currentUser.UserId.Value, id)) return null;
 
         var store = await repo.GetStoreByIdAsync(request.StoreId);
         if (store is null || !store.IsActive || store.FK_RouteId != id) return null;
@@ -206,7 +203,7 @@ public class RouteService(IRouteRepository repo, Region.IRegionRepository region
         {
             FK_RouteId = id,
             FK_StoreId = request.StoreId,
-            FK_UserId = userId,
+            FK_UserId = currentUser.UserId.Value,
             CheckInAt = request.Timestamp ?? DateTime.Now,
             CheckInLatitude = request.Latitude,
             CheckInLongitude = request.Longitude,
@@ -228,10 +225,11 @@ public class RouteService(IRouteRepository repo, Region.IRegionRepository region
 
     public async Task<RouteVisitResponse?> RecordCheckOutAsync(Guid id, RecordCheckOutRequest request, CancellationToken ct = default)
     {
-        // TEMPORARY: the route-scope check depends on the broken auth middleware
-        // (testbug.md #28) — skipped for now, same as check-in.
+        if (currentUser.UserId is null) return null;
+
         var route = await repo.GetByIdAsync(id);
         if (route is null || !route.IsActive) return null;
+        if (!await scopeAccess.HasRouteScopeAsync(currentUser.UserId.Value, id)) return null;
 
         var log = await repo.GetOpenVisitAsync(id, request.StoreId);
         if (log is null) return null;

Distribution/Features/Sale/SaleController.cs

@@ -24,18 +24,14 @@ public class SaleController(SaleService service) : ControllerBase
     public async Task<IActionResult> GetByStore(Guid storeId)
     {
         var result = await service.GetByStoreIdAsync(storeId);
-        return result is null ? StatusCode(StatusCodes.Status403Forbidden) : Ok(result);
+        return result is null ? Forbid() : Ok(result);
     }
 
     [HttpPost]
     public async Task<IActionResult> Create(CreateSaleRequest request, CancellationToken ct)
     {
-        try
-        {
-            var result = await service.CreateAsync(request, ct);
-            return result is null ? StatusCode(StatusCodes.Status403Forbidden) : CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
-        }
-        catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
+        var result = await service.CreateAsync(request, ct);
+        return result is null ? Forbid() : CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
     }
 
     [HttpPatch("{id:guid}/cancel")]

Distribution/Features/Sale/SaleDTOs.cs

@@ -10,10 +10,7 @@ public record CreateSaleRequest(
     decimal TotalAmount,
     bool FulfillImmediately,
     Guid? RideId,
-    List<SaleItemRequest> Items,
-    // TEMPORARY: auth middleware doesn't attach a resolvable user yet (see testbug.md #28), so the
-    // caller supplies the acting user explicitly. Remove once currentUser.UserId is reliable again.
-    Guid? CreatedByUserId = null);
+    List<SaleItemRequest> Items);
 
 public record SaleItemResponse(Guid ItemId, int Quantity, int QuantityFulfilled, decimal UnitPrice);
 

Distribution/Features/Sale/SaleService.cs

@@ -121,10 +121,9 @@ public class SaleService(
 
     public async Task<SaleResponse?> CancelAsync(Guid id, CancellationToken ct = default)
     {
-        // TEMPORARY: see CreateAsync — store-scope enforcement depends on the broken auth
-        // middleware (testbug.md #28) and would reject every cancel. Skipped for now.
         var sale = await repo.GetByIdAsync(id);
         if (sale is null || !sale.IsActive) return null;
+        if (!await HasStoreScopeAsync(sale.FK_StoreId)) return null;
         if (sale.Status == SaleStatus.Cancelled)
             throw new InvalidOperationException("Sale is already cancelled");
 
@@ -142,45 +141,46 @@ public class SaleService(
 
     public async Task<SaleResponse?> CreateAsync(CreateSaleRequest request, CancellationToken ct = default)
     {
-        // TEMPORARY: store-scope enforcement and currentUser resolution both depend on the broken
-        // auth middleware (see testbug.md #28) — currentUser.UserId/RoleLevel are always unset, so
-        // both checks would reject every sale. Skipped for now; restore once auth is fixed.
-        var userId = currentUser.UserId ?? request.CreatedByUserId
-            ?? throw new InvalidOperationException("CreatedByUserId is required while auth is unavailable");
-        var store = await storeRepo.GetByIdWithRegionAsync(request.StoreId)
-            ?? throw new InvalidOperationException("Store not found");
-        if (!store.IsActive)
-            throw new InvalidOperationException("Store is inactive");
+        if (!await HasStoreScopeAsync(request.StoreId)) return null;
+
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
+        var store = await storeRepo.GetByIdWithRegionAsync(request.StoreId);
+        if (store is null || !store.IsActive) return null;
 
         if (store.KycStatus != KycStatus.Verified)
         {
             var threshold = configuration.GetValue<decimal>("StoreManagement:UnverifiedKycOrderThreshold");
-            if (request.TotalAmount > threshold)
-                throw new InvalidOperationException(
-                    $"Store KYC is not verified — sale amount ({request.TotalAmount}) exceeds the unverified-store threshold ({threshold})");
+            if (request.TotalAmount > threshold) return null;
         }
 
+        var saleStatus = request.FulfillImmediately ? SaleStatus.Completed : SaleStatus.Pending;
+        var orderStatus = request.FulfillImmediately ? OrderStatus.Fulfilled : OrderStatus.Pending;
+        var fulfilledAt = request.FulfillImmediately ? DateTime.Now : (DateTime?)null;
+
         var sale = new Models.Sale
         {
             FK_StoreId = request.StoreId,
             SaleDate = request.SaleDate,
             CreatedByUserId = userId,
             FK_RideId = request.RideId,
-            FulfillImmediately = request.FulfillImmediately
+            TotalAmount = request.TotalAmount,
+            Status = saleStatus,
+            FulfillImmediately = request.FulfillImmediately,
+            CompletedAt = request.FulfillImmediately ? DateTime.Now : null
         };
 
         var orderItems = new List<Models.OrderItem>();
         foreach (var item in request.Items)
         {
-            var unitPrice = await ResolveUnitPriceAsync(item.ItemId, item.UnitPrice, store, request.SaleDate)
-                ?? throw new InvalidOperationException(
-                    $"Could not resolve a price for item {item.ItemId} on {request.SaleDate:yyyy-MM-dd} — check the item exists, an active price list covers this date/region, and any supplied unit price is within its min/max range");
+            var unitPrice = await ResolveUnitPriceAsync(item.ItemId, item.UnitPrice, store, request.SaleDate);
+            if (unitPrice is null) return null;
 
             orderItems.Add(new Models.OrderItem
             {
                 FK_ItemId = item.ItemId,
                 Quantity = item.Quantity,
-                UnitPrice = unitPrice
+                QuantityFulfilled = request.FulfillImmediately ? item.Quantity : 0,
+                UnitPrice = unitPrice.Value
             });
         }
 
@@ -189,48 +189,29 @@ public class SaleService(
             FK_SaleId = sale.Id,
             FK_StoreId = request.StoreId,
             OrderDate = request.SaleDate,
-            CreatedByUserId = userId,
+            TotalAmount = request.TotalAmount,
+            Status = orderStatus,
+            FulfilledAt = fulfilledAt
         };
 
         foreach (var orderItem in orderItems)
             orderItem.FK_OrderId = order.Id;
 
-        // For a van sale against a specific ride, sell whatever quantity is actually on that
-        // vehicle instead of rejecting the whole sale over one short item — the sale is always a
-        // clean, completed sale of what's handed over, never a "partially fulfilled" order.
         Guid? vehicleId = null;
         if (request.FulfillImmediately && request.RideId.HasValue)
         {
-            var ride = await rideRepo.GetByIdAsync(request.RideId.Value)
-                ?? throw new InvalidOperationException("Ride not found");
+            var ride = await rideRepo.GetByIdAsync(request.RideId.Value);
+            if (ride is null) return null;
             vehicleId = ride.FK_VehicleId;
 
             foreach (var item in orderItems)
             {
                 var balance = await stockRepo.GetBalanceAsync(item.FK_ItemId, vehicleId.Value);
-                item.Quantity = Math.Min(item.Quantity, (int)(balance?.Quantity ?? 0));
+                if (balance is null || balance.Quantity < item.Quantity)
+                    return null;
             }
         }
 
-        foreach (var item in orderItems)
-            item.QuantityFulfilled = request.FulfillImmediately ? item.Quantity : 0;
-
-        if (request.FulfillImmediately)
-        {
-            sale.Status = SaleStatus.Completed;
-            sale.CompletedAt = DateTime.Now;
-            order.Status = OrderStatus.Fulfilled;
-            order.FulfilledAt = DateTime.Now;
-        }
-        else
-        {
-            sale.Status = SaleStatus.Pending;
-            order.Status = OrderStatus.Pending;
-        }
-
-        sale.TotalAmount = orderItems.Sum(i => i.Quantity * i.UnitPrice);
-        order.TotalAmount = sale.TotalAmount;
-
         await uow.BeginAsync(ct);
         try
         {
@@ -240,10 +221,10 @@ public class SaleService(
 
             if (vehicleId.HasValue)
             {
-                foreach (var item in orderItems.Where(i => i.QuantityFulfilled > 0))
+                foreach (var item in orderItems)
                 {
                     var balance = await stockRepo.GetBalanceAsync(item.FK_ItemId, vehicleId.Value);
-                    balance!.Quantity -= item.QuantityFulfilled;
+                    balance!.Quantity -= item.Quantity;
                     balance.UpdatedAt = DateTime.Now;
                     stockRepo.UpdateBalance(balance);
 
@@ -252,9 +233,7 @@ public class SaleService(
                         FK_ItemId = item.FK_ItemId,
                         FromLocationId = vehicleId.Value,
                         FromLocationType = LocationType.Vehicle,
-                        ToLocationId = StockService.ExternalLocationId,
-                        ToLocationType = LocationType.External,
-                        Quantity = item.QuantityFulfilled,
+                        Quantity = item.Quantity,
                         Type = MovementType.Sale,
                         ReferenceId = order.Id
                     });

Distribution/Features/Scheme/SchemeDTOs.cs

@@ -46,8 +46,7 @@ public record UpdateSchemeRequest(
     DateTime DateRangeFrom,
     DateTime DateRangeTo,
     bool AgentLimitExempt,
-    decimal? BaselineExpectedSales,
-    bool IsActive);
+    decimal? BaselineExpectedSales);
 
 public record ApplySchemeRequest(Guid SchemeId);
 

Distribution/Features/Scheme/SchemeRepository.cs

@@ -20,7 +20,7 @@ public class SchemeRepository(AppDBContext context) : ISchemeRepository
             .Include(s => s.TriggerItem)
             .Include(s => s.FreeItem)
             .Include(s => s.BundleComponents).ThenInclude(c => c.Item)
-            .AsQueryable();
+            .Where(s => s.IsActive);
 
         if (regionId.HasValue) query = query.Where(s => s.FK_RegionId == regionId);
 

Distribution/Features/Scheme/SchemeService.cs

@@ -41,7 +41,7 @@ public class SchemeService(
     public async Task<SchemeResponse?> GetByIdAsync(Guid id)
     {
         var scheme = await repo.GetByIdAsync(id);
-        return scheme is null ? null : ToResponse(scheme);
+        return scheme is null || !scheme.IsActive ? null : ToResponse(scheme);
     }
 
     /// <summary>
@@ -114,7 +114,7 @@ public class SchemeService(
     public async Task<SchemeResponse?> UpdateAsync(Guid id, UpdateSchemeRequest request, CancellationToken ct = default)
     {
         var scheme = await repo.GetByIdAsync(id);
-        if (scheme is null) return null;
+        if (scheme is null || !scheme.IsActive) return null;
 
         ValidatePercentRuleConfig(scheme.RuleType, request.RuleConfig);
         if (request.DateRangeFrom > request.DateRangeTo)
@@ -128,7 +128,6 @@ public class SchemeService(
         scheme.DateRangeTo = request.DateRangeTo;
         scheme.AgentLimitExempt = request.AgentLimitExempt;
         scheme.BaselineExpectedSales = request.BaselineExpectedSales;
-        scheme.IsActive = request.IsActive;
 
         await uow.BeginAsync(ct);
         try { repo.Update(scheme); await uow.CommitAsync(ct); }
@@ -256,7 +255,7 @@ public class SchemeService(
         var orderItems = await orderRepo.GetItemsByOrderIdAsync(orderId);
         var regionId = store.Route?.FK_RegionId;
 
-        var candidates = (await repo.GetAllAsync()).Where(s => s.IsActive);
+        var candidates = await repo.GetAllAsync();
         var result = new List<SchemeEligibilityResponse>();
 
         foreach (var scheme in candidates)

Distribution/Features/Stock/IStockRepository.cs

@@ -15,8 +15,6 @@ public interface IStockRepository
 
     // Movements
     Task AddMovementAsync(StockMovement movement);
-    Task<StockMovement?> GetMovementByIdAsync(Guid id);
-    void UpdateMovement(StockMovement movement);
     Task<List<StockMovement>> GetMovementsAsync(Guid? locationId, Guid? itemId, MovementType? type, DateTime? from, DateTime? to, int page, int pageSize);
     Task<int> GetMovementsCountAsync(Guid? locationId, Guid? itemId, MovementType? type, DateTime? from, DateTime? to);
 }

Distribution/Features/Stock/StockController.cs

@@ -85,24 +85,10 @@ public class StockController(StockService service, ICurrentUserService currentUs
     [HttpPost("adjustment")]
     public async Task<IActionResult> Adjust(AdjustmentRequest request, CancellationToken ct)
     {
-        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
-        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
-        var userId = currentUser.UserId ?? request.AdjustedByUserId;
-        if (userId is null) return BadRequest(new { error = "AdjustedByUserId is required while auth is unavailable" });
+        if (currentUser.UserId is null) return Unauthorized();
         try
         {
-            var result = await service.AdjustAsync(request, userId.Value, ct);
-            return Ok(result);
-        }
-        catch (InvalidOperationException ex) { return BadRequest(ex.Message); }
-    }
-
-    [HttpPatch("movements/{id}/reason")]
-    public async Task<IActionResult> UpdateMovementReason(Guid id, UpdateMovementReasonRequest request, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.UpdateMovementReasonAsync(id, request, ct);
+            var result = await service.AdjustAsync(request, currentUser.UserId.Value, ct);
             return Ok(result);
         }
         catch (InvalidOperationException ex) { return BadRequest(ex.Message); }

Distribution/Features/Stock/StockDTOs.cs

@@ -12,8 +12,7 @@ public record StockBalanceResponse(
     Guid LocationId,
     LocationType LocationType,
     decimal Quantity,
-    DateTime UpdatedAt,
-    string LocationName);
+    DateTime UpdatedAt);
 
 public record StockTotalResponse(
     Guid ItemId,
@@ -35,9 +34,7 @@ public record StockMovementResponse(
     string? ReasonCode,
     Guid? ReferenceId,
     DateTime CreatedAt,
-    Guid CreatedBy,
-    string? FromLocationName,
-    string? ToLocationName);
+    Guid CreatedBy);
 
 // Write requests
 public record TransferRequest(
@@ -67,10 +64,4 @@ public record AdjustmentRequest(
     Guid LocationId,
     LocationType LocationType,
     decimal Quantity,
-    string ReasonCode,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? AdjustedByUserId = null);
-
-// Movements are an immutable ledger — quantity, locations, and type can never change once recorded
-// (the running stock balance is the sum of all movements). Only the free-text reason/note is editable.
-public record UpdateMovementReasonRequest(string ReasonCode);
+    string ReasonCode);

Distribution/Features/Stock/StockRepository.cs

@@ -50,12 +50,6 @@ public class StockRepository(AppDBContext db) : IStockRepository
     public async Task AddMovementAsync(StockMovement movement) =>
         await db.StockMovements.AddAsync(movement);
 
-    public Task<StockMovement?> GetMovementByIdAsync(Guid id) =>
-        db.StockMovements.Include(m => m.Item).FirstOrDefaultAsync(m => m.Id == id);
-
-    public void UpdateMovement(StockMovement movement) =>
-        db.StockMovements.Update(movement);
-
     public Task<List<StockMovement>> GetMovementsAsync(Guid? locationId, Guid? itemId, MovementType? type, DateTime? from, DateTime? to, int page, int pageSize)
     {
         var query = db.StockMovements.Include(m => m.Item).AsQueryable();

Distribution/Features/Stock/StockService.cs

@@ -1,79 +1,19 @@
 using Distribution.Features.Category;
 using Distribution.Features.Item;
-using Distribution.Features.Vehicle;
-using Distribution.Features.Warehouse;
 using Distribution.Infra.UoW;
 using Distribution.Models;
 
 namespace Distribution.Features.Stock;
 
-public class StockService(
-    IStockRepository repo,
-    IItemRepository itemRepo,
-    ICategoryRepository categoryRepo,
-    IWarehouseRepository warehouseRepo,
-    IVehicleRepository vehicleRepo,
-    IUnitOfWork uow)
+public class StockService(IStockRepository repo, IItemRepository itemRepo, ICategoryRepository categoryRepo, IUnitOfWork uow)
 {
-    private static StockBalanceResponse MapBalance(StockBalance b, string locationName) =>
-        new(b.FK_ItemId, b.Item.Name, b.LocationId, b.LocationType, b.Quantity, b.UpdatedAt, locationName);
+    private static StockBalanceResponse MapBalance(StockBalance b) =>
+        new(b.FK_ItemId, b.Item.Name, b.LocationId, b.LocationType, b.Quantity, b.UpdatedAt);
 
-    // Sentinel id used for the "External" side of a movement (customer, supplier, write-off, adjustment
-    // source/sink) that has no real Warehouse/Vehicle record — every movement must always show both a
-    // From and a To, even when one side is outside the tracked system.
-    public static readonly Guid ExternalLocationId = Guid.Empty;
-
-    private static string ExternalLocationLabel(MovementType type, bool isFrom) => type switch
-    {
-        MovementType.Sale => "Customer",
-        MovementType.CustomerReturn => "Customer",
-        MovementType.PurchaseReceipt => "Supplier",
-        MovementType.PurchaseReturn => "Supplier",
-        MovementType.Damage => "Written Off",
-        MovementType.Adjustment => "Stock Adjustment",
-        _ => isFrom ? "External Source" : "External Destination",
-    };
-
-    private static StockMovementResponse MapMovement(StockMovement m, string? fromLocationName, string? toLocationName) =>
+    private static StockMovementResponse MapMovement(StockMovement m) =>
         new(m.Id, m.FK_ItemId, m.Item.Name, m.FromLocationId, m.FromLocationType,
             m.ToLocationId, m.ToLocationType, m.Quantity, m.Type, m.ReasonCode,
-            m.ReferenceId, m.CreatedAt, m.CreatedBy, fromLocationName, toLocationName);
-
-    private async Task<StockMovementResponse> MapMovementAsync(StockMovement m)
-    {
-        var locations = new List<(Guid, LocationType)>();
-        if (m.FromLocationId is Guid fromId && m.FromLocationType is LocationType fromType && fromType != LocationType.External) locations.Add((fromId, fromType));
-        if (m.ToLocationId is Guid toId && m.ToLocationType is LocationType toType && toType != LocationType.External) locations.Add((toId, toType));
-        var names = await ResolveLocationNamesAsync(locations);
-        return MapMovement(m, ResolveMovementSideName(m, names, isFrom: true), ResolveMovementSideName(m, names, isFrom: false));
-    }
-
-    private static string? ResolveMovementSideName(StockMovement m, Dictionary<Guid, string> names, bool isFrom)
-    {
-        var id = isFrom ? m.FromLocationId : m.ToLocationId;
-        var type = isFrom ? m.FromLocationType : m.ToLocationType;
-        if (id is not Guid locId || type is not LocationType locType) return null;
-        return locType == LocationType.External ? ExternalLocationLabel(m.Type, isFrom) : names.GetValueOrDefault(locId, "—");
-    }
-
-    private async Task<Dictionary<Guid, string>> ResolveLocationNamesAsync(IEnumerable<(Guid Id, LocationType Type)> locations)
-    {
-        var warehouseIds = locations.Where(l => l.Type == LocationType.Warehouse).Select(l => l.Id).Distinct().ToList();
-        var vehicleIds = locations.Where(l => l.Type == LocationType.Vehicle).Select(l => l.Id).Distinct().ToList();
-
-        var names = new Dictionary<Guid, string>();
-        foreach (var id in warehouseIds)
-        {
-            var warehouse = await warehouseRepo.GetByIdAsync(id);
-            names[id] = warehouse?.Name ?? "Unknown Warehouse";
-        }
-        foreach (var id in vehicleIds)
-        {
-            var vehicle = await vehicleRepo.GetByIdAsync(id);
-            names[id] = vehicle?.RegNumber ?? "Unknown Vehicle";
-        }
-        return names;
-    }
+            m.ReferenceId, m.CreatedAt, m.CreatedBy);
 
     // ── Queries ────────────────────────────────────────────────────────────
 
@@ -82,9 +22,7 @@ public class StockService(
     {
         var items = await repo.GetBalancesAsync(locationId, locationType, itemId, page, pageSize);
         var total = await repo.GetBalancesCountAsync(locationId, locationType, itemId);
-        var names = await ResolveLocationNamesAsync(items.Select(b => (b.LocationId, b.LocationType)));
-        return new PagedResponse<StockBalanceResponse>(page, pageSize, total,
-            items.Select(b => MapBalance(b, names.GetValueOrDefault(b.LocationId, "—"))).ToList());
+        return new PagedResponse<StockBalanceResponse>(page, pageSize, total, items.Select(MapBalance).ToList());
     }
 
     public async Task<StockTotalResponse?> GetItemTotalAsync(Guid itemId)
@@ -94,9 +32,7 @@ public class StockService(
 
         var balances = await repo.GetBalancesByItemAsync(itemId);
         var total = balances.Sum(b => b.Quantity);
-        var names = await ResolveLocationNamesAsync(balances.Select(b => (b.LocationId, b.LocationType)));
-        return new StockTotalResponse(itemId, item.Name, total,
-            balances.Select(b => MapBalance(b, names.GetValueOrDefault(b.LocationId, "—"))).ToList());
+        return new StockTotalResponse(itemId, item.Name, total, balances.Select(MapBalance).ToList());
     }
 
     public async Task<PagedResponse<StockMovementResponse>> GetMovementsAsync(
@@ -104,20 +40,7 @@ public class StockService(
     {
         var items = await repo.GetMovementsAsync(locationId, itemId, type, from, to, page, pageSize);
         var total = await repo.GetMovementsCountAsync(locationId, itemId, type, from, to);
-
-        var locations = new List<(Guid, LocationType)>();
-        foreach (var m in items)
-        {
-            if (m.FromLocationId is Guid fromId && m.FromLocationType is LocationType fromType && fromType != LocationType.External) locations.Add((fromId, fromType));
-            if (m.ToLocationId is Guid toId && m.ToLocationType is LocationType toType && toType != LocationType.External) locations.Add((toId, toType));
-        }
-        var names = await ResolveLocationNamesAsync(locations);
-
-        return new PagedResponse<StockMovementResponse>(page, pageSize, total,
-            items.Select(m => MapMovement(
-                m,
-                ResolveMovementSideName(m, names, isFrom: true),
-                ResolveMovementSideName(m, names, isFrom: false))).ToList());
+        return new PagedResponse<StockMovementResponse>(page, pageSize, total, items.Select(MapMovement).ToList());
     }
 
     // ── Writes ─────────────────────────────────────────────────────────────
@@ -148,7 +71,7 @@ public class StockService(
         }
         catch { await uow.RollbackAsync(ct); throw; }
 
-        return await MapMovementAsync(movement);
+        return MapMovement(movement);
     }
 
     public async Task<StockMovementResponse> RecordDamageAsync(DamageRequest request, Guid userId, CancellationToken ct = default)
@@ -160,8 +83,6 @@ public class StockService(
             FK_ItemId = request.ItemId,
             FromLocationId = request.LocationId,
             FromLocationType = request.LocationType,
-            ToLocationId = ExternalLocationId,
-            ToLocationType = LocationType.External,
             Quantity = request.Quantity,
             Type = MovementType.Damage,
             ReasonCode = request.ReasonCode,
@@ -177,7 +98,7 @@ public class StockService(
         }
         catch { await uow.RollbackAsync(ct); throw; }
 
-        return await MapMovementAsync(movement);
+        return MapMovement(movement);
     }
 
     public async Task<StockMovementResponse> RecordCustomerReturnAsync(CustomerReturnRequest request, Guid userId, CancellationToken ct = default)
@@ -194,8 +115,6 @@ public class StockService(
         var movement = new StockMovement
         {
             FK_ItemId = request.ItemId,
-            FromLocationId = ExternalLocationId,
-            FromLocationType = LocationType.External,
             ToLocationId = request.VehicleId,
             ToLocationType = LocationType.Vehicle,
             Quantity = request.Quantity,
@@ -213,7 +132,7 @@ public class StockService(
         }
         catch { await uow.RollbackAsync(ct); throw; }
 
-        return await MapMovementAsync(movement);
+        return MapMovement(movement);
     }
 
     public async Task<StockMovementResponse> AdjustAsync(AdjustmentRequest request, Guid userId, CancellationToken ct = default)
@@ -225,10 +144,10 @@ public class StockService(
         var movement = new StockMovement
         {
             FK_ItemId = request.ItemId,
-            FromLocationId = request.Quantity < 0 ? request.LocationId : ExternalLocationId,
-            FromLocationType = request.Quantity < 0 ? request.LocationType : LocationType.External,
-            ToLocationId = request.Quantity > 0 ? request.LocationId : ExternalLocationId,
-            ToLocationType = request.Quantity > 0 ? request.LocationType : LocationType.External,
+            FromLocationId = request.Quantity < 0 ? request.LocationId : null,
+            FromLocationType = request.Quantity < 0 ? request.LocationType : null,
+            ToLocationId = request.Quantity > 0 ? request.LocationId : null,
+            ToLocationType = request.Quantity > 0 ? request.LocationType : null,
             Quantity = Math.Abs(request.Quantity),
             Type = MovementType.Adjustment,
             ReasonCode = request.ReasonCode,
@@ -259,20 +178,7 @@ public class StockService(
         }
         catch { await uow.RollbackAsync(ct); throw; }
 
-        return await MapMovementAsync(movement);
-    }
-
-    // Movements are an immutable ledger — only the reason/note can be edited, never quantity/locations/type.
-    public async Task<StockMovementResponse> UpdateMovementReasonAsync(Guid movementId, UpdateMovementReasonRequest request, CancellationToken ct = default)
-    {
-        var movement = await repo.GetMovementByIdAsync(movementId)
-            ?? throw new InvalidOperationException("Movement not found.");
-
-        movement.ReasonCode = request.ReasonCode;
-        repo.UpdateMovement(movement);
-        await uow.SaveChangesAsync(ct);
-
-        return await MapMovementAsync(movement);
+        return MapMovement(movement);
     }
 
     // ── Helpers ────────────────────────────────────────────────────────────

Distribution/Features/Store/IStoreRepository.cs

@@ -1,5 +1,3 @@
-using Distribution.Models;
-
 namespace Distribution.Features.Store;
 
 public interface IStoreRepository
@@ -7,8 +5,6 @@ public interface IStoreRepository
     Task<Models.Store?> GetByIdAsync(Guid id);
     Task<Models.Store?> GetByIdWithRegionAsync(Guid id);
     Task<List<Models.Store>> GetAllAsync();
-    Task<List<Models.Store>> GetAllAsync(Guid? routeId, KycStatus? kycStatus, string? search, int page, int pageSize);
-    Task<int> GetCountAsync(Guid? routeId, KycStatus? kycStatus, string? search);
     Task AddAsync(Models.Store entity);
     void Update(Models.Store entity);
     void Remove(Models.Store entity);

Distribution/Features/Store/StoreController.cs

@@ -1,5 +1,4 @@
-using Distribution.Models;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 
 namespace Distribution.Features.Store;
 
@@ -8,13 +7,8 @@ namespace Distribution.Features.Store;
 public class StoreController(StoreService service) : ControllerBase
 {
     [HttpGet]
-    public async Task<IActionResult> GetAll(
-        [FromQuery] Guid? routeId,
-        [FromQuery] KycStatus? kycStatus,
-        [FromQuery] string? search,
-        [FromQuery] int page = 1,
-        [FromQuery] int pageSize = 20) =>
-        Ok(await service.GetAllAsync(routeId, kycStatus, search, page, pageSize));
+    public async Task<IActionResult> GetAll() =>
+        Ok(await service.GetAllAsync());
 
     [HttpGet("{id:guid}")]
     public async Task<IActionResult> GetById(Guid id)
@@ -48,14 +42,14 @@ public class StoreController(StoreService service) : ControllerBase
     public async Task<IActionResult> UpdateCreditLimit(Guid id, UpdateCreditLimitRequest request, CancellationToken ct)
     {
         var result = await service.UpdateCreditLimitAsync(id, request, ct);
-        return result is null ? StatusCode(StatusCodes.Status403Forbidden) : Ok(result);
+        return result is null ? Forbid() : Ok(result);
     }
 
     [HttpPut("{id:guid}/outstanding-balance")]
     public async Task<IActionResult> UpdateOutstandingBalance(Guid id, UpdateOutstandingBalanceRequest request, CancellationToken ct)
     {
         var result = await service.UpdateOutstandingBalanceAsync(id, request, ct);
-        return result is null ? StatusCode(StatusCodes.Status403Forbidden) : Ok(result);
+        return result is null ? Forbid() : Ok(result);
     }
 
     [HttpGet("{id:guid}/outstanding-balance")]
@@ -106,11 +100,4 @@ public class StoreController(StoreService service) : ControllerBase
         var result = await service.VerifyKycAsync(id, new VerifyKycRequest(request.KycStatus, null), ct);
         return result is null ? NotFound() : Ok(result);
     }
-
-    [HttpPatch("{id:guid}/status")]
-    public async Task<IActionResult> PatchStatus(Guid id, PatchStoreStatusRequest request, CancellationToken ct)
-    {
-        var result = await service.SetActiveStatusAsync(id, request.IsActive, ct);
-        return result is null ? NotFound() : Ok(result);
-    }
 }

Distribution/Features/Store/StoreDTOs.cs

@@ -20,8 +20,7 @@ public record UpdateStoreRequest(
     decimal Latitude,
     decimal Longitude,
     decimal OneTimeAmount,
-    decimal CreditAmount,
-    bool IsActive = true);
+    decimal CreditAmount);
 
 public record StoreResponse(
     Guid Id,
@@ -56,6 +55,4 @@ public record SchemeEligibilityResponse(bool Eligible, string? Reason);
 
 public record PatchKycStatusRequest(KycStatus KycStatus);
 
-public record PatchStoreStatusRequest(bool IsActive);
-
 public record StoreDashboardResponse(Guid StoreId, string Period, int OrderCount, decimal TotalOrderValue, DateTime? LastOrderDate);

Distribution/Features/Store/StoreRepository.cs

@@ -1,5 +1,4 @@
 using Distribution.Data;
-using Distribution.Models;
 using Microsoft.EntityFrameworkCore;
 
 namespace Distribution.Features.Store;
@@ -17,25 +16,6 @@ public class StoreRepository(AppDBContext context) : IStoreRepository
     public async Task<List<Models.Store>> GetAllAsync() =>
         await context.Stores.ToListAsync();
 
-    private static IQueryable<Models.Store> ApplyFilters(
-        IQueryable<Models.Store> query, Guid? routeId, KycStatus? kycStatus, string? search) =>
-        query
-            .Where(s => routeId == null || s.FK_RouteId == routeId)
-            .Where(s => kycStatus == null || s.KycStatus == kycStatus)
-            .Where(s => string.IsNullOrWhiteSpace(search)
-                || s.StoreName.Contains(search)
-                || s.OwnerName.Contains(search));
-
-    public async Task<List<Models.Store>> GetAllAsync(Guid? routeId, KycStatus? kycStatus, string? search, int page, int pageSize) =>
-        await ApplyFilters(context.Stores, routeId, kycStatus, search)
-            .OrderBy(s => s.StoreName)
-            .Skip((page - 1) * pageSize)
-            .Take(pageSize)
-            .ToListAsync();
-
-    public async Task<int> GetCountAsync(Guid? routeId, KycStatus? kycStatus, string? search) =>
-        await ApplyFilters(context.Stores, routeId, kycStatus, search).CountAsync();
-
     public async Task AddAsync(Models.Store entity) =>
         await context.Stores.AddAsync(entity);
 

Distribution/Features/Store/StoreService.cs

@@ -1,5 +1,4 @@
 using Distribution.Features.Scheme;
-using Distribution.Features.Stock;
 using Distribution.Infra.Authorization;
 using Distribution.Infra.UoW;
 using Distribution.Models;
@@ -16,28 +15,28 @@ public class StoreService(IStoreRepository repo, IUnitOfWork uow, ICurrentUserSe
     private async Task<bool> HasStoreScopeAsync(Guid storeId)
     {
         //if (HasGlobalScope || currentUser.UserId is null) return HasGlobalScope;
-        //return await scopeAccess.HasStoreScopeAsync(currentUser.UserId.Value, storeId);
-        return true;
+        return await scopeAccess.HasStoreScopeAsync(currentUser.UserId.Value, storeId);
     }
 
     private static StoreResponse ToResponse(Models.Store s) =>
         new(s.Id, s.FK_RouteId, s.OwnerName, s.StoreName, s.StoreAddress, s.Latitude, s.Longitude, s.OneTimeAmount, s.CreditAmount,
             s.CreditLimit, s.OutstandingBalance, s.Segment, s.KycStatus, s.IsActive, s.CreatedAt);
 
-    public async Task<PagedResponse<StoreResponse>> GetAllAsync(
-        Guid? routeId, KycStatus? kycStatus, string? search, int page, int pageSize)
+    public async Task<List<StoreResponse>> GetAllAsync()
     {
-        // Deactivated stores stay visible in the list showing Inactive — deactivate never
-        // removes the row, only marks it (same rule as Orders, see testbug.md #42).
-        var total = await repo.GetCountAsync(routeId, kycStatus, search);
-        var stores = await repo.GetAllAsync(routeId, kycStatus, search, page, pageSize);
-        return new PagedResponse<StoreResponse>(page, pageSize, total, stores.Select(ToResponse).ToList());
+        var stores = (await repo.GetAllAsync()).Where(s => s.IsActive).ToList();
+        if (!HasGlobalScope && currentUser.UserId is not null)
+        {
+            var accessibleStoreIds = (await scopeAccess.GetAccessibleStoreIdsAsync(currentUser.UserId.Value)).ToHashSet();
+            stores = stores.Where(s => accessibleStoreIds.Contains(s.Id)).ToList();
+        }
+        return stores.Select(ToResponse).ToList();
     }
 
     public async Task<StoreResponse?> GetByIdAsync(Guid id)
     {
         var store = await repo.GetByIdAsync(id);
-        if (store is null) return null;
+        if (store is null || !store.IsActive) return null;
         //if (!await HasStoreScopeAsync(id)) return null;
         return ToResponse(store);
     }
@@ -72,7 +71,7 @@ public class StoreService(IStoreRepository repo, IUnitOfWork uow, ICurrentUserSe
     public async Task<StoreResponse?> UpdateAsync(Guid id, UpdateStoreRequest request, CancellationToken ct = default)
     {
         var store = await repo.GetByIdAsync(id);
-        if (store is null) return null;
+        if (store is null || !store.IsActive) return null;
         if (!await HasStoreScopeAsync(id)) return null;
         store.FK_RouteId = request.RouteId;
         store.OwnerName = request.OwnerName;
@@ -82,7 +81,6 @@ public class StoreService(IStoreRepository repo, IUnitOfWork uow, ICurrentUserSe
         store.Longitude = request.Longitude;
         store.OneTimeAmount = request.OneTimeAmount;
         store.CreditAmount = request.CreditAmount;
-        store.IsActive = request.IsActive;
         await uow.BeginAsync(ct);
         try
         {
@@ -206,32 +204,10 @@ public class StoreService(IStoreRepository repo, IUnitOfWork uow, ICurrentUserSe
         return ToResponse(store);
     }
 
-    public async Task<StoreResponse?> SetActiveStatusAsync(Guid id, bool isActive, CancellationToken ct = default)
-    {
-        var store = await repo.GetByIdAsync(id);
-        if (store is null) return null;
-        if (!await HasStoreScopeAsync(id)) return null;
-
-        store.IsActive = isActive;
-
-        await uow.BeginAsync(ct);
-        try
-        {
-            repo.Update(store);
-            await uow.CommitAsync(ct);
-        }
-        catch
-        {
-            await uow.RollbackAsync(ct);
-            throw;
-        }
-        return ToResponse(store);
-    }
-
     public async Task<List<StoreVisitHistoryItem>?> GetVisitHistoryAsync(Guid id)
     {
         var store = await repo.GetByIdAsync(id);
-        if (store is null) return null;
+        if (store is null || !store.IsActive) return null;
         if (!await HasStoreScopeAsync(id)) return null;
 
         var visits = await routeRepo.GetVisitsByStoreIdAsync(id);

Distribution/Features/Supplier/SupplierDTOs.cs

@@ -2,7 +2,7 @@ namespace Distribution.Features.Supplier;
 
 public record CreateSupplierRequest(string Name, string? ContactInfo);
 
-public record UpdateSupplierRequest(string Name, string? ContactInfo, bool IsActive);
+public record UpdateSupplierRequest(string Name, string? ContactInfo);
 
 public record SupplierResponse(
     Guid Id,

Distribution/Features/Supplier/SupplierRepository.cs

@@ -9,7 +9,7 @@ public class SupplierRepository(AppDBContext context) : ISupplierRepository
         await context.Suppliers.FindAsync(id);
 
     public async Task<List<Models.Supplier>> GetAllAsync() =>
-        await context.Suppliers.ToListAsync();
+        await context.Suppliers.Where(s => s.IsActive).ToListAsync();
 
     public async Task AddAsync(Models.Supplier entity) =>
         await context.Suppliers.AddAsync(entity);

Distribution/Features/Supplier/SupplierService.cs

@@ -19,7 +19,8 @@ public class SupplierService(
     public async Task<SupplierResponse?> GetByIdAsync(Guid id)
     {
         var supplier = await repo.GetByIdAsync(id);
-        return supplier is null ? null : Map(supplier);
+        if (supplier is null || !supplier.IsActive) return null;
+        return Map(supplier);
     }
 
     public async Task<SupplierResponse> CreateAsync(CreateSupplierRequest request, CancellationToken ct = default)
@@ -40,11 +41,10 @@ public class SupplierService(
     public async Task<SupplierResponse?> UpdateAsync(Guid id, UpdateSupplierRequest request, CancellationToken ct = default)
     {
         var supplier = await repo.GetByIdAsync(id);
-        if (supplier is null) return null;
+        if (supplier is null || !supplier.IsActive) return null;
 
         supplier.Name = request.Name;
         supplier.ContactInfo = request.ContactInfo;
-        supplier.IsActive = request.IsActive;
 
         await uow.BeginAsync(ct);
         try { repo.Update(supplier); await uow.CommitAsync(ct); }

Distribution/Features/SupplierClaims/ISupplierClaimRepository.cs

@@ -3,7 +3,6 @@ namespace Distribution.Features.SupplierClaims;
 public interface ISupplierClaimRepository
 {
     Task<Models.SupplierClaim?> GetByIdAsync(Guid id);
-    Task<List<Models.SupplierClaim>> GetAllAsync();
     Task<List<Models.SupplierClaim>> GetByPurchaseOrderIdAsync(Guid purchaseOrderId);
     Task AddAsync(Models.SupplierClaim entity);
     void Update(Models.SupplierClaim entity);

Distribution/Features/SupplierClaims/SupplierClaimController.cs

@@ -6,10 +6,6 @@ namespace Distribution.Features.SupplierClaims;
 [ApiController]
 public class SupplierClaimController(SupplierClaimService service, ICurrentUserService currentUser) : ControllerBase
 {
-    [HttpGet("api/supplier-claims")]
-    public async Task<IActionResult> GetAll() =>
-        Ok(await service.GetAllAsync());
-
     [HttpGet("api/supplier-claims/{id:guid}")]
     public async Task<IActionResult> GetById(Guid id)
     {
@@ -24,37 +20,22 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     [HttpPost("api/purchase-orders/{id:guid}/claims")]
     public async Task<IActionResult> Create(Guid id, CreateSupplierClaimRequest request, CancellationToken ct)
     {
-        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
-        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
-        var userId = currentUser.UserId ?? request.RaisedByUserId;
-        if (userId is null) return BadRequest(new { error = "RaisedByUserId is required while auth is unavailable" });
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
         try
         {
-            var result = await service.CreateAsync(id, request, userId.Value, ct);
+            var result = await service.CreateAsync(id, request, userId, ct);
             return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
         }
         catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
     }
 
-    [HttpPut("api/supplier-claims/{id:guid}")]
-    public async Task<IActionResult> Update(Guid id, UpdateSupplierClaimRequest request, CancellationToken ct)
-    {
-        try
-        {
-            var result = await service.UpdateAsync(id, request, ct);
-            return Ok(result);
-        }
-        catch (InvalidOperationException ex) { return Conflict(new { error = ex.Message }); }
-    }
-
     [HttpPost("api/supplier-claims/{id:guid}/approve")]
     public async Task<IActionResult> Approve(Guid id, ApproveSupplierClaimRequest request, CancellationToken ct)
     {
-        var userId = currentUser.UserId ?? request.ApprovedByUserId;
-        if (userId is null) return BadRequest(new { error = "ApprovedByUserId is required while auth is unavailable" });
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
         try
         {
-            var result = await service.ApproveAsync(id, request, userId.Value, ct);
+            var result = await service.ApproveAsync(id, request, userId, ct);
             return Ok(result);
         }
         catch (KeyNotFoundException) { return NotFound(); }
@@ -64,11 +45,10 @@ public class SupplierClaimController(SupplierClaimService service, ICurrentUserS
     [HttpPost("api/supplier-claims/{id:guid}/reject")]
     public async Task<IActionResult> Reject(Guid id, RejectSupplierClaimRequest request, CancellationToken ct)
     {
-        var userId = currentUser.UserId ?? request.RejectedByUserId;
-        if (userId is null) return BadRequest(new { error = "RejectedByUserId is required while auth is unavailable" });
+        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
         try
         {
-            var result = await service.RejectAsync(id, request, userId.Value, ct);
+            var result = await service.RejectAsync(id, request, userId, ct);
             return Ok(result);
         }
         catch (KeyNotFoundException) { return NotFound(); }

Distribution/Features/SupplierClaims/SupplierClaimDTOs.cs

@@ -6,15 +6,6 @@ public record SupplierClaimItemRequest(Guid ItemId, decimal Quantity, SupplierCl
 
 public record CreateSupplierClaimRequest(
     Guid? GoodsReceiptId,
-    string Details,
-    string? EvidenceUrl,
-    List<SupplierClaimItemRequest> Items,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? RaisedByUserId = null);
-
-// Only editable while the claim is still Open — Approve/Reject resolve it, and a resolved
-// claim's details/items shouldn't silently change after the fact.
-public record UpdateSupplierClaimRequest(
     string Details,
     string? EvidenceUrl,
     List<SupplierClaimItemRequest> Items);
@@ -22,14 +13,9 @@ public record UpdateSupplierClaimRequest(
 public record ApproveSupplierClaimRequest(
     SupplierClaimResolutionType ResolutionType,
     decimal? ResolutionAmount,
-    string? ResolutionNotes,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? ApprovedByUserId = null);
+    string? ResolutionNotes);
 
-public record RejectSupplierClaimRequest(
-    string? ResolutionNotes,
-    // TEMPORARY: required while auth doesn't resolve a logged-in user server-side — see testbug.md #28.
-    Guid? RejectedByUserId = null);
+public record RejectSupplierClaimRequest(string? ResolutionNotes);
 
 public record SupplierClaimItemResponse(
     Guid Id,

Distribution/Features/SupplierClaims/SupplierClaimRepository.cs

@@ -10,13 +10,6 @@ public class SupplierClaimRepository(AppDBContext context) : ISupplierClaimRepos
             .Include(c => c.Items).ThenInclude(i => i.Item)
             .FirstOrDefaultAsync(c => c.Id == id);
 
-    public async Task<List<Models.SupplierClaim>> GetAllAsync() =>
-        await context.SupplierClaims
-            .Include(c => c.Items).ThenInclude(i => i.Item)
-            .Where(c => c.IsActive)
-            .OrderByDescending(c => c.CreatedAt)
-            .ToListAsync();
-
     public async Task<List<Models.SupplierClaim>> GetByPurchaseOrderIdAsync(Guid purchaseOrderId) =>
         await context.SupplierClaims
             .Include(c => c.Items).ThenInclude(i => i.Item)

Distribution/Features/SupplierClaims/SupplierClaimService.cs

@@ -26,9 +26,6 @@ public class SupplierClaimService(
         return Map(c);
     }
 
-    public async Task<List<SupplierClaimResponse>> GetAllAsync() =>
-        (await repo.GetAllAsync()).Select(Map).ToList();
-
     public async Task<List<SupplierClaimResponse>> GetByPurchaseOrderIdAsync(Guid purchaseOrderId) =>
         (await repo.GetByPurchaseOrderIdAsync(purchaseOrderId)).Select(Map).ToList();
 
@@ -86,44 +83,6 @@ public class SupplierClaimService(
         return Map(saved!);
     }
 
-    public async Task<SupplierClaimResponse> UpdateAsync(Guid id, UpdateSupplierClaimRequest request, CancellationToken ct = default)
-    {
-        var claim = await repo.GetByIdAsync(id)
-            ?? throw new InvalidOperationException("Supplier claim not found.");
-        if (claim.Status != SupplierClaimStatus.Open)
-            throw new InvalidOperationException("Only an open claim can be edited.");
-        if (string.IsNullOrWhiteSpace(request.Details))
-            throw new InvalidOperationException("Claim details are required.");
-        if (request.Items is null || request.Items.Count == 0)
-            throw new InvalidOperationException("A supplier claim must have at least one line item.");
-
-        claim.Details = request.Details;
-        claim.EvidenceUrl = request.EvidenceUrl;
-
-        foreach (var existing in claim.Items.Where(i => i.IsActive))
-            existing.IsActive = false;
-
-        foreach (var line in request.Items)
-        {
-            if (line.Quantity <= 0)
-                throw new InvalidOperationException("Claim quantity must be greater than zero.");
-
-            claim.Items.Add(new SupplierClaimItem
-            {
-                FK_ItemId = line.ItemId,
-                Quantity = line.Quantity,
-                IssueType = line.IssueType
-            });
-        }
-
-        await uow.BeginAsync(ct);
-        try { repo.Update(claim); await uow.CommitAsync(ct); }
-        catch { await uow.RollbackAsync(ct); throw; }
-
-        var saved = await repo.GetByIdAsync(claim.Id);
-        return Map(saved!);
-    }
-
     public async Task<SupplierClaimResponse> ApproveAsync(Guid id, ApproveSupplierClaimRequest request, Guid approverId, CancellationToken ct = default)
     {
         var claim = await repo.GetByIdAsync(id)

Distribution/Infra/Authorization/Middleware/AuthMiddleware.cs

@@ -0,0 +1,185 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Security.Cryptography;
+using Distribution.Features.User;
+using Distribution.Infra.Authorization;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Distribution.Infra.Authorization.Middleware;
+
+/// <summary>
+/// Ported from OSMCore's System/Authentication/AuthMiddleware.cs (global path-skip-based
+/// middleware). NOT registered in Program.cs — this project's actual token validation is the
+/// standard AddJwtBearer handler (see Program.cs), same as OSMCore's own recommendation. Kept here
+/// unregistered, exactly like OSMCore's own copy, for reference/reuse if a project needs a
+/// middleware-based (rather than AddJwtBearer-based) validation entry point.
+///
+/// Two adaptations from the OSMCore original, both required for this to actually work against
+/// this project's authorization system rather than just compiling:
+/// 1. RSA key parsing goes through <see cref="RsaXmlKeyReader"/> instead of RSA.FromXmlString,
+///    which is Windows-only in modern .NET (see docs/authentication_flow.md §2.2 Gotcha).
+/// 2. After validating the token, the user id is mapped onto a local User/Role row and
+///    role_id/role_level/username claims are attached — the same step Program.cs's
+///    OnTokenValidated performs for the AddJwtBearer path. Without this, a request authenticated
+///    through this middleware would have no role_id claim, and every
+///    [Authorize(Policy = "resource.action")] check (PermissionAuthorizationHandler) would fail.
+/// </summary>
+public sealed class AuthMiddleware(RequestDelegate next, IConfiguration configuration, ILogger<AuthMiddleware> logger)
+{
+    public async Task InvokeAsync(HttpContext context)
+    {
+        if (ShouldSkipAuthentication(context.Request.Path))
+        {
+            await next(context);
+            return;
+        }
+
+        if (!TryGetToken(context, out var token))
+        {
+            await RejectAsync(context, "Authentication token is missing.");
+            return;
+        }
+
+        try
+        {
+            var principal = ValidateToken(token);
+            var userRepo = context.RequestServices.GetRequiredService<IUserRepository>();
+            if (!await TryAttachLocalRoleClaimsAsync(principal, userRepo))
+            {
+                await RejectAsync(context, "User not found or inactive.");
+                return;
+            }
+
+            context.User = principal;
+            PopulateContextItems(context, principal);
+            await next(context);
+        }
+        catch (Exception ex) when (ex is SecurityTokenException or ArgumentException or CryptographicException)
+        {
+            logger.LogInformation(ex, "JWT validation failed for request path {Path}", context.Request.Path);
+            await RejectAsync(context, "Invalid or expired token.");
+        }
+    }
+
+    private ClaimsPrincipal ValidateToken(string token)
+    {
+        var jwtOptions = configuration.GetSection("Jwt").Get<JwtOptions>()
+            ?? throw new InvalidOperationException("Jwt configuration is missing.");
+
+        if (string.IsNullOrWhiteSpace(jwtOptions.PublicKey))
+        {
+            throw new InvalidOperationException("Jwt:PublicKey configuration is missing.");
+        }
+
+        using var rsa = RsaXmlKeyReader.ReadPublicKey(jwtOptions.PublicKey);
+
+        var handler = new JwtSecurityTokenHandler();
+        var parameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidIssuer = jwtOptions.Issuer,
+            ValidateAudience = true,
+            ValidAudience = jwtOptions.Audience,
+            ValidateIssuerSigningKey = true,
+            IssuerSigningKey = new RsaSecurityKey(rsa),
+            ValidateLifetime = true,
+            ClockSkew = TimeSpan.FromMinutes(1)
+        };
+
+        return handler.ValidateToken(token, parameters, out _);
+    }
+
+    /// <summary>Mirrors Program.cs's OnTokenValidated mapping — see class remarks.</summary>
+    private static async Task<bool> TryAttachLocalRoleClaimsAsync(ClaimsPrincipal principal, IUserRepository userRepo)
+    {
+        var subClaim = principal.FindFirst("sub")?.Value ?? principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        if (!Guid.TryParse(subClaim, out var userId))
+            return false;
+
+        var user = await userRepo.GetByIdAsync(userId);
+        if (user is null || !user.IsActive)
+            return false;
+
+        var identity = (ClaimsIdentity)principal.Identity!;
+        identity.AddClaim(new Claim("username", user.Username));
+        identity.AddClaim(new Claim("role_id", user.FK_RoleId.ToString()));
+        identity.AddClaim(new Claim("role_level", (user.Role?.Level ?? 0).ToString()));
+        return true;
+    }
+
+    private static bool TryGetToken(HttpContext context, out string token)
+    {
+        token = string.Empty;
+
+        if (TryGetBearerToken(context.Request.Headers.Authorization, out token))
+        {
+            return true;
+        }
+
+        var headerToken = context.Request.Headers["MobileAuthToken"].FirstOrDefault();
+        if (TryGetBearerToken(headerToken, out token))
+        {
+            return true;
+        }
+
+        var cookieToken = context.Request.Cookies["access_token"];
+        if (!string.IsNullOrWhiteSpace(cookieToken))
+        {
+            token = cookieToken.Trim();
+            return true;
+        }
+
+        return false;
+    }
+
+    private static bool TryGetBearerToken(string? authorizationHeader, out string token)
+    {
+        token = string.Empty;
+
+        if (string.IsNullOrWhiteSpace(authorizationHeader))
+        {
+            return false;
+        }
+
+        const string bearerPrefix = "Bearer ";
+        if (!authorizationHeader.StartsWith(bearerPrefix, StringComparison.OrdinalIgnoreCase))
+        {
+            token = authorizationHeader.Trim();
+            return !string.IsNullOrWhiteSpace(token);
+        }
+
+        token = authorizationHeader[bearerPrefix.Length..].Trim();
+        return !string.IsNullOrWhiteSpace(token);
+    }
+
+    /// <summary>
+    /// Adapted from OSMCore's path list: this project has no Shopify-style webhook route, so that
+    /// skip is dropped; /api/auth is narrowed to just login/register (this project's /api/auth/me
+    /// and /api/auth/logout are meant to require auth, unlike a blanket "/api/auth" skip).
+    /// </summary>
+    private static bool ShouldSkipAuthentication(PathString path)
+        => path.Equals("/health", StringComparison.OrdinalIgnoreCase)
+           || path.Equals("/api/auth/login", StringComparison.OrdinalIgnoreCase)
+           || path.Equals("/api/auth/register", StringComparison.OrdinalIgnoreCase)
+           || path.StartsWithSegments("/swagger", StringComparison.OrdinalIgnoreCase);
+
+    private static void PopulateContextItems(HttpContext context, ClaimsPrincipal principal)
+    {
+        context.Items["UserId"] = principal.FindFirst("sub")?.Value ?? principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        context.Items["Username"] = principal.FindFirst("username")?.Value;
+        context.Items["RoleId"] = principal.FindFirst("role_id")?.Value;
+        context.Items["RoleLevel"] = principal.FindFirst("role_level")?.Value;
+    }
+
+    private static async Task RejectAsync(HttpContext context, string message)
+    {
+        context.Response.StatusCode = StatusCodes.Status401Unauthorized;
+        await context.Response.WriteAsJsonAsync(new ApiResponse<object>
+        {
+            StatusCode = StatusCodes.Status401Unauthorized,
+            Success = false,
+            Message = message,
+            Data = null
+        });
+    }
+}

Distribution/Infra/Authorization/Middleware/JwtMiddleware.cs

@@ -0,0 +1,191 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Security.Cryptography;
+using Distribution.Features.User;
+using Distribution.Infra.Authorization;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Distribution.Infra.Authorization.Middleware;
+
+/// <summary>
+/// Ported from OSMCore's System/Authentication/JwtMiddleware.cs (action-filter attribute pattern,
+/// applied per controller/action as [JwtMiddleware.CustomMiddleware]). Not applied anywhere in
+/// this project — the standard AddJwtBearer handler (Program.cs) is this project's actual
+/// validation path.
+///
+/// docs/authentication_flow.md explicitly calls out not running this alongside AuthMiddleware or
+/// AddJwtBearer at the same time — all three independently re-validate the same RSA-signed token,
+/// which is wasteful and error-prone (this is the same duplication OSMCore's own guide flags as a
+/// Gotcha). Kept here, unregistered, only as a ported reference implementation.
+///
+/// Same two adaptations as AuthMiddleware: portable RSA parsing via
+/// <see cref="RsaXmlKeyReader"/>, and local User/Role → role_id/role_level claim mapping after
+/// validation (see AuthMiddleware's remarks for why this is required, not optional).
+/// </summary>
+public sealed class JwtMiddleware
+{
+    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+    public sealed class CustomMiddlewareAttribute : Attribute, IAsyncActionFilter
+    {
+        public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
+        {
+            var configuration = context.HttpContext.RequestServices.GetService<IConfiguration>();
+
+            if (!TryGetToken(context.HttpContext, out var token))
+            {
+                await RejectAsync(context.HttpContext, "Authentication token is missing.");
+                return;
+            }
+
+            try
+            {
+                if (configuration is null)
+                {
+                    throw new InvalidOperationException("Jwt configuration is missing.");
+                }
+
+                var principal = ValidateToken(token, configuration);
+
+                var userRepo = context.HttpContext.RequestServices.GetRequiredService<IUserRepository>();
+                if (!await TryAttachLocalRoleClaimsAsync(principal, userRepo))
+                {
+                    await RejectAsync(context.HttpContext, "User not found or inactive.");
+                    return;
+                }
+
+                context.HttpContext.User = principal;
+                PopulateContextItems(context.HttpContext, principal);
+
+                await next();
+            }
+            catch (Exception ex) when (ex is SecurityTokenException or ArgumentException or CryptographicException or InvalidOperationException)
+            {
+                await RejectAsync(context.HttpContext, "Invalid or expired token.");
+            }
+        }
+
+        private static ClaimsPrincipal ValidateToken(string token, IConfiguration configuration)
+        {
+            var xmlKey = configuration["Jwt:PublicKey"];
+
+            if (string.IsNullOrWhiteSpace(xmlKey))
+                throw new SecurityTokenException("JWT public key not configured.");
+
+            using var rsa = RsaXmlKeyReader.ReadPublicKey(xmlKey);
+            var rsaParameters = rsa.ExportParameters(false);
+
+            var key = new RsaSecurityKey(rsaParameters)
+            {
+                KeyId = ComputeKeyId(rsaParameters)
+            };
+
+            var handler = new JwtSecurityTokenHandler();
+            var parameters = new TokenValidationParameters
+            {
+                ValidateIssuer = true,
+                ValidIssuer = configuration["Jwt:Issuer"],
+                ValidateAudience = true,
+                ValidAudience = configuration["Jwt:Audience"],
+                ValidateIssuerSigningKey = true,
+                IssuerSigningKey = key,
+                ValidateLifetime = true,
+                ClockSkew = TimeSpan.FromMinutes(1)
+            };
+
+            return handler.ValidateToken(token, parameters, out _);
+        }
+
+        /// <summary>Mirrors Program.cs's OnTokenValidated mapping — see class remarks.</summary>
+        private static async Task<bool> TryAttachLocalRoleClaimsAsync(ClaimsPrincipal principal, IUserRepository userRepo)
+        {
+            var subClaim = principal.FindFirst("sub")?.Value ?? principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+            if (!Guid.TryParse(subClaim, out var userId))
+                return false;
+
+            var user = await userRepo.GetByIdAsync(userId);
+            if (user is null || !user.IsActive)
+                return false;
+
+            var identity = (ClaimsIdentity)principal.Identity!;
+            identity.AddClaim(new Claim("username", user.Username));
+            identity.AddClaim(new Claim("role_id", user.FK_RoleId.ToString()));
+            identity.AddClaim(new Claim("role_level", (user.Role?.Level ?? 0).ToString()));
+            return true;
+        }
+
+        private static bool TryGetToken(HttpContext context, out string token)
+        {
+            token = string.Empty;
+
+            if (TryGetBearerToken(context.Request.Headers.Authorization, out token))
+            {
+                return true;
+            }
+
+            var headerToken = context.Request.Headers["MobileAuthToken"].FirstOrDefault();
+            if (TryGetBearerToken(headerToken, out token))
+            {
+                return true;
+            }
+
+            var cookieToken = context.Request.Cookies["access_token"];
+            if (!string.IsNullOrWhiteSpace(cookieToken))
+            {
+                token = cookieToken.Trim();
+                return true;
+            }
+
+            return false;
+        }
+
+        private static bool TryGetBearerToken(string? authorizationHeader, out string token)
+        {
+            token = string.Empty;
+
+            if (string.IsNullOrWhiteSpace(authorizationHeader))
+            {
+                return false;
+            }
+
+            const string bearerPrefix = "Bearer ";
+            if (!authorizationHeader.StartsWith(bearerPrefix, StringComparison.OrdinalIgnoreCase))
+            {
+                token = authorizationHeader.Trim();
+                return !string.IsNullOrWhiteSpace(token);
+            }
+
+            token = authorizationHeader[bearerPrefix.Length..].Trim();
+            return !string.IsNullOrWhiteSpace(token);
+        }
+
+        private static void PopulateContextItems(HttpContext context, ClaimsPrincipal principal)
+        {
+            context.Items["UserId"] = principal.FindFirst("sub")?.Value ?? principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+            context.Items["Username"] = principal.FindFirst("username")?.Value;
+            context.Items["RoleId"] = principal.FindFirst("role_id")?.Value;
+            context.Items["RoleLevel"] = principal.FindFirst("role_level")?.Value;
+        }
+
+        private static async Task RejectAsync(HttpContext context, string message)
+        {
+            context.Response.StatusCode = StatusCodes.Status401Unauthorized;
+            await context.Response.WriteAsJsonAsync(new ApiResponse<object>
+            {
+                StatusCode = StatusCodes.Status401Unauthorized,
+                Success = false,
+                Message = message,
+                Data = null
+            });
+        }
+
+        private static string ComputeKeyId(RSAParameters publicParameters)
+        {
+            var modulus = publicParameters.Modulus ?? [];
+            var exponent = publicParameters.Exponent ?? [];
+            var payload = $"{Convert.ToBase64String(modulus)}.{Convert.ToBase64String(exponent)}";
+            var hash = SHA256.HashData(System.Text.Encoding.UTF8.GetBytes(payload));
+            return Base64UrlEncoder.Encode(hash);
+        }
+    }
+}

Distribution/Migrations/20260908073439_FixSeedStockMovementExternalLocations.cs

@@ -1,47 +0,0 @@
-using System;
-using Microsoft.EntityFrameworkCore.Migrations;
-
-#nullable disable
-
-namespace Distribution.Migrations
-{
-    /// <inheritdoc />
-    public partial class FixSeedStockMovementExternalLocations : Migration
-    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.UpdateData(
-                table: "StockMovements",
-                keyColumn: "Id",
-                keyValue: new Guid("62000000-0000-0000-0000-000000000001"),
-                columns: new[] { "FromLocationId", "FromLocationType" },
-                values: new object[] { new Guid("00000000-0000-0000-0000-000000000000"), 2 });
-
-            migrationBuilder.UpdateData(
-                table: "StockMovements",
-                keyColumn: "Id",
-                keyValue: new Guid("62000000-0000-0000-0000-000000000003"),
-                columns: new[] { "ToLocationId", "ToLocationType" },
-                values: new object[] { new Guid("00000000-0000-0000-0000-000000000000"), 2 });
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.UpdateData(
-                table: "StockMovements",
-                keyColumn: "Id",
-                keyValue: new Guid("62000000-0000-0000-0000-000000000001"),
-                columns: new[] { "FromLocationId", "FromLocationType" },
-                values: new object[] { null, null });
-
-            migrationBuilder.UpdateData(
-                table: "StockMovements",
-                keyColumn: "Id",
-                keyValue: new Guid("62000000-0000-0000-0000-000000000003"),
-                columns: new[] { "ToLocationId", "ToLocationType" },
-                values: new object[] { null, null });
-        }
-    }
-}

Distribution/Migrations/20260909104836_AddRetailPriceAndAgencyMargin.cs

@@ -1,53 +0,0 @@
-using System;
-using Microsoft.EntityFrameworkCore.Migrations;
-
-#nullable disable
-
-namespace Distribution.Migrations
-{
-    /// <inheritdoc />
-    public partial class AddRetailPriceAndAgencyMargin : Migration
-    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.AddColumn<decimal>(
-                name: "AgencyMarginPercent",
-                table: "PriceListItems",
-                type: "decimal(65,30)",
-                nullable: true);
-
-            migrationBuilder.AddColumn<decimal>(
-                name: "RetailPrice",
-                table: "PriceListItems",
-                type: "decimal(65,30)",
-                nullable: true);
-
-            migrationBuilder.UpdateData(
-                table: "PriceListItems",
-                keyColumn: "Id",
-                keyValue: new Guid("40000000-0000-0000-0000-000000000001"),
-                columns: new[] { "AgencyMarginPercent", "RetailPrice" },
-                values: new object[] { null, null });
-
-            migrationBuilder.UpdateData(
-                table: "PriceListItems",
-                keyColumn: "Id",
-                keyValue: new Guid("40000000-0000-0000-0000-000000000002"),
-                columns: new[] { "AgencyMarginPercent", "RetailPrice" },
-                values: new object[] { null, null });
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.DropColumn(
-                name: "AgencyMarginPercent",
-                table: "PriceListItems");
-
-            migrationBuilder.DropColumn(
-                name: "RetailPrice",
-                table: "PriceListItems");
-        }
-    }
-}

Distribution/Migrations/20260916083241_AddOrderInvoiceLifecycle.cs

@@ -1,306 +0,0 @@
-using System;
-using Microsoft.EntityFrameworkCore.Migrations;
-
-#nullable disable
-
-#pragma warning disable CA1814 // Prefer jagged arrays over multidimensional
-
-namespace Distribution.Migrations
-{
-    /// <inheritdoc />
-    public partial class AddOrderInvoiceLifecycle : Migration
-    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            // Must run before DropPrimaryKey below: OrderItems.FK_OrderId has a foreign key to
-            // Orders, and MySQL requires a supporting index on that column at all times. The old
-            // composite PK (FK_OrderId, FK_ItemId) was providing that support; without this index
-            // created first, dropping the PK leaves FK_OrderId's constraint without an index and
-            // MySQL rejects the DROP PRIMARY KEY (errno 150).
-            migrationBuilder.CreateIndex(
-                name: "IX_OrderItems_FK_OrderId",
-                table: "OrderItems",
-                column: "FK_OrderId");
-
-            migrationBuilder.DropPrimaryKey(
-                name: "PK_OrderItems",
-                table: "OrderItems");
-
-            migrationBuilder.DeleteData(
-                table: "OrderItems",
-                keyColumns: new[] { "FK_ItemId", "FK_OrderId" },
-                keyValues: new object[] { new Guid("23000000-0000-0000-0000-000000000001"), new Guid("33000000-0000-0000-0000-000000000001") });
-
-            migrationBuilder.DeleteData(
-                table: "OrderItems",
-                keyColumns: new[] { "FK_ItemId", "FK_OrderId" },
-                keyValues: new object[] { new Guid("23000000-0000-0000-0000-000000000003"), new Guid("33000000-0000-0000-0000-000000000001") });
-
-            migrationBuilder.DeleteData(
-                table: "OrderItems",
-                keyColumns: new[] { "FK_ItemId", "FK_OrderId" },
-                keyValues: new object[] { new Guid("23000000-0000-0000-0000-000000000002"), new Guid("33000000-0000-0000-0000-000000000002") });
-
-            migrationBuilder.AlterColumn<Guid>(
-                name: "FK_SaleId",
-                table: "Orders",
-                type: "char(36)",
-                nullable: true,
-                collation: "ascii_general_ci",
-                oldClrType: typeof(Guid),
-                oldType: "char(36)")
-                .OldAnnotation("Relational:Collation", "ascii_general_ci");
-
-            migrationBuilder.AddColumn<DateTime>(
-                name: "ConfirmedAt",
-                table: "Orders",
-                type: "datetime(6)",
-                nullable: true);
-
-            migrationBuilder.AddColumn<Guid>(
-                name: "ConfirmedByUserId",
-                table: "Orders",
-                type: "char(36)",
-                nullable: true,
-                collation: "ascii_general_ci");
-
-            migrationBuilder.AddColumn<Guid>(
-                name: "CreatedByUserId",
-                table: "Orders",
-                type: "char(36)",
-                nullable: false,
-                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"),
-                collation: "ascii_general_ci");
-
-            // Backfill every existing Order's new CreatedByUserId from its linked Sale (Order.FK_SaleId
-            // was required until this migration, so every pre-existing row has one). Covers every
-            // row generically, not just the two rows seeded via HasData below — otherwise any Order
-            // created outside the EF seed data would keep the temporary AddColumn default
-            // (Guid.Empty) and fail the FK_Orders_Users_CreatedByUserId constraint added at the end
-            // of this migration.
-            migrationBuilder.Sql(@"
-                UPDATE `Orders` o
-                INNER JOIN `Sales` s ON s.`Id` = o.`FK_SaleId`
-                SET o.`CreatedByUserId` = s.`CreatedByUserId`
-                WHERE o.`FK_SaleId` IS NOT NULL;");
-
-            migrationBuilder.AddColumn<Guid>(
-                name: "InvoiceId",
-                table: "Orders",
-                type: "char(36)",
-                nullable: true,
-                collation: "ascii_general_ci");
-
-            migrationBuilder.AddPrimaryKey(
-                name: "PK_OrderItems",
-                table: "OrderItems",
-                column: "Id");
-
-            migrationBuilder.CreateTable(
-                name: "Invoices",
-                columns: table => new
-                {
-                    Id = table.Column<Guid>(type: "char(36)", nullable: false, collation: "ascii_general_ci"),
-                    FK_OrderId = table.Column<Guid>(type: "char(36)", nullable: false, collation: "ascii_general_ci"),
-                    Status = table.Column<int>(type: "int", nullable: false),
-                    CreatedByUserId = table.Column<Guid>(type: "char(36)", nullable: false, collation: "ascii_general_ci"),
-                    PrintedAt = table.Column<DateTime>(type: "datetime(6)", nullable: true),
-                    PrintedByUserId = table.Column<Guid>(type: "char(36)", nullable: true, collation: "ascii_general_ci"),
-                    FinalizedAt = table.Column<DateTime>(type: "datetime(6)", nullable: true),
-                    FinalizedByUserId = table.Column<Guid>(type: "char(36)", nullable: true, collation: "ascii_general_ci"),
-                    TotalAmount = table.Column<decimal>(type: "decimal(65,30)", nullable: false),
-                    CreatedAt = table.Column<DateTime>(type: "datetime(6)", nullable: false),
-                    IsActive = table.Column<bool>(type: "tinyint(1)", nullable: false)
-                },
-                constraints: table =>
-                {
-                    table.PrimaryKey("PK_Invoices", x => x.Id);
-                    table.ForeignKey(
-                        name: "FK_Invoices_Orders_FK_OrderId",
-                        column: x => x.FK_OrderId,
-                        principalTable: "Orders",
-                        principalColumn: "Id",
-                        onDelete: ReferentialAction.Restrict);
-                    table.ForeignKey(
-                        name: "FK_Invoices_Users_CreatedByUserId",
-                        column: x => x.CreatedByUserId,
-                        principalTable: "Users",
-                        principalColumn: "Id",
-                        onDelete: ReferentialAction.Restrict);
-                    table.ForeignKey(
-                        name: "FK_Invoices_Users_FinalizedByUserId",
-                        column: x => x.FinalizedByUserId,
-                        principalTable: "Users",
-                        principalColumn: "Id",
-                        onDelete: ReferentialAction.Restrict);
-                    table.ForeignKey(
-                        name: "FK_Invoices_Users_PrintedByUserId",
-                        column: x => x.PrintedByUserId,
-                        principalTable: "Users",
-                        principalColumn: "Id",
-                        onDelete: ReferentialAction.Restrict);
-                })
-                .Annotation("MySql:CharSet", "utf8mb4");
-
-            migrationBuilder.InsertData(
-                table: "OrderItems",
-                columns: new[] { "Id", "CreatedAt", "FK_ItemId", "FK_OrderId", "IsActive", "Quantity", "QuantityFulfilled", "UnitPrice" },
-                values: new object[,]
-                {
-                    { new Guid("34000000-0000-0000-0000-000000000001"), new DateTime(2026, 8, 25, 9, 0, 0, 0, DateTimeKind.Unspecified), new Guid("23000000-0000-0000-0000-000000000001"), new Guid("33000000-0000-0000-0000-000000000001"), true, 30, 30, 60m },
-                    { new Guid("34000000-0000-0000-0000-000000000002"), new DateTime(2026, 8, 25, 9, 0, 0, 0, DateTimeKind.Unspecified), new Guid("23000000-0000-0000-0000-000000000003"), new Guid("33000000-0000-0000-0000-000000000001"), true, 24, 24, 50m },
-                    { new Guid("34000000-0000-0000-0000-000000000003"), new DateTime(2026, 8, 30, 10, 0, 0, 0, DateTimeKind.Unspecified), new Guid("23000000-0000-0000-0000-000000000002"), new Guid("33000000-0000-0000-0000-000000000002"), true, 10, 0, 120m }
-                });
-
-            migrationBuilder.UpdateData(
-                table: "Orders",
-                keyColumn: "Id",
-                keyValue: new Guid("33000000-0000-0000-0000-000000000001"),
-                columns: new[] { "ConfirmedAt", "ConfirmedByUserId", "CreatedByUserId", "InvoiceId" },
-                values: new object[] { null, null, new Guid("29000000-0000-0000-0000-000000000002"), null });
-
-            migrationBuilder.UpdateData(
-                table: "Orders",
-                keyColumn: "Id",
-                keyValue: new Guid("33000000-0000-0000-0000-000000000002"),
-                columns: new[] { "ConfirmedAt", "ConfirmedByUserId", "CreatedByUserId", "InvoiceId" },
-                values: new object[] { null, null, new Guid("29000000-0000-0000-0000-000000000003"), null });
-
-            migrationBuilder.CreateIndex(
-                name: "IX_Orders_ConfirmedByUserId",
-                table: "Orders",
-                column: "ConfirmedByUserId");
-
-            migrationBuilder.CreateIndex(
-                name: "IX_Orders_CreatedByUserId",
-                table: "Orders",
-                column: "CreatedByUserId");
-
-            migrationBuilder.CreateIndex(
-                name: "IX_Invoices_CreatedByUserId",
-                table: "Invoices",
-                column: "CreatedByUserId");
-
-            migrationBuilder.CreateIndex(
-                name: "IX_Invoices_FinalizedByUserId",
-                table: "Invoices",
-                column: "FinalizedByUserId");
-
-            migrationBuilder.CreateIndex(
-                name: "IX_Invoices_FK_OrderId",
-                table: "Invoices",
-                column: "FK_OrderId");
-
-            migrationBuilder.CreateIndex(
-                name: "IX_Invoices_PrintedByUserId",
-                table: "Invoices",
-                column: "PrintedByUserId");
-
-            migrationBuilder.AddForeignKey(
-                name: "FK_Orders_Users_ConfirmedByUserId",
-                table: "Orders",
-                column: "ConfirmedByUserId",
-                principalTable: "Users",
-                principalColumn: "Id",
-                onDelete: ReferentialAction.Restrict);
-
-            migrationBuilder.AddForeignKey(
-                name: "FK_Orders_Users_CreatedByUserId",
-                table: "Orders",
-                column: "CreatedByUserId",
-                principalTable: "Users",
-                principalColumn: "Id",
-                onDelete: ReferentialAction.Restrict);
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.DropForeignKey(
-                name: "FK_Orders_Users_ConfirmedByUserId",
-                table: "Orders");
-
-            migrationBuilder.DropForeignKey(
-                name: "FK_Orders_Users_CreatedByUserId",
-                table: "Orders");
-
-            migrationBuilder.DropTable(
-                name: "Invoices");
-
-            migrationBuilder.DropIndex(
-                name: "IX_Orders_ConfirmedByUserId",
-                table: "Orders");
-
-            migrationBuilder.DropIndex(
-                name: "IX_Orders_CreatedByUserId",
-                table: "Orders");
-
-            migrationBuilder.DropPrimaryKey(
-                name: "PK_OrderItems",
-                table: "OrderItems");
-
-            migrationBuilder.DropIndex(
-                name: "IX_OrderItems_FK_OrderId",
-                table: "OrderItems");
-
-            migrationBuilder.DeleteData(
-                table: "OrderItems",
-                keyColumn: "Id",
-                keyValue: new Guid("34000000-0000-0000-0000-000000000001"));
-
-            migrationBuilder.DeleteData(
-                table: "OrderItems",
-                keyColumn: "Id",
-                keyValue: new Guid("34000000-0000-0000-0000-000000000002"));
-
-            migrationBuilder.DeleteData(
-                table: "OrderItems",
-                keyColumn: "Id",
-                keyValue: new Guid("34000000-0000-0000-0000-000000000003"));
-
-            migrationBuilder.DropColumn(
-                name: "ConfirmedAt",
-                table: "Orders");
-
-            migrationBuilder.DropColumn(
-                name: "ConfirmedByUserId",
-                table: "Orders");
-
-            migrationBuilder.DropColumn(
-                name: "CreatedByUserId",
-                table: "Orders");
-
-            migrationBuilder.DropColumn(
-                name: "InvoiceId",
-                table: "Orders");
-
-            migrationBuilder.AlterColumn<Guid>(
-                name: "FK_SaleId",
-                table: "Orders",
-                type: "char(36)",
-                nullable: false,
-                defaultValue: new Guid("00000000-0000-0000-0000-000000000000"),
-                collation: "ascii_general_ci",
-                oldClrType: typeof(Guid),
-                oldType: "char(36)",
-                oldNullable: true)
-                .OldAnnotation("Relational:Collation", "ascii_general_ci");
-
-            migrationBuilder.AddPrimaryKey(
-                name: "PK_OrderItems",
-                table: "OrderItems",
-                columns: new[] { "FK_OrderId", "FK_ItemId" });
-
-            migrationBuilder.InsertData(
-                table: "OrderItems",
-                columns: new[] { "FK_ItemId", "FK_OrderId", "CreatedAt", "Id", "IsActive", "Quantity", "QuantityFulfilled", "UnitPrice" },
-                values: new object[,]
-                {
-                    { new Guid("23000000-0000-0000-0000-000000000001"), new Guid("33000000-0000-0000-0000-000000000001"), new DateTime(2026, 8, 25, 9, 0, 0, 0, DateTimeKind.Unspecified), new Guid("34000000-0000-0000-0000-000000000001"), true, 30, 30, 60m },
-                    { new Guid("23000000-0000-0000-0000-000000000003"), new Guid("33000000-0000-0000-0000-000000000001"), new DateTime(2026, 8, 25, 9, 0, 0, 0, DateTimeKind.Unspecified), new Guid("34000000-0000-0000-0000-000000000002"), true, 24, 24, 50m },
-                    { new Guid("23000000-0000-0000-0000-000000000002"), new Guid("33000000-0000-0000-0000-000000000002"), new DateTime(2026, 8, 30, 10, 0, 0, 0, DateTimeKind.Unspecified), new Guid("34000000-0000-0000-0000-000000000003"), true, 10, 0, 120m }
-                });
-        }
-    }
-}

Distribution/Migrations/AppDBContextModelSnapshot.cs

@@ -536,55 +536,6 @@ namespace Distribution.Migrations
                         });
                 });
 
-            modelBuilder.Entity("Distribution.Models.Invoice", b =>
-                {
-                    b.Property<Guid>("Id")
-                        .ValueGeneratedOnAdd()
-                        .HasColumnType("char(36)");
-
-                    b.Property<DateTime>("CreatedAt")
-                        .HasColumnType("datetime(6)");
-
-                    b.Property<Guid>("CreatedByUserId")
-                        .HasColumnType("char(36)");
-
-                    b.Property<Guid>("FK_OrderId")
-                        .HasColumnType("char(36)");
-
-                    b.Property<DateTime?>("FinalizedAt")
-                        .HasColumnType("datetime(6)");
-
-                    b.Property<Guid?>("FinalizedByUserId")
-                        .HasColumnType("char(36)");
-
-                    b.Property<bool>("IsActive")
-                        .HasColumnType("tinyint(1)");
-
-                    b.Property<DateTime?>("PrintedAt")
-                        .HasColumnType("datetime(6)");
-
-                    b.Property<Guid?>("PrintedByUserId")
-                        .HasColumnType("char(36)");
-
-                    b.Property<int>("Status")
-                        .HasColumnType("int");
-
-                    b.Property<decimal>("TotalAmount")
-                        .HasColumnType("decimal(65,30)");
-
-                    b.HasKey("Id");
-
-                    b.HasIndex("CreatedByUserId");
-
-                    b.HasIndex("FK_OrderId");
-
-                    b.HasIndex("FinalizedByUserId");
-
-                    b.HasIndex("PrintedByUserId");
-
-                    b.ToTable("Invoices");
-                });
-
             modelBuilder.Entity("Distribution.Models.Item", b =>
                 {
                     b.Property<Guid>("Id")
@@ -817,19 +768,10 @@ namespace Distribution.Migrations
                         .ValueGeneratedOnAdd()
                         .HasColumnType("char(36)");
 
-                    b.Property<DateTime?>("ConfirmedAt")
-                        .HasColumnType("datetime(6)");
-
-                    b.Property<Guid?>("ConfirmedByUserId")
-                        .HasColumnType("char(36)");
-
                     b.Property<DateTime>("CreatedAt")
                         .HasColumnType("datetime(6)");
 
-                    b.Property<Guid>("CreatedByUserId")
-                        .HasColumnType("char(36)");
-
-                    b.Property<Guid?>("FK_SaleId")
+                    b.Property<Guid>("FK_SaleId")
                         .HasColumnType("char(36)");
 
                     b.Property<Guid>("FK_StoreId")
@@ -838,10 +780,6 @@ namespace Distribution.Migrations
                     b.Property<DateTime?>("FulfilledAt")
                         .HasColumnType("datetime(6)");
 
-                    b.Property<Guid?>("InvoiceId")
-                        .HasColumnType("char(36)")
-                        .HasColumnName("InvoiceId");
-
                     b.Property<bool>("IsActive")
                         .HasColumnType("tinyint(1)");
 
@@ -856,10 +794,6 @@ namespace Distribution.Migrations
 
                     b.HasKey("Id");
 
-                    b.HasIndex("ConfirmedByUserId");
-
-                    b.HasIndex("CreatedByUserId");
-
                     b.HasIndex("FK_SaleId")
                         .IsUnique();
 
@@ -872,7 +806,6 @@ namespace Distribution.Migrations
                         {
                             Id = new Guid("33000000-0000-0000-0000-000000000001"),
                             CreatedAt = new DateTime(2026, 8, 25, 9, 0, 0, 0, DateTimeKind.Unspecified),
-                            CreatedByUserId = new Guid("29000000-0000-0000-0000-000000000002"),
                             FK_SaleId = new Guid("32000000-0000-0000-0000-000000000001"),
                             FK_StoreId = new Guid("26000000-0000-0000-0000-000000000001"),
                             FulfilledAt = new DateTime(2026, 8, 25, 13, 0, 0, 0, DateTimeKind.Unspecified),
@@ -885,7 +818,6 @@ namespace Distribution.Migrations
                         {
                             Id = new Guid("33000000-0000-0000-0000-000000000002"),
                             CreatedAt = new DateTime(2026, 8, 30, 10, 0, 0, 0, DateTimeKind.Unspecified),
-                            CreatedByUserId = new Guid("29000000-0000-0000-0000-000000000003"),
                             FK_SaleId = new Guid("32000000-0000-0000-0000-000000000002"),
                             FK_StoreId = new Guid("26000000-0000-0000-0000-000000000005"),
                             IsActive = true,
@@ -897,17 +829,16 @@ namespace Distribution.Migrations
 
             modelBuilder.Entity("Distribution.Models.OrderItem", b =>
                 {
-                    b.Property<Guid>("Id")
-                        .ValueGeneratedOnAdd()
+                    b.Property<Guid>("FK_OrderId")
+                        .HasColumnType("char(36)");
+
+                    b.Property<Guid>("FK_ItemId")
                         .HasColumnType("char(36)");
 
                     b.Property<DateTime>("CreatedAt")
                         .HasColumnType("datetime(6)");
 
-                    b.Property<Guid>("FK_ItemId")
-                        .HasColumnType("char(36)");
-
-                    b.Property<Guid>("FK_OrderId")
+                    b.Property<Guid>("Id")
                         .HasColumnType("char(36)");
 
                     b.Property<bool>("IsActive")
@@ -922,21 +853,19 @@ namespace Distribution.Migrations
                     b.Property<decimal>("UnitPrice")
                         .HasColumnType("decimal(65,30)");
 
-                    b.HasKey("Id");
+                    b.HasKey("FK_OrderId", "FK_ItemId");
 
                     b.HasIndex("FK_ItemId");
 
-                    b.HasIndex("FK_OrderId");
-
                     b.ToTable("OrderItems");
 
                     b.HasData(
                         new
                         {
-                            Id = new Guid("34000000-0000-0000-0000-000000000001"),
-                            CreatedAt = new DateTime(2026, 8, 25, 9, 0, 0, 0, DateTimeKind.Unspecified),
-                            FK_ItemId = new Guid("23000000-0000-0000-0000-000000000001"),
                             FK_OrderId = new Guid("33000000-0000-0000-0000-000000000001"),
+                            FK_ItemId = new Guid("23000000-0000-0000-0000-000000000001"),
+                            CreatedAt = new DateTime(2026, 8, 25, 9, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("34000000-0000-0000-0000-000000000001"),
                             IsActive = true,
                             Quantity = 30,
                             QuantityFulfilled = 30,
@@ -944,10 +873,10 @@ namespace Distribution.Migrations
                         },
                         new
                         {
-                            Id = new Guid("34000000-0000-0000-0000-000000000002"),
-                            CreatedAt = new DateTime(2026, 8, 25, 9, 0, 0, 0, DateTimeKind.Unspecified),
-                            FK_ItemId = new Guid("23000000-0000-0000-0000-000000000003"),
                             FK_OrderId = new Guid("33000000-0000-0000-0000-000000000001"),
+                            FK_ItemId = new Guid("23000000-0000-0000-0000-000000000003"),
+                            CreatedAt = new DateTime(2026, 8, 25, 9, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("34000000-0000-0000-0000-000000000002"),
                             IsActive = true,
                             Quantity = 24,
                             QuantityFulfilled = 24,
@@ -955,10 +884,10 @@ namespace Distribution.Migrations
                         },
                         new
                         {
-                            Id = new Guid("34000000-0000-0000-0000-000000000003"),
-                            CreatedAt = new DateTime(2026, 8, 30, 10, 0, 0, 0, DateTimeKind.Unspecified),
-                            FK_ItemId = new Guid("23000000-0000-0000-0000-000000000002"),
                             FK_OrderId = new Guid("33000000-0000-0000-0000-000000000002"),
+                            FK_ItemId = new Guid("23000000-0000-0000-0000-000000000002"),
+                            CreatedAt = new DateTime(2026, 8, 30, 10, 0, 0, 0, DateTimeKind.Unspecified),
+                            Id = new Guid("34000000-0000-0000-0000-000000000003"),
                             IsActive = true,
                             Quantity = 10,
                             QuantityFulfilled = 0,
@@ -1094,9 +1023,6 @@ namespace Distribution.Migrations
                         .ValueGeneratedOnAdd()
                         .HasColumnType("char(36)");
 
-                    b.Property<decimal?>("AgencyMarginPercent")
-                        .HasColumnType("decimal(65,30)");
-
                     b.Property<DateTime>("CreatedAt")
                         .HasColumnType("datetime(6)");
 
@@ -1115,9 +1041,6 @@ namespace Distribution.Migrations
                     b.Property<decimal>("Price")
                         .HasColumnType("decimal(65,30)");
 
-                    b.Property<decimal?>("RetailPrice")
-                        .HasColumnType("decimal(65,30)");
-
                     b.HasKey("Id");
 
                     b.HasIndex("FK_ItemId");
@@ -2376,8 +2299,6 @@ namespace Distribution.Migrations
                             CreatedAt = new DateTime(2026, 8, 15, 0, 0, 0, 0, DateTimeKind.Unspecified),
                             CreatedBy = new Guid("29000000-0000-0000-0000-000000000001"),
                             FK_ItemId = new Guid("23000000-0000-0000-0000-000000000001"),
-                            FromLocationId = new Guid("00000000-0000-0000-0000-000000000000"),
-                            FromLocationType = 2,
                             Quantity = 200m,
                             ReferenceId = new Guid("43000000-0000-0000-0000-000000000001"),
                             ToLocationId = new Guid("27000000-0000-0000-0000-000000000001"),
@@ -2408,8 +2329,6 @@ namespace Distribution.Migrations
                             FromLocationType = 1,
                             Quantity = 30m,
                             ReferenceId = new Guid("32000000-0000-0000-0000-000000000001"),
-                            ToLocationId = new Guid("00000000-0000-0000-0000-000000000000"),
-                            ToLocationType = 2,
                             Type = 0
                         });
                 });
@@ -3371,39 +3290,6 @@ namespace Distribution.Migrations
                     b.Navigation("PurchaseOrderItem");
                 });
 
-            modelBuilder.Entity("Distribution.Models.Invoice", b =>
-                {
-                    b.HasOne("Distribution.Models.User", "CreatedByUser")
-                        .WithMany()
-                        .HasForeignKey("CreatedByUserId")
-                        .OnDelete(DeleteBehavior.Restrict)
-                        .IsRequired();
-
-                    b.HasOne("Distribution.Models.Order", "Order")
-                        .WithMany()
-                        .HasForeignKey("FK_OrderId")
-                        .OnDelete(DeleteBehavior.Restrict)
-                        .IsRequired();
-
-                    b.HasOne("Distribution.Models.User", "FinalizedByUser")
-                        .WithMany()
-                        .HasForeignKey("FinalizedByUserId")
-                        .OnDelete(DeleteBehavior.Restrict);
-
-                    b.HasOne("Distribution.Models.User", "PrintedByUser")
-                        .WithMany()
-                        .HasForeignKey("PrintedByUserId")
-                        .OnDelete(DeleteBehavior.Restrict);
-
-                    b.Navigation("CreatedByUser");
-
-                    b.Navigation("FinalizedByUser");
-
-                    b.Navigation("Order");
-
-                    b.Navigation("PrintedByUser");
-                });
-
             modelBuilder.Entity("Distribution.Models.Item", b =>
                 {
                     b.HasOne("Distribution.Models.Uom", "BaseUom")
@@ -3475,21 +3361,11 @@ namespace Distribution.Migrations
 
             modelBuilder.Entity("Distribution.Models.Order", b =>
                 {
-                    b.HasOne("Distribution.Models.User", "ConfirmedByUser")
-                        .WithMany()
-                        .HasForeignKey("ConfirmedByUserId")
-                        .OnDelete(DeleteBehavior.Restrict);
-
-                    b.HasOne("Distribution.Models.User", "CreatedByUser")
-                        .WithMany()
-                        .HasForeignKey("CreatedByUserId")
-                        .OnDelete(DeleteBehavior.Restrict)
-                        .IsRequired();
-
                     b.HasOne("Distribution.Models.Sale", "Sale")
                         .WithMany()
                         .HasForeignKey("FK_SaleId")
-                        .OnDelete(DeleteBehavior.Restrict);
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
 
                     b.HasOne("Distribution.Models.Store", "Store")
                         .WithMany()
@@ -3497,10 +3373,6 @@ namespace Distribution.Migrations
                         .OnDelete(DeleteBehavior.Cascade)
                         .IsRequired();
 
-                    b.Navigation("ConfirmedByUser");
-
-                    b.Navigation("CreatedByUser");
-
                     b.Navigation("Sale");
 
                     b.Navigation("Store");

Distribution/Models/Enums.cs

@@ -1,7 +1,7 @@
 namespace Distribution.Models
 {
     public enum LocationType
-    {  Warehouse, Vehicle, External }
+    {  Warehouse, Vehicle }
 
     public enum KycStatus { Pending,Verified, Rejected }
 
@@ -23,12 +23,6 @@ namespace Distribution.Models
 
     public enum OrderStatus { Pending, PartiallyFulfilled, Fulfilled, Cancelled }
 
-    public enum InvoiceStatus { Draft, Printed, Finalized }
-
-    public enum InvoiceCreationMode { A, B }
-
-    public enum DiscountType { Amount, Percentage }
-
     public enum PaymentStatus { Pending, PartiallyPaid, Paid }
 
     public enum PaymentMethod { Cash, Credit }