ERP_Distribution/Distribution/docs/testbug.md

Test Bugs & Change Tracker

Running log of backend API failures found during testing and the corresponding frontend changes needed. Add one entry per issue found; move to "Resolved" once fixed and verified.

Open

#	Area	Backend API Failure	Frontend Change Needed	Date
3	Sales (Create Sale)	Sale create not working	Update the Create Sale modal UI	Sale summary calculation not display
4	Orders		Add a View icon to the action column in Orders table	2026-09-01
5	Payments (Record Payment)	Cannot add new payment	Add a View icon to the action column in Payments table	2026-09-01
6	Sales → Visits (Route dropdown)	Selecting a specific route in the route dropdown does not filter route sales — all routes still show; check-in also not working	Fix route filter and check-in on Sales Visits page	2026-09-02
7	Catalogue → Categories (Subcategories)	Added subcategories don't display in the FE	Fix subcategory list rendering	Add a View icon to the action column in Categories table
8	Stock Balances		Add a View icon to the action column in Stock Balances table; allow Edit	2026-09-02
9	Stock Movements	Some rows missing From/To locations — every movement should always have both	Add a View icon and an Edit icon to the action column in Stock Movements table	2026-09-02
10	Procurement → Orders (Place Order)	Placing a new order throws: var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();	Add action icons to the action column in Procurement Orders table	2026-09-02
11	Procurement → GRN		Full module CRUD check pending (CRUD + action icons)	2026-09-02
12	Pricing		Full module CRUD check pending (frontend + CRUD + action icons)	2026-09-02
13	Pricing → Schemes (Add Scheme modal)		Add Scheme modal should show a rule-type-specific "value" input field that changes based on the selected Scheme Name/Rule Type (currently no dynamic value field for the chosen rule type)	2026-09-02
14	Suppliers		Add a View icon and a Cancel icon to the action column in Suppliers table	2026-09-02
15	Driver Profiles	Delete doesn't work	Add a View icon to the action column in Driver Profiles table	2026-09-02
16	Users	Delete action not working	Add View icon	2026-09-02
17	Users → Roles		For now, hide the Add Role icon and the Edit/Cancel (deactivate) icons in the action column; keep only the View icon	2026-09-02
18	Network → Regions	Adding a region that already exists is not blocked — no duplicate-name validation; deleting a region does not work (backend as well)	Add View action icon to the action column; when status is Inactive, region should actually be set to inactive and reflect that status in the frontend	2026-09-02
19	Network → Region Manage		Remove the Rule Config JSON-type field from the frontend view; add a View icon to the action column; on Cancel, just set status to Inactive and reflect that in the UI	2026-09-02
20	Network → Routes	Inactive status doesn't work properly	Check Manage Owner and Manage Stores actions; add View icon to the action column; check Cancel action too	2026-09-02
21	Network → Vehicles		Add a View icon to the action column; check Cancel action	2026-09-02
22	Network → Warehouses	Delete doesn't work	Add a View icon to the action column; check Inactive status	2026-09-02
23	Returns & Claims Management	ReturnController, ClaimController, SupplierClaimController all exist and are fully implemented	No frontend integration at all — no API client, no pages/UI for order returns, claims, or supplier claims. Build the module end-to-end	2026-09-02
24	Procurement → Purchase Returns	PurchaseReturn CRUD fully implemented	No frontend API client and no UI at all for purchase returns. Build the module end-to-end	2026-09-02
25	Orders (CRUD gap)	Create/Update/Delete endpoints exist and work	Orders page is read-only in the frontend — only list/get are wired up; add Create/Update/Delete UI	2026-09-02
26	Pricing → Schemes (unused capability)	Eligibility check, spend/ROI analytics, and apply-scheme-to-order endpoints all exist	None of these are wired into the frontend — only basic scheme CRUD is; add UI for eligibility check, spend/ROI view, and applying a scheme to an order	2026-09-02
27	Misc missing Delete actions	Delete/soft-delete endpoints exist for Users, Stores, Price Lists, and Suppliers	No Delete UI wired up for these on their respective pages	2026-09-02
28	Auth (root cause of #10 and likely others)	The actually-registered middleware is Distribution/Middleware/AuthMiddleware.cs (app.UseMiddleware<AuthMiddleware>() in Program.cs) — a plain, symmetric-key JWT check, NOT the RSA-based Infra/Authorization/Middleware/AuthMiddleware.cs/JwtMiddleware.cs, which despite their doc comments claiming to be "reference-only," are actually unregistered/dead. The active middleware reads config["Jwt:Key"], but appsettings.json only defines Jwt:PublicKey (RSA XML, used by AuthHex-issued tokens) — so Jwt:Key is always null, the whole validation block is skipped, and context.User is never set for ANY request, valid token or not. It also never attaches role_id/role_level/username claims the way the dead Infra middleware does. Net effect: ICurrentUserService.UserId/RoleId are always null, so every currentUser.UserId ?? throw new UnauthorizedAccessException() check fails (this is the actual cause of bug #10, Procurement → Orders) and every permission/role-level check silently fails too	Decision: keep Distribution/Middleware/AuthMiddleware.cs (outside Infra) as the one true auth flow going forward; delete the dead unregistered duplicates Infra/Authorization/Middleware/AuthMiddleware.cs and JwtMiddleware.cs. Then fix the active middleware to validate against Jwt:PublicKey (RSA), reject (not silently swallow) invalid/missing tokens, and attach role_id/role_level/username claims from the local User/Role row after validation	2026-09-02

Resolved

#	Area	Backend API Failure	Frontend Change Needed	Fixed In	Date
1	Operations → Rides (Create Ride)	Create Ride failed with "Vehicle not found"	—	Fixed DTO field naming mismatch	2026-09-02
29	Operations → Rides	Cancel-request API routes mismatched	Added View, Edit, and Cancel icons to Rides table	Fixed API routes + added action icons	2026-09-02
30	Operations → Delivery Tasks	Delivery task status update API mismatched	Added View, Confirm Delivery, and Mark as Failed icons	Fixed API routes + added action icons	2026-09-02
32	Sales (Create Sale, van sale)	If any item was short on the vehicle, the whole sale was rejected instead of selling what was available	—	Van sale now sells whatever quantity is on the vehicle per item and is always a clean Completed sale (no partial status)	2026-09-03
33	Operations → Rides (Close Ride)	No validation that meter end >= meter start	Close Ride dialog now enforces meter end >= meter start	Added backend + frontend validation	2026-09-03
2	Operations → Loading Sheets	—	Missing View icon	Added View icon + details modal (status, dispatch/receipt confirmer + timestamps, item-level dispatched/received/resolved breakdown)	2026-09-02

Implementation Guide

Cross-cutting rules to apply consistently across every module/page while working through the entries above:

1. Cancel / Delete semantics — Cancel and Delete actions should never remove a row from the page. They should always set the record's status to Inactive (soft delete) and immediately reflect that updated status in the UI. The row must stay visible in the table after the action.
2. Frontend validation — On every page, check that form validation is handled per the actual business scenario (required fields, duplicate checks, valid ranges/formats) before submitting to the backend.
3. Summary calculations — Verify that any summary/total/aggregate calculations shown on a page (e.g. sale totals, stock summaries) compute and display correctly.
4. UI consistency — Maintain consistent layout, spacing, and interaction patterns across all pages.
5. Icon consistency — Use the correct, consistent icon set for actions (View/Edit/Delete/Cancel/etc.) across every page.
6. Search & filters — Check that the search bar and filters actually filter the table results, and that dropdown filters fetch their options correctly from the backend.