admin/pos-system
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
656 Commits 1 Branch 0 Tags
659e8e05e5b89dac4a5fd636627eba826a99eb5d
Commit Graph

656 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ho Ngoc Hai
659e8e05e5 fix: POS settings button navigates by role — staff→/staff, admin→/admin 
PosLayout.razor hardcoded navigation to /admin for the settings button
and sidebar link, causing staff users to land on the admin page.
Now uses AuthStateService.GetPortalUrl() for role-aware routing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-14 07:24:08 +07:00
Ho Ngoc Hai
b40662fbd8 docs: pure staff session POS tests — 38/41 pass 
Added T39-T41: Staff POS tested with only aPOS_token_staff
(admin token removed). Bank transfer 120k, dashboard 358k,
order history all verified in staff-only context.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-14 07:17:17 +07:00
Ho Ngoc Hai
eda45e11a3 docs: Staff POS E2E complete — 35/38 pass, full order flow verified 
Added T35-T38: Staff POS order creation (238k cash), pending orders
(6 orders with status filters), POS dashboard (real revenue), and
order history (4 orders across 7 days). All Staff POS features working.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-14 07:06:37 +07:00
Ho Ngoc Hai
a1e36f1266 docs: POS E2E test results — 31/34 pass, cash + bank transfer verified 
Added T28-T34: full POS order flow tests (create order, cash payment
with change, bank transfer, order history, dashboard, finance, reports).
Updated CTO report with P0 bug fixes and deployment readiness.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 22:03:55 +07:00
Ho Ngoc Hai
cb5bc95b8d fix: remove [Authorize] from BFF OrderController — BFF proxies don't configure auth schemes 
BFF server forwards JWT via AuthForwardingHandler to downstream services.
Adding [Authorize] on BFF controllers causes "No authenticationScheme was specified"
error since the BFF server itself has no JWT middleware configured.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 22:02:24 +07:00
Ho Ngoc Hai
dd74b05189 docs: CTO report — both bugs verified fixed on Chrome UI 
P2: POS duplicates were DB seed issue (9 records deleted), now 9 unique products.
P3: Settings shop name now shows "Cobic Coffee" correctly.
Both verified visually on Chrome.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 21:31:09 +07:00
Ho Ngoc Hai
db72640198 docs: update CTO deployment report — bugs fixed, ready for staging 
Both P2 (duplicate POS products) and P3 (settings shop name) resolved
in commit 344be33. Updated checklist and next steps.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 21:27:22 +07:00
Ho Ngoc Hai
344be332d7 fix: resolve POS duplicate products + settings shop name display 
P2: Products appeared 2x in POS grid — BFF now filters isActive=true
by default, plus client-side dedup by product ID as safety net.
P3: Admin Settings showed "--" for shop name — parent ShopPage now
passes ShopName and VerticalLabel parameters to ShopSettings component.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 21:26:08 +07:00
Ho Ngoc Hai
5e666010b6 docs: QA complete — 24/27 pass, CTO deployment report created 
27 test cases covering all admin (15 pages) and staff (7 pages) features.
Zero regressions from Wave 1-3 fixes. 2 bugs found: duplicate POS products (P2),
settings shop name display (P3). Recommendation: ready for staging.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 21:18:03 +07:00
Ho Ngoc Hai
ea1608cf94 docs: TESTER_TRACKER — 11/14 tests passed on Chrome UI 
Regression test after Wave 1-3 fixes (202 files changed):
- T1-T8: All core flows PASS (admin login, staff login, dashboard,
  schedule, attendance, leave)
- T10-T11: Auth token + multi-role sessions PASS
- T13: Empty states PASS
- No regressions found from code changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 20:46:18 +07:00
Ho Ngoc Hai
4f8a205af0 docs: CTO_FIX_TRACKER — all 3 waves complete 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 20:34:31 +07:00
Ho Ngoc Hai
efabe49157 refactor(P2): standardize API responses + fix migrations + cleanup DI 
Wave 3 — 3 parallel agents fixing P2 code quality issues:

Response format standardization (30 controllers across 8 services):
- Wrapped all raw DTO returns with { success: true, data: result }
- Standardized error responses with { success: false, error: { code, message } }
- Services: chat, social, membership, ads-manager, ads-serving,
  ads-billing, ads-tracking, ads-analytics
- booking-service already compliant (skipped)

Migration fixes:
- ads-billing: Fixed InvoiceId1 spurious FK (explicit HasMany navigation)
- Removed unused IRequestManager DI from: ads-analytics, ads-serving,
  booking, mkt-facebook (classes preserved for future use)

Unused dependencies:
- No Redis/Dapper DI registrations found (only NuGet refs, kept as-is)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 20:34:10 +07:00
Ho Ngoc Hai
52c818ea83 docs: update CTO_FIX_TRACKER — Wave 1+2 complete (P0+P1 resolved) 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 20:24:30 +07:00
Ho Ngoc Hai
59b2cecaf2 feat(P1): add 57 validators + 10 missing handlers across 13 services 
Wave 2 — 3 parallel agents fixing P1 issues:

Validators (57 new FluentValidation validators):
- ads-manager: 10 validators for all commands
- ads-billing: 3 validators for all commands
- ads-tracking: 2 validators for missing commands
- ads-analytics: 1 validator for CreateReport
- social: 8 validators for all commands
- mining: 16 validators for all commands
- mission: 4 validators for all commands
- promotion: 13 validators for all commands

Missing handlers (10 implemented):
- promotion: ExchangeVoucher, PurchaseVoucher, SearchVouchers,
  GetCampaignStatistics, GetCampaignVouchers
- mission: GetUserMissionProgress
- mkt-facebook: GetConversations, GetCustomers
- ads-manager: ListAudiences, GetAudienceById

All validators use bilingual messages (EN/VI) and are auto-registered
via MediatR ValidatorBehavior pipeline.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 20:24:06 +07:00
Ho Ngoc Hai
f8606e0447 fix(P0): security hardening + critical bug fixes across 22 services 
Wave 1 — 6 parallel agents fixing P0 issues from code audit:

Auth (18 services secured):
- Added JWT Bearer auth + [Authorize] to all unprotected controllers
- Webhook endpoints (Facebook/WhatsApp/Zalo/X) stay [AllowAnonymous]
- Health checks remain public for Docker/K8s probes
- Services: catalog, order, booking, fnb-engine, inventory, social,
  ads-manager, ads-serving, ads-billing, ads-tracking, ads-analytics,
  mkt-facebook, mkt-whatsapp, mkt-x, mkt-zalo, promotion

Template artifacts (4 services):
- mission-service: myservice_db → mission_service
- mkt-facebook: Dockerfile MyService.API → FacebookService.API
- mkt-whatsapp: MyServiceContext.cs → WhatsAppServiceContext.cs
- promotion: UserSecretsId fixed

Critical handler bugs (7 fixes):
- ads-tracking: TrackPixelEventHandler now persists to DB
- ads-tracking: RecordConversion endpoint exposed via controller
- booking: UpdateResource now applies Name + Capacity changes
- ads-manager: ListPendingAds uses correct enum (pending_review)
- mining: BanMiner calls Ban() not Suspend()
- mining: ResetMinerStreak now actually resets streak
- mkt-x: 8 missing repository DI registrations added

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 20:18:09 +07:00
Ho Ngoc Hai
f3779c4ebe docs: add SERVICE_DOCS.md for all 24 microservices from per-service code audit 
Each SERVICE_DOCS.md documents: Overview, API Endpoints, Commands, Queries,
Domain Model, Database Schema, Integration Events, Dependencies, Configuration.
Generated by 23 parallel audit agents reading actual source code.

Key corrections from audit:
- inventory-service: 12 commands/6 queries (was listed as scaffold)
- promotion-service: 12 commands/10 queries (was listed as 0)
- mission-service: 4 commands/7 queries (was listed as 0)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 17:54:53 +07:00
Ho Ngoc Hai
afe8b7c966 docs: comprehensive ROADMAP rewrite from full platform audit 
- 4 parallel agents audited: backend (23 services), frontend (5 apps),
  infrastructure (Docker/K8s/CI/CD), database schemas
- Corrected service status: 15 production-ready, 5 in-progress, 3 scaffold
  (was inaccurately showing 8 production-ready)
- Added deployment matrix: Docker/Traefik/K8s/CI coverage per service
- Identified critical gaps: inventory (1/12 handlers), promotion (0),
  mission (0), 13 missing Traefik routes, 4 mkt-* not in Docker
- Updated POS vertical status with actual page counts (141 total)
- Added database architecture section (multi-tenant patterns)
- Added environment/test accounts with verified IDs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 17:38:46 +07:00
Ho Ngoc Hai
fffedea785 fix: schedule pages — real API data, role display, time formatting 
- Rewrite StaffSchedule.razor from hardcoded stub to real API integration
  (profile → shop schedules → filter by staffId)
- Fix admin ShopSchedule role column: use staff role from merchant data
  instead of showing "—"
- Add FormatTime() helper to strip seconds from time display (08:00:00 → 08:00)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 17:06:40 +07:00
Ho Ngoc Hai
deffb9de4a fix: resolve attendance staffName display and token conflict between staff/admin sessions 
1. Attendance API now joins with MerchantStaff to return staffName instead of showing truncated staffId
2. AuthService uses role-suffixed localStorage keys (aPOS_token_owner, aPOS_token_staff) to prevent
   staff and admin tokens from overwriting each other on the same origin

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 16:38:01 +07:00
Ho Ngoc Hai
ddd02be26e feat: Display attendance times in local timezone and calculate staff leave statistics from real data, removing stub notifications. 2026-03-13 16:23:00 +07:00
Ho Ngoc Hai
598193e6cb fix: wire up admin attendance page to real API, add BFF shop attendance endpoint 
- BFF: add GET /api/bff/shops/{shopId}/attendance proxy to merchant-service
- ShopAttendance.razor: replace mock data with real attendance API call
- Calculate present/late/absent counts from actual attendance records

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 15:30:12 +07:00
Ho Ngoc Hai
8086bc627f fix: resolve HR module bugs — leave approval, staff auth timing, EF Core mapping 
- BFF: extract approver/rejector userId from JWT instead of accepting Guid.Empty from client
- Staff pages (Dashboard, Leave, Attendance): move data loading to OnAfterRenderAsync
  to fix token timing bug where OnInitializedAsync runs before auth session is restored
- EF Core: fix AttendanceRepository to use public properties after HasField() migration
- LeaveRequest: fix DateTime UTC kind for Npgsql 10 compatibility
- merchant-service: add debug seed endpoints for staff/shop test data
- EF configs: migrate to HasField() pattern for private field mapping

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 15:23:35 +07:00
Ho Ngoc Hai
aba5ee1162 fix: resolve inventory display bugs — transaction history & item type mapping 
- Fix DTO field mismatch: QuantityChange→Quantity, Reason→Notes in PosDataService
- Fix ItemType enum mismatch: FinishedProduct→FinishedGood, Supply→Consumable in ShopInventory
- Add ResolveTransactionTypeName fallback in InventoryMapper when Type nav property is null
- Add "In"/"Out" alternative matches for TransactionType in history display

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-13 13:54:44 +07:00
Ho Ngoc Hai
e4e7cca1ce fix: resolve Blazor compilation errors — RZ9986, RZ10010, CS0246 
- StaffPerformance.razor: fix mixed C#/markup in Style attributes (RZ9986) using @($"...")
- AppointmentCalendar.razor: fix duplicate DateChanged parameter (RZ10010) using @bind-Date:after
- RetailDesktop.razor: add missing @using WebClientTpos.Client.Services (CS0246)
- ReturnDialog.razor: add missing @using WebClientTpos.Client.Services (CS0246)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 01:26:25 +07:00
Ho Ngoc Hai
5c3d90ee44 docs: update ROADMAP — Phase 2 close-out complete, all 5 verticals working 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 19:59:05 +07:00
Ho Ngoc Hai
76b5e6afd0 feat: Phase 2 close-out — multi-branch management, production K8s, revenue dashboard UI, responsive POS 
Backend:
- Multi-branch shop management: SetDefaultShop, TransferShop commands, GetMerchantShops paginated query
- Shop aggregate: IsDefault field, SetAsDefault/ClearDefault/TransferOwnership behavior methods
- 2 new domain events: ShopSetAsDefaultDomainEvent, ShopTransferredDomainEvent

Frontend:
- Revenue Dashboard (MudChart line/donut/bar, 4 KPI cards, top products table)
- Staff Performance (sortable table, color-coded completion rates, CSV export)
- Customer QR Menu page (/menu/{ShopId}, mobile-first, Vietnamese labels)
- QR Code Generator admin page (batch generate, print-all, per-table QR)
- Responsive POS layout (collapsible sidebar, slide-out order drawer, touch-friendly CSS)
- ResponsiveOrderPanel component (desktop inline / tablet drawer / mobile overlay)

Infrastructure:
- Production K8s manifests: 8 services (3 replicas, 512Mi-1Gi, HPA min3/max10), Redis with persistence
- Production ingress: api.goodgo.vn, cert-manager TLS, rate-limit middleware
- Deploy script: pre-flight checks, dry-run, single-service deploy, rollback support
- CI/CD: deploy-production.yml with environment approval, commit SHA tags
- Prometheus full scrape config (11 targets), docker-compose observability stack
- Production deployment checklist (80+ items)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 19:58:40 +07:00
Ho Ngoc Hai
a6ea9fa29b docs: update ROADMAP — Phase 2 W7-8 complete (analytics, QR menu, E2E tests, observability) 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 19:52:20 +07:00
Ho Ngoc Hai
dc1ea7c0d2 feat: Phase 2 W7-8 production readiness — QR menu, analytics, E2E tests, observability 
- Public QR menu: BFF proxy endpoints (no auth), PosDataService public methods
- Revenue analytics + staff performance: Dapper queries, validators, BFF proxy
- Playwright E2E tests: 8 spec files covering auth, admin, 5 POS verticals, reports
- Observability: Grafana dashboard (HTTP metrics, infra, business), Prometheus alert rules
- Fixes: validator frozen-date bug (Must vs LessThanOrEqualTo), PublicMenuController logging + CancellationToken

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 19:51:37 +07:00
Ho Ngoc Hai
870f1218f8 feat: Phase 2 frontend — Spa, Retail, Cafe Blazor UI pages and BFF proxies 
Spa/Beauty UI (booking-service integration):
- TherapistManagement.razor: CRUD table, specialty multi-select, working hours
- AppointmentCalendar.razor: daily calendar grouped by therapist, color-coded statuses
- ShopTherapists embedded component for ShopPage, sidebar menu for spa/beauty
- BookingController BFF: therapist CRUD + appointment proxy endpoints
- Localization: vi-VN + en-US for "Nhân viên trị liệu"

Retail POS UI (catalog + inventory + order integration):
- RetailDesktop.razor: barcode input, API lookup, stock badges, cart warnings
- ReturnDialog.razor: order lookup, return/exchange mode toggle, refund summary
- StockOverview.razor: admin stock table, search/filter, threshold edit dialog
- PosDataService: barcode lookup, bulk stock, return/exchange API methods

Cafe UI (membership + fnb-engine integration):
- StampCard.razor: visual stamp grid, animated fill, celebration UI, claim/reset
- BaristaQueue.razor: 3-column Kanban, stats bar, auto-refresh 10s, pulse animation
- CafeController BFF: stamp cards + barista queue proxy endpoints

Infrastructure:
- Traefik: added /api/v1/therapists + /api/v1/appointments to booking-service
- ROADMAP: Phase 2 vertical tasks DONE, UI refinement IN-PROGRESS

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 17:03:55 +07:00
Ho Ngoc Hai
0d03feeffd feat: Phase 2 multi-vertical expansion — Spa appointments, Retail POS, Cafe loyalty 
Spa/Beauty (booking-service) — Therapist + Appointment scheduling:
- Therapist aggregate: specialties (text[]), workingHours (jsonb), CRUD
- Appointment: notes field, Pending initial status, MarkNoShow() behavior
- TherapistsController (4 endpoints), 9 FluentValidation validators
- EF config: PostgreSQL native text[] + jsonb column types

Retail POS (catalog + inventory + order) — Barcode, stock, returns:
- Product: barcode/SKU fields, GetProductByBarcodeQuery (lookup endpoint)
- Inventory: bulk stock check, low stock alert threshold (SetReorderLevel)
- Order: return/exchange flow with ProcessReturn(), Returned status (id=8)
- CreateReturnCommand, CreateExchangeCommand (same UnitOfWork)
- 2 domain events: OrderReturnedDomainEvent, OrderExchangedDomainEvent
- 6 new API endpoints across 3 services

Cafe (membership + fnb-engine) — Loyalty stamps + barista queue:
- StampCard aggregate: AddStamp(), ClaimReward(), Reset(), 4 domain events
- Auto-create card on first stamp (friction-free UX)
- StampCardsController (6 endpoints), 4 commands, 2 queries
- BaristaQueueItem: 5-status workflow (Queued→Preparing→Ready→Delivered)
- BaristaController (6 endpoints), 5 commands, 2 queries
- Tenant isolation (shop-level) on both features

ROADMAP: Phase 1 closed out, Phase 2 vertical tasks IN-PROGRESS

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 16:45:43 +07:00
Ho Ngoc Hai
a7a753bf38 feat: EOD reports, security audit (rate limiting + 44 validators), and 30 critical path tests 
EOD Reports & Daily Close (order-service + Blazor UI):
- GetEodReportQuery: Dapper query for revenue, orders, payment breakdown, top items, hourly chart
- CloseDayCommand: check pending orders, generate final report
- EodReport.razor: 6 KPI cards, donut/bar charts, top 10 table, close-day dialog
- FluentValidation for both query and command
- BFF proxy endpoints for reports

Security Audit — Rate Limiting:
- Tighten auth-ratelimit from 100 to 10 req/min (brute force protection)
- Add payment-ratelimit (30/min), api-ratelimit (100/min), hub-ratelimit (500/min)
- Apply rate limits to ALL Traefik routers (previously many had none)

Security Audit — Input Sanitization (44 missing validators created):
- iam-service: 14 validators (auth, user, role commands)
- merchant-service: 11 validators (admin, attendance commands)
- wallet-service: 7 validators (wallet, points commands)
- fnb-engine: 7 validators (session, table, ticket, reservation)
- catalog-service: 6 validators (product, category CRUD)
- storage-service: 6 validators (upload, share, quota)
- order-service: 2 validators (complete order/payment)

Critical Path Unit Tests (30 new tests):
- inventory-service: 12 tests (deduction, partial stock, idempotency)
- wallet-service: 14 tests (create payment, process callback, domain events)
- fnb-engine: 8 tests (kitchen-served event handler, inventory client integration)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 16:33:39 +07:00
Ho Ngoc Hai
653322b26c fix: resolve 12 critical/high issues from code review across backend, frontend, and infra 
Backend (7 fixes):
- wallet-service: remove conflicting EF Ignore() calls for mapped backing fields
- fnb-engine: remove KitchenTicket short constructor that set productId=orderItemId
- fnb-engine: replace fire-and-forget Task.Run with direct await for inventory deduction
- TenantMiddleware: implement PostgreSQL RLS SET LOCAL in 4 services (wallet, fnb, inventory, catalog)
- order-service: fix SQL injection pattern in TenantMiddleware with Guid.ToString("D")
- order-service: add ValidateShopAccess() authorization check in SignalR PosHub
- 4 services: register IDbConnection (NpgsqlConnection) in DI for RLS middleware

Frontend (3 fixes):
- PosDataService: return Success=false (not true) when PayOrder response parsing fails
- QrPayment: add _disposed guard to prevent timer race condition after component disposal
- BFF OrderController: add [Authorize] attribute to require JWT for all endpoints

Infrastructure (3 fixes):
- docker-compose: upgrade PostgreSQL 15-alpine to 16-alpine per project spec
- init-databases.sh: add 4 missing marketing service databases (mkt_*)
- Traefik routes: add wallet, catalog, booking routers and /api/v1/stock path

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 16:22:08 +07:00
Ho Ngoc Hai
7f8709ac9f docs: thêm dấu tiếng Việt cho toàn bộ agent prompts trong CLAUDE.md 
Sửa tất cả tiếng Việt không dấu thành có dấu đúng chính tả trong
các phần: Product Manager, CTO, Tech Lead, Backend Dev, Frontend Dev,
QA, DevOps, và Workflow section.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 16:10:55 +07:00
Ho Ngoc Hai
cf3a67f275 docs: add Product Manager agent role and update workflow pipeline 
Add PM role with market analysis, user stories, PRD creation, priority matrix,
and Vietnamese merchant personas. Update workflow to include PM as first and
last step in the development pipeline.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 16:07:13 +07:00
Ho Ngoc Hai
9aa4b1b3cf docs: update ROADMAP.md — Phase 1 complete (7/8 P0 done) 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 13:56:29 +07:00
Ho Ngoc Hai
1d12a7980b feat: add order lifecycle integration tests (29 tests) and staging K8s deployment manifests 
Testing (P0-7):
- 29 functional tests for order-service API (create/pay/complete/cancel lifecycle)
- CustomWebApplicationFactory with InMemory DB, mocked wallet/SignalR/tenant
- TestAuthHandler for JWT auth in tests
- Full lifecycle tests: cash flow and online payment flow end-to-end

Staging Deployment (P0-8):
- K8s manifests for 8 MVP services + Redis + POS web (namespace, configmap, secrets)
- Traefik Ingress with path-based routing and TLS via cert-manager
- HPA auto-scaling (2-4 replicas, CPU/memory thresholds)
- deploy-staging.sh script with --dry-run and --service flags
- CI/CD: deploy-staging.yml and docker-build.yml with matrix strategy
- Consistent patterns: port 8080, 3 health probes, RollingUpdate

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 13:56:03 +07:00
Ho Ngoc Hai
914dda3fe9 docs: update ROADMAP.md with RLS and FnB tests completion 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 13:41:18 +07:00
Ho Ngoc Hai
6061164873 feat: add multi-tenant row-level security across 5 services and 96 FnB engine unit tests 
Security (P0-5):
- Implement ITenantProvider + HttpContextTenantProvider per service (order, fnb, inventory, catalog, wallet)
- Add EF Core global query filters for tenant isolation (shop_id/user_id based)
- Add TenantMiddleware setting PostgreSQL session variables for RLS
- Create PostgreSQL RLS policies script (scripts/db/rls-policies.sql)
- Adapter pattern bridges API-layer to Infrastructure-layer (Clean Architecture)
- Bypass mechanisms for admin roles, service-to-service calls, and migrations

Testing (P1-12):
- Add 96 unit tests for fnb-engine (up from 3)
- 57 domain entity tests: Table(18), KitchenTicket(12), Session(8), Reservation(13), Recipe(6)
- 39 command handler tests: CRUD operations, status transitions, validation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 13:40:34 +07:00
Ho Ngoc Hai
8af86e9e89 feat: implement Phase 1 payment gateway, real-time SignalR, kitchen-inventory deduction, and order payment flow 
- wallet-service: IPaymentGateway abstraction + VN Pay implementation (HMAC-SHA512, sandbox), Payment aggregate root, PaymentsController with create/callback/query endpoints
- order-service: PosHub SignalR hub with Redis backplane + MessagePack, strongly-typed clients, 3 group types (shop/kds/pos), integrated into Create/Pay/Complete/Cancel order handlers
- fnb-engine + inventory-service: Kitchen→Inventory auto-deduction via domain events, HTTP with Polly retry + circuit breaker, idempotency check, graceful degradation on insufficient stock
- order-service: Enhanced PayOrderCommand with 3 flows (cash/card/online), PaymentPending status, WalletServiceClient, CompleteOrderPaymentCommand for gateway callbacks
- POS frontend: Cash/Card/QR payment components wired to real backend, BFF proxy updated
- infra: Traefik routes for fnb-engine, inventory-service, and SignalR WebSocket hub
- ROADMAP.md: Updated with Phase 1 progress tracking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-06 13:28:46 +07:00
Ho Ngoc Hai
5d9a41fde9 feat(docs): add comprehensive platform roadmap and development tracker 2026-03-06 12:55:25 +07:00
Ho Ngoc Hai
2e1bb65bd3 feat: implement merchant subscription management and enhanced user account/security features with a new BFF layer. 2026-03-06 12:34:53 +07:00
Ho Ngoc Hai
193b9edd23 feat(staff): Integrate kitchen display system, add new staff roles, and enhance staff profile resolution with improved attendance proxying. 2026-03-06 11:42:41 +07:00
Ho Ngoc Hai
30b3f9a37c feat(staff-portal): implement staff attendance and leave request management with dedicated portal UI and backend services 2026-03-06 04:29:00 +07:00
Ho Ngoc Hai
a51ecacfac feat(shop-recipes): add product linking, ingredient display, and edit functionality for recipes. 2026-03-06 03:29:28 +07:00
Ho Ngoc Hai
fd75da34dc feat: enhance inventory management with new item types, stocktake, wastage, and recipe-based deductions 2026-03-05 22:28:45 +07:00
Ho Ngoc Hai
6d5d4108c7 refactor(api, web-client): remove API versioning from services and update client calls, and enhance staff schedule management in the admin UI to support multiple days and shift presets. 2026-03-05 16:40:02 +07:00
Ho Ngoc Hai
3f1ecc8122 feat(booking-service, web-client-tpos): implement staff schedule creation/deletion and enhance staff name display. 2026-03-05 16:19:46 +07:00
Ho Ngoc Hai
81c5be9e37 fix(staff): Vấn đề trạng thái nhân viên "Invited" 2026-03-05 15:56:37 +07:00
Ho Ngoc Hai
e4bedf2cd3 feat(allPos): upgrad frontend 2026-03-05 15:33:23 +07:00
Ho Ngoc Hai
1fb1a5c52c feat(claude): establish detailed agent role definitions and comprehensive project context 2026-03-05 14:30:06 +07:00