Merge pull request 'Send platform operators to the platform console after sign-in' (#9 ) from fix/operator-landing into main

Reviewed-on: #9
Send platform operators to the platform console after sign-in
2026-10-13 15:06:36 +00:00 · 2026-10-13 18:04:58 +03:00 · 2026-10-13 11:04:47 +00:00 · 2026-10-13 13:57:04 +03:00 · 2026-10-12 09:54:13 +00:00 · 2026-10-12 12:08:15 +03:00
26 changed files with 969 additions and 82 deletions
@@ -98,7 +98,7 @@ seven findings and a retest plan. All of them are addressed on
 | F-04 No way back for deactivated products | Products page lists deactivated products under a toggle, with Reactivate. Deactivating warns about stock still on hand; that stock stays on the Stock page and can be transferred or counted out. |
 | F-05 Eggs shown as litres | Products carry a unit (L, ml, kg, g, pcs, tray, pack), chosen when the product is created and shown everywhere. |
 | F-06 No branch or staff removal | Staff: deactivate/reactivate (previous change). Branches: rename and deactivate/reactivate on the Branches page. A branch can only be deactivated once it has no stock and no active staff; its history stays in reports. |
-| F-07 Purchases shown as cost of goods | Cost of goods sold is now units sold x the product's average buying price. Purchases in the period are shown separately as "Stock purchased", with a "Cash surplus" line. |
+| F-07 Purchases shown as cost of goods | Cost of goods sold covers only units sold (now first-in-first-out per branch; see "Cost of goods sold" below). Purchases in the period are shown separately as "Stock purchased", with a "Cash surplus" line. |
 | STA-04 No invites | Staff and new branch managers can be invited: the owner or manager gets a one-time link (7 days) to send, and the person sets their own password. A new link can be made from Staff. |
 | CAT-12 Zero price, duplicates | Prices must be above zero; product names are unique per business, ignoring case. |
 | OFF-02 Local stock deduction | The till shows each product's stock and deducts every sale immediately, online or offline. |
@@ -181,10 +181,27 @@ business's data.
 - Not guarded, by design: Business (the tenant itself, always looked up by
  the session's id), UserSession, MpesaCallbackLog and StockLock.

+## Cost of goods sold
+
+The profit report costs sales first-in-first-out, per branch
+(`src/lib/server/costing.ts`). It replays the stock ledger in order. Each
+branch keeps queues of stock at the price it was bought at, and a sale
+takes the oldest first.
+
+- **Transfers carry their cost.** Stock moved between branches arrives at
+  what the sending branch paid.
+- **Opening stock and upward counts** are valued at the product's purchase
+  price at the time (or its first purchase price, if they came first).
+- **A sale recorded before its stock** (e.g. an offline sale before the
+  purchase was entered) is costed by the next stock to arrive at that
+  branch. Until then it counts as "units with no purchase cost on record".
+- **Stock written off** by counts or adjustments is shown as "Stock losses"
+  and deducted in net profit. It is not part of cost of goods sold.
+- Each report replays the business's whole stock history. That is fast at
+  pilot volumes; a business with years of history would want stored cost
+  layers instead.
+
 ## Still open
- **Cost of goods is an average.** It uses each product's average buying
-  price across the business, not first-in-first-out per branch. Units sold
-  with no purchase on record are counted and flagged, but have no cost.
 - **M-Pesa, if turned on.** Only one product per payment. A prompt that
  times out still needs a manual check before taking cash.
 - **Not modelled yet:** email verification at signup, sending invites by
@@ -0,0 +1,109 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useRouter } from "next/navigation";
+import { apiFetch, ApiError } from "@/lib/api";
+import { AuthUser } from "@/lib/types";
+
+const inputClass =
+  "tap-target w-full rounded-xl2 border border-depth-200 bg-white px-4 text-depth-900 shadow-sm transition focus:border-flow-500 focus:outline-none focus:ring-2 focus:ring-flow-500/25";
+
+/** The signed-in user changes their own password. */
+export default function ChangePasswordPage() {
+  const router = useRouter();
+  const [me, setMe] = useState<AuthUser | null>(null);
+  const [current, setCurrent] = useState("");
+  const [next, setNext] = useState("");
+  const [confirm, setConfirm] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [done, setDone] = useState(false);
+  const [saving, setSaving] = useState(false);
+
+  useEffect(() => {
+    apiFetch<{ user: AuthUser }>("/api/auth/me")
+      .then((r) => setMe(r.user))
+      .catch(() => router.replace("/login"));
+  }, [router]);
+
+  const home = me?.role === "DELIVERY" ? "/terminal" : "/admin/dashboard";
+
+  async function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setError(null);
+    if (next.length < 8) return setError("The new password must be at least 8 characters.");
+    if (next !== confirm) return setError("The two new passwords do not match.");
+    setSaving(true);
+    try {
+      await apiFetch("/api/auth/password", {
+        method: "POST",
+        body: JSON.stringify({ currentPassword: current, newPassword: next }),
+      });
+      setDone(true);
+      setCurrent("");
+      setNext("");
+      setConfirm("");
+    } catch (err) {
+      setError(err instanceof ApiError ? err.message : "Could not change your password.");
+    }
+    setSaving(false);
+  }
+
+  return (
+    <main className="flex min-h-screen items-center justify-center bg-sand-50 px-5 py-10">
+      <div className="w-full max-w-md rounded-3xl bg-white p-6 shadow-soft">
+        <h1 className="font-display text-2xl font-bold text-depth-900">Change password</h1>
+        {me && <p className="mt-1 text-sm text-depth-600">{me.email}</p>}
+
+        {done ? (
+          <div className="mt-6">
+            <p className="rounded-lg bg-confirm-500/10 px-3 py-2 text-sm text-confirm-600">
+              Your password is changed. Any other phone or computer signed in to your account has been signed out.
+            </p>
+            <button
+              onClick={() => router.replace(home)}
+              className="tap-target mt-4 w-full rounded-full bg-gradient-to-r from-flow-500 to-flow-700 font-display font-semibold text-white"
+            >
+              Back
+            </button>
+          </div>
+        ) : (
+          <form onSubmit={handleSubmit} className="mt-6 space-y-4">
+            <div>
+              <label htmlFor="current-password" className="mb-1.5 block text-sm font-medium text-depth-700">
+                Current password
+              </label>
+              <input id="current-password" type="password" autoComplete="current-password" value={current} onChange={(e) => setCurrent(e.target.value)} className={inputClass} />
+            </div>
+            <div>
+              <label htmlFor="new-password" className="mb-1.5 block text-sm font-medium text-depth-700">
+                New password
+              </label>
+              <input id="new-password" type="password" autoComplete="new-password" value={next} onChange={(e) => setNext(e.target.value)} className={inputClass} />
+            </div>
+            <div>
+              <label htmlFor="confirm-password" className="mb-1.5 block text-sm font-medium text-depth-700">
+                Confirm new password
+              </label>
+              <input id="confirm-password" type="password" autoComplete="new-password" value={confirm} onChange={(e) => setConfirm(e.target.value)} className={inputClass} />
+            </div>
+            {error && (
+              <p role="alert" className="rounded-lg bg-alert-500/10 px-3 py-2 text-sm text-alert-600">
+                {error}
+              </p>
+            )}
+            <button
+              type="submit"
+              disabled={saving}
+              className="tap-target w-full rounded-full bg-gradient-to-r from-flow-500 to-flow-700 font-display font-semibold text-white disabled:opacity-60"
+            >
+              {saving ? "Saving…" : "Change password"}
+            </button>
+            <button type="button" onClick={() => router.replace(home)} className="w-full text-sm text-depth-500 underline">
+              Cancel
+            </button>
+          </form>
+        )}
+      </div>
+    </main>
+  );
+}
@@ -17,6 +17,7 @@ import BranchRankingList from "@/components/admin/BranchRankingList";
 import ActivityFeedMatrix from "@/components/admin/ActivityFeedMatrix";
 import ReconciliationGrid from "@/components/admin/ReconciliationGrid";
 import StockSummaryCard from "@/components/admin/StockSummaryCard";
+import AccountLinks from "@/components/AccountLinks";

 export default function AdminDashboardPage() {
  const router = useRouter();
@@ -112,7 +113,8 @@ export default function AdminDashboardPage() {
  }

  const scope: "global" | "branch" = selectedBranchId === "ALL" ? "global" : "branch";
-  const showNoBranchesNudge = me.role === "SUPER_ADMIN" && branchesLoaded && branches.length === 0;
+  // The operator's own business is a placeholder; don't nudge it to set up branches.
+  const showNoBranchesNudge = me.role === "SUPER_ADMIN" && !me.isPlatformAdmin && branchesLoaded && branches.length === 0;

  return (
    <main className="min-h-screen bg-sand-50 pb-12">
@@ -129,6 +131,13 @@ export default function AdminDashboardPage() {
                ? `${me.branchName} Dashboard`
                : "Branch Dashboard"}
            </h1>
+            <p className="mt-1 text-xs text-sand-200/60">
+              {me.name}
+              {me.isPlatformAdmin && " · Platform operator"}
+            </p>
+            <div className="mt-2">
+              <AccountLinks />
+            </div>
          </div>
          <div className="flex flex-wrap items-center gap-3">
            <GlobalSwitcher
@@ -137,7 +146,7 @@ export default function AdminDashboardPage() {
              onChange={setSelectedBranchId}
              isSuperAdmin={me.role === "SUPER_ADMIN"}
            />
-{me.isPlatformAdmin && (
+            {me.isPlatformAdmin && (
              <Link href="/platform" className="tap-target flex items-center rounded-xl2 bg-gradient-to-r from-flow-500 to-flow-700 px-4 text-sm font-semibold text-depth-950 hover:opacity-90">
                Platform
              </Link>
@@ -145,6 +154,11 @@ export default function AdminDashboardPage() {
            <Link href="/admin/stock" className="tap-target flex items-center rounded-xl2 bg-white/10 px-4 text-sm font-medium text-white hover:bg-white/15">
              Stock
            </Link>
+            {me.role === "SUPER_ADMIN" && (
+              <Link href="/admin/branches" className="tap-target flex items-center rounded-xl2 bg-white/10 px-4 text-sm font-medium text-white hover:bg-white/15">
+                Branches
+              </Link>
+            )}
            <Link href="/admin/products" className="tap-target flex items-center rounded-xl2 bg-white/10 px-4 text-sm font-medium text-white hover:bg-white/15">
              Products
            </Link>
@@ -18,6 +18,7 @@ interface ProfitReport {
  unitsSold: number;
  costOfGoodsSold: number;
  unitsWithoutCost: number;
+  stockLosses: number;
  grossProfit: number;
  expenses: number;
  expenseCount: number;
@@ -121,8 +122,9 @@ export default function ReportsPage() {
      ["  M-Pesa", report.mpesaTotal],
      ["Sales count", report.salesCount],
      ["Units sold", report.unitsSold],
-      ["Cost of goods sold (average purchase cost)", report.costOfGoodsSold],
+      ["Cost of goods sold (FIFO per branch)", report.costOfGoodsSold],
      ["Units sold with no purchase cost on record", report.unitsWithoutCost],
+      ["Stock losses (counts and write-offs)", report.stockLosses],
      ["Gross profit", report.grossProfit],
      ["Expenses", report.expenses],
      ["Estimated net profit", report.netProfit],
@@ -248,7 +250,7 @@ export default function ReportsPage() {
                <p className="text-xs uppercase tracking-wide text-depth-500">Cost of goods sold</p>
                <p className="mt-1 font-display text-2xl font-bold text-depth-900">{money(report.costOfGoodsSold)}</p>
                <p className="mt-1 text-xs text-depth-500">
-                  {report.unitsSold} units sold x average buying price
+                  {report.unitsSold} units sold, each at what its branch paid for its oldest stock (first in, first out)
                  {report.unitsWithoutCost > 0 && ` · ${report.unitsWithoutCost} units have no purchase cost on record`}
                </p>
              </div>
@@ -272,11 +274,11 @@ export default function ReportsPage() {
                >
                  {money(report.netProfit)}
                </p>
-                <p className="mt-1 text-xs text-depth-500">Gross profit − expenses</p>
+                <p className="mt-1 text-xs text-depth-500">Gross profit − expenses − stock losses</p>
              </div>
            </div>

-            <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+            <div className="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-3">
              <div className="rounded-xl2 bg-white p-5 shadow-soft">
                <p className="text-xs uppercase tracking-wide text-depth-500">Stock purchased</p>
                <p className="mt-1 font-display text-2xl font-bold text-depth-900">{money(report.stockPurchases)}</p>
@@ -290,6 +292,15 @@ export default function ReportsPage() {
                <p className="mt-1 font-display text-2xl font-bold text-depth-900">{money(report.cashSurplus)}</p>
                <p className="mt-1 text-xs text-depth-500">Sales − stock purchased − expenses</p>
              </div>
+              <div className="rounded-xl2 bg-white p-5 shadow-soft">
+                <p className="text-xs uppercase tracking-wide text-depth-500">Stock losses</p>
+                <p className={"mt-1 font-display text-2xl font-bold " + (report.stockLosses > 0 ? "text-alert-600" : "text-depth-900")}>
+                  {money(report.stockLosses)}
+                </p>
+                <p className="mt-1 text-xs text-depth-500">
+                  Cost of stock written off by counts, breakage or adjustments. Deducted in net profit.
+                </p>
+              </div>
            </div>

            <div className="flex items-center justify-between rounded-xl2 border border-depth-200 bg-sand-100 px-4 py-3">
@@ -46,7 +46,7 @@ export default function StaffPage() {
  // Inviting is the default: the person sets their own password, so the
  // owner never has to know or pass on anyone's password.
  const [setPasswordNow, setSetPasswordNow] = useState(false);
-  const [inviteLink, setInviteLink] = useState<{ name: string; url: string } | null>(null);
+  const [inviteLink, setInviteLink] = useState<{ name: string; url: string; purpose: "invite" | "reset" } | null>(null);

  const isSuperAdmin = me?.role === "SUPER_ADMIN";

@@ -99,7 +99,7 @@ export default function StaffPage() {
        }),
      });
      show(name.trim() + " added as " + role.replace("_", " ").toLowerCase(), "success");
-      setInviteLink(result.inviteUrl ? { name: name.trim(), url: result.inviteUrl } : null);
+      setInviteLink(result.inviteUrl ? { name: name.trim(), url: result.inviteUrl, purpose: "invite" } : null);
      setName("");
      setBranchId("");
      setPhoneNumber("");
@@ -121,13 +121,35 @@ export default function StaffPage() {
    return s.role === "DELIVERY" && s.branchId === me.branchId;
  }

-  async function newInviteLink(s: StaffMember) {
+  // A new invite link while the person has no password yet; a password
+  // reset link once they have one.
+  async function newPasswordLink(s: StaffMember) {
+    if (!s.invitePending && !window.confirm(`Create a password reset link for ${s.name}? Their current password keeps working until they use it.`)) {
+      return;
+    }
    try {
-      const result = await apiFetch<{ inviteUrl: string }>("/api/users/" + s._id + "/invite", { method: "POST" });
-      setInviteLink({ name: s.name, url: result.inviteUrl });
-      show("New invite link created. The old link no longer works.", "success");
+      const result = await apiFetch<{ inviteUrl: string; purpose: "invite" | "reset" }>("/api/users/" + s._id + "/invite", {
+        method: "POST",
+      });
+      setInviteLink({ name: s.name, url: result.inviteUrl, purpose: result.purpose });
+      show(result.purpose === "reset" ? "Reset link created" : "New invite link created. The old link no longer works.", "success");
    } catch (err) {
-      show(err instanceof ApiError ? err.message : "Could not create an invite link", "error");
+      show(err instanceof ApiError ? err.message : "Could not create a link", "error");
+    }
+  }
+
+  // Owner only: move a manager or cashier to another branch. They are signed
+  // out and sign in again; sales already recorded stay with the old branch.
+  async function moveToBranch(s: StaffMember, branchId: string) {
+    const to = branches.find((b) => b._id === branchId);
+    if (!to || branchId === s.branchId) return;
+    if (!window.confirm(`Move ${s.name} to ${to.branchName}? They will be signed out and must sign in again.`)) return;
+    try {
+      await apiFetch("/api/users/" + s._id, { method: "PATCH", body: JSON.stringify({ branchId }) });
+      show(`${s.name} moved to ${to.branchName}`, "success");
+      await loadStaff();
+    } catch (err) {
+      show(err instanceof ApiError ? err.message : "Could not move this person", "error");
    }
  }

@@ -219,8 +241,15 @@ export default function StaffPage() {

        {inviteLink && (
          <div className="rounded-xl2 border border-confirm-500/30 bg-confirm-500/10 p-4 text-sm text-depth-800">
-            <p className="font-medium">Send this link to {inviteLink.name} so they can set their password.</p>
-            <p className="mt-1 text-xs text-depth-500">It works once and expires in 7 days. Anyone with the link can claim the account, so send it only to them.</p>
+            <p className="font-medium">
+              {inviteLink.purpose === "reset"
+                ? `Send this password reset link to ${inviteLink.name}.`
+                : `Send this link to ${inviteLink.name} so they can set their password.`}
+            </p>
+            <p className="mt-1 text-xs text-depth-500">
+              It works once and expires in {inviteLink.purpose === "reset" ? "24 hours" : "7 days"}. Anyone with the link can
+              take over the account, so send it only to them.
+            </p>
            <input
              readOnly
              value={inviteLink.url}
@@ -233,7 +262,7 @@ export default function StaffPage() {
                Copy link
              </button>
              <a
-                href={`https://wa.me/?text=${encodeURIComponent(`Set your Vessel password here: ${inviteLink.url}`)}`}
+                href={`https://wa.me/?text=${encodeURIComponent(`${inviteLink.purpose === "reset" ? "Reset" : "Set"} your Vessel password here: ${inviteLink.url}`)}`}
                target="_blank"
                rel="noreferrer"
                className="rounded-lg border border-depth-200 bg-white px-3 py-1.5 text-xs font-semibold text-depth-700"
@@ -262,7 +291,7 @@ export default function StaffPage() {
              {staff.map((s) => {
                const branchName = branches.find((b) => b._id === s.branchId)?.branchName;
                return (
-                  <li key={s._id} className="flex items-center justify-between gap-3 px-4 py-3 animate-fade-up">
+                  <li key={s._id} className="flex flex-wrap items-center justify-between gap-3 px-4 py-3 animate-fade-up">
                    <div className={s.isActive ? "" : "opacity-50"}>
                      <p className="font-medium text-depth-900">
                        {s.name}
@@ -276,16 +305,33 @@ export default function StaffPage() {
                        {branchName ? " · " + branchName : ""}
                      </p>
                    </div>
-                    <div className="flex shrink-0 items-center gap-2">
+                    <div className="flex flex-wrap items-center gap-2">
                      <span className={"rounded-full px-2.5 py-1 text-xs font-medium " + roleBadgeStyles[s.role]}>
                        {s.role.replace("_", " ")}
                      </span>
-                      {canManage(s) && s.isActive && s.invitePending && (
+                      {isSuperAdmin && canManage(s) && s.isActive && s.role !== "SUPER_ADMIN" && branches.length > 1 && (
+                        <select
+                          value=""
+                          onChange={(e) => moveToBranch(s, e.target.value)}
+                          aria-label={`Move ${s.name} to another branch`}
+                          className="rounded-lg border border-depth-200 bg-white px-2 py-1 text-xs text-depth-700"
+                        >
+                          <option value="">Move to…</option>
+                          {branches
+                            .filter((b) => b._id !== s.branchId)
+                            .map((b) => (
+                              <option key={b._id} value={b._id}>
+                                {b.branchName}
+                              </option>
+                            ))}
+                        </select>
+                      )}
+                      {canManage(s) && s.isActive && (
                        <button
-                          onClick={() => newInviteLink(s)}
+                          onClick={() => newPasswordLink(s)}
                          className="rounded-lg border border-depth-200 px-2.5 py-1 text-xs font-medium text-depth-700"
                        >
-                          New link
+                          {s.invitePending ? "New link" : "Reset password"}
                        </button>
                      )}
                      {canManage(s) && (
@@ -167,7 +167,9 @@ export async function POST(req: NextRequest) {
      phoneNumber: user.phoneNumber,
      email: user.email,
    },
-    redirectTo: user.role === "DELIVERY" ? "/terminal" : "/admin/dashboard",
+    // Platform operators start on the console for every business, not on
+    // their own (placeholder) business's dashboard.
+    redirectTo: isPlatformAdmin(user) ? "/platform" : user.role === "DELIVERY" ? "/terminal" : "/admin/dashboard",
    isPlatformAdmin: isPlatformAdmin(user),
  });

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import bcrypt from "bcryptjs";
+import { connectDb } from "@/lib/server/db";
+import { User } from "@/lib/server/models/User";
+import { UserSession } from "@/lib/server/models/UserSession";
+import { authorize } from "@/lib/server/auth";
+
+export const runtime = "nodejs";
+
+const changeSchema = z.object({
+  currentPassword: z.string().min(1, "Enter your current password"),
+  newPassword: z.string().min(8, "The new password must be at least 8 characters"),
+});
+
+/**
+ * POST /api/auth/password — the signed-in user changes their own password.
+ * Every other device is signed out; this one stays signed in.
+ */
+export async function POST(req: NextRequest) {
+  await connectDb();
+  const gate = authorize(req);
+  if (!gate.ok) return gate.response;
+  const auth = gate.auth;
+
+  const parsed = changeSchema.safeParse(await req.json().catch(() => null));
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.issues[0]?.message ?? "Invalid request" }, { status: 400 });
+  }
+  const { currentPassword, newPassword } = parsed.data;
+  if (currentPassword === newPassword) {
+    return NextResponse.json({ error: "Choose a password different from the current one" }, { status: 400 });
+  }
+
+  const user = await User.findOne({ _id: auth.sub, businessId: auth.businessId }).select("+passwordHash");
+  if (!user || !user.isActive) return NextResponse.json({ error: "Not authenticated" }, { status: 401 });
+  if (!(await user.comparePassword(currentPassword))) {
+    return NextResponse.json({ error: "Your current password is not correct" }, { status: 400 });
+  }
+
+  user.passwordHash = await bcrypt.hash(newPassword, 12);
+  await user.save();
+  await UserSession.deleteMany({ userId: user._id, deviceId: { $ne: auth.deviceId } });
+  return NextResponse.json({ ok: true });
+}
@@ -4,6 +4,7 @@ import bcrypt from "bcryptjs";
 import { connectDb } from "@/lib/server/db";
 import { User } from "@/lib/server/models/User";
 import { Business } from "@/lib/server/models/Business";
+import { UserSession } from "@/lib/server/models/UserSession";
 import { hashInviteToken } from "@/lib/server/invites";
 import { crossTenant } from "@/lib/server/tenantGuard";

@@ -27,7 +28,12 @@ export async function GET(_req: NextRequest, { params }: { params: { token: stri
  const user = await findInvitee(params.token);
  if (!user) return NextResponse.json(INVALID, { status: 404 });
  const business = await Business.findById(user.businessId).select("name").lean();
-  return NextResponse.json({ name: user.name, email: user.email, businessName: business?.name ?? null });
+  return NextResponse.json({
+    name: user.name,
+    email: user.email,
+    businessName: business?.name ?? null,
+    purpose: user.invitePurpose === "reset" ? "reset" : "invite",
+  });
 }

 const acceptSchema = z.object({ password: z.string().min(8, "Password must be at least 8 characters") });
@@ -45,8 +51,12 @@ export async function POST(req: NextRequest, { params }: { params: { token: stri
  user.passwordHash = await bcrypt.hash(parsed.data.password, 12);
  user.inviteTokenHash = null;
  user.inviteExpiresAt = null;
+  user.invitePurpose = null;
  user.failedLoginAttempts = 0;
  user.lockedUntil = null;
  await user.save();
+  // A new password ends every existing session, so whoever had the old one
+  // (a lost phone, a former colleague) is signed out.
+  await UserSession.deleteMany({ userId: user._id });
  return NextResponse.json({ ok: true, email: user.email });
 }
@@ -0,0 +1,37 @@
+import { NextRequest, NextResponse } from "next/server";
+import { isValidObjectId } from "mongoose";
+import { connectDb } from "@/lib/server/db";
+import { Business } from "@/lib/server/models/Business";
+import { User } from "@/lib/server/models/User";
+import { requirePlatformAdmin } from "@/lib/server/platform";
+import { invitePending, issueInvite } from "@/lib/server/invites";
+
+export const runtime = "nodejs";
+
+/**
+ * POST /api/platform/businesses/:id/owner-reset — operator only. A one-time
+ * password link for a business's owner of record: the way back in for an
+ * owner who has forgotten their password (nobody inside the business can
+ * reset the owner). Send the link to the owner yourself, by a channel you
+ * know is theirs. Their current password keeps working until it is used.
+ */
+export async function POST(req: NextRequest, { params }: { params: { id: string } }) {
+  await connectDb();
+  const admin = await requirePlatformAdmin(req);
+  if (!admin) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  if (!isValidObjectId(params.id)) return NextResponse.json({ error: "Business not found" }, { status: 404 });
+
+  const business = await Business.findById(params.id).select("ownerId").lean();
+  if (!business) return NextResponse.json({ error: "Business not found" }, { status: 404 });
+  const owner = await User.findOne({ _id: business.ownerId, businessId: business._id });
+  if (!owner) return NextResponse.json({ error: "This business has no owner account" }, { status: 404 });
+  if (owner._id.toString() === admin.userId) {
+    return NextResponse.json({ error: "Change your own password from Change password instead" }, { status: 409 });
+  }
+  if (!owner.isActive) return NextResponse.json({ error: "The owner's account is deactivated" }, { status: 409 });
+
+  const purpose = invitePending(owner) ? "invite" : "reset";
+  const inviteUrl = issueInvite(owner, req, purpose);
+  await owner.save();
+  return NextResponse.json({ inviteUrl, purpose, email: owner.email, name: owner.name, expiresAt: owner.inviteExpiresAt });
+}
@@ -6,6 +6,7 @@ import { Purchase } from "@/lib/server/models/Purchase";
 import { Expense } from "@/lib/server/models/Expense";
 import { authorize, badRequest, branchParam, MANAGERS } from "@/lib/server/auth";
 import { dayRangeNairobi, isBusinessDate, startOfMonthNairobi } from "@/lib/server/businessDay";
+import { costOfGoodsSold as fifoCost } from "@/lib/server/costing";

 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -15,11 +16,13 @@ export const dynamic = "force-dynamic";
 *
 * Management overview, NOT accounting (full accounting is out of the PRD's scope).
 *   Revenue            SUCCESS sales in the period
- *   Cost of goods sold units sold x that product's average purchase cost
- *                      (all purchases up to the end of the period)
+ *   Cost of goods sold first-in-first-out per branch: each unit sold costs
+ *                      what that branch paid for its oldest stock on hand
+ *                      (see src/lib/server/costing.ts)
 *   Gross profit       revenue - cost of goods sold
 *   Expenses           operating expenses in the period
- *   Net profit         gross profit - expenses
+ *   Stock losses       cost of stock written off by counts and adjustments
+ *   Net profit         gross profit - expenses - stock losses
 * Shown separately, because buying stock is not the same as using it:
 *   Stock purchased    cash spent on stock in the period
 *   Cash surplus       revenue - stock purchased - expenses
@@ -47,7 +50,7 @@ export async function GET(req: NextRequest) {
  const branchObjId = branchId ? new mongoose.Types.ObjectId(branchId) : null;
  const inPeriod = { businessId: businessObjId, createdAt: { $gte: from, $lt: to }, ...(branchObjId ? { branchId: branchObjId } : {}) };

-  const [salesByProduct, avgCosts, purchaseAgg, expenseAgg] = await Promise.all([
+  const [salesByProduct, cost, purchaseAgg, expenseAgg] = await Promise.all([
    Transaction.aggregate<{
      _id: Types.ObjectId;
      revenue: number;
@@ -68,12 +71,7 @@ export async function GET(req: NextRequest) {
        },
      },
    ]),
-    // Average buying price per product across the business (suppliers
-    // charge every branch alike), using everything bought up to period end.
-    Purchase.aggregate<{ _id: Types.ObjectId; cost: number; qty: number }>([
-      { $match: { businessId: businessObjId, productId: { $ne: null }, createdAt: { $lt: to } } },
-      { $group: { _id: "$productId", cost: { $sum: "$totalCost" }, qty: { $sum: "$quantity" } } },
-    ]),
+    fifoCost(auth.businessId, { from, to, branchId }),
    Purchase.aggregate<{ total: number; count: number }>([
      { $match: inPeriod },
      { $group: { _id: null, total: { $sum: "$totalCost" }, count: { $sum: 1 } } },
@@ -84,19 +82,18 @@ export async function GET(req: NextRequest) {
    ]),
  ]);

-  const avgCost = new Map(avgCosts.filter((c) => c.qty > 0).map((c) => [c._id.toString(), c.cost / c.qty]));
-  let revenue = 0, cashTotal = 0, mpesaTotal = 0, salesCount = 0, unitsSold = 0, unitsWithoutCost = 0, costOfGoodsSold = 0;
+  let revenue = 0, cashTotal = 0, mpesaTotal = 0, salesCount = 0, unitsSold = 0;
  for (const s of salesByProduct) {
    revenue += s.revenue;
    cashTotal += s.cashTotal;
    mpesaTotal += s.mpesaTotal;
    salesCount += s.lines;
    unitsSold += s.units;
-    const unitCost = avgCost.get(s._id.toString());
-    if (unitCost === undefined) unitsWithoutCost += s.units;
-    else costOfGoodsSold += s.units * unitCost;
  }
-  costOfGoodsSold = Math.round(costOfGoodsSold * 100) / 100;
+  const costOfGoodsSold = cost.costOfGoodsSold;
+  // Sales recorded before the stock ledger existed have no stock movement,
+  // so FIFO cannot cost them: count them as uncosted too.
+  const unitsWithoutCost = Math.max(cost.unitsWithoutCost, unitsSold - cost.unitsCosted);

  const stockPurchases = purchaseAgg[0]?.total ?? 0;
  const expenses = expenseAgg[0]?.total ?? 0;
@@ -111,13 +108,15 @@ export async function GET(req: NextRequest) {
    salesCount,
    unitsSold,
    costOfGoodsSold,
-    // Units sold of products never bought through Purchases: their cost
-    // is unknown, so gross profit overstates by their cost.
+    costMethod: "FIFO per branch",
+    // Units sold whose cost is unknown (no purchase price for that stock on
+    // record): gross profit overstates by their cost.
    unitsWithoutCost,
+    stockLosses: cost.stockLosses,
    grossProfit,
    expenses,
    expenseCount: expenseAgg[0]?.count ?? 0,
-    netProfit: Math.round((grossProfit - expenses) * 100) / 100,
+    netProfit: Math.round((grossProfit - expenses - cost.stockLosses) * 100) / 100,
    stockPurchases,
    purchaseCount: purchaseAgg[0]?.count ?? 0,
    cashSurplus: Math.round((revenue - stockPurchases - expenses) * 100) / 100,
@@ -3,14 +3,17 @@ import { isValidObjectId } from "mongoose";
 import { connectDb } from "@/lib/server/db";
 import { User } from "@/lib/server/models/User";
 import { authorize, MANAGERS } from "@/lib/server/auth";
-import { issueInvite } from "@/lib/server/invites";
+import { invitePending, issueInvite } from "@/lib/server/invites";

 export const runtime = "nodejs";

 /**
- * POST /api/users/:id/invite — a new invite link for someone who has not
- * accepted theirs yet (lost or expired). The previous link stops working.
- * Owners: anyone in the business. Managers: their own branch's cashiers.
+ * POST /api/users/:id/invite — a one-time password link for a staff member:
+ *   - an INVITE link while they have not set a password yet (lost or expired invite);
+ *   - a RESET link once they have (forgotten password). Their current password
+ *     keeps working until the link is used; using it signs them out everywhere.
+ * The previous link stops working either way.
+ * Owners: anyone in the business but themselves. Managers: their own branch's cashiers.
 */
 export async function POST(req: NextRequest, { params }: { params: { id: string } }) {
  await connectDb();
@@ -23,13 +26,17 @@ export async function POST(req: NextRequest, { params }: { params: { id: string
  if (!user) return NextResponse.json({ error: "User not found" }, { status: 404 });

  if (auth.role === "BRANCH_MANAGER" && !(user.role === "DELIVERY" && user.branchId?.toString() === auth.branchId)) {
-    return NextResponse.json({ error: "Branch managers may only invite delivery staff in their own branch" }, { status: 403 });
+    return NextResponse.json({ error: "Branch managers may only do this for delivery staff in their own branch" }, { status: 403 });
  }
-  if (!user.inviteExpiresAt) {
-    return NextResponse.json({ error: "This person has already set their password" }, { status: 409 });
+  if (user._id.toString() === auth.sub) {
+    return NextResponse.json({ error: "Change your own password from Change password instead" }, { status: 409 });
+  }
+  if (!user.isActive) {
+    return NextResponse.json({ error: "Reactivate this account first" }, { status: 409 });
  }

-  const inviteUrl = issueInvite(user, req);
+  const purpose = invitePending(user) ? "invite" : "reset";
+  const inviteUrl = issueInvite(user, req, purpose);
  await user.save();
-  return NextResponse.json({ inviteUrl, expiresAt: user.inviteExpiresAt });
+  return NextResponse.json({ inviteUrl, purpose, expiresAt: user.inviteExpiresAt });
 }
@@ -69,7 +69,14 @@ export async function PATCH(req: NextRequest, { params }: { params: { id: string
    }
    const branch = await Branch.findOne({ _id: branchId, businessId: auth.businessId, ...ACTIVE_BRANCH }).lean();
    if (!branch) return NextResponse.json({ error: "Branch not found in your business" }, { status: 404 });
+    const fromBranch = target.branchId;
    target.branchId = branch._id;
+    // A moved manager stops being the old branch's manager, and becomes the
+    // new branch's manager if it has none.
+    if (target.role === "BRANCH_MANAGER" && fromBranch?.toString() !== branch._id.toString()) {
+      await Branch.updateOne({ _id: fromBranch, businessId: auth.businessId, managerId: target._id }, { managerId: null });
+      await Branch.updateOne({ _id: branch._id, businessId: auth.businessId, managerId: null }, { managerId: target._id });
+    }
  }
  if (isActive !== undefined) target.isActive = isActive;
  await target.save();
@@ -8,7 +8,7 @@ import { authorize, branchParam, MANAGERS } from "@/lib/server/auth";
 import { objectId } from "@/lib/server/validation";
 import { normalizeKenyanPhone } from "@/lib/server/phone";
 import { userLimitError, loadTier } from "@/lib/server/subscription";
-import { issueInvite, unusablePasswordHash } from "@/lib/server/invites";
+import { invitePending, issueInvite, unusablePasswordHash } from "@/lib/server/invites";

 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -26,7 +26,7 @@ export async function GET(req: NextRequest) {
  const users = await User.find(filter).select("-passwordHash -inviteTokenHash").sort({ name: 1 }).lean();
  // invitePending: the person has not set their password yet.
  return NextResponse.json({
-    users: users.map((u) => ({ ...u, invitePending: !!u.inviteExpiresAt })),
+    users: users.map((u) => ({ ...u, invitePending: invitePending(u) })),
  });
 }

@@ -8,6 +8,7 @@ interface Invite {
  name: string;
  email: string;
  businessName: string | null;
+  purpose: "invite" | "reset";
 }

 const inputClass =
@@ -60,9 +61,12 @@ export default function InvitePage() {
        ) : (
          <>
            <p className="text-xs uppercase tracking-wide text-flow-600">{invite.businessName ?? "Vessel"}</p>
-            <h1 className="mt-1 font-display text-2xl font-bold text-depth-900">Welcome, {invite.name}</h1>
+            <h1 className="mt-1 font-display text-2xl font-bold text-depth-900">
+              {invite.purpose === "reset" ? `Reset your password, ${invite.name}` : `Welcome, ${invite.name}`}
+            </h1>
            <p className="mt-2 text-sm text-depth-600">
-              Choose a password. You will sign in with <strong>{invite.email}</strong> and this password.
+              {invite.purpose === "reset" ? "Choose a new password. Every device signed in to your account will be signed out." : "Choose a password."}{" "}
+              You will sign in with <strong>{invite.email}</strong> and this password.
            </p>
            <form onSubmit={handleSubmit} className="mt-6 space-y-4">
              <div>
@@ -36,6 +36,7 @@ export default function LoginPage() {
  // Set when this email and password open accounts in more than one business.
  const [choices, setChoices] = useState<BusinessChoice[] | null>(null);
  const [invited, setInvited] = useState(false);
+  const [showForgot, setShowForgot] = useState(false);

  useEffect(() => {
    setInvited(new URLSearchParams(window.location.search).get("invited") === "1");
@@ -226,9 +227,17 @@ export default function LoginPage() {
                  />
                  Remember me
                </label>
-                <span className="font-medium text-flow-600">Forgot password?</span>
+                <button type="button" onClick={() => setShowForgot((v) => !v)} className="font-medium text-flow-600">
+                  Forgot password?
+                </button>
              </div>

+              {showForgot && (
+                <p className="rounded-lg bg-sand-100 px-3 py-2 text-sm text-depth-700">
+                  Ask your branch manager or business owner for a password reset link (Staff page, Reset password). If
+                  you are the owner, contact Digital Chances support for one.
+                </p>
+              )}
              {invited && !error && (
                <p className="rounded-lg bg-confirm-500/10 px-3 py-2 text-sm text-confirm-600">
                  Your password is set. Sign in with your email and new password.
@@ -12,7 +12,9 @@ export default function RootPage() {
    (async () => {
      try {
        const result = await apiFetch<{ user: AuthUser }>("/api/auth/me");
-        if (result.user.role === "DELIVERY") {
+        if (result.user.isPlatformAdmin) {
+          router.replace("/platform");
+        } else if (result.user.role === "DELIVERY") {
          router.replace("/terminal");
        } else {
          router.replace("/admin/dashboard");
@@ -6,6 +6,7 @@ import { apiFetch, ApiError } from "@/lib/api";
 import { AuthUser } from "@/lib/types";
 import { useToast } from "@/components/ui/Toast";
 import { SkeletonList } from "@/components/ui/Skeleton";
+import AccountLinks from "@/components/AccountLinks";

 type TierId = "STARTER" | "GROWTH" | "ENTERPRISE";
 type SubStatus = "TRIALING" | "ACTIVE" | "PAST_DUE" | "SUSPENDED";
@@ -63,6 +64,7 @@ export default function PlatformPage() {
  const [stats, setStats] = useState<Stats | null>(null);
  const [loading, setLoading] = useState(true);
  const [savingId, setSavingId] = useState<string | null>(null);
+  const [ownerLink, setOwnerLink] = useState<{ business: string; name: string; email: string; url: string } | null>(null);

  useEffect(() => {
    (async () => {
@@ -107,6 +109,23 @@ export default function PlatformPage() {
    setSavingId(null);
  }

+  // A one-time password link for a business's owner (an owner who forgot
+  // their password has nobody inside the business who can reset it).
+  async function ownerReset(b: BizRow) {
+    if (!window.confirm(`Create a password link for the owner of ${b.name}? Send it only to the owner, by a channel you know is theirs.`)) {
+      return;
+    }
+    try {
+      const r = await apiFetch<{ inviteUrl: string; email: string; name: string }>(
+        "/api/platform/businesses/" + b.id + "/owner-reset",
+        { method: "POST" }
+      );
+      setOwnerLink({ business: b.name, name: r.name, email: r.email, url: r.inviteUrl });
+    } catch (err) {
+      show(err instanceof ApiError ? err.message : "Could not create the link", "error");
+    }
+  }
+
  if (!ready) {
    return (
      <main className="min-h-screen bg-depth-950 pb-12">
@@ -130,6 +149,12 @@ export default function PlatformPage() {
            Every business on your platform, across all tenants. Change plans, extend billing periods,
            and suspend accounts here.
          </p>
+          <div className="mt-3 flex items-center gap-4">
+            <a href="/admin/dashboard" className="text-sm text-sand-200/70 underline underline-offset-2 hover:text-white">
+              Your business dashboard
+            </a>
+            <AccountLinks />
+          </div>
        </div>
      </header>

@@ -144,6 +169,28 @@ export default function PlatformPage() {
          </div>
        )}

+        {ownerLink && (
+          <div className="rounded-xl2 border border-confirm-500/30 bg-confirm-500/10 p-4 text-sm">
+            <p className="font-medium text-white">
+              Password link for {ownerLink.name} ({ownerLink.email}), owner of {ownerLink.business}
+            </p>
+            <p className="mt-1 text-xs text-white/60">
+              It works once and expires within 24 hours (7 days if they never set a password). Whoever opens it can take
+              over the account: send it only to the owner, by a channel you know is theirs.
+            </p>
+            <input
+              readOnly
+              value={ownerLink.url}
+              onFocus={(e) => e.target.select()}
+              aria-label="Owner password link"
+              className="mt-3 w-full rounded-lg border border-white/20 bg-depth-900 px-3 py-2 font-mono text-xs text-white"
+            />
+            <button onClick={() => setOwnerLink(null)} className="mt-2 text-xs text-white/60 underline">
+              Done
+            </button>
+          </div>
+        )}
+
        {loading ? (
          <SkeletonList rows={4} />
        ) : rows.length === 0 ? (
@@ -158,6 +205,7 @@ export default function PlatformPage() {
                b={b}
                saving={savingId === b.id}
                onPatch={patch}
+                onOwnerReset={ownerReset}
              />
            ))}
          </div>
@@ -180,10 +228,12 @@ function BusinessCard({
  b,
  saving,
  onPatch,
+  onOwnerReset,
 }: {
  b: BizRow;
  saving: boolean;
  onPatch: (id: string, update: Record<string, unknown>, label: string) => void;
+  onOwnerReset: (b: BizRow) => void;
 }) {
  const overBranches = b.maxBranches !== null && b.branchCount > b.maxBranches;
  const overUsers = b.maxUsers !== null && b.userCount > b.maxUsers;
@@ -287,6 +337,15 @@ function BusinessCard({
            Reactivate
          </button>
        )}
+        {b.owner && (
+          <button
+            type="button"
+            onClick={() => onOwnerReset(b)}
+            className="tap-target rounded-xl2 border border-white/20 px-4 text-sm font-medium text-white/80"
+          >
+            Owner password link
+          </button>
+        )}
      </div>
    </div>
  );
@@ -17,7 +17,8 @@ import {
  type QueuedSale,
  type QueueOwner,
 } from "@/lib/offlineQueue";
-import { clearSession, loadSession, saveSession, type StockSnapshot } from "@/lib/sessionCache";
+import { loadSession, saveSession, type StockSnapshot } from "@/lib/sessionCache";
+import { signOut } from "@/lib/signOut";
 import { MAX_LINES_PER_SALE } from "@/lib/syncProtocol";
 import { useToast } from "@/components/ui/Toast";
 import ProductGrid from "@/components/terminal/ProductGrid";
@@ -392,12 +393,7 @@ export default function TerminalPage() {
      );
      if (!ok) return;
    }
-    try {
-      await apiFetch("/api/auth/logout", { method: "POST" });
-    } catch {
-      // Offline: the cookies expire on their own; still clear this device.
-    }
-    clearSession();
+    await signOut();
    router.replace("/login");
  }

@@ -451,11 +447,16 @@ export default function TerminalPage() {
            >
              {connected ? "● Online" : "● Offline"}
            </span>
+            <div className="flex gap-3">
+              <button onClick={() => router.push("/account/password")} className="text-xs text-sand-200/60 underline underline-offset-2">
+                Password
+              </button>
              <button onClick={handleSignOut} className="text-xs text-sand-200/60 underline underline-offset-2">
                Sign out
              </button>
            </div>
          </div>
+        </div>
      </header>

      <div className="mx-auto -mt-3 max-w-md space-y-4 px-5">
@@ -0,0 +1,26 @@
+"use client";
+
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { signOut } from "@/lib/signOut";
+
+/** Change password + Sign out, for the dark page headers. */
+export default function AccountLinks() {
+  const router = useRouter();
+  return (
+    <div className="flex items-center gap-3 whitespace-nowrap text-sm">
+      <Link href="/account/password" className="text-sand-200/70 underline underline-offset-2 hover:text-white">
+        Change password
+      </Link>
+      <button
+        onClick={async () => {
+          await signOut();
+          router.replace("/login");
+        }}
+        className="text-sand-200/70 underline underline-offset-2 hover:text-white"
+      >
+        Sign out
+      </button>
+    </div>
+  );
+}
@@ -0,0 +1,194 @@
+import mongoose, { Types } from "mongoose";
+import { StockMovement, type MovementType } from "@/lib/server/models/StockMovement";
+import { Purchase } from "@/lib/server/models/Purchase";
+
+/**
+ * Cost of goods sold, first-in-first-out, per branch.
+ *
+ * The stock ledger is replayed in order. Each branch keeps, per product, a
+ * queue of cost layers (quantity at a unit cost). Stock coming in adds a
+ * layer; stock going out takes from the oldest layers first:
+ *
+ *   PURCHASE      in, at the purchase's unit cost
+ *   TRANSFER_IN   in, at the cost of the layers the sending branch gave up
+ *   ADJUSTMENT +  in (opening stock, a count that found more), at an
+ *                 estimated cost: the latest purchase price for the product
+ *                 at that time, or the first one after it if none yet
+ *   SALE          out: its cost is cost of goods sold
+ *   TRANSFER_OUT  out: its cost travels with the stock to the other branch
+ *   ADJUSTMENT -  out (breakage, a count that found less): its cost is a
+ *                 stock loss, reported separately from cost of goods
+ *
+ * Stock can go negative (an offline sale recorded before the stock it came
+ * from). The units sold short wait as a deficit and are costed by the next
+ * stock that arrives at that branch, which is where they must have come
+ * from. Units still uncosted at the end are reported as unitsWithoutCost.
+ *
+ * The replay reads the whole history, in order, so a sale is costed against
+ * what was actually on hand when it happened, whatever period is being
+ * reported; only events inside the period (and branch) are added up. A sale
+ * made short in the period is costed by stock that arrived later, even
+ * after the period ended.
+ */
+
+type Id = Types.ObjectId | string;
+
+interface Layer {
+  qty: number;
+  unitCost: number | null; // null: cost unknown
+}
+
+interface Deficit {
+  qty: number;
+  kind: "sale" | "loss" | "transfer";
+  counts: boolean; // inside the reported period and branch
+}
+
+interface Position {
+  layers: Layer[];
+  deficits: Deficit[];
+}
+
+export interface CostOfGoods {
+  costOfGoodsSold: number;
+  unitsCosted: number; // units sold in the period that have a cost
+  unitsWithoutCost: number; // units sold in the period whose cost is unknown
+  stockLosses: number; // cost of stock written off by counts or adjustments in the period
+}
+
+// Process transfers' outgoing side before the incoming side, so the cost is known.
+const TYPE_ORDER: Record<MovementType, number> = {
+  PURCHASE: 0,
+  ADJUSTMENT: 1,
+  TRANSFER_OUT: 2,
+  TRANSFER_IN: 3,
+  SALE: 4,
+};
+
+const round2 = (n: number) => Math.round(n * 100) / 100;
+
+/** Take `qty` units from the front of `layers`; returns what was taken and the shortfall. */
+function take(layers: Layer[], qty: number): { taken: Layer[]; short: number } {
+  const taken: Layer[] = [];
+  let need = qty;
+  while (need > 0 && layers.length > 0) {
+    const head = layers[0];
+    const n = Math.min(head.qty, need);
+    taken.push({ qty: n, unitCost: head.unitCost });
+    head.qty -= n;
+    need -= n;
+    if (head.qty === 0) layers.shift();
+  }
+  return { taken, short: need };
+}
+
+export async function costOfGoodsSold(
+  businessId: Id,
+  period: { from: Date; to: Date; branchId?: Id | null }
+): Promise<CostOfGoods> {
+  const biz = new mongoose.Types.ObjectId(businessId.toString());
+  const branchFilter = period.branchId ? period.branchId.toString() : null;
+
+  const [movements, purchases] = await Promise.all([
+    StockMovement.find({ businessId: biz })
+      .select("branchId productId type quantity refId createdAt")
+      .sort({ createdAt: 1, _id: 1 })
+      .lean(),
+    Purchase.find({ businessId: biz, productId: { $ne: null } })
+      .select("productId unitCost createdAt")
+      .sort({ createdAt: 1 })
+      .lean(),
+  ]);
+  movements.sort(
+    (a, b) => a.createdAt.getTime() - b.createdAt.getTime() || TYPE_ORDER[a.type] - TYPE_ORDER[b.type]
+  );
+
+  const purchaseCost = new Map(purchases.map((p) => [p._id.toString(), p.unitCost]));
+  const priceHistory = new Map<string, { at: number; unitCost: number }[]>();
+  for (const p of purchases) {
+    const key = p.productId!.toString();
+    if (!priceHistory.has(key)) priceHistory.set(key, []);
+    priceHistory.get(key)!.push({ at: p.createdAt.getTime(), unitCost: p.unitCost });
+  }
+  const estimateCost = (productId: string, at: number): number | null => {
+    const history = priceHistory.get(productId);
+    if (!history || history.length === 0) return null;
+    let latest: number | null = null;
+    for (const h of history) {
+      if (h.at <= at) latest = h.unitCost;
+      else break;
+    }
+    return latest ?? history[0].unitCost;
+  };
+
+  const positions = new Map<string, Position>();
+  const position = (branch: string, product: string) => {
+    const key = `${branch}:${product}`;
+    if (!positions.has(key)) positions.set(key, { layers: [], deficits: [] });
+    return positions.get(key)!;
+  };
+  const inTransit = new Map<string, Layer[]>(); // transfer refId -> layers given up by the sender
+
+  const result = { costOfGoodsSold: 0, unitsCosted: 0, unitsWithoutCost: 0, stockLosses: 0 };
+  const charge = (kind: Deficit["kind"], layers: Layer[]) => {
+    for (const l of layers) {
+      if (kind === "sale") {
+        if (l.unitCost === null) result.unitsWithoutCost += l.qty;
+        else {
+          result.costOfGoodsSold += l.qty * l.unitCost;
+          result.unitsCosted += l.qty;
+        }
+      } else if (kind === "loss" && l.unitCost !== null) {
+        result.stockLosses += l.qty * l.unitCost;
+      }
+    }
+  };
+
+  for (const m of movements) {
+    const branch = m.branchId.toString();
+    const product = m.productId.toString();
+    const pos = position(branch, product);
+    const at = m.createdAt.getTime();
+    const counts =
+      at >= period.from.getTime() && at < period.to.getTime() && (!branchFilter || branch === branchFilter);
+
+    if (m.quantity > 0) {
+      let incoming: Layer[];
+      if (m.type === "PURCHASE") incoming = [{ qty: m.quantity, unitCost: purchaseCost.get(m.refId) ?? null }];
+      else if (m.type === "TRANSFER_IN") incoming = (inTransit.get(m.refId) ?? [{ qty: m.quantity, unitCost: null }]).map((l) => ({ ...l }));
+      else incoming = [{ qty: m.quantity, unitCost: estimateCost(product, at) }];
+
+      // Stock that was already sold short is covered first, at this stock's cost.
+      while (pos.deficits.length > 0 && incoming.length > 0) {
+        const d = pos.deficits[0];
+        const { taken, short } = take(incoming, d.qty);
+        if (d.counts) charge(d.kind, taken);
+        d.qty = short;
+        if (d.qty === 0) pos.deficits.shift();
+      }
+      pos.layers.push(...incoming);
+    } else if (m.quantity < 0) {
+      const kind: Deficit["kind"] = m.type === "SALE" ? "sale" : m.type === "TRANSFER_OUT" ? "transfer" : "loss";
+      const { taken, short } = take(pos.layers, -m.quantity);
+      if (kind === "transfer") {
+        // The receiving branch inherits this cost; any shortfall arrives with no known cost.
+        inTransit.set(m.refId, short > 0 ? [...taken, { qty: short, unitCost: null }] : taken);
+      } else if (counts) {
+        charge(kind, taken);
+      }
+      if (short > 0) pos.deficits.push({ qty: short, kind, counts: counts && kind !== "transfer" });
+    }
+  }
+
+  // Short sales in the period that no later stock has covered yet.
+  for (const pos of positions.values()) {
+    for (const d of pos.deficits) if (d.counts && d.kind === "sale") result.unitsWithoutCost += d.qty;
+  }
+
+  return {
+    costOfGoodsSold: round2(result.costOfGoodsSold),
+    unitsCosted: result.unitsCosted,
+    unitsWithoutCost: result.unitsWithoutCost,
+    stockLosses: round2(result.stockLosses),
+  };
+}
@@ -4,6 +4,10 @@ import type { NextRequest } from "next/server";
 import type { IUser } from "@/lib/server/models/User";

 export const INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+/** Reset links are shorter-lived: they can take over an account that is already in use. */
+export const RESET_TTL_MS = 24 * 60 * 60 * 1000;
+
+export type LinkPurpose = "invite" | "reset";

 export function hashInviteToken(token: string): string {
  return crypto.createHash("sha256").update(token).digest("hex");
@@ -14,14 +18,20 @@ export async function unusablePasswordHash(): Promise<string> {
  return bcrypt.hash(crypto.randomBytes(32).toString("hex"), 12);
 }

+/** Whether the account is waiting for its first password (not a reset). */
+export function invitePending(user: Pick<IUser, "inviteExpiresAt" | "invitePurpose">): boolean {
+  return !!user.inviteExpiresAt && user.invitePurpose !== "reset";
+}
+
 /**
- * Give the user a fresh invite (any earlier link stops working) and return
- * the link to send them. The caller saves the user.
+ * Give the user a fresh one-time password link (any earlier link stops
+ * working) and return it to send them. The caller saves the user.
 */
-export function issueInvite(user: IUser, req: NextRequest): string {
+export function issueInvite(user: IUser, req: NextRequest, purpose: LinkPurpose = "invite"): string {
  const token = crypto.randomBytes(32).toString("base64url");
  user.inviteTokenHash = hashInviteToken(token);
-  user.inviteExpiresAt = new Date(Date.now() + INVITE_TTL_MS);
+  user.inviteExpiresAt = new Date(Date.now() + (purpose === "reset" ? RESET_TTL_MS : INVITE_TTL_MS));
+  user.invitePurpose = purpose;
  const origin = process.env.APP_URL?.replace(/\/$/, "") || req.nextUrl.origin;
  return `${origin}/invite/${token}`;
 }
@@ -25,11 +25,15 @@ export interface IUser extends Document {
  isActive: boolean;
  failedLoginAttempts: number;
  lockedUntil: Date | null;
-  // Pending invite: the person sets their own password through a one-time
-  // link. Only the SHA-256 of the token is stored. Until they accept, the
-  // account has a random unknown password, so it cannot be signed into.
+  // A one-time link through which the person sets their own password.
+  // Only the SHA-256 of the token is stored.
+  //   invite: a new account; until accepted it has a random unknown password.
+  //   reset:  a forgotten password; the old password keeps working until the
+  //           link is used, and using it signs the account out everywhere.
+  // Rows from before invitePurpose existed have null, which means invite.
  inviteTokenHash: string | null;
  inviteExpiresAt: Date | null;
+  invitePurpose: "invite" | "reset" | null;
  createdAt: Date;
  updatedAt: Date;

@@ -51,6 +55,7 @@ const userSchema = new Schema<IUser>(
    lockedUntil: { type: Date, default: null },
    inviteTokenHash: { type: String, default: null, index: { sparse: true } },
    inviteExpiresAt: { type: Date, default: null },
+    invitePurpose: { type: String, enum: ["invite", "reset", null], default: null },
  },
  { timestamps: true }
 );
@@ -0,0 +1,16 @@
+import { apiFetch } from "@/lib/api";
+import { clearSession } from "@/lib/sessionCache";
+
+/**
+ * End this device's session and forget the cached terminal session. Works
+ * offline too: the server session then expires on its own, and this device
+ * keeps nothing that would sign it back in.
+ */
+export async function signOut(): Promise<void> {
+  try {
+    await apiFetch("/api/auth/logout", { method: "POST" });
+  } catch {
+    // Offline or already signed out.
+  }
+  clearSession();
+}
@@ -0,0 +1,147 @@
+import { describe, expect, it } from "vitest";
+import bcrypt from "bcryptjs";
+import { User } from "@/lib/server/models/User";
+import { Branch } from "@/lib/server/models/Branch";
+import { UserSession } from "@/lib/server/models/UserSession";
+import * as invite from "@/app/api/users/[id]/invite/route";
+import * as invites from "@/app/api/invites/[token]/route";
+import * as users from "@/app/api/users/route";
+import * as userById from "@/app/api/users/[id]/route";
+import * as password from "@/app/api/auth/password/route";
+import * as login from "@/app/api/auth/login/route";
+import * as ownerReset from "@/app/api/platform/businesses/[id]/owner-reset/route";
+import { db, json, makeTenant, params, req, uuid, type Actor } from "./helpers";
+
+const DEVICE = "00000000-0000-4000-8000-000000000001"; // the device tokenFor() signs in on
+
+async function setPassword(a: Actor, pw: string) {
+  await db(() => User.updateOne({ _id: a.id }, { passwordHash: bcrypt.hashSync(pw, 4) }));
+}
+const signIn = (a: Actor, pw: string) =>
+  login.POST(req("POST", "/x", { body: { email: a.email, password: pw, deviceId: uuid() } }));
+const tokenOf = (url: string) => url.split("/invite/")[1];
+const sessions = (a: Actor) => db(() => UserSession.countDocuments({ userId: a.id }));
+
+describe("password reset links", () => {
+  it("lets a manager reset their cashier's forgotten password; the old one works until the link is used", async () => {
+    const t = await makeTenant();
+    await setPassword(t.cashierA, "old-password");
+    await signIn(t.cashierA, "old-password"); // a session on some phone
+
+    const r = await json(await invite.POST(req("POST", "/x", { as: t.managerA }), params({ id: t.cashierA.id })));
+    expect(r.status).toBe(200);
+    expect(r.body.purpose).toBe("reset");
+    expect((await signIn(t.cashierA, "old-password")).status).toBe(200);
+
+    const page = await json(await invites.GET(req("GET", "/x"), params({ token: tokenOf(r.body.inviteUrl) })));
+    expect(page.body.purpose).toBe("reset");
+
+    const accept = await invites.POST(req("POST", "/x", { body: { password: "new-password" } }), params({ token: tokenOf(r.body.inviteUrl) }));
+    expect(accept.status).toBe(200);
+    expect(await sessions(t.cashierA)).toBe(0); // every device signed out
+    expect((await signIn(t.cashierA, "old-password")).status).toBe(401);
+    expect((await signIn(t.cashierA, "new-password")).status).toBe(200);
+  });
+
+  it("does not show a reset as a pending invite", async () => {
+    const t = await makeTenant();
+    await invite.POST(req("POST", "/x", { as: t.owner }), params({ id: t.cashierA.id }));
+    const list = await json(await users.GET(req("GET", "/api/users", { as: t.owner })));
+    expect(list.body.users.find((u: any) => u._id === t.cashierA.id).invitePending).toBe(false);
+  });
+
+  it("expires a reset link after 24 hours", async () => {
+    const t = await makeTenant();
+    const r = await json(await invite.POST(req("POST", "/x", { as: t.owner }), params({ id: t.cashierA.id })));
+    const user = await db(() => User.findById(t.cashierA.id).lean());
+    const hours = (user!.inviteExpiresAt!.getTime() - Date.now()) / 3_600_000;
+    expect(hours).toBeGreaterThan(23.9);
+    expect(hours).toBeLessThanOrEqual(24);
+    await db(() => User.updateOne({ _id: t.cashierA.id }, { inviteExpiresAt: new Date(Date.now() - 1000) }));
+    expect((await invites.GET(req("GET", "/x"), params({ token: tokenOf(r.body.inviteUrl) }))).status).toBe(404);
+  });
+
+  it("keeps managers to their own cashiers, and nobody resets themselves", async () => {
+    const t = await makeTenant();
+    const post = (as: Actor, id: string) => invite.POST(req("POST", "/x", { as }), params({ id }));
+    expect((await post(t.managerA, t.cashierB.id)).status).toBe(403);
+    expect((await post(t.managerA, t.owner.id)).status).toBe(403);
+    expect((await post(t.owner, t.owner.id)).status).toBe(409);
+    expect((await post(t.cashierA, t.cashierB.id)).status).toBe(403);
+  });
+
+  it("lets the platform operator give a business owner a reset link, and nobody else", async () => {
+    const t = await makeTenant("Customer Co");
+    const home = await makeTenant("Operator Co");
+    await db(() => User.updateOne({ _id: home.owner.id }, { email: "operator@aquaflow.test", platformAdmin: true }));
+    const operator = { ...home.owner, email: "operator@aquaflow.test" };
+
+    const ok = await json(await ownerReset.POST(req("POST", "/x", { as: operator }), params({ id: t.businessId })));
+    expect(ok.status).toBe(200);
+    expect(ok.body).toMatchObject({ purpose: "reset", email: t.owner.email.toLowerCase() });
+
+    expect((await ownerReset.POST(req("POST", "/x", { as: t.owner }), params({ id: t.businessId }))).status).toBe(403);
+  });
+});
+
+describe("changing your own password", () => {
+  it("needs the current password, then signs out every other device but this one", async () => {
+    const t = await makeTenant();
+    await setPassword(t.managerA, "current-pass");
+    await signIn(t.managerA, "current-pass"); // another device
+    await db(() => UserSession.create({ userId: t.managerA.id, deviceId: DEVICE, refreshTokenHash: "x", expiresAt: new Date(Date.now() + 86_400_000) }));
+    expect(await sessions(t.managerA)).toBe(2);
+
+    const change = (currentPassword: string, newPassword: string) =>
+      password.POST(req("POST", "/x", { as: t.managerA, body: { currentPassword, newPassword } }));
+    expect((await change("wrong-pass", "brand-new-pass")).status).toBe(400);
+    expect((await change("current-pass", "short")).status).toBe(400);
+    expect((await change("current-pass", "brand-new-pass")).status).toBe(200);
+
+    expect(await sessions(t.managerA)).toBe(1);
+    expect(await db(() => UserSession.exists({ userId: t.managerA.id, deviceId: DEVICE }))).toBeTruthy();
+    expect((await signIn(t.managerA, "brand-new-pass")).status).toBe(200);
+  });
+});
+
+describe("moving staff between branches", () => {
+  it("moves a manager, updates both branches' manager, and signs them out", async () => {
+    const t = await makeTenant();
+    await db(() => Branch.updateOne({ _id: t.branchA }, { managerId: t.managerA.id }));
+    await db(() => UserSession.create({ userId: t.managerA.id, deviceId: uuid(), refreshTokenHash: "x", expiresAt: new Date(Date.now() + 86_400_000) }));
+
+    const res = await userById.PATCH(req("PATCH", "/x", { as: t.owner, body: { branchId: t.branchB } }), params({ id: t.managerA.id }));
+    expect(res.status).toBe(200);
+    const [a, b, mgr] = await Promise.all([
+      db(() => Branch.findById(t.branchA).lean()),
+      db(() => Branch.findById(t.branchB).lean()),
+      db(() => User.findById(t.managerA.id).lean()),
+    ]);
+    expect(a!.managerId).toBeNull();
+    expect(b!.managerId!.toString()).toBe(t.managerA.id);
+    expect(mgr!.branchId!.toString()).toBe(t.branchB);
+    expect(await sessions(t.managerA)).toBe(0);
+  });
+
+  it("only lets the owner move people, and only to an active branch", async () => {
+    const t = await makeTenant();
+    const move = (as: Actor, branchId: string) =>
+      userById.PATCH(req("PATCH", "/x", { as, body: { branchId } }), params({ id: t.cashierA.id }));
+    expect((await move(t.managerA, t.branchB)).status).toBe(403);
+    await db(() => Branch.updateOne({ _id: t.branchB }, { isActive: false }));
+    expect((await move(t.owner, t.branchB)).status).toBe(404);
+  });
+});
+
+describe("where sign-in lands", () => {
+  it("sends the platform operator to the platform console, owners to the dashboard, cashiers to the till", async () => {
+    const t = await makeTenant();
+    await Promise.all([setPassword(t.owner, "owner-pass"), setPassword(t.cashierA, "cashier-pass")]);
+    expect((await json(await signIn(t.owner, "owner-pass"))).body.redirectTo).toBe("/admin/dashboard");
+    expect((await json(await signIn(t.cashierA, "cashier-pass"))).body.redirectTo).toBe("/terminal");
+
+    await db(() => User.updateOne({ _id: t.owner.id }, { email: "operator@aquaflow.test", platformAdmin: true }));
+    const operator = { ...t.owner, email: "operator@aquaflow.test" };
+    expect((await json(await signIn(operator, "owner-pass"))).body.redirectTo).toBe("/platform");
+  });
+});
@@ -0,0 +1,110 @@
+import { describe, expect, it } from "vitest";
+import mongoose from "mongoose";
+import { costOfGoodsSold } from "@/lib/server/costing";
+import { StockMovement } from "@/lib/server/models/StockMovement";
+import { Transaction } from "@/lib/server/models/Transaction";
+import { Purchase } from "@/lib/server/models/Purchase";
+import { startOfMonthNairobi } from "@/lib/server/businessDay";
+import * as cash from "@/app/api/transactions/cash/route";
+import * as purchases from "@/app/api/purchases/route";
+import * as adjustments from "@/app/api/stock/adjustments/route";
+import * as transfers from "@/app/api/stock/transfers/route";
+import * as profit from "@/app/api/reports/profit/route";
+import { json, makeTenant, req, uuid, type Actor, type Tenant } from "./helpers";
+
+const ALL_TIME = { from: new Date(0), to: new Date(Date.now() + 86_400_000) };
+
+const buy = (t: Tenant, branchId: string, quantity: number, unitCost: number, productId = t.water20) =>
+  purchases.POST(req("POST", "/x", { as: t.owner, body: { branchId, supplierName: "Supplier", productId, quantity, unitCost } }));
+
+const sell = (cashier: Actor, quantity: number, productId: string) =>
+  cash.POST(req("POST", "/x", { as: cashier, body: { sales: [{ clientUuid: uuid(), lines: [{ productId, quantity }] }] } }));
+
+const adjust = (t: Tenant, mode: "COUNT" | "DELTA", quantity: number) =>
+  adjustments.POST(
+    req("POST", "/x", { as: t.owner, body: { clientUuid: uuid(), branchId: t.branchA, productId: t.water20, mode, quantity } })
+  );
+
+/** Move everything recorded so far to `when` (tests need history in an earlier period). */
+async function backdate(t: Tenant, when: Date) {
+  // The raw collection: Mongoose treats createdAt as immutable.
+  const filter = { businessId: new mongoose.Types.ObjectId(t.businessId) };
+  await StockMovement.collection.updateMany(filter, { $set: { createdAt: when } });
+  await Transaction.collection.updateMany(filter, { $set: { createdAt: when } });
+  await Purchase.collection.updateMany(filter, { $set: { createdAt: when } });
+}
+
+describe("cost of goods sold: FIFO per branch", () => {
+  it("costs the oldest stock first, not an average", async () => {
+    const t = await makeTenant();
+    await buy(t, t.branchA, 10, 10);
+    await buy(t, t.branchA, 10, 20);
+    await sell(t.cashierA, 15, t.water20);
+    const c = await costOfGoodsSold(t.businessId, ALL_TIME);
+    expect(c).toMatchObject({ costOfGoodsSold: 200, unitsCosted: 15, unitsWithoutCost: 0 }); // 10x10 + 5x20 (the average would say 225)
+  });
+
+  it("costs each branch at what that branch paid", async () => {
+    const t = await makeTenant();
+    await buy(t, t.branchA, 10, 10);
+    await buy(t, t.branchB, 10, 30);
+    await sell(t.cashierB, 2, t.water20);
+    await sell(t.cashierA, 1, t.water20);
+    expect((await costOfGoodsSold(t.businessId, ALL_TIME)).costOfGoodsSold).toBe(70);
+    expect((await costOfGoodsSold(t.businessId, { ...ALL_TIME, branchId: t.branchA })).costOfGoodsSold).toBe(10);
+    expect((await costOfGoodsSold(t.businessId, { ...ALL_TIME, branchId: t.branchB })).costOfGoodsSold).toBe(60);
+  });
+
+  it("carries the sending branch's cost with a transfer", async () => {
+    const t = await makeTenant();
+    await buy(t, t.branchA, 10, 10);
+    await transfers.POST(
+      req("POST", "/x", {
+        as: t.owner,
+        body: { clientUuid: uuid(), fromBranchId: t.branchA, toBranchId: t.branchB, productId: t.water20, quantity: 5 },
+      })
+    );
+    await buy(t, t.branchB, 5, 30);
+    await sell(t.cashierB, 6, t.water20);
+    // B's oldest stock is the 5 transferred at 10, then 1 of its own at 30.
+    expect((await costOfGoodsSold(t.businessId, { ...ALL_TIME, branchId: t.branchB })).costOfGoodsSold).toBe(80);
+  });
+
+  it("costs a sale made before its stock was recorded by the stock that arrives next", async () => {
+    const t = await makeTenant();
+    await sell(t.cashierA, 3, t.water20); // offline sale, nothing on the books yet
+    expect(await costOfGoodsSold(t.businessId, ALL_TIME)).toMatchObject({ costOfGoodsSold: 0, unitsWithoutCost: 3 });
+    await buy(t, t.branchA, 10, 12);
+    expect(await costOfGoodsSold(t.businessId, ALL_TIME)).toMatchObject({ costOfGoodsSold: 36, unitsWithoutCost: 0 });
+  });
+
+  it("reports written-off stock as a loss, not as cost of goods sold, and deducts it in net profit", async () => {
+    const t = await makeTenant();
+    await buy(t, t.branchA, 10, 10);
+    await adjust(t, "COUNT", 8);
+    expect(await costOfGoodsSold(t.businessId, ALL_TIME)).toMatchObject({ costOfGoodsSold: 0, stockLosses: 20 });
+    const { body } = await json(await profit.GET(req("GET", "/api/reports/profit", { as: t.owner })));
+    expect(body).toMatchObject({ stockLosses: 20, grossProfit: 0, netProfit: -20 });
+  });
+
+  it("values opening stock at the product's purchase price", async () => {
+    const t = await makeTenant();
+    await adjust(t, "DELTA", 10); // opening stock, before any purchase was recorded
+    await buy(t, t.branchA, 10, 15);
+    await sell(t.cashierA, 12, t.water20);
+    expect((await costOfGoodsSold(t.businessId, ALL_TIME)).costOfGoodsSold).toBe(180);
+  });
+
+  it("counts only the period's sales, costed against what was left from earlier periods", async () => {
+    const t = await makeTenant();
+    await buy(t, t.branchA, 10, 10);
+    await sell(t.cashierA, 6, t.water20);
+    const lastMonth = new Date(startOfMonthNairobi().getTime() - 5 * 86_400_000);
+    await backdate(t, lastMonth);
+    await buy(t, t.branchA, 10, 20);
+    await sell(t.cashierA, 6, t.water20); // 4 left from last month at 10, then 2 at 20
+
+    const { body } = await json(await profit.GET(req("GET", "/api/reports/profit", { as: t.owner })));
+    expect(body).toMatchObject({ costMethod: "FIFO per branch", unitsSold: 6, costOfGoodsSold: 80, unitsWithoutCost: 0 });
+  });
+});
@@ -100,12 +100,12 @@ describe("F-03 report period validation", () => {
 });

 describe("F-07 cost of goods sold", () => {
-  it("costs only the units sold, at the average buying price, and reports purchases separately", async () => {
+  it("costs only the units sold, first-in-first-out, and reports purchases separately", async () => {
    const t = await makeTenant();
    const buy = (quantity: number, unitCost: number) =>
      purchases.POST(req("POST", "/x", { as: t.managerA, body: { supplierName: "Kiwanja", productId: t.water20, quantity, unitCost } }));
    await buy(20, 10);
-    await buy(10, 13); // average (200 + 130) / 30 = 11
+    await buy(10, 13);
    await cash.POST(
      req("POST", "/x", {
        as: t.cashierA,
@@ -116,9 +116,9 @@ describe("F-07 cost of goods sold", () => {
    expect(body).toMatchObject({
      revenue: 660, // 3 x 200 + 1 x 60
      unitsSold: 4,
-      costOfGoodsSold: 33, // 3 x 11; the 5L was never purchased
+      costOfGoodsSold: 30, // 3 x 10 from the oldest purchase; the 5L was never purchased
      unitsWithoutCost: 1,
-      grossProfit: 627,
+      grossProfit: 630,
      stockPurchases: 330,
      cashSurplus: 330,
    });
Author	SHA1	Message	Date
denis_ireri	34ea64c4d4	Merge pull request 'Send platform operators to the platform console after sign-in' (#9 ) from fix/operator-landing into main Reviewed-on: #9	2026-10-13 15:06:36 +00:00
denis_ireri	d15273e2a6	Send platform operators to the platform console after sign-in The operator account is the owner of a placeholder business, so sign-in landed it on that business's empty dashboard with a "Create your first branch" nudge. Operators now land on /platform (sign-in and the root page), the dashboard header says "Platform operator", and the nudge is hidden on the operator's own business. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 18:04:58 +03:00
denis_ireri	5b7a2b847f	Merge pull request 'Add password resets, change password, sign-out, a Branches link and moving staff' (#8 ) from fix/account-and-navigation-gaps into main Reviewed-on: #8	2026-10-13 11:04:47 +00:00
denis_ireri	6f8a5fe969	Add password resets, change password, sign-out, a Branches link and moving staff Gaps found while writing the user manual: - Forgotten passwords: owners and managers can create a one-time password reset link from Staff (managers for their own cashiers). It expires after 24 hours; the old password works until it is used, and using it signs the account out everywhere. Reset and invite links share the invite page, which now says which it is. An owner who forgets their password gets a link from the platform operator (Platform console, "Owner password link"). The login page's "Forgot password?" explains this. - Change password: any signed-in user, from the dashboard, the till or the platform console. Needs the current password; other devices are signed out. - Sign out on the dashboard and the platform console (the till already had it), through one shared helper that also clears the till's cached session. - A Branches link on the owner's dashboard; the page was only reachable by typing its address. - Owners can move a manager or cashier to another branch from Staff. A moved manager stops being the old branch's manager and becomes the new branch's if it has none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 13:57:04 +03:00
denis_ireri	418ad36b02	Merge pull request 'Cost sales first-in-first-out per branch instead of at an average' (#7 ) from fix/fifo-cost-of-goods into main Reviewed-on: #7	2026-10-12 09:54:13 +00:00
denis_ireri	ff75cf2fa7	Cost sales first-in-first-out per branch instead of at an average Cost of goods sold used each product's average buying price across the whole business. Ten jerrycans bought at 100 and ten at 140, with 15 sold, cost 1,800 instead of the 1,700 actually paid for those units; a branch that bought dearer was costed like one that bought cheaper; and units moved between branches lost their cost. src/lib/server/costing.ts replays the stock ledger in order with cost layers per branch and product: - purchases add stock at their unit cost; transfers carry the sending branch's layers to the receiving branch; opening stock and upward counts are valued at the product's purchase price at the time; - sales take the oldest layers first, and that is cost of goods sold; - stock written off by counts or adjustments is a separate "stock losses" figure, now deducted in net profit; - a sale recorded before its stock (stock gone negative) is costed by the next stock to arrive at that branch, even after the period ended; until then it is reported as units with no purchase cost on record. The report shows the method and a Stock losses card. Sales recorded before the stock ledger existed are counted as uncosted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-12 12:08:15 +03:00
denis_ireri	db9387c01a	Merge pull request 'Enforce tenant isolation in the data layer instead of per route' (#6 ) from fix/enforced-tenant-isolation into main Reviewed-on: #6	2026-10-12 08:58:31 +00:00