Product Stock Pro SaaS V15 — Multi-device + Invoice/Due stability update

PRODUCT STOCK PRO — FULL SAAS (cPanel + PHP + MySQL)

ইনস্টল:
1) cPanel > MySQL Databases থেকে একটি database ও user তৈরি করুন এবং user-কে ALL PRIVILEGES দিন।
2) এই package-এর সব ফাইল subdomain document root-এ upload/extract করুন। উদাহরণ: public_html/app/
3) config.php খুলে host/name/user/pass বসান।
4) https://আপনার-subdomain.com/install.php খুলুন। Installer database tables তৈরি করবে এবং প্রথম Admin তৈরি করবে।
5) Installation complete হলে install.php অবশ্যই delete করুন।
6) Admin: /login.php ; customer registration: /register.php ; billing: /billing.php

SaaS:
- প্রতিটি registered business-এর business_id আলাদা।
- Trial subscription স্বয়ংক্রিয়ভাবে তৈরি হয় (config.php-এ 14 দিন default)।
- Product/Sales/Purchase/Stock/Customer/Supplier data business অনুযায়ী server MySQL-এ সংরক্ষিত হয়।
- Customer subscription না থাকলে মূল app ব্যবহার করতে পারে না।
- Customer billing page থেকে plan ও transaction ID submit করতে পারে।
- Admin payment approve/reject করতে পারে। Approve করলে active subscription তৈরি/বর্ধিত হয়।
- Admin plans ও users manage করতে পারে।

নিরাপত্তা:
- Password password_hash দিয়ে সংরক্ষিত।
- Session cookie HttpOnly/SameSite এবং HTTPS হলে Secure।
- State-changing API requests-এ CSRF token ব্যবহৃত।
- Client থেকে business_id নিয়ে data access করা হয় না; session-এর business_id ব্যবহার করা হয়।
- config.php এবং SQL web access থেকে blocked রাখার .htaccess আছে।

গুরুত্বপূর্ণ:
- bKash/Nagad/SSLCommerz-এর live automatic payment gateway এই package-এ merchant credentials ছাড়া চালু করা সম্ভব নয়। বর্তমানে manual transaction submission + admin approval flow আছে।
- এটি cPanel shared hosting-এর জন্য PHP/MySQL architecture।


V5 Subscription Update
- Customer Dashboard/Settings-এ Current Package, Price, Status, Expiry Date ও Remaining Days দেখা যায়।
- Sidebar plan card customer-এর active package অনুযায়ী dynamic হয়।
- Upgrade / Renew থেকে Billing page খোলা যায়।
- Payment history API থেকে customer-এর নিজের payment status দেখা যায়।
- আগের UI/design ও database structure রাখা হয়েছে; নতুন database import প্রয়োজন নেই।


V7 আপডেট
- Trial শেষ হলেও customer dashboard/data read-only থাকবে; data delete হবে না।
- Save/Reset/Business Profile mutation server-side subscription check ও CSRF protection-এর অধীনে।
- bKash, Nagad, Rocket manual transaction payment flow।
- Admin থেকে payment numbers/settings পরিবর্তন করা যাবে।
- Duplicate Transaction ID block।
- Admin customer search/status, block/activate, subscription +30 days extension, password reset।
- Admin SaaS summary: customers, active, expired, pending payments, monthly revenue।
- Automatic database migration-এ app_settings যোগ হয়েছে।


V8 — REAL MULTI-TENANT DATA CORE
- Products, Sales, Purchases, Customers, Suppliers, Stock Movements and Activities are now stored in normalized MySQL tables per business.
- Legacy app_data JSON is retained only as a compatibility/cache layer for the business logo and one-time migration; tenant operational records are read from normalized tables.
- Existing V7 JSON data is imported automatically when a tenant has no normalized records.
- Audit log table added for important server actions.
- CSRF/profile-save issue fixed to use the live session token.
- install.php now loads the normalized schema as part of migration.
- This is the V8 core foundation. Automatic payment gateway APIs, staff UI/permissions UI, invoices/PDF, due ledger, advanced reports, rate limiting, scheduled backups and production monitoring remain subsequent production modules and are not falsely marked as complete here.

V9 — Commercial SaaS Core
- Relational tenant data layer remains the source of truth for operational data.
- Added staff/permission tables and server-side permission checks for Product/Sales/Purchase/Customer/Supplier/Settings/Backup changes.
- Added plan limits: max_products, max_users, max_monthly_sales.
- Added invoice/invoice_items and customer/supplier ledger tables for the commercial billing foundation.
- Added subscription_events for subscription lifecycle history.
- Existing V7/V8 JSON data is preserved for compatibility and migration; new operational sync uses normalized tables.


V12 COMMERCIAL UPDATE
----------------------
- Tenant-specific browser cache key prevents cross-business cache mixing.
- Server database remains the source of truth; trial data persists across refresh.
- Added server-backed Invoices & Due workflow.
- Invoice creation validates tenant ownership, stock, discount and payment, updates stock, sales, invoice items and customer ledger atomically.
- Invoice payments update paid/due/status and ledger atomically.
- Invoice print/PDF uses the browser print dialog (Save as PDF).
- Responsive layout hardened for phone, tablet and desktop.
- Existing dark UI is preserved.


V15 — MULTI-DEVICE / INVOICE STABILITY UPDATE
----------------------------------------------
- Server-side MySQL remains the canonical source for tenant operational records.
- Save now uses a base-state delta instead of deleting and recreating all operational tables.
- This prevents one phone/browser from wiping records created by another device.
- After a successful save, the app re-reads the canonical server state.
- Product/customer/supplier records are updated by tenant-scoped legacy IDs; referenced records are archived/inactivated instead of being blindly deleted.
- Invoice customer joins support both legacy customer IDs and internal customer IDs for compatibility with earlier versions.
- Added the missing server due_summary endpoint.
- Invoice totals, paid, due and status are read from MySQL.
- Invoice payments are atomic and update invoice + customer payment + ledger together.
- Invoice payment history now has invoice reference fields while keeping a legacy note fallback.
- Invoice-generated sales are marked as invoice-source so ordinary sales sync cannot delete them.
- Customer Due > View Due now filters the invoice list for the selected customer.
- Admin data lookup tolerates older accounts whose business row needs repair.
- Existing dark UI/design and previous SaaS modules are preserved.

IMPORTANT: Automatic bKash/Nagad/Rocket gateway API is still not included; billing remains manual Transaction ID submission + Admin approval unless real merchant/API credentials and gateway integration are added.


V18 UPDATE (2026-09-15)
- Sidebar-এ Invoices & Due menu যোগ করা হয়েছে।
- Customer Due / Invoice / Payment History UI access ঠিক করা হয়েছে।
- Multi-device server sync আরও শক্ত করা হয়েছে: অন্য ডিভাইস থেকে একই account-এর data পরিবর্তন হলে visible/focus এবং প্রতি 30 সেকেন্ডে server থেকে refresh হবে।
- Normal save এখনও server relational database-এ delta sync করে এবং সফল save-এর পরে canonical server data re-read করে।


V19 Sync: MySQL is the authoritative source. Each business has a server sync version. Stale saves are rejected with conflict (HTTP 409) instead of overwriting newer data from another device. Browser localStorage is cache/recovery only and is never auto-uploaded on a new/empty server state.
