# Auction Catalog Deduplication

## Plan
- [x] Search deps for legacy Auction routes
- [x] Remove replaced duplicates; keep thin adapters only where needed
- [x] Drop purchase-request / share-event / public-profile from public surface
- [x] Hide legacy from OpenAPI + regenerate Postman
- [x] Auction tests + full suite

## Review
- Canonical Swagger = query-param catalog only (see `docs/AUCTION_HTTP_API.md`).
- Runtime adapters kept (hidden): `/auction-details`, `/pay-auction-deposit`, `/pay-auction`, `/create-product-auction`.
- Runtime removed: `/list-auctions`, `/bids-list`, `/auction-bids`, `/update-auction`, `/cancel-auction`, purchase-request, share-event, public-profile.
- `test/auction*.test.js` → **68 pass / 0 fail**. Focused OpenAPI/Postman bundle → **65 pass / 0 fail**.
- Full `npm test` → **890 pass / 1 fail** unrelated (`productDetailsSimilarAds`).

# Auction Catalog HTTP + Socket Contracts

## Plan
- [x] Public/provider Auction APIs with query-param ids (no path params)
- [x] Favourite, report, conversation, similar, deposit, winner payment
- [x] Provider create/update/submit/cancel + price suggestion
- [x] Socket enter DTO safety; keep Socket-only bidding (no `/place-bid`)
- [x] OpenAPI + Postman + `docs/AUCTION_SOCKET_EVENTS.md`
- [x] Focused contract tests + full suite report

## Review
- Classification: **READY AFTER MANUAL QA**

# Order Approval Timeout (Store Response Window)

## Plan
- [x] Add `providerResponseTime` / `providerResponseTimeUnit` to settings + dashboard UI + validation + i18n
- [x] Add `scheduleOrderApprovalTimeout` / `clearOrderApprovalTimeout` / `cancelUnacceptedOrder` cron helpers
- [x] Schedule on `createOrder`; clear on accept / reject / client cancel
- [x] Focused tests + full suite verification

## Review
- Dashboard card lives under Order control → cycle durations (`control.ejs`).
- Create-time cron sets `approvalExpiresAt` and job `{orderId}-order-approval-timeout`.
- Auto-cancel restores stock and notifies client + provider via `orders.autoCancelOrderDueToNoProviderResponse`.
- Existing Settings rows now use an operational fallback of `1 hour`, so createOrder always persists the approval CronJob until the dashboard saves another positive duration.
- `addCronJobToDB` returns the upserted row, reactivates reused jobs, and propagates persistence errors.
- Notification interpolation and payload preserve nested `data.orderNumber` instead of overwriting it with an empty string.
- Focused timeout/settings/notification tests → **30 pass / 0 fail**.
- Full suite: `npm test` → **351 pass / 0 fail**.

# Product Details — Four Similar Products

## Plan
- [x] Restore the client `GET /productDetails` route.
- [x] Add a four-item similar-products preview using the client home/list DTO.
- [x] Fetch five matches internally to calculate `hasMore`.
- [x] Add focused route, query, DTO, limit, and response-contract tests.

## Review
- Same `subDepartment` products are prioritized before same-department fallback.
- Current, hidden, deleted, rejected, and non-approved products are excluded.
- Products from non-active providers are excluded.
- Response contains `similarAds: { title, items, hasMore }` with at most four items and no pagination.
- Focused tests: `node --test test/productDetailsSimilarAds.test.js` → **5 pass / 0 fail**.
- Syntax and whitespace checks passed.
- Full suite: `npm test` → **813 pass / 1 unrelated failure** (`returnRequestFlow`: missing delivered route).

# Departments / SubDepartments / Products Seed

## Plan
- [x] Inspect the live taxonomy state before writing anything
- [x] Add an idempotent seed script for departments + subdepartments + sample products
- [x] Register the npm script and run it against the database
- [x] Verify links, filters, images, and re-run idempotency

## Review
- New script: `scripts/seedDepartmentsProducts.js`, wired as `npm run seed:departments-products`.
- Seeds 4 departments (تمور / قهوة / شاي / ورود), 9 subdepartments, and 5 products; each product points to a subdepartment that belongs to its own department.
- Products reuse an existing accepted provider (default: oldest accepted, override with `--provider=<id>`); the script never creates users and never deletes data.
- Upsert keys: `slug` for taxonomy, `provider + subDepartment + name.ar` for products, so re-running updates in place — second run reported `created=0, updated=4/9/5` with unchanged ids.
- Seed images are per-row copies under `assets/uploads/{departments,subDepartments,products/<productId>}`, so a dashboard delete cannot break another row's image.
- `--dry-run` supported for a no-write preview.
- Verification: no orphan or mismatched department/subdepartment links; provider list filter returns 2 products for `departmentId=dates` and 1 for `subdepartmentId=sukkari-dates`; all seeded image files exist on disk.

# Restore Approved Order Chat Contract

## Plan
- [x] Audit runtime vs last approved chat state
- [x] Keep routes `/order/delivered` + `/order/received` (no deliveredShipping)
- [x] Keep Profit-on-payment and FinancialTransaction-on-received
- [x] Sync OpenAPI/Postman Figma + descriptions
- [x] Lock contract with focused tests

## Review
- Runtime already matched approved chat state: simplified routes, order chat on create, Profit only on payment, FT on client receipt.
- Removed dead `order-delivered-shipping` fragment from `docs/openapi/paths/order.yaml`.
- Added approved Figma links (design first) for payment / received / delivered and documented chat + FT placement.
- Synced `public/api-docs/openapi.json` + Postman export.
- Focused tests: `orderDeliveryConfirmation` + `orderChatCreation` → **2 pass / 0 fail**.

# Dual-Role Product Details (`GET /products/details`)

## Plan
- [x] Expand route guard + shared productId validation
- [x] Role-aware helper: Provider admin DTO / Client details + similarAds
- [x] Update OpenAPI/Postman/contract docs
- [x] Focused + full test verification

## Review
- Route accepts `authorize(CLIENT, PROVIDER)`; validator checks `productId` format only.
- Provider path unchanged (owned, hidden/pending readable, `toProviderProductDetailsDto`).
- Client path requires accepted + visible product and returns `productDetails` with `similarAds` (max 4 + hasMore).
- OpenAPI security is OR of ProviderBearerAuth / ClientBearerAuth; Postman regenerated.
- Focused: `providerProducts.test.js` → **63/63 pass**.
- Full suite: **828 pass / 1 unrelated fail** (`dashboardPermissionsContract`: missing `permissions.roleNameAr`).