first commit

deploy/build-dist.bat

@@ -0,0 +1,77 @@
+@echo off
+rem ==================================================================
+rem  BUILD FOR DEPLOYMENT - run on the DEVELOPMENT machine.
+rem
+rem  Produces a dist\ folder containing ONLY what the server needs:
+rem    dist\server.js    whole backend bundled + minified (1 file,
+rem                       no readable source, no node_modules needed)
+rem    dist\public\      frontend (browsers download this anyway)
+rem    dist\deploy\      the run/install scripts
+rem    dist\SapDiConsole\..\SapDiConsole.exe + interop (DI API)
+rem    dist\sap-di-pr.ps1, dist\logo.png etc.
+rem
+rem  COPY THE dist\ CONTENTS to the server as the app folder, add the
+rem  .env there manually (never ships with the build), done.
+rem
+rem  NOTE: pdfkit also has a second, rarely-hit fallback path for its ICC
+rem  color profile at "<app folder>\..\color_profiles\sRGB_IEC61966_2_1.icc"
+rem  - i.e. OUTSIDE the app folder entirely, a sibling of it on the server.
+rem  This script can't produce that (it only ever writes inside dist\), so
+rem  if a future ENOENT ever names that path, copy dist\data\
+rem  sRGB_IEC61966_2_1.icc to a "color_profiles" folder next to the server's
+rem  app folder (not inside it) by hand.
+rem ==================================================================
+cd /d "%~dp0.."
+
+echo [1/4] Bundling backend with esbuild...
+if exist dist rmdir /s /q dist
+mkdir dist
+call npx esbuild server.js --bundle --platform=node --target=node18 --minify --outfile=dist\server.js --log-level=warning
+if %ERRORLEVEL% NEQ 0 (
+    echo BUILD FAILED - see errors above.
+    pause
+    exit /b 1
+)
+
+echo [2/4] Copying frontend + assets...
+xcopy /e /i /q /y public dist\public >nul
+if exist logo.png copy /y logo.png dist\ >nul
+
+rem esbuild only inlines JS - pdfkit/fontkit load these binary data files at
+rem runtime via __dirname-relative fs.readFileSync() calls, so they must sit
+rem next to dist\server.js or "Download PDF" fails with ENOENT (data.trie,
+rem then Helvetica-Bold.afm, etc. - found the hard way, see chat history).
+mkdir dist\data 2>nul
+copy /y node_modules\@foliojs-fork\fontkit\data.trie dist\ >nul
+copy /y node_modules\@foliojs-fork\fontkit\indic.trie dist\ >nul
+copy /y node_modules\@foliojs-fork\fontkit\use.trie dist\ >nul
+copy /y node_modules\@foliojs-fork\linebreak\src\classes.trie dist\ >nul
+copy /y node_modules\@foliojs-fork\pdfkit\js\data\*.afm dist\data\ >nul
+copy /y node_modules\@foliojs-fork\pdfkit\js\data\sRGB_IEC61966_2_1.icc dist\data\ >nul
+
+echo [3/4] Copying deploy scripts + DI console...
+xcopy /e /i /q /y deploy dist\deploy >nul
+del dist\deploy\build-dist.bat >nul 2>&1
+if exist services\sap-di-pr.ps1 copy /y services\sap-di-pr.ps1 dist\ >nul
+if exist services\SapDiConsole\bin\Release\net472\SapDiConsole.exe (
+    xcopy /i /q /y services\SapDiConsole\bin\Release\net472\* dist\SapDiConsole\bin\Release\net472\ >nul
+) else (
+    echo   WARNING: SapDiConsole.exe not built - Purchase Requests will not work.
+)
+
+echo [4/4] Creating runtime folders + .env template...
+mkdir dist\uploads 2>nul
+mkdir dist\logs 2>nul
+echo # Copy the real .env here manually - it is NEVER included in the build. > dist\PUT-ENV-FILE-HERE.txt
+
+echo.
+echo ==========================================================
+echo  Build complete:  dist\
+for %%A in (dist\server.js) do echo  Bundle size: %%~zA bytes
+echo.
+echo  Next steps:
+echo   1. Copy the CONTENTS of dist\ to the server app folder
+echo   2. Put the real .env in that folder
+echo   3. On the server run deploy\install-autostart.bat (as admin)
+echo ==========================================================
+pause

deploy/install-autostart.bat

@@ -0,0 +1,9 @@
+@echo off
+rem ==================================================================
+rem  Registers the portal to start AUTOMATICALLY when Windows boots
+rem  (no login required) and starts it right now.
+rem  >> RUN THIS AS ADMINISTRATOR (right-click - Run as administrator)
+rem  All real work happens in install-autostart.ps1 (robust quoting).
+rem ==================================================================
+powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0install-autostart.ps1"
+pause

deploy/install-autostart.ps1

@@ -0,0 +1,44 @@
+# ==================================================================
+#  SAP-ERP Portal - autostart installer (called by install-autostart.bat)
+#  Registers a Task-Scheduler task that starts the portal at every
+#  Windows boot (as SYSTEM, hidden), and starts it right now.
+# ==================================================================
+$ErrorActionPreference = 'Stop'
+
+# must be admin
+$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
+           ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if (-not $isAdmin) {
+    Write-Host 'This script must be run as Administrator.' -ForegroundColor Red
+    Write-Host 'Right-click install-autostart.bat and choose "Run as administrator".'
+    exit 1
+}
+
+$here = Split-Path -Parent $MyInvocation.MyCommand.Path
+$vbs  = Join-Path $here 'run-hidden.vbs'
+if (-not (Test-Path $vbs)) { Write-Host "Missing: $vbs" -ForegroundColor Red; exit 1 }
+
+Write-Host 'Creating scheduled task "SAP-ERP-Portal"...'
+$action    = New-ScheduledTaskAction  -Execute 'wscript.exe' -Argument ('"{0}"' -f $vbs)
+$trigger   = New-ScheduledTaskTrigger -AtStartup
+$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+$settings  = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
+             -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1)
+
+Register-ScheduledTask -TaskName 'SAP-ERP-Portal' -Action $action -Trigger $trigger `
+    -Principal $principal -Settings $settings -Force | Out-Null
+
+Write-Host 'Starting the portal now...'
+Start-ScheduledTask -TaskName 'SAP-ERP-Portal'
+Start-Sleep -Seconds 4
+
+$state = (Get-ScheduledTask -TaskName 'SAP-ERP-Portal').State
+Write-Host ''
+Write-Host "Task state: $state"
+$node = Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'node.exe' -and $_.CommandLine -match 'server\.js' }
+if ($node) { Write-Host ("Portal RUNNING - node PID " + ($node.ProcessId -join ', ')) -ForegroundColor Green }
+else       { Write-Host 'Portal process not detected yet - check logs\server.log & logs\supervisor.log' -ForegroundColor Yellow }
+Write-Host ''
+Write-Host 'Done. The portal now starts automatically with Windows.'
+Write-Host 'Check anytime with deploy\status.bat'
+exit 0

deploy/open-firewall.bat

@@ -0,0 +1,27 @@
+@echo off
+rem ==================================================================
+rem  Opens Windows Firewall so OTHER PCs on the network can reach the
+rem  portal. The port is read automatically from .env (PORT=...),
+rem  falling back to 5000. >> RUN AS ADMINISTRATOR
+rem  Re-run this after changing PORT in .env (old rule is replaced).
+rem ==================================================================
+net session >nul 2>&1
+if %ERRORLEVEL% NEQ 0 (
+    echo This script must be run as Administrator.
+    pause
+    exit /b 1
+)
+
+set "PORT=5000"
+if exist "%~dp0..\.env" (
+    for /f "tokens=2 delims==" %%P in ('findstr /b /i "PORT=" "%~dp0..\.env"') do set "PORT=%%P"
+)
+rem strip possible spaces
+set "PORT=%PORT: =%"
+
+echo Using port: %PORT%
+netsh advfirewall firewall delete rule name="SAP-ERP-Portal" >nul 2>&1
+netsh advfirewall firewall delete rule name="SAP-ERP-Portal 5000" >nul 2>&1
+netsh advfirewall firewall add rule name="SAP-ERP-Portal" dir=in action=allow protocol=TCP localport=%PORT%
+echo Firewall rule added for TCP port %PORT%.
+pause

deploy/protect-folder.bat

@@ -0,0 +1,37 @@
+@echo off
+rem ==================================================================
+rem  Locks the application folder down so ONLY Administrators and the
+rem  SYSTEM account (which runs the portal's scheduled task) can read
+rem  it. Normal / standard Windows users on this machine will get
+rem  "Access denied" when trying to open the folder - protecting the
+rem  source code and, far more importantly, the passwords in .env.
+rem
+rem  >> RUN AS ADMINISTRATOR
+rem  >> To undo:  icacls "<app folder>" /reset /T
+rem ==================================================================
+net session >nul 2>&1
+if %ERRORLEVEL% NEQ 0 (
+    echo This script must be run as Administrator.
+    pause
+    exit /b 1
+)
+
+set "APPDIR=%~dp0.."
+for %%I in ("%APPDIR%") do set "APPDIR=%%~fI"
+
+echo Locking down: %APPDIR%
+echo Only SYSTEM and Administrators will keep access. Continue? (Ctrl+C to abort)
+pause
+
+icacls "%APPDIR%" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F"
+if %ERRORLEVEL% NEQ 0 (
+    echo Failed - no changes may have been applied.
+    pause
+    exit /b 1
+)
+
+echo.
+echo Done. Standard users on this machine can no longer open the folder.
+echo The portal keeps working (its task runs as SYSTEM).
+echo To undo later:  icacls "%APPDIR%" /reset /T
+pause

deploy/run-hidden.vbs

@@ -0,0 +1,7 @@
+' Launches start-server.bat with NO console window (used by the
+' "SAP-ERP-Portal" scheduled task so the server runs in the background).
+Dim fso, shell, here
+Set fso   = CreateObject("Scripting.FileSystemObject")
+Set shell = CreateObject("Wscript.Shell")
+here = fso.GetParentFolderName(WScript.ScriptFullName)
+shell.Run """" & here & "\start-server.bat""", 0, False

deploy/start-server.bat

@@ -0,0 +1,26 @@
+@echo off
+rem ==================================================================
+rem  SAP-ERP Portal - supervisor loop.
+rem  Runs the Node server and AUTOMATICALLY RESTARTS it if it ever
+rem  crashes. All output goes to the logs\ folder.
+rem  Run directly for a visible console, or via run-hidden.vbs /
+rem  install-autostart.bat for background operation.
+rem ==================================================================
+title SAP-ERP-Portal
+cd /d "%~dp0.."
+if not exist logs mkdir logs
+
+rem Resolve node.exe - the SYSTEM account (autostart) may not have it on
+rem PATH, so fall back to the standard install location.
+set "NODEEXE=node"
+where node >nul 2>&1
+if %ERRORLEVEL% NEQ 0 (
+    if exist "%ProgramFiles%\nodejs\node.exe" set "NODEEXE=%ProgramFiles%\nodejs\node.exe"
+)
+
+:loop
+echo [%date% %time%] starting server via "%NODEEXE%" >> logs\supervisor.log
+"%NODEEXE%" server.js >> logs\server.log 2>&1
+echo [%date% %time%] server exited with code %ERRORLEVEL% - restarting in 5s >> logs\supervisor.log
+timeout /t 5 /nobreak >nul
+goto loop

deploy/status.bat

@@ -0,0 +1,24 @@
+@echo off
+rem ==================================================================
+rem  Shows whether the portal is running and on which port.
+rem  Port is read from .env (PORT=...), default 5000.
+rem ==================================================================
+set "PORT=5000"
+if exist "%~dp0..\.env" (
+    for /f "tokens=2 delims==" %%P in ('findstr /b /i "PORT=" "%~dp0..\.env"') do set "PORT=%%P"
+)
+set "PORT=%PORT: =%"
+
+echo === SAP-ERP Portal status (port %PORT%) ===
+echo.
+powershell -NoProfile -Command "$p = Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'node.exe' -and $_.CommandLine -match 'server\.js' }; if ($p) { $p | ForEach-Object { Write-Host ('RUNNING - node.exe PID ' + $_.ProcessId) } } else { Write-Host 'NOT RUNNING' }"
+echo.
+echo Listening on port %PORT%:
+netstat -ano | findstr :%PORT% | findstr LISTENING
+if %ERRORLEVEL% NEQ 0 echo   (nothing listening on %PORT%)
+echo.
+echo Autostart task:
+schtasks /Query /TN "SAP-ERP-Portal" 2>nul | findstr /I "SAP-ERP-Portal Ready Running"
+if %ERRORLEVEL% NEQ 0 echo   (autostart task not installed - run install-autostart.bat)
+echo.
+pause

deploy/stop-server.bat

@@ -0,0 +1,23 @@
+@echo off
+rem ==================================================================
+rem  Stops the portal: ends the supervisor loop AND the node process.
+rem  (Only kills the node.exe running THIS app's server.js - other
+rem  Node programs on the machine are untouched.)
+rem ==================================================================
+echo Stopping SAP-ERP Portal...
+
+rem End the scheduled-task instance (if it was started via autostart)
+schtasks /End /TN "SAP-ERP-Portal" >nul 2>&1
+
+rem Kill the supervisor console (titled window), if running in foreground
+taskkill /F /FI "WINDOWTITLE eq SAP-ERP-Portal*" >nul 2>&1
+
+rem Kill any cmd.exe still running the supervisor loop
+powershell -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'cmd.exe' -and $_.CommandLine -match 'start-server\.bat' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"
+
+rem Kill the node process running server.js (works whatever the app folder
+rem is named; on a dedicated portal server no other node app runs server.js)
+powershell -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'node.exe' -and $_.CommandLine -match 'server\.js' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force; Write-Host ('  stopped node PID ' + $_.ProcessId) }"
+
+echo Stopped.
+pause

deploy/uninstall-autostart.bat

@@ -0,0 +1,15 @@
+@echo off
+rem ==================================================================
+rem  Removes the Windows autostart (scheduled task) and stops the app.
+rem  >> RUN AS ADMINISTRATOR
+rem ==================================================================
+net session >nul 2>&1
+if %ERRORLEVEL% NEQ 0 (
+    echo This script must be run as Administrator.
+    pause
+    exit /b 1
+)
+call "%~dp0stop-server.bat"
+schtasks /Delete /TN "SAP-ERP-Portal" /F
+echo Autostart removed.
+pause