first commit

dist-1/deploy/install-autostart.bat

@@ -0,0 +1,9 @@
+@echo off
+rem ==================================================================
+rem  Registers the portal to start AUTOMATICALLY when Windows boots
+rem  (no login required) and starts it right now.
+rem  >> RUN THIS AS ADMINISTRATOR (right-click - Run as administrator)
+rem  All real work happens in install-autostart.ps1 (robust quoting).
+rem ==================================================================
+powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0install-autostart.ps1"
+pause

dist-1/deploy/install-autostart.ps1

@@ -0,0 +1,44 @@
+# ==================================================================
+#  SAP-ERP Portal - autostart installer (called by install-autostart.bat)
+#  Registers a Task-Scheduler task that starts the portal at every
+#  Windows boot (as SYSTEM, hidden), and starts it right now.
+# ==================================================================
+$ErrorActionPreference = 'Stop'
+
+# must be admin
+$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
+           ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+if (-not $isAdmin) {
+    Write-Host 'This script must be run as Administrator.' -ForegroundColor Red
+    Write-Host 'Right-click install-autostart.bat and choose "Run as administrator".'
+    exit 1
+}
+
+$here = Split-Path -Parent $MyInvocation.MyCommand.Path
+$vbs  = Join-Path $here 'run-hidden.vbs'
+if (-not (Test-Path $vbs)) { Write-Host "Missing: $vbs" -ForegroundColor Red; exit 1 }
+
+Write-Host 'Creating scheduled task "SAP-ERP-Portal"...'
+$action    = New-ScheduledTaskAction  -Execute 'wscript.exe' -Argument ('"{0}"' -f $vbs)
+$trigger   = New-ScheduledTaskTrigger -AtStartup
+$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+$settings  = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
+             -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1)
+
+Register-ScheduledTask -TaskName 'SAP-ERP-Portal' -Action $action -Trigger $trigger `
+    -Principal $principal -Settings $settings -Force | Out-Null
+
+Write-Host 'Starting the portal now...'
+Start-ScheduledTask -TaskName 'SAP-ERP-Portal'
+Start-Sleep -Seconds 4
+
+$state = (Get-ScheduledTask -TaskName 'SAP-ERP-Portal').State
+Write-Host ''
+Write-Host "Task state: $state"
+$node = Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'node.exe' -and $_.CommandLine -match 'server\.js' }
+if ($node) { Write-Host ("Portal RUNNING - node PID " + ($node.ProcessId -join ', ')) -ForegroundColor Green }
+else       { Write-Host 'Portal process not detected yet - check logs\server.log & logs\supervisor.log' -ForegroundColor Yellow }
+Write-Host ''
+Write-Host 'Done. The portal now starts automatically with Windows.'
+Write-Host 'Check anytime with deploy\status.bat'
+exit 0

dist-1/deploy/open-firewall.bat

@@ -0,0 +1,27 @@
+@echo off
+rem ==================================================================
+rem  Opens Windows Firewall so OTHER PCs on the network can reach the
+rem  portal. The port is read automatically from .env (PORT=...),
+rem  falling back to 5000. >> RUN AS ADMINISTRATOR
+rem  Re-run this after changing PORT in .env (old rule is replaced).
+rem ==================================================================
+net session >nul 2>&1
+if %ERRORLEVEL% NEQ 0 (
+    echo This script must be run as Administrator.
+    pause
+    exit /b 1
+)
+
+set "PORT=5000"
+if exist "%~dp0..\.env" (
+    for /f "tokens=2 delims==" %%P in ('findstr /b /i "PORT=" "%~dp0..\.env"') do set "PORT=%%P"
+)
+rem strip possible spaces
+set "PORT=%PORT: =%"
+
+echo Using port: %PORT%
+netsh advfirewall firewall delete rule name="SAP-ERP-Portal" >nul 2>&1
+netsh advfirewall firewall delete rule name="SAP-ERP-Portal 5000" >nul 2>&1
+netsh advfirewall firewall add rule name="SAP-ERP-Portal" dir=in action=allow protocol=TCP localport=%PORT%
+echo Firewall rule added for TCP port %PORT%.
+pause

dist-1/deploy/protect-folder.bat

@@ -0,0 +1,37 @@
+@echo off
+rem ==================================================================
+rem  Locks the application folder down so ONLY Administrators and the
+rem  SYSTEM account (which runs the portal's scheduled task) can read
+rem  it. Normal / standard Windows users on this machine will get
+rem  "Access denied" when trying to open the folder - protecting the
+rem  source code and, far more importantly, the passwords in .env.
+rem
+rem  >> RUN AS ADMINISTRATOR
+rem  >> To undo:  icacls "<app folder>" /reset /T
+rem ==================================================================
+net session >nul 2>&1
+if %ERRORLEVEL% NEQ 0 (
+    echo This script must be run as Administrator.
+    pause
+    exit /b 1
+)
+
+set "APPDIR=%~dp0.."
+for %%I in ("%APPDIR%") do set "APPDIR=%%~fI"
+
+echo Locking down: %APPDIR%
+echo Only SYSTEM and Administrators will keep access. Continue? (Ctrl+C to abort)
+pause
+
+icacls "%APPDIR%" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F"
+if %ERRORLEVEL% NEQ 0 (
+    echo Failed - no changes may have been applied.
+    pause
+    exit /b 1
+)
+
+echo.
+echo Done. Standard users on this machine can no longer open the folder.
+echo The portal keeps working (its task runs as SYSTEM).
+echo To undo later:  icacls "%APPDIR%" /reset /T
+pause

dist-1/deploy/run-hidden.vbs

@@ -0,0 +1,7 @@
+' Launches start-server.bat with NO console window (used by the
+' "SAP-ERP-Portal" scheduled task so the server runs in the background).
+Dim fso, shell, here
+Set fso   = CreateObject("Scripting.FileSystemObject")
+Set shell = CreateObject("Wscript.Shell")
+here = fso.GetParentFolderName(WScript.ScriptFullName)
+shell.Run """" & here & "\start-server.bat""", 0, False

dist-1/deploy/start-server.bat

@@ -0,0 +1,26 @@
+@echo off
+rem ==================================================================
+rem  SAP-ERP Portal - supervisor loop.
+rem  Runs the Node server and AUTOMATICALLY RESTARTS it if it ever
+rem  crashes. All output goes to the logs\ folder.
+rem  Run directly for a visible console, or via run-hidden.vbs /
+rem  install-autostart.bat for background operation.
+rem ==================================================================
+title SAP-ERP-Portal
+cd /d "%~dp0.."
+if not exist logs mkdir logs
+
+rem Resolve node.exe - the SYSTEM account (autostart) may not have it on
+rem PATH, so fall back to the standard install location.
+set "NODEEXE=node"
+where node >nul 2>&1
+if %ERRORLEVEL% NEQ 0 (
+    if exist "%ProgramFiles%\nodejs\node.exe" set "NODEEXE=%ProgramFiles%\nodejs\node.exe"
+)
+
+:loop
+echo [%date% %time%] starting server via "%NODEEXE%" >> logs\supervisor.log
+"%NODEEXE%" server.js >> logs\server.log 2>&1
+echo [%date% %time%] server exited with code %ERRORLEVEL% - restarting in 5s >> logs\supervisor.log
+timeout /t 5 /nobreak >nul
+goto loop

dist-1/deploy/status.bat

@@ -0,0 +1,24 @@
+@echo off
+rem ==================================================================
+rem  Shows whether the portal is running and on which port.
+rem  Port is read from .env (PORT=...), default 5000.
+rem ==================================================================
+set "PORT=5000"
+if exist "%~dp0..\.env" (
+    for /f "tokens=2 delims==" %%P in ('findstr /b /i "PORT=" "%~dp0..\.env"') do set "PORT=%%P"
+)
+set "PORT=%PORT: =%"
+
+echo === SAP-ERP Portal status (port %PORT%) ===
+echo.
+powershell -NoProfile -Command "$p = Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'node.exe' -and $_.CommandLine -match 'server\.js' }; if ($p) { $p | ForEach-Object { Write-Host ('RUNNING - node.exe PID ' + $_.ProcessId) } } else { Write-Host 'NOT RUNNING' }"
+echo.
+echo Listening on port %PORT%:
+netstat -ano | findstr :%PORT% | findstr LISTENING
+if %ERRORLEVEL% NEQ 0 echo   (nothing listening on %PORT%)
+echo.
+echo Autostart task:
+schtasks /Query /TN "SAP-ERP-Portal" 2>nul | findstr /I "SAP-ERP-Portal Ready Running"
+if %ERRORLEVEL% NEQ 0 echo   (autostart task not installed - run install-autostart.bat)
+echo.
+pause

dist-1/deploy/stop-server.bat

@@ -0,0 +1,23 @@
+@echo off
+rem ==================================================================
+rem  Stops the portal: ends the supervisor loop AND the node process.
+rem  (Only kills the node.exe running THIS app's server.js - other
+rem  Node programs on the machine are untouched.)
+rem ==================================================================
+echo Stopping SAP-ERP Portal...
+
+rem End the scheduled-task instance (if it was started via autostart)
+schtasks /End /TN "SAP-ERP-Portal" >nul 2>&1
+
+rem Kill the supervisor console (titled window), if running in foreground
+taskkill /F /FI "WINDOWTITLE eq SAP-ERP-Portal*" >nul 2>&1
+
+rem Kill any cmd.exe still running the supervisor loop
+powershell -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'cmd.exe' -and $_.CommandLine -match 'start-server\.bat' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"
+
+rem Kill the node process running server.js (works whatever the app folder
+rem is named; on a dedicated portal server no other node app runs server.js)
+powershell -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'node.exe' -and $_.CommandLine -match 'server\.js' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force; Write-Host ('  stopped node PID ' + $_.ProcessId) }"
+
+echo Stopped.
+pause

dist-1/deploy/uninstall-autostart.bat

@@ -0,0 +1,15 @@
+@echo off
+rem ==================================================================
+rem  Removes the Windows autostart (scheduled task) and stops the app.
+rem  >> RUN AS ADMINISTRATOR
+rem ==================================================================
+net session >nul 2>&1
+if %ERRORLEVEL% NEQ 0 (
+    echo This script must be run as Administrator.
+    pause
+    exit /b 1
+)
+call "%~dp0stop-server.bat"
+schtasks /Delete /TN "SAP-ERP-Portal" /F
+echo Autostart removed.
+pause