sale order

.env

@@ -54,6 +54,14 @@ TCS_GSP_FILE_TYPE=JSON
 # ─── JWT Secret ───────────────────────────────────────────
 JWT_SECRET=sap-portal-super-secret-key-change-in-production
 
+# ─── Central Auth SSO (Mitra Industry) ───────────────────
+# CENTRAL_AUTH_API_URL is the Django BACKEND (port 8016), not the Next.js
+# frontend (port 8017) users actually log into — the backend is what verifies
+# the access token server-to-server. This app is registered there as
+# CENTRAL_AUTH_APP_NAME exactly ("SAP ERP", with the space) — must match.
+CENTRAL_AUTH_API_URL=http://14.99.235.114:8016
+CENTRAL_AUTH_APP_NAME=SAP ERP
+
 # ─── ITC-04 Job Work Challan (TCS GSP) ──────────────────
 ITC04_M2JW_MAPPING_CD=MFHGSTTN0000880
 ITC04_M2JW_TEMPLATE_CD=ITC04M2JWTemplate880
@@ -79,7 +87,7 @@ SAP_ATTACHMENT_SERVER_PATH=\\192.9.205.132\COAUpload
 # SMTP_HOST is set, notifications are skipped (logged only, nothing crashes).
 # The recipient list per step/module, and the on/off switch, are configured
 # from Admin Settings (services/appSettingsStore.js) — not here.
-SMTP_HOST=smtp.office3651.com
+SMTP_HOST=smtp.office365.com
 SMTP_PORT=587
 SMTP_SECURE=false
 SMTP_USER=no-reply@mitraindustries.com
@@ -87,3 +95,16 @@ SMTP_PASSWORD=fzxkjxqkzvydjbfb
 SMTP_FROM=SAP ERP Portal <no-reply@mitraindustries.com>
 # Base URL used to build clickable links in notification emails.
 APP_BASE_URL=http://localhost:5000
+
+# ─── Sales Order module (replaces the msale portal) ─────────────
+# API key for the external job that pushes invoice PDFs to /api/sales-ext
+# (header MS-API-KEY). Leave unset to keep that endpoint disabled.
+#SALES_EXT_API_KEY=
+# One-time migration source (scripts/migrate-msale.js) — the LIVE msale MySQL copy.
+#MSALE_MYSQL_HOST=localhost
+#MSALE_MYSQL_PORT=3306
+#MSALE_MYSQL_USER=root
+#MSALE_MYSQL_PASSWORD=
+#MSALE_MYSQL_DATABASE=u709187725_msale_db
+# Extra folders to look for COA/attachment files (comma separated), besides SAP_ATTACHMENT_PATH
+#SALES_COA_PATHS=