# SAP-ERP Portal — Publishing Guide (Local Windows Server)

How to run this portal permanently on a local Windows machine so everyone on
your network can use it, it starts automatically with Windows, and restarts
itself if it ever crashes. No extra software is needed beyond Node.js —
everything uses built-in Windows features (Task Scheduler).

---

## 1. What you are deploying

| Piece | What it is |
|---|---|
| `server.js` | The Node/Express app — serves the web UI (`public/`) **and** all APIs on **port 5000** |
| `.env` | ALL configuration: SQL Server, SAP Service Layer, company DB, JWT secret, port |
| `services/SapDiConsole/` | Compiled DI-API console exe (Purchase Requests). Built once with `build.bat` |
| `deploy/` | The publish scripts described below |
| `logs/` | Created automatically — server output + supervisor log |

The app needs live network access to the **SQL Server** (`192.9.205.132:1433`)
and the **SAP Service Layer** (`https://192.9.205.132:50000`), and the SAP
**DI API v10.00.331** installed locally for the Purchase Request feature.

---

## 2. One-time setup on the server machine

1. **Install Node.js LTS** (v18 or newer) from https://nodejs.org — use the
   default installer options ("Add to PATH" must stay ticked, it is by default).
   Verify in a new Command Prompt: `node -v`

2. **Copy the whole project folder** to its permanent home, e.g. `D:\sap-erp`
   *(scripts work from any folder — they always operate on their own parent folder)*.

3. **Install dependencies** (only needed if `node_modules` was not copied):
   ```bat
   cd /d D:\sap-erp
   npm install
   ```

4. **Configure `.env`** — copy it from the current machine or review every key
   (SQL host/user/password, `SAP_B1_SERVER`, `SAP_B1_COMPANY`, `SAP_B1_USER`/`PASSWORD`,
   `JWT_SECRET`, optional `PORT`). **Never commit or share this file — it holds passwords.**

5. **Build the DI console** (Purchase Requests) if `services\SapDiConsole\bin\Release\net472\SapDiConsole.exe`
   doesn't exist yet:
   ```bat
   cd /d D:\sap-erp\services\SapDiConsole
   build.bat
   ```
   Requires the SAP B1 **DI API (build ≥ 331)** installed on this machine.

6. **Open the firewall** so other PCs can reach the portal
   *(right-click → Run as administrator)*:
   ```bat
   deploy\open-firewall.bat
   ```

7. **Test it manually first** — double-click `deploy\start-server.bat`.
   A console window opens; browse to **http://localhost:5000** and log in.
   Close the window when done testing (or leave it — step 3 below replaces it).

---

## 3. Publish — auto-start with Windows

Right-click → **Run as administrator**:

```bat
deploy\install-autostart.bat
```

This registers a Task-Scheduler task **"SAP-ERP-Portal"** that:
- starts the portal **at every Windows boot** (no user login needed, runs as SYSTEM),
- runs it **hidden** (no console window),
- and because the task runs the **supervisor loop**, the server is
  **restarted automatically within 5 seconds** if it ever crashes.

It also starts the portal immediately, so you're live as soon as it finishes.

---

## 4. Daily operations

| Action | How |
|---|---|
| Check it's running | `deploy\status.bat` |
| Stop | `deploy\stop-server.bat` |
| Start (background) | `schtasks /Run /TN "SAP-ERP-Portal"` — or reboot |
| Start (visible console, for debugging) | `deploy\start-server.bat` |
| View logs | `logs\server.log` (app output) · `logs\supervisor.log` (start/crash history) |
| Remove autostart | `deploy\uninstall-autostart.bat` *(as administrator)* |

**Users access the portal at:** `http://<server-ip>:5000`
(find the IP with `ipconfig` — give users that address, e.g. `http://192.9.205.50:5000`).
Optionally add a DNS/hosts entry like `erp.mitra.local` pointing to that IP.

---

## 5. Updating the application

1. `deploy\stop-server.bat`
2. Copy the new/changed files over the folder (keep your `.env`!)
3. If `package.json` changed: `npm install`
4. If `services/SapDiConsole` changed: re-run its `build.bat`
5. `schtasks /Run /TN "SAP-ERP-Portal"` (or reboot)
6. Users press **Ctrl+F5** in the browser once (pages are cache-busted, but a
   hard refresh guarantees the newest files)

---

## 6. Changing the port (e.g. if 5000 is taken)

1. Add to `.env`:
   ```
   PORT=8080
   ```
   (any free port — check with `netstat -ano | findstr :8080` that nothing is on it)
2. Re-run `deploy\open-firewall.bat` *(as administrator)* — it **reads the port
   from `.env` automatically** and replaces the old rule.
3. Restart the portal (`deploy\stop-server.bat`, then `schtasks /Run /TN "SAP-ERP-Portal"`).

`deploy\status.bat` also reads the port from `.env`, so it always checks the
right one. Users then browse to `http://<server-ip>:8080`.

---

## 7. Troubleshooting

| Symptom | Check |
|---|---|
| Page won't open from another PC but works on the server | Firewall — re-run `deploy\open-firewall.bat`; confirm with `deploy\status.bat` that port 5000 is LISTENING |
| "NOT RUNNING" in status | `logs\server.log` tail — usually a bad `.env` value (SQL/SAP unreachable) or port already in use |
| Starts then dies repeatedly | `logs\supervisor.log` shows exit codes; fix the cause in `logs\server.log` — the loop keeps retrying every 5 s |
| Task exists but nothing runs after reboot | Node not on the SYSTEM PATH — reinstall Node.js with defaults, or edit `deploy\start-server.bat` to use the full path `"C:\Program Files\nodejs\node.exe"` |
| Purchase Request errors (DI API) | DI API build must be ≥ 331 and `Interop.SAPbobsCOM.dll` regenerated — see the comment inside `services\SapDiConsole\build.bat` |
| SAP/SQL password changed | Update `.env`, then stop + start the portal |

---

## 8. Compiled deployment — ship NO source code to the server (recommended)

Instead of copying the project, build a **dist** package on your development
machine and copy only that. The server then holds no readable source and no
`node_modules` at all.

On the **development machine**:
```bat
deploy\build-dist.bat
```
This produces `dist\` containing only:

| | |
|---|---|
| `server.js` | the ENTIRE backend (server + routes + services + all npm packages) bundled & minified into one ~4 MB file — variable names crushed, comments stripped, no project structure |
| `public\` | the frontend (browsers download this anyway) |
| `deploy\` | the run/install scripts from section 3–4 |
| `SapDiConsole\…` + `sap-di-pr.ps1` | the DI-API console for Purchase Requests |
| `uploads\`, `logs\` | empty runtime folders |

Then on the **server**:
1. Copy the **contents of `dist\`** to the app folder (e.g. `D:\sap-erp-portal`)
2. Place the real **`.env`** there (it is deliberately never part of the build)
3. Run `deploy\open-firewall.bat` and `deploy\install-autostart.bat` as admin — same as section 3
4. Only **Node.js** needs to be installed on the server — **no `npm install`, no node_modules**

**Updating:** rebuild on the dev machine, stop the portal, copy the new
`dist\server.js` (and `public\` if the frontend changed) over, start again.

**Honest limits:** minified JS deters reading and copying but is not
encryption — combine it with `deploy\protect-folder.bat` (section 9) and a
short server-admin list for real protection. The `.env` is still plain text
on the server; the ACL lock is what protects it.

## 9. Protecting the source code & passwords on the server

**Browser users can never see the backend.** Express serves only `public/` and
API responses — `server.js`, `routes/`, `services/` and `.env` are unreachable
over the network. (Frontend HTML/JS is visible in every web app by nature.)

**The real risk is people who log into the server machine** — they could open
the folder and read the code and, worse, the passwords in `.env`. Protect it:

1. Run *(as administrator)*:
   ```bat
   deploy\protect-folder.bat
   ```
   This strips folder permissions down to **SYSTEM + Administrators** only.
   Standard Windows users on the machine get "Access denied", while the portal
   keeps running because its scheduled task runs as SYSTEM.
   Undo anytime: `icacls "<app folder>" /reset /T`

2. **Don't hand out admin/RDP access** to the server — that is the actual
   security boundary. Anyone who is a Windows *administrator* on the box can
   always get to the files, no tool can prevent that.

3. Use the **compiled deployment** (section 8) so no readable source is on the
   server in the first place.

## 10. Good practices

- **Back up** `.env` and the app DB (`SAP-ERP` database on the SQL server) regularly.
- Keep the server on a **UPS** and set Windows power settings to never sleep.
- The `logs\` folder grows over time — delete or archive old logs occasionally.