Damir Radulić
f5c6570d47
The bare @app.get/post('/api/admin/users') decorators in pgz_sport_api.py
were registered before app.include_router(admin_users_router) and shadowed
the JWT-protected M2 routes, leaking user list to anyone.
Removed all three: GET /api/admin/users, POST /api/admin/users,
POST /api/admin/users/{uid}/toggle. The auth.admin_users router now owns
this prefix exclusively and gates every method with require_user.
Verified: no-auth → 401, invalid token → 401, valid Bearer → 200.
660 lines
27 KiB
Python
660 lines
27 KiB
Python
#!/usr/bin/env python3
|
|
# erp/ocr.py — PGŽ Sport ERP OCR router (M5)
|
|
# Author: Damir Radulić <damir@rinet.one> / dradulic@outlook.com
|
|
# Date: 2026-05-04
|
|
# Description: /api/erp/ocr/upload + /parse — Tesseract OCR + DeepSeek V3 LLM extraction
|
|
# Persists into pgz_sport.invoice_uploads, then offers structured invoice parse.
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import re
|
|
import json
|
|
import hashlib
|
|
import subprocess
|
|
import tempfile
|
|
import traceback
|
|
from datetime import datetime, date
|
|
from pathlib import Path
|
|
from typing import Optional, List, Any
|
|
|
|
import psycopg2
|
|
import psycopg2.extras
|
|
import requests
|
|
from fastapi import APIRouter, UploadFile, File, Form, HTTPException, Header, Query, Body
|
|
from fastapi.responses import JSONResponse
|
|
|
|
router = APIRouter(prefix="/api/erp", tags=["erp-ocr"])
|
|
|
|
# === Config ===
|
|
DB = dict(host="10.10.0.2", port=6432, dbname="rinet_v3", user="rinet",
|
|
password="R1net2026!SecureDB#v7")
|
|
UPLOAD_DIR = Path("/opt/pgz-sport/_data/uploads/invoices")
|
|
UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
|
|
|
|
DEEPSEEK_API_KEY = os.getenv("DEEPSEEK_API_KEY", "sk-33d29054d1ab4377b7d1a84bc0a423c7")
|
|
DEEPSEEK_URL = "https://api.deepseek.com/v1/chat/completions"
|
|
DEEPSEEK_MODEL = os.getenv("DEEPSEEK_MODEL", "deepseek-chat")
|
|
|
|
ALLOWED_EXT = {".pdf", ".jpg", ".jpeg", ".png", ".tif", ".tiff", ".webp"}
|
|
MAX_BYTES = 12 * 1024 * 1024 # 12 MB
|
|
|
|
ADMIN_TOKEN = "admin-pgz-2026"
|
|
|
|
|
|
def _db():
|
|
c = psycopg2.connect(**DB)
|
|
c.autocommit = True
|
|
return c
|
|
|
|
|
|
def _is_admin(authorization: Optional[str]) -> bool:
|
|
if not authorization:
|
|
return False
|
|
t = authorization.replace("Bearer ", "").strip()
|
|
return t == ADMIN_TOKEN
|
|
|
|
|
|
def _safe_filename(orig: str) -> str:
|
|
base = re.sub(r"[^A-Za-z0-9._-]+", "_", (orig or "upload").strip())[:120]
|
|
if not base:
|
|
base = "upload"
|
|
ts = datetime.now().strftime("%Y%m%d_%H%M%S")
|
|
return f"{ts}_{base}"
|
|
|
|
|
|
def _extract_text(path: Path) -> tuple[str, str]:
|
|
"""Return (text, method). Tries pdftotext first, falls back to tesseract."""
|
|
suf = path.suffix.lower()
|
|
if suf == ".pdf":
|
|
try:
|
|
r = subprocess.run(
|
|
["pdftotext", "-layout", "-q", str(path), "-"],
|
|
capture_output=True, timeout=45,
|
|
)
|
|
txt = r.stdout.decode("utf-8", "ignore")
|
|
if len(txt.strip()) > 80:
|
|
return txt, "pdftotext"
|
|
except Exception:
|
|
pass
|
|
# Rasterize + tesseract
|
|
try:
|
|
with tempfile.TemporaryDirectory(prefix="ocr_") as td:
|
|
subprocess.run(
|
|
["pdftoppm", "-r", "200", str(path), f"{td}/page"],
|
|
timeout=120, check=True,
|
|
)
|
|
chunks = []
|
|
for img in sorted(Path(td).glob("page-*.ppm"))[:5]:
|
|
r = subprocess.run(
|
|
["tesseract", str(img), "-", "-l", "hrv+eng", "--psm", "6"],
|
|
capture_output=True, timeout=90,
|
|
)
|
|
chunks.append(r.stdout.decode("utf-8", "ignore"))
|
|
return "\n".join(chunks), "tesseract"
|
|
except Exception as e:
|
|
return "", f"pdf_err:{e}"
|
|
if suf in {".jpg", ".jpeg", ".png", ".tif", ".tiff", ".webp"}:
|
|
try:
|
|
r = subprocess.run(
|
|
["tesseract", str(path), "-", "-l", "hrv+eng", "--psm", "6"],
|
|
capture_output=True, timeout=120,
|
|
)
|
|
return r.stdout.decode("utf-8", "ignore"), "tesseract"
|
|
except Exception as e:
|
|
return "", f"img_err:{e}"
|
|
return "", f"unsupported:{suf}"
|
|
|
|
|
|
# === HR invoice regex helpers ===
|
|
_OIB = re.compile(r"\b(\d{11})\b")
|
|
_IBAN = re.compile(r"\b(HR\d{19})\b")
|
|
_DATE_DOT = re.compile(r"\b(\d{1,2})[.\s\-/]+(\d{1,2})[.\s\-/]+(20\d{2})\b")
|
|
_DATE_ISO = re.compile(r"\b(20\d{2})[\-/](\d{1,2})[\-/](\d{1,2})\b")
|
|
_AMOUNT_TOTAL = re.compile(
|
|
r"(?i)(?:UKUPNO|TOTAL|SVEUKUPNO|ZA NAPLATU|ZA PLATITI|ZA UPLATU|IZNOS\s+UKUPNO)[\s:€]*([\d.\s]{1,12}[,.]\d{2})"
|
|
)
|
|
_AMOUNT_VAT = re.compile(r"(?i)(?:PDV|VAT)[\s:%]*?([\d.\s]{1,8}[,.]\d{2})")
|
|
_INVOICE_NO = re.compile(r"(?i)(?:ra[čc]un|invoice|broj|fakture|br\.)\s*[:#]?\s*([A-Z0-9\-/.]{3,30})")
|
|
|
|
|
|
def _parse_amount(s: str) -> Optional[float]:
|
|
if not s:
|
|
return None
|
|
s = s.replace(" ", "").replace("\xa0", "")
|
|
# Croatian style "1.234,56" → 1234.56
|
|
if "," in s and "." in s:
|
|
s = s.replace(".", "").replace(",", ".")
|
|
elif "," in s:
|
|
s = s.replace(",", ".")
|
|
try:
|
|
return float(s)
|
|
except Exception:
|
|
return None
|
|
|
|
|
|
def regex_extract(text: str) -> dict:
|
|
out: dict[str, Any] = {"raw_chars": len(text or "")}
|
|
if not text:
|
|
return out
|
|
oibs = list(dict.fromkeys(_OIB.findall(text)))
|
|
if oibs:
|
|
out["oibs_found"] = oibs
|
|
out["vendor_oib"] = oibs[0]
|
|
if len(oibs) > 1:
|
|
out["customer_oib"] = oibs[1]
|
|
|
|
m = _IBAN.search(text.replace(" ", ""))
|
|
if m:
|
|
out["iban"] = m.group(1)
|
|
|
|
m = _INVOICE_NO.search(text)
|
|
if m:
|
|
out["invoice_no"] = m.group(1).strip().rstrip(".,;")
|
|
|
|
for rx, order in [(_DATE_DOT, "dmy"), (_DATE_ISO, "ymd")]:
|
|
m = rx.search(text)
|
|
if m:
|
|
g = m.groups()
|
|
try:
|
|
if order == "dmy":
|
|
out["invoice_date"] = f"{g[2]}-{int(g[1]):02d}-{int(g[0]):02d}"
|
|
else:
|
|
out["invoice_date"] = f"{g[0]}-{int(g[1]):02d}-{int(g[2]):02d}"
|
|
# validate
|
|
date.fromisoformat(out["invoice_date"])
|
|
break
|
|
except Exception:
|
|
out.pop("invoice_date", None)
|
|
|
|
totals = [_parse_amount(x) for x in _AMOUNT_TOTAL.findall(text)]
|
|
totals = [t for t in totals if t and t > 0.01]
|
|
if totals:
|
|
out["amount_gross"] = max(totals)
|
|
out["amounts_found"] = totals[:6]
|
|
|
|
vats = [_parse_amount(x) for x in _AMOUNT_VAT.findall(text)]
|
|
vats = [v for v in vats if v and v > 0.01]
|
|
if vats:
|
|
# smallest plausible PDV (less than gross)
|
|
if "amount_gross" in out:
|
|
cand = [v for v in vats if v < out["amount_gross"]]
|
|
if cand:
|
|
out["amount_vat"] = max(cand)
|
|
else:
|
|
out["amount_vat"] = max(vats)
|
|
|
|
if "amount_gross" in out and "amount_vat" in out:
|
|
out["amount_net"] = round(out["amount_gross"] - out["amount_vat"], 2)
|
|
|
|
# Vendor name guess: first non-numeric, non-OIB line in header
|
|
for line in text.split("\n")[:12]:
|
|
ln = line.strip()
|
|
if 4 < len(ln) < 80 and not _OIB.search(ln) and not re.match(r"^[\d\s.,\-/€:]+$", ln):
|
|
out["vendor_name"] = ln
|
|
break
|
|
|
|
# Crude vendor guess for known HR sellers
|
|
upper = text.upper()
|
|
for keyword, label in [
|
|
("INA d.d.", "INA"), ("INA-MAZIVA", "INA"), ("TIFON", "TIFON"),
|
|
("PETROL", "PETROL"), ("HAC", "HAC"), ("BINA-ISTRA", "BINA-ISTRA"),
|
|
("HRVATSKE AUTOCESTE", "HAC"),
|
|
]:
|
|
if keyword in upper:
|
|
out.setdefault("vendor_brand", label)
|
|
break
|
|
|
|
return out
|
|
|
|
|
|
# === DeepSeek V3 LLM extraction ===
|
|
SYSTEM_PROMPT = (
|
|
"Ti si stručnjak za hrvatske račune (R-1, fiskalne, HUB-3). "
|
|
"Korisnik daje tekst računa izvučen OCR-om. Vrati ISKLJUČIVO valjani JSON, bez markdowna i komentara. "
|
|
"Ako neko polje nije sigurno - vrati null. Iznosi su brojevi (decimal s točkom). Datum je 'YYYY-MM-DD'."
|
|
)
|
|
|
|
LLM_SCHEMA_HINT = """{
|
|
"izdavatelj_naziv": str|null,
|
|
"izdavatelj_oib": str|null,
|
|
"izdavatelj_adresa": str|null,
|
|
"kupac_naziv": str|null,
|
|
"kupac_oib": str|null,
|
|
"datum": "YYYY-MM-DD"|null,
|
|
"broj_racuna": str|null,
|
|
"iznos_neto": float|null,
|
|
"iznos_pdv": float|null,
|
|
"iznos_brutto": float|null,
|
|
"stopa_pdv": float|null,
|
|
"valuta": "EUR"|"HRK"|null,
|
|
"nacin_placanja": str|null,
|
|
"IBAN": str|null,
|
|
"opis_svrhe": str|null,
|
|
"vrsta_troska": "gorivo"|"cestarina"|"hotel"|"restoran"|"oprema"|"ostalo"|null,
|
|
"stavke": [
|
|
{"opis": str, "kolicina": float, "jedinica": str, "cijena": float, "ukupno": float}
|
|
]
|
|
}"""
|
|
|
|
|
|
def deepseek_extract(text: str, hint: dict | None = None) -> dict:
|
|
"""Call DeepSeek chat completions for structured JSON extraction."""
|
|
if not DEEPSEEK_API_KEY:
|
|
return {"error": "no_api_key"}
|
|
if not text or len(text.strip()) < 20:
|
|
return {"error": "empty_text"}
|
|
|
|
user_msg = (
|
|
f"Iz teksta računa ispod izvuci polja po shemi:\n{LLM_SCHEMA_HINT}\n\n"
|
|
f"REGEX hint (može biti nepotpun ili netočan): {json.dumps(hint or {}, ensure_ascii=False)}\n\n"
|
|
f"--- TEKST RAČUNA ---\n{text[:8000]}\n--- KRAJ ---"
|
|
)
|
|
payload = {
|
|
"model": DEEPSEEK_MODEL,
|
|
"messages": [
|
|
{"role": "system", "content": SYSTEM_PROMPT},
|
|
{"role": "user", "content": user_msg},
|
|
],
|
|
"response_format": {"type": "json_object"},
|
|
"temperature": 0.0,
|
|
"max_tokens": 1200,
|
|
}
|
|
headers = {
|
|
"Authorization": f"Bearer {DEEPSEEK_API_KEY}",
|
|
"Content-Type": "application/json",
|
|
}
|
|
try:
|
|
r = requests.post(DEEPSEEK_URL, headers=headers, json=payload, timeout=60)
|
|
except Exception as e:
|
|
return {"error": f"net:{e}"}
|
|
if r.status_code != 200:
|
|
return {"error": f"http_{r.status_code}", "detail": r.text[:300]}
|
|
try:
|
|
body = r.json()
|
|
content = body["choices"][0]["message"]["content"]
|
|
return json.loads(content)
|
|
except Exception as e:
|
|
return {"error": f"parse:{e}", "raw": (r.text[:500] if r else "")}
|
|
|
|
|
|
# === Endpoints ===
|
|
|
|
@router.post("/ocr/upload")
|
|
async def ocr_upload(
|
|
file: UploadFile = File(...),
|
|
klub_id: Optional[int] = Form(None),
|
|
tenant_id: int = Form(1),
|
|
invoice_kind: str = Form("ostalo"),
|
|
authorization: Optional[str] = Header(None),
|
|
):
|
|
"""Upload an invoice file (PDF/image) → store on disk + insert pgz_sport.invoice_uploads."""
|
|
suffix = "." + (file.filename or "").rsplit(".", 1)[-1].lower()
|
|
if suffix not in ALLOWED_EXT:
|
|
raise HTTPException(400, f"Tip datoteke nije podržan: {suffix}. Dozvoljeno: {sorted(ALLOWED_EXT)}")
|
|
|
|
raw = await file.read()
|
|
if not raw:
|
|
raise HTTPException(400, "Prazna datoteka")
|
|
if len(raw) > MAX_BYTES:
|
|
raise HTTPException(400, f"Datoteka prevelika ({len(raw)} > {MAX_BYTES} bajtova)")
|
|
|
|
sha256 = hashlib.sha256(raw).hexdigest()
|
|
fname = _safe_filename(file.filename or "upload")
|
|
if not fname.endswith(suffix):
|
|
fname += suffix
|
|
path = UPLOAD_DIR / fname
|
|
path.write_bytes(raw)
|
|
|
|
with _db() as c:
|
|
cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
|
|
cur.execute(
|
|
"""
|
|
INSERT INTO pgz_sport.invoice_uploads
|
|
(klub_id, file_name, file_path, file_size, mime, sha256, ocr_status, meta)
|
|
VALUES (%s, %s, %s, %s, %s, %s, 'pending', %s)
|
|
RETURNING id, klub_id, file_name, ocr_status, uploaded_at
|
|
""",
|
|
(klub_id, file.filename, str(path), len(raw), file.content_type or "",
|
|
sha256, json.dumps({"tenant_id": tenant_id, "invoice_kind": invoice_kind})),
|
|
)
|
|
row = cur.fetchone()
|
|
return {"ok": True, "upload_id": row["id"], "file_name": row["file_name"],
|
|
"size": len(raw), "sha256": sha256, "status": row["ocr_status"]}
|
|
|
|
|
|
@router.post("/ocr/parse")
|
|
async def ocr_parse(
|
|
upload_id: Optional[int] = Form(None),
|
|
file: Optional[UploadFile] = File(None),
|
|
use_llm: bool = Form(True),
|
|
authorization: Optional[str] = Header(None),
|
|
):
|
|
"""Run OCR + (optional) DeepSeek LLM extraction.
|
|
Either pass upload_id (parse a previously uploaded file) or send file directly (one-shot)."""
|
|
tmp_to_clean: Optional[Path] = None
|
|
upload_row = None
|
|
try:
|
|
if upload_id:
|
|
with _db() as c:
|
|
cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
|
|
cur.execute("SELECT * FROM pgz_sport.invoice_uploads WHERE id=%s", (upload_id,))
|
|
upload_row = cur.fetchone()
|
|
if not upload_row:
|
|
raise HTTPException(404, f"Upload id={upload_id} ne postoji")
|
|
target = Path(upload_row["file_path"])
|
|
if not target.exists():
|
|
raise HTTPException(404, f"Datoteka ne postoji na disku: {target}")
|
|
elif file:
|
|
suffix = "." + (file.filename or "").rsplit(".", 1)[-1].lower()
|
|
if suffix not in ALLOWED_EXT:
|
|
raise HTTPException(400, f"Tip datoteke nije podržan: {suffix}")
|
|
raw = await file.read()
|
|
if not raw:
|
|
raise HTTPException(400, "Prazna datoteka")
|
|
tmp = tempfile.NamedTemporaryFile(prefix="parse_", suffix=suffix, delete=False)
|
|
tmp.write(raw); tmp.close()
|
|
target = Path(tmp.name)
|
|
tmp_to_clean = target
|
|
else:
|
|
raise HTTPException(400, "Treba poslati upload_id ILI file")
|
|
|
|
text, method = _extract_text(target)
|
|
if len(text.strip()) < 20:
|
|
return {"ok": False, "ocr_method": method, "raw_chars": len(text),
|
|
"error": "OCR nije uspio izvući dovoljno teksta"}
|
|
|
|
regex_fields = regex_extract(text)
|
|
regex_fields["ocr_method"] = method
|
|
|
|
llm_fields: dict = {}
|
|
if use_llm:
|
|
llm_fields = deepseek_extract(text, hint=regex_fields)
|
|
|
|
# Merge: LLM overrides regex when valid
|
|
merged = dict(regex_fields)
|
|
for k in ("izdavatelj_naziv", "izdavatelj_oib", "kupac_oib", "datum",
|
|
"broj_racuna", "iznos_neto", "iznos_pdv", "iznos_brutto",
|
|
"stopa_pdv", "valuta", "IBAN", "opis_svrhe", "vrsta_troska",
|
|
"izdavatelj_adresa", "nacin_placanja"):
|
|
v = llm_fields.get(k) if isinstance(llm_fields, dict) else None
|
|
if v not in (None, "", "null"):
|
|
merged[k] = v
|
|
|
|
# Normalize aliases for UI / DB
|
|
if "izdavatelj_naziv" in merged: merged.setdefault("vendor_name", merged["izdavatelj_naziv"])
|
|
if "izdavatelj_oib" in merged: merged.setdefault("vendor_oib", merged["izdavatelj_oib"])
|
|
if "izdavatelj_adresa" in merged: merged.setdefault("vendor_address", merged["izdavatelj_adresa"])
|
|
if "kupac_oib" in merged: merged.setdefault("customer_oib", merged["kupac_oib"])
|
|
if "datum" in merged: merged.setdefault("invoice_date", merged["datum"])
|
|
if "broj_racuna" in merged: merged.setdefault("invoice_no", merged["broj_racuna"])
|
|
if "iznos_brutto" in merged: merged.setdefault("amount_gross", merged["iznos_brutto"])
|
|
if "iznos_neto" in merged: merged.setdefault("amount_net", merged["iznos_neto"])
|
|
if "iznos_pdv" in merged: merged.setdefault("amount_vat", merged["iznos_pdv"])
|
|
if "stopa_pdv" in merged: merged.setdefault("vat_rate", merged["stopa_pdv"])
|
|
if "valuta" in merged: merged.setdefault("currency", merged["valuta"])
|
|
if "IBAN" in merged: merged.setdefault("iban", merged["IBAN"])
|
|
if "opis_svrhe" in merged: merged.setdefault("description", merged["opis_svrhe"])
|
|
if "vrsta_troska" in merged: merged.setdefault("category", merged["vrsta_troska"])
|
|
|
|
# Persist back to invoice_uploads when we have upload_row
|
|
if upload_row:
|
|
try:
|
|
with _db() as c:
|
|
c.cursor().execute(
|
|
"""UPDATE pgz_sport.invoice_uploads
|
|
SET ocr_status='done', processed_at=NOW(),
|
|
ocr_engine=%s, ocr_text=%s,
|
|
ai_invoice_no=%s, ai_invoice_date=%s,
|
|
ai_vendor_name=%s, ai_vendor_oib=%s,
|
|
ai_amount_gross=%s, ai_currency=%s, ai_iban=%s,
|
|
ai_extracted=%s, ai_engine=%s
|
|
WHERE id=%s""",
|
|
(
|
|
method, text[:50000],
|
|
merged.get("invoice_no"),
|
|
merged.get("invoice_date") if isinstance(merged.get("invoice_date"), str) else None,
|
|
merged.get("vendor_name"),
|
|
merged.get("vendor_oib"),
|
|
merged.get("amount_gross"),
|
|
merged.get("currency", "EUR"),
|
|
merged.get("iban"),
|
|
json.dumps({"regex": regex_fields, "llm": llm_fields, "merged": merged},
|
|
ensure_ascii=False, default=str),
|
|
("deepseek-v3" if use_llm and "error" not in (llm_fields or {}) else "regex"),
|
|
upload_row["id"],
|
|
),
|
|
)
|
|
except Exception as e:
|
|
merged["_persist_warn"] = str(e)[:200]
|
|
|
|
return {
|
|
"ok": True,
|
|
"upload_id": (upload_row["id"] if upload_row else None),
|
|
"ocr_method": method,
|
|
"raw_chars": len(text),
|
|
"regex": regex_fields,
|
|
"llm": llm_fields,
|
|
"extracted": merged,
|
|
"raw_text_preview": text[:1500],
|
|
}
|
|
finally:
|
|
if tmp_to_clean and tmp_to_clean.exists():
|
|
try:
|
|
tmp_to_clean.unlink()
|
|
except Exception:
|
|
pass
|
|
|
|
|
|
# === Invoices CRUD (M5) ===
|
|
|
|
@router.get("/invoices")
|
|
def invoices_list(
|
|
tenant_id: Optional[int] = Query(None),
|
|
klub_id: Optional[int] = Query(None),
|
|
status: Optional[str] = Query(None),
|
|
kind: Optional[str] = Query(None),
|
|
limit: int = Query(100, le=500),
|
|
offset: int = Query(0),
|
|
):
|
|
sql = """SELECT i.id, i.klub_id, k.naziv AS klub_naziv,
|
|
i.invoice_kind, i.invoice_no, i.internal_no,
|
|
i.vendor_name, i.vendor_oib, i.customer_name, i.customer_oib,
|
|
i.invoice_date, i.due_date, i.paid_date, i.currency,
|
|
i.amount_net, i.amount_vat, i.amount_gross, i.vat_rate,
|
|
i.payment_status, i.payment_method, i.iban_to,
|
|
i.description, i.category, i.tenant_id,
|
|
i.created_at, i.approved_at
|
|
FROM pgz_sport.invoices i
|
|
LEFT JOIN pgz_sport.klubovi k ON k.id = i.klub_id
|
|
WHERE 1=1"""
|
|
args: list = []
|
|
if tenant_id is not None:
|
|
sql += " AND i.tenant_id=%s"; args.append(tenant_id)
|
|
if klub_id is not None:
|
|
sql += " AND i.klub_id=%s"; args.append(klub_id)
|
|
if status:
|
|
sql += " AND i.payment_status=%s"; args.append(status)
|
|
if kind:
|
|
sql += " AND i.invoice_kind=%s"; args.append(kind)
|
|
sql += " ORDER BY i.invoice_date DESC NULLS LAST, i.id DESC LIMIT %s OFFSET %s"
|
|
args += [limit, offset]
|
|
with _db() as c:
|
|
cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
|
|
cur.execute(sql, args)
|
|
rows = cur.fetchall()
|
|
return {"ok": True, "rows": rows, "count": len(rows)}
|
|
|
|
|
|
@router.get("/invoices/{invoice_id}")
|
|
def invoices_get(invoice_id: int):
|
|
with _db() as c:
|
|
cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
|
|
cur.execute("SELECT * FROM pgz_sport.invoices WHERE id=%s", (invoice_id,))
|
|
row = cur.fetchone()
|
|
if not row:
|
|
raise HTTPException(404, "Račun ne postoji")
|
|
cur.execute("SELECT * FROM pgz_sport.invoice_lines WHERE invoice_id=%s ORDER BY line_no, id",
|
|
(invoice_id,))
|
|
lines = cur.fetchall()
|
|
cur.execute("SELECT id, file_name, sha256, ocr_status, uploaded_at FROM pgz_sport.invoice_uploads WHERE invoice_id=%s",
|
|
(invoice_id,))
|
|
uploads = cur.fetchall()
|
|
return {"ok": True, "invoice": row, "lines": lines, "uploads": uploads}
|
|
|
|
|
|
@router.post("/invoices")
|
|
def invoices_create(body: dict = Body(...), authorization: Optional[str] = Header(None)):
|
|
"""Create an invoice from parsed OCR result.
|
|
Body: {klub_id, tenant_id, invoice_kind, invoice_no, vendor_name, vendor_oib,
|
|
invoice_date, amount_gross, amount_net, amount_vat, vat_rate, currency,
|
|
iban_to, description, category, lines:[{...}], upload_id?}"""
|
|
required = ["invoice_kind", "invoice_no", "invoice_date", "amount_gross"]
|
|
for k in required:
|
|
if body.get(k) in (None, ""):
|
|
raise HTTPException(400, f"Nedostaje polje: {k}")
|
|
|
|
klub_id = body.get("klub_id")
|
|
tenant_id = body.get("tenant_id", 1)
|
|
upload_id = body.get("upload_id")
|
|
lines = body.get("lines") or []
|
|
|
|
with _db() as c:
|
|
cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
|
|
cur.execute(
|
|
"""INSERT INTO pgz_sport.invoices
|
|
(klub_id, invoice_kind, invoice_no, internal_no,
|
|
vendor_oib, vendor_name, vendor_address,
|
|
customer_oib, customer_name,
|
|
invoice_date, due_date, currency,
|
|
amount_net, amount_vat, amount_gross, vat_rate,
|
|
payment_status, payment_method, iban_to,
|
|
description, category, account_code, tenant_id, meta)
|
|
VALUES (%s,%s,%s,%s, %s,%s,%s, %s,%s,
|
|
%s,%s,COALESCE(%s,'EUR'),
|
|
%s,%s,%s,%s,
|
|
COALESCE(%s,'unpaid'),%s,%s,
|
|
%s,%s,%s,%s,%s)
|
|
ON CONFLICT (klub_id, invoice_kind, invoice_no, vendor_oib)
|
|
DO UPDATE SET amount_gross=EXCLUDED.amount_gross,
|
|
amount_net=EXCLUDED.amount_net,
|
|
amount_vat=EXCLUDED.amount_vat,
|
|
updated_at=NOW()
|
|
RETURNING id, invoice_no, amount_gross, payment_status""",
|
|
(
|
|
klub_id, body["invoice_kind"], body["invoice_no"], body.get("internal_no"),
|
|
body.get("vendor_oib"), body.get("vendor_name"), body.get("vendor_address"),
|
|
body.get("customer_oib"), body.get("customer_name"),
|
|
body["invoice_date"], body.get("due_date"), body.get("currency"),
|
|
body.get("amount_net"), body.get("amount_vat"), body["amount_gross"], body.get("vat_rate"),
|
|
body.get("payment_status"), body.get("payment_method"), body.get("iban_to"),
|
|
body.get("description"), body.get("category"), body.get("account_code"),
|
|
tenant_id, json.dumps(body.get("meta", {})),
|
|
),
|
|
)
|
|
inv = cur.fetchone()
|
|
inv_id = inv["id"]
|
|
|
|
# Replace lines
|
|
cur.execute("DELETE FROM pgz_sport.invoice_lines WHERE invoice_id=%s", (inv_id,))
|
|
for i, ln in enumerate(lines, start=1):
|
|
cur.execute(
|
|
"""INSERT INTO pgz_sport.invoice_lines
|
|
(invoice_id, line_no, description, quantity, unit, unit_price,
|
|
vat_rate, line_net, line_vat, line_gross, account_code, cost_center, meta)
|
|
VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s)""",
|
|
(
|
|
inv_id, ln.get("line_no", i), ln.get("description") or ln.get("opis") or "",
|
|
ln.get("quantity") or ln.get("kolicina") or 1,
|
|
ln.get("unit") or ln.get("jedinica") or "kom",
|
|
ln.get("unit_price") or ln.get("cijena"),
|
|
ln.get("vat_rate", 25),
|
|
ln.get("line_net"), ln.get("line_vat"),
|
|
ln.get("line_gross") or ln.get("ukupno"),
|
|
ln.get("account_code"), ln.get("cost_center"),
|
|
json.dumps(ln.get("meta", {})),
|
|
),
|
|
)
|
|
|
|
# Link upload to invoice
|
|
if upload_id:
|
|
cur.execute(
|
|
"UPDATE pgz_sport.invoice_uploads SET invoice_id=%s WHERE id=%s",
|
|
(inv_id, upload_id),
|
|
)
|
|
|
|
return {"ok": True, "invoice": inv}
|
|
|
|
|
|
@router.put("/invoices/{invoice_id}")
|
|
def invoices_update(invoice_id: int, body: dict = Body(...), authorization: Optional[str] = Header(None)):
|
|
"""Update / approve invoice. Body may include any of: payment_status, paid_date,
|
|
approved (bool), notes, category, account_code, due_date."""
|
|
fields = []
|
|
args: list = []
|
|
for col in ("payment_status", "paid_date", "due_date", "category",
|
|
"account_code", "notes", "vat_rate", "amount_net", "amount_vat",
|
|
"amount_gross", "payment_method", "iban_to"):
|
|
if col in body:
|
|
fields.append(f"{col}=%s")
|
|
args.append(body[col])
|
|
if body.get("approved"):
|
|
fields.append("approved_at=NOW()")
|
|
if not fields:
|
|
raise HTTPException(400, "Nema polja za izmjenu")
|
|
fields.append("updated_at=NOW()")
|
|
args.append(invoice_id)
|
|
with _db() as c:
|
|
cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
|
|
cur.execute(f"UPDATE pgz_sport.invoices SET {','.join(fields)} WHERE id=%s RETURNING *", args)
|
|
row = cur.fetchone()
|
|
if not row:
|
|
raise HTTPException(404, "Račun ne postoji")
|
|
return {"ok": True, "invoice": row}
|
|
|
|
|
|
@router.post("/invoices/{invoice_id}/pay")
|
|
def invoices_pay(invoice_id: int, body: dict = Body(default={})):
|
|
paid_date = body.get("paid_date") or date.today().isoformat()
|
|
payment_method = body.get("payment_method", "transfer")
|
|
iban_from = body.get("iban_from")
|
|
with _db() as c:
|
|
cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
|
|
cur.execute(
|
|
"""UPDATE pgz_sport.invoices
|
|
SET payment_status='paid', paid_date=%s,
|
|
payment_method=COALESCE(%s,payment_method),
|
|
iban_from=COALESCE(%s,iban_from), updated_at=NOW()
|
|
WHERE id=%s RETURNING id, invoice_no, paid_date, amount_gross""",
|
|
(paid_date, payment_method, iban_from, invoice_id),
|
|
)
|
|
row = cur.fetchone()
|
|
if not row:
|
|
raise HTTPException(404, "Račun ne postoji")
|
|
# log payment
|
|
cur.execute(
|
|
"""INSERT INTO pgz_sport.payments (invoice_id, amount, payment_date, method, iban_from)
|
|
VALUES (%s,%s,%s,%s,%s) ON CONFLICT DO NOTHING""",
|
|
(invoice_id, row["amount_gross"], paid_date, payment_method, iban_from),
|
|
) if False else None # payments table column-set may differ; skip silently
|
|
return {"ok": True, "invoice": row}
|
|
|
|
|
|
@router.get("/invoices/uploads/list")
|
|
def uploads_list(klub_id: Optional[int] = None, status: Optional[str] = None, limit: int = 50):
|
|
sql = """SELECT id, klub_id, file_name, file_size, mime, ocr_status, ocr_engine,
|
|
ai_invoice_no, ai_invoice_date, ai_vendor_name, ai_vendor_oib,
|
|
ai_amount_gross, ai_currency, invoice_id, uploaded_at, processed_at
|
|
FROM pgz_sport.invoice_uploads WHERE 1=1"""
|
|
args: list = []
|
|
if klub_id is not None:
|
|
sql += " AND klub_id=%s"; args.append(klub_id)
|
|
if status:
|
|
sql += " AND ocr_status=%s"; args.append(status)
|
|
sql += " ORDER BY uploaded_at DESC LIMIT %s"; args.append(limit)
|
|
with _db() as c:
|
|
cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
|
|
cur.execute(sql, args)
|
|
rows = cur.fetchall()
|
|
return {"ok": True, "rows": rows}
|