pgz-sport/erp/putni_nalozi.py

#!/usr/bin/env python3
# erp/putni_nalozi.py — PGŽ Sport ERP putni nalozi (M6)
# Author: Damir Radulić <damir@rinet.one> / dradulic@outlook.com
# Date:   2026-05-04
# Description: CRUD putnih naloga + obračun dnevnica (HR pravilnik 2025).

from __future__ import annotations

import json
from datetime import datetime, date, timedelta
from pathlib import Path
from typing import Optional, Any

import psycopg2
import psycopg2.extras
from fastapi import APIRouter, Body, HTTPException, Query, Header

try:
    from erp.permissions import (
        can_view_putni_nalog, can_edit_putni_nalog, can_submit_putni_nalog,
        can_approve_putni_nalog, can_pay_putni_nalog, putni_nalog_actions,
        audit_putni, fetch_audit, is_pgz_admin,
    )
except Exception:
    def can_view_putni_nalog(u, p): return True
    def can_edit_putni_nalog(u, p): return True
    def can_submit_putni_nalog(u, p): return True
    def can_approve_putni_nalog(u, p): return True
    def can_pay_putni_nalog(u, p): return True
    def putni_nalog_actions(u, p): return {"view": True, "edit": True, "submit": True, "approve": True, "reject": True, "pay": True, "delete": False}
    def audit_putni(u, pid, op, field=None, old=None, new=None): pass
    def fetch_audit(t, r, limit=50): return []
    def is_pgz_admin(u): return False

try:
    from auth.auth_v2 import get_current_user as _auth_user
except Exception:
    _auth_user = None

try:
    from erp.notifications import (
        notify_pn_submitted, notify_pn_approved, notify_pn_rejected, notify_pn_paid,
    )
except Exception:
    def notify_pn_submitted(*a, **k): return {}
    def notify_pn_approved(*a, **k): return {}
    def notify_pn_rejected(*a, **k): return {}
    def notify_pn_paid(*a, **k): return {}

ADMIN_TOKEN = "admin-pgz-2026"

def _resolve_user(authorization):
    if _auth_user:
        try:
            u = _auth_user(authorization)
            if u: return u
        except Exception:
            pass
    if authorization and authorization.replace("Bearer ", "").strip() == ADMIN_TOKEN:
        return {"id": 0, "email": "admin@token", "user_type": "pgz_admin",
                "klub_id": None, "savez_id": None, "_synthetic": True}
    return None


router = APIRouter(prefix="/api/erp", tags=["erp-putni-nalozi"])

DB = dict(host="10.10.0.2", port=6432, dbname="rinet_v3", user="rinet",
          password="R1net2026!SecureDB#v7")

# === HR pravilnik 2025 — dnevnice ===
# Domaće: 26.54 € (puna) za put >8h, 13.27 € za 5-8h, 0 € za <5h.
# Izvor: NN — Pravilnik o porezu na dohodak, neoporezivi iznosi 2025 (200 kn ≈ 26.54 €).
DNEVNICA_DOM_FULL = 26.54   # EUR
DNEVNICA_DOM_HALF = 13.27   # EUR
KM_RATE_DEFAULT = 0.50      # EUR/km (vlastiti automobil)

# Inozemne dnevnice (Uredba o izdacima službenih putovanja u inozemstvo).
DNEVNICE_INO = {
    "Italija": 35.00,
    "Italy": 35.00,
    "Slovenija": 30.00,
    "Slovenia": 30.00,
    "Austrija": 35.00,
    "Austria": 35.00,
    "Mađarska": 30.00,
    "Madarska": 30.00,
    "Hungary": 30.00,
    "Bosna i Hercegovina": 30.00,
    "BiH": 30.00,
    "Bosnia": 30.00,
    "Srbija": 30.00,
    "Serbia": 30.00,
    "Crna Gora": 30.00,
    "Montenegro": 30.00,
    "Njemačka": 50.00,
    "Germany": 50.00,
    "Francuska": 50.00,
    "France": 50.00,
    "Švicarska": 60.00,
    "Switzerland": 60.00,
    "SAD": 70.00,
    "USA": 70.00,
}


def _db():
    c = psycopg2.connect(**DB)
    c.autocommit = True
    return c


def _parse_dt(v) -> Optional[datetime]:
    if v is None or v == "":
        return None
    if isinstance(v, datetime):
        return v
    s = str(v).strip().replace("Z", "+00:00")
    for fmt in ("%Y-%m-%dT%H:%M:%S", "%Y-%m-%dT%H:%M", "%Y-%m-%d %H:%M:%S",
                "%Y-%m-%d %H:%M", "%Y-%m-%d"):
        try:
            return datetime.strptime(s[:len(fmt) + 5].rstrip("ZZ"), fmt)
        except Exception:
            continue
    try:
        return datetime.fromisoformat(s)
    except Exception:
        return None


def compute_dnevnice(date_from, date_to, country: str = "Hrvatska") -> dict:
    """
    Vraća: {hours, days_full, days_half, dnevnica_amount_total, breakdown[]}
    Pravila (HR pravilnik 2025, neoporeziv iznos):
      - Domaće: <5h = 0; 5-8h = pola; >8h = puna; svaka dodatna pokrivena 24h sekcija = puna.
      - Inozemne: pune dnevnice po zemlji (DNEVNICE_INO), inače fallback 50 €.
      - Više dana: zaokružujemo po 24h segmentima; završetak <8h = 0, 8-12 = puna (po pravilu zaokruživanja na cijele dane), no koristimo konzervativni izračun po segmentima.
    Implementacija (jednostavna, transparentna):
      1) ukupne sate računaj kao razliku.
      2) full_segments = sati // 24
      3) ostatak_sati = sati - full_segments*24
      4) ako ostatak >= 8 → +1 puna; ako 5 <= ostatak < 8 → +0.5; ako <5 → +0.
      5) puna dnevnica = pun_iznos po zemlji; pola = polovica.
    """
    df = _parse_dt(date_from)
    dt = _parse_dt(date_to)
    if not df or not dt or dt < df:
        return {"error": "neispravni datumi", "hours": 0,
                "days_full": 0, "days_half": 0,
                "dnevnica_amount_total": 0.0, "breakdown": []}

    delta = dt - df
    hours = round(delta.total_seconds() / 3600, 2)

    full_segments = int(delta.total_seconds() // (24 * 3600))
    remainder_h = (delta.total_seconds() - full_segments * 24 * 3600) / 3600.0

    days_full = full_segments
    days_half = 0.0
    if remainder_h >= 8:
        days_full += 1
    elif remainder_h >= 5:
        days_half += 1
    # else: 0

    is_domestic = (country or "").strip().lower() in ("hrvatska", "croatia", "hr")
    if is_domestic:
        full_amt = DNEVNICA_DOM_FULL
        half_amt = DNEVNICA_DOM_HALF
    else:
        full_amt = DNEVNICE_INO.get(country.strip(), 50.00)
        half_amt = full_amt / 2.0

    total = round(days_full * full_amt + days_half * half_amt, 2)

    return {
        "hours": hours,
        "days_full": days_full,
        "days_half": days_half,
        "country": country,
        "rate_full": full_amt,
        "rate_half": half_amt,
        "dnevnica_amount_total": total,
        "breakdown": [
            f"{days_full} pun{'' if days_full == 1 else 'e'} dnevnice × {full_amt:.2f} €",
            f"{days_half} pola dnevnice × {full_amt:.2f} €" if days_half else "",
        ],
    }


def compute_kilometrina(km: float, km_rate: float = KM_RATE_DEFAULT) -> float:
    try:
        return round(float(km or 0) * float(km_rate or 0), 2)
    except Exception:
        return 0.0


# === Endpoints ===

@router.get("/putni-nalog/dnevnice/preview")
def preview_dnevnice(date_from: str, date_to: str, country: str = "Hrvatska",
                     km: float = 0.0, km_rate: float = KM_RATE_DEFAULT):
    """Preview dnevnica + kilometrine bez upisa u DB. Koristi UI za live preview."""
    d = compute_dnevnice(date_from, date_to, country)
    km_amt = compute_kilometrina(km, km_rate)
    d["km_amount"] = km_amt
    d["km_driven"] = km
    d["km_rate"] = km_rate
    d["total_estimated"] = round((d.get("dnevnica_amount_total") or 0) + km_amt, 2)
    return {"ok": True, "preview": d}


@router.get("/putni-nalog")
def list_putni_nalozi(klub_id: Optional[int] = None,
                     status: Optional[str] = None,
                     limit: int = Query(100, le=500),
                     offset: int = 0):
    sql = """SELECT er.id, er.klub_id, k.naziv AS klub_naziv,
                    er.user_id, er.clan_id, er.report_type, er.report_no,
                    er.destination, er.purpose,
                    er.date_from, er.date_to,
                    er.vehicle_type, er.vehicle_plate,
                    er.km_driven, er.km_rate,
                    er.cost_transport, er.cost_lodging, er.cost_meals,
                    er.cost_other, er.cost_total,
                    er.dnevnice_count, er.dnevnice_amount,
                    er.status, er.approved_at, er.paid_at,
                    er.created_at, er.tenant_id, er.notes
             FROM pgz_sport.expense_reports er
             LEFT JOIN pgz_sport.klubovi k ON k.id = er.klub_id
             WHERE er.report_type='putni_nalog'"""
    args: list = []
    if klub_id is not None:
        sql += " AND er.klub_id=%s"; args.append(klub_id)
    if status:
        sql += " AND er.status=%s"; args.append(status)
    sql += " ORDER BY er.date_from DESC NULLS LAST, er.id DESC LIMIT %s OFFSET %s"
    args += [limit, offset]
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(sql, args)
        rows = cur.fetchall()
    return {"ok": True, "rows": rows, "count": len(rows)}


@router.get("/putni-nalog/{nalog_id}")
def get_putni_nalog(nalog_id: int, authorization: Optional[str] = Header(None)):
    user = _resolve_user(authorization)
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute("""SELECT er.*, k.naziv AS klub_naziv, k.savez_id
                       FROM pgz_sport.expense_reports er
                       LEFT JOIN pgz_sport.klubovi k ON k.id = er.klub_id
                       WHERE er.id=%s AND er.report_type='putni_nalog'""", (nalog_id,))
        row = cur.fetchone()
        if not row:
            raise HTTPException(404, "Putni nalog ne postoji")
        if user and not can_view_putni_nalog(user, row):
            raise HTTPException(403, "Nemate ovlasti vidjeti ovaj putni nalog")

        # Vezani računi iz m2m tablice
        cur.execute(
            """SELECT i.id, i.invoice_no, i.invoice_kind, i.vendor_name, i.vendor_oib,
                      i.invoice_date, i.amount_gross, i.payment_status, i.currency, i.category,
                      pnr.kategorija AS attached_kategorija, pnr.attached_at
               FROM pgz_sport.putni_nalog_racuni pnr
               JOIN pgz_sport.invoices i ON i.id = pnr.invoice_id
               WHERE pnr.putni_nalog_id=%s
               ORDER BY i.invoice_date DESC""", (nalog_id,))
        invoices = cur.fetchall()

        # Auto-suggest: računi kluba u rasponu putovanja koji NISU jos vezani
        cur.execute(
            """SELECT i.id, i.invoice_no, i.invoice_kind, i.vendor_name, i.vendor_oib,
                      i.invoice_date, i.amount_gross, i.payment_status, i.currency, i.category
               FROM pgz_sport.invoices i
               LEFT JOIN pgz_sport.putni_nalog_racuni pnr
                 ON pnr.invoice_id=i.id AND pnr.putni_nalog_id=%s
               WHERE i.klub_id=%s
                 AND i.invoice_date BETWEEN %s AND %s
                 AND i.invoice_kind IN ('gorivo','cestarina','hotel','restoran','oprema','ostalo')
                 AND pnr.id IS NULL
               ORDER BY i.invoice_date DESC LIMIT 50""",
            (nalog_id, row.get("klub_id"), row.get("date_from"), row.get("date_to")),
        )
        suggested = cur.fetchall()

        # Payments za ovaj putni nalog
        cur.execute(
            """SELECT id, payment_date, amount, currency, payment_method, iban_from,
                      iban_to, reference, bank_transaction_id, matched_status, created_at
               FROM pgz_sport.payments WHERE expense_report_id=%s
               ORDER BY payment_date DESC""", (nalog_id,))
        payments = cur.fetchall()

    audit = fetch_audit("pgz_sport.expense_reports", nalog_id, 50)
    actions = putni_nalog_actions(user, row) if user else {"view": True, "edit": False, "submit": False, "approve": False, "reject": False, "pay": False, "delete": False}
    return {"ok": True, "putni_nalog": row, "invoices": invoices,
            "suggested_invoices": suggested,
            "payments": payments, "audit": audit, "actions": actions}


@router.post("/putni-nalog/{nalog_id}/attach-invoice")
def attach_invoice(nalog_id: int, body: dict = Body(...),
                    authorization: Optional[str] = Header(None)):
    """Veži postojeći račun na putni nalog (m2m)."""
    user = _resolve_user(authorization)
    inv_id = body.get("invoice_id")
    kategorija = body.get("kategorija") or body.get("category")
    if not inv_id:
        raise HTTPException(400, "invoice_id je obavezan")
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute("SELECT er.*, k.savez_id FROM pgz_sport.expense_reports er LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id WHERE er.id=%s AND er.report_type='putni_nalog'", (nalog_id,))
        pn = cur.fetchone()
    if not pn:
        raise HTTPException(404, "Putni nalog ne postoji")
    if user and not can_edit_putni_nalog(user, pn) and not is_pgz_admin(user):
        raise HTTPException(403, "Nemate ovlasti za vezivanje računa")
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(
            """INSERT INTO pgz_sport.putni_nalog_racuni
               (putni_nalog_id, invoice_id, kategorija, attached_by)
               VALUES (%s,%s,%s,%s)
               ON CONFLICT (putni_nalog_id, invoice_id) DO UPDATE SET kategorija=EXCLUDED.kategorija
               RETURNING id, attached_at""",
            (nalog_id, inv_id, kategorija, (user.get("id") if user else None)),
        )
        link = cur.fetchone()
    audit_putni(user, nalog_id, "attach_invoice", field="invoice_id", new=inv_id)
    return {"ok": True, "link_id": link["id"], "attached_at": link["attached_at"]}


@router.delete("/putni-nalog/{nalog_id}/invoice/{invoice_id}")
def detach_invoice(nalog_id: int, invoice_id: int,
                    authorization: Optional[str] = Header(None)):
    user = _resolve_user(authorization)
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute("SELECT er.*, k.savez_id FROM pgz_sport.expense_reports er LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id WHERE er.id=%s AND er.report_type='putni_nalog'", (nalog_id,))
        pn = cur.fetchone()
    if not pn:
        raise HTTPException(404, "Putni nalog ne postoji")
    if user and not can_edit_putni_nalog(user, pn) and not is_pgz_admin(user):
        raise HTTPException(403, "Nemate ovlasti")
    with _db() as c:
        cur = c.cursor()
        cur.execute(
            "DELETE FROM pgz_sport.putni_nalog_racuni WHERE putni_nalog_id=%s AND invoice_id=%s",
            (nalog_id, invoice_id),
        )
    audit_putni(user, nalog_id, "detach_invoice", field="invoice_id", old=invoice_id)
    return {"ok": True}


@router.post("/putni-nalog/{nalog_id}/posalji")
def posalji_putni_nalog(nalog_id: int, authorization: Optional[str] = Header(None)):
    """Voditelj/klub_admin šalje draft → poslan."""
    user = _resolve_user(authorization)
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute("SELECT er.*, k.savez_id FROM pgz_sport.expense_reports er LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id WHERE er.id=%s AND er.report_type='putni_nalog'", (nalog_id,))
        pn = cur.fetchone()
    if not pn:
        raise HTTPException(404, "Putni nalog ne postoji")
    if user and not can_submit_putni_nalog(user, pn):
        raise HTTPException(403, "Nemate ovlasti slanja na odobrenje")
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(
            """UPDATE pgz_sport.expense_reports SET status='poslan', updated_at=NOW()
               WHERE id=%s RETURNING id, status""", (nalog_id,))
        row = cur.fetchone()
    audit_putni(user, nalog_id, "submit", field="status", old=pn.get("status"), new="poslan")
    notif = notify_pn_submitted({**pn, "status": "poslan"})
    return {"ok": True, "putni_nalog": row, "notification": notif}


@router.post("/putni-nalog/{nalog_id}/odbij")
def odbij_putni_nalog(nalog_id: int, body: dict = Body(default={}),
                      authorization: Optional[str] = Header(None)):
    """Klub_admin/pgz_admin odbija s razlogom."""
    user = _resolve_user(authorization)
    razlog = (body.get("razlog") or body.get("reason") or "").strip()
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute("SELECT er.*, k.savez_id FROM pgz_sport.expense_reports er LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id WHERE er.id=%s AND er.report_type='putni_nalog'", (nalog_id,))
        pn = cur.fetchone()
    if not pn:
        raise HTTPException(404, "Putni nalog ne postoji")
    if user and not can_approve_putni_nalog(user, pn):
        raise HTTPException(403, "Nemate ovlasti odbiti")
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(
            """UPDATE pgz_sport.expense_reports
               SET status='odbijen', notes=COALESCE(notes,'') || E'\n[ODBIJEN] ' || %s, updated_at=NOW()
               WHERE id=%s RETURNING id, status, notes""",
            (razlog or "(bez razloga)", nalog_id),
        )
        row = cur.fetchone()
    audit_putni(user, nalog_id, "reject", field="status",
                 old=pn.get("status"), new=f"odbijen: {razlog}")
    notif = notify_pn_rejected({**pn, "status": "odbijen"}, razlog=razlog)
    return {"ok": True, "putni_nalog": row, "notification": notif}


@router.post("/putni-nalog/{nalog_id}/isplati")
def isplati_putni_nalog(nalog_id: int, body: dict = Body(default={}),
                         authorization: Optional[str] = Header(None)):
    """Isplata putnog naloga (odobren/zatvoren → isplaćen).
    Body: {iban_to, iban_from, paid_date, amount, reference, bank_transaction_id}"""
    user = _resolve_user(authorization)
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute("SELECT er.*, k.savez_id FROM pgz_sport.expense_reports er LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id WHERE er.id=%s AND er.report_type='putni_nalog'", (nalog_id,))
        pn = cur.fetchone()
    if not pn:
        raise HTTPException(404, "Putni nalog ne postoji")
    if user and not can_pay_putni_nalog(user, pn):
        raise HTTPException(403, "Nemate ovlasti za isplatu")

    paid_date = body.get("paid_date") or date.today().isoformat()
    iban_to = body.get("iban_to")
    iban_from = body.get("iban_from")
    amount = body.get("amount") or pn.get("cost_total")
    reference = body.get("reference")
    tx_id = body.get("bank_transaction_id") or body.get("tx_id")
    payment_method = body.get("payment_method") or "transfer"

    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(
            """UPDATE pgz_sport.expense_reports
               SET status='isplacen', paid_at=%s, updated_at=NOW()
               WHERE id=%s RETURNING id, status, paid_at, cost_total""",
            (paid_date, nalog_id),
        )
        row = cur.fetchone()
        cur.execute(
            """INSERT INTO pgz_sport.payments
               (klub_id, expense_report_id, payment_date, amount, currency,
                payment_method, iban_from, iban_to, reference, bank_transaction_id,
                matched_status)
               VALUES (%s,%s,%s,%s,'EUR',%s,%s,%s,%s,%s,'matched')
               RETURNING id""",
            (pn.get("klub_id"), nalog_id, paid_date, amount, payment_method,
             iban_from, iban_to, reference, tx_id),
        )
        pay = cur.fetchone()
    audit_putni(user, nalog_id, "pay", field="status",
                 old=pn.get("status"), new="isplacen")
    notif = notify_pn_paid(
        {**pn, **(row or {}), "id": nalog_id},
        {"iban_to": iban_to, "iban_from": iban_from, "amount": amount,
         "reference": reference, "payment_date": paid_date},
    )
    return {"ok": True, "putni_nalog": row, "payment_id": pay["id"] if pay else None,
            "notification": notif}


@router.get("/putni-nalog/{nalog_id}/hub3.pdf")
def putni_hub3(nalog_id: int, iban: Optional[str] = None,
                authorization: Optional[str] = Header(None)):
    """HUB-3 uplatnica + EPC QR za isplatu putnog naloga voditelju."""
    user = _resolve_user(authorization)
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(
            """SELECT er.*, k.naziv AS klub_naziv, k.savez_id, k.adresa AS klub_adresa
               FROM pgz_sport.expense_reports er
               LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id
               WHERE er.id=%s AND er.report_type='putni_nalog'""", (nalog_id,))
        pn = cur.fetchone()
    if not pn:
        raise HTTPException(404, "Putni nalog ne postoji")
    if user and not can_view_putni_nalog(user, pn):
        raise HTTPException(403, "Nemate ovlasti")

    try:
        from crm.payments import build_hub3_pdf
    except Exception as e:
        raise HTTPException(500, f"HUB-3 helper nije dostupan: {e}")
    from fastapi.responses import Response

    att = pn.get("attachments") or {}
    if isinstance(att, str):
        try: att = json.loads(att)
        except Exception: att = {}
    voditelj = att.get("voditelj") or "Voditelj putovanja"
    iban_to = (iban or "").strip() or att.get("iban_voditelja") or "HR0000000000000000000"
    iznos = float(pn.get("cost_total") or 0)
    if iznos <= 0:
        raise HTTPException(400, "Iznos isplate mora biti veći od 0")

    poziv = f"{nalog_id:08d}"
    opis = f"Putni nalog #{nalog_id}: {pn.get('destination') or ''} ({pn.get('date_from')}–{pn.get('date_to')})"[:140]

    pdf = build_hub3_pdf(
        platitelj_naziv=pn.get("klub_naziv") or "PGŽ Sport klub",
        platitelj_adresa=pn.get("klub_adresa") or "—",
        primatelj_naziv=voditelj,
        primatelj_adresa="—",
        iban=iban_to,
        amount_eur=iznos,
        model="HR99",
        poziv_na_broj=poziv,
        opis=opis,
        sifra_namjene="SALA",
        datum=date.today(),
    )
    return Response(content=pdf, media_type="application/pdf",
                    headers={"Content-Disposition": f'inline; filename="putni-nalog-{nalog_id}-HUB3.pdf"'})


@router.get("/putni-nalog/{nalog_id}/audit")
def putni_audit(nalog_id: int, limit: int = 100,
                authorization: Optional[str] = Header(None)):
    user = _resolve_user(authorization)
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute("SELECT * FROM pgz_sport.expense_reports WHERE id=%s AND report_type='putni_nalog'", (nalog_id,))
        pn = cur.fetchone()
    if not pn:
        raise HTTPException(404, "Putni nalog ne postoji")
    if user and not can_view_putni_nalog(user, pn):
        raise HTTPException(403, "Nemate ovlasti")
    return {"ok": True, "audit": fetch_audit("pgz_sport.expense_reports", nalog_id, limit)}


@router.post("/putni-nalog")
def create_putni_nalog(body: dict = Body(...), authorization: Optional[str] = Header(None)):
    """Kreiraj putni nalog.
    Polja: klub_id, user_id, clan_id, voditelj_ime, putnici[],
           svrha (purpose), od_grada, do_grada (destination),
           datum_polaska (date_from), datum_povratka (date_to),
           registracija_vozila (vehicle_plate), vehicle_type,
           kilometara (km_driven), km_rate,
           predviđeni_troškovi (cost_estimate), country, notes."""
    df = body.get("date_from") or body.get("datum_polaska")
    dt = body.get("date_to") or body.get("datum_povratka")
    if not df or not dt:
        raise HTTPException(400, "Datum polaska i povratka su obavezni")
    klub_id = body.get("klub_id")
    if not klub_id:
        raise HTTPException(400, "klub_id je obavezan")

    user = _resolve_user(authorization)
    # Permission: pgz_admin uvijek; klub_admin/klub_user samo za vlastiti klub
    if user and not is_pgz_admin(user):
        if user.get("user_type") not in ("klub_admin", "klub_user") or user.get("klub_id") != klub_id:
            raise HTTPException(403, "Nemate ovlasti kreirati putni nalog za ovaj klub")

    country = body.get("country", "Hrvatska")
    km = body.get("km_driven", body.get("kilometara", 0)) or 0
    km_rate = body.get("km_rate") or KM_RATE_DEFAULT
    dnv = compute_dnevnice(df, dt, country)
    dnevnice_count = (dnv.get("days_full") or 0) + 0.5 * (dnv.get("days_half") or 0)
    dnevnice_amount = dnv.get("dnevnica_amount_total") or 0
    cost_transport = compute_kilometrina(km, km_rate) + (body.get("cost_transport") or 0)

    od = body.get("od_grada") or body.get("from_city")
    do = body.get("do_grada") or body.get("to_city") or body.get("destination")
    destination = " → ".join([x for x in [od, do] if x]) or do

    putnici = body.get("putnici") or []
    voditelj = body.get("voditelj_ime") or body.get("voditelj")
    purpose = body.get("svrha") or body.get("purpose") or ""

    meta = {
        "voditelj": voditelj,
        "putnici": putnici,
        "from_city": od, "to_city": do,
        "country": country,
        "dnevnice_calc": dnv,
        "predvideni_troskovi": body.get("predvideni_troskovi") or body.get("cost_estimate") or [],
    }

    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(
            """INSERT INTO pgz_sport.expense_reports
               (klub_id, user_id, clan_id, report_type, report_no, destination, purpose,
                date_from, date_to, vehicle_type, vehicle_plate, km_driven, km_rate,
                cost_transport, cost_lodging, cost_meals, cost_other,
                dnevnice_count, dnevnice_amount, status, attachments, notes, tenant_id)
               VALUES (%s, %s, %s, 'putni_nalog', %s, %s, %s,
                       %s, %s, %s, %s, %s, %s,
                       %s, %s, %s, %s,
                       %s, %s, COALESCE(%s,'draft'), %s, %s, %s)
               RETURNING id, klub_id, status, dnevnice_count, dnevnice_amount,
                         cost_transport, date_from, date_to, destination""",
            (
                klub_id, body.get("user_id"), body.get("clan_id"),
                body.get("report_no"), destination, purpose,
                df, dt, body.get("vehicle_type"), body.get("vehicle_plate") or body.get("registracija_vozila"),
                float(km or 0), float(km_rate or 0),
                cost_transport,
                body.get("cost_lodging") or 0, body.get("cost_meals") or 0,
                body.get("cost_other") or 0,
                dnevnice_count, dnevnice_amount,
                body.get("status"),
                json.dumps(meta, ensure_ascii=False, default=str),
                body.get("notes"),
                body.get("tenant_id", 1),
            ),
        )
        row = cur.fetchone()
        # cost_total via trigger maybe; recompute here
        cur.execute(
            """UPDATE pgz_sport.expense_reports
               SET cost_total = COALESCE(cost_transport,0)+COALESCE(cost_lodging,0)
                              +COALESCE(cost_meals,0)+COALESCE(cost_other,0)
                              +COALESCE(dnevnice_amount,0)
               WHERE id=%s
               RETURNING cost_total""", (row["id"],),
        )
        ct = cur.fetchone()
        if ct:
            row["cost_total"] = ct["cost_total"]
    audit_putni(user, row["id"], "create", field="status",
                 new=f"draft (€{row.get('cost_total')})")
    return {"ok": True, "putni_nalog": row, "dnevnice_calc": dnv}


@router.put("/putni-nalog/{nalog_id}")
def update_putni_nalog(nalog_id: int, body: dict = Body(...)):
    """Update polja putnog naloga (osim odobrenja/zatvaranja - oni imaju vlastite endpointe)."""
    cols = []
    args: list = []
    for col in ("destination", "purpose", "date_from", "date_to", "vehicle_type",
                "vehicle_plate", "km_driven", "km_rate", "cost_transport",
                "cost_lodging", "cost_meals", "cost_other", "notes",
                "dnevnice_count", "dnevnice_amount"):
        if col in body:
            cols.append(f"{col}=%s"); args.append(body[col])
    # Recompute dnevnice if dates provided
    if "date_from" in body or "date_to" in body or "country" in body:
        with _db() as c:
            cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
            cur.execute("SELECT date_from, date_to, attachments FROM pgz_sport.expense_reports WHERE id=%s", (nalog_id,))
            cur_row = cur.fetchone()
        if cur_row:
            df = body.get("date_from") or cur_row["date_from"]
            dt = body.get("date_to") or cur_row["date_to"]
            country = body.get("country") or (cur_row["attachments"] or {}).get("country", "Hrvatska")
            d = compute_dnevnice(df, dt, country)
            cols += ["dnevnice_count=%s", "dnevnice_amount=%s"]
            args += [(d.get("days_full") or 0) + 0.5 * (d.get("days_half") or 0),
                     d.get("dnevnica_amount_total") or 0]
    if not cols:
        raise HTTPException(400, "Nema polja za izmjenu")
    cols.append("updated_at=NOW()")
    args.append(nalog_id)
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(f"UPDATE pgz_sport.expense_reports SET {','.join(cols)} WHERE id=%s AND report_type='putni_nalog' RETURNING *", args)
        row = cur.fetchone()
        if row:
            cur.execute(
                """UPDATE pgz_sport.expense_reports
                   SET cost_total = COALESCE(cost_transport,0)+COALESCE(cost_lodging,0)
                                  +COALESCE(cost_meals,0)+COALESCE(cost_other,0)
                                  +COALESCE(dnevnice_amount,0)
                   WHERE id=%s""", (nalog_id,),
            )
    if not row:
        raise HTTPException(404, "Putni nalog ne postoji")
    return {"ok": True, "putni_nalog": row}


@router.post("/putni-nalog/{nalog_id}/odobriti")
def odobriti_putni_nalog(nalog_id: int, body: dict = Body(default={}),
                          authorization: Optional[str] = Header(None)):
    user = _resolve_user(authorization)
    approved_by = body.get("approved_by") or (user.get("id") if user else None)
    if approved_by == 0 or (user and user.get("_synthetic")):
        approved_by = None  # admin token nema realnog user_id u DB
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute("SELECT er.*, k.savez_id FROM pgz_sport.expense_reports er LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id WHERE er.id=%s AND er.report_type='putni_nalog'", (nalog_id,))
        pn = cur.fetchone()
    if not pn:
        raise HTTPException(404, "Putni nalog ne postoji")
    if user and not can_approve_putni_nalog(user, pn):
        raise HTTPException(403, "Nemate ovlasti odobriti")
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(
            """UPDATE pgz_sport.expense_reports
               SET status='odobren', approved_by=%s, approved_at=NOW(), updated_at=NOW()
               WHERE id=%s AND report_type='putni_nalog'
               RETURNING id, status, approved_at""", (approved_by, nalog_id),
        )
        row = cur.fetchone()
    audit_putni(user, nalog_id, "approve", field="status",
                 old=pn.get("status"), new="odobren")
    notif = notify_pn_approved({**pn, "status": "odobren"})
    return {"ok": True, "putni_nalog": row, "notification": notif}


# R6.2 — PUT alias za simetriju s briefom
@router.put("/putni-nalog/{nalog_id}/odobri")
def odobri_putni_nalog_put(nalog_id: int, body: dict = Body(default={}),
                            authorization: Optional[str] = Header(None)):
    return odobriti_putni_nalog(nalog_id, body, authorization)


@router.put("/putni-nalog/{nalog_id}/odbij")
def odbij_putni_nalog_put(nalog_id: int, body: dict = Body(default={}),
                           authorization: Optional[str] = Header(None)):
    return odbij_putni_nalog(nalog_id, body, authorization)


@router.put("/putni-nalog/{nalog_id}/isplati")
def isplati_putni_nalog_put(nalog_id: int, body: dict = Body(default={}),
                             authorization: Optional[str] = Header(None)):
    return isplati_putni_nalog(nalog_id, body, authorization)


@router.post("/putni-nalog/{nalog_id}/zatvori")
def zatvori_putni_nalog(nalog_id: int, body: dict = Body(default={})):
    """Zatvori putni nalog: priloži račune i konačan obračun."""
    invoice_ids = body.get("invoice_ids") or []
    cost_lodging = body.get("cost_lodging")
    cost_meals = body.get("cost_meals")
    cost_other = body.get("cost_other")
    notes = body.get("notes")
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute("SELECT * FROM pgz_sport.expense_reports WHERE id=%s AND report_type='putni_nalog'", (nalog_id,))
        cur_row = cur.fetchone()
        if not cur_row:
            raise HTTPException(404, "Putni nalog ne postoji")

        # Aggregiraj iznose iz računa (ako su poslani)
        if invoice_ids:
            cur.execute(
                "SELECT COALESCE(SUM(amount_gross),0) AS total FROM pgz_sport.invoices WHERE id = ANY(%s)",
                (invoice_ids,),
            )
            invs_total = float(cur.fetchone()["total"] or 0)
        else:
            invs_total = None

        sets = ["status='zatvoren'", "updated_at=NOW()"]
        args: list = []
        if cost_lodging is not None: sets.append("cost_lodging=%s"); args.append(cost_lodging)
        if cost_meals is not None: sets.append("cost_meals=%s"); args.append(cost_meals)
        if cost_other is not None: sets.append("cost_other=%s"); args.append(cost_other)
        if notes: sets.append("notes=%s"); args.append(notes)
        # Pohrani povezane račune u attachments
        atts = cur_row["attachments"] or {}
        if isinstance(atts, str):
            try: atts = json.loads(atts)
            except Exception: atts = {}
        atts["invoice_ids"] = invoice_ids
        if invs_total is not None:
            atts["invoices_total"] = invs_total
        sets.append("attachments=%s"); args.append(json.dumps(atts, ensure_ascii=False, default=str))
        args.append(nalog_id)
        cur.execute(f"UPDATE pgz_sport.expense_reports SET {','.join(sets)} WHERE id=%s RETURNING *", args)
        row = cur.fetchone()
        cur.execute(
            """UPDATE pgz_sport.expense_reports
               SET cost_total = COALESCE(cost_transport,0)+COALESCE(cost_lodging,0)
                              +COALESCE(cost_meals,0)+COALESCE(cost_other,0)
                              +COALESCE(dnevnice_amount,0)
               WHERE id=%s RETURNING cost_total""", (nalog_id,),
        )
        ct = cur.fetchone()
        if ct: row["cost_total"] = ct["cost_total"]
    return {"ok": True, "putni_nalog": row}


# ──────────────────────────────────────────────────────────────────────
# CC4 STEP 2 — alias-i za "putni-nalozi" (množina), PATCH approve/reject,
# /export/putni.xlsx, /placanja (HUB-3 + EPC PDF) + GET /placanja{,/{id}/pdf}
# ──────────────────────────────────────────────────────────────────────

# GET /putni-nalozi (alias plural) → reuse list_putni_nalozi
@router.get("/putni-nalozi")
def list_putni_nalozi_alias(klub_id: Optional[int] = None,
                             status: Optional[str] = None,
                             limit: int = Query(100, le=500),
                             offset: int = 0):
    return list_putni_nalozi(klub_id=klub_id, status=status, limit=limit, offset=offset)


@router.get("/putni-nalozi/{nalog_id}")
def get_putni_nalog_alias(nalog_id: int, authorization: Optional[str] = Header(None)):
    return get_putni_nalog(nalog_id, authorization)


@router.post("/putni-nalozi")
def create_putni_nalog_alias(body: dict = Body(...), authorization: Optional[str] = Header(None)):
    return create_putni_nalog(body, authorization)


@router.patch("/putni-nalozi/{nalog_id}")
def patch_putni_nalog(nalog_id: int, body: dict = Body(...),
                      authorization: Optional[str] = Header(None)):
    """PATCH semantics — body.action: approve/reject/submit/pay; ostalo update polja."""
    action = (body.get("action") or "").lower()
    if action in ("approve", "odobri", "odobriti"):
        return odobriti_putni_nalog(nalog_id, body, authorization)
    if action in ("reject", "odbij"):
        return odbij_putni_nalog(nalog_id, body, authorization)
    if action in ("submit", "posalji"):
        return posalji_putni_nalog(nalog_id, authorization)
    if action in ("pay", "isplati"):
        return isplati_putni_nalog(nalog_id, body, authorization)
    return update_putni_nalog(nalog_id, body)


@router.patch("/putni-nalog/{nalog_id}")
def patch_putni_nalog_singular(nalog_id: int, body: dict = Body(...),
                                authorization: Optional[str] = Header(None)):
    return patch_putni_nalog(nalog_id, body, authorization)


# ──────────── XLSX export — putni nalozi ────────────
@router.get("/export/putni.xlsx")
def putni_export_xlsx(
    klub_id: Optional[int] = Query(None),
    od: Optional[str] = Query(None),
    do: Optional[str] = Query(None),
    status: Optional[str] = None,
    authorization: Optional[str] = Header(None),
):
    """XLSX export putnih naloga: ID, klub, voditelj, ruta, datumi, km, dnevnice, transport, ukupno, status."""
    from openpyxl import Workbook
    from openpyxl.styles import Font, PatternFill, Alignment
    from io import BytesIO
    from fastapi.responses import StreamingResponse

    user = _resolve_user(authorization)
    sql = """SELECT er.id, er.klub_id, k.naziv AS klub_naziv,
                    er.destination, er.purpose,
                    er.date_from, er.date_to, er.km_driven, er.km_rate,
                    er.cost_transport, er.cost_lodging, er.cost_meals,
                    er.cost_other, er.dnevnice_count, er.dnevnice_amount,
                    er.cost_total, er.status, er.approved_at, er.paid_at,
                    er.attachments
             FROM pgz_sport.expense_reports er
             LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id
             WHERE er.report_type='putni_nalog'"""
    args: list = []
    if klub_id is not None: sql += " AND er.klub_id=%s"; args.append(klub_id)
    if od: sql += " AND er.date_from >= %s"; args.append(od)
    if do: sql += " AND er.date_to <= %s"; args.append(do)
    if status: sql += " AND er.status=%s"; args.append(status)
    sql += " ORDER BY er.date_from DESC, er.id DESC"
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        cur.execute(sql, args)
        rows = cur.fetchall()

    if user and not is_pgz_admin(user):
        rows = [r for r in rows if can_view_putni_nalog(user, r)]

    wb = Workbook()
    ws = wb.active
    ws.title = "Putni nalozi"
    headers = ["ID", "Klub", "Voditelj", "Ruta", "Svrha", "Polazak", "Povratak",
               "Km", "€/km", "Transport", "Smještaj", "Hrana", "Ostalo",
               "Br. dnevnica", "Iznos dnevnica", "UKUPNO", "Status",
               "Odobreno", "Isplaćeno"]
    bold = Font(bold=True, color="FFFFFF")
    fill = PatternFill("solid", fgColor="003087")
    for col_idx, h in enumerate(headers, 1):
        c = ws.cell(row=1, column=col_idx, value=h)
        c.font = bold; c.fill = fill; c.alignment = Alignment(horizontal="center")
    for r_idx, r in enumerate(rows, 2):
        att = r.get("attachments") or {}
        if isinstance(att, str):
            try: att = json.loads(att)
            except Exception: att = {}
        ws.cell(row=r_idx, column=1,  value=r.get("id"))
        ws.cell(row=r_idx, column=2,  value=r.get("klub_naziv"))
        ws.cell(row=r_idx, column=3,  value=att.get("voditelj"))
        ws.cell(row=r_idx, column=4,  value=r.get("destination"))
        ws.cell(row=r_idx, column=5,  value=r.get("purpose"))
        ws.cell(row=r_idx, column=6,  value=str(r.get("date_from") or ""))
        ws.cell(row=r_idx, column=7,  value=str(r.get("date_to") or ""))
        ws.cell(row=r_idx, column=8,  value=float(r["km_driven"]) if r.get("km_driven") is not None else None)
        ws.cell(row=r_idx, column=9,  value=float(r["km_rate"]) if r.get("km_rate") is not None else None)
        ws.cell(row=r_idx, column=10, value=float(r["cost_transport"]) if r.get("cost_transport") is not None else None)
        ws.cell(row=r_idx, column=11, value=float(r["cost_lodging"]) if r.get("cost_lodging") is not None else None)
        ws.cell(row=r_idx, column=12, value=float(r["cost_meals"]) if r.get("cost_meals") is not None else None)
        ws.cell(row=r_idx, column=13, value=float(r["cost_other"]) if r.get("cost_other") is not None else None)
        ws.cell(row=r_idx, column=14, value=float(r["dnevnice_count"]) if r.get("dnevnice_count") is not None else None)
        ws.cell(row=r_idx, column=15, value=float(r["dnevnice_amount"]) if r.get("dnevnice_amount") is not None else None)
        ws.cell(row=r_idx, column=16, value=float(r["cost_total"]) if r.get("cost_total") is not None else None)
        ws.cell(row=r_idx, column=17, value=r.get("status"))
        ws.cell(row=r_idx, column=18, value=str(r.get("approved_at") or ""))
        ws.cell(row=r_idx, column=19, value=str(r.get("paid_at") or ""))
    widths = [6, 24, 22, 28, 22, 11, 11, 8, 6, 12, 12, 10, 10, 10, 14, 12, 11, 18, 18]
    for i, w in enumerate(widths, 1):
        ws.column_dimensions[ws.cell(row=1, column=i).column_letter].width = w
    ws.freeze_panes = "A2"

    buf = BytesIO()
    wb.save(buf); buf.seek(0)
    fname = f"putni-nalozi_{date.today().isoformat()}.xlsx"
    return StreamingResponse(
        buf, media_type="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
        headers={"Content-Disposition": f'attachment; filename="{fname}"'},
    )


# ──────────── /placanja — HUB-3 PDF s EPC QR (uplatnice) ────────────
@router.get("/placanja")
def placanja_list(klub_id: Optional[int] = None, limit: int = 100,
                   authorization: Optional[str] = Header(None)):
    """Lista placanja (vraća unaplaćene račune i odobrene putne naloge kao kandidate)."""
    user = _resolve_user(authorization)
    out = []
    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        sql = """SELECT i.id, 'invoice' AS kind, i.invoice_no AS ref,
                        i.vendor_name AS primatelj, i.vendor_oib AS oib,
                        i.amount_gross AS iznos, i.iban_to AS iban,
                        i.payment_status AS status, i.invoice_date AS datum,
                        i.klub_id, k.naziv AS klub_naziv
                 FROM pgz_sport.invoices i
                 LEFT JOIN pgz_sport.klubovi k ON k.id=i.klub_id
                 WHERE i.payment_status='unpaid'"""
        args: list = []
        if klub_id is not None: sql += " AND i.klub_id=%s"; args.append(klub_id)
        sql += " ORDER BY i.invoice_date DESC LIMIT %s"; args.append(limit)
        cur.execute(sql, args)
        out.extend(cur.fetchall())

        sql2 = """SELECT er.id, 'putni_nalog' AS kind,
                         CONCAT('PN-', er.id) AS ref,
                         (er.attachments->>'voditelj') AS primatelj,
                         NULL::text AS oib,
                         er.cost_total AS iznos,
                         NULL::text AS iban,
                         er.status, er.date_from AS datum,
                         er.klub_id, k.naziv AS klub_naziv
                  FROM pgz_sport.expense_reports er
                  LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id
                  WHERE er.report_type='putni_nalog'
                    AND er.status IN ('odobren','zatvoren')"""
        args2: list = []
        if klub_id is not None: sql2 += " AND er.klub_id=%s"; args2.append(klub_id)
        sql2 += " ORDER BY er.date_from DESC LIMIT %s"; args2.append(limit)
        cur.execute(sql2, args2)
        out.extend(cur.fetchall())

    return {"ok": True, "rows": out, "count": len(out)}


@router.post("/placanja")
def placanja_create(body: dict = Body(...), authorization: Optional[str] = Header(None)):
    """Kreiraj HUB-3 + EPC PDF za bilo koji entitet (invoice ili putni nalog).
    Body: {kind: 'invoice'|'putni_nalog', id: int, iban?, model?, opis?, poziv_na_broj?}.
    Vraća: {placanja_id, pdf_url}."""
    user = _resolve_user(authorization)
    kind = (body.get("kind") or "invoice").lower()
    eid = body.get("id")
    if not eid:
        raise HTTPException(400, "id je obavezan")

    try:
        from crm.payments import build_hub3_pdf
    except Exception as e:
        raise HTTPException(500, f"HUB-3 helper nije dostupan: {e}")

    with _db() as c:
        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
        if kind == "invoice":
            cur.execute(
                """SELECT i.*, k.naziv AS klub_naziv, k.adresa AS klub_adresa
                   FROM pgz_sport.invoices i
                   LEFT JOIN pgz_sport.klubovi k ON k.id=i.klub_id
                   WHERE i.id=%s""", (eid,))
            row = cur.fetchone()
            if not row:
                raise HTTPException(404, "Račun ne postoji")
            iban = body.get("iban") or row.get("iban_to") or "HR0000000000000000000"
            iznos = float(row.get("amount_gross") or 0)
            primatelj = row.get("vendor_name") or "Dobavljač"
            primatelj_addr = row.get("vendor_address") or "—"
            platitelj_naziv = row.get("klub_naziv") or "PGŽ Sport klub"
            platitelj_adresa = row.get("klub_adresa") or "—"
            poziv = body.get("poziv_na_broj") or f"{eid:08d}"
            opis = body.get("opis") or f"Račun {row.get('invoice_no')} — {primatelj}"
        elif kind in ("putni_nalog", "pn"):
            cur.execute(
                """SELECT er.*, k.naziv AS klub_naziv, k.adresa AS klub_adresa
                   FROM pgz_sport.expense_reports er
                   LEFT JOIN pgz_sport.klubovi k ON k.id=er.klub_id
                   WHERE er.id=%s AND er.report_type='putni_nalog'""", (eid,))
            row = cur.fetchone()
            if not row:
                raise HTTPException(404, "Putni nalog ne postoji")
            att = row.get("attachments") or {}
            if isinstance(att, str):
                try: att = json.loads(att)
                except Exception: att = {}
            iban = body.get("iban") or att.get("iban_voditelja") or "HR0000000000000000000"
            iznos = float(row.get("cost_total") or 0)
            primatelj = att.get("voditelj") or "Voditelj"
            primatelj_addr = "—"
            platitelj_naziv = row.get("klub_naziv") or "PGŽ Sport klub"
            platitelj_adresa = row.get("klub_adresa") or "—"
            poziv = body.get("poziv_na_broj") or f"PN{eid:06d}"
            opis = body.get("opis") or f"Putni nalog #{eid}: {row.get('destination','')}"
        else:
            raise HTTPException(400, "kind mora biti 'invoice' ili 'putni_nalog'")

    if iznos <= 0:
        raise HTTPException(400, "Iznos mora biti > 0")

    pdf = build_hub3_pdf(
        platitelj_naziv=platitelj_naziv,
        platitelj_adresa=platitelj_adresa,
        primatelj_naziv=primatelj,
        primatelj_adresa=primatelj_addr,
        iban=iban,
        amount_eur=iznos,
        model=body.get("model", "HR99"),
        poziv_na_broj=poziv,
        opis=opis[:140],
        sifra_namjene=body.get("sifra_namjene", "OTHR"),
        datum=date.today(),
    )
    # Save PDF na disk za GET /placanja/{id}/pdf
    out_dir = Path("/opt/pgz-sport/_data/uploads/placanja")
    out_dir.mkdir(parents=True, exist_ok=True)
    fname = f"{kind}_{eid}_HUB3_{datetime.now().strftime('%Y%m%d_%H%M%S')}.pdf"
    fpath = out_dir / fname
    fpath.write_bytes(pdf)

    # Audit
    try: audit_putni(user, eid if kind != 'invoice' else 0, "placanja_pdf",
                    field=kind, new=str(fname))
    except Exception: pass

    return {"ok": True, "kind": kind, "id": eid,
            "pdf_url": f"/api/erp/placanja/{kind}/{eid}/pdf",
            "iban": iban, "iznos": iznos, "primatelj": primatelj,
            "poziv_na_broj": poziv, "opis": opis,
            "filename": fname, "size": len(pdf)}


@router.get("/placanja/{kind}/{eid}/pdf")
def placanja_pdf(kind: str, eid: int, authorization: Optional[str] = Header(None)):
    """Dohvat zadnjeg generiranog HUB-3 PDF-a za invoice ili putni-nalog.
    Ako PDF još nije generiran, kreira ga on-the-fly."""
    out_dir = Path("/opt/pgz-sport/_data/uploads/placanja")
    out_dir.mkdir(parents=True, exist_ok=True)
    pat = f"{kind}_{eid}_HUB3_*.pdf"
    candidates = sorted(out_dir.glob(pat), reverse=True)
    if candidates:
        from fastapi.responses import FileResponse
        return FileResponse(str(candidates[0]), media_type="application/pdf",
                             filename=candidates[0].name)
    # Generate on-the-fly
    res = placanja_create({"kind": kind, "id": eid}, authorization)
    p = out_dir / res["filename"]
    from fastapi.responses import FileResponse
    return FileResponse(str(p), media_type="application/pdf", filename=p.name)