# -*- coding: utf-8 -*- """ Cloud POS Sync Server & Web Management Portal 24/24 (Python Backend) Hỗ trợ đầy đủ 9 phân hệ đồng bộ 2 chiều với Desktop App OfflinePOS (.exe): 1. Tổng quan (Dashboard) 2. Bán hàng POS trực tiếp trên Web (Web POS) 3. Đơn bán hàng (Invoices) 4. Nhập hàng từ NCC (Purchases) 5. Kho & Danh mục hàng hóa (Inventory) 6. Khách hàng & Nhà cung cấp (Partners) 7. Sổ quỹ Thu - Chi (Finance) 8. Báo cáo thống kê (Reports) 9. Quản lý Nhân sự & Chấm công (HR: Hồ sơ NV, Chấm công, Tạm ứng, Bảng lương) 10. Cài đặt & Đồng bộ 2 chiều (Sync & Pending Events) """ import os import sys import json import gzip import sqlite3 import argparse import time from datetime import datetime, date, timedelta from pathlib import Path from http.server import HTTPServer, BaseHTTPRequestHandler from urllib.parse import urlparse, parse_qs # Thiết lập thư mục gốc BASE_DIR = Path(__file__).resolve().parent DB_FILE = BASE_DIR / "cloud_pos.db" ATT_DB_FILE = BASE_DIR / "cloud_attendance.db" META_FILE = BASE_DIR / "sync_meta.json" EVENTS_FILE = BASE_DIR / "cloud_pending_events.json" DEFAULT_SECRET = "cuahang123" def get_server_secret() -> str: if "SYNC_SECRET_KEY" in os.environ: return os.environ["SYNC_SECRET_KEY"].strip() if META_FILE.exists(): try: with open(META_FILE, "r", encoding="utf-8") as f: data = json.load(f) return data.get("sync_secret", DEFAULT_SECRET).strip() except Exception: pass return DEFAULT_SECRET def set_server_secret(new_secret: str): meta = get_meta() meta["sync_secret"] = new_secret.strip() save_meta(meta) def get_meta() -> dict: if META_FILE.exists(): try: with open(META_FILE, "r", encoding="utf-8") as f: return json.load(f) except Exception: pass return { "last_sync_time": "Chưa có dữ liệu", "sync_count": 0, "store_name": "CỬA HÀNG ĐA NGÀNH", "sync_secret": DEFAULT_SECRET, "store_wifi_ips": "" } def save_meta(data: dict): try: with open(META_FILE, "w", encoding="utf-8") as f: json.dump(data, f, ensure_ascii=False, indent=2) except Exception as e: print(f"Error saving meta: {e}") # ----------------------------------------------------------------------------- # CLOUD PENDING EVENTS (DONG BO 2 CHIEU VE APP .EXE) # ----------------------------------------------------------------------------- def get_pending_events() -> list: if EVENTS_FILE.exists(): try: with open(EVENTS_FILE, "r", encoding="utf-8") as f: return json.load(f) except Exception: pass return [] def save_pending_events(events: list): try: with open(EVENTS_FILE, "w", encoding="utf-8") as f: json.dump(events, f, ensure_ascii=False, indent=2) except Exception as e: print(f"Error saving events: {e}") def record_cloud_event(entity_type: str, action: str, entity_id: str, payload: dict) -> int: event_id = int(time.time() * 1000) ev = { "id": event_id, "entity_type": entity_type, "action": action, "entity_id": str(entity_id or ""), "payload": payload, "created_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S") } events = get_pending_events() events.append(ev) save_pending_events(events) if DB_FILE.exists(): try: conn = get_sqlite_conn(DB_FILE) cur = conn.cursor() cur.execute(""" CREATE TABLE IF NOT EXISTS cloud_sync_events ( id INTEGER PRIMARY KEY AUTOINCREMENT, entity_type TEXT NOT NULL, action TEXT NOT NULL, entity_id TEXT, payload TEXT NOT NULL, created_at DATETIME DEFAULT CURRENT_TIMESTAMP, is_synced_to_desktop INTEGER DEFAULT 0 ) """) cur.execute(""" INSERT INTO cloud_sync_events (id, entity_type, action, entity_id, payload, created_at, is_synced_to_desktop) VALUES (?, ?, ?, ?, ?, ?, 0) """, (event_id, entity_type, action, str(entity_id or ""), json.dumps(payload, ensure_ascii=False), ev["created_at"])) conn.commit() conn.close() except Exception: pass return event_id def get_sqlite_conn(path: Path) -> sqlite3.Connection: conn = sqlite3.connect(str(path), timeout=30.0) conn.execute("PRAGMA journal_mode = WAL;") conn.execute("PRAGMA busy_timeout = 30000;") conn.execute("PRAGMA synchronous = NORMAL;") return conn def get_db_connection() -> sqlite3.Connection: if not DB_FILE.exists(): return None try: return get_sqlite_conn(DB_FILE) except Exception as e: print(f"Database connection error: {e}") return None def ensure_hr_tables(conn: sqlite3.Connection): try: cur = conn.cursor() cur.executescript(""" CREATE TABLE IF NOT EXISTS employees ( id INTEGER PRIMARY KEY AUTOINCREMENT, code TEXT NOT NULL UNIQUE, full_name TEXT NOT NULL, phone TEXT, position TEXT DEFAULT 'Nhân viên', username TEXT NOT NULL UNIQUE, password_hash TEXT NOT NULL, password_plain TEXT, base_salary REAL DEFAULT 0.0, hourly_rate REAL DEFAULT 0.0, commission_rate REAL DEFAULT 0.0, insurance_amount REAL DEFAULT 0.0, allowance_amount REAL DEFAULT 0.0, allowance_details TEXT, ot_multiplier REAL DEFAULT 1.5, is_active INTEGER DEFAULT 1, created_at DATETIME DEFAULT CURRENT_TIMESTAMP, updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ); CREATE TABLE IF NOT EXISTS hr_salary_advances ( id INTEGER PRIMARY KEY AUTOINCREMENT, month_year TEXT NOT NULL, employee_code TEXT NOT NULL, advance_date TEXT NOT NULL, amount REAL NOT NULL DEFAULT 0, reason TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP ); CREATE TABLE IF NOT EXISTS hr_payrolls ( id INTEGER PRIMARY KEY AUTOINCREMENT, month_year TEXT NOT NULL, employee_code TEXT NOT NULL, standard_work_days REAL DEFAULT 24.0, actual_work_days REAL DEFAULT 0.0, actual_hours REAL DEFAULT 0.0, base_salary REAL DEFAULT 0.0, hourly_rate REAL DEFAULT 0.0, salary_amount REAL DEFAULT 0.0, allowance_amount REAL DEFAULT 0.0, ot_amount REAL DEFAULT 0.0, insurance_deduction REAL DEFAULT 0.0, advance_deduction REAL DEFAULT 0.0, net_salary REAL DEFAULT 0.0, payment_status TEXT DEFAULT 'Chưa chi', note TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP, updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ); CREATE TABLE IF NOT EXISTS attendance_logs ( id INTEGER PRIMARY KEY AUTOINCREMENT, remote_id INTEGER, employee_id INTEGER, employee_code TEXT NOT NULL, employee_name TEXT NOT NULL, work_date TEXT NOT NULL, check_in_time TEXT, check_out_time TEXT, total_hours REAL DEFAULT 0.0, ip_address TEXT, status TEXT DEFAULT 'Hợp lệ', note TEXT, synced INTEGER DEFAULT 0, created_at DATETIME DEFAULT CURRENT_TIMESTAMP, updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ); CREATE TABLE IF NOT EXISTS cloud_sync_events ( id INTEGER PRIMARY KEY AUTOINCREMENT, entity_type TEXT NOT NULL, action TEXT NOT NULL, entity_id TEXT, payload TEXT NOT NULL, created_at DATETIME DEFAULT CURRENT_TIMESTAMP, is_synced_to_desktop INTEGER DEFAULT 0 ); CREATE INDEX IF NOT EXISTS idx_att_date ON attendance_logs (work_date); CREATE INDEX IF NOT EXISTS idx_att_emp ON attendance_logs (employee_code); """) conn.commit() except Exception as e: print(f"ensure_hr_tables error: {e}") def query_dashboard_data(conn: sqlite3.Connection) -> dict: conn.row_factory = sqlite3.Row cursor = conn.cursor() ensure_hr_tables(conn) today_str = datetime.now().strftime("%Y-%m-%d") # 1. Doanh thu & Lợi nhuận hôm nay cursor.execute(""" SELECT COALESCE(SUM(total_amount), 0) as today_revenue, COALESCE(SUM(total_cost), 0) as today_cogs, COALESCE(SUM(paid_amount), 0) as today_paid, COALESCE(SUM(remaining_debt), 0) as today_debt, COUNT(id) as today_invoices FROM sales_invoices WHERE status = 'COMPLETED' AND date(invoice_date) = date(?) """, (today_str,)) today_inv = dict(cursor.fetchone() or {}) today_rev = float(today_inv.get("today_revenue", 0)) today_cogs = float(today_inv.get("today_cogs", 0)) today_profit = today_rev - today_cogs # 2. Toàn bộ doanh số cursor.execute(""" SELECT COALESCE(SUM(total_amount), 0) as total_revenue, COUNT(id) as total_invoices FROM sales_invoices WHERE status = 'COMPLETED' """) all_inv = dict(cursor.fetchone() or {}) # 3. Tiền mặt & Ngân hàng cursor.execute("SELECT id, name, account_type, current_balance FROM cash_accounts WHERE is_active = 1") accounts = [dict(r) for r in cursor.fetchall()] total_cash = sum(float(a["current_balance"]) for a in accounts if a["account_type"] == "CASH") total_bank = sum(float(a["current_balance"]) for a in accounts if a["account_type"] == "BANK") # 4. Công nợ cursor.execute("SELECT COALESCE(SUM(current_debt), 0) FROM customers WHERE is_active = 1") customer_debt = float(cursor.fetchone()[0]) cursor.execute("SELECT COALESCE(SUM(current_debt), 0) FROM suppliers WHERE is_active = 1") supplier_debt = float(cursor.fetchone()[0]) # 5. Tồn kho & Cảnh báo cursor.execute("SELECT COALESCE(SUM(quantity * cost_price), 0) FROM stock_balances") inventory_value = float(cursor.fetchone()[0]) cursor.execute(""" SELECT COUNT(p.id) FROM products p LEFT JOIN stock_balances sb ON p.id = sb.product_id WHERE p.is_active = 1 AND ((p.min_stock > 0 AND COALESCE(sb.quantity, 0) <= p.min_stock) OR (COALESCE(sb.quantity, 0) <= 0)) """) low_stock_count = int(cursor.fetchone()[0]) # 6. Đơn bán hàng gần nhất cursor.execute(""" SELECT i.id, i.code, i.invoice_date, i.total_amount, i.paid_amount, i.remaining_debt, i.payment_method, i.status, c.name as customer_name, c.phone as customer_phone, COALESCE(u.full_name, u.username, 'Admin') as cashier_name FROM sales_invoices i LEFT JOIN customers c ON i.customer_id = c.id LEFT JOIN users u ON i.user_id = u.id ORDER BY i.id DESC LIMIT 50 """) recent_invoices = [dict(r) for r in cursor.fetchall()] # 7. Nhập hàng gần nhất cursor.execute(""" SELECT p.id, p.code, p.receipt_date, p.total_amount, p.paid_amount, p.remaining_debt, p.payment_method, p.status, s.name as supplier_name FROM purchase_receipts p LEFT JOIN suppliers s ON p.supplier_id = s.id ORDER BY p.id DESC LIMIT 30 """) recent_purchases = [dict(r) for r in cursor.fetchall()] # 8. Danh mục hàng hóa cursor.execute(""" SELECT p.id, p.code, p.barcode, p.name, COALESCE(c.name, 'Chưa phân loại') as category_name, COALESCE(u.name, 'Cái') as unit_name, p.cost_price, p.retail_price, p.wholesale_price, COALESCE(sb.quantity, 0) as stock_qty, p.min_stock FROM products p LEFT JOIN product_categories c ON p.category_id = c.id LEFT JOIN units u ON p.base_unit_id = u.id LEFT JOIN stock_balances sb ON p.id = sb.product_id WHERE p.is_active = 1 ORDER BY p.name ASC LIMIT 500 """) products = [dict(r) for r in cursor.fetchall()] # 9. Khách hàng cursor.execute("SELECT id, code, name, phone, address, current_debt FROM customers WHERE is_active = 1 AND current_debt > 0 ORDER BY current_debt DESC LIMIT 100") debt_customers = [dict(r) for r in cursor.fetchall()] cursor.execute("SELECT id, code, name, phone, address, current_debt FROM customers WHERE is_active = 1 ORDER BY name ASC LIMIT 300") all_customers = [dict(r) for r in cursor.fetchall()] # 10. Nhà cung cấp cursor.execute("SELECT id, code, name, phone, current_debt FROM suppliers WHERE is_active = 1 AND current_debt > 0 ORDER BY current_debt DESC LIMIT 100") debt_suppliers = [dict(r) for r in cursor.fetchall()] cursor.execute("SELECT id, code, name, phone, current_debt FROM suppliers WHERE is_active = 1 ORDER BY name ASC LIMIT 300") all_suppliers = [dict(r) for r in cursor.fetchall()] # 11. Sổ quỹ cursor.execute(""" SELECT t.id, t.code, t.trans_type, t.created_at, t.category, t.amount, t.partner_name, t.note, a.name as account_name FROM cash_transactions t LEFT JOIN cash_accounts a ON t.account_id = a.id ORDER BY t.id DESC LIMIT 50 """) recent_transactions = [dict(r) for r in cursor.fetchall()] # 12. Danh mục & Đơn vị & Nhân sự cursor.execute("SELECT id, name FROM product_categories ORDER BY name ASC") categories = [dict(r) for r in cursor.fetchall()] cursor.execute("SELECT id, name FROM units ORDER BY name ASC") units = [dict(r) for r in cursor.fetchall()] cursor.execute(""" SELECT id, code, full_name, phone, position, username, password_plain, base_salary, hourly_rate, insurance_amount, allowance_amount, allowance_details, ot_multiplier, is_active FROM employees WHERE is_active = 1 ORDER BY full_name ASC """) employees = [dict(r) for r in cursor.fetchall()] cursor.execute(""" SELECT a.id, a.month_year, a.employee_code, a.advance_date, a.amount, a.reason, e.full_name as employee_name FROM hr_salary_advances a LEFT JOIN employees e ON UPPER(a.employee_code) = UPPER(e.code) ORDER BY a.id DESC LIMIT 100 """) salary_advances = [dict(r) for r in cursor.fetchall()] cursor.execute(""" SELECT p.*, e.full_name as employee_name FROM hr_payrolls p LEFT JOIN employees e ON UPPER(p.employee_code) = UPPER(e.code) ORDER BY p.month_year DESC, p.id DESC LIMIT 100 """) payrolls = [dict(r) for r in cursor.fetchall()] # 13. Tên cửa hàng cursor.execute("SELECT key, value FROM app_settings WHERE key IN ('store_name', 'store_phone', 'store_address')") settings_map = {r[0]: r[1] for r in cursor.fetchall()} store_name = settings_map.get("store_name", "CỬA HÀNG ĐA NGÀNH") # 14. 7 days financial chart data c_today = date.today() c_dates = [(c_today - timedelta(days=i)).strftime('%Y-%m-%d') for i in reversed(range(7))] c_cats = [(c_today - timedelta(days=i)).strftime('%d/%m') for i in reversed(range(7))] c_start = c_dates[0] cursor.execute(""" SELECT substr(invoice_date, 1, 10) as dt, COALESCE(SUM(total_amount), 0) as rev, COALESCE(SUM(total_cost), 0) as cogs FROM sales_invoices WHERE status = 'COMPLETED' AND substr(invoice_date, 1, 10) >= ? GROUP BY substr(invoice_date, 1, 10) """, (c_start,)) c_rev_map = {r[0]: (float(r[1]), float(r[2])) for r in cursor.fetchall()} cursor.execute(""" SELECT substr(created_at, 1, 10) as dt, COALESCE(SUM(CASE WHEN trans_type = 'THU' THEN amount ELSE 0 END), 0) as cash_in, COALESCE(SUM(CASE WHEN trans_type = 'CHI' THEN amount ELSE 0 END), 0) as cash_out FROM cash_transactions WHERE substr(created_at, 1, 10) >= ? GROUP BY substr(created_at, 1, 10) """, (c_start,)) c_cash_map = {r[0]: (float(r[1]), float(r[2])) for r in cursor.fetchall()} c_revs, c_cogs, c_profits, c_ins, c_outs = [], [], [], [], [] for dt in c_dates: rv, cg = c_rev_map.get(dt, (0.0, 0.0)) cin, cout = c_cash_map.get(dt, (0.0, 0.0)) c_revs.append(round(rv, 2)) c_cogs.append(round(cg, 2)) c_profits.append(round(rv - cg, 2)) c_ins.append(round(cin, 2)) c_outs.append(round(cout, 2)) chart_data = { "categories": c_cats, "dates": c_dates, "revenues": c_revs, "cogs": c_cogs, "profits": c_profits, "cash_ins": c_ins, "cash_outs": c_outs, "total_revenue": sum(c_revs), "total_profit": sum(c_profits), "total_cash_in": sum(c_ins), "total_cash_out": sum(c_outs) } res = { "store_name": store_name, "store_phone": settings_map.get("store_phone", ""), "store_address": settings_map.get("store_address", ""), "today": { "date": today_str, "revenue": today_rev, "cogs": today_cogs, "profit": today_profit, "invoices": today_inv.get("today_invoices", 0), "paid": float(today_inv.get("today_paid", 0)), "debt": float(today_inv.get("today_debt", 0)) }, "all_time": { "revenue": float(all_inv.get("total_revenue", 0)), "invoices": int(all_inv.get("total_invoices", 0)) }, "finance": { "cash": total_cash, "bank": total_bank, "customer_debt": customer_debt, "supplier_debt": supplier_debt, "accounts": accounts }, "chart_data": chart_data, "inventory": { "total_value": inventory_value, "low_stock_count": low_stock_count }, "recent_invoices": recent_invoices, "recent_purchases": recent_purchases, "products": products, "debt_customers": debt_customers, "all_customers": all_customers, "debt_suppliers": debt_suppliers, "all_suppliers": all_suppliers, "recent_transactions": recent_transactions, "attendance_logs": [], "categories": categories, "units": units, "employees": employees, "salary_advances": salary_advances, "payrolls": payrolls } if ATT_DB_FILE.exists(): try: c_att = get_sqlite_conn(ATT_DB_FILE) c_att.row_factory = sqlite3.Row c_att_cur = c_att.cursor() c_att_cur.execute("SELECT * FROM attendance_logs ORDER BY work_date DESC, id DESC LIMIT 200") res["attendance_logs"] = [dict(r) for r in c_att_cur.fetchall()] c_att.close() except Exception: pass if not res["attendance_logs"]: try: cursor.execute("SELECT * FROM attendance_logs ORDER BY work_date DESC, id DESC LIMIT 200") res["attendance_logs"] = [dict(r) for r in cursor.fetchall()] except Exception: pass return res def get_invoice_items(conn: sqlite3.Connection, invoice_id: int) -> list: cursor = conn.cursor() cursor.execute(""" SELECT item.id, item.product_id, item.unit_name, item.quantity, item.unit_price, item.discount_amount, item.line_total, item.note, p.name as product_name, p.code as product_code FROM sales_invoice_items item LEFT JOIN products p ON item.product_id = p.id WHERE item.invoice_id = ? ORDER BY item.id ASC """, (invoice_id,)) return [dict(r) for r in cursor.fetchall()] def get_purchase_items(conn: sqlite3.Connection, receipt_id: int) -> list: cursor = conn.cursor() cursor.execute(""" SELECT item.id, item.product_id, item.unit_name, item.quantity, item.unit_cost as unit_price, item.line_total, p.name as product_name, p.code as product_code FROM purchase_receipt_items item LEFT JOIN products p ON item.product_id = p.id WHERE item.receipt_id = ? ORDER BY item.id ASC """, (receipt_id,)) return [dict(r) for r in cursor.fetchall()] HTML_PORTAL = r""" Tạp Hóa Số - Quản Lý Bán Hàng Trực Tuyến 24/24

Tạp Hóa Số

Hệ Thống Quản Lý Tạp Hóa Số 24/24
Nhập Mã Bảo Mật bạn đã đặt trong App .exe
(mục Cài đặt → Đồng bộ Online)

Dashboard / TỔNG QUAN HỆ THỐNG (24/24)
Cập nhật: --:--:-- --:--:--
CỬA HÀNG ĐA NGÀNH
Tải SQLite
--:--:--
Giỏ Hàng (0 món)
Sản phẩm SL Thành tiền
Giỏ hàng đang trống.
Nhấn vào sản phẩm để chọn.
Tổng tiền hàng: 0 đ
Giảm giá:
Khách cần trả: 0 đ
HÌNH THỨC THANH TOÁN
Tiền khách đưa:
Tiền thừa trả khách: 0 đ
Doanh Thu Hôm Nay
0 đ
0 đơn hàng hôm nay
Lợi Nhuận Hôm Nay
0 đ
Giá vốn: 0 đ
Tiền Mặt Tại Quầy
0 đ
Ngân hàng: 0 đ
Khách Hàng Đang Nợ
0 đ
Nợ NCC: 0 đ
Giá Trị Tồn Kho
0 đ
0 mặt hàng sắp hết
Doanh Thu & Lợi Nhuận Gộp (7 Ngày)
--
Dòng Tiền Thu - Chi (7 Ngày)
--
Đơn Bán Hàng Mới Nhất (Tại Quầy POS)
Mã HĐ Thời gian Thu ngân Khách hàng Tổng tiền Đã thanh toán Còn nợ Hình thức Thao tác
Cảnh Báo Hàng Hóa Sắp Hết Tồn Kho
Mã hàng Tên hàng ĐVT Tồn hiện tại Tồn tối thiểu Trạng thái
Toàn Bộ Đơn Bán Hàng (24/24)
Mã HĐ Thời gian Thu ngân Khách hàng Tổng tiền Đã trả Còn nợ Thanh toán Trạng thái Thao tác
Phiếu Nhập Hàng Từ Nhà Cung Cấp
Mã Phiếu Thời gian Nhà cung cấp Tổng tiền nhập Đã thanh toán Còn nợ NCC Thao tác
Danh Mục Kho & Hàng Hóa
Mã hàng Tên hàng hóa Mã vạch ĐVT Giá vốn Giá bán Tồn kho hiện tại Thao tác
Quản Lý Khách Hàng & Công Nợ
Mã KH Họ và tên Số điện thoại Địa chỉ Nợ hiện tại Thao tác
Sổ Quỹ Thu - Chi Thời Gian Thực
Mã Phiếu Thời gian Loại Hạng mục Đối tác Số tiền Tài khoản Ghi chú
Báo Cáo Thống Kê Doanh Thu & Lợi Nhuận
Doanh Thu Thuần
0 đ
0 đơn bán
Lợi Nhuận Gộp
0 đ
Giá vốn: 0 đ
Tổng Chi Tiêu Sổ Quỹ
0 đ
Phiếu chi từ sổ quỹ
Lợi Nhuận Ròng Thực Tế
0 đ
(Lợi nhuận gộp - Chi phí)
Top 10 Hàng Hóa Bán Chạy Nhất
STT Mã hàng Tên hàng hóa ĐVT Số lượng bán Doanh số
Hồ Sơ Nhân Viên & Cấu Hình Lương
Mã NV Họ và tên SĐT Chức vụ Lương CB (24 công) Lương giờ BHXH (10.5%) Phụ cấp Trạng thái Thao tác
Thông Tin Máy Chủ & Kết Nối Đồng Bộ 2 Chiều
Cửa Hàng
--
Lần Đồng Bộ Cuối
--
Tổng Số Lần Đồng Bộ
0

Cơ Chế Đồng Bộ 2 Chiều Tự Động (Offline-First)

- Mọi chỉnh sửa của Chủ cửa hàng trên web này (Thêm/Sửa hàng hóa, Sửa nợ khách, Tạo phiếu thu/chi, Sửa công) sẽ được lưu lại và tự động kéo về App .exe ngay khi máy tính cửa hàng kết nối mạng.
- Mọi đơn hàng bán ra hoặc nhập hàng tại cửa hàng cũng được tự động đẩy lên web này theo thời gian thực 24/24.

""" HTML_ATTENDANCE = r""" Chấm Công Nhân Viên - Cửa Hàng Đa Ngành
Cửa Hàng Đa Ngành
HỆ THỐNG CHẤM CÔNG NHÂN VIÊN TRỰC TUYẾN
--:--:--
ĐĂNG NHẬP CHẤM CÔNG
Wi-Fi Cửa Hàng Hợp Lệ (IP: 127.0.0.1)
CẢNH BÁO: Chưa kết nối Wi-Fi Cửa Hàng (IP: 127.0.0.1)
Quản lý / Chủ cửa hàng đăng nhập tại đây →
Mã: •
Đăng xuất
Wi-Fi Hợp Lệ: Đã khớp vị trí cửa hàng.
Cảnh báo: Cần kết nối Wi-Fi cửa hàng để được xác nhận công!
XÁC NHẬN CÔNG HÔM NAY 18/10/2026
Giờ vào
Giờ ra
Tổng giờ
0) ? floatval($today_log['total_hours']) . 'h' : '-' ?>
Trạng thái
CÔNG THÁNG ngày | h
Ngày Vào Ra Tổng giờ Trạng thái
Chưa có bản ghi nào.
h
""" class CloudSyncHandler(BaseHTTPRequestHandler): server_version = "OfflinePOS-CloudSync/2.0" def check_auth(self) -> bool: token = self.headers.get("X-Sync-Token", "").strip() if not token: parsed = urlparse(self.path) qs = parse_qs(parsed.query) token = qs.get("token", [""])[0].strip() if not token: return False current = get_server_secret() if token == current: return True if current == DEFAULT_SECRET: set_server_secret(token) return True old_token = self.headers.get("X-Sync-Old-Token", "").strip() if not old_token: parsed = urlparse(self.path) qs = parse_qs(parsed.query) old_token = qs.get("old_token", [""])[0].strip() if old_token and old_token == current: set_server_secret(token) return True return False def get_real_client_ip(self) -> str: cf_ip = self.headers.get("CF-Connecting-IP", "").strip() if cf_ip: return cf_ip xf = self.headers.get("X-Forwarded-For", "").strip() if xf: return xf.split(",")[0].strip() return self.client_address[0] def send_json(self, status_code: int, data: dict): body = json.dumps(data, ensure_ascii=False).encode("utf-8") self.send_response(status_code) self.send_header("Content-Type", "application/json; charset=utf-8") self.send_header("Access-Control-Allow-Origin", "*") self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) def do_OPTIONS(self): self.send_response(200) self.send_header("Access-Control-Allow-Origin", "*") self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS") self.send_header("Access-Control-Allow-Headers", "X-Sync-Token, X-Sync-Old-Token, Content-Type, Content-Encoding") self.end_headers() def do_GET(self): parsed = urlparse(self.path) path = parsed.path qs = parse_qs(parsed.query) api = qs.get("api", [""])[0].strip() page = qs.get("page", [""])[0].strip() if path == "/api/my-ip" or api == "my-ip": meta = get_meta() client_ip = self.get_real_client_ip() store_ips = meta.get("store_wifi_ips", "") self.send_json(200, { "status": "ok", "ip": client_ip, "store_wifi_ips": store_ips, "time": datetime.now().strftime("%H:%M:%S %d/%m/%Y") }) return if path == "/api/ping" or api == "ping": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Sai mã bảo mật (Invalid Secret Token)"}) return meta = get_meta() self.send_json(200, { "status": "ok", "message": "Máy chủ đồng bộ đang hoạt động 24/24", "server_name": meta.get("store_name", "Cloud POS Server"), "last_sync_time": meta.get("last_sync_time", "Chưa có") }) return if path == "/api/get-attendance-logs" or api == "get-attendance-logs": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Sai mã bảo mật"}) return logs = [] if ATT_DB_FILE.exists(): try: c_att = get_sqlite_conn(ATT_DB_FILE) c_att.row_factory = sqlite3.Row cur = c_att.cursor() cur.execute("SELECT * FROM attendance_logs ORDER BY work_date DESC, id DESC LIMIT 500") logs = [dict(r) for r in cur.fetchall()] c_att.close() except Exception: pass if not logs: conn = get_db_connection() if conn: try: conn.row_factory = sqlite3.Row ensure_hr_tables(conn) cur = conn.cursor() cur.execute("SELECT * FROM attendance_logs ORDER BY work_date DESC, id DESC LIMIT 500") logs = [dict(r) for r in cur.fetchall()] except Exception: pass finally: conn.close() self.send_json(200, {"status": "ok", "logs": logs}) return # PULL CLOUD EVENTS (Desktop App kéo các thay đổi từ Web về máy) if path == "/api/pull-cloud-events" or api == "pull-cloud-events": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return events_map = {ev["id"]: ev for ev in get_pending_events()} conn = get_db_connection() if conn: try: conn.row_factory = sqlite3.Row cur = conn.cursor() cur.execute("SELECT * FROM cloud_sync_events WHERE is_synced_to_desktop = 0 ORDER BY id ASC") for r in cur.fetchall(): ev_id = int(r["id"]) if ev_id not in events_map: events_map[ev_id] = { "id": ev_id, "entity_type": r["entity_type"], "action": r["action"], "entity_id": r["entity_id"], "payload": json.loads(r["payload"]) if isinstance(r["payload"], str) else r["payload"], "created_at": r["created_at"] } except Exception: pass finally: conn.close() self.send_json(200, {"status": "ok", "events": list(events_map.values())}) return if path == "/api/dashboard-data" or api == "dashboard-data": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Chưa đăng nhập hoặc sai mã bảo mật"}) return conn = get_db_connection() if not conn: self.send_json(200, {"status": "ok", "meta": get_meta(), "data": { "store_name": "CỬA HÀNG (Chờ đồng bộ lần đầu)", "today": {"revenue": 0, "profit": 0, "invoices": 0, "cogs": 0, "paid": 0, "debt": 0}, "finance": {"cash": 0, "bank": 0, "customer_debt": 0, "supplier_debt": 0, "accounts": []}, "inventory": {"total_value": 0, "low_stock_count": 0}, "recent_invoices": [], "recent_purchases": [], "products": [], "debt_customers": [], "all_customers": [], "debt_suppliers": [], "all_suppliers": [], "recent_transactions": [], "attendance_logs": [], "categories": [], "units": [], "employees": [], "salary_advances": [], "payrolls": [] }}) return try: data = query_dashboard_data(conn) meta = get_meta() self.send_json(200, {"status": "ok", "meta": meta, "data": data}) except Exception as e: self.send_json(500, {"status": "error", "error": f"Lỗi truy vấn dữ liệu: {str(e)}"}) finally: conn.close() return if path == "/api/invoice-items" or api == "invoice-items": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return inv_id = int(qs.get("id", [0])[0]) conn = get_db_connection() if not conn or not inv_id: self.send_json(200, {"status": "ok", "items": []}) return try: items = get_invoice_items(conn, inv_id) self.send_json(200, {"status": "ok", "items": items}) finally: conn.close() return if path == "/api/purchase-items" or api == "purchase-items": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return rec_id = int(qs.get("id", [0])[0]) conn = get_db_connection() if not conn or not rec_id: self.send_json(200, {"status": "ok", "items": []}) return try: items = get_purchase_items(conn, rec_id) self.send_json(200, {"status": "ok", "items": items}) finally: conn.close() return if path == "/api/download-db" or api == "download-db": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return if not DB_FILE.exists(): self.send_json(404, {"status": "error", "error": "Chưa có file dữ liệu trên máy chủ"}) return with open(DB_FILE, "rb") as f: content = f.read() self.send_response(200) self.send_header("Content-Type", "application/x-sqlite3") self.send_header("Content-Disposition", f'attachment; filename="backup_pos_{datetime.now().strftime("%Y%m%d_%H%M%S")}.db"') self.send_header("Content-Length", str(len(content))) self.end_headers() self.wfile.write(content) return if path == "/cham-cong" or page == "cham-cong": body = HTML_ATTENDANCE.encode("utf-8") self.send_response(200) self.send_header("Content-Type", "text/html; charset=utf-8") self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) return if path == "/" or path == "/index.html": body = HTML_PORTAL.encode("utf-8") self.send_response(200) self.send_header("Content-Type", "text/html; charset=utf-8") self.send_header("Content-Length", str(len(body))) self.end_headers() self.wfile.write(body) return self.send_json(404, {"status": "error", "error": "Not Found"}) def do_POST(self): parsed = urlparse(self.path) path = parsed.path qs = parse_qs(parsed.query) api = qs.get("api", [""])[0].strip() content_len = int(self.headers.get("Content-Length", 0)) raw_body = self.rfile.read(content_len) if content_len > 0 else b"" # ACK CLOUD EVENTS (Desktop báo nhận và áp dụng event xong) if path == "/api/ack-cloud-events" or api == "ack-cloud-events": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} ids = data.get("event_ids", []) if not isinstance(ids, list): ids = [ids] id_set = set(ids) curr = get_pending_events() rem = [e for e in curr if e.get("id") not in id_set] save_pending_events(rem) conn = get_db_connection() if conn and ids: try: cur = conn.cursor() q = f"UPDATE cloud_sync_events SET is_synced_to_desktop = 1 WHERE id IN ({','.join(['?']*len(ids))})" cur.execute(q, ids) conn.commit() except Exception: pass finally: conn.close() self.send_json(200, {"status": "ok", "acknowledged": len(ids)}) return # UPDATE STORE IP if path == "/api/update-store-ip" or api == "update-store-ip": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Sai mã bảo mật"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} store_ips = str(data.get("store_wifi_ips", "")).strip() meta = get_meta() meta["store_wifi_ips"] = store_ips meta["store_ip_updated_at"] = datetime.now().strftime("%H:%M:%S %d/%m/%Y") save_meta(meta) self.send_json(200, {"status": "ok", "message": "Đã cập nhật IP Wi-Fi cửa hàng!", "store_wifi_ips": store_ips}) return # UPDATE STORE INFO if path == "/api/update-store-info" or api == "update-store-info": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} meta = get_meta() if data.get("store_name"): meta["store_name"] = str(data["store_name"]).strip() if data.get("sync_secret"): meta["sync_secret"] = str(data["sync_secret"]).strip() save_meta(meta) conn = get_db_connection() if conn: try: cur = conn.cursor() if data.get("store_name"): cur.execute("INSERT OR REPLACE INTO app_settings (key, value) VALUES ('store_name', ?)", (meta["store_name"],)) if data.get("store_phone"): cur.execute("INSERT OR REPLACE INTO app_settings (key, value) VALUES ('store_phone', ?)", (str(data["store_phone"]).strip(),)) if data.get("store_address"): cur.execute("INSERT OR REPLACE INTO app_settings (key, value) VALUES ('store_address', ?)", (str(data["store_address"]).strip(),)) conn.commit() except Exception: pass finally: conn.close() record_cloud_event("store_settings", "update", "info", data) self.send_json(200, {"status": "ok", "message": "Đã cập nhật thông tin cửa hàng thành công!"}) return # SYNC EMPLOYEES if path == "/api/sync-employees" or api == "sync-employees": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Sai mã bảo mật"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} employees = data.get("employees", []) conn = get_db_connection() count = 0 if conn and employees: try: ensure_hr_tables(conn) cur = conn.cursor() for emp in employees: cur.execute(""" INSERT INTO employees (id, code, full_name, phone, position, username, password_hash, password_plain, base_salary, hourly_rate, is_active, updated_at) VALUES (:id, :code, :full_name, :phone, :position, :username, :password_hash, :password_plain, :base_salary, :hourly_rate, :is_active, CURRENT_TIMESTAMP) ON CONFLICT(code) DO UPDATE SET full_name = excluded.full_name, phone = excluded.phone, position = excluded.position, username = excluded.username, password_hash = excluded.password_hash, password_plain = excluded.password_plain, base_salary = excluded.base_salary, hourly_rate = excluded.hourly_rate, is_active = excluded.is_active, updated_at = CURRENT_TIMESTAMP """, { "id": emp.get("id"), "code": emp.get("code"), "full_name": emp.get("full_name"), "phone": emp.get("phone"), "position": emp.get("position", ""), "username": emp.get("username"), "password_hash": emp.get("password_hash", ""), "password_plain": emp.get("password_plain", ""), "base_salary": emp.get("base_salary", 0.0), "hourly_rate": emp.get("hourly_rate", 0.0), "is_active": emp.get("is_active", 1) }) count += 1 conn.commit() finally: conn.close() self.send_json(200, {"status": "ok", "count": count, "message": f"Đã đồng bộ {count} nhân viên"}) return # SYNC DB SNAPSHOT if path == "/api/sync" or api == "sync": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Sai mã bảo mật (Sync Secret Key)"}) return content_encoding = self.headers.get("Content-Encoding", "").lower() if "gzip" in content_encoding or (len(raw_body) > 2 and raw_body[:2] == bytes([0x1f, 0x8b])): try: raw_db = gzip.decompress(raw_body) except Exception: raw_db = raw_body else: raw_db = raw_body if len(raw_db) < 16 or not raw_db.startswith(b"SQLite format 3\0"): self.send_json(400, {"status": "error", "error": "Dữ liệu không đúng định dạng SQLite chuẩn"}) return tmp_file = BASE_DIR / "cloud_pos.db.tmp" with open(tmp_file, "wb") as f: f.write(raw_db) # Bảo toàn dữ liệu chấm công và events chưa sync if DB_FILE.exists(): try: old_conn = get_sqlite_conn(DB_FILE) new_conn = get_sqlite_conn(tmp_file) ensure_hr_tables(new_conn) old_conn.row_factory = sqlite3.Row old_cur = old_conn.cursor() old_cur.execute("SELECT * FROM attendance_logs") for ol in old_cur.fetchall(): d = dict(ol) new_conn.execute(""" INSERT INTO attendance_logs (employee_id, employee_code, employee_name, work_date, check_in_time, check_out_time, total_hours, ip_address, status, note, synced, created_at) SELECT :employee_id, :employee_code, :employee_name, :work_date, :check_in_time, :check_out_time, :total_hours, :ip_address, :status, :note, :synced, :created_at WHERE NOT EXISTS (SELECT 1 FROM attendance_logs WHERE UPPER(employee_code) = UPPER(:employee_code2) AND work_date = :work_date2 AND check_in_time = :check_in_time2) """, {**d, "employee_code2": d.get("employee_code"), "work_date2": d.get("work_date"), "check_in_time2": d.get("check_in_time")}) old_cur.execute("SELECT * FROM cloud_sync_events WHERE is_synced_to_desktop = 0") for ev in old_cur.fetchall(): d_ev = dict(ev) new_conn.execute("INSERT INTO cloud_sync_events (entity_type, action, entity_id, payload, is_synced_to_desktop, created_at) VALUES (?, ?, ?, ?, 0, ?)", (d_ev["entity_type"], d_ev["action"], d_ev["entity_id"], d_ev["payload"], d_ev["created_at"])) new_conn.commit() old_conn.close() new_conn.close() except Exception as e: print(f"Error preserving sync data: {e}") if sys.platform == "win32" and DB_FILE.exists(): try: os.replace(str(tmp_file), str(DB_FILE)) except Exception: import shutil shutil.copyfile(str(tmp_file), str(DB_FILE)) try: os.remove(str(tmp_file)) except Exception: pass else: os.replace(str(tmp_file), str(DB_FILE)) meta = get_meta() meta["last_sync_time"] = datetime.now().strftime("%H:%M:%S %d/%m/%Y") meta["sync_count"] = meta.get("sync_count", 0) + 1 save_meta(meta) self.send_json(200, {"status": "ok", "message": "Đã đồng bộ thành công lên máy chủ 24/24", "timestamp": meta["last_sync_time"], "bytes_received": len(raw_db)}) return # POS CHECKOUT if path == "/api/pos-checkout" or api == "pos-checkout": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} items = data.get("items", []) if not items: self.send_json(400, {"status": "error", "error": "Giỏ hàng rỗng"}) return conn = get_db_connection() if not conn: self.send_json(500, {"status": "error", "error": "Chưa có CSDL trên máy chủ"}) return try: cur = conn.cursor() c_id = data.get("customer_id") subtotal = float(data.get("subtotal", 0)) discount = float(data.get("discount_amount", 0)) total_amt = float(data.get("total_amount", max(0, subtotal - discount))) pay_method = data.get("payment_method", "TIEN_MAT") paid_amt = float(data.get("paid_amount", total_amt)) rem_debt = float(data.get("remaining_debt", max(0, total_amt - paid_amt))) note = data.get("note", "Bán hàng qua Web POS") inv_date = datetime.now().strftime("%Y-%m-%d %H:%M:%S") code = f"HD{datetime.now().strftime('%y%m%d')}{int(time.time()%10000):04d}" total_cost = 0.0 for it in items: cur.execute("SELECT cost_price FROM products WHERE id = ?", (it.get("product_id"),)) cp_row = cur.fetchone() total_cost += float(it.get("quantity", 1)) * (float(cp_row[0]) if cp_row and cp_row[0] else 0.0) cur.execute(""" INSERT INTO sales_invoices (code, invoice_date, user_id, customer_id, warehouse_id, subtotal, discount_amount, shipping_fee, tax_amount, total_amount, previous_debt, total_payment_required, paid_amount, remaining_debt, total_cost, status, payment_method, note, created_at) VALUES (?, ?, 1, ?, 1, ?, ?, 0.0, 0.0, ?, 0.0, ?, ?, ?, ?, 'COMPLETED', ?, ?, ?) """, (code, inv_date, c_id, subtotal, discount, total_amt, total_amt, paid_amt, rem_debt, total_cost, pay_method, note, inv_date)) inv_id = cur.lastrowid for it in items: p_id = it.get("product_id") qty = float(it.get("quantity", 1)) price = float(it.get("unit_price", 0)) lt = float(it.get("line_total", qty * price)) u_name = str(it.get("unit_name", "Cái")) cur.execute("SELECT id FROM units WHERE UPPER(name) = UPPER(?) LIMIT 1", (u_name,)) u_row = cur.fetchone() u_id = u_row[0] if u_row else 1 cur.execute(""" INSERT INTO sales_invoice_items (invoice_id, product_id, unit_id, unit_name, conversion_rate, quantity, quantity_base, unit_price, discount_percent, discount_amount, line_total, unit_cost, line_cost, note) VALUES (?, ?, ?, ?, 1.0, ?, ?, ?, 0.0, 0.0, ?, 0.0, 0.0, ?) """, (inv_id, p_id, u_id, u_name, qty, qty, price, lt, it.get("note", ""))) cur.execute("UPDATE stock_balances SET quantity = quantity - ? WHERE product_id = ? AND warehouse_id = 1", (qty, p_id)) if rem_debt > 0 and c_id: cur.execute("UPDATE customers SET current_debt = current_debt + ? WHERE id = ?", (rem_debt, c_id)) if paid_amt > 0: t_code = f"PT_{code}" acc_id = 2 if pay_method == "CHUYEN_KHOAN" else 1 cur.execute(""" INSERT INTO cash_transactions (code, trans_type, account_id, amount, partner_type, partner_id, category, document_type, document_id, document_code, note) VALUES (?, 'THU', ?, ?, 'CUSTOMER', ?, 'Thu tiền bán hàng', 'INVOICE', ?, ?, ?) """, (t_code, acc_id, paid_amt, c_id, inv_id, code, f"Thu tiền đơn bán hàng {code} qua Web POS")) cur.execute("UPDATE cash_accounts SET current_balance = current_balance + ? WHERE id = ?", (paid_amt, acc_id)) conn.commit() payload = { "id": inv_id, "code": code, "invoice_date": inv_date, "customer_id": c_id, "subtotal": subtotal, "discount_amount": discount, "total_amount": total_amt, "paid_amount": paid_amt, "remaining_debt": rem_debt, "total_cost": total_cost, "payment_method": pay_method, "note": note, "items": items } record_cloud_event("invoice_create", "create", code, payload) self.send_json(200, {"status": "ok", "message": "Thanh toán thành công!", "invoice": payload}) except Exception as e: self.send_json(500, {"status": "error", "error": str(e)}) finally: conn.close() return # CREATE PURCHASE if path == "/api/create-purchase" or api == "create-purchase": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} items = data.get("items", []) conn = get_db_connection() if not conn: self.send_json(500, {"status": "error", "error": "Chưa có CSDL"}) return try: cur = conn.cursor() s_id = data.get("supplier_id") subtotal = float(data.get("subtotal", 0)) discount = float(data.get("discount_amount", 0)) total_amt = float(data.get("total_amount", max(0, subtotal - discount))) pay_method = data.get("payment_method", "TIEN_MAT") paid_amt = float(data.get("paid_amount", total_amt)) rem_debt = float(data.get("remaining_debt", max(0, total_amt - paid_amt))) note = data.get("note", "Nhập hàng từ Web Portal") rec_date = datetime.now().strftime("%Y-%m-%d %H:%M:%S") code = f"PN{datetime.now().strftime('%y%m%d')}{int(time.time()%10000):04d}" cur.execute(""" INSERT INTO purchase_receipts (code, receipt_date, user_id, supplier_id, warehouse_id, subtotal, discount_amount, shipping_fee, tax_amount, total_amount, previous_debt, paid_amount, remaining_debt, payment_method, status, note, created_at) VALUES (?, ?, 1, ?, 1, ?, ?, 0.0, 0.0, ?, 0.0, ?, ?, ?, 'COMPLETED', ?, ?) """, (code, rec_date, s_id, subtotal, discount, total_amt, paid_amt, rem_debt, pay_method, note, rec_date)) rec_id = cur.lastrowid for it in items: p_id = it.get("product_id") qty = float(it.get("quantity", 1)) cost = float(it.get("unit_cost", 0)) lt = float(it.get("line_total", qty * cost)) u_name = str(it.get("unit_name", "Cái")) cur.execute("SELECT id FROM units WHERE UPPER(name) = UPPER(?) LIMIT 1", (u_name,)) u_row = cur.fetchone() u_id = u_row[0] if u_row else 1 cur.execute(""" INSERT INTO purchase_receipt_items (receipt_id, product_id, unit_id, unit_name, conversion_rate, quantity, quantity_base, unit_cost, discount_amount, allocated_fee, line_total, note) VALUES (?, ?, ?, ?, 1.0, ?, ?, ?, 0.0, 0.0, ?, ?) """, (rec_id, p_id, u_id, u_name, qty, qty, cost, lt, it.get("note", ""))) cur.execute(""" INSERT INTO stock_balances (warehouse_id, product_id, quantity, cost_price) VALUES (1, ?, ?, ?) ON CONFLICT(warehouse_id, product_id) DO UPDATE SET quantity = quantity + excluded.quantity, cost_price = excluded.cost_price """, (p_id, qty, cost)) cur.execute("UPDATE products SET cost_price = ? WHERE id = ?", (cost, p_id)) if rem_debt > 0 and s_id: cur.execute("UPDATE suppliers SET current_debt = current_debt + ? WHERE id = ?", (rem_debt, s_id)) if paid_amt > 0: t_code = f"PC_{code}" acc_id = 2 if pay_method == "CHUYEN_KHOAN" else 1 cur.execute(""" INSERT INTO cash_transactions (code, trans_type, account_id, amount, partner_type, partner_id, category, document_type, document_id, document_code, note) VALUES (?, 'CHI', ?, ?, 'SUPPLIER', ?, 'Trả tiền mua hàng', 'PURCHASE', ?, ?, ?) """, (t_code, acc_id, paid_amt, s_id, rec_id, code, f"Thanh toán phiếu nhập {code} qua Web")) cur.execute("UPDATE cash_accounts SET current_balance = current_balance - ? WHERE id = ?", (paid_amt, acc_id)) conn.commit() payload = { "id": rec_id, "code": code, "receipt_date": rec_date, "supplier_id": s_id, "subtotal": subtotal, "discount_amount": discount, "total_amount": total_amt, "paid_amount": paid_amt, "remaining_debt": rem_debt, "payment_method": pay_method, "note": note, "items": items } record_cloud_event("purchase_create", "create", code, payload) self.send_json(200, {"status": "ok", "message": "Lập phiếu nhập thành công!", "receipt": payload}) except Exception as e: self.send_json(500, {"status": "error", "error": str(e)}) finally: conn.close() return # SAVE EMPLOYEE if path == "/api/save-employee" or api == "save-employee": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} name = (data.get("full_name") or "").strip() if not name: self.send_json(400, {"status": "error", "error": "Họ và tên không được để trống"}) return conn = get_db_connection() if not conn: self.send_json(500, {"status": "error", "error": "Chưa có CSDL"}) return try: ensure_hr_tables(conn) cur = conn.cursor() emp_id = int(data.get("id") or 0) code = (data.get("code") or "").strip().upper() phone = (data.get("phone") or "").strip() pos = (data.get("position") or "Nhân viên bán hàng").strip() username = (data.get("username") or "").strip().lower() pwd = data.get("password_plain", "123456") b_sal = float(data.get("base_salary") or 0) h_rate = float(data.get("hourly_rate") or 0) ins = float(data.get("insurance_amount") or (round(b_sal * 0.105) if b_sal > 0 else 0)) allow = float(data.get("allowance_amount") or 0) al_det = (data.get("allowance_details") or "").strip() ot_m = float(data.get("ot_multiplier") or 1.5) is_act = int(data.get("is_active", 1)) if emp_id > 0: cur.execute(""" UPDATE employees SET full_name = ?, phone = ?, position = ?, username = ?, password_plain = ?, base_salary = ?, hourly_rate = ?, insurance_amount = ?, allowance_amount = ?, allowance_details = ?, ot_multiplier = ?, is_active = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ? """, (name, phone, pos, username, pwd, b_sal, h_rate, ins, allow, al_det, ot_m, is_act, emp_id)) action = "save" else: if not code: cur.execute("SELECT COALESCE(MAX(id), 0) + 1 FROM employees") code = f"NV{cur.fetchone()[0]:04d}" if not username: username = code.lower() cur.execute(""" INSERT INTO employees (code, full_name, phone, position, username, password_plain, password_hash, base_salary, hourly_rate, insurance_amount, allowance_amount, allowance_details, ot_multiplier, is_active) VALUES (?, ?, ?, ?, ?, ?, '', ?, ?, ?, ?, ?, ?, ?) """, (code, name, phone, pos, username, pwd, b_sal, h_rate, ins, allow, al_det, ot_m, is_act)) emp_id = cur.lastrowid action = "save" conn.commit() payload = { "id": emp_id, "code": code, "full_name": name, "phone": phone, "position": pos, "username": username, "password_plain": pwd, "base_salary": b_sal, "hourly_rate": h_rate, "insurance_amount": ins, "allowance_amount": allow, "allowance_details": al_det, "ot_multiplier": ot_m, "is_active": is_act } record_cloud_event("employee_save", action, code, payload) self.send_json(200, {"status": "ok", "message": "Lưu nhân viên thành công!", "employee": payload}) except Exception as e: self.send_json(500, {"status": "error", "error": str(e)}) finally: conn.close() return # DELETE EMPLOYEE if path == "/api/delete-employee" or api == "delete-employee": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} emp_id = int(data.get("id") or 0) code = (data.get("code") or "").strip() conn = get_db_connection() if conn: try: cur = conn.cursor() cur.execute("UPDATE employees SET is_active = 0, updated_at = CURRENT_TIMESTAMP WHERE id = ? OR UPPER(code) = UPPER(?)", (emp_id, code)) conn.commit() record_cloud_event("employee_save", "delete", code, {"id": emp_id, "code": code, "is_active": 0}) finally: conn.close() self.send_json(200, {"status": "ok", "message": "Đã ngừng kích hoạt nhân viên!"}) return # SAVE ADVANCE if path == "/api/save-advance" or api == "save-advance": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} code = (data.get("employee_code") or "").strip().upper() amt = float(data.get("amount") or 0) adv_date = data.get("advance_date") or datetime.now().strftime("%Y-%m-%d") my = data.get("month_year") or adv_date[:7] reason = data.get("reason", "Tạm ứng lương") if amt <= 0 or not code: self.send_json(400, {"status": "error", "error": "Dữ liệu tạm ứng không hợp lệ"}) return conn = get_db_connection() if conn: try: ensure_hr_tables(conn) cur = conn.cursor() cur.execute("INSERT INTO hr_salary_advances (month_year, employee_code, advance_date, amount, reason) VALUES (?, ?, ?, ?, ?)", (my, code, adv_date, amt, reason)) t_code = f"PC_UNG_{datetime.now().strftime('%y%m%d')}{int(time.time()%1000):03d}" cur.execute("INSERT INTO cash_transactions (code, trans_type, account_id, amount, partner_name, category, note) VALUES (?, 'CHI', 1, ?, ?, 'Tạm ứng lương', ?)", (t_code, amt, code, f"Tạm ứng lương tháng {my} cho {code}: {reason}")) cur.execute("UPDATE cash_accounts SET current_balance = current_balance - ? WHERE id = 1", (amt,)) conn.commit() payload = {"employee_code": code, "month_year": my, "advance_date": adv_date, "amount": amt, "reason": reason} record_cloud_event("salary_advance", "save", code, payload) self.send_json(200, {"status": "ok", "message": "Lập phiếu tạm ứng thành công!", "advance": payload}) finally: conn.close() return # SAVE PAYROLL STATUS if path == "/api/save-payroll-status" or api == "save-payroll-status": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} code = (data.get("employee_code") or "").strip().upper() my = data.get("month_year") or datetime.now().strftime("%Y-%m") status = data.get("status", "Đã thanh toán") conn = get_db_connection() if conn: try: ensure_hr_tables(conn) cur = conn.cursor() cur.execute("UPDATE hr_payrolls SET payment_status = ?, updated_at = CURRENT_TIMESTAMP WHERE UPPER(employee_code) = UPPER(?) AND month_year = ?", (status, code, my)) conn.commit() record_cloud_event("payroll_paid", "save", code, {"employee_code": code, "month_year": my, "status": status}) finally: conn.close() self.send_json(200, {"status": "ok", "message": "Cập nhật thanh toán lương thành công!"}) return # SAVE PRODUCT if path == "/api/save-product" or api == "save-product": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} name = (data.get("name") or "").strip() if not name: self.send_json(400, {"status": "error", "error": "Tên hàng hóa không được để trống"}) return conn = get_db_connection() if not conn: self.send_json(500, {"status": "error", "error": "Chưa có CSDL"}) return try: cur = conn.cursor() p_id = int(data.get("id") or 0) code = (data.get("code") or "").strip() barcode = (data.get("barcode") or "").strip() retail = float(data.get("retail_price") or 0) cost = float(data.get("cost_price") or 0) stock_qty = float(data.get("stock_qty") or 0) min_stock = float(data.get("min_stock") or 0) unit_name = (data.get("unit_name") or "Cái").strip() cur.execute("SELECT id FROM units WHERE UPPER(name) = UPPER(?) LIMIT 1", (unit_name,)) u_row = cur.fetchone() if u_row: u_id = u_row[0] else: cur.execute("INSERT INTO units (name) VALUES (?)", (unit_name,)) u_id = cur.lastrowid if p_id > 0: cur.execute(""" UPDATE products SET name = ?, barcode = ?, cost_price = ?, retail_price = ?, wholesale_price = ?, min_stock = ?, base_unit_id = ?, is_active = 1, updated_at = CURRENT_TIMESTAMP WHERE id = ? """, (name, barcode, cost, retail, retail, min_stock, u_id, p_id)) cur.execute("INSERT OR REPLACE INTO stock_balances (warehouse_id, product_id, quantity, cost_price) VALUES (1, ?, ?, ?)", (p_id, stock_qty, cost)) action = "save" else: if not code: cur.execute("SELECT COALESCE(MAX(id), 0) + 1 FROM products") code = f"HH{cur.fetchone()[0]:04d}" cur.execute(""" INSERT INTO products (code, barcode, name, base_unit_id, cost_price, retail_price, wholesale_price, min_stock, is_active) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1) """, (code, barcode, name, u_id, cost, retail, retail, min_stock)) p_id = cur.lastrowid cur.execute("INSERT OR REPLACE INTO stock_balances (warehouse_id, product_id, quantity, cost_price) VALUES (1, ?, ?, ?)", (p_id, stock_qty, cost)) action = "save" conn.commit() payload = {"id": p_id, "code": code, "name": name, "barcode": barcode, "cost_price": cost, "retail_price": retail, "stock_qty": stock_qty, "min_stock": min_stock, "unit_name": unit_name} record_cloud_event("product", action, code, payload) self.send_json(200, {"status": "ok", "message": "Lưu hàng hóa thành công!", "product": payload}) finally: conn.close() return # DELETE PRODUCT if path == "/api/delete-product" or api == "delete-product": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} p_id = int(data.get("id") or 0) code = (data.get("code") or "").strip() conn = get_db_connection() if conn: try: cur = conn.cursor() cur.execute("UPDATE products SET is_active = 0, updated_at = CURRENT_TIMESTAMP WHERE id = ? OR code = ?", (p_id, code)) conn.commit() record_cloud_event("product", "delete", code or str(p_id), {"id": p_id, "code": code}) finally: conn.close() self.send_json(200, {"status": "ok", "message": "Đã ngừng kinh doanh sản phẩm!"}) return # SAVE CUSTOMER if path == "/api/save-customer" or api == "save-customer": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} name = (data.get("name") or "").strip() conn = get_db_connection() if not conn: self.send_json(500, {"status": "error", "error": "Chưa có CSDL"}) return try: cur = conn.cursor() c_id = int(data.get("id") or 0) code = (data.get("code") or "").strip() phone = (data.get("phone") or "").strip() addr = (data.get("address") or "").strip() init_debt = float(data.get("initial_debt") or 0) if c_id > 0: cur.execute("UPDATE customers SET name = ?, phone = ?, address = ?, is_active = 1 WHERE id = ?", (name, phone, addr, c_id)) else: if not code: cur.execute("SELECT COALESCE(MAX(id), 0) + 1 FROM customers") code = f"KH{cur.fetchone()[0]:04d}" cur.execute("INSERT INTO customers (code, name, phone, address, initial_debt, current_debt, is_active) VALUES (?, ?, ?, ?, ?, ?, 1)", (code, name, phone, addr, init_debt, init_debt)) c_id = cur.lastrowid conn.commit() payload = {"id": c_id, "code": code, "name": name, "phone": phone, "address": addr, "initial_debt": init_debt} record_cloud_event("customer", "save", code, payload) self.send_json(200, {"status": "ok", "message": "Lưu khách hàng thành công!", "customer": payload}) finally: conn.close() return # PAY CUSTOMER DEBT if path == "/api/pay-customer-debt" or api == "pay-customer-debt": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} c_id = int(data.get("customer_id") or 0) amount = float(data.get("amount") or 0) acc_id = int(data.get("account_id") or 1) note = data.get("note", "Thu nợ khách hàng") conn = get_db_connection() if conn: try: cur = conn.cursor() cur.execute("SELECT name, code FROM customers WHERE id = ?", (c_id,)) row = cur.fetchone() if row: cust_name, cust_code = row[0], row[1] cur.execute("UPDATE customers SET current_debt = MAX(0, current_debt - ?) WHERE id = ?", (amount, c_id)) t_code = f"PT{datetime.now().strftime('%y%m%d')}{int(time.time()%1000):03d}" cur.execute("INSERT INTO cash_transactions (code, trans_type, account_id, amount, partner_type, partner_id, partner_name, category, note) VALUES (?, 'THU', ?, ?, 'CUSTOMER', ?, ?, 'Thu nợ khách hàng', ?)", (t_code, acc_id, amount, c_id, cust_name, note)) cur.execute("UPDATE cash_accounts SET current_balance = current_balance + ? WHERE id = ?", (amount, acc_id)) conn.commit() payload = {"customer_id": c_id, "customer_code": cust_code, "customer_name": cust_name, "amount": amount, "account_id": acc_id, "trans_code": t_code, "note": note} record_cloud_event("customer_debt_pay", "pay", cust_code, payload) finally: conn.close() self.send_json(200, {"status": "ok", "message": f"Đã thu {amount} đ nợ khách hàng thành công!"}) return # SAVE TRANSACTION if path == "/api/save-transaction" or api == "save-transaction": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} t_type = (data.get("trans_type") or "THU").upper() amt = float(data.get("amount") or 0) cat = data.get("category", "Thu khác" if t_type == "THU" else "Chi khác") p_name = data.get("partner_name", "") note = data.get("note", "") acc_id = int(data.get("account_id") or 1) conn = get_db_connection() if conn and amt > 0: try: cur = conn.cursor() prefix = "PT" if t_type == "THU" else "PC" code = f"{prefix}{datetime.now().strftime('%y%m%d')}{int(time.time()%1000):03d}" cur.execute("INSERT INTO cash_transactions (code, trans_type, account_id, amount, partner_name, category, note) VALUES (?, ?, ?, ?, ?, ?, ?)", (code, t_type, acc_id, amt, p_name, cat, note)) delta = amt if t_type == "THU" else -amt cur.execute("UPDATE cash_accounts SET current_balance = current_balance + ? WHERE id = ?", (delta, acc_id)) conn.commit() payload = {"code": code, "trans_type": t_type, "account_id": acc_id, "amount": amt, "category": cat, "partner_name": p_name, "note": note} record_cloud_event("transaction", "save", code, payload) finally: conn.close() self.send_json(200, {"status": "ok", "message": f"Đã tạo phiếu {t_type} thành công!"}) return # CANCEL INVOICE if path == "/api/cancel-invoice" or api == "cancel-invoice": if not self.check_auth(): self.send_json(401, {"status": "error", "error": "Unauthorized"}) return data = json.loads(raw_body.decode("utf-8")) if raw_body else {} inv_id = int(data.get("invoice_id") or 0) reason = data.get("reason", "Hủy từ Portal Online") conn = get_db_connection() if conn: try: cur = conn.cursor() cur.execute("SELECT code, customer_id, remaining_debt, status FROM sales_invoices WHERE id = ?", (inv_id,)) inv_row = cur.fetchone() if inv_row and inv_row[3] != "CANCELLED": code, c_id, r_debt = inv_row[0], inv_row[1], float(inv_row[2]) cur.execute("SELECT product_id, quantity FROM sales_invoice_items WHERE invoice_id = ?", (inv_id,)) for it in cur.fetchall(): cur.execute("UPDATE stock_balances SET quantity = quantity + ? WHERE product_id = ? AND warehouse_id = 1", (it[1], it[0])) if r_debt > 0 and c_id: cur.execute("UPDATE customers SET current_debt = MAX(0, current_debt - ?) WHERE id = ?", (r_debt, c_id)) cur.execute("UPDATE sales_invoices SET status = 'CANCELLED', note = note || ' [HỦY: ' || ? || ']' WHERE id = ?", (reason, inv_id)) conn.commit() record_cloud_event("invoice_cancel", "cancel", code, {"invoice_id": inv_id, "invoice_code": code, "reason": reason}) finally: conn.close() self.send_json(200, {"status": "ok", "message": "Đã hủy đơn hàng và hoàn lại tồn kho thành công!"}) return self.send_json(404, {"status": "error", "error": "Not Found"}) def run_server(port: int = 8000, host: str = "0.0.0.0"): server_address = (host, port) httpd = HTTPServer(server_address, CloudSyncHandler) print(f"=================================================================") print(f" CLOUD POS SYNC SERVER & WEB MANAGEMENT PORTAL 24/24") print(f" Listening on: http://{host}:{port}") print(f" Secret Key: {get_server_secret()}") print(f"=================================================================") try: httpd.serve_forever() except KeyboardInterrupt: print("\nShutting down server...") httpd.server_close() if __name__ == "__main__": parser = argparse.ArgumentParser(description="Cloud POS Sync Server") parser.add_argument("--port", type=int, default=int(os.environ.get("PORT", 8000)), help="Port to listen on") parser.add_argument("--host", type=str, default="0.0.0.0", help="Host address") parser.add_argument("--secret", type=str, default="", help="Sync Secret Key") args = parser.parse_args() if args.secret: set_server_secret(args.secret) run_server(port=args.port, host=args.host)