# Orders-CRUD — Implementation Tasks > Produced by the Reversa **Writer** (phase: generation) · doc_level: `complete` > Generated on 2026-09-21 **Confidence scale:** 🟢 CONFIRMED · 🟡 INFERRED · 🔴 GAP ## Prerequisites - [ ] `Order` model with `$fillable = ['notes','debt_amount']`, `$appends = ['code','is_editable','debt_locked']`, `$status = ['draft','done']`, `$prefix_id = '#QT78-'`, `$limit_hours_editable = 24`, and relations `customer()`/`products()` (`order_product` withPivot `qty,price,unit_id,conversion_qty`)/`debts()`. **No SoftDeletes.** 🟢 (`app/Models/Order.php:12-67`) - [ ] `Product` model with `code()` scope, `units()` relation, and `getPriceByCustomerType($type,$unitId)` (owned by `products-pricing`). 🟢 (`products-pricing`) - [ ] `Customer` model with `code()` (phone) scope, `points`, `type`, and `reversePointsForOrder(Order)`. 🟢 (`customers-crud`, `Customer.php:97-112`) - [ ] `CustomerDebt::record()` and `voidForOrder()` available (owned by `customers-debt-actions`). 🟢 (`CustomerDebt.php:38-64,83-144`) - [ ] `orders` and `order_product` tables per the data dictionary (`order_product.order_id` cascade; `customer_debts.order_id` set null). 🟢 (`data-dictionary.md:200-237,174`) - [ ] Admin route group `['web','admin']` + CSRF; the three pre-resource `/orders/*` routes (`scan`, `print`, `note`) registered **before** the resource. 🟢 (`routes/web.php:72-75`) ## Tasks > Each task references the legacy file the behaviour was extracted from. - [ ] T-01, Register `resource('/orders','OrderController')` in the admin group, **after** `/orders/scan`, `/orders/{order}/print`, and `PUT /orders/{order}/note`. - Legacy origin: `routes/web.php:72-75` - Done when: `index/store/show/update/destroy` resolve; `create`/`edit` are reachable but empty; the three named routes are not shadowed. - Confidence: 🟢 - [x] T-02, Implement `index`: `Order::with('customer')->orderBy('updated_at','desc')`, optional `q` (id / `#QT78-{id}` / customer phone, grouped closure) and `status` filter, `paginate(30)`, render `pages.orders`. - Legacy origin: `OrderController.php:21-47` - Done when: rows show code/customer/count/total/status newest-first; `?status=` narrows; `?q=` searches id/code/phone; pagination preserves the query string. - Confidence: 🟢 — ✅ Fixed 2026-09-21 (`q` block wrapped in a grouped closure; was ungrouped, letting an id/code match bypass `status`). - [ ] T-03, Implement the **totalling engine** (shared helper): iterate `items`, resolve each `Product::with('units')->code(code)->first()` (skip unknown), resolve `unit_id`→`ProductUnit` (null fallback), price via `getPriceByCustomerType`, accumulate `subtotal += round(price,1)*qty`, `earned_point += round(reward_point,1)*qty`, `count++` per line, and build pivot rows `{qty,price,unit_id,conversion_qty}`. - Legacy origin: `OrderController.php:92-117,261-288` - Done when: totals/points/count and pivot payloads match the engine for a mixed cart (known + unknown codes, base + converted units). - Confidence: 🟢 - [ ] T-04, Implement `store`: validate the payload (empty-cart message "Không thể tạo đơn hàng rỗng"), run the engine, `total = subtotal - discount_amount`, `paid = total`, apply the debt guard, associate customer, award points on `done`, save + attach pivots, record `pos_debt` on a done debt-bearing order, then route draft→POS / done→`pages.pos-print`. - Legacy origin: `OrderController.php:64-165` - Done when: a valid done order persists with correct totals/pivots, awards points once, posts one `pos_debt`, and renders the receipt; a draft toasts + redirects to POS. - Confidence: 🟢 - [ ] T-05, Enforce the debt guard: `debt_amount > 0` requires a customer (else redirect + "Phải chọn khách hàng khi có tiền nợ."); `debt_amount > total` → redirect + "Số tiền nợ không được lớn hơn tổng tiền hàng."; nothing persisted on either. - Legacy origin: `OrderController.php:121-131,294-306` - Done when: both violations short-circuit before persistence with the exact messages. - Confidence: 🟢 - [ ] T-06, Implement the **award-once** points rule: on `done` with a customer, `customer.points += earned_point` and stamp `points_awarded_at`; in `update` only when `points_awarded_at` is null. - Legacy origin: `OrderController.php:136-140,311-315` - Done when: finalising twice (done→draft→done) credits points exactly once. - Confidence: 🟢 - [ ] T-07, Implement the **post-once** debt rule via `debt_locked`: record `pos_debt` only when done + customer + `debt_amount > 0` and no prior `pos_debt` row; freeze `debt_amount` on edit when `debt_locked`. - Legacy origin: `OrderController.php:149-151,296,321-323`; `Order.php:65-67` - Done when: a debt-bearing order posts one ledger row; a subsequent edit neither re-posts nor changes `debt_amount`. - Confidence: 🟢 - [ ] T-08, Implement `show`: `Order::findOrFail($id)` → `pages.orders-detail` (404 on unknown). - Legacy origin: `OrderController.php:173-184` - Done when: a valid id renders detail; an unknown id returns 404. - Confidence: 🟢 - [ ] T-09, Implement `update` (`$id, Request` arg order): validate (`items` `required_without:create_now_mode`), `findOrFail`, capture `debtLocked`, handle `create_now_mode` (rebuild items from pivots), enforce `is_editable` (24h window), pick the customer source by status, re-run the engine, detach + re-attach pivots, apply/freeze debt, award points once, save, record `pos_debt` when applicable, route draft→POS / done→receipt. - Legacy origin: `OrderController.php:204-337` - Done when: an editable order recomputes correctly; a done order older than 24h is refused with "Không thể cập nhật đơn hàng hoàn thành quá 24h"; `create_now_mode` finalises a stored draft. - Confidence: 🟢 - [ ] T-10, Implement `destroy`: `Order::find($id)`, then inside `DB::transaction` call `Customer::reversePointsForOrder`, `CustomerDebt::voidForOrder`, and `order->delete()` (hard); return `{status,message}` JSON using `trans('admin.delete_succeeded'|'delete_failed')`. - Legacy origin: `OrderController.php:362-383` - Done when: deleting a done order reverses points (clamped ≥ 0), inserts `debt_void`, hard-deletes order + pivots, and returns `{status:true}`; an unknown id returns `{status:false}` (not 404). - Confidence: 🟢 - [ ] T-11, Render `pages.orders` (list): status `