add product

apps/shop/admin.py

@@ -1,40 +1,133 @@
+from utils.admin_base import CRMModelAdmin
+from utils.admin_excel import excel_response
+from apps.shop.admin_import import ProductImportAdminMixin
+from apps.shop.import_models import ProductImportBatch
+
 from django.contrib import admin
-from apps.shop.models import (
-    ProductCategory as ProductCategoryModel,
-    Product as ProductModel,
-    Order as OrderModel,
-    OrderItem as OrderItemModel,
-    Cart as CartModel,
-    ProductType as ProductTypeModel
-)
-# Register your models here.
+from django.urls import reverse
+from django.utils.html import format_html
+
+from apps.shop.models import ProductCategory, Product, Order, OrderItem, Cart, ProductType
+from apps.shop.ordering import category_ordering, product_ordering
 
 
-@admin.register(ProductTypeModel)
-class ProductTypeAdmin(admin.ModelAdmin):
+def export_products(queryset):
+    headers = ('فضای کاری', 'دسته', 'محصول', 'کد محصول', 'قیمت', 'ترتیب نمایش دسته', 'ترتیب نمایش محصول', 'ترتیب اکسل دسته', 'ترتیب اکسل محصول', 'فقط نمایش', 'ویژگی‌ها')
+    categories = {category.pk: (category.name, category.parent_id) for category in
+                  ProductCategory.objects.filter(sys_ws_id__in=queryset.values('sys_ws_id'))}
+    def path(category_id):
+        names, visited = [], set()
+        while category_id in categories and category_id not in visited:
+            visited.add(category_id)
+            name, category_id = categories[category_id]
+            names.append(name)
+        return '/'.join(reversed(names))
+    rows = ((item.sys_ws.name, path(item.category_id), item.name, item.acc_code, item.price,
+             item.category.order_cat, item.order_prd, item.category.excel_order, item.excel_order,
+             item.view_only, item.attr) for item in queryset.select_related('sys_ws', 'category').iterator())
+    return excel_response(headers, rows, 'products.xlsx')
+
+
+class ProductInline(admin.TabularInline):
+    model = Product
+    fields = ('name', 'price', 'order_prd', 'excel_order')
+    extra = 0
+    show_change_link = True
+    readonly_fields = ('name', 'price')
+    can_delete = False
+
+    def has_add_permission(self, request, obj=None):
+        return False
+
+
+@admin.register(ProductType)
+class ProductTypeAdmin(CRMModelAdmin):
     pass
 
 
-@admin.register(ProductCategoryModel)
-class ProductCategoryAdmin(admin.ModelAdmin):
-    pass
+@admin.register(ProductCategory)
+class ProductCategoryAdmin(CRMModelAdmin):
+    list_display = ('name', 'sys_ws', 'parent', 'order_cat', 'excel_order')
+    list_editable = ('order_cat', 'excel_order')
+    list_filter = ('sys_ws',)
+    search_fields = ('name',)
+    inlines = (ProductInline,)
+    actions = ('export_display_order', 'export_excel_order')
+
+    @admin.action(description='خروجی اکسل دسته‌ها با ترتیب نمایش فعلی')
+    def export_display_order(self, request, queryset):
+        return self.export_categories(queryset)
+
+    @admin.action(description='خروجی اکسل دسته‌ها با ترتیب مستقل اکسل')
+    def export_excel_order(self, request, queryset):
+        return self.export_categories(queryset.order_by(*category_ordering(excel=True)))
+
+    def export_categories(self, queryset):
+        return excel_response(('فضای کاری', 'دسته', 'ترتیب نمایش', 'ترتیب اکسل'),
+                              queryset.values_list('sys_ws__name', 'name', 'order_cat', 'excel_order'), 'categories.xlsx')
 
 
-@admin.register(ProductModel)
-class ProductAdmin(admin.ModelAdmin):
-    search_fields = ("name", "category__name", "acc_code")
+@admin.register(Product)
+class ProductAdmin(ProductImportAdminMixin, CRMModelAdmin):
+    list_display = ('name', 'category', 'sys_ws', 'price', 'order_prd', 'excel_order', 'view_only')
+    list_editable = ('order_prd', 'excel_order')
+    list_filter = ('sys_ws', 'category', 'view_only')
+    search_fields = ('name', 'category__name', 'acc_code')
+    list_select_related = ('category', 'sys_ws')
+    actions = ('export_display_order', 'export_excel_order')
+
+    @admin.action(description='خروجی اکسل محصولات با ترتیب نمایش فعلی')
+    def export_display_order(self, request, queryset):
+        return export_products(queryset)
+
+    @admin.action(description='خروجی اکسل محصولات با ترتیب مستقل اکسل')
+    def export_excel_order(self, request, queryset):
+        return export_products(queryset.order_by(*product_ordering(excel=True)))
 
 
-@admin.register(OrderModel)
-class OrderAdmin(admin.ModelAdmin):
-    pass
+@admin.register(Order)
+class OrderAdmin(CRMModelAdmin):
+    list_display = ('id', 'customer', 'sys_ws', 'total_price', 'factor_type', 'factor_status', 'view_at', 'created_at')
 
 
-@admin.register(OrderItemModel)
-class OrderItemAdmin(admin.ModelAdmin):
-    pass
+@admin.register(OrderItem)
+class OrderItemAdmin(CRMModelAdmin):
+    list_display = ('id', 'order', 'product', 'product_name', 'price', 'amount')
+    search_fields = ('product_name', 'product__name', 'order__customer__name_family')
 
 
-@admin.register(CartModel)
-class CartAdmin(admin.ModelAdmin):
-    pass
+@admin.register(Cart)
+class CartAdmin(CRMModelAdmin):
+    list_display = ('id', 'cuser_role', 'product', 'quantity', 'sys_ws', 'updated_at')
+
+
+@admin.register(ProductImportBatch)
+class ProductImportBatchAdmin(CRMModelAdmin):
+    list_display = ("id", "filename", "sys_ws", "created_by", "summary", "created_at", "confirmed_at")
+    search_fields = ("filename", "created_by__username")
+    exclude = ("payload", "fingerprint", "result")
+    sensitive_fields = ("payload", "fingerprint", "result")
+    actions = None
+
+    def get_readonly_fields(self, request, obj=None):
+        fields = tuple(field.name for field in self.model._meta.fields if field.name not in self.exclude)
+        return (*fields, 'summary', 'report_link') if obj and obj.created_by_id == request.user.pk else (*fields, 'summary')
+
+    @admin.display(description='خلاصه نتیجه')
+    def summary(self, obj):
+        result = obj.result
+        status = 'ثبت نهایی' if obj.confirmed_at else 'پیش‌نمایش'
+        return f"{status} | ایجاد: {result.get('created', 0)} | به‌روزرسانی: {result.get('updated', 0)} | خطا: {result.get('errors', 0)}"
+
+    @admin.display(description='گزارش ردیف‌ها')
+    def report_link(self, obj):
+        return format_html('<a href="{}">دریافت اکسل گزارش</a>', reverse('admin:shop_product_import_report', args=[obj.pk]))
+
+    def has_add_permission(self, request):
+        return False
+
+    def has_change_permission(self, request, obj=None):
+        return False
+
+    def has_delete_permission(self, request, obj=None):
+        return False

apps/shop/admin_import.py

@@ -0,0 +1,113 @@
+import json
+
+from django import forms
+from django.core.exceptions import PermissionDenied, ValidationError
+from django.shortcuts import get_object_or_404
+from django.template.response import TemplateResponse
+from django.urls import path
+
+from apps.shop.import_models import ProductImportBatch
+from apps.shop.product_import import HEADERS, parse_workbook
+from apps.shop.import_batches import preview_batch, confirm_batch
+from apps.workspace.models import Workspace
+from utils.admin_excel import excel_response
+
+
+class ProductImportForm(forms.Form):
+    workspace = forms.ModelChoiceField(label='فضای کاری مقصد', queryset=Workspace.objects.all())
+    file = forms.FileField(label='فایل xlsx')
+    sheet = forms.CharField(label='نام برگه (خالی = اولین برگه)', required=False)
+    header_row = forms.IntegerField(label='شماره ردیف سرستون', min_value=1, max_value=100, initial=1)
+    mode = forms.ChoiceField(label='نوع ورود', choices=(('create', 'فقط ایجاد'), ('upsert', 'ایجاد و به‌روزرسانی'), ('update', 'فقط به‌روزرسانی')))
+    create_categories = forms.BooleanField(label='ساخت دسته‌های ناموجود', required=False, initial=True)
+    errors = forms.ChoiceField(label='مدیریت خطا', choices=(('atomic', 'در صورت هر خطا، هیچ ردیفی ثبت نشود'), ('skip', 'فقط ردیف‌های معتبر ثبت شوند')))
+    ordering = forms.ChoiceField(label='ترتیب نمایش محصولات', choices=(('preserve', 'مقادیر فایل؛ خالی = حفظ مقدار فعلی'), ('rows', 'ترتیب ردیف فایل برای مقادیر خالی'), ('append', 'محصول جدید در انتهای دسته')))
+    mapping = forms.CharField(label='نگاشت اختیاری ستون‌ها (JSON)', required=False, widget=forms.Textarea(attrs={'rows': 3}),
+                              help_text='مثال: {"name": "عنوان کالا", "category": "گروه", "acc_code": "شناسه"}')
+
+    def clean_mapping(self):
+        try:
+            value = json.loads(self.cleaned_data['mapping'] or '{}')
+            if not isinstance(value, dict) or not all(isinstance(key, str) and isinstance(item, str) for key, item in value.items()):
+                raise ValueError
+            return value
+        except ValueError:
+            raise forms.ValidationError('یک شیء JSON با کلید و مقدار متنی وارد کنید.')
+
+
+class ProductImportAdminMixin:
+    change_list_template = 'admin/shop/product/change_list.html'
+
+    def import_allowed(self, request):
+        return (self.has_add_permission(request) and self.has_change_permission(request)
+                and request.user.has_perm('shop.view_productcategory'))
+
+    def get_urls(self):
+        return [path('import-excel/', self.admin_site.admin_view(self.import_view), name='shop_product_import'),
+                path('import-template/', self.admin_site.admin_view(self.import_template), name='shop_product_import_template'),
+                path('import-report/<int:batch_id>/', self.admin_site.admin_view(self.import_report), name='shop_product_import_report')] + super().get_urls()
+
+    def changelist_view(self, request, extra_context=None):
+        return super().changelist_view(request, dict(extra_context or {}, can_import=self.import_allowed(request)))
+
+    def import_template(self, request):
+        if not self.import_allowed(request):
+            raise PermissionDenied
+        return excel_response(HEADERS.keys(), [('محصول نمونه', 'دسته اصلی/زیردسته', 'CODE-001', 1000, 1, 1, 1, 1, False, '{}', 'عدد')], 'product-import-template.xlsx')
+
+    def import_report(self, request, batch_id):
+        if not self.import_allowed(request):
+            raise PermissionDenied
+        batch = get_object_or_404(ProductImportBatch, pk=batch_id, created_by=request.user)
+        rows = ((row['row'], *(row['values'].get(key) for key in HEADERS), row['status'], row['errors'])
+                for row in batch.result.get('rows', []))
+        return excel_response(('ردیف', *HEADERS, 'وضعیت', 'خطاها'), rows, f'import-report-{batch.pk}.xlsx')
+
+    def import_view(self, request):
+        if not self.import_allowed(request):
+            raise PermissionDenied
+        form = ProductImportForm(request.POST or None, request.FILES or None)
+        batch, problem = None, None
+        if request.method == 'POST':
+            if request.POST.get('confirm'):
+                try:
+                    batch = self.confirm_import(request)
+                except ValidationError as error:
+                    problem = '؛ '.join(error.messages)
+            elif form.is_valid():
+                try:
+                    batch = self.preview_import(request, form.cleaned_data)
+                except ValidationError as error:
+                    form.add_error(None, error)
+        context = dict(self.admin_site.each_context(request), opts=self.model._meta, title='ورود محصولات از اکسل',
+                       form=form, batch=batch, problem=problem,
+                       result=batch.result if batch else None, can_confirm=batch and not batch.confirmed_at
+                       and (batch.payload['options']['errors'] == 'skip' or not batch.result['errors']))
+        return TemplateResponse(request, 'admin/shop/product/import.html', context)
+
+    def preview_import(self, request, data):
+        if data['create_categories'] and not request.user.has_perm('shop.add_productcategory'):
+            raise PermissionDenied
+        # Category-order permission is checked against the parsed file before preview writes.
+        rows = parse_workbook(data['file'], data['sheet'], data['header_row'], data['mapping'])
+        if any(row['values'].get(key) for row in rows for key in ('order_cat', 'category_excel_order')):
+            if not request.user.has_perm('shop.change_productcategory'):
+                raise PermissionDenied
+        data['file'].seek(0)
+        options = {key: data[key] for key in ('mode', 'create_categories', 'errors', 'ordering')}
+        return preview_batch(request.user, data['workspace'], data['file'], options,
+                             data['sheet'], data['header_row'], data['mapping'])
+
+    def confirm_import(self, request):
+        try:
+            batch_id = int(request.POST['batch_id'])
+        except (KeyError, ValueError, TypeError):
+            raise ValidationError('شناسه پیش‌نمایش معتبر نیست.')
+        batch = get_object_or_404(ProductImportBatch, pk=batch_id, created_by=request.user)
+        options = batch.payload['options']
+        if options['create_categories'] and not request.user.has_perm('shop.add_productcategory'):
+            raise PermissionDenied
+        if any(row['values'].get(key) for row in batch.payload['rows'] for key in ('order_cat', 'category_excel_order')):
+            if not request.user.has_perm('shop.change_productcategory'):
+                raise PermissionDenied
+        return confirm_batch(batch_id, request.user)

apps/shop/import_batches.py

@@ -0,0 +1,59 @@
+"""Shared import lifecycle; callers enforce their own admin permission boundary."""
+import json
+from datetime import timedelta
+from django.contrib.admin.models import LogEntry, ADDITION
+from django.contrib.contenttypes.models import ContentType
+from django.core.exceptions import ValidationError
+from django.db import transaction
+from django.shortcuts import get_object_or_404
+from django.utils import timezone
+
+from apps.shop.import_models import ProductImportBatch
+from apps.shop.models import Product
+from apps.shop.product_import import parse_workbook, import_products, catalog_fingerprint, lock_catalog, HEADERS
+from utils.admin_excel import excel_response
+
+
+@transaction.atomic
+def preview_batch(owner, workspace, upload, options, sheet='', header_row=1, mapping=None):
+    rows = parse_workbook(upload, sheet, header_row, mapping)
+    lock_catalog(workspace)
+    fingerprint = catalog_fingerprint(workspace)
+    result = import_products(workspace, rows, options, dry_run=True)
+    return ProductImportBatch.objects.create(sys_ws=workspace, created_by=owner,
+        expires_at=timezone.now()+timedelta(minutes=30), filename=upload.name[:255],
+        fingerprint=fingerprint, payload={'rows': rows, 'options': options}, result=result)
+
+
+@transaction.atomic
+def confirm_batch(batch_id, owner, workspace=None):
+    queryset = ProductImportBatch.objects.select_for_update().filter(created_by=owner)
+    if workspace is not None:
+        queryset = queryset.filter(sys_ws=workspace)
+    batch = get_object_or_404(queryset, pk=batch_id)
+    if batch.confirmed_at:
+        return batch
+    if batch.expires_at <= timezone.now():
+        raise ValidationError('پیش‌نمایش منقضی شده؛ فایل را دوباره اعتبارسنجی کنید.')
+    lock_catalog(batch.sys_ws)
+    if catalog_fingerprint(batch.sys_ws) != batch.fingerprint:
+        raise ValidationError('محصولات یا دسته‌ها پس از پیش‌نمایش تغییر کرده‌اند؛ پیش‌نمایش تازه بسازید.')
+    result = import_products(batch.sys_ws, batch.payload['rows'], batch.payload['options'])
+    batch.result = result
+    if result['committed']:
+        batch.confirmed_at = timezone.now()
+        LogEntry.objects.log_action(user_id=owner.pk, content_type_id=ContentType.objects.get_for_model(Product).pk,
+            object_id=None, object_repr=f'Excel import #{batch.pk}', action_flag=ADDITION,
+            change_message=json.dumps({'import': batch.pk, 'created': result['created'], 'updated': result['updated'], 'errors': result['errors']}))
+    batch.save(update_fields=('result', 'confirmed_at'))
+    return batch
+
+
+def batch_report(batch):
+    rows = ((row['row'], *(row['values'].get(key) for key in HEADERS), row['status'], row['errors'])
+            for row in batch.result.get('rows', []))
+    return excel_response(('ردیف', *HEADERS, 'وضعیت', 'خطاها'), rows, f'import-report-{batch.pk}.xlsx')
+
+
+def import_template():
+    return excel_response(HEADERS.keys(), [('محصول نمونه', 'دسته اصلی/زیردسته', 'CODE-001', 1000, 1, 1, 1, 1, False, '{}', 'عدد')], 'product-import-template.xlsx')

apps/shop/import_models.py

@@ -0,0 +1,22 @@
+from django.conf import settings
+from django.db import models
+
+
+class ProductImportBatch(models.Model):
+    sys_ws = models.ForeignKey('workspace.Workspace', on_delete=models.CASCADE)
+    created_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.PROTECT)
+    created_at = models.DateTimeField(auto_now_add=True)
+    expires_at = models.DateTimeField()
+    confirmed_at = models.DateTimeField(null=True, blank=True)
+    filename = models.CharField(max_length=255)
+    fingerprint = models.CharField(max_length=64)
+    payload = models.JSONField()
+    result = models.JSONField(default=dict)
+
+    class Meta:
+        ordering = ('-pk',)
+        verbose_name = 'ورود اکسل محصولات'
+        verbose_name_plural = 'سوابق ورود اکسل محصولات'
+
+    def __str__(self):
+        return f'{self.pk}: {self.filename}'

apps/shop/management_serializers.py

@@ -0,0 +1,89 @@
+from rest_framework import serializers
+
+from apps.shop.models import Product, ProductCategory
+
+
+class CategoryManagementSerializer(serializers.ModelSerializer):
+    order_cat = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+    excel_order = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+    product_count = serializers.IntegerField(read_only=True)
+    child_count = serializers.IntegerField(read_only=True)
+    parent = serializers.PrimaryKeyRelatedField(queryset=ProductCategory.objects.all(), allow_null=True, required=False)
+
+    class Meta:
+        model = ProductCategory
+        fields = ('id', 'name', 'parent', 'image', 'order_cat', 'excel_order', 'product_count', 'child_count')
+
+    def validate(self, attrs):
+        workspace = self.context['workspace']
+        parent = attrs.get('parent', self.instance.parent if self.instance else None)
+        if parent and parent.sys_ws_id != workspace.pk:
+            raise serializers.ValidationError({'parent': 'دسته والد متعلق به فضای کاری دیگری است.'})
+        visited = set()
+        cursor = parent
+        while cursor:
+            if cursor.pk in visited or self.instance and cursor.pk == self.instance.pk:
+                raise serializers.ValidationError({'parent': 'انتخاب این والد باعث چرخه در دسته‌ها می‌شود.'})
+            visited.add(cursor.pk)
+            cursor = cursor.parent
+        name = attrs.get('name', self.instance.name if self.instance else '')
+        matches = ProductCategory.objects.filter(sys_ws=workspace, name=name, parent=parent)
+        if self.instance:
+            matches = matches.exclude(pk=self.instance.pk)
+        if matches.exists():
+            raise serializers.ValidationError({'name': 'این نام در همین دسته والد قبلاً ثبت شده است.'})
+        return attrs
+
+
+class ProductManagementSerializer(serializers.ModelSerializer):
+    order_prd = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+    excel_order = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+    category_name = serializers.CharField(source='category.name', read_only=True)
+    price = serializers.IntegerField(min_value=0, max_value=9223372036854775807)
+    category = serializers.PrimaryKeyRelatedField(queryset=ProductCategory.objects.all())
+    acc_code = serializers.CharField(required=False, allow_blank=True, allow_null=True)
+
+    class Meta:
+        model = Product
+        fields = ('id', 'name', 'price', 'category', 'category_name', 'acc_code', 'attr', 'view_only', 'order_prd', 'excel_order', 'created_at', 'updated_at')
+        read_only_fields = ('id', 'created_at', 'updated_at')
+
+    def validate_category(self, category):
+        if category.sys_ws_id != self.context['workspace'].pk:
+            raise serializers.ValidationError('دسته متعلق به فضای کاری دیگری است.')
+        return category
+
+    def validate_acc_code(self, code):
+        if code:
+            matches = Product.objects.filter(sys_ws=self.context['workspace'], acc_code=code)
+            if self.instance:
+                matches = matches.exclude(pk=self.instance.pk)
+            if matches.exists():
+                raise serializers.ValidationError('کد محصول در این فضای کاری تکراری است.')
+        return code
+
+    def validate_attr(self, value):
+        if value is not None and not isinstance(value, dict):
+            raise serializers.ValidationError('ویژگی‌ها باید یک شیء JSON باشد.')
+        return value
+
+    def to_representation(self, instance):
+        data = super().to_representation(instance)
+        data['price'] = str(instance.price)
+        return data
+
+
+class ImportOptionsSerializer(serializers.Serializer):
+    file = serializers.FileField()
+    sheet = serializers.CharField(required=False, allow_blank=True, default='')
+    header_row = serializers.IntegerField(min_value=1, max_value=100, default=1)
+    mode = serializers.ChoiceField(choices=('create', 'upsert', 'update'), default='create')
+    create_categories = serializers.BooleanField(default=True)
+    errors = serializers.ChoiceField(choices=('atomic', 'skip'), default='atomic')
+    ordering = serializers.ChoiceField(choices=('preserve', 'rows', 'append'), default='preserve')
+    mapping = serializers.JSONField(default=dict)
+
+    def validate_mapping(self, value):
+        if not isinstance(value, dict) or not all(isinstance(key, str) and isinstance(item, str) for key, item in value.items()):
+            raise serializers.ValidationError('نگاشت ستون‌ها باید شیء JSON با مقدارهای متنی باشد.')
+        return value

apps/shop/migrations/0021_product_display_excel_ordering.py

@@ -0,0 +1,41 @@
+# Generated by Django 4.2.1 on 2026-10-08 08:48
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('shop', '0020_product_view_only'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='product',
+            options={'ordering': (models.OrderBy(models.F('category__order_cat'), nulls_last=True), 'category__name', 'category__pk', models.OrderBy(models.F('order_prd'), nulls_last=True), 'name', 'pk')},
+        ),
+        migrations.AlterModelOptions(
+            name='productcategory',
+            options={'ordering': (models.OrderBy(models.F('order_cat'), nulls_last=True), 'name', 'pk')},
+        ),
+        migrations.AddField(
+            model_name='product',
+            name='excel_order',
+            field=models.PositiveIntegerField(blank=True, default=None, help_text='عدد کمتر زودتر نمایش داده می\u200cشود؛ خالی یعنی استفاده از ترتیب نمایش.', null=True, verbose_name='ترتیب محصول در اکسل'),
+        ),
+        migrations.AddField(
+            model_name='productcategory',
+            name='excel_order',
+            field=models.PositiveIntegerField(blank=True, default=None, help_text='عدد کمتر زودتر نمایش داده می\u200cشود؛ خالی یعنی استفاده از ترتیب نمایش.', null=True, verbose_name='ترتیب دسته در اکسل'),
+        ),
+        migrations.AlterField(
+            model_name='product',
+            name='order_prd',
+            field=models.PositiveIntegerField(blank=True, default=None, null=True, verbose_name='ترتیب نمایش محصول'),
+        ),
+        migrations.AlterField(
+            model_name='productcategory',
+            name='order_cat',
+            field=models.PositiveIntegerField(blank=True, default=None, null=True, verbose_name='ترتیب نمایش دسته'),
+        ),
+    ]

apps/shop/migrations/0022_productimportbatch.py

@@ -0,0 +1,37 @@
+# Generated by Django 4.2.1 on 2026-10-08 09:52
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('workspace', '0016_remove_workspace_cuser_owner'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('shop', '0021_product_display_excel_ordering'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='ProductImportBatch',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('expires_at', models.DateTimeField()),
+                ('confirmed_at', models.DateTimeField(blank=True, null=True)),
+                ('filename', models.CharField(max_length=255)),
+                ('fingerprint', models.CharField(max_length=64)),
+                ('payload', models.JSONField()),
+                ('result', models.JSONField(default=dict)),
+                ('created_by', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL)),
+                ('sys_ws', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='workspace.workspace')),
+            ],
+            options={
+                'verbose_name': 'ورود اکسل محصولات',
+                'verbose_name_plural': 'سوابق ورود اکسل محصولات',
+                'ordering': ('-pk',),
+            },
+        ),
+    ]

apps/shop/models.py

@@ -1,8 +1,10 @@
 from django.db import models
+from apps.shop.import_models import ProductImportBatch
 from utils.base_model import BaseModel
 from apps.workspace.models import Workspace as WorkspaceModel
 from apps.cuser.models import CuserRole as CuserRoleModel
 from apps.customer.models import ResponsibleGroup as ResponsibleGroupModel, Customer as CustomerModel
+from apps.shop.ordering import category_ordering, product_ordering
 # Create your models here.
 
 
@@ -18,9 +20,14 @@ class ProductCategory(BaseModel):
     name = models.CharField(max_length=60, null=False, blank=False)
     parent = models.ForeignKey('self', on_delete=models.CASCADE, null=True, blank=True)
     image = models.ImageField(null=True, blank=True, default=None, upload_to='product-cat/')
-    order_cat = models.PositiveIntegerField(null=True, blank=True, default=None)
+    order_cat = models.PositiveIntegerField('ترتیب نمایش دسته', null=True, blank=True, default=None)
+    excel_order = models.PositiveIntegerField('ترتیب دسته در اکسل', null=True, blank=True, default=None,
+                                             help_text='عدد کمتر زودتر نمایش داده می‌شود؛ خالی یعنی استفاده از ترتیب نمایش.')
     sys_ws = models.ForeignKey(WorkspaceModel, on_delete=models.CASCADE, null=False, blank=False)
 
+    class Meta:
+        ordering = category_ordering()
+
     def __str__(self):
         return f'{self.name}'
 
@@ -30,12 +37,17 @@ class Product(BaseModel):
     price = models.PositiveBigIntegerField(null=False, blank=False)
     category = models.ForeignKey(ProductCategory, on_delete=models.CASCADE, null=False, blank=False)
     acc_code = models.CharField(null=True, blank=True)
-    order_prd = models.PositiveIntegerField(null=True, blank=True, default=None)
+    order_prd = models.PositiveIntegerField('ترتیب نمایش محصول', null=True, blank=True, default=None)
+    excel_order = models.PositiveIntegerField('ترتیب محصول در اکسل', null=True, blank=True, default=None,
+                                             help_text='عدد کمتر زودتر نمایش داده می‌شود؛ خالی یعنی استفاده از ترتیب نمایش.')
     attr = models.JSONField(null=True, blank=True)
     view_only = models.BooleanField(null=True, blank=True, default=False)
 
     sys_ws = models.ForeignKey(WorkspaceModel, on_delete=models.CASCADE, null=False, blank=False)
 
+    class Meta:
+        ordering = product_ordering()
+
     def __str__(self):
         return f'{self.name}'
 

apps/shop/ordering.py

@@ -0,0 +1,18 @@
+from django.db.models import F
+from django.db.models.functions import Coalesce
+
+
+def category_ordering(prefix='', excel=False):
+    field = F(prefix + 'order_cat')
+    if excel:
+        field = Coalesce(prefix + 'excel_order', prefix + 'order_cat')
+    return (field.asc(nulls_last=True), prefix + 'name', prefix + 'pk')
+
+
+def product_ordering(prefix='', excel=False):
+    field = F(prefix + 'order_prd')
+    if excel:
+        field = Coalesce(prefix + 'excel_order', prefix + 'order_prd')
+    return category_ordering(prefix + 'category__', excel) + (
+        field.asc(nulls_last=True), prefix + 'name', prefix + 'pk',
+    )

apps/shop/product_import.py

@@ -0,0 +1,274 @@
+"""Bounded Excel parsing and transactional product import, shared by admin views."""
+import hashlib
+import json
+from decimal import Decimal, InvalidOperation
+from io import BytesIO
+from zipfile import ZipFile
+
+from django.core.exceptions import ValidationError
+from django.db import DataError, IntegrityError, transaction
+from django.db.models import Max
+from openpyxl import load_workbook
+
+from apps.shop.models import Product, ProductCategory
+from apps.workspace.models import Workspace
+
+MAX_ROWS = 5000
+MAX_FILE_BYTES = 2 * 1024 * 1024
+HEADERS = {
+    'name': ('name', 'محصول', 'نام محصول'),
+    'category': ('category', 'cate_name', 'دسته', 'مسیر دسته'),
+    'acc_code': ('acc_code', 'کد محصول', 'کد'),
+    'price': ('price', 'قیمت'),
+    'order_prd': ('order_prd', 'size', 'ترتیب نمایش محصول'),
+    'excel_order': ('excel_order', 'ترتیب اکسل محصول'),
+    'order_cat': ('order_cat', 'ترتیب نمایش دسته'),
+    'category_excel_order': ('category_excel_order', 'ترتیب اکسل دسته'),
+    'view_only': ('view_only', 'فقط نمایش'),
+    'attr': ('attr', 'ویژگی‌ها'),
+    'unit': ('unit', 'vahed', 'واحد'),
+}
+DIGITS = str.maketrans('۰۱۲۳۴۵۶۷۸۹٠١٢٣٤٥٦٧٨٩', '01234567890123456789')
+
+
+def text_value(value):
+    if value is None:
+        return ''
+    if isinstance(value, float) and value.is_integer():
+        return str(int(value))
+    return str(value).strip()
+
+
+def integer_value(value, field, maximum=2147483647):
+    try:
+        number = Decimal(text_value(value).translate(DIGITS).replace(',', '').replace('٬', ''))
+        if not number.is_finite() or number != number.to_integral_value() or not 0 <= number <= maximum:
+            raise InvalidOperation
+        return int(number)
+    except (InvalidOperation, ValueError):
+        raise ValidationError({field: 'عدد صحیح نامنفی در محدوده مجاز وارد کنید.'})
+
+
+def boolean_value(value):
+    normalized = text_value(value).translate(DIGITS).lower()
+    if normalized in ('1', 'true', 'yes', 'بله'):
+        return True
+    if normalized in ('0', 'false', 'no', 'خیر'):
+        return False
+    raise ValidationError({'view_only': 'مقدار بله/خیر یا true/false وارد کنید.'})
+
+
+def parse_workbook(upload, sheet_name='', header_row=1, mapping=None):
+    """Never evaluate formula cells; cap compressed and uncompressed workbook sizes."""
+    if not upload.name.lower().endswith('.xlsx'):
+        raise ValidationError('فقط فایل xlsx پذیرفته می‌شود؛ فایل xls را به xlsx تبدیل کنید.')
+    content = upload.read(MAX_FILE_BYTES + 1)
+    if len(content) > MAX_FILE_BYTES:
+        raise ValidationError('حداکثر حجم فایل ۲ مگابایت است.')
+    try:
+        with ZipFile(BytesIO(content)) as archive:
+            if sum(item.file_size for item in archive.infolist()) > 25 * 1024 * 1024:
+                raise ValidationError('حجم بازشده فایل بیش از حد مجاز است.')
+        book = load_workbook(BytesIO(content), read_only=True, data_only=False)
+    except ValidationError:
+        raise
+    except Exception:
+        # Workbook parsers raise several XML/ZIP-specific exception types.
+        raise ValidationError('فایل اکسل خراب است یا ساختار معتبر ندارد.')
+    try:
+        if sheet_name and sheet_name not in book.sheetnames:
+            raise ValidationError('برگه انتخاب‌شده در فایل وجود ندارد.')
+        sheet = book[sheet_name] if sheet_name else book.worksheets[0]
+        if sheet.max_row and sheet.max_row > header_row + MAX_ROWS:
+            raise ValidationError('حداکثر ۵۰۰۰ ردیف پس از سرستون مجاز است؛ ردیف‌های خالی انتهای فایل را حذف کنید.')
+        if sheet.max_column and sheet.max_column > 100:
+            raise ValidationError('حداکثر ۱۰۰ ستون مجاز است.')
+        iterator = sheet.iter_rows(min_row=header_row, max_row=header_row + MAX_ROWS + 1, max_col=100)
+        headers = [text_value(cell.value) for cell in next(iterator, ())]
+        indexes = resolve_headers(headers, mapping or {})
+        rows = []
+        for number, cells in enumerate(iterator, header_row + 1):
+            if not any(cell.value is not None for cell in cells):
+                continue
+            if number > header_row + MAX_ROWS:
+                raise ValidationError('حداکثر ۵۰۰۰ ردیف پس از سرستون مجاز است.')
+            values = {key: text_value(cells[index].value) for key, index in indexes.items()}
+            formulas = [key for key, index in indexes.items() if cells[index].data_type == 'f']
+            rows.append({'row': number, 'values': values, 'formulas': formulas})
+        if not rows:
+            raise ValidationError('فایل ردیف محصول ندارد.')
+        return rows
+    except ValidationError:
+        raise
+    except Exception:
+        raise ValidationError('محتوای برگه اکسل خراب است یا خوانده نمی‌شود.')
+    finally:
+        book.close()
+
+
+def resolve_headers(headers, mapping):
+    if set(mapping) - set(HEADERS):
+        raise ValidationError('کلید نگاشت ستون ناشناخته است.')
+    indexes = {}
+    for key, aliases in HEADERS.items():
+        names = (mapping[key],) if key in mapping else aliases
+        matches = [index for index, name in enumerate(headers) if name and name in names]
+        if len(matches) > 1:
+            raise ValidationError(f'ستون {key} تکراری یا مبهم است.')
+        if matches:
+            indexes[key] = matches[0]
+    if len(set(indexes.values())) != len(indexes):
+        raise ValidationError('یک ستون به چند فیلد نگاشت شده است.')
+    if not {'name', 'category', 'acc_code'}.issubset(indexes):
+        raise ValidationError('ستون‌های نام محصول، دسته و کد محصول الزامی هستند.')
+    return indexes
+
+
+def catalog_fingerprint(workspace):
+    """Detect intervening writes between preview and confirmation."""
+    digest = hashlib.sha256()
+    for model in (ProductCategory, Product):
+        for item in model.objects.filter(sys_ws=workspace).order_by('pk').values().iterator():
+            digest.update(json.dumps(item, sort_keys=True, default=str, ensure_ascii=False).encode())
+    return digest.hexdigest()
+
+
+def lock_catalog(workspace):
+    """Lock existing rows in stable order as well as the workspace during confirmation."""
+    Workspace.objects.select_for_update().get(pk=workspace.pk)
+    for model in (ProductCategory, Product):
+        list(model.objects.select_for_update().filter(sys_ws=workspace).order_by('pk').values_list('pk', flat=True))
+
+
+def category_for_path(workspace, path, create):
+    names = [name.strip() for name in path.split('/')]
+    if not names or len(names) > 10 or any(not name or len(name) > 60 for name in names):
+        raise ValidationError({'category': 'مسیر دسته با /، حداکثر ۱۰ سطح و نام‌های ۱ تا ۶۰ کاراکتری لازم است.'})
+    parent = None
+    for name in names:
+        matches = ProductCategory.objects.filter(sys_ws=workspace, name=name, parent=parent)
+        if matches.count() > 1:
+            raise ValidationError({'category': 'دسته تکراری و مبهم است؛ ابتدا دسته‌های موجود را اصلاح کنید.'})
+        category = matches.first()
+        if category is None:
+            if not create:
+                raise ValidationError({'category': f'دسته {name} وجود ندارد و ساخت دسته غیرفعال است.'})
+            category = ProductCategory(sys_ws=workspace, name=name, parent=parent)
+            category.full_clean()
+            category.save()
+        parent = category
+    return parent
+
+
+def product_values(values):
+    fields = {'name': values.get('name', '').strip()}
+    if not fields['name']:
+        raise ValidationError({'name': 'نام محصول الزامی است.'})
+    for key in ('price', 'order_prd', 'excel_order'):
+        if values.get(key):
+            maximum = 9223372036854775807 if key == 'price' else 2147483647
+            fields[key] = integer_value(values[key], key, maximum)
+    if values.get('view_only'):
+        fields['view_only'] = boolean_value(values['view_only'])
+    if values.get('attr'):
+        try:
+            fields['attr'] = json.loads(values['attr'])
+            if not isinstance(fields['attr'], dict):
+                raise ValueError
+        except (ValueError, TypeError):
+            raise ValidationError({'attr': 'ویژگی‌ها باید یک شیء JSON معتبر باشد.'})
+    return fields
+
+
+def apply_product_row(workspace, row, options):
+    values = row['values']
+    if row.get('formulas'):
+        raise ValidationError({key: 'فرمول مجاز نیست؛ مقدار ثابت جایگزین کنید.' for key in row['formulas']})
+    code = values.get('acc_code', '').strip()
+    if not code:
+        raise ValidationError({'acc_code': 'کد ثابت و غیرخالی محصول الزامی است.'})
+    matches = Product.objects.filter(sys_ws=workspace, acc_code=code)
+    if matches.count() > 1:
+        raise ValidationError({'acc_code': 'کد در دیتابیس تکراری است؛ تطبیق یکتا امکان‌پذیر نیست.'})
+    product = matches.first()
+    mode = options['mode']
+    if product is not None and mode == 'create':
+        raise ValidationError({'acc_code': 'محصول موجود است؛ حالت ایجاد اجازه به‌روزرسانی ندارد.'})
+    if product is None and mode == 'update':
+        raise ValidationError({'acc_code': 'محصول برای به‌روزرسانی پیدا نشد.'})
+    created = product is None
+    fields = product_values(values)
+    category = category_for_path(workspace, values.get('category', ''), options['create_categories'])
+    changed_order = False
+    for source, target in (('order_cat', 'order_cat'), ('category_excel_order', 'excel_order')):
+        if values.get(source):
+            setattr(category, target, integer_value(values[source], source))
+            changed_order = True
+    if changed_order:
+        category.full_clean()
+        category.save()
+    product = product or Product(sys_ws=workspace, acc_code=code, price=0)
+    product.category = category
+    for key, value in fields.items():
+        setattr(product, key, value)
+    if values.get('unit'):
+        product.attr = dict(product.attr or {}, acc_vahed=values['unit'])
+    set_product_order(product, values, options['ordering'])
+    product.full_clean()
+    product.save()
+    return 'created' if created else 'updated'
+
+
+def set_product_order(product, values, ordering):
+    if ordering == 'append' and product.pk is None and not values.get('order_prd'):
+        maximum = Product.objects.filter(category=product.category).aggregate(value=Max('order_prd'))['value']
+        product.order_prd = (maximum or 0) + 1
+
+
+def import_products(workspace, rows, options, dry_run=False):
+    """Each rejected row rolls back its categories too; atomic mode rolls back all rows."""
+    if options.get('mode') not in ('create', 'update', 'upsert') or options.get('errors') not in ('atomic', 'skip') or options.get('ordering') not in ('preserve', 'rows', 'append') or not isinstance(options.get('create_categories'), bool):
+        raise ValidationError('تنظیمات ورود معتبر نیست.')
+    results, seen, category_orders = [], set(), {}
+    with transaction.atomic():
+        Workspace.objects.select_for_update().get(pk=workspace.pk)
+        for position, row in enumerate(rows, 1):
+            previous_orders = dict(category_orders)
+            values = dict(row['values'])
+            if options['ordering'] == 'rows' and not values.get('order_prd'):
+                values['order_prd'] = str(position)
+            candidate = dict(row, values=values)
+            try:
+                with transaction.atomic():
+                    code = values.get('acc_code', '').strip()
+                    if code in seen:
+                        raise ValidationError({'acc_code': 'کد در همین فایل تکراری است.'})
+                    seen.add(code)
+                    check_category_orders(values, category_orders)
+                    status = apply_product_row(workspace, candidate, options)
+                results.append(dict(row, status=status, errors={}))
+            except ValidationError as error:
+                category_orders = previous_orders
+                errors = error.message_dict if hasattr(error, 'message_dict') else {'row': error.messages}
+                results.append(dict(row, status='error', errors=errors))
+            except (IntegrityError, DataError):
+                category_orders = previous_orders
+                results.append(dict(row, status='error', errors={'row': ['تعارض دیتابیس؛ اطلاعات یا کد تکراری را بررسی کنید.']}))
+        has_errors = any(result['status'] == 'error' for result in results)
+        if dry_run or (has_errors and options['errors'] == 'atomic'):
+            transaction.set_rollback(True)
+    return {'rows': results, 'errors': sum(row['status'] == 'error' for row in results),
+            'created': sum(row['status'] == 'created' for row in results),
+            'updated': sum(row['status'] == 'updated' for row in results),
+            'committed': not dry_run and not (has_errors and options['errors'] == 'atomic')}
+
+
+def check_category_orders(values, orders):
+    path = '/'.join(part.strip() for part in values.get('category', '').split('/'))
+    for key in ('order_cat', 'category_excel_order'):
+        if values.get(key):
+            number = integer_value(values[key], key)
+            previous = orders.get((path, key), number)
+            if previous != number:
+                raise ValidationError({key: 'ترتیب همین دسته در ردیف‌های فایل ناسازگار است.'})
+            orders[(path, key)] = number

apps/shop/selectors/order.py

@@ -9,6 +9,7 @@ from apps.customer.models import Customer as CustomerModel
 from django.http import HttpResponse
 import pandas as pd
 from django.utils import timezone
+from apps.shop.ordering import product_ordering
 
 
 def retrieve_order(cuser_role_uuid: str, order_id: int, workspace_uuid: str) -> OrderModel:
@@ -104,20 +105,12 @@ def retrieve_order_operators(request, order_id) -> OrderModel:
 def retrieve_order_item_excel(request, order_id):
     try:
         workspace_uuid = get_user_workspace_uuid(request)
-        cuser_role_uuid = get_cuser_role_uuid(request)
-        customer_responsibles = CustomerResponsibleModel.objects.filter(cuser_role__uuid=cuser_role_uuid,
-                                                                        sys_ws__uuid=workspace_uuid)
-
-        #responsible_group_ids = customer_responsibles.values_list('responsible_group__id', flat=True)
-
-        #order_items = OrderItemModel.objects.filter(order_id=order_id,
-        #                                            order__responsible_group_id__in=responsible_group_ids)
-        
-
-        order_items = OrderItemModel.objects.filter(order_id=order_id)
-
-
-        df = pd.DataFrame(list(order_items.values('product__acc_code', 'product__category__name', 'product_name', 'amount', 'product__attr__acc_vahed')))
+        OrderModel.objects.get(pk=order_id, sys_ws__uuid=workspace_uuid)
+        order_items = OrderItemModel.objects.filter(order_id=order_id).order_by(
+            *product_ordering(prefix='product__', excel=True), 'pk',
+        )
+        columns = ['product__acc_code', 'product__category__name', 'product_name', 'amount', 'product__attr__acc_vahed']
+        df = pd.DataFrame.from_records(list(order_items.values(*columns)), columns=columns)
 
         #df['واحد سنجش'] = ''
         df['عامل کنترل موجودی اول'] = ''

apps/shop/services/catalog_records.py

@@ -0,0 +1,33 @@
+from django.core.exceptions import ValidationError as ModelValidationError
+from django.db import DataError, IntegrityError
+from django.shortcuts import get_object_or_404
+from rest_framework import exceptions
+from apps.workspace.models import Workspace
+
+
+def validate_catalog_save(record):
+    try:
+        record.full_clean()
+        record.save()
+    except ModelValidationError as error:
+        raise exceptions.ValidationError(error.message_dict if hasattr(error, 'message_dict') else error.messages)
+    except (DataError, IntegrityError):
+        raise exceptions.ValidationError('داده‌ها با محدودیت‌های دیتابیس سازگار نیستند؛ اطلاعات را تازه کنید.')
+    return record
+
+
+def update_catalog_record(model, serializer_type, workspace_uuid, record_id, values):
+    workspace = get_object_or_404(Workspace.objects.select_for_update(), uuid=workspace_uuid)
+    record = get_object_or_404(model.objects.select_for_update(), pk=record_id, sys_ws=workspace)
+    serializer = serializer_type(record, data=values, partial=True, context={'workspace': workspace})
+    serializer.is_valid(raise_exception=True)
+    for key, value in serializer.validated_data.items():
+        setattr(record, key, value)
+    return validate_catalog_save(record)
+
+
+def delete_catalog_record(model, check, workspace_uuid, record_id):
+    workspace = get_object_or_404(Workspace.objects.select_for_update(), uuid=workspace_uuid)
+    record = get_object_or_404(model.objects.select_for_update(), pk=record_id, sys_ws=workspace)
+    check(record)
+    return record.delete()

apps/shop/services/product.py

@@ -1,55 +1,29 @@
+from django.db import transaction
 from apps.shop.models import Product as ProductModel
-from decimal import Decimal
-from rest_framework import exceptions
+from apps.shop.management_serializers import ProductManagementSerializer
+from apps.workspace.models import Workspace
 
 
-def create_product(name: str, price: Decimal, category: int, acc_code: str = None, attr: str = None, workspace=None) -> ProductModel:
-    try:
-        product_obj = ProductModel()
-        product_obj.name = name
-        product_obj.price = price
-        product_obj.category_id = category
-        if acc_code is not None:
-            product_obj.acc_code = acc_code
-        if attr is not None:
-            product_obj.attr = attr
-        product_obj.sys_ws = workspace
-
-        product_obj.full_clean()
-        product_obj.save()
-
-        return product_obj
-
-    except Exception as exp:
-        message = f'Error Create Product: {exp}'
-        exceptions.ValidationError({'error': message})
+from apps.shop.services.catalog_records import validate_catalog_save, update_catalog_record, delete_catalog_record
 
 
-def update_product(product_id: int, name: str, price: Decimal, category: int, acc_code: str = None, attr: str = None, workspace_uuid: str = None) -> ProductModel:
-    try:
-
-        product_obj = ProductModel.objects.get(id=product_id, sys_ws__uuid=workspace_uuid)
-
-        product_obj.name = name
-        product_obj.price = price
-        product_obj.category_id = category
-        if acc_code is not None:
-            product_obj.acc_code = acc_code
-        if attr is not None:
-            product_obj.attr = attr
-        product_obj.full_clean()
-        product_obj.save()
-
-        return product_obj
-    except Exception as exp:
-        message = f'Error Updating Product: {exp}'
-        raise exceptions.ValidationError({'error': message})
+@transaction.atomic
+def create_product(name, price, category, acc_code=None, attr=None, workspace=None, **fields):
+    Workspace.objects.select_for_update().get(pk=workspace.pk)
+    data = dict(name=name, price=price, category=category, acc_code=acc_code, attr=attr, **fields)
+    serializer = ProductManagementSerializer(data=data, context={'workspace': workspace})
+    serializer.is_valid(raise_exception=True)
+    return validate_catalog_save(ProductModel(sys_ws=workspace, **serializer.validated_data))
 
 
-def delete_product(product_id: int, workspace_uuid: str) -> ProductModel:
-    try:
-        product_obj = ProductModel.objects.get(id=product_id, sys_ws__uuid=workspace_uuid).delete()
-        return product_obj
-    except Exception as exp:
-        message = f'Error Deleting Product: {exp}'
-        raise exceptions.ValidationError({'error': message})
+@transaction.atomic
+def update_product(product_id, name=None, price=None, category=None, acc_code=None, attr=None, workspace_uuid=None, **fields):
+    values = {key: value for key, value in dict(name=name, price=price, category=category, acc_code=acc_code, attr=attr).items() if value is not None}
+    values.update(fields)
+    return update_catalog_record(ProductModel, ProductManagementSerializer, workspace_uuid, product_id, values)
+
+
+@transaction.atomic
+def delete_product(product_id, workspace_uuid):
+    from apps.shop.views.management import ensure_product_deletable
+    return delete_catalog_record(ProductModel, ensure_product_deletable, workspace_uuid, product_id)

apps/shop/services/product_category.py

@@ -1,40 +1,29 @@
+from django.db import transaction
 from apps.shop.models import ProductCategory as ProductCategoryModel
-from rest_framework import exceptions
+from apps.shop.management_serializers import CategoryManagementSerializer
+from apps.workspace.models import Workspace
 
 
-def create_product_category(name: str, parent: int = None, workspace=None) -> ProductCategoryModel:
-    try:
-        product_category_obj = ProductCategoryModel(name=name, sys_ws=workspace)
-
-        if parent is not None:
-            product_category_obj.parent_id = parent
-
-        product_category_obj.full_clean()
-        product_category_obj.save()
-
-        return product_category_obj
-
-    except Exception as exp:
-        message = f'Error Create ProductCategory: {exp}'
-        exceptions.ValidationError({'error': message})
+from apps.shop.services.catalog_records import validate_catalog_save, update_catalog_record, delete_catalog_record
 
 
-def update_product_category(category_id: int, name: str, workspace_uuid: str) -> ProductCategoryModel:
-    try:
-        product_category_obj = ProductCategoryModel.objects.get(id=category_id, sys_ws__uuid=workspace_uuid)
-        product_category_obj.name = name
-        product_category_obj.full_clean()
-        product_category_obj.save()
-        return product_category_obj
-    except Exception as exp:
-        message = f'Error Updating ProductCategory: {exp}'
-        raise exceptions.ValidationError({'error': message})
+@transaction.atomic
+def create_product_category(name, parent=None, workspace=None, **fields):
+    Workspace.objects.select_for_update().get(pk=workspace.pk)
+    serializer = CategoryManagementSerializer(data=dict(name=name, parent=parent, **fields), context={'workspace': workspace})
+    serializer.is_valid(raise_exception=True)
+    return validate_catalog_save(ProductCategoryModel(sys_ws=workspace, **serializer.validated_data))
 
 
-def delete_product_category(category_id: int, workspace_uuid: str) -> ProductCategoryModel:
-    try:
-        product_category_obj = ProductCategoryModel.objects.get(id=category_id, sys_ws__uuid=workspace_uuid).delete()
-        return product_category_obj
-    except Exception as exp:
-        message = f'Error Deleting ProductCategory: {exp}'
-        raise exceptions.ValidationError({'error': message})
+@transaction.atomic
+def update_product_category(category_id, name=None, workspace_uuid=None, **fields):
+    values = dict(fields)
+    if name is not None:
+        values['name'] = name
+    return update_catalog_record(ProductCategoryModel, CategoryManagementSerializer, workspace_uuid, category_id, values)
+
+
+@transaction.atomic
+def delete_product_category(category_id, workspace_uuid):
+    from apps.shop.views.management import ensure_category_deletable
+    return delete_catalog_record(ProductCategoryModel, ensure_category_deletable, workspace_uuid, category_id)

apps/shop/templates/admin/shop/product/change_list.html

@@ -0,0 +1,5 @@
+{% extends "admin/change_list.html" %}
+{% block object-tools-items %}
+{% if can_import %}<li><a href="{% url 'admin:shop_product_import' %}">ورود محصولات از اکسل</a></li>{% endif %}
+{{ block.super }}
+{% endblock %}

apps/shop/templates/admin/shop/product/import.html

@@ -0,0 +1,20 @@
+{% extends "admin/base_site.html" %}
+{% block content %}
+<div dir="rtl">
+<p><a href="{% url 'admin:shop_product_changelist' %}">فهرست محصولات</a> | <a href="{% url 'admin:shop_product_import_template' %}">دریافت فایل نمونه</a></p>
+<p>تطبیق محصولات بر اساس کد در فضای کاری انتخاب‌شده است. مسیر دسته با / جدا می‌شود. فیلدهای خالی مقدار فعلی را حفظ می‌کنند؛ قیمت محصول جدید بدون قیمت صفر است. کدهای دارای صفر ابتدایی را در اکسل به صورت متن ذخیره کنید. فرمول پذیرفته نمی‌شود.</p>
+{% if problem %}<p class="errornote">{{ problem }}</p>{% endif %}
+{% if batch %}
+<h2>نتیجه ورود شماره {{ batch.pk }} — {{ batch.filename }}</h2>
+<p>ایجاد: {{ result.created }} | به‌روزرسانی: {{ result.updated }} | خطا: {{ result.errors }}</p>
+{% if batch.confirmed_at %}<p>ثبت نهایی انجام شد: {{ batch.confirmed_at }}</p>{% else %}<p>هنوز محصولی ثبت نشده است. اعتبار پیش‌نمایش تا {{ batch.expires_at }}.</p>{% endif %}
+<p><a href="{% url 'admin:shop_product_import_report' batch.pk %}">دریافت گزارش همه ردیف‌ها و خطاها</a></p>
+<table><thead><tr><th>ردیف</th><th>کد</th><th>نام</th><th>دسته</th><th>عملیات</th><th>خطا</th></tr></thead><tbody>
+{% for row in result.rows|slice:':100' %}<tr><td>{{ row.row }}</td><td>{{ row.values.acc_code }}</td><td>{{ row.values.name }}</td><td>{{ row.values.category }}</td><td>{{ row.status }}</td><td>{{ row.errors }}</td></tr>{% endfor %}
+</tbody></table><p>در صفحه حداکثر ۱۰۰ ردیف نمایش داده می‌شود؛ گزارش اکسل شامل تمام ردیف‌هاست.</p>
+{% if can_confirm %}<form method="post">{% csrf_token %}<input type="hidden" name="batch_id" value="{{ batch.pk }}"><button type="submit" name="confirm" value="1">تأیید و ثبت نهایی</button></form>{% endif %}
+{% endif %}
+<h2>بارگذاری و پیش‌نمایش فایل</h2>
+<form method="post" enctype="multipart/form-data">{% csrf_token %}{{ form.as_p }}<input type="submit" value="اعتبارسنجی و پیش‌نمایش"></form>
+</div>
+{% endblock %}

apps/shop/test_admin_import.py

@@ -0,0 +1,338 @@
+from datetime import timedelta
+from io import BytesIO
+from django.apps import apps
+from django.contrib import admin
+from django.contrib.auth import get_user_model
+from django.core.exceptions import ValidationError
+from django.core.files.uploadedfile import SimpleUploadedFile
+from django.test import TestCase
+from django.urls import reverse
+from django.utils import timezone
+from openpyxl import Workbook, load_workbook
+
+from apps.shop.import_models import ProductImportBatch
+from apps.shop.models import Product, ProductCategory
+from apps.shop.product_import import parse_workbook, import_products, HEADERS
+from apps.workspace.models import Workspace
+
+
+class ExcelImportTests(TestCase):
+    @classmethod
+    def setUpTestData(cls):
+        cls.workspace = Workspace.objects.create(name='Main', username='main')
+        cls.other = Workspace.objects.create(name='Other', username='other')
+        cls.user = get_user_model().objects.create_user(username='staff', mobile=9123456789, password='secret', is_active=True, is_staff=True, is_superuser=True)
+
+    def setUp(self):
+        self.client.force_login(self.user)
+        self.options = {'mode': 'upsert', 'create_categories': True, 'errors': 'atomic', 'ordering': 'preserve'}
+
+    def row(self, code='001', name='Product', category='Parent/Child', **values):
+        return {'row': 2, 'values': dict(acc_code=code, name=name, category=category, **values), 'formulas': []}
+
+    def upload(self, headers=None, data=None, name='products.xlsx'):
+        workbook = Workbook()
+        sheet = workbook.active
+        sheet.title = 'Products'
+        sheet.append(headers or ['name', 'category', 'acc_code', 'price'])
+        for row in data or [['Product', 'Parent/Child', '001', 1200]]:
+            sheet.append(row)
+        content = BytesIO()
+        workbook.save(content)
+        return SimpleUploadedFile(name, content.getvalue())
+
+    def preview(self, **overrides):
+        data = dict(workspace=self.workspace.pk, file=self.upload(), header_row=1,
+                    mode='upsert', create_categories='on', errors='atomic', ordering='preserve')
+        data.update(overrides)
+        return self.client.post(reverse('admin:shop_product_import'), data)
+
+    def confirm(self, batch):
+        return self.client.post(reverse('admin:shop_product_import'), {'confirm': '1', 'batch_id': batch.pk})
+
+    def test_parse_aliases_persian_digits_and_text_codes(self):
+        rows = parse_workbook(self.upload(['نام محصول', 'دسته', 'کد محصول', 'قیمت'], [['P', 'C', '0001', '۱٬۲۰۰']]))
+        result = import_products(self.workspace, rows, self.options)
+        self.assertTrue(result['committed'])
+        self.assertEqual(Product.objects.get().acc_code, '0001')
+        self.assertEqual(Product.objects.get().price, 1200)
+
+    def test_manual_mapping_sheet_and_header_row(self):
+        rows = parse_workbook(self.upload(['Title', 'Group', 'Code']), 'Products', 1, {'name': 'Title', 'category': 'Group', 'acc_code': 'Code'})
+        self.assertEqual(rows[0]['values']['acc_code'], '001')
+        with self.assertRaises(ValidationError):
+            parse_workbook(self.upload(), 'Absent')
+
+    def test_duplicate_headers_mapping_and_wrong_file_rejected(self):
+        for file, mapping in ((self.upload(['name', 'name', 'category', 'acc_code']), {}),
+                              (self.upload(), {'unknown': 'X'}),
+                              (self.upload(name='bad.xls'), {}),
+                              (SimpleUploadedFile('bad.xlsx', b'broken'), {})):
+            with self.assertRaises(ValidationError):
+                parse_workbook(file, mapping=mapping)
+
+    def test_formula_is_row_error(self):
+        rows = parse_workbook(self.upload(data=[['=1+1', 'C', 'X', 1]]))
+        result = import_products(self.workspace, rows, self.options)
+        self.assertEqual(result['errors'], 1)
+        self.assertEqual(Product.objects.count(), 0)
+
+    def test_dry_run_creates_no_products_or_categories(self):
+        result = import_products(self.workspace, [self.row()], self.options, dry_run=True)
+        self.assertEqual(result['created'], 1)
+        self.assertFalse(result['committed'])
+        self.assertEqual(ProductCategory.objects.count(), 0)
+        self.assertEqual(Product.objects.count(), 0)
+
+    def test_nested_categories_and_independent_orders(self):
+        result = import_products(self.workspace, [self.row(order_prd='3', excel_order='8', order_cat='6', category_excel_order='9', unit='عدد', view_only='بله', attr='{"color": "blue"}')], self.options)
+        self.assertTrue(result['committed'])
+        product = Product.objects.get()
+        self.assertEqual(product.category.parent.name, 'Parent')
+        self.assertEqual((product.order_prd, product.excel_order, product.category.order_cat, product.category.excel_order), (3, 8, 6, 9))
+        self.assertEqual(product.attr, {'color': 'blue', 'acc_vahed': 'عدد'})
+        self.assertTrue(product.view_only)
+
+    def test_atomic_errors_rollback_everything(self):
+        result = import_products(self.workspace, [self.row(), self.row('002', price='-1')], self.options)
+        self.assertFalse(result['committed'])
+        self.assertEqual(ProductCategory.objects.count(), 0)
+        self.assertEqual(Product.objects.count(), 0)
+        self.assertIn('price', result['rows'][1]['errors'])
+
+    def test_skip_errors_rollback_categories_of_rejected_row(self):
+        self.options['errors'] = 'skip'
+        result = import_products(self.workspace, [self.row(), self.row('002', category='Rejected', name='X'*201)], self.options)
+        self.assertTrue(result['committed'])
+        self.assertEqual(Product.objects.count(), 1)
+        self.assertFalse(ProductCategory.objects.filter(name='Rejected').exists())
+
+    def test_duplicate_code_in_file_and_database_are_errors(self):
+        result = import_products(self.workspace, [self.row(), self.row()], self.options)
+        self.assertEqual(result['errors'], 1)
+        category = ProductCategory.objects.create(sys_ws=self.workspace, name='C')
+        for _ in range(2):
+            Product.objects.create(sys_ws=self.workspace, category=category, name='P', acc_code='001', price=0)
+        result = import_products(self.workspace, [self.row()], self.options)
+        self.assertEqual(result['errors'], 1)
+
+    def test_matching_is_scoped_to_workspace(self):
+        import_products(self.other, [self.row()], self.options)
+        import_products(self.workspace, [self.row(name='Mine')], self.options)
+        self.assertEqual(Product.objects.count(), 2)
+        self.assertEqual(Product.objects.get(sys_ws=self.other).name, 'Product')
+
+    def test_update_create_modes_and_preserve_blank(self):
+        import_products(self.workspace, [self.row(price='80', order_prd='4')], self.options)
+        self.options['mode'] = 'create'
+        self.assertEqual(import_products(self.workspace, [self.row()], self.options)['errors'], 1)
+        self.options['mode'] = 'update'
+        self.assertEqual(import_products(self.workspace, [self.row('missing')], self.options)['errors'], 1)
+        result = import_products(self.workspace, [self.row(name='Updated', price='')], self.options)
+        self.assertTrue(result['committed'])
+        self.assertEqual(Product.objects.get().price, 80)
+        self.assertEqual(Product.objects.get().order_prd, 4)
+
+    def test_category_creation_disabled_and_ambiguous(self):
+        self.options['create_categories'] = False
+        self.assertEqual(import_products(self.workspace, [self.row()], self.options)['errors'], 1)
+        self.options['create_categories'] = True
+        for _ in range(2):
+            ProductCategory.objects.create(sys_ws=self.workspace, name='C')
+        self.assertEqual(import_products(self.workspace, [self.row(category='C')], self.options)['errors'], 1)
+
+    def test_conflicting_category_orders(self):
+        result = import_products(self.workspace, [self.row(order_cat='1'), self.row('002', order_cat='2')], self.options)
+        self.assertEqual(result['errors'], 1)
+        self.assertFalse(result['committed'])
+
+    def test_rows_order_and_append(self):
+        self.options['ordering'] = 'rows'
+        import_products(self.workspace, [self.row('1'), self.row('2')], self.options)
+        self.assertEqual(list(Product.objects.order_by('acc_code').values_list('order_prd', flat=True)), [1, 2])
+        self.options['ordering'] = 'append'
+        import_products(self.workspace, [self.row('3')], self.options)
+        self.assertEqual(Product.objects.get(acc_code='3').order_prd, 3)
+
+    def test_bad_numbers_booleans_attributes_and_category_path(self):
+        for values in ({'price': '1.5'}, {'price': 'NaN'}, {'view_only': 'maybe'}, {'attr': '[]'}, {'category': 'A//B'}, {'price': '999999999999999999999'}):
+            self.assertEqual(import_products(self.workspace, [self.row(**values)], self.options)['errors'], 1)
+
+    def test_admin_preview_confirm_replay_and_audit(self):
+        response = self.preview()
+        self.assertEqual(response.status_code, 200)
+        batch = ProductImportBatch.objects.get()
+        self.assertEqual(Product.objects.count(), 0)
+        self.assertContains(response, 'ثبت نهایی')
+        self.assertEqual(self.confirm(batch).status_code, 200)
+        batch.refresh_from_db()
+        self.assertIsNotNone(batch.confirmed_at)
+        self.assertEqual(Product.objects.count(), 1)
+        self.assertContains(self.confirm(batch), 'ثبت نهایی انجام شد')
+        self.assertEqual(Product.objects.count(), 1)
+        from django.contrib.admin.models import LogEntry
+        self.assertEqual(LogEntry.objects.filter(object_repr=f'Excel import #{batch.pk}').count(), 1)
+
+    def test_admin_expired_preview_rejected(self):
+        self.preview()
+        batch = ProductImportBatch.objects.get()
+        batch.expires_at = timezone.now()-timedelta(seconds=1)
+        batch.save()
+        self.assertContains(self.confirm(batch), 'منقضی')
+        self.assertEqual(Product.objects.count(), 0)
+
+    def test_admin_changed_catalog_requires_new_preview(self):
+        self.preview()
+        batch = ProductImportBatch.objects.get()
+        ProductCategory.objects.create(sys_ws=self.workspace, name='Changed')
+        self.assertContains(self.confirm(batch), 'تغییر کرده')
+        self.assertEqual(Product.objects.count(), 0)
+
+    def test_other_admin_cannot_confirm_or_download_batch(self):
+        self.preview()
+        batch = ProductImportBatch.objects.get()
+        other = get_user_model().objects.create_user(username='otherstaff', mobile=9123456790, password='secret', is_active=True, is_staff=True, is_superuser=True)
+        self.client.force_login(other)
+        self.assertEqual(self.confirm(batch).status_code, 404)
+        self.assertEqual(self.client.get(reverse('admin:shop_product_import_report', args=[batch.pk])).status_code, 404)
+
+    def test_template_and_formula_safe_report(self):
+        response = self.client.get(reverse('admin:shop_product_import_template'))
+        self.assertEqual(response.status_code, 200)
+        sheet = load_workbook(BytesIO(response.content)).active
+        self.assertEqual([cell.value for cell in sheet[1]], list(HEADERS))
+        self.preview(file=self.upload(data=[['=1+1', 'C', 'X', 1]]))
+        batch = ProductImportBatch.objects.get()
+        response = self.client.get(reverse('admin:shop_product_import_report', args=[batch.pk]))
+        sheet = load_workbook(BytesIO(response.content)).active
+        self.assertEqual(sheet.cell(2, 2).data_type, 's')
+        self.assertEqual(sheet.cell(2, 2).value, '=1+1')
+
+    def test_nonstaff_and_staff_without_permissions_cannot_import(self):
+        self.user.is_superuser = False
+        self.user.save()
+        self.assertEqual(self.preview().status_code, 403)
+        self.assertEqual(self.client.get(reverse('admin:shop_product_import_template')).status_code, 403)
+
+    def test_atomic_preview_cannot_be_forced_to_commit_errors(self):
+        self.preview(file=self.upload(data=[['Valid', 'C', '1', 10], ['Invalid', 'D', '2', -1]]))
+        batch = ProductImportBatch.objects.get()
+        self.confirm(batch)
+        batch.refresh_from_db()
+        self.assertIsNone(batch.confirmed_at)
+        self.assertEqual(Product.objects.count(), 0)
+
+    def test_all_application_models_have_working_admin_lists_and_forms(self):
+        labels = {'shop', 'workspace', 'customer', 'cuser', 'jwt_auth', 'lead', 'ticket', 'customform', 'reminder'}
+        for model in apps.get_models():
+            if model._meta.app_label not in labels:
+                continue
+            with self.subTest(model=model._meta.label):
+                self.assertIn(model, admin.site._registry)
+                url = reverse(f'admin:{model._meta.app_label}_{model._meta.model_name}_changelist')
+                self.assertEqual(self.client.get(url).status_code, 200)
+                model_admin = admin.site._registry[model]
+                from django.test import RequestFactory
+                request = RequestFactory().get('/')
+                request.user = self.user
+                if model_admin.has_add_permission(request):
+                    url = reverse(f'admin:{model._meta.app_label}_{model._meta.model_name}_add')
+                    self.assertEqual(self.client.get(url).status_code, 200)
+
+    def test_cross_workspace_relation_and_category_cycle_rejected(self):
+        category = ProductCategory.objects.create(sys_ws=self.other, name='C')
+        response = self.client.post(reverse('admin:shop_product_add'), {'name': 'P', 'price': '1', 'category': category.pk, 'sys_ws': self.workspace.pk, 'acc_code': '1', 'view_only': '2'})
+        self.assertContains(response, 'فضای کاری دیگری')
+        self.assertEqual(Product.objects.count(), 0)
+        category.parent = category
+        from utils.admin_base import RelatedWorkspaceForm
+        from django.forms import modelform_factory
+        form = modelform_factory(ProductCategory, form=RelatedWorkspaceForm, fields=['name', 'parent', 'sys_ws'])(data={'name': 'C', 'parent': category.pk, 'sys_ws': self.other.pk}, instance=category)
+        self.assertFalse(form.is_valid())
+        self.assertIn('parent', form.errors)
+
+    def test_product_export_can_be_reimported_with_category_path_and_attributes(self):
+        import_products(self.workspace, [self.row(price='70', attr='{"color":"blue"}', view_only='true')], self.options)
+        from apps.shop.admin import export_products
+        response = export_products(Product.objects.all())
+        rows = parse_workbook(SimpleUploadedFile('export.xlsx', response.content))
+        self.assertEqual(rows[0]['values']['category'], 'Parent/Child')
+        result = import_products(self.workspace, rows, self.options)
+        self.assertEqual(result['updated'], 1)
+        self.assertEqual(ProductCategory.objects.count(), 2)
+        self.assertEqual(Product.objects.get().attr, {'color': 'blue'})
+
+    def test_skip_rejected_category_order_does_not_poison_later_rows(self):
+        self.options['errors'] = 'skip'
+        rows = [self.row('1', name='X'*201, order_cat='1'), self.row('2', order_cat='2')]
+        result = import_products(self.workspace, rows, self.options)
+        self.assertEqual(result['errors'], 1)
+        self.assertEqual(Product.objects.get().category.order_cat, 2)
+
+    def test_permissions_rechecked_after_preview(self):
+        self.preview()
+        batch = ProductImportBatch.objects.get()
+        self.user.is_superuser = False
+        self.user.save()
+        self.assertEqual(self.confirm(batch).status_code, 403)
+        self.assertEqual(Product.objects.count(), 0)
+
+    def test_secret_tokens_and_otps_are_not_in_admin_forms_or_exports(self):
+        from apps.jwt_auth.models import JwtToken, CUserRoleLoginOpt
+        from apps.cuser.models import SmsOpt
+        from django.test import RequestFactory
+        request = RequestFactory().get('/')
+        request.user = self.user
+        for model, secrets in ((JwtToken, ('refresh', 'access')), (CUserRoleLoginOpt, ('uuid',)), (SmsOpt, ('opt',))):
+            model_admin = admin.site._registry[model]
+            form = model_admin.get_form(request)
+            self.assertFalse(set(secrets).intersection(form.base_fields))
+            response = model_admin.export_selected(request, model.objects.none())
+            headers = list(load_workbook(BytesIO(response.content)).active.values)[0]
+            self.assertFalse(set(secrets).intersection(headers))
+
+
+from apps.jwt_auth.test_regressions import RegressionFixtures
+
+
+class LegacyProductImportTests(RegressionFixtures):
+    def admin_login(self):
+        from apps.cuser.models import CuserRole
+        role = CuserRole.objects.create(cuser=self.user, role_type=self.admin_type, sys_ws=self.workspace,
+                                       name_family='Admin', mobile=self.user.mobile, is_active=True, mobile_verify=True)
+        self.use_role(role)
+
+    def workbook_content(self, data):
+        book = Workbook()
+        sheet = book.active
+        sheet.append(['name', 'cate_name', 'acc_code', 'size', 'vahed'])
+        for row in data:
+            sheet.append(row)
+        output = BytesIO()
+        book.save(output)
+        return output.getvalue()
+
+    def test_legacy_api_uses_shared_validation_and_rolls_back(self):
+        from unittest.mock import patch
+        self.admin_login()
+        content = self.workbook_content([['P', 'C', '1', 1, 'عدد'], ['Bad', 'D', '2', -1, 'عدد']])
+        with patch('apps.shop.views.excel_import.open', return_value=BytesIO(content), create=True):
+            response = self.client.get('/shop/import/')
+        self.assertEqual(response.status_code, 400)
+        self.assertEqual(Product.objects.count(), 0)
+        self.assertEqual(ProductCategory.objects.count(), 0)
+
+    def test_legacy_api_import_still_works_and_scopes_workspace(self):
+        from unittest.mock import patch
+        self.admin_login()
+        content = self.workbook_content([['P', 'C', '0001', 1, 'عدد']])
+        with patch('apps.shop.views.excel_import.open', return_value=BytesIO(content), create=True):
+            response = self.client.get('/shop/import/')
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(Product.objects.get().acc_code, '0001')
+        self.assertEqual(Product.objects.get().sys_ws, self.workspace)
+        self.assertTrue(Product.objects.get().view_only)
+
+    def test_legacy_api_requires_admin_role(self):
+        self.use_role()
+        self.assertEqual(self.client.get('/shop/import/').status_code, 403)

apps/shop/test_management.py

@@ -0,0 +1,289 @@
+from datetime import timedelta
+from io import BytesIO
+from django.core.files.uploadedfile import SimpleUploadedFile
+from django.utils import timezone
+from openpyxl import Workbook, load_workbook
+from apps.jwt_auth.test_regressions import RegressionFixtures
+from apps.cuser.models import CuserRole, RoleType
+from apps.shop.models import Product, ProductCategory, Order, OrderItem, Cart
+from apps.shop.import_models import ProductImportBatch
+
+ROOT = '/shop/manage/'
+
+
+class ProductManagementTests(RegressionFixtures):
+    @classmethod
+    def setUpTestData(cls):
+        super().setUpTestData()
+        cls.admin_role = CuserRole.objects.create(cuser=cls.user, role_type=cls.admin_type, sys_ws=cls.workspace,
+            name_family='Admin', mobile=cls.user.mobile, is_active=True, mobile_verify=True)
+        cls.category = ProductCategory.objects.create(sys_ws=cls.workspace, name='C', order_cat=1)
+        cls.foreign_category = ProductCategory.objects.create(sys_ws=cls.other_workspace, name='Foreign')
+        cls.product = Product.objects.create(sys_ws=cls.workspace, category=cls.category, name='P', acc_code='P1', price=10)
+        cls.foreign_product = Product.objects.create(sys_ws=cls.other_workspace, category=cls.foreign_category, name='Foreign', acc_code='F1', price=20)
+
+    def setUp(self):
+        self.use_role(self.admin_role)
+
+    def payload(self, **values):
+        return dict(name='New product', price='100', category=self.category.pk, acc_code='NEW', **values)
+
+    def patch(self, path, data):
+        return self.client.patch(ROOT+path, data, format='json')
+
+    def upload(self, rows=None):
+        book = Workbook()
+        sheet = book.active
+        sheet.append(['name', 'category', 'acc_code', 'price'])
+        for row in rows or [['Imported', 'Root/Child', 'EXCEL1', 50]]:
+            sheet.append(row)
+        output = BytesIO()
+        book.save(output)
+        return SimpleUploadedFile('products.xlsx', output.getvalue())
+
+    def preview(self, **values):
+        data = dict(file=self.upload(), mode='upsert', create_categories='true', errors='atomic', ordering='preserve')
+        data.update(values)
+        return self.client.post(ROOT+'import/preview/', data, format='multipart')
+
+    def test_operator_customer_even_flagged_admin_denied_every_management_endpoint(self):
+        paths = [('get', 'products/'), ('post', 'products/'), ('get', f'products/{self.product.pk}/'),
+                 ('patch', f'products/{self.product.pk}/'), ('delete', f'products/{self.product.pk}/'),
+                 ('post', 'products/bulk/'), ('get', 'products/export/'), ('get', 'categories/'),
+                 ('post', 'categories/'), ('patch', f'categories/{self.category.pk}/'),
+                 ('delete', f'categories/{self.category.pk}/'), ('post', 'import/preview/'),
+                 ('get', 'import/template/'), ('get', 'imports/'), ('get', 'imports/999/'),
+                 ('post', 'imports/999/confirm/'), ('get', 'imports/999/report/')]
+        for role in (self.role, self.operator):
+            role.is_admin = True
+            role.save()
+            self.use_role(role)
+            for method, path in paths:
+                with self.subTest(role=role.role_type.role_name_en, method=method, path=path):
+                    response = getattr(self.client, method)(ROOT+path)
+                    self.assertEqual(response.status_code, 403)
+
+    def test_unauthenticated_and_revoked_session_cannot_manage(self):
+        self.client.credentials()
+        self.assertEqual(self.client.get(ROOT+'products/').status_code, 401)
+        self.use_role(self.admin_role)
+        from apps.jwt_auth.models import JwtToken
+        JwtToken.objects.update(is_blocked=True)
+        self.assertEqual(self.client.get(ROOT+'products/').status_code, 401)
+
+    def test_capabilities_match_current_role_and_owner(self):
+        self.assertTrue(self.client.get('/cuser/info/').data['permissions']['manage_products'])
+        self.use_role(self.operator)
+        self.assertFalse(self.client.get('/cuser/info/').data['permissions']['manage_products'])
+        owner_type = RoleType.objects.create(role_name='Owner', role_name_en='workspace_owner')
+        owner = CuserRole.objects.create(cuser=self.user, role_type=owner_type, sys_ws=self.workspace, name_family='Owner', mobile=self.user.mobile, is_active=True, mobile_verify=True)
+        self.use_role(owner)
+        self.assertEqual(self.client.get(ROOT+'products/').status_code, 200)
+
+    def test_product_list_paginated_filtered_and_workspace_scoped(self):
+        result = self.client.get(ROOT+'products/').data
+        self.assertEqual(result['count'], 1)
+        self.assertEqual(result['results'][0]['id'], self.product.pk)
+        self.assertEqual(self.client.get(ROOT+'products/?search=Foreign').data['count'], 0)
+        self.assertEqual(self.client.get(ROOT+'products/?search=P1&price_min=10&price_max=10').data['count'], 1)
+        self.assertEqual(self.client.get(ROOT+'products/?view_only=true').data['count'], 0)
+        self.assertEqual(self.client.get(ROOT+'products/?price_min=20&price_max=1').status_code, 400)
+        self.assertEqual(self.client.get(ROOT+'products/?ordering=unknown').status_code, 400)
+
+    def test_categories_include_empty_and_counts(self):
+        empty = ProductCategory.objects.create(sys_ws=self.workspace, name='Empty', parent=self.category)
+        response = self.client.get(ROOT+'categories/')
+        self.assertEqual(response.status_code, 200)
+        rows = {row['id']: row for row in response.data}
+        self.assertNotIn(self.foreign_category.pk, rows)
+        self.assertEqual(rows[self.category.pk]['product_count'], 1)
+        self.assertEqual(rows[self.category.pk]['child_count'], 1)
+        self.assertEqual(rows[empty.pk]['product_count'], 0)
+
+    def test_product_crud_attributes_orders_and_big_price_precision(self):
+        data = self.payload()
+        data.update(name='N'*150, price='9223372036854775807', attr={'unit': 'عدد'}, order_prd=3, excel_order=7)
+        response = self.client.post(ROOT+'products/', data, format='json')
+        self.assertEqual(response.status_code, 201, response.data)
+        self.assertEqual(response.data['price'], '9223372036854775807')
+        product_id = response.data['id']
+        response = self.patch(f'products/{product_id}/', {'price': '0', 'order_prd': None, 'attr': None, 'view_only': True})
+        self.assertEqual(response.status_code, 200)
+        self.assertIsNone(response.data['order_prd'])
+        self.assertIsNone(response.data['attr'])
+        self.assertTrue(response.data['view_only'])
+        self.assertEqual(self.client.delete(ROOT+f'products/{product_id}/').status_code, 204)
+
+    def test_product_duplicate_code_invalid_values_and_foreign_category(self):
+        for values in ({'acc_code': 'P1'}, {'category': self.foreign_category.pk}, {'price': -1}, {'price': '1.5'}, {'price': '9223372036854775808'}, {'attr': []}, {'order_prd': -1}):
+            data = self.payload()
+            data.update(values)
+            response = self.client.post(ROOT+'products/', data, format='json')
+            self.assertEqual(response.status_code, 400, response.data)
+        self.assertEqual(Product.objects.count(), 2)
+
+    def test_foreign_records_not_read_changed_or_deleted(self):
+        for path in (f'products/{self.foreign_product.pk}/', f'categories/{self.foreign_category.pk}/'):
+            self.assertEqual(self.client.get(ROOT+path).status_code, 404)
+            self.assertEqual(self.patch(path, {'name': 'Stolen'}).status_code, 404)
+            self.assertEqual(self.client.delete(ROOT+path).status_code, 404)
+        self.foreign_product.refresh_from_db()
+        self.assertEqual(self.foreign_product.name, 'Foreign')
+
+    def test_category_crud_duplicate_and_foreign_parent(self):
+        response = self.client.post(ROOT+'categories/', {'name': 'New category', 'parent': self.category.pk, 'order_cat': 2, 'excel_order': 9}, format='json')
+        self.assertEqual(response.status_code, 201)
+        pk = response.data['id']
+        self.assertEqual(self.client.post(ROOT+'categories/', {'name': 'New category', 'parent': self.category.pk}, format='json').status_code, 400)
+        self.assertEqual(self.patch(f'categories/{pk}/', {'parent': self.foreign_category.pk}).status_code, 400)
+        response = self.patch(f'categories/{pk}/', {'name': 'Renamed', 'parent': None, 'order_cat': None})
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.data['name'], 'Renamed')
+        self.assertEqual(self.client.delete(ROOT+f'categories/{pk}/').status_code, 204)
+
+    def test_category_cycles_and_nonempty_deletion_blocked(self):
+        child = ProductCategory.objects.create(sys_ws=self.workspace, name='Child', parent=self.category)
+        self.assertEqual(self.patch(f'categories/{self.category.pk}/', {'parent': child.pk}).status_code, 400)
+        self.assertEqual(self.patch(f'categories/{child.pk}/', {'parent': child.pk}).status_code, 400)
+        self.assertEqual(self.client.delete(ROOT+f'categories/{self.category.pk}/').status_code, 409)
+        self.assertTrue(Product.objects.filter(pk=self.product.pk).exists())
+
+    def test_product_with_order_or_cart_cannot_delete(self):
+        order = Order.objects.create(sys_ws=self.workspace, customer=self.customer, total_price=10, factor_type=1)
+        OrderItem.objects.create(order=order, product=self.product, product_name='P', price=10, amount=1)
+        self.assertEqual(self.client.delete(ROOT+f'products/{self.product.pk}/').status_code, 409)
+        self.assertTrue(OrderItem.objects.filter(order=order).exists())
+        OrderItem.objects.all().delete()
+        Cart.objects.create(sys_ws=self.workspace, product=self.product, cuser_role=self.role, quantity=1)
+        self.assertEqual(self.client.delete(ROOT+f'products/{self.product.pk}/').status_code, 409)
+
+    def test_bulk_move_toggle_and_reorder(self):
+        second = Product.objects.create(sys_ws=self.workspace, category=self.category, name='Second', price=0)
+        target = ProductCategory.objects.create(sys_ws=self.workspace, name='Target')
+        for action, fields in (('move', {'category': target.pk}), ('view_only', {'view_only': True}), ('excel_order', {})):
+            response = self.client.post(ROOT+'products/bulk/', dict(ids=[second.pk, self.product.pk], action=action, **fields), format='json')
+            self.assertEqual(response.status_code, 200, response.data)
+        self.product.refresh_from_db()
+        self.assertEqual(self.product.category, target)
+        self.assertTrue(self.product.view_only)
+        self.assertEqual(self.product.excel_order, 2)
+
+    def test_bulk_foreign_or_duplicate_ids_roll_back(self):
+        for ids in ([self.product.pk, self.foreign_product.pk], [self.product.pk, self.product.pk]):
+            response = self.client.post(ROOT+'products/bulk/', {'ids': ids, 'action': 'view_only', 'view_only': True}, format='json')
+            self.assertEqual(response.status_code, 400)
+        self.product.refresh_from_db()
+        self.assertFalse(self.product.view_only)
+
+    def test_bulk_deletion_all_or_nothing(self):
+        removable = Product.objects.create(sys_ws=self.workspace, category=self.category, name='Removable', price=0)
+        Cart.objects.create(sys_ws=self.workspace, product=self.product, cuser_role=self.role, quantity=1)
+        response = self.client.post(ROOT+'products/bulk/', {'ids': [removable.pk, self.product.pk], 'action': 'delete'}, format='json')
+        self.assertEqual(response.status_code, 409)
+        self.assertTrue(Product.objects.filter(pk=removable.pk).exists())
+
+    def test_legacy_category_update_fixed_and_cross_workspace_product_rejected(self):
+        response = self.client.put(f'/shop/product-category/update/{self.category.pk}/', {'name': 'Fixed'}, format='json')
+        self.assertEqual(response.status_code, 200, response.data)
+        self.assertEqual(response.data['name'], 'Fixed')
+        response = self.client.post('/shop/product/create/', {'name': 'X', 'price': 1, 'category': self.foreign_category.pk}, format='json')
+        self.assertEqual(response.status_code, 400)
+        self.assertEqual(self.client.delete(f'/shop/product-category/delete/{self.category.pk}/').status_code, 409)
+
+    def test_excel_template_export_is_workspace_scoped_and_formula_safe(self):
+        self.product.name = '=1+1'
+        self.product.save()
+        response = self.client.get(ROOT+'products/export/?search=P1')
+        self.assertEqual(response.status_code, 200)
+        sheet = load_workbook(BytesIO(response.content)).active
+        self.assertEqual(sheet.cell(2, 3).data_type, 's')
+        self.assertEqual(sheet.max_row, 2)
+        self.assertEqual(self.client.get(ROOT+'import/template/').status_code, 200)
+
+    def test_import_preview_confirm_replay_and_report(self):
+        response = self.preview()
+        self.assertEqual(response.status_code, 201, response.data)
+        batch_id = response.data['id']
+        self.assertFalse(response.data['committed'])
+        self.assertFalse(Product.objects.filter(acc_code='EXCEL1').exists())
+        self.assertEqual(self.client.get(ROOT+'imports/').data['count'], 1)
+        self.assertEqual(self.client.get(ROOT+f'imports/{batch_id}/report/').status_code, 200)
+        for _ in range(2):
+            response = self.client.post(ROOT+f'imports/{batch_id}/confirm/', {}, format='json')
+            self.assertEqual(response.status_code, 200, response.data)
+            self.assertTrue(response.data['committed'])
+        self.assertEqual(Product.objects.filter(acc_code='EXCEL1').count(), 1)
+
+    def test_import_atomic_and_skip_modes(self):
+        bad = [['Good', 'Valid', 'GOOD', 1], ['Bad', 'Invalid', 'BAD', -1]]
+        response = self.preview(file=self.upload(bad))
+        self.assertEqual(response.data['errors'], 1)
+        self.assertFalse(response.data['can_confirm'])
+        batch_id = response.data['id']
+        self.client.post(ROOT+f'imports/{batch_id}/confirm/')
+        self.assertFalse(Product.objects.filter(acc_code='GOOD').exists())
+        response = self.preview(file=self.upload(bad), errors='skip')
+        batch_id = response.data['id']
+        result = self.client.post(ROOT+f'imports/{batch_id}/confirm/').data
+        self.assertTrue(result['committed'])
+        self.assertEqual(result['errors'], 1)
+        self.assertTrue(Product.objects.filter(acc_code='GOOD').exists())
+        self.assertFalse(ProductCategory.objects.filter(name='Invalid').exists())
+
+    def test_import_wrong_options_mapping_or_file_returns_error(self):
+        for values in ({'mode': 'unknown'}, {'mapping': '[]'}, {'header_row': 0}, {'file': SimpleUploadedFile('bad.xlsx', b'bad')}):
+            response = self.preview(**values)
+            self.assertEqual(response.status_code, 400, response.data)
+
+    def test_import_expired_or_changed_catalog_cannot_confirm(self):
+        for expired in (True, False):
+            batch_id = self.preview().data['id']
+            if expired:
+                ProductImportBatch.objects.filter(pk=batch_id).update(expires_at=timezone.now()-timedelta(seconds=1))
+            else:
+                self.product.name = 'Changed'
+                self.product.save()
+            self.assertEqual(self.client.post(ROOT+f'imports/{batch_id}/confirm/').status_code, 400)
+        self.assertFalse(Product.objects.filter(acc_code='EXCEL1').exists())
+
+    def test_import_other_workspace_and_other_owner_hidden(self):
+        batch_id = self.preview().data['id']
+        self.admin_role.sys_ws = self.other_workspace
+        self.admin_role.save()
+        self.use_role(self.admin_role)
+        for suffix in ('', 'report/', 'confirm/'):
+            method = self.client.post if suffix == 'confirm/' else self.client.get
+            self.assertEqual(method(ROOT+f'imports/{batch_id}/'+suffix).status_code, 404)
+        self.assertEqual(self.client.get(ROOT+'imports/').data['count'], 0)
+
+    def test_import_rows_paginate_without_losing_report_rows(self):
+        rows = [[f'P{i}', 'C', f'CODE{i}', 1] for i in range(101)]
+        response = self.preview(file=self.upload(rows))
+        self.assertEqual(len(response.data['rows']), 100)
+        self.assertEqual(response.data['row_count'], 101)
+        batch_id = response.data['id']
+        self.assertEqual(len(self.client.get(ROOT+f'imports/{batch_id}/?row_page=2').data['rows']), 1)
+        self.assertEqual(self.client.get(ROOT+f'imports/{batch_id}/?row_page=0').status_code, 400)
+
+    def test_category_multipart_image_and_clearing_nullable_fields(self):
+        from tempfile import TemporaryDirectory
+        from django.test import override_settings
+        from PIL import Image
+        content = BytesIO()
+        Image.new('RGB', (2, 2), color='blue').save(content, format='PNG')
+        with TemporaryDirectory(dir='../../reports/product-management') as directory, override_settings(MEDIA_ROOT=directory):
+            upload = SimpleUploadedFile('category.png', content.getvalue(), content_type='image/png')
+            response = self.client.post(ROOT+'categories/', {'name': 'Image', 'parent': '', 'order_cat': '', 'excel_order': '', 'image': upload}, format='multipart')
+            self.assertEqual(response.status_code, 201, response.data)
+            self.assertIsNone(response.data['order_cat'])
+            pk = response.data['id']
+            self.assertTrue(response.data['image'].endswith('.png'))
+            response = self.patch(f'categories/{pk}/', {'image': None, 'order_cat': 4})
+            self.assertEqual(response.status_code, 200)
+            self.assertIsNone(response.data['image'])
+
+    def test_category_negative_and_out_of_range_orders_are_rejected(self):
+        for values in ({'order_cat': -1}, {'excel_order': -1}, {'order_cat': 2147483648}):
+            data = {'name': 'Invalid'}
+            data.update(values)
+            self.assertEqual(self.client.post(ROOT+'categories/', data, format='json').status_code, 400)

apps/shop/urls.py

@@ -1,7 +1,25 @@
 from django.urls import path
 from apps.shop.views import *
+from apps.shop.views.management import (
+    ProductManagementListApi, ProductManagementDetailApi, CategoryManagementListApi,
+    CategoryManagementDetailApi, ProductBulkApi, ProductExportApi,
+    ProductImportPreviewApi, ProductImportListApi, ProductImportDetailApi,
+    ProductImportConfirmApi, ProductImportReportApi, ProductImportTemplateApi,
+)
 
 urlpatterns = [
+    path('manage/products/', ProductManagementListApi.as_view()),
+    path('manage/products/bulk/', ProductBulkApi.as_view()),
+    path('manage/products/export/', ProductExportApi.as_view()),
+    path('manage/products/<int:pk>/', ProductManagementDetailApi.as_view()),
+    path('manage/categories/', CategoryManagementListApi.as_view()),
+    path('manage/categories/<int:pk>/', CategoryManagementDetailApi.as_view()),
+    path('manage/import/preview/', ProductImportPreviewApi.as_view()),
+    path('manage/import/template/', ProductImportTemplateApi.as_view()),
+    path('manage/imports/', ProductImportListApi.as_view()),
+    path('manage/imports/<int:pk>/', ProductImportDetailApi.as_view()),
+    path('manage/imports/<int:pk>/confirm/', ProductImportConfirmApi.as_view()),
+    path('manage/imports/<int:pk>/report/', ProductImportReportApi.as_view()),
     path('product-category/create/', ProductCategoryCreateApi.as_view(), name='create_product_category'),
     path('product-category/<int:category_id>/', ProductCategoryRetrieveApi.as_view(), name='retrieve_product_category'),
     path('product-category/update/<int:category_id>/', ProductCategoryUpdateApi.as_view(), name='update_product_category'),

apps/shop/views/excel_import.py

@@ -5,45 +5,34 @@ from apps.shop.models import Product as ProductModel, ProductCategory as Product
 from apps.workspace.models import Workspace as WorkspaceModel, City as CityModel
 from apps.customer.models import Customer as CustomerModel
 from apps.customer.models import ResponsibleGroup as ResponsibleGroupModel
-import os
+from django.core.exceptions import ValidationError as DjangoValidationError
+from django.db import IntegrityError, transaction
+from rest_framework import exceptions
+from rest_framework.permissions import IsAuthenticated
+from utils import custom_permissions
+from utils.get_user_workspace import get_user_workspace
+from utils.validations.mobile import normalize_mobile
 
 
 class ImportExcelView(APIView):
+    permission_classes = (IsAuthenticated, custom_permissions.WorkspaceAdminPermission)
 
     def get(self, request):
-
-        df = pd.read_excel('pe.xlsx')
-        for index, row in df.iterrows():
-            cate_name = row['cate_name']
-            #order_cat = row['order_cat']
-            acc_code = row['acc_code']
-            prd_name = row['name']
-            order_prd = row['size']
-            vahed = row['vahed']
-
-            workspace = WorkspaceModel.objects.get(id=2)
-            try:
-                prd_ct = ProductCategoryModel.objects.get(name=cate_name, sys_ws=workspace)
-            except ProductCategoryModel.DoesNotExist as exp:
-                prd_ct = ProductCategoryModel.objects.create(name=cate_name, sys_ws=workspace)
-
-            if ProductModel.objects.filter(acc_code=acc_code).exists() == False:
-                new_product = ProductModel()
-                new_product.name = prd_name
-                new_product.price = 0
-                new_product.category = ProductCategoryModel.objects.get(id=prd_ct.id)
-                new_product.acc_code = acc_code
-                new_product.order_prd = order_prd
-                new_product.view_only = True
-                new_product.attr = {"acc_vahed": vahed}
-                new_product.sys_ws = workspace
-                new_product.save()
-            else:
-                up_product = ProductModel.objects.get(acc_code=acc_code)
-                up_product.name = prd_name
-                up_product.save()
-
-        return Response(data={"result": 'ok'})
+        # Keep the legacy URL and filename, but use the same validated importer as Admin.
+        from django.core.files import File
+        from apps.shop.product_import import parse_workbook, import_products
+        try:
+            with open('pe.xlsx', 'rb') as source:
+                rows = parse_workbook(File(source, name='pe.xlsx'))
+            for row in rows:
+                row['values'].setdefault('view_only', 'true')
+            result = import_products(get_user_workspace(request), rows,
+                {'mode': 'upsert', 'create_categories': True, 'errors': 'atomic', 'ordering': 'preserve'})
+        except (OSError, DjangoValidationError) as error:
+            raise exceptions.ValidationError(getattr(error, 'messages', ['فایل اکسل محصولات خوانده نشد.']))
+        if not result['committed']:
+            raise exceptions.ValidationError(result)
+        return Response(data={'result': 'ok', 'imported': result['created'] + result['updated']})
 
 
 class ImportExcelCitysView(APIView):
@@ -72,43 +61,46 @@ class ImportExcelCitysView(APIView):
         return Response(data={"result": 'ok'})
 
 
+def customer_from_excel(row, workspace):
+    mobile = row['mobile']
+    if pd.isna(mobile) or pd.isna(row['name']):
+        raise exceptions.ValidationError('نام و شماره موبایل مشتری الزامی است.')
+    if isinstance(mobile, float) and mobile.is_integer():
+        mobile = int(mobile)
+    city = CityModel.objects.filter(name=row['shar'], ostan__name=row['ostan'], ostan__is_ostan=True).first()
+    city = city or CityModel.objects.filter(pk=1229).first()
+    if not city:
+        raise exceptions.ValidationError('شهر مشتری در فایل پیدا نشد.')
+    group = ResponsibleGroupModel.objects.filter(pk=row['id_mantaghe'], sys_ws=workspace).first()
+    if not group:
+        raise exceptions.ValidationError('گروه مسئول متعلق به این فضای کاری نیست.')
+    customer = CustomerModel(name_family=row['name'], mobile=normalize_mobile(mobile), city=city,
+                             responsible_group=group, sys_ws=workspace,
+                             phone=None if pd.isna(row['phone']) else row['phone'],
+                             address=None if pd.isna(row['address']) else row['address'])
+    customer.full_clean()
+    customer.save()
+
+
 class ImportExcelCustomersView(APIView):
+    permission_classes = (IsAuthenticated, custom_permissions.WorkspaceAdminPermission)
 
+    @transaction.atomic
     def get(self, request):
-
-        df = pd.read_excel('customersData.xlsx')
-        for index, row in df.iterrows():
-            name = row['name']
-            mobile = row['mobile']
-
-            if name and mobile:
-
-                phone = row['phone']
-                address = row['address']
-                ostan = row['ostan']
-                shahr = row['shar']
-                mantaghe = row['id_mantaghe']
-
-                try:
-                    ostan_obj = CityModel.objects.get(name=ostan, is_ostan=True)
-                    shahr_obj = CityModel.objects.get(name=shahr, ostan=ostan_obj)
-                except Exception as exp:
-                    shahr_obj = CityModel.objects.get(id=1229)
-
-                try:
-                    cs = CustomerModel()
-                    cs.name_family = name
-                    cs.mobile = mobile
-                    if phone:
-                        cs.phone = phone
-
-                    cs.city = shahr_obj
-                    if address:
-                        cs.address = address
-                    cs.responsible_group = ResponsibleGroupModel.objects.get(id=mantaghe)
-                    cs.sys_ws = WorkspaceModel.objects.get(id=2)
-                    cs.save()
-                except Exception as exp:
-                    print(name)
-
-        return Response(data={"result": 'ok'})
+        workspace = get_user_workspace(request)
+        try:
+            data = pd.read_excel('customersData.xlsx')
+        except (OSError, ValueError):
+            raise exceptions.ValidationError('فایل اکسل مشتریان خوانده نشد.')
+        for index, row in data.iterrows():
+            try:
+                customer_from_excel(row, workspace)
+            except DjangoValidationError as error:
+                raise exceptions.ValidationError({'row': int(index)+2, 'errors': error.message_dict})
+            except IntegrityError:
+                raise exceptions.ValidationError({'row': int(index)+2, 'mobile': 'شماره موبایل مشتری تکراری است.'})
+            except exceptions.ValidationError as error:
+                raise exceptions.ValidationError({'row': int(index)+2, 'errors': error.detail})
+            except (KeyError, TypeError, ValueError):
+                raise exceptions.ValidationError({'row': int(index)+2, 'error': 'اطلاعات این ردیف معتبر نیست.'})
+        return Response(data={'result': 'ok', 'imported': len(data)})

apps/shop/views/management.py

@@ -0,0 +1,293 @@
+"""JWT-protected workspace administration for the CRM product pages."""
+from django.core.exceptions import ValidationError as ModelValidationError
+from django.db import DataError, IntegrityError, transaction
+from django.db.models import Count, Q
+from django.shortcuts import get_object_or_404
+from django.utils import timezone
+from rest_framework import serializers
+from rest_framework.exceptions import APIException, ValidationError
+from rest_framework.pagination import PageNumberPagination
+from rest_framework.permissions import IsAuthenticated
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from apps.shop.import_batches import preview_batch, confirm_batch, batch_report, import_template
+from apps.shop.import_models import ProductImportBatch
+from apps.shop.management_serializers import ProductManagementSerializer, CategoryManagementSerializer, ImportOptionsSerializer
+from apps.shop.models import Product, ProductCategory, Cart, OrderItem
+from apps.shop.ordering import product_ordering
+from apps.workspace.models import Workspace
+from utils.custom_permissions import WorkspaceAdminPermission
+from utils.get_user_workspace import get_user_workspace
+
+
+class CatalogConflict(APIException):
+    status_code = 409
+    default_detail = 'این عملیات با داده‌های فعلی سازگار نیست.'
+
+
+def ensure_product_deletable(product):
+    if OrderItem.objects.filter(product=product).exists() or Cart.objects.filter(product=product).exists():
+        raise CatalogConflict('محصول در سفارش یا سبد استفاده شده است؛ برای حفظ سوابق امکان حذف ندارد.')
+
+
+def ensure_category_deletable(category):
+    if Product.objects.filter(category=category).exists() or ProductCategory.objects.filter(parent=category).exists():
+        raise CatalogConflict('دسته دارای محصول یا زیردسته است؛ ابتدا محصولات و زیردسته‌ها را منتقل کنید.')
+
+
+class ManagementPagination(PageNumberPagination):
+    page_size = 25
+    page_size_query_param = 'page_size'
+    max_page_size = 100
+
+
+class ManagementApi(APIView):
+    permission_classes = (IsAuthenticated, WorkspaceAdminPermission)
+
+    def initial(self, request, *args, **kwargs):
+        super().initial(request, *args, **kwargs)
+        self.workspace = get_user_workspace(request)
+
+    def handle_exception(self, exc):
+        if isinstance(exc, ModelValidationError):
+            exc = ValidationError(exc.message_dict if hasattr(exc, 'message_dict') else {'detail': exc.messages})
+        elif isinstance(exc, (DataError, IntegrityError)):
+            exc = CatalogConflict('داده‌ها با محدودیت‌های دیتابیس سازگار نیستند یا هم‌زمان تغییر کرده‌اند؛ اطلاعات را تازه کنید.')
+        return super().handle_exception(exc)
+
+    def serializer_context(self):
+        return {'request': self.request, 'workspace': self.workspace}
+
+    def lock_workspace(self):
+        Workspace.objects.select_for_update().get(pk=self.workspace.pk)
+
+
+class ProductFilters(serializers.Serializer):
+    search = serializers.CharField(required=False, allow_blank=True, max_length=200)
+    category = serializers.IntegerField(required=False, min_value=1)
+    view_only = serializers.BooleanField(required=False)
+    price_min = serializers.IntegerField(required=False, min_value=0)
+    price_max = serializers.IntegerField(required=False, min_value=0)
+    ordering = serializers.ChoiceField(choices=('display', 'excel', 'name', '-name', 'price', '-price', '-created_at'), default='display')
+
+    def validate(self, attrs):
+        if attrs.get('price_min', 0) > attrs.get('price_max', 9223372036854775807):
+            raise ValidationError({'price_max': 'حداکثر قیمت باید از حداقل کمتر نباشد.'})
+        return attrs
+
+
+def filtered_products(workspace, parameters):
+    serializer = ProductFilters(data=parameters)
+    serializer.is_valid(raise_exception=True)
+    data = serializer.validated_data
+    queryset = Product.objects.filter(sys_ws=workspace).select_related('category')
+    if data.get('search'):
+        queryset = queryset.filter(Q(name__icontains=data['search']) | Q(acc_code__icontains=data['search']) | Q(category__name__icontains=data['search']))
+    if 'category' in data:
+        queryset = queryset.filter(category_id=data['category'])
+    if 'view_only' in data:
+        queryset = queryset.filter(view_only=data['view_only'])
+    for key, lookup in (('price_min', 'price__gte'), ('price_max', 'price__lte')):
+        if key in data:
+            queryset = queryset.filter(**{lookup: data[key]})
+    ordering = data['ordering']
+    return queryset.order_by(*product_ordering(excel=ordering == 'excel')) if ordering in ('display', 'excel') else queryset.order_by(ordering, 'pk')
+
+
+class ProductManagementListApi(ManagementApi):
+    def get(self, request):
+        pagination = ManagementPagination()
+        rows = pagination.paginate_queryset(filtered_products(self.workspace, request.query_params), request)
+        return pagination.get_paginated_response(ProductManagementSerializer(rows, many=True).data)
+
+    @transaction.atomic
+    def post(self, request):
+        self.lock_workspace()
+        serializer = ProductManagementSerializer(data=request.data, context=self.serializer_context())
+        serializer.is_valid(raise_exception=True)
+        product = Product(sys_ws=self.workspace, **serializer.validated_data)
+        product.full_clean()
+        product.save()
+        return Response(ProductManagementSerializer(product).data, status=201)
+
+
+class ProductManagementDetailApi(ManagementApi):
+    def get(self, request, pk):
+        product = get_object_or_404(Product, pk=pk, sys_ws=self.workspace)
+        return Response(ProductManagementSerializer(product).data)
+
+    @transaction.atomic
+    def patch(self, request, pk):
+        self.lock_workspace()
+        product = get_object_or_404(Product.objects.select_for_update(), pk=pk, sys_ws=self.workspace)
+        serializer = ProductManagementSerializer(product, data=request.data, partial=True, context=self.serializer_context())
+        serializer.is_valid(raise_exception=True)
+        for name, value in serializer.validated_data.items():
+            setattr(product, name, value)
+        product.full_clean()
+        product.save()
+        return Response(ProductManagementSerializer(product).data)
+
+    put = patch
+
+    @transaction.atomic
+    def delete(self, request, pk):
+        self.lock_workspace()
+        product = get_object_or_404(Product.objects.select_for_update(), pk=pk, sys_ws=self.workspace)
+        ensure_product_deletable(product)
+        product.delete()
+        return Response(status=204)
+
+
+class CategoryManagementListApi(ManagementApi):
+    def get(self, request):
+        queryset = ProductCategory.objects.filter(sys_ws=self.workspace).annotate(product_count=Count('product', distinct=True), child_count=Count('productcategory', distinct=True))
+        return Response(CategoryManagementSerializer(queryset, many=True, context=self.serializer_context()).data)
+
+    @transaction.atomic
+    def post(self, request):
+        self.lock_workspace()
+        serializer = CategoryManagementSerializer(data=request.data, context=self.serializer_context())
+        serializer.is_valid(raise_exception=True)
+        category = ProductCategory(sys_ws=self.workspace, **serializer.validated_data)
+        category.full_clean()
+        category.save()
+        return Response(CategoryManagementSerializer(category, context=self.serializer_context()).data, status=201)
+
+
+class CategoryManagementDetailApi(ManagementApi):
+    def get(self, request, pk):
+        category = get_object_or_404(ProductCategory, pk=pk, sys_ws=self.workspace)
+        return Response(CategoryManagementSerializer(category, context=self.serializer_context()).data)
+
+    @transaction.atomic
+    def patch(self, request, pk):
+        self.lock_workspace()
+        category = get_object_or_404(ProductCategory.objects.select_for_update(), pk=pk, sys_ws=self.workspace)
+        serializer = CategoryManagementSerializer(category, data=request.data, partial=True, context=self.serializer_context())
+        serializer.is_valid(raise_exception=True)
+        for name, value in serializer.validated_data.items():
+            setattr(category, name, value)
+        category.full_clean()
+        category.save()
+        return Response(CategoryManagementSerializer(category, context=self.serializer_context()).data)
+
+    put = patch
+
+    @transaction.atomic
+    def delete(self, request, pk):
+        self.lock_workspace()
+        category = get_object_or_404(ProductCategory.objects.select_for_update(), pk=pk, sys_ws=self.workspace)
+        ensure_category_deletable(category)
+        category.delete()
+        return Response(status=204)
+
+
+class ProductBulkSerializer(serializers.Serializer):
+    ids = serializers.ListField(child=serializers.IntegerField(min_value=1), min_length=1, max_length=100)
+    action = serializers.ChoiceField(choices=('delete', 'move', 'view_only', 'display_order', 'excel_order'))
+    category = serializers.IntegerField(min_value=1, required=False)
+    view_only = serializers.BooleanField(required=False)
+
+    def validate(self, attrs):
+        if len(set(attrs['ids'])) != len(attrs['ids']):
+            raise ValidationError({'ids': 'شناسه‌های تکراری مجاز نیست.'})
+        for action, key in (('move', 'category'), ('view_only', 'view_only')):
+            if attrs['action'] == action and key not in attrs:
+                raise ValidationError({key: 'این مقدار برای عملیات انتخاب‌شده لازم است.'})
+        return attrs
+
+
+class ProductBulkApi(ManagementApi):
+    @transaction.atomic
+    def post(self, request):
+        self.lock_workspace()
+        input_serializer = ProductBulkSerializer(data=request.data)
+        input_serializer.is_valid(raise_exception=True)
+        data = input_serializer.validated_data
+        products = {item.pk: item for item in Product.objects.select_for_update().filter(sys_ws=self.workspace, pk__in=data['ids'])}
+        if len(products) != len(data['ids']):
+            raise ValidationError({'ids': 'یک یا چند محصول در فضای کاری شما پیدا نشد.'})
+        for position, pk in enumerate(data['ids'], 1):
+            product = products[pk]
+            if data['action'] == 'delete':
+                ensure_product_deletable(product)
+                product.delete()
+            else:
+                values = bulk_values(data, position)
+                serializer = ProductManagementSerializer(product, data=values, partial=True, context=self.serializer_context())
+                serializer.is_valid(raise_exception=True)
+                for name, value in serializer.validated_data.items():
+                    setattr(product, name, value)
+                product.full_clean()
+                product.save()
+        return Response({'updated': len(products), 'action': data['action']})
+
+
+def bulk_values(data, position):
+    if data['action'] == 'move':
+        return {'category': data['category']}
+    if data['action'] == 'view_only':
+        return {'view_only': data['view_only']}
+    return {'order_prd' if data['action'] == 'display_order' else 'excel_order': position}
+
+
+class ProductExportApi(ManagementApi):
+    def get(self, request):
+        from apps.shop.admin import export_products
+        return export_products(filtered_products(self.workspace, request.query_params))
+
+
+def batch_data(batch, page=1):
+    result = batch.result
+    rows = result.get('rows', [])
+    return {'id': batch.pk, 'filename': batch.filename, 'created_at': batch.created_at, 'expires_at': batch.expires_at,
+            'confirmed_at': batch.confirmed_at, 'options': batch.payload['options'],
+            'created': result.get('created', 0), 'updated': result.get('updated', 0), 'errors': result.get('errors', 0),
+            'committed': bool(batch.confirmed_at), 'can_confirm': not batch.confirmed_at and batch.expires_at > timezone.now()
+            and (batch.payload['options']['errors'] == 'skip' or not result.get('errors')),
+            'row_count': len(rows), 'row_page': page, 'rows': rows[(page-1)*100:page*100]}
+
+
+class ProductImportPreviewApi(ManagementApi):
+    def post(self, request):
+        serializer = ImportOptionsSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        data = serializer.validated_data
+        options = {key: data[key] for key in ('mode', 'create_categories', 'errors', 'ordering')}
+        batch = preview_batch(request.user, self.workspace, data['file'], options, data['sheet'], data['header_row'], data['mapping'])
+        return Response(batch_data(batch), status=201)
+
+
+class ProductImportListApi(ManagementApi):
+    def get(self, request):
+        queryset = ProductImportBatch.objects.filter(sys_ws=self.workspace, created_by=request.user)
+        pagination = ManagementPagination()
+        rows = pagination.paginate_queryset(queryset, request)
+        results = [{key: value for key, value in batch_data(batch).items() if key != 'rows'} for batch in rows]
+        return pagination.get_paginated_response(results)
+
+
+class ProductImportDetailApi(ManagementApi):
+    def get(self, request, pk):
+        batch = get_object_or_404(ProductImportBatch, pk=pk, sys_ws=self.workspace, created_by=request.user)
+        page_serializer = serializers.IntegerField(min_value=1, max_value=50)
+        page = page_serializer.run_validation(request.query_params.get('row_page', 1))
+        return Response(batch_data(batch, page))
+
+
+class ProductImportConfirmApi(ManagementApi):
+    def post(self, request, pk):
+        return Response(batch_data(confirm_batch(pk, request.user, self.workspace)))
+
+
+class ProductImportReportApi(ManagementApi):
+    def get(self, request, pk):
+        batch = get_object_or_404(ProductImportBatch, pk=pk, sys_ws=self.workspace, created_by=request.user)
+        return batch_report(batch)
+
+
+class ProductImportTemplateApi(ManagementApi):
+    def get(self, request):
+        return import_template()

apps/shop/views/order.py

@@ -11,6 +11,7 @@ from rest_framework import generics
 from apps.customer.models import Customer as CustomerModel
 from rest_framework.permissions import IsAuthenticated
 from utils import custom_permissions
+import pandas as pd
 from utils.tools import inline_serializer
 from io import BytesIO
 
@@ -212,13 +213,14 @@ class OrderRetrieveOperatorApi(APIView):
 
 
 class OrderRetrieveOperatorExcelApi(APIView):
-    permission_classes = (IsAuthenticated, )
+    permission_classes = (IsAuthenticated, custom_permissions.WorkspaceOperatorPermission)
     def get(self, request, order_id):
 
         order_df = retrieve_order_item_excel(request=request, order_id=order_id)
 
         excel_file = BytesIO()
-        order_df.to_excel(excel_file, engine='xlsxwriter', index=False)
+        with pd.ExcelWriter(excel_file, engine='xlsxwriter', engine_kwargs={'options': {'strings_to_formulas': False, 'strings_to_urls': False}}) as writer:
+            order_df.to_excel(writer, index=False)
         excel_file.seek(0)
 
         response = HttpResponse(excel_file.read(), content_type='application/ms-excel')

apps/shop/views/product.py

@@ -16,11 +16,14 @@ class ProductCreateApi(APIView):
     permission_classes = (IsAuthenticated, custom_permissions.WorkspaceAdminPermission)
 
     class InputSerializer(serializers.Serializer):
-        name = serializers.CharField(required=True, max_length=20)
-        price = serializers.DecimalField(required=True, max_digits=20, decimal_places=2)
+        name = serializers.CharField(required=True, max_length=200)
+        price = serializers.IntegerField(required=True, min_value=0, max_value=9223372036854775807)
         category = serializers.IntegerField(required=True)
         acc_code = serializers.CharField(required=False)
-        attr = serializers.CharField(required=False)
+        attr = serializers.JSONField(required=False, allow_null=True)
+        order_prd = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+        excel_order = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+        view_only = serializers.BooleanField(required=False)
 
     class OutputSerializer(serializers.ModelSerializer):
         class Meta:
@@ -64,11 +67,14 @@ class ProductUpdateApi(APIView):
     permission_classes = (IsAuthenticated, custom_permissions.WorkspaceAdminPermission)
 
     class InputSerializer(serializers.Serializer):
-        name = serializers.CharField(required=True, max_length=20)
-        price = serializers.DecimalField(required=True, max_digits=20, decimal_places=2)
+        name = serializers.CharField(required=True, max_length=200)
+        price = serializers.IntegerField(required=True, min_value=0, max_value=9223372036854775807)
         category = serializers.IntegerField(required=True)
         acc_code = serializers.CharField(required=False)
-        attr = serializers.CharField(required=False)
+        attr = serializers.JSONField(required=False, allow_null=True)
+        order_prd = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+        excel_order = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+        view_only = serializers.BooleanField(required=False)
 
     class OutputSerializer(serializers.ModelSerializer):
         class Meta:
@@ -77,7 +83,7 @@ class ProductUpdateApi(APIView):
 
     def put(self, request, product_id: int):
 
-        serializer = self.InputSerializer(data=request.data)
+        serializer = self.InputSerializer(data=request.data, partial=True)
         serializer.is_valid(raise_exception=True)
 
         user_workspace_uuid = get_user_workspace_uuid(request)
@@ -116,7 +122,7 @@ class ProductListApi(generics.ListAPIView):
 
     class OutputSerializer(serializers.ModelSerializer):
         class Meta:
-            model = ProductCategoryModel
+            model = ProductModel
             exclude = ('sys_ws', )
 
     def get_queryset(self):
@@ -154,7 +160,7 @@ class ProductListCategoryApi(generics.ListAPIView):
             )
         data = {
             "category_name": category.name,
-            "category_img": category.image.url,
+            "category_img": category.image.url if category.image else None,
             "products": serializer.data,
         }
 

apps/shop/views/product_category.py

@@ -18,8 +18,10 @@ class ProductCategoryCreateApi(APIView):
     permission_classes = (IsAuthenticated, custom_permissions.WorkspaceAdminPermission)
 
     class InputSerializer(serializers.Serializer):
-        name = serializers.CharField(required=True, max_length=20)
-        parent = serializers.IntegerField(required=False)
+        name = serializers.CharField(required=True, max_length=60)
+        parent = serializers.IntegerField(required=False, allow_null=True)
+        order_cat = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+        excel_order = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
 
     class OutputSerializer(serializers.ModelSerializer):
         class Meta:
@@ -62,7 +64,10 @@ class ProductCategoryUpdateApi(APIView):
     permission_classes = (IsAuthenticated, custom_permissions.WorkspaceAdminPermission)
 
     class InputSerializer(serializers.Serializer):
-        name = serializers.CharField(required=True)
+        name = serializers.CharField(required=False, max_length=60)
+        parent = serializers.IntegerField(required=False, allow_null=True)
+        order_cat = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
+        excel_order = serializers.IntegerField(required=False, allow_null=True, min_value=0, max_value=2147483647)
 
     class OutputSerializer(serializers.ModelSerializer):
         class Meta:
@@ -74,11 +79,11 @@ class ProductCategoryUpdateApi(APIView):
         serializer = self.InputSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
-        name = serializer.validated_data.get
+        name = serializer.validated_data.get("name")
 
         user_workspace_uuid = get_user_workspace_uuid(request)
 
-        product_category_obj = update_product_category(name=name, category_id=category_id, workspace_uuid=user_workspace_uuid)
+        product_category_obj = update_product_category(category_id=category_id, workspace_uuid=user_workspace_uuid, **serializer.validated_data)
 
         output = self.OutputSerializer(product_category_obj)
 
@@ -146,6 +151,7 @@ class ProductCategoryListApi(generics.ListAPIView):
 
 
 class ProductsCategoryApi(APIView):
+    permission_classes = (IsAuthenticated, custom_permissions.WorkspaceCustomerPermission)
 
     class OutputSerializer(serializers.ModelSerializer):
         product_count = serializers.IntegerField()
@@ -156,7 +162,9 @@ class ProductsCategoryApi(APIView):
 
     def get(self, request):
 
-        p_cate = ProductCategoryModel.objects.annotate(product_count=Count('product')).filter(product_count__gte=1).order_by('order_cat')
+        p_cate = ProductCategoryModel.objects.filter(
+            sys_ws__uuid=get_user_workspace_uuid(request),
+        ).annotate(product_count=Count('product')).filter(product_count__gte=1)
         output = self.OutputSerializer(p_cate, many=True)
 
         return Response(data=output.data, status=status.HTTP_200_OK)