# Configurare ERP/CRM DiDi

Variabile de mediu, credentiale, integrari externe.

## Fisier `.env`

Localizat la `~/erp_crm/.env`. NU se commiteaza in git.

```env
# MariaDB
MYSQL_ROOT_PASSWORD=<schimba-ma>
DB_PASSWORD=<schimba-ma>

# ERPNext
ERPNEXT_VERSION=v15
FRAPPE_VERSION=v15
SITE_NAME=didi-erp
ADMIN_PASSWORD=<schimba-ma>

# Redis (intern, container DNS)
REDIS_CACHE=redis-cache:6379
REDIS_QUEUE=redis-queue:6379
REDIS_SOCKETIO=redis-queue:6379

# Network
ERPNEXT_PORT=8080
```

### Variabile critice de schimbat la productie

| Variabila | De ce | Recomandare |
|-----------|-------|-------------|
| `MYSQL_ROOT_PASSWORD` | Acces total la DB | 32+ caractere random |
| `ADMIN_PASSWORD` | Login ERPNext Administrator | Min 12 caractere, schimbare la prima logare |
| `DB_PASSWORD` | Conexiune Frappe la DB | Generat random la `bench new-site` |

Genereaza parole:

```bash
openssl rand -base64 24
# sau
pwgen -s 32 1
```

## Configurare in DB (post-install)

Anumite valori sunt setate doar in DB, nu in `.env`.

### `Global Defaults`

| Camp | Valoare implicita | Unde se schimba |
|------|-------------------|-----------------|
| `default_company` | TOP CLOSSERS SRL | UI: Setup > Global Defaults |
| `default_currency` | RON | UI: Setup > Global Defaults |
| `country` | Romania | UI: Setup > Global Defaults |

### `System Settings`

| Camp | Valoare implicita |
|------|-------------------|
| `time_zone` | Europe/Bucharest |
| `language` | ro |
| `setup_complete` | 1 |
| `host_name` | http://didi-erpnext:8080 |
| `country` | Romania |

### `Website Settings`

| Camp | Valoare |
|------|---------|
| `home_page` | login (sau pagina ce vrei) |
| `disable_signup` | 1 (sign-up doar prin Stripe checkout) |

## Company config

Company-ul `TOP CLOSSERS SRL` are urmatoarele conturi default (din planul de conturi RO):

| Setting | Cont |
|---------|------|
| `default_receivable_account` | Clienti - facturi de intocmit - TC |
| `default_income_account` | 704 - Venituri din servicii prestate - TC |
| `default_cash_account` | Casa in lei - TC |
| `default_bank_account` | Conturi la banci in lei - TC |
| `round_off_account` | Round Off - TC |
| `cost_center` | Main - TC |

## Tax templates

| Template | Cota | Cont colectata |
|----------|------|----------------|
| TVA 21% | 21% | 4427 - 4427 - TVA colectata - TC |

TVA 21% e cota standard RO de la 01.08.2025. Pentru cote reduse (5%, 9%), se creeaza template-uri suplimentare.

## Custom Fields

Adaugate de `scripts/setup/02-doctypes.py`:

### `Customer`
- `didi_user_id` (Data) - UUID Keycloak, link la userul DiDi
- `iam_role` (Data) - `free_tier` / `paid_tier` / `enterprise_tier`
- `active_plan` (Data) - cheia planului curent (paid-monthly, etc.)
- `plan_activation_date` (Date) - data activarii

### `Lead`
- `source_form` (Data) - formularul de origine (contact, demo, etc.)
- `page_origin` (Data) - pagina de origine
- `utm_source`, `utm_medium`, `utm_campaign` (Data)

### `Sales Invoice`
- `analysis_consumed` (Check) - daca analiza din factura a fost folosita
- `analysis_session_id` (Data) - ID-ul sesiunii de analiza in DiDi

### `Payment Log`
- `stripe_session_id` (Data, indexed) - ID Stripe Checkout Session

## Custom DocTypes (didi_custom)

| DocType | Scop |
|---------|------|
| `Analysis Report` | Raport rezultate analiza cu PDF atasat |
| `Payment Log` | Log evenimente webhook Stripe |
| `Service Agreement` | Acord servicii la activarea unui plan |
| `Website Content` | CMS pentru paginile publice (homepage, services, etc.) |

## Integrari externe

### SendGrid (email tranzactional)

| Setting | Valoare |
|---------|---------|
| Email Account | `DiDi Outgoing` |
| SMTP Server | smtp.sendgrid.net:587 |
| TLS | DA |
| Username (`login_id`) | `apikey` (literal) |
| Password | API key SendGrid (`SG.xxxxxxxx...`) |
| Default outgoing | DA |
| Send notifications | DA |
| From | office@clossers.com (Sender Identity verificat) |

API key se genereaza din: SendGrid > Settings > API Keys > Create

Sender Identity se verifica din: SendGrid > Settings > Sender Authentication > Verify Single Sender (sau Domain Authentication pentru deliverability mai buna).

### Stripe (plati)

ERPNext nu se conecteaza direct la Stripe. Toate platile pleaca via website-ul Next.js care:
1. Creeaza Stripe Checkout Session
2. Stripe trimite webhook la `/api/webhooks/stripe`
3. Website apeleaza ERPNext API pentru a crea Sales Invoice + Payment Entry + Payment Log

Variabilele Stripe sunt in `~/website/.env.production`, nu aici.

### Keycloak (autentificare)

ERPNext NU foloseste Keycloak direct - se logheaza doar admin/Administrator local. Userii finali (clientii) se logheaza prin website via Keycloak, iar website-ul ii referenctiaza in ERPNext prin `Customer.didi_user_id`.

### API tokens pentru integrare externa (website -> ERPNext)

User dedicat: `Administrator` (sau cream `website_api@didi.local` cu rol Website Integration).

Token-ul de API key + secret se genereaza din:
ERPNext > Settings > User > [user] > API Access > Generate Keys

Format header pentru request:
```
Authorization: token <api_key>:<api_secret>
```

## SECURITATE — token-urile

**Token-urile NU se mai pun in acest fisier.** Sunt stocate doar in `.env` (gitignored):

```bash
# In ~/erp_crm/.env si ~/website/.env.production
ERPNEXT_API_KEY=<api_key_generat>
ERPNEXT_API_SECRET=<api_secret_generat>
```

**Recomandare puternica**: NU folosi userul `Administrator` ca service account pentru website. Creeaza un user dedicat:

```bash
# 1. Creeaza userul website_api@didi.local cu rol "Website Integration"
docker exec didi-erpnext bench --site didi-erp add-user \
  website_api@didi.local --first-name "Website" --last-name "API" --send-welcome-email 0

# 2. Asigneaza rol minim necesar (in UI: Settings > User > website_api@didi.local > Roles)
#    Roles recomandate: "Website Manager", "Sales User", "Accounts User"
#    NU asigna "System Manager" (echivalentul de admin)

# 3. Genereaza key+secret pentru noul user
docker exec didi-erpnext bash -c '
cd /home/frappe/frappe-bench && \
bench --site didi-erp execute frappe.core.doctype.user.user.generate_keys \
  --args "[\"website_api@didi.local\"]"
'

# 4. Output: copiaza api_key:api_secret in .env (NU comita in repo)
```

**Pentru rotatie** (Administrator sau service account):
```bash
docker exec didi-erpnext bash -c '
cd /home/frappe/frappe-bench && \
bench --site didi-erp execute frappe.core.doctype.user.user.generate_keys \
  --args "[\"<user_email>\"]"
'
```

**ATENTIE**: Generarea unei chei noi INVALIDEAZA cheile vechi. Actualizeaza imediat `.env` in toate locatiile (website, erp_crm, agent-v3 daca aplicabil).

## Porturi expuse

| Port host | Container | Scop |
|-----------|-----------|------|
| 8080 | didi-erpnext:8080 | Web UI + API |
| 3307 | didi-mariadb:3306 | DB (pentru debug, nu expune la prod) |

Pentru productie, expune doar 8080 via reverse proxy (nginx/Caddy) cu HTTPS.

## Workspace-uri custom

Configurate de `scripts/setup/06-sidebar.py`. Active (vizibile):

| Workspace | Continut |
|-----------|----------|
| Home | Welcome page Frappe |
| Facturi | Sales Invoice list + shortcut Create |
| Clienti | Customer list |
| CRM | Lead, Opportunity, pipeline Kanban |
| Servicii | Item list (DIDI-*) |
| Plati | Payment Entry + Payment Log |
| Contabilitate | Account, Journal Entry, GL Entry |
| Financial Reports | Trial Balance, P&L, Balance Sheet, etc. |
| Website CMS | Website Content list |

Ascunse (standard ERPNext nefolosit): Selling, Buying, Stock, Assets, Quality, Projects, Support, Manufacturing.

## Notificari email

Configurate de `scripts/setup/08-email.py`:

| Notification | Trigger | Receiver |
|--------------|---------|----------|
| DiDi - Factura Emisa | Sales Invoice Submit | customer.email_id (cu PDF atasat) |
| DiDi - Plata Confirmata | Payment Log New | customer.email_id |
| DiDi - Expirare Abonament | Subscription, 7 zile inainte | customer.email_id |

## Limba

Frappe e configurat in `ro` (Romana). Traduceri suplimentare in `scripts/setup/05-translations.py` (~146 termeni custom DiDi).

Schimbare limba per user: User > Language.