diff --git a/app/include_topbar.php b/app/include_topbar.php
index 88f642c..b069679 100644
--- a/app/include_topbar.php
+++ b/app/include_topbar.php
@@ -1,5 +1,9 @@
getStatus();
+$_usage_max_pct = max($_usage['daily_pct'], $_usage['weekly_pct']);
+$_usage_warn = $_usage_max_pct >= 80 && $_usage_max_pct < 100;
+$_usage_full = $_usage_max_pct >= 100;
?>
@@ -183,6 +192,22 @@ $topbar_show_accounting = in_array($topbar_app_access, ['all', 'accounting']);
+
+
+
+
+
+
+ Limit reached — reports locked
+
+ % usage
+
+
+
+
+
diff --git a/app/inventory/api/engine/manage_storage.php b/app/inventory/api/engine/manage_storage.php
index 6c73a56..e6105dc 100644
--- a/app/inventory/api/engine/manage_storage.php
+++ b/app/inventory/api/engine/manage_storage.php
@@ -2,7 +2,7 @@
session_start();
require '../../../assets/utils/db_auth.php';
require '../../../assets/utils/classes/WarehouseManager.php';
- require '../../../assets/utils/classes/CompanySettingManager.php';
+ require_once '../../../assets/utils/classes/CompanySettingManager.php';
require_role($user_role, ['owner', 'admin']);
diff --git a/app/login/api/engine/invited_onboarding.php b/app/login/api/engine/invited_onboarding.php
new file mode 100644
index 0000000..ed23ac5
--- /dev/null
+++ b/app/login/api/engine/invited_onboarding.php
@@ -0,0 +1,149 @@
+ 0, 'message' => ''];
+
+// ── Step 1: Session guard ─────────────────────────────────────────────────────
+if (empty($_SESSION['invited_user_id']) || empty($_SESSION['invited_token'])) {
+ $answer['message'] = 'Invalid session. Please use your invitation link.';
+ http_response_code(403);
+ exit(json_encode($answer));
+}
+
+$user_id = (int)$_SESSION['invited_user_id'];
+$token = $_SESSION['invited_token'];
+
+// ── Step 2: CSRF check ────────────────────────────────────────────────────────
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+ $csrf = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
+ if (empty($csrf) || $csrf !== ($_SESSION['csrf_token'] ?? '')) {
+ http_response_code(403);
+ $answer['message'] = 'Invalid request.';
+ exit(json_encode($answer));
+ }
+}
+
+$data = json_decode($_POST['json'] ?? '{}', true) ?: [];
+
+try {
+
+ // ── Step 3: Re-validate token ─────────────────────────────────────────────
+ $sth = $pdo1->prepare(
+ "SELECT user_id FROM user
+ WHERE user_id = :uid
+ AND verify_token = :token
+ AND status = 'pending'
+ AND license = 'user'
+ AND verify_expires_at > NOW()
+ LIMIT 1"
+ );
+ $sth->execute([':uid' => $user_id, ':token' => $token]);
+ if (!$sth->fetchColumn()) {
+ $answer['message'] = 'Invitation has expired or already been used. Please request a new invitation.';
+ http_response_code(403);
+ exit(json_encode($answer));
+ }
+
+ // ── Step 4: Sanitise and validate input ───────────────────────────────────
+ $name = trim($data['name'] ?? '');
+ $surname = trim($data['surname'] ?? '');
+ $username = strtolower(trim($data['username'] ?? ''));
+ $password = $data['password'] ?? '';
+ $confirm = $data['confirm_password'] ?? '';
+
+ if (!$name || !$surname || !$username || !$password || !$confirm) {
+ throw new Exception('All fields are required.');
+ }
+
+ // ── Step 5: Username format and uniqueness ────────────────────────────────
+ if (!preg_match('/^[a-z0-9_]+$/', $username)) {
+ throw new Exception('Username may only contain lowercase letters, numbers and underscores.');
+ }
+
+ $sth = $pdo1->prepare("SELECT user_id FROM user WHERE username = :u AND user_id != :uid LIMIT 1");
+ $sth->execute([':u' => $username, ':uid' => $user_id]);
+ if ($sth->fetchColumn()) {
+ throw new Exception('Username is already taken. Please choose another.');
+ }
+
+ // ── Step 6: Password match and strength ───────────────────────────────────
+ if ($password !== $confirm) {
+ throw new Exception('Passwords do not match.');
+ }
+
+ $pm = new PasswordManager($pdo1, $include_url);
+ $result = $pm->checkStrength($password, [$name, $surname, $username]);
+ if ($result['score'] < PasswordManager::MIN_SCORE) {
+ $msg = $result['warning'] ?: ($result['suggestions'][0] ?? 'Please choose a stronger password.');
+ throw new Exception('Password is too weak. ' . $msg);
+ }
+
+ // ── Step 7–8: Hash and activate account ──────────────────────────────────
+ $hashed = password_hash($password, PASSWORD_BCRYPT);
+
+ $pdo1->prepare(
+ "UPDATE user
+ SET name = :name,
+ surname = :surname,
+ username = :username,
+ password = :password,
+ status = 'active',
+ verify_token = NULL,
+ verify_expires_at = NULL
+ WHERE user_id = :uid"
+ )->execute([
+ ':name' => $name,
+ ':surname' => $surname,
+ ':username' => $username,
+ ':password' => $hashed,
+ ':uid' => $user_id,
+ ]);
+
+ // ── Step 9: Clear invite token from company_map_user ─────────────────────
+ $pdo1->prepare(
+ "UPDATE company_map_user SET invite_token = NULL WHERE user_id = :uid"
+ )->execute([':uid' => $user_id]);
+
+ // ── Step 10: Clear session invite keys ────────────────────────────────────
+ unset($_SESSION['invited_user_id'], $_SESSION['invited_token']);
+
+ $answer['success'] = 1;
+ $answer['message'] = 'Account setup complete.';
+
+} catch (Exception $e) {
+ $answer['message'] = $e->getMessage();
+ http_response_code(400);
+}
+
+exit(json_encode($answer));
diff --git a/app/login/api/engine/login_confirm.php b/app/login/api/engine/login_confirm.php
index fe3028c..c57999c 100644
--- a/app/login/api/engine/login_confirm.php
+++ b/app/login/api/engine/login_confirm.php
@@ -124,10 +124,13 @@ $_SESSION["login_name"] = $temp["name"];
$_SESSION["login_surname"] = $temp["surname"];
$_SESSION["login_company_id"] = $temp["default_company"];
$_SESSION["login_profile_picture"] = $temp["profile_picture"] ?? '';
-$_SESSION["login_app_access"] = $temp["app_access"] ?? 'wms';
+$_SESSION["login_license"] = $temp["license"] ?? 'user';
+// license='owner' means the user holds their own subscription — use user.app_access.
+// license='user' means they were invited — use company_map_user.app_access instead.
+$_SESSION["login_app_access"] = $temp["app_access"] ?? 'wms';
$role_sth = $pdo1->prepare(
- "SELECT role FROM company_map_user
+ "SELECT role, app_access FROM company_map_user
WHERE company_id = :company_id AND user_id = :user_id
LIMIT 1"
);
@@ -135,7 +138,12 @@ $role_sth->execute([
':company_id' => $_SESSION["login_company_id"],
':user_id' => $_SESSION["login_user_id"],
]);
-$_SESSION["login_role"] = $role_sth->fetchColumn() ?: 'viewer';
+$map_row = $role_sth->fetch(PDO::FETCH_ASSOC);
+$_SESSION["login_role"] = $map_row['role'] ?? 'viewer';
+
+if (($temp['license'] ?? 'owner') !== 'owner') {
+ $_SESSION["login_app_access"] = $map_row['app_access'] ?? 'wms';
+}
// ── Step 6: Respond ───────────────────────────────────────────────────────────
$answer["success"] = 1;
diff --git a/app/login/api/engine/onboarding.php b/app/login/api/engine/onboarding.php
index d5b0887..a6d7e70 100644
--- a/app/login/api/engine/onboarding.php
+++ b/app/login/api/engine/onboarding.php
@@ -191,11 +191,17 @@ try {
// ── Step 11: Map user as company owner ───────────────────────────────────
// company_map_user is the many-to-many table between users and companies.
// 'owner' role grants full admin access within the company.
+ // app_access mirrors the owner's license (user.app_access) so the column
+ // is never NULL and switch_branch reads consistent data.
+ $sth = $pdo1->prepare("SELECT app_access FROM user WHERE user_id = :u LIMIT 1");
+ $sth->execute([':u' => $user_id]);
+ $owner_app_access = $sth->fetchColumn() ?: 'wms';
+
$sth = $pdo1->prepare("
- INSERT INTO company_map_user (company_id, user_id, role, created_at)
- VALUES (:company_id, :user_id, 'owner', NOW())
+ INSERT INTO company_map_user (company_id, user_id, role, app_access, created_at)
+ VALUES (:company_id, :user_id, 'owner', :app_access, NOW())
");
- $sth->execute([':company_id' => $company_id, ':user_id' => $user_id]);
+ $sth->execute([':company_id' => $company_id, ':user_id' => $user_id, ':app_access' => $owner_app_access]);
db_check($sth, $answer);
// ── Step 12: Activate user account and set default company ───────────────
diff --git a/app/login/invited_onboarding.php b/app/login/invited_onboarding.php
new file mode 100644
index 0000000..79114f7
--- /dev/null
+++ b/app/login/invited_onboarding.php
@@ -0,0 +1,193 @@
+prepare(
+ "SELECT u.user_id, u.email, u.verify_expires_at, c.company_name
+ FROM user u
+ JOIN company_map_user m ON m.user_id = u.user_id
+ JOIN company_list c ON c.company_id = m.company_id
+ WHERE u.verify_token = :token
+ AND u.status = 'pending'
+ AND u.license = 'user'
+ LIMIT 1"
+ );
+ $sth->execute([':token' => $token]);
+ $row = $sth->fetch(PDO::FETCH_ASSOC);
+
+ // Determine error state: cancelled (no row) or expired (row found but past expiry)
+ $invite_error = null;
+ if (!$row) {
+ $invite_error = 'cancelled';
+ } elseif (strtotime($row['verify_expires_at']) <= time()) {
+ $invite_error = 'expired';
+ }
+
+ if ($invite_error) {
+ require '../include_header.php';
+ $msg = $invite_error === 'expired'
+ ? ['icon' => 'ti-clock-x', 'title' => 'Invitation Expired',
+ 'body' => 'This invitation link has expired. Please contact your administrator to send a new invitation.']
+ : ['icon' => 'ti-user-x', 'title' => 'Invitation Cancelled',
+ 'body' => 'This invitation has been cancelled. Please contact your administrator if you believe this is a mistake.'];
+?>
+
+
+
+
+
+
+ 
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ Back to Sign In
+
+
+