Changelog

All notable changes to TRx WMS are documented here. Format: ## [version] — YYYY-MM-DD with sections Added / Changed / Fixed / Removed.

[Unreleased]

Role-based access control enforcement across all API endpoints and UI pages (see ROLES.md)

Barcode system — md_barcode table, SKU label page (ics/sku_barcode_label.php), Location label page (ics/location_barcode_label.php)
scanner.js — unified scanner module supporting USB scanner, handheld, phone camera (Html5Qrcode), and clipboard paste
Scan-driven stock flows — scan SKU label → scan location label → F2 to save (no mouse required)
ics/api/engine/barcode_lookup.php — validates barcode string, returns typed result (sku / loc / raw)
ics/api/engine/validate_scan_location.php — pre-save location validation for stock in/out/transfer
ics/api/engine/sku_label_lots.php, sku_label_products.php — lot and product data feeds for SKU label page
Cost, price, and margin fields on md_product
Contact module linked to setting sidebar

location_barcode_label.php — ON DUPLICATE KEY UPDATE now includes status = 1 so previewing a previously-disabled location barcode re-enables it

Purchase Orders (po/) — create, confirm, receive, cancel, payment tracking
Order module (order/) — sales orders, returns, invoices (invoice / credit note / debit note), order confirmation, payment status
td_order, td_invoice, td_return, td_purchase_order tables
Invoice print view (order/print_invoice.php)

Warehouse location modes — simple (warehouse + rack) and advanced (warehouse + zone + aisle + rack)
company_setting keys: advanced_location, location_label_rack/zone/aisle, default_stock_status, auto_complete_on_ship, auto_invoice_and_credit_note
Per-warehouse stock tables (td_stock_{warehouse_id}) — balance = SUM(in) - SUM(out) where status = 1
Stock approval flow — transactions created as status = 0 (draft) and approved separately
Rack occupancy report (reports/occupy_rack.php)
Expired / near-expiry report (reports/expired_stock.php)

Multi-tenant branch support — company_list, company_map_user, branch switcher in topbar
User management (setting/users.php) — invite by email, role assignment, remove member
SMTP configuration (setting/smtp.php)
OTP validation on every API request (HMAC-SHA1 based on user password + session time)
CSRF token enforcement on all POST requests