# SMS Backend Audit & Fix TODO

## Step 1: Structural/ESM/Imports Audit
- [ ] Verify server.js imports match actual file paths
- [ ] Verify all routes/controllers/models referenced exist
- [ ] Spot potential circular deps

## Step 2: Dependency Cleanup
- [ ] Check package.json for unused deps
- [ ] Remove unused deps (only if confirmed safe)

## Step 3: DB Connection Hardening
- [ ] Stop server crash on Mongo connection failure
- [ ] Enforce/verify DB name is SMS
- [ ] Improve connection error handling


## Step 4: Response Format Standardization
- [ ] Standardize success response: { success:true, message:"", data:{} }
- [ ] Standardize error response: { success:false, message:"" }
- [ ] Ensure CastError/ValidationError handled consistently

## Step 5: Auth Verification & Fixes
- [ ] Ensure register/login/protected routes return standardized format
- [ ] Ensure invalid/expired JWT handling uses consistent response shape

## Step 6: Product & Warehouse Fixes
- [ ] Explicit numeric/required-field validation
- [ ] Handle invalid ObjectId cleanly
- [ ] Standardize status codes + response format
- [ ] Confirm no update/delete routes (should remain absent)

## Step 7: Transaction Stock Logic Fixes (CRITICAL)
- [ ] Fix updateTransaction stock recalculation invariants
- [ ] Validate quantityMoved + transactionType on PUT
- [ ] Prevent negative stock in all paths
- [ ] Ensure deleteTransaction restores stock correctly
- [ ] Standardize response format

## Step 8: Reports Fixes
- [ ] Fix metrics to return stock-in/out totals by quantity moved (not just counts)
- [ ] Verify date filtering boundaries (daily/weekly/monthly)
- [ ] Standardize response format

## Step 9: Security Review
- [ ] Ensure passwords never returned
- [ ] Confirm JWT secret/env usage
- [ ] Ensure protected routes block unauthorized access

## Step 10: Testing Deliverables
- [ ] Create Postman requests for all required endpoints
- [ ] Provide passed/failed checklist based on manual verification

