web: bulk CK edit on customer list (admin, after access code) + send-per-customer via Zalo

- Customer list rows get an admin-only bulk checkbox; a bulk bar lets the
admin type a CK% (global or per-brand) and apply it to all selected
customers at once (POST /api/customers, V.AISTUDIO-gated).
- Customer DETAIL modal gets a 'Gửi qua Zalo' button (admin, after unlock)
that saves the current CK + all filled fields and DMs that customer a
message containing every field that has content (ma KH, CK, company,
address, representative, recipient, tax code...).
- Bulk 'Gửi qua Zalo' sends the same to each selected customer.
- Access code is no longer auto-filled into quote modal input (hidden).

index.html

@@ -551,8 +551,8 @@
     <script defer src="https://cdnjs.cloudflare.com/ajax/libs/html2canvas/1.4.1/html2canvas.min.js"></script>
     <!-- App modules: defer keeps execution order (parse order) but doesn't block
          first paint — the welcome/avatar-picker modal renders immediately. -->
-    <script defer src="./src/cart-quote.js?gc=23"></script>    <!-- Cart + Quote module (Giỏ hàng / Báo giá) -->
-    <script defer src="./src/customers.js?gc=12"></script>    <!-- Customer list (Danh sách khách hàng) -->
+    <script defer src="./src/cart-quote.js?gc=24"></script>    <!-- Cart + Quote module (Giỏ hàng / Báo giá) -->
+    <script defer src="./src/customers.js?gc=13"></script>    <!-- Customer list (Danh sách khách hàng) -->
     <script defer src="./src/vaix-rag.js?gc=48"></script>    <!-- V.AI STUDIO RAG Module - loads FASTER via light index; lazy galleries; spec-aware search -->
     <script defer src="./src/greeting-news.js?gc=27"></script>  <!-- Greeting HOT news cards + source links -->
     <script defer src="./src/order-sync.js?gc=15"></script>    <!-- Order sync with V.AISTUDIO backend -->

src/cart-quote.js

@@ -233,7 +233,9 @@ window.openQuotation = function() {
   if (addr && !addr.value) addr.value = saved.addr || '';
   if (codeEl) codeEl.value = genOrderCode();
   if (dateEl) dateEl.value = new Date().toISOString().slice(0, 10);
-  if (accessEl && _quoteUnlocked && !accessEl.value) accessEl.value = ACCESS_CODE;
+  // NOTE: the V.AISTUDIO access code is NEVER auto-filled into the modal input —
+  // it stays hidden (masked, type=password) and the admin types it manually.
+  // This prevents the access code from being displayed/revealed on any modal.
   _pushTopbarDown();
   ov.style.display = 'flex';
   ov.classList.add('open');

src/customers.js

@@ -352,7 +352,12 @@
     var editBtn = allowEdit
       ? '<button class="cus-edit-btn" data-cid="' + esc(cid) + '" title="Sửa">✎</button>'
       : '';
+    // Admin-only checkbox for bulk CK editing (homepage, after access code).
+    var chk = allowEdit
+      ? '<label class="cus-chk" title="Chọn chỉnh CK hàng loạt" style="display:flex;align-items:center;margin-right:10px;cursor:pointer"><input type="checkbox" class="cus-bulk-chk" data-cid="' + esc(cid) + '" style="width:16px;height:16px;cursor:pointer"></label>'
+      : '';
     return '<div class="cus-row" data-cid="' + esc(cid) + '">'
+      + (chk)
       + '<div class="cus-row-main">'
       + '<div class="cus-row-name">' + esc(name) + '</div>'
       + '<div class="cus-row-meta">' + esc(cid.slice(0, 8)) + ma + ck + '</div>'
@@ -363,6 +368,16 @@
       + '</div>'
       + '</div>';
   }
+  // Collect the cids currently ticked in the (admin) bulk-CK checkboxes.
+  function selectedBulkCids() {
+    var out = [];
+    (window.__cusModal && window.__cusModal.querySelectorAll ? window.__cusModal.querySelectorAll('.cus-bulk-chk:checked') : []).forEach(function (chk) {
+      var cid = chk.getAttribute('data-cid');
+      if (cid) out.push(cid);
+    });
+    return out;
+  }
+  window.selectedBulkCids = selectedBulkCids;
 
   // ── Detail editor modal (V.AISTUDIO access-code gated in normal mode) ──
   function openCustomerDetail(cid, c) {
@@ -433,7 +448,7 @@
       + '<div style="border-top:1px solid #e2e8f0;padding-top:12px"></div>'
       + fieldsHtml
       + (allowEdit
-          ? '<div style="text-align:right;margin-top:16px"><button id="cus-save" style="padding:10px 22px;background:#0077b6;color:#fff;border:none;border-radius:8px;cursor:pointer;font-weight:700">Lưu</button></div>'
+          ? '<div style="text-align:right;margin-top:16px"><button id="cus-save" style="padding:10px 22px;background:#0077b6;color:#fff;border:none;border-radius:8px;cursor:pointer;font-weight:700">Lưu</button> <button id="cus-send-zalo" style="padding:10px 16px;background:#25D366;color:#fff;border:none;border-radius:8px;cursor:pointer;font-weight:700"><i class="fab fa-whatsapp"></i> Gửi qua Zalo</button></div>'
           : '')
       + '</div>';
     document.body.appendChild(ov);
@@ -528,7 +543,155 @@
       }
     };
     } // end if (saveBtn)
+
+    // ── "Gửi qua Zalo" on the customer DETAIL modal: saves the current CK + all
+    // filled fields to the dataset, then DMs this customer a message containing
+    // every field that has content (mã KH, CK, Zalo name, company, address,
+    // representative, recipient, tax code...). Only shown for admin after unlock.
+    var sendZaloBtn = document.getElementById('cus-send-zalo');
+    if (sendZaloBtn) {
+      sendZaloBtn.onclick = async function () {
+        var record = Object.assign({}, c);
+        record.cid = cid;
+        record.ma_kh = document.getElementById('cus-ma').value.trim();
+        record.ck = document.getElementById('cus-ck').value.trim();
+        MULTI_FIELDS.forEach(function (f) {
+          var vals = [];
+          ov.querySelectorAll('.cus-mv-row[data-field="' + f.key + '"] .cus-mv-input').forEach(function (i) {
+            var v = i.value.trim(); if (v) vals.push(v);
+          });
+          if (vals.length) record[f.key] = vals; else delete record[f.key];
+        });
+        // Resolve the real Zalo cid to send to.
+        var zcid = customerCidForSend(record);
+        if (!zcid) { toast('❌ Khách hàng này chưa có Zalo ID để gửi.'); return; }
+        try {
+          // Persist first (so the Zalo message reflects the just-saved CK).
+          var resp = await saveCustomers([record], ACCESS_CODE);
+          if (resp && resp.customers) window.__customers = resp.customers;
+          else { try { window.__customers = await fetchCustomers(); } catch (_e) {} }
+          var msg = buildCustomerSendMessage(record);
+          toast('📨 Đang gửi qua Zalo cho ' + (record.name || record.ma_kh || '') + '...');
+          var r = await fetch('https://bep40-vaistudio-zalo-bot.hf.space/send', {
+            method: 'POST', headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ user_id: zcid, message: msg })
+          });
+          var d = await r.json().catch(function () { return {}; });
+          if (r.ok && d && d.ok) toast('✅ Đã lưu & gửi qua Zalo.');
+          else toast('✅ Đã lưu, nhưng gửi qua Zalo thất bại.');
+          renderCustomerList();
+        } catch (e) {
+          toast('❌ Lỗi: ' + e.message);
+        }
+      };
+    }
+  }
+
+  // ── Bulk CK editing on the customer list (homepage, after access code) ──
+  // The admin selects multiple customers, types a CK% (global "35" or per-brand
+  // "Malloca 35, Grob 20") and hits "Áp cho đã chọn". Saves every selected
+  // customer via POST /api/customers (V.AISTUDIO-gated, dataset-backed).
+  window.bulkApplyCk = async function () {
+    var cids = selectedBulkCids();
+    if (!cids.length) { toast('⚠️ Chưa chọn khách h��ng nào.'); return; }
+    if (!(window.canEditCk ? window.canEditCk() : false)) { toast('🔒 Cần nhập mã truy cập để chỉnh CK hàng loạt.'); return; }
+    var ckEl = document.getElementById('cus-bulk-ck');
+    var ckVal = (ckEl && ckEl.value || '').trim();
+    if (!ckVal) { toast('⚠️ Nhập giá trị chiết khấu (VD: 35 hoặc Malloca 35, Grob 20).'); ckEl && ckEl.focus(); return; }
+    // Basic validation so junk like "abc" doesn't reach the server.
+    var parsed = parseCk(ckVal);
+    if (parsed.all == null && !parsed.hasBrand) { toast('❌ CK không hợp lệ. VD: 35 hoặc Malloca 35, Grob 20'); return; }
+    var records = cids.map(function (cid) {
+      var c = (window.__customers || {})[cid] || {};
+      var rec = {};
+      Object.keys(c).forEach(function (k) { rec[k] = c[k]; });
+      rec.cid = cid;
+      rec.ck = ckVal;
+      return rec;
+    });
+    try {
+      toast('💾 Đang lưu CK cho ' + records.length + ' khách...');
+      var resp = await saveCustomers(records, ACCESS_CODE);
+      if (resp && resp.customers) window.__customers = resp.customers;
+      else { try { window.__customers = await fetchCustomers(); } catch (_e) {} }
+      toast('✅ Đã cập nhật chiết khấu cho ' + records.length + ' khách hàng.');
+      if (window.__cusModal) window.__cusModal.querySelectorAll('.cus-bulk-chk:checked').forEach(function (chk) { chk.checked = false; });
+      var n = document.getElementById('cus-bulk-count'); if (n) n.textContent = 0;
+      renderCustomerList();
+    } catch (e) {
+      toast('❌ Lưu CK thất bại: ' + e.message);
+    }
+  };
+  // ── Send the edited CK / customer info to each selected customer via the Zalo
+  // bot (/send). Content = the fields that have content on the customer's detail
+  // record (mã KH, Zalo name, company, address, representative, recipient, tax
+  // code, shipping address, CK...) — so each customer receives their own updated
+  // policy. The bot prepends the "📋 Mã KH + 🔗 Chiết khấu" header automatically.
+  function buildCustomerSendMessage(c) {
+    var lines = [];
+    var name = c.name || (Array.isArray(c.zalo_name) ? c.zalo_name[0] : c.zalo_name) || '';
+    var ma = c.ma_kh || '';
+    if (name) lines.push('👋 Chào ' + name + '!');
+    if (ma) lines.push('📋 Mã khách hàng: ' + ma);
+    if (c.ck) lines.push('💳 Chiết khấu cập nhật: ' + c.ck + '%');
+    lines.push('');
+    // Fields that HAVE content — same set the customer detail modal shows.
+    [
+      ['Công ty', c.company], ['Người đại diện', c.representative], ['Người nhận', c.recipient],
+      ['Địa chỉ giao hàng', c.shipping_address], ['Địa chỉ công ty', c.company_address],
+      ['Mã số thuế', c.tax_code]
+    ].forEach(function (pair) {
+      var label = pair[0], v = pair[1];
+      if (v == null) return;
+      var arr = Array.isArray(v) ? v.filter(Boolean) : [String(v).trim()];
+      arr.forEach(function (item) { if (item) lines.push('• ' + label + ': ' + item); });
+    });
+    lines.push('');
+    lines.push('Thông tin chiết khấu mới nhất của anh/chị đã được cập nhật. Truy cập web để xem báo giá kèm chiết khấu nhé!');
+    return lines.join('\n');
+  }
+  // Resolve a customer to a sendable Zalo cid (the customer record's own cid).
+  // Zalo chat ids are long NUMERIC strings (e.g. "479b1..." is hex, but real Zalo
+  // OA user cids are numeric ~13-24 digits; the web/zalo customers use those).
+  // Ketoan-directory rows are keyed by ma_kh with an EMPTY cid — those can't be
+  // DMed until the real Zalo cid is present. Skip (return '').
+  function customerCidForSend(cust) {
+    if (!cust) return '';
+    var cidv = cust.cid || '';
+    var s = String(cidv).trim();
+    if (s && s.length >= 10) {
+      // Accept both numeric Zalo ids AND the known admin/hex format; but reject
+      // ma_kh-lookalike keys (letters like VASCAS...) with no numeric core that
+      // are really directory keys, not Zalo chat ids.
+      if (/^\d+$/.test(s)) return s;
+      // Known OA/hex cids used in this system (admin 479b1cfad6a83ff666b9 etc.).
+      if (/^[0-9a-f]{8,}$/i.test(s) && /^[a-f0-9]+$/i.test(s)) return s;
+      return '';
+    }
+    return '';
   }
+  window.bulkSendViaZalo = async function () {
+    var cids = selectedBulkCids();
+    if (!cids.length) { toast('⚠️ Chưa chọn khách hàng nào.'); return; }
+    if (!(window.canEditCk ? window.canEditCk() : false)) { toast('🔒 Cần nhập mã truy cập.'); return; }
+    var sent = 0, skipped = 0;
+    for (var i = 0; i < cids.length; i++) {
+      var cid = cids[i];
+      var cust = (window.__customers || {})[cid] || {};
+      var zcid = customerCidForSend(cust);
+      if (!zcid) { skipped++; continue; }
+      var msg = buildCustomerSendMessage(cust);
+      try {
+        var r = await fetch('https://bep40-vaistudio-zalo-bot.hf.space/send', {
+          method: 'POST', headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ user_id: zcid, message: msg })
+        });
+        var d = await r.json().catch(function () { return {}; });
+        if (r.ok && d && d.ok) sent++; else skipped++;
+      } catch (e) { skipped++; }
+    }
+    toast('✅ Đã gửi qua Zalo cho ' + sent + ' khách' + (skipped ? ', bỏ qua ' + skipped + ' (thiếu Zalo ID)' : ''));
+  };
 
   function renderCustomerList() {
     var box = document.getElementById('cus-list');
@@ -569,10 +732,17 @@
       + '<button id="cus-close" style="background:none;border:none;color:#fff;font-size:22px;cursor:pointer">✕</button></div>'
       + '<div id="cus-gate"></div>'
       + '<div style="padding:10px 18px;border-bottom:1px solid #e2e8f0"><input id="cus-q" placeholder="Tìm khách hàng..." style="width:100%;padding:9px;border:2px solid #e2e8f0;border-radius:8px;font-size:13px;box-sizing:border-box;outline:none"></div>'
+      + '<div id="cus-bulkbar" style="display:none;padding:8px 18px;background:#e0f2fe;border-bottom:1px solid #bae6fd;align-items:center;gap:8px;flex-wrap:wrap">'
+      + '<b style="font-size:12px;color:#0369a1">Chiết khấu hàng loạt:</b>'
+      + '<input id="cus-bulk-ck" placeholder="CK%: 35 hoặc Malloca 35, Grob 20" style="flex:1;min-width:180px;padding:7px 10px;border:1.5px solid #7dd3fc;border-radius:8px;font-size:13px;outline:none">'
+      + '<button id="cus-bulk-apply" style="padding:8px 14px;background:#0284c7;color:#fff;border:none;border-radius:8px;font-size:12px;font-weight:700;cursor:pointer">Áp cho đã chọn (<span id="cus-bulk-count">0</span>)</button>'
+      + '<button id="cus-bulk-send" style="padding:8px 14px;background:#25D366;color:#fff;border:none;border-radius:8px;font-size:12px;font-weight:700;cursor:pointer">Gửi qua Zalo</button>'
+      + '</div>'
       + '<div id="cus-list" style="flex:1;overflow-y:auto;padding:10px 18px"></div>'
       + '</div>';
     document.body.appendChild(ov);
-    document.getElementById('cus-close').onclick = function () { ov.remove(); };
+    window.__cusModal = ov;
+    document.getElementById('cus-close').onclick = function () { ov.remove(); window.__cusModal = null; };
 
     // Access gate for NORMAL mode (no ?kh link): the full customer directory is
     // revealed only after the V.AISTUDIO access code is entered. In
@@ -618,6 +788,21 @@
         return;
       }
     });
+    // ── Live bulk-CK counter: as the admin ticks/unticks checkboxes, show how
+    // many are selected (requires admin identity — checked in openCustomerModal).
+    ov.addEventListener('change', function (e) {
+      if (e.target && e.target.classList && e.target.classList.contains('cus-bulk-chk')) {
+        var n = document.getElementById('cus-bulk-count');
+        if (n) n.textContent = selectedBulkCids().length;
+      }
+    });
+    // Bulk bar visible only for the admin (after V.AISTUDIO unlock in normal mode).
+    var bulkBar = document.getElementById('cus-bulkbar');
+    if (bulkBar) bulkBar.style.display = (window.isAdmin ? window.isAdmin() : false) ? 'flex' : 'none';
+    var bapply = document.getElementById('cus-bulk-apply');
+    if (bapply) bapply.onclick = function () { if (window.bulkApplyCk) window.bulkApplyCk(); };
+    var bsend = document.getElementById('cus-bulk-send');
+    if (bsend) bsend.onclick = function () { if (window.bulkSendViaZalo) window.bulkSendViaZalo(); };
 
     // Search filter (non-admin sees only their own row, so the filter is no-op)
     document.getElementById('cus-q').oninput = function () {