fix: console tenant scoping, miler identity spoofing, delivery proof, timezone

Security
- Express console had no tenant scoping at all: LoginAdmin hardcoded tenantid 0
  into every JWT and none of the 85 admin handlers filtered by tenant, so any
  client given a console login would read every other client's bookings,
  customers, pricing and reports. Adds DoormileAuth.Tenantid (nil = Doormile
  staff, unrestricted; set = client, scoped), emits it in the token, and scopes
  reads, guards writes and pins tenantid on create.
- Miler telemetry (/miler/logs, /miler/status, /miler/consignments/logs) took
  userid from the request body, letting any authenticated rider write another
  rider's status and GPS trail — data the dispatch layer reasons over. Identity
  now comes from the token.
- POST /miler/reset-pin was unauthenticated and overwrote a PIN given only a
  phone number, so reset-pin + verify-pin took over any rider account. Now
  requires admin/manager/executive auth.

Correctness
- Date ranges compared the container's UTC clock against timestamps the DB
  writes as IST wall-clock (DSN sets TimeZone=Asia/Kolkata), so "today so far"
  ended 5h30m in the past and silently dropped everything created after noon
  IST from every report. Sets TZ in the image and adds utils.DBNow/DBToday,
  which stay correct regardless of container timezone.
- CreateMiler never set Configid, so console-created riders got the column
  default of 1 while LoginMiler looks up configid 1001 — every such rider was
  unable to log in, reported as "no miler account found".
- Delivery wrote no consignment history row, so a tracking timeline never
  showed the parcel arriving.

Features
- Delivery OTP is now real (crypto/rand, issued to the receiver, verified and
  cleared on delivery) but opt-in per client via Tenant.Requiredeliveryotp,
  defaulting off — friction worth it for a courier parcel, not a food order.
- Express bookings accept pickuplocationid, so the console can name a client
  site (a DailyGrubs kitchen) instead of retyping its address; validated
  against the tenant and carried through to the consignment.
- TenantLocation.Locationname, miler tenantid/hubid, Nagercoil (629) opened.
- PUT /miler/availability accepts both "status" and "availabilitystatus", and
  /miler/location no longer drops speed/heading — both were contract
  mismatches against the doc the Flutter dev was given.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -9,8 +9,14 @@ RUN CGO_ENABLED=0 GOOS=linux go build -o server .
 # Second Stage: Run the compiled binary inside alpine
 FROM alpine
 
-# Fix: Alpine needs ca-certificates to verify SSL certificates
+# Fix: Alpine needs ca-certificates to verify SSL certificates.
-RUN apk add --no-cache ca-certificates
+# tzdata + TZ: the database connection sets TimeZone=Asia/Kolkata, so
+# CURRENT_TIMESTAMP defaults write IST wall-clock into the timestamp columns.
+# With the container defaulting to UTC, every time.Now() the app wrote was 5h30m
+# behind those defaults, and "today so far" date ranges ended 5h30m in the past —
+# which silently dropped anything created after noon IST from every report.
+RUN apk add --no-cache ca-certificates tzdata
+ENV TZ=Asia/Kolkata
 
 # Copy from first stage
 COPY --from=0 /app/server /app/server

controllers/adminController.go

@@ -21,8 +21,72 @@ import (
 
 	"github.com/gofiber/fiber/v2"
 	"github.com/redis/go-redis/v9"
+	"gorm.io/gorm"
 )
 
+// consoleTenantID returns the tenant a console login is restricted to, or 0
+// for Doormile's own staff, who are unrestricted. Client logins carry their
+// tenant in the JWT (see LoginAdmin); Doormile staff have DoormileAuth.Tenantid
+// nil and so authenticate with 0.
+func consoleTenantID(c *fiber.Ctx) int {
+	tenantID, ok := c.Locals("tenantid").(int)
+	if !ok {
+		return 0
+	}
+	return tenantID
+}
+
+// isDoormileConsoleStaff reports whether the caller sees every tenant's data.
+func isDoormileConsoleStaff(c *fiber.Ctx) bool {
+	return consoleTenantID(c) == 0
+}
+
+// scopeToOwnTenant restricts a query on a tenant-owned table to the requesting
+// console user's own tenant. Doormile staff are unrestricted. This is the
+// admin-console counterpart of scopeBookingsToOwnTenant in hubController.go —
+// without it, any client given an express-console login reads every other
+// client's data.
+//
+// The column name is taken as a parameter because the tenant key is not always
+// literally "tenantid": on the tenants table itself it is the primary key.
+func scopeToOwnTenant(c *fiber.Ctx, query *gorm.DB, column string) *gorm.DB {
+	tenantID := consoleTenantID(c)
+	if tenantID == 0 {
+		return query
+	}
+	return query.Where(column+" = ?", tenantID)
+}
+
+// canAccessTenant reports whether the caller may act on the given tenant.
+// Used where the tenant is addressed by a path parameter or request body rather
+// than filtered in a query — scoping a WHERE clause does nothing when the
+// caller names the tenant directly.
+func canAccessTenant(c *fiber.Ctx, tenantID int) bool {
+	own := consoleTenantID(c)
+	return own == 0 || own == tenantID
+}
+
+// assertBookingAccess checks that the caller may act on a booking addressed by
+// id. Returns nil for Doormile staff. Mutating handlers take the booking id
+// straight from the path, so a scoped SELECT elsewhere in the handler does not
+// protect them — this has to run before the write.
+func assertBookingAccess(c *fiber.Ctx, bookingID int) error {
+	own := consoleTenantID(c)
+	if own == 0 {
+		return nil
+	}
+	var booking models.PickupBooking
+	if err := db.DB.Select("bookingid", "tenantid").First(&booking, bookingID).Error; err != nil {
+		return utils.NotFound(c, "booking not found")
+	}
+	// A booking with no tenant predates tenant attribution and can't be proven
+	// to belong to this client, so it stays invisible to them.
+	if booking.Tenantid == nil || *booking.Tenantid != own {
+		return utils.NotFound(c, "booking not found")
+	}
+	return nil
+}
+
 // Helper to generate tripsheet number
 func generateTripsheetNo() string {
 	b := make([]byte, 4)
@@ -68,8 +132,18 @@ func LoginAdmin(cfg *config.Config) fiber.Handler {
 			userName = appUser.Authname
 		}
 
+		// A client's console login carries their tenant so handlers can scope to
+		// it; Doormile's own staff have Tenantid nil and keep tenantID 0, which
+		// scopeToOwnTenant reads as "unrestricted". Emitting 0 unconditionally
+		// (as this did) is what left every console login able to read every
+		// tenant's data.
+		tenantID := 0
+		if auth.Tenantid != nil {
+			tenantID = *auth.Tenantid
+		}
+
 		// Important: use appUser.Userid instead of auth.ID to ensure consistent IDs across the system
-		token, err := utils.GenerateToken(int(appUser.Userid), auth.Email, roleId, 0, 1, cfg.JWTSecret)
+		token, err := utils.GenerateToken(int(appUser.Userid), auth.Email, roleId, tenantID, 1, cfg.JWTSecret)
 		if err != nil {
 			return utils.Internal(c, "failed to generate token")
 		}
@@ -82,6 +156,7 @@ func LoginAdmin(cfg *config.Config) fiber.Handler {
 				"name":     userName,
 				"email":    auth.Email,
 				"role":     auth.Role,
+				"tenantid": auth.Tenantid,
 			},
 		})
 	}
@@ -95,12 +170,19 @@ func GetAdminDashboard(c *fiber.Ctx) error {
 	var totalConsignments int64
 	var openExceptions int64
 
-	db.DB.Model(&models.Tenant{}).Count(&totalTenants)
+	scopeToOwnTenant(c, db.DB.Model(&models.Tenant{}), "tenantid").Count(&totalTenants)
+	scopeToOwnTenant(c, db.DB.Model(&models.PickupBooking{}), "tenantid").Count(&totalBookings)
+	scopeToOwnTenant(c, db.DB.Model(&models.Consignment{}), "tenantid").Count(&totalConsignments)
+
+	// Customers, milers and exceptions have no tenant column, so there is no
+	// way to attribute them to one client here. Rather than show a client
+	// Doormile-wide totals, these are reported as zero for client logins; the
+	// per-client versions need a join through bookings and are not built yet.
+	if isDoormileConsoleStaff(c) {
 		db.DB.Model(&models.AppCustomer{}).Count(&totalCustomers)
 		db.DB.Model(&models.AppUser{}).Where("roleid = 5").Count(&totalMilers)
-	db.DB.Model(&models.PickupBooking{}).Count(&totalBookings)
-	db.DB.Model(&models.Consignment{}).Count(&totalConsignments)
 		db.DB.Model(&models.ConsignmentException{}).Where("status = ?", "Open").Count(&openExceptions)
+	}
 
 	return utils.OK(c, fiber.Map{
 		"tenants":      totalTenants,
@@ -131,20 +213,26 @@ func GetAdminReports(c *fiber.Ctx) error {
 	tenantID := c.Query("tenantid")
 	hubID := c.Query("hubid")
 
+	// ownTenant is 0 for Doormile staff (whole-network view) and the client's
+	// tenant for a client login, which every figure below is restricted to.
+	ownTenant := consoleTenantID(c)
+
 	var totalBookings int64
-	db.DB.Model(&models.PickupBooking{}).Where("createdat BETWEEN ? AND ?", from, to).Count(&totalBookings)
+	scopeToOwnTenant(c, db.DB.Model(&models.PickupBooking{}), "tenantid").
+		Where("createdat BETWEEN ? AND ?", from, to).Count(&totalBookings)
 
 	var delivered int64
-	db.DB.Model(&models.PickupBooking{}).
+	scopeToOwnTenant(c, db.DB.Model(&models.PickupBooking{}), "tenantid").
 		Where("status = ? AND updatedat BETWEEN ? AND ?", constants.BookingConvertedConsignment, from, to).
 		Count(&delivered)
 
 	var cancelled int64
-	db.DB.Model(&models.PickupBooking{}).
+	scopeToOwnTenant(c, db.DB.Model(&models.PickupBooking{}), "tenantid").
 		Where("status = ? AND updatedat BETWEEN ? AND ?", constants.BookingCancelled, from, to).
 		Count(&cancelled)
 
-	consignmentQuery := db.DB.Model(&models.Consignment{}).Where("createdat BETWEEN ? AND ?", from, to)
+	consignmentQuery := scopeToOwnTenant(c, db.DB.Model(&models.Consignment{}), "tenantid").
+		Where("createdat BETWEEN ? AND ?", from, to)
 	if tenantID != "" {
 		consignmentQuery = consignmentQuery.Where("tenantid = ?", tenantID)
 	}
@@ -154,15 +242,26 @@ func GetAdminReports(c *fiber.Ctx) error {
 	var totalConsignments int64
 	consignmentQuery.Count(&totalConsignments)
 
+	// Payments and exceptions carry no tenant column, so they're restricted
+	// through the bookings/consignments they belong to. COD in particular is a
+	// figure a client genuinely needs, so it's joined rather than suppressed.
 	var codCollected float64
-	db.DB.Model(&models.BookingPayment{}).
+	codQuery := db.DB.Model(&models.BookingPayment{}).
-		Where("paymentstatus = ? AND createdat BETWEEN ? AND ?", constants.PaymentStatusPaid, from, to).
+		Where("paymentstatus = ? AND createdat BETWEEN ? AND ?", constants.PaymentStatusPaid, from, to)
-		Select("COALESCE(SUM(amount), 0)").Scan(&codCollected)
+	if ownTenant != 0 {
+		codQuery = codQuery.Where("bookingid IN (?)",
+			db.DB.Model(&models.PickupBooking{}).Select("bookingid").Where("tenantid = ?", ownTenant))
+	}
+	codQuery.Select("COALESCE(SUM(amount), 0)").Scan(&codCollected)
 
 	var openExceptions int64
-	db.DB.Model(&models.ConsignmentException{}).
+	excQuery := db.DB.Model(&models.ConsignmentException{}).
-		Where("status != ? AND createdat BETWEEN ? AND ?", constants.ExceptionClosed, from, to).
+		Where("status != ? AND createdat BETWEEN ? AND ?", constants.ExceptionClosed, from, to)
-		Count(&openExceptions)
+	if ownTenant != 0 {
+		excQuery = excQuery.Where("consignmentid IN (?)",
+			db.DB.Model(&models.Consignment{}).Select("consignmentid").Where("tenantid = ?", ownTenant))
+	}
+	excQuery.Count(&openExceptions)
 
 	completionRate := 0.0
 	if totalBookings > 0 {
@@ -176,14 +275,23 @@ func GetAdminReports(c *fiber.Ctx) error {
 		Delivered int64  `gorm:"column:delivered"`
 	}
 	var hubRows []hubRow
-	db.DB.Raw(`
+	// The tenant filter belongs in the JOIN condition, not a WHERE — in a WHERE
+	// it would drop hubs with no matching parcels instead of showing them as
+	// zero.
+	hubSQL := `
 		SELECT h.hubid AS hubid, h.hubname AS hubname, COUNT(c.consignmentid) AS delivered
 		FROM hubs h
-		LEFT JOIN consignments c ON c.currenthubid = h.hubid AND c.status = ? AND c.updatedat BETWEEN ? AND ?
+		LEFT JOIN consignments c ON c.currenthubid = h.hubid AND c.status = ? AND c.updatedat BETWEEN ? AND ?`
+	hubArgs := []interface{}{constants.ConsignmentDelivered, from, to}
+	if ownTenant != 0 {
+		hubSQL += ` AND c.tenantid = ?`
+		hubArgs = append(hubArgs, ownTenant)
+	}
+	hubSQL += `
 		WHERE h.deletedat IS NULL
 		GROUP BY h.hubid, h.hubname
-		ORDER BY delivered DESC
+		ORDER BY delivered DESC`
-	`, constants.ConsignmentDelivered, from, to).Scan(&hubRows)
+	db.DB.Raw(hubSQL, hubArgs...).Scan(&hubRows)
 
 	byHub := make([]fiber.Map, 0, len(hubRows))
 	for _, r := range hubRows {
@@ -197,13 +305,19 @@ func GetAdminReports(c *fiber.Ctx) error {
 		Bookings   int64  `gorm:"column:bookings"`
 	}
 	var tenantRows []tenantRow
-	db.DB.Raw(`
+	tenantSQL := `
 		SELECT t.tenantid AS tenantid, t.tenantname AS tenantname, COUNT(c.consignmentid) AS bookings
 		FROM tenants t
-		LEFT JOIN consignments c ON c.tenantid = t.tenantid AND c.createdat BETWEEN ? AND ?
+		LEFT JOIN consignments c ON c.tenantid = t.tenantid AND c.createdat BETWEEN ? AND ?`
+	tenantArgs := []interface{}{from, to}
+	if ownTenant != 0 {
+		tenantSQL += ` WHERE t.tenantid = ?`
+		tenantArgs = append(tenantArgs, ownTenant)
+	}
+	tenantSQL += `
 		GROUP BY t.tenantid, t.tenantname
-		ORDER BY bookings DESC
+		ORDER BY bookings DESC`
-	`, from, to).Scan(&tenantRows)
+	db.DB.Raw(tenantSQL, tenantArgs...).Scan(&tenantRows)
 
 	byTenant := make([]fiber.Map, 0, len(tenantRows))
 	for _, r := range tenantRows {
@@ -219,6 +333,9 @@ func GetAdminReports(c *fiber.Ctx) error {
 		TotalKms       float64 `gorm:"column:total_kms"`
 		TotalEarnings  float64 `gorm:"column:total_earnings"`
 	}
+	// Rider earnings, kms and completed stops are Doormile's own workforce data
+	// — a client has no business reading them, and there's no per-client view
+	// of a rider who works across tenants. Clients get an empty list.
 	var riderRows []riderRow
 	riderQuery := `
 		SELECT mp.userid AS userid, mp.displayname AS displayname,
@@ -235,7 +352,9 @@ func GetAdminReports(c *fiber.Ctx) error {
 		args = append(args, hubID)
 	}
 	riderQuery += " GROUP BY mp.userid, mp.displayname ORDER BY completed_stops DESC LIMIT 50"
+	if isDoormileConsoleStaff(c) {
 		db.DB.Raw(riderQuery, args...).Scan(&riderRows)
+	}
 
 	byRider := make([]fiber.Map, 0, len(riderRows))
 	for _, r := range riderRows {
@@ -271,13 +390,16 @@ func GetAppUsers(c *fiber.Ctx) error {
 	page := utils.ParsePage(c)
 
 	var total int64
-	if err := db.DB.Model(&models.AppUser{}).Where("roleid != ?", 5).Count(&total).Error; err != nil {
+	if err := scopeToOwnTenant(c, db.DB.Model(&models.AppUser{}), "tenantid").
+		Where("roleid != ?", 5).Count(&total).Error; err != nil {
 		return utils.Internal(c, "failed to count users")
 	}
 
 	var users []models.AppUser
-	// Exclude Milers (Roleid = 5) from the CRM user list
+	// Exclude Milers (Roleid = 5) from the CRM user list. Scoped as well, so a
-	if err := page.Apply(db.DB.Where("roleid != ?", 5)).Find(&users).Error; err != nil {
+	// client sees only their own people, not Doormile's staff directory.
+	if err := page.Apply(scopeToOwnTenant(c, db.DB, "tenantid").Where("roleid != ?", 5)).
+		Find(&users).Error; err != nil {
 		return utils.Internal(c, "failed to fetch users")
 	}
 
@@ -420,7 +542,9 @@ func DeleteAppUser(c *fiber.Ctx) error {
 
 func GetTenants(c *fiber.Ctx) error {
 	var tenants []models.Tenant
-	if err := db.DB.Find(&tenants).Error; err != nil {
+	// A client login sees only its own tenant row; the tenant key here is the
+	// primary key, not a "tenantid" foreign column.
+	if err := scopeToOwnTenant(c, db.DB, "tenantid").Find(&tenants).Error; err != nil {
 		return utils.Internal(c, "failed to fetch tenants")
 	}
 	return utils.List(c, tenants, int64(len(tenants)))
@@ -441,6 +565,9 @@ func CreateTenant(c *fiber.Ctx) error {
 	if tenant.Status == "" {
 		tenant.Status = "Active"
 	}
+	if req.Requiredeliveryotp != nil {
+		tenant.Requiredeliveryotp = *req.Requiredeliveryotp
+	}
 
 	if err := db.DB.Create(&tenant).Error; err != nil {
 		return utils.Internal(c, "failed to create tenant")
@@ -451,7 +578,7 @@ func CreateTenant(c *fiber.Ctx) error {
 func GetTenantDetails(c *fiber.Ctx) error {
 	id, _ := strconv.Atoi(c.Params("id"))
 	var tenant models.Tenant
-	if err := db.DB.First(&tenant, id).Error; err != nil {
+	if err := scopeToOwnTenant(c, db.DB, "tenantid").First(&tenant, id).Error; err != nil {
 		return utils.NotFound(c, "tenant not found")
 	}
 	return utils.OK(c, tenant)
@@ -459,6 +586,9 @@ func GetTenantDetails(c *fiber.Ctx) error {
 
 func UpdateTenant(c *fiber.Ctx) error {
 	id, _ := strconv.Atoi(c.Params("id"))
+	if !canAccessTenant(c, id) {
+		return utils.Forbidden(c, "not permitted for this tenant")
+	}
 	var tenant models.Tenant
 	if err := db.DB.First(&tenant, id).Error; err != nil {
 		return utils.NotFound(c, "tenant not found")
@@ -481,6 +611,9 @@ func UpdateTenant(c *fiber.Ctx) error {
 	if req.Status != "" {
 		tenant.Status = req.Status
 	}
+	if req.Requiredeliveryotp != nil {
+		tenant.Requiredeliveryotp = *req.Requiredeliveryotp
+	}
 	tenant.Updatedat = time.Now()
 
 	if err := db.DB.Save(&tenant).Error; err != nil {
@@ -491,6 +624,11 @@ func UpdateTenant(c *fiber.Ctx) error {
 
 func DeleteTenant(c *fiber.Ctx) error {
 	id, _ := strconv.Atoi(c.Params("id"))
+	// Deleting your own tenant is not a client operation either — this is
+	// Doormile-staff only.
+	if !isDoormileConsoleStaff(c) {
+		return utils.Forbidden(c, "not permitted for this tenant")
+	}
 	var tenant models.Tenant
 	if err := db.DB.First(&tenant, id).Error; err != nil {
 		return utils.NotFound(c, "tenant not found")
@@ -504,6 +642,9 @@ func DeleteTenant(c *fiber.Ctx) error {
 
 func GetTenantLocations(c *fiber.Ctx) error {
 	tenantID, _ := strconv.Atoi(c.Params("id"))
+	if !canAccessTenant(c, tenantID) {
+		return utils.Forbidden(c, "not permitted for this tenant")
+	}
 	var locations []models.TenantLocation
 	if err := db.DB.Where("tenantid = ?", tenantID).Find(&locations).Error; err != nil {
 		return utils.Internal(c, "failed to fetch locations")
@@ -513,6 +654,9 @@ func GetTenantLocations(c *fiber.Ctx) error {
 
 func CreateTenantLocation(c *fiber.Ctx) error {
 	tenantID, _ := strconv.Atoi(c.Params("id"))
+	if !canAccessTenant(c, tenantID) {
+		return utils.Forbidden(c, "not permitted for this tenant")
+	}
 	req := new(dto.TenantLocationCreateRequest)
 	if err := c.BodyParser(req); err != nil {
 		return utils.BadRequest(c, "invalid request body")
@@ -520,6 +664,7 @@ func CreateTenantLocation(c *fiber.Ctx) error {
 
 	location := models.TenantLocation{
 		Tenantid:     tenantID,
+		Locationname: req.Locationname,
 		Address:      req.Address,
 		City:         req.City,
 		State:        req.State,
@@ -549,12 +694,20 @@ func UpdateTenantLocation(c *fiber.Ctx) error {
 	if err := db.DB.First(&location, id).Error; err != nil {
 		return utils.NotFound(c, "tenant location not found")
 	}
+	// The location is addressed by its own id, so the tenant guard has to run
+	// against the row we loaded rather than a path parameter.
+	if !canAccessTenant(c, location.Tenantid) {
+		return utils.Forbidden(c, "not permitted for this tenant")
+	}
 
 	req := new(dto.TenantLocationCreateRequest)
 	if err := c.BodyParser(req); err != nil {
 		return utils.BadRequest(c, "invalid request body")
 	}
 
+	if req.Locationname != "" {
+		location.Locationname = req.Locationname
+	}
 	if req.Address != "" {
 		location.Address = req.Address
 	}
@@ -1177,6 +1330,21 @@ func CreateMiler(c *fiber.Ctx) error {
 		appLocID = 1
 	}
 
+	// A client login may only create riders under its own tenant.
+	tenantID := req.Tenantid
+	if own := consoleTenantID(c); own != 0 {
+		tenantID = own
+	}
+
+	// Configid must match what LoginMiler looks up by — it queries
+	// "contactno = ? AND configid = ?" defaulting to 1001. Left unset, AppUser's
+	// column default of 1 applies and the rider can never log in, which is what
+	// happened to every miler created through this endpoint until now.
+	configID := req.Configid
+	if configID == 0 {
+		configID = 1001
+	}
+
 	user := models.AppUser{
 		Authname:      req.Authname,
 		Email:         req.Email,
@@ -1185,6 +1353,9 @@ func CreateMiler(c *fiber.Ctx) error {
 		Roleid:        5, // Miler
 		Status:        "Active",
 		Applocationid: appLocID,
+		Tenantid:      tenantID,
+		Hubid:         req.Hubid,
+		Configid:      configID,
 	}
 
 	if err := tx.Create(&user).Error; err != nil {
@@ -1200,6 +1371,7 @@ func CreateMiler(c *fiber.Ctx) error {
 		Availabilitystatus: constants.MilerOffline,
 		Rating:             5.00,
 		Applocationid:      appLocID,
+		Hubid:              req.Hubid,
 	}
 
 	if err := tx.Create(&profile).Error; err != nil {
@@ -1360,6 +1532,9 @@ func GetAdminBookings(c *fiber.Ctx) error {
 	if tenantID := c.Query("tenantid"); tenantID != "" {
 		query = query.Where("tenantid = ?", tenantID)
 	}
+	// Applied after the caller's own ?tenantid= filter so a client login can
+	// narrow within their tenant but never widen past it.
+	query = scopeToOwnTenant(c, query, "tenantid")
 
 	var total int64
 	if err := query.Count(&total).Error; err != nil {
@@ -1392,6 +1567,11 @@ type AdminBookingRequest struct {
 	Appcustomerid int    `json:"appcustomerid"`
 	CustomerPhone string `json:"customer_phone"`
 	CustomerName  string `json:"customer_name"`
+	// Pickuplocationid names the client site the parcel is collected from — a
+	// DailyGrubs kitchen, for instance. Optional, but supplying it lets the
+	// address/pincode/coordinates be filled from the stored location instead of
+	// retyped, and is the only thing that makes per-site reporting possible.
+	Pickuplocationid    *int                `json:"pickuplocationid"`
 	Pickupaddress       string              `json:"pickupaddress"`
 	Pickuppincode       string              `json:"pickuppincode"`
 	Pickuplatitude      float64             `json:"pickuplatitude"`
@@ -1426,9 +1606,6 @@ func (e *expressBookingValidationError) Error() string { return e.msg }
 // *fiber.Ctx — the original function never touched c after BodyParser, so
 // both callers can use this identically.
 func createExpressBooking(req AdminBookingRequest) (*models.PickupBooking, error) {
-	if req.Pickupaddress == "" || req.Pickuppincode == "" {
-		return nil, &expressBookingValidationError{"pickup address and pincode are required"}
-	}
 	if len(req.Parcels) == 0 {
 		return nil, &expressBookingValidationError{"at least one parcel is required"}
 	}
@@ -1440,6 +1617,35 @@ func createExpressBooking(req AdminBookingRequest) (*models.PickupBooking, error
 		return nil, &expressBookingValidationError{"tenantid does not match a known tenant"}
 	}
 
+	// A named pickup location fills in whatever the caller left blank, so the
+	// console can send a kitchen id instead of restating its address every time.
+	// It must belong to the booking's tenant — otherwise one client could book
+	// against another client's site.
+	if req.Pickuplocationid != nil {
+		var loc models.TenantLocation
+		if err := db.DB.Where("tenantlocationid = ?", *req.Pickuplocationid).First(&loc).Error; err != nil {
+			return nil, &expressBookingValidationError{"pickuplocationid does not match a known location"}
+		}
+		if loc.Tenantid != req.Tenantid {
+			return nil, &expressBookingValidationError{"pickuplocationid does not belong to this tenant"}
+		}
+		if req.Pickupaddress == "" {
+			req.Pickupaddress = loc.Address
+		}
+		if req.Pickuppincode == "" {
+			req.Pickuppincode = loc.Pincode
+		}
+		if req.Pickuplatitude == 0 && req.Pickuplongitude == 0 {
+			req.Pickuplatitude, req.Pickuplongitude = loc.Latitude, loc.Longitude
+		}
+	}
+
+	// Checked after the location fill-in, so a caller supplying only a kitchen
+	// id is not rejected for an address it never needed to send.
+	if req.Pickupaddress == "" || req.Pickuppincode == "" {
+		return nil, &expressBookingValidationError{"pickup address and pincode are required"}
+	}
+
 	tx := db.DB.Begin()
 
 	customerID := req.Appcustomerid
@@ -1472,6 +1678,7 @@ func createExpressBooking(req AdminBookingRequest) (*models.PickupBooking, error
 		Bookingno:           generateBookingNo(),
 		Tenantid:            &tenantID,
 		Appcustomerid:       customerID,
+		Pickuplocationid:    req.Pickuplocationid,
 		Pickupaddress:       req.Pickupaddress,
 		Pickuppincode:       req.Pickuppincode,
 		Pickuplatitude:      req.Pickuplatitude,
@@ -1641,6 +1848,13 @@ func CreateExpressBooking(c *fiber.Ctx) error {
 		return utils.BadRequest(c, "invalid request body")
 	}
 
+	// A client login may only book under its own tenant. Left unchecked, the
+	// tenantid is caller-supplied, so a client could attribute bookings — and
+	// their cost — to another client.
+	if own := consoleTenantID(c); own != 0 {
+		req.Tenantid = own
+	}
+
 	booking, err := createExpressBooking(*req)
 	if err != nil {
 		if _, ok := err.(*expressBookingValidationError); ok {
@@ -1679,7 +1893,14 @@ func AdminBulkCreateBookings(c *fiber.Ctx) error {
 	}
 	results := make([]result, 0, len(req.Bookings))
 
+	ownTenant := consoleTenantID(c)
+
 	for i, item := range req.Bookings {
+		// Same tenant pin as the single-booking path — a bulk import must not
+		// be a way around it.
+		if ownTenant != 0 {
+			item.Tenantid = ownTenant
+		}
 		booking, err := createExpressBooking(item)
 		if err != nil {
 			results = append(results, result{Index: i, Success: false, Error: err.Error()})
@@ -1694,7 +1915,8 @@ func AdminBulkCreateBookings(c *fiber.Ctx) error {
 func GetAdminBookingDetails(c *fiber.Ctx) error {
 	id, _ := strconv.Atoi(c.Params("id"))
 	var booking models.PickupBooking
-	if err := db.DB.Preload("Parcels").Preload("ServiceOptions").Preload("Payments").First(&booking, id).Error; err != nil {
+	q := scopeToOwnTenant(c, db.DB.Preload("Parcels").Preload("ServiceOptions").Preload("Payments"), "tenantid")
+	if err := q.First(&booking, id).Error; err != nil {
 		return utils.NotFound(c, "booking not found")
 	}
 	return utils.OK(c, booking)
@@ -1702,6 +1924,9 @@ func GetAdminBookingDetails(c *fiber.Ctx) error {
 
 func AdminAssignMiler(c *fiber.Ctx) error {
 	id, _ := strconv.Atoi(c.Params("id"))
+	if err := assertBookingAccess(c, id); err != nil {
+		return err
+	}
 
 	type MilerAssign struct {
 		Mileruserid int `json:"mileruserid"`
@@ -1723,6 +1948,9 @@ func AdminAssignMiler(c *fiber.Ctx) error {
 
 func AdminAssignVehicle(c *fiber.Ctx) error {
 	id, _ := strconv.Atoi(c.Params("id"))
+	if err := assertBookingAccess(c, id); err != nil {
+		return err
+	}
 
 	type VehicleAssign struct {
 		Vehicleid    int `json:"vehicleid"`
@@ -1749,6 +1977,9 @@ func AdminAssignVehicle(c *fiber.Ctx) error {
 
 func AdminUpdateBookingStatus(c *fiber.Ctx) error {
 	id, _ := strconv.Atoi(c.Params("id"))
+	if err := assertBookingAccess(c, id); err != nil {
+		return err
+	}
 
 	type StatusUpdate struct {
 		Status string `json:"status"`
@@ -1783,6 +2014,9 @@ func AdminCancelBooking(c *fiber.Ctx) error {
 	if err != nil {
 		return utils.BadRequest(c, "invalid booking ID")
 	}
+	if err := assertBookingAccess(c, id); err != nil {
+		return err
+	}
 
 	var booking models.PickupBooking
 	if err := db.DB.First(&booking, id).Error; err != nil {
@@ -1850,6 +2084,8 @@ func AdminBulkCancelBookings(c *fiber.Ctx) error {
 	}
 	results := make([]result, 0, len(req.Bookingids))
 
+	ownTenant := consoleTenantID(c)
+
 	for _, id := range req.Bookingids {
 		var booking models.PickupBooking
 		if err := db.DB.First(&booking, id).Error; err != nil {
@@ -1857,6 +2093,13 @@ func AdminBulkCancelBookings(c *fiber.Ctx) error {
 			continue
 		}
 
+		// Reported as not-found rather than forbidden, so a client can't probe
+		// which booking ids belong to other tenants.
+		if ownTenant != 0 && (booking.Tenantid == nil || *booking.Tenantid != ownTenant) {
+			results = append(results, result{Bookingid: id, Success: false, Error: "booking not found"})
+			continue
+		}
+
 		if booking.Status == constants.BookingConvertedConsignment || booking.Status == constants.BookingCancelled {
 			results = append(results, result{Bookingid: id, Success: false, Error: "cannot cancel a delivered or already cancelled booking"})
 			continue
@@ -1905,12 +2148,13 @@ func GetAdminConsignments(c *fiber.Ctx) error {
 	page := utils.ParsePage(c)
 
 	var total int64
-	if err := db.DB.Model(&models.Consignment{}).Count(&total).Error; err != nil {
+	if err := scopeToOwnTenant(c, db.DB.Model(&models.Consignment{}), "tenantid").
+		Count(&total).Error; err != nil {
 		return utils.Internal(c, "failed to count consignments")
 	}
 
 	var list []models.Consignment
-	if err := page.Apply(db.DB).Find(&list).Error; err != nil {
+	if err := page.Apply(scopeToOwnTenant(c, db.DB, "tenantid")).Find(&list).Error; err != nil {
 		return utils.Internal(c, "failed to fetch consignments")
 	}
 	return utils.Paginated(c, list, total, page)
@@ -1919,7 +2163,7 @@ func GetAdminConsignments(c *fiber.Ctx) error {
 func GetAdminConsignmentDetails(c *fiber.Ctx) error {
 	id, _ := strconv.Atoi(c.Params("id"))
 	var csg models.Consignment
-	if err := db.DB.First(&csg, id).Error; err != nil {
+	if err := scopeToOwnTenant(c, db.DB, "tenantid").First(&csg, id).Error; err != nil {
 		return utils.NotFound(c, "consignment not found")
 	}
 	return utils.OK(c, csg)
@@ -1928,7 +2172,8 @@ func GetAdminConsignmentDetails(c *fiber.Ctx) error {
 func GetAdminConsignmentTracking(c *fiber.Ctx) error {
 	trackingNo := c.Params("trackingno")
 	var consignment models.Consignment
-	if err := db.DB.Where("trackingno = ?", trackingNo).First(&consignment).Error; err != nil {
+	if err := scopeToOwnTenant(c, db.DB, "tenantid").
+		Where("trackingno = ?", trackingNo).First(&consignment).Error; err != nil {
 		return utils.NotFound(c, "consignment not found")
 	}
 	var history []models.ConsignmentHistory
@@ -2218,7 +2463,10 @@ func ArriveTripsheet(c *fiber.Ctx) error {
 
 func GetPricing(c *fiber.Ctx) error {
 	var pricing []models.Pricing
-	if err := db.DB.Where("deletedat IS NULL").Find(&pricing).Error; err != nil {
+	// Rates are commercially sensitive: one client must never see what another
+	// is charged.
+	if err := scopeToOwnTenant(c, db.DB, "tenantid").
+		Where("deletedat IS NULL").Find(&pricing).Error; err != nil {
 		return utils.Internal(c, "failed to fetch pricing schedules")
 	}
 	return utils.List(c, pricing, int64(len(pricing)))

controllers/hubController.go

@@ -96,9 +96,11 @@ func humanizeRelativeTime(t time.Time) string {
 
 // todayMidnight returns the start of the current day in server local time,
 // used to scope "today" counters on the hub dashboard.
+// todayMidnight is the start of the current day as the database records it —
+// see utils.DBNow. Using the container's own clock here dropped every row
+// created after noon IST out of "today so far".
 func todayMidnight() time.Time {
-	now := time.Now()
+	return utils.DBToday()
-	return time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location())
 }
 
 // parseHubDateRange parses optional from/to (YYYY-MM-DD) query params shared
@@ -110,17 +112,20 @@ func parseHubDateRange(c *fiber.Ctx) (time.Time, time.Time, error) {
 	toStr := c.Query("to")
 
 	if fromStr == "" && toStr == "" {
-		return todayMidnight(), time.Now(), nil
+		return todayMidnight(), utils.DBNow(), nil
 	}
 	if fromStr == "" || toStr == "" {
 		return time.Time{}, time.Time{}, fmt.Errorf("both from and to query params are required (YYYY-MM-DD)")
 	}
 
-	from, err := time.ParseInLocation("2006-01-02", fromStr, time.Local)
+	// Parsed as UTC, not time.Local: stored timestamps are bare wall-clock
+	// digits, so the bounds must be too — otherwise the window silently shifts
+	// with whatever timezone the container happens to run in.
+	from, err := time.ParseInLocation("2006-01-02", fromStr, time.UTC)
 	if err != nil {
 		return time.Time{}, time.Time{}, fmt.Errorf("invalid from date, expected YYYY-MM-DD")
 	}
-	toDate, err := time.ParseInLocation("2006-01-02", toStr, time.Local)
+	toDate, err := time.ParseInLocation("2006-01-02", toStr, time.UTC)
 	if err != nil {
 		return time.Time{}, time.Time{}, fmt.Errorf("invalid to date, expected YYYY-MM-DD")
 	}

controllers/milerAppController.go

@@ -274,9 +274,6 @@ func MilerDeliverConsignment(c *fiber.Ctx) error {
 	if err := c.BodyParser(&req); err != nil {
 		return utils.BadRequest(c, "invalid request body")
 	}
-	if req.Otp == "" {
-		return utils.BadRequest(c, "otp is required")
-	}
 	if req.Deliveredtoname == "" {
 		return utils.BadRequest(c, "deliveredtoname is required")
 	}
@@ -296,17 +293,28 @@ func MilerDeliverConsignment(c *fiber.Ctx) error {
 		return utils.BadRequest(c, "consignment is not out for delivery")
 	}
 
+	// An OTP is only present when the client asked for one (Tenant.Requiredeliveryotp),
+	// so an empty one means this delivery was never meant to need a code — that
+	// covers food clients like DailyGrubs as well as parcels already in the
+	// network from before OTPs existed, which would otherwise be unclosable.
+	if consignment.Deliveryotp != "" {
+		if req.Otp == "" {
+			return utils.BadRequest(c, "otp is required for this delivery")
+		}
+		if req.Otp != consignment.Deliveryotp {
+			return utils.BadRequest(c, "incorrect delivery OTP")
+		}
+	}
+
 	tx := db.DB.Begin()
 
-	// OTP generation/storage is Phase 2 — no delivery_otp field exists yet on
-	// consignments, so acceptance of a non-empty OTP is treated as verified.
 	proof := models.DeliveryProof{
 		Consignmentid:        consignment.Consignmentid,
 		Deliveredat:          time.Now(),
 		Deliveredtoname:      req.Deliveredtoname,
 		Receiversignatureurl: req.Receiversignatureurl,
 		Photourl:             req.Photourl,
-		Otpverified:          true,
+		Otpverified:          consignment.Deliveryotp != "",
 		Geolatitude:          req.Lat,
 		Geolongitude:         req.Lon,
 		Createdby:            milerUserID,
@@ -317,12 +325,30 @@ func MilerDeliverConsignment(c *fiber.Ctx) error {
 	}
 
 	consignment.Status = constants.ConsignmentDelivered
+	// Cleared once redeemed so the same code can't close out a second attempt.
+	consignment.Deliveryotp = ""
 	consignment.Updatedat = time.Now()
 	if err := tx.Save(&consignment).Error; err != nil {
 		tx.Rollback()
 		return utils.Internal(c, "failed to mark consignment delivered")
 	}
 
+	// Every other state change on a consignment writes a history row; delivery
+	// did not, so a customer following the tracking timeline never saw the
+	// parcel arrive — it just stopped at Out_for_Delivery.
+	deliveredEvent := models.ConsignmentHistory{
+		Consignmentid: consignment.Consignmentid,
+		Hubid:         consignment.Currenthubid,
+		Userid:        &milerUserID,
+		Eventstatus:   constants.ConsignmentDelivered,
+		Remarks: fmt.Sprintf("Delivered to %s at (%.5f, %.5f)",
+			req.Deliveredtoname, req.Lat, req.Lon),
+	}
+	if err := tx.Create(&deliveredEvent).Error; err != nil {
+		tx.Rollback()
+		return utils.Internal(c, "failed to record delivery history")
+	}
+
 	if err := tx.Model(&models.BookingAssignment{}).
 		Where("bookingid = ? AND mileruserid = ?", booking.Bookingid, milerUserID).
 		Updates(map[string]interface{}{

controllers/milerController.go

@@ -293,7 +293,8 @@ func UpdateMilerAvailability(c *fiber.Ctx) error {
 		return utils.BadRequest(c, "invalid request body")
 	}
 
-	if req.Status == "" {
+	status := req.ResolvedStatus()
+	if status == "" {
 		return utils.BadRequest(c, "status is required")
 	}
 
@@ -302,7 +303,7 @@ func UpdateMilerAvailability(c *fiber.Ctx) error {
 		return utils.NotFound(c, "miler profile not found")
 	}
 
-	profile.Availabilitystatus = req.Status
+	profile.Availabilitystatus = status
 	profile.Updatedat = time.Now()
 	if err := db.DB.Save(&profile).Error; err != nil {
 		return utils.Internal(c, "failed to update availability")
@@ -796,9 +797,13 @@ func BookingPickupComplete(c *fiber.Ctx) error {
 		consignmentTenantID = *booking.Tenantid
 	}
 
+	// Carried over so the consignment stays traceable to the client site it was
+	// collected from — for a food client that's the kitchen, and "how many
+	// parcels went out of which kitchen" is unanswerable without it.
 	consignment := models.Consignment{
 		Trackingno:          trackingNo,
 		Tenantid:            consignmentTenantID,
+		Pickuplocationid:    booking.Pickuplocationid,
 		Pickuplatitude:      booking.Pickuplatitude,
 		Pickuplongitude:     booking.Pickuplongitude,
 		Deliverylatitude:    booking.Deliverylatitude,
@@ -829,6 +834,17 @@ func BookingPickupComplete(c *fiber.Ctx) error {
 		}
 	}
 
+	// A hyperlocal parcel goes straight out for delivery, so its receiver OTP has
+	// to exist before this transaction commits. Anything routed via a hub gets
+	// its OTP when it actually leaves for the final mile instead. Only issued
+	// for clients that ask for it — see Tenant.Requiredeliveryotp.
+	if consignmentStatus == constants.ConsignmentOutForDelivery {
+		var tenant models.Tenant
+		if tx.Where("tenantid = ?", consignmentTenantID).First(&tenant).Error == nil && tenant.Requiredeliveryotp {
+			consignment.Deliveryotp = utils.GenerateNumericOTP(6)
+		}
+	}
+
 	if err := tx.Create(&consignment).Error; err != nil {
 		tx.Rollback()
 		return utils.Internal(c, "failed to convert booking to consignment")
@@ -865,15 +881,18 @@ func BookingPickupComplete(c *fiber.Ctx) error {
 
 	var customer models.AppCustomer
 	if err := db.DB.Where("appcustomerid = ?", booking.Appcustomerid).First(&customer).Error; err == nil && customer.Devicetoken != "" {
-		if notifyErr := notify.SendToDevice(
+		body := fmt.Sprintf("Parcel picked up — Tracking No: %s", trackingNo)
-			customer.Devicetoken,
+		payload := map[string]string{
-			"Parcel Picked Up",
-			fmt.Sprintf("Parcel picked up — Tracking No: %s", trackingNo),
-			map[string]string{
 			"booking_id":  strconv.Itoa(bookingID),
 			"tracking_no": trackingNo,
-			},
+		}
-		); notifyErr != nil {
+		// The OTP goes to the receiver and only the receiver — the rider has to
+		// be told it at the door, which is what makes it proof of handover.
+		if consignment.Deliveryotp != "" {
+			body = fmt.Sprintf("%s. Share OTP %s with the rider on delivery.", body, consignment.Deliveryotp)
+			payload["delivery_otp"] = consignment.Deliveryotp
+		}
+		if notifyErr := notify.SendToDevice(customer.Devicetoken, "Parcel Picked Up", body, payload); notifyErr != nil {
 			utils.Warn("FCM: failed to notify customer on pickup", "booking_id", bookingID, "error", notifyErr)
 		}
 	}
@@ -919,6 +938,11 @@ func CreateMilerPeriodicLog(c *fiber.Ctx) error {
 		return utils.BadRequest(c, "invalid request body")
 	}
 
+	// The rider's identity comes from their token, never the body. Trusting a
+	// client-supplied userid let any authenticated miler write another miler's
+	// GPS trail, which feeds the location data dispatch reasons over.
+	log.UserID = c.Locals("userid").(int)
+
 	t, err := time.Parse("2006-01-02 15:04:05", log.LogDate)
 	if err != nil {
 		return utils.BadRequest(c, "invalid logdate format — expected YYYY-MM-DD HH:MM:SS")
@@ -987,8 +1011,12 @@ func CreateMilerStatus(c *fiber.Ctx) error {
 		return utils.BadRequest(c, "invalid request body")
 	}
 
-	if status.UserID == 0 || status.Status == "" {
+	// Identity from the token, not the body — otherwise one rider can set
-		return utils.BadRequest(c, "userid and status are required")
+	// another rider's live status.
+	status.UserID = c.Locals("userid").(int)
+
+	if status.Status == "" {
+		return utils.BadRequest(c, "status is required")
 	}
 
 	key := fmt.Sprintf("miler_status:%d", status.UserID)
@@ -1088,10 +1116,16 @@ func PublishConsignmentLogs(c *fiber.Ctx) error {
 		return utils.Internal(c, "cache service unavailable")
 	}
 
+	milerUserID := c.Locals("userid").(int)
+
 	pipe := db.Rdb.TxPipeline()
 	tx := db.DB.Begin()
 
 	for _, item := range input {
+		// Same rule as the other telemetry writers: the token owns the identity,
+		// so a batch can't be attributed to some other rider.
+		item.UserID = milerUserID
+
 		logTime, err := time.Parse("2006-01-02 15:04:05", item.LogDate)
 		if err != nil {
 			logTime = time.Now()

dto/admin.go

@@ -7,9 +7,15 @@ type TenantCreateRequest struct {
 	Primaryemail   string `json:"primaryemail"`
 	Primarycontact string `json:"primarycontact"`
 	Status         string `json:"status"`
+	// Requiredeliveryotp is a pointer so an update that omits it leaves the
+	// existing setting alone rather than silently switching OTPs off.
+	Requiredeliveryotp *bool `json:"requiredeliveryotp"`
 }
 
 type TenantLocationCreateRequest struct {
+	// Locationname is the client's own label for the site — "DailyGrubs
+	// Peelamedu Kitchen" — since an address alone doesn't identify a branch.
+	Locationname string  `json:"locationname"`
 	Address      string  `json:"address"`
 	City         string  `json:"city"`
 	State        string  `json:"state"`
@@ -62,8 +68,18 @@ type MilerCreateRequest struct {
 	Contactno   string `json:"contactno"`
 	Password    string `json:"password"`
 	Displayname string `json:"displayname"`
+	// Tenantid attaches a rider to the client they deliver for — riders migrated
+	// from jupiter belong to a specific client (DailyGrubs, Bawa Medicals)
+	// rather than to Doormile's general pool. Zero leaves them unattached.
+	Tenantid           int    `json:"tenantid"`
 	Defaultvehicletype string `json:"defaultvehicletype"`
 	Applocationid      int    `json:"applocationid"`
+	// Configid partitions logins; defaults to 1001, which is what the miler app
+	// authenticates against. Only set this if you know why you're changing it.
+	Configid int `json:"configid"`
+	// Hubid is optional: a rider with no hub is still assignable from the
+	// express console, but is invisible to the hub console's miler list.
+	Hubid *int `json:"hubid"`
 }
 
 type PricingCreateRequest struct {

dto/booking.go

@@ -55,10 +55,28 @@ type MilerLocationUpdateRequest struct {
 	Latitude  float64 `json:"latitude"`
 	Longitude float64 `json:"longitude"`
 	Pincode   string  `json:"pincode"`
+	// Speed and Heading are sent by the rider app and were previously dropped on
+	// the floor, since unknown JSON fields parse silently. Accepted here so the
+	// values at least reach the periodic-log telemetry rather than vanishing.
+	Speed   float64 `json:"speed"`
+	Heading float64 `json:"heading"`
 }
 
 type MilerAvailabilityRequest struct {
 	Status string `json:"status"` // Offline, Available, Break, etc.
+	// Availabilitystatus is the field name the published Miler App API Contract
+	// v1.0 told the Flutter dev to send, while the code only ever read "status"
+	// — so the documented request 400s. Both are accepted rather than picking a
+	// winner, because either side may already be built against either name.
+	Availabilitystatus string `json:"availabilitystatus"`
+}
+
+// ResolvedStatus returns whichever of the two accepted field names was sent.
+func (r MilerAvailabilityRequest) ResolvedStatus() string {
+	if r.Status != "" {
+		return r.Status
+	}
+	return r.Availabilitystatus
 }
 
 type PricingQuoteRequest struct {

middlewares/city_gate.go

@@ -13,6 +13,7 @@ var operatingCityPrefixes = map[string]string{
 	"600": "Chennai",
 	"560": "Bengaluru",
 	"500": "Hyderabad",
+	"629": "Nagercoil",
 }
 
 // CityGateMiddleware rejects bookings from pincodes outside Doormile's operating cities.

models/audit.go

@@ -69,6 +69,11 @@ type Consignment struct {
 	Parentconsignmentid *int       `json:"parentconsignmentid" gorm:"column:parentconsignmentid"`
 	Condition           string     `json:"condition" gorm:"column:condition;size:50"` // recorded at hub inbound scan: Good, Damaged, etc.
 	Shelf               string     `json:"shelf" gorm:"column:shelf;size:50"`         // hub storage location assigned at inbound scan
+	// Deliveryotp is issued when the consignment goes out for delivery and is
+	// given to the receiver, not the rider — it is the only proof the parcel
+	// reached the right person. Never serialised outward: returning it in an API
+	// response would hand the rider the code they are supposed to be told.
+	Deliveryotp string     `json:"-" gorm:"column:deliveryotp;size:6"`
 	Createdat   time.Time  `json:"createdat" gorm:"column:createdat;default:CURRENT_TIMESTAMP"`
 	Updatedat   time.Time  `json:"updatedat" gorm:"column:updatedat;default:CURRENT_TIMESTAMP"`
 	Createdby   int        `json:"createdby" gorm:"column:createdby"`

models/client.go

@@ -63,6 +63,11 @@ type DoormileAuth struct {
 	Email        string         `gorm:"uniqueIndex;size:255;not null" json:"email"`
 	PasswordHash string         `gorm:"not null" json:"-"`
 	Role         string         `gorm:"default:'user'" json:"role"`
+	// Tenantid scopes an express-console login to one client, using the same
+	// convention as HubStaffAccount.Tenantid: null = Doormile's own staff, who
+	// see every tenant's data; set = a client's own login, restricted to their
+	// tenant. Without this every console login sees all tenants.
+	Tenantid  *int      `gorm:"column:tenantid;index" json:"tenantid"`
 	CreatedAt time.Time `json:"created_at"`
 	UpdatedAt time.Time `json:"updated_at"`
 }

models/external.go

@@ -9,6 +9,12 @@ type Tenant struct {
 	Primaryemail   string `json:"primaryemail" gorm:"column:primaryemail"`
 	Primarycontact string `json:"primarycontact" gorm:"column:primarycontact"`
 	Status         string `json:"status" gorm:"column:status;default:Active"`
+	// Requiredeliveryotp decides whether the receiver must read a code back to
+	// the rider. Worth the friction for a courier handing over a valuable
+	// parcel; not for a food order, where it just slows every drop down.
+	// Defaults off: turning it on platform-wide would block deliveries for
+	// clients whose customer app has no way to show the code yet.
+	Requiredeliveryotp bool      `json:"requiredeliveryotp" gorm:"column:requiredeliveryotp;default:false"`
 	Createdat          time.Time `json:"createdat" gorm:"column:createdat;default:CURRENT_TIMESTAMP"`
 	Updatedat          time.Time `json:"updatedat" gorm:"column:updatedat;default:CURRENT_TIMESTAMP"`
 }

models/users.go

@@ -158,6 +158,7 @@ func (AppCustomerLocation) TableName() string {
 type TenantLocation struct {
 	Tenantlocationid int       `json:"tenantlocationid" gorm:"primaryKey;column:tenantlocationid"`
 	Tenantid         int       `json:"tenantid" gorm:"column:tenantid;not null"`
+	Locationname     string    `json:"locationname" gorm:"column:locationname"`
 	Address          string    `json:"address" gorm:"column:address;not null"`
 	City             string    `json:"city" gorm:"column:city;not null"`
 	State            string    `json:"state" gorm:"column:state;not null"`

routes/routes.go

@@ -113,7 +113,15 @@ func RegisterRoutes(app *fiber.App, cfg *config.Config) {
 	miler := api.Group("/miler")
 	miler.Post("/login", authThrottle, controllers.LoginMiler(cfg))
 	miler.Post("/verify-pin", authThrottle, controllers.VerifyMilerPin(cfg))
-	miler.Post("/reset-pin", authThrottle, controllers.ResetMilerPin)
+	// PIN reset is console-operated, NOT self-service: ResetMilerPin overwrites
+	// the PIN given only a phone number, and phone numbers are the miler login
+	// identifier rather than a secret. Left unauthenticated, two calls
+	// (reset-pin then verify-pin) take over any miler account. Ops resets a
+	// rider's PIN on request instead, so this carries admin/manager/executive
+	// auth even though it sits under the /miler prefix.
+	miler.Post("/reset-pin", authThrottle,
+		middlewares.AuthMiddleware(cfg), middlewares.RoleCheckMiddleware(1, 3, 4),
+		controllers.ResetMilerPin)
 
 	// Authenticated Miler App routes
 	milerAuth := miler.Use(middlewares.AuthMiddleware(cfg), middlewares.RoleCheckMiddleware(5))

utils/helper.go

@@ -1,7 +1,9 @@
 package utils
 
 import (
+	"crypto/rand"
 	"errors"
+	"math/big"
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
@@ -13,6 +15,55 @@ func HashPassword(password string) (string, error) {
 	return string(bytes), err
 }
 
+// dbLocation is the timezone the database records wall-clock timestamps in: the
+// connection DSN sets TimeZone=Asia/Kolkata, so CURRENT_TIMESTAMP column
+// defaults write IST wall-clock into timestamp-without-timezone columns.
+var dbLocation = func() *time.Location {
+	if loc, err := time.LoadLocation("Asia/Kolkata"); err == nil {
+		return loc
+	}
+	// A container without tzdata can't load the database; IST observes no DST,
+	// so a fixed +05:30 offset is exact rather than an approximation.
+	return time.FixedZone("IST", 5*3600+30*60)
+}()
+
+// DBNow returns the current moment expressed as the wall-clock the database
+// stores, tagged UTC so the driver sends exactly those digits. Use it for any
+// comparison against a stored timestamp: comparing the container's UTC clock
+// against IST-stamped rows is what made date-range reports undercount.
+//
+// Deliberately independent of the container's own TZ, so it stays correct
+// whether or not TZ=Asia/Kolkata is set.
+func DBNow() time.Time {
+	n := time.Now().In(dbLocation)
+	return time.Date(n.Year(), n.Month(), n.Day(), n.Hour(), n.Minute(), n.Second(), n.Nanosecond(), time.UTC)
+}
+
+// DBToday returns midnight at the start of the current database-local day.
+func DBToday() time.Time {
+	n := DBNow()
+	return time.Date(n.Year(), n.Month(), n.Day(), 0, 0, 0, 0, time.UTC)
+}
+
+// GenerateNumericOTP returns a random n-digit code, leading zeros preserved.
+// crypto/rand rather than math/rand: this is the only thing standing between a
+// parcel and someone claiming it was delivered, so a predictable sequence would
+// defeat the point.
+func GenerateNumericOTP(n int) string {
+	const digits = "0123456789"
+	out := make([]byte, n)
+	for i := range out {
+		idx, err := rand.Int(rand.Reader, big.NewInt(int64(len(digits))))
+		if err != nil {
+			// A failing system RNG must not silently downgrade to a guessable
+			// code; the caller treats an empty OTP as "not issued".
+			return ""
+		}
+		out[i] = digits[idx.Int64()]
+	}
+	return string(out)
+}
+
 func CheckPasswordHash(password, hash string) bool {
 	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
 	return err == nil