status updated

controllers/tenantController.go

@@ -871,3 +871,53 @@ func (ctl *TenantController) ResendInvite(c *fiber.Ctx) error {
 		"code": http.StatusOK, "status": true, "message": "Invitation sent.",
 	})
 }
+
+/*
+PUT /v1/web/tenants/storeopen
+
+Open or close a branch for the day.
+
+── Why this is on the guarded group ────────────────────────────────────────
+
+Closing a shop stops it taking money. On /v1/mob/* — which carries no session
+at all — anyone who could guess a locationid could shut any shop on the
+platform. WebAuth checks the tenant scope, so a business can only reach its
+own branches.
+
+A business objection — a date in the past, a branch that is not yours — is 409
+and not 500: the request was well formed, and the message is written to be
+shown to the person who typed it.
+*/
+func (ctl *TenantController) SetStoreOpen(c *fiber.Ctx) error {
+	var req struct {
+		Tenantid   int `json:"tenantid"`
+		Locationid int `json:"locationid"`
+		// A POINTER, so "not sent" and "sent as false" stay different answers.
+		// A plain bool would read a missing field as "close this shop".
+		Isopen      *bool  `json:"isopen"`
+		Closeduntil string `json:"closeduntil"`
+	}
+
+	if err := c.BodyParser(&req); err != nil {
+		return c.Status(http.StatusBadRequest).JSON(fiber.Map{
+			"code": http.StatusBadRequest, "message": "Invalid request body", "status": false,
+		})
+	}
+	if req.Isopen == nil {
+		return c.Status(http.StatusBadRequest).JSON(fiber.Map{
+			"code": http.StatusBadRequest, "message": "isopen is required", "status": false,
+		})
+	}
+
+	if err := ctl.tenantService.SetStoreOpen(
+		req.Tenantid, req.Locationid, *req.Isopen, req.Closeduntil,
+	); err != nil {
+		return c.Status(http.StatusConflict).JSON(fiber.Map{
+			"code": http.StatusConflict, "message": err.Error(), "status": false,
+		})
+	}
+
+	return c.Status(http.StatusOK).JSON(fiber.Map{
+		"code": http.StatusOK, "message": "Successfully Updated", "status": true,
+	})
+}