Add products and sales management modules with database schema and validation

- Introduced `ProductsModule` to manage product data, including read and write controllers.
- Created database migrations for the `products`, `sales_requests`, `sales_orders`, `sales_invoices`, and related tables, including constraints and unique indexes.
- Implemented validation for product fields such as code, name, unit, and brand with corresponding utility functions.
- Developed service and repository layers for handling product and sales data operations.
- Added unit tests for the products and sales services, repositories, and controllers to ensure functionality and correctness.
- Updated application module to include the new `ProductsModule` and related sales modules for better organization.

test/packing-slips.e2e-spec.ts

@@ -0,0 +1,163 @@
+import { INestApplication } from '@nestjs/common';
+import { Test, TestingModule } from '@nestjs/testing';
+import { eq } from 'drizzle-orm';
+import request from 'supertest';
+import { App } from 'supertest/types';
+import { AppModule } from '../src/app.module';
+import { configureApp } from '../src/common/configure-app';
+import { DRIZZLE, type DrizzleDB } from '../src/database/database.module';
+import {
+  privilegeDetails,
+  privilegeKeys,
+  privileges,
+  users,
+} from '../src/database/schema';
+import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+
+describe('Packing slips (e2e)', () => {
+  let app: INestApplication<App>;
+  let db: DrizzleDB;
+  let adminAccessToken: string;
+  let otherAccessToken: string;
+  let customerId: string;
+  let productId: string;
+
+  const password = 'password123';
+  const suffix = Date.now().toString().slice(-6);
+
+  beforeAll(async () => {
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+    app = moduleFixture.createNestApplication();
+    configureApp(app, { NODE_ENV: 'test', SWAGGER_ENABLED: 'false' });
+    await app.init();
+    db = app.get(DRIZZLE);
+
+    const adminReg = await request(app.getHttpServer())
+      .post('/auth/register')
+      .send({ username: `ps_admin_${suffix}`, password })
+      .expect(201);
+    adminAccessToken = (adminReg.body as { accessToken: string }).accessToken;
+    const adminMe = await request(app.getHttpServer())
+      .get('/auth/me')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .expect(200);
+    const adminUserId = (adminMe.body as { id: string }).id;
+    const otherReg = await request(app.getHttpServer())
+      .post('/auth/register')
+      .send({ username: `ps_other_${suffix}`, password })
+      .expect(201);
+    otherAccessToken = (otherReg.body as { accessToken: string }).accessToken;
+
+    const now = Date.now();
+    const [priv] = await db
+      .insert(privileges)
+      .values({
+        name: 'Packing Admin',
+        code: `PS_ADMIN_${now}`,
+        status: 'active',
+        createdAt: now,
+        updatedAt: now,
+        createdBy: adminUserId,
+        updatedBy: adminUserId,
+      })
+      .returning();
+    const keys = await db.select().from(privilegeKeys);
+    await db.insert(privilegeDetails).values(
+      keys.flatMap((key) =>
+        PRIVILEGE_ACTIONS.map((action) => ({
+          privilegeId: priv.id,
+          privilegeKeyId: key.id,
+          action,
+          value: true,
+        })),
+      ),
+    );
+    await db
+      .update(users)
+      .set({ privilegeId: priv.id, updatedAt: Date.now() })
+      .where(eq(users.id, adminUserId));
+
+    const customer = await request(app.getHttpServer())
+      .post('/customers')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({
+        code: `C_${suffix}`,
+        name: 'Acme Corp',
+        phone: '+6281234567890',
+        address: 'Jl Sudirman 1',
+      })
+      .expect(201);
+    customerId = (customer.body as { id: string }).id;
+    const product = await request(app.getHttpServer())
+      .post('/products')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({
+        code: `P_${suffix}`,
+        name: 'Fuel 95',
+        unit: 'L',
+        price: '12500.0000',
+      })
+      .expect(201);
+    productId = (product.body as { id: string }).id;
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('rejects unauthenticated access', async () => {
+    await request(app.getHttpServer()).get('/packing-slips').expect(401);
+  });
+
+  it('forbids list without permission', async () => {
+    await request(app.getHttpServer())
+      .get('/packing-slips')
+      .set('Authorization', `Bearer ${otherAccessToken}`)
+      .expect(403);
+  });
+
+  it('creates, patches, and deletes a packing slip', async () => {
+    const created = await request(app.getHttpServer())
+      .post('/packing-slips')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({
+        date: '2026-08-24T10:00:00+07:00',
+        customerId,
+        address: 'Jl Sudirman 1',
+        products: [{ productId, quantity: '2' }],
+      })
+      .expect(201);
+    expect(created.body).toMatchObject({
+      customerId,
+      address: 'Jl Sudirman 1',
+      status: 'draft',
+    });
+    expect((created.body as { code: string }).code).toMatch(/^PS-/);
+    const id = (created.body as { id: string }).id;
+
+    await request(app.getHttpServer())
+      .patch(`/packing-slips/${id}`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ status: 'processed' })
+      .expect(400);
+
+    await request(app.getHttpServer())
+      .patch(`/packing-slips/${id}/status`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ status: 'processed' })
+      .expect(200);
+
+    const detail = await request(app.getHttpServer())
+      .get(`/packing-slips/${id}`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .expect(200);
+    expect((detail.body as { products: unknown[] }).products).toHaveLength(1);
+
+    await request(app.getHttpServer())
+      .delete(`/packing-slips/${id}`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .expect(204);
+  });
+});