the admin page now make sense for products

Cargo.lock

@@ -572,6 +572,12 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
+[[package]]
+name = "base32"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "022dfe9eb35f19ebbcb51e0b40a5ab759f46ad60cadf7297e0bd085afb50e076"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -755,12 +761,24 @@ version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
 
+[[package]]
+name = "bytemuck"
+version = "1.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
+[[package]]
+name = "byteorder-lite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
+
 [[package]]
 name = "bytes"
 version = "1.12.0"
@@ -1059,6 +1077,12 @@ dependencies = [
  "tiny-keccak",
 ]
 
+[[package]]
+name = "constant_time_eq"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6"
+
 [[package]]
 name = "cookie"
 version = "0.18.1"
@@ -1581,6 +1605,15 @@ version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -2424,6 +2457,19 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "image"
+version = "0.25.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85ab80394333c02fe689eaf900ab500fbd0c2213da414687ebf995a65d5a6104"
+dependencies = [
+ "bytemuck",
+ "byteorder-lite",
+ "moxcms",
+ "num-traits",
+ "png",
+]
+
 [[package]]
 name = "include_dir"
 version = "0.7.4"
@@ -2604,11 +2650,15 @@ dependencies = [
  "chrono",
  "dotenvy",
  "fluent-templates",
+ "form_urlencoded",
+ "futures-util",
+ "hmac",
  "include_dir",
  "insta",
  "loco-oauth2",
  "loco-rs",
  "migration",
+ "multer",
  "passwords",
  "regex",
  "reqwest",
@@ -2617,8 +2667,11 @@ dependencies = [
  "serde",
  "serde_json",
  "serial_test",
+ "sha2",
+ "subtle",
  "time",
  "tokio",
+ "totp-rs",
  "tower-sessions",
  "tracing",
  "tracing-subscriber",
@@ -3052,6 +3105,16 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "moxcms"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb85c154ba489f01b25c0d36ae69a87e4a1c73a72631fc6c0eb6dde34a73e44b"
+dependencies = [
+ "num-traits",
+ "pxfm",
+]
+
 [[package]]
 name = "multer"
 version = "3.1.0"
@@ -3654,6 +3717,19 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "polling"
 version = "3.11.0"
@@ -3816,6 +3892,29 @@ dependencies = [
  "unicase",
 ]
 
+[[package]]
+name = "pxfm"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f"
+
+[[package]]
+name = "qrcodegen"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4339fc7a1021c9c1621d87f5e3505f2805c8c105420ba2f2a4df86814590c142"
+
+[[package]]
+name = "qrcodegen-image"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99530e45ded4640c0eab5420fc60f9a0ec1be51a22e49cc8578b9a0d8be70712"
+dependencies = [
+ "base64",
+ "image",
+ "qrcodegen",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.38.4"
@@ -5739,6 +5838,23 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
+[[package]]
+name = "totp-rs"
+version = "5.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2b36a9dd327e9f401320a2cb4572cc76ff43742bcfc3291f871691050f140ba"
+dependencies = [
+ "base32",
+ "constant_time_eq",
+ "hmac",
+ "qrcodegen-image",
+ "rand 0.9.4",
+ "sha1",
+ "sha2",
+ "url",
+ "urlencoding",
+]
+
 [[package]]
 name = "tower"
 version = "0.4.13"
@@ -6144,6 +6260,12 @@ dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
 [[package]]
 name = "utf-8"
 version = "0.7.6"

Cargo.toml

@@ -49,6 +49,15 @@ axum-casbin = "1.3.0"
 loco-oauth2 = "0.5.0"
 passwords = "3.1.16"
 tower-sessions = "0.14"
+# TOTP (Google Authenticator) for optional two-factor auth
+totp-rs = { version = "5", features = ["qr", "gen_secret"] }
+# CSRF: HMAC-signed double-submit token + body inspection for the `_csrf` field
+hmac = { version = "0.12" }
+sha2 = { version = "0.10" }
+subtle = { version = "2.6" }
+form_urlencoded = { version = "1" }
+multer = { version = "3" }
+futures-util = { version = "0.3" }
 
 [[bin]]
 name = "kompress-eshop-cli"

assets/i18n/en/main.ftl

@@ -208,6 +208,75 @@ edit-category = Edit category
 product = Product
 name = Name
 price = Price
+sale-price = Sale price
+variants-options = Variants / options
+add-option = Add option
+option-label = Option label
+optional = optional
+choose-option = Choose an option
+from-price = from { $price }
+admin-discounts = Discounts
+admin-discounts-desc = Set discounted product prices. A discount shows up as a sale in the shop.
+business-discount-desc = A baseline discount for all business accounts (off the regular price). Profiles and negotiated prices apply on top (lowest price wins).
+audience-personal = Personal
+audience-business = Business
+apply-profiles-personal-hint = These profiles lower the public price for all customers.
+apply-profiles-business-hint = These profiles lower the price for all business accounts. Businesses always get the lower of the personal and business price.
+on-sale = On sale
+no-discount = No discount
+discount = Discount
+set-discount = Set discount
+remove-discount = Remove discount
+remove = Remove
+discount-mode-fixed = Fixed price
+discount-mode-percent = Percentage
+discount-percent = Discount (%)
+discount-preview-before = Original price
+discount-preview-after = New price
+discount-preview-save = You save
+discount-invalid = Invalid price.
+discount-must-be-positive = The sale price must be greater than zero.
+discount-below-regular = The sale price must be below the regular price.
+discount-percent-range = The percentage must be between 0 and 100.
+discount-apply-confirm = Apply these discounts to the shop?
+discount-remove-confirm = Remove this discount?
+profile-applied = Applied
+profile-will-apply = Will apply
+profile-will-remove = Will remove
+profiles-unsaved = Unsaved changes — Save to apply
+profiles-no-changes = No changes
+admin-customers = Business accounts
+admin-customers-desc = Manage negotiated prices for business (B2B) accounts.
+admin-no-customers = No business accounts yet.
+email = Email
+back = Back
+negotiated-prices = Negotiated prices
+negotiated-prices-hint = Set a price for a specific product for this business account. The customer always pays the lower of the public and negotiated price.
+manage-prices = Manage prices
+public-price = Public price
+business-price = Business price
+negotiated-price = Negotiated price
+set-negotiated-price = Set price
+negotiated-price-hint = Set a negotiated price for this product for this business account. The customer always pays the lowest of the public, business and negotiated price.
+negotiated-remove-confirm = Remove this negotiated price?
+effective-price = Effective price
+admin-discount-profiles = Discount profiles
+admin-discount-profiles-desc = Create reusable discount layers (a % over chosen products) and assign them to business accounts.
+admin-no-profiles = No discount profiles yet.
+new-profile = New profile
+edit-profile = Edit profile
+profile-name-required = Profile name is required.
+scope = Scope
+products = Products
+scope-include = Selected products
+scope-all-except = All except selected
+scope-include-hint = Applies only to the products selected below.
+scope-all-except-hint = Applies to every product except those selected below.
+automated-price = Automated price
+discount-profiles = Discount profiles
+collision = Conflict
+resolve = Resolve
+no-profiles-assigned = No profiles assigned.
 stock = Stock
 sku = SKU
 currency = Currency
@@ -217,6 +286,8 @@ image = Image
 slug = URL slug
 slug-auto = generated automatically
 position = Position
+position-auto = added to the end
+position-hint = Sort order in the menu (lowest first). Leave blank to add it last.
 parent-category = Parent category
 no-parent = — None (top level) —
 quantity = Quantity
@@ -232,6 +303,7 @@ shop-subtitle = browse our products.
 shop-empty = There are no products here yet.
 categories = Categories
 all-products = All products
+uncategorized = Uncategorized
 cart-title = Cart
 cart-empty = Your cart is empty.
 cart-total = Total
@@ -289,6 +361,34 @@ password-change-title = Change password
 password-current = Current password
 password-current-wrong = Your current password is incorrect.
 password-changed = Your password has been changed.
+
+# Two-factor authentication (TOTP / Google Authenticator)
+security-title = Security
+security-2fa-intro = Two-factor authentication (2FA) adds a one-time code from an app like Google Authenticator to your sign-in.
+security-2fa-on = 2FA is on
+security-2fa-off = 2FA is off
+security-2fa-enable = Enable two-factor authentication
+security-2fa-scan = Scan this QR code in Google Authenticator (or any compatible app).
+security-2fa-manual = Or enter the key manually:
+security-2fa-enter-code = Enter the 6-digit code from the app
+security-2fa-confirm = Confirm and enable
+security-2fa-code-wrong = That code is wrong or expired. Please try again.
+security-2fa-enroll-error = Could not start 2FA setup. Please try again.
+security-2fa-enabled-ok = Two-factor authentication is enabled.
+security-2fa-backup-intro = Save these backup codes somewhere safe. Each can be used once if you lose access to your app.
+security-2fa-backup-remaining = Backup codes remaining
+security-2fa-regenerate = Generate new backup codes
+security-2fa-disable = Disable two-factor authentication
+security-2fa-disable-hint = Enter your current password to confirm.
+
+# Second login step (after password)
+login-totp-title = Two-factor authentication
+login-totp-intro = Enter the code from your authenticator app.
+login-totp-error = That code is wrong or expired.
+login-totp-code = Verification code
+login-totp-submit = Verify
+login-totp-backup-hint = No access to your app? Enter one of your backup codes.
+
 account-type-locked = Account type can't be changed after registration.
 checkout-create-account = Create an account from this order
 checkout-create-account-hint = We'll email you a link to set your password. This order will be linked to your account.

assets/i18n/sk/main.ftl

@@ -208,6 +208,75 @@ edit-category = Upraviť kategóriu
 product = Produkt
 name = Názov
 price = Cena
+sale-price = Zľavnená cena
+variants-options = Varianty / možnosti
+add-option = Pridať možnosť
+option-label = Označenie možnosti
+optional = voliteľné
+choose-option = Vyberte možnosť
+from-price = od { $price }
+admin-discounts = Zľavy
+admin-discounts-desc = Nastavte zľavnené ceny produktov. Zľava sa v obchode zobrazí ako akcia.
+business-discount-desc = Základná zľava pre všetky firemné účty (z bežnej ceny). Profily a dohodnuté ceny sa uplatnia navyše (platí najnižšia cena).
+audience-personal = Osobné
+audience-business = Firemné
+apply-profiles-personal-hint = Tieto profily znížia verejnú cenu pre všetkých zákazníkov.
+apply-profiles-business-hint = Tieto profily znížia cenu pre všetky firemné účty. Firmy vždy dostanú nižšiu z osobnej a firemnej ceny.
+on-sale = V akcii
+no-discount = Bez zľavy
+discount = Zľava
+set-discount = Nastaviť zľavu
+remove-discount = Zrušiť zľavu
+remove = Odstrániť
+discount-mode-fixed = Pevná cena
+discount-mode-percent = Percentá
+discount-percent = Zľava (%)
+discount-preview-before = Pôvodná cena
+discount-preview-after = Nová cena
+discount-preview-save = Ušetríte
+discount-invalid = Neplatná cena.
+discount-must-be-positive = Zľavnená cena musí byť väčšia ako nula.
+discount-below-regular = Zľavnená cena musí byť nižšia ako bežná cena.
+discount-percent-range = Percento musí byť medzi 0 a 100.
+discount-apply-confirm = Uplatniť tieto zľavy v obchode?
+discount-remove-confirm = Zrušiť túto zľavu?
+profile-applied = Uplatnené
+profile-will-apply = Bude uplatnené
+profile-will-remove = Bude zrušené
+profiles-unsaved = Neuložené zmeny — uložte na uplatnenie
+profiles-no-changes = Žiadne zmeny
+admin-customers = Firemné účty
+admin-customers-desc = Spravujte dohodnuté ceny pre firemné (B2B) účty.
+admin-no-customers = Zatiaľ žiadne firemné účty.
+email = E-mail
+back = Späť
+negotiated-prices = Dohodnuté ceny
+negotiated-prices-hint = Nastavte cenu pre konkrétny produkt pre tento firemný účet. Zákazník vždy zaplatí najnižšiu z verejnej a dohodnutej ceny.
+manage-prices = Spravovať ceny
+public-price = Verejná cena
+business-price = Firemná cena
+negotiated-price = Dohodnutá cena
+set-negotiated-price = Nastaviť cenu
+negotiated-price-hint = Nastavte dohodnutú cenu tohto produktu pre tento firemný účet. Zákazník vždy zaplatí najnižšiu z verejnej, firemnej a dohodnutej ceny.
+negotiated-remove-confirm = Zrušiť túto dohodnutú cenu?
+effective-price = Výsledná cena
+admin-discount-profiles = Zľavové profily
+admin-discount-profiles-desc = Vytvorte opakovane použiteľné zľavové vrstvy (% na vybrané produkty) a priraďte ich firemným účtom.
+admin-no-profiles = Zatiaľ žiadne zľavové profily.
+new-profile = Nový profil
+edit-profile = Upraviť profil
+profile-name-required = Názov profilu je povinný.
+scope = Rozsah
+products = Produkty
+scope-include = Vybrané produkty
+scope-all-except = Všetky okrem vybraných
+scope-include-hint = Platí len pre vybrané produkty nižšie.
+scope-all-except-hint = Platí pre všetky produkty okrem vybraných nižšie.
+automated-price = Automatická cena
+discount-profiles = Zľavové profily
+collision = Konflikt
+resolve = Vyriešiť
+no-profiles-assigned = Žiadne priradené profily.
 stock = Sklad
 sku = Kód (SKU)
 currency = Mena
@@ -217,6 +286,8 @@ image = Obrázok
 slug = URL adresa
 slug-auto = vygeneruje sa automaticky
 position = Poradie
+position-auto = pridá sa na koniec
+position-hint = Poradie v menu (najnižšie ako prvé). Nechajte prázdne a pridá sa na koniec.
 parent-category = Nadradená kategória
 no-parent = — Žiadna (najvyššia úroveň) —
 quantity = Množstvo
@@ -232,6 +303,7 @@ shop-subtitle = prezrite si našu ponuku produktov.
 shop-empty = Zatiaľ tu nie sú žiadne produkty.
 categories = Kategórie
 all-products = Všetky produkty
+uncategorized = Bez kategórie
 cart-title = Košík
 cart-empty = Váš košík je prázdny.
 cart-total = Spolu
@@ -289,6 +361,34 @@ password-change-title = Zmeniť heslo
 password-current = Súčasné heslo
 password-current-wrong = Vaše súčasné heslo je nesprávne.
 password-changed = Vaše heslo bolo zmenené.
+
+# Two-factor authentication (TOTP / Google Authenticator)
+security-title = Zabezpečenie
+security-2fa-intro = Dvojfaktorové overenie (2FA) pridáva k prihláseniu jednorazový kód z aplikácie ako Google Authenticator.
+security-2fa-on = 2FA je zapnuté
+security-2fa-off = 2FA je vypnuté
+security-2fa-enable = Zapnúť dvojfaktorové overenie
+security-2fa-scan = Naskenujte tento QR kód v aplikácii Google Authenticator (alebo inej kompatibilnej).
+security-2fa-manual = Alebo zadajte kľúč ručne:
+security-2fa-enter-code = Zadajte 6-miestny kód z aplikácie
+security-2fa-confirm = Potvrdiť a zapnúť
+security-2fa-code-wrong = Kód je nesprávny alebo vypršal. Skúste to znova.
+security-2fa-enroll-error = Nepodarilo sa pripraviť 2FA. Skúste to znova.
+security-2fa-enabled-ok = Dvojfaktorové overenie je zapnuté.
+security-2fa-backup-intro = Uložte si tieto záložné kódy na bezpečné miesto. Každý sa dá použiť iba raz, ak nemáte prístup k aplikácii.
+security-2fa-backup-remaining = Zostávajúce záložné kódy
+security-2fa-regenerate = Vygenerovať nové záložné kódy
+security-2fa-disable = Vypnúť dvojfaktorové overenie
+security-2fa-disable-hint = Na potvrdenie zadajte svoje súčasné heslo.
+
+# Second login step (after password)
+login-totp-title = Dvojfaktorové overenie
+login-totp-intro = Zadajte kód z vašej autentifikačnej aplikácie.
+login-totp-error = Kód je nesprávny alebo vypršal.
+login-totp-code = Overovací kód
+login-totp-submit = Overiť
+login-totp-backup-hint = Nemáte prístup k aplikácii? Zadajte jeden zo svojich záložných kódov.
+
 account-type-locked = Typ účtu sa po registrácii nedá zmeniť.
 checkout-create-account = Vytvoriť účet z tejto objednávky
 checkout-create-account-hint = Pošleme vám e-mail na nastavenie hesla. Objednávka sa priradí k vášmu účtu.

assets/views/account/order_detail.html

@@ -29,7 +29,7 @@
     <ul class="space-y-2 pb-3 text-sm">
       {% for item in items %}
       <li class="flex justify-between gap-2">
-        <span class="text-on-surface/80 dark:text-on-surface-dark/80">{{ item.product_name }} × {{ item.quantity }}</span>
+        <span class="text-on-surface/80 dark:text-on-surface-dark/80">{{ item.product_name }}{% if item.variant_label %} · {{ item.variant_label }}{% endif %} × {{ item.quantity }}</span>
         <span class="tabular-nums">{{ item.line_total }} {{ order.currency }}</span>
       </li>
       {% endfor %}

assets/views/account/password.html

@@ -22,6 +22,7 @@
 
   <form method="post" action="/account/password" hx-boost="false" class="mt-6 flex flex-col gap-4"
     x-data="{ password: '', confirm: '' }">
+  {{ ui::csrf_field() }}
     <div class="flex flex-col gap-1">
       <label for="current_password" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="password-current", lang=lang | default(value='sk')) }}</label>
       {{ ui::input(name="current_password", id="current_password", type="password", required=true, autocomplete="current-password") }}

assets/views/account/profile.html

@@ -82,6 +82,7 @@
 
   <!-- edit form -->
   <form x-show="editing" x-cloak method="post" action="/account/profile" hx-boost="false" class="mt-6 space-y-6">
+  {{ ui::csrf_field() }}
     <!-- account type is fixed at registration and shown read-only -->
     <fieldset class="space-y-2 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
       <legend class="px-1 text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-type", lang=lang | default(value='sk')) }}</legend>

assets/views/account/security.html

@@ -0,0 +1,84 @@
+{% extends "base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="security-title", lang=lang | default(value='sk')) }}{% endblock title %}
+
+{% block content %}
+<div class="mx-auto max-w-md">
+  <h1 class="text-3xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="security-title", lang=lang | default(value='sk')) }}</h1>
+  <p class="mt-2 text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-intro", lang=lang | default(value='sk')) }}</p>
+
+  {% if error == "password" %}
+  {{ ui::alert_danger(message=t(key="password-current-wrong", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% elif error == "code" %}
+  {{ ui::alert_danger(message=t(key="security-2fa-code-wrong", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% elif error == "enroll" %}
+  {{ ui::alert_danger(message=t(key="security-2fa-enroll-error", lang=lang | default(value='sk')), extra="mt-4") }}
+  {% endif %}
+
+  {# --- One-time backup codes, shown right after enabling / regenerating --- #}
+  {% if backup_codes and backup_codes | length > 0 %}
+  <div class="mt-6 rounded-radius border border-success bg-success/10 px-4 py-3" role="status">
+    <p class="text-sm font-medium text-success">{{ t(key="security-2fa-enabled-ok", lang=lang | default(value='sk')) }}</p>
+    <p class="mt-2 text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-backup-intro", lang=lang | default(value='sk')) }}</p>
+    <ul class="mt-3 grid grid-cols-2 gap-2 font-mono text-sm text-on-surface-strong dark:text-on-surface-dark-strong">
+      {% for code in backup_codes %}
+      <li class="rounded-radius bg-surface px-3 py-1.5 text-center tracking-wider dark:bg-surface-dark">{{ code }}</li>
+      {% endfor %}
+    </ul>
+  </div>
+  {% endif %}
+
+  {% if enrolling %}
+  {# --- Step 2: scan the QR and confirm a code --- #}
+  <div class="mt-6 flex flex-col gap-4 rounded-radius border border-outline bg-surface-alt p-5 dark:border-outline-dark dark:bg-surface-dark-alt">
+    <p class="text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-scan", lang=lang | default(value='sk')) }}</p>
+    <img src="{{ qr }}" alt="TOTP QR" class="mx-auto size-48 rounded-radius bg-white p-2" />
+    <div class="text-center">
+      <p class="text-xs text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-manual", lang=lang | default(value='sk')) }}</p>
+      <code class="mt-1 inline-block break-all font-mono text-sm text-on-surface-strong dark:text-on-surface-dark-strong">{{ secret }}</code>
+    </div>
+    <form method="post" action="/account/security/confirm" hx-boost="false" class="flex flex-col gap-3">
+  {{ ui::csrf_field() }}
+      <label for="code" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="security-2fa-enter-code", lang=lang | default(value='sk')) }}</label>
+      {{ ui::input(name="code", id="code", type="text", required=true, autocomplete="one-time-code", attrs='inputmode="numeric" pattern="[0-9]*" maxlength="6" autofocus') }}
+      {{ ui::button(label=t(key="security-2fa-confirm", lang=lang | default(value='sk')), type="submit", extra="w-full") }}
+    </form>
+  </div>
+
+  {% elif totp_enabled %}
+  {# --- Enabled: status + remaining backup codes + disable / regenerate --- #}
+  <div class="mt-6 flex items-center gap-2">
+    {{ ui::badge(label=t(key="security-2fa-on", lang=lang | default(value='sk')), variant="success") }}
+    <span class="text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-backup-remaining", lang=lang | default(value='sk')) }}: {{ backup_remaining }}</span>
+  </div>
+
+  <form method="post" action="/account/security/backup-codes" hx-boost="false" class="mt-6 flex flex-col gap-3 rounded-radius border border-outline bg-surface-alt p-5 dark:border-outline-dark dark:bg-surface-dark-alt">
+  {{ ui::csrf_field() }}
+    <p class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="security-2fa-regenerate", lang=lang | default(value='sk')) }}</p>
+    <label for="regen_pw" class="text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="password-current", lang=lang | default(value='sk')) }}</label>
+    {{ ui::input(name="current_password", id="regen_pw", type="password", required=true, autocomplete="current-password") }}
+    {{ ui::button(label=t(key="security-2fa-regenerate", lang=lang | default(value='sk')), type="submit", variant="outline-secondary", extra="w-full") }}
+  </form>
+
+  <form method="post" action="/account/security/disable" hx-boost="false" class="mt-4 flex flex-col gap-3 rounded-radius border border-danger/40 bg-danger/5 p-5">
+  {{ ui::csrf_field() }}
+    <p class="text-sm font-medium text-danger">{{ t(key="security-2fa-disable", lang=lang | default(value='sk')) }}</p>
+    <p class="text-xs text-on-surface dark:text-on-surface-dark">{{ t(key="security-2fa-disable-hint", lang=lang | default(value='sk')) }}</p>
+    <label for="disable_pw" class="text-sm text-on-surface dark:text-on-surface-dark">{{ t(key="password-current", lang=lang | default(value='sk')) }}</label>
+    {{ ui::input(name="current_password", id="disable_pw", type="password", required=true, autocomplete="current-password") }}
+    {{ ui::button(label=t(key="security-2fa-disable", lang=lang | default(value='sk')), type="submit", variant="danger", extra="w-full") }}
+  </form>
+
+  {% else %}
+  {# --- Disabled: offer to enable --- #}
+  <form method="post" action="/account/security/enable" hx-boost="false" class="mt-6">
+  {{ ui::csrf_field() }}
+    <div class="flex items-center gap-2">
+      {{ ui::badge(label=t(key="security-2fa-off", lang=lang | default(value='sk')), variant="neutral") }}
+    </div>
+    {{ ui::button(label=t(key="security-2fa-enable", lang=lang | default(value='sk')), type="submit", extra="mt-4 w-full") }}
+  </form>
+  {% endif %}
+</div>
+{% endblock content %}

assets/views/admin/base.html

@@ -45,7 +45,15 @@
     <script defer src="/static/vendor/alpine/alpinejs-3.14.9.min.js"></script>
   </head>
   <body
-    x-data="{ showSidebar: false }"
+    hx-headers='{"X-CSRF-Token": "{{ csrf_token() }}"}'
+    x-data="{
+      showSidebar: false,
+      collapsed: localStorage.getItem('adminSidebarCollapsed') === '1',
+      toggleCollapsed() {
+        this.collapsed = !this.collapsed;
+        localStorage.setItem('adminSidebarCollapsed', this.collapsed ? '1' : '0');
+      }
+    }"
     class="min-h-screen bg-surface text-on-surface antialiased dark:bg-surface-dark dark:text-on-surface-dark">
 
     <!-- dark overlay for the open sidebar on small screens -->
@@ -55,8 +63,8 @@
 
     <!-- sidebar -->
     <nav aria-label="{{ t(key='menu', lang=lang | default(value='sk')) }}"
-      x-bind:class="showSidebar ? 'translate-x-0' : '-translate-x-60'"
-      class="fixed inset-y-0 left-0 z-40 flex w-60 flex-col border-r border-outline bg-surface-alt transition-transform duration-300 md:translate-x-0 dark:border-outline-dark dark:bg-surface-dark-alt">
+      x-bind:class="(showSidebar ? 'translate-x-0' : '-translate-x-60') + ' ' + (collapsed ? 'md:-translate-x-60' : 'md:translate-x-0')"
+      class="fixed inset-y-0 left-0 z-40 flex w-60 flex-col border-r border-outline bg-surface-alt transition-transform duration-300 dark:border-outline-dark dark:bg-surface-dark-alt">
 
       {# Sidebar nav links — adapted from the vendored Penguin UI component
          penguinui-components/sidebar/simple-sidebar.html: Penguin's link
@@ -77,6 +85,10 @@
           class="flex items-center gap-2 rounded-radius px-2 py-1.5 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-on-surface-strong focus:outline-hidden focus-visible:underline aria-[current=page]:bg-primary/10 aria-[current=page]:text-on-surface-strong dark:text-on-surface-dark dark:hover:bg-primary-dark/5 dark:hover:text-on-surface-dark-strong dark:aria-[current=page]:bg-primary-dark/10 dark:aria-[current=page]:text-on-surface-dark-strong">
           {{ t(key="admin-products", lang=lang | default(value='sk')) }}
         </a>
+        <a href="/admin/catalog/discount-profiles" data-nav="/admin/catalog/discount-profiles"
+          class="flex items-center gap-2 rounded-radius px-2 py-1.5 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-on-surface-strong focus:outline-hidden focus-visible:underline aria-[current=page]:bg-primary/10 aria-[current=page]:text-on-surface-strong dark:text-on-surface-dark dark:hover:bg-primary-dark/5 dark:hover:text-on-surface-dark-strong dark:aria-[current=page]:bg-primary-dark/10 dark:aria-[current=page]:text-on-surface-dark-strong">
+          {{ t(key="admin-discount-profiles", lang=lang | default(value='sk')) }}
+        </a>
         <a href="/admin/catalog/categories" data-nav="/admin/catalog/categories"
           class="flex items-center gap-2 rounded-radius px-2 py-1.5 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-on-surface-strong focus:outline-hidden focus-visible:underline aria-[current=page]:bg-primary/10 aria-[current=page]:text-on-surface-strong dark:text-on-surface-dark dark:hover:bg-primary-dark/5 dark:hover:text-on-surface-dark-strong dark:aria-[current=page]:bg-primary-dark/10 dark:aria-[current=page]:text-on-surface-dark-strong">
           {{ t(key="admin-categories", lang=lang | default(value='sk')) }}
@@ -85,6 +97,10 @@
           class="flex items-center gap-2 rounded-radius px-2 py-1.5 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-on-surface-strong focus:outline-hidden focus-visible:underline aria-[current=page]:bg-primary/10 aria-[current=page]:text-on-surface-strong dark:text-on-surface-dark dark:hover:bg-primary-dark/5 dark:hover:text-on-surface-dark-strong dark:aria-[current=page]:bg-primary-dark/10 dark:aria-[current=page]:text-on-surface-dark-strong">
           {{ t(key="admin-orders", lang=lang | default(value='sk')) }}
         </a>
+        <a href="/admin/customers" data-nav="/admin/customers"
+          class="flex items-center gap-2 rounded-radius px-2 py-1.5 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-on-surface-strong focus:outline-hidden focus-visible:underline aria-[current=page]:bg-primary/10 aria-[current=page]:text-on-surface-strong dark:text-on-surface-dark dark:hover:bg-primary-dark/5 dark:hover:text-on-surface-dark-strong dark:aria-[current=page]:bg-primary-dark/10 dark:aria-[current=page]:text-on-surface-dark-strong">
+          {{ t(key="admin-customers", lang=lang | default(value='sk')) }}
+        </a>
         <a href="/admin/shipping" data-nav="/admin/shipping"
           class="flex items-center gap-2 rounded-radius px-2 py-1.5 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-on-surface-strong focus:outline-hidden focus-visible:underline aria-[current=page]:bg-primary/10 aria-[current=page]:text-on-surface-strong dark:text-on-surface-dark dark:hover:bg-primary-dark/5 dark:hover:text-on-surface-dark-strong dark:aria-[current=page]:bg-primary-dark/10 dark:aria-[current=page]:text-on-surface-dark-strong">
           {{ t(key="admin-shipping", lang=lang | default(value='sk')) }}
@@ -96,6 +112,7 @@
           {{ t(key="admin-exit", lang=lang | default(value='sk')) }}
         </a>
         <form method="post" action="/logout">
+          {{ ui::csrf_field() }}
           <button type="submit" class="flex w-full items-center gap-2 rounded-radius px-2 py-1.5 text-left text-sm font-medium text-danger underline-offset-2 transition hover:bg-danger/5 focus:outline-hidden focus-visible:underline">
             {{ t(key="logout", lang=lang | default(value='sk')) }}
           </button>
@@ -104,7 +121,8 @@
     </nav>
 
     <!-- content column -->
-    <div class="flex min-h-screen flex-col md:ml-60">
+    <div :class="collapsed ? 'md:ml-0' : 'md:ml-60'"
+      class="flex min-h-screen flex-col transition-[margin] duration-300">
       <header class="sticky top-0 z-20 flex h-16 items-center gap-4 border-b border-outline bg-surface/95 px-4 backdrop-blur dark:border-outline-dark dark:bg-surface-dark/95">
         <!-- Penguin animated hamburger (bars ↔ X) in our ghost-square shell -->
         <button type="button" @click="showSidebar = !showSidebar" :aria-expanded="showSidebar" aria-label="{{ t(key='menu', lang=lang | default(value='sk')) }}"
@@ -113,6 +131,12 @@
           {{ ui::icon(name="close", size="size-6", attrs='x-cloak x-show="showSidebar"') }}
         </button>
 
+        <!-- desktop sidebar collapse toggle (chevron flips when collapsed) -->
+        <button type="button" @click="toggleCollapsed()" :aria-expanded="(!collapsed).toString()" aria-label="{{ t(key='menu', lang=lang | default(value='sk')) }}"
+          class="hidden size-9 shrink-0 items-center justify-center rounded-radius bg-transparent text-secondary transition hover:opacity-75 focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-secondary active:opacity-100 active:outline-offset-0 md:inline-flex dark:text-secondary-dark dark:focus-visible:outline-secondary-dark">
+          {{ ui::icon(name="chevron-double-left", size="size-6", extra="transition-transform duration-300", attrs=`x-bind:class="collapsed ? 'rotate-180' : ''"`) }}
+        </button>
+
         <span class="text-sm font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">
           {% block crumb %}{{ t(key="admin-title", lang=lang | default(value='sk')) }}{% endblock crumb %}
         </span>
@@ -123,7 +147,7 @@
         </div>
       </header>
 
-      <main class="mx-auto w-full max-w-5xl flex-1 px-4 py-8">
+      <main class="mx-auto w-full flex-1 px-4 py-8 {% block main_class %}max-w-5xl{% endblock main_class %}">
         {% block content %}{% endblock content %}
       </main>
     </div>

assets/views/admin/catalog/_price_preview.html

@@ -0,0 +1,8 @@
+{# OOB fragment: effective-price cells recomputed from the unsaved profile
+   selection on the products page. Each span replaces the matching #eff-<id>
+   span in the table via htmx out-of-band swap. Rendered by
+   admin_products::profiles_preview. #}
+{% import "macros/ui.html" as ui %}
+{% for product in products %}
+<span id="eff-{{ product.id }}" hx-swap-oob="true">{{ ui::eff_price(p=product, preview=true) }}</span>
+{% endfor %}

assets/views/admin/catalog/categories.html

@@ -46,6 +46,7 @@
             {{ ui::button(variant="outline-secondary", label=t(key="edit", lang=lang | default(value='sk')), href="/admin/catalog/categories/" ~ row.category.id ~ "/edit", size="px-3 py-1.5 text-xs") }}
             <form method="post" action="/admin/catalog/categories/{{ row.category.id }}/delete"
               onsubmit="return confirm('{{ t(key="confirm-delete", lang=lang | default(value='sk')) }}')">
+  {{ ui::csrf_field() }}
               {{ ui::button(variant="outline-danger", label=t(key="delete", lang=lang | default(value='sk')), type="submit", size="px-3 py-1.5 text-xs") }}
             </form>
           </div>

assets/views/admin/catalog/category_form.html

@@ -15,11 +15,12 @@
 <form method="post" enctype="multipart/form-data"
   action="{% if category %}/admin/catalog/categories/{{ category.id }}{% else %}/admin/catalog/categories{% endif %}"
   class="mt-6 space-y-5 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+  {{ ui::csrf_field() }}
 
   {% if category %}
-    {% set v_name = category.name %}{% set v_slug = category.slug %}{% set v_pos = category.position %}{% set v_desc = category.description | default(value="") %}{% set v_pub = category.published %}
+    {% set v_name = category.name %}{% set v_pos = category.position %}{% set v_desc = category.description | default(value="") %}{% set v_pub = category.published %}
   {% else %}
-    {% set v_name = "" %}{% set v_slug = "" %}{% set v_pos = 0 %}{% set v_desc = "" %}{% set v_pub = false %}
+    {% set v_name = "" %}{% set v_pos = "" %}{% set v_desc = "" %}{% set v_pub = false %}
   {% endif %}
 
   <div class="space-y-1.5">
@@ -27,17 +28,6 @@
     {{ ui::input(name="name", id="name", required=true, value=v_name) }}
   </div>
 
-  <div class="grid gap-5 sm:grid-cols-2">
-    <div class="space-y-1.5">
-      <label for="slug" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="slug", lang=lang | default(value='sk')) }}</label>
-      {{ ui::input(name="slug", id="slug", value=v_slug, placeholder=t(key='slug-auto', lang=lang | default(value='sk'))) }}
-    </div>
-    <div class="space-y-1.5">
-      <label for="position" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="position", lang=lang | default(value='sk')) }}</label>
-      {{ ui::input(name="position", id="position", type="number", value=v_pos) }}
-    </div>
-  </div>
-
   <div class="space-y-1.5">
     <label for="parent_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="parent-category", lang=lang | default(value='sk')) }}</label>
     <div class="relative">
@@ -67,6 +57,15 @@
     {{ ui::file_input(name="image", id="image", accept="image/*") }}
   </div>
 
+  <div class="space-y-1.5">
+    <label for="position" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
+      {{ t(key="position", lang=lang | default(value='sk')) }}
+      <span class="font-normal text-on-surface/60 dark:text-on-surface-dark/60">({{ t(key="field-optional", lang=lang | default(value='sk')) }})</span>
+    </label>
+    {{ ui::input(name="position", id="position", type="number", value=v_pos, placeholder=t(key='position-auto', lang=lang | default(value='sk'))) }}
+    <p class="text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="position-hint", lang=lang | default(value='sk')) }}</p>
+  </div>
+
   {{ ui::checkbox(name="published", id="published", label=t(key="published", lang=lang | default(value='sk')), checked=v_pub) }}
 
   <div class="flex gap-3 pt-2">

assets/views/admin/catalog/discount_form.html

@@ -0,0 +1,102 @@
+{% extends "admin/base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="set-discount", lang=lang | default(value='sk')) }}{% endblock title %}
+{% block crumb %}{{ t(key="admin-discounts", lang=lang | default(value='sk')) }}{% endblock crumb %}
+
+{% block content %}
+<div class="flex items-center justify-between gap-3">
+  <div>
+    <h1 class="text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ product.name }}</h1>
+    <p class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">
+      {% if audience == "business" %}{{ t(key="audience-business", lang=lang | default(value='sk')) }}{% else %}{{ t(key="audience-personal", lang=lang | default(value='sk')) }}{% endif %}
+    </p>
+  </div>
+  {{ ui::button(variant="outline-secondary", label=t(key="cancel", lang=lang | default(value='sk')), href="/admin/catalog/products?audience=" ~ audience, size="px-3 py-2 text-sm") }}
+</div>
+
+<form method="post" action="/admin/catalog/products/{{ product.id }}/discount?audience={{ audience }}"
+  x-data="{
+    mode: '{{ mode }}',
+    fixed: '{{ fixed }}',
+    percent: '{{ percent }}',
+    regular: {{ product.regular_cents }},
+    num(v) { let n = parseFloat(String(v).replace(',', '.')); return isFinite(n) ? n : null; },
+    get afterCents() {
+      if (this.mode === 'percent') {
+        let p = this.num(this.percent); if (p === null) return null;
+        return this.regular - Math.round(this.regular * p / 100);
+      }
+      let f = this.num(this.fixed); if (f === null) return null;
+      return Math.round(f * 100);
+    },
+    money(c) { return (c / 100).toFixed(2); },
+    get valid() { let a = this.afterCents; return a !== null && a > 0 && a < this.regular; },
+    get percentOff() { let a = this.afterCents; return (a === null || this.regular <= 0) ? null : Math.round((this.regular - a) / this.regular * 100); }
+  }"
+  class="mt-6 max-w-md space-y-5 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+  {{ ui::csrf_field() }}
+
+  {% if error %}
+  {{ ui::alert_danger(message=t(key=error, lang=lang | default(value='sk'))) }}
+  {% endif %}
+
+  <div class="flex items-center justify-between gap-3 rounded-radius bg-surface-alt px-4 py-3 dark:bg-surface-dark/40">
+    <span class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="price", lang=lang | default(value='sk')) }}</span>
+    <span class="font-semibold tabular-nums text-on-surface-strong dark:text-on-surface-dark-strong">{{ product.regular_price }} {{ product.currency }}</span>
+  </div>
+
+  <!-- mode toggle -->
+  <div class="grid grid-cols-2 gap-2">
+    <label class="flex cursor-pointer items-center justify-center gap-2 rounded-radius border px-3 py-2 text-sm transition"
+      :class="mode === 'fixed' ? 'border-primary bg-primary/10 text-on-surface-strong dark:border-primary-dark dark:bg-primary-dark/10 dark:text-on-surface-dark-strong' : 'border-outline text-on-surface dark:border-outline-dark dark:text-on-surface-dark'">
+      <input type="radio" name="mode" value="fixed" x-model="mode" class="sr-only">
+      {{ t(key="discount-mode-fixed", lang=lang | default(value='sk')) }}
+    </label>
+    <label class="flex cursor-pointer items-center justify-center gap-2 rounded-radius border px-3 py-2 text-sm transition"
+      :class="mode === 'percent' ? 'border-primary bg-primary/10 text-on-surface-strong dark:border-primary-dark dark:bg-primary-dark/10 dark:text-on-surface-dark-strong' : 'border-outline text-on-surface dark:border-outline-dark dark:text-on-surface-dark'">
+      <input type="radio" name="mode" value="percent" x-model="mode" class="sr-only">
+      {{ t(key="discount-mode-percent", lang=lang | default(value='sk')) }}
+    </label>
+  </div>
+
+  <!-- fixed price input -->
+  <div class="space-y-1.5" x-show="mode === 'fixed'">
+    <label for="sale_price" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="sale-price", lang=lang | default(value='sk')) }}</label>
+    {{ ui::input(name="sale_price", id="sale_price", value=fixed, placeholder="0.00", attrs='inputmode="decimal" x-model="fixed"') }}
+  </div>
+
+  <!-- percentage input -->
+  <div class="space-y-1.5" x-show="mode === 'percent'">
+    <label for="percent" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="discount-percent", lang=lang | default(value='sk')) }}</label>
+    {{ ui::input(name="percent", id="percent", value=percent, placeholder="0", attrs='inputmode="decimal" min="0" max="100" x-model="percent"') }}
+  </div>
+
+  <!-- live preview -->
+  <div x-show="afterCents !== null" x-cloak
+    class="space-y-2 rounded-radius border border-outline bg-surface-alt px-4 py-3 dark:border-outline-dark dark:bg-surface-dark/40">
+    <div class="flex items-center justify-between gap-3 text-sm">
+      <span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="discount-preview-before", lang=lang | default(value='sk')) }}</span>
+      <span class="tabular-nums text-on-surface/60 line-through dark:text-on-surface-dark/60"><span x-text="money(regular)"></span> {{ product.currency }}</span>
+    </div>
+    <div class="flex items-center justify-between gap-3">
+      <span class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="discount-preview-after", lang=lang | default(value='sk')) }}</span>
+      <span class="text-lg font-semibold tabular-nums" :class="valid ? 'text-danger' : 'text-on-surface/40 dark:text-on-surface-dark/40'">
+        <span x-text="money(afterCents)"></span> {{ product.currency }}
+      </span>
+    </div>
+    <div x-show="valid" class="flex items-center justify-between gap-3 text-xs text-on-surface/60 dark:text-on-surface-dark/60">
+      <span>{{ t(key="discount-preview-save", lang=lang | default(value='sk')) }}</span>
+      <span class="tabular-nums"><span x-text="money(regular - afterCents)"></span> {{ product.currency }} (−<span x-text="percentOff"></span>%)</span>
+    </div>
+    <p x-show="!valid" class="text-xs text-danger">{{ t(key="discount-below-regular", lang=lang | default(value='sk')) }}</p>
+  </div>
+
+  <div class="flex flex-wrap gap-3 pt-2">
+    {{ ui::button(label=t(key="save", lang=lang | default(value='sk')), type="submit", attrs=`onclick="return confirm('` ~ t(key="discount-apply-confirm", lang=lang | default(value='sk')) ~ `')"`) }}
+    {% if has_discount %}
+    {{ ui::button(variant="outline-danger", label=t(key="remove-discount", lang=lang | default(value='sk')), type="submit", attrs=`formaction="/admin/catalog/products/` ~ product.id ~ `/discount/remove?audience=` ~ audience ~ `" onclick="return confirm('` ~ t(key="discount-remove-confirm", lang=lang | default(value='sk')) ~ `')"`) }}
+    {% endif %}
+  </div>
+</form>
+{% endblock content %}

assets/views/admin/catalog/discount_profile_form.html

@@ -0,0 +1,71 @@
+{% extends "admin/base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{% if profile %}{{ t(key="edit-profile", lang=lang | default(value='sk')) }}{% else %}{{ t(key="new-profile", lang=lang | default(value='sk')) }}{% endif %}{% endblock title %}
+{% block crumb %}{{ t(key="admin-discount-profiles", lang=lang | default(value='sk')) }}{% endblock crumb %}
+
+{% block content %}
+<div class="flex items-center justify-between gap-3">
+  <h1 class="text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">
+    {% if profile %}{{ t(key="edit-profile", lang=lang | default(value='sk')) }}{% else %}{{ t(key="new-profile", lang=lang | default(value='sk')) }}{% endif %}
+  </h1>
+  {{ ui::button(variant="outline-secondary", label=t(key="cancel", lang=lang | default(value='sk')), href="/admin/catalog/discount-profiles", size="px-3 py-2 text-sm") }}
+</div>
+
+{% if profile %}{% set v_name = profile.name %}{% set v_percent = profile.percent %}{% set v_scope = profile.scope_type %}
+{% else %}{% set v_name = "" %}{% set v_percent = "" %}{% set v_scope = "include" %}{% endif %}
+
+<form method="post"
+  action="{% if profile %}/admin/catalog/discount-profiles/{{ profile.id }}{% else %}/admin/catalog/discount-profiles{% endif %}"
+  class="mt-6 space-y-5 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+  {{ ui::csrf_field() }}
+
+  {% if error %}{{ ui::alert_danger(message=t(key=error, lang=lang | default(value='sk'))) }}{% endif %}
+
+  <div class="grid gap-5 sm:grid-cols-2">
+    <div class="space-y-1.5">
+      <label for="name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="name", lang=lang | default(value='sk')) }}</label>
+      {{ ui::input(name="name", id="name", required=true, value=v_name) }}
+    </div>
+    <div class="space-y-1.5">
+      <label for="percent" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="discount-percent", lang=lang | default(value='sk')) }}</label>
+      {{ ui::input(name="percent", id="percent", required=true, value=v_percent, placeholder="0", attrs='inputmode="decimal" min="0" max="100"') }}
+    </div>
+  </div>
+
+  <fieldset class="space-y-2">
+    <legend class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="scope", lang=lang | default(value='sk')) }}</legend>
+    <label class="flex items-center gap-2 text-sm text-on-surface dark:text-on-surface-dark">
+      <input type="radio" name="scope_type" value="include" {% if v_scope != "all_except" %}checked{% endif %}>
+      {{ t(key="scope-include-hint", lang=lang | default(value='sk')) }}
+    </label>
+    <label class="flex items-center gap-2 text-sm text-on-surface dark:text-on-surface-dark">
+      <input type="radio" name="scope_type" value="all_except" {% if v_scope == "all_except" %}checked{% endif %}>
+      {{ t(key="scope-all-except-hint", lang=lang | default(value='sk')) }}
+    </label>
+  </fieldset>
+
+  <div class="space-y-1.5">
+    <span class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="products", lang=lang | default(value='sk')) }}</span>
+    <div class="max-h-72 overflow-y-auto rounded-radius border border-outline p-3 dark:border-outline-dark">
+      {% if products | length > 0 %}
+      <div class="grid gap-2 sm:grid-cols-2">
+        {% for product in products %}
+        <label class="flex items-center gap-2 text-sm text-on-surface dark:text-on-surface-dark">
+          <input type="checkbox" name="product_ids" value="{{ product.id }}" {% if product.selected %}checked{% endif %}>
+          {{ product.name }}
+        </label>
+        {% endfor %}
+      </div>
+      {% else %}
+      <p class="text-sm text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="admin-no-products", lang=lang | default(value='sk')) }}</p>
+      {% endif %}
+    </div>
+  </div>
+
+  <div class="flex gap-3 pt-2">
+    {{ ui::button(label=t(key="save", lang=lang | default(value='sk')), type="submit") }}
+    {{ ui::button(variant="outline-secondary", label=t(key="cancel", lang=lang | default(value='sk')), href="/admin/catalog/discount-profiles") }}
+  </div>
+</form>
+{% endblock content %}

assets/views/admin/catalog/discount_profiles.html

@@ -0,0 +1,58 @@
+{% extends "admin/base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="admin-discount-profiles", lang=lang | default(value='sk')) }}{% endblock title %}
+{% block crumb %}{{ t(key="admin-discount-profiles", lang=lang | default(value='sk')) }}{% endblock crumb %}
+
+{% block content %}
+<div class="flex flex-wrap items-end justify-between gap-3">
+  <div>
+    <h1 class="text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="admin-discount-profiles", lang=lang | default(value='sk')) }}</h1>
+    <p class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="admin-discount-profiles-desc", lang=lang | default(value='sk')) }}</p>
+  </div>
+  {{ ui::button(label=t(key="new-profile", lang=lang | default(value='sk')), href="/admin/catalog/discount-profiles/new") }}
+</div>
+
+<div class="mt-6 {{ ui::table_wrap_cls() }}">
+  {% if profiles | length > 0 %}
+  <table class="{{ ui::table_cls() }}">
+    <thead class="{{ ui::thead_cls() }}">
+      <tr>
+        {{ ui::th(label=t(key="name", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="discount-percent", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="scope", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="products", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="actions", lang=lang | default(value='sk')), align="text-right") }}
+      </tr>
+    </thead>
+    <tbody class="{{ ui::tbody_cls() }}">
+      {% for profile in profiles %}
+      <tr class="{{ ui::row_cls() }}">
+        <td class="px-4 py-3 font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ profile.name }}</td>
+        <td class="px-4 py-3 tabular-nums">−{{ profile.percent }}%</td>
+        <td class="px-4 py-3">
+          {% if profile.scope_type == "all_except" %}{{ t(key="scope-all-except", lang=lang | default(value='sk')) }}{% else %}{{ t(key="scope-include", lang=lang | default(value='sk')) }}{% endif %}
+        </td>
+        <td class="px-4 py-3 tabular-nums">{{ profile.product_count }}</td>
+        <td class="px-4 py-3">
+          <div class="flex flex-wrap justify-end gap-2">
+            {{ ui::button(variant="outline-secondary", label=t(key="edit", lang=lang | default(value='sk')), href="/admin/catalog/discount-profiles/" ~ profile.id ~ "/edit", size="px-3 py-1.5 text-xs") }}
+            <form method="post" action="/admin/catalog/discount-profiles/{{ profile.id }}/delete"
+              onsubmit="return confirm('{{ t(key="confirm-delete", lang=lang | default(value='sk')) }}')">
+              {{ ui::csrf_field() }}
+              {{ ui::button(variant="outline-danger", label=t(key="delete", lang=lang | default(value='sk')), type="submit", size="px-3 py-1.5 text-xs") }}
+            </form>
+          </div>
+        </td>
+      </tr>
+      {% endfor %}
+    </tbody>
+  </table>
+  {% else %}
+  <div class="flex flex-col items-center gap-3 px-4 py-16 text-center">
+    <p class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="admin-no-profiles", lang=lang | default(value='sk')) }}</p>
+    {{ ui::button(label=t(key="new-profile", lang=lang | default(value='sk')), href="/admin/catalog/discount-profiles/new") }}
+  </div>
+  {% endif %}
+</div>
+{% endblock content %}

assets/views/admin/catalog/product_form.html

@@ -15,40 +15,97 @@
 <form method="post" enctype="multipart/form-data"
   action="{% if product %}/admin/catalog/products/{{ product.id }}{% else %}/admin/catalog/products{% endif %}"
   class="mt-6 space-y-5 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+  {{ ui::csrf_field() }}
 
   {% if product %}
-    {% set v_name = product.name %}{% set v_price = product.price %}{% set v_currency = product.currency %}{% set v_stock = product.stock %}{% set v_sku = product.sku | default(value="") %}{% set v_slug = product.slug %}{% set v_desc = product.description | default(value="") %}{% set v_pub = product.published %}
+    {% set v_name = product.name %}{% set v_currency = product.currency %}{% set v_desc = product.description | default(value="") %}{% set v_pub = product.published %}
   {% else %}
-    {% set v_name = "" %}{% set v_price = "" %}{% set v_currency = "EUR" %}{% set v_stock = 0 %}{% set v_sku = "" %}{% set v_slug = "" %}{% set v_desc = "" %}{% set v_pub = false %}
+    {% set v_name = "" %}{% set v_currency = "EUR" %}{% set v_desc = "" %}{% set v_pub = false %}
   {% endif %}
+  {% set inp = "w-full rounded-radius border border-outline bg-surface-alt px-3 py-2 text-sm text-on-surface focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary dark:border-outline-dark dark:bg-surface-dark-alt/50 dark:text-on-surface-dark dark:focus-visible:outline-primary-dark" %}
+  {% set sublabel = "text-xs font-medium text-on-surface/70 dark:text-on-surface-dark/70" %}
 
   <div class="space-y-1.5">
     <label for="name" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="name", lang=lang | default(value='sk')) }}</label>
     {{ ui::input(name="name", id="name", required=true, value=v_name) }}
   </div>
 
-  <div class="grid gap-5 sm:grid-cols-2">
-    <div class="space-y-1.5">
-      <label for="price" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="price", lang=lang | default(value='sk')) }}</label>
-      {{ ui::input(name="price", id="price", required=true, value=v_price, placeholder="0.00", attrs='inputmode="decimal"') }}
-    </div>
-    <div class="space-y-1.5">
-      <label for="currency" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="currency", lang=lang | default(value='sk')) }}</label>
-      {{ ui::input(name="currency", id="currency", value=v_currency, attrs='maxlength="3"', extra="uppercase") }}
-    </div>
+  <div class="space-y-1.5 sm:max-w-[10rem]">
+    <label for="currency" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="currency", lang=lang | default(value='sk')) }}</label>
+    {{ ui::input(name="currency", id="currency", value=v_currency, attrs='maxlength="3"', extra="uppercase") }}
   </div>
 
-  <div class="grid gap-5 sm:grid-cols-2">
-    <div class="space-y-1.5">
-      <label for="stock" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="stock", lang=lang | default(value='sk')) }}</label>
-      {{ ui::input(name="stock", id="stock", type="number", value=v_stock, attrs='min="0"') }}
-    </div>
-    <div class="space-y-1.5">
-      <label for="sku" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="sku", lang=lang | default(value='sk')) }}</label>
-      {{ ui::input(name="sku", id="sku", value=v_sku) }}
+  {# --- Variants / options editor ------------------------------------------- #}
+  {# Each product is sold as one or more variants (a free-text label such as     #}
+  {# "10cm x 13cm" or "5ml" plus its own price/stock, optional sku & business    #}
+  {# price). Price and stock are required; the browser blocks save if a row is    #}
+  {# incomplete. Rows are managed client-side; names are indexed (variants[i][…]) #}
+  {# and read back by the controller.                                             #}
+  {% set opt = " (" ~ t(key="optional", lang=lang | default(value='sk')) ~ ")" %}
+  <script id="variants-data" type="application/json">{{ variants | json_encode() | safe }}</script>
+  <div class="space-y-3" x-data="variantEditor(JSON.parse(document.getElementById('variants-data').textContent))">
+    <div class="flex items-center justify-between">
+      <span class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="variants-options", lang=lang | default(value='sk')) }}</span>
+      <button type="button" @click="add()"
+        class="rounded-radius border border-outline px-3 py-1.5 text-sm font-medium text-on-surface hover:bg-surface-alt dark:border-outline-dark dark:text-on-surface-dark dark:hover:bg-surface-dark-alt/50">
+        + {{ t(key="add-option", lang=lang | default(value='sk')) }}
+      </button>
     </div>
+
+    <template x-for="(row, i) in rows" :key="i">
+      <div class="flex items-end gap-3 rounded-radius border border-outline bg-surface-alt/40 p-3 dark:border-outline-dark dark:bg-surface-dark-alt/30">
+        <input type="hidden" :name="`variants[${i}][id]`" :value="row.id">
+
+        {# items-end bottom-aligns every input regardless of how many lines each
+           label takes, so the row stays aligned even with the "(optional)" notes. #}
+        <div class="grid flex-1 grid-cols-2 gap-3 sm:grid-cols-12 sm:items-end">
+          <div class="space-y-1 col-span-2 sm:col-span-4">
+            <label class="{{ sublabel }} block truncate">{{ t(key="option-label", lang=lang | default(value='sk')) }}{{ opt }}</label>
+            <input :name="`variants[${i}][label]`" x-model="row.label" class="{{ inp }}" placeholder="napr. 10cm x 13cm">
+          </div>
+          <div class="space-y-1 sm:col-span-2">
+            <label class="{{ sublabel }} block truncate">{{ t(key="sku", lang=lang | default(value='sk')) }}{{ opt }}</label>
+            <input :name="`variants[${i}][sku]`" x-model="row.sku" class="{{ inp }}">
+          </div>
+          <div class="space-y-1 sm:col-span-2">
+            <label class="{{ sublabel }} block truncate">{{ t(key="stock", lang=lang | default(value='sk')) }}</label>
+            <input type="number" min="0" required :name="`variants[${i}][stock]`" x-model="row.stock" class="{{ inp }}">
+          </div>
+          <div class="space-y-1 sm:col-span-2">
+            <label class="{{ sublabel }} block truncate">{{ t(key="price", lang=lang | default(value='sk')) }}</label>
+            <input :name="`variants[${i}][price]`" x-model="row.price" inputmode="decimal" required class="{{ inp }}" placeholder="0.00">
+          </div>
+          <div class="space-y-1 sm:col-span-2">
+            <label class="{{ sublabel }} block truncate">{{ t(key="business-price", lang=lang | default(value='sk')) }}{{ opt }}</label>
+            <input :name="`variants[${i}][business_sale]`" x-model="row.business_sale" inputmode="decimal" class="{{ inp }}" placeholder="—">
+          </div>
+        </div>
+
+        <button type="button" @click="remove(i)"
+          class="mb-1 shrink-0 rounded-radius px-2 py-2 text-sm text-danger hover:bg-danger/10" title="{{ t(key='delete', lang=lang | default(value='sk')) }}">✕</button>
+      </div>
+    </template>
   </div>
 
+  <script>
+    function variantEditor(initial) {
+      const blank = () => ({ id: '', label: '', sku: '', stock: '', price: '', business_sale: '' });
+      return {
+        rows: (initial || []).map(r => ({
+          id: r.id || '',
+          label: r.label || '',
+          sku: r.sku || '',
+          stock: (r.stock === null || r.stock === undefined) ? '' : r.stock,
+          price: r.price || '',
+          business_sale: r.business_sale || '',
+        })),
+        init() { if (this.rows.length === 0) this.add(); },
+        add() { this.rows.push(blank()); },
+        remove(i) { this.rows.splice(i, 1); if (this.rows.length === 0) this.add(); },
+      };
+    }
+  </script>
+
   <div class="space-y-1.5">
     <label for="category_id" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="category", lang=lang | default(value='sk')) }}</label>
     <div class="relative">
@@ -63,11 +120,6 @@
     </div>
   </div>
 
-  <div class="space-y-1.5">
-    <label for="slug" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="slug", lang=lang | default(value='sk')) }}</label>
-    {{ ui::input(name="slug", id="slug", value=v_slug, placeholder=t(key='slug-auto', lang=lang | default(value='sk'))) }}
-  </div>
-
   <div class="space-y-1.5">
     <label for="description" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="description", lang=lang | default(value='sk')) }}</label>
     {{ ui::textarea(name="description", id="description", rows="5", value=v_desc) }}

assets/views/admin/catalog/products.html

@@ -3,8 +3,10 @@
 
 {% block title %}{{ t(key="admin-products", lang=lang | default(value='sk')) }}{% endblock title %}
 {% block crumb %}{{ t(key="admin-products", lang=lang | default(value='sk')) }}{% endblock crumb %}
+{% block main_class %}max-w-none{% endblock main_class %}
 
 {% block content %}
+{% set business = audience == "business" %}
 <div class="flex flex-wrap items-end justify-between gap-3">
   <div>
     <h1 class="text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="admin-products", lang=lang | default(value='sk')) }}</h1>
@@ -13,13 +15,76 @@
   {{ ui::button(label=t(key="new-product", lang=lang | default(value='sk')), href="/admin/catalog/products/new") }}
 </div>
 
-<div class="mt-6 {{ ui::table_wrap_cls() }}">
+<!-- audience tabs -->
+<div class="mt-4 inline-flex rounded-radius border border-outline p-1 dark:border-outline-dark">
+  <a href="/admin/catalog/products?audience=personal"
+    class="rounded-radius px-4 py-1.5 text-sm font-medium {% if not business %}bg-primary/10 text-on-surface-strong dark:bg-primary-dark/10 dark:text-on-surface-dark-strong{% else %}text-on-surface/70 dark:text-on-surface-dark/70{% endif %}">
+    {{ t(key="audience-personal", lang=lang | default(value='sk')) }}
+  </a>
+  <a href="/admin/catalog/products?audience=business"
+    class="rounded-radius px-4 py-1.5 text-sm font-medium {% if business %}bg-primary/10 text-on-surface-strong dark:bg-primary-dark/10 dark:text-on-surface-dark-strong{% else %}text-on-surface/70 dark:text-on-surface-dark/70{% endif %}">
+    {{ t(key="audience-business", lang=lang | default(value='sk')) }}
+  </a>
+</div>
+
+{% set category_base = "/admin/catalog/products" %}
+{% set category_suffix = "&audience=" ~ audience %}
+<div class="mt-4 flex flex-col gap-6 md:flex-row md:items-start">
+  {% include "admin/partials/category_filter.html" %}
+
+  <!-- discount profiles applied to this audience -->
+  <section class="min-w-0 flex-1 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+  <h2 class="text-lg font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="discount-profiles", lang=lang | default(value='sk')) }}</h2>
+  <p class="mt-1 text-sm text-on-surface/70 dark:text-on-surface-dark/70">
+    {% if business %}{{ t(key="apply-profiles-business-hint", lang=lang | default(value='sk')) }}{% else %}{{ t(key="apply-profiles-personal-hint", lang=lang | default(value='sk')) }}{% endif %}
+  </p>
+  {% if profiles | length > 0 %}
+  <form method="post" action="/admin/catalog/products/profiles?audience={{ audience }}" class="mt-3 space-y-3"
+    hx-post="/admin/catalog/products/profiles/preview?audience={{ audience }}&category={{ selected_category }}"
+    hx-trigger="change"
+    hx-swap="none"
+    x-data="{
+      orig: { {% for p in profiles %}'{{ p.id }}': {% if p.assigned %}true{% else %}false{% endif %}{% if not loop.last %}, {% endif %}{% endfor %} },
+      sel: { {% for p in profiles %}'{{ p.id }}': {% if p.assigned %}true{% else %}false{% endif %}{% if not loop.last %}, {% endif %}{% endfor %} },
+      get changed() { return Object.keys(this.orig).some(k => this.orig[k] !== this.sel[k]) }
+    }"
+    onsubmit="return confirm('{{ t(key="discount-apply-confirm", lang=lang | default(value='sk')) }}')">
+    {{ ui::csrf_field() }}
+    <div class="grid gap-2 sm:grid-cols-2">
+      {% for profile in profiles %}
+      <label class="flex items-center gap-2 text-sm text-on-surface dark:text-on-surface-dark">
+        <input type="checkbox" name="profile_ids" value="{{ profile.id }}" x-model="sel['{{ profile.id }}']" {% if profile.assigned %}checked{% endif %}>
+        <span>{{ profile.name }} <span class="text-on-surface/60 dark:text-on-surface-dark/60">(−{{ profile.percent }}%, {% if profile.scope_type == "all_except" %}{{ t(key="scope-all-except", lang=lang | default(value='sk')) }}{% else %}{{ t(key="scope-include", lang=lang | default(value='sk')) }}{% endif %})</span></span>
+        <span x-cloak x-show="sel['{{ profile.id }}'] && orig['{{ profile.id }}']" class="inline-flex items-center rounded-radius border border-success px-1.5 py-0.5 text-xs font-medium text-success">{{ t(key="profile-applied", lang=lang | default(value='sk')) }}</span>
+        <span x-cloak x-show="sel['{{ profile.id }}'] && !orig['{{ profile.id }}']" class="inline-flex items-center rounded-radius border border-primary px-1.5 py-0.5 text-xs font-medium text-primary dark:border-primary-dark dark:text-primary-dark">{{ t(key="profile-will-apply", lang=lang | default(value='sk')) }}</span>
+        <span x-cloak x-show="!sel['{{ profile.id }}'] && orig['{{ profile.id }}']" class="inline-flex items-center rounded-radius border border-warning px-1.5 py-0.5 text-xs font-medium text-warning">{{ t(key="profile-will-remove", lang=lang | default(value='sk')) }}</span>
+      </label>
+      {% endfor %}
+    </div>
+    <div class="flex items-center gap-3">
+      {{ ui::button(label=t(key="save", lang=lang | default(value='sk')), type="submit", size="px-4 py-2 text-sm", attrs='x-bind:disabled="!changed"') }}
+      <span x-cloak x-show="changed" class="text-xs font-medium text-warning">{{ t(key="profiles-unsaved", lang=lang | default(value='sk')) }}</span>
+      <span x-cloak x-show="!changed" class="text-xs text-on-surface/50 dark:text-on-surface-dark/50">{{ t(key="profiles-no-changes", lang=lang | default(value='sk')) }}</span>
+    </div>
+  </form>
+  {% else %}
+  <p class="mt-2 text-sm text-on-surface/70 dark:text-on-surface-dark/70">
+    {{ t(key="admin-no-profiles", lang=lang | default(value='sk')) }}
+    <a href="/admin/catalog/discount-profiles/new" class="text-primary dark:text-primary-dark">{{ t(key="new-profile", lang=lang | default(value='sk')) }}</a>
+  </p>
+  {% endif %}
+  </section>
+</div>
+
+<div class="mt-4 {{ ui::table_wrap_cls() }}">
   {% if products | length > 0 %}
   <table class="{{ ui::table_cls() }}">
     <thead class="{{ ui::thead_cls() }}">
       <tr>
         {{ ui::th(label=t(key="product", lang=lang | default(value='sk'))) }}
         {{ ui::th(label=t(key="price", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="variants-options", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="effective-price", lang=lang | default(value='sk'))) }}
         {{ ui::th(label=t(key="stock", lang=lang | default(value='sk'))) }}
         {{ ui::th(label=t(key="status", lang=lang | default(value='sk'))) }}
         {{ ui::th(label=t(key="actions", lang=lang | default(value='sk')), align="text-right") }}
@@ -41,7 +106,11 @@
             </div>
           </div>
         </td>
-        <td class="px-4 py-3 tabular-nums">{{ product.price }} {{ product.currency }}</td>
+        <td class="px-4 py-3 tabular-nums">{% if product.has_options %}{{ t(key="from-price", price=product.regular_price, lang=lang | default(value='sk')) }}{% else %}{{ product.regular_price }}{% endif %} {{ product.currency }}</td>
+        <td class="px-4 py-3 tabular-nums">{{ product.variant_count }}</td>
+        <td class="px-4 py-3 tabular-nums">
+          <span id="eff-{{ product.id }}">{{ ui::eff_price(p=product) }}</span>
+        </td>
         <td class="px-4 py-3 tabular-nums">{{ product.stock }}</td>
         <td class="px-4 py-3">
           {% if product.published %}
@@ -56,6 +125,7 @@
             {{ ui::button(variant="outline-secondary", label=t(key="view", lang=lang | default(value='sk')), href="/shop/" ~ product.slug, size="px-3 py-1.5 text-xs") }}
             <form method="post" action="/admin/catalog/products/{{ product.id }}/delete"
               onsubmit="return confirm('{{ t(key="confirm-delete", lang=lang | default(value='sk')) }}')">
+              {{ ui::csrf_field() }}
               {{ ui::button(variant="outline-danger", label=t(key="delete", lang=lang | default(value='sk')), type="submit", size="px-3 py-1.5 text-xs") }}
             </form>
           </div>

assets/views/admin/customers/index.html

@@ -0,0 +1,45 @@
+{% extends "admin/base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="admin-customers", lang=lang | default(value='sk')) }}{% endblock title %}
+{% block crumb %}{{ t(key="admin-customers", lang=lang | default(value='sk')) }}{% endblock crumb %}
+
+{% block content %}
+<div class="flex flex-wrap items-end justify-between gap-3">
+  <div>
+    <h1 class="text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="admin-customers", lang=lang | default(value='sk')) }}</h1>
+    <p class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="admin-customers-desc", lang=lang | default(value='sk')) }}</p>
+  </div>
+</div>
+
+<div class="mt-6 {{ ui::table_wrap_cls() }}">
+  {% if customers | length > 0 %}
+  <table class="{{ ui::table_cls() }}">
+    <thead class="{{ ui::thead_cls() }}">
+      <tr>
+        {{ ui::th(label=t(key="name", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="email", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="negotiated-prices", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="actions", lang=lang | default(value='sk')), align="text-right") }}
+      </tr>
+    </thead>
+    <tbody class="{{ ui::tbody_cls() }}">
+      {% for customer in customers %}
+      <tr class="{{ ui::row_cls() }}">
+        <td class="px-4 py-3 font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ customer.name }}</td>
+        <td class="px-4 py-3 text-on-surface/70 dark:text-on-surface-dark/70">{{ customer.email }}</td>
+        <td class="px-4 py-3 tabular-nums">{{ customer.negotiated_count }}</td>
+        <td class="px-4 py-3 text-right">
+          {{ ui::button(variant="outline-secondary", label=t(key="manage-prices", lang=lang | default(value='sk')), href="/admin/customers/" ~ customer.id, size="px-3 py-1.5 text-xs") }}
+        </td>
+      </tr>
+      {% endfor %}
+    </tbody>
+  </table>
+  {% else %}
+  <div class="flex flex-col items-center gap-3 px-4 py-16 text-center">
+    <p class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="admin-no-customers", lang=lang | default(value='sk')) }}</p>
+  </div>
+  {% endif %}
+</div>
+{% endblock content %}

assets/views/admin/customers/price_form.html

@@ -0,0 +1,97 @@
+{% extends "admin/base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="set-negotiated-price", lang=lang | default(value='sk')) }}{% endblock title %}
+{% block crumb %}{{ t(key="admin-customers", lang=lang | default(value='sk')) }}{% endblock crumb %}
+
+{% block content %}
+<div class="flex items-center justify-between gap-3">
+  <div>
+    <div class="flex items-center gap-2">
+      <h1 class="text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ product.name }}{% if product.variant_label %} <span class="text-on-surface/60 dark:text-on-surface-dark/60">· {{ product.variant_label }}</span>{% endif %}</h1>
+      {{ ui::badge(label=t(key="negotiated-price", lang=lang | default(value='sk')), variant="info") }}
+    </div>
+    <p class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ customer.name }}</p>
+  </div>
+  {{ ui::button(variant="outline-secondary", label=t(key="back", lang=lang | default(value='sk')), href="/admin/customers/" ~ customer.id, size="px-3 py-2 text-sm") }}
+</div>
+
+{% if error %}
+<div class="mt-4 max-w-md">{{ ui::alert_danger(message=t(key=error, lang=lang | default(value='sk'))) }}</div>
+{% endif %}
+
+<form method="post" action="/admin/customers/{{ customer.id }}/prices/{{ product.variant_id }}"
+  x-data="{
+    price: '{{ negotiated }}',
+    regular: {{ product.regular_cents }},
+    num(v) { let n = parseFloat(String(v).replace(',', '.')); return isFinite(n) ? n : null; },
+    get afterCents() { let f = this.num(this.price); return f === null ? null : Math.round(f * 100); },
+    money(c) { return (c / 100).toFixed(2); },
+    get valid() { let a = this.afterCents; return a !== null && a > 0; }
+  }"
+  class="mt-6 max-w-md space-y-5 rounded-radius border-2 border-secondary/60 bg-surface p-6 dark:border-secondary-dark/60 dark:bg-surface-dark-alt">
+  {{ ui::csrf_field() }}
+
+  <p class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="negotiated-price-hint", lang=lang | default(value='sk')) }}</p>
+
+  <!-- reference prices -->
+  <div class="space-y-2 rounded-radius bg-surface-alt px-4 py-3 dark:bg-surface-dark/40">
+    <div class="flex items-center justify-between gap-3 text-sm">
+      <span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="price", lang=lang | default(value='sk')) }}</span>
+      <span class="tabular-nums text-on-surface-strong dark:text-on-surface-dark-strong">{{ product.regular_price }} {{ product.currency }}</span>
+    </div>
+    <div class="flex items-center justify-between gap-3 text-sm">
+      <span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="business-price", lang=lang | default(value='sk')) }}</span>
+      <span class="tabular-nums {% if product.business_reduced %}font-medium text-danger{% else %}text-on-surface-strong dark:text-on-surface-dark-strong{% endif %}">{{ product.business_price }} {{ product.currency }}</span>
+    </div>
+    <div class="flex items-center justify-between gap-3 text-sm">
+      <span class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="effective-price", lang=lang | default(value='sk')) }}</span>
+      <span class="tabular-nums font-medium {% if product.effective_differs %}text-primary dark:text-primary-dark{% else %}text-on-surface-strong dark:text-on-surface-dark-strong{% endif %}">{{ product.effective_price }} {{ product.currency }}</span>
+    </div>
+  </div>
+
+  <!-- negotiated price input -->
+  <div class="space-y-1.5">
+    <label for="price" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="negotiated-price", lang=lang | default(value='sk')) }}</label>
+    {{ ui::input(name="price", id="price", value=negotiated, placeholder="0.00", attrs='inputmode="decimal" x-model="price"') }}
+  </div>
+
+  <!-- live preview -->
+  <div x-show="afterCents !== null" x-cloak
+    class="space-y-2 rounded-radius border border-outline bg-surface-alt px-4 py-3 dark:border-outline-dark dark:bg-surface-dark/40">
+    <div class="flex items-center justify-between gap-3">
+      <span class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="negotiated-price", lang=lang | default(value='sk')) }}</span>
+      <span class="text-lg font-semibold tabular-nums" :class="valid ? 'text-secondary dark:text-secondary-dark' : 'text-on-surface/40 dark:text-on-surface-dark/40'">
+        <span x-text="money(afterCents)"></span> {{ product.currency }}
+      </span>
+    </div>
+    <p x-show="!valid" class="text-xs text-danger">{{ t(key="discount-must-be-positive", lang=lang | default(value='sk')) }}</p>
+  </div>
+
+  <div class="flex flex-wrap gap-3 pt-2">
+    {{ ui::button(variant="secondary", label=t(key="save", lang=lang | default(value='sk')), type="submit") }}
+    {% if has_negotiated %}
+    {{ ui::button(variant="outline-danger", label=t(key="remove", lang=lang | default(value='sk')), type="submit", attrs=`formaction="/admin/customers/` ~ customer.id ~ `/prices/` ~ product.variant_id ~ `/remove" onclick="return confirm('` ~ t(key="negotiated-remove-confirm", lang=lang | default(value='sk')) ~ `')"`) }}
+    {% endif %}
+  </div>
+</form>
+
+{% if collision %}
+<!-- collision resolution: two assigned profiles cover this product -->
+<section class="mt-4 max-w-md rounded-radius border border-warning/60 bg-surface p-6 dark:bg-surface-dark-alt">
+  <div class="flex items-center gap-2">
+    <h2 class="text-lg font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="automated-price", lang=lang | default(value='sk')) }}</h2>
+    {{ ui::badge(label=t(key="collision", lang=lang | default(value='sk')), variant="warning") }}
+  </div>
+  <form method="post" action="/admin/customers/{{ customer.id }}/resolutions/{{ product.variant_id }}" class="mt-3 flex items-center gap-2">
+    {{ ui::csrf_field() }}
+    <select name="profile_id" class="rounded-radius border border-outline bg-surface-alt px-2 py-1.5 text-sm dark:border-outline-dark dark:bg-surface-dark-alt/50 dark:text-on-surface-dark">
+      {% for c in covering %}
+      <option value="{{ c.id }}" {% if c.id == auto_profile_id %}selected{% endif %}>{{ c.name }}</option>
+      {% endfor %}
+    </select>
+    {{ ui::button(label=t(key="resolve", lang=lang | default(value='sk')), type="submit", size="px-3 py-1.5 text-sm") }}
+  </form>
+</section>
+{% endif %}
+{% endblock content %}

assets/views/admin/customers/show.html

@@ -0,0 +1,103 @@
+{% extends "admin/base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ customer.name }}{% endblock title %}
+{% block crumb %}{{ t(key="admin-customers", lang=lang | default(value='sk')) }}{% endblock crumb %}
+
+{% block content %}
+<div class="flex items-center justify-between gap-3">
+  <div>
+    <h1 class="text-2xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ customer.name }}</h1>
+    <p class="text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ customer.email }}</p>
+  </div>
+  {{ ui::button(variant="outline-secondary", label=t(key="back", lang=lang | default(value='sk')), href="/admin/customers", size="px-3 py-2 text-sm") }}
+</div>
+
+{% if error %}
+<div class="mt-4">{{ ui::alert_danger(message=t(key=error, lang=lang | default(value='sk'))) }}</div>
+{% endif %}
+
+<!-- assigned discount profiles -->
+<section class="mt-6 rounded-radius border border-outline bg-surface p-6 dark:border-outline-dark dark:bg-surface-dark-alt">
+  <h2 class="text-lg font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="discount-profiles", lang=lang | default(value='sk')) }}</h2>
+  {% if profiles | length > 0 %}
+  <form method="post" action="/admin/customers/{{ customer.id }}/profiles" class="mt-3 space-y-3">
+    {{ ui::csrf_field() }}
+    <div class="grid gap-2 sm:grid-cols-2">
+      {% for profile in profiles %}
+      <label class="flex items-center gap-2 text-sm text-on-surface dark:text-on-surface-dark">
+        <input type="checkbox" name="profile_ids" value="{{ profile.id }}" {% if profile.assigned %}checked{% endif %}>
+        <span>{{ profile.name }} <span class="text-on-surface/60 dark:text-on-surface-dark/60">(−{{ profile.percent }}%, {% if profile.scope_type == "all_except" %}{{ t(key="scope-all-except", lang=lang | default(value='sk')) }}{% else %}{{ t(key="scope-include", lang=lang | default(value='sk')) }}{% endif %})</span></span>
+      </label>
+      {% endfor %}
+    </div>
+    {{ ui::button(label=t(key="save", lang=lang | default(value='sk')), type="submit", size="px-4 py-2 text-sm") }}
+  </form>
+  {% else %}
+  <p class="mt-2 text-sm text-on-surface/70 dark:text-on-surface-dark/70">
+    {{ t(key="admin-no-profiles", lang=lang | default(value='sk')) }}
+    <a href="/admin/catalog/discount-profiles/new" class="text-primary dark:text-primary-dark">{{ t(key="new-profile", lang=lang | default(value='sk')) }}</a>
+  </p>
+  {% endif %}
+</section>
+
+<p class="mt-6 text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="negotiated-prices-hint", lang=lang | default(value='sk')) }}</p>
+
+{% set category_base = "/admin/customers/" ~ customer.id %}
+{% set category_suffix = "" %}
+<div class="mt-3 flex flex-col gap-6 md:flex-row md:items-start">
+  {% include "admin/partials/category_filter.html" %}
+  <div class="min-w-0 flex-1 {{ ui::table_wrap_cls() }}">
+  {% if products | length > 0 %}
+  <table class="{{ ui::table_cls() }}">
+    <thead class="{{ ui::thead_cls() }}">
+      <tr>
+        {{ ui::th(label=t(key="product", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="business-price", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="effective-price", lang=lang | default(value='sk'))) }}
+        {{ ui::th(label=t(key="actions", lang=lang | default(value='sk')), align="text-right") }}
+      </tr>
+    </thead>
+    <tbody class="{{ ui::tbody_cls() }}">
+      {% for product in products %}
+      <tr class="{{ ui::row_cls() }}">
+        <td class="px-4 py-3 font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
+          {{ product.name }}
+          {% if product.variant_label %}<span class="block text-xs font-normal text-on-surface/60 dark:text-on-surface-dark/60">{{ product.variant_label }}</span>{% endif %}
+        </td>
+        <td class="px-4 py-3 tabular-nums">
+          {% if product.business_reduced %}
+          <span class="font-medium text-danger">{{ product.business_price }} {{ product.currency }}</span>
+          <span class="ml-1 text-xs text-on-surface/50 line-through dark:text-on-surface-dark/50">{{ product.regular_price }}</span>
+          {% else %}
+          {{ product.business_price }} {{ product.currency }}
+          {% endif %}
+        </td>
+        <td class="px-4 py-3 tabular-nums">
+          <span class="font-medium {% if product.effective_differs %}text-primary dark:text-primary-dark{% else %}text-on-surface-strong dark:text-on-surface-dark-strong{% endif %}">{{ product.effective_price }} {{ product.currency }}</span>
+          {% if product.collision %}<span class="ml-1">{{ ui::badge(label=t(key="collision", lang=lang | default(value='sk')), variant="warning") }}</span>{% endif %}
+        </td>
+        <td class="px-4 py-3">
+          <div class="flex flex-wrap justify-end gap-2">
+            {{ ui::button(variant="outline-secondary", label=t(key="set-negotiated-price", lang=lang | default(value='sk')), href="/admin/customers/" ~ customer.id ~ "/prices/" ~ product.variant_id ~ "/edit", size="px-3 py-1.5 text-xs") }}
+            {% if product.has_negotiated %}
+            <form method="post" action="/admin/customers/{{ customer.id }}/prices/{{ product.variant_id }}/remove"
+              onsubmit="return confirm('{{ t(key="negotiated-remove-confirm", lang=lang | default(value='sk')) }}')">
+              {{ ui::csrf_field() }}
+              {{ ui::button(variant="outline-danger", label=t(key="remove", lang=lang | default(value='sk')), type="submit", size="px-3 py-1.5 text-xs") }}
+            </form>
+            {% endif %}
+          </div>
+        </td>
+      </tr>
+      {% endfor %}
+    </tbody>
+  </table>
+  {% else %}
+  <div class="flex flex-col items-center gap-3 px-4 py-16 text-center">
+    <p class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="admin-no-products", lang=lang | default(value='sk')) }}</p>
+  </div>
+  {% endif %}
+  </div>
+</div>
+{% endblock content %}

assets/views/admin/orders/show.html

@@ -36,7 +36,7 @@
         <tbody class="{{ ui::tbody_cls() }}">
           {% for item in items %}
           <tr>
-            <td class="px-4 py-3">{{ item.product_name }}</td>
+            <td class="px-4 py-3">{{ item.product_name }}{% if item.variant_label %} <span class="text-on-surface/60 dark:text-on-surface-dark/60">· {{ item.variant_label }}</span>{% endif %}</td>
             <td class="px-4 py-3 tabular-nums">{{ item.quantity }}</td>
             <td class="px-4 py-3 text-right tabular-nums">{{ item.line_total }} {{ order.currency }}</td>
           </tr>
@@ -110,6 +110,7 @@
       <p class="text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="order-send-hint", lang=lang | default(value='sk')) }}</p>
       <form method="post" action="/admin/orders/{{ order.id }}/ship"
         onsubmit="return confirm('{{ t(key="order-send-confirm", lang=lang | default(value='sk')) }}')">
+  {{ ui::csrf_field() }}
         {% set carrier_up = carrier | upper %}
         {% set ship_label = t(key="order-send-to-carrier", lang=lang | default(value='sk')) ~ " " ~ carrier_up %}
         {{ ui::button(label=ship_label, type="submit", extra="w-full") }}
@@ -118,6 +119,7 @@
     </div>
 
     <form method="post" action="/admin/orders/{{ order.id }}/status" class="space-y-3 rounded-radius border border-outline bg-surface p-5 dark:border-outline-dark dark:bg-surface-dark-alt">
+  {{ ui::csrf_field() }}
       <label for="status" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="order-status", lang=lang | default(value='sk')) }}</label>
       <div class="relative">
         <select id="status" name="status"

assets/views/admin/partials/category_filter.html

@@ -0,0 +1,75 @@
+{# Category-filter sidebar for admin product listings. Clicking a category
+   reloads the page with `?category=<id>` so the table server-side filters to
+   that category and its descendants. Expects in context:
+   - category_groups: [{ id, name, count, children: [{ id, name, count }] }]
+     (from views::shop::admin_category_groups)
+   - selected_category: "all" | "none" | "<id>" — the active filter
+   - total_count, uncategorized_count: ints
+   - category_base: page path, e.g. "/admin/catalog/products"
+   - category_suffix: extra query appended after the category param, e.g.
+     "&audience=business", or "" — set by the including template.
+
+   The link treatment mirrors shop/_sidebar.html (Penguin UI), but active state
+   is server-driven via aria-current (these links share a path, differing only
+   by query, so markActiveNav() can't pick the active one — hence no data-nav).
+   Numeric compare uses `| int(default=0)` because Tera string==number is false. #}
+{% set sel = selected_category | int(default=0) %}
+{% set link_cls = "flex flex-1 items-center gap-2 truncate rounded-radius px-2 py-1.5 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-on-surface-strong focus:outline-hidden focus-visible:underline aria-[current=page]:bg-primary/10 aria-[current=page]:text-on-surface-strong dark:text-on-surface-dark dark:hover:bg-primary-dark/5 dark:hover:text-on-surface-dark-strong dark:aria-[current=page]:bg-primary-dark/10 dark:aria-[current=page]:text-on-surface-dark-strong" %}
+<aside class="w-full shrink-0 md:w-56">
+  <p class="px-2 pb-2 text-xs font-semibold uppercase tracking-wide text-on-surface/60 dark:text-on-surface-dark/60">
+    {{ t(key="categories", lang=lang | default(value='sk')) }}
+  </p>
+  <div class="flex flex-col gap-1">
+    <a href="{{ category_base }}?category=all{{ category_suffix }}"
+      {% if selected_category == "all" %}aria-current="page"{% endif %} class="{{ link_cls }}">
+      <span class="flex-1 truncate">{{ t(key="all-products", lang=lang | default(value='sk')) }}</span>
+      <span class="text-xs text-on-surface/50 dark:text-on-surface-dark/50">{{ total_count }}</span>
+    </a>
+    {% for group in category_groups %}
+    {% set open_group = sel == group.id %}
+    {% for child in group.children %}{% if sel == child.id %}{% set_global open_group = true %}{% endif %}{% endfor %}
+    {% if group.children | length > 0 %}
+    <div x-data="{ open: {% if open_group %}true{% else %}false{% endif %} }" class="flex flex-col">
+      <div class="flex items-stretch">
+        <a href="{{ category_base }}?category={{ group.id }}{{ category_suffix }}"
+          {% if sel == group.id %}aria-current="page"{% endif %} class="{{ link_cls }} rounded-l-radius">
+          <span class="flex-1 truncate">{{ group.name }}</span>
+          <span class="text-xs text-on-surface/50 dark:text-on-surface-dark/50">{{ group.count }}</span>
+        </a>
+        <button type="button" x-on:click="open = ! open" x-bind:aria-expanded="open ? 'true' : 'false'"
+          aria-label="{{ group.name }}"
+          class="inline-flex w-8 shrink-0 items-center justify-center rounded-r-radius text-on-surface/60 transition hover:bg-primary/5 hover:text-on-surface-strong focus:outline-hidden focus-visible:underline dark:text-on-surface-dark/60 dark:hover:bg-primary-dark/5 dark:hover:text-on-surface-dark-strong">
+          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor"
+            class="size-5 shrink-0 transition-transform rotate-0" x-bind:class="open ? 'rotate-180' : 'rotate-0'" aria-hidden="true">
+            <path fill-rule="evenodd" d="M5.22 8.22a.75.75 0 0 1 1.06 0L10 11.94l3.72-3.72a.75.75 0 1 1 1.06 1.06l-4.25 4.25a.75.75 0 0 1-1.06 0L5.22 9.28a.75.75 0 0 1 0-1.06Z" clip-rule="evenodd" />
+          </svg>
+        </button>
+      </div>
+      <ul x-show="open" x-cloak x-transition class="ml-3 mt-0.5 flex flex-col gap-0.5 border-l border-outline pl-1 dark:border-outline-dark">
+        {% for child in group.children %}
+        <li class="flex">
+          <a href="{{ category_base }}?category={{ child.id }}{{ category_suffix }}"
+            {% if sel == child.id %}aria-current="page"{% endif %}
+            class="flex flex-1 items-center gap-2 truncate rounded-radius px-2 py-1.5 text-sm text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-on-surface-strong focus:outline-hidden focus-visible:underline aria-[current=page]:bg-primary/10 aria-[current=page]:text-on-surface-strong dark:text-on-surface-dark dark:hover:bg-primary-dark/5 dark:hover:text-on-surface-dark-strong dark:aria-[current=page]:bg-primary-dark/10 dark:aria-[current=page]:text-on-surface-dark-strong">
+            <span class="flex-1 truncate">{{ child.name }}</span>
+            <span class="text-xs text-on-surface/50 dark:text-on-surface-dark/50">{{ child.count }}</span>
+          </a>
+        </li>
+        {% endfor %}
+      </ul>
+    </div>
+    {% else %}
+    <a href="{{ category_base }}?category={{ group.id }}{{ category_suffix }}"
+      {% if sel == group.id %}aria-current="page"{% endif %} class="{{ link_cls }}">
+      <span class="flex-1 truncate">{{ group.name }}</span>
+      <span class="text-xs text-on-surface/50 dark:text-on-surface-dark/50">{{ group.count }}</span>
+    </a>
+    {% endif %}
+    {% endfor %}
+    <a href="{{ category_base }}?category=none{{ category_suffix }}"
+      {% if selected_category == "none" %}aria-current="page"{% endif %} class="{{ link_cls }}">
+      <span class="flex-1 truncate">{{ t(key="uncategorized", lang=lang | default(value='sk')) }}</span>
+      <span class="text-xs text-on-surface/50 dark:text-on-surface-dark/50">{{ uncategorized_count }}</span>
+    </a>
+  </div>
+</aside>

assets/views/admin/shipping/index.html

@@ -14,6 +14,7 @@
   {% for method in methods %}
   <form method="post" action="/admin/shipping/{{ method.id }}"
     class="flex flex-wrap items-end gap-4 rounded-radius border border-outline bg-surface p-5 dark:border-outline-dark dark:bg-surface-dark-alt">
+  {{ ui::csrf_field() }}
     <div class="min-w-40">
       <p class="font-semibold text-on-surface-strong dark:text-on-surface-dark-strong">{{ method.name }}</p>
       <p class="text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ method.carrier | upper }}{% if method.requires_pickup_point %} · {{ t(key="checkout-pickup-point", lang=lang | default(value='sk')) }}{% endif %}</p>

assets/views/auth/login.html

@@ -30,6 +30,7 @@
       {% endif %}
 
       <form method="post" action="/login" hx-boost="false" class="mt-4 flex flex-col gap-4">
+        {{ ui::csrf_field() }}
         <div class="flex flex-col gap-1">
           <label for="email"
             class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">

assets/views/auth/login_totp.html

@@ -0,0 +1,48 @@
+{% extends "base.html" %}
+{% import "macros/ui.html" as ui %}
+
+{% block title %}{{ t(key="login-totp-title", lang=lang | default(value='sk')) }}{% endblock title %}
+
+{% block content %}
+<div class="mx-auto mt-8 max-w-sm">
+  <div
+    class="rounded-radius border border-outline bg-surface-alt shadow-sm dark:border-outline-dark dark:bg-surface-dark-alt">
+    <div
+      class="flex items-center justify-between border-b border-outline px-5 py-3 dark:border-outline-dark">
+      <span class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
+        {{ t(key="brand", lang=lang | default(value='sk')) }}
+      </span>
+      {{ ui::badge(label=t(key="auth", lang=lang | default(value='sk')), variant="primary") }}
+    </div>
+
+    <div class="p-5">
+      <h1 class="text-xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">
+        {{ t(key="login-totp-title", lang=lang | default(value='sk')) }}
+      </h1>
+      <p class="mt-2 text-sm text-on-surface dark:text-on-surface-dark">
+        {{ t(key="login-totp-intro", lang=lang | default(value='sk')) }}
+      </p>
+
+      {% if error %}
+      {{ ui::alert_danger(message=t(key="login-totp-error", lang=lang | default(value='sk')), extra="mt-3") }}
+      {% endif %}
+
+      <form method="post" action="/login/totp" hx-boost="false" class="mt-4 flex flex-col gap-4">
+  {{ ui::csrf_field() }}
+        <div class="flex flex-col gap-1">
+          <label for="code"
+            class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">
+            {{ t(key="login-totp-code", lang=lang | default(value='sk')) }}
+          </label>
+          {{ ui::input(name="code", id="code", type="text", required=true, autocomplete="one-time-code", attrs='inputmode="numeric" autofocus') }}
+        </div>
+        {{ ui::button(label=t(key="login-totp-submit", lang=lang | default(value='sk')), type="submit", extra="mt-1 w-full") }}
+      </form>
+
+      <p class="mt-4 text-xs text-on-surface dark:text-on-surface-dark">
+        {{ t(key="login-totp-backup-hint", lang=lang | default(value='sk')) }}
+      </p>
+    </div>
+  </div>
+</div>
+{% endblock content %}

assets/views/auth/register.html

@@ -32,6 +32,7 @@
 
       <form method="post" action="/register" hx-boost="false" class="mt-4 flex flex-col gap-4"
         x-data="{ password: '', confirm: '' }">
+  {{ ui::csrf_field() }}
         <div class="flex flex-col gap-1.5">
           <span class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="account-type", lang=lang | default(value='sk')) }}</span>
           <div class="grid grid-cols-2 gap-2">

assets/views/auth/resend_verification.html

@@ -24,6 +24,7 @@
       {% else %}
       <p class="mt-1 text-sm text-on-surface/70 dark:text-on-surface-dark/70">{{ t(key="resend-verification-intro", lang=lang | default(value='sk')) }}</p>
       <form method="post" action="/resend-verification" hx-boost="false" class="mt-4 flex flex-col gap-4">
+  {{ ui::csrf_field() }}
         <div class="flex flex-col gap-1">
           <label for="email" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="login-email", lang=lang | default(value='sk')) }}</label>
           {{ ui::input(name="email", id="email", type="email", required=true, autocomplete="email", attrs="autofocus") }}

assets/views/auth/set_password.html

@@ -29,6 +29,7 @@
       {% endif %}
 
       <form method="post" action="/set-password" hx-boost="false" class="mt-4 flex flex-col gap-4">
+  {{ ui::csrf_field() }}
         <input type="hidden" name="token" value="{{ token }}">
         <div class="flex flex-col gap-1">
           <label for="password" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="set-password-new", lang=lang | default(value='sk')) }}</label>

assets/views/base.html

@@ -69,6 +69,7 @@
     <script defer src="/static/vendor/alpine/alpinejs-3.14.9.min.js"></script>
   </head>
   <body hx-boost="true"
+    hx-headers='{"X-CSRF-Token": "{{ csrf_token() }}"}'
     x-data="{ cats: false, lg: window.matchMedia('(min-width: 1024px)').matches }"
     x-init="window.matchMedia('(min-width: 1024px)').addEventListener('change', e => lg = e.matches)"
     class="min-h-screen bg-surface text-on-surface antialiased dark:bg-surface-dark dark:text-on-surface-dark">
@@ -91,6 +92,7 @@
           <li>{{ ui::nav_link(label=t(key="admin-title", lang=lang | default(value='sk')), href="/admin/dashboard", data_nav="/admin", variant="warning", attrs='hx-boost="false"') }}</li>
           <li>
             <form method="post" action="/logout" hx-boost="false">
+  {{ ui::csrf_field() }}
               <button type="submit" class="text-sm font-medium text-danger underline-offset-2 transition hover:opacity-75 focus:outline-hidden focus-visible:underline">{{ t(key="logout", lang=lang | default(value='sk')) }}</button>
             </form>
           </li>
@@ -163,6 +165,7 @@
           <li><a href="/admin/dashboard" hx-boost="false" data-nav="/admin" class="block rounded-radius px-3 py-2 text-sm font-medium text-warning underline-offset-2 transition hover:bg-primary/5 focus:outline-hidden focus-visible:underline">{{ t(key="admin-title", lang=lang | default(value='sk')) }}</a></li>
           <li>
             <form method="post" action="/logout" hx-boost="false">
+  {{ ui::csrf_field() }}
               <button type="submit" class="block w-full rounded-radius px-3 py-2 text-left text-sm font-medium text-danger underline-offset-2 transition hover:bg-primary/5 focus:outline-hidden focus-visible:underline">{{ t(key="logout", lang=lang | default(value='sk')) }}</button>
             </form>
           </li>
@@ -170,6 +173,7 @@
           <li><a href="/account/profile" data-nav="/account" class="block rounded-radius px-3 py-2 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-primary focus:outline-hidden focus-visible:underline aria-[current=page]:font-semibold aria-[current=page]:bg-primary/10 aria-[current=page]:text-primary dark:text-on-surface-dark dark:hover:text-primary-dark dark:aria-[current=page]:text-primary-dark">{{ t(key="nav-profile", lang=lang | default(value='sk')) }}</a></li>
           <li>
             <form method="post" action="/logout" hx-boost="false">
+  {{ ui::csrf_field() }}
               <button type="submit" class="block w-full rounded-radius px-3 py-2 text-left text-sm font-medium text-danger underline-offset-2 transition hover:bg-primary/5 focus:outline-hidden focus-visible:underline">{{ t(key="logout", lang=lang | default(value='sk')) }}</button>
             </form>
           </li>
@@ -196,8 +200,10 @@
           <li><a href="/account/orders" data-nav="/account/orders" class="block rounded-radius px-3 py-2 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-primary focus:outline-hidden focus-visible:underline aria-[current=page]:font-semibold aria-[current=page]:bg-primary/10 aria-[current=page]:text-primary dark:text-on-surface-dark dark:hover:text-primary-dark dark:aria-[current=page]:text-primary-dark">{{ t(key="account-orders", lang=lang | default(value='sk')) }}</a></li>
           <li><a href="/account/profile" data-nav="/account/profile" class="block rounded-radius px-3 py-2 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-primary focus:outline-hidden focus-visible:underline aria-[current=page]:font-semibold aria-[current=page]:bg-primary/10 aria-[current=page]:text-primary dark:text-on-surface-dark dark:hover:text-primary-dark dark:aria-[current=page]:text-primary-dark">{{ t(key="profile-title", lang=lang | default(value='sk')) }}</a></li>
           <li><a href="/account/password" data-nav="/account/password" class="block rounded-radius px-3 py-2 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-primary focus:outline-hidden focus-visible:underline aria-[current=page]:font-semibold aria-[current=page]:bg-primary/10 aria-[current=page]:text-primary dark:text-on-surface-dark dark:hover:text-primary-dark dark:aria-[current=page]:text-primary-dark">{{ t(key="account-change-password", lang=lang | default(value='sk')) }}</a></li>
+          <li><a href="/account/security" data-nav="/account/security" class="block rounded-radius px-3 py-2 text-sm font-medium text-on-surface underline-offset-2 transition hover:bg-primary/5 hover:text-primary focus:outline-hidden focus-visible:underline aria-[current=page]:font-semibold aria-[current=page]:bg-primary/10 aria-[current=page]:text-primary dark:text-on-surface-dark dark:hover:text-primary-dark dark:aria-[current=page]:text-primary-dark">{{ t(key="security-title", lang=lang | default(value='sk')) }}</a></li>
         </ul>
         <form method="post" action="/logout" hx-boost="false" class="mt-4 border-t border-outline pt-3 dark:border-outline-dark">
+  {{ ui::csrf_field() }}
           <button type="submit" class="block w-full rounded-radius px-3 py-2 text-left text-sm font-medium text-danger underline-offset-2 transition hover:bg-primary/5 focus:outline-hidden focus-visible:underline">{{ t(key="logout", lang=lang | default(value='sk')) }}</button>
         </form>
       </aside>

assets/views/macros/ui.html

@@ -29,6 +29,13 @@
        outline : outline-primary | outline-secondary | outline-alternate | outline-danger
        ghost   : ghost-primary | ghost-secondary | ghost-danger #}
 
+{# CSRF hidden field for native (non-htmx) <form method="post"> submits. htmx
+   requests instead inherit the X-CSRF-Token header from <body hx-headers>.
+   `csrf_token()` is a global Tera function bound per-request by shared::csrf. #}
+{% macro csrf_field() -%}
+<input type="hidden" name="_csrf" value="{{ csrf_token() }}">
+{%- endmacro %}
+
 {% macro button(label, variant="primary", type="button", href="", attrs="", extra="", icon="", size="px-4 py-2 text-sm") -%}
 {%- if variant == "secondary" -%}{% set cls = "border border-secondary bg-secondary text-on-secondary focus-visible:outline-secondary dark:border-secondary-dark dark:bg-secondary-dark dark:text-on-secondary-dark dark:focus-visible:outline-secondary-dark" -%}
 {%- elif variant == "danger" -%}{% set cls = "border border-danger bg-danger text-on-danger focus-visible:outline-danger dark:bg-danger dark:border-danger dark:text-on-danger dark:focus-visible:outline-danger" -%}
@@ -74,6 +81,8 @@
 <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="{{ size }}{% if extra %} {{ extra }}{% endif %}" aria-hidden="true" {{ attrs | safe }}><path stroke-linecap="round" stroke-linejoin="round" d="M2.25 3h1.386c.51 0 .955.343 1.087.835l.383 1.437M7.5 14.25a3 3 0 0 0-3 3h15.75m-12.75-3h11.218c1.121-2.3 2.1-4.684 2.924-7.138a60.114 60.114 0 0 0-16.536-1.84M7.5 14.25 5.106 5.272M6 20.25a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0Zm12.75 0a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0Z" /></svg>
 {%- elif name == "close" -%}
 <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="{{ size }}{% if extra %} {{ extra }}{% endif %}" aria-hidden="true" {{ attrs | safe }}><path stroke-linecap="round" stroke-linejoin="round" d="M6 18 18 6M6 6l12 12" /></svg>
+{%- elif name == "chevron-double-left" -%}
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="{{ size }}{% if extra %} {{ extra }}{% endif %}" aria-hidden="true" {{ attrs | safe }}><path stroke-linecap="round" stroke-linejoin="round" d="m18.75 4.5-7.5 7.5 7.5 7.5m-6-15L5.25 12l7.5 7.5" /></svg>
 {%- else -%}
 <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" class="{{ size }}{% if extra %} {{ extra }}{% endif %}" aria-hidden="true" {{ attrs | safe }}><path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25h16.5" /></svg>
 {%- endif -%}
@@ -113,6 +122,21 @@
 {%- endif %}
 {%- endmacro badge %}
 
+{# Effective-price cell content for the admin products table. The value is
+   colored only when it differs from the regular price (effective_reduced);
+   when equal it renders in the plain text color, unified with the Price column.
+   `preview=true` uses the info color (an unsaved profile-toggle preview) instead
+   of the saved primary color. No t() calls, so it is safe inside a macro. #}
+{% macro eff_price(p, preview=false) -%}
+{%- if preview -%}{% set strong = "text-info" %}{%- else -%}{% set strong = "text-primary dark:text-primary-dark" %}{%- endif -%}
+{% if p.effective_reduced %}
+<span class="font-medium {{ strong }}">{{ p.effective_price }} {{ p.currency }}</span>
+<span class="ml-1 text-xs text-on-surface/60 dark:text-on-surface-dark/60">(−{{ p.effective_percent_off }}%)</span>
+{% else %}
+{{ p.effective_price }} {{ p.currency }}
+{% endif %}
+{%- endmacro eff_price %}
+
 {# ---- Form controls. Verbatim Penguin classes from
    penguinui/{text-input,text-area,select,checkbox,file-input}/default-*.html.
    These macros emit only the control (callers keep their own <label>/layout), so
@@ -120,7 +144,7 @@
 
 {# Text/email/number/password input. #}
 {% macro input(name, type="text", id="", value="", placeholder="", required=false, autocomplete="", attrs="", extra="", width="w-full") -%}
-<input {% if id %}id="{{ id }}" {% endif %}name="{{ name }}" type="{{ type }}"{% if value != "" %} value="{{ value }}"{% endif %}{% if placeholder %} placeholder="{{ placeholder }}"{% endif %}{% if required %} required{% endif %}{% if autocomplete %} autocomplete="{{ autocomplete }}"{% endif %} class="{{ width }} rounded-radius border border-outline bg-surface-alt px-2 py-2 text-sm text-on-surface focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary disabled:cursor-not-allowed disabled:opacity-75 dark:border-outline-dark dark:bg-surface-dark-alt/50 dark:text-on-surface-dark dark:focus-visible:outline-primary-dark {{ extra }}" {{ attrs | safe }}/>
+<input {% if id %}id="{{ id }}" {% endif %}name="{{ name }}" type="{{ type }}"{% if value is number or value != "" %} value="{{ value }}"{% endif %}{% if placeholder %} placeholder="{{ placeholder }}"{% endif %}{% if required %} required{% endif %}{% if autocomplete %} autocomplete="{{ autocomplete }}"{% endif %} class="{{ width }} rounded-radius border border-outline bg-surface-alt px-2 py-2 text-sm text-on-surface focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary disabled:cursor-not-allowed disabled:opacity-75 dark:border-outline-dark dark:bg-surface-dark-alt/50 dark:text-on-surface-dark dark:focus-visible:outline-primary-dark {{ extra }}" {{ attrs | safe }}/>
 {%- endmacro input %}
 
 {% macro textarea(name, id="", value="", rows="3", placeholder="", required=false, attrs="", extra="") -%}

assets/views/partials/profile_menu.html

@@ -61,10 +61,15 @@
         <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor" class="size-4 shrink-0"><path fill-rule="evenodd" d="M15.75 1.5a6.75 6.75 0 00-6.651 7.906c.067.39-.032.717-.221.906l-6.5 6.499a3 3 0 00-.878 2.121v2.818c0 .414.336.75.75.75H6a.75.75 0 00.75-.75v-1.5h1.5A.75.75 0 009 21v-1.5h1.5a.75.75 0 00.53-.22l2.658-2.658c.19-.189.517-.288.906-.22A6.75 6.75 0 1015.75 1.5zm0 3a.75.75 0 000 1.5A2.25 2.25 0 0118 8.25a.75.75 0 001.5 0 3.75 3.75 0 00-3.75-3.75z" clip-rule="evenodd"/></svg>
         {{ t(key="account-change-password", lang=lang | default(value='sk')) }}
       </a>
+      <a href="/account/security" data-nav="/account/security" role="menuitem" class="flex items-center gap-2 bg-surface-alt px-4 py-2 text-sm text-on-surface hover:bg-surface-dark-alt/5 hover:text-on-surface-strong focus-visible:bg-surface-dark-alt/10 focus-visible:text-on-surface-strong focus-visible:outline-hidden dark:bg-surface-dark-alt dark:text-on-surface-dark dark:hover:bg-surface-alt/5 dark:hover:text-on-surface-dark-strong dark:focus-visible:bg-surface-alt/10 dark:focus-visible:text-on-surface-dark-strong">
+        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor" class="size-4 shrink-0"><path fill-rule="evenodd" d="M12 1.5a5.25 5.25 0 00-5.25 5.25v3a3 3 0 00-3 3v6.75a3 3 0 003 3h10.5a3 3 0 003-3v-6.75a3 3 0 00-3-3v-3c0-2.9-2.35-5.25-5.25-5.25zm3.75 8.25v-3a3.75 3.75 0 10-7.5 0v3h7.5z" clip-rule="evenodd"/></svg>
+        {{ t(key="security-title", lang=lang | default(value='sk')) }}
+      </a>
     </div>
     <!-- logout -->
     <div class="flex flex-col py-1.5">
-      <form method="post" action="/logout" hx-boost="false"><button type="submit" role="menuitem" class="flex w-full items-center gap-2 bg-surface-alt px-4 py-2 text-left text-sm text-on-surface hover:bg-surface-dark-alt/5 hover:text-on-surface-strong focus-visible:bg-surface-dark-alt/10 focus-visible:text-on-surface-strong focus-visible:outline-hidden dark:bg-surface-dark-alt dark:text-on-surface-dark dark:hover:bg-surface-alt/5 dark:hover:text-on-surface-dark-strong dark:focus-visible:bg-surface-alt/10 dark:focus-visible:text-on-surface-dark-strong">
+      <form method="post" action="/logout" hx-boost="false">
+  <input type="hidden" name="_csrf" value="{{ csrf_token() }}"><button type="submit" role="menuitem" class="flex w-full items-center gap-2 bg-surface-alt px-4 py-2 text-left text-sm text-on-surface hover:bg-surface-dark-alt/5 hover:text-on-surface-strong focus-visible:bg-surface-dark-alt/10 focus-visible:text-on-surface-strong focus-visible:outline-hidden dark:bg-surface-dark-alt dark:text-on-surface-dark dark:hover:bg-surface-alt/5 dark:hover:text-on-surface-dark-strong dark:focus-visible:bg-surface-alt/10 dark:focus-visible:text-on-surface-dark-strong">
         <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true" fill="currentColor" class="size-4 shrink-0"><path fill-rule="evenodd" d="M7.5 3.75A1.5 1.5 0 006 5.25v13.5a1.5 1.5 0 001.5 1.5h6a1.5 1.5 0 001.5-1.5V15a.75.75 0 011.5 0v3.75a3 3 0 01-3 3h-6a3 3 0 01-3-3V5.25a3 3 0 013-3h6a3 3 0 013 3V9A.75.75 0 0115 9V5.25a1.5 1.5 0 00-1.5-1.5h-6zm10.72 4.72a.75.75 0 011.06 0l3 3a.75.75 0 010 1.06l-3 3a.75.75 0 11-1.06-1.06l1.72-1.72H9a.75.75 0 010-1.5h10.94l-1.72-1.72a.75.75 0 010-1.06z" clip-rule="evenodd"/></svg>
         {{ t(key="logout", lang=lang | default(value='sk')) }}
       </button></form>

assets/views/partials/settings_dropdown.html

@@ -20,6 +20,7 @@
   class="absolute right-0 mt-2 flex w-56 flex-col overflow-hidden rounded-radius border border-outline bg-surface-alt py-1 shadow-lg dark:border-outline-dark dark:bg-surface-dark-alt"
   role="menu">
   <form method="post" action="/lang" hx-boost="false">
+  <input type="hidden" name="_csrf" value="{{ csrf_token() }}">
     <p class="px-4 py-1.5 text-xs font-semibold uppercase tracking-wide text-on-surface/60 dark:text-on-surface-dark/60">
       {{ t(key="settings-language", lang=lang | default(value='sk')) }}
     </p>

assets/views/shop/_card.html

@@ -17,16 +17,27 @@
       <!-- Header: Title & Price -->
       <div class="flex justify-between gap-4">
         <h3 class="text-lg font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ product.name }}</h3>
-        <span class="whitespace-nowrap text-xl"><span class="sr-only">Price</span>{{ product.price }} {{ product.currency }}</span>
+        {% if product.on_sale %}
+        <span class="flex flex-col items-end whitespace-nowrap leading-tight">
+          <span class="text-sm text-on-surface/50 line-through dark:text-on-surface-dark/50">{{ product.regular_price }} {{ product.currency }}</span>
+          <span class="text-xl font-semibold text-danger"><span class="sr-only">Price</span>{% if product.has_options %}{{ t(key="from-price", price=product.price, lang=lang | default(value='sk')) }}{% else %}{{ product.price }}{% endif %} {{ product.currency }}</span>
+        </span>
+        {% else %}
+        <span class="whitespace-nowrap text-xl"><span class="sr-only">Price</span>{% if product.has_options %}{{ t(key="from-price", price=product.price, lang=lang | default(value='sk')) }}{% else %}{{ product.price }}{% endif %} {{ product.currency }}</span>
+        {% endif %}
       </div>
     </div>
   </a>
   <div class="flex flex-col gap-2 p-6 pt-0">
-    {% if product.stock > 0 %}
+    {% if product.has_options %}
+    {# Multiple variants: customer must pick on the product page. #}
+    {{ ui::button(label=t(key="choose-option", lang=lang | default(value='sk')), href="/shop/" ~ product.slug, extra="w-full") }}
+    {% elif product.stock > 0 %}
     <p class="text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="in-stock", lang=lang | default(value='sk')) }}: {{ product.stock }}</p>
     <form method="post" action="/cart/add" hx-post="/cart/add" hx-swap="none"
       hx-on::after-request="if (event.detail.successful) toast('{{ t(key='cart-added', lang=lang | default(value='sk')) }}')">
-      <input type="hidden" name="product_id" value="{{ product.id }}">
+  <input type="hidden" name="_csrf" value="{{ csrf_token() }}">
+      <input type="hidden" name="variant_id" value="{{ product.variant_id }}">
       <input type="hidden" name="quantity" value="1">
       {{ ui::button(label=t(key="add-to-cart", lang=lang | default(value='sk')), type="submit", extra="w-full", icon='<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" fill="currentColor" aria-hidden="true" class="size-3.5"><path fill-rule="evenodd" d="M5 4a3 3 0 0 1 6 0v1h.643a1.5 1.5 0 0 1 1.492 1.35l.7 7A1.5 1.5 0 0 1 12.342 15H3.657a1.5 1.5 0 0 1-1.492-1.65l.7-7A1.5 1.5 0 0 1 4.357 5H5V4Zm4.5 0v1h-3V4a1.5 1.5 0 0 1 3 0Zm-3 3.75a.75.75 0 0 0-1.5 0v1a3 3 0 1 0 6 0v-1a.75.75 0 0 0-1.5 0v1a1.5 1.5 0 1 1-3 0v-1Z" clip-rule="evenodd" /></svg>') }}
     </form>

assets/views/shop/_cart_body.html

@@ -19,15 +19,24 @@
       <tr>
         <td class="px-4 py-3">
           <a href="/shop/{{ item.slug }}" class="font-medium text-on-surface-strong hover:text-primary dark:text-on-surface-dark-strong dark:hover:text-primary-dark">{{ item.name }}</a>
+          {% if item.variant_label %}<span class="block text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ item.variant_label }}</span>{% endif %}
+        </td>
+        <td class="px-4 py-3 tabular-nums">
+          {% if item.on_sale %}
+          <span class="font-medium text-danger">{{ item.price }} {{ item.currency }}</span>
+          <span class="ml-1 text-xs text-on-surface/50 line-through dark:text-on-surface-dark/50">{{ item.regular_price }}</span>
+          {% else %}
+          {{ item.price }} {{ item.currency }}
+          {% endif %}
         </td>
-        <td class="px-4 py-3 tabular-nums">{{ item.price }} {{ item.currency }}</td>
         <td class="px-4 py-3">
           {# Changing the quantity posts via htmx (custom `cartchange` event) and
              swaps only #cart-body. Dropping to 0 asks for confirmation first,
              reverting to the previous quantity if the customer cancels. #}
           <form method="post" action="/cart/update"
             hx-post="/cart/update" hx-trigger="cartchange" hx-target="#cart-body" hx-swap="innerHTML">
-            <input type="hidden" name="product_id" value="{{ item.id }}">
+  {{ ui::csrf_field() }}
+            <input type="hidden" name="variant_id" value="{{ item.id }}">
             <input type="number" name="quantity" min="0" max="{{ item.stock }}" value="{{ item.quantity }}"
               @change="
                 if (parseInt($el.value || '0') <= 0 && !window.confirm('{{ t(key='cart-remove-confirm', lang=lang | default(value='sk')) }}')) {
@@ -43,7 +52,8 @@
         <td class="px-4 py-3 text-right">
           <form method="post" action="/cart/remove"
             hx-post="/cart/remove" hx-target="#cart-body" hx-swap="innerHTML">
-            <input type="hidden" name="product_id" value="{{ item.id }}">
+  {{ ui::csrf_field() }}
+            <input type="hidden" name="variant_id" value="{{ item.id }}">
             {{ ui::button(variant="ghost-danger", label=t(key="cart-remove", lang=lang | default(value='sk')), type="submit", size="px-2 py-1 text-xs") }}
           </form>
         </td>
@@ -62,7 +72,7 @@
 
 <div class="mt-6 flex flex-wrap justify-between gap-3">
   {{ ui::button(variant="outline-secondary", label=t(key="cart-continue", lang=lang | default(value='sk')), href="/shop") }}
-  {{ ui::button(label=t(key="cart-checkout", lang=lang | default(value='sk')), href="/checkout", size="px-5 py-2 text-sm") }}
+  {{ ui::button(label=t(key="cart-checkout", lang=lang | default(value='sk')), href="/checkout", size="px-5 py-2 text-sm", attrs='hx-boost="false"') }}
 </div>
 {% else %}
 <div class="rounded-radius border border-outline px-6 py-16 text-center dark:border-outline-dark">

assets/views/shop/_cart_preview.html

@@ -8,6 +8,7 @@
   <div class="flex items-start gap-3 px-4 py-3">
     <div class="min-w-0 flex-1">
       <a href="/shop/{{ item.slug }}" class="block truncate text-sm font-medium text-on-surface-strong hover:text-primary dark:text-on-surface-dark-strong dark:hover:text-primary-dark">{{ item.name }}</a>
+      {% if item.variant_label %}<span class="block truncate text-xs text-on-surface/60 dark:text-on-surface-dark/60">{{ item.variant_label }}</span>{% endif %}
       <p class="mt-0.5 text-xs tabular-nums text-on-surface dark:text-on-surface-dark">{{ item.quantity }} × {{ item.price }} {{ item.currency }}</p>
     </div>
     <span class="shrink-0 text-sm font-semibold tabular-nums text-on-surface-strong dark:text-on-surface-dark-strong">{{ item.line_total }} {{ item.currency }}</span>

assets/views/shop/checkout.html

@@ -30,6 +30,7 @@
     }
   }"
   class="mt-6 grid gap-8 lg:grid-cols-3">
+  {{ ui::csrf_field() }}
 
   <div class="space-y-6 lg:col-span-2">
     <!-- personal vs company. Fixed (read-only) for a logged-in account; a guest

assets/views/shop/order_confirmed.html

@@ -29,7 +29,7 @@
     <ul class="space-y-2 py-3 text-sm">
       {% for item in items %}
       <li class="flex justify-between gap-2">
-        <span class="text-on-surface/80 dark:text-on-surface-dark/80">{{ item.product_name }} × {{ item.quantity }}</span>
+        <span class="text-on-surface/80 dark:text-on-surface-dark/80">{{ item.product_name }}{% if item.variant_label %} · {{ item.variant_label }}{% endif %} × {{ item.quantity }}</span>
         <span class="tabular-nums">{{ item.line_total }} {{ order.currency }}</span>
       </li>
       {% endfor %}

assets/views/shop/show.html

@@ -49,31 +49,78 @@
   </div>
 
   <!-- details -->
-  <div class="space-y-6">
+  {% set fld = "w-full rounded-radius border border-outline bg-surface-alt px-3 py-2 text-sm text-on-surface focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary dark:border-outline-dark dark:bg-surface-dark-alt/50 dark:text-on-surface-dark dark:focus-visible:outline-primary-dark" %}
+  {% set btn = "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-radius px-5 py-2 text-sm text-center font-medium tracking-wide transition hover:opacity-75 focus-visible:outline-2 focus-visible:outline-offset-2 active:opacity-100 active:outline-offset-0 disabled:cursor-not-allowed disabled:opacity-75 border border-primary bg-primary text-on-primary focus-visible:outline-primary dark:border-primary-dark dark:bg-primary-dark dark:text-on-primary-dark dark:focus-visible:outline-primary-dark" %}
+  <script id="variant-data" type="application/json">{{ variants | json_encode() | safe }}</script>
+  <div class="space-y-6" x-data="productBuy(JSON.parse(document.getElementById('variant-data').textContent))">
     {% if category %}
     <a href="/category/{{ category.slug }}" class="text-sm font-medium text-primary dark:text-primary-dark">{{ category.name }}</a>
     {% endif %}
     <h1 class="text-3xl font-bold text-on-surface-strong dark:text-on-surface-dark-strong">{{ product.name }}</h1>
-    <p class="text-2xl font-semibold text-primary dark:text-primary-dark">{{ product.price }} {{ product.currency }}</p>
 
-    {% if product.description %}
-    <div class="whitespace-pre-line leading-relaxed text-on-surface/80 dark:text-on-surface-dark/80">{{ product.description }}</div>
-    {% endif %}
+    <template x-if="current">
+      <div class="space-y-6">
+        <!-- option picker (only when there's a real choice); first option is
+             selected by default and switching it updates the price + buy form -->
+        <template x-if="variants.length > 1">
+          <div class="max-w-sm space-y-1.5">
+            <label for="variant-select" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="choose-option", lang=lang | default(value='sk')) }}</label>
+            <select id="variant-select" x-model.number="sel" class="{{ fld }}">
+              <template x-for="(v, i) in variants" :key="v.id">
+                <option :value="i" x-text="(v.label || '—') + ' · ' + v.price + ' {{ product.currency }}' + (v.in_stock ? '' : ' ({{ t(key='out-of-stock', lang=lang | default(value='sk')) }})')"></option>
+              </template>
+            </select>
+          </div>
+        </template>
 
-    {% if product.stock > 0 %}
-    <form method="post" action="/cart/add" hx-post="/cart/add" hx-swap="none" class="flex flex-wrap items-end gap-3"
-      hx-on::after-request="if (event.detail.successful) toast('{{ t(key='cart-added', lang=lang | default(value='sk')) }}')">
-      <input type="hidden" name="product_id" value="{{ product.id }}">
-      <div class="space-y-1.5">
-        <label for="quantity" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="quantity", lang=lang | default(value='sk')) }}</label>
-        {{ ui::input(name="quantity", id="quantity", type="number", value="1", width="w-24", attrs='min="1" max="' ~ product.stock ~ '"') }}
+        <div class="flex items-baseline gap-3">
+          <p class="text-2xl font-semibold" :class="current.on_sale ? 'text-danger' : 'text-primary dark:text-primary-dark'">
+            <span x-text="current.price"></span> {{ product.currency }}
+          </p>
+          <template x-if="current.on_sale">
+            <p class="text-lg text-on-surface/50 line-through dark:text-on-surface-dark/50"><span x-text="current.regular_price"></span> {{ product.currency }}</p>
+          </template>
+        </div>
+
+        {% if product.description %}
+        <div class="whitespace-pre-line leading-relaxed text-on-surface/80 dark:text-on-surface-dark/80">{{ product.description }}</div>
+        {% endif %}
+
+        <template x-if="current.in_stock">
+          <div class="space-y-2">
+            <form method="post" action="/cart/add" hx-post="/cart/add" hx-swap="none" class="flex flex-wrap items-end gap-3"
+              hx-on::after-request="if (event.detail.successful) toast('{{ t(key='cart-added', lang=lang | default(value='sk')) }}')">
+              {{ ui::csrf_field() }}
+              <input type="hidden" name="variant_id" :value="current.id">
+              <div class="space-y-1.5">
+                <label for="quantity" class="text-sm font-medium text-on-surface-strong dark:text-on-surface-dark-strong">{{ t(key="quantity", lang=lang | default(value='sk')) }}</label>
+                <input type="number" id="quantity" name="quantity" value="1" min="1" :max="current.stock" class="{{ fld }} w-24">
+              </div>
+              <button type="submit" class="{{ btn }}">{{ t(key="add-to-cart", lang=lang | default(value='sk')) }}</button>
+            </form>
+            <p class="text-sm text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="in-stock", lang=lang | default(value='sk')) }}: <span x-text="current.stock"></span></p>
+          </div>
+        </template>
+        <template x-if="!current.in_stock">
+          <p class="inline-flex rounded-radius bg-danger/10 px-3 py-2 text-sm font-medium text-danger">{{ t(key="out-of-stock", lang=lang | default(value='sk')) }}</p>
+        </template>
       </div>
-      {{ ui::button(label=t(key="add-to-cart", lang=lang | default(value='sk')), type="submit", size="px-5 py-2 text-sm") }}
-    </form>
-    <p class="text-sm text-on-surface/60 dark:text-on-surface-dark/60">{{ t(key="in-stock", lang=lang | default(value='sk')) }}: {{ product.stock }}</p>
-    {% else %}
-    <p class="inline-flex rounded-radius bg-danger/10 px-3 py-2 text-sm font-medium text-danger">{{ t(key="out-of-stock", lang=lang | default(value='sk')) }}</p>
-    {% endif %}
+    </template>
+
+    <template x-if="!current">
+      <p class="inline-flex rounded-radius bg-danger/10 px-3 py-2 text-sm font-medium text-danger">{{ t(key="out-of-stock", lang=lang | default(value='sk')) }}</p>
+    </template>
   </div>
+
+  <script>
+    function productBuy(variants) {
+      return {
+        variants: variants || [],
+        // Default to the first in-stock variant, else the first.
+        sel: Math.max(0, (variants || []).findIndex(v => v.in_stock)),
+        get current() { return this.variants[this.sel] || null; },
+      };
+    }
+  </script>
 </div>
 {% endblock content %}

migration/src/lib.rs

@@ -34,6 +34,13 @@ mod m20260618_000001_o_auth2_sessions;
 mod m20260618_000002_customer_profiles;
 mod m20260618_000003_account_type;
 mod m20260618_000004_account_ownership;
+mod m20260620_000001_add_totp_to_users;
+mod m20260621_000001_add_sale_price_to_products;
+mod m20260621_000002_account_product_prices;
+mod m20260621_000003_discount_profiles;
+mod m20260621_000004_add_business_sale_price_to_products;
+mod m20260622_000001_audience_discount_profiles;
+mod m20260622_000002_product_variants;
 pub struct Migrator;
 
 #[async_trait::async_trait]
@@ -72,6 +79,13 @@ impl MigratorTrait for Migrator {
             Box::new(m20260618_000002_customer_profiles::Migration),
             Box::new(m20260618_000003_account_type::Migration),
             Box::new(m20260618_000004_account_ownership::Migration),
+            Box::new(m20260620_000001_add_totp_to_users::Migration),
+            Box::new(m20260621_000001_add_sale_price_to_products::Migration),
+            Box::new(m20260621_000002_account_product_prices::Migration),
+            Box::new(m20260621_000003_discount_profiles::Migration),
+            Box::new(m20260621_000004_add_business_sale_price_to_products::Migration),
+            Box::new(m20260622_000001_audience_discount_profiles::Migration),
+            Box::new(m20260622_000002_product_variants::Migration),
             // inject-above (do not remove this comment)
         ]
     }

migration/src/m20260620_000001_add_totp_to_users.rs

@@ -0,0 +1,32 @@
+use loco_rs::schema::*;
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+// Optional TOTP (Google Authenticator) two-factor auth. All three columns are
+// nullable and only populated once a user opts in:
+//   - `totp_secret`         base32 shared secret; present while enrolling/enabled.
+//                           TODO(security): stored PLAINTEXT and is password-
+//                           equivalent (must stay reversible to recompute codes).
+//                           Encrypt at rest later with an out-of-DB key. See the
+//                           TODO(security) block in src/models/users.rs.
+//   - `totp_enabled_at`     NULL = 2FA off. Set only after the user confirms a
+//                           code, so a half-finished enrollment never gates login.
+//   - `totp_backup_codes`   JSON array of hashed one-time recovery codes.
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        add_column(m, "users", "totp_secret", ColType::TextNull).await?;
+        add_column(m, "users", "totp_enabled_at", ColType::TimestampWithTimeZoneNull).await?;
+        add_column(m, "users", "totp_backup_codes", ColType::TextNull).await?;
+        Ok(())
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        remove_column(m, "users", "totp_backup_codes").await?;
+        remove_column(m, "users", "totp_enabled_at").await?;
+        remove_column(m, "users", "totp_secret").await?;
+        Ok(())
+    }
+}

migration/src/m20260621_000001_add_sale_price_to_products.rs

@@ -0,0 +1,19 @@
+use loco_rs::schema::*;
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        // Optional discounted price in minor units. When set (and below
+        // `price_cents`) the product is on sale; the regular price is shown
+        // struck through and this is the effective price everywhere.
+        add_column(m, "products", "sale_price_cents", ColType::BigIntegerNull).await
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        remove_column(m, "products", "sale_price_cents").await
+    }
+}

migration/src/m20260621_000002_account_product_prices.rs

@@ -0,0 +1,40 @@
+use loco_rs::schema::*;
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        // A manually negotiated price (in minor units) for one product, for one
+        // business account — the "personal agreement" layer. `user`/`product`
+        // add the user_id/product_id FKs; the unique index below keeps it to one
+        // row per (account, product).
+        create_table(
+            m,
+            "account_product_prices",
+            &[
+                ("id", ColType::PkAuto),
+                ("price_cents", ColType::BigInteger),
+            ],
+            &[("user", ""), ("product", "")],
+        )
+        .await?;
+
+        m.create_index(
+            Index::create()
+                .name("idx_account_product_prices_user_product_unique")
+                .table(Alias::new("account_product_prices"))
+                .col(Alias::new("user_id"))
+                .col(Alias::new("product_id"))
+                .unique()
+                .to_owned(),
+        )
+        .await
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        drop_table(m, "account_product_prices").await
+    }
+}

migration/src/m20260621_000003_discount_profiles.rs

@@ -0,0 +1,91 @@
+use loco_rs::schema::*;
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        // A reusable, named discount layer: a percentage (basis points, 5% = 500)
+        // over a product scope. `scope_type` is 'include' (covers the listed
+        // products) or 'all_except' (covers everything but the listed products).
+        create_table(
+            m,
+            "discount_profiles",
+            &[
+                ("id", ColType::PkAuto),
+                ("name", ColType::String),
+                ("percent_bp", ColType::Integer),
+                ("scope_type", ColType::StringWithDefault("include".to_string())),
+            ],
+            &[],
+        )
+        .await?;
+
+        // Which products the scope lists (meaning depends on scope_type).
+        create_table(
+            m,
+            "discount_profile_products",
+            &[("id", ColType::PkAuto)],
+            &[("discount_profile", ""), ("product", "")],
+        )
+        .await?;
+        m.create_index(
+            Index::create()
+                .name("idx_discount_profile_products_unique")
+                .table(Alias::new("discount_profile_products"))
+                .col(Alias::new("discount_profile_id"))
+                .col(Alias::new("product_id"))
+                .unique()
+                .to_owned(),
+        )
+        .await?;
+
+        // Which profiles a business account has (mixable).
+        create_table(
+            m,
+            "account_discount_profiles",
+            &[("id", ColType::PkAuto)],
+            &[("user", ""), ("discount_profile", "")],
+        )
+        .await?;
+        m.create_index(
+            Index::create()
+                .name("idx_account_discount_profiles_unique")
+                .table(Alias::new("account_discount_profiles"))
+                .col(Alias::new("user_id"))
+                .col(Alias::new("discount_profile_id"))
+                .unique()
+                .to_owned(),
+        )
+        .await?;
+
+        // The admin's chosen winning profile when two assigned profiles cover the
+        // same product for an account (collision resolution).
+        create_table(
+            m,
+            "account_product_resolutions",
+            &[("id", ColType::PkAuto)],
+            &[("user", ""), ("product", ""), ("discount_profile", "")],
+        )
+        .await?;
+        m.create_index(
+            Index::create()
+                .name("idx_account_product_resolutions_unique")
+                .table(Alias::new("account_product_resolutions"))
+                .col(Alias::new("user_id"))
+                .col(Alias::new("product_id"))
+                .unique()
+                .to_owned(),
+        )
+        .await
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        drop_table(m, "account_product_resolutions").await?;
+        drop_table(m, "account_discount_profiles").await?;
+        drop_table(m, "discount_profile_products").await?;
+        drop_table(m, "discount_profiles").await
+    }
+}

migration/src/m20260621_000004_add_business_sale_price_to_products.rs

@@ -0,0 +1,20 @@
+use loco_rs::schema::*;
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        // Optional per-product discounted price (minor units) shown to ALL
+        // business (company) accounts as a baseline, computed off the regular
+        // price like the personal sale. Per-company profiles/negotiated prices
+        // still layer on top (lowest price wins).
+        add_column(m, "products", "business_sale_price_cents", ColType::BigIntegerNull).await
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        remove_column(m, "products", "business_sale_price_cents").await
+    }
+}

migration/src/m20260622_000001_audience_discount_profiles.rs

@@ -0,0 +1,40 @@
+use loco_rs::schema::*;
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        // Discount profiles applied globally to a whole audience, set on the
+        // discounts page: "personal" lowers the public price for everyone,
+        // "business" lowers the price for all company accounts. Per-company
+        // assignments (account_discount_profiles) still layer on top.
+        create_table(
+            m,
+            "audience_discount_profiles",
+            &[
+                ("id", ColType::PkAuto),
+                ("audience", ColType::String),
+            ],
+            &[("discount_profile", "")],
+        )
+        .await?;
+
+        m.create_index(
+            Index::create()
+                .name("idx_audience_discount_profiles_unique")
+                .table(Alias::new("audience_discount_profiles"))
+                .col(Alias::new("audience"))
+                .col(Alias::new("discount_profile_id"))
+                .unique()
+                .to_owned(),
+        )
+        .await
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        drop_table(m, "audience_discount_profiles").await
+    }
+}

migration/src/m20260622_000002_product_variants.rs

@@ -0,0 +1,204 @@
+//! Introduce product variants as the purchasable unit.
+//!
+//! A product becomes a presentation grouping (name, description, images,
+//! category, tags, percentage discount profiles). Each product owns one or more
+//! `product_variants`, and the variant is what carries the things that actually
+//! differ between options: a free-text `label` (e.g. "rolovaná 90cm x 10m",
+//! "5ml"), its own `sku`, `stock`, regular `price_cents`, and its own optional
+//! public/business quick-sale prices.
+//!
+//! This migration:
+//!   1. creates `product_variants`,
+//!   2. backfills one variant per existing product from the product's current
+//!      price/stock/sku/sale columns,
+//!   3. moves the per-account negotiated price and collision-resolution tables
+//!      from keying on `product_id` to `variant_id`,
+//!   4. snapshots the variant onto `order_items`,
+//!   5. drops the now-moved purchasable columns from `products`.
+
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        let db = m.get_connection();
+
+        // 1. The variants table.
+        db.execute_unprepared(
+            r#"
+            CREATE TABLE product_variants (
+                id          SERIAL PRIMARY KEY,
+                created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+                updated_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+                product_id  INTEGER NOT NULL REFERENCES products(id) ON DELETE CASCADE,
+                label       VARCHAR NOT NULL DEFAULT '',
+                position    INTEGER NOT NULL DEFAULT 0,
+                sku         VARCHAR,
+                stock       INTEGER NOT NULL DEFAULT 0,
+                price_cents BIGINT NOT NULL,
+                sale_price_cents          BIGINT,
+                business_sale_price_cents BIGINT
+            );
+            CREATE INDEX idx_product_variants_product ON product_variants (product_id);
+            "#,
+        )
+        .await?;
+
+        // 2. One variant per existing product, carrying its current pricing.
+        db.execute_unprepared(
+            r#"
+            INSERT INTO product_variants
+                (product_id, label, position, sku, stock,
+                 price_cents, sale_price_cents, business_sale_price_cents)
+            SELECT id, '', 0, sku, stock,
+                   price_cents, sale_price_cents, business_sale_price_cents
+            FROM products;
+            "#,
+        )
+        .await?;
+
+        // 3a. Negotiated prices: product_id -> variant_id.
+        db.execute_unprepared(
+            r#"
+            ALTER TABLE account_product_prices ADD COLUMN variant_id INTEGER;
+            UPDATE account_product_prices a
+                SET variant_id = pv.id
+                FROM product_variants pv
+                WHERE pv.product_id = a.product_id;
+            DROP INDEX IF EXISTS idx_account_product_prices_user_product_unique;
+            ALTER TABLE account_product_prices DROP COLUMN product_id;
+            ALTER TABLE account_product_prices ALTER COLUMN variant_id SET NOT NULL;
+            ALTER TABLE account_product_prices
+                ADD CONSTRAINT fk_account_product_prices_variant
+                FOREIGN KEY (variant_id) REFERENCES product_variants(id) ON DELETE CASCADE;
+            CREATE UNIQUE INDEX idx_account_product_prices_user_variant_unique
+                ON account_product_prices (user_id, variant_id);
+            "#,
+        )
+        .await?;
+
+        // 3b. Collision resolutions: product_id -> variant_id.
+        db.execute_unprepared(
+            r#"
+            ALTER TABLE account_product_resolutions ADD COLUMN variant_id INTEGER;
+            UPDATE account_product_resolutions a
+                SET variant_id = pv.id
+                FROM product_variants pv
+                WHERE pv.product_id = a.product_id;
+            DROP INDEX IF EXISTS idx_account_product_resolutions_unique;
+            ALTER TABLE account_product_resolutions DROP COLUMN product_id;
+            ALTER TABLE account_product_resolutions ALTER COLUMN variant_id SET NOT NULL;
+            ALTER TABLE account_product_resolutions
+                ADD CONSTRAINT fk_account_product_resolutions_variant
+                FOREIGN KEY (variant_id) REFERENCES product_variants(id) ON DELETE CASCADE;
+            CREATE UNIQUE INDEX idx_account_product_resolutions_unique
+                ON account_product_resolutions (user_id, variant_id);
+            "#,
+        )
+        .await?;
+
+        // 4. Snapshot the variant on order lines (label is frozen at order time;
+        //    the FK is nullable + SET NULL so deleting a variant keeps history).
+        db.execute_unprepared(
+            r#"
+            ALTER TABLE order_items ADD COLUMN variant_label VARCHAR NOT NULL DEFAULT '';
+            ALTER TABLE order_items ADD COLUMN variant_id INTEGER
+                REFERENCES product_variants(id) ON DELETE SET NULL;
+            "#,
+        )
+        .await?;
+
+        // 5. Drop the purchasable columns now owned by the variant.
+        db.execute_unprepared(
+            r#"
+            ALTER TABLE products DROP COLUMN price_cents;
+            ALTER TABLE products DROP COLUMN sale_price_cents;
+            ALTER TABLE products DROP COLUMN business_sale_price_cents;
+            ALTER TABLE products DROP COLUMN sku;
+            ALTER TABLE products DROP COLUMN stock;
+            "#,
+        )
+        .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, m: &SchemaManager) -> Result<(), DbErr> {
+        let db = m.get_connection();
+
+        // Restore product columns from each product's first variant.
+        db.execute_unprepared(
+            r#"
+            ALTER TABLE products ADD COLUMN price_cents BIGINT NOT NULL DEFAULT 0;
+            ALTER TABLE products ADD COLUMN sale_price_cents BIGINT;
+            ALTER TABLE products ADD COLUMN business_sale_price_cents BIGINT;
+            ALTER TABLE products ADD COLUMN sku VARCHAR;
+            ALTER TABLE products ADD COLUMN stock INTEGER NOT NULL DEFAULT 0;
+            UPDATE products p SET
+                price_cents = pv.price_cents,
+                sale_price_cents = pv.sale_price_cents,
+                business_sale_price_cents = pv.business_sale_price_cents,
+                sku = pv.sku,
+                stock = pv.stock
+            FROM (
+                SELECT DISTINCT ON (product_id) product_id, price_cents,
+                       sale_price_cents, business_sale_price_cents, sku, stock
+                FROM product_variants ORDER BY product_id, position, id
+            ) pv
+            WHERE pv.product_id = p.id;
+            "#,
+        )
+        .await?;
+
+        db.execute_unprepared(
+            r#"
+            ALTER TABLE order_items DROP COLUMN variant_id;
+            ALTER TABLE order_items DROP COLUMN variant_label;
+            "#,
+        )
+        .await?;
+
+        db.execute_unprepared(
+            r#"
+            ALTER TABLE account_product_resolutions ADD COLUMN product_id INTEGER;
+            UPDATE account_product_resolutions a
+                SET product_id = pv.product_id
+                FROM product_variants pv WHERE pv.id = a.variant_id;
+            DROP INDEX IF EXISTS idx_account_product_resolutions_unique;
+            ALTER TABLE account_product_resolutions DROP COLUMN variant_id;
+            ALTER TABLE account_product_resolutions ALTER COLUMN product_id SET NOT NULL;
+            ALTER TABLE account_product_resolutions
+                ADD CONSTRAINT fk_account_product_resolutions_product
+                FOREIGN KEY (product_id) REFERENCES products(id) ON DELETE CASCADE;
+            CREATE UNIQUE INDEX idx_account_product_resolutions_unique
+                ON account_product_resolutions (user_id, product_id);
+            "#,
+        )
+        .await?;
+
+        db.execute_unprepared(
+            r#"
+            ALTER TABLE account_product_prices ADD COLUMN product_id INTEGER;
+            UPDATE account_product_prices a
+                SET product_id = pv.product_id
+                FROM product_variants pv WHERE pv.id = a.variant_id;
+            DROP INDEX IF EXISTS idx_account_product_prices_user_variant_unique;
+            ALTER TABLE account_product_prices DROP COLUMN variant_id;
+            ALTER TABLE account_product_prices ALTER COLUMN product_id SET NOT NULL;
+            ALTER TABLE account_product_prices
+                ADD CONSTRAINT fk_account_product_prices_product
+                FOREIGN KEY (product_id) REFERENCES products(id) ON DELETE CASCADE;
+            CREATE UNIQUE INDEX idx_account_product_prices_user_product_unique
+                ON account_product_prices (user_id, product_id);
+            "#,
+        )
+        .await?;
+
+        db.execute_unprepared("DROP TABLE product_variants;").await?;
+
+        Ok(())
+    }
+}

src/app.rs

@@ -17,8 +17,9 @@ use std::{path::Path, sync::Arc};
 #[allow(unused_imports)]
 use crate::{
     controllers::{
-        account, admin_categories, admin_dashboard, admin_form, admin_orders,
-        admin_products, admin_shipping, auth, auth_pages, cart, checkout, home, i18n, media, oauth2,
+        account, admin_categories, admin_customers, admin_dashboard, admin_discount_profiles,
+        admin_form, admin_orders, admin_products, admin_shipping, auth, auth_pages,
+        cart, checkout, home, i18n, media, oauth2,
         shop,
     },
     initializers,
@@ -68,6 +69,12 @@ impl Hooks for App {
             .layer(axum::middleware::from_fn_with_state(
                 ctx.clone(),
                 crate::shared::rbac::inject_subject,
+            ))
+            // CSRF runs outermost so it validates the double-submit token before
+            // any handler sees the request and stamps the cookie on safe ones.
+            .layer(axum::middleware::from_fn_with_state(
+                ctx.clone(),
+                crate::shared::csrf::protect,
             )))
     }
 
@@ -98,8 +105,10 @@ impl Hooks for App {
             // admin
             .add_route(admin_dashboard::routes())
             .add_route(admin_products::routes())
+            .add_route(admin_discount_profiles::routes())
             .add_route(admin_categories::routes())
             .add_route(admin_orders::routes())
+            .add_route(admin_customers::routes())
             .add_route(admin_shipping::routes())
     }
 

src/controllers/account.rs

@@ -363,6 +363,177 @@ async fn change_password(
     password_view(&v, &jar, &user, true, None)
 }
 
+// ---- Two-factor authentication (TOTP / Google Authenticator) -------------
+//
+// Entirely opt-in. The security page has three shapes, all rendered from
+// `security.html`:
+//   * disabled  -> an "enable" button,
+//   * enrolling -> the QR + a confirm-code field (secret staged, not yet on),
+//   * enabled   -> status, remaining backup codes, disable/regenerate forms.
+// Both turning 2FA off and regenerating backup codes require re-entering the
+// account password, so a walk-up attacker on an open session can't weaken it.
+
+#[derive(Debug, Deserialize)]
+struct ConfirmTotpForm {
+    code: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct PasswordConfirmForm {
+    current_password: String,
+}
+
+/// Render the security page. Exactly one of (`enrolling`, plain status) applies;
+/// `backup_codes` is non-empty only on the one render right after enabling or
+/// regenerating, where the plaintext codes are shown once.
+#[allow(clippy::too_many_arguments)]
+fn security_view(
+    v: &TeraView,
+    jar: &CookieJar,
+    user: &users::Model,
+    enrolling: bool,
+    qr: Option<&str>,
+    secret: Option<&str>,
+    backup_codes: &[String],
+    error: Option<&str>,
+) -> Result<Response> {
+    format::view(
+        v,
+        "account/security.html",
+        json!({
+            "logged_in_admin": false,
+            "logged_in_customer": true,
+            "account_nav": true,
+            "customer_name": user.name,
+            "customer_account_type": user.account_type,
+            "totp_enabled": user.totp_enabled(),
+            "enrolling": enrolling,
+            "qr": qr,
+            "secret": secret,
+            "backup_codes": backup_codes,
+            "backup_remaining": user.backup_codes_remaining(),
+            "error": error,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+/// Common guard for every security handler: a signed-in, non-admin customer.
+async fn require_customer(ctx: &AppContext, jar: &CookieJar) -> Result<users::Model> {
+    match guard::current_user(ctx, jar).await {
+        Some(user) if guard::is_admin(ctx, &user) => Err(Error::string("admin")),
+        Some(user) => Ok(user),
+        None => Err(Error::Unauthorized("login required".into())),
+    }
+}
+
+#[debug_handler]
+async fn security_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    let Some(user) = guard::current_user(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if guard::is_admin(&ctx, &user) {
+        return format::redirect("/admin/dashboard");
+    }
+    security_view(&v, &jar, &user, false, None, None, &[], None)
+}
+
+/// Stage a fresh secret and show the QR + confirm-code field.
+#[debug_handler]
+async fn enable_totp(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    let Ok(user) = require_customer(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    // Already on — nothing to enroll.
+    if user.totp_enabled() {
+        return security_view(&v, &jar, &user, false, None, None, &[], None);
+    }
+    let user = user.into_active_model().begin_totp_enrollment(&ctx.db).await?;
+    let Some((qr, secret)) = user.totp_provisioning() else {
+        return security_view(&v, &jar, &user, false, None, None, &[], Some("enroll"));
+    };
+    security_view(&v, &jar, &user, true, Some(&qr), Some(&secret), &[], None)
+}
+
+/// Verify the first code against the staged secret; on success flip 2FA on and
+/// show the one-time backup codes. On a wrong code, re-show the QR to retry.
+#[debug_handler]
+async fn confirm_totp(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<ConfirmTotpForm>,
+) -> Result<Response> {
+    let Ok(user) = require_customer(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if user.totp_enabled() {
+        return security_view(&v, &jar, &user, false, None, None, &[], None);
+    }
+    if !user.verify_totp_code(&form.code) {
+        let qr = user.totp_provisioning();
+        let (qr, secret) = match &qr {
+            Some((q, s)) => (Some(q.as_str()), Some(s.as_str())),
+            None => (None, None),
+        };
+        return security_view(&v, &jar, &user, true, qr, secret, &[], Some("code"));
+    }
+    let (user, backup_codes) = user.into_active_model().enable_totp(&ctx.db).await?;
+    security_view(&v, &jar, &user, false, None, None, &backup_codes, None)
+}
+
+/// Turn 2FA off — requires the account password as confirmation.
+#[debug_handler]
+async fn disable_totp(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<PasswordConfirmForm>,
+) -> Result<Response> {
+    let Ok(user) = require_customer(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if !user.totp_enabled() {
+        return security_view(&v, &jar, &user, false, None, None, &[], None);
+    }
+    if !user.verify_password(&form.current_password) {
+        return security_view(&v, &jar, &user, false, None, None, &[], Some("password"));
+    }
+    let user = user.into_active_model().disable_totp(&ctx.db).await?;
+    security_view(&v, &jar, &user, false, None, None, &[], None)
+}
+
+/// Issue a fresh set of backup codes (invalidating the old ones) — also gated by
+/// the account password.
+#[debug_handler]
+async fn regenerate_backup_codes(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<PasswordConfirmForm>,
+) -> Result<Response> {
+    let Ok(user) = require_customer(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+    if !user.totp_enabled() {
+        return security_view(&v, &jar, &user, false, None, None, &[], None);
+    }
+    if !user.verify_password(&form.current_password) {
+        return security_view(&v, &jar, &user, false, None, None, &[], Some("password"));
+    }
+    let (user, backup_codes) =
+        user.into_active_model().regenerate_backup_codes(&ctx.db).await?;
+    security_view(&v, &jar, &user, false, None, None, &backup_codes, None)
+}
+
 pub fn routes() -> Routes {
     Routes::new()
         .add("/account/profile", get(profile_page))
@@ -371,4 +542,9 @@ pub fn routes() -> Routes {
         .add("/account/orders/{order_number}", get(order_detail_page))
         .add("/account/password", get(change_password_page))
         .add("/account/password", post(change_password))
+        .add("/account/security", get(security_page))
+        .add("/account/security/enable", post(enable_totp))
+        .add("/account/security/confirm", post(confirm_totp))
+        .add("/account/security/disable", post(disable_totp))
+        .add("/account/security/backup-codes", post(regenerate_backup_codes))
 }

src/controllers/admin_categories.rs

@@ -49,10 +49,6 @@ async fn parse_category_fields(
         .text("name")
         .ok_or_else(|| Error::BadRequest("category name is required".to_string()))?;
     let description = form.text("description");
-    let position = form
-        .text("position")
-        .and_then(|s| s.parse::<i32>().ok())
-        .unwrap_or(0);
     let published = form.checked("published");
 
     // Resolve the chosen parent, rejecting cycles: a category may not be its
@@ -81,6 +77,28 @@ async fn parse_category_fields(
         None => None,
     };
 
+    // Position is optional: an explicit value sorts the category among its
+    // siblings, but a blank field appends it to the end of its parent's group
+    // (one past the current max), so new categories land last instead of first.
+    let position = match form.text("position").and_then(|s| s.parse::<i32>().ok()) {
+        Some(explicit) => explicit,
+        None => {
+            let mut query = categories::Entity::find();
+            query = match parent_id {
+                Some(pid) => query.filter(categories::Column::ParentId.eq(pid)),
+                None => query.filter(categories::Column::ParentId.is_null()),
+            };
+            query
+                .all(&ctx.db)
+                .await?
+                .iter()
+                .filter(|c| Some(c.id) != current_id)
+                .map(|c| c.position)
+                .max()
+                .map_or(0, |max| max + 1)
+        }
+    };
+
     let desired = form
         .text("slug")
         .map(|s| slugify(&s))

src/controllers/admin_customers.rs

@@ -0,0 +1,421 @@
+//! Admin management of business (company) accounts and their pricing.
+//!
+//! Per company the admin can: assign reusable discount profiles (the automated
+//! layer), resolve per-product collisions when two assigned profiles cover the
+//! same product, and set a manually negotiated price per product. The effective
+//! price the business pays is always resolved by [`crate::shared::pricing`]
+//! (lowest of public / automated / negotiated), shown here for reference.
+
+use std::collections::{HashMap, HashSet};
+
+use axum_extra::extract::cookie::CookieJar;
+use loco_rs::prelude::*;
+use sea_orm::{
+    ActiveModelTrait, ColumnTrait, EntityTrait, IntoActiveModel, PaginatorTrait, QueryFilter,
+    QueryOrder, Set, TransactionTrait,
+};
+use serde::Deserialize;
+use serde_json::json;
+
+use crate::{
+    controllers::i18n::current_lang,
+    models::{
+        account_discount_profiles, account_product_prices, account_product_resolutions,
+        categories, discount_profiles, product_variants, products, _entities::users,
+    },
+    shared::{
+        guard,
+        money::{format_bp, format_price, parse_price_to_cents},
+        pricing,
+    },
+    views::shop as view,
+};
+
+const COMPANY: &str = "company";
+const BUSINESS_AUDIENCE: &str = "business";
+
+#[derive(Debug, Deserialize)]
+struct PriceForm {
+    price: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct ResolutionForm {
+    profile_id: i32,
+}
+
+async fn company_by_id(ctx: &AppContext, id: i32) -> Result<users::Model> {
+    let user = users::Entity::find_by_id(id)
+        .one(&ctx.db)
+        .await?
+        .ok_or_else(|| Error::NotFound)?;
+    if user.account_type != COMPANY {
+        return Err(Error::NotFound);
+    }
+    Ok(user)
+}
+
+async fn assigned_profile_ids(ctx: &AppContext, user_id: i32) -> Result<HashSet<i32>> {
+    Ok(account_discount_profiles::Entity::find()
+        .filter(account_discount_profiles::Column::UserId.eq(user_id))
+        .all(&ctx.db)
+        .await?
+        .into_iter()
+        .map(|a| a.discount_profile_id)
+        .collect())
+}
+
+#[debug_handler]
+async fn index(
+    auth: auth::JWT,
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let companies = users::Entity::find()
+        .filter(users::Column::AccountType.eq(COMPANY))
+        .order_by_asc(users::Column::Name)
+        .all(&ctx.db)
+        .await?;
+
+    let mut rows = Vec::with_capacity(companies.len());
+    for company in &companies {
+        let negotiated = account_product_prices::Entity::find()
+            .filter(account_product_prices::Column::UserId.eq(company.id))
+            .count(&ctx.db)
+            .await?;
+        rows.push(json!({
+            "id": company.id,
+            "name": company.name,
+            "email": company.email,
+            "negotiated_count": negotiated,
+        }));
+    }
+
+    format::view(
+        &v,
+        "admin/customers/index.html",
+        json!({ "customers": rows, "lang": current_lang(&jar) }),
+    )
+}
+
+#[debug_handler]
+async fn show(
+    auth: auth::JWT,
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    Path(id): Path<i32>,
+    Query(params): Query<HashMap<String, String>>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let company = company_by_id(&ctx, id).await?;
+
+    // All profiles (for the assignment section + name lookup) and which are
+    // assigned to this company.
+    let all_profiles = discount_profiles::Entity::find()
+        .order_by_asc(discount_profiles::Column::Name)
+        .all(&ctx.db)
+        .await?;
+    let assigned = assigned_profile_ids(&ctx, company.id).await?;
+    let profiles_json: Vec<serde_json::Value> = all_profiles
+        .iter()
+        .map(|p| {
+            json!({
+                "id": p.id,
+                "name": p.name,
+                "percent": format_bp(p.percent_bp),
+                "scope_type": p.scope_type,
+                "assigned": assigned.contains(&p.id),
+            })
+        })
+        .collect();
+
+    let all_categories = categories::Entity::find()
+        .order_by_asc(categories::Column::Position)
+        .order_by_asc(categories::Column::Name)
+        .all(&ctx.db)
+        .await?;
+
+    let list = products::Entity::find()
+        .order_by_asc(products::Column::Name)
+        .all(&ctx.db)
+        .await?;
+
+    // Category sidebar tree (counts over the full, unfiltered product list) plus
+    // the active `?category=` filter applied to the rows.
+    let category_ids: Vec<Option<i32>> = list.iter().map(|p| p.category_id).collect();
+    let category_groups = view::admin_category_groups(&all_categories, &category_ids);
+    let selected_category = params
+        .get("category")
+        .map(String::as_str)
+        .unwrap_or("all")
+        .to_string();
+    let filter = view::category_filter_ids(&all_categories, &selected_category);
+
+    // Pricing is per variant. Flatten the (filtered) products into their variants
+    // in product-name then variant-position order, carrying each variant's
+    // product for the row's display name.
+    let product_ids: Vec<i32> = list.iter().map(|p| p.id).collect();
+    let grouped = product_variants::Entity::grouped_for_products(&ctx.db, &product_ids).await?;
+    let mut variant_rows: Vec<(&products::Model, product_variants::Model)> = Vec::new();
+    for product in &list {
+        if !view::category_filter_keep(&filter, product.category_id) {
+            continue;
+        }
+        if let Some(variants) = grouped.get(&product.id) {
+            for variant in variants {
+                variant_rows.push((product, variant.clone()));
+            }
+        }
+    }
+
+    // Two prices per variant:
+    // - the generic business price a freshly-registered company sees (business
+    //   baseline + business-audience profiles, no per-company deals), and
+    // - this company's effective price (its negotiated price + assigned profiles).
+    // The effective price is highlighted only when it differs from the generic one.
+    let variants_only: Vec<product_variants::Model> =
+        variant_rows.iter().map(|(_, v)| v.clone()).collect();
+    let business = pricing::audience_price_variants(&ctx, &variants_only, BUSINESS_AUDIENCE).await?;
+    let details = pricing::detail_variants(&ctx, &variants_only, Some(&company)).await?;
+
+    let rows: Vec<serde_json::Value> = variant_rows
+        .iter()
+        .zip(business.iter())
+        .zip(details.iter())
+        .map(|(((product, variant), b), d)| {
+            json!({
+                "product_id": product.id,
+                "variant_id": variant.id,
+                "name": product.name,
+                "variant_label": variant.label,
+                "currency": product.currency,
+                "regular_price": format_price(d.regular_cents),
+                "business_price": format_price(b.price_cents),
+                "business_reduced": b.price_cents < d.regular_cents,
+                "has_negotiated": d.manual_cents.is_some(),
+                "collision": d.collision,
+                "effective_price": format_price(d.price_cents),
+                "effective_differs": d.price_cents != b.price_cents,
+            })
+        })
+        .collect();
+
+    format::view(
+        &v,
+        "admin/customers/show.html",
+        json!({
+            "customer": { "id": company.id, "name": company.name, "email": company.email },
+            "profiles": profiles_json,
+            "products": rows,
+            "category_groups": category_groups,
+            "selected_category": selected_category,
+            "total_count": list.len(),
+            "uncategorized_count": category_ids.iter().filter(|c| c.is_none()).count(),
+            "error": params.get("error"),
+            "lang": current_lang(&jar),
+        }),
+    )
+}
+
+/// Dedicated per-product page for the negotiated price (and, when two assigned
+/// profiles collide, the resolution selector). Mirrors the catalog "Set discount"
+/// page but for a single company.
+#[debug_handler]
+async fn price_edit(
+    auth: auth::JWT,
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    Path((id, variant_id)): Path<(i32, i32)>,
+    Query(params): Query<HashMap<String, String>>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let company = company_by_id(&ctx, id).await?;
+    let variant = product_variants::Entity::find_by_id(variant_id)
+        .one(&ctx.db)
+        .await?
+        .ok_or_else(|| Error::NotFound)?;
+    let product = products::Entity::find_by_id(variant.product_id)
+        .one(&ctx.db)
+        .await?
+        .ok_or_else(|| Error::NotFound)?;
+
+    let business =
+        pricing::audience_price_variants(&ctx, std::slice::from_ref(&variant), BUSINESS_AUDIENCE)
+            .await?;
+    let business_cents = business[0].price_cents;
+    let detail =
+        pricing::detail_variants(&ctx, std::slice::from_ref(&variant), Some(&company)).await?;
+    let d = &detail[0];
+
+    // Names for the covering profiles, used by the collision resolution selector.
+    let covering: Vec<serde_json::Value> = if d.covering_profile_ids.is_empty() {
+        Vec::new()
+    } else {
+        let profiles = discount_profiles::Entity::find()
+            .filter(discount_profiles::Column::Id.is_in(d.covering_profile_ids.clone()))
+            .all(&ctx.db)
+            .await?;
+        let name: HashMap<i32, String> =
+            profiles.iter().map(|p| (p.id, p.name.clone())).collect();
+        d.covering_profile_ids
+            .iter()
+            .map(|pid| json!({ "id": pid, "name": name.get(pid) }))
+            .collect()
+    };
+
+    format::view(
+        &v,
+        "admin/customers/price_form.html",
+        json!({
+            "customer": { "id": company.id, "name": company.name },
+            "product": {
+                "id": product.id,
+                "variant_id": variant.id,
+                "name": product.name,
+                "variant_label": variant.label,
+                "currency": product.currency,
+                "regular_price": format_price(d.regular_cents),
+                "regular_cents": d.regular_cents,
+                "business_price": format_price(business_cents),
+                "business_reduced": business_cents < d.regular_cents,
+                "effective_price": format_price(d.price_cents),
+                "effective_differs": d.price_cents != business_cents,
+            },
+            "negotiated": d.manual_cents.map(format_price).unwrap_or_default(),
+            "has_negotiated": d.manual_cents.is_some(),
+            "collision": d.collision,
+            "covering": covering,
+            "auto_profile_id": d.auto_profile_id,
+            "error": params.get("error"),
+            "lang": current_lang(&jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn set_price(
+    auth: auth::JWT,
+    Path((id, variant_id)): Path<(i32, i32)>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<PriceForm>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let company = company_by_id(&ctx, id).await?;
+
+    let entered = form.price.trim().to_string();
+    if entered.is_empty() {
+        account_product_prices::Model::clear(&ctx.db, company.id, variant_id).await?;
+        return format::redirect(&format!("/admin/customers/{id}"));
+    }
+
+    let cents = match parse_price_to_cents(&entered) {
+        Ok(cents) if cents > 0 => cents,
+        _ => {
+            return format::redirect(&format!(
+                "/admin/customers/{id}/prices/{variant_id}/edit?error=discount-must-be-positive"
+            ))
+        }
+    };
+    account_product_prices::Model::upsert(&ctx.db, company.id, variant_id, cents).await?;
+    format::redirect(&format!("/admin/customers/{id}"))
+}
+
+#[debug_handler]
+async fn remove_price(
+    auth: auth::JWT,
+    Path((id, variant_id)): Path<(i32, i32)>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let company = company_by_id(&ctx, id).await?;
+    account_product_prices::Model::clear(&ctx.db, company.id, variant_id).await?;
+    format::redirect(&format!("/admin/customers/{id}"))
+}
+
+/// Replace the company's assigned profiles with the submitted set of checkboxes
+/// (`profile_ids`, a repeated field axum `Form` can't collect, parsed directly).
+#[debug_handler]
+async fn sync_profiles(
+    auth: auth::JWT,
+    Path(id): Path<i32>,
+    State(ctx): State<AppContext>,
+    body: String,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let company = company_by_id(&ctx, id).await?;
+
+    let profile_ids: Vec<i32> = form_urlencoded::parse(body.as_bytes())
+        .filter(|(k, _)| k == "profile_ids")
+        .filter_map(|(_, v)| v.parse::<i32>().ok())
+        .collect();
+
+    let txn = ctx.db.begin().await?;
+    account_discount_profiles::Entity::delete_many()
+        .filter(account_discount_profiles::Column::UserId.eq(company.id))
+        .exec(&txn)
+        .await?;
+    for profile_id in profile_ids {
+        account_discount_profiles::ActiveModel {
+            user_id: Set(company.id),
+            discount_profile_id: Set(profile_id),
+            ..Default::default()
+        }
+        .insert(&txn)
+        .await?;
+    }
+    txn.commit().await?;
+    format::redirect(&format!("/admin/customers/{id}"))
+}
+
+/// Record the admin's chosen winning profile for a colliding product.
+#[debug_handler]
+async fn set_resolution(
+    auth: auth::JWT,
+    Path((id, variant_id)): Path<(i32, i32)>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<ResolutionForm>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let company = company_by_id(&ctx, id).await?;
+
+    let existing = account_product_resolutions::Entity::find()
+        .filter(account_product_resolutions::Column::UserId.eq(company.id))
+        .filter(account_product_resolutions::Column::VariantId.eq(variant_id))
+        .one(&ctx.db)
+        .await?;
+    let mut active = match existing {
+        Some(row) => row.into_active_model(),
+        None => account_product_resolutions::ActiveModel {
+            user_id: Set(company.id),
+            variant_id: Set(variant_id),
+            ..Default::default()
+        },
+    };
+    active.discount_profile_id = Set(form.profile_id);
+    active.save(&ctx.db).await?;
+    format::redirect(&format!("/admin/customers/{id}"))
+}
+
+pub fn routes() -> Routes {
+    Routes::new()
+        .add("/admin/customers", get(index))
+        .add("/admin/customers/{id}", get(show))
+        .add("/admin/customers/{id}/profiles", post(sync_profiles))
+        .add(
+            "/admin/customers/{id}/prices/{variant_id}/edit",
+            get(price_edit),
+        )
+        .add("/admin/customers/{id}/prices/{variant_id}", post(set_price))
+        .add(
+            "/admin/customers/{id}/prices/{variant_id}/remove",
+            post(remove_price),
+        )
+        .add(
+            "/admin/customers/{id}/resolutions/{variant_id}",
+            post(set_resolution),
+        )
+}

src/controllers/admin_discount_profiles.rs

@@ -0,0 +1,298 @@
+//! Admin CRUD for reusable discount profiles (a named percentage over a product
+//! scope). Profiles are assigned to business accounts on the customer page; here
+//! the admin only defines them.
+
+use std::collections::HashSet;
+
+use axum_extra::extract::cookie::CookieJar;
+use loco_rs::prelude::*;
+use sea_orm::{
+    ActiveModelTrait, ColumnTrait, EntityTrait, IntoActiveModel, ModelTrait, PaginatorTrait,
+    QueryFilter, QueryOrder, Set, TransactionTrait,
+};
+use serde_json::json;
+
+use crate::{
+    controllers::i18n::current_lang,
+    models::{discount_profile_products, discount_profiles, products},
+    shared::{
+        guard,
+        money::{format_bp, parse_percent, percent_to_bp},
+    },
+};
+
+/// Scalar + repeated fields parsed from the profile form. `product_ids` is a
+/// repeated checkbox field, which `serde_urlencoded` (axum `Form`) can't collect,
+/// so the body is parsed directly.
+struct ProfileInput {
+    name: String,
+    percent: String,
+    scope_type: String,
+    product_ids: Vec<i32>,
+}
+
+fn parse_profile_form(body: &str) -> ProfileInput {
+    let mut name = String::new();
+    let mut percent = String::new();
+    let mut scope_type = discount_profiles::SCOPE_INCLUDE.to_string();
+    let mut product_ids = Vec::new();
+    for (key, value) in form_urlencoded::parse(body.as_bytes()) {
+        match key.as_ref() {
+            "name" => name = value.into_owned(),
+            "percent" => percent = value.into_owned(),
+            "scope_type" => scope_type = value.into_owned(),
+            "product_ids" => {
+                if let Ok(id) = value.parse::<i32>() {
+                    product_ids.push(id);
+                }
+            }
+            _ => {}
+        }
+    }
+    ProfileInput {
+        name,
+        percent,
+        scope_type,
+        product_ids,
+    }
+}
+
+async fn profile_by_id(ctx: &AppContext, id: i32) -> Result<discount_profiles::Model> {
+    discount_profiles::Entity::find_by_id(id)
+        .one(&ctx.db)
+        .await?
+        .ok_or_else(|| Error::NotFound)
+}
+
+#[debug_handler]
+async fn index(
+    auth: auth::JWT,
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let profiles = discount_profiles::Entity::find()
+        .order_by_asc(discount_profiles::Column::Name)
+        .all(&ctx.db)
+        .await?;
+
+    let mut rows = Vec::with_capacity(profiles.len());
+    for profile in &profiles {
+        let count = discount_profile_products::Entity::find()
+            .filter(discount_profile_products::Column::DiscountProfileId.eq(profile.id))
+            .count(&ctx.db)
+            .await?;
+        rows.push(json!({
+            "id": profile.id,
+            "name": profile.name,
+            "percent": format_bp(profile.percent_bp),
+            "scope_type": profile.scope_type,
+            "product_count": count,
+        }));
+    }
+
+    format::view(
+        &v,
+        "admin/catalog/discount_profiles.html",
+        json!({ "profiles": rows, "lang": current_lang(&jar) }),
+    )
+}
+
+/// Render the create/edit form. `profile` is null on create.
+async fn render_form(
+    ctx: &AppContext,
+    v: &TeraView,
+    jar: &CookieJar,
+    profile: Option<&discount_profiles::Model>,
+    selected: &HashSet<i32>,
+    error: Option<&str>,
+) -> Result<Response> {
+    let all_products = products::Entity::find()
+        .order_by_asc(products::Column::Name)
+        .all(&ctx.db)
+        .await?;
+    let product_rows: Vec<serde_json::Value> = all_products
+        .iter()
+        .map(|p| json!({ "id": p.id, "name": p.name, "selected": selected.contains(&p.id) }))
+        .collect();
+
+    let profile_json = match profile {
+        Some(p) => json!({
+            "id": p.id,
+            "name": p.name,
+            "percent": format_bp(p.percent_bp),
+            "scope_type": p.scope_type,
+        }),
+        None => serde_json::Value::Null,
+    };
+
+    format::view(
+        v,
+        "admin/catalog/discount_profile_form.html",
+        json!({
+            "profile": profile_json,
+            "products": product_rows,
+            "error": error,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn new(
+    auth: auth::JWT,
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    render_form(&ctx, &v, &jar, None, &HashSet::new(), None).await
+}
+
+#[debug_handler]
+async fn edit(
+    auth: auth::JWT,
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    Path(id): Path<i32>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let profile = profile_by_id(&ctx, id).await?;
+    let selected = member_ids(&ctx, id).await?;
+    render_form(&ctx, &v, &jar, Some(&profile), &selected, None).await
+}
+
+async fn member_ids(ctx: &AppContext, profile_id: i32) -> Result<HashSet<i32>> {
+    Ok(discount_profile_products::Entity::find()
+        .filter(discount_profile_products::Column::DiscountProfileId.eq(profile_id))
+        .all(&ctx.db)
+        .await?
+        .into_iter()
+        .map(|r| r.product_id)
+        .collect())
+}
+
+/// Validate the parsed form into `(name, percent_bp, scope_type)`, or an error key.
+fn validate(input: &ProfileInput) -> std::result::Result<(String, i32, String), &'static str> {
+    let name = input.name.trim().to_string();
+    if name.is_empty() {
+        return Err("profile-name-required");
+    }
+    let pct = parse_percent(&input.percent).ok_or("discount-invalid")?;
+    if pct <= 0.0 || pct >= 100.0 {
+        return Err("discount-percent-range");
+    }
+    let scope = if input.scope_type == discount_profiles::SCOPE_ALL_EXCEPT {
+        discount_profiles::SCOPE_ALL_EXCEPT
+    } else {
+        discount_profiles::SCOPE_INCLUDE
+    };
+    Ok((name, percent_to_bp(pct), scope.to_string()))
+}
+
+/// Replace a profile's product membership with `product_ids`.
+async fn sync_membership(
+    ctx: &AppContext,
+    profile_id: i32,
+    product_ids: &[i32],
+) -> Result<()> {
+    let txn = ctx.db.begin().await?;
+    discount_profile_products::Entity::delete_many()
+        .filter(discount_profile_products::Column::DiscountProfileId.eq(profile_id))
+        .exec(&txn)
+        .await?;
+    for product_id in product_ids {
+        discount_profile_products::ActiveModel {
+            discount_profile_id: Set(profile_id),
+            product_id: Set(*product_id),
+            ..Default::default()
+        }
+        .insert(&txn)
+        .await?;
+    }
+    txn.commit().await?;
+    Ok(())
+}
+
+#[debug_handler]
+async fn create(
+    auth: auth::JWT,
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    body: String,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let input = parse_profile_form(&body);
+    let (name, percent_bp, scope_type) = match validate(&input) {
+        Ok(values) => values,
+        Err(key) => {
+            let selected: HashSet<i32> = input.product_ids.iter().copied().collect();
+            return render_form(&ctx, &v, &jar, None, &selected, Some(key)).await;
+        }
+    };
+
+    let profile = discount_profiles::ActiveModel {
+        name: Set(name),
+        percent_bp: Set(percent_bp),
+        scope_type: Set(scope_type),
+        ..Default::default()
+    }
+    .insert(&ctx.db)
+    .await?;
+    sync_membership(&ctx, profile.id, &input.product_ids).await?;
+    format::redirect("/admin/catalog/discount-profiles")
+}
+
+#[debug_handler]
+async fn update(
+    auth: auth::JWT,
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    Path(id): Path<i32>,
+    State(ctx): State<AppContext>,
+    body: String,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let profile = profile_by_id(&ctx, id).await?;
+    let input = parse_profile_form(&body);
+    let (name, percent_bp, scope_type) = match validate(&input) {
+        Ok(values) => values,
+        Err(key) => {
+            let selected: HashSet<i32> = input.product_ids.iter().copied().collect();
+            return render_form(&ctx, &v, &jar, Some(&profile), &selected, Some(key)).await;
+        }
+    };
+
+    let mut active = profile.into_active_model();
+    active.name = Set(name);
+    active.percent_bp = Set(percent_bp);
+    active.scope_type = Set(scope_type);
+    active.update(&ctx.db).await?;
+    sync_membership(&ctx, id, &input.product_ids).await?;
+    format::redirect("/admin/catalog/discount-profiles")
+}
+
+#[debug_handler]
+async fn delete(
+    auth: auth::JWT,
+    Path(id): Path<i32>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    // FK cascades remove membership, assignments and resolutions.
+    profile_by_id(&ctx, id).await?.delete(&ctx.db).await?;
+    format::redirect("/admin/catalog/discount-profiles")
+}
+
+pub fn routes() -> Routes {
+    Routes::new()
+        .add("/admin/catalog/discount-profiles", get(index))
+        .add("/admin/catalog/discount-profiles/new", get(new))
+        .add("/admin/catalog/discount-profiles", post(create))
+        .add("/admin/catalog/discount-profiles/{id}/edit", get(edit))
+        .add("/admin/catalog/discount-profiles/{id}", post(update))
+        .add("/admin/catalog/discount-profiles/{id}/delete", post(delete))
+}

src/controllers/admin_form.rs

@@ -38,6 +38,23 @@ impl MultipartForm {
             Some("on" | "true" | "1")
         )
     }
+
+    /// The distinct row indices `N` present among `variants[N][...]` fields,
+    /// sorted ascending. Used to read the repeated variant rows of the product
+    /// form (each row's fields are uniquely keyed, so the HashMap keeps them all).
+    pub(crate) fn variant_indices(&self) -> Vec<usize> {
+        let mut idx: Vec<usize> = self
+            .fields
+            .keys()
+            .filter_map(|k| {
+                let rest = k.strip_prefix("variants[")?;
+                rest.split(']').next()?.parse::<usize>().ok()
+            })
+            .collect();
+        idx.sort_unstable();
+        idx.dedup();
+        idx
+    }
 }
 
 pub(crate) async fn read_multipart_form(mut multipart: Multipart) -> Result<MultipartForm> {

src/controllers/admin_products.rs

@@ -1,11 +1,20 @@
 //! Admin product CRUD.
+//!
+//! A product is a presentation grouping; its purchasable options live in
+//! `product_variants` (each with its own label, sku, stock, regular price and
+//! optional public/business quick-sale prices), edited inline on the product
+//! form. The products list and the per-audience percentage discount profiles
+//! operate at the product level, previewing prices on each product's
+//! representative (first) variant.
+
+use std::collections::{HashMap, HashSet};
 
 use axum::extract::{DefaultBodyLimit, Multipart};
 use axum_extra::extract::cookie::CookieJar;
 use loco_rs::prelude::*;
 use sea_orm::{
     ActiveModelTrait, ColumnTrait, EntityTrait, ModelTrait, PaginatorTrait, QueryFilter,
-    QueryOrder, Set,
+    QueryOrder, Set, TransactionTrait,
 };
 use serde_json::json;
 
@@ -17,13 +26,20 @@ use crate::{
     },
     shared::{
         guard,
-        money::parse_price_to_cents,
+        money::{format_bp, format_price, parse_price_to_cents},
+        pricing,
         slug::{slugify, unique_slug},
     },
-    models::{categories, product_images, products},
+    models::{
+        audience_discount_profiles, categories, discount_profiles, product_images,
+        product_variants, products,
+    },
     views::shop as view,
 };
 
+/// Which discount column an audience tab operates on.
+const BUSINESS: &str = "business";
+
 async fn product_by_id(ctx: &AppContext, id: i32) -> Result<products::Model> {
     products::Entity::find_by_id(id)
         .one(&ctx.db)
@@ -36,10 +52,7 @@ struct ProductFields {
     name: String,
     slug: String,
     description: Option<String>,
-    price_cents: i64,
     currency: String,
-    sku: Option<String>,
-    stock: i32,
     category_id: Option<i32>,
     published: bool,
 }
@@ -52,19 +65,8 @@ async fn parse_product_fields(
     let name = form
         .text("name")
         .ok_or_else(|| Error::BadRequest("product name is required".to_string()))?;
-    let price_cents = parse_price_to_cents(
-        form.text("price")
-            .ok_or_else(|| Error::BadRequest("price is required".to_string()))?
-            .as_str(),
-    )?;
     let currency = form.text("currency").unwrap_or_else(|| "EUR".to_string());
     let description = form.text("description");
-    let sku = form.text("sku");
-    let stock = form
-        .text("stock")
-        .and_then(|s| s.parse::<i32>().ok())
-        .filter(|n| *n >= 0)
-        .unwrap_or(0);
     let category_id = form.text("category_id").and_then(|s| s.parse::<i32>().ok());
     let published = form.checked("published");
 
@@ -89,15 +91,148 @@ async fn parse_product_fields(
         name,
         slug,
         description,
-        price_cents,
         currency,
-        sku,
-        stock,
         category_id,
         published,
     })
 }
 
+/// One variant row parsed from the product form.
+struct VariantInput {
+    id: Option<i32>,
+    label: String,
+    sku: Option<String>,
+    stock: i32,
+    price_cents: i64,
+    business_sale_cents: Option<i64>,
+    position: i32,
+}
+
+/// The optional business-sale price field on a variant row: blank means "no
+/// business quick-sale", a value must parse and be below the regular price.
+fn parse_optional_sale(
+    form: &MultipartForm,
+    i: usize,
+    key: &str,
+    price_cents: i64,
+) -> Result<Option<i64>> {
+    let Some(raw) = form.text(&format!("variants[{i}][{key}]")) else {
+        return Ok(None);
+    };
+    let cents = parse_price_to_cents(&raw)?;
+    if cents <= 0 || cents >= price_cents {
+        return Err(Error::BadRequest(
+            "a sale price must be positive and below the regular price".to_string(),
+        ));
+    }
+    Ok(Some(cents))
+}
+
+/// Parse the repeated variant rows from the form, in submission order. Blank
+/// rows (no price and no label) are skipped; at least one valid row is required.
+fn parse_variants(form: &MultipartForm) -> Result<Vec<VariantInput>> {
+    let mut out = Vec::new();
+    for i in form.variant_indices() {
+        let label = form
+            .text(&format!("variants[{i}][label]"))
+            .unwrap_or_default();
+        let price_raw = form.text(&format!("variants[{i}][price]"));
+
+        let Some(price_raw) = price_raw else {
+            // A completely empty leftover row is ignored; a labelled row without
+            // a price is a mistake worth reporting.
+            if label.is_empty() {
+                continue;
+            }
+            return Err(Error::BadRequest(
+                "each option needs a price".to_string(),
+            ));
+        };
+        let price_cents = parse_price_to_cents(&price_raw)?;
+        if price_cents <= 0 {
+            return Err(Error::BadRequest(
+                "an option price must be positive".to_string(),
+            ));
+        }
+
+        let sku = form.text(&format!("variants[{i}][sku]"));
+        let stock = form
+            .text(&format!("variants[{i}][stock]"))
+            .and_then(|s| s.parse::<i32>().ok())
+            .filter(|n| *n >= 0)
+            .ok_or_else(|| Error::BadRequest("each option needs a stock quantity".to_string()))?;
+        let business_sale_cents = parse_optional_sale(form, i, "business_sale", price_cents)?;
+        let id = form
+            .text(&format!("variants[{i}][id]"))
+            .and_then(|s| s.parse::<i32>().ok());
+
+        out.push(VariantInput {
+            id,
+            label,
+            sku,
+            stock,
+            price_cents,
+            business_sale_cents,
+            position: out.len() as i32,
+        });
+    }
+    if out.is_empty() {
+        return Err(Error::BadRequest(
+            "add at least one option with a price".to_string(),
+        ));
+    }
+    Ok(out)
+}
+
+/// Apply a parsed variant row onto a (new or existing) active model.
+fn apply_variant(active: &mut product_variants::ActiveModel, input: &VariantInput) {
+    active.label = Set(input.label.clone());
+    active.sku = Set(input.sku.clone());
+    active.stock = Set(input.stock);
+    active.price_cents = Set(input.price_cents);
+    // The per-variant public sale price was removed from the UI; keep it cleared.
+    active.sale_price_cents = Set(None);
+    active.business_sale_price_cents = Set(input.business_sale_cents);
+    active.position = Set(input.position);
+}
+
+/// Reconcile the product's variants with the submitted rows inside `txn`: update
+/// rows carrying an id, insert rows without one, and delete existing variants no
+/// longer present.
+async fn sync_variants<C: ConnectionTrait>(
+    txn: &C,
+    product_id: i32,
+    inputs: &[VariantInput],
+) -> Result<()> {
+    let existing = product_variants::Entity::for_product(txn, product_id).await?;
+    let keep: HashSet<i32> = inputs.iter().filter_map(|v| v.id).collect();
+    for variant in &existing {
+        if !keep.contains(&variant.id) {
+            variant.clone().delete(txn).await?;
+        }
+    }
+    let by_id: HashMap<i32, product_variants::Model> =
+        existing.into_iter().map(|v| (v.id, v)).collect();
+    for input in inputs {
+        match input.id.and_then(|id| by_id.get(&id)) {
+            Some(model) => {
+                let mut active = model.clone().into_active_model();
+                apply_variant(&mut active, input);
+                active.update(txn).await?;
+            }
+            None => {
+                let mut active = product_variants::ActiveModel {
+                    product_id: Set(product_id),
+                    ..Default::default()
+                };
+                apply_variant(&mut active, input);
+                active.insert(txn).await?;
+            }
+        }
+    }
+    Ok(())
+}
+
 async fn form_context(ctx: &AppContext, jar: &CookieJar) -> Result<serde_json::Value> {
     let categories = categories::Entity::find()
         .order_by_asc(categories::Column::Position)
@@ -107,37 +242,165 @@ async fn form_context(ctx: &AppContext, jar: &CookieJar) -> Result<serde_json::V
     Ok(json!({ "categories": categories, "lang": current_lang(jar) }))
 }
 
+/// Variant shape used to pre-fill a row of the product form's variant editor.
+fn variant_form_json(variant: &product_variants::Model) -> serde_json::Value {
+    json!({
+        "id": variant.id,
+        "label": variant.label,
+        "sku": variant.sku,
+        "stock": variant.stock,
+        "price": format_price(variant.price_cents),
+        "business_sale": variant.business_sale_price_cents.map(format_price),
+    })
+}
+
 #[debug_handler]
 async fn index(
     auth: auth::JWT,
     jar: CookieJar,
     ViewEngine(v): ViewEngine<TeraView>,
+    Query(params): Query<HashMap<String, String>>,
     State(ctx): State<AppContext>,
 ) -> Result<Response> {
     guard::current_admin(auth, &ctx).await?;
+    let audience = read_audience(&params);
+    let all_categories = categories::Entity::find()
+        .order_by_asc(categories::Column::Position)
+        .order_by_asc(categories::Column::Name)
+        .all(&ctx.db)
+        .await?;
+    let category_name: HashMap<i32, String> = all_categories
+        .iter()
+        .map(|c| (c.id, c.name.clone()))
+        .collect();
+
     let list = products::Entity::find()
         .order_by_desc(products::Column::CreatedAt)
         .all(&ctx.db)
         .await?;
-    let mut rows = Vec::new();
-    for product in list {
-        let image = product_images::first_for(&ctx, product.id).await?;
-        let category_name = match product.category_id {
-            Some(id) => categories::Entity::find_by_id(id)
-                .one(&ctx.db)
-                .await?
-                .map(|c| c.name),
-            None => None,
-        };
-        rows.push(view::product_card(&product, image, category_name));
+    let ids: Vec<i32> = list.iter().map(|p| p.id).collect();
+    let grouped = product_variants::Entity::grouped_for_products(&ctx.db, &ids).await?;
+
+    // Category sidebar tree (counts over the full, unfiltered list) plus the
+    // active `?category=` filter applied to the rows.
+    let category_ids: Vec<Option<i32>> = list.iter().map(|p| p.category_id).collect();
+    let category_groups = view::admin_category_groups(&all_categories, &category_ids);
+    let selected_category = params
+        .get("category")
+        .map(String::as_str)
+        .unwrap_or("all")
+        .to_string();
+    let filter = view::category_filter_ids(&all_categories, &selected_category);
+
+    // The kept products with their representative (first) variant, priced in one
+    // batch for the active audience.
+    let mut kept: Vec<(&products::Model, &Vec<product_variants::Model>)> = Vec::new();
+    for product in &list {
+        if !view::category_filter_keep(&filter, product.category_id) {
+            continue;
+        }
+        if let Some(variants) = grouped.get(&product.id) {
+            if !variants.is_empty() {
+                kept.push((product, variants));
+            }
+        }
     }
+    let reps: Vec<product_variants::Model> =
+        kept.iter().map(|(_, vs)| vs[0].clone()).collect();
+    let effective = pricing::audience_price_variants(&ctx, &reps, audience).await?;
+
+    let mut rows = Vec::new();
+    for ((product, variants), priced) in kept.iter().zip(effective.iter()) {
+        let image = product_images::first_for(&ctx, product.id).await?;
+        let category_name = product
+            .category_id
+            .and_then(|id| category_name.get(&id).cloned());
+        let total_stock: i32 = variants.iter().map(|v| v.stock).sum();
+        rows.push(product_row(
+            product,
+            priced,
+            variants.len(),
+            total_stock,
+            image,
+            category_name,
+        ));
+    }
+
     format::view(
         &v,
         "admin/catalog/products.html",
-        json!({ "products": rows, "lang": current_lang(&jar) }),
+        json!({
+            "products": rows,
+            "profiles": load_audience_profiles(&ctx, audience).await?,
+            "audience": audience,
+            "category_groups": category_groups,
+            "selected_category": selected_category,
+            "total_count": list.len(),
+            "uncategorized_count": category_ids.iter().filter(|c| c.is_none()).count(),
+            "lang": current_lang(&jar),
+        }),
     )
 }
 
+/// List-row shape: the product card fields plus its representative variant's
+/// resolved effective price (after the active audience's profiles) and the count
+/// of options.
+fn product_row(
+    product: &products::Model,
+    effective: &pricing::PricedProduct,
+    variant_count: usize,
+    total_stock: i32,
+    image: Option<String>,
+    category_name: Option<String>,
+) -> serde_json::Value {
+    json!({
+        "id": product.id,
+        "name": product.name,
+        "slug": product.slug,
+        "currency": product.currency,
+        "stock": total_stock,
+        "variant_count": variant_count,
+        "has_options": variant_count > 1,
+        "published": product.published,
+        "image": image,
+        "category_name": category_name,
+        "regular_price": format_price(effective.regular_cents),
+        "effective_price": format_price(effective.price_cents),
+        "effective_reduced": effective.is_reduced(),
+        "effective_percent_off": percent_off(effective.regular_cents, effective.price_cents),
+    })
+}
+
+/// All discount profiles, flagged with whether they are assigned to `audience`.
+async fn load_audience_profiles(
+    ctx: &AppContext,
+    audience: &str,
+) -> Result<Vec<serde_json::Value>> {
+    let assigned: HashSet<i32> = audience_discount_profiles::Entity::find()
+        .filter(audience_discount_profiles::Column::Audience.eq(audience))
+        .all(&ctx.db)
+        .await?
+        .into_iter()
+        .map(|a| a.discount_profile_id)
+        .collect();
+    let all_profiles = discount_profiles::Entity::find()
+        .order_by_asc(discount_profiles::Column::Name)
+        .all(&ctx.db)
+        .await?;
+    Ok(all_profiles
+        .iter()
+        .map(|p| {
+            json!({
+                "id": p.id,
+                "name": p.name,
+                "percent": format_bp(p.percent_bp),
+                "scope_type": p.scope_type,
+                "assigned": assigned.contains(&p.id),
+            })
+        })
+        .collect())
+}
+
 #[debug_handler]
 async fn new(
     auth: auth::JWT,
@@ -148,6 +411,7 @@ async fn new(
     guard::current_admin(auth, &ctx).await?;
     let mut context = form_context(&ctx, &jar).await?;
     context["product"] = serde_json::Value::Null;
+    context["variants"] = json!([]);
     format::view(&v, "admin/catalog/product_form.html", context)
 }
 
@@ -160,23 +424,23 @@ async fn create(
     guard::current_admin(auth, &ctx).await?;
     let form = read_multipart_form(multipart).await?;
     let fields = parse_product_fields(&ctx, &form, None).await?;
+    let variants = parse_variants(&form)?;
 
+    let txn = ctx.db.begin().await?;
     let product = products::ActiveModel {
         name: Set(fields.name),
         slug: Set(fields.slug),
         description: Set(fields.description),
-        price_cents: Set(fields.price_cents),
         currency: Set(fields.currency),
-        sku: Set(fields.sku),
-        stock: Set(fields.stock),
         view_count: Set(0),
         published: Set(fields.published),
         published_at: Set(fields.published.then(|| chrono::Utc::now().into())),
         category_id: Set(fields.category_id),
         ..Default::default()
     }
-    .insert(&ctx.db)
+    .insert(&txn)
     .await?;
+    sync_variants(&txn, product.id, &variants).await?;
 
     if let Some(data) = form.image {
         let filename = store_image(&ctx, data).await?;
@@ -187,9 +451,10 @@ async fn create(
             alt: Set(None),
             ..Default::default()
         }
-        .insert(&ctx.db)
+        .insert(&txn)
         .await?;
     }
+    txn.commit().await?;
 
     format::redirect("/admin/catalog/products")
 }
@@ -205,8 +470,10 @@ async fn edit(
     guard::current_admin(auth, &ctx).await?;
     let product = product_by_id(&ctx, id).await?;
     let image = product_images::first_for(&ctx, id).await?;
+    let variants = product_variants::Entity::for_product(&ctx.db, id).await?;
     let mut context = form_context(&ctx, &jar).await?;
     context["product"] = view::product_form(&product, image);
+    context["variants"] = json!(variants.iter().map(variant_form_json).collect::<Vec<_>>());
     format::view(&v, "admin/catalog/product_form.html", context)
 }
 
@@ -222,15 +489,14 @@ async fn update(
     let was_published = existing.published;
     let form = read_multipart_form(multipart).await?;
     let fields = parse_product_fields(&ctx, &form, Some(id)).await?;
+    let variants = parse_variants(&form)?;
 
+    let txn = ctx.db.begin().await?;
     let mut product = existing.into_active_model();
     product.name = Set(fields.name);
     product.slug = Set(fields.slug);
     product.description = Set(fields.description);
-    product.price_cents = Set(fields.price_cents);
     product.currency = Set(fields.currency);
-    product.sku = Set(fields.sku);
-    product.stock = Set(fields.stock);
     product.category_id = Set(fields.category_id);
     product.published = Set(fields.published);
     if fields.published && !was_published {
@@ -238,7 +504,8 @@ async fn update(
     } else if !fields.published {
         product.published_at = Set(None);
     }
-    product.update(&ctx.db).await?;
+    product.update(&txn).await?;
+    sync_variants(&txn, id, &variants).await?;
 
     if let Some(data) = form.image {
         let filename = store_image(&ctx, data).await?;
@@ -250,9 +517,10 @@ async fn update(
             alt: Set(None),
             ..Default::default()
         }
-        .insert(&ctx.db)
+        .insert(&txn)
         .await?;
     }
+    txn.commit().await?;
 
     format::redirect("/admin/catalog/products")
 }
@@ -268,6 +536,151 @@ async fn delete(
     format::redirect("/admin/catalog/products")
 }
 
+// --- Discount profiles -----------------------------------------------------
+//
+// Two audiences, switched by an `?audience=` tab on the products page:
+// - **personal** (default): what everyone sees.
+// - **business**: what company accounts see (per-company profiles/negotiated
+//   prices still layer on top; lowest price wins).
+//
+// Per-product absolute quick-sale prices live on each variant and are edited in
+// the product form. This section is only the reusable *percentage* discount
+// profiles assigned to an audience.
+
+fn read_audience(params: &HashMap<String, String>) -> &'static str {
+    match params.get("audience").map(String::as_str) {
+        Some(BUSINESS) => BUSINESS,
+        _ => "personal",
+    }
+}
+
+fn list_redirect(audience: &str) -> Result<Response> {
+    format::redirect(&format!("/admin/catalog/products?audience={audience}"))
+}
+
+/// Percent off the regular price, rounded to a whole number.
+fn percent_off(regular_cents: i64, sale_cents: i64) -> i64 {
+    if regular_cents <= 0 {
+        return 0;
+    }
+    let off = (regular_cents - sale_cents) as f64 / regular_cents as f64 * 100.0;
+    off.round() as i64
+}
+
+/// Representative (first) variant for each product in `list`, in the same order,
+/// dropping products with no variants. Returns the products kept alongside their
+/// representative variant.
+async fn representatives<'a>(
+    ctx: &AppContext,
+    list: &'a [products::Model],
+) -> Result<(Vec<&'a products::Model>, Vec<product_variants::Model>)> {
+    let ids: Vec<i32> = list.iter().map(|p| p.id).collect();
+    let grouped = product_variants::Entity::grouped_for_products(&ctx.db, &ids).await?;
+    let mut products_kept = Vec::new();
+    let mut reps = Vec::new();
+    for product in list {
+        if let Some(variants) = grouped.get(&product.id) {
+            if let Some(first) = variants.first() {
+                products_kept.push(product);
+                reps.push(first.clone());
+            }
+        }
+    }
+    Ok((products_kept, reps))
+}
+
+/// Preview the effective prices that the submitted (unsaved) checkbox set would
+/// produce, without persisting anything. Returns OOB `<span>`s that htmx swaps
+/// into the effective-price column so the admin sees the effect before Save.
+#[debug_handler]
+async fn profiles_preview(
+    auth: auth::JWT,
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    Query(params): Query<HashMap<String, String>>,
+    State(ctx): State<AppContext>,
+    body: String,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let audience = read_audience(&params);
+
+    let profile_ids: Vec<i32> = form_urlencoded::parse(body.as_bytes())
+        .filter(|(k, _)| k == "profile_ids")
+        .filter_map(|(_, value)| value.parse::<i32>().ok())
+        .collect();
+
+    let all_categories = categories::Entity::find()
+        .order_by_asc(categories::Column::Position)
+        .order_by_asc(categories::Column::Name)
+        .all(&ctx.db)
+        .await?;
+    let list = products::Entity::find()
+        .order_by_desc(products::Column::CreatedAt)
+        .all(&ctx.db)
+        .await?;
+    let (products_kept, reps) = representatives(&ctx, &list).await?;
+    let effective =
+        pricing::audience_price_variants_preview(&ctx, &reps, audience, profile_ids).await?;
+
+    let selected_category = params.get("category").map(String::as_str).unwrap_or("all");
+    let filter = view::category_filter_ids(&all_categories, selected_category);
+
+    let mut rows = Vec::new();
+    for (product, priced) in products_kept.iter().zip(effective.iter()) {
+        if !view::category_filter_keep(&filter, product.category_id) {
+            continue;
+        }
+        rows.push(json!({
+            "id": product.id,
+            "currency": product.currency,
+            "effective_price": format_price(priced.price_cents),
+            "effective_reduced": priced.is_reduced(),
+            "effective_percent_off": percent_off(priced.regular_cents, priced.price_cents),
+        }));
+    }
+
+    format::view(
+        &v,
+        "admin/catalog/_price_preview.html",
+        json!({ "products": rows, "lang": current_lang(&jar) }),
+    )
+}
+
+/// Replace the profiles applied to this audience with the submitted checkbox set
+/// (`profile_ids`, a repeated field parsed directly from the body).
+#[debug_handler]
+async fn sync_profiles(
+    auth: auth::JWT,
+    Query(params): Query<HashMap<String, String>>,
+    State(ctx): State<AppContext>,
+    body: String,
+) -> Result<Response> {
+    guard::current_admin(auth, &ctx).await?;
+    let audience = read_audience(&params);
+
+    let profile_ids: Vec<i32> = form_urlencoded::parse(body.as_bytes())
+        .filter(|(k, _)| k == "profile_ids")
+        .filter_map(|(_, value)| value.parse::<i32>().ok())
+        .collect();
+
+    let txn = ctx.db.begin().await?;
+    audience_discount_profiles::Entity::delete_many()
+        .filter(audience_discount_profiles::Column::Audience.eq(audience))
+        .exec(&txn)
+        .await?;
+    for profile_id in profile_ids {
+        audience_discount_profiles::ActiveModel {
+            audience: Set(audience.to_string()),
+            discount_profile_id: Set(profile_id),
+            ..Default::default()
+        }
+        .insert(&txn)
+        .await?;
+    }
+    txn.commit().await?;
+    list_redirect(audience)
+}
+
 pub fn routes() -> Routes {
     let image_limit = DefaultBodyLimit::max(IMAGE_MAX_BYTES + 1024 * 1024);
     Routes::new()
@@ -277,6 +690,11 @@ pub fn routes() -> Routes {
             "/admin/catalog/products",
             post(create).layer(image_limit.clone()),
         )
+        .add("/admin/catalog/products/profiles", post(sync_profiles))
+        .add(
+            "/admin/catalog/products/profiles/preview",
+            post(profiles_preview),
+        )
         .add("/admin/catalog/products/{id}/edit", get(edit))
         .add(
             "/admin/catalog/products/{id}",

src/controllers/auth.rs

@@ -13,6 +13,13 @@ use time::Duration as TimeDuration;
 
 pub static EMAIL_DOMAIN_RE: OnceLock<Regex> = OnceLock::new();
 pub(crate) const AUTH_COOKIE: &str = "auth_token";
+/// Short-lived cookie that carries a half-authenticated session between the
+/// password step and the TOTP step. It is a *separate* name from `auth_token`
+/// on purpose: the auth guards only read `auth_token`, so this cookie can never
+/// authenticate a request on its own — it only proves the password step passed.
+pub(crate) const TOTP_PENDING_COOKIE: &str = "totp_pending";
+/// How long the user has to enter their 2FA code after the password step.
+pub(crate) const TOTP_PENDING_TTL_SECS: u64 = 300;
 
 fn get_allow_email_domain_re() -> &'static Regex {
     EMAIL_DOMAIN_RE.get_or_init(|| {
@@ -38,6 +45,24 @@ pub(crate) fn clear_auth_cookie() -> Cookie<'static> {
         .build()
 }
 
+pub(crate) fn totp_pending_cookie(token: &str, max_age_seconds: u64) -> Cookie<'static> {
+    Cookie::build((TOTP_PENDING_COOKIE, token.to_string()))
+        .path("/")
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .max_age(TimeDuration::seconds(max_age_seconds as i64))
+        .build()
+}
+
+pub(crate) fn clear_totp_pending_cookie() -> Cookie<'static> {
+    Cookie::build((TOTP_PENDING_COOKIE, ""))
+        .path("/")
+        .http_only(true)
+        .same_site(SameSite::Lax)
+        .max_age(TimeDuration::seconds(0))
+        .build()
+}
+
 #[derive(Debug, Deserialize, Serialize)]
 pub struct ForgotParams {
     pub email: String,

src/controllers/auth_pages.rs

@@ -85,6 +85,23 @@ async fn login(
     }
 
     let jwt_secret = ctx.config.get_jwt_config()?;
+
+    // If the user opted into 2FA, the password is only the first factor: don't
+    // issue the real auth cookie yet. Hand out a short-lived, separate "pending"
+    // cookie and send them to the code-entry page. Everyone without 2FA logs in
+    // in a single step exactly as before.
+    if user.totp_enabled() {
+        let pending = user
+            .generate_jwt(&jwt_secret.secret, auth_controller::TOTP_PENDING_TTL_SECS)
+            .or_else(|_| unauthorized("unauthorized!"))?;
+        return format::render()
+            .cookies(&[auth_controller::totp_pending_cookie(
+                &pending,
+                auth_controller::TOTP_PENDING_TTL_SECS,
+            )])?
+            .redirect("/login/totp");
+    }
+
     let token = user
         .generate_jwt(&jwt_secret.secret, jwt_secret.expiration)
         .or_else(|_| unauthorized("unauthorized!"))?;
@@ -94,6 +111,89 @@ async fn login(
         .redirect(home_for(&ctx, &user))
 }
 
+/// Resolve the user behind a valid, unexpired `totp_pending` cookie. Returns
+/// `None` (never errors) when the cookie is missing, malformed, or expired —
+/// the caller bounces such requests back to `/login`.
+async fn user_from_pending(ctx: &AppContext, jar: &CookieJar) -> Option<users::Model> {
+    let cookie = jar.get(auth_controller::TOTP_PENDING_COOKIE)?;
+    let jwt_config = ctx.config.get_jwt_config().ok()?;
+    let claims = loco_rs::auth::jwt::JWT::new(&jwt_config.secret)
+        .validate(cookie.value())
+        .ok()?;
+    let user = users::Model::find_by_pid(&ctx.db, &claims.claims.pid).await.ok()?;
+    // Defend against a stale pending cookie outliving a 2FA disable.
+    user.totp_enabled().then_some(user)
+}
+
+fn login_totp_view(v: &TeraView, jar: &CookieJar, error: Option<&str>) -> Result<Response> {
+    format::view(
+        v,
+        "auth/login_totp.html",
+        json!({
+            "error": error,
+            "logged_in_admin": false,
+            "lang": current_lang(jar),
+        }),
+    )
+}
+
+#[debug_handler]
+async fn login_totp_page(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+) -> Result<Response> {
+    if user_from_pending(&ctx, &jar).await.is_none() {
+        return format::redirect("/login");
+    }
+    login_totp_view(&v, &jar, None)
+}
+
+/// Second login factor. Accepts either a 6-digit authenticator code or one of
+/// the one-time backup codes (auto-detected by length). On success the pending
+/// cookie is cleared and the real `auth_token` is issued.
+#[derive(Debug, serde::Deserialize)]
+struct TotpLoginForm {
+    code: String,
+}
+
+#[debug_handler]
+async fn login_totp(
+    jar: CookieJar,
+    ViewEngine(v): ViewEngine<TeraView>,
+    State(ctx): State<AppContext>,
+    Form(form): Form<TotpLoginForm>,
+) -> Result<Response> {
+    let Some(user) = user_from_pending(&ctx, &jar).await else {
+        return format::redirect("/login");
+    };
+
+    let code = form.code.trim();
+    let via_totp = user.verify_totp_code(code);
+    let via_backup = !via_totp && user.matches_backup_code(code);
+
+    if !via_totp && !via_backup {
+        return login_totp_view(&v, &jar, Some("invalid"));
+    }
+
+    // A used backup code must be burned so it can't be replayed.
+    if via_backup {
+        user.clone().into_active_model().consume_backup_code(&ctx.db, code).await?;
+    }
+
+    let jwt_secret = ctx.config.get_jwt_config()?;
+    let token = user
+        .generate_jwt(&jwt_secret.secret, jwt_secret.expiration)
+        .or_else(|_| unauthorized("unauthorized!"))?;
+
+    format::render()
+        .cookies(&[
+            auth_controller::auth_cookie(&token, jwt_secret.expiration),
+            auth_controller::clear_totp_pending_cookie(),
+        ])?
+        .redirect(home_for(&ctx, &user))
+}
+
 #[debug_handler]
 async fn register_page(
     jar: CookieJar,
@@ -366,6 +466,8 @@ pub fn routes() -> Routes {
     Routes::new()
         .add("/login", get(login_page))
         .add("/login", post(login))
+        .add("/login/totp", get(login_totp_page))
+        .add("/login/totp", post(login_totp))
         .add("/register", get(register_page))
         .add("/register", post(register))
         .add("/verify/{token}", get(verify))

src/controllers/cart.rs

@@ -1,4 +1,4 @@
-use crate::{controllers::i18n::current_lang, shared::{guard, money::format_price}, models::products};
+use crate::{controllers::i18n::current_lang, shared::{guard, money::format_price, pricing}, models::{product_variants, products}};
 use axum::{
     http::{HeaderMap, StatusCode},
     response::Redirect,
@@ -15,22 +15,22 @@ const CART_MAX_AGE_DAYS: i64 = 30;
 
 #[derive(Debug, Deserialize)]
 struct AddForm {
-    product_id: i32,
+    variant_id: i32,
     quantity: Option<i32>,
 }
 
 #[derive(Debug, Deserialize)]
 struct UpdateForm {
-    product_id: i32,
+    variant_id: i32,
     quantity: i32,
 }
 
 #[derive(Debug, Deserialize)]
 struct RemoveForm {
-    product_id: i32,
+    variant_id: i32,
 }
 
-/// Parse the `cart` cookie ("id:qty,id:qty") into `(product_id, quantity)`
+/// Parse the `cart` cookie ("id:qty,id:qty") into `(variant_id, quantity)`
 /// pairs, silently dropping malformed or non-positive entries.
 pub(crate) fn parse_cart(jar: &CookieJar) -> Vec<(i32, i32)> {
     let Some(cookie) = jar.get(CART_COOKIE) else {
@@ -64,12 +64,23 @@ fn cart_cookie(value: String) -> Cookie<'static> {
         .build()
 }
 
-/// Look up a published product, returning its current stock cap.
-async fn published_product(ctx: &AppContext, id: i32) -> Result<Option<products::Model>> {
-    Ok(products::Entity::find_by_id(id)
+/// Look up a variant whose product is published, returning the variant together
+/// with its parent product (for name/slug/currency).
+async fn published_variant(
+    ctx: &AppContext,
+    variant_id: i32,
+) -> Result<Option<(product_variants::Model, products::Model)>> {
+    let Some(variant) = product_variants::Entity::find_by_id(variant_id)
+        .one(&ctx.db)
+        .await?
+    else {
+        return Ok(None);
+    };
+    let product = products::Entity::find_by_id(variant.product_id)
         .filter(products::Column::Published.eq(true))
         .one(&ctx.db)
-        .await?)
+        .await?;
+    Ok(product.map(|p| (variant, p)))
 }
 
 #[debug_handler]
@@ -79,16 +90,16 @@ async fn add(
     headers: HeaderMap,
     Form(form): Form<AddForm>,
 ) -> Result<Response> {
-    let Some(product) = published_product(&ctx, form.product_id).await? else {
+    let Some((variant, _product)) = published_variant(&ctx, form.variant_id).await? else {
         return Err(Error::NotFound);
     };
 
     let mut items = parse_cart(&jar);
     let add_qty = form.quantity.unwrap_or(1).max(1);
-    if let Some(entry) = items.iter_mut().find(|(id, _)| *id == product.id) {
-        entry.1 = (entry.1 + add_qty).min(product.stock);
+    if let Some(entry) = items.iter_mut().find(|(id, _)| *id == variant.id) {
+        entry.1 = (entry.1 + add_qty).min(variant.stock);
     } else {
-        items.push((product.id, add_qty.min(product.stock)));
+        items.push((variant.id, add_qty.min(variant.stock)));
     }
     items.retain(|(_, qty)| *qty > 0);
 
@@ -117,14 +128,14 @@ async fn update(
     headers: HeaderMap,
     Form(form): Form<UpdateForm>,
 ) -> Result<Response> {
-    let stock = published_product(&ctx, form.product_id)
+    let stock = published_variant(&ctx, form.variant_id)
         .await?
-        .map(|p| p.stock)
+        .map(|(v, _)| v.stock)
         .unwrap_or(0);
 
     let mut items = parse_cart(&jar);
     let clamped = form.quantity.clamp(0, stock);
-    if let Some(entry) = items.iter_mut().find(|(id, _)| *id == form.product_id) {
+    if let Some(entry) = items.iter_mut().find(|(id, _)| *id == form.variant_id) {
         entry.1 = clamped;
     }
     items.retain(|(_, qty)| *qty > 0);
@@ -142,7 +153,7 @@ async fn remove(
     Form(form): Form<RemoveForm>,
 ) -> Result<Response> {
     let mut items = parse_cart(&jar);
-    items.retain(|(id, _)| *id != form.product_id);
+    items.retain(|(id, _)| *id != form.variant_id);
 
     let jar = jar.add(cart_cookie(serialize_cart(&items)));
     cart_response(&ctx, &v, jar, &headers).await
@@ -189,29 +200,43 @@ pub(crate) async fn resolve_cart(
     ctx: &AppContext,
     jar: &CookieJar,
 ) -> Result<(Vec<serde_json::Value>, Vec<(i32, i32)>, i64)> {
-    let mut lines = Vec::new();
-    let mut valid = Vec::new();
-    let mut total: i64 = 0;
-
+    // Resolve the cart entries to in-stock products first, then price them all
+    // for the current viewer in one batch (the price depends on who's logged in).
+    let user = guard::current_user(ctx, jar).await;
+    let mut items: Vec<(product_variants::Model, products::Model, i32)> = Vec::new();
     for (id, qty) in parse_cart(jar) {
-        let Some(product) = published_product(ctx, id).await? else {
+        let Some((variant, product)) = published_variant(ctx, id).await? else {
             continue;
         };
-        let qty = qty.clamp(0, product.stock);
+        let qty = qty.clamp(0, variant.stock);
         if qty == 0 {
             continue;
         }
-        let line_total = product.price_cents * i64::from(qty);
+        items.push((variant, product, qty));
+    }
+    let variants_only: Vec<product_variants::Model> =
+        items.iter().map(|(v, _, _)| v.clone()).collect();
+    let priced = pricing::price_variants(ctx, &variants_only, user.as_ref()).await?;
+
+    let mut lines = Vec::new();
+    let mut valid = Vec::new();
+    let mut total: i64 = 0;
+    for ((variant, product, qty), priced) in items.iter().zip(priced.iter()) {
+        let unit_price = priced.price_cents;
+        let line_total = unit_price * i64::from(*qty);
         total += line_total;
-        valid.push((product.id, qty));
+        valid.push((variant.id, *qty));
         lines.push(json!({
-            "id": product.id,
+            "id": variant.id,
             "name": product.name,
+            "variant_label": variant.label,
             "slug": product.slug,
-            "price": format_price(product.price_cents),
+            "price": format_price(unit_price),
+            "regular_price": format_price(priced.regular_cents),
+            "on_sale": priced.is_reduced(),
             "currency": product.currency,
             "quantity": qty,
-            "stock": product.stock,
+            "stock": variant.stock,
             "line_total": format_price(line_total),
         }));
     }

src/controllers/checkout.rs

@@ -331,6 +331,7 @@ async fn place_order(
             pickup_point_id,
             pickup_point_name,
         },
+        logged_in_customer,
     )
     .await?;
 

src/controllers/home.rs

@@ -12,8 +12,9 @@ async fn index(
     ViewEngine(v): ViewEngine<TeraView>,
     State(ctx): State<AppContext>,
 ) -> Result<Response> {
-    let products = shop::featured_products(&ctx, 8).await?;
-    let c = guard::chrome(&ctx, &jar).await;
+    let user = guard::current_user(&ctx, &jar).await;
+    let products = shop::featured_products(&ctx, user.as_ref(), 8).await?;
+    let c = guard::chrome_from(&ctx, user.as_ref());
 
     format::view(
         &v,

src/controllers/mod.rs

@@ -3,7 +3,9 @@ pub mod auth;
 pub mod auth_pages;
 pub mod oauth2;
 pub mod admin_categories;
+pub mod admin_customers;
 pub mod admin_dashboard;
+pub mod admin_discount_profiles;
 pub mod admin_form;
 pub mod admin_orders;
 pub mod admin_products;

src/controllers/shop.rs

@@ -8,17 +8,41 @@ use serde_json::json;
 
 use crate::{
     controllers::i18n::current_lang,
-    shared::guard,
-    models::{categories, product_images, products},
+    shared::{guard, pricing},
+    models::{categories, product_images, product_variants, products, users},
     views::shop as view,
 };
 
-/// Shape a list of products into card rows, loading each one's primary image.
-async fn product_rows(ctx: &AppContext, list: Vec<products::Model>) -> Result<Vec<serde_json::Value>> {
-    let mut rows = Vec::with_capacity(list.len());
-    for product in list {
+/// Shape a list of products into card rows for `user` (None = public). Each card
+/// shows the resolved price of the product's representative (first) variant; the
+/// `variant_count` lets the template render "from {price}" for multi-variant
+/// products. Products with no variants are skipped (not purchasable).
+async fn product_rows(
+    ctx: &AppContext,
+    user: Option<&users::Model>,
+    list: Vec<products::Model>,
+) -> Result<Vec<serde_json::Value>> {
+    let ids: Vec<i32> = list.iter().map(|p| p.id).collect();
+    let grouped = product_variants::Entity::grouped_for_products(&ctx.db, &ids).await?;
+
+    // Representative (first) variant per product, in list order, dropping any
+    // product that has no variants.
+    let mut entries: Vec<(&products::Model, product_variants::Model, usize)> = Vec::new();
+    for product in &list {
+        if let Some(variants) = grouped.get(&product.id) {
+            if let Some(first) = variants.first() {
+                entries.push((product, first.clone(), variants.len()));
+            }
+        }
+    }
+
+    let reps: Vec<product_variants::Model> = entries.iter().map(|(_, v, _)| v.clone()).collect();
+    let priced = pricing::price_variants(ctx, &reps, user).await?;
+
+    let mut rows = Vec::with_capacity(entries.len());
+    for ((product, rep, count), priced) in entries.iter().zip(priced.iter()) {
         let image = product_images::first_for(ctx, product.id).await?;
-        rows.push(view::product_card(&product, image, None));
+        rows.push(view::product_card(product, rep, priced, *count, image, None));
     }
     Ok(rows)
 }
@@ -27,6 +51,7 @@ async fn product_rows(ctx: &AppContext, list: Vec<products::Model>) -> Result<Ve
 /// by the home-page landing grid.
 pub(crate) async fn featured_products(
     ctx: &AppContext,
+    user: Option<&users::Model>,
     limit: u64,
 ) -> Result<Vec<serde_json::Value>> {
     let list = products::Entity::find()
@@ -35,7 +60,7 @@ pub(crate) async fn featured_products(
         .limit(limit)
         .all(&ctx.db)
         .await?;
-    product_rows(ctx, list).await
+    product_rows(ctx, user, list).await
 }
 
 /// The site-wide category sidebar, loaded lazily via htmx by the base layout so
@@ -69,12 +94,13 @@ async fn index(
         .all(&ctx.db)
         .await?;
 
-    let c = guard::chrome(&ctx, &jar).await;
+    let user = guard::current_user(&ctx, &jar).await;
+    let c = guard::chrome_from(&ctx, user.as_ref());
     format::view(
         &v,
         "shop/index.html",
         json!({
-            "products": product_rows(&ctx, list).await?,
+            "products": product_rows(&ctx, user.as_ref(), list).await?,
             "logged_in_admin": c.logged_in_admin,
             "logged_in_customer": c.logged_in_customer,
             "customer_name": c.customer_name,
@@ -112,12 +138,45 @@ async fn show(
         None => None,
     };
 
-    let c = guard::chrome(&ctx, &jar).await;
+    let user = guard::current_user(&ctx, &jar).await;
+    let variants = product_variants::Entity::for_product(&ctx.db, product.id).await?;
+    let variant_prices = pricing::price_variants(&ctx, &variants, user.as_ref()).await?;
+    let options: Vec<serde_json::Value> = variants
+        .iter()
+        .zip(variant_prices.iter())
+        .map(|(variant, priced)| view::variant_option(variant, priced))
+        .collect();
+    // The card header uses the representative (first) variant for its headline
+    // price; the picker below lets the customer switch.
+    let representative = variants.first();
+    let priced = variant_prices.first().copied();
+    let card = match (representative, priced) {
+        (Some(rep), Some(priced)) => view::product_card(
+            &product,
+            rep,
+            &priced,
+            variants.len(),
+            None,
+            category.as_ref().map(|c| c.name.clone()),
+        ),
+        // A product with no variants isn't purchasable; show it without a price.
+        _ => serde_json::json!({
+            "id": product.id,
+            "name": product.name,
+            "slug": product.slug,
+            "description": product.description,
+            "currency": product.currency,
+            "variant_count": 0,
+            "has_options": false,
+        }),
+    };
+    let c = guard::chrome_from(&ctx, user.as_ref());
     format::view(
         &v,
         "shop/show.html",
         json!({
-            "product": view::product_card(&product, None, category.as_ref().map(|c| c.name.clone())),
+            "product": card,
+            "variants": options,
             "images": images.iter().map(|i| i.image_id.clone()).collect::<Vec<_>>(),
             "category": category,
             "logged_in_admin": c.logged_in_admin,
@@ -159,7 +218,8 @@ async fn category(
         .all(&ctx.db)
         .await?;
 
-    let c = guard::chrome(&ctx, &jar).await;
+    let user = guard::current_user(&ctx, &jar).await;
+    let c = guard::chrome_from(&ctx, user.as_ref());
     format::view(
         &v,
         "shop/category.html",
@@ -167,7 +227,7 @@ async fn category(
             "category": category,
             "breadcrumbs": breadcrumbs,
             "children": children,
-            "products": product_rows(&ctx, list).await?,
+            "products": product_rows(&ctx, user.as_ref(), list).await?,
             "logged_in_admin": c.logged_in_admin,
             "logged_in_customer": c.logged_in_customer,
             "customer_name": c.customer_name,

src/initializers/view_engine.rs

@@ -6,6 +6,7 @@ use loco_rs::{
     controller::views::{engines, ViewEngine},
     Error, Result,
 };
+use std::collections::HashMap;
 use tracing::info;
 
 const I18N_DIR: &str = "assets/i18n";
@@ -23,7 +24,9 @@ impl Initializer for ViewEngineInitializer {
     }
 
     async fn after_routes(&self, router: AxumRouter, _ctx: &AppContext) -> Result<AxumRouter> {
-        let tera_engine = if std::path::Path::new(I18N_DIR).exists() {
+        // Load locales only if present; `t` is registered conditionally below so
+        // the single post-process closure covers both cases.
+        let locales = if std::path::Path::new(I18N_DIR).exists() {
             let arc = std::sync::Arc::new(
                 ArcLoader::builder(&I18N_DIR, unic_langid::langid!("sk"))
                     .shared_resources(Some(&[I18N_SHARED.into()]))
@@ -32,15 +35,28 @@ impl Initializer for ViewEngineInitializer {
                     .map_err(|e| Error::string(&e.to_string()))?,
             );
             info!("locales loaded");
-
-            engines::TeraView::build()?.post_process(move |tera| {
-                tera.register_function("t", FluentLoader::new(arc.clone()));
-                Ok(())
-            })?
+            Some(arc)
         } else {
-            engines::TeraView::build()?
+            None
         };
 
+        let tera_engine = engines::TeraView::build()?.post_process(move |tera| {
+            if let Some(arc) = &locales {
+                tera.register_function("t", FluentLoader::new(arc.clone()));
+            }
+            // `csrf_token()`: the in-flight request's CSRF token (bound by
+            // `shared::csrf::protect`), rendered into `<body hx-headers>` and
+            // `ui::csrf_field()`. Inlined so its `tera::Error` return is inferred
+            // from `register_function` — we never name a `tera` type, keeping it
+            // off our direct deps and pinned to loco's.
+            tera.register_function("csrf_token", |_args: &HashMap<String, serde_json::Value>| {
+                Ok(serde_json::Value::String(
+                    crate::shared::csrf::current_token().unwrap_or_default(),
+                ))
+            });
+            Ok(())
+        })?;
+
         Ok(router.layer(Extension(ViewEngine::from(tera_engine))))
     }
 }

src/models/_entities/account_discount_profiles.rs

@@ -0,0 +1,47 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "account_discount_profiles")]
+pub struct Model {
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub user_id: i32,
+    pub discount_profile_id: i32,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::discount_profiles::Entity",
+        from = "Column::DiscountProfileId",
+        to = "super::discount_profiles::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    DiscountProfiles,
+    #[sea_orm(
+        belongs_to = "super::users::Entity",
+        from = "Column::UserId",
+        to = "super::users::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    Users,
+}
+
+impl Related<super::discount_profiles::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::DiscountProfiles.def()
+    }
+}
+
+impl Related<super::users::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Users.def()
+    }
+}

src/models/_entities/account_product_prices.rs

@@ -0,0 +1,48 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "account_product_prices")]
+pub struct Model {
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub price_cents: i64,
+    pub user_id: i32,
+    pub variant_id: i32,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::product_variants::Entity",
+        from = "Column::VariantId",
+        to = "super::product_variants::Column::Id",
+        on_update = "NoAction",
+        on_delete = "Cascade"
+    )]
+    ProductVariants,
+    #[sea_orm(
+        belongs_to = "super::users::Entity",
+        from = "Column::UserId",
+        to = "super::users::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    Users,
+}
+
+impl Related<super::product_variants::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::ProductVariants.def()
+    }
+}
+
+impl Related<super::users::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Users.def()
+    }
+}

src/models/_entities/account_product_resolutions.rs

@@ -0,0 +1,62 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "account_product_resolutions")]
+pub struct Model {
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub user_id: i32,
+    pub discount_profile_id: i32,
+    pub variant_id: i32,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::discount_profiles::Entity",
+        from = "Column::DiscountProfileId",
+        to = "super::discount_profiles::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    DiscountProfiles,
+    #[sea_orm(
+        belongs_to = "super::product_variants::Entity",
+        from = "Column::VariantId",
+        to = "super::product_variants::Column::Id",
+        on_update = "NoAction",
+        on_delete = "Cascade"
+    )]
+    ProductVariants,
+    #[sea_orm(
+        belongs_to = "super::users::Entity",
+        from = "Column::UserId",
+        to = "super::users::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    Users,
+}
+
+impl Related<super::discount_profiles::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::DiscountProfiles.def()
+    }
+}
+
+impl Related<super::product_variants::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::ProductVariants.def()
+    }
+}
+
+impl Related<super::users::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Users.def()
+    }
+}

src/models/_entities/audience_discount_profiles.rs

@@ -0,0 +1,33 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "audience_discount_profiles")]
+pub struct Model {
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub audience: String,
+    pub discount_profile_id: i32,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::discount_profiles::Entity",
+        from = "Column::DiscountProfileId",
+        to = "super::discount_profiles::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    DiscountProfiles,
+}
+
+impl Related<super::discount_profiles::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::DiscountProfiles.def()
+    }
+}

src/models/_entities/audit_logs.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};

src/models/_entities/categories.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};
@@ -23,8 +23,6 @@ pub struct Model {
 
 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
 pub enum Relation {
-    #[sea_orm(has_many = "super::products::Entity")]
-    Products,
     #[sea_orm(
         belongs_to = "Entity",
         from = "Column::ParentId",
@@ -32,7 +30,9 @@ pub enum Relation {
         on_update = "Cascade",
         on_delete = "SetNull"
     )]
-    Parent,
+    SelfRef,
+    #[sea_orm(has_many = "super::products::Entity")]
+    Products,
 }
 
 impl Related<super::products::Entity> for Entity {

src/models/_entities/customer_profiles.rs

@@ -1,5 +1,4 @@
-//! `SeaORM` Entity for customer shipping/contact profiles. Hand-written to match
-//! the `customer_profiles` migration (1:1 with `users` via a unique `user_id`).
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};
@@ -11,18 +10,18 @@ pub struct Model {
     pub updated_at: DateTimeWithTimeZone,
     #[sea_orm(primary_key)]
     pub id: i32,
-    #[sea_orm(unique)]
-    pub user_id: i32,
-    pub company_name: Option<String>,
-    pub company_id: Option<String>,
-    pub tax_id: Option<String>,
-    pub vat_id: Option<String>,
     pub phone_prefix: Option<String>,
     pub phone: Option<String>,
     pub address: Option<String>,
     pub city: Option<String>,
     pub zip: Option<String>,
     pub country: Option<String>,
+    #[sea_orm(unique)]
+    pub user_id: i32,
+    pub company_name: Option<String>,
+    pub company_id: Option<String>,
+    pub tax_id: Option<String>,
+    pub vat_id: Option<String>,
 }
 
 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]

src/models/_entities/discount_profile_products.rs

@@ -0,0 +1,47 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "discount_profile_products")]
+pub struct Model {
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub discount_profile_id: i32,
+    pub product_id: i32,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::discount_profiles::Entity",
+        from = "Column::DiscountProfileId",
+        to = "super::discount_profiles::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    DiscountProfiles,
+    #[sea_orm(
+        belongs_to = "super::products::Entity",
+        from = "Column::ProductId",
+        to = "super::products::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    Products,
+}
+
+impl Related<super::discount_profiles::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::DiscountProfiles.def()
+    }
+}
+
+impl Related<super::products::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Products.def()
+    }
+}

src/models/_entities/discount_profiles.rs

@@ -0,0 +1,52 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "discount_profiles")]
+pub struct Model {
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub name: String,
+    pub percent_bp: i32,
+    pub scope_type: String,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(has_many = "super::account_discount_profiles::Entity")]
+    AccountDiscountProfiles,
+    #[sea_orm(has_many = "super::account_product_resolutions::Entity")]
+    AccountProductResolutions,
+    #[sea_orm(has_many = "super::audience_discount_profiles::Entity")]
+    AudienceDiscountProfiles,
+    #[sea_orm(has_many = "super::discount_profile_products::Entity")]
+    DiscountProfileProducts,
+}
+
+impl Related<super::account_discount_profiles::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::AccountDiscountProfiles.def()
+    }
+}
+
+impl Related<super::account_product_resolutions::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::AccountProductResolutions.def()
+    }
+}
+
+impl Related<super::audience_discount_profiles::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::AudienceDiscountProfiles.def()
+    }
+}
+
+impl Related<super::discount_profile_products::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::DiscountProfileProducts.def()
+    }
+}

src/models/_entities/mod.rs

@@ -1,16 +1,23 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 pub mod prelude;
 
+pub mod account_discount_profiles;
+pub mod account_product_prices;
+pub mod account_product_resolutions;
+pub mod audience_discount_profiles;
 pub mod audit_logs;
 pub mod categories;
 pub mod customer_profiles;
+pub mod discount_profile_products;
+pub mod discount_profiles;
 pub mod o_auth2_sessions;
 pub mod order_items;
 pub mod orders;
 pub mod product_images;
 pub mod product_product_tags;
 pub mod product_tags;
+pub mod product_variants;
 pub mod products;
 pub mod shipping_methods;
 pub mod users;

src/models/_entities/o_auth2_sessions.rs

@@ -1,6 +1,4 @@
-//! `SeaORM` Entity for loco-oauth2 sessions. Hand-written to match the
-//! `o_auth2_sessions` migration (the rest of `_entities/` is codegen; this table
-//! is owned by the loco-oauth2 integration).
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};
@@ -8,12 +6,13 @@ use serde::{Deserialize, Serialize};
 #[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
 #[sea_orm(table_name = "o_auth2_sessions")]
 pub struct Model {
-    pub created_at: DateTimeUtc,
-    pub updated_at: DateTimeUtc,
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
     #[sea_orm(primary_key)]
     pub id: i32,
+    #[sea_orm(unique)]
     pub session_id: String,
-    pub expires_at: DateTimeUtc,
+    pub expires_at: DateTimeWithTimeZone,
     pub user_id: i32,
 }
 

src/models/_entities/order_items.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};
@@ -15,6 +15,8 @@ pub struct Model {
     pub quantity: i32,
     pub order_id: i32,
     pub product_id: Option<i32>,
+    pub variant_label: String,
+    pub variant_id: Option<i32>,
 }
 
 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
@@ -27,6 +29,14 @@ pub enum Relation {
         on_delete = "Cascade"
     )]
     Orders,
+    #[sea_orm(
+        belongs_to = "super::product_variants::Entity",
+        from = "Column::VariantId",
+        to = "super::product_variants::Column::Id",
+        on_update = "NoAction",
+        on_delete = "SetNull"
+    )]
+    ProductVariants,
     #[sea_orm(
         belongs_to = "super::products::Entity",
         from = "Column::ProductId",
@@ -43,6 +53,12 @@ impl Related<super::orders::Entity> for Entity {
     }
 }
 
+impl Related<super::product_variants::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::ProductVariants.def()
+    }
+}
+
 impl Related<super::products::Entity> for Entity {
     fn to() -> RelationDef {
         Relation::Products.def()

src/models/_entities/orders.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};
@@ -13,17 +13,10 @@ pub struct Model {
     #[sea_orm(unique)]
     pub order_number: String,
     pub email: String,
-    pub phone: Option<String>,
     pub customer_name: Option<String>,
     pub status: String,
     pub total_cents: i64,
     pub currency: String,
-    pub user_id: Option<i32>,
-    pub account_type: String,
-    pub company_name: Option<String>,
-    pub company_id: Option<String>,
-    pub tax_id: Option<String>,
-    pub vat_id: Option<String>,
     pub address: Option<String>,
     pub city: Option<String>,
     pub zip: Option<String>,
@@ -39,6 +32,13 @@ pub struct Model {
     pub tracking_number: Option<String>,
     pub shipment_id: Option<String>,
     pub label_url: Option<String>,
+    pub phone: Option<String>,
+    pub account_type: String,
+    pub company_name: Option<String>,
+    pub company_id: Option<String>,
+    pub tax_id: Option<String>,
+    pub vat_id: Option<String>,
+    pub user_id: Option<i32>,
 }
 
 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]

src/models/_entities/prelude.rs

@@ -1,14 +1,21 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
+pub use super::account_discount_profiles::Entity as AccountDiscountProfiles;
+pub use super::account_product_prices::Entity as AccountProductPrices;
+pub use super::account_product_resolutions::Entity as AccountProductResolutions;
+pub use super::audience_discount_profiles::Entity as AudienceDiscountProfiles;
 pub use super::audit_logs::Entity as AuditLogs;
 pub use super::categories::Entity as Categories;
 pub use super::customer_profiles::Entity as CustomerProfiles;
+pub use super::discount_profile_products::Entity as DiscountProfileProducts;
+pub use super::discount_profiles::Entity as DiscountProfiles;
 pub use super::o_auth2_sessions::Entity as OAuth2Sessions;
 pub use super::order_items::Entity as OrderItems;
 pub use super::orders::Entity as Orders;
 pub use super::product_images::Entity as ProductImages;
 pub use super::product_product_tags::Entity as ProductProductTags;
 pub use super::product_tags::Entity as ProductTags;
+pub use super::product_variants::Entity as ProductVariants;
 pub use super::products::Entity as Products;
 pub use super::shipping_methods::Entity as ShippingMethods;
 pub use super::users::Entity as Users;

src/models/_entities/product_images.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};

src/models/_entities/product_product_tags.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};

src/models/_entities/product_tags.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};

src/models/_entities/product_variants.rs

@@ -0,0 +1,63 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(table_name = "product_variants")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i32,
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
+    pub product_id: i32,
+    pub label: String,
+    pub position: i32,
+    pub sku: Option<String>,
+    pub stock: i32,
+    pub price_cents: i64,
+    pub sale_price_cents: Option<i64>,
+    pub business_sale_price_cents: Option<i64>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(has_many = "super::account_product_prices::Entity")]
+    AccountProductPrices,
+    #[sea_orm(has_many = "super::account_product_resolutions::Entity")]
+    AccountProductResolutions,
+    #[sea_orm(has_many = "super::order_items::Entity")]
+    OrderItems,
+    #[sea_orm(
+        belongs_to = "super::products::Entity",
+        from = "Column::ProductId",
+        to = "super::products::Column::Id",
+        on_update = "NoAction",
+        on_delete = "Cascade"
+    )]
+    Products,
+}
+
+impl Related<super::account_product_prices::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::AccountProductPrices.def()
+    }
+}
+
+impl Related<super::account_product_resolutions::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::AccountProductResolutions.def()
+    }
+}
+
+impl Related<super::order_items::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::OrderItems.def()
+    }
+}
+
+impl Related<super::products::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Products.def()
+    }
+}

src/models/_entities/products.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};
@@ -15,10 +15,7 @@ pub struct Model {
     pub slug: String,
     #[sea_orm(column_type = "Text", nullable)]
     pub description: Option<String>,
-    pub price_cents: i64,
     pub currency: String,
-    pub sku: Option<String>,
-    pub stock: i32,
     pub view_count: i32,
     pub published: bool,
     pub published_at: Option<DateTimeWithTimeZone>,
@@ -35,12 +32,16 @@ pub enum Relation {
         on_delete = "SetNull"
     )]
     Categories,
+    #[sea_orm(has_many = "super::discount_profile_products::Entity")]
+    DiscountProfileProducts,
     #[sea_orm(has_many = "super::order_items::Entity")]
     OrderItems,
     #[sea_orm(has_many = "super::product_images::Entity")]
     ProductImages,
     #[sea_orm(has_many = "super::product_product_tags::Entity")]
     ProductProductTags,
+    #[sea_orm(has_many = "super::product_variants::Entity")]
+    ProductVariants,
 }
 
 impl Related<super::categories::Entity> for Entity {
@@ -49,6 +50,12 @@ impl Related<super::categories::Entity> for Entity {
     }
 }
 
+impl Related<super::discount_profile_products::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::DiscountProfileProducts.def()
+    }
+}
+
 impl Related<super::order_items::Entity> for Entity {
     fn to() -> RelationDef {
         Relation::OrderItems.def()
@@ -67,6 +74,12 @@ impl Related<super::product_product_tags::Entity> for Entity {
     }
 }
 
+impl Related<super::product_variants::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::ProductVariants.def()
+    }
+}
+
 impl Related<super::product_tags::Entity> for Entity {
     fn to() -> RelationDef {
         super::product_product_tags::Relation::ProductTags.def()

src/models/_entities/shipping_methods.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};

src/models/_entities/users.rs

@@ -1,4 +1,4 @@
-//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.20
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.19
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};
@@ -26,12 +26,45 @@ pub struct Model {
     pub magic_link_expiration: Option<DateTimeWithTimeZone>,
     pub theme: String,
     pub account_type: String,
+    #[sea_orm(column_type = "Text", nullable)]
+    pub totp_secret: Option<String>,
+    pub totp_enabled_at: Option<DateTimeWithTimeZone>,
+    #[sea_orm(column_type = "Text", nullable)]
+    pub totp_backup_codes: Option<String>,
 }
 
 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
 pub enum Relation {
+    #[sea_orm(has_many = "super::account_discount_profiles::Entity")]
+    AccountDiscountProfiles,
+    #[sea_orm(has_many = "super::account_product_prices::Entity")]
+    AccountProductPrices,
+    #[sea_orm(has_many = "super::account_product_resolutions::Entity")]
+    AccountProductResolutions,
     #[sea_orm(has_many = "super::audit_logs::Entity")]
     AuditLogs,
+    #[sea_orm(has_one = "super::customer_profiles::Entity")]
+    CustomerProfiles,
+    #[sea_orm(has_many = "super::o_auth2_sessions::Entity")]
+    OAuth2Sessions,
+}
+
+impl Related<super::account_discount_profiles::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::AccountDiscountProfiles.def()
+    }
+}
+
+impl Related<super::account_product_prices::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::AccountProductPrices.def()
+    }
+}
+
+impl Related<super::account_product_resolutions::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::AccountProductResolutions.def()
+    }
 }
 
 impl Related<super::audit_logs::Entity> for Entity {
@@ -39,3 +72,15 @@ impl Related<super::audit_logs::Entity> for Entity {
         Relation::AuditLogs.def()
     }
 }
+
+impl Related<super::customer_profiles::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::CustomerProfiles.def()
+    }
+}
+
+impl Related<super::o_auth2_sessions::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::OAuth2Sessions.def()
+    }
+}

src/models/account_discount_profiles.rs

@@ -0,0 +1,16 @@
+//! Assignment of a discount profile to a business account.
+
+pub use crate::models::_entities::account_discount_profiles::{ActiveModel, Column, Entity, Model};
+use sea_orm::entity::prelude::*;
+
+pub type AccountDiscountProfiles = Entity;
+
+#[async_trait::async_trait]
+impl ActiveModelBehavior for ActiveModel {
+    async fn before_save<C>(self, _db: &C, _insert: bool) -> std::result::Result<Self, DbErr>
+    where
+        C: ConnectionTrait,
+    {
+        Ok(self)
+    }
+}

src/models/account_product_prices.rs

@@ -0,0 +1,77 @@
+//! Per-account negotiated product prices: an admin-set price for one product,
+//! for one business account ("personal agreement"). One row per (user, product),
+//! kept unique by the index in the migration.
+
+pub use crate::models::_entities::account_product_prices::{ActiveModel, Column, Entity, Model};
+use sea_orm::entity::prelude::*;
+use sea_orm::{ActiveValue, IntoActiveModel, QueryFilter, TryIntoModel};
+
+pub type AccountProductPrices = Entity;
+
+#[async_trait::async_trait]
+impl ActiveModelBehavior for ActiveModel {
+    async fn before_save<C>(self, _db: &C, insert: bool) -> std::result::Result<Self, DbErr>
+    where
+        C: ConnectionTrait,
+    {
+        if !insert && self.updated_at.is_unchanged() {
+            let mut this = self;
+            this.updated_at = ActiveValue::set(chrono::Utc::now().into());
+            Ok(this)
+        } else {
+            Ok(self)
+        }
+    }
+}
+
+impl Model {
+    /// All negotiated prices for one account, as a `(variant_id -> cents)` map.
+    pub async fn map_for_user(
+        db: &DatabaseConnection,
+        user_id: i32,
+    ) -> Result<std::collections::HashMap<i32, i64>, DbErr> {
+        let rows = Entity::find()
+            .filter(Column::UserId.eq(user_id))
+            .all(db)
+            .await?;
+        Ok(rows.into_iter().map(|r| (r.variant_id, r.price_cents)).collect())
+    }
+
+    /// Insert or update the negotiated price for `(user_id, variant_id)`.
+    pub async fn upsert(
+        db: &DatabaseConnection,
+        user_id: i32,
+        variant_id: i32,
+        price_cents: i64,
+    ) -> Result<Self, DbErr> {
+        let existing = Entity::find()
+            .filter(Column::UserId.eq(user_id))
+            .filter(Column::VariantId.eq(variant_id))
+            .one(db)
+            .await?;
+        let mut active = match existing {
+            Some(row) => row.into_active_model(),
+            None => ActiveModel {
+                user_id: ActiveValue::set(user_id),
+                variant_id: ActiveValue::set(variant_id),
+                ..Default::default()
+            },
+        };
+        active.price_cents = ActiveValue::set(price_cents);
+        active.save(db).await?.try_into_model()
+    }
+
+    /// Remove the negotiated price for `(user_id, variant_id)`, if any.
+    pub async fn clear(
+        db: &DatabaseConnection,
+        user_id: i32,
+        variant_id: i32,
+    ) -> Result<(), DbErr> {
+        Entity::delete_many()
+            .filter(Column::UserId.eq(user_id))
+            .filter(Column::VariantId.eq(variant_id))
+            .exec(db)
+            .await?;
+        Ok(())
+    }
+}

src/models/account_product_resolutions.rs

@@ -0,0 +1,19 @@
+//! The chosen winning profile for an account+product when assigned profiles
+//! collide on that product.
+
+pub use crate::models::_entities::account_product_resolutions::{
+    ActiveModel, Column, Entity, Model,
+};
+use sea_orm::entity::prelude::*;
+
+pub type AccountProductResolutions = Entity;
+
+#[async_trait::async_trait]
+impl ActiveModelBehavior for ActiveModel {
+    async fn before_save<C>(self, _db: &C, _insert: bool) -> std::result::Result<Self, DbErr>
+    where
+        C: ConnectionTrait,
+    {
+        Ok(self)
+    }
+}

src/models/audience_discount_profiles.rs

@@ -0,0 +1,18 @@
+//! Discount profiles applied globally to an audience ("personal" or "business").
+
+pub use crate::models::_entities::audience_discount_profiles::{
+    ActiveModel, Column, Entity, Model,
+};
+use sea_orm::entity::prelude::*;
+
+pub type AudienceDiscountProfiles = Entity;
+
+#[async_trait::async_trait]
+impl ActiveModelBehavior for ActiveModel {
+    async fn before_save<C>(self, _db: &C, _insert: bool) -> std::result::Result<Self, DbErr>
+    where
+        C: ConnectionTrait,
+    {
+        Ok(self)
+    }
+}

src/models/discount_profile_products.rs

@@ -0,0 +1,17 @@
+//! A discount profile's product membership (meaning depends on the profile's
+//! scope: included products, or excluded ones).
+
+pub use crate::models::_entities::discount_profile_products::{ActiveModel, Column, Entity, Model};
+use sea_orm::entity::prelude::*;
+
+pub type DiscountProfileProducts = Entity;
+
+#[async_trait::async_trait]
+impl ActiveModelBehavior for ActiveModel {
+    async fn before_save<C>(self, _db: &C, _insert: bool) -> std::result::Result<Self, DbErr>
+    where
+        C: ConnectionTrait,
+    {
+        Ok(self)
+    }
+}

src/models/discount_profiles.rs

@@ -0,0 +1,42 @@
+//! Reusable discount profiles: a named percentage over a product scope, mixable
+//! across business accounts.
+
+pub use crate::models::_entities::discount_profiles::{ActiveModel, Column, Entity, Model};
+use sea_orm::entity::prelude::*;
+
+pub type DiscountProfiles = Entity;
+
+/// Scope value: the profile covers exactly the listed products.
+pub const SCOPE_INCLUDE: &str = "include";
+/// Scope value: the profile covers every product except the listed ones.
+pub const SCOPE_ALL_EXCEPT: &str = "all_except";
+
+#[async_trait::async_trait]
+impl ActiveModelBehavior for ActiveModel {
+    async fn before_save<C>(self, _db: &C, insert: bool) -> std::result::Result<Self, DbErr>
+    where
+        C: ConnectionTrait,
+    {
+        if !insert && self.updated_at.is_unchanged() {
+            let mut this = self;
+            this.updated_at = sea_orm::ActiveValue::set(chrono::Utc::now().into());
+            Ok(this)
+        } else {
+            Ok(self)
+        }
+    }
+}
+
+impl Model {
+    /// A profile covers `product_id` when its scope lists the product (include)
+    /// or does not list it (all_except). `membership` is the profile's product
+    /// id set.
+    #[must_use]
+    pub fn covers(&self, product_id: i32, membership: &std::collections::HashSet<i32>) -> bool {
+        let listed = membership.contains(&product_id);
+        match self.scope_type.as_str() {
+            SCOPE_ALL_EXCEPT => !listed,
+            _ => listed,
+        }
+    }
+}

src/models/mod.rs

@@ -6,8 +6,14 @@
 
 pub mod _entities;
 
+pub mod account_discount_profiles;
+pub mod account_product_prices;
+pub mod account_product_resolutions;
+pub mod audience_discount_profiles;
 pub mod audit_logs;
 pub mod categories;
+pub mod discount_profile_products;
+pub mod discount_profiles;
 pub mod customer_profiles;
 pub mod o_auth2_sessions;
 pub mod order_items;
@@ -18,3 +24,4 @@ pub mod product_tags;
 pub mod products;
 pub mod shipping_methods;
 pub mod users;
+pub mod product_variants;

src/models/o_auth2_sessions.rs

@@ -17,7 +17,7 @@ impl ActiveModelBehavior for ActiveModel {
     {
         if !insert && self.updated_at.is_unchanged() {
             let mut this = self;
-            this.updated_at = sea_orm::ActiveValue::Set(Utc::now());
+            this.updated_at = sea_orm::ActiveValue::Set(Utc::now().into());
             Ok(this)
         } else {
             Ok(self)
@@ -34,7 +34,7 @@ impl OAuth2SessionsTrait<users::Model> for Model {
             .one(db)
             .await?
             .ok_or_else(|| ModelError::EntityNotFound)?;
-        Ok(session.expires_at < Utc::now())
+        Ok(session.expires_at < Utc::now().fixed_offset())
     }
 
     /// Create or refresh the session row for `user` from the provider token.
@@ -58,14 +58,14 @@ impl OAuth2SessionsTrait<users::Model> for Model {
             Some(session) => {
                 let mut session: o_auth2_sessions::ActiveModel = session.into();
                 session.session_id = ActiveValue::set(session_id);
-                session.expires_at = ActiveValue::set(expires_at);
-                session.updated_at = ActiveValue::set(Utc::now());
+                session.expires_at = ActiveValue::set(expires_at.into());
+                session.updated_at = ActiveValue::set(Utc::now().into());
                 session.update(&txn).await?
             }
             None => {
                 o_auth2_sessions::ActiveModel {
                     session_id: ActiveValue::set(session_id),
-                    expires_at: ActiveValue::set(expires_at),
+                    expires_at: ActiveValue::set(expires_at.into()),
                     user_id: ActiveValue::set(user.id),
                     ..Default::default()
                 }

src/models/orders.rs

@@ -3,7 +3,9 @@ use sea_orm::entity::prelude::*;
 use sea_orm::{Set, TransactionTrait};
 use uuid::Uuid;
 
-use crate::models::_entities::{order_items, products, shipping_methods};
+use crate::models::_entities::{order_items, product_variants, products, shipping_methods};
+use crate::models::users;
+use crate::shared::pricing;
 pub use crate::models::_entities::orders::{ActiveModel, Column, Entity, Model};
 pub type Orders = Entity;
 
@@ -38,36 +40,49 @@ fn generate_order_number() -> String {
     format!("ORD-{suffix}")
 }
 
-/// Atomically place an order for the given `(product_id, quantity)` lines:
-/// snapshot each product's price/name, decrement stock (re-checking inside the
-/// transaction so an item can't oversell between cart and pay), then write the
-/// order and its line items. Returns the persisted order.
-pub async fn place(ctx: &AppContext, items: &[(i32, i32)], details: Checkout) -> Result<Model> {
+/// Atomically place an order for the given `(variant_id, quantity)` lines:
+/// snapshot each variant's price/name/label, decrement its stock (re-checking
+/// inside the transaction so an item can't oversell between cart and pay), then
+/// write the order and its line items. Returns the persisted order.
+pub async fn place(
+    ctx: &AppContext,
+    items: &[(i32, i32)],
+    details: Checkout,
+    user: Option<&users::Model>,
+) -> Result<Model> {
     let txn = ctx.db.begin().await?;
 
     let mut subtotal: i64 = 0;
     let mut currency = "EUR".to_string();
     let mut snapshots = Vec::new();
-    for (product_id, qty) in items {
-        let product = products::Entity::find_by_id(*product_id)
+    for (variant_id, qty) in items {
+        let variant = product_variants::Entity::find_by_id(*variant_id)
+            .one(&txn)
+            .await?
+            .ok_or_else(|| Error::BadRequest("an item is no longer available".to_string()))?;
+        let product = products::Entity::find_by_id(variant.product_id)
             .filter(products::Column::Published.eq(true))
             .one(&txn)
             .await?
             .ok_or_else(|| Error::BadRequest("a product is no longer available".to_string()))?;
-        if product.stock < *qty {
+        if variant.stock < *qty {
             return Err(Error::BadRequest(format!(
                 "not enough stock for {}",
                 product.name
             )));
         }
         currency = product.currency.clone();
-        subtotal += product.price_cents * i64::from(*qty);
+        // Snapshot the price the buyer actually pays — public sale or, for a
+        // business account, their negotiated/lowest price (same resolver the
+        // cart and storefront use).
+        let unit_price_cents = pricing::price_variant(ctx, &variant, user).await?.price_cents;
+        subtotal += unit_price_cents * i64::from(*qty);
 
-        let mut active = product.clone().into_active_model();
-        active.stock = Set(product.stock - *qty);
+        let mut active = variant.clone().into_active_model();
+        active.stock = Set(variant.stock - *qty);
         active.update(&txn).await?;
 
-        snapshots.push((product.id, product.name, product.price_cents, *qty));
+        snapshots.push((product.id, variant.id, product.name, variant.label, unit_price_cents, *qty));
     }
 
     let order = ActiveModel {
@@ -100,11 +115,13 @@ pub async fn place(ctx: &AppContext, items: &[(i32, i32)], details: Checkout) ->
     .insert(&txn)
     .await?;
 
-    for (product_id, name, unit_price_cents, qty) in snapshots {
+    for (product_id, variant_id, name, variant_label, unit_price_cents, qty) in snapshots {
         order_items::ActiveModel {
             order_id: Set(order.id),
             product_id: Set(Some(product_id)),
+            variant_id: Set(Some(variant_id)),
             product_name: Set(name),
+            variant_label: Set(variant_label),
             unit_price_cents: Set(unit_price_cents),
             quantity: Set(qty),
             ..Default::default()

src/models/product_variants.rs

@@ -0,0 +1,89 @@
+use sea_orm::entity::prelude::*;
+use sea_orm::QueryOrder;
+pub use super::_entities::product_variants::{ActiveModel, Column, Entity, Model};
+pub type ProductVariants = Entity;
+
+#[async_trait::async_trait]
+impl ActiveModelBehavior for ActiveModel {
+    async fn before_save<C>(self, _db: &C, insert: bool) -> std::result::Result<Self, DbErr>
+    where
+        C: ConnectionTrait,
+    {
+        if !insert && self.updated_at.is_unchanged() {
+            let mut this = self;
+            this.updated_at = sea_orm::ActiveValue::Set(chrono::Utc::now().into());
+            Ok(this)
+        } else {
+            Ok(self)
+        }
+    }
+}
+
+// implement your read-oriented logic here
+impl Model {
+    /// Whether a discount is currently active: a sale price is set and is
+    /// strictly below the regular price.
+    #[must_use]
+    pub fn on_sale(&self) -> bool {
+        matches!(self.sale_price_cents, Some(sale) if sale < self.price_cents)
+    }
+
+    /// The price actually charged: the sale price when [`Model::on_sale`],
+    /// otherwise the regular price.
+    #[must_use]
+    pub fn effective_price_cents(&self) -> i64 {
+        if self.on_sale() {
+            self.sale_price_cents.unwrap_or(self.price_cents)
+        } else {
+            self.price_cents
+        }
+    }
+
+    /// Whether a baseline business discount (for all company accounts) is set and
+    /// actually below the regular price.
+    #[must_use]
+    pub fn business_on_sale(&self) -> bool {
+        matches!(self.business_sale_price_cents, Some(sale) if sale < self.price_cents)
+    }
+}
+
+// implement your write-oriented logic here
+impl ActiveModel {}
+
+// implement your custom finders, selectors oriented logic here
+impl Entity {
+    /// All variants for one product, in display order.
+    pub async fn for_product<C: ConnectionTrait>(
+        db: &C,
+        product_id: i32,
+    ) -> Result<Vec<Model>, DbErr> {
+        Entity::find()
+            .filter(Column::ProductId.eq(product_id))
+            .order_by_asc(Column::Position)
+            .order_by_asc(Column::Id)
+            .all(db)
+            .await
+    }
+
+    /// All variants for many products in one query, grouped by `product_id` and
+    /// ordered within each group. Products with no variants are absent.
+    pub async fn grouped_for_products<C: ConnectionTrait>(
+        db: &C,
+        product_ids: &[i32],
+    ) -> Result<std::collections::HashMap<i32, Vec<Model>>, DbErr> {
+        let mut map: std::collections::HashMap<i32, Vec<Model>> = std::collections::HashMap::new();
+        if product_ids.is_empty() {
+            return Ok(map);
+        }
+        let rows = Entity::find()
+            .filter(Column::ProductId.is_in(product_ids.to_vec()))
+            .order_by_asc(Column::Position)
+            .order_by_asc(Column::Id)
+            .all(db)
+            .await?;
+        for row in rows {
+            map.entry(row.product_id).or_default().push(row);
+        }
+        Ok(map)
+    }
+}

src/models/users.rs

@@ -5,6 +5,7 @@ use loco_rs::{auth::jwt, hash, prelude::*};
 use passwords::PasswordGenerator;
 use serde::{Deserialize, Serialize};
 use serde_json::Map;
+use totp_rs::{Algorithm, Secret, TOTP};
 use uuid::Uuid;
 
 use crate::models::_entities::o_auth2_sessions;
@@ -16,6 +17,45 @@ pub const MAGIC_LINK_EXPIRATION_MIN: i8 = 5;
 /// Minimum gap between verification-email resends for one account, in seconds.
 pub const VERIFICATION_RESEND_COOLDOWN_SECS: i64 = 60;
 
+// TODO(security): `users.totp_secret` is stored as a PLAINTEXT base32 string.
+// Unlike `password` (a one-way hash) the TOTP secret must be kept in reversible
+// form — the server needs the original value to recompute codes — so it is
+// effectively password-equivalent: anyone who can read this column can mint
+// valid 2FA codes for that user. It is deliberately left in plaintext for now
+// and treated like the app's other server-side secrets (e.g. the SMTP password,
+// kept out of the DB entirely). When secrets get a proper at-rest story, encrypt
+// this column with a key held OUTSIDE the database (env / `pass`), decrypting
+// only in memory. The single read/write site is `build_totp` +
+// `begin_totp_enrollment` below; `totp_backup_codes` are already hashed and need
+// no change. Grep `TODO(security)` to find this.
+
+/// TOTP (Google Authenticator) parameters. These are the values Google
+/// Authenticator assumes; it ignores anything else encoded in the otpauth URL,
+/// so they must stay SHA1 / 6 digits / 30s or codes won't match.
+const TOTP_ISSUER: &str = "Kompress";
+const TOTP_DIGITS: usize = 6;
+/// Accept codes ±1 time-step (~30s) to tolerate client/server clock drift.
+const TOTP_SKEW: u8 = 1;
+const TOTP_STEP: u64 = 30;
+/// Number of one-time recovery codes generated when 2FA is enabled.
+pub const TOTP_BACKUP_CODE_COUNT: usize = 8;
+
+/// Build a [`TOTP`] from a stored base32 secret and the account label (email).
+/// Returns `None` if the secret can't be decoded.
+fn build_totp(secret_base32: &str, account: &str) -> Option<TOTP> {
+    let bytes = Secret::Encoded(secret_base32.to_string()).to_bytes().ok()?;
+    TOTP::new(
+        Algorithm::SHA1,
+        TOTP_DIGITS,
+        TOTP_SKEW,
+        TOTP_STEP,
+        bytes,
+        Some(TOTP_ISSUER.to_string()),
+        account.to_string(),
+    )
+    .ok()
+}
+
 #[derive(Debug, Deserialize, Serialize)]
 pub struct LoginParams {
     pub email: String,
@@ -241,6 +281,68 @@ impl Model {
         self.account_type == "company"
     }
 
+    /// Whether two-factor auth is active for this account. This is the single
+    /// source of truth used by the login flow: a secret may be present during a
+    /// half-finished enrollment, but 2FA only gates login once it is *confirmed*
+    /// (which is what sets `totp_enabled_at`).
+    #[must_use]
+    pub fn totp_enabled(&self) -> bool {
+        self.totp_enabled_at.is_some()
+    }
+
+    /// Build the [`TOTP`] for this user from its stored secret, if any.
+    fn totp(&self) -> Option<TOTP> {
+        let secret = self.totp_secret.as_deref()?;
+        build_totp(secret, &self.email)
+    }
+
+    /// A `data:image/png;base64,...` QR for the *pending* secret plus the secret
+    /// itself (shown as a manual-entry fallback). Used on the enrollment page.
+    /// Returns `None` if no secret is staged or QR rendering fails.
+    #[must_use]
+    pub fn totp_provisioning(&self) -> Option<(String, String)> {
+        let totp = self.totp()?;
+        let qr = totp.get_qr_base64().ok()?;
+        Some((
+            format!("data:image/png;base64,{qr}"),
+            self.totp_secret.clone()?,
+        ))
+    }
+
+    /// Verify a 6-digit authenticator code against the stored secret. Returns
+    /// false if no secret is staged or the code is wrong. Works both during
+    /// enrollment confirmation and at login.
+    #[must_use]
+    pub fn verify_totp_code(&self, code: &str) -> bool {
+        let code = code.trim().replace(' ', "");
+        self.totp()
+            .and_then(|t| t.check_current(&code).ok())
+            .unwrap_or(false)
+    }
+
+    /// Whether `code` matches one of the still-unused backup codes.
+    #[must_use]
+    pub fn matches_backup_code(&self, code: &str) -> bool {
+        let code = code.trim().replace([' ', '-'], "");
+        self.backup_code_hashes()
+            .iter()
+            .any(|h| hash::verify_password(&code, h))
+    }
+
+    /// The stored hashed backup codes (empty if none).
+    fn backup_code_hashes(&self) -> Vec<String> {
+        self.totp_backup_codes
+            .as_deref()
+            .and_then(|s| serde_json::from_str::<Vec<String>>(s).ok())
+            .unwrap_or_default()
+    }
+
+    /// How many unused backup codes remain.
+    #[must_use]
+    pub fn backup_codes_remaining(&self) -> usize {
+        self.backup_code_hashes().len()
+    }
+
     /// Seconds the user must still wait before another verification email may be
     /// sent — 0 means a resend is allowed now. Throttling resends off the last
     /// `email_verification_sent_at` keeps the endpoint from being an easy way to
@@ -446,6 +548,96 @@ impl ActiveModel {
         self.magic_link_expiration = ActiveValue::set(None);
         self.update(db).await.map_err(ModelError::from)
     }
+
+    /// Stage a fresh TOTP secret for enrollment. This does **not** turn 2FA on —
+    /// `totp_enabled_at` stays null until the user proves they scanned it by
+    /// confirming a code (see [`Self::enable_totp`]). Any previously staged
+    /// secret/backup codes are discarded so re-enrolling always starts clean.
+    pub async fn begin_totp_enrollment(mut self, db: &DatabaseConnection) -> ModelResult<Model> {
+        let secret = match Secret::generate_secret().to_encoded() {
+            Secret::Encoded(s) => s,
+            // generate_secret() always yields raw bytes that encode cleanly.
+            Secret::Raw(_) => unreachable!("to_encoded() returns Encoded"),
+        };
+        self.totp_secret = ActiveValue::set(Some(secret));
+        self.totp_enabled_at = ActiveValue::set(None);
+        self.totp_backup_codes = ActiveValue::set(None);
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Confirm enrollment and switch 2FA on. The caller must have already
+    /// verified a code against the staged secret. Generates and stores hashed
+    /// one-time backup codes and returns the plaintext codes to display **once**.
+    pub async fn enable_totp(
+        mut self,
+        db: &DatabaseConnection,
+    ) -> ModelResult<(Model, Vec<String>)> {
+        let (plain, hashes) = generate_backup_codes()?;
+        let encoded = serde_json::to_string(&hashes).map_err(|e| ModelError::Any(e.into()))?;
+        self.totp_enabled_at = ActiveValue::set(Some(Local::now().into()));
+        self.totp_backup_codes = ActiveValue::set(Some(encoded));
+        let model = self.update(db).await.map_err(ModelError::from)?;
+        Ok((model, plain))
+    }
+
+    /// Turn 2FA off and wipe all TOTP state. Callers gate this behind a fresh
+    /// confirmation (password or a current code).
+    pub async fn disable_totp(mut self, db: &DatabaseConnection) -> ModelResult<Model> {
+        self.totp_secret = ActiveValue::set(None);
+        self.totp_enabled_at = ActiveValue::set(None);
+        self.totp_backup_codes = ActiveValue::set(None);
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Remove a used backup code from the stored set so it can't be reused.
+    /// `code` is matched against the remaining hashes; a no-op if it doesn't
+    /// match (the caller decides whether a match was required).
+    pub async fn consume_backup_code(
+        mut self,
+        db: &DatabaseConnection,
+        code: &str,
+    ) -> ModelResult<Model> {
+        let code = code.trim().replace([' ', '-'], "");
+        let current: Vec<String> = match self.totp_backup_codes.as_ref() {
+            Some(s) => serde_json::from_str(s.as_str()).unwrap_or_default(),
+            None => Vec::new(),
+        };
+        let remaining: Vec<String> = current
+            .into_iter()
+            .filter(|h| !hash::verify_password(&code, h))
+            .collect();
+        let encoded = serde_json::to_string(&remaining).map_err(|e| ModelError::Any(e.into()))?;
+        self.totp_backup_codes = ActiveValue::set(Some(encoded));
+        self.update(db).await.map_err(ModelError::from)
+    }
+
+    /// Replace the backup codes with a fresh set (e.g. after the user used some).
+    /// Only meaningful while 2FA is enabled; returns the new plaintext codes.
+    pub async fn regenerate_backup_codes(
+        mut self,
+        db: &DatabaseConnection,
+    ) -> ModelResult<(Model, Vec<String>)> {
+        let (plain, hashes) = generate_backup_codes()?;
+        let encoded = serde_json::to_string(&hashes).map_err(|e| ModelError::Any(e.into()))?;
+        self.totp_backup_codes = ActiveValue::set(Some(encoded));
+        let model = self.update(db).await.map_err(ModelError::from)?;
+        Ok((model, plain))
+    }
+}
+
+/// Generate `TOTP_BACKUP_CODE_COUNT` recovery codes, returning
+/// `(plaintext, hashes)`. Only the hashes are persisted; the plaintext is shown
+/// to the user once and never stored.
+fn generate_backup_codes() -> ModelResult<(Vec<String>, Vec<String>)> {
+    let mut plain = Vec::with_capacity(TOTP_BACKUP_CODE_COUNT);
+    let mut hashes = Vec::with_capacity(TOTP_BACKUP_CODE_COUNT);
+    for _ in 0..TOTP_BACKUP_CODE_COUNT {
+        let code = hash::random_string(10).to_lowercase();
+        let hashed = hash::hash_password(&code).map_err(|e| ModelError::Any(e.into()))?;
+        plain.push(code);
+        hashes.push(hashed);
+    }
+    Ok((plain, hashes))
 }
 
 /// Google OpenID Connect user profile (the fields our scopes request).

src/seed.rs

@@ -4,7 +4,7 @@ use loco_rs::prelude::*;
 use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, QueryFilter, Set};
 
 use crate::{
-    models::_entities::{categories, products},
+    models::_entities::{categories, product_variants, products},
     shared::slug::slugify,
 };
 
@@ -157,14 +157,11 @@ pub async fn seed_catalog(ctx: &AppContext) -> Result<()> {
 
         let now = chrono::Utc::now();
 
-        products::ActiveModel {
+        let product = products::ActiveModel {
             name: Set(item.name.to_string()),
             slug: Set(product_slug),
             description: Set(Some(item.description.to_string())),
-            price_cents: Set(item.price_cents),
             currency: Set("EUR".to_string()),
-            sku: Set(item.sku.map(|s| s.to_string())),
-            stock: Set(item.stock),
             published: Set(true),
             published_at: Set(Some(now.into())),
             category_id: Set(category.map(|c| c.id)),
@@ -172,6 +169,20 @@ pub async fn seed_catalog(ctx: &AppContext) -> Result<()> {
         }
         .insert(&ctx.db)
         .await?;
+
+        // Each seed product ships as a single default (unlabelled) variant
+        // carrying its price/stock/sku.
+        product_variants::ActiveModel {
+            product_id: Set(product.id),
+            label: Set(String::new()),
+            position: Set(0),
+            sku: Set(item.sku.map(|s| s.to_string())),
+            stock: Set(item.stock),
+            price_cents: Set(item.price_cents),
+            ..Default::default()
+        }
+        .insert(&ctx.db)
+        .await?;
     }
 
     Ok(())

src/shared/csrf.rs

@@ -0,0 +1,304 @@
+//! Stateless CSRF protection (signed double-submit cookie).
+//!
+//! Authentication is cookie-based (the `auth_token` JWT cookie, see
+//! [`crate::shared::guard`]), so any state-changing request the browser can be
+//! tricked into making carries the victim's credentials. `SameSite=Lax` on the
+//! auth cookie already blocks the cross-site *form* POST case; this layer is the
+//! defense-in-depth on top of it.
+//!
+//! ## How it works
+//! On every safe request we ensure the browser holds a `csrf_token` cookie whose
+//! value is `<random>.<hmac>` — the HMAC is keyed by the app's JWT secret, so the
+//! server can recognise its own tokens without storing any per-session state
+//! (no session table, survives restarts and multiple instances). On every unsafe
+//! request ([`protect`]) the same token must be echoed back, either as the
+//! `X-CSRF-Token` header (htmx requests) or a `_csrf` form field (native
+//! `<form>` submits, which cannot set a custom header). Because a cross-origin
+//! attacker can neither read the cookie nor forge a valid signature, they cannot
+//! produce a matching echo.
+//!
+//! The browser side lives in the two base templates (`base.html`,
+//! `admin/base.html`): an `htmx:configRequest` hook adds the header and a
+//! `submit` hook injects the hidden `_csrf` field.
+//!
+//! `/api/*` is exempt: that subtree is the token-authenticated JSON API and the
+//! OAuth2 callback, neither of which is driven by the browser session cookie.
+
+use axum::{
+    body::{to_bytes, Body},
+    extract::{Request, State},
+    http::{header, Method, StatusCode},
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
+use bytes::Bytes;
+use hmac::{Hmac, Mac};
+use loco_rs::prelude::*;
+use sha2::Sha256;
+use subtle::ConstantTimeEq;
+use time::Duration as TimeDuration;
+use uuid::Uuid;
+
+/// Cookie that holds the signed token. Deliberately *not* `HttpOnly`: the page
+/// JS has to read it to echo it back in the header / hidden field.
+pub const CSRF_COOKIE: &str = "csrf_token";
+/// Header carrying the echoed token on htmx (and any scripted) requests.
+pub const CSRF_HEADER: &str = "x-csrf-token";
+/// Hidden form field carrying the echoed token on native `<form>` submits.
+pub const CSRF_FIELD: &str = "_csrf";
+
+/// Cookie lifetime. Long enough to outlast a normal browsing session; the token
+/// only needs to be stable, not short-lived (it is not a credential on its own).
+const COOKIE_MAX_AGE_SECS: i64 = 60 * 60 * 24 * 14;
+/// Upper bound on a body we will buffer to find the `_csrf` field. Covers the
+/// largest native multipart submit (a 10 MiB image upload plus the other
+/// fields); anything bigger is rejected rather than buffered.
+const MAX_BODY_BYTES: usize = 16 * 1024 * 1024;
+
+tokio::task_local! {
+    /// CSRF token bound to the in-flight request. [`protect`] sets it so the
+    /// `csrf_token()` Tera function can render it into pages (the `hx-headers`
+    /// on `<body>` and the `ui::csrf_field()` hidden input) without every
+    /// controller having to thread it through the view context.
+    static REQUEST_TOKEN: String;
+}
+
+/// The CSRF token for the current request task, if one is bound. Returns `None`
+/// outside a request (e.g. a mailer rendering a template). Used by the
+/// `csrf_token()` Tera function registered in the view engine.
+#[must_use]
+pub fn current_token() -> Option<String> {
+    REQUEST_TOKEN.try_with(String::clone).ok()
+}
+
+type HmacSha256 = Hmac<Sha256>;
+
+fn to_hex(bytes: &[u8]) -> String {
+    let mut s = String::with_capacity(bytes.len() * 2);
+    for b in bytes {
+        s.push_str(&format!("{b:02x}"));
+    }
+    s
+}
+
+/// HMAC-SHA256 of the random part, keyed by the app secret.
+fn sign(secret: &str, random: &str) -> String {
+    let mut mac =
+        HmacSha256::new_from_slice(secret.as_bytes()).expect("HMAC accepts a key of any length");
+    mac.update(random.as_bytes());
+    to_hex(&mac.finalize().into_bytes())
+}
+
+/// Mint a fresh `<random>.<hmac>` token.
+pub fn make_token(secret: &str) -> String {
+    let random = Uuid::new_v4().simple().to_string();
+    let sig = sign(secret, &random);
+    format!("{random}.{sig}")
+}
+
+/// True when `token` is well-formed and its signature is the one this server
+/// would produce — i.e. it is one of *our* tokens, not an attacker-injected one.
+fn signature_valid(secret: &str, token: &str) -> bool {
+    let Some((random, sig)) = token.split_once('.') else {
+        return false;
+    };
+    let expected = sign(secret, random);
+    expected.as_bytes().ct_eq(sig.as_bytes()).into()
+}
+
+/// Constant-time equality of two full tokens (the double-submit comparison).
+fn tokens_match(a: &str, b: &str) -> bool {
+    a.as_bytes().ct_eq(b.as_bytes()).into()
+}
+
+fn issue_cookie(token: String) -> Cookie<'static> {
+    Cookie::build((CSRF_COOKIE, token))
+        .path("/")
+        .http_only(false)
+        .same_site(SameSite::Lax)
+        .max_age(TimeDuration::seconds(COOKIE_MAX_AGE_SECS))
+        .build()
+}
+
+fn forbidden(reason: &str) -> Response {
+    tracing::debug!(reason, "CSRF check rejected request");
+    (StatusCode::FORBIDDEN, "CSRF validation failed").into_response()
+}
+
+/// Attach the given token to an outgoing response as the `csrf_token` cookie.
+fn attach_cookie(res: &mut Response, token: &str) {
+    let cookie = issue_cookie(token.to_string());
+    if let Ok(value) = cookie.encoded().to_string().parse() {
+        res.headers_mut().append(header::SET_COOKIE, value);
+    }
+}
+
+/// Pull the `_csrf` value out of an `application/x-www-form-urlencoded` body.
+fn field_from_urlencoded(bytes: &[u8]) -> Option<String> {
+    form_urlencoded::parse(bytes)
+        .find(|(k, _)| k == CSRF_FIELD)
+        .map(|(_, v)| v.into_owned())
+}
+
+/// Pull the `_csrf` value out of a `multipart/form-data` body. Parses a *copy*
+/// of the buffered bytes purely to read the field; the original bytes are still
+/// forwarded to the handler unchanged.
+async fn field_from_multipart(content_type: &str, bytes: Bytes) -> Option<String> {
+    let boundary = multer::parse_boundary(content_type).ok()?;
+    let stream = futures_util::stream::once(async move { Ok::<_, std::io::Error>(bytes) });
+    let mut multipart = multer::Multipart::new(stream, boundary);
+    while let Ok(Some(field)) = multipart.next_field().await {
+        if field.name() == Some(CSRF_FIELD) {
+            return field.text().await.ok();
+        }
+    }
+    None
+}
+
+/// CSRF enforcement middleware. Safe methods get a token cookie (minted if
+/// missing); unsafe methods must echo a valid, matching token. See the module
+/// docs for the full scheme.
+pub async fn protect(
+    State(ctx): State<AppContext>,
+    jar: CookieJar,
+    req: Request,
+    next: Next,
+) -> Response {
+    // The token is keyed by the JWT secret. If no secret is configured we cannot
+    // validate, so fail open rather than 403 the whole site — the same secret is
+    // already required for auth to work at all.
+    let Ok(jwt) = ctx.config.get_jwt_config() else {
+        return next.run(req).await;
+    };
+    let secret = jwt.secret.clone();
+
+    // The token the browser currently holds, accepted only if untampered.
+    let cookie_token = jar
+        .get(CSRF_COOKIE)
+        .map(|c| c.value().to_string())
+        .filter(|t| signature_valid(&secret, t));
+
+    let is_safe = matches!(
+        *req.method(),
+        Method::GET | Method::HEAD | Method::OPTIONS | Method::TRACE
+    );
+    // Token-auth JSON API + OAuth2 callback: not browser-cookie-driven.
+    let exempt = req.uri().path().starts_with("/api/");
+
+    if is_safe || exempt {
+        // Bind a token for the page to render even on the very first visit, and
+        // persist that same token in the cookie so the later submit matches.
+        let token = cookie_token.clone().unwrap_or_else(|| make_token(&secret));
+        let mut res = REQUEST_TOKEN.scope(token.clone(), next.run(req)).await;
+        if cookie_token.is_none() {
+            attach_cookie(&mut res, &token);
+        }
+        return res;
+    }
+
+    // ---- unsafe, non-exempt: require a valid double-submit ----
+    let Some(expected) = cookie_token else {
+        return forbidden("missing or tampered CSRF cookie");
+    };
+
+    // htmx and other scripted requests send the token as a header; prefer it so
+    // we never have to touch the body.
+    let header_token = req
+        .headers()
+        .get(CSRF_HEADER)
+        .and_then(|v| v.to_str().ok())
+        .map(str::to_string);
+    if let Some(header_token) = header_token {
+        if tokens_match(&header_token, &expected) {
+            return REQUEST_TOKEN.scope(expected, next.run(req)).await;
+        }
+        return forbidden("CSRF header did not match cookie");
+    }
+
+    // Native <form> submit: the token is a `_csrf` body field. Buffer the body,
+    // read the field from a copy, then forward the original bytes untouched.
+    let content_type = req
+        .headers()
+        .get(header::CONTENT_TYPE)
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("")
+        .to_string();
+
+    let (parts, body) = req.into_parts();
+    let Ok(bytes) = to_bytes(body, MAX_BODY_BYTES).await else {
+        return forbidden("request body too large to validate CSRF");
+    };
+
+    let submitted = if content_type.starts_with("application/x-www-form-urlencoded") {
+        field_from_urlencoded(&bytes)
+    } else if content_type.starts_with("multipart/form-data") {
+        field_from_multipart(&content_type, bytes.clone()).await
+    } else {
+        None
+    };
+
+    let valid = submitted
+        .as_deref()
+        .is_some_and(|t| tokens_match(t, &expected));
+    if !valid {
+        return forbidden("missing or non-matching CSRF form field");
+    }
+
+    let req = Request::from_parts(parts, Body::from(bytes));
+    REQUEST_TOKEN.scope(expected, next.run(req)).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const SECRET: &str = "test-secret";
+
+    #[test]
+    fn fresh_token_validates() {
+        let token = make_token(SECRET);
+        assert!(signature_valid(SECRET, &token));
+    }
+
+    #[test]
+    fn tampered_or_foreign_token_rejected() {
+        let token = make_token(SECRET);
+        // Flip the random part but keep the old signature.
+        let (_, sig) = token.split_once('.').unwrap();
+        let forged = format!("{}.{sig}", Uuid::new_v4().simple());
+        assert!(!signature_valid(SECRET, &forged));
+        // A token minted under a different secret is not ours.
+        assert!(!signature_valid(SECRET, &make_token("other-secret")));
+        // Malformed input never validates.
+        assert!(!signature_valid(SECRET, "no-dot-here"));
+    }
+
+    #[test]
+    fn double_submit_compare() {
+        let token = make_token(SECRET);
+        assert!(tokens_match(&token, &token.clone()));
+        assert!(!tokens_match(&token, &make_token(SECRET)));
+    }
+
+    #[test]
+    fn extract_field_from_urlencoded() {
+        let body = b"email=a%40b.com&_csrf=abc.def&password=x";
+        assert_eq!(field_from_urlencoded(body), Some("abc.def".to_string()));
+        assert_eq!(field_from_urlencoded(b"email=x"), None);
+    }
+
+    #[tokio::test]
+    async fn extract_field_from_multipart() {
+        let boundary = "X-BOUNDARY";
+        let content_type = format!("multipart/form-data; boundary={boundary}");
+        let body = format!(
+            "--{b}\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\nWidget\r\n\
+             --{b}\r\nContent-Disposition: form-data; name=\"_csrf\"\r\n\r\nabc.def\r\n\
+             --{b}--\r\n",
+            b = boundary
+        );
+        let got = field_from_multipart(&content_type, Bytes::from(body)).await;
+        assert_eq!(got, Some("abc.def".to_string()));
+    }
+}

src/shared/guard.rs

@@ -59,15 +59,21 @@ pub struct Chrome {
 }
 
 pub async fn chrome(ctx: &AppContext, jar: &CookieJar) -> Chrome {
-    match current_user(ctx, jar).await {
-        Some(user) if is_admin(ctx, &user) => Chrome {
+    chrome_from(ctx, current_user(ctx, jar).await.as_ref())
+}
+
+/// Same as [`chrome`] but from an already-loaded user, so a handler that needs
+/// the user model (e.g. for pricing) can resolve chrome without a second lookup.
+pub fn chrome_from(ctx: &AppContext, user: Option<&users::Model>) -> Chrome {
+    match user {
+        Some(user) if is_admin(ctx, user) => Chrome {
             logged_in_admin: true,
             ..Default::default()
         },
         Some(user) => Chrome {
             logged_in_customer: true,
-            customer_name: Some(user.name),
-            customer_account_type: Some(user.account_type),
+            customer_name: Some(user.name.clone()),
+            customer_account_type: Some(user.account_type.clone()),
             ..Default::default()
         },
         None => Chrome::default(),

src/shared/mod.rs

@@ -1,7 +1,9 @@
 //! Cross-cutting helpers used across feature slices.
 
+pub mod csrf;
 pub mod guard;
 pub mod money;
+pub mod pricing;
 pub mod rbac;
 pub mod settings;
 pub mod slug;

src/shared/money.rs

@@ -34,3 +34,41 @@ pub fn parse_price_to_cents(value: &str) -> Result<i64> {
 pub fn format_price(cents: i64) -> String {
     format!("{}.{:02}", cents / 100, (cents % 100).abs())
 }
+
+/// Parse a percentage typed as "20", "20.5" or "20,5" into an `f64`. Returns
+/// `None` for anything non-numeric or non-finite.
+#[must_use]
+pub fn parse_percent(value: &str) -> Option<f64> {
+    let parsed: f64 = value.trim().replace(',', ".").parse().ok()?;
+    parsed.is_finite().then_some(parsed)
+}
+
+/// Convert a percentage to basis points (5% -> 500), rounded to the nearest bp.
+#[must_use]
+pub fn percent_to_bp(percent: f64) -> i32 {
+    (percent * 100.0).round() as i32
+}
+
+/// Render basis points as a human percentage string, e.g. `550` -> `"5.5"`,
+/// `500` -> `"5"`.
+#[must_use]
+pub fn format_bp(bp: i32) -> String {
+    let whole = bp / 100;
+    let frac = (bp % 100).abs();
+    if frac == 0 {
+        whole.to_string()
+    } else if frac % 10 == 0 {
+        format!("{whole}.{}", frac / 10)
+    } else {
+        format!("{whole}.{frac:02}")
+    }
+}
+
+/// Apply a basis-point discount to a price in minor units, rounding the discount
+/// amount to the nearest cent. Never returns more than `cents`.
+#[must_use]
+pub fn apply_discount_bp(cents: i64, percent_bp: i32) -> i64 {
+    let bp = percent_bp.max(0) as i128;
+    let discount = (cents as i128 * bp + 5000) / 10000; // round half up
+    (cents - discount as i64).max(0)
+}

src/shared/pricing.rs

@@ -0,0 +1,477 @@
+//! Single source of truth for the price a given viewer pays for a product, so
+//! the storefront, cart, and placed orders always agree.
+//!
+//! Layers, all combined by "lowest wins":
+//! - **Personal price** (everyone, incl. anonymous): the lower of the regular
+//!   price, the public sale (`products.sale_price_cents`), and any discount
+//!   profiles assigned to the *personal* audience on the discounts page.
+//! - **Business price** (company accounts): the lower of the personal price, the
+//!   global business baseline (`products.business_sale_price_cents`), discount
+//!   profiles assigned to the *business* audience, the company's own assigned
+//!   profiles, and the company's manually negotiated price.
+//!
+//! A company therefore always pays the lowest of personal vs business.
+
+use std::collections::{HashMap, HashSet};
+
+use loco_rs::prelude::*;
+use sea_orm::{ColumnTrait, EntityTrait, QueryFilter};
+
+use crate::models::{
+    account_discount_profiles, account_product_prices, account_product_resolutions,
+    audience_discount_profiles, discount_profile_products, discount_profiles, product_variants,
+    users,
+};
+use crate::shared::money::apply_discount_bp;
+
+/// `account_type` value that unlocks business pricing.
+const COMPANY: &str = "company";
+const AUDIENCE_PERSONAL: &str = "personal";
+const AUDIENCE_BUSINESS: &str = "business";
+
+/// The resolved price for one product and one viewer (the slim shape templates
+/// and the cart use).
+#[derive(Debug, Clone, Copy)]
+pub struct PricedProduct {
+    pub price_cents: i64,
+    pub regular_cents: i64,
+    /// True when a business-specific deal (not just the personal price) won.
+    pub is_business: bool,
+}
+
+impl PricedProduct {
+    #[must_use]
+    pub fn is_reduced(&self) -> bool {
+        self.price_cents < self.regular_cents
+    }
+}
+
+/// Full breakdown for one product and one viewer, used by the admin company page.
+#[derive(Debug, Clone)]
+pub struct PriceDetail {
+    pub regular_cents: i64,
+    /// The personal price (what non-business viewers pay).
+    pub public_cents: i64,
+    pub manual_cents: Option<i64>,
+    pub auto_cents: Option<i64>,
+    pub auto_profile_id: Option<i32>,
+    pub covering_profile_ids: Vec<i32>,
+    pub collision: bool,
+    pub price_cents: i64,
+    pub is_business: bool,
+}
+
+impl PriceDetail {
+    fn public_only(regular_cents: i64, public_cents: i64) -> Self {
+        Self {
+            regular_cents,
+            public_cents,
+            manual_cents: None,
+            auto_cents: None,
+            auto_profile_id: None,
+            covering_profile_ids: Vec::new(),
+            collision: false,
+            price_cents: public_cents,
+            is_business: false,
+        }
+    }
+
+    #[must_use]
+    pub fn priced(&self) -> PricedProduct {
+        PricedProduct {
+            price_cents: self.price_cents,
+            regular_cents: self.regular_cents,
+            is_business: self.is_business,
+        }
+    }
+}
+
+/// The "lowest wins" decision: take the business price only when it is at or
+/// below the personal price. Pure, so it is unit-tested directly.
+fn decide(regular_cents: i64, personal_cents: i64, business: Option<i64>) -> PricedProduct {
+    match business {
+        Some(b) if b <= personal_cents => PricedProduct {
+            price_cents: b,
+            regular_cents,
+            is_business: true,
+        },
+        _ => PricedProduct {
+            price_cents: personal_cents,
+            regular_cents,
+            is_business: false,
+        },
+    }
+}
+
+fn is_company(user: Option<&users::Model>) -> bool {
+    matches!(user, Some(u) if u.account_type == COMPANY)
+}
+
+/// `min` of `Option`s, ignoring `None`s.
+fn lowest(values: [Option<i64>; 4]) -> Option<i64> {
+    values.into_iter().flatten().min()
+}
+
+/// A set of discount profiles plus their product membership, with the logic to
+/// price a product against them.
+struct LoadedProfiles {
+    profiles: Vec<discount_profiles::Model>,
+    membership: HashMap<i32, HashSet<i32>>,
+}
+
+impl LoadedProfiles {
+    fn empty() -> Self {
+        Self {
+            profiles: Vec::new(),
+            membership: HashMap::new(),
+        }
+    }
+
+    /// The best (lowest) price any covering profile produces off the regular
+    /// price, or `None` when no profile covers the product.
+    fn best_price(&self, regular_cents: i64, product_id: i32) -> Option<i64> {
+        let empty = HashSet::new();
+        self.profiles
+            .iter()
+            .filter(|p| p.covers(product_id, self.membership.get(&p.id).unwrap_or(&empty)))
+            .map(|p| apply_discount_bp(regular_cents, p.percent_bp))
+            .min()
+    }
+
+    /// Every profile that covers a product (for the per-company collision UI).
+    fn covering(&self, product_id: i32) -> Vec<&discount_profiles::Model> {
+        let empty = HashSet::new();
+        self.profiles
+            .iter()
+            .filter(|p| p.covers(product_id, self.membership.get(&p.id).unwrap_or(&empty)))
+            .collect()
+    }
+}
+
+async fn load_membership(
+    ctx: &AppContext,
+    profile_ids: &[i32],
+) -> Result<HashMap<i32, HashSet<i32>>> {
+    let mut membership: HashMap<i32, HashSet<i32>> = HashMap::new();
+    if profile_ids.is_empty() {
+        return Ok(membership);
+    }
+    let rows = discount_profile_products::Entity::find()
+        .filter(discount_profile_products::Column::DiscountProfileId.is_in(profile_ids.to_vec()))
+        .all(&ctx.db)
+        .await?;
+    for row in rows {
+        membership
+            .entry(row.discount_profile_id)
+            .or_default()
+            .insert(row.product_id);
+    }
+    Ok(membership)
+}
+
+async fn load_profiles_by_ids(ctx: &AppContext, ids: Vec<i32>) -> Result<LoadedProfiles> {
+    if ids.is_empty() {
+        return Ok(LoadedProfiles::empty());
+    }
+    let profiles = discount_profiles::Entity::find()
+        .filter(discount_profiles::Column::Id.is_in(ids.clone()))
+        .all(&ctx.db)
+        .await?;
+    let membership = load_membership(ctx, &ids).await?;
+    Ok(LoadedProfiles {
+        profiles,
+        membership,
+    })
+}
+
+/// Profiles assigned globally to an audience on the discounts page.
+async fn load_audience(ctx: &AppContext, audience: &str) -> Result<LoadedProfiles> {
+    let ids: Vec<i32> = audience_discount_profiles::Entity::find()
+        .filter(audience_discount_profiles::Column::Audience.eq(audience))
+        .all(&ctx.db)
+        .await?
+        .into_iter()
+        .map(|a| a.discount_profile_id)
+        .collect();
+    load_profiles_by_ids(ctx, ids).await
+}
+
+/// Per-company pricing inputs (manual prices, assigned profiles, resolutions).
+struct B2bContext {
+    manual: HashMap<i32, i64>,
+    profiles: LoadedProfiles,
+    resolutions: HashMap<i32, i32>,
+}
+
+async fn load_b2b(ctx: &AppContext, user_id: i32) -> Result<B2bContext> {
+    let manual = account_product_prices::Model::map_for_user(&ctx.db, user_id).await?;
+
+    let ids: Vec<i32> = account_discount_profiles::Entity::find()
+        .filter(account_discount_profiles::Column::UserId.eq(user_id))
+        .all(&ctx.db)
+        .await?
+        .into_iter()
+        .map(|a| a.discount_profile_id)
+        .collect();
+    let profiles = load_profiles_by_ids(ctx, ids).await?;
+
+    let resolutions = account_product_resolutions::Entity::find()
+        .filter(account_product_resolutions::Column::UserId.eq(user_id))
+        .all(&ctx.db)
+        .await?
+        .into_iter()
+        .map(|r| (r.variant_id, r.discount_profile_id))
+        .collect();
+
+    Ok(B2bContext {
+        manual,
+        profiles,
+        resolutions,
+    })
+}
+
+/// Everything loaded once per request to price any product for the viewer.
+struct PricingCtx {
+    personal: LoadedProfiles,
+    business: LoadedProfiles,
+    b2b: Option<B2bContext>,
+}
+
+/// Resolve the per-company automated price for a variant. Discount profiles
+/// cover the *product* (`product_id`); the admin's collision resolution is set
+/// per *variant* (`variant_id`). Result: the single covering profile, the
+/// admin-resolved winner on a collision, or (unresolved) the biggest discount,
+/// flagged.
+fn company_auto(
+    b2b: &B2bContext,
+    regular_cents: i64,
+    product_id: i32,
+    variant_id: i32,
+) -> (Option<i64>, Option<i32>, bool, Vec<i32>) {
+    let covering = b2b.profiles.covering(product_id);
+    let ids: Vec<i32> = covering.iter().map(|p| p.id).collect();
+    if covering.is_empty() {
+        return (None, None, false, ids);
+    }
+    let (chosen, collision) = if covering.len() == 1 {
+        (covering[0], false)
+    } else {
+        match b2b
+            .resolutions
+            .get(&variant_id)
+            .and_then(|rid| covering.iter().find(|p| p.id == *rid).copied())
+        {
+            Some(resolved) => (resolved, false),
+            None => (
+                covering
+                    .iter()
+                    .max_by_key(|p| p.percent_bp)
+                    .copied()
+                    .expect("covering is non-empty"),
+                true,
+            ),
+        }
+    };
+    (
+        Some(apply_discount_bp(regular_cents, chosen.percent_bp)),
+        Some(chosen.id),
+        collision,
+        ids,
+    )
+}
+
+fn detail_for_variant(variant: &product_variants::Model, pc: &PricingCtx) -> PriceDetail {
+    let regular = variant.price_cents;
+    let product_id = variant.product_id;
+
+    // Personal price: the variant's own public sale + personal-audience profiles
+    // (which cover the product), lowest wins.
+    let personal_sale = variant.effective_price_cents();
+    let personal_profile = pc.personal.best_price(regular, product_id);
+    let personal_effective = personal_profile
+        .map_or(personal_sale, |p| personal_sale.min(p));
+
+    let Some(b2b) = &pc.b2b else {
+        return PriceDetail::public_only(regular, personal_effective);
+    };
+
+    // Business candidates (company accounts only). The negotiated price is keyed
+    // to the variant; the baseline business sale lives on the variant.
+    let manual = b2b.manual.get(&variant.id).copied();
+    let (auto_cents, auto_profile_id, collision, covering_ids) =
+        company_auto(b2b, regular, product_id, variant.id);
+    let business_global = variant.business_sale_price_cents;
+    let business_profile = pc.business.best_price(regular, product_id);
+    let business_best = lowest([manual, auto_cents, business_global, business_profile]);
+
+    let priced = decide(regular, personal_effective, business_best);
+    PriceDetail {
+        regular_cents: regular,
+        public_cents: personal_effective,
+        manual_cents: manual,
+        auto_cents,
+        auto_profile_id,
+        covering_profile_ids: covering_ids,
+        collision,
+        price_cents: priced.price_cents,
+        is_business: priced.is_business,
+    }
+}
+
+async fn load_pricing_ctx(ctx: &AppContext, user: Option<&users::Model>) -> Result<PricingCtx> {
+    let personal = load_audience(ctx, AUDIENCE_PERSONAL).await?;
+    let (business, b2b) = if is_company(user) {
+        (
+            load_audience(ctx, AUDIENCE_BUSINESS).await?,
+            Some(load_b2b(ctx, user.expect("is_company implies Some").id).await?),
+        )
+    } else {
+        (LoadedProfiles::empty(), None)
+    };
+    Ok(PricingCtx {
+        personal,
+        business,
+        b2b,
+    })
+}
+
+/// Full breakdowns for many variants for `user`, batching per-request lookups.
+pub async fn detail_variants(
+    ctx: &AppContext,
+    list: &[product_variants::Model],
+    user: Option<&users::Model>,
+) -> Result<Vec<PriceDetail>> {
+    let pc = load_pricing_ctx(ctx, user).await?;
+    Ok(list.iter().map(|v| detail_for_variant(v, &pc)).collect())
+}
+
+/// Effective prices for a whole audience using only the global layers (the
+/// per-product sale + audience-assigned profiles + the business baseline), with
+/// no specific company's per-company deals. Used by the discounts admin page to
+/// preview what each tab's discounts produce. `audience` is "personal" or
+/// "business".
+pub async fn audience_price_variants(
+    ctx: &AppContext,
+    list: &[product_variants::Model],
+    audience: &str,
+) -> Result<Vec<PricedProduct>> {
+    let personal = load_audience(ctx, AUDIENCE_PERSONAL).await?;
+    let (business, b2b) = if audience == AUDIENCE_BUSINESS {
+        (
+            load_audience(ctx, AUDIENCE_BUSINESS).await?,
+            // A generic company with no per-company profiles/negotiated prices.
+            Some(B2bContext {
+                manual: HashMap::new(),
+                profiles: LoadedProfiles::empty(),
+                resolutions: HashMap::new(),
+            }),
+        )
+    } else {
+        (LoadedProfiles::empty(), None)
+    };
+    let pc = PricingCtx {
+        personal,
+        business,
+        b2b,
+    };
+    Ok(list.iter().map(|v| detail_for_variant(v, &pc).priced()).collect())
+}
+
+/// Like [`audience_price_many`], but prices against an *unsaved* set of profile
+/// ids for the active audience instead of the persisted assignment. Used by the
+/// products page to preview effective prices as the admin toggles profile
+/// checkboxes, before they hit Save. For the business tab the personal layer
+/// stays the persisted one (businesses get the lower of personal/business), and
+/// only the business layer is replaced by the previewed selection.
+pub async fn audience_price_variants_preview(
+    ctx: &AppContext,
+    list: &[product_variants::Model],
+    audience: &str,
+    selected_profile_ids: Vec<i32>,
+) -> Result<Vec<PricedProduct>> {
+    let preview = load_profiles_by_ids(ctx, selected_profile_ids).await?;
+    let (personal, business, b2b) = if audience == AUDIENCE_BUSINESS {
+        (
+            load_audience(ctx, AUDIENCE_PERSONAL).await?,
+            preview,
+            Some(B2bContext {
+                manual: HashMap::new(),
+                profiles: LoadedProfiles::empty(),
+                resolutions: HashMap::new(),
+            }),
+        )
+    } else {
+        (preview, LoadedProfiles::empty(), None)
+    };
+    let pc = PricingCtx {
+        personal,
+        business,
+        b2b,
+    };
+    Ok(list.iter().map(|v| detail_for_variant(v, &pc).priced()).collect())
+}
+
+/// Price one variant for `user` (`None` = anonymous/public).
+pub async fn price_variant(
+    ctx: &AppContext,
+    variant: &product_variants::Model,
+    user: Option<&users::Model>,
+) -> Result<PricedProduct> {
+    let detail = detail_variants(ctx, std::slice::from_ref(variant), user).await?;
+    Ok(detail[0].priced())
+}
+
+/// Price many variants for `user`, batching the per-request lookups.
+pub async fn price_variants(
+    ctx: &AppContext,
+    list: &[product_variants::Model],
+    user: Option<&users::Model>,
+) -> Result<Vec<PricedProduct>> {
+    Ok(detail_variants(ctx, list, user)
+        .await?
+        .iter()
+        .map(PriceDetail::priced)
+        .collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::decide;
+    use crate::shared::money::apply_discount_bp;
+
+    #[test]
+    fn personal_only() {
+        let p = decide(10000, 10000, None);
+        assert_eq!(p.price_cents, 10000);
+        assert!(!p.is_business);
+    }
+
+    #[test]
+    fn business_lower_wins() {
+        let p = decide(10000, 10000, Some(9000));
+        assert_eq!(p.price_cents, 9000);
+        assert!(p.is_business);
+    }
+
+    #[test]
+    fn personal_beats_business() {
+        // personal already 80 (e.g. personal profile), business best 90 -> 80.
+        let p = decide(10000, 8000, Some(9000));
+        assert_eq!(p.price_cents, 8000);
+        assert!(!p.is_business);
+    }
+
+    #[test]
+    fn business_equal_is_business() {
+        let p = decide(10000, 10000, Some(10000));
+        assert_eq!(p.price_cents, 10000);
+        assert!(p.is_business);
+    }
+
+    #[test]
+    fn discount_bp_rounds_half_up() {
+        assert_eq!(apply_discount_bp(10000, 500), 9500);
+        assert_eq!(apply_discount_bp(10000, 1500), 8500);
+        assert_eq!(apply_discount_bp(10000, 0), 10000);
+    }
+}