RKR Control de Productos: stock muerto y cortafuegos de precios

v1.3.02026/11/05

Full review before selling it. What a merchant would have noticed:

• Installation failed on every PrestaShop version (hooks registered before the module existed, Module::$_errors written from a helper).
• Dead stock scan never worked: it read order_detail.wholesale_price, which does not exist. Sales now counted once per product (all orders except cancelled / payment error), stock shared between shops read through StockAvailable, products created less than X days ago are no longer flagged, "days without sale" counted from the last sale or the creation date.
• Price drop deleted every specific price of the product (group, customer, quantity prices, catalogue rules). Now only the rule created by the module is replaced; drops add up step by step (10 % + 10 % = 20 %), no end date, floor and cost respected.
• Chain steps ran twice (direct + queue) and failing steps were retried forever; cron lock.
• "Last chance" label: wrong query and a feature without shop association (never visible).
• When a product sells again it leaves the list and what the chain did is undone (label, markdown, outlet, deactivation); pending steps are cancelled. Revert undoes markdown and outlet too and only reactivates what the module deactivated. Uninstall leaves the catalogue as it was.
• Saving a flagged product that never sold failed (null date validation).
• Price firewall: combinations are watched through Combination (the old hooks were attribute values and raised false "zero price" alerts), group / customer / quantity / catalogue rule prices are respected, saving a product without touching its price no longer raises incidents, new products drafted at 0 neither. New installs start in alert mode.
• AJAX never passed the token on PrestaShop 9.2 (Tools::hash is a salted bcrypt there): per-employee token, separate public token for the front. Permissions by action (view / edit / delete) instead of "can view = can do everything".
• Emails never left: templates moved to mails/en and mails/es.
• Badges: no more "Minimum price guaranteed" nor "(Verified)"; factual texts, only with competitor prices entered by the merchant in the last 7 days, same shop and currency, never prices guessed by the AI; the public endpoint no longer reveals the competitors; painted once; no request on every page view; no database write per page view.
• AI: SSRF closed (literal private IPs, redirects, IPv6, ports, pinned DNS); keys encrypted with PrestaShop's PhpEncryption (they were stored as broken binary or plain base64); proposals built from third-party pages always wait for review; a text never overwrites the other languages; product URLs are not rewritten; an applied/rejected proposal cannot be re-applied; fatal Tools::link_rewrite (PS 9) and getCategoriesName fixed.
• Import: SQL injection through non-string values closed; secrets of the source shop are not imported.
• Weekly report is really weekly (day of the week). Cron route renamed to rkrmpc-cron/{key}.
• Addons validator: version literal, no Context::, no HTML in PHP, no obsolete calls, .htaccess and index.php in every folder.