# Vendor hub and supplier portal

External suppliers reach the product through **organisation-scoped public URLs** (`/vendor-hub/{organizationUuid}` in the Next.js app). The API exposes unauthenticated registration and authenticated **vendor portal** APIs under `/api/public/...`.

## URL and API map

```mermaid
flowchart TB
  subgraph FE["Next.js"]
    H["/vendor-hub/:orgUuid"]
    R["/register"]
    L["/login"]
    P["/portal"]
  end

  subgraph API["Laravel /api/public"]
    GH[GET organizations org vendor-hub]
    REG[POST organizations org vendor-registrations]
    LI[POST organizations org vendor-portal/login]
    VP[vendor-portal/* authenticated]
  end

  H --> GH
  R --> REG
  L --> LI
  P --> VP
```

## Registration and account creation

```mermaid
sequenceDiagram
  participant S as Supplier browser
  participant API as PublicVendorHubController
  participant V as vendors
  participant A as vendor_portal_accounts

  S->>API: multipart PR + password + optional PDF
  API->>API: validate PDF magic + mime
  API->>V: insert inactive vendor
  API->>A: insert portal row email + hash
  API-->>S: 201 vendor uuid + message
```

## Supplier session

```mermaid
flowchart LR
  subgraph Browser["Browser storage"]
    T[ngoerp_vendor_portal_token]
  end

  subgraph API["Authenticated vendor-portal group"]
    M[GET me / PATCH me]
    O[GET opportunities]
    B[POST bids]
    X[POST logout]
  end

  T -->|Authorization Bearer| M
  T --> O
  T --> B
  T --> X
```

## RFQ opportunity and bid (supplier view)

```mermaid
flowchart TD
  L[List RFQs published closed awarded] --> D[GET detail by uuid]
  D --> C{published and closes_on ge today}
  C -->|yes| F[POST bid with notes]
  C -->|no| R[Read-only or closed message]
```

## Legal document upload (registration)

```mermaid
flowchart TD
  U[Upload PDF] --> V[Validate mimes + size]
  V --> F[finfo application/pdf]
  F --> M[Magic bytes PDF]
  M --> S[Store on organisation_private disk]
  S --> DB[Save path + sha256 on vendor]
```

Staff download uses authenticated `GET /api/vendors/{vendor}/registration-legal-document` (procurement visibility).
