Auth fixes, show correct cost each value on pos

inventory-server/scripts/import/products.js

@@ -922,6 +922,11 @@ async function importProducts(prodConnection, localConnection, incrementalUpdate
       // Cleanup temporary tables
       await cleanupTemporaryTables(localConnection);
 
+      // Sync supplier-quoted cost fields (notions_cost_each / supplier_cost_each).
+      // These feed the Create-PO page so the displayed cost matches what the
+      // legacy PHP backend will stamp onto the PO line item.
+      await syncSupplierCosts(prodConnection, localConnection);
+
       // Commit the transaction
       await localConnection.commit();
 
@@ -954,10 +959,80 @@ async function importProducts(prodConnection, localConnection, incrementalUpdate
   }
 }
 
+// Bulk-sync supplier_item_data.notions_cost_each / supplier_cost_each into
+// products.{notions_cost_each, supplier_cost_each}. These mirror the supplier-
+// quoted "cost each" values the legacy PHP backend writes onto a PO when
+// _product_add() runs (see po.class.php:189-209). Kept as a separate, idempotent
+// pass so the main 49-column import paths don't need to know about it.
+async function syncSupplierCosts(prodConnection, localConnection) {
+  outputProgress({
+    status: "running",
+    operation: "Products import",
+    message: "Syncing supplier costs from supplier_item_data"
+  });
+
+  const [rows] = await prodConnection.query(`
+    SELECT pid, notions_cost_each, supplier_cost_each
+    FROM supplier_item_data
+  `);
+
+  if (!rows || rows.length === 0) {
+    return { updated: 0 };
+  }
+
+  // Stage into a temp table, then UPDATE in a single SQL statement.
+  await localConnection.query(`
+    CREATE TEMP TABLE temp_supplier_costs (
+      pid BIGINT PRIMARY KEY,
+      notions_cost_each NUMERIC(10,3),
+      supplier_cost_each NUMERIC(10,3)
+    ) ON COMMIT DROP
+  `);
+
+  const CHUNK = 5000;
+  for (let i = 0; i < rows.length; i += CHUNK) {
+    const batch = rows.slice(i, i + CHUNK);
+    const placeholders = batch
+      .map((_, idx) => `($${idx * 3 + 1}, $${idx * 3 + 2}, $${idx * 3 + 3})`)
+      .join(',');
+    const values = batch.flatMap(r => [
+      r.pid,
+      r.notions_cost_each,
+      r.supplier_cost_each
+    ]);
+    await localConnection.query(
+      `INSERT INTO temp_supplier_costs (pid, notions_cost_each, supplier_cost_each)
+       VALUES ${placeholders}
+       ON CONFLICT (pid) DO NOTHING`,
+      values
+    );
+  }
+
+  const [result] = await localConnection.query(`
+    UPDATE products p
+    SET notions_cost_each = t.notions_cost_each,
+        supplier_cost_each = t.supplier_cost_each
+    FROM temp_supplier_costs t
+    WHERE p.pid = t.pid
+      AND (p.notions_cost_each IS DISTINCT FROM t.notions_cost_each
+        OR p.supplier_cost_each IS DISTINCT FROM t.supplier_cost_each)
+  `);
+
+  const updated = result.rowCount || 0;
+  outputProgress({
+    status: "running",
+    operation: "Products import",
+    message: `Supplier costs synced for ${updated} products`
+  });
+
+  return { updated };
+}
+
 module.exports = {
   importProducts,
   importMissingProducts,
   setupTemporaryTables,
   cleanupTemporaryTables,
-  materializeCalculations
+  materializeCalculations,
+  syncSupplierCosts
 };