Open ERP: An Open-Source ERP System

🏷️ erp 🏷️ open erp 🏷️ 开放erpOpen ERP 📂 开源 📝 4.2k 字 · ⏱️ 26 分钟 阅读 0 次 👀

Open ERP System (open-erp)

A full-stack ERP system based on webman v2 + Flutter.

Feature List

Business Domain Feature Notes
🔐 Authentication Login/register/token refresh/logout Click captcha + JWT + blacklist
Account lockout Locked for 15 minutes after 5 failures
Concurrent session limit Max 3 valid tokens per user
📊 Dashboard Business overview/sales board/inventory board/finance board Redis cache for 5 minutes
👥 User management CRUD + batch delete/enable/disable Soft delete + password re-confirmation
Excel bulk import Row-by-row validation + error report
🔒 Roles and permissions Role CRUD + permission tree RBAC with method.path granular authorization
⚙ System config Key-value CRUD Grouped management
📋 Operation audit Log query + source client detection Automatic detection of 8 platforms
📁 File management Upload/Excel export/PDF export Automatic masking of sensitive data
🛡 Security protection 18 layers of defense in depth XSS/SQL injection/path traversal/command injection/CSRF/rate limiting/CSP…
🏥 Operations Health check/metrics/API docs/security.txt Prometheus + OpenAPI 3.0
📦 Product management Product records/SKU/multi-spec/multi-unit/category/brand/price strategy Multi-level category tree + multi-unit conversion
Warehouse locations Multi-warehouse, multi-location management
Supplier/customer records Contacts/bank accounts/credit limit
📥 Purchasing Requisition → order → receipt → return → settlement Complete purchasing flow + approval
📤 Sales Quotation → order → delivery → return → settlement Quotation-to-order + sales gross margin
🏗 Inventory Real-time stock/batches/serial numbers/transfers/stocktakes/alerts Moving weighted average costing
💰 Finance AR/AP/receipts and payments/day journal/expense reimbursement/income statement/fixed assets/tax/multi-currency/budget/cost and profit centers Auto-generated AR/AP + write-off + comprehensive financial management
🤝 CRM Customers/contacts/follow-up records/campaigns/service tickets/analytics reports/sales funnel/public pool/quotations/contracts Full customer lifecycle management
✅ Approval workflow Workflow definition/submit for approval/approve/reject/withdraw/my approvals Multi-node approval process engine
🔔 Notifications Notification list/read marking/unread count/mark all as read Real-time message push with status tracking
📐 Project management Projects/tasks/timesheets Project progress tracking and resource management
👤 HR Departments/employees/positions/attendance/leave/payroll Comprehensive HR management
🏭 Manufacturing BOM/production orders/routings/workstations/MRP Material requirements planning and production execution
📈 Custom reports Report templates/datasets/fields/filters/execution/scheduled jobs Visual report builder

Download

ERP Modules

Data flow between the business modules:

  • Purchase receipt → automatic stock-in (moving weighted average costing) → automatic AP generation
  • Sales delivery → automatic stock-out → automatic AR generation
  • Receipts and payments → write off AR/AP → update the day journal
  • Voucher review → automatically updates the general ledger (account summary) + subsidiary ledger (entry-by-entry records)
  • Balance sheet → generated by automatically aggregating general ledger closing balances
  • Cash flow statement → generated by automatically aggregating cash and bank day journals (operating/investing/financing classification)
  • Approval workflow → business documents submitted for approval → multi-node routing → approval result calls back into the business module
  • Notifications → triggered by approvals/alerts/system events → real-time push → user marks as read
  • MRP → based on sales orders + BOM → calculates material requirements → generates purchase suggestions/production suggestions

Tech Stack

Layer Technology Notes
Backend framework webman v2 (workerman) Ultra-high-performance resident-process PHP framework
PHP version 8.3+
Database MySQL 8.0+ Table prefix erik_, BIGINT non-auto-increment primary keys
Search engine Elasticsearch Sync and query through webman-scout
Admin frontend Flutter 3.x The web build uses a PC admin backend style (apps/flutter/)
Mobile HarmonyOS ArkTS Native HarmonyOS client (apps/harmonyos/), supports phone/tablet/2in1

Core Dependencies

Package Purpose
erikwang2013/snowflake-php Snowflake algorithm to generate globally unique BIGINT primary keys
erikwang2013/hashids Encrypt/decrypt IDs at the API layer to hide real database IDs
erikwang2013/jwt-webman JWT auth token issuance and verification
erikwang2013/encryption Encrypt/decrypt sensitive data at the API transport layer
erikwang2013/encryptable Automatic encrypt/decrypt of sensitive fields at the database storage layer
erikwang2013/webman-scout Elasticsearch data sync and full-text search
erikwang2013/season Country flag data
erikwang2013/poster-php Click captcha generation and verification + poster generation
erikwang2013/security-php Security tool checks
phpoffice/phpspreadsheet Excel export
barryvdh/laravel-dompdf PDF export (based on Dompdf)
hg/apidoc Automatic API documentation generation Annotation-based API docs, grouped by admin/client

Internationalization

Internationalization | Automatic Accept-Language header detection | Chinese/English bilingual support

Project Structure

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
open-erp/
├── app/
│   ├── admin/controller/       # System management controllers (14)
│   ├── api/v1/controller/      # Client API (version controlled by the API-Version request header)
│   ├── controller/             # Business module controllers (70)
│   │   ├── product/            # Product/category/brand/warehouse/location/supplier/customer (7)
│   │   ├── purchase/           # Purchase requisition/order/receipt/return/settlement (5)
│   │   ├── sales/              # Sales quotation/order/delivery/return/settlement (5)
│   │   ├── inventory/          # Inventory/transactions/transfer/stocktake/alert (5)
│   │   ├── finance/            # AR-AP/voucher/receipt/payment/day journal/general ledger/subsidiary ledger/reports/assets/tax/multi-currency/budget/cost and profit centers (20)
│   │   ├── crm/                # Opportunities/follow-ups/funnel/contacts/public pool/contracts/quotations/campaigns/tickets/analytics (10)
│   │   ├── workflow/           # Workflow definition/approval submission/approve/reject/withdraw (2)
│   │   ├── notification/       # Notification list/read/unread count (1)
│   │   ├── project/            # Projects/tasks/timesheets (3)
│   │   ├── hr/                 # Departments/employees/positions/attendance/leave/payroll (5)
│   │   ├── manufacturing/      # BOM/production orders/routings/workstations/MRP (5)
│   │   └── report/             # Report templates/datasets/execution/scheduled jobs (2)
│   ├── service/                # Business logic layer
│   │   ├── inventory/          # Stock in/out + moving weighted average costing
│   │   ├── finance/            # Automatic AR/AP generation + write-off
│   │   └── notification/       # Notification delivery service
│   ├── model/                  # 121 Eloquent models (shared across modules)
│   ├── middleware/             # 9 middleware
│   ├── common/                 # Hashids/Snowflake/Encryption services
│   └── queue/                  # Queue jobs
├── apps/
│   ├── flutter/                # Flutter cross-platform (Web PC + iOS/Android/macOS/Windows/Linux)
│   └── harmonyos/              # Native HarmonyOS client
├── config/                     # Configuration files (with Chinese comments)
│   ├── plugin/hg/apidoc/        # API documentation config
├── database/
│   ├── migrations/             # SQL migration files (18, 122 tables)
│   └── backup/                 # Backup/restore scripts
├── docs/                       # Architecture, design, security and API docs
├── tests/                      # PHPUnit tests (11 test files, 90 test methods, 168 assertions)
├── resource/
│   └── translations/           # Translation files (zh_CN, en)
│       ├── zh_CN/              # Chinese translations (127 keys)
│       └── en/                 # English translations (127 keys)
├── public/                     # Public entry point
├── runtime/                    # Runtime files
└── vendor/                     # Composer dependencies

Requirements

  • PHP >= 8.3
  • Composer 2.x
  • MySQL >= 8.0
  • Flutter >= 3.41 (only needed for frontend development)
  • Elasticsearch >= 7.x (optional, required for search)

Quick Start

1. Install dependencies

1
composer install

2. Configure environment variables

Copy and edit the environment variables (optional — if you don’t configure them, the defaults in config/*.php are used):

1
cp .env.example .env

Key configuration items:

Environment variable Description Default
JWT_SECRET JWT signing key open-admin-jwt-secret-change-in-production
HASHIDS_SALT Hashids salt open-admin-hashids-salt-2026
ENCRYPTION_KEY API encryption key 32-byte default value
SNOWFLAKE_DATACENTER_ID Datacenter ID (0-31) 1
SNOWFLAKE_WORKER_ID Worker node ID (0-31) 1
SCOUT_HOSTS ES address http://localhost:9200

In production you must change all keys to random strings.

3. Initialize the database

Run the SQL files under database/migrations/ in order:

1
2
3
4
# Create tables
mysql -u root -p < database/migrations/2026_05_16_000000_init_tables.sql
# Seed permission data
mysql -u root -p < database/migrations/2026_05_20_000001_seed_permissions.sql

4. Start the service

1
php start.php start

Listens on http://0.0.0.0:8787 by default.

5. Start the frontends (optional)

Flutter admin backend (web):

1
2
3
cd apps/flutter
flutter pub get
flutter run -d chrome    # Web build (PC admin backend style)

HarmonyOS client (mobile):

Open the apps/harmonyos/ directory with DevEco Studio, connect a real device or an emulator and run.

The project ships a complete Docker orchestration setup with 5 services: Nginx, PHP (webman app), MySQL, Redis and Elasticsearch.

1
2
3
4
5
6
7
8
9
10
11
12
13
# 1. Configure the Docker environment variables
cp .env.docker .env

# 2. Start all services
docker-compose up -d

# 3. Initialize the database (run inside the app container)
docker-compose exec app mysql -h mysql -u root -p < database/migrations/2026_05_16_000000_init_tables.sql
docker-compose exec app mysql -h mysql -u root -p < database/migrations/2026_05_20_000001_seed_permissions.sql

# 4. Access
# http://localhost:8787  (webman)
# http://localhost:8080  (Nginx reverse proxy)
  • Dockerfile: PHP 8.3 + OPcache + Composer, based on php:8.3-cli
  • docker-compose.yml: orchestration of 5 services, network isolation, persistent data volumes
  • .env.docker: environment variables dedicated to the Docker environment

Database Conventions

  • Table prefix: erik_
  • Primary key: every table’s primary key is id BIGINT UNSIGNED NOT NULL, with AUTO_INCREMENT forbidden
  • ID generation: primary key IDs are generated by SnowflakeService::generate() in the application layer, unique across the cluster
  • Required fields: every table must contain id, created_at, updated_at
  • Soft delete: tables that need soft delete add deleted_at DATETIME DEFAULT NULL
  • Sensitive fields: phone numbers, emails, ID card numbers and the like are encrypted/decrypted automatically by the encryptable plugin, with ciphertext stored in VARCHAR(500) columns

API Conventions

API documentation

The project uses hg/apidoc to generate API documentation automatically; visit /apidoc to view it.

  • Admin APIs: 25 module groups, with complete request parameters and response structures
  • Client APIs (Service API): 3 groups — auth/captcha/product
  • Every endpoint is annotated with global request headers such as JWT auth, API version and internationalization

Unified response format

1
2
3
4
5
{
    "code": 0,
    "message": "success",
    "data": {}
}

Business error codes

Code Meaning Notes
0 Success
400 Invalid request parameters
401 Not logged in (invalid or expired token)
403 No permission / security block RBAC authorization failure / SecurityFilter attack detection
404 Resource not found
422 Parameter validation failed
413 Request body too large Triggered by SecurityFilter, over 10MB
405 Method not allowed Triggered by SecurityFilter; only GET/POST/PUT/DELETE/OPTIONS/HEAD are allowed
415 Unsupported media type Triggered by SecurityFilter; Content-Type is not JSON
429 Too many requests Triggered by RateLimit / account lockout (5 failed logins locks for 15 minutes)
500 Internal server error

Internationalization

The Accept-Language request header switches the language automatically (zh-CN → Chinese, en → English); Chinese is the default.

ID handling

  • IDs in requests/responses: encrypted with hashids into strings, so real database IDs are never exposed
  • API paths: GET /admin/user/{hashid} — the {id} in the path is a hashid string
  • Database storage: the raw BIGINT value, generated by snowflake

API versioning

The API version is controlled by a request header and is not part of the URL:

1
API-Version: v1
  • When no version is provided, v1 is used by default
  • Unsupported versions return 400 Bad Request
  • To add a version, just create an app/api/{version}/controller/ directory and register the new version in the middleware

Rate limiting

Based on a Redis sliding window algorithm, 60 requests/minute/IP/route by default. Sensitive endpoints are stricter:

  • Login: 10 requests/minute
  • Register: 5 requests/minute

Responses include the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers. Exceeding the limit returns 429 with a Retry-After header.

Middleware architecture

Global middleware applies to every request and runs in order:

1
2
3
4
5
6
7
8
Locale (automatic Accept-Language detection, sets the locale)
  → Cors (CORS preflight + response headers)
  → SecurityFilter (HTTP method restriction/request body size/Content-Type validation/XSS/SQL injection/path traversal/command injection/CSRF attack blocking)
  → RateLimit (Redis sliding window rate limiting + account lockout: 5 failed logins locks for 15 minutes)
  → ApiVersion (API version validation, /api route group)
  → AdminAuth (JWT auth + blacklist, /admin route group)
  → AdminPermission (RBAC authorization, /admin route group)
  → OperationLog (automatic logging for POST/PUT/DELETE, with source client detection, /admin route group)

/health and /api/docs are public endpoints and only pass through Locale → Cors → SecurityFilter → RateLimit.

Security hardening:

  • Account lockout: after 5 consecutive failed logins the account is locked for 15 minutes, during which login returns 429
  • Concurrent session limit: a user can have at most 3 valid tokens; beyond that, the oldest token is automatically blacklisted
  • security.txt: GET /.well-known/security.txt provides security contact information per RFC 9116
  • Nginx security configuration: see docs/nginx-security.conf for a complete reverse proxy hardening example

Authentication

Login and registration both require click captcha verification first:

  1. The client calls POST /api/captcha/generate to get the captcha image (base64 PNG) and the list of target words
  2. The user clicks the positions of the corresponding words in the image in order; the click coordinates are collected as [{x, y}, ...]
  3. On login, captcha_key and clicks are submitted together; the server verifies the captcha before verifying the credentials
1
2
3
4
5
6
7
8
9
POST /api/auth/login
Content-Type: application/json

{
  "username": "admin",
  "password": "******",
  "captcha_key": "abc123...",
  "clicks": [{"x": 120, "y": 85}, {"x": 210, "y": 140}, {"x": 95, "y": 170}]
}

Subsequent admin endpoints require JWT authentication:

1
Authorization: Bearer <token>

A successful login returns an access_token valid for 2 hours, plus a refresh_token valid for 14 days.

On logout the token is added to the Redis blacklist and cannot be reused within its lifetime. POST /admin/profile/logout

Secondary confirmation for sensitive operations

Sensitive operations such as deleting users, roles or permissions require the current logged-in user’s password in the request body for a second identity confirmation:

1
2
3
4
5
DELETE /admin/user/{id}
Content-Type: application/json
Authorization: Bearer <token>

{ "password": "******" }

API List

All /api/* endpoints require the API-Version: v1 header (defaults to v1 if omitted).

Public endpoints

Method Path Description
GET /health Health check (DB/Redis/ES status)
GET /api/docs OpenAPI 3.0 specification document
POST /api/captcha/generate Generate a click captcha
POST /api/captcha/verify Verify a click captcha
POST /api/auth/login Login (requires captcha)
POST /api/auth/register Register (requires captcha)
POST /api/auth/refresh Refresh token
GET /metrics Prometheus metrics

Admin endpoints (JWT + RBAC required)

Method Path Description
GET /admin/dashboard Dashboard data (Redis cache for 5 minutes)
GET /admin/user User list (pagination + search)
POST /admin/user Create user
GET /admin/user/{id} User details
PUT /admin/user/{id} Update user
DELETE /admin/user/{id} Delete user (soft delete, password confirmation required)
POST /admin/user/batch/destroy Batch delete users (password confirmation required)
POST /admin/user/batch/status Batch enable/disable users
GET /admin/role Role list
POST /admin/role Create role
PUT /admin/role/{id} Update role
DELETE /admin/role/{id} Delete role (password confirmation required)
GET /admin/permission Permission tree
POST /admin/permission Create permission
PUT /admin/permission/{id} Update permission
DELETE /admin/permission/{id} Delete permission (cascades to child permissions, password confirmation required)
GET /admin/config System config list
POST /admin/config Create config item
PUT /admin/config/{id} Update config item
DELETE /admin/config/{id} Delete config item (password confirmation required)
GET /admin/log Operation logs (pagination + filters)
PUT /admin/profile Update personal profile
PUT /admin/profile/password Change password
POST /admin/profile/logout Logout (JWT blacklist)
POST /admin/export/excel Export Excel
POST /admin/export/pdf Export PDF
POST /admin/import/users Import users from Excel
POST /admin/upload File upload (images/documents, max 10MB)

Business endpoints (JWT + RBAC required)

Method Path Description
GET/POST/PUT/DELETE /admin/product Product CRUD (with SKUs, prices)
GET/POST/PUT/DELETE /admin/category Product category CRUD (tree)
GET/POST/PUT/DELETE /admin/brand Brand CRUD
GET/POST/PUT/DELETE /admin/warehouse Warehouse CRUD
GET /admin/warehouse/{id}/locations List locations under a warehouse
GET/POST/PUT/DELETE /admin/location Location CRUD
GET/POST/PUT/DELETE /admin/supplier Supplier CRUD
GET/POST/PUT/DELETE /admin/customer Customer CRUD
ANY /admin/customer-level Customer level management
GET/POST/PUT/DELETE /admin/purchase/apply Purchase requisition
GET/POST/PUT/DELETE /admin/purchase/order Purchase order
GET/POST/PUT/DELETE /admin/purchase/receive Purchase receipt (automatic stock-in + AP generation)
GET/POST/PUT/DELETE /admin/purchase/return Purchase return
ANY /admin/purchase/settlement Supplier settlement
GET/POST/PUT/DELETE /admin/sales/quotation Sales quotation
GET/POST/PUT/DELETE /admin/sales/order Sales order
GET/POST/PUT/DELETE /admin/sales/delivery Sales delivery (automatic stock-out + AR generation)
GET/POST/PUT/DELETE /admin/sales/return Sales return
ANY /admin/sales/settlement Customer settlement
ANY /admin/inventory Real-time inventory query
ANY /admin/inventory/flow Stock in/out transactions
GET/POST/PUT/DELETE /admin/inventory/transfer Inventory transfer
GET/POST/PUT/DELETE /admin/inventory/check Stocktake tasks
GET/POST/PUT/DELETE /admin/inventory/alert Inventory alert rules
GET/POST/PUT/DELETE /admin/finance/ar-ap Accounts receivable/payable
GET/POST/PUT/DELETE /admin/finance/voucher Accounting vouchers
GET/POST/PUT/DELETE /admin/finance/receipt Receipt vouchers
GET/POST/PUT/DELETE /admin/finance/payment Payment vouchers
ANY /admin/finance/cash-journal Cash and bank day journal
GET/POST/PUT/DELETE /admin/finance/expense Expense reimbursement
ANY /admin/finance/report/profit Income statement
GET/POST/PUT/DELETE /admin/finance/bank-account Bank accounts
ANY /admin/finance/general-ledger General ledger (summarized by account + period)
ANY /admin/finance/subsidiary-ledger Subsidiary ledger (entry-by-entry detail by account)
ANY /admin/finance/report/balance-sheet Balance sheet
ANY /admin/finance/report/cash-flow Cash flow statement (operating/investing/financing)
GET/POST/PUT/DELETE /admin/finance/asset Fixed asset CRUD + depreciation
GET/POST/DELETE /admin/finance/tax-rate Tax rate configuration
ANY /admin/finance/tax-record Tax records
GET/POST/PUT/DELETE /admin/finance/currency Currency management
GET/POST/PUT/DELETE /admin/finance/exchange-rate Exchange rate management
GET/POST/PUT/DELETE /admin/finance/budget Budget management (with budget vs actual comparison)
GET/POST/PUT/DELETE /admin/finance/cost-center Cost centers (tree structure)
GET/POST/PUT/DELETE /admin/finance/profit-center Profit centers (tree structure)
GET/POST/PUT/DELETE /admin/crm/opportunity Opportunity management
GET/POST/PUT/DELETE /admin/crm/follow Follow-up records
GET/POST/PUT/DELETE /admin/crm/funnel Sales funnel stage configuration
GET/POST/PUT/DELETE /admin/crm/contact Contacts
ANY /admin/crm/pool Public pool (customer list)
POST /admin/crm/pool/claim/{id} Claim a public pool customer
POST /admin/crm/pool/release/{id} Release a customer to the public pool
GET/POST/PUT/DELETE /admin/crm/pool/rules Public pool rules
GET/POST/PUT/DELETE /admin/crm/contract Contract CRUD
POST /admin/crm/contract/{id}/transition Contract status transition
GET/POST/PUT/DELETE /admin/crm/quotation CRM quotations
POST /admin/crm/quotation/{id}/to-contract Convert quotation to contract
GET/POST/PUT/DELETE /admin/crm/campaign Marketing campaigns
GET/POST/PUT/DELETE /admin/crm/ticket Service tickets
POST /admin/crm/ticket/{id}/assign Assign a ticket
POST /admin/crm/ticket/{id}/resolve Resolve a ticket
POST /admin/crm/ticket/{id}/reply Reply to a ticket
ANY /admin/crm/analytics/report Customer analytics reports
POST /admin/crm/analytics/generate Generate an analytics report
ANY/POST /admin/crm/analytics/metric Analytics metrics
ANY /admin/dashboard/sales Sales board
ANY /admin/dashboard/inventory Inventory board
ANY /admin/dashboard/finance Finance board
GET/POST/PUT/DELETE /admin/workflow Workflow definition CRUD
POST /admin/workflow/{id}/submit Submit for approval
POST /admin/approval/{id}/approve Approve
POST /admin/approval/{id}/reject Reject
POST /admin/approval/{id}/withdraw Withdraw
ANY /admin/approval/my My approval list
ANY /admin/notification/my My notifications
POST /admin/notification/{id}/read Mark as read
POST /admin/notification/read-all Mark all as read
ANY /admin/notification/unread-count Unread count
GET/POST/PUT/DELETE /admin/project Project CRUD
GET/POST/PUT/DELETE /admin/project/task Project task CRUD
GET/POST/PUT/DELETE /admin/project/timesheet Timesheet CRUD
GET/POST/PUT/DELETE /admin/hr/department Department CRUD
GET/POST/PUT/DELETE /admin/hr/employee Employee CRUD
GET/POST/PUT/DELETE /admin/hr/position Position CRUD
ANY/POST /admin/hr/attendance Attendance/clock-in
GET/POST/PUT/DELETE /admin/hr/leave Leave CRUD + approval
GET/POST/PUT/DELETE /admin/hr/salary Payroll CRUD + disbursement
ANY/POST /admin/hr/salary-item Salary items
GET/POST/PUT/DELETE /admin/mfg/bom BOM CRUD
GET/POST/PUT/DELETE /admin/mfg/production Production orders + start/complete
GET/POST/PUT/DELETE /admin/mfg/routing Routing CRUD
GET/POST/PUT/DELETE /admin/mfg/workstation Workstation CRUD
GET/POST/PUT/DELETE /admin/mfg/mrp MRP plans + generation
GET/POST/PUT/DELETE /admin/report Report template CRUD
POST /admin/report/{id}/execute Execute a report
ANY /admin/report/{id}/result Report results
GET/POST/PUT/DELETE /admin/report/schedule Scheduled report jobs

Client endpoints (requires the API-Version header)

Method Path Description
GET /api/product Product list (excluding cost price)
GET /api/product/{hashid} Product details (including retail/wholesale prices)

Frontend Notes

Flutter admin backend (PC style)

  • Layout: sidebar (collapsible 64px/240px) + top bar + content area, responsive with three breakpoints (phone/tablet/desktop)
  • Pages: login, dashboard, user management, roles and permissions, system config, operation logs, personal center
  • State management: GetX (ApiService singleton + AuthService token persistence)
  • Dashboard: stat cards, trend line chart (fl_chart), pie chart, recent operation logs
  • Export: Excel/PDF export, with a non-removable copyright notice in the PDF
  • Batch operations: multi-select batch delete, batch enable/disable
  • Theme: Material 3 light/dark dual themes

HarmonyOS mobile client

  • Pages: login, dashboard, user list/details, personal center
  • Auth: JWT Bearer + transparent automatic token refresh on 401; if the refresh fails, it redirects to the login page
  • Storage: tokens are managed through AppStorage

Development Conventions

  • Global function/class references are not prefixed with \; use use imports uniformly
  • All PHP files must start with a copyright notice
  • All configuration files must include explanatory Chinese comments
  • Database primary keys must be generated by snowflake in the application layer; auto-increment is forbidden
  • All IDs in API-layer parameters and responses must be encrypted/decrypted with hashids
  • The AdminPermission middleware caches user permissions in Redis (TTL=60s), eliminating the N+1 query bottleneck

Deployment

The project root provides a docker-compose.yml orchestrating 5 services:

Service Image Ports
nginx nginx:alpine 80, 443
app built locally from Dockerfile 8787
mysql mysql:8.0 3306
redis redis:7-alpine 6379
elasticsearch elasticsearch:8.x 9200

The PHP image is built from the Dockerfile, based on php:8.3-cli, with OPcache enabled.

1
2
cp .env.docker .env
docker-compose up -d

CI/CD

GitHub Actions continuous integration pipeline: .github/workflows/ci.yml

  • PHP syntax check (php -l)
  • PHPUnit unit tests
  • Flutter static analysis (flutter analyze)

Database backup

The database/backup/ directory:

  • backup.sh — mysqldump + gzip backup, automatically cleans up backups older than 30 days
  • restore.sh — interactive restore that lists available backups to choose from

Nginx security configuration

For production deployments, refer to docs/nginx-security.conf to configure reverse proxy security hardening.

The Open ERP system comes in three editions to suit the needs of companies of different sizes.

Edition Overview

Dimension Lite Standard Full
Branch lite standard full
Database tables 62 72 122
Controllers 48 42 70
Business modules 6 6 12

Feature Comparison

System Management

Feature Lite (open source) Standard (commercial) Full (commercial)
User management (CRUD + batch + import) ✔ ✔ ✔
Roles and permissions (RBAC three-level permission tree) ✔ ✔ ✔
System config (key-value pairs) ✔ ✔ ✔
Operation audit (source client detection for 8 platforms) ✔ ✔ ✔
File upload / Excel export / PDF export ✔ ✔ ✔
Health check / Prometheus metrics ✔ ✔ ✔
JWT auth + click captcha ✔ ✔ ✔
18 layers of security protection ✔ ✔ ✔
Internationalization (i18n), Chinese/English — — ✔

Products and Master Data

Feature Lite (open source) Standard (commercial) Full (commercial)
Product records + multi-spec SKUs ✔ ✔ ✔
Multi-unit conversion + price strategy ✔ ✔ ✔
Product categories (tree) + brands ✔ ✔ ✔
Multiple warehouses + multiple locations ✔ ✔ ✔
Supplier/customer records ✔ ✔ ✔

Purchasing

Feature Lite (open source) Standard (commercial) Full (commercial)
Purchase requisition + approval ✔ ✔ ✔
Purchase orders ✔ ✔ ✔
Purchase receipt (automatic stock-in + AP generation) ✔ ✔ ✔
Purchase returns ✔ ✔ ✔
Supplier settlement ✔ ✔ ✔

Sales

Feature Lite (open source) Standard (commercial) Full (commercial)
Quotations (can be converted to orders) ✔ ✔ ✔
Sales orders ✔ ✔ ✔
Sales delivery (automatic stock-out + AR generation) ✔ ✔ ✔
Sales returns ✔ ✔ ✔
Customer settlement + gross margin analysis ✔ ✔ ✔

Inventory

Feature Lite (open source) Standard (commercial) Full (commercial)
Real-time inventory (four-dimensional precision) ✔ ✔ ✔
Stock in/out transactions ✔ ✔ ✔
Batch tracking + serial number tracking ✔ ✔ ✔
Inventory transfers ✔ ✔ ✔
Stocktake management (planned + dynamic) ✔ ✔ ✔
Inventory alerts (upper/lower limit warnings) ✔ ✔ ✔
Moving weighted average costing ✔ ✔ ✔

Finance

Feature Lite (open source) Standard (commercial) Full (commercial)
AR/AP (automatic generation + write-off) ✔ ✔ ✔
Receipt vouchers / payment vouchers ✔ ✔ ✔
Cash and bank day journal ✔ ✔ ✔
Expense reimbursement (submit → approve → pay out) ✔ ✔ ✔
Income statement ✔ ✔ ✔
Fixed asset depreciation — — ✔
Tax management (multi-tax configuration) — — ✔
Multi-currency + exchange rate management — — ✔
Budget management (budget vs actual comparison) — — ✔
Cost centers / profit centers (tree-based accounting) — — ✔

CRM

Feature Lite (open source) Standard (commercial) Full (commercial)
Customer contact management ✔ ✔ ✔
Follow-up records ✔ ✔ ✔
Marketing campaign management — — ✔
Service tickets (priority + assignment + resolution flow) — — ✔
Customer analytics reports — — ✔

Platform Capabilities

Feature Lite (open source) Standard (commercial) Full (commercial)
Approval workflow engine — — ✔
Notification system — — ✔
API documentation (hg/apidoc) ✔ ✔ ✔

Extension Modules

Feature Lite (open source) Standard (commercial) Full (commercial)
Project management (WBS/Gantt/timesheets) — — ✔
Human resources (organization/attendance/payroll) — — ✔
Manufacturing (BOM/MRP/work orders/routings) — — ✔
Custom report builder — — ✔

Use Cases

Edition Recommended for
Lite (open source) Small and mid-size trading companies centered on purchasing-sales-inventory + basic finance, with no need for approval flows or extension modules
Standard (commercial) The same functional scope, with a leaner table design, a good foundation for custom development
Full (commercial) Medium and large enterprises that need a complete full-stack platform of purchasing-sales-inventory + finance + CRM + HR + manufacturing + project management

Upgrade Path

1
2
3
4
5
6
7
8
Lite
  ├─ 62 tables / 12 business modules / no approval/notification/HR/manufacturing/reports
  │
  ├─ Standard
  │    ├─ 72 tables / 12 business modules / leaner data model
  │
  └─ Full
       └─ 122 tables / 6 business modules / comprehensive enterprise platform capabilities
🧑‍💻 本文作者：艾瑞可erik
🔗 本文链接：https://erik.xyz/2026/05/23/open-erp-lite-en/
📜 版权声明：本作品采用 知识共享署名-非商业性使用-相同方式共享 4.0 国际许可协议 进行许可，转载请注明出处！
支付宝💙 支付宝
微信💚 微信