From d2e5b50ef1bf3ba6429be7a0874ec5de7d4c16bf Mon Sep 17 00:00:00 2001
From: Jacek Pyziak <jacek.pyziak@project-pro.pl>
Date: Sat, 28 Mar 2026 12:06:51 +0100
Subject: [PATCH] update

---
 admin/index.php                               |   8 -
 admin/templates/components/form-edit.php      |   3 +-
 admin/templates/site/unlogged-layout.php      |   3 +-
 admin/templates/users/user-2fa.php            |   2 +
 autoload/Domain/Article/ArticleRepository.php |   2 +
 autoload/Domain/CronJob/CronJobRepository.php |  14 +-
 autoload/Domain/CronJob/CronJobType.php       |  14 +
 .../Domain/Integrations/ApiloRepository.php   | 567 ++++++++++++++++++
 .../Integrations/IntegrationsRepository.php   | 526 +---------------
 autoload/Domain/Order/OrderAdminService.php   |  12 +-
 autoload/Domain/Order/OrderRepository.php     |   6 +-
 .../PaymentMethod/PaymentMethodRepository.php |   5 +-
 autoload/Domain/Product/ProductRepository.php |   8 +-
 autoload/Shared/Security/CsrfToken.php        |  26 +
 autoload/admin/App.php                        |  14 +-
 .../Controllers/IntegrationsController.php    |  17 +-
 .../ShopPaymentMethodController.php           |   5 +
 .../Support/Forms/FormRequestHandler.php      |   7 +
 .../Controllers/ShopBasketController.php      | 165 ++++-
 cron.php                                      | 102 +++-
 index.php                                     |   8 -
 .../_partials/product-custom-fields.php       |  68 ++-
 templates/shop-basket/basket-details.php      |   3 +-
 templates/shop-basket/basket.php              | 100 +++
 templates/shop-basket/summary-view.php        |   7 +-
 templates/shop-order/order-details.php        |  10 +-
 templates/shop-product/product.php            |  10 +-
 .../_partials/product-custom-fields.php       |  63 +-
 templates_user/shop-basket/basket-details.php |   3 +-
 templates_user/shop-basket/basket.php         | 102 +++-
 templates_user/shop-basket/summary-view.php   |   7 +-
 templates_user/shop-order/order-details.php   |  10 +-
 templates_user/shop-product/product.php       |   6 +-
 33 files changed, 1255 insertions(+), 648 deletions(-)
 create mode 100644 autoload/Domain/Integrations/ApiloRepository.php
 create mode 100644 autoload/Shared/Security/CsrfToken.php

diff --git a/admin/index.php b/admin/index.php
index fcd897d..8affdba 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -31,17 +31,9 @@ function __autoload_my_classes( $classname )
 spl_autoload_register( '__autoload_my_classes' );
 require_once '../config.php';
 require_once '../libraries/medoo/medoo.php';
-require_once '../libraries/rb.php';
 require_once '../libraries/phpmailer/class.phpmailer.php';
 require_once '../libraries/phpmailer/class.smtp.php';
 
-define( 'REDBEAN_MODEL_PREFIX', '' );
-\R::setup( 'mysql:host=' . $database['host'] . ';dbname=' . $database['name'], $database['user'], $database['password'] );
-\R::ext( 'xdispense', function ( $type )
-{
-  return R::getRedBean() -> dispense( $type );
-} );
-
 date_default_timezone_set( 'Europe/Warsaw' );
 
 $mdb = new medoo( [
diff --git a/admin/templates/components/form-edit.php b/admin/templates/components/form-edit.php
index 1ed2713..d9b04c0 100644
--- a/admin/templates/components/form-edit.php
+++ b/admin/templates/components/form-edit.php
@@ -78,7 +78,8 @@ $_SESSION['can_use_rfm'] = true;
                 action="<?= htmlspecialchars($form->action) ?>" enctype="multipart/form-data">
             
             <input type="hidden" name="_form_id" value="<?= htmlspecialchars($form->formId) ?>">
-            
+            <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
+
             <?php foreach ($form->hiddenFields as $name => $value): ?>
               <input type="hidden" name="<?= htmlspecialchars($name) ?>" value="<?= htmlspecialchars($value ?? '') ?>">
             <?php endforeach; ?>
diff --git a/admin/templates/site/unlogged-layout.php b/admin/templates/site/unlogged-layout.php
index fbd1eb6..f1cebd2 100644
--- a/admin/templates/site/unlogged-layout.php
+++ b/admin/templates/site/unlogged-layout.php
@@ -37,12 +37,13 @@
                   ?>
                   <div class="alert alert-danger alert-dismissable">
                     <button type="button" class="close" data-dismiss="alert" aria-hidden="true">×</button>
-                    <i class="icon fa fa-ban "></i><?= $alert;?>
+                    <i class="icon fa fa-ban "></i><?= htmlspecialchars($alert) ?>
                   </div>
                 <? endif;
                 ?>
                 <form method="POST" action="/admin/" class="form-horizontal" rol="form">
                   <input type="hidden" name="s-action" value="user-logon" />
+                  <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
                   <div class="form-group form-inline row">
                     <div class="col-12">
                       <div class="input-group input-login">
diff --git a/admin/templates/users/user-2fa.php b/admin/templates/users/user-2fa.php
index b6bd65e..16e706e 100644
--- a/admin/templates/users/user-2fa.php
+++ b/admin/templates/users/user-2fa.php
@@ -1,5 +1,6 @@
 <form method="POST" action="/admin/" class="form-horizontal" rol="form">
   <input type="hidden" name="s-action" value="user-2fa-verify">
+  <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
   <div class="form-group row">
     <label class="col col-sm-4 control-label" for="login">Kod z e-maila:</label>
     <div class="col col-sm-8">
@@ -14,5 +15,6 @@
 </form>
 <form method="POST" action="/admin/" style="margin-top:10px">
   <input type="hidden" name="s-action" value="user-2fa-resend">
+  <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
   <button class="btn btn-danger">Wyślij kod ponownie</button>
 </form>
\ No newline at end of file
diff --git a/autoload/Domain/Article/ArticleRepository.php b/autoload/Domain/Article/ArticleRepository.php
index bd1a360..fb71159 100644
--- a/autoload/Domain/Article/ArticleRepository.php
+++ b/autoload/Domain/Article/ArticleRepository.php
@@ -850,6 +850,8 @@ class ArticleRepository
         $full = realpath('../' . ltrim($src, '/'));
         if ($full && strpos($full, $base . DIRECTORY_SEPARATOR) === 0 && is_file($full)) {
             unlink($full);
+        } elseif ($full) {
+            error_log( '[shopPRO] safeUnlink: ścieżka poza upload/: ' . $src );
         }
     }
 
diff --git a/autoload/Domain/CronJob/CronJobRepository.php b/autoload/Domain/CronJob/CronJobRepository.php
index 3a872c0..27b667b 100644
--- a/autoload/Domain/CronJob/CronJobRepository.php
+++ b/autoload/Domain/CronJob/CronJobRepository.php
@@ -130,10 +130,22 @@ class CronJobRepository
      */
     public function markFailed($jobId, $error, $attempt = 1)
     {
-        $job = $this->db->get('pp_cron_jobs', ['max_attempts', 'attempts'], ['id' => $jobId]);
+        $job = $this->db->get('pp_cron_jobs', ['job_type', 'max_attempts', 'attempts'], ['id' => $jobId]);
 
         $attempts = $job ? (int) $job['attempts'] : $attempt;
         $maxAttempts = $job ? (int) $job['max_attempts'] : 10;
+        $jobType = $job ? $job['job_type'] : '';
+
+        // Order-related Apilo joby — infinite retry co 30 min
+        if (CronJobType::isOrderRelatedApiloJob($jobType)) {
+            $nextRun = date('Y-m-d H:i:s', time() + CronJobType::APILO_ORDER_BACKOFF_SECONDS);
+            $this->db->update('pp_cron_jobs', [
+                'status' => CronJobType::STATUS_PENDING,
+                'last_error' => mb_substr($error, 0, 500),
+                'scheduled_at' => $nextRun,
+            ], ['id' => $jobId]);
+            return;
+        }
 
         if ($attempts >= $maxAttempts) {
             // Przekroczono limit prób — trwale failed
diff --git a/autoload/Domain/CronJob/CronJobType.php b/autoload/Domain/CronJob/CronJobType.php
index 8bee136..8fe89c0 100644
--- a/autoload/Domain/CronJob/CronJobType.php
+++ b/autoload/Domain/CronJob/CronJobType.php
@@ -34,6 +34,7 @@ class CronJobType
     // Backoff
     const BASE_BACKOFF_SECONDS = 60;
     const MAX_BACKOFF_SECONDS = 3600;
+    const APILO_ORDER_BACKOFF_SECONDS = 1800; // 30 min — stały interwał dla order jobów
 
     /**
      * @return string[]
@@ -69,6 +70,19 @@ class CronJobType
         ];
     }
 
+    /**
+     * @param string $jobType
+     * @return bool
+     */
+    public static function isOrderRelatedApiloJob($jobType)
+    {
+        return in_array($jobType, [
+            self::APILO_SEND_ORDER,
+            self::APILO_SYNC_PAYMENT,
+            self::APILO_SYNC_STATUS,
+        ], true);
+    }
+
     /**
      * @param int $attempt
      * @return int
diff --git a/autoload/Domain/Integrations/ApiloRepository.php b/autoload/Domain/Integrations/ApiloRepository.php
new file mode 100644
index 0000000..1bcaf85
--- /dev/null
+++ b/autoload/Domain/Integrations/ApiloRepository.php
@@ -0,0 +1,567 @@
+<?php
+namespace Domain\Integrations;
+
+class ApiloRepository
+{
+    private $db;
+
+    private const SETTINGS_TABLE = 'pp_shop_apilo_settings';
+
+    private const APILO_ENDPOINTS = [
+        'platform' => 'https://projectpro.apilo.com/rest/api/orders/platform/map/',
+        'status'   => 'https://projectpro.apilo.com/rest/api/orders/status/map/',
+        'carrier'  => 'https://projectpro.apilo.com/rest/api/orders/carrier-account/map/',
+        'payment'  => 'https://projectpro.apilo.com/rest/api/orders/payment/map/',
+    ];
+
+    private const APILO_SETTINGS_KEYS = [
+        'platform' => 'platform-list',
+        'status'   => 'status-types-list',
+        'carrier'  => 'carrier-account-list',
+        'payment'  => 'payment-types-list',
+    ];
+
+    public function __construct( $db )
+    {
+        $this->db = $db;
+    }
+
+    // ── Settings access (Apilo-specific) ────────────────────────
+
+    private function getApiloSettings(): array
+    {
+        $rows = $this->db->select( self::SETTINGS_TABLE, [ 'name', 'value' ] );
+        $settings = [];
+        foreach ( $rows ?: [] as $row )
+            $settings[$row['name']] = $row['value'];
+
+        return $settings;
+    }
+
+    private function saveApiloSetting( string $name, $value ): void
+    {
+        if ( $this->db->count( self::SETTINGS_TABLE, [ 'name' => $name ] ) ) {
+            $this->db->update( self::SETTINGS_TABLE, [ 'value' => $value ], [ 'name' => $name ] );
+        } else {
+            $this->db->insert( self::SETTINGS_TABLE, [ 'name' => $name, 'value' => $value ] );
+        }
+        \Shared\Helpers\Helpers::delete_dir( '../temp/' );
+    }
+
+    // ── Apilo OAuth ─────────────────────────────────────────────
+
+    public function apiloAuthorize( string $clientId, string $clientSecret, string $authCode ): bool
+    {
+        $postData = [
+            'grantType' => 'authorization_code',
+            'token'     => $authCode,
+        ];
+
+        $ch = curl_init( "https://projectpro.apilo.com/rest/auth/token/" );
+        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
+        curl_setopt( $ch, CURLOPT_CUSTOMREQUEST, "POST" );
+        curl_setopt( $ch, CURLOPT_POSTFIELDS, json_encode( $postData ) );
+        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
+            "Authorization: Basic " . base64_encode( $clientId . ":" . $clientSecret ),
+            "Accept: application/json"
+        ] );
+
+        $response = curl_exec( $ch );
+        if ( curl_errno( $ch ) ) {
+            curl_close( $ch );
+            return false;
+        }
+        curl_close( $ch );
+        $response = json_decode( $response, true );
+
+        if ( empty( $response['accessToken'] ) )
+            return false;
+
+        try {
+            $this->saveApiloSetting( 'access-token', $response['accessToken'] );
+            $this->saveApiloSetting( 'refresh-token', $response['refreshToken'] );
+            $this->saveApiloSetting( 'access-token-expire-at', $response['accessTokenExpireAt'] );
+            $this->saveApiloSetting( 'refresh-token-expire-at', $response['refreshTokenExpireAt'] );
+        } catch ( \Exception $e ) {
+            error_log( '[shopPRO] Apilo: błąd zapisu tokenów: ' . $e->getMessage() );
+            return false;
+        }
+
+        return true;
+    }
+
+    public function apiloGetAccessToken( int $refreshLeadSeconds = 300 ): ?string
+    {
+        $settings = $this->getApiloSettings();
+
+        $hasRefreshCredentials = !empty( $settings['refresh-token'] )
+            && !empty( $settings['client-id'] )
+            && !empty( $settings['client-secret'] );
+
+        $accessToken = trim( (string)($settings['access-token'] ?? '') );
+        $accessTokenExpireAt = trim( (string)($settings['access-token-expire-at'] ?? '') );
+
+        if ( $accessToken !== '' && $accessTokenExpireAt !== '' ) {
+            if ( !$this->shouldRefreshAccessToken( $accessTokenExpireAt, $refreshLeadSeconds ) ) {
+                return $accessToken;
+            }
+        }
+
+        if ( !$hasRefreshCredentials ) {
+            return null;
+        }
+
+        if (
+            !empty( $settings['refresh-token-expire-at'] ) &&
+            !$this->isFutureDate( (string)$settings['refresh-token-expire-at'] )
+        ) {
+            return null;
+        }
+
+        return $this->refreshApiloAccessToken( $settings );
+    }
+
+    /**
+     * Keepalive tokenu Apilo do uzycia w CRON.
+     * Odswieza token, gdy wygasa lub jest bliski wygasniecia.
+     *
+     * @return array{success:bool,skipped:bool,message:string}
+     */
+    public function apiloKeepalive( int $refreshLeadSeconds = 300 ): array
+    {
+        $settings = $this->getApiloSettings();
+
+        if ( (int)($settings['enabled'] ?? 0) !== 1 ) {
+            return [
+                'success' => false,
+                'skipped' => true,
+                'message' => 'Apilo disabled.',
+            ];
+        }
+
+        if ( empty( $settings['client-id'] ) || empty( $settings['client-secret'] ) ) {
+            return [
+                'success' => false,
+                'skipped' => true,
+                'message' => 'Missing Apilo credentials.',
+            ];
+        }
+
+        $token = $this->apiloGetAccessToken( $refreshLeadSeconds );
+        if ( !$token ) {
+            return [
+                'success' => false,
+                'skipped' => false,
+                'message' => 'Unable to refresh Apilo token.',
+            ];
+        }
+
+        $this->saveApiloSetting( 'token-keepalive-at', date( 'Y-m-d H:i:s' ) );
+
+        return [
+            'success' => true,
+            'skipped' => false,
+            'message' => 'Apilo token keepalive OK.',
+        ];
+    }
+
+    private function refreshApiloAccessToken( array $settings ): ?string
+    {
+        $postData = [
+            'grantType' => 'refresh_token',
+            'token'     => $settings['refresh-token'],
+        ];
+
+        $ch = curl_init( "https://projectpro.apilo.com/rest/auth/token/" );
+        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
+            "Authorization: Basic " . base64_encode( $settings['client-id'] . ":" . $settings['client-secret'] ),
+            "Accept: application/json"
+        ] );
+        curl_setopt( $ch, CURLOPT_POST, true );
+        curl_setopt( $ch, CURLOPT_POSTFIELDS, json_encode( $postData ) );
+        curl_setopt( $ch, CURLOPT_CUSTOMREQUEST, "POST" );
+        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
+
+        $response = curl_exec( $ch );
+        if ( curl_errno( $ch ) ) {
+            curl_close( $ch );
+            return null;
+        }
+        curl_close( $ch );
+        $response = json_decode( $response, true );
+
+        if ( empty( $response['accessToken'] ) ) {
+            return null;
+        }
+
+        $this->saveApiloSetting( 'access-token', $response['accessToken'] );
+        $this->saveApiloSetting( 'refresh-token', $response['refreshToken'] ?? ( $settings['refresh-token'] ?? '' ) );
+        $this->saveApiloSetting( 'access-token-expire-at', $response['accessTokenExpireAt'] ?? null );
+        $this->saveApiloSetting( 'refresh-token-expire-at', $response['refreshTokenExpireAt'] ?? null );
+
+        return $response['accessToken'];
+    }
+
+    private function shouldRefreshAccessToken( string $expiresAtRaw, int $leadSeconds = 300 ): bool
+    {
+        try {
+            $expiresAt = new \DateTime( $expiresAtRaw );
+        } catch ( \Exception $e ) {
+            return true;
+        }
+
+        $threshold = new \DateTime( date( 'Y-m-d H:i:s', time() + max( 0, $leadSeconds ) ) );
+        return $expiresAt <= $threshold;
+    }
+
+    private function isFutureDate( string $dateRaw ): bool
+    {
+        try {
+            $date = new \DateTime( $dateRaw );
+        } catch ( \Exception $e ) {
+            return false;
+        }
+
+        return $date > new \DateTime( date( 'Y-m-d H:i:s' ) );
+    }
+
+    /**
+     * Sprawdza aktualny stan integracji Apilo i zwraca komunikat dla UI.
+     *
+     * @return array{is_valid:bool,severity:string,message:string}
+     */
+    public function apiloIntegrationStatus(): array
+    {
+        $settings = $this->getApiloSettings();
+
+        $missing = [];
+        foreach ( [ 'client-id', 'client-secret' ] as $field ) {
+            if ( trim( (string)($settings[$field] ?? '') ) === '' )
+                $missing[] = $field;
+        }
+
+        if ( !empty( $missing ) ) {
+            return [
+                'is_valid' => false,
+                'severity' => 'danger',
+                'message' => 'Brakuje konfiguracji Apilo: ' . implode( ', ', $missing ) . '.',
+            ];
+        }
+
+        $accessToken = trim( (string)($settings['access-token'] ?? '') );
+        $authorizationCode = trim( (string)($settings['authorization-code'] ?? '') );
+
+        if ( $accessToken === '' ) {
+            if ( $authorizationCode === '' ) {
+                return [
+                    'is_valid' => false,
+                    'severity' => 'warning',
+                    'message' => 'Brak authorization-code i access-token. Wpisz kod autoryzacji i uruchom autoryzacje.',
+                ];
+            }
+
+            return [
+                'is_valid' => false,
+                'severity' => 'warning',
+                'message' => 'Brak access-token. Uruchom autoryzacje Apilo.',
+            ];
+        }
+
+        $token = $this->apiloGetAccessToken();
+        if ( !$token ) {
+            return [
+                'is_valid' => false,
+                'severity' => 'danger',
+                'message' => 'Token Apilo jest niewazny lub wygasl i nie udal sie refresh. Wykonaj ponowna autoryzacje.',
+            ];
+        }
+
+        $expiresAt = trim( (string)($settings['access-token-expire-at'] ?? '') );
+        $suffix = $expiresAt !== '' ? ( ' Token wazny do: ' . $expiresAt . '.' ) : '';
+
+        return [
+            'is_valid' => true,
+            'severity' => 'success',
+            'message' => 'Integracja Apilo jest aktywna.' . $suffix,
+        ];
+    }
+
+    // ── Apilo API fetch lists ───────────────────────────────────
+
+    /**
+     * Fetch list from Apilo API and save to settings.
+     * @param string $type  platform|status|carrier|payment
+     */
+    public function apiloFetchList( string $type ): bool
+    {
+        $result = $this->apiloFetchListResult( $type );
+        return !empty( $result['success'] );
+    }
+
+    /**
+     * Fetch list from Apilo API and return detailed status for UI.
+     *
+     * @param string $type platform|status|carrier|payment
+     * @return array{success:bool,count:int,message:string}
+     */
+    public function apiloFetchListResult( string $type ): array
+    {
+        if ( !isset( self::APILO_ENDPOINTS[$type] ) )
+            throw new \InvalidArgumentException( "Unknown apilo list type: $type" );
+
+        $settings = $this->getApiloSettings();
+        $missingFields = [];
+        foreach ( [ 'client-id', 'client-secret' ] as $requiredField ) {
+            if ( trim( (string)($settings[$requiredField] ?? '') ) === '' )
+                $missingFields[] = $requiredField;
+        }
+
+        if ( !empty( $missingFields ) ) {
+            return [
+                'success' => false,
+                'count' => 0,
+                'message' => 'Brakuje konfiguracji Apilo: ' . implode( ', ', $missingFields ) . '. Uzupelnij pola i zapisz ustawienia.',
+            ];
+        }
+
+        $accessToken = $this->apiloGetAccessToken();
+        if ( !$accessToken ) {
+            return [
+                'success' => false,
+                'count' => 0,
+                'message' => 'Brak aktywnego tokenu Apilo. Wykonaj autoryzacje Apilo i sprobuj ponownie.',
+            ];
+        }
+
+        $ch = curl_init( self::APILO_ENDPOINTS[$type] );
+        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
+        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
+            "Authorization: Bearer " . $accessToken,
+            "Accept: application/json"
+        ] );
+
+        $response = curl_exec( $ch );
+        if ( curl_errno( $ch ) ) {
+            $error = curl_error( $ch );
+            curl_close( $ch );
+            return [
+                'success' => false,
+                'count' => 0,
+                'message' => 'Blad polaczenia z Apilo: ' . $error . '. Sprawdz polaczenie serwera i sprobuj ponownie.',
+            ];
+        }
+        $httpCode = (int) curl_getinfo( $ch, CURLINFO_HTTP_CODE );
+        curl_close( $ch );
+
+        $data = json_decode( $response, true );
+        if ( !is_array( $data ) ) {
+            $responsePreview = substr( trim( (string)$response ), 0, 180 );
+            if ( $responsePreview === '' )
+                $responsePreview = '[pusta odpowiedz]';
+
+            return [
+                'success' => false,
+                'count' => 0,
+                'message' => 'Apilo zwrocilo niepoprawny format odpowiedzi (HTTP ' . $httpCode . '). Odpowiedz: ' . $responsePreview,
+            ];
+        }
+
+        if ( $httpCode >= 400 ) {
+            return [
+                'success' => false,
+                'count' => 0,
+                'message' => 'Apilo zwrocilo blad HTTP ' . $httpCode . ': ' . $this->extractApiloErrorMessage( $data ),
+            ];
+        }
+
+        $normalizedList = $this->normalizeApiloMapList( $data );
+        if ( $normalizedList === null ) {
+            return [
+                'success' => false,
+                'count' => 0,
+                'message' => 'Apilo zwrocilo dane w nieoczekiwanym formacie. Odswiez token i sproboj ponownie.',
+            ];
+        }
+
+        $this->saveApiloSetting( self::APILO_SETTINGS_KEYS[$type], $normalizedList );
+        return [
+            'success' => true,
+            'count' => count( $normalizedList ),
+            'message' => 'OK',
+        ];
+    }
+
+    /**
+     * Normalizuje odpowiedz API mapowania do listy rekordow ['id' => ..., 'name' => ...].
+     * Zwraca null dla payloadu bledow lub nieoczekiwanego formatu.
+     *
+     * @return array<int, array{id:mixed,name:mixed}>|null
+     */
+    private function normalizeApiloMapList( array $data ): ?array
+    {
+        if ( isset( $data['message'] ) && isset( $data['code'] ) )
+            return null;
+
+        if ( $this->isMapListShape( $data ) )
+            return $data;
+
+        if ( isset( $data['items'] ) && is_array( $data['items'] ) && $this->isMapListShape( $data['items'] ) )
+            return $data['items'];
+
+        if ( isset( $data['data'] ) && is_array( $data['data'] ) && $this->isMapListShape( $data['data'] ) )
+            return $data['data'];
+
+        // Dopuszczamy rowniez format asocjacyjny: [id => name, ...], ale tylko dla kluczy liczbowych.
+        if ( !empty( $data ) ) {
+            $normalized = [];
+            foreach ( $data as $key => $value ) {
+                if ( !( is_int( $key ) || ( is_string( $key ) && preg_match('/^-?\d+$/', $key) === 1 ) ) )
+                    return null;
+
+                if ( !is_scalar( $value ) )
+                    return null;
+
+                $normalized[] = [
+                    'id' => $key,
+                    'name' => (string) $value,
+                ];
+            }
+
+            return !empty( $normalized ) ? $normalized : null;
+        }
+
+        return null;
+    }
+
+    private function isMapListShape( array $list ): bool
+    {
+        if ( empty( $list ) )
+            return false;
+
+        foreach ( $list as $row ) {
+            if ( !is_array( $row ) || !array_key_exists( 'id', $row ) || !array_key_exists( 'name', $row ) )
+                return false;
+        }
+
+        return true;
+    }
+
+    private function extractApiloErrorMessage( array $data ): string
+    {
+        foreach ( [ 'message', 'error', 'detail', 'title' ] as $key ) {
+            if ( isset( $data[$key] ) && is_scalar( $data[$key] ) ) {
+                $message = trim( (string)$data[$key] );
+                if ( $message !== '' )
+                    return $message;
+            }
+        }
+
+        if ( isset( $data['errors'] ) ) {
+            if ( is_array( $data['errors'] ) ) {
+                $flat = [];
+                foreach ( $data['errors'] as $errorItem ) {
+                    if ( is_scalar( $errorItem ) )
+                        $flat[] = (string)$errorItem;
+                    elseif ( is_array( $errorItem ) )
+                        $flat[] = json_encode( $errorItem, JSON_UNESCAPED_UNICODE );
+                }
+
+                if ( !empty( $flat ) )
+                    return implode( '; ', $flat );
+            } elseif ( is_scalar( $data['errors'] ) ) {
+                return (string)$data['errors'];
+            }
+        }
+
+        return 'Nieznany blad odpowiedzi API.';
+    }
+
+    // ── Apilo product operations ────────────────────────────────
+
+    public function apiloProductSearch( string $sku ): array
+    {
+        $accessToken = $this->apiloGetAccessToken();
+        if ( !$accessToken )
+            return [ 'status' => 'error', 'msg' => 'Brak tokenu Apilo.' ];
+
+        $url = "https://projectpro.apilo.com/rest/api/warehouse/product/?" . http_build_query( [ 'sku' => $sku ] );
+
+        $ch = curl_init( $url );
+        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
+        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
+            "Authorization: Bearer " . $accessToken,
+            "Accept: application/json"
+        ] );
+
+        $response = curl_exec( $ch );
+        if ( curl_errno( $ch ) ) {
+            $error = curl_error( $ch );
+            curl_close( $ch );
+            return [ 'status' => 'error', 'msg' => 'Błąd cURL: ' . $error ];
+        }
+        curl_close( $ch );
+
+        $data = json_decode( $response, true );
+        if ( $data && isset( $data['products'] ) ) {
+            $data['status'] = 'SUCCESS';
+            return $data;
+        }
+
+        return [ 'status' => 'SUCCESS', 'msg' => 'Brak wyników dla podanego SKU.', 'products' => '' ];
+    }
+
+    public function apiloCreateProduct( int $productId ): array
+    {
+        $accessToken = $this->apiloGetAccessToken();
+        if ( !$accessToken )
+            return [ 'success' => false, 'message' => 'Brak tokenu Apilo.' ];
+
+        $product = ( new \Domain\Product\ProductRepository( $this->db ) )->findCached( $productId );
+
+        $params = [
+            'sku'              => $product['sku'],
+            'ean'              => $product['ean'],
+            'name'             => $product['language']['name'],
+            'tax'              => (int) $product['vat'],
+            'status'           => 1,
+            'quantity'         => (int) $product['quantity'],
+            'priceWithTax'     => $product['price_brutto'],
+            'description'      => $product['language']['description'] . '<br>' . $product['language']['short_description'],
+            'shortDescription' => '',
+            'images'           => [],
+        ];
+
+        foreach ( $product['images'] as $image )
+            $params['images'][] = "https://" . $_SERVER['HTTP_HOST'] . $image['src'];
+
+        $ch = curl_init( "https://projectpro.apilo.com/rest/api/warehouse/product/" );
+        curl_setopt( $ch, CURLOPT_POSTFIELDS, json_encode( [ $params ] ) );
+        curl_setopt( $ch, CURLOPT_CUSTOMREQUEST, "POST" );
+        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
+            "Authorization: Bearer " . $accessToken,
+            "Content-Type: application/json",
+            "Accept: application/json"
+        ] );
+        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
+        $response = curl_exec( $ch );
+        $responseData = json_decode( $response, true );
+
+        if ( curl_errno( $ch ) ) {
+            $error = curl_error( $ch );
+            curl_close( $ch );
+            return [ 'success' => false, 'message' => 'Błąd cURL: ' . $error ];
+        }
+        curl_close( $ch );
+
+        if ( !empty( $responseData['products'] ) ) {
+            $this->db->update( 'pp_shop_products', [
+                'apilo_product_id'   => reset( $responseData['products'] ),
+                'apilo_product_name' => $product['language']['name'],
+            ], [ 'id' => $product['id'] ] );
+
+            return [ 'success' => true, 'message' => 'Produkt został dodany do magazynu APILO.' ];
+        }
+
+        return [ 'success' => false, 'message' => 'Podczas dodawania produktu wystąpił błąd.' ];
+    }
+}
diff --git a/autoload/Domain/Integrations/IntegrationsRepository.php b/autoload/Domain/Integrations/IntegrationsRepository.php
index 545269d..a2f9fee 100644
--- a/autoload/Domain/Integrations/IntegrationsRepository.php
+++ b/autoload/Domain/Integrations/IntegrationsRepository.php
@@ -130,444 +130,7 @@ class IntegrationsRepository
         ], [ 'id' => $productId ] );
     }
 
-    // ── Apilo OAuth ─────────────────────────────────────────────
-
-    public function apiloAuthorize( string $clientId, string $clientSecret, string $authCode ): bool
-    {
-        $postData = [
-            'grantType' => 'authorization_code',
-            'token'     => $authCode,
-        ];
-
-        $ch = curl_init( "https://projectpro.apilo.com/rest/auth/token/" );
-        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
-        curl_setopt( $ch, CURLOPT_CUSTOMREQUEST, "POST" );
-        curl_setopt( $ch, CURLOPT_POSTFIELDS, json_encode( $postData ) );
-        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
-            "Authorization: Basic " . base64_encode( $clientId . ":" . $clientSecret ),
-            "Accept: application/json"
-        ] );
-
-        $response = curl_exec( $ch );
-        if ( curl_errno( $ch ) ) {
-            curl_close( $ch );
-            return false;
-        }
-        curl_close( $ch );
-        $response = json_decode( $response, true );
-
-        if ( empty( $response['accessToken'] ) )
-            return false;
-
-        $this->saveSetting( 'apilo', 'access-token', $response['accessToken'] );
-        $this->saveSetting( 'apilo', 'refresh-token', $response['refreshToken'] );
-        $this->saveSetting( 'apilo', 'access-token-expire-at', $response['accessTokenExpireAt'] );
-        $this->saveSetting( 'apilo', 'refresh-token-expire-at', $response['refreshTokenExpireAt'] );
-
-        return true;
-    }
-
-    public function apiloGetAccessToken( int $refreshLeadSeconds = 300 ): ?string
-    {
-        $settings = $this->getSettings( 'apilo' );
-
-        $hasRefreshCredentials = !empty( $settings['refresh-token'] )
-            && !empty( $settings['client-id'] )
-            && !empty( $settings['client-secret'] );
-
-        $accessToken = trim( (string)($settings['access-token'] ?? '') );
-        $accessTokenExpireAt = trim( (string)($settings['access-token-expire-at'] ?? '') );
-
-        if ( $accessToken !== '' && $accessTokenExpireAt !== '' ) {
-            if ( !$this->shouldRefreshAccessToken( $accessTokenExpireAt, $refreshLeadSeconds ) ) {
-                return $accessToken;
-            }
-        }
-
-        if ( !$hasRefreshCredentials ) {
-            return null;
-        }
-
-        if (
-            !empty( $settings['refresh-token-expire-at'] ) &&
-            !$this->isFutureDate( (string)$settings['refresh-token-expire-at'] )
-        ) {
-            return null;
-        }
-
-        return $this->refreshApiloAccessToken( $settings );
-    }
-
-    /**
-     * Keepalive tokenu Apilo do uzycia w CRON.
-     * Odswieza token, gdy wygasa lub jest bliski wygasniecia.
-     *
-     * @return array{success:bool,skipped:bool,message:string}
-     */
-    public function apiloKeepalive( int $refreshLeadSeconds = 300 ): array
-    {
-        $settings = $this->getSettings( 'apilo' );
-
-        if ( (int)($settings['enabled'] ?? 0) !== 1 ) {
-            return [
-                'success' => false,
-                'skipped' => true,
-                'message' => 'Apilo disabled.',
-            ];
-        }
-
-        if ( empty( $settings['client-id'] ) || empty( $settings['client-secret'] ) ) {
-            return [
-                'success' => false,
-                'skipped' => true,
-                'message' => 'Missing Apilo credentials.',
-            ];
-        }
-
-        $token = $this->apiloGetAccessToken( $refreshLeadSeconds );
-        if ( !$token ) {
-            return [
-                'success' => false,
-                'skipped' => false,
-                'message' => 'Unable to refresh Apilo token.',
-            ];
-        }
-
-        $this->saveSetting( 'apilo', 'token-keepalive-at', date( 'Y-m-d H:i:s' ) );
-
-        return [
-            'success' => true,
-            'skipped' => false,
-            'message' => 'Apilo token keepalive OK.',
-        ];
-    }
-
-    private function refreshApiloAccessToken( array $settings ): ?string
-    {
-        $postData = [
-            'grantType' => 'refresh_token',
-            'token'     => $settings['refresh-token'],
-        ];
-
-        $ch = curl_init( "https://projectpro.apilo.com/rest/auth/token/" );
-        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
-            "Authorization: Basic " . base64_encode( $settings['client-id'] . ":" . $settings['client-secret'] ),
-            "Accept: application/json"
-        ] );
-        curl_setopt( $ch, CURLOPT_POST, true );
-        curl_setopt( $ch, CURLOPT_POSTFIELDS, json_encode( $postData ) );
-        curl_setopt( $ch, CURLOPT_CUSTOMREQUEST, "POST" );
-        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
-
-        $response = curl_exec( $ch );
-        if ( curl_errno( $ch ) ) {
-            curl_close( $ch );
-            return null;
-        }
-        curl_close( $ch );
-        $response = json_decode( $response, true );
-
-        if ( empty( $response['accessToken'] ) ) {
-            return null;
-        }
-
-        $this->saveSetting( 'apilo', 'access-token', $response['accessToken'] );
-        $this->saveSetting( 'apilo', 'refresh-token', $response['refreshToken'] ?? ( $settings['refresh-token'] ?? '' ) );
-        $this->saveSetting( 'apilo', 'access-token-expire-at', $response['accessTokenExpireAt'] ?? null );
-        $this->saveSetting( 'apilo', 'refresh-token-expire-at', $response['refreshTokenExpireAt'] ?? null );
-
-        return $response['accessToken'];
-    }
-
-    private function shouldRefreshAccessToken( string $expiresAtRaw, int $leadSeconds = 300 ): bool
-    {
-        try {
-            $expiresAt = new \DateTime( $expiresAtRaw );
-        } catch ( \Exception $e ) {
-            return true;
-        }
-
-        $threshold = new \DateTime( date( 'Y-m-d H:i:s', time() + max( 0, $leadSeconds ) ) );
-        return $expiresAt <= $threshold;
-    }
-
-    private function isFutureDate( string $dateRaw ): bool
-    {
-        try {
-            $date = new \DateTime( $dateRaw );
-        } catch ( \Exception $e ) {
-            return false;
-        }
-
-        return $date > new \DateTime( date( 'Y-m-d H:i:s' ) );
-    }
-
-    /**
-     * Sprawdza aktualny stan integracji Apilo i zwraca komunikat dla UI.
-     *
-     * @return array{is_valid:bool,severity:string,message:string}
-     */
-    public function apiloIntegrationStatus(): array
-    {
-        $settings = $this->getSettings( 'apilo' );
-
-        $missing = [];
-        foreach ( [ 'client-id', 'client-secret' ] as $field ) {
-            if ( trim( (string)($settings[$field] ?? '') ) === '' )
-                $missing[] = $field;
-        }
-
-        if ( !empty( $missing ) ) {
-            return [
-                'is_valid' => false,
-                'severity' => 'danger',
-                'message' => 'Brakuje konfiguracji Apilo: ' . implode( ', ', $missing ) . '.',
-            ];
-        }
-
-        $accessToken = trim( (string)($settings['access-token'] ?? '') );
-        $authorizationCode = trim( (string)($settings['authorization-code'] ?? '') );
-
-        if ( $accessToken === '' ) {
-            if ( $authorizationCode === '' ) {
-                return [
-                    'is_valid' => false,
-                    'severity' => 'warning',
-                    'message' => 'Brak authorization-code i access-token. Wpisz kod autoryzacji i uruchom autoryzacje.',
-                ];
-            }
-
-            return [
-                'is_valid' => false,
-                'severity' => 'warning',
-                'message' => 'Brak access-token. Uruchom autoryzacje Apilo.',
-            ];
-        }
-
-        $token = $this->apiloGetAccessToken();
-        if ( !$token ) {
-            return [
-                'is_valid' => false,
-                'severity' => 'danger',
-                'message' => 'Token Apilo jest niewazny lub wygasl i nie udal sie refresh. Wykonaj ponowna autoryzacje.',
-            ];
-        }
-
-        $expiresAt = trim( (string)($settings['access-token-expire-at'] ?? '') );
-        $suffix = $expiresAt !== '' ? ( ' Token wazny do: ' . $expiresAt . '.' ) : '';
-
-        return [
-            'is_valid' => true,
-            'severity' => 'success',
-            'message' => 'Integracja Apilo jest aktywna.' . $suffix,
-        ];
-    }
-
-    // ── Apilo API fetch lists ───────────────────────────────────
-
-    private const APILO_ENDPOINTS = [
-        'platform' => 'https://projectpro.apilo.com/rest/api/orders/platform/map/',
-        'status'   => 'https://projectpro.apilo.com/rest/api/orders/status/map/',
-        'carrier'  => 'https://projectpro.apilo.com/rest/api/orders/carrier-account/map/',
-        'payment'  => 'https://projectpro.apilo.com/rest/api/orders/payment/map/',
-    ];
-
-    private const APILO_SETTINGS_KEYS = [
-        'platform' => 'platform-list',
-        'status'   => 'status-types-list',
-        'carrier'  => 'carrier-account-list',
-        'payment'  => 'payment-types-list',
-    ];
-
-    /**
-     * Fetch list from Apilo API and save to settings.
-     * @param string $type  platform|status|carrier|payment
-     */
-    public function apiloFetchList( string $type ): bool
-    {
-        $result = $this->apiloFetchListResult( $type );
-        return !empty( $result['success'] );
-    }
-
-    /**
-     * Fetch list from Apilo API and return detailed status for UI.
-     *
-     * @param string $type platform|status|carrier|payment
-     * @return array{success:bool,count:int,message:string}
-     */
-    public function apiloFetchListResult( string $type ): array
-    {
-        if ( !isset( self::APILO_ENDPOINTS[$type] ) )
-            throw new \InvalidArgumentException( "Unknown apilo list type: $type" );
-
-        $settings = $this->getSettings( 'apilo' );
-        $missingFields = [];
-        foreach ( [ 'client-id', 'client-secret' ] as $requiredField ) {
-            if ( trim( (string)($settings[$requiredField] ?? '') ) === '' )
-                $missingFields[] = $requiredField;
-        }
-
-        if ( !empty( $missingFields ) ) {
-            return [
-                'success' => false,
-                'count' => 0,
-                'message' => 'Brakuje konfiguracji Apilo: ' . implode( ', ', $missingFields ) . '. Uzupelnij pola i zapisz ustawienia.',
-            ];
-        }
-
-        $accessToken = $this->apiloGetAccessToken();
-        if ( !$accessToken ) {
-            return [
-                'success' => false,
-                'count' => 0,
-                'message' => 'Brak aktywnego tokenu Apilo. Wykonaj autoryzacje Apilo i sprobuj ponownie.',
-            ];
-        }
-
-        $ch = curl_init( self::APILO_ENDPOINTS[$type] );
-        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
-        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
-            "Authorization: Bearer " . $accessToken,
-            "Accept: application/json"
-        ] );
-
-        $response = curl_exec( $ch );
-        if ( curl_errno( $ch ) ) {
-            $error = curl_error( $ch );
-            curl_close( $ch );
-            return [
-                'success' => false,
-                'count' => 0,
-                'message' => 'Blad polaczenia z Apilo: ' . $error . '. Sprawdz polaczenie serwera i sprobuj ponownie.',
-            ];
-        }
-        $httpCode = (int) curl_getinfo( $ch, CURLINFO_HTTP_CODE );
-        curl_close( $ch );
-
-        $data = json_decode( $response, true );
-        if ( !is_array( $data ) ) {
-            $responsePreview = substr( trim( (string)$response ), 0, 180 );
-            if ( $responsePreview === '' )
-                $responsePreview = '[pusta odpowiedz]';
-
-            return [
-                'success' => false,
-                'count' => 0,
-                'message' => 'Apilo zwrocilo niepoprawny format odpowiedzi (HTTP ' . $httpCode . '). Odpowiedz: ' . $responsePreview,
-            ];
-        }
-
-        if ( $httpCode >= 400 ) {
-            return [
-                'success' => false,
-                'count' => 0,
-                'message' => 'Apilo zwrocilo blad HTTP ' . $httpCode . ': ' . $this->extractApiloErrorMessage( $data ),
-            ];
-        }
-
-        $normalizedList = $this->normalizeApiloMapList( $data );
-        if ( $normalizedList === null ) {
-            return [
-                'success' => false,
-                'count' => 0,
-                'message' => 'Apilo zwrocilo dane w nieoczekiwanym formacie. Odswiez token i sproboj ponownie.',
-            ];
-        }
-
-        $this->saveSetting( 'apilo', self::APILO_SETTINGS_KEYS[$type], $normalizedList );
-        return [
-            'success' => true,
-            'count' => count( $normalizedList ),
-            'message' => 'OK',
-        ];
-    }
-
-    /**
-     * Normalizuje odpowiedz API mapowania do listy rekordow ['id' => ..., 'name' => ...].
-     * Zwraca null dla payloadu bledow lub nieoczekiwanego formatu.
-     *
-     * @return array<int, array{id:mixed,name:mixed}>|null
-     */
-    private function normalizeApiloMapList( array $data ): ?array
-    {
-        if ( isset( $data['message'] ) && isset( $data['code'] ) )
-            return null;
-
-        if ( $this->isMapListShape( $data ) )
-            return $data;
-
-        if ( isset( $data['items'] ) && is_array( $data['items'] ) && $this->isMapListShape( $data['items'] ) )
-            return $data['items'];
-
-        if ( isset( $data['data'] ) && is_array( $data['data'] ) && $this->isMapListShape( $data['data'] ) )
-            return $data['data'];
-
-        // Dopuszczamy rowniez format asocjacyjny: [id => name, ...], ale tylko dla kluczy liczbowych.
-        if ( !empty( $data ) ) {
-            $normalized = [];
-            foreach ( $data as $key => $value ) {
-                if ( !( is_int( $key ) || ( is_string( $key ) && preg_match('/^-?\d+$/', $key) === 1 ) ) )
-                    return null;
-
-                if ( !is_scalar( $value ) )
-                    return null;
-
-                $normalized[] = [
-                    'id' => $key,
-                    'name' => (string) $value,
-                ];
-            }
-
-            return !empty( $normalized ) ? $normalized : null;
-        }
-
-        return null;
-    }
-
-    private function isMapListShape( array $list ): bool
-    {
-        if ( empty( $list ) )
-            return false;
-
-        foreach ( $list as $row ) {
-            if ( !is_array( $row ) || !array_key_exists( 'id', $row ) || !array_key_exists( 'name', $row ) )
-                return false;
-        }
-
-        return true;
-    }
-
-    private function extractApiloErrorMessage( array $data ): string
-    {
-        foreach ( [ 'message', 'error', 'detail', 'title' ] as $key ) {
-            if ( isset( $data[$key] ) && is_scalar( $data[$key] ) ) {
-                $message = trim( (string)$data[$key] );
-                if ( $message !== '' )
-                    return $message;
-            }
-        }
-
-        if ( isset( $data['errors'] ) ) {
-            if ( is_array( $data['errors'] ) ) {
-                $flat = [];
-                foreach ( $data['errors'] as $errorItem ) {
-                    if ( is_scalar( $errorItem ) )
-                        $flat[] = (string)$errorItem;
-                    elseif ( is_array( $errorItem ) )
-                        $flat[] = json_encode( $errorItem, JSON_UNESCAPED_UNICODE );
-                }
-
-                if ( !empty( $flat ) )
-                    return implode( '; ', $flat );
-            } elseif ( is_scalar( $data['errors'] ) ) {
-                return (string)$data['errors'];
-            }
-        }
-
-        return 'Nieznany blad odpowiedzi API.';
-    }
-
-    // ── Apilo product operations ────────────────────────────────
+    // ── Product data ─────────────────────────────────────────────
 
     public function getProductSku( int $productId ): ?string
     {
@@ -575,93 +138,6 @@ class IntegrationsRepository
         return $sku ?: null;
     }
 
-    public function apiloProductSearch( string $sku ): array
-    {
-        $accessToken = $this->apiloGetAccessToken();
-        if ( !$accessToken )
-            return [ 'status' => 'error', 'msg' => 'Brak tokenu Apilo.' ];
-
-        $url = "https://projectpro.apilo.com/rest/api/warehouse/product/?" . http_build_query( [ 'sku' => $sku ] );
-
-        $ch = curl_init( $url );
-        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
-        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
-            "Authorization: Bearer " . $accessToken,
-            "Accept: application/json"
-        ] );
-
-        $response = curl_exec( $ch );
-        if ( curl_errno( $ch ) ) {
-            $error = curl_error( $ch );
-            curl_close( $ch );
-            return [ 'status' => 'error', 'msg' => 'Błąd cURL: ' . $error ];
-        }
-        curl_close( $ch );
-
-        $data = json_decode( $response, true );
-        if ( $data && isset( $data['products'] ) ) {
-            $data['status'] = 'SUCCESS';
-            return $data;
-        }
-
-        return [ 'status' => 'SUCCESS', 'msg' => 'Brak wyników dla podanego SKU.', 'products' => '' ];
-    }
-
-    public function apiloCreateProduct( int $productId ): array
-    {
-        $accessToken = $this->apiloGetAccessToken();
-        if ( !$accessToken )
-            return [ 'success' => false, 'message' => 'Brak tokenu Apilo.' ];
-
-        $product = ( new \Domain\Product\ProductRepository( $this->db ) )->findCached( $productId );
-
-        $params = [
-            'sku'              => $product['sku'],
-            'ean'              => $product['ean'],
-            'name'             => $product['language']['name'],
-            'tax'              => (int) $product['vat'],
-            'status'           => 1,
-            'quantity'         => (int) $product['quantity'],
-            'priceWithTax'     => $product['price_brutto'],
-            'description'      => $product['language']['description'] . '<br>' . $product['language']['short_description'],
-            'shortDescription' => '',
-            'images'           => [],
-        ];
-
-        foreach ( $product['images'] as $image )
-            $params['images'][] = "https://" . $_SERVER['HTTP_HOST'] . $image['src'];
-
-        $ch = curl_init( "https://projectpro.apilo.com/rest/api/warehouse/product/" );
-        curl_setopt( $ch, CURLOPT_POSTFIELDS, json_encode( [ $params ] ) );
-        curl_setopt( $ch, CURLOPT_CUSTOMREQUEST, "POST" );
-        curl_setopt( $ch, CURLOPT_HTTPHEADER, [
-            "Authorization: Bearer " . $accessToken,
-            "Content-Type: application/json",
-            "Accept: application/json"
-        ] );
-        curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
-        $response = curl_exec( $ch );
-        $responseData = json_decode( $response, true );
-
-        if ( curl_errno( $ch ) ) {
-            $error = curl_error( $ch );
-            curl_close( $ch );
-            return [ 'success' => false, 'message' => 'Błąd cURL: ' . $error ];
-        }
-        curl_close( $ch );
-
-        if ( !empty( $responseData['products'] ) ) {
-            $this->db->update( 'pp_shop_products', [
-                'apilo_product_id'   => reset( $responseData['products'] ),
-                'apilo_product_name' => $product['language']['name'],
-            ], [ 'id' => $product['id'] ] );
-
-            return [ 'success' => true, 'message' => 'Produkt został dodany do magazynu APILO.' ];
-        }
-
-        return [ 'success' => false, 'message' => 'Podczas dodawania produktu wystąpił błąd.' ];
-    }
-
     // ── ShopPRO import ──────────────────────────────────────────
 
     public function shopproImportProduct( int $productId ): array
diff --git a/autoload/Domain/Order/OrderAdminService.php b/autoload/Domain/Order/OrderAdminService.php
index 405045f..d55784b 100644
--- a/autoload/Domain/Order/OrderAdminService.php
+++ b/autoload/Domain/Order/OrderAdminService.php
@@ -419,8 +419,8 @@ class OrderAdminService
             return false;
         }
 
-        $integrationsRepository = new \Domain\Integrations\IntegrationsRepository( $mdb );
-        $accessToken = $integrationsRepository -> apiloGetAccessToken();
+        $apiloRepository = new \Domain\Integrations\ApiloRepository( $mdb );
+        $accessToken = $apiloRepository->apiloGetAccessToken();
         if (!$accessToken) {
             \Domain\Integrations\ApiloLogger::log(
                 $mdb,
@@ -675,7 +675,7 @@ class OrderAdminService
         global $config;
 
         $db = $this->orders->getDb();
-        $integrationsRepository = new \Domain\Integrations\IntegrationsRepository($db);
+        $apiloRepository = new \Domain\Integrations\ApiloRepository($db);
 
         if (empty($order['apilo_order_id'])) {
             return true;
@@ -687,7 +687,7 @@ class OrderAdminService
         }
 
         $payment_date = new \DateTime($order['date_order']);
-        $access_token = $integrationsRepository->apiloGetAccessToken();
+        $access_token = $apiloRepository->apiloGetAccessToken();
 
         $ch = curl_init();
         curl_setopt($ch, CURLOPT_URL, "https://projectpro.apilo.com/rest/api/orders/" . $order['apilo_order_id'] . '/payment/');
@@ -742,13 +742,13 @@ class OrderAdminService
         global $config;
 
         $db = $this->orders->getDb();
-        $integrationsRepository = new \Domain\Integrations\IntegrationsRepository($db);
+        $apiloRepository = new \Domain\Integrations\ApiloRepository($db);
 
         if (empty($order['apilo_order_id'])) {
             return true;
         }
 
-        $access_token = $integrationsRepository->apiloGetAccessToken();
+        $access_token = $apiloRepository->apiloGetAccessToken();
 
         $ch = curl_init();
         curl_setopt($ch, CURLOPT_URL, "https://projectpro.apilo.com/rest/api/orders/" . $order['apilo_order_id'] . '/status/');
diff --git a/autoload/Domain/Order/OrderRepository.php b/autoload/Domain/Order/OrderRepository.php
index adfdfa5..5185d8f 100644
--- a/autoload/Domain/Order/OrderRepository.php
+++ b/autoload/Domain/Order/OrderRepository.php
@@ -790,8 +790,8 @@ class OrderRepository
             }
         }
 
-        if ($coupon && $coupon->is_one_time()) {
-            $coupon->set_as_used();
+        if ($coupon && (int)$coupon->one_time === 1) {
+            (new \Domain\Coupon\CouponRepository($this->db))->markAsUsed((int)$coupon->id);
         }
 
         $order = $this->orderDetailsFrontend($order_id);
@@ -814,7 +814,7 @@ class OrderRepository
         \Shared\Helpers\Helpers::send_email($settings['contact_email'], 'Nowe zamówienie / ' . $settings['firm_name'] . ' / ' . $order['number'] . ' - ' . $order['client_surname'] . ' ' . $order['client_name'], $mail_order);
 
         // zmiana statusu w realizacji jeżeli płatność przy odbiorze
-        if ($payment_id == 3) {
+        if (!empty($payment_method['is_cod'])) {
             $this->updateOrderStatus($order_id, 4);
             $this->insertStatusHistory($order_id, 4, 1);
         }
diff --git a/autoload/Domain/PaymentMethod/PaymentMethodRepository.php b/autoload/Domain/PaymentMethod/PaymentMethodRepository.php
index d0fee49..4ddad69 100644
--- a/autoload/Domain/PaymentMethod/PaymentMethodRepository.php
+++ b/autoload/Domain/PaymentMethod/PaymentMethodRepository.php
@@ -122,6 +122,7 @@ class PaymentMethodRepository
             'apilo_payment_type_id' => $this->normalizeApiloPaymentTypeId($data['apilo_payment_type_id'] ?? null),
             'min_order_amount' => $this->normalizeDecimalOrNull($data['min_order_amount'] ?? null),
             'max_order_amount' => $this->normalizeDecimalOrNull($data['max_order_amount'] ?? null),
+            'is_cod' => (int)(!empty($data['is_cod']) ? 1 : 0),
         ];
 
         $this->db->update('pp_shop_payment_methods', $row, ['id' => $paymentMethodId]);
@@ -240,7 +241,8 @@ class PaymentMethodRepository
                 spm.status,
                 spm.apilo_payment_type_id,
                 spm.min_order_amount,
-                spm.max_order_amount
+                spm.max_order_amount,
+                spm.is_cod
             FROM pp_shop_payment_methods AS spm
             INNER JOIN pp_shop_transport_payment_methods AS stpm
                 ON stpm.id_payment_method = spm.id
@@ -335,6 +337,7 @@ class PaymentMethodRepository
         $row['apilo_payment_type_id'] = $this->normalizeApiloPaymentTypeId($row['apilo_payment_type_id'] ?? null);
         $row['min_order_amount'] = $this->normalizeDecimalOrNull($row['min_order_amount'] ?? null);
         $row['max_order_amount'] = $this->normalizeDecimalOrNull($row['max_order_amount'] ?? null);
+        $row['is_cod'] = (int)($row['is_cod'] ?? 0);
 
         return $row;
     }
diff --git a/autoload/Domain/Product/ProductRepository.php b/autoload/Domain/Product/ProductRepository.php
index c546bd0..562db10 100644
--- a/autoload/Domain/Product/ProductRepository.php
+++ b/autoload/Domain/Product/ProductRepository.php
@@ -1751,8 +1751,10 @@ class ProductRepository
         if ( \Shared\Helpers\Helpers::is_array_fix( $customFields ) ) {
             foreach ( $customFields as $row ) {
                 $this->db->insert( 'pp_shop_products_custom_fields', [
-                    'id_product' => $newProductId,
-                    'name'       => $row['name'],
+                    'id_product'  => $newProductId,
+                    'name'        => $row['name'],
+                    'type'        => $row['type'] ?? 'text',
+                    'is_required' => $row['is_required'] ?? 0,
                 ] );
             }
         }
@@ -2140,6 +2142,8 @@ class ProductRepository
         $full = realpath('../' . ltrim($src, '/'));
         if ($full && strpos($full, $base . DIRECTORY_SEPARATOR) === 0 && is_file($full)) {
             unlink($full);
+        } elseif ($full) {
+            error_log( '[shopPRO] safeUnlink: ścieżka poza upload/: ' . $src );
         }
     }
 
diff --git a/autoload/Shared/Security/CsrfToken.php b/autoload/Shared/Security/CsrfToken.php
new file mode 100644
index 0000000..2bb70cf
--- /dev/null
+++ b/autoload/Shared/Security/CsrfToken.php
@@ -0,0 +1,26 @@
+<?php
+namespace Shared\Security;
+
+class CsrfToken
+{
+    const SESSION_KEY = 'csrf_token';
+
+    public static function getToken(): string
+    {
+        if (empty($_SESSION[self::SESSION_KEY])) {
+            $_SESSION[self::SESSION_KEY] = bin2hex(random_bytes(32));
+        }
+        return (string) $_SESSION[self::SESSION_KEY];
+    }
+
+    public static function validate(string $token): bool
+    {
+        $sessionToken = isset($_SESSION[self::SESSION_KEY]) ? (string) $_SESSION[self::SESSION_KEY] : '';
+        return $sessionToken !== '' && hash_equals($sessionToken, $token);
+    }
+
+    public static function regenerate(): void
+    {
+        $_SESSION[self::SESSION_KEY] = bin2hex(random_bytes(32));
+    }
+}
diff --git a/autoload/admin/App.php b/autoload/admin/App.php
index b0c051e..51e8324 100644
--- a/autoload/admin/App.php
+++ b/autoload/admin/App.php
@@ -43,6 +43,15 @@ class App
     $sa = \Shared\Helpers\Helpers::get( 's-action' );
     if ( !$sa ) return;
 
+    if ( $_SERVER['REQUEST_METHOD'] === 'POST' ) {
+      $csrfToken = isset( $_POST['_csrf_token'] ) ? (string) $_POST['_csrf_token'] : '';
+      if ( !\Shared\Security\CsrfToken::validate( $csrfToken ) ) {
+        \Shared\Helpers\Helpers::alert( 'Nieprawidłowy token bezpieczeństwa. Spróbuj ponownie.' );
+        header( 'Location: /admin/' );
+        exit;
+      }
+    }
+
     $domain      = preg_replace( '/^www\./', '', $_SERVER['SERVER_NAME'] );
     $cookie_name = 'admin_remember_' . str_replace( '.', '-', $domain );
     $users       = new \Domain\User\UserRepository( $mdb );
@@ -84,6 +93,7 @@ class App
             exit;
           }
 
+          \Shared\Security\CsrfToken::regenerate();
           self::finalize_admin_login( $user, $domain, $cookie_name, (bool) \Shared\Helpers\Helpers::get( 'remember' ) );
           header( 'Location: /admin/articles/list/' );
           exit;
@@ -127,6 +137,7 @@ class App
           header( 'Location: /admin/' );
           exit;
         }
+        \Shared\Security\CsrfToken::regenerate();
         self::finalize_admin_login( $user, $domain, $cookie_name, !empty( $pending['remember'] ) );
         header( 'Location: /admin/articles/list/' );
         exit;
@@ -372,7 +383,8 @@ class App
       'Integrations' => function() {
         global $mdb;
         return new \admin\Controllers\IntegrationsController(
-          new \Domain\Integrations\IntegrationsRepository( $mdb )
+          new \Domain\Integrations\IntegrationsRepository( $mdb ),
+          new \Domain\Integrations\ApiloRepository( $mdb )
         );
       },
       'ShopStatuses' => function() {
diff --git a/autoload/admin/Controllers/IntegrationsController.php b/autoload/admin/Controllers/IntegrationsController.php
index e182a90..1b9daf2 100644
--- a/autoload/admin/Controllers/IntegrationsController.php
+++ b/autoload/admin/Controllers/IntegrationsController.php
@@ -2,15 +2,18 @@
 namespace admin\Controllers;
 
 use Domain\Integrations\IntegrationsRepository;
+use Domain\Integrations\ApiloRepository;
 use admin\ViewModels\Common\PaginatedTableViewModel;
 
 class IntegrationsController
 {
     private IntegrationsRepository $repository;
+    private ApiloRepository $apiloRepository;
 
-    public function __construct( IntegrationsRepository $repository )
+    public function __construct( IntegrationsRepository $repository, ApiloRepository $apiloRepository )
     {
         $this->repository = $repository;
+        $this->apiloRepository = $apiloRepository;
     }
 
     public function logs(): string
@@ -125,7 +128,7 @@ class IntegrationsController
     {
         return \Shared\Tpl\Tpl::view( 'integrations/apilo-settings', [
             'settings' => $this->repository->getSettings( 'apilo' ),
-            'apilo_status' => $this->repository->apiloIntegrationStatus(),
+            'apilo_status' => $this->apiloRepository->apiloIntegrationStatus(),
         ] );
     }
 
@@ -147,7 +150,7 @@ class IntegrationsController
     {
         $settings = $this->repository->getSettings( 'apilo' );
 
-        if ( $this->repository->apiloAuthorize(
+        if ( $this->apiloRepository->apiloAuthorize(
             (string)($settings['client-id'] ?? ''),
             (string)($settings['client-secret'] ?? ''),
             (string)($settings['authorization-code'] ?? '')
@@ -156,7 +159,7 @@ class IntegrationsController
             exit;
         }
 
-        $status = $this->repository->apiloIntegrationStatus();
+        $status = $this->apiloRepository->apiloIntegrationStatus();
         $message = trim( (string)($status['message'] ?? '') );
         if ( $message === '' ) {
             $message = 'Podczas autoryzacji wystapil blad. Prosze sprawdzic dane i sprobowac ponownie.';
@@ -191,7 +194,7 @@ class IntegrationsController
     public function apilo_create_product(): void
     {
         $productId = (int) \Shared\Helpers\Helpers::get( 'product_id' );
-        $result = $this->repository->apiloCreateProduct( $productId );
+        $result = $this->apiloRepository->apiloCreateProduct( $productId );
 
         \Shared\Helpers\Helpers::alert( (string)($result['message'] ?? 'Wystapil blad podczas tworzenia produktu w Apilo.') );
         header( 'Location: /admin/shop_product/view_list/' );
@@ -208,7 +211,7 @@ class IntegrationsController
             exit;
         }
 
-        echo json_encode( $this->repository->apiloProductSearch( $sku ) );
+        echo json_encode( $this->apiloRepository->apiloProductSearch( $sku ) );
         exit;
     }
 
@@ -267,7 +270,7 @@ class IntegrationsController
 
     private function fetchApiloListWithFeedback( string $type, string $label ): void
     {
-        $result = $this->repository->apiloFetchListResult( $type );
+        $result = $this->apiloRepository->apiloFetchListResult( $type );
 
         if ( !empty( $result['success'] ) ) {
             $count = (int)($result['count'] ?? 0);
diff --git a/autoload/admin/Controllers/ShopPaymentMethodController.php b/autoload/admin/Controllers/ShopPaymentMethodController.php
index 6ae73dc..ea3be85 100644
--- a/autoload/admin/Controllers/ShopPaymentMethodController.php
+++ b/autoload/admin/Controllers/ShopPaymentMethodController.php
@@ -184,6 +184,7 @@ class ShopPaymentMethodController
             'apilo_payment_type_id' => $paymentMethod['apilo_payment_type_id'] ?? '',
             'min_order_amount' => $paymentMethod['min_order_amount'] ?? '',
             'max_order_amount' => $paymentMethod['max_order_amount'] ?? '',
+            'is_cod' => (int)($paymentMethod['is_cod'] ?? 0),
         ];
 
         $fields = [
@@ -220,6 +221,10 @@ class ShopPaymentMethodController
                 'tab' => 'settings',
                 'options' => $apiloOptions,
             ]),
+            FormField::switch('is_cod', [
+                'label' => 'Platnosc przy odbiorze',
+                'tab' => 'settings',
+            ]),
             FormField::switch('status', [
                 'label' => 'Aktywny',
                 'tab' => 'settings',
diff --git a/autoload/admin/Support/Forms/FormRequestHandler.php b/autoload/admin/Support/Forms/FormRequestHandler.php
index 2bf5105..74bd765 100644
--- a/autoload/admin/Support/Forms/FormRequestHandler.php
+++ b/autoload/admin/Support/Forms/FormRequestHandler.php
@@ -32,6 +32,13 @@ class FormRequestHandler
             'data' => []
         ];
 
+        // Walidacja CSRF
+        $csrfToken = isset($postData['_csrf_token']) ? (string) $postData['_csrf_token'] : '';
+        if (!\Shared\Security\CsrfToken::validate($csrfToken)) {
+            $result['errors'] = ['csrf' => 'Nieprawidłowy token bezpieczeństwa. Odśwież stronę i spróbuj ponownie.'];
+            return $result;
+        }
+
         // Walidacja
         $errors = $this->validator->validate($postData, $formViewModel->fields, $formViewModel->languages);
         
diff --git a/autoload/front/Controllers/ShopBasketController.php b/autoload/front/Controllers/ShopBasketController.php
index e267d48..e26e7fa 100644
--- a/autoload/front/Controllers/ShopBasketController.php
+++ b/autoload/front/Controllers/ShopBasketController.php
@@ -5,6 +5,7 @@ class ShopBasketController
 {
   private const ORDER_SUBMIT_TOKEN_SESSION_KEY = 'order-submit-token';
   private const ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY = 'order-submit-last-order-id';
+  private const ORDER_SUBMIT_TOKEN_TTL = 1800;
 
   public static $title = [
       'mainView' => 'Koszyk'
@@ -298,20 +299,23 @@ class ShopBasketController
     $orderSubmitToken = (string)\Shared\Helpers\Helpers::get( 'order_submit_token', true );
     $existingOrderId = isset( $_SESSION[ self::ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY ] ) ? (int)$_SESSION[ self::ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY ] : 0;
 
+    $basket = \Shared\Helpers\Helpers::get_session( 'basket' );
+    if ( empty( $basket ) && $existingOrderId > 0 )
+    {
+      $existingOrderHash = $this->orderRepository->findHashById( $existingOrderId );
+      if ( $existingOrderHash )
+      {
+        $this->logOrder( 'Double-submit detected, redirecting to existing order id=' . $existingOrderId );
+        header( 'Location: /zamowienie/' . $existingOrderHash );
+        exit;
+      }
+    }
+
     if ( !$this->isValidOrderSubmitToken( $orderSubmitToken ) )
     {
-      if ( $existingOrderId > 0 )
-      {
-        $existingOrderHash = $this->orderRepository->findHashById( $existingOrderId );
-        if ( $existingOrderHash )
-        {
-          header( 'Location: /zamowienie/' . $existingOrderHash );
-          exit;
-        }
-      }
-
+      $this->logOrder( 'Token validation failed. formToken=' . $orderSubmitToken . ' existingOrderId=' . $existingOrderId );
       \Shared\Helpers\Helpers::error( \Shared\Helpers\Helpers::lang( 'zamowienie-zostalo-zlozone-komunikat-blad' ) );
-      header( 'Location: /koszyk' );
+      header( 'Location: /koszyk-podsumowanie' );
       exit;
     }
 
@@ -325,7 +329,10 @@ class ShopBasketController
       exit;
     }
 
-    if ( $order_id = $this->orderRepository->createFromBasket(
+    $order_id = null;
+    try
+    {
+      $order_id = $this->orderRepository->createFromBasket(
         $client[ 'id' ],
         \Shared\Helpers\Helpers::get_session( 'basket' ),
         \Shared\Helpers\Helpers::get_session( 'basket-transport-method-id' ),
@@ -347,7 +354,18 @@ class ShopBasketController
         \Shared\Helpers\Helpers::get_session( 'basket_orlen_point_info' ),
         \Shared\Helpers\Helpers::get_session( 'coupon' ),
         \Shared\Helpers\Helpers::get_session( 'basket_message' )
-      ) )
+      );
+    }
+    catch ( \Exception $e )
+    {
+      $this->logOrder( 'createFromBasket exception: ' . $e->getMessage() );
+      error_log( '[basketSave] createFromBasket exception: ' . $e->getMessage() );
+      \Shared\Helpers\Helpers::error( \Shared\Helpers\Helpers::lang( 'zamowienie-zostalo-zlozone-komunikat-blad' ) );
+      header( 'Location: /koszyk' );
+      exit;
+    }
+
+    if ( $order_id )
     {
       \Shared\Helpers\Helpers::set_session( self::ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY, (int)$order_id );
       \Shared\Helpers\Helpers::alert( \Shared\Helpers\Helpers::lang( 'zamowienie-zostalo-zlozone-komunikat' ) );
@@ -374,6 +392,7 @@ class ShopBasketController
     }
     else
     {
+      $this->logOrder( 'createFromBasket returned falsy order_id. client_id=' . ( $client['id'] ?? '?' ) . ' email=' . ( \Shared\Helpers\Helpers::get( 'email', true ) ?: '?' ) );
       \Shared\Helpers\Helpers::error( \Shared\Helpers\Helpers::lang( 'zamowienie-zostalo-zlozone-komunikat-blad' ) );
       header( 'Location: /koszyk' );
       exit;
@@ -420,6 +439,79 @@ class ShopBasketController
       ] );
   }
 
+  public function basketUpdateCustomFields()
+  {
+    $basket = \Shared\Helpers\Helpers::get_session( 'basket' );
+    $product_code = \Shared\Helpers\Helpers::get( 'product_code' );
+
+    if ( !isset( $basket[ $product_code ] ) )
+    {
+      echo json_encode( [ 'result' => 'error', 'message' => 'Pozycja nie istnieje w koszyku' ] );
+      exit;
+    }
+
+    $position = $basket[ $product_code ];
+    $new_custom_fields = [];
+    $custom_fields_raw = \Shared\Helpers\Helpers::get( 'custom_field' );
+
+    if ( is_array( $custom_fields_raw ) )
+    {
+      foreach ( $custom_fields_raw as $field_id => $value )
+      {
+        $new_custom_fields[ (int)$field_id ] = $value;
+      }
+    }
+
+    $productRepo = new \Domain\Product\ProductRepository( $GLOBALS['mdb'] );
+    $missing_fields = [];
+
+    foreach ( $new_custom_fields as $field_id => $value )
+    {
+      $field_meta = $productRepo->findCustomFieldCached( $field_id );
+      if ( $field_meta && (int)$field_meta['is_required'] === 1 && trim( $value ) === '' )
+      {
+        $missing_fields[] = $field_meta['name'];
+      }
+    }
+
+    if ( count( $missing_fields ) > 0 )
+    {
+      echo json_encode( [ 'result' => 'error', 'message' => 'Wypełnij wymagane pola: ' . implode( ', ', $missing_fields ) ] );
+      exit;
+    }
+
+    $attributes_implode = '';
+    if ( isset( $position['attributes'] ) && is_array( $position['attributes'] ) && count( $position['attributes'] ) > 0 )
+    {
+      $attributes_implode = implode( '|', $position['attributes'] );
+    }
+
+    $message = isset( $position['message'] ) ? $position['message'] : '';
+    $new_product_code = md5( $position['product-id'] . $attributes_implode . $message . json_encode( $new_custom_fields ) );
+
+    if ( $new_product_code === $product_code )
+    {
+      $basket[ $product_code ]['custom_fields'] = $new_custom_fields;
+    }
+    elseif ( isset( $basket[ $new_product_code ] ) )
+    {
+      $basket[ $new_product_code ]['quantity'] += $position['quantity'];
+      unset( $basket[ $product_code ] );
+    }
+    else
+    {
+      $position['custom_fields'] = $new_custom_fields;
+      $basket[ $new_product_code ] = $position;
+      unset( $basket[ $product_code ] );
+    }
+
+    $basket = ( new \Domain\Promotion\PromotionRepository( $GLOBALS['mdb'] ) )->findPromotion( $basket );
+    \Shared\Helpers\Helpers::set_session( 'basket', $basket );
+
+    echo json_encode( [ 'result' => 'ok' ] );
+    exit;
+  }
+
   private function jsonBasketResponse( $basket, $coupon, $lang_id, $basket_transport_method_id )
   {
     global $settings;
@@ -445,8 +537,23 @@ class ShopBasketController
 
   private function createOrderSubmitToken()
   {
+    $sessionData = isset( $_SESSION[ self::ORDER_SUBMIT_TOKEN_SESSION_KEY ] )
+      ? $_SESSION[ self::ORDER_SUBMIT_TOKEN_SESSION_KEY ]
+      : null;
+
+    if ( is_array( $sessionData ) && isset( $sessionData['token'], $sessionData['created_at'] ) )
+    {
+      if ( ( time() - $sessionData['created_at'] ) < self::ORDER_SUBMIT_TOKEN_TTL )
+      {
+        return $sessionData['token'];
+      }
+    }
+
     $token = $this->generateOrderSubmitToken();
-    \Shared\Helpers\Helpers::set_session( self::ORDER_SUBMIT_TOKEN_SESSION_KEY, $token );
+    \Shared\Helpers\Helpers::set_session( self::ORDER_SUBMIT_TOKEN_SESSION_KEY, [
+      'token' => $token,
+      'created_at' => time()
+    ] );
     \Shared\Helpers\Helpers::delete_session( self::ORDER_SUBMIT_LAST_ORDER_ID_SESSION_KEY );
 
     return $token;
@@ -469,10 +576,29 @@ class ShopBasketController
     if ( !$token )
       return false;
 
-    $sessionToken = isset( $_SESSION[ self::ORDER_SUBMIT_TOKEN_SESSION_KEY ] ) ? (string)$_SESSION[ self::ORDER_SUBMIT_TOKEN_SESSION_KEY ] : '';
-    if ( !$sessionToken )
+    $sessionData = isset( $_SESSION[ self::ORDER_SUBMIT_TOKEN_SESSION_KEY ] )
+      ? $_SESSION[ self::ORDER_SUBMIT_TOKEN_SESSION_KEY ]
+      : null;
+
+    if ( !$sessionData )
       return false;
 
+    // Backward compatibility: stary format (plain string)
+    if ( is_string( $sessionData ) )
+    {
+      $sessionToken = $sessionData;
+    }
+    elseif ( is_array( $sessionData ) && isset( $sessionData['token'], $sessionData['created_at'] ) )
+    {
+      if ( ( time() - $sessionData['created_at'] ) >= self::ORDER_SUBMIT_TOKEN_TTL )
+        return false;
+      $sessionToken = $sessionData['token'];
+    }
+    else
+    {
+      return false;
+    }
+
     if ( function_exists( 'hash_equals' ) )
       return hash_equals( $sessionToken, $token );
 
@@ -483,4 +609,11 @@ class ShopBasketController
   {
     \Shared\Helpers\Helpers::delete_session( self::ORDER_SUBMIT_TOKEN_SESSION_KEY );
   }
+
+  private function logOrder( $message )
+  {
+    $logFile = __DIR__ . '/../../../logs/logs-order-' . date( 'Y-m-d' ) . '.log';
+    $line = '[' . date( 'Y-m-d H:i:s' ) . '] ' . $message . "\n";
+    @file_put_contents( $logFile, $line, FILE_APPEND );
+  }
 }
diff --git a/cron.php b/cron.php
index a6bed4f..912ee55 100644
--- a/cron.php
+++ b/cron.php
@@ -1,5 +1,5 @@
 <?php
-error_reporting( E_ALL ^ E_NOTICE ^ E_STRICT ^ E_WARNING ^ E_DEPRECATED );
+error_reporting( E_ALL ^ E_NOTICE ^ E_STRICT );
 
 function __autoload_my_classes( $classname )
 {
@@ -131,6 +131,7 @@ function getImageUrlById($id) {
 
 $settings = ( new \Domain\Settings\SettingsRepository( $mdb ) )->allSettings();
 $integrationsRepository = new \Domain\Integrations\IntegrationsRepository( $mdb );
+$apiloRepository = new \Domain\Integrations\ApiloRepository( $mdb );
 $orderRepo = new \Domain\Order\OrderRepository( $mdb );
 $cronRepo = new \Domain\CronJob\CronJobRepository( $mdb );
 $orderAdminService = new \Domain\Order\OrderAdminService( $orderRepo, null, null, null, $cronRepo );
@@ -184,21 +185,28 @@ if ( file_exists( $json_queue_path ) )
 // =========================================================================
 
 // 1. Apilo token keepalive (priorytet: krytyczny)
-$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_TOKEN_KEEPALIVE, function($payload) use ($integrationsRepository) {
+$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_TOKEN_KEEPALIVE, function($payload) use ($integrationsRepository, $apiloRepository) {
   $apilo_settings = $integrationsRepository->getSettings('apilo');
   if ( !(int)($apilo_settings['enabled'] ?? 0) ) return true; // skip if disabled
 
-  $integrationsRepository->apiloKeepalive( 300 );
+  $apiloRepository->apiloKeepalive( 300 );
   echo '<p>Apilo token keepalive</p>';
   return true;
 });
 
 // 2. Apilo send order (priorytet: wysoki)
-$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_SEND_ORDER, function($payload) use ($mdb, $integrationsRepository, $orderAdminService, $config) {
+$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_SEND_ORDER, function($payload) use ($mdb, $integrationsRepository, $apiloRepository, $orderAdminService, $config) {
   $apilo_settings = $integrationsRepository->getSettings('apilo');
   if ( !$apilo_settings['enabled'] || !$apilo_settings['sync_orders'] || !$apilo_settings['access-token'] || $apilo_settings['sync_orders_date_start'] > date('Y-m-d H:i:s') ) return true;
 
   $orders = $mdb->select( 'pp_shop_orders', '*', [ 'AND' => [ 'apilo_order_id' => null, 'date_order[>=]' => $apilo_settings['sync_orders_date_start'] ], 'ORDER' => [ 'date_order' => 'ASC' ], 'LIMIT' => 1 ] );
+
+  // Jeśli brak nowych, ponów failed (-1) z interwałem 1h
+  if ( empty($orders) ) {
+    $retryAfter = date( 'Y-m-d H:i:s', strtotime( '-1 hour' ) );
+    $orders = $mdb->select( 'pp_shop_orders', '*', [ 'AND' => [ 'apilo_order_id' => -1, 'apilo_order_status_date[<=]' => $retryAfter, 'date_order[>=]' => $apilo_settings['sync_orders_date_start'] ], 'ORDER' => [ 'date_order' => 'ASC' ], 'LIMIT' => 1 ] );
+  }
+
   if ( empty($orders) ) return true;
 
   foreach ( $orders as $order )
@@ -276,7 +284,7 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::APILO_SEND_ORDER, func
       continue;
     }
 
-    $access_token = $integrationsRepository->apiloGetAccessToken();
+    $access_token = $apiloRepository->apiloGetAccessToken();
     $order_date = new DateTime( $order['date_order'] );
     $paczkomatData = parsePaczkomatAddress( $order['inpost_paczkomat'] );
     $orlenPointData = parseOrlenAddress( $order['orlen_point'] );
@@ -423,6 +431,7 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::APILO_SEND_ORDER, func
     if (curl_errno( $ch ) ) {
       $curl_error_send = curl_error( $ch );
       \Domain\Integrations\ApiloLogger::log( $mdb, 'send_order', (int)$order['id'], 'Błąd cURL przy wysyłaniu zamówienia: ' . $curl_error_send, [ 'curl_error' => $curl_error_send ] );
+      \Shared\Helpers\Helpers::send_email( 'biuro@project-pro.pl', 'Błąd cURL wysyłania zamówienia #' . $order['id'] . ' do apilo.com', 'Zamówienie #' . $order['id'] . ' nie zostało wysłane do Apilo z powodu błędu połączenia (cURL).' . "\n\n" . 'Błąd: ' . $curl_error_send );
       echo 'Błąd cURL: ' . $curl_error_send;
     }
     $http_code_send = (int)curl_getinfo( $ch, CURLINFO_HTTP_CODE );
@@ -500,8 +509,8 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::APILO_SEND_ORDER, func
     }
     elseif ( $http_code_send >= 400 || !isset( $response['id'] ) )
     {
-      $mdb->update( 'pp_shop_orders', [ 'apilo_order_id' => -1 ], [ 'id' => $order['id'] ] );
-      \Domain\Integrations\ApiloLogger::log( $mdb, 'send_order', (int)$order['id'], 'Błąd wysyłania zamówienia do Apilo (HTTP ' . $http_code_send . ')', [ 'http_code' => $http_code_send, 'response' => $response ] );
+      $mdb->update( 'pp_shop_orders', [ 'apilo_order_id' => -1, 'apilo_order_status_date' => date('Y-m-d H:i:s') ], [ 'id' => $order['id'] ] );
+      \Domain\Integrations\ApiloLogger::log( $mdb, 'send_order', (int)$order['id'], 'Błąd wysyłania zamówienia do Apilo (HTTP ' . $http_code_send . ') — ponowna próba za 1h', [ 'http_code' => $http_code_send, 'response' => $response ] );
       $email_data = 'HTTP Code: ' . $http_code_send . "\n\n";
       $email_data .= print_r( $response, true );
       $email_data .= print_r( $postData, true );
@@ -512,6 +521,17 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::APILO_SEND_ORDER, func
     {
       $mdb->update( 'pp_shop_orders', [ 'apilo_order_id' => $response['id'] ], [ 'id' => $order['id'] ] );
       \Domain\Integrations\ApiloLogger::log( $mdb, 'send_order', (int)$order['id'], 'Zamówienie wysłane do Apilo (apilo_order_id: ' . $response['id'] . ')', [ 'http_code' => $http_code_send, 'response' => $response ] );
+
+      // Wyczyść stare stuck joby sync_payment/sync_status dla tego zamówienia
+      $orderPayloadJson = json_encode(['order_id' => (int)$order['id']]);
+      $mdb->delete('pp_cron_jobs', [
+        'AND' => [
+          'job_type' => [\Domain\CronJob\CronJobType::APILO_SYNC_PAYMENT, \Domain\CronJob\CronJobType::APILO_SYNC_STATUS],
+          'payload' => $orderPayloadJson,
+          'status' => [\Domain\CronJob\CronJobType::STATUS_PENDING, \Domain\CronJob\CronJobType::STATUS_FAILED],
+        ]
+      ]);
+
       echo '<p>Wysłałem zamówienie do apilo.com: ID: ' . $order['id'] . ' - ' . $response['id'] . '</p>';
     }
   }
@@ -549,7 +569,7 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::APILO_SYNC_STATUS, fun
 });
 
 // 5. Apilo product sync
-$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_PRODUCT_SYNC, function($payload) use ($mdb, $integrationsRepository) {
+$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_PRODUCT_SYNC, function($payload) use ($mdb, $integrationsRepository, $apiloRepository) {
   $apilo_settings = $integrationsRepository->getSettings('apilo');
   if ( !$apilo_settings['enabled'] || !$apilo_settings['sync_products'] || !$apilo_settings['access-token'] ) return true;
 
@@ -557,7 +577,7 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::APILO_PRODUCT_SYNC, fu
   $result = $stmt ? $stmt->fetch( \PDO::FETCH_ASSOC ) : null;
   if ( !$result ) return true;
 
-  $access_token = $integrationsRepository->apiloGetAccessToken();
+  $access_token = $apiloRepository->apiloGetAccessToken();
   $url = 'https://projectpro.apilo.com/rest/api/warehouse/product/' . $result['apilo_product_id'] . '/';
   $curl = curl_init( $url );
   curl_setopt( $curl, CURLOPT_RETURNTRANSFER, true );
@@ -582,11 +602,11 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::APILO_PRODUCT_SYNC, fu
 });
 
 // 6. Apilo pricelist sync
-$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_PRICELIST_SYNC, function($payload) use ($mdb, $integrationsRepository) {
+$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_PRICELIST_SYNC, function($payload) use ($mdb, $integrationsRepository, $apiloRepository) {
   $apilo_settings = $integrationsRepository->getSettings('apilo');
   if ( !$apilo_settings['enabled'] || !$apilo_settings['access-token'] ) return true;
 
-  $access_token = $integrationsRepository->apiloGetAccessToken();
+  $access_token = $apiloRepository->apiloGetAccessToken();
   $url = 'https://projectpro.apilo.com/rest/api/warehouse/price-calculated/?price=' . $apilo_settings['pricelist_id'];
 
   $curl = curl_init( $url );
@@ -628,7 +648,7 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::APILO_PRICELIST_SYNC,
 });
 
 // 7. Apilo status poll
-$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_STATUS_POLL, function($payload) use ($mdb, $integrationsRepository, $orderRepo, $orderAdminService) {
+$processor->registerHandler( \Domain\CronJob\CronJobType::APILO_STATUS_POLL, function($payload) use ($mdb, $integrationsRepository, $apiloRepository, $orderRepo, $orderAdminService) {
   $apilo_settings = $integrationsRepository->getSettings('apilo');
   if ( !$apilo_settings['enabled'] || !$apilo_settings['sync_orders'] || !$apilo_settings['access-token'] ) return true;
 
@@ -639,7 +659,7 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::APILO_STATUS_POLL, fun
   {
     if ( $order['apilo_order_id'] )
     {
-      $access_token = $integrationsRepository->apiloGetAccessToken();
+      $access_token = $apiloRepository->apiloGetAccessToken();
       $url = 'https://projectpro.apilo.com/rest/api/orders/' . $order['apilo_order_id'] . '/';
 
       $ch = curl_init( $url );
@@ -751,5 +771,61 @@ $processor->registerHandler( \Domain\CronJob\CronJobType::TRUSTMATE_INVITATION,
 
 $result = $processor->run( 20 );
 
+// Powiadomienie mailowe o problemach Apilo
+// 1. Trwale failed joby (nie-order: token, product sync itp.)
+$failedApiloJobs = $mdb->select('pp_cron_jobs', ['id', 'job_type', 'last_error', 'payload', 'attempts', 'completed_at'], [
+  'AND' => [
+    'status' => 'failed',
+    'job_type[~]' => 'apilo_%',
+    'completed_at[>=]' => date('Y-m-d H:i:s', time() - 120),
+  ]
+]);
+// 2. Order joby z wieloma próbami (infinite retry, ale wymagają uwagi)
+$stuckOrderJobs = $mdb->select('pp_cron_jobs', ['id', 'job_type', 'last_error', 'payload', 'attempts', 'scheduled_at'], [
+  'AND' => [
+    'status' => 'pending',
+    'job_type' => [\Domain\CronJob\CronJobType::APILO_SEND_ORDER, \Domain\CronJob\CronJobType::APILO_SYNC_PAYMENT, \Domain\CronJob\CronJobType::APILO_SYNC_STATUS],
+    'attempts[>=]' => 10,
+  ]
+]);
+
+$allProblems = array_merge($failedApiloJobs, $stuckOrderJobs);
+if (!empty($allProblems)) {
+  $emailBody = "";
+  $orderNumbers = [];
+
+  foreach ($allProblems as $fj) {
+    $payloadData = is_string($fj['payload']) ? json_decode($fj['payload'], true) : $fj['payload'];
+    $orderId = isset($payloadData['order_id']) ? (int)$payloadData['order_id'] : 0;
+    $isOrderJob = \Domain\CronJob\CronJobType::isOrderRelatedApiloJob($fj['job_type']);
+    $statusLabel = $isOrderJob ? 'PONAWIANY CO 30 MIN' : 'TRWAŁY BŁĄD';
+
+    $emailBody .= "Job #" . $fj['id'] . " (" . $fj['job_type'] . ") — " . $statusLabel . "\n";
+
+    if ($orderId > 0) {
+      $order = $mdb->get('pp_shop_orders', ['id', 'client_name', 'client_surname', 'date_order', 'summary'], ['id' => $orderId]);
+      if ($order) {
+        $emailBody .= "  Zamówienie: #" . $order['id'] . "\n";
+        $emailBody .= "  Klient: " . trim($order['client_name'] . ' ' . $order['client_surname']) . "\n";
+        $emailBody .= "  Data zamówienia: " . $order['date_order'] . "\n";
+        $emailBody .= "  Kwota: " . $order['summary'] . " PLN\n";
+        $orderNumbers[] = '#' . $order['id'];
+      }
+    }
+
+    $emailBody .= "  Próby: " . $fj['attempts'] . "\n";
+    $emailBody .= "  Błąd: " . $fj['last_error'] . "\n";
+    $emailBody .= "  Data: " . ($fj['completed_at'] ? $fj['completed_at'] : $fj['scheduled_at']) . "\n\n";
+  }
+
+  $subject = 'shopPRO: Problemy synchronizacji Apilo';
+  if (!empty($orderNumbers)) {
+    $subject .= ' — zamówienia ' . implode(', ', array_unique($orderNumbers));
+  }
+  $subject .= ' (' . count($allProblems) . ' zadań)';
+
+  \Shared\Helpers\Helpers::send_email('biuro@project-pro.pl', $subject, $emailBody);
+}
+
 echo '<hr>';
 echo '<p><small>CronJob stats: scheduled=' . $result['scheduled'] . ', processed=' . $result['processed'] . ', succeeded=' . $result['succeeded'] . ', failed=' . $result['failed'] . ', skipped=' . $result['skipped'] . '</small></p>';
diff --git a/index.php b/index.php
index 3c0d695..63232d6 100644
--- a/index.php
+++ b/index.php
@@ -22,17 +22,9 @@ date_default_timezone_set( 'Europe/Warsaw' );
 
 require_once 'config.php';
 require_once 'libraries/medoo/medoo.php';
-require_once 'libraries/rb.php';
 require_once 'libraries/phpmailer/class.phpmailer.php';
 require_once 'libraries/phpmailer/class.smtp.php';
 
-\R::setup( 'mysql:host=' . $database[ 'host' ] . ';dbname=' . $database[ 'name' ], $database[ 'user' ], $database[ 'password' ] );
-\R::ext( 'xdispense', function ( $type )
-{
-  return R::getRedBean() -> dispense( $type );
-} );
-$pdo = \R::getPDO();
-
 session_start();
 
 if ( !isset( $_SESSION[ 'check' ] ) )
diff --git a/templates/shop-basket/_partials/product-custom-fields.php b/templates/shop-basket/_partials/product-custom-fields.php
index a9134c7..8d2c805 100644
--- a/templates/shop-basket/_partials/product-custom-fields.php
+++ b/templates/shop-basket/_partials/product-custom-fields.php
@@ -1,20 +1,52 @@
 <? if ( $this -> custom_fields ) : ?>
-  <? foreach ( $this -> custom_fields as $key => $val ) : ?>
-    <? $custom_field = ( new \Domain\Product\ProductRepository( $GLOBALS['mdb'] ) )->findCustomFieldCached( $key ); ?>
-    
-    <? if ( $custom_field['type'] == 'text' ) : ?>
-      <div class="custom-field">
-        <div class="_name">
-          <?
-            echo $custom_field['name'] . ':';
-          ?>
-        </div>
-        <div class="_text">
-          <?= $val;?>
-        </div>
-      </div>
-    <? elseif ( $custom_field['type'] == 'image' ) : ?>
+  <div class="custom-fields-display" data-product-code="<?= htmlspecialchars( $this->product_code ); ?>">
+    <? foreach ( $this -> custom_fields as $key => $val ) : ?>
+      <? $custom_field = ( new \Domain\Product\ProductRepository( $GLOBALS['mdb'] ) )->findCustomFieldCached( $key ); ?>
+      <? $field_type = !empty( $custom_field['type'] ) ? $custom_field['type'] : 'text'; ?>
 
-    <? endif; ?>
-  <? endforeach; ?>
-<? endif;?>
\ No newline at end of file
+      <? if ( $field_type == 'text' ) : ?>
+        <div class="custom-field">
+          <div class="_name">
+            <?= htmlspecialchars( $custom_field['name'] ) . ':'; ?>
+          </div>
+          <div class="_text">
+            <?= nl2br( htmlspecialchars( $val ) );?>
+          </div>
+        </div>
+      <? elseif ( $field_type == 'image' && !empty( $val ) ) : ?>
+        <div class="custom-field">
+          <div class="_name">
+            <?= htmlspecialchars( $custom_field['name'] ) . ':'; ?>
+          </div>
+          <div class="_image">
+            <img src="<?= htmlspecialchars( $val );?>" alt="<?= htmlspecialchars( $custom_field['name'] );?>">
+          </div>
+        </div>
+      <? endif; ?>
+    <? endforeach; ?>
+    <a href="#" class="btn btn-sm btn-default btn-edit-custom-fields">Edytuj personalizację</a>
+  </div>
+
+  <div class="custom-fields-edit" data-product-code="<?= htmlspecialchars( $this->product_code ); ?>" style="display: none;">
+    <? foreach ( $this -> custom_fields as $key => $val ) : ?>
+      <? $custom_field = ( new \Domain\Product\ProductRepository( $GLOBALS['mdb'] ) )->findCustomFieldCached( $key ); ?>
+      <? $field_type = !empty( $custom_field['type'] ) ? $custom_field['type'] : 'text'; ?>
+      <? $is_required = !empty( $custom_field['is_required'] ) ? (int)$custom_field['is_required'] : 0; ?>
+
+      <div class="custom-field-edit-row" style="margin-bottom: 5px;">
+        <label>
+          <?= htmlspecialchars( $custom_field['name'] ); ?><?= $is_required ? ' <span style="color:red;">*</span>' : ''; ?>
+        </label>
+        <? if ( $field_type == 'text' ) : ?>
+          <input type="text" class="form-control form-control-sm" name="custom_field[<?= (int)$key; ?>]" value="<?= htmlspecialchars( $val ); ?>" <?= $is_required ? 'required' : ''; ?>>
+        <? elseif ( $field_type == 'image' ) : ?>
+          <input type="text" class="form-control form-control-sm" name="custom_field[<?= (int)$key; ?>]" value="<?= htmlspecialchars( $val ); ?>" placeholder="URL obrazka" <?= $is_required ? 'required' : ''; ?>>
+        <? endif; ?>
+      </div>
+    <? endforeach; ?>
+    <div style="margin-top: 5px;">
+      <a href="#" class="btn btn-sm btn-primary btn-save-custom-fields">Zapisz</a>
+      <a href="#" class="btn btn-sm btn-default btn-cancel-custom-fields">Anuluj</a>
+    </div>
+  </div>
+<? endif; ?>
diff --git a/templates/shop-basket/basket-details.php b/templates/shop-basket/basket-details.php
index 8708c92..d82a063 100644
--- a/templates/shop-basket/basket-details.php
+++ b/templates/shop-basket/basket-details.php
@@ -61,7 +61,8 @@
               <hr>
             <? endif; ?>
             <?= \Shared\Tpl\Tpl::view( 'shop-basket/_partials/product-custom-fields', [
-              'custom_fields' => $position['custom_fields']
+              'custom_fields' => $position['custom_fields'],
+              'product_code'  => $position_hash
             ] ); ?>
             <? if ( $product['additional_message'] ):?>
               <div class="basket-product-message">
diff --git a/templates/shop-basket/basket.php b/templates/shop-basket/basket.php
index 67f3952..a7f7db5 100644
--- a/templates/shop-basket/basket.php
+++ b/templates/shop-basket/basket.php
@@ -1,4 +1,46 @@
 <? global $settings; ?>
+<?
+  if ( $settings['google_tag_manager_id'] && is_array( $this -> basket ) && count( $this -> basket ) ):
+    $view_cart_items = '';
+    $view_cart_value = 0;
+
+    foreach ( $this -> basket as $position ):
+      $vc_product = (new \Domain\Product\ProductRepository($GLOBALS['mdb']))->findCached( (int)$position['product-id'], (new \Domain\Languages\LanguagesRepository($GLOBALS['mdb']))->defaultLanguage() );
+
+      if ( !$vc_product )
+        continue;
+
+      $vc_price = (float)$vc_product['price_brutto_promo'] > 0 && (float)$vc_product['price_brutto_promo'] < (float)$vc_product['price_brutto']
+        ? (float)$vc_product['price_brutto_promo']
+        : (float)$vc_product['price_brutto'];
+
+      $vc_qty = (int)$position['quantity'];
+      $view_cart_value += $vc_price * $vc_qty;
+
+      if ( $view_cart_items )
+        $view_cart_items .= ',';
+
+      $view_cart_items .= '{';
+      $view_cart_items .= 'item_id: "' . $vc_product['id'] . '",';
+      $view_cart_items .= 'item_name: "' . str_replace( '"', '', $vc_product['language']['name'] ) . '",';
+      $view_cart_items .= 'price: ' . \Shared\Helpers\Helpers::normalize_decimal( $vc_price ) . ',';
+      $view_cart_items .= 'quantity: ' . $vc_qty . ',';
+      $view_cart_items .= 'google_business_vertical: "retail"';
+      $view_cart_items .= '}';
+    endforeach;
+?>
+<script type="text/javascript">
+  dataLayer.push({ ecommerce: null });
+  dataLayer.push({
+    event: "view_cart",
+    ecommerce: {
+      currency: "PLN",
+      value: <?= \Shared\Helpers\Helpers::normalize_decimal( $view_cart_value );?>,
+      items: [<?= $view_cart_items;?>]
+    }
+  });
+</script>
+<? endif; ?>
 <div id="basket-container">
   <div id="content">
     <?= $this->basket_details; ?>
@@ -508,4 +550,62 @@
       console.warn('#orlen_point_id nie został znaleziony.');
     }
   });
+
+  // edycja personalizacji produktu w koszyku
+  $(document).on('click', '.btn-edit-custom-fields', function(e) {
+    e.preventDefault();
+    var $display = $(this).closest('.custom-fields-display');
+    var productCode = $display.data('product-code');
+    $display.hide();
+    $display.siblings('.custom-fields-edit[data-product-code="' + productCode + '"]').show();
+  });
+
+  $(document).on('click', '.btn-cancel-custom-fields', function(e) {
+    e.preventDefault();
+    var $edit = $(this).closest('.custom-fields-edit');
+    var productCode = $edit.data('product-code');
+    $edit.hide();
+    $edit.siblings('.custom-fields-display[data-product-code="' + productCode + '"]').show();
+  });
+
+  $(document).on('click', '.btn-save-custom-fields', function(e) {
+    e.preventDefault();
+    var $edit = $(this).closest('.custom-fields-edit');
+    var productCode = $edit.data('product-code');
+
+    var valid = true;
+    $edit.find('input[required]').each(function() {
+      if ($.trim($(this).val()) === '') {
+        $(this).css('border-color', 'red');
+        valid = false;
+      } else {
+        $(this).css('border-color', '');
+      }
+    });
+
+    if (!valid) {
+      alert('Wypełnij wszystkie wymagane pola');
+      return;
+    }
+
+    var formData = { product_code: productCode };
+    $edit.find('input[name^="custom_field"]').each(function() {
+      formData[$(this).attr('name')] = $(this).val();
+    });
+
+    $.ajax({
+      type: 'POST',
+      cache: false,
+      url: '/shopBasket/basket_update_custom_fields',
+      data: formData,
+      success: function(response) {
+        var data = jQuery.parseJSON(response);
+        if (data.result === 'ok') {
+          location.reload();
+        } else {
+          alert(data.message || 'Wystąpił błąd');
+        }
+      }
+    });
+  });
 </script>
\ No newline at end of file
diff --git a/templates/shop-basket/summary-view.php b/templates/shop-basket/summary-view.php
index 78acbe5..26e373d 100644
--- a/templates/shop-basket/summary-view.php
+++ b/templates/shop-basket/summary-view.php
@@ -73,10 +73,11 @@
             $begin_checkout_items .= ',';
 
           $begin_checkout_items .= '{';
-          $begin_checkout_items .= '"id": "' . $product['id'] . '",';
-          $begin_checkout_items .= '"name": "' . $product['language']['name'] . '",';
+          $begin_checkout_items .= '"item_id": "' . $product['id'] . '",';
+          $begin_checkout_items .= '"item_name": "' . str_replace( '"', '', $product['language']['name'] ) . '",';
           $begin_checkout_items .= '"price": ' . \Shared\Helpers\Helpers::normalize_decimal( $price_product['price_new'] ) . ',';
-          $begin_checkout_items .= '"quantity": ' . $position['quantity'];
+          $begin_checkout_items .= '"quantity": ' . (int)$position['quantity'] . ',';
+          $begin_checkout_items .= '"google_business_vertical": "retail"';
           $begin_checkout_items .= '}';
         ?>
       <? endforeach;?>
diff --git a/templates/shop-order/order-details.php b/templates/shop-order/order-details.php
index d32eef6..fb09f05 100644
--- a/templates/shop-order/order-details.php
+++ b/templates/shop-order/order-details.php
@@ -169,17 +169,17 @@
           event: "purchase",
           ecommerce: {
             transaction_id: "<?= $this -> order['id'];?>",
-            value: 25.42,
             currency: "PLN",
             value: <?= \Shared\Helpers\Helpers::normalize_decimal( round( $this -> order['summary'], 2 ) ) - str_replace( ',', '.', round( $this -> order['transport_cost'], 2 ) );?>,
             shipping: <?= \Shared\Helpers\Helpers::normalize_decimal( $this -> order['transport_cost'] );?>,
             items: [
               <? foreach ( $this -> order['products'] as $product ):?>
               {
-                'id': <?= (int)$product['product_id'];?>,
-                'name': '<?= $product['name'];?>',
-                'quantity': <?= $product['quantity'];?>,
-                'price': <?= ((float)$product['price_brutto_promo'] > 0 && (float)$product['price_brutto_promo'] < (float)$product['price_brutto']) ? (float)$product['price_brutto_promo'] : (float)$product['price_brutto'];?>
+                item_id: "<?= $product['product_id'];?>",
+                item_name: "<?= str_replace( '"', '', $product['name'] );?>",
+                quantity: <?= (int)$product['quantity'];?>,
+                price: <?= ((float)$product['price_brutto_promo'] > 0 && (float)$product['price_brutto_promo'] < (float)$product['price_brutto']) ? \Shared\Helpers\Helpers::normalize_decimal( $product['price_brutto_promo'] ) : \Shared\Helpers\Helpers::normalize_decimal( $product['price_brutto'] );?>,
+                google_business_vertical: "retail"
               }<? if ( $product != end( $this -> order['products'] ) ) echo ',';?>
             <? endforeach;?>
             ]
diff --git a/templates/shop-product/product.php b/templates/shop-product/product.php
index 3d0ce7c..7cb7468 100644
--- a/templates/shop-product/product.php
+++ b/templates/shop-product/product.php
@@ -275,12 +275,15 @@
       dataLayer.push({
         event: "view_item",
         ecommerce: {
+          currency: "PLN",
+          value: <? if ( $this -> product['price_brutto_promo'] ): echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto_promo'] ); else: echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto'] ); endif;?>,
           items: [
             {
               item_id: "<?= $this -> product['id'];?>",
               item_name: "<?= str_replace( '"', '', $this -> product['language']['name'] );?>",
-              price: '<? if ( $this -> product['price_brutto_promo'] ): echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto_promo'] ); else: echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto'] ); endif;?>',
-              quantity: 1
+              price: <? if ( $this -> product['price_brutto_promo'] ): echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto_promo'] ); else: echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto'] ); endif;?>,
+              quantity: 1,
+              google_business_vertical: "retail"
             }
           ]
         }
@@ -617,7 +620,8 @@
                       item_id: "<?= $this -> product['id'];?>",
                       item_name: "<?= str_replace( '"', '', $this -> product['language']['name'] );?>",
                       price: <? if ( $this -> product['price_brutto_promo'] ): echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto_promo'] ); else: echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto'] ); endif;?>,
-                      quantity: quantity
+                      quantity: parseInt(quantity),
+                      google_business_vertical: "retail"
                     }
                   ]
                 }
diff --git a/templates_user/shop-basket/_partials/product-custom-fields.php b/templates_user/shop-basket/_partials/product-custom-fields.php
index e3adeab..8d2c805 100644
--- a/templates_user/shop-basket/_partials/product-custom-fields.php
+++ b/templates_user/shop-basket/_partials/product-custom-fields.php
@@ -1,15 +1,52 @@
-<? if ( $this -> custom_fields ): foreach ( $this -> custom_fields as $key => $val ):?>
-  <? if ( $key ):?>
-    <div class="custom-field">
-      <div class="_name">
-        <?
-          $custom_field = ( new \Domain\Product\ProductRepository( $GLOBALS['mdb'] ) )->findCustomFieldCached( $key );
-          echo $custom_field['name'] . ':';
-        ?>
-      </div>
-      <div class="_text">
-        <?= $val;?>
+<? if ( $this -> custom_fields ) : ?>
+  <div class="custom-fields-display" data-product-code="<?= htmlspecialchars( $this->product_code ); ?>">
+    <? foreach ( $this -> custom_fields as $key => $val ) : ?>
+      <? $custom_field = ( new \Domain\Product\ProductRepository( $GLOBALS['mdb'] ) )->findCustomFieldCached( $key ); ?>
+      <? $field_type = !empty( $custom_field['type'] ) ? $custom_field['type'] : 'text'; ?>
+
+      <? if ( $field_type == 'text' ) : ?>
+        <div class="custom-field">
+          <div class="_name">
+            <?= htmlspecialchars( $custom_field['name'] ) . ':'; ?>
+          </div>
+          <div class="_text">
+            <?= nl2br( htmlspecialchars( $val ) );?>
+          </div>
+        </div>
+      <? elseif ( $field_type == 'image' && !empty( $val ) ) : ?>
+        <div class="custom-field">
+          <div class="_name">
+            <?= htmlspecialchars( $custom_field['name'] ) . ':'; ?>
+          </div>
+          <div class="_image">
+            <img src="<?= htmlspecialchars( $val );?>" alt="<?= htmlspecialchars( $custom_field['name'] );?>">
+          </div>
+        </div>
+      <? endif; ?>
+    <? endforeach; ?>
+    <a href="#" class="btn btn-sm btn-default btn-edit-custom-fields">Edytuj personalizację</a>
+  </div>
+
+  <div class="custom-fields-edit" data-product-code="<?= htmlspecialchars( $this->product_code ); ?>" style="display: none;">
+    <? foreach ( $this -> custom_fields as $key => $val ) : ?>
+      <? $custom_field = ( new \Domain\Product\ProductRepository( $GLOBALS['mdb'] ) )->findCustomFieldCached( $key ); ?>
+      <? $field_type = !empty( $custom_field['type'] ) ? $custom_field['type'] : 'text'; ?>
+      <? $is_required = !empty( $custom_field['is_required'] ) ? (int)$custom_field['is_required'] : 0; ?>
+
+      <div class="custom-field-edit-row" style="margin-bottom: 5px;">
+        <label>
+          <?= htmlspecialchars( $custom_field['name'] ); ?><?= $is_required ? ' <span style="color:red;">*</span>' : ''; ?>
+        </label>
+        <? if ( $field_type == 'text' ) : ?>
+          <input type="text" class="form-control form-control-sm" name="custom_field[<?= (int)$key; ?>]" value="<?= htmlspecialchars( $val ); ?>" <?= $is_required ? 'required' : ''; ?>>
+        <? elseif ( $field_type == 'image' ) : ?>
+          <input type="text" class="form-control form-control-sm" name="custom_field[<?= (int)$key; ?>]" value="<?= htmlspecialchars( $val ); ?>" placeholder="URL obrazka" <?= $is_required ? 'required' : ''; ?>>
+        <? endif; ?>
       </div>
+    <? endforeach; ?>
+    <div style="margin-top: 5px;">
+      <a href="#" class="btn btn-sm btn-primary btn-save-custom-fields">Zapisz</a>
+      <a href="#" class="btn btn-sm btn-default btn-cancel-custom-fields">Anuluj</a>
     </div>
-  <? endif;?>
-<? endforeach; endif;?>
+  </div>
+<? endif; ?>
diff --git a/templates_user/shop-basket/basket-details.php b/templates_user/shop-basket/basket-details.php
index 2d35371..1f1f2f1 100644
--- a/templates_user/shop-basket/basket-details.php
+++ b/templates_user/shop-basket/basket-details.php
@@ -57,7 +57,8 @@
               <hr>
             <? endif; ?>
             <?= \Shared\Tpl\Tpl::view( 'shop-basket/_partials/product-custom-fields', [
-              'custom_fields' => $position['custom_fields']
+              'custom_fields' => $position['custom_fields'],
+              'product_code'  => $position_hash
             ] ); ?>
             <? if ( $product['additional_message'] ):?>
               <div class="basket-product-message">
diff --git a/templates_user/shop-basket/basket.php b/templates_user/shop-basket/basket.php
index b3a28f8..aa2fe90 100644
--- a/templates_user/shop-basket/basket.php
+++ b/templates_user/shop-basket/basket.php
@@ -1,4 +1,46 @@
 <? global $settings; ?>
+<?
+  if ( $settings['google_tag_manager_id'] && is_array( $this -> basket ) && count( $this -> basket ) ):
+    $view_cart_items = '';
+    $view_cart_value = 0;
+
+    foreach ( $this -> basket as $position ):
+      $vc_product = (new \Domain\Product\ProductRepository($GLOBALS['mdb']))->findCached( (int)$position['product-id'], (new \Domain\Languages\LanguagesRepository($GLOBALS['mdb']))->defaultLanguage() );
+
+      if ( !$vc_product )
+        continue;
+
+      $vc_price = (float)$vc_product['price_brutto_promo'] > 0 && (float)$vc_product['price_brutto_promo'] < (float)$vc_product['price_brutto']
+        ? (float)$vc_product['price_brutto_promo']
+        : (float)$vc_product['price_brutto'];
+
+      $vc_qty = (int)$position['quantity'];
+      $view_cart_value += $vc_price * $vc_qty;
+
+      if ( $view_cart_items )
+        $view_cart_items .= ',';
+
+      $view_cart_items .= '{';
+      $view_cart_items .= 'item_id: "' . $vc_product['id'] . '",';
+      $view_cart_items .= 'item_name: "' . str_replace( '"', '', $vc_product['language']['name'] ) . '",';
+      $view_cart_items .= 'price: ' . \Shared\Helpers\Helpers::normalize_decimal( $vc_price ) . ',';
+      $view_cart_items .= 'quantity: ' . $vc_qty . ',';
+      $view_cart_items .= 'google_business_vertical: "retail"';
+      $view_cart_items .= '}';
+    endforeach;
+?>
+<script type="text/javascript">
+  dataLayer.push({ ecommerce: null });
+  dataLayer.push({
+    event: "view_cart",
+    ecommerce: {
+      currency: "PLN",
+      value: <?= \Shared\Helpers\Helpers::normalize_decimal( $view_cart_value );?>,
+      items: [<?= $view_cart_items;?>]
+    }
+  });
+</script>
+<? endif; ?>
 <div id="basket-container">
   <div id="content">
     <?= $this->basket_details; ?>
@@ -511,4 +553,62 @@
       console.warn('#orlen_point_id nie został znaleziony.');
     }
   });
-</script>
\ No newline at end of file
+
+  // edycja personalizacji produktu w koszyku
+  $(document).on('click', '.btn-edit-custom-fields', function(e) {
+    e.preventDefault();
+    var $display = $(this).closest('.custom-fields-display');
+    var productCode = $display.data('product-code');
+    $display.hide();
+    $display.siblings('.custom-fields-edit[data-product-code="' + productCode + '"]').show();
+  });
+
+  $(document).on('click', '.btn-cancel-custom-fields', function(e) {
+    e.preventDefault();
+    var $edit = $(this).closest('.custom-fields-edit');
+    var productCode = $edit.data('product-code');
+    $edit.hide();
+    $edit.siblings('.custom-fields-display[data-product-code="' + productCode + '"]').show();
+  });
+
+  $(document).on('click', '.btn-save-custom-fields', function(e) {
+    e.preventDefault();
+    var $edit = $(this).closest('.custom-fields-edit');
+    var productCode = $edit.data('product-code');
+
+    var valid = true;
+    $edit.find('input[required]').each(function() {
+      if ($.trim($(this).val()) === '') {
+        $(this).css('border-color', 'red');
+        valid = false;
+      } else {
+        $(this).css('border-color', '');
+      }
+    });
+
+    if (!valid) {
+      alert('Wypełnij wszystkie wymagane pola');
+      return;
+    }
+
+    var formData = { product_code: productCode };
+    $edit.find('input[name^="custom_field"]').each(function() {
+      formData[$(this).attr('name')] = $(this).val();
+    });
+
+    $.ajax({
+      type: 'POST',
+      cache: false,
+      url: '/shopBasket/basket_update_custom_fields',
+      data: formData,
+      success: function(response) {
+        var data = jQuery.parseJSON(response);
+        if (data.result === 'ok') {
+          location.reload();
+        } else {
+          alert(data.message || 'Wystąpił błąd');
+        }
+      }
+    });
+  });
+</script>
diff --git a/templates_user/shop-basket/summary-view.php b/templates_user/shop-basket/summary-view.php
index 5b795e6..38ab45c 100644
--- a/templates_user/shop-basket/summary-view.php
+++ b/templates_user/shop-basket/summary-view.php
@@ -73,10 +73,11 @@
             $begin_checkout_items .= ',';
 
           $begin_checkout_items .= '{';
-          $begin_checkout_items .= '"id": "' . $product['id'] . '",';
-          $begin_checkout_items .= '"name": "' . $product['language']['name'] . '",';
+          $begin_checkout_items .= '"item_id": "' . $product['id'] . '",';
+          $begin_checkout_items .= '"item_name": "' . str_replace( '"', '', $product['language']['name'] ) . '",';
           $begin_checkout_items .= '"price": ' . \Shared\Helpers\Helpers::normalize_decimal( $price_product['price_new'] ) . ',';
-          $begin_checkout_items .= '"quantity": ' . $position['quantity'];
+          $begin_checkout_items .= '"quantity": ' . (int)$position['quantity'] . ',';
+          $begin_checkout_items .= '"google_business_vertical": "retail"';
           $begin_checkout_items .= '}';
         ?>
       <? endforeach;?>
diff --git a/templates_user/shop-order/order-details.php b/templates_user/shop-order/order-details.php
index 02eaf40..61b69e4 100644
--- a/templates_user/shop-order/order-details.php
+++ b/templates_user/shop-order/order-details.php
@@ -177,10 +177,10 @@
             items: [
               <? foreach ( $this -> order['products'] as $product ):?>
               {
-                id: <?= (int)$product['product_id'];?>,
-                name: '<?= $product['name'];?>',
-                quantity: <?= $product['quantity'];?>,
-                price: <?= $product['price_brutto_promo'];?>,
+                item_id: "<?= $product['product_id'];?>",
+                item_name: "<?= str_replace( '"', '', $product['name'] );?>",
+                quantity: <?= (int)$product['quantity'];?>,
+                price: <?= ((float)$product['price_brutto_promo'] > 0 && (float)$product['price_brutto_promo'] < (float)$product['price_brutto']) ? \Shared\Helpers\Helpers::normalize_decimal( $product['price_brutto_promo'] ) : \Shared\Helpers\Helpers::normalize_decimal( $product['price_brutto'] );?>,
                 google_business_vertical: "retail"
               }<? if ( $product != end( $this -> order['products'] ) ) echo ',';?>
             <? endforeach;?>
@@ -188,7 +188,7 @@
           }
         });
       <? endif;?>
-      <? unset( $_SESSION['google-adwords-purchase'] );?>
+      <? unset( $_SESSION['google-analytics-purchase'] );?>
     <? endif;?>
   });
 </script>
diff --git a/templates_user/shop-product/product.php b/templates_user/shop-product/product.php
index 6ec9763..8c674f4 100644
--- a/templates_user/shop-product/product.php
+++ b/templates_user/shop-product/product.php
@@ -294,11 +294,13 @@
       dataLayer.push({
         event: "view_item",
         ecommerce: {
+          currency: "PLN",
+          value: <? if ( $this -> product['price_brutto_promo'] ): echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto_promo'] ); else: echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto'] ); endif;?>,
           items: [
             {
               item_id: "<?= $this -> product['id'];?>",
               item_name: "<?= str_replace( '"', '', $this -> product['language']['name'] );?>",
-              price: '<? if ( $this -> product['price_brutto_promo'] ): echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto_promo'] ); else: echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto'] ); endif;?>',
+              price: <? if ( $this -> product['price_brutto_promo'] ): echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto_promo'] ); else: echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto'] ); endif;?>,
               quantity: 1,
               google_business_vertical: "retail"
             }
@@ -633,7 +635,7 @@
                       item_id: "<?= $this -> product['id'];?>",
                       item_name: "<?= str_replace( '"', '', $this -> product['language']['name'] );?>",
                       price: <? if ( $this -> product['price_brutto_promo'] ): echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto_promo'] ); else: echo \Shared\Helpers\Helpers::normalize_decimal( $this -> product['price_brutto'] ); endif;?>,
-                      quantity: quantity,
+                      quantity: parseInt(quantity),
                       google_business_vertical: "retail"
                     }
                   ]