Implement update functionality in /order-bookings PUT route

- Added parameter extraction and validation for updating order bookings.
- Enhanced permission checks for editing own and departmental bookings.
- Implemented detailed access control logic based on user permissions.
- Built logic for updating booking details with strict type handling.

services/nginx/app/routes/orderBookingRoute.php

@@ -124,6 +124,70 @@ class orderBookingRoute
         $this->put('/order-bookings', function () {
             // Require the user to be logged in
             global $response;
+            /**
+             * Parameters
+             */
+            $object = self::getTargetObject();
+            $customer_number = self::getTargetCustomer(); // users_o object (Can only be changed by admins)
+            $department = self::getTargetDepartment(); // Int
+            $reg_1 = self::getTargetReg(1); // String
+            $reg_2 = self::getTargetReg(2); // String | Null
+            $reg_3 = self::getTargetReg(3); // String | Null
+            $datetime = self::getTargetDateTime(); // DateTime
+            $note = self::getTargetNote(); // String | Null
+            $reference = self::getTargetReference(); // String | Null
+            $po = self::getTargetPo(); // String | Null
+            $pickup = self::getTargetPickup(); // Bool | Null
+            $items = self::getTargetItems(); // Array of order_items_o objects
+            /**
+             * Authentication
+             */
+            $user = (new authentication())->get_user();
+            /**
+             * Permissions
+             */
+            $permission_own = 'edit_own_bookings'; // Only permits editing bookings with the user's customer number
+            $permission_other = 'edit_bookings'; // Requires access to the department as an admin to edit other users' bookings
+            $has_permission_own = self::hasPermission($permission_own);
+            $has_permission_other = self::hasPermission($permission_other);
+            $has_permission = false; // Updated below
+            // Check if the user has permission to edit their own bookings
+            if ($has_permission_own && (int)$object->customer_number->value() === (int)$user->customer_number->value()) {
+                $has_permission = true;
+            }
+            // Check if the user has permission to edit other users' bookings
+            if (!$has_permission && $has_permission_other) {
+                self::requireDepartmentAccess((int)$object->department->value());
+                // Check if the user has access to the department
+                $has_permission = true;
+            }
+            // If the user does not have permission, return an error
+            if (!$has_permission) {
+                $response->error('You do not have permission to edit this order booking.', 403);
+            }
+            /**
+             * Update the object
+             */
+            $data = [
+                ...(self::hasPermission($permission_other) ? [
+                    'customer_number' => (int)$customer_number->customer_number->value(),
+                ] : []),
+                'department' => $department->id,
+                'reg_1' => $reg_1,
+                'reg_2' => $reg_2,
+                'reg_3' => $reg_3,
+                'datetime' => $datetime->format('Y-m-d H:i:s'),
+                'note' => $note,
+                'reference' => $reference,
+                'po' => $po,
+                'pickup' => $pickup,
+                'items' => $items,
+            ];
+            $object->update($data);
+            /**
+             * Return the object
+             */
+            $response->success($object->asArray());
         },
             [
                 'edit_bookings' => 'Permission to edit order bookings. Only applies to bookings already permitted.'