Add PO number support and enhance permissions for order management

- Introduced `po` property in `orders_o` for handling Purchase Order (PO) numbers, including API integration for retrieval and validation.
- Enhanced customer permissions to allow limited order editing (`po` updates) and attachment downloads for their own orders.
- Added new helper methods to `users_o` for attributes like `showPricesOnBookingPage` and `usePONumbers`.
- Improved order item listing logic with distinct permissions for customers' own orders and price visibility.
- Implemented numeric value casting in filters within `db_object_t`.

services/nginx/app/routes/orderItemsRoute.php

@@ -93,9 +93,18 @@ class orderItemsRoute
         $this->get('/order/items', function () {
             // Require the user to be logged in
             global $response;
-            $this->requirePermission('list_order_items');
-            // Get the user object
+            // Check if the user is requesting their own order items
+            $isCustomerAccess = ($this->hasPermission('user') && !($this->hasPermission('list_order_items')));
             $user = (new authentication())->get_user();
+            if ($isCustomerAccess) {
+                $hasPermission = $this->hasPermission('list_own_order_items');
+                $hasAttribute = $user->showPricesOnBookingPage(); // Check if the user has the attribute to show prices on the booking page
+                if (!$hasPermission && !$hasAttribute) {
+                    $response->error('You do not have permission to list order items, neither your own nor all orders', 403);
+                }
+            } else {
+                $this->requirePermission('list_order_items');
+            }
             // Check if the request was successful
             if ($user) {
                 // Get the post data
@@ -113,6 +122,10 @@ class orderItemsRoute
                     $response->error('Order not found', 404);
                 }
                 $order = (new orders_o())->getOrderById((int)$data['order_id']);
+                // If the user is requesting their own order items, check if the order belongs to them
+                if ($isCustomerAccess && !$order->isOwnOrder((int)$user->customer_number->value())) {
+                    $response->error('Order does not belong to the user', 400);
+                };
                 // Apply the departments unique pricing
                 $orderItems = $order->getOrderItems($order->id);
                 $orderItems = $order->applyDepartmentPrices($orderItems, $order->department_id->value());