copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Add PO number support and enhance permissions for order management

Browse Source 
- Introduced `po` property in `orders_o` for handling Purchase Order (PO) numbers, including API integration for retrieval and validation.
- Enhanced customer permissions to allow limited order editing (`po` updates) and attachment downloads for their own orders.
- Added new helper methods to `users_o` for attributes like `showPricesOnBookingPage` and `usePONumbers`.
- Improved order item listing logic with distinct permissions for customers' own orders and price visibility.
- Implemented numeric value casting in filters within `db_object_t`.
This commit is contained in:
Jeppe Bundgaard
2025-10-22 11:38:35 +02:00
parent b78d9e0e63
commit 30b94e89d7
6 changed files with 117 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/ordersRoute.php
+54 -3
View File
@@ -93,6 +93,8 @@ class ordersRoute
$order['user_id'] = (int)$tmp_customer->id;
$order['pending_handheld'] = $order_obj->isPendingHandheld();
$order['attachments'] = $order_obj->listAttachments();
$order['po'] = $order['po'] ?? null;
$order['lane'] = $order['lane'] ?? null;
/** @var array $order */
return $order;
},
@@ -208,7 +210,13 @@ class ordersRoute
$this->put('/orders', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('edit_order');
// Check if the user has permission to partially edit the order
$isCustomerAccess = ((new authentication())->get_user()->hasPermission('user') && !((new authentication())->get_user()->hasPermission('edit_order')));
if (!$isCustomerAccess) {
$this->requirePermission('edit_order');
} else {
$this->requirePermission('user'); // This is used to allow the user to edit their own order
}
// Get the user object
$user = (new authentication())->get_user();
// Check if the request was successful
@@ -225,6 +233,33 @@ class ordersRoute
if (!$order->exists()) {
$response->error('Order not found', 400);
}
// Check if the user has customer edit access
if ($isCustomerAccess) {
if ($order->customer_id->value() !== $user->customer_number->value()) {
$response->error('You do not have permission to edit this order', 400);
}
// Allowed to edit list
$allowed_to_edit = [
// Include the order ID (Even though it is not editable)
'id',
'po',
];
// Check if the $data contains any non-allowed keys
foreach ($data as $key => $value) {
if (!in_array($key, $allowed_to_edit)) {
$response->error('You do not have permission to edit this order field (key: ' . $key . ')', 400);
break;
}
};
// PO
if (isset($data['po'])) {
$order->po->set((string)$data['po']);
}
$order->objectChanged();
// Return a success message
$response->success($order->asArray());
}
/** Departmental access */
// If the customer ID is set, validate it
if (isset($data['customer_id'])) {
if (!(new users_o())->getCustomerByIdOrCustomerNumber((int)$data['customer_id'])->exists() || empty($data['customer_id'])) {
@@ -252,6 +287,10 @@ class ordersRoute
if (isset($data['reg_3'])) {
$order->reg_3->set($data['reg_3']);
}
// If the PO is set, validate it
if (isset($data['po'])) {
$order->po->set((string)$data['po']);
}
// If the lane is set, validate it
if (isset($data['lane'])) {
$order->lane->set((int)$data['lane']);
@@ -338,7 +377,12 @@ class ordersRoute
$this->get('/orders/attachments/download', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('download_order_attachments');
$isCustomerAccess = ($this->hasPermission('user') && !($this->hasPermission('download_order_attachments')));
if (!$isCustomerAccess) {
$this->requirePermission('download_order_attachments');
} else {
$this->requirePermission('download_order_attachments_own');
}
// Get the user object
$user = (new authentication())->get_user();
// Check if the request was successful
@@ -362,6 +406,12 @@ class ordersRoute
if (!$order->exists()) {
$response->error('Order not found', 400);
}
// Check if the user has customer edit access
if ($isCustomerAccess) {
if ($order->isOwnOrder($user->customer_number->value()) === false) {
$response->error('You do not have permission to download this order', 400);
}
}
// Get the attachment
$attachment = $order->getAttachment((int)$attachment_id);
if (!$attachment->exists()) {
@@ -387,7 +437,8 @@ class ordersRoute
}
},
[
'download_order_attachments' => 'Download attachments for an order'
'download_order_attachments' => 'Download attachments for an order',
'download_order_attachments_own' => 'Download attachments for an order (Only for own orders)'
]
);