Merge pull request #27 from copenhagentruckwash/development

Permit customer department changes

services/nginx/app/objects/department_time_bookings_entries_o.php

@@ -71,6 +71,7 @@ class department_time_bookings_entries_o extends db
         int     $phone,
         ?string $note = null,
         ?string $reg = null,
+        ?array  $addons = null,
     ): void
     {
         self::preChecks(...func_get_args());
@@ -83,6 +84,7 @@ class department_time_bookings_entries_o extends db
             'reg' => $reg,
             'phone' => $phone,
             'phone_country_code' => $phone_country_code,
+            'addons' => $addons,
         ]);
         $this->id = $tmp_id;
         self::getObjectProperties();
@@ -113,6 +115,7 @@ class department_time_bookings_entries_o extends db
         int     $phone,
         ?string $note = null,
         ?string $reg = null,
+        ?array  $addons = null,
     ): void
     {
         // Check if the type_id exists
@@ -139,6 +142,14 @@ class department_time_bookings_entries_o extends db
         if (count($bookings_overlapping) > 0) {
             throw new Exception('The time slot is already booked');
         }
+        // Validate phone number
+        if (!is_numeric($phone) || $phone <= 0) {
+            throw new Exception('Invalid phone number');
+        }
+        // Validate phone country code
+        if (!is_numeric($phone_country_code) || $phone_country_code <= 0) {
+            throw new Exception('Invalid phone country code');
+        }
     }
 
     private function getBookingsByDepartmentAndTime(int $department_id, string $start, string $end): array
@@ -197,11 +208,11 @@ class department_time_bookings_entries_o extends db
                     : self::generateUpdateBookingMessage(true)),
                 true,
             );
-            print_r($department->notificationSmsPhoneNumbers());
+            //print_r($department->notificationSmsPhoneNumbers());
             // Get the phone numbers of the customer
             $customer_phone_numbers = [];
             $customer_phone_numbers[] = '' . $this->phone_country_code->value() . $this->phone->value();
-            print_r($customer_phone_numbers);
+            //print_r($customer_phone_numbers);
             // Send the message to the customer
             $gateway->send(
                 [...$customer_phone_numbers],
@@ -255,7 +266,7 @@ class department_time_bookings_entries_o extends db
         self::requireSelected();
         $message .= self::addNewline('Afdeling: ' . $department->name->value());
         $message .= self::addNewline('Tidspunkt: ' . (string)$this->start->value());
-        $message .= self::addNewline('Type: ' . (string)$type->name->value());
+        $message .= self::addNewline('Type: ' . (string)$type->getName());
         $registration_number = $this->reg->value();
         if (!empty($registration_number)) {
             $message .= self::addNewline('Registreringsnummer: ' . $registration_number);

services/nginx/app/objects/department_time_bookings_types_o.php

@@ -86,4 +86,45 @@ class department_time_bookings_types_o extends db
     {
         //TODO: Add cache invalidation
     }
+
+    /**
+     * Get the duration of a booking type by its ID
+     * @param int $id The ID of the booking type
+     * @return int The duration of the booking type in minutes
+     * @throws Exception If the object could not be selected
+     */
+    public function getDurationById(int $id): int
+    {
+        self::select((int)$id);
+        return (int)$this->duration->value();
+    }
+
+    /**
+     * @throws Exception
+     */
+    public function getName(): string
+    {
+        self::requireSelected();
+        // Check if the type has a name set
+        $type_name = $this->name->value();
+        if (!empty($type_name)) {
+            return $type_name;
+        }
+        // If the type does not have a name set, return the product name
+        return self::getProduct()->name->value();
+    }
+
+    /**
+     * @throws Exception
+     */
+    public function getProduct(): \objects\products_o
+    {
+        self::requireSelected();
+        $product = new \objects\products_o();
+        $product->select((int)$this->product->value());
+        if (!$product->exists()) {
+            throw new Exception('Product not found');
+        }
+        return $product;
+    }
 }

services/nginx/app/objects/department_variables_o.php

@@ -139,6 +139,13 @@ class department_variables_o extends db
         if (!$variable) {
             return null;
         }
+        // Check if the variable is 'false' or 'true'
+        if ($variable[0]['value'] === 'false') {
+            return false;
+        }
+        if ($variable[0]['value'] === 'true') {
+            return true;
+        }
         return $variable[0]['value'];
     }
 

services/nginx/app/objects/departments_o.php

@@ -346,4 +346,13 @@ class departments_o extends db
         self::requireSelected();
         return (new department_notification_sms_o())->getDepartmentActivePhoneNumbers($this->id);
     }
+
+    /**
+     * @throws Exception
+     */
+    public function isModuleTimeBookingsEnabled(): bool
+    {
+        self::requireSelected();
+        return (bool)$this->variables->getVariable('bookingsystem_time_based_enabled');
+    }
 }

services/nginx/app/objects/product_options_o.php

@@ -187,4 +187,14 @@ class product_options_o extends db
     {
         return self::getFieldsWhere(['option_id' => $product_id], ['product_id']);
     }
+
+    public function isOptionAllowedOnType(int $option_id, int $primary_type_id): bool
+    {
+        // Check if the option is allowed on the primary type
+        $allowed_options = self::getFieldsWhere(
+            ['option_id' => $option_id, 'product_id' => $primary_type_id],
+            ['id']
+        );
+        return !empty($allowed_options);
+    }
 }

services/nginx/app/routes/customerDefaultDepartmentRoute.php

@@ -25,13 +25,11 @@ class customerDefaultDepartmentRoute
                 $response->error('Invalid session', 400);
             }
             // Require the customer number parameter
-            self::requireParameters(['customer_number']);
-            // Check if the customer number is valid
-            $customer_number = (int)self::getParameter('customer_number');
-            self::requireMinLength('customer_number', 1);
-            self::requireMaxLength('customer_number', 255);
-            self::requireType($customer_number, self::type_int());
-            self::requireMinValue($customer_number, 1);
+            $customer_number = (int)$this->getCustomerNumberFromParameterOrUser($user);
+            // Check if the customer is its own customer number
+            if ($customer_number !== (int)$user->customer_number->value()) {
+                self::requirePermission('get_customer_default_department_other');
+            }
             // Check if the customer number exists
             $customer = (new users_o())->getUserByCustomerNumber((int)$customer_number);
             if (!$customer->exists()) {
@@ -53,7 +51,8 @@ class customerDefaultDepartmentRoute
             $response->success($customer_default_department_o->asArray());
         },
             [
-                'get_customer_default_department' => 'Get the default department for a customer',
+                'get_customer_default_department' => 'Get the default department for a customer (for its both own and other customers, depending on the get_customer_default_department_other permission)',
+                'get_customer_default_department_other' => 'Get the default department for other customers',
             ]
         );
 
@@ -67,13 +66,13 @@ class customerDefaultDepartmentRoute
                 $response->error('Invalid session', 400);
             }
             // Require the customer number and department parameters
-            self::requireParameters(['customer_number', 'department']);
-            // Check if the customer number is valid
-            $customer_number = (int)self::getParameter('customer_number');
-            self::requireMinLength('customer_number', 1);
-            self::requireMaxLength('customer_number', 255);
-            self::requireType($customer_number, self::type_int());
-            self::requireMinValue($customer_number, 1);
+            self::requireParameters(['department']);
+            // Require the customer number parameter
+            $customer_number = $this->getCustomerNumberFromParameterOrUser($user);
+            // Check if the customer is its own customer number
+            if ($customer_number !== (int)$user->customer_number->value()) {
+                self::requirePermission('add_customer_default_department_other');
+            }
             // Check if the department is valid
             $department = (int)self::getParameter('department');
             self::requireMinLength('department', 1);
@@ -108,7 +107,8 @@ class customerDefaultDepartmentRoute
             $response->success($customer_default_department_o->asArray());
         },
             [
-                'add_customer_default_department' => 'Add a default department for a customer',
+                'add_customer_default_department' => 'Add a default department for a customer (for its both own and other customers, depending on the add_customer_default_department_other permission)',
+                'add_customer_default_department_other' => 'Add a default department for other customers',
             ]
         );
 
@@ -122,13 +122,11 @@ class customerDefaultDepartmentRoute
                 $response->error('Invalid session', 400);
             }
             // Require the customer number parameter
-            self::requireParameters(['customer_number']);
-            // Check if the customer number is valid
-            $customer_number = (int)self::getParameter('customer_number');
-            self::requireMinLength('customer_number', 1);
-            self::requireMaxLength('customer_number', 255);
-            self::requireType($customer_number, self::type_int());
-            self::requireMinValue($customer_number, 1);
+            $customer_number = $this->getCustomerNumberFromParameterOrUser($user);
+            // Check if the customer is its own customer number
+            if ($customer_number !== (int)$user->customer_number->value()) {
+                self::requirePermission('delete_customer_default_department_other');
+            }
             // Check if the customer number exists
             $customer = (new users_o())->getUserByCustomerNumber((int)$customer_number);
             if (!$customer->exists()) {
@@ -151,9 +149,32 @@ class customerDefaultDepartmentRoute
             $response->success('Default department deleted');
         },
             [
-                'delete_customer_default_department' => 'Delete a default department for a customer',
+                'delete_customer_default_department' => 'Delete a default department for a customer (for its both own and other customers, depending on the delete_customer_default_department_other permission)',
+                'delete_customer_default_department_other' => 'Delete a default department for other customers',
             ]
         );
 
     }
+
+    /**
+     * @param users_o|false $user
+     * @return int
+     */
+    private function getCustomerNumberFromParameterOrUser(users_o|false $user): int
+    {
+        if (self::isParametersSet(['customer_number'])) {
+            self::requireParameters(['customer_number']);
+            // Check if the customer number is valid
+            $customer_number = (int)self::getParameter('customer_number');
+            self::requireMinLength('customer_number', 1);
+            self::requireMaxLength('customer_number', 255);
+            self::requireType($customer_number, self::type_int());
+        } else {
+            // If the customer number is not set, use the user's customer number
+            $customer_number = (int)$user->customer_number->value();
+            // Make sure the customer number is valid
+        }
+        self::requireMinValue($customer_number, 1);
+        return $customer_number;
+    }
 }

services/nginx/app/routes/customerTimeBookingsRoute.php

@@ -0,0 +1,272 @@
+<?php
+
+namespace routes;
+
+use classes\response;
+use classes\router;
+use objects\department_time_bookings_entries_o;
+use objects\department_time_bookings_opening_hours_o;
+use objects\department_time_bookings_types_o;
+use objects\departments_o;
+use objects\product_options_o;
+use traits\route_t;
+
+class customerTimeBookingsRoute
+{
+    use route_t;
+
+    public function run(): void
+    {
+        global /** @var response $response */
+        /** @var router $router */
+        $router, $response;
+
+
+        /** Guest Time Bookings -> Opening Hours -> GET */
+        $this->get('/department/timebookings/opening-hours/public', function () {
+            global $response;
+            if (!self::isParametersSet(['id'])) {
+                $response->error('Missing id parameter', 400);
+            }
+            self::requireType((int)self::getParameter('id'), self::type_int());
+            self::requireMinValue((int)self::getParameter('id'), 1);
+            self::requireSameLength(self::getParameter('id'), (int)self::getParameter('id'));
+            // Check if the department exists
+            $department = new \objects\departments_o();
+            $department->select((int)self::getParameter('id'));
+            if (!$department->exists()) {
+                $response->error('Department not found', 404);
+            }
+            // Check if the department has time bookings enabled
+            $variable = $department->isModuleTimeBookingsEnabled();
+            if (!$variable) {
+                $response->error('Department time bookings are not enabled', 404);
+            }
+            $department_time_bookings_opening_hours = new department_time_bookings_opening_hours_o();
+            $department_time_bookings_opening_hours->selectByDepartment(
+                (int)self::getParameter('id')
+            );
+            if (!$department_time_bookings_opening_hours->exists()) {
+                $response->error('Department time bookings opening hours not found', 404);
+            }
+            $result = $department_time_bookings_opening_hours->asArray();
+            // Restrict the result to only the opening hours
+            $result = array_filter($result, function ($key) {
+                return in_array($key, [
+                    'monday_start',
+                    'monday_end',
+                    'tuesday_start',
+                    'tuesday_end',
+                    'wednesday_start',
+                    'wednesday_end',
+                    'thursday_start',
+                    'thursday_end',
+                    'friday_start',
+                    'friday_end',
+                    'saturday_start',
+                    'saturday_end',
+                    'sunday_start',
+                    'sunday_end'
+                ]);
+            }, ARRAY_FILTER_USE_KEY);
+            $response->success($result);
+        },
+            [
+                // No permissions required for this endpoint, as it is for guests
+            ]
+        );
+
+        /** Guest Time Bookings -> Types -> GET */
+        $this->get('/department/timebookings/types/public', function () {
+            global $response;
+            if (!self::isParametersSet(['id'])) {
+                $response->error('Missing id parameter', 400);
+            }
+            self::requireType((int)self::getParameter('id'), self::type_int());
+            self::requireMinValue((int)self::getParameter('id'), 1);
+            self::requireSameLength(self::getParameter('id'), (int)self::getParameter('id'));
+            // Check if the department exists
+            $department = new \objects\departments_o();
+            $department->select((int)self::getParameter('id'));
+            if (!$department->exists()) {
+                $response->error('Department not found', 404);
+            }
+            // Check if the department has time bookings enabled
+            $variable = $department->isModuleTimeBookingsEnabled();
+            if (!$variable) {
+                $response->error('Department time bookings are not enabled', 404);
+            }
+            $department_time_bookings_types = new department_time_bookings_types_o();
+            $booking_types_array = $department_time_bookings_types->getFieldsWhere(
+                [
+                    'department' => (int)self::getParameter('id'),
+                ],
+                ['id', 'department', 'product', 'name', 'description', 'duration']
+            );
+            function formatBookingType($booking_type): array
+            {
+                return [
+                    'id' => (int)$booking_type['id'],
+                    'department' => (int)$booking_type['department'],
+                    'product' => (int)$booking_type['product'],
+                    'name' => (string)$booking_type['name'],
+                    'description' => (string)$booking_type['description'],
+                    'duration' => (int)$booking_type['duration'],
+                ];
+            }
+
+            $result = array_map('formatBookingType', $booking_types_array);
+            if (empty($result)) {
+                $response->error('No department time bookings types found', 404);
+            }
+            $response->success($result);
+        },
+            [
+                // No permissions required for this endpoint, as it is for guests
+            ]
+        );
+        /** Guest Time Bookings -> Entries -> GET */
+        $this->get('/department/timebookings/entries/public', function () {
+            /**
+             * @example Usage of this endpoint:
+             * GET /department/timebookings/entries/public?id=1&filters=created_at-date_from:2025-04-01,created_at-date_to:2025-05-30&order=created_at:desc
+             * This will return all time booking entries for the department with ID 1, created between 2025-04-01 and 2025-05-30, ordered by created_at in descending order.
+             * https://api.truckwash.dk:4433/department/timebookings/entries/public?id=1&filters=created_at-date_from:2025-04-01,created_at-date_to:2025-05-30&order=created_at:desc
+             */
+            global $response;
+            if (!self::isParametersSet(['id'])) {
+                $response->error('Missing id parameter', 400);
+            }
+            self::requireType((int)self::getParameter('id'), self::type_int());
+            self::requireMinValue((int)self::getParameter('id'), 1);
+            self::requireSameLength(self::getParameter('id'), (int)self::getParameter('id'));
+            // Check if the department exists
+            $department = new \objects\departments_o();
+            $department->select((int)self::getParameter('id'));
+            if (!$department->exists()) {
+                $response->error('Department not found', 404);
+            }
+            // Check if the department has time bookings enabled
+            $variable = $department->isModuleTimeBookingsEnabled();
+            if (!$variable) {
+                $response->error('Department time bookings are not enabled', 404);
+            }
+            $department_time_bookings_entries = new department_time_bookings_entries_o();
+            $booking_entries_array = $department_time_bookings_entries->listObjectsWithPaginationIfSet(
+                function ($booking_entry): array {
+                    $booking_type_duration = (new department_time_bookings_types_o())->getDurationById((int)$booking_entry['type']);
+                    return [
+                        'start' => (string)$booking_entry['start'],
+                        'duration' => (int)$booking_type_duration, // The duration in minutes, defined by the type
+                    ];
+                },
+                $department_time_bookings_entries->forceRestrictFilters(
+                    [
+                        'department' => [
+                            (int)$department->id
+                        ],
+                    ]
+                )
+            );
+            $response->success($booking_entries_array);
+        },
+            [
+                // No permissions required for this endpoint, as it is for guests
+            ]
+        );
+
+        /** Guest Time Bookings -> Entries -> Add */
+        $this->post('/department/timebookings/entries/public', function () {
+            global $response;
+            self::requireParameters(['department', 'type', 'start']);
+            self::requireType((int)self::getParameter('department'), self::type_int());
+            self::requireMinValue((int)self::getParameter('department'), 1);
+            self::requireSameLength(self::getParameter('department'), (int)self::getParameter('department'));
+
+            // Get the type
+            self::requireType((int)self::getParameter('type'), self::type_int());
+            self::requireMinValue((int)self::getParameter('type'), 1);
+            self::requireSameLength(self::getParameter('type'), (int)self::getParameter('type'));
+
+            // Get the start time
+            self::requireType((string)self::getParameter('start'), self::type_string());
+            self::requireMinLength('start', 1);
+            self::requireMaxLength('start', 255);
+            self::requireSameLength(self::getParameter('start'), (string)self::getParameter('start'));
+            self::requireDateFormat((string)self::getParameter('start'), 'Y-m-d H:i:s');
+
+            // Check if the department exists
+            $department = new departments_o();
+            $department->select((int)self::getParameter('department'));
+            if (!$department->exists()) {
+                $response->error('Department not found', 404);
+            }
+            // Check if the department has time bookings enabled
+            $variable = $department->isModuleTimeBookingsEnabled();
+            if (!$variable) {
+                $response->error('Department time bookings are not enabled', 404);
+            }
+            // Check if the type exists
+            $department_time_bookings_types = new department_time_bookings_types_o();
+            $department_time_bookings_types->select((int)self::getParameter('type'));
+            if (!$department_time_bookings_types->exists()) {
+                $response->error('Department time bookings type not found', 404);
+            }
+            // Check if the type belongs to the department
+            if ((int)$department_time_bookings_types->department->value() !== (int)$department->id) {
+                $response->error('Department time bookings type does not belong to the department', 404);
+            }
+            // Calculate the end time
+            $start_time = \DateTime::createFromFormat('Y-m-d H:i:s', (string)self::getParameter('start'));
+            if (!$start_time) {
+                $response->error('Invalid start time format', 400);
+            }
+            $duration = (int)$department_time_bookings_types->duration->value();
+            if ($duration <= 0) {
+                $response->error('Invalid duration for department time bookings type', 400);
+            }
+            $end_time = clone $start_time;
+            $end_time->modify("+{$duration} minutes");
+
+            // Check if the addons parameter is set
+            $addons = [];
+            if (self::isParametersSet(['addons'])) {
+                self::requireType((array)self::getParameter('addons'), self::type_array());
+                $addons = (array)self::getParameter('addons');
+                // Validate each addon
+                foreach ( $addons as $addon ) {
+                    self::requireType((int)$addon, self::type_int());
+                    self::requireMinValue((int)$addon, 1);
+                    self::requireSameLength($addon, (int)$addon);
+                    // Check if the addon is allowed on the primary type
+                    $product_options = new product_options_o();
+                    if (!$product_options->isOptionAllowedOnType(
+                        (int)$addon,
+                        (int)$department_time_bookings_types->product->value()
+                    )) {
+                        $response->error('This product option is not allowed on the primary product type', 400);
+                    }
+                }
+            }
+            // Add the department time bookings entry
+            $department_time_bookings_entries = new department_time_bookings_entries_o();
+            $department_time_bookings_entries->add(
+                (int)self::getParameter('department'),
+                (int)self::getParameter('type'),
+                (string)$start_time->format('Y-m-d H:i:s'),
+                (string)$end_time->format('Y-m-d H:i:s'),
+                (int)(self::isParametersSet(['phone_country_code']) ? self::getParameter('phone_country_code') : 0),
+                (int)(self::isParametersSet(['phone']) ? self::getParameter('phone') : 0),
+                (self::isParametersSet(['note']) ? (string)self::getParameter('note') : null),
+                (self::isParametersSet(['reg']) ? (string)self::getParameter('reg') : null),
+                (array)$addons,
+            );
+            // Return success
+            $response->success($department_time_bookings_entries->asArray());
+        },
+            [
+                // No permissions required for this endpoint, as it is for guests
+            ]
+        );
+    }
+}

services/nginx/app/routes/departmentTimeBookingsRoute.php

@@ -9,6 +9,7 @@ use objects\department_time_bookings_entries_o;
 use objects\department_time_bookings_opening_hours_o;
 use objects\department_time_bookings_types_o;
 use objects\logs_o;
+use objects\product_options_o;
 use traits\route_t;
 
 class departmentTimeBookingsRoute
@@ -29,16 +30,17 @@ class departmentTimeBookingsRoute
             $user = (new authentication())->get_user();
             if ($user) {
                 $specific_department = null;
-                if (self::isParametersSet(['department'])) {
-                    self::requireType((int)self::getParameter('department'), self::type_int());
-                    self::requireMinValue((int)self::getParameter('department'), 1);
-                    self::requireSameLength(self::getParameter('department'), (int)self::getParameter('department'));
-                    self::requireDepartmentAccess((int)self::getParameter('department'));
-                    $specific_department = (int)self::getParameter('department');
+                if (self::isParametersSet(['department']) || self::isParametersSet(['id'])) {
+                    $parameter_name = self::isParametersSet(['department']) ? 'department' : 'id';
+                    self::requireType((int)self::getParameter($parameter_name), self::type_int());
+                    self::requireMinValue((int)self::getParameter($parameter_name), 1);
+                    self::requireSameLength(self::getParameter($parameter_name), (int)self::getParameter($parameter_name));
+                    self::requireDepartmentAccess((int)self::getParameter($parameter_name));
+                    $specific_department = (int)self::getParameter($parameter_name);
                     // Select the specific department
                     $department_time_bookings_opening_hours = new department_time_bookings_opening_hours_o();
                     $department_time_bookings_opening_hours->selectByDepartment(
-                        (int)self::getParameter('department')
+                        (int)self::getParameter($parameter_name)
                     );
                     $response->success($department_time_bookings_opening_hours->asArray());
                 }
@@ -127,12 +129,13 @@ class departmentTimeBookingsRoute
             $user = (new authentication())->get_user();
             if ($user) {
                 $specific_department = null;
-                if (self::isParametersSet(['department'])) {
-                    self::requireType((int)self::getParameter('department'), self::type_int());
-                    self::requireMinValue((int)self::getParameter('department'), 1);
-                    self::requireSameLength(self::getParameter('department'), (int)self::getParameter('department'));
-                    self::requireDepartmentAccess((int)self::getParameter('department'));
-                    $specific_department = (int)self::getParameter('department');
+                if (self::isParametersSet(['department']) || self::isParametersSet(['id'])) {
+                    $parameter_name = self::isParametersSet(['department']) ? 'department' : 'id';
+                    self::requireType((int)self::getParameter($parameter_name), self::type_int());
+                    self::requireMinValue((int)self::getParameter($parameter_name), 1);
+                    self::requireSameLength(self::getParameter($parameter_name), (int)self::getParameter($parameter_name));
+                    self::requireDepartmentAccess((int)self::getParameter($parameter_name));
+                    $specific_department = (int)self::getParameter($parameter_name);
                 }
                 $department_time_bookings_types = new department_time_bookings_types_o();
                 $result = $department_time_bookings_types->listObjectsWithPaginationIfSet(
@@ -325,23 +328,98 @@ class departmentTimeBookingsRoute
             self::requirePermission('department_timebookings_entries_post');
             $user = (new authentication())->get_user();
             if ($user) {
-                self::requireParameters(['department', 'type', 'start', 'end']);
+                self::requireParameters(['department', 'type', 'start']);
                 self::requireType((int)self::getParameter('department'), self::type_int());
                 self::requireMinValue((int)self::getParameter('department'), 1);
                 self::requireSameLength(self::getParameter('department'), (int)self::getParameter('department'));
                 self::requireDepartmentAccess((int)self::getParameter('department'));
 
+                // Get the type
+                self::requireType((int)self::getParameter('type'), self::type_int());
+                self::requireMinValue((int)self::getParameter('type'), 1);
+                self::requireSameLength(self::getParameter('type'), (int)self::getParameter('type'));
+
+                // Get the start time
+                self::requireType((string)self::getParameter('start'), self::type_string());
+                self::requireMinLength('start', 1);
+                self::requireMaxLength('start', 255);
+                self::requireSameLength(self::getParameter('start'), (string)self::getParameter('start'));
+                self::requireDateFormat((string)self::getParameter('start'), 'Y-m-d H:i:s');
+
+                // Check if the department exists
+                $department = new \objects\departments_o();
+                $department->select((int)self::getParameter('department'));
+                if (!$department->exists()) {
+                    (new logs_o())->add('department_time_bookings_entries', 'global', 0, $user->id, 'DEPARTMENT_TIME_BOOKINGS_ENTRIES_POST', 'Department not found');
+                    $response->error('Department not found', 404);
+                }
+                // Check if the department has time bookings enabled
+                $variable = $department->isModuleTimeBookingsEnabled();
+                if (!$variable) {
+                    (new logs_o())->add('department_time_bookings_entries', 'global', 0, $user->id, 'DEPARTMENT_TIME_BOOKINGS_ENTRIES_POST', 'Department time bookings are not enabled');
+                    $response->error('Department time bookings are not enabled', 404);
+                }
+                // Check if the type exists
+                $department_time_bookings_types = new department_time_bookings_types_o();
+                $department_time_bookings_types->select((int)self::getParameter('type'));
+                if (!$department_time_bookings_types->exists()) {
+                    (new logs_o())->add('department_time_bookings_entries', 'global', 0, $user->id, 'DEPARTMENT_TIME_BOOKINGS_ENTRIES_POST', 'Department time bookings type not found');
+                    $response->error('Department time bookings type not found', 404);
+                }
+                // Check if the type belongs to the department
+                if ((int)$department_time_bookings_types->department->value() !== (int)$department->id) {
+                    (new logs_o())->add('department_time_bookings_entries', 'global', 0, $user->id, 'DEPARTMENT_TIME_BOOKINGS_ENTRIES_POST', 'Department time bookings type does not belong to the department');
+                    $response->error('Department time bookings type does not belong to the department', 404);
+                }
+                // Calculate the end time
+                $start_time = \DateTime::createFromFormat('Y-m-d H:i:s', (string)self::getParameter('start'));
+                if (!$start_time) {
+                    (new logs_o())->add('department_time_bookings_entries', 'global', 0, $user->id, 'DEPARTMENT_TIME_BOOKINGS_ENTRIES_POST', 'Invalid start time format');
+                    $response->error('Invalid start time format', 400);
+                }
+                $duration = (int)$department_time_bookings_types->duration->value();
+                if ($duration <= 0) {
+                    (new logs_o())->add('department_time_bookings_entries', 'global', 0, $user->id, 'DEPARTMENT_TIME_BOOKINGS_ENTRIES_POST', 'Invalid duration for department time bookings type');
+                    $response->error('Invalid duration for department time bookings type', 400);
+                }
+                $end_time = clone $start_time;
+                $end_time->modify("+{$duration} minutes");
+
+                // Check if the addons parameter is set
+                $addons = [];
+                if (self::isParametersSet(['addons'])) {
+                    self::requireType((array)self::getParameter('addons'), self::type_array());
+                    $addons = (array)self::getParameter('addons');
+                    // Validate each addon
+                    foreach ( $addons as $addon ) {
+                        self::requireType((int)$addon, self::type_int());
+                        self::requireMinValue((int)$addon, 1);
+                        self::requireSameLength($addon, (int)$addon);
+                        // Check if the addon is allowed on the primary type
+                        $product_options = new product_options_o();
+                        if (!$product_options->isOptionAllowedOnType(
+                            (int)$addon,
+                            (int)$department_time_bookings_types->product->value()
+                        )) {
+                            (new logs_o())->add('department_time_bookings_entries', 'global', 0, $user->id, 'DEPARTMENT_TIME_BOOKINGS_ENTRIES_POST', 'This product option is not allowed on the primary product type');
+                            $response->error('This product option is not allowed on the primary product type', 400);
+                        }
+                    }
+                }
+
+
                 // Add the department time bookings entry
                 $department_time_bookings_entries = new department_time_bookings_entries_o();
                 $department_time_bookings_entries->add(
                     (int)self::getParameter('department'),
                     (int)self::getParameter('type'),
-                    (string)self::getParameter('start'),
-                    (string)self::getParameter('end'),
+                    (string)$start_time->format('Y-m-d H:i:s'),
+                    (string)$end_time->format('Y-m-d H:i:s'),
                     (int)(self::isParametersSet(['phone_country_code']) ? self::getParameter('phone_country_code') : 0),
                     (int)(self::isParametersSet(['phone']) ? self::getParameter('phone') : 0),
                     (self::isParametersSet(['note']) ? (string)self::getParameter('note') : null),
-                    (self::isParametersSet(['reg']) ? (string)self::getParameter('reg') : null)
+                    (self::isParametersSet(['reg']) ? (string)self::getParameter('reg') : null),
+                    (array)$addons,
                 );
                 (new logs_o())->add('department_time_bookings_entries', 'global', 0, $user->id, 'DEPARTMENT_TIME_BOOKINGS_ENTRIES_POST', 'Add department time bookings entries');
                 $response->success($department_time_bookings_entries->asArray());

services/nginx/app/traits/db_object_t.php

@@ -923,6 +923,33 @@ trait db_object_t
         global /** @var db $db */
         $db;
         try {
+            // Sanitize the data
+            foreach ( $data as $key => $value ) {
+                // If the value is an object or an array, convert it to a JSON string
+                if (is_object($value) || is_array($value)) {
+                    $data[$key] = json_encode($value);
+                    if ($data[$key] === false) {
+                        throw new Exception('Failed to encode value for key: ' . $key . ' - ' . json_last_error_msg());
+                    }
+                }
+                // If the value is null, set it to null
+                if ($value === null || (is_string($value) && strtolower($value) === 'null')) {
+                    $data[$key] = 'NULL';
+                    continue;
+                }
+                // Escape the value to prevent SQL injection (this is important for strings)
+                if (is_string($value)) {
+                    // If the value is a string, escape it
+                    $data[$key] = $db->escape_string($value);
+                } elseif (is_numeric($value)) {
+                    // If the value is numeric, cast it to a string
+                    $data[$key] = (string)$value;
+                } elseif (is_bool($value)) {
+                    // If the value is a boolean, convert it to an integer
+                    $data[$key] = (int)$value;
+                }
+            }
+            // Prepare the SQL query to insert the data
             $columns = implode(', ', array_keys($data));
             $values = implode("', '", array_values($data));
             $sql = "INSERT INTO $this->table ($columns) VALUES ('$values')";