From 734cd13c8751d8011b2bab248bf98f9cc1e6e383 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 6 Jul 2026 23:16:55 +0000
Subject: [PATCH] Handle prepared statement failure with error response in
 DELETE /order/items

---
 services/nginx/app/routes/orderItemsRoute.php | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/services/nginx/app/routes/orderItemsRoute.php b/services/nginx/app/routes/orderItemsRoute.php
index 2e5ba3b4..ca1baa3e 100644
--- a/services/nginx/app/routes/orderItemsRoute.php
+++ b/services/nginx/app/routes/orderItemsRoute.php
@@ -190,14 +190,14 @@ class orderItemsRoute
                 // Look up the order item to check department access
                 $itemId = (int)$data['id'];
                 $stmt = $db->prepare('SELECT oi.order_id FROM order_items oi WHERE oi.id = ? LIMIT 1');
-                if ($stmt !== false) {
-                    $stmt->bind_param('i', $itemId);
-                    $stmt->execute();
-                    $orderItemRow = $stmt->get_result()->fetch_assoc();
-                    $stmt->close();
-                } else {
-                    $orderItemRow = null;
+                if ($stmt === false) {
+                    (new logs_o())->add('order_items', 'global', 1, 0, 'DELETE_ORDER_ITEMS', 'Failed to prepare department access check query');
+                    $response->error('Failed to validate department access', 500);
                 }
+                $stmt->bind_param('i', $itemId);
+                $stmt->execute();
+                $orderItemRow = $stmt->get_result()->fetch_assoc();
+                $stmt->close();
                 if ($orderItemRow !== null) {
                     $orderForAccess = (new orders_o())->getOrderById((int)$orderItemRow['order_id']);
                     if ($orderForAccess->exists()) {