Add endpoint for updating bookings with user access checks

2025-05-27 08:30:06 +02:00
parent 743928459e
commit 73a9c4baf4
1 changed files with 66 additions and 0 deletions
@@ -127,6 +127,72 @@ class bookingsRoute
                'list_own_bookings' => 'List all bookings for the logged in user'
            ]
        );
+
+        $this->put('/bookings', function () {
+            // Require the user to be logged in
+            global /** @var response $response */
+            $response;
+            $this->requirePermission('list_own_bookings');
+            // Get the user object
+            $user = (new authentication())->get_user();
+            // Check if the request was successful
+            if ($user) {
+                // Log the incident
+                (new logs_o())->add('bookings', 'global', 1, $user->id, 'UPDATE_BOOKING', 'Successfully updated booking');
+                // Require the booking id parameter
+                self::requireParameters([
+                    'id'
+                ]);
+                // Check if the booking id is a number
+                self::requireType((int)$this->getParameter('id'), self::type_int());
+                self::requireMinValue((int)$this->getParameter('id'), 1);
+                self::requireSameLength(
+                    (int)$this->getParameter('id'),
+                    $this->getParameter('id'),
+                );
+                // Check if the booking exists
+                $booking = (new bookings_o())->select((int)$this->getParameter('id'));
+                if (!$booking->exists()) {
+                    $response->error('Booking not found', 404);
+                }
+                // Check if the user has access to the booking
+                if (!$user->hasAccessToBooking((int)$this->getParameter('id'))) {
+                    $response->error('You are not allowed to update this booking', 403);
+                }
+                // Check if the optional parameters are set
+                if (self::isParametersSet(['reference_number'])) {
+                    // Check if the reference number is a string
+                    self::requireType(
+                        (string)$this->getParameter('reference_number'),
+                        self::type_string()
+                    );
+                    self::requireMinLength(
+                        'reference_number',
+                        0
+                    );
+                    self::requireMaxLength(
+                        'reference_number',
+                        255
+                    );
+                    $booking->reference_number->set(
+                        (string)$this->getParameter('reference_number')
+                    );
+                }
+                // Return the booking
+                $response->success(
+                    $booking->asArray()
+                );
+            } else {
+                // Log the incident
+                (new logs_o())->add('bookings', 'global', 1, 0, 'ADD_BOOKING', 'No user found, or invalid session');
+                // Return an error
+                $response->error('Invalid session', 400);
+            }
+        },
+            [
+                'add_booking' => 'Add a new booking'
+            ]
+        );
        // Synchronize booking from the external system
        $this->post('/admin/bookings/sync', function () {
            // Require the user to be logged in