From 8c0f3a1b5c47c9c0c76986605c1e4d8f1925c34c Mon Sep 17 00:00:00 2001
From: Jepp9350 <2jepp9350@gmail.com>
Date: Tue, 17 Dec 2024 12:01:37 +0100
Subject: [PATCH] added /order/items route, making it possible to change price,
 notes, references on order items.

---
 objects/order_items_o.php  | 19 +++++++++++++++++++
 routes/orderItemsRoute.php | 31 +++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/objects/order_items_o.php b/objects/order_items_o.php
index 0ea72eb2..969daf11 100644
--- a/objects/order_items_o.php
+++ b/objects/order_items_o.php
@@ -143,4 +143,23 @@ class order_items_o extends db
         }
         return $items;
     }
+
+    public function updateOrderItem(int $id, int $price, string $notes, string $reference): void
+    {
+        global $db, $response;
+        $this->id = $id;
+        try {
+            // Avoid SQL injection
+            $price = $db->escape_string($price);
+            $notes = $db->escape_string($notes);
+            $reference = $db->escape_string($reference);
+            // Update the record in the database
+            $sql = "UPDATE $this->table SET price = $price, notes = '$notes', reference = '$reference' WHERE id = $this->id";
+            $db->query($sql);
+            // Set the values of the object properties
+            $this->getObjectProperties();
+        } catch (\Exception $e) {
+            $response->error($e->getMessage());
+        }
+    }
 }
\ No newline at end of file
diff --git a/routes/orderItemsRoute.php b/routes/orderItemsRoute.php
index 954dca9a..e9a40c0f 100644
--- a/routes/orderItemsRoute.php
+++ b/routes/orderItemsRoute.php
@@ -95,5 +95,36 @@ class orderItemsRoute
                 $response->error('Invalid session', 400);
             }
         });
+
+        $this->put('/order/items', function () {
+            // Require the user to be logged in
+            global $response;
+            $this->requirePermission('edit_order_items');
+            // Get the user object
+            $user = (new authentication())->get_user();
+            // Check if the request was successful
+            if ($user) {
+                // Get the post data
+                $data = json_decode(file_get_contents('php://input'), true);
+                // Check if the required fields are set
+                if (!isset($data['id'])) { $response->error('Order Item ID is required', 400); }
+                if (!isset($data['price'])) { $response->error('Price is required', 400); }
+                if (!isset($data['notes'])) { $response->error('Notes is required', 400); }
+                if (!isset($data['reference'])) { $response->error('Reference is required', 400); }
+                // Update the order item
+                (new order_items_o())->updateOrderItem((int)$data['id'], (int)$data['price'], (string)$data['notes'], (string)$data['reference']);
+                // Log the incident
+                (new logs_o())->add('departments', 'global', 1, $user->id, 'EDIT_ORDER_ITEMS', 'Changed order item: ' . $data['id']);
+                // Return the list of departments
+                $response->success(
+                    ['message' => 'Order item updated']
+                );
+            } else {
+                // Log the incident
+                (new logs_o())->add('departments', 'global', 1, 0, 'EDIT_ORDER_ITEMS', 'No user found, or invalid session');
+                // Return an error
+                $response->error('Invalid session', 400);
+            }
+        });
     }
 }
\ No newline at end of file