copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Validate access and booking status for retrieving invoice PDFs

Browse Source 
- Added validation to ensure the user owns the invoice and it has been booked before generating the PDF.
- Updated logic to retrieve and store booked invoice PDFs using the correct `booked_invoice_id`.
- Improved error handling for unauthorized access and unbooked invoices.
This commit is contained in:
Jeppe Bundgaard
2025-12-10 14:22:37 +01:00
parent f8af8cae46
commit 9c9df0f1f4
1 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/invoicesRoute.php
+15 -7
View File
@@ -5,6 +5,7 @@ namespace routes;
use classes\authentication;
use classes\economic;
use classes\invoice_store;
use objects\collected_order_invoices_o;
use objects\economic_module_orders;
use objects\logs_o;
use objects\orders_o;
@@ -104,18 +105,25 @@ class invoicesRoute
if (!$this->fromRequest('id')) {
$response->error('id parameter is required', 400);
}
$order_id = (new orders_o())->getOrderByInvoiceId($this->fromRequest('id'))->id;
// Check if the user has permission to view the invoice
if (!$user->hasAccessToOrder($order_id)) {
$response->error('User does not have access to this invoice', 403);
// Get the collected order invoice object
$collected_order_invoice = (new collected_order_invoices_o())->select((int)$this->fromRequest('id'));
// Make sure the user owns the invoice
if ((int)$collected_order_invoice->customer_number->value() !== (int)$user->customer_number->value()) {
$response->error('You do not have permission to access this invoice', 403);
}
// Check if the invoice is booked
$is_booked = $collected_order_invoice->isBooked();
if (!$is_booked) {
$response->error('Invoice is not booked yet', 400);
}
$booked_invoice_id = (int)$collected_order_invoice->booked_invoice_id->value();
// Create economic object
$economic = new economic();
// Get the draft invoice
$invoicePathFile = $economic->invoices->pdf->get($this->fromRequest('id'));
$invoicePathFile = $economic->invoices->pdf->get($booked_invoice_id);
// Add the pdf to the invoice store
$invoice_store = new invoice_store();
$invoice_store->uploadFile('invoice_' . $this->fromRequest('id') . '.pdf', $invoicePathFile);
$invoice_store->uploadFile('invoice_' . $booked_invoice_id . '.pdf', $invoicePathFile);
// Log the incident
(new logs_o())->add('invoices', 'global', 1, $user->id, 'GET_INVOICE_PDF', 'Successfully retrieved invoice pdf');
@@ -123,7 +131,7 @@ class invoicesRoute
unlink($invoicePathFile);
// Return the download link
$response->success(
['message' => 'Invoice PDF retrieved', 'url' => $invoice_store->getInvoiceDownloadUrl($this->fromRequest('id'))]
['message' => 'Invoice PDF retrieved', 'url' => $invoice_store->getInvoiceDownloadUrl($booked_invoice_id)]
);
} else {
// Log the incident