diff --git a/services/nginx/app/routes/invoicesRoute.php b/services/nginx/app/routes/invoicesRoute.php index 584164ae..6bdf022f 100644 --- a/services/nginx/app/routes/invoicesRoute.php +++ b/services/nginx/app/routes/invoicesRoute.php @@ -5,6 +5,7 @@ namespace routes; use classes\authentication; use classes\economic; use classes\invoice_store; +use objects\collected_order_invoices_o; use objects\economic_module_orders; use objects\logs_o; use objects\orders_o; @@ -104,18 +105,25 @@ class invoicesRoute if (!$this->fromRequest('id')) { $response->error('id parameter is required', 400); } - $order_id = (new orders_o())->getOrderByInvoiceId($this->fromRequest('id'))->id; - // Check if the user has permission to view the invoice - if (!$user->hasAccessToOrder($order_id)) { - $response->error('User does not have access to this invoice', 403); + // Get the collected order invoice object + $collected_order_invoice = (new collected_order_invoices_o())->select((int)$this->fromRequest('id')); + // Make sure the user owns the invoice + if ((int)$collected_order_invoice->customer_number->value() !== (int)$user->customer_number->value()) { + $response->error('You do not have permission to access this invoice', 403); } + // Check if the invoice is booked + $is_booked = $collected_order_invoice->isBooked(); + if (!$is_booked) { + $response->error('Invoice is not booked yet', 400); + } + $booked_invoice_id = (int)$collected_order_invoice->booked_invoice_id->value(); // Create economic object $economic = new economic(); // Get the draft invoice - $invoicePathFile = $economic->invoices->pdf->get($this->fromRequest('id')); + $invoicePathFile = $economic->invoices->pdf->get($booked_invoice_id); // Add the pdf to the invoice store $invoice_store = new invoice_store(); - $invoice_store->uploadFile('invoice_' . $this->fromRequest('id') . '.pdf', $invoicePathFile); + $invoice_store->uploadFile('invoice_' . $booked_invoice_id . '.pdf', $invoicePathFile); // Log the incident (new logs_o())->add('invoices', 'global', 1, $user->id, 'GET_INVOICE_PDF', 'Successfully retrieved invoice pdf'); @@ -123,7 +131,7 @@ class invoicesRoute unlink($invoicePathFile); // Return the download link $response->success( - ['message' => 'Invoice PDF retrieved', 'url' => $invoice_store->getInvoiceDownloadUrl($this->fromRequest('id'))] + ['message' => 'Invoice PDF retrieved', 'url' => $invoice_store->getInvoiceDownloadUrl($booked_invoice_id)] ); } else { // Log the incident