From 9c9df0f1f4a4cc799b3c9bc20d8136df3c03d2d2 Mon Sep 17 00:00:00 2001
From: Jeppe Bundgaard <jb@truckwash.dk>
Date: Wed, 10 Dec 2025 14:22:37 +0100
Subject: [PATCH] Validate access and booking status for retrieving invoice
 PDFs

- Added validation to ensure the user owns the invoice and it has been booked before generating the PDF.
- Updated logic to retrieve and store booked invoice PDFs using the correct `booked_invoice_id`.
- Improved error handling for unauthorized access and unbooked invoices.
---
 services/nginx/app/routes/invoicesRoute.php | 22 ++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/services/nginx/app/routes/invoicesRoute.php b/services/nginx/app/routes/invoicesRoute.php
index 584164ae..6bdf022f 100644
--- a/services/nginx/app/routes/invoicesRoute.php
+++ b/services/nginx/app/routes/invoicesRoute.php
@@ -5,6 +5,7 @@ namespace routes;
 use classes\authentication;
 use classes\economic;
 use classes\invoice_store;
+use objects\collected_order_invoices_o;
 use objects\economic_module_orders;
 use objects\logs_o;
 use objects\orders_o;
@@ -104,18 +105,25 @@ class invoicesRoute
                 if (!$this->fromRequest('id')) {
                     $response->error('id parameter is required', 400);
                 }
-                $order_id = (new orders_o())->getOrderByInvoiceId($this->fromRequest('id'))->id;
-                // Check if the user has permission to view the invoice
-                if (!$user->hasAccessToOrder($order_id)) {
-                    $response->error('User does not have access to this invoice', 403);
+                // Get the collected order invoice object
+                $collected_order_invoice = (new collected_order_invoices_o())->select((int)$this->fromRequest('id'));
+                // Make sure the user owns the invoice
+                if ((int)$collected_order_invoice->customer_number->value() !== (int)$user->customer_number->value()) {
+                    $response->error('You do not have permission to access this invoice', 403);
                 }
+                // Check if the invoice is booked
+                $is_booked = $collected_order_invoice->isBooked();
+                if (!$is_booked) {
+                    $response->error('Invoice is not booked yet', 400);
+                }
+                $booked_invoice_id = (int)$collected_order_invoice->booked_invoice_id->value();
                 // Create economic object
                 $economic = new economic();
                 // Get the draft invoice
-                $invoicePathFile = $economic->invoices->pdf->get($this->fromRequest('id'));
+                $invoicePathFile = $economic->invoices->pdf->get($booked_invoice_id);
                 // Add the pdf to the invoice store
                 $invoice_store = new invoice_store();
-                $invoice_store->uploadFile('invoice_' . $this->fromRequest('id') . '.pdf', $invoicePathFile);
+                $invoice_store->uploadFile('invoice_' . $booked_invoice_id . '.pdf', $invoicePathFile);
 
                 // Log the incident
                 (new logs_o())->add('invoices', 'global', 1, $user->id, 'GET_INVOICE_PDF', 'Successfully retrieved invoice pdf');
@@ -123,7 +131,7 @@ class invoicesRoute
                 unlink($invoicePathFile);
                 // Return the download link
                 $response->success(
-                    ['message' => 'Invoice PDF retrieved', 'url' => $invoice_store->getInvoiceDownloadUrl($this->fromRequest('id'))]
+                    ['message' => 'Invoice PDF retrieved', 'url' => $invoice_store->getInvoiceDownloadUrl($booked_invoice_id)]
                 );
             } else {
                 // Log the incident