From b42c864bff93f38f198b9b783399764a24a08ab3 Mon Sep 17 00:00:00 2001
From: Jepp9350 <2jepp9350@gmail.com>
Date: Thu, 22 May 2025 10:27:09 +0200
Subject: [PATCH] Add `wash_id` property and support for listing own orders

Introduced a new `wash_id` property to the `orders_o` object and updated related order handling logic. Implemented functionality to restrict users to only list their own orders if they lack permissions to view all orders. Updated permissions and adjusted queries accordingly.
---
 services/nginx/app/objects/orders_o.php   |  3 +++
 services/nginx/app/routes/ordersRoute.php | 27 ++++++++++++++++++++---
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/services/nginx/app/objects/orders_o.php b/services/nginx/app/objects/orders_o.php
index 7e8671ef..2a32bbc9 100644
--- a/services/nginx/app/objects/orders_o.php
+++ b/services/nginx/app/objects/orders_o.php
@@ -29,6 +29,7 @@ class orders_o extends db
     public stripe_module_orders_o $stripe_module_orders;
     public object_property $invoice_collection_id;
     public object_property $booking_id;
+    public object_property $wash_id; // The XL Vask Wash ID, if any
 
     public function structure(): void
     {
@@ -71,6 +72,7 @@ class orders_o extends db
         $this->deleted_at = new object_property($this->table, $this->id, 'deleted_at', 'timestamp', false);
         $this->invoice_collection_id = new object_property($this->table, $this->id, 'invoice_collection_id', 'int', false);
         $this->booking_id = new object_property($this->table, $this->id, 'booking_id', 'int', false);
+        $this->wash_id = new object_property($this->table, $this->id, 'wash_id', 'string', false);
     }
 
     public function getCustomerByOrderId(?string $order_id): users_o
@@ -479,6 +481,7 @@ class orders_o extends db
             'total_net_amount' => $this->getNetAmount(),
             'invoice_collection_id' => (int)$this->invoice_collection_id->value(),
             'booking_id' => (int)$this->booking_id->value(),
+            'wash_id' => $this->wash_id->value(),
             'closed_at' => (int)$this->invoice_collection_id->value() ? (new collected_order_invoices_o())->select((int)$this->invoice_collection_id->value())->closed_at->value() : null,
         ];
     }
diff --git a/services/nginx/app/routes/ordersRoute.php b/services/nginx/app/routes/ordersRoute.php
index 7997e394..4c735d10 100644
--- a/services/nginx/app/routes/ordersRoute.php
+++ b/services/nginx/app/routes/ordersRoute.php
@@ -24,17 +24,30 @@ class ordersRoute
         $this->get('/orders', function () {
             // Require the user to be logged in
             global $response;
-            $this->requirePermission('list_orders');
+            $restrict_only_own = false;
             // Get the user object
             $user = (new authentication())->get_user();
             // Check if the request was successful
             if ($user) {
+                // Check if the user has the permission to list their own orders
+                $can_list_own_orders = $this->hasPermission('list_own_orders');
+                $can_list_all_orders = $this->hasPermission('list_orders');
+                if (!$can_list_own_orders && !$can_list_all_orders) {
+                    $response->error('You do not have permission to list orders, neither your own nor all orders', 403);
+                };
+                if ($can_list_own_orders && !$can_list_all_orders) {
+                    $restrict_only_own = true;
+                }
                 // Log the incident
                 (new logs_o())->add('orders', 'global', 1, $user->id, 'LIST_ORDERS', 'Successfully listed orders');
                 // Create economic_module_orders object
                 $economic_module_orders = new economic_module_orders();
                 $orders = new orders_o();
-                $department_ids = $user->getGroup()->getDepartments();
+                if (!$restrict_only_own) {
+                    $department_ids = $user->getGroup()->getDepartments();
+                } else {
+                    $department_ids = [];
+                }
                 if (self::isParametersSet(['show_wash_subscription'])) {
                     // Check if the boolean is true
                     if (self::getParameter('show_wash_subscription') === 'true') {
@@ -77,6 +90,9 @@ class ordersRoute
                             [
                                 // This makes sure that the user can only see orders from the departments they explicitly have access to
                                 'department_id' => $department_ids,
+                                ...($restrict_only_own ? [
+                                    'customer_id' => $user->customer_number->value(),
+                                ] : []),
                             ]
                         )
                     )
@@ -89,7 +105,8 @@ class ordersRoute
             }
         },
             [
-                'list_orders' => 'List all orders'
+                'list_orders' => 'List all orders',
+                'list_own_orders' => 'List own orders',
             ]
         );
 
@@ -186,6 +203,10 @@ class ordersRoute
                 if (isset($data['invoice_collection_id'])) {
                     $order->invoice_collection_id->set((int)$data['invoice_collection_id']);
                 }
+                // Check if the wash_id is set
+                if (isset($data['wash_id'])) {
+                    $order->wash_id->set($data['wash_id']);
+                }
                 // If the department ID is set, validate it
                 // Log the incident
                 (new logs_o())->add('orders', $order->department_id->value(), 1, $user->id, 'EDIT_ORDER', 'Successfully updated an order (ID: ' . $data['id'] . ')');