copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Add wash_id property and support for listing own orders

Browse Source 
Introduced a new `wash_id` property to the `orders_o` object and updated related order handling logic. Implemented functionality to restrict users to only list their own orders if they lack permissions to view all orders. Updated permissions and adjusted queries accordingly.
This commit is contained in:
Jepp9350
2025-05-22 10:27:09 +02:00
parent 543a02c8e6
commit b42c864bff
2 changed files with 27 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/ordersRoute.php
+24 -3
View File
@@ -24,17 +24,30 @@ class ordersRoute
$this->get('/orders', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('list_orders');
$restrict_only_own = false;
// Get the user object
$user = (new authentication())->get_user();
// Check if the request was successful
if ($user) {
// Check if the user has the permission to list their own orders
$can_list_own_orders = $this->hasPermission('list_own_orders');
$can_list_all_orders = $this->hasPermission('list_orders');
if (!$can_list_own_orders && !$can_list_all_orders) {
$response->error('You do not have permission to list orders, neither your own nor all orders', 403);
};
if ($can_list_own_orders && !$can_list_all_orders) {
$restrict_only_own = true;
}
// Log the incident
(new logs_o())->add('orders', 'global', 1, $user->id, 'LIST_ORDERS', 'Successfully listed orders');
// Create economic_module_orders object
$economic_module_orders = new economic_module_orders();
$orders = new orders_o();
$department_ids = $user->getGroup()->getDepartments();
if (!$restrict_only_own) {
$department_ids = $user->getGroup()->getDepartments();
} else {
$department_ids = [];
}
if (self::isParametersSet(['show_wash_subscription'])) {
// Check if the boolean is true
if (self::getParameter('show_wash_subscription') === 'true') {
@@ -77,6 +90,9 @@ class ordersRoute
[
// This makes sure that the user can only see orders from the departments they explicitly have access to
'department_id' => $department_ids,
...($restrict_only_own ? [
'customer_id' => $user->customer_number->value(),
] : []),
]
)
)
@@ -89,7 +105,8 @@ class ordersRoute
}
},
[
'list_orders' => 'List all orders'
'list_orders' => 'List all orders',
'list_own_orders' => 'List own orders',
]
);
@@ -186,6 +203,10 @@ class ordersRoute
if (isset($data['invoice_collection_id'])) {
$order->invoice_collection_id->set((int)$data['invoice_collection_id']);
}
// Check if the wash_id is set
if (isset($data['wash_id'])) {
$order->wash_id->set($data['wash_id']);
}
// If the department ID is set, validate it
// Log the incident
(new logs_o())->add('orders', $order->department_id->value(), 1, $user->id, 'EDIT_ORDER', 'Successfully updated an order (ID: ' . $data['id'] . ')');