From bf8262b64f4322db6617ab550c9a11b464e8d151 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 22:51:09 +0200
Subject: [PATCH] Validate invoice collection ownership when updating orders

---
 services/nginx/app/routes/ordersRoute.php | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/services/nginx/app/routes/ordersRoute.php b/services/nginx/app/routes/ordersRoute.php
index a05a6a97..02b3d2db 100644
--- a/services/nginx/app/routes/ordersRoute.php
+++ b/services/nginx/app/routes/ordersRoute.php
@@ -942,6 +942,9 @@ class ordersRoute
                 }
                 $order->customer_id->set((int)$data['customer_id']);
             }
+            $targetCustomerNumber = isset($data['customer_id'])
+                ? (int)$data['customer_id']
+                : (int)$order->customer_id->value();
             // If the reference is set, validate it
             if (isset($data['reference'])) {
                 $order->reference->set($data['reference']);
@@ -983,7 +986,17 @@ class ordersRoute
             }
             // Check if the invoice collection is set
             if (isset($data['invoice_collection_id'])) {
-                $order->invoice_collection_id->set((int)$data['invoice_collection_id']);
+                $invoiceCollectionId = (int)$data['invoice_collection_id'];
+                if ($invoiceCollectionId > 0) {
+                    $invoiceCollection = (new collected_order_invoices_o())->select($invoiceCollectionId);
+                    if (!$invoiceCollection->exists()) {
+                        $response->error('Invoice collection not found', 400);
+                    }
+                    if ((int)$invoiceCollection->customer_number->value() !== $targetCustomerNumber) {
+                        $response->error('Invoice collection does not belong to the order customer', 400);
+                    }
+                }
+                $order->invoice_collection_id->set($invoiceCollectionId);
             }
             // Check if the wash_id is set
             if (isset($data['wash_id'])) {
@@ -1038,4 +1051,4 @@ class ordersRoute
         // Optional fields are not checked here, as they are optional and can be empty
         return $data;
     }
-}
\ No newline at end of file
+}