Add support for related item ID in order items

Enhanced the order items functionality to include a related item ID. This involved adding a new property, updating methods to handle the related item ID, and ensuring appropriate validation and sanitation in the API routes. Also improved input sanitization for motorapi lookups to prevent SQL injection risks.

services/nginx/app/objects/motorapi_lookups_o.php

@@ -32,6 +32,13 @@ class motorapi_lookups_o extends db
      */
     public function add(string $license_plate, string $result, string $endpoint): void
     {
+        global /** @var db $db */
+        $db;
+        // Sanitize the input
+        $license_plate = $db->escape_string($license_plate);
+        $result = $db->escape_string($result);
+        $endpoint = $db->escape_string($endpoint);
+        // Add the object
         $tmp_id = self::add_object([
             'license_plate' => $license_plate,
             'result' => $result,

services/nginx/app/objects/order_items_o.php

@@ -45,6 +45,11 @@ class order_items_o extends db
      * @var object_property
      */
     public object_property $quantity;
+    /**
+     * The id of the related item, if it exists
+     * @var object_property
+     */
+    public object_property $related_item_id;
 
     public function structure(): void
     {
@@ -78,6 +83,7 @@ class order_items_o extends db
         $this->cashier_id = new object_property($this->table, $this->id, 'cashier_id', 'int', true);
         $this->price = new object_property($this->table, $this->id, 'price', 'int', true);
         $this->quantity = new object_property($this->table, $this->id, 'quantity', 'int', true);
+        $this->related_item_id = new object_property($this->table, $this->id, 'related_item_id', 'int', false);
     }
 
     public function add(int $order_id, int $product_id, string $reference, string $notes, int $cashier_id, int $price, int $quantity): void
@@ -120,7 +126,7 @@ class order_items_o extends db
         }
     }
 
-    public function addItemToOrder(int $order_id, int $product_id, int $cashier_id, int $quantity): void
+    public function addItemToOrder(int $order_id, int $product_id, int $cashier_id, int $quantity, $related_item_id = null): void
     {
         global $db, $response;
         try {
@@ -143,6 +149,11 @@ class order_items_o extends db
             $this->id = $db->insert_id();
             // Set the values of the object properties
             $this->getObjectProperties();
+            // Set the related item id, if it is set
+            if ($related_item_id) {
+                $this->related_item_id->set($related_item_id);
+            }
+
         } catch (\Exception $e) {
             $response->error($e->getMessage());
         }
@@ -154,7 +165,7 @@ class order_items_o extends db
         // TODO: Implement delete() method instead
         global $db;
         $this->id = $id;
-        $sql = "DELETE FROM $this->table WHERE id = $this->id";
+        $sql = "DELETE FROM $this->table WHERE id = $this->id or related_item_id = $this->id";
         $db->query($sql);
     }
 
@@ -169,6 +180,7 @@ class order_items_o extends db
             'cashier_id' => (int)$this->cashier_id->value(),
             'price' => (int)$this->price->value(),
             'quantity' => (int)$this->quantity->value(),
+            'related_item_id' => (int)$this->related_item_id->value(),
             'product' => (array)(new products_o())->getProductById($this->product_id->value())->asArray(),
             'cashier' => (array)(new users_o())->getUserById($this->cashier_id->value())->asArray()
         ];

services/nginx/app/routes/orderItemsRoute.php

@@ -33,12 +33,26 @@ class orderItemsRoute
                 if (!isset($data['quantity'])) {
                     $response->error('Quantity is required', 400);
                 }
+                $related_item_id = null;
+                // Check if the related_item_id is set
+                if (self::isParametersSet(['related_item_id'])) {
+                    // Check if the related_item_id is null, if so continue
+                    if ($data['related_item_id'] !== null) {
+                        // Check if the related_item_id is a number
+                        if (!is_numeric($data['related_item_id'])) {
+                            $response->error('Related item ID must be a number', 400);
+                        }
+                        $related_item_id = (int)$data['related_item_id'];
+                    }
+                }
 
                 // Add the order item to the order This is done individually, to make the notes to the individual order items possible
-                (new order_items_o())->addItemToOrder((int)$data['order_id'], (int)$data['product_id'], (int)$user->id, (int)$data['quantity']);
+                $order_items = (new order_items_o());
+                // Add the order item to the order
+                $order_items->addItemToOrder((int)$data['order_id'], (int)$data['product_id'], (int)$user->id, (int)$data['quantity'], $related_item_id);
                 // Return the list of departments
                 $response->success(
-                    ['message' => 'Order items added']
+                    $order_items->getItemAsArray()
                 );
             } else {
                 // Log the incident