Refactor attachment permissions in ordersRoute

- Introduced separate permissions for listing all order attachments and own order attachments.
- Added conditional logic to verify ownership of orders for `list_own_order_attachments` permission.
- Improved error responses for unauthorized access to order attachments.

services/nginx/app/routes/ordersRoute.php

@@ -445,7 +445,6 @@ class ordersRoute
         $this->get('/orders/attachments', function () {
             // Require the user to be logged in
             global $response;
-            $this->requirePermission('list_order_attachments');
             // Get the user object
             $user = (new authentication())->get_user();
             // Check if the request was successful
@@ -464,6 +463,25 @@ class ordersRoute
                 if (!$order->exists()) {
                     $response->error('Order not found', 400);
                 }
+                /**
+                 * Permissions
+                 */
+                $hasPermissionOwn = self::hasPermission('list_own_order_attachments');
+                $hasPermissionAll = self::hasPermission('list_order_attachments');
+                $hasPermission = false;
+                if ($hasPermissionOwn || !$hasPermissionAll) {
+                    // Check if the order belongs to the user
+                    if ($order->isOwnOrder($user->customer_number->value())) {
+                        $hasPermission = true;
+                        self::requirePermission('list_own_order_attachments');
+                    }
+                } else {
+                    $hasPermission = true;
+                    self::requirePermission('list_order_attachments');
+                }
+                if (!$hasPermission) {
+                    $response->error('You do not have permission to list attachments for this order', 403);
+                }
                 // Get the attachments
                 $attachments = $order->listAttachments();
                 // Log the incident
@@ -478,7 +496,8 @@ class ordersRoute
             }
         },
             [
-                'list_order_attachments' => 'List attachments for an order'
+                'list_order_attachments' => 'List attachments for an order',
+                'list_own_order_attachments' => 'List attachments for an order (Only for own orders)'
             ]
         );