From d58f61f80d069d2f0e4fdaecaf0cf91e1a575c9b Mon Sep 17 00:00:00 2001
From: Jeppe Bundgaard <jb@truckwash.dk>
Date: Tue, 11 Nov 2025 11:22:23 +0100
Subject: [PATCH] Refactor attachment permissions in `ordersRoute`

- Introduced separate permissions for listing all order attachments and own order attachments.
- Added conditional logic to verify ownership of orders for `list_own_order_attachments` permission.
- Improved error responses for unauthorized access to order attachments.
---
 services/nginx/app/routes/ordersRoute.php | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/services/nginx/app/routes/ordersRoute.php b/services/nginx/app/routes/ordersRoute.php
index 7222ba8a..0e7a3912 100644
--- a/services/nginx/app/routes/ordersRoute.php
+++ b/services/nginx/app/routes/ordersRoute.php
@@ -445,7 +445,6 @@ class ordersRoute
         $this->get('/orders/attachments', function () {
             // Require the user to be logged in
             global $response;
-            $this->requirePermission('list_order_attachments');
             // Get the user object
             $user = (new authentication())->get_user();
             // Check if the request was successful
@@ -464,6 +463,25 @@ class ordersRoute
                 if (!$order->exists()) {
                     $response->error('Order not found', 400);
                 }
+                /**
+                 * Permissions
+                 */
+                $hasPermissionOwn = self::hasPermission('list_own_order_attachments');
+                $hasPermissionAll = self::hasPermission('list_order_attachments');
+                $hasPermission = false;
+                if ($hasPermissionOwn || !$hasPermissionAll) {
+                    // Check if the order belongs to the user
+                    if ($order->isOwnOrder($user->customer_number->value())) {
+                        $hasPermission = true;
+                        self::requirePermission('list_own_order_attachments');
+                    }
+                } else {
+                    $hasPermission = true;
+                    self::requirePermission('list_order_attachments');
+                }
+                if (!$hasPermission) {
+                    $response->error('You do not have permission to list attachments for this order', 403);
+                }
                 // Get the attachments
                 $attachments = $order->listAttachments();
                 // Log the incident
@@ -478,7 +496,8 @@ class ordersRoute
             }
         },
             [
-                'list_order_attachments' => 'List attachments for an order'
+                'list_order_attachments' => 'List attachments for an order',
+                'list_own_order_attachments' => 'List attachments for an order (Only for own orders)'
             ]
         );