diff --git a/services/nginx/app/routes/orderItemsRoute.php b/services/nginx/app/routes/orderItemsRoute.php index ca1baa3e..6dc7d174 100644 --- a/services/nginx/app/routes/orderItemsRoute.php +++ b/services/nginx/app/routes/orderItemsRoute.php @@ -191,8 +191,8 @@ class orderItemsRoute $itemId = (int)$data['id']; $stmt = $db->prepare('SELECT oi.order_id FROM order_items oi WHERE oi.id = ? LIMIT 1'); if ($stmt === false) { - (new logs_o())->add('order_items', 'global', 1, 0, 'DELETE_ORDER_ITEMS', 'Failed to prepare department access check query'); - $response->error('Failed to validate department access', 500); + (new logs_o())->add('order_items', 'global', 1, 0, 'DELETE_ORDER_ITEMS', 'Database error while preparing department access check query'); + $response->error('Database error while checking department access', 500); } $stmt->bind_param('i', $itemId); $stmt->execute(); @@ -200,9 +200,10 @@ class orderItemsRoute $stmt->close(); if ($orderItemRow !== null) { $orderForAccess = (new orders_o())->getOrderById((int)$orderItemRow['order_id']); - if ($orderForAccess->exists()) { - self::requireDepartmentAccess((string)(int)$orderForAccess->department_id->value()); + if (!$orderForAccess->exists()) { + $response->error('Order not found', 404); } + self::requireDepartmentAccess((string)(int)$orderForAccess->department_id->value()); } // Delete the order item (new order_items_o())->removeOrderItem((int)$data['id']);