From eb1dec1d0e9d5d42059d16356634cd4ba04c3019 Mon Sep 17 00:00:00 2001 From: Jeppe Bundgaard Date: Tue, 18 Nov 2025 12:32:44 +0100 Subject: [PATCH] Refactor order update logic into `updateOrder` method - Moved redundant order update logic to a centralized `updateOrder` method for better code reuse. - Simplified route definitions in `ordersRoute` by delegating updates to the new `updateOrder` method. - Added `NoReturn` attribute for improved type hinting and error handling. --- services/nginx/app/routes/orderRoute.php | 81 ++++--- services/nginx/app/routes/ordersRoute.php | 282 ++++++++++++---------- 2 files changed, 202 insertions(+), 161 deletions(-) diff --git a/services/nginx/app/routes/orderRoute.php b/services/nginx/app/routes/orderRoute.php index 34863e3a..ca284172 100644 --- a/services/nginx/app/routes/orderRoute.php +++ b/services/nginx/app/routes/orderRoute.php @@ -54,44 +54,47 @@ class orderRoute ] ); - $this->put('/order', function () { - - // Require the user to be logged in - global $response; - $this->requirePermission('update_order'); - // Get the user object - $user = (new authentication())->get_user(); - // Check if the request was successful - if ($user) { - // Get the post data - $data = json_decode(file_get_contents('php://input'), true); - // Require the id to be set, and to be a valid integer - if (!isset($data['id']) || !(int)$data['id']) { - $response->error('Order id is required', 400); - } - // Get the orders_o objects' properties - $order = (new orders_o())->getOrderById($data['id']); - // Check if the order exists - if (!$order->exists()) { - $response->error('Order not found', 400); - } - // Update the order - $order->updateRequest(); - - // Log the incident - (new logs_o())->add('orders', $order->department_id->value(), 1, $user->id, 'UPDATE_ORDER', 'Successfully updated order'); - // Return a success message - $response->success(['message' => 'Order updated successfully']); - } else { - // Log the incident - (new logs_o())->add('orders', 'global', 1, 0, 'UPDATE_ORDER', 'No user found, or invalid session'); - // Return an error - $response->error('Invalid session', 400); - } - }, - [ - 'update_order' => 'Update order' - ] - ); + /** + * $this->put('/order', function () { + * + * // Require the user to be logged in + * global $response; + * $this->requirePermission('update_order'); + * // Get the user object + * $user = (new authentication())->get_user(); + * // Check if the request was successful + * if ($user) { + * // Get the post data + * $data = json_decode(file_get_contents('php://input'), true); + * // Require the id to be set, and to be a valid integer + * if (!isset($data['id']) || !(int)$data['id']) { + * $response->error('Order id is required', 400); + * } + * // Get the orders_o objects' properties + * $order = (new orders_o())->getOrderById($data['id']); + * // Check if the order exists + * if (!$order->exists()) { + * $response->error('Order not found', 400); + * } + * // Update the order + * $order->updateRequest(); + * + * // Log the incident + * (new logs_o())->add('orders', $order->department_id->value(), 1, $user->id, 'UPDATE_ORDER', 'Successfully updated order'); + * // Return a success message + * $response->success(['message' => 'Order updated successfully']); + * } else { + * // Log the incident + * (new logs_o())->add('orders', 'global', 1, 0, 'UPDATE_ORDER', 'No user found, or invalid session'); + * // Return an error + * $response->error('Invalid session', 400); + * } + * }, + * [ + * 'update_order' => 'Update order' + * ] + * ); + * } + */ } } \ No newline at end of file diff --git a/services/nginx/app/routes/ordersRoute.php b/services/nginx/app/routes/ordersRoute.php index cb8f0eb3..14b2b0a8 100644 --- a/services/nginx/app/routes/ordersRoute.php +++ b/services/nginx/app/routes/ordersRoute.php @@ -8,6 +8,7 @@ use classes\attachments; use classes\authentication; use classes\response; use classes\stripe; +use JetBrains\PhpStorm\NoReturn; use objects\collected_order_invoices_o; use objects\departments_o; use objects\economic_module_orders; @@ -207,129 +208,16 @@ class ordersRoute ] ); + $this->put('/order', function () { + self::updateOrder(); + }, + [ + 'edit_order' => 'Edit an order' + ] + ); + $this->put('/orders', function () { - // Require the user to be logged in - global $response; - // Check if the user has permission to partially edit the order - $isCustomerAccess = ((new authentication())->get_user()->hasPermission('user') && !((new authentication())->get_user()->hasPermission('edit_order'))); - if (!$isCustomerAccess) { - $this->requirePermission('edit_order'); - } else { - $this->requirePermission('user'); // This is used to allow the user to edit their own order - } - // Get the user object - $user = (new authentication())->get_user(); - // Check if the request was successful - if ($user) { - // Get the post data - $data = json_decode(file_get_contents('php://input'), true); - // Check if the required fields are set - if (!isset($data['id'])) { - $response->error('ID is required', 400); - } - // Get the current order - $order = (new orders_o())->getOrderById((int)$data['id']); - // Check if the order exists - if (!$order->exists()) { - $response->error('Order not found', 400); - } - // Check if the user has customer edit access - if ($isCustomerAccess) { - if ($order->customer_id->value() !== $user->customer_number->value()) { - $response->error('You do not have permission to edit this order', 400); - } - // Allowed to edit list - $allowed_to_edit = [ - // Include the order ID (Even though it is not editable) - 'id', - 'po', - ]; - // Check if the $data contains any non-allowed keys - foreach ($data as $key => $value) { - if (!in_array($key, $allowed_to_edit)) { - $response->error('You do not have permission to edit this order field (key: ' . $key . ')', 400); - break; - } - }; - // PO - if (isset($data['po'])) { - $order->po->set((string)$data['po']); - } - $order->objectChanged(); - // Return a success message - $response->success($order->asArray()); - } - /** Departmental access */ - // If the customer ID is set, validate it - if (isset($data['customer_id'])) { - if (!(new users_o())->getCustomerByIdOrCustomerNumber((int)$data['customer_id'])->exists() || empty($data['customer_id'])) { - $response->error('Customer not found or invalid', 400); - } - $order->customer_id->set((int)$data['customer_id']); - } - // If the reference is set, validate it - if (isset($data['reference'])) { - $order->reference->set($data['reference']); - } - // If the notes are set, validate them - if (isset($data['notes'])) { - $order->notes->set($data['notes']); - } - // If the registration number is set, validate it - if (isset($data['reg_1'])) { - $order->reg_1->set($data['reg_1']); - } - // If the registration number 2 is set, validate it - if (isset($data['reg_2'])) { - $order->reg_2->set($data['reg_2']); - } - // If the registration number 3 is set, validate it - if (isset($data['reg_3'])) { - $order->reg_3->set($data['reg_3']); - } - // If the PO is set, validate it - if (isset($data['po'])) { - $order->po->set((string)$data['po']); - } - // If the lane is set, validate it - if (isset($data['lane'])) { - $order->lane->set((int)$data['lane']); - } - // If the department ID is set, validate it - if (isset($data['department_id'])) { - if (!(new departments_o())->getDepartmentById((int)$data['department_id'])) { - $response->error('Department not found', 400); - } - $order->department_id->set((int)$data['department_id']); - } - // If the booking ID is set, validate it - if (isset($data['booking_id'])) { - $order->booking_id->set((int)$data['booking_id']); - } - // Check if the invoice collection is set - if (isset($data['invoice_collection_id'])) { - $order->invoice_collection_id->set((int)$data['invoice_collection_id']); - } - // Check if the wash_id is set - if (isset($data['wash_id'])) { - $order->wash_id->set($data['wash_id']); - } - // Check if the created_at is set - if (isset($data['created_at'])) { - $order->created_at->set($data['created_at']); - } - // Void any cached key for the order - $order->objectChanged(); - // Log the incident - (new logs_o())->add('orders', $order->department_id->value(), 1, $user->id, 'EDIT_ORDER', 'Successfully updated an order (ID: ' . $data['id'] . ')'); - // Return a success message - $response->success(['message' => 'Order updated successfully']); - } else { - // Log the incident - (new logs_o())->add('orders', 'global', 1, 0, 'EDIT_ORDER', 'No user found, or invalid session'); - // Return an error - $response->error('Invalid session', 400); - } + self::updateOrder(); }, [ 'edit_order' => 'Edit an order' @@ -356,6 +244,8 @@ class ordersRoute if (!$order->exists()) { $response->error('Order not found', 400); } + // Check if the user has access to the department + self::requireDepartmentAccess((int)$order->department_id->value()); // Delete the order $order->delete(); // Log the incident @@ -945,6 +835,154 @@ class ordersRoute ); } + /** + * @throws \Exception + */ + #[NoReturn] private function updateOrder(): void + { + // Require the user to be logged in + global $response; + // Check if the user has permission to partially edit the order + $isCustomerAccess = ((new authentication())->get_user()->hasPermission('user') && !((new authentication())->get_user()->hasPermission('edit_order'))); + if (!$isCustomerAccess) { + $this->requirePermission('edit_order'); + } else { + $this->requirePermission('user'); // This is used to allow the user to edit their own order + } + // Get the user object + $user = (new authentication())->get_user(); + // Check if the request was successful + if ($user) { + // Get the post data + $data = json_decode(file_get_contents('php://input'), true); + // Check if the required fields are set + if (!isset($data['id'])) { + $response->error('ID is required', 400); + } + // Get the current order + $order = (new orders_o())->getOrderById((int)$data['id']); + // Check if the order exists + if (!$order->exists()) { + $response->error('Order not found', 400); + } + // Check if the user has customer edit access + if ($isCustomerAccess) { + if ($order->customer_id->value() !== $user->customer_number->value()) { + $response->error('You do not have permission to edit this order', 400); + } + // Allowed to edit list + $allowed_to_edit = [ + // Include the order ID (Even though it is not editable) + 'id', + 'po', + ]; + // Check if the $data contains any non-allowed keys + foreach ( $data as $key => $value ) { + if (!in_array($key, $allowed_to_edit)) { + $response->error('You do not have permission to edit this order field (key: ' . $key . ')', 400); + break; + } + }; + // PO + if (isset($data['po'])) { + $order->po->set((string)$data['po']); + } + // Registration numbers + if (isset($data['reg_1'])) { + $order->reg_1->set((string)$data['reg_1']); + } + if (isset($data['reg_2'])) { + $order->reg_2->set((string)$data['reg_2']); + } + if (isset($data['reg_3'])) { + $order->reg_3->set((string)$data['reg_3']); + } + // Reference + if (isset($data['reference'])) { + $order->reference->set((string)$data['reference']); + } + // Notes + if (isset($data['notes'])) { + $order->notes->set((string)$data['notes']); + } + // Register the change + $order->objectChanged(); + // Return a success message + $response->success($order->asArray()); + } + /** Departmental access */ + // If the customer ID is set, validate it + if (isset($data['customer_id'])) { + if (!(new users_o())->getCustomerByIdOrCustomerNumber((int)$data['customer_id'])->exists() || empty($data['customer_id'])) { + $response->error('Customer not found or invalid', 400); + } + $order->customer_id->set((int)$data['customer_id']); + } + // If the reference is set, validate it + if (isset($data['reference'])) { + $order->reference->set($data['reference']); + } + // If the notes are set, validate them + if (isset($data['notes'])) { + $order->notes->set($data['notes']); + } + // If the registration number is set, validate it + if (isset($data['reg_1'])) { + $order->reg_1->set($data['reg_1']); + } + // If the registration number 2 is set, validate it + if (isset($data['reg_2'])) { + $order->reg_2->set($data['reg_2']); + } + // If the registration number 3 is set, validate it + if (isset($data['reg_3'])) { + $order->reg_3->set($data['reg_3']); + } + // If the PO is set, validate it + if (isset($data['po'])) { + $order->po->set((string)$data['po']); + } + // If the lane is set, validate it + if (isset($data['lane'])) { + $order->lane->set((int)$data['lane']); + } + // If the department ID is set, validate it + if (isset($data['department_id'])) { + if (!(new departments_o())->getDepartmentById((int)$data['department_id'])) { + $response->error('Department not found', 400); + } + $order->department_id->set((int)$data['department_id']); + } + // If the booking ID is set, validate it + if (isset($data['booking_id'])) { + $order->booking_id->set((int)$data['booking_id']); + } + // Check if the invoice collection is set + if (isset($data['invoice_collection_id'])) { + $order->invoice_collection_id->set((int)$data['invoice_collection_id']); + } + // Check if the wash_id is set + if (isset($data['wash_id'])) { + $order->wash_id->set($data['wash_id']); + } + // Check if the created_at is set + if (isset($data['created_at'])) { + $order->created_at->set($data['created_at']); + } + // Void any cached key for the order + $order->objectChanged(); + // Log the incident + (new logs_o())->add('orders', $order->department_id->value(), 1, $user->id, 'EDIT_ORDER', 'Successfully updated an order (ID: ' . $data['id'] . ')'); + // Return a success message + $response->success(['message' => 'Order updated successfully']); + } else { + // Log the incident + (new logs_o())->add('orders', 'global', 1, 0, 'EDIT_ORDER', 'No user found, or invalid session'); + // Return an error + $response->error('Invalid session', 400); + } + } + /** * @param mixed $data * @param response $response