Refactor order update logic into updateOrder method
- Moved redundant order update logic to a centralized `updateOrder` method for better code reuse. - Simplified route definitions in `ordersRoute` by delegating updates to the new `updateOrder` method. - Added `NoReturn` attribute for improved type hinting and error handling.
This commit is contained in:
Jeppe Bundgaard
@@ -8,6 +8,7 @@ use classes\attachments;
|
||||
use classes\authentication;
|
||||
use classes\response;
|
||||
use classes\stripe;
|
||||
use JetBrains\PhpStorm\NoReturn;
|
||||
use objects\collected_order_invoices_o;
|
||||
use objects\departments_o;
|
||||
use objects\economic_module_orders;
|
||||
@@ -207,129 +208,16 @@ class ordersRoute
|
||||
]
|
||||
);
|
||||
|
||||
$this->put('/order', function () {
|
||||
self::updateOrder();
|
||||
},
|
||||
[
|
||||
'edit_order' => 'Edit an order'
|
||||
]
|
||||
);
|
||||
|
||||
$this->put('/orders', function () {
|
||||
// Require the user to be logged in
|
||||
global $response;
|
||||
// Check if the user has permission to partially edit the order
|
||||
$isCustomerAccess = ((new authentication())->get_user()->hasPermission('user') && !((new authentication())->get_user()->hasPermission('edit_order')));
|
||||
if (!$isCustomerAccess) {
|
||||
$this->requirePermission('edit_order');
|
||||
} else {
|
||||
$this->requirePermission('user'); // This is used to allow the user to edit their own order
|
||||
}
|
||||
// Get the user object
|
||||
$user = (new authentication())->get_user();
|
||||
// Check if the request was successful
|
||||
if ($user) {
|
||||
// Get the post data
|
||||
$data = json_decode(file_get_contents('php://input'), true);
|
||||
// Check if the required fields are set
|
||||
if (!isset($data['id'])) {
|
||||
$response->error('ID is required', 400);
|
||||
}
|
||||
// Get the current order
|
||||
$order = (new orders_o())->getOrderById((int)$data['id']);
|
||||
// Check if the order exists
|
||||
if (!$order->exists()) {
|
||||
$response->error('Order not found', 400);
|
||||
}
|
||||
// Check if the user has customer edit access
|
||||
if ($isCustomerAccess) {
|
||||
if ($order->customer_id->value() !== $user->customer_number->value()) {
|
||||
$response->error('You do not have permission to edit this order', 400);
|
||||
}
|
||||
// Allowed to edit list
|
||||
$allowed_to_edit = [
|
||||
// Include the order ID (Even though it is not editable)
|
||||
'id',
|
||||
'po',
|
||||
];
|
||||
// Check if the $data contains any non-allowed keys
|
||||
foreach ($data as $key => $value) {
|
||||
if (!in_array($key, $allowed_to_edit)) {
|
||||
$response->error('You do not have permission to edit this order field (key: ' . $key . ')', 400);
|
||||
break;
|
||||
}
|
||||
};
|
||||
// PO
|
||||
if (isset($data['po'])) {
|
||||
$order->po->set((string)$data['po']);
|
||||
}
|
||||
$order->objectChanged();
|
||||
// Return a success message
|
||||
$response->success($order->asArray());
|
||||
}
|
||||
/** Departmental access */
|
||||
// If the customer ID is set, validate it
|
||||
if (isset($data['customer_id'])) {
|
||||
if (!(new users_o())->getCustomerByIdOrCustomerNumber((int)$data['customer_id'])->exists() || empty($data['customer_id'])) {
|
||||
$response->error('Customer not found or invalid', 400);
|
||||
}
|
||||
$order->customer_id->set((int)$data['customer_id']);
|
||||
}
|
||||
// If the reference is set, validate it
|
||||
if (isset($data['reference'])) {
|
||||
$order->reference->set($data['reference']);
|
||||
}
|
||||
// If the notes are set, validate them
|
||||
if (isset($data['notes'])) {
|
||||
$order->notes->set($data['notes']);
|
||||
}
|
||||
// If the registration number is set, validate it
|
||||
if (isset($data['reg_1'])) {
|
||||
$order->reg_1->set($data['reg_1']);
|
||||
}
|
||||
// If the registration number 2 is set, validate it
|
||||
if (isset($data['reg_2'])) {
|
||||
$order->reg_2->set($data['reg_2']);
|
||||
}
|
||||
// If the registration number 3 is set, validate it
|
||||
if (isset($data['reg_3'])) {
|
||||
$order->reg_3->set($data['reg_3']);
|
||||
}
|
||||
// If the PO is set, validate it
|
||||
if (isset($data['po'])) {
|
||||
$order->po->set((string)$data['po']);
|
||||
}
|
||||
// If the lane is set, validate it
|
||||
if (isset($data['lane'])) {
|
||||
$order->lane->set((int)$data['lane']);
|
||||
}
|
||||
// If the department ID is set, validate it
|
||||
if (isset($data['department_id'])) {
|
||||
if (!(new departments_o())->getDepartmentById((int)$data['department_id'])) {
|
||||
$response->error('Department not found', 400);
|
||||
}
|
||||
$order->department_id->set((int)$data['department_id']);
|
||||
}
|
||||
// If the booking ID is set, validate it
|
||||
if (isset($data['booking_id'])) {
|
||||
$order->booking_id->set((int)$data['booking_id']);
|
||||
}
|
||||
// Check if the invoice collection is set
|
||||
if (isset($data['invoice_collection_id'])) {
|
||||
$order->invoice_collection_id->set((int)$data['invoice_collection_id']);
|
||||
}
|
||||
// Check if the wash_id is set
|
||||
if (isset($data['wash_id'])) {
|
||||
$order->wash_id->set($data['wash_id']);
|
||||
}
|
||||
// Check if the created_at is set
|
||||
if (isset($data['created_at'])) {
|
||||
$order->created_at->set($data['created_at']);
|
||||
}
|
||||
// Void any cached key for the order
|
||||
$order->objectChanged();
|
||||
// Log the incident
|
||||
(new logs_o())->add('orders', $order->department_id->value(), 1, $user->id, 'EDIT_ORDER', 'Successfully updated an order (ID: ' . $data['id'] . ')');
|
||||
// Return a success message
|
||||
$response->success(['message' => 'Order updated successfully']);
|
||||
} else {
|
||||
// Log the incident
|
||||
(new logs_o())->add('orders', 'global', 1, 0, 'EDIT_ORDER', 'No user found, or invalid session');
|
||||
// Return an error
|
||||
$response->error('Invalid session', 400);
|
||||
}
|
||||
self::updateOrder();
|
||||
},
|
||||
[
|
||||
'edit_order' => 'Edit an order'
|
||||
@@ -356,6 +244,8 @@ class ordersRoute
|
||||
if (!$order->exists()) {
|
||||
$response->error('Order not found', 400);
|
||||
}
|
||||
// Check if the user has access to the department
|
||||
self::requireDepartmentAccess((int)$order->department_id->value());
|
||||
// Delete the order
|
||||
$order->delete();
|
||||
// Log the incident
|
||||
@@ -945,6 +835,154 @@ class ordersRoute
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @throws \Exception
|
||||
*/
|
||||
#[NoReturn] private function updateOrder(): void
|
||||
{
|
||||
// Require the user to be logged in
|
||||
global $response;
|
||||
// Check if the user has permission to partially edit the order
|
||||
$isCustomerAccess = ((new authentication())->get_user()->hasPermission('user') && !((new authentication())->get_user()->hasPermission('edit_order')));
|
||||
if (!$isCustomerAccess) {
|
||||
$this->requirePermission('edit_order');
|
||||
} else {
|
||||
$this->requirePermission('user'); // This is used to allow the user to edit their own order
|
||||
}
|
||||
// Get the user object
|
||||
$user = (new authentication())->get_user();
|
||||
// Check if the request was successful
|
||||
if ($user) {
|
||||
// Get the post data
|
||||
$data = json_decode(file_get_contents('php://input'), true);
|
||||
// Check if the required fields are set
|
||||
if (!isset($data['id'])) {
|
||||
$response->error('ID is required', 400);
|
||||
}
|
||||
// Get the current order
|
||||
$order = (new orders_o())->getOrderById((int)$data['id']);
|
||||
// Check if the order exists
|
||||
if (!$order->exists()) {
|
||||
$response->error('Order not found', 400);
|
||||
}
|
||||
// Check if the user has customer edit access
|
||||
if ($isCustomerAccess) {
|
||||
if ($order->customer_id->value() !== $user->customer_number->value()) {
|
||||
$response->error('You do not have permission to edit this order', 400);
|
||||
}
|
||||
// Allowed to edit list
|
||||
$allowed_to_edit = [
|
||||
// Include the order ID (Even though it is not editable)
|
||||
'id',
|
||||
'po',
|
||||
];
|
||||
// Check if the $data contains any non-allowed keys
|
||||
foreach ( $data as $key => $value ) {
|
||||
if (!in_array($key, $allowed_to_edit)) {
|
||||
$response->error('You do not have permission to edit this order field (key: ' . $key . ')', 400);
|
||||
break;
|
||||
}
|
||||
};
|
||||
// PO
|
||||
if (isset($data['po'])) {
|
||||
$order->po->set((string)$data['po']);
|
||||
}
|
||||
// Registration numbers
|
||||
if (isset($data['reg_1'])) {
|
||||
$order->reg_1->set((string)$data['reg_1']);
|
||||
}
|
||||
if (isset($data['reg_2'])) {
|
||||
$order->reg_2->set((string)$data['reg_2']);
|
||||
}
|
||||
if (isset($data['reg_3'])) {
|
||||
$order->reg_3->set((string)$data['reg_3']);
|
||||
}
|
||||
// Reference
|
||||
if (isset($data['reference'])) {
|
||||
$order->reference->set((string)$data['reference']);
|
||||
}
|
||||
// Notes
|
||||
if (isset($data['notes'])) {
|
||||
$order->notes->set((string)$data['notes']);
|
||||
}
|
||||
// Register the change
|
||||
$order->objectChanged();
|
||||
// Return a success message
|
||||
$response->success($order->asArray());
|
||||
}
|
||||
/** Departmental access */
|
||||
// If the customer ID is set, validate it
|
||||
if (isset($data['customer_id'])) {
|
||||
if (!(new users_o())->getCustomerByIdOrCustomerNumber((int)$data['customer_id'])->exists() || empty($data['customer_id'])) {
|
||||
$response->error('Customer not found or invalid', 400);
|
||||
}
|
||||
$order->customer_id->set((int)$data['customer_id']);
|
||||
}
|
||||
// If the reference is set, validate it
|
||||
if (isset($data['reference'])) {
|
||||
$order->reference->set($data['reference']);
|
||||
}
|
||||
// If the notes are set, validate them
|
||||
if (isset($data['notes'])) {
|
||||
$order->notes->set($data['notes']);
|
||||
}
|
||||
// If the registration number is set, validate it
|
||||
if (isset($data['reg_1'])) {
|
||||
$order->reg_1->set($data['reg_1']);
|
||||
}
|
||||
// If the registration number 2 is set, validate it
|
||||
if (isset($data['reg_2'])) {
|
||||
$order->reg_2->set($data['reg_2']);
|
||||
}
|
||||
// If the registration number 3 is set, validate it
|
||||
if (isset($data['reg_3'])) {
|
||||
$order->reg_3->set($data['reg_3']);
|
||||
}
|
||||
// If the PO is set, validate it
|
||||
if (isset($data['po'])) {
|
||||
$order->po->set((string)$data['po']);
|
||||
}
|
||||
// If the lane is set, validate it
|
||||
if (isset($data['lane'])) {
|
||||
$order->lane->set((int)$data['lane']);
|
||||
}
|
||||
// If the department ID is set, validate it
|
||||
if (isset($data['department_id'])) {
|
||||
if (!(new departments_o())->getDepartmentById((int)$data['department_id'])) {
|
||||
$response->error('Department not found', 400);
|
||||
}
|
||||
$order->department_id->set((int)$data['department_id']);
|
||||
}
|
||||
// If the booking ID is set, validate it
|
||||
if (isset($data['booking_id'])) {
|
||||
$order->booking_id->set((int)$data['booking_id']);
|
||||
}
|
||||
// Check if the invoice collection is set
|
||||
if (isset($data['invoice_collection_id'])) {
|
||||
$order->invoice_collection_id->set((int)$data['invoice_collection_id']);
|
||||
}
|
||||
// Check if the wash_id is set
|
||||
if (isset($data['wash_id'])) {
|
||||
$order->wash_id->set($data['wash_id']);
|
||||
}
|
||||
// Check if the created_at is set
|
||||
if (isset($data['created_at'])) {
|
||||
$order->created_at->set($data['created_at']);
|
||||
}
|
||||
// Void any cached key for the order
|
||||
$order->objectChanged();
|
||||
// Log the incident
|
||||
(new logs_o())->add('orders', $order->department_id->value(), 1, $user->id, 'EDIT_ORDER', 'Successfully updated an order (ID: ' . $data['id'] . ')');
|
||||
// Return a success message
|
||||
$response->success(['message' => 'Order updated successfully']);
|
||||
} else {
|
||||
// Log the incident
|
||||
(new logs_o())->add('orders', 'global', 1, 0, 'EDIT_ORDER', 'No user found, or invalid session');
|
||||
// Return an error
|
||||
$response->error('Invalid session', 400);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @param mixed $data
|
||||
* @param response $response
|
||||
|
||||
Reference in New Issue
Block a user