Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.
## Summary
- Makes Stripe Terminal card payment intents always use 25% moms in the
API, independent of any client-supplied `tax_percentage`.
- Updates amount calculation, metadata persistence, stored-intent reuse
matching, the authoritative OpenAPI contracts, and operation-specific
Writerside outputs.
- Prevents double charging and false order closure across stale,
concurrently succeeded, partially recorded, or mismatched intents.
- Serializes payment create/capture/closure with order-item changes and
every order-to-invoice-collection reassignment through shared database
locks.
- Converts expected lock contention and reconciliation cases into
deliberate 409 responses.
## Exact-head evidence
Current head: `3a0f70d315a94d2efe586a2188d2c54f8ff11cd4`
- PHP syntax passed for all changed runtime files.
- Focused Orders suite: **42 tests / 293 assertions passed**.
- `git diff --check` passed.
- Fresh exact-head Tests and Qodana are running.
- Every Codex finding has a concrete reply; a fresh exact-head review is
requested below.
## Safety behavior
- Caller-controlled VAT is absent from request contracts; fixed 25% moms
is server-owned.
- A succeeded payment is preserved, requires the full expected
`amount_received`, and cannot close a changed/mismatched or
already-claimed collection.
- A compatible partially recorded Stripe closure is completed
idempotently; conflicting partial state fails closed for manual
reconciliation.
- Every cancellation/delete caller honors a concurrent-success result
and never falsely reports a completed payment as cleared.
- Price changes and invoice-collection reassignment share the payment
lock through validation, capture, post-capture reload, and closure.
- Reader changes are persisted only for reusable matching intents, so
stale intent cancellation targets the original terminal.
- Accepted legacy succeeded intents normalize stored tax to 25% before
response construction.
---------
Co-authored-by: Jeppe Bundgaard <jb@truckwash.dk>
- Implemented `InvoicingPeriodPaginationTest` for testing period pagination modes, normalization of options, search functionality, and visibility filters.
- Added comprehensive tests to validate scenarios such as active period views, exact counts, and customer-card level search.
- Improved cURL timeout settings with `CURLOPT_CONNECTTIMEOUT` and `CURLOPT_TIMEOUT` adjustments.
- Introduced and documented helper classes/methods for local caching, pagination response structure, and customer name retrieval.
- Add branding management feature: API routes, payload handling, and OpenAPI schema updates.
- Implement department branding logic: CRUD operations, validation, and permissions.
- Add order deletion confirmation support with conflict handling and OpenAPI schema updates.
- Enhance tests and API methods for improved order handling and branding workflows.
Transitioned from obsolete gateway object classes (`edge_gateway_shell_action_jobs_o`, `edge_gateway_shell_events_o`, `edge_gateway_shell_sessions_o`, `edge_gateway_update_jobs_o`) to the new agent implementation (`edge-gateway-agent/agent.php`).
- Introduced `safety_seal` column in the `orders` table.
- Updated order creation and completion logic to handle safety seal values.
- Enhanced order and booking classes to manage safety seal attachment and retrieval.
- Added tests to validate safety seal functionality in order processing.
- Introduce filtering by time range and optional department ID.
- Validate inputs and ensure robust exception handling for invalid ranges.
- Optimize SQL queries for performance with joins and distinct order retrieval.
- Introduce `getOrderItemObjects` in `orders_o` to retrieve item objects for an order.
- Add `getProduct` in `order_items_o` for product retrieval by item.
- Enhance Slack notification logic in invoicing routes for better error reporting and fixed pricing summaries.
- Temporarily comment out permission checks in certain invoicing endpoints for debugging purposes.
- Added `generateWashCertificate` method to `orders_o` for wash certificate PDF generation and attachment.
- Introduced `OTHER_TYPE_WASH_CERTIFICATE` constant in `attachment_content` for new attachment type.
- Added `/order/wash-certificate` route to provide wash certificate generation functionality via API.
- Update cache expiration times for `economicCustomerName` and `isBooked` objects
- Introduce `getCachedForMultipleObjects` for batch cache retrieval
- Optimize `isBooked` with optional caching and update to store results
- Implement `getCustomerNames` in `users_o` with caching for bulk name retrieval
- Refactor customer transaction handling in `InvoicingPeriodRoute` for efficiency
- Filter orders excluded from invoicing in `collected_order_invoices_o`
- Introduced `isIncludedInInvoicing` in `orders_o` to check department-based invoicing exclusions.
- Updated routes and methods to skip orders excluded from invoicing.
- Refined transaction and order handling to respect invoicing settings, ensuring correct filtering.
- Added functionality to create and attach wash certificates during booking completion.
- Enhanced `completeBooking` to generate and associate wash certificates with orders based on booking items.
- Updated safety seal parameter handling in relevant methods.
- Integrated wash certificate PDF generation with customer branding and order attachment logic.
- Improved file retrieval logic in the `file_server` to handle missing certificates via alternative store lookup.
- Introduced `po` property in `orders_o` for handling Purchase Order (PO) numbers, including API integration for retrieval and validation.
- Enhanced customer permissions to allow limited order editing (`po` updates) and attachment downloads for their own orders.
- Added new helper methods to `users_o` for attributes like `showPricesOnBookingPage` and `usePONumbers`.
- Improved order item listing logic with distinct permissions for customers' own orders and price visibility.
- Implemented numeric value casting in filters within `db_object_t`.
- Simplified department retrieval in `economic_invoice_draft.php` by streamlining logic for default department usage.
- Enhanced `getDepartmentByOrderId` in `orders_o` to ensure correct department is fetched based on given `order_id`.
- Updated discount line logic to leverage appropriate department dimension values.
- Introduced new endpoints for invoicing distribution: `/superuser/invoicing/period/distribution/fixed-pricing` and `/superuser/invoicing/period/distribution/wash-subscriptions`.
- Enhanced `customer_vehicles_o` with `getSubscriptionAppliedTransactionsFromList` method for transaction filtering based on subscriptions.
- Added `getNetAmountForOrderItemsOriginal` to `orders_o` for calculating the original net amount of order items.
- Introduced parsing utilities for department-based aggregation in invoicing.
- Extended `products_o` with `getSubscriptionMonthlyPrice` to calculate subscription pricing.
- Added `getFieldsWhereIn` to `db_object_t` for advanced database querying.
- Introduced `is_handheld` field in order creation to identify orders from handheld devices.
- Added logic to set, cache, and expire pending handheld orders automatically at midnight.
- Enhanced `orders_o` class with `setPendingHandheldIndicator` and `isPendingHandheld` methods.
- Updated order processing flow to include `pending_handheld` indicator in responses.
- Enhanced `orderInvoicesRoute` with `reset`, `unlink`, and `remove-special-arrangements` handlers for invoice actions, improving E-Conomic integration.
- Added `resetPricesOfItemsNotIncludedInInvoice`, `setAllItemsToBeIncludedInInvoice`, and `unlinkFromEconomic` methods in `collected_order_invoices_o` for robust invoice control.
- Introduced `getCustomerProductPrice` in `orders_o` to calculate customer-specific product pricing with discounts.
- Added `getCachedResultsBySubstring` in `motorapi_lookups_o` for efficient cached lookup based on result substrings.
- Updated `orders_o` to use `round` for consistent discounted price calculations.
- Refined `xlvask_parser_stor_bil` with MotorAPI-based vehicle type validation and added `checkMotorAPI` method.
- Optimized `motorapi_lookups_o` license plate validation to streamline database queries.
- Introduced `getProductDiscountPercentage` method to calculate accurate discounts for users across products, categories, and global settings.
- Adjusted `importUsageLogs` to refine date modifier parameter and enhance `usage log` checks.
- Enhanced `orders_o` to include product discount logic with stricter type casting for consistency.
- Added `updateFieldsWhere` method for selective database updates based on specific conditions.
- Updated `customers_o` to handle updates for existing customers while adding new ones.
- Improved null safety by updating product ID retrieval logic in parsers and usage logs.
- Enhanced primary wash item selection with stricter checks for valid product types.
- Adjusted import date modifier in `importUsageLogs` for extended range (`-7 day`).
- Streamlined product and user association in order creation with additional validations.
- Removed redundant checks and refined permission handling in import tasks.
- Introduced `addArray` method in `orders_o` for streamlined order creation using an associative array.
- Updated `ordersRoute` to utilize `addArray`, replacing older implementation for better manageability.
- Improved input handling by trimming whitespaces from registration numbers.
- Enhanced product pricing by incorporating department-specific prices and discount percentages.
- Introduced `runImportTasks` method for vehicle, user, and usage log imports.
- Added new product parsers: `ht_b_rstel_s`, `ht_turbo`, and `ikke_b_rster_p_kabinen`.
- Implemented simulation and duplicate detection for usage logs via order objects.
- Updated usage log handling to include default customer checks and user association.
- Enhanced request handling with fast-link functionality for usage orders.
Jeppe B