Adds `reason_code`, `reason_label_snapshot`, `reason_comment` columns to `order_items` and integrates the `order_item_reason_policy` class into the POST and PUT /order/items routes.
Validation order on audited products (consistent across POST and PUT):
1. If `reason_code` is present, validate reason first — emits the most specific error (invalid code, deprecated code, missing reason_comment).
2. If notes are provided but empty/whitespace, return "Notes is required for this product" (the legacy message).
3. Otherwise run reason validation — covers the missing-reason_code case.
PHP api suite went from 284/290 to 290/290 (was 6 OrderItemsApiTest failures, now 0). Wired `addItemToOrder`, `updateOrderItem`, and `getItemAsArray` to persist and return the new columns.
## Summary
- Makes Stripe Terminal card payment intents always use 25% moms in the
API, independent of any client-supplied `tax_percentage`.
- Updates amount calculation, metadata persistence, stored-intent reuse
matching, the authoritative OpenAPI contracts, and operation-specific
Writerside outputs.
- Prevents double charging and false order closure across stale,
concurrently succeeded, partially recorded, or mismatched intents.
- Serializes payment create/capture/closure with order-item changes and
every order-to-invoice-collection reassignment through shared database
locks.
- Converts expected lock contention and reconciliation cases into
deliberate 409 responses.
## Exact-head evidence
Current head: `3a0f70d315a94d2efe586a2188d2c54f8ff11cd4`
- PHP syntax passed for all changed runtime files.
- Focused Orders suite: **42 tests / 293 assertions passed**.
- `git diff --check` passed.
- Fresh exact-head Tests and Qodana are running.
- Every Codex finding has a concrete reply; a fresh exact-head review is
requested below.
## Safety behavior
- Caller-controlled VAT is absent from request contracts; fixed 25% moms
is server-owned.
- A succeeded payment is preserved, requires the full expected
`amount_received`, and cannot close a changed/mismatched or
already-claimed collection.
- A compatible partially recorded Stripe closure is completed
idempotently; conflicting partial state fails closed for manual
reconciliation.
- Every cancellation/delete caller honors a concurrent-success result
and never falsely reports a completed payment as cleared.
- Price changes and invoice-collection reassignment share the payment
lock through validation, capture, post-capture reload, and closure.
- Reader changes are persisted only for reusable matching intents, so
stale intent cancellation targets the original terminal.
- Accepted legacy succeeded intents normalize stored tax to 25% before
response construction.
---------
Co-authored-by: Jeppe Bundgaard <jb@truckwash.dk>
- Introduced `department_daily_targets` field in criteria, renderer, and API to define daily target overrides for departments.
- Enhanced daily target logic to honor per-department overrides while maintaining backward compatibility.
- Updated SMS, email, and Slack renderers for consistent enforcement of text length limits with fallback to non-mbstring functions.
- Refactored order item update logic to improve database interaction safety by using setters.
- Introduce `getOrderItemObjects` in `orders_o` to retrieve item objects for an order.
- Add `getProduct` in `order_items_o` for product retrieval by item.
- Enhance Slack notification logic in invoicing routes for better error reporting and fixed pricing summaries.
- Temporarily comment out permission checks in certain invoicing endpoints for debugging purposes.
- Add `goals` class for managing goal metrics and calculations.
- Extend `goals_criteria` with timeframe initialization and validation.
- Implement `getListByCriteria` in `order_items_o.php` for product-based goal evaluation.
- Add unit tests for `goals` to validate
- Added `objectChanged()` to notify the order object when items are updated or deleted.
- Refactored `delete()` method to ensure the order is informed before executing the database query.
Introduced support for forced pricing in `addItemToOrder` and added stricter validation for array inputs in SQL queries. Enhanced JSON handling in type validation and improved code reuse with new objects. Added new endpoint `/modules/xlvask/related-orders` to fetch related orders by wash IDs.
Added functionality to handle vehicle subscriptions in invoices, including validation and item visibility. Introduced department notification SMS capability with endpoints for creating, retrieving, and deleting SMS records. Enhanced invoice drafting logic to exclude items not flagged for inclusion in invoices.
Extended the `addItemToOrder` method to accept an optional `notes` parameter and updated relevant logic to handle it. Modified input validation in `orderItemsRoute` to ensure notes are a valid string. Adjusted `set_name` in `product_options_o` to handle empty strings by nullifying the name.
Enhanced the order items functionality to include a related item ID. This involved adding a new property, updating methods to handle the related item ID, and ensuring appropriate validation and sanitation in the API routes. Also improved input sanitization for motorapi lookups to prevent SQL injection risks.
Added `delete`, `restore`, and other utility methods to enhance CRUD operations, including support for soft deletes. Introduced `objectChanged` hooks across objects for better cache or event handling, ensuring scalability and maintainability. Refactored and standardized object property handling while restructuring related methods.
Jeppe B