## Summary
Audit and (where needed) fix additional fields in the e-conomic export
path. PR #391 covered the main order.* and order_item.* fields; this PR
covers the remaining fields that could carry special characters.
## Changes
1. Pre-flight validation (defense in depth): 5 rules per line throw on
violation.
2. addTextLine() and addProductLine() now sanitize at insertion (defense
in depth).
3. Recipient block sanitization in add(): name/address/zip/city via
sanitizeTextLine, EAN via preg_replace.
4. Audit document: documentation/economic/export-field-audit.md.
5. Tests: 94 tests / 171 assertions (14 + 19 + 6 + 24 new tests).
## Refs
- TRU-193, TRU-188, TRU-194, PR #391
---------
Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: OpenClaw <openclaw@copenhagentruckwash.io>
Co-authored-by: Bugfix Subagent <bugfix@subagent.local>
## Problem
E-conomic API returns HTTP 400 when text-line descriptions contain
certain characters. The most common case is `/` in the order reference
field, which causes the entire draft-invoice export to fail.
## Root cause
When `order.reference` (or notes, reg_*, po) contains `/`, e-conomic's
text-line validation rejects the entire draft with HTTP 400. Same for
control characters and very long strings.
## Fix
Adds `economic_export_sanitizer` class that sanitizes all user-input
fields flowing into e-conomic:
- `/` → `-` (the reported 400 trigger)
- Control chars stripped (\x00-\x1F except \t and \n)
- Tab and newline → single space
- Whitespace normalized and trimmed
- Lengths capped (text 250, product 50, description 500) with `...`
suffix
- Multibyte safe (æ, ø, å, emoji, Chinese)
## Applied to
In `economic_invoice_draft.php`:
- `order.po`
- `order.reference` (PRIMARY FIX for the reported issue)
- `order.notes`
- `order.reg_1/2/3`
- `order_item.reference`
- `order_item.notes`
- `product.description`
- `product.productNumber`
- `department_name`
## Test coverage
- 31 unit tests with 45 assertions
- All edge cases (null, empty, control chars, multibyte, very long,
HTML, control chars in every position)
- Lint and test suite both pass
## Linear
Refs: TRU-189, TRU-190, TRU-191, TRU-192, TRU-193, TRU-194, TRU-196
Co-authored-by: OpenClaw <openclaw@copenhagentruckwash.io>
- Introduced `po` property in `orders_o` for handling Purchase Order (PO) numbers, including API integration for retrieval and validation.
- Enhanced customer permissions to allow limited order editing (`po` updates) and attachment downloads for their own orders.
- Added new helper methods to `users_o` for attributes like `showPricesOnBookingPage` and `usePONumbers`.
- Improved order item listing logic with distinct permissions for customers' own orders and price visibility.
- Implemented numeric value casting in filters within `db_object_t`.
- Simplified department retrieval in `economic_invoice_draft.php` by streamlining logic for default department usage.
- Enhanced `getDepartmentByOrderId` in `orders_o` to ensure correct department is fetched based on given `order_id`.
- Updated discount line logic to leverage appropriate department dimension values.
Introduced functionality to handle fixed prices for collected order invoices, allowing customer-specific pricing overrides. Added a new route and methods to integrate fixed pricing logic, modify invoice items, and ensure proper data management in E-Conomic. Adjusted discount calculations to accommodate cases where final price is zero.
Updated default values for department IDs to prevent null issues and ensure proper handling of optional fields. Adjusted logic to skip non-invoiceable items and corrected department validation to avoid invalid entries. Improved overall robustness and consistency in invoice-related operations.
Added functionality to handle vehicle subscriptions in invoices, including validation and item visibility. Introduced department notification SMS capability with endpoints for creating, retrieving, and deleting SMS records. Enhanced invoice drafting logic to exclude items not flagged for inclusion in invoices.
Refactored invoice draft handling to improve error checks, added support for optional fetch skipping, and enhanced currency management. Expanded filtering capabilities with date range and attribute-based filters. Adjusted Nginx config to increase FastCGI read timeout for long-running processes.
Replaced hardcoded "DKK" with a dynamic currency variable to ensure the correct currency is displayed on invoice discounts. This improves flexibility and localization for international users.
Introduced dynamic currency handling in invoice generation by adding methods to set currency and retrieve conversion rates. Adjusted logic to ensure accurate currency conversions when processing orders, draft invoices, and customer data. Default behavior falls back to DKK if no currency is specified.
Added support for defining and retrieving form field options, along with methods to manage field-specific configurations. Enhanced invoice draft generation to handle discounts, including the ability to calculate total discounts and display them as separate lines. These updates improve flexibility in forms and invoice processing.
Introduced a new endpoint for syncing collected order invoices with E-Conomic via a POST route. Added methods for creating, managing, and closing invoice drafts in E-Conomic. The implementation includes validations, external ID handling, and seamless integration of payment terms and layout configurations.
