116 lines
5.0 KiB
PHP
116 lines
5.0 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use objects\collected_order_invoices_o;
|
|
use objects\logs_o;
|
|
use traits\route_t;
|
|
|
|
class userInvoicesRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->get('/user/invoices', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
self::requirePermission('user_invoices');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('user_invoices', 'global', 0, 0, 'USER_INVOICES', 'User not logged in');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
// Return the invoices owned by the user
|
|
$collected_order_invoices = new collected_order_invoices_o();
|
|
$result = $collected_order_invoices->listObjectsWithPaginationIfSet(
|
|
function ($invoice_collection_array) {
|
|
$tmp_invoice = (new collected_order_invoices_o())->select((int)$invoice_collection_array['id']);
|
|
return [
|
|
...$tmp_invoice->asArray(),
|
|
];
|
|
},
|
|
$collected_order_invoices->forceRestrictFilters(
|
|
[
|
|
// This makes sure that the user can only see orders from the departments they explicitly have access to
|
|
'customer_number' => $user->customer_number->value()
|
|
]
|
|
)
|
|
);
|
|
$response->success($result);
|
|
},
|
|
[
|
|
'user_invoices' => 'Get the invoices of the user',
|
|
]
|
|
);
|
|
|
|
$this->put('/collected-invoices', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
self::requirePermission('user_invoices');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('user_invoices', 'global', 0, 0, 'USER_INVOICES', 'User not logged in');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
self::requireParameters(['id']);
|
|
self::requireType((int)self::getParameter('id'), self::type_int());
|
|
$id = (int)self::getParameter('id');
|
|
// Make sure the id is valid
|
|
self::requireMinValue($id, 1);
|
|
self::requireSameLength($id, self::getParameter('id'));
|
|
$is_superuser = self::hasPermission('superuser');
|
|
if (!self::isParametersSet(['po_number']) && !self::isParametersSet(['closed_at'])) {
|
|
$response->error('Missing required parameters: po_number, closed_at', 400);
|
|
}
|
|
if (self::isParametersSet(['closed_at']) && !$is_superuser) {
|
|
$response->error('Forbidden: only superusers can update closed_at', 403);
|
|
}
|
|
// Make sure optional fields are valid
|
|
if (self::isParametersSet(['po_number'])) {
|
|
self::requireType((string)self::getParameter('po_number'), self::type_string());
|
|
self::requireMinLength('po_number', 0);
|
|
self::requireMaxLength('po_number', 255);
|
|
}
|
|
$closed_at = null;
|
|
if (self::isParametersSet(['closed_at'])) {
|
|
$closed_at = self::getParameter('closed_at');
|
|
if ($closed_at !== null && $closed_at !== '') {
|
|
self::requireType((string)$closed_at, self::type_string());
|
|
self::requireDateFormat((string)$closed_at, self::FORMAT_DATE());
|
|
}
|
|
}
|
|
// Get the invoice
|
|
$collected_order_invoices = new collected_order_invoices_o();
|
|
$invoice = $collected_order_invoices->select((int)$id);
|
|
$invoice->requireSelected();
|
|
// Make sure the invoice belongs to the user
|
|
if ((int)$invoice->customer_number->value() !== (int)$user->customer_number->value() && !$is_superuser) {
|
|
(new logs_o())->add(
|
|
'user_invoices',
|
|
'global',
|
|
0,
|
|
0,
|
|
'USER_INVOICES',
|
|
'User not allowed to access this invoice (invoice_customer=' . (int)$invoice->customer_number->value() . ', user_customer=' . (int)$user->customer_number->value() . ')'
|
|
);
|
|
$response->error('Forbidden: invoice does not belong to authenticated user', 403);
|
|
}
|
|
// Update the invoice
|
|
if (self::isParametersSet(['po_number'])) {
|
|
$invoice->po_number->set((string)self::getParameter('po_number'));
|
|
}
|
|
if (self::isParametersSet(['closed_at'])) {
|
|
$invoice->closed_at->set($closed_at === null || $closed_at === '' ? null : date('Y-m-d 23:59:59', strtotime((string)$closed_at . ' 00:00:01')));
|
|
}
|
|
// Return success
|
|
$response->success($invoice->asArray());
|
|
},
|
|
[
|
|
'user_invoices' => 'Get the invoices of the user',
|
|
]
|
|
);
|
|
}
|
|
}
|