Jepp9350
2a35b7ce4d
Replaced redundant SQL queries with reusable methods for paginating, filtering, and searching records. Improved query safety using prepared statements and enhanced flexibility with dynamic order and filter processing. Updated related routes and objects to support the new structure.
81 lines
3.2 KiB
PHP
81 lines
3.2 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use objects\logs_o;
|
|
use objects\orders_o;
|
|
use traits\route_t;
|
|
|
|
class userOrdersRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->get('/user/orders', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('list_own_orders');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Check if the request was successful
|
|
if ($user) {
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, $user->id, 'LIST_OWN_ORDERS', 'Successfully listed own orders');
|
|
// Return the list of the user's orders
|
|
$response->success(
|
|
(new orders_o())->getCustomerOrdersPaginated(
|
|
$user->customer_number->value(),
|
|
($this->fromRequest('page') ?? 1),
|
|
($this->fromRequest('limit') ?? 10),
|
|
['id' => 'DESC'],
|
|
$this->fromRequest('search') === null ? '' : $this->fromRequest('search'),
|
|
$this->fromRequest('filters') === null ? [] :
|
|
$response->parseFilters($this->fromRequest('filters')) ?? []
|
|
)
|
|
);
|
|
} else {
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, 0, 'LIST_OWN_ORDERS', 'No user found, or invalid session');
|
|
// Return an error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
});
|
|
|
|
$this->get('/user/order', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('fetch_own_order');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Check if the request was successful
|
|
if ($user) {
|
|
// Check if the required fields are set
|
|
$data = $_GET;
|
|
if (!isset($data['id'])) {
|
|
$response->error('id parameter is required', 400);
|
|
}
|
|
// Make sure the user exists
|
|
if (!$user->exists()) {
|
|
$response->error('User not found', 400);
|
|
}
|
|
// Make sure the user is allowed to fetch the order
|
|
if (!$user->hasAccessToOrder($data['id'])) {
|
|
$response->error('You are not allowed to fetch this order', 400);
|
|
}
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, $user->id, 'FETCH_OWN_ORDER', 'Successfully fetched own order');
|
|
// Return the list of the user's orders
|
|
$response->success(
|
|
(new orders_o())->getOrderById($data['id'])->includeIncludes()->asArray()
|
|
);
|
|
} else {
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, 0, 'FETCH_OWN_ORDER', 'No user found, or invalid session');
|
|
// Return an error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
});
|
|
}
|
|
} |