Jepp9350
b37499e0f0
Introduced a new `po_number` property in `collected_order_invoices_o` and updated related methods to handle it. Added `userInvoicesRoute` to manage user invoice APIs with GET and PUT endpoints for listing and updating invoices. Updated `microsoft/microsoft-graph` dependency to version `^2.8`.
86 lines
3.5 KiB
PHP
86 lines
3.5 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use objects\collected_order_invoices_o;
|
|
use objects\logs_o;
|
|
use traits\route_t;
|
|
|
|
class userInvoicesRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->get('/user/invoices', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
self::requirePermission('user_invoices');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('user_invoices', 'global', 0, 0, 'USER_INVOICES', 'User not logged in');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
// Return the invoices owned by the user
|
|
$collected_order_invoices = new collected_order_invoices_o();
|
|
$result = $collected_order_invoices->listObjectsWithPaginationIfSet(
|
|
function ($invoice_collection_array) {
|
|
$tmp_invoice = (new collected_order_invoices_o())->select((int)$invoice_collection_array['id']);
|
|
return [
|
|
...$tmp_invoice->asArray(),
|
|
];
|
|
},
|
|
$collected_order_invoices->forceRestrictFilters(
|
|
[
|
|
// This makes sure that the user can only see orders from the departments they explicitly have access to
|
|
'customer_number' => $user->customer_number->value()
|
|
]
|
|
)
|
|
);
|
|
$response->success($result);
|
|
},
|
|
[
|
|
'user_invoices' => 'Get the invoices of the user',
|
|
]
|
|
);
|
|
|
|
$this->put('/collected-invoices', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
self::requirePermission('user_invoices');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('user_invoices', 'global', 0, 0, 'USER_INVOICES', 'User not logged in');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
self::requireParameters(['id', 'po_number']);
|
|
self::requireType((int)self::getParameter('id'), self::type_int());
|
|
$id = (int)self::getParameter('id');
|
|
// Make sure the id is valid
|
|
self::requireMinValue($id, 1);
|
|
self::requireSameLength($id, self::getParameter('id'));
|
|
// Make sure the po_number is valid
|
|
self::requireType((string)self::getParameter('po_number'), self::type_string());
|
|
self::requireMinLength('po_number', 0);
|
|
self::requireMaxLength('po_number', 255);
|
|
// Get the invoice
|
|
$collected_order_invoices = new collected_order_invoices_o();
|
|
$invoice = $collected_order_invoices->select((int)$id);
|
|
$invoice->requireSelected();
|
|
// Make sure the invoice belongs to the user
|
|
if ((int)$invoice->customer_number->value() !== (int)$user->customer_number->value()) {
|
|
(new logs_o())->add('user_invoices', 'global', 0, 0, 'USER_INVOICES', 'User not allowed to access this invoice');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
// Update the invoice
|
|
$invoice->po_number->set((string)self::getParameter('po_number'));
|
|
// Return success
|
|
$response->success($invoice->asArray());
|
|
},
|
|
[
|
|
'user_invoices' => 'Get the invoices of the user',
|
|
]
|
|
);
|
|
}
|
|
} |