api/services/nginx/app/routes/userInvoicesRoute.php

<?php

namespace routes;

use classes\authentication;
use objects\collected_order_invoices_o;
use objects\logs_o;
use traits\route_t;

use app\auth\Scope;
use app\auth\ScopeMiddleware;

class userInvoicesRoute
{
    use route_t;

    public function run(): void
    {
        $this->get('/user/invoices', function () {
            ScopeMiddleware::requireScope(Scope::INVOICE_READ, '/user/invoices');
            // Require the user to be logged in
            global $response;
            $this->requirePermission('user_invoices');
            $user = (new authentication())->get_user();
            if (!$user) {
                (new logs_o())->add('user_invoices', 'global', 0, 0, 'USER_INVOICES', 'User not logged in');
                $response->error('Invalid session', 400);
            }
            // Return the invoices owned by the user
            $collected_order_invoices = new collected_order_invoices_o();
            $result = $collected_order_invoices->listObjectsWithPaginationIfSet(
                function ($invoice_collection_array) {
                    $tmp_invoice = (new collected_order_invoices_o())->select((int)$invoice_collection_array['id']);
                    return [
                        ...$tmp_invoice->asArray(),
                    ];
                },
                $collected_order_invoices->forceRestrictFilters(
                    [
                        // This makes sure that the user can only see orders from the departments they explicitly have access to
                        'customer_number' => $user->customer_number->value()
                    ]
                )
            );
            $response->success($result);
        },
            [
                'user_invoices' => 'Get the invoices of the user',
            ]
        );

        $this->put('/collected-invoices', function () {
            ScopeMiddleware::requireScope(Scope::INVOICE_READ, '/collected-invoices');
            // Require the user to be logged in
            global $response;
            $this->requirePermission('user_invoices');
            $user = (new authentication())->get_user();
            if (!$user) {
                (new logs_o())->add('user_invoices', 'global', 0, 0, 'USER_INVOICES', 'User not logged in');
                $response->error('Invalid session', 400);
            }
            self::requireParameters(['id']);
            self::requireType((int)self::getParameter('id'), self::type_int());
            $id = (int)self::getParameter('id');
            // Make sure the id is valid
            self::requireMinValue($id, 1);
            self::requireSameLength($id, self::getParameter('id'));
            $is_superuser = $this->hasPermission('superuser');
            if (!self::isParametersSet(['po_number']) && !self::isParametersSet(['closed_at'])) {
                // At least one of po_number or closed_at must be provided. The
                // previous message said "Missing required parameters:
                // po_number, closed_at" which read as if BOTH were required
                // and confused customers trying to invoice (TRU-128).
                $response->error('At least one of po_number or closed_at must be provided', 400);
            }
            // Only superusers may set a non-empty closed_at. Customers are
            // still allowed to pass an empty/null closed_at to CLEAR a
            // previously set value (the field is then set to null below).
            $closed_at_is_non_empty = false;
            if (self::isParametersSet(['closed_at'])) {
                $raw_closed_at = self::getParameter('closed_at');
                $closed_at_is_non_empty = ($raw_closed_at !== null && $raw_closed_at !== '');
            }
            if ($closed_at_is_non_empty && !$is_superuser) {
                $response->error('Forbidden: only superusers can update closed_at', 403);
            }
            // Make sure optional fields are valid
            if (self::isParametersSet(['po_number'])) {
                self::requireType((string)self::getParameter('po_number'), self::type_string());
                self::requireMinLength('po_number', 0);
                self::requireMaxLength('po_number', 255);
            }
            $closed_at = null;
            if (self::isParametersSet(['closed_at'])) {
                $closed_at = self::getParameter('closed_at');
                if ($closed_at !== null && $closed_at !== '') {
                    self::requireType((string)$closed_at, self::type_string());
                    self::requireDateFormat((string)$closed_at, self::FORMAT_DATE());
                }
            }
            // Get the invoice
            $collected_order_invoices = new collected_order_invoices_o();
            $invoice = $collected_order_invoices->select((int)$id);
            $invoice->requireSelected();
            // Make sure the invoice belongs to the user
            if ((int)$invoice->customer_number->value() !== (int)$user->customer_number->value() && !$is_superuser) {
                (new logs_o())->add(
                    'user_invoices',
                    'global',
                    0,
                    0,
                    'USER_INVOICES',
                    'User not allowed to access this invoice (invoice_customer=' . (int)$invoice->customer_number->value() . ', user_customer=' . (int)$user->customer_number->value() . ')'
                );
                $response->error('Forbidden: invoice does not belong to authenticated user', 403);
            }
            // Update the invoice
            if (self::isParametersSet(['po_number'])) {
                $invoice->po_number->set((string)self::getParameter('po_number'));
            }
            if (self::isParametersSet(['closed_at'])) {
                $invoice->closed_at->set($closed_at === null || $closed_at === '' ? null : date('Y-m-d 23:59:59', strtotime((string)$closed_at . ' 00:00:01')));
            }
            // Return success
            $response->success($invoice->asArray());
        },
            [
                'user_invoices' => 'Get the invoices of the user',
            ]
        );
    }
}