This update introduces explicit permission definitions for various route handlers across multiple routes. These changes enhance clarity and allow for more granular control over route access based on defined permissions. The updates ensure better manageability and scalability of endpoint permissions.
140 lines
5.7 KiB
PHP
140 lines
5.7 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\economic;
|
|
use classes\invoice_store;
|
|
use objects\economic_module_orders;
|
|
use objects\logs_o;
|
|
use objects\orders_o;
|
|
use objects\users_o;
|
|
use traits\route_t;
|
|
|
|
class invoicesRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->get('/invoices/draft', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('get_invoice_draft');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Check if the request was successful
|
|
if ($user) {
|
|
// Check if the invoice id is set
|
|
if (!(string)$this->fromRequest('id')) {
|
|
$response->error('id parameter is required', 400);
|
|
}
|
|
// Create economic object
|
|
$economic = new economic();
|
|
// Get the draft invoice
|
|
$result = $economic->invoices->draft->get($this->fromRequest('id'));
|
|
if (isset($result->message)) {
|
|
$response->error($result->message, $result->httpStatusCode);
|
|
}
|
|
|
|
// Log the incident
|
|
(new logs_o())->add('invoices', 'global', 1, $user->id, 'GET_INVOICE', 'Successfully retrieved invoice');
|
|
// Return the list of departments
|
|
$response->success(
|
|
$economic->invoices->draft->get($this->fromRequest('id'))
|
|
);
|
|
} else {
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, 0, 'LIST_ORDERS', 'No user found, or invalid session');
|
|
// Return an error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'get_invoice_draft' => 'Get invoice draft'
|
|
]
|
|
);
|
|
|
|
$this->post('/invoices/draft/close', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('close_invoice_draft');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Check if the request was successful
|
|
if ($user) {
|
|
// Check if the invoice id is set
|
|
if (!$this->fromRequest('id')) {
|
|
$response->error('id parameter is required', 400);
|
|
}
|
|
// Create economic object
|
|
$economic_module_orders = new economic_module_orders();
|
|
// Get the user object from the draft invoice id
|
|
/** @var users_o $target_user */
|
|
$target_user = $economic_module_orders->getUserFromDraftId($this->fromRequest('id'));
|
|
// Get the draft invoice
|
|
$target_user->unsetOpenInvoiceDraft();
|
|
// Log the incident
|
|
(new logs_o())->add('invoices', 'global', 1, $user->id, 'CLOSE_INVOICE', 'Successfully closed invoice');
|
|
// Return the list of departments
|
|
$response->success(
|
|
['message' => 'Invoice closed']
|
|
);
|
|
} else {
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, 0, 'LIST_ORDERS', 'No user found, or invalid session');
|
|
// Return an error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'close_invoice_draft' => 'Close invoice draft'
|
|
]
|
|
);
|
|
|
|
$this->get('/invoices/pdf', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('get_invoice_pdf');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Check if the request was successful
|
|
if ($user) {
|
|
// Check if the invoice id is set
|
|
if (!$this->fromRequest('id')) {
|
|
$response->error('id parameter is required', 400);
|
|
}
|
|
$order_id = (new orders_o())->getOrderByInvoiceId($this->fromRequest('id'))->id;
|
|
// Check if the user has permission to view the invoice
|
|
if (!$user->hasAccessToOrder($order_id)) {
|
|
$response->error('User does not have access to this invoice', 403);
|
|
}
|
|
// Create economic object
|
|
$economic = new economic();
|
|
// Get the draft invoice
|
|
$invoicePathFile = $economic->invoices->pdf->get($this->fromRequest('id'));
|
|
// Add the pdf to the invoice store
|
|
$invoice_store = new invoice_store();
|
|
$invoice_store->uploadFile('invoice_' . $this->fromRequest('id') . '.pdf', $invoicePathFile);
|
|
|
|
// Log the incident
|
|
(new logs_o())->add('invoices', 'global', 1, $user->id, 'GET_INVOICE_PDF', 'Successfully retrieved invoice pdf');
|
|
// Remove the file
|
|
unlink($invoicePathFile);
|
|
// Return the download link
|
|
$response->success(
|
|
['message' => 'Invoice PDF retrieved', 'url' => $invoice_store->getInvoiceDownloadUrl($this->fromRequest('id'))]
|
|
);
|
|
} else {
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, 0, 'LIST_ORDERS', 'No user found, or invalid session');
|
|
// Return an error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'get_invoice_pdf' => 'Get invoice pdf'
|
|
]
|
|
);
|
|
}
|
|
} |