Enhanced the order items functionality to include a related item ID. This involved adding a new property, updating methods to handle the related item ID, and ensuring appropriate validation and sanitation in the API routes. Also improved input sanitization for motorapi lookups to prevent SQL injection risks.
222 lines
8.1 KiB
PHP
222 lines
8.1 KiB
PHP
<?php
|
|
|
|
namespace objects;
|
|
|
|
use classes\db;
|
|
use classes\object_property;
|
|
use traits\db_object_t;
|
|
|
|
class order_items_o extends db
|
|
{
|
|
use db_object_t;
|
|
|
|
/**
|
|
* The associated order id
|
|
* @var object_property
|
|
*/
|
|
public object_property $order_id;
|
|
/**
|
|
* The associated product id
|
|
* @var object_property
|
|
*/
|
|
public object_property $product_id;
|
|
/**
|
|
* The text reference assigned to the product at the time of the order
|
|
* @var object_property
|
|
*/
|
|
public object_property $reference;
|
|
/**
|
|
* The notes added to the order item
|
|
* @var object_property
|
|
*/
|
|
public object_property $notes;
|
|
/**
|
|
* The cashier (id) who added the item to the order
|
|
* @var object_property
|
|
*/
|
|
public object_property $cashier_id;
|
|
/**
|
|
* The price of the product at the time of the order
|
|
* @var object_property
|
|
*/
|
|
public object_property $price;
|
|
/**
|
|
* The quantity of the product ordered
|
|
* @var object_property
|
|
*/
|
|
public object_property $quantity;
|
|
/**
|
|
* The id of the related item, if it exists
|
|
* @var object_property
|
|
*/
|
|
public object_property $related_item_id;
|
|
|
|
public function structure(): void
|
|
{
|
|
$this->setTable('order_items');
|
|
}
|
|
|
|
public function objectChanged(): void
|
|
{
|
|
// No need to invalidate the cache, since the order_items object is not cached
|
|
}
|
|
|
|
public function getOrderItemById(int $id): order_items_o
|
|
{
|
|
global $db;
|
|
// Get the record from the database
|
|
$sql = "SELECT * FROM $this->table WHERE id = $id";
|
|
$result = $db->query($sql);
|
|
if ($result->num_rows > 0) {
|
|
$this->id = $id;
|
|
$this->getObjectProperties();
|
|
}
|
|
return $this;
|
|
}
|
|
|
|
public function getObjectProperties(): void
|
|
{
|
|
$this->order_id = new object_property($this->table, $this->id, 'order_id', 'int', true);
|
|
$this->product_id = new object_property($this->table, $this->id, 'product_id', 'int', true);
|
|
$this->reference = new object_property($this->table, $this->id, 'reference', 'string', true);
|
|
$this->notes = new object_property($this->table, $this->id, 'notes', 'string', false);
|
|
$this->cashier_id = new object_property($this->table, $this->id, 'cashier_id', 'int', true);
|
|
$this->price = new object_property($this->table, $this->id, 'price', 'int', true);
|
|
$this->quantity = new object_property($this->table, $this->id, 'quantity', 'int', true);
|
|
$this->related_item_id = new object_property($this->table, $this->id, 'related_item_id', 'int', false);
|
|
}
|
|
|
|
public function add(int $order_id, int $product_id, string $reference, string $notes, int $cashier_id, int $price, int $quantity): void
|
|
{
|
|
global $db, $response;
|
|
try {
|
|
// Avoid SQL injection
|
|
$reference = $db->escape_string($reference);
|
|
$notes = $db->escape_string($notes);
|
|
// Create a new record in the database
|
|
$sql = "INSERT INTO $this->table (order_id, product_id, reference, notes, cashier_id, price, quantity) VALUES ($order_id, $product_id, '$reference', '$notes', $cashier_id, $price, $quantity)";
|
|
$db->query($sql);
|
|
|
|
// Get the id of the new record
|
|
$this->id = $db->insert_id();
|
|
|
|
// Set the values of the object properties
|
|
$this->getObjectProperties();
|
|
} catch (\Exception $e) {
|
|
$response->error($e->getMessage());
|
|
}
|
|
}
|
|
|
|
public function edit(int $id, int $order_id, int $product_id, string $reference, string $notes, int $cashier_id, int $price, int $quantity): void
|
|
{
|
|
global $db, $response;
|
|
$this->id = $id;
|
|
try {
|
|
// Avoid SQL injection
|
|
$reference = $db->escape_string($reference);
|
|
$notes = $db->escape_string($notes);
|
|
// Update the record in the database
|
|
$sql = "UPDATE $this->table SET order_id = $order_id, product_id = $product_id, reference = '$reference', notes = '$notes', cashier_id = $cashier_id, price = $price, quantity = $quantity WHERE id = $this->id";
|
|
$db->query($sql);
|
|
|
|
// Set the values of the object properties
|
|
$this->getObjectProperties();
|
|
} catch (\Exception $e) {
|
|
$response->error($e->getMessage());
|
|
}
|
|
}
|
|
|
|
public function addItemToOrder(int $order_id, int $product_id, int $cashier_id, int $quantity, $related_item_id = null): void
|
|
{
|
|
global $db, $response;
|
|
try {
|
|
// Get the order
|
|
$order = (new orders_o())->getOrderById($order_id);
|
|
// Get the product price
|
|
$price = (new products_o())->getProductById($product_id)->getDepartmentPrice((int)$order->department_id->value());
|
|
|
|
// Check if the user has a discount on the product, or category
|
|
$customer = (new orders_o())->getOrderCustomer($order_id);
|
|
$discount = $customer->getCustomPrice($product_id, false);
|
|
if ($discount) {
|
|
$price = $price - ($price * $discount / 100);
|
|
}
|
|
|
|
// Create a new record in the database
|
|
$sql = "INSERT INTO $this->table (order_id, product_id, price, cashier_id, quantity) VALUES ($order_id, $product_id, $price, $cashier_id, $quantity)";
|
|
$db->query($sql);
|
|
// Get the id of the new record
|
|
$this->id = $db->insert_id();
|
|
// Set the values of the object properties
|
|
$this->getObjectProperties();
|
|
// Set the related item id, if it is set
|
|
if ($related_item_id) {
|
|
$this->related_item_id->set($related_item_id);
|
|
}
|
|
|
|
} catch (\Exception $e) {
|
|
$response->error($e->getMessage());
|
|
}
|
|
}
|
|
|
|
|
|
public function removeOrderItem(int $id): void
|
|
{
|
|
// TODO: Implement delete() method instead
|
|
global $db;
|
|
$this->id = $id;
|
|
$sql = "DELETE FROM $this->table WHERE id = $this->id or related_item_id = $this->id";
|
|
$db->query($sql);
|
|
}
|
|
|
|
public function getItemAsArray(): array
|
|
{
|
|
return [
|
|
'id' => (int)$this->id,
|
|
'order_id' => (int)$this->order_id->value(),
|
|
'product_id' => (int)$this->product_id->value(),
|
|
'reference' => (string)$this->reference->value(),
|
|
'notes' => (string)$this->notes->value(),
|
|
'cashier_id' => (int)$this->cashier_id->value(),
|
|
'price' => (int)$this->price->value(),
|
|
'quantity' => (int)$this->quantity->value(),
|
|
'related_item_id' => (int)$this->related_item_id->value(),
|
|
'product' => (array)(new products_o())->getProductById($this->product_id->value())->asArray(),
|
|
'cashier' => (array)(new users_o())->getUserById($this->cashier_id->value())->asArray()
|
|
];
|
|
}
|
|
|
|
public function getAllItemsAsArray(int $orderId): array
|
|
{
|
|
global $db;
|
|
$sql = "SELECT * FROM $this->table WHERE order_id = $orderId AND deleted_at IS NULL";
|
|
$result = $db->query($sql);
|
|
// Circumvent the repeated instantiation of the object, by just selecting the fields
|
|
$items = [];
|
|
if ($result->num_rows > 0) {
|
|
while ($row = $result->fetch_assoc()) {
|
|
$items[] = $row;
|
|
}
|
|
}
|
|
return $items;
|
|
}
|
|
|
|
public function updateOrderItem(int $id, int $price, string $notes, string $reference, int $quantity): void
|
|
{
|
|
global $db, $response;
|
|
$this->id = $id;
|
|
try {
|
|
// Avoid SQL injection
|
|
$price = $db->escape_string($price);
|
|
$notes = $db->escape_string($notes);
|
|
$reference = $db->escape_string($reference);
|
|
// Update the record in the database
|
|
$sql = "UPDATE $this->table SET price = $price, notes = '$notes', reference = '$reference', quantity = $quantity WHERE id = $this->id";
|
|
$db->query($sql);
|
|
// Set the values of the object properties
|
|
$this->getObjectProperties();
|
|
} catch (\Exception $e) {
|
|
$response->error($e->getMessage());
|
|
}
|
|
}
|
|
} |