diff --git a/src/modules/order/controllers/order.controller.ts b/src/modules/order/controllers/order.controller.ts index 52934d6..d04bce1 100644 --- a/src/modules/order/controllers/order.controller.ts +++ b/src/modules/order/controllers/order.controller.ts @@ -36,8 +36,8 @@ export class OrderController { @Delete('public/order/:id') @UseGuards(AuthGuard) @ApiOperation({ summary: 'Delete order ' }) - deleteOrder(@Param('id') orderId: string) { - return this.orderService.removeOrderAsUser(orderId); + deleteOrder(@Param('id') orderId: string, @UserId() userId: string) { + return this.orderService.removeOrderAsUser(userId, orderId); } @Get('public/orders') @@ -84,7 +84,7 @@ export class OrderController { @Param('orderItemId') orderItemId: string, @UserId() userId: string ) { - return this.orderService.removeOrderItemAsUser(userId, orderId, orderItemId); + return this.orderService.removeOrderItemAsUser(userId, orderId, +orderItemId); } /*========================== Admin Routes =====================*/ @@ -133,7 +133,7 @@ export class OrderController { @Param('orderId') orderId: string, @Param('orderItemId') orderItemId: string, ) { - return this.orderService.removeOrderItemAsAdmin(orderId, orderItemId); + return this.orderService.removeOrderItemAsAdmin(orderId, +orderItemId); } @Patch('admin/order/:id/item') diff --git a/src/modules/order/providers/order.service.ts b/src/modules/order/providers/order.service.ts index 6f6516e..5b916cd 100644 --- a/src/modules/order/providers/order.service.ts +++ b/src/modules/order/providers/order.service.ts @@ -146,7 +146,7 @@ export class OrderService { return orderItem } - async removeOrderItemAsAdmin(orderId: string, itemId: string) { + async removeOrderItemAsAdmin(orderId: string, itemId: number) { const order = await this.findOrderOrFail(orderId) @@ -159,7 +159,7 @@ export class OrderService { return true } - async removeOrderItemAsUser(userId: string, orderId: string, itemId: string) { + async removeOrderItemAsUser(userId: string, orderId: string, itemId: number) { const order = await this.findOrderOrFail(orderId) @@ -263,10 +263,11 @@ export class OrderService { } - async removeOrderAsUser(orderId: string) { - const order = await this.orderRepository.findOne({ id: orderId }) - if (!order) { - throw new BadRequestException("Order not found") + async removeOrderAsUser(userId: string, orderId: string) { + const order = await this.findOrderOrFail(orderId) + + if (order.user.id !== userId) { + throw new BadRequestException("this order doesnt belongs to you") } if (![OrderStatusEnum.CREATED].includes(order.status)) { @@ -299,6 +300,7 @@ export class OrderService { if (order.user.id !== userId) { throw new BadRequestException("This order is not belongs to you") } + return order } // ==================== Entity Methods ==================== @@ -335,7 +337,7 @@ export class OrderService { return this.em.transactional(async (em) => { - const order = this.em.create(Order, { + const order = em.create(Order, { creator: admin, user, attachments, @@ -383,13 +385,13 @@ export class OrderService { } - if (adminId != undefined) { + if (adminId != undefined && adminId !== null) { const admin = await this.adminService.findOrFail(adminId) order.creator = admin } - if (designerId != undefined) { + if (designerId != undefined && designerId != undefined) { const designer = await this.adminService.findOrFail(designerId) order.designer = designer } @@ -467,7 +469,7 @@ export class OrderService { return orderItem } - async removeOrderItem(itemId: string) { + async removeOrderItem(itemId: number) { const orderItem = await this.orderItemRepository.findOne({ id: itemId @@ -483,13 +485,8 @@ export class OrderService { } async hardDeleteOrder(orderId: string) { - const order = await this.orderRepository.findOne({ id: orderId }) - if (!order) { - throw new BadRequestException("Order not found") - } - if (![OrderStatusEnum.CREATED, OrderStatusEnum.INVOICED].includes(order.status)) { - throw new BadRequestException("Order status must be of of Draft or Invoiced") - } + const order = await this.findOrderOrFail(orderId) + if (order.payments.length > 0) { throw new BadRequestException("order with payments can not be deleted!") }