bug

src/modules/order/controllers/order.controller.ts

@@ -36,8 +36,8 @@ export class OrderController {
   @Delete('public/order/:id')
   @UseGuards(AuthGuard)
   @ApiOperation({ summary: 'Delete order ' })
-  deleteOrder(@Param('id') orderId: string) {
-    return this.orderService.removeOrderAsUser(orderId);
+  deleteOrder(@Param('id') orderId: string, @UserId() userId: string) {
+    return this.orderService.removeOrderAsUser(userId, orderId);
   }
 
   @Get('public/orders')
@@ -84,7 +84,7 @@ export class OrderController {
     @Param('orderItemId') orderItemId: string,
     @UserId() userId: string
   ) {
-    return this.orderService.removeOrderItemAsUser(userId, orderId, orderItemId);
+    return this.orderService.removeOrderItemAsUser(userId, orderId, +orderItemId);
   }
 
   /*==========================  Admin Routes =====================*/
@@ -133,7 +133,7 @@ export class OrderController {
     @Param('orderId') orderId: string,
     @Param('orderItemId') orderItemId: string,
   ) {
-    return this.orderService.removeOrderItemAsAdmin(orderId, orderItemId);
+    return this.orderService.removeOrderItemAsAdmin(orderId, +orderItemId);
   }
 
   @Patch('admin/order/:id/item')

src/modules/order/providers/order.service.ts

@@ -146,7 +146,7 @@ export class OrderService {
     return orderItem
   }
 
-  async removeOrderItemAsAdmin(orderId: string, itemId: string) {
+  async removeOrderItemAsAdmin(orderId: string, itemId: number) {
 
     const order = await this.findOrderOrFail(orderId)
 
@@ -159,7 +159,7 @@ export class OrderService {
     return true
   }
 
-  async removeOrderItemAsUser(userId: string, orderId: string, itemId: string) {
+  async removeOrderItemAsUser(userId: string, orderId: string, itemId: number) {
 
     const order = await this.findOrderOrFail(orderId)
 
@@ -263,10 +263,11 @@ export class OrderService {
   }
 
 
-  async removeOrderAsUser(orderId: string) {
-    const order = await this.orderRepository.findOne({ id: orderId })
-    if (!order) {
-      throw new BadRequestException("Order not found")
+  async removeOrderAsUser(userId: string, orderId: string) {
+    const order = await this.findOrderOrFail(orderId)
+
+    if (order.user.id !== userId) {
+      throw new BadRequestException("this order doesnt belongs to you")
     }
 
     if (![OrderStatusEnum.CREATED].includes(order.status)) {
@@ -299,6 +300,7 @@ export class OrderService {
     if (order.user.id !== userId) {
       throw new BadRequestException("This order is not belongs to you")
     }
+    return order
   }
 
   // ==================== Entity Methods ====================
@@ -335,7 +337,7 @@ export class OrderService {
 
     return this.em.transactional(async (em) => {
 
-      const order = this.em.create(Order, {
+      const order = em.create(Order, {
         creator: admin,
         user,
         attachments,
@@ -383,13 +385,13 @@ export class OrderService {
     }
 
 
-    if (adminId != undefined) {
+    if (adminId != undefined && adminId !== null) {
       const admin = await this.adminService.findOrFail(adminId)
       order.creator = admin
     }
 
 
-    if (designerId != undefined) {
+    if (designerId != undefined && designerId != undefined) {
       const designer = await this.adminService.findOrFail(designerId)
       order.designer = designer
     }
@@ -467,7 +469,7 @@ export class OrderService {
     return orderItem
   }
 
-  async removeOrderItem(itemId: string) {
+  async removeOrderItem(itemId: number) {
 
     const orderItem = await this.orderItemRepository.findOne({
       id: itemId
@@ -483,13 +485,8 @@ export class OrderService {
   }
 
   async hardDeleteOrder(orderId: string) {
-    const order = await this.orderRepository.findOne({ id: orderId })
-    if (!order) {
-      throw new BadRequestException("Order not found")
-    }
-    if (![OrderStatusEnum.CREATED, OrderStatusEnum.INVOICED].includes(order.status)) {
-      throw new BadRequestException("Order status must be of of Draft or Invoiced")
-    }
+    const order = await this.findOrderOrFail(orderId)
+
     if (order.payments.length > 0) {
       throw new BadRequestException("order with payments can not be deleted!")
     }