Dave
97603dce71
Remove payment amount, reference, notes and manual combining forms. Link supplier POs automatically and record paid from supplier evidence plus proof, keeping readiness and attachment safeguards. Keep active supplier/company views current and retire stale supplier evidence on routing changes. Verified 5167 tests with only the two existing script-import errors.
57 lines
2.6 KiB
JavaScript
57 lines
2.6 KiB
JavaScript
/** Supplier payment commands and direct-write readiness enforcement. */
|
|
routerAdd("GET", "/api/wfdash/order-payments-capability", (e) => {
|
|
const payments = require(`${__hooks}/order_payment_utils.js`);
|
|
payments.assertSchema(e.app);
|
|
return e.json(200, { version: 3 });
|
|
}, $apis.requireSuperuserAuth());
|
|
|
|
routerAdd("POST", "/api/wfdash/order-payments", (e) => {
|
|
const payments = require(`${__hooks}/order_payment_utils.js`);
|
|
const audit = require(`${__hooks}/audit_log_utils.js`);
|
|
const result = payments.command(e, e.requestInfo().body, audit.log);
|
|
return e.json(200, result);
|
|
}, $apis.requireSuperuserAuth());
|
|
|
|
routerAdd("POST", "/api/wfdash/order-payments-document", (e) => {
|
|
const payments = require(`${__hooks}/order_payment_utils.js`);
|
|
const audit = require(`${__hooks}/audit_log_utils.js`);
|
|
const result = payments.uploadDocument(e, e.requestInfo().body, audit.log);
|
|
return e.json(200, result);
|
|
}, $apis.requireSuperuserAuth());
|
|
|
|
onRecordUpdateRequest((e) => {
|
|
const payments = require(`${__hooks}/order_payment_utils.js`);
|
|
const audit = require(`${__hooks}/audit_log_utils.js`);
|
|
return payments.protectItemUpdate(e, audit.log);
|
|
}, "order_items");
|
|
|
|
onRecordCreateRequest((e) => {
|
|
const payments = require(`${__hooks}/order_payment_utils.js`);
|
|
payments.protectProjection(e.requestInfo());
|
|
return e.next();
|
|
}, "order_items");
|
|
|
|
onRecordCreate((e) => {
|
|
const payments = require(`${__hooks}/order_payment_utils.js`);
|
|
const audit = require(`${__hooks}/audit_log_utils.js`);
|
|
return payments.protectModelCreate(e, audit.log);
|
|
}, "order_items");
|
|
|
|
// Also covers internal hook/model writes. Public API projections are protected
|
|
// above; internal payment commands update the request before their item writes.
|
|
onRecordUpdate((e) => {
|
|
const payments = require(`${__hooks}/order_payment_utils.js`);
|
|
payments.checkReadiness(e.app, payments.plain(e.record));
|
|
return e.next();
|
|
}, "order_items");
|
|
|
|
// These records are immutable to ordinary record API callers, including an
|
|
// admin client. Only the transactional command above may change them.
|
|
onRecordCreateRequest((e) => { throw new ForbiddenError("Use the supplier payment command."); }, "supplier_payment_requests");
|
|
onRecordUpdateRequest((e) => { throw new ForbiddenError("Use the supplier payment command."); }, "supplier_payment_requests");
|
|
onRecordDeleteRequest((e) => { throw new ForbiddenError("Payment history cannot be deleted."); }, "supplier_payment_requests");
|
|
onRecordDeleteRequest((e) => {
|
|
const payments = require(`${__hooks}/order_payment_utils.js`);
|
|
payments.protectDeletion(e.app, e.record);
|
|
return e.next();
|
|
}, "order_items");
|