Merge pull request #99 from heseya/bugfix/B2B-317

Removed metadata from public order

app/Http/Controllers/OrderController.php

@@ -38,11 +38,13 @@
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Resources\Json\JsonResource;
 use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Config;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Response;
 use Symfony\Component\HttpFoundation\Response as HttpFoundationResponse;
 use Symfony\Component\HttpFoundation\StreamedResponse;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 class OrderController extends Controller
 {
@@ -79,6 +81,10 @@ public function index(OrderIndexRequest $request): JsonResource
 
     public function show(Order $order): JsonResource
     {
+        if (!Auth::user() || !Auth::user()->can('orders.show_details')) {
+            return OrderPublicResource::make($order);
+        }
+
         $order->load([
             'products.urls',
             'products.schemas',
@@ -101,6 +107,10 @@ public function show(Order $order): JsonResource
 
     public function showPublic(Order $order): JsonResource
     {
+        if (!config('orders.enable_order_public')) {
+            throw new NotFoundHttpException();
+        }
+
         return OrderPublicResource::make($order);
     }
 

config/orders.php

@@ -0,0 +1,5 @@
+<?php
+
+return [
+    'enable_order_public' => env('ENABLE_ORDER_PUBLIC', true),
+];

routes/order.php

@@ -29,7 +29,7 @@
     });
 
     Route::get('id:{order:id}', [OrderController::class, 'show'])
-        ->middleware('can:orders.show_details');
+        ->middleware('permission:orders.show_details|orders.show_summary');
     Route::patch('id:{order:id}/status', [OrderController::class, 'updateStatus'])
         ->middleware('can:orders.edit.status');
     Route::patch('id:{order:id}', [OrderController::class, 'update'])
@@ -42,6 +42,7 @@
         ->middleware('can:orders.edit');
     Route::post('id:{order:id}/send-urls', [OrderController::class, 'sendUrls'])
         ->middleware('can:orders.show_details');
+    /** @deprecated  */
     Route::get('{order:code}', [OrderController::class, 'showPublic'])
         ->middleware('can:orders.show_summary');
 

src/Domain/Order/Resources/OrderPublicResource.php

@@ -6,7 +6,6 @@
 
 use App\Http\Resources\Resource;
 use App\Models\Order;
-use App\Traits\MetadataResource;
 use Domain\Order\Dtos\OrderPriceDto;
 use Illuminate\Http\Request;
 
@@ -15,14 +14,12 @@
  */
 final class OrderPublicResource extends Resource
 {
-    use MetadataResource;
-
     /**
      * @return array<string, mixed>
      */
     public function base(Request $request): array
     {
-        return array_merge([
+        return [
             'id' => $this->resource->getKey(),
             'code' => $this->resource->code,
             'status' => OrderStatusResource::make($this->resource->status),
@@ -41,6 +38,6 @@ public function base(Request $request): array
             'language' => $this->resource->language,
             'payment_method_type' => $this->resource->payment_method_type,
             'vat_rate' => $this->resource->vat_rate,
-        ], $this->metadataResource('orders.show_metadata_private'));
+        ];
     }
 }