diff --git a/VERSION b/VERSION index 56f5e1b..01b0f09 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.8.12 +2.8.13 diff --git a/app/core/economic_write_policy.py b/app/core/economic_write_policy.py index f09b228..8bd57ee 100644 --- a/app/core/economic_write_policy.py +++ b/app/core/economic_write_policy.py @@ -14,7 +14,9 @@ ALLOWED_WRITES = { } _approved_four_eyes_write = ContextVar('approved_four_eyes_write', default=False) +_approved_order_draft_update = ContextVar('approved_order_draft_update', default=False) _FOUR_EYES_UPDATES = re.compile(r'^(?:customers|products)/[^/]+$') +_ORDER_DRAFT_UPDATE = re.compile(r'^orders/drafts/[0-9]+$') @contextmanager @@ -27,6 +29,16 @@ def approved_four_eyes_write(): _approved_four_eyes_write.reset(token) +@contextmanager +def approved_order_draft_update(): + """Permit one user-confirmed update of an existing e-conomic order draft.""" + token = _approved_order_draft_update.set(True) + try: + yield + finally: + _approved_order_draft_update.reset(token) + + def assert_economic_write_allowed(method: str, path: str) -> None: clean_path = path.split('?', 1)[0].strip('/') operation = (method.upper(), clean_path) @@ -35,7 +47,12 @@ def assert_economic_write_allowed(method: str, path: str) -> None: and _FOUR_EYES_UPDATES.fullmatch(clean_path) and _approved_four_eyes_write.get() ) - if operation not in ALLOWED_WRITES and not approved_update: + approved_draft_update = ( + operation[0] == 'PUT' + and _ORDER_DRAFT_UPDATE.fullmatch(clean_path) + and _approved_order_draft_update.get() + ) + if operation not in ALLOWED_WRITES and not approved_update and not approved_draft_update: raise HTTPException( status_code=403, detail='e-conomic er låst: Hub må kun oprette kunder, varer og ordrekladder', diff --git a/app/modules/orders/backend/economic_sync.py b/app/modules/orders/backend/economic_sync.py new file mode 100644 index 0000000..2bc6100 --- /dev/null +++ b/app/modules/orders/backend/economic_sync.py @@ -0,0 +1,182 @@ +"""Safe updates and daily read-only lifecycle checks for e-conomic order drafts.""" +import json +import logging +from copy import deepcopy +from datetime import datetime, timezone, timedelta +from decimal import Decimal +from uuid import UUID + +from fastapi import HTTPException +from psycopg2.extras import Json + +from app.core.economic_write_policy import approved_order_draft_update +from app.products.backend.economic_catalog import EconomicClient, RemoteError, query, transaction +from app.products.backend.economic_documents import active_connection + +logger = logging.getLogger(__name__) + + +def _number(value): + try: + return str(Decimal(str(value or 0)).quantize(Decimal('.01'))) + except Exception: + return '0.00' + + +def _editable_snapshot(payload): + return { + 'notes': ((payload.get('notes') or {}).get('textLine1') or ''), + 'lines': [{ + 'product_number': ((line.get('product') or {}).get('productNumber')), + 'description': line.get('description') or '', + 'quantity': _number(line.get('quantity')), + 'unit_price': _number(line.get('unitNetPrice')), + 'discount_percentage': _number(line.get('discountPercentage')), + } for line in payload.get('lines') or []], + } + + +def build_update_payload(remote, local_lines, notes): + """Keep external identity fields and only replace user-editable order content.""" + allowed = ('date', 'currency', 'customer', 'paymentTerms', 'recipient', 'layout', 'references') + payload = {key: deepcopy(remote[key]) for key in allowed if key in remote} + remote_lines = remote.get('lines') or [] + if len(remote_lines) != len(local_lines): + raise HTTPException(409, 'Antallet af linjer er ændret. Opret en ny ordre for at tilføje eller fjerne varer.') + changed, payload_lines = [], [] + for remote_line, local in zip(remote_lines, local_lines): + if not (remote_line.get('product') or {}).get('productNumber'): + raise HTTPException(409, 'En eksisterende e-conomic-linje mangler varenummer og kan ikke opdateres sikkert.') + output = {'product': deepcopy(remote_line['product']), + 'description': str(local.get('description') or 'Ordrelinje'), + 'quantity': float(local.get('quantity') or 0), + 'unitNetPrice': float(local.get('unit_price') or 0), + 'discountPercentage': float(local.get('discount_percentage') or 0)} + if remote_line.get('unit'): + output['unit'] = deepcopy(remote_line['unit']) + if output['quantity'] <= 0 or output['unitNetPrice'] < 0 or not 0 <= output['discountPercentage'] <= 100: + raise HTTPException(422, 'Ugyldig mængde, pris eller rabat') + payload_lines.append(output) + changed.append(dict(local)) + payload['lines'] = payload_lines + if notes: + payload['notes'] = {'textLine1': str(notes)[:1000]} + else: + payload.pop('notes', None) + return payload, changed + + +async def create_update_preview(draft_id, local_lines, notes, actor_id): + row = query('SELECT * FROM ordre_drafts WHERE id=%s', (draft_id,), one=True) + if not row: + raise HTTPException(404, 'Ordren findes ikke') + if not row.get('economic_order_number') or row.get('economic_invoice_number') or row.get('sync_status') in ('posted', 'paid'): + raise HTTPException(409, 'Kun en åben e-conomic-ordrekladde kan opdateres') + connection = active_connection() + client = EconomicClient() + if connection: + await client.verify(connection['id']) + try: + remote = await client.request('GET', f"orders/drafts/{int(row['economic_order_number'])}") + except RemoteError as exc: + if exc.status == 404: + raise HTTPException(409, 'Ordren er ikke længere en åben kladde. Hent status for at finde fakturaen.') from exc + raise HTTPException(502, str(exc)) from exc + proposed, saved_lines = build_update_payload(remote, local_lines, notes) + before, after = _editable_snapshot(remote), _editable_snapshot(proposed) + with transaction() as cur: + cur.execute("UPDATE economic_order_update_requests SET status='expired' WHERE draft_id=%s AND status='pending'", (draft_id,)) + cur.execute('''INSERT INTO economic_order_update_requests + (draft_id,economic_order_number,before_snapshot,proposed_payload,proposed_local_lines,requested_by_user_id) + VALUES(%s,%s,%s,%s,%s,%s) RETURNING id,expires_at''', + (draft_id, str(row['economic_order_number']), Json(before), Json(proposed), Json(saved_lines), actor_id)) + request_row = cur.fetchone() + return {'request_id': str(request_row['id']), 'expires_at': request_row['expires_at'], 'before': before, 'after': after} + + +async def apply_update(request_id, draft_id, actor_id): + try: + UUID(str(request_id)) + except ValueError as exc: + raise HTTPException(422, 'Ugyldig godkendelsesreference') from exc + row = query('''SELECT r.*,d.sync_status,d.economic_invoice_number FROM economic_order_update_requests r + JOIN ordre_drafts d ON d.id=r.draft_id WHERE r.id=%s AND r.draft_id=%s''', (request_id, draft_id), one=True) + if not row or row['status'] != 'pending' or row['expires_at'] <= datetime.now(timezone.utc): + raise HTTPException(409, 'Godkendelsen er udløbet eller allerede brugt') + if row.get('economic_invoice_number') or row.get('sync_status') in ('posted', 'paid'): + raise HTTPException(409, 'Ordren er faktureret og kan ikke længere opdateres') + client = EconomicClient() + remote = await client.request('GET', f"orders/drafts/{int(row['economic_order_number'])}") + if _editable_snapshot(remote) != row['before_snapshot']: + raise HTTPException(409, 'Ordren er ændret i e-conomic siden forhåndsvisningen. Lav en ny forhåndsvisning.') + try: + with approved_order_draft_update(): + response = await client.request('PUT', f"orders/drafts/{int(row['economic_order_number'])}", row['proposed_payload']) + except RemoteError as exc: + query("UPDATE economic_order_update_requests SET status='failed',error=%s WHERE id=%s", (str(exc), request_id)) + raise HTTPException(502, str(exc)) from exc + with transaction() as cur: + cur.execute("SELECT set_config('bmc.economic_order_update',%s,true)", (str(draft_id),)) + cur.execute('''UPDATE ordre_drafts SET lines_json=%s,notes=%s,export_request_json=%s, + export_response_json=%s,last_sync_at=now(),updated_at=now() WHERE id=%s''', + (Json(row['proposed_local_lines']), (row['proposed_payload'].get('notes') or {}).get('textLine1'), + Json(row['proposed_payload']), Json(response), draft_id)) + cur.execute("UPDATE economic_order_update_requests SET status='applied',applied_at=now(),response=%s WHERE id=%s", (Json(response), request_id)) + cur.execute('''INSERT INTO ordre_draft_sync_events(draft_id,event_type,from_status,to_status,event_payload,created_by_user_id) + VALUES(%s,'economic_draft_updated',%s,%s,%s,%s)''', + (draft_id, row['sync_status'], row['sync_status'], Json({'request_id': str(request_id)}), actor_id)) + return {'status': 'updated', 'economic_order_number': row['economic_order_number']} + + +async def sync_one_draft(draft_id, force=False): + row = query('SELECT * FROM ordre_drafts WHERE id=%s', (draft_id,), one=True) + if not row or not row.get('economic_order_number'): + raise HTTPException(404, 'Ordren har intet e-conomic-ordrenummer') + if not force and row.get('economic_last_checked_at') and row['economic_last_checked_at'] > datetime.now(timezone.utc) - timedelta(days=1): + return {'status': row.get('economic_document_state') or 'unchanged', 'skipped': True} + client = EconomicClient() + marker = 'BMC-HUB:' + str(row.get('economic_export_id') or row.get('export_idempotency_key') or '') + state, invoice, remote = 'draft', None, None + try: + remote = await client.request('GET', f"orders/drafts/{int(row['economic_order_number'])}") + except RemoteError as exc: + if exc.status != 404: + query('UPDATE ordre_drafts SET economic_last_checked_at=now(),economic_status_error=%s WHERE id=%s', (str(exc), draft_id)) + raise + booked = await client.collection('invoices/booked') + order_number = str(row['economic_order_number']) + matches = [x for x in booked if ( + (x.get('references') or {}).get('other') == marker + or str(x.get('orderNumber') or (x.get('references') or {}).get('orderNumber') or '') == order_number + )] + if len(matches) == 1: + remote, invoice, state = matches[0], str(matches[0].get('bookedInvoiceNumber') or matches[0].get('invoiceNumber')), 'posted' + paid = await client.collection('invoices/paid') + if any(str(x.get('bookedInvoiceNumber') or x.get('invoiceNumber')) == invoice for x in paid): + state = 'paid' + else: + state = 'not_found' + payment = 'paid' if state == 'paid' else ('unpaid' if state == 'posted' else None) + with transaction() as cur: + cur.execute('''UPDATE ordre_drafts SET economic_invoice_number=COALESCE(%s,economic_invoice_number), + sync_status=CASE WHEN %s='paid' THEN 'paid' WHEN %s='posted' THEN 'posted' ELSE sync_status END, + economic_document_state=%s,economic_payment_status=%s,economic_status_response=%s, + economic_status_error=NULL,economic_last_checked_at=now(),last_sync_at=now(),updated_at=now() WHERE id=%s''', + (invoice,state,state,state,payment,Json(remote or {}),draft_id)) + if state in ('posted','paid') and state != row.get('sync_status'): + cur.execute('''INSERT INTO ordre_draft_sync_events(draft_id,event_type,from_status,to_status,event_payload) + VALUES(%s,'economic_status_sync',%s,%s,%s)''', (draft_id,row.get('sync_status'),state,Json({'invoice_number':invoice,'payment_status':payment}))) + return {'status': state, 'invoice_number': invoice, 'payment_status': payment, 'skipped': False} + + +async def sync_due_drafts(): + rows = query("""SELECT id FROM ordre_drafts WHERE economic_order_number IS NOT NULL + AND sync_status IN ('exported','posted') + AND (economic_last_checked_at IS NULL OR economic_last_checked_at < now()-interval '1 day') + ORDER BY economic_last_checked_at NULLS FIRST LIMIT 100""") or [] + for row in rows: + try: + await sync_one_draft(row['id']) + except Exception: + logger.exception('Daglig e-conomic-statuskontrol fejlede for ordre %s', row['id']) + return {'checked': len(rows)} diff --git a/app/modules/orders/backend/router.py b/app/modules/orders/backend/router.py index 07becdf..5f0e7c4 100644 --- a/app/modules/orders/backend/router.py +++ b/app/modules/orders/backend/router.py @@ -88,6 +88,15 @@ class OrdreDraftConsolidateRequest(BaseModel): draft_ids: List[int] = Field(..., min_length=2) +class EconomicDraftUpdatePreviewRequest(BaseModel): + lines: List[Dict[str, Any]] + notes: Optional[str] = None + + +class EconomicDraftUpdateConfirmRequest(BaseModel): + request_id: str + + def _safe_json_field(value: Any) -> Any: if value is None: return None @@ -426,6 +435,36 @@ async def get_ordre_draft(draft_id: int, http_request: Request): raise HTTPException(status_code=500, detail="Failed to fetch ordre draft") +async def _require_economic_order_update(http_request: Request) -> Dict[str, Any]: + from app.core.auth_dependencies import get_current_user, security + from app.core.auth_service import AuthService + actor = await get_current_user(http_request, await security(http_request)) + if not actor.get('is_superadmin') and not AuthService.user_has_permission(actor['id'], 'economic.orders.update'): + raise HTTPException(403, 'Du mangler rettighed til at opdatere e-conomic-ordrekladder') + return actor + + +@router.post('/ordre/drafts/{draft_id}/economic-update-preview') +async def preview_economic_draft_update(draft_id: int, payload: EconomicDraftUpdatePreviewRequest, http_request: Request): + actor = await _require_economic_order_update(http_request) + from app.modules.orders.backend.economic_sync import create_update_preview + return await create_update_preview(draft_id, payload.lines, payload.notes, actor['id']) + + +@router.post('/ordre/drafts/{draft_id}/economic-update-confirm') +async def confirm_economic_draft_update(draft_id: int, payload: EconomicDraftUpdateConfirmRequest, http_request: Request): + actor = await _require_economic_order_update(http_request) + from app.modules.orders.backend.economic_sync import apply_update + return await apply_update(payload.request_id, draft_id, actor['id']) + + +@router.post('/ordre/drafts/{draft_id}/economic-status-refresh') +async def refresh_economic_draft_status(draft_id: int, http_request: Request): + await _require_economic_order_update(http_request) + from app.modules.orders.backend.economic_sync import sync_one_draft + return await sync_one_draft(draft_id, force=True) + + @router.post("/ordre/drafts") async def create_ordre_draft(request: OrdreDraftUpsertRequest, http_request: Request): """Create a new ordre draft.""" @@ -639,6 +678,19 @@ async def list_ordre_draft_sync_events( async def update_ordre_draft(draft_id: int, request: OrdreDraftUpsertRequest, http_request: Request): """Update existing ordre draft.""" try: + from app.core.database import execute_query_single + existing = execute_query_single('SELECT customer_id,lines_json,notes,layout_number,sync_status FROM ordre_drafts WHERE id=%s', (draft_id,)) + if not existing: + raise HTTPException(status_code=404, detail="Draft not found") + if (existing.get('sync_status') or '').lower() in {'exported','posted','paid'}: + content_changed = ( + existing.get('customer_id') != request.customer_id + or (_safe_json_field(existing.get('lines_json')) or []) != request.lines + or (existing.get('notes') or None) != (request.notes or None) + or existing.get('layout_number') != request.layout_number + ) + if content_changed: + raise HTTPException(409, 'Brug “Opdatér e-conomic-kladde”, så ændringen forhåndsvises og gemmes begge steder.') await _check_draft_prices(http_request, request.customer_id, request.lines, draft_id) from app.core.database import execute_query diff --git a/app/modules/orders/templates/detail.html b/app/modules/orders/templates/detail.html index 3da58b0..12f6d46 100644 --- a/app/modules/orders/templates/detail.html +++ b/app/modules/orders/templates/detail.html @@ -174,6 +174,12 @@
Status, e-conomic-numre og historik for ordren
+ + @@ -227,6 +233,10 @@
Fakturanummer
-
+
+
Betalingsstatus
+
-
+
@@ -339,6 +349,13 @@
+ {% endblock %} @@ -352,6 +369,7 @@ let syncEventsTotal = 0; let detailToast = null; let pendingEconomicProductPreview = null; + let pendingEconomicUpdateId = null; function showToast(message, variant = 'dark') { const toastEl = document.getElementById('detailToast'); @@ -453,8 +471,10 @@ tbody.innerHTML = orderLines.map((line, index) => { const isExportedLine = line.export_status === 'exported'; + const mayEditExportedDraft = isExportedLine && orderData && orderData.sync_status === 'exported' && !orderData.economic_invoice_number; + const lockLine = isExportedLine && !mayEditExportedDraft; const descriptionField = ``; const exportStatus = line.export_status || '-'; @@ -481,17 +501,17 @@ ${descriptionField} ${formatCurrency(line.amount)} @@ -660,6 +680,10 @@ const errorBanner = document.getElementById('exportErrorBanner'); errorBanner.textContent = orderData.last_export_error ? `Seneste eksportfejl: ${orderData.last_export_error}` : ''; errorBanner.classList.toggle('d-none', !orderData.last_export_error); + const openEconomicDraft = orderData.sync_status === 'exported' && orderData.economic_order_number && !orderData.economic_invoice_number; + document.getElementById('economicUpdateBtn').classList.toggle('d-none', !openEconomicDraft); + document.getElementById('economicStatusBtn').classList.toggle('d-none', !orderData.economic_order_number); + document.getElementById('economicPaymentStatusView').textContent = orderData.economic_payment_status || (orderData.economic_document_state === 'draft' ? 'Ikke faktureret' : '-'); document.getElementById('createdAt').textContent = formatDate(orderData.created_at); document.getElementById('updatedAt').textContent = formatDate(orderData.updated_at); @@ -854,6 +878,48 @@ } } + async function previewEconomicUpdate() { + try { + const res = await fetch(`/api/v1/ordre/drafts/${draftId}/economic-update-preview`, { + method: 'POST', headers: {'Content-Type':'application/json'}, + body: JSON.stringify({lines: orderLines, notes: document.getElementById('orderNotes').value || null}), + }); + const data = await res.json(); + if (!res.ok) throw new Error(data.detail || 'Forhåndsvisning fejlede'); + pendingEconomicUpdateId = data.request_id; + const before = data.before || {}, after = data.after || {}; + const rows = (after.lines || []).map((line, i) => { + const old = (before.lines || [])[i] || {}; + return `${escapeHtml(line.product_number || '-')}${escapeHtml(old.description)} → ${escapeHtml(line.description)}${escapeHtml(old.quantity)} → ${escapeHtml(line.quantity)}${escapeHtml(old.unit_price)} → ${escapeHtml(line.unit_price)}${escapeHtml(old.discount_percentage)} → ${escapeHtml(line.discount_percentage)}`; + }).join(''); + document.getElementById('economicUpdateComparison').innerHTML = `
Noter: ${escapeHtml(before.notes || '-')} → ${escapeHtml(after.notes || '-')}
${rows}
VareBeskrivelseAntalPrisRabat %
`; + bootstrap.Modal.getOrCreateInstance(document.getElementById('economicUpdatePreviewModal')).show(); + } catch (err) { showToast(err.message, 'danger'); } + } + + async function confirmEconomicUpdate() { + if (!pendingEconomicUpdateId) return; + try { + const res = await fetch(`/api/v1/ordre/drafts/${draftId}/economic-update-confirm`, {method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({request_id:pendingEconomicUpdateId})}); + const data = await res.json(); + if (!res.ok) throw new Error(data.detail || 'Opdateringen fejlede'); + bootstrap.Modal.getInstance(document.getElementById('economicUpdatePreviewModal'))?.hide(); + pendingEconomicUpdateId = null; + showToast('e-conomic-ordrekladden er opdateret', 'success'); + await loadOrder(); + } catch (err) { showToast(err.message, 'danger'); } + } + + async function refreshEconomicStatus() { + try { + const res = await fetch(`/api/v1/ordre/drafts/${draftId}/economic-status-refresh`, {method:'POST'}); + const data = await res.json(); + if (!res.ok) throw new Error(data.detail || 'Statuskontrol fejlede'); + showToast(data.invoice_number ? `Faktura ${data.invoice_number}: ${data.payment_status || data.status}` : 'Ordren er stadig en åben kladde', 'success'); + await loadOrder(); + } catch (err) { showToast(err.message, 'danger'); } + } + async function previewPrices() { try { const url = `/api/v1/economic/ordre-drafts/${draftId}/reprice`; diff --git a/main.py b/main.py index d231102..3fb4169 100644 --- a/main.py +++ b/main.py @@ -227,6 +227,17 @@ async def lifespan(app: FastAPI): ) logger.info("✅ Ordre draft reconcile job scheduled (daily at 04:30)") + from app.modules.orders.backend.economic_sync import sync_due_drafts + backup_scheduler.scheduler.add_job( + func=sync_due_drafts, + trigger=CronTrigger(hour=4, minute=45), + id='economic_order_daily_status', + name='Daily e-conomic order and payment status', + max_instances=1, + replace_existing=True, + ) + logger.info("✅ e-conomic ordre- og betalingsstatus planlagt dagligt kl. 04:45") + if settings.ESET_ENABLED and settings.ESET_SYNC_ENABLED: from app.jobs.eset_sync import run_eset_sync diff --git a/migrations/246_economic_order_updates_and_status.sql b/migrations/246_economic_order_updates_and_status.sql new file mode 100644 index 0000000..9ee2b8e --- /dev/null +++ b/migrations/246_economic_order_updates_and_status.sql @@ -0,0 +1,48 @@ +BEGIN; + +ALTER TABLE ordre_drafts +ADD COLUMN IF NOT EXISTS economic_last_checked_at TIMESTAMPTZ, +ADD COLUMN IF NOT EXISTS economic_document_state VARCHAR(30), +ADD COLUMN IF NOT EXISTS economic_payment_status VARCHAR(30), +ADD COLUMN IF NOT EXISTS economic_status_response JSONB, +ADD COLUMN IF NOT EXISTS economic_status_error TEXT; + +CREATE TABLE IF NOT EXISTS economic_order_update_requests ( + id UUID PRIMARY KEY DEFAULT gen_random_uuid(), + draft_id INTEGER NOT NULL REFERENCES ordre_drafts(id) ON DELETE CASCADE, + economic_order_number VARCHAR(80) NOT NULL, + before_snapshot JSONB NOT NULL, + proposed_payload JSONB NOT NULL, + proposed_local_lines JSONB NOT NULL, + status VARCHAR(20) NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','applied','expired','failed')), + requested_by_user_id INTEGER REFERENCES users(user_id) ON DELETE SET NULL, + created_at TIMESTAMPTZ NOT NULL DEFAULT now(), + expires_at TIMESTAMPTZ NOT NULL DEFAULT now() + interval '15 minutes', + applied_at TIMESTAMPTZ, + response JSONB, + error TEXT +); + +CREATE INDEX IF NOT EXISTS idx_economic_order_update_pending ON economic_order_update_requests(draft_id,status); +CREATE INDEX IF NOT EXISTS idx_ordre_economic_daily_check ON ordre_drafts(economic_last_checked_at) WHERE economic_order_number IS NOT NULL; + +CREATE OR REPLACE FUNCTION protect_exported_ordre_lines() RETURNS trigger AS $$ +BEGIN + IF (NEW.lines_json IS DISTINCT FROM OLD.lines_json OR NEW.customer_id IS DISTINCT FROM OLD.customer_id) + AND current_setting('bmc.economic_order_update', true) IS DISTINCT FROM OLD.id::text + AND EXISTS (SELECT 1 FROM economic_document_exports WHERE document_key='order-draft:'||OLD.id::text AND status NOT IN ('rejected','archived')) THEN + RAISE EXCEPTION 'Exported or uncertain document lines are immutable; use the approved e-conomic draft update flow'; + END IF; + RETURN NEW; +END; $$ LANGUAGE plpgsql; + +INSERT INTO permissions(code,description,category) +VALUES ('economic.orders.update','Forhåndsvis og godkend opdatering af en åben e-conomic-ordrekladde','economic') +ON CONFLICT (code) DO NOTHING; + +INSERT INTO group_permissions(group_id,permission_id) +SELECT g.id,p.id FROM groups g CROSS JOIN permissions p +WHERE g.name='Administrators' AND p.code='economic.orders.update' +ON CONFLICT DO NOTHING; + +COMMIT; diff --git a/tests/test_economic_catalog.py b/tests/test_economic_catalog.py index 7e552cb..c403e1a 100644 --- a/tests/test_economic_catalog.py +++ b/tests/test_economic_catalog.py @@ -140,6 +140,28 @@ def test_four_eyes_context_allows_only_customer_and_product_put(): assert_economic_write_allowed('PUT', 'products/ABC-1') +def test_confirmed_order_context_allows_only_numeric_draft_put(): + from app.core.economic_write_policy import approved_order_draft_update, assert_economic_write_allowed + with pytest.raises(HTTPException): + assert_economic_write_allowed('PUT', 'orders/drafts/12') + with approved_order_draft_update(): + assert_economic_write_allowed('PUT', 'orders/drafts/12') + with pytest.raises(HTTPException): + assert_economic_write_allowed('PUT', 'orders/12') + with pytest.raises(HTTPException): + assert_economic_write_allowed('DELETE', 'orders/drafts/12') + + +def test_order_update_payload_strips_read_only_fields_and_keeps_product(): + from app.modules.orders.backend.economic_sync import build_update_payload + payload, _ = build_update_payload({ + 'date':'2026-09-13','currency':'DKK','customer':{'customerNumber':1}, + 'orderNumber':42,'netAmount':100,'lines':[{'lineNumber':1,'product':{'productNumber':'P1'},'quantity':1,'unitNetPrice':10}], + }, [{'description':'Ny','quantity':2,'unit_price':25,'discount_percentage':10}], 'Note') + assert 'orderNumber' not in payload and 'netAmount' not in payload + assert payload['lines'] == [{'product':{'productNumber':'P1'},'description':'Ny','quantity':2.0,'unitNetPrice':25.0,'discountPercentage':10.0}] + + def test_four_eyes_change_field_allowlist(): from app.products.backend.economic_routes import _validate_change_fields assert _validate_change_fields('product', {'name': 'Nyt navn'}) == {'name': 'Nyt navn'}