mirror of
https://github.com/InvoiceShelf/InvoiceShelf.git
synced 2026-07-17 22:35:19 +00:00
84524ce247
v3 port. Invoice/estimate/recurring creation and update accepted total, sub_total, tax and due_amount straight from the request with no recalculation, letting a client persist financial totals that don't match the line items (and corrupt the invoice update due-amount/paid-amount logic which keyed off the client total). - Adds App\Support\DocumentTotals (mirrors the front-end calc) trusting only price/quantity/discounts/tax-line amounts. - getInvoicePayload/getEstimatePayload/getRecurringInvoicePayload override the client totals; the shared DocumentItemService::createItems recomputes each item total; InvoiceService::update keys its due-amount logic off the recomputed total. Adds DocumentTotals unit tests + a feature test proving a tampered invoice total is ignored; existing create/update tests no longer assert the now server-authoritative derived totals.
74 lines
2.7 KiB
PHP
74 lines
2.7 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Document;
|
|
|
|
use App\Support\DocumentTotals;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
|
|
class DocumentItemService
|
|
{
|
|
public function createItems(Model $document, array $items): void
|
|
{
|
|
$exchangeRate = $document->exchange_rate;
|
|
|
|
foreach ($items as $item) {
|
|
$item['company_id'] = $document->company_id;
|
|
$item['exchange_rate'] = $exchangeRate;
|
|
// Recompute the item total from price/quantity so a tampered item
|
|
// total can't desync from the recomputed document totals (GHSA-8c69).
|
|
$item['total'] = DocumentTotals::itemTotal($item, $document->discount_per_item === 'YES');
|
|
$item['base_price'] = $item['price'] * $exchangeRate;
|
|
$item['base_discount_val'] = $item['discount_val'] * $exchangeRate;
|
|
$item['base_tax'] = $item['tax'] * $exchangeRate;
|
|
$item['base_total'] = $item['total'] * $exchangeRate;
|
|
|
|
if (array_key_exists('recurring_invoice_id', $item)) {
|
|
unset($item['recurring_invoice_id']);
|
|
}
|
|
|
|
$createdItem = $document->items()->create($item);
|
|
|
|
if (array_key_exists('taxes', $item) && $item['taxes']) {
|
|
foreach ($item['taxes'] as $tax) {
|
|
$tax['company_id'] = $document->company_id;
|
|
$tax['exchange_rate'] = $document->exchange_rate;
|
|
$tax['base_amount'] = $tax['amount'] * $exchangeRate;
|
|
$tax['currency_id'] = $document->currency_id;
|
|
|
|
if (gettype($tax['amount']) !== 'NULL') {
|
|
if (array_key_exists('recurring_invoice_id', $tax)) {
|
|
unset($tax['recurring_invoice_id']);
|
|
}
|
|
|
|
$createdItem->taxes()->create($tax);
|
|
}
|
|
}
|
|
}
|
|
|
|
if (array_key_exists('custom_fields', $item) && $item['custom_fields']) {
|
|
$createdItem->addCustomFields($item['custom_fields']);
|
|
}
|
|
}
|
|
}
|
|
|
|
public function createTaxes(Model $document, array $taxes): void
|
|
{
|
|
$exchangeRate = $document->exchange_rate;
|
|
|
|
foreach ($taxes as $tax) {
|
|
$tax['company_id'] = $document->company_id;
|
|
$tax['exchange_rate'] = $document->exchange_rate;
|
|
$tax['base_amount'] = $tax['amount'] * $exchangeRate;
|
|
$tax['currency_id'] = $document->currency_id;
|
|
|
|
if (gettype($tax['amount']) !== 'NULL') {
|
|
if (array_key_exists('recurring_invoice_id', $tax)) {
|
|
unset($tax['recurring_invoice_id']);
|
|
}
|
|
|
|
$document->taxes()->create($tax);
|
|
}
|
|
}
|
|
}
|
|
}
|