← All changes | app/Http/Routes/api.php +8 -6 1.6.0 → 1.6.5 View file →

		@@ -553,9 +553,9 @@
553	553	'permissions' => 'orders/create'
554	554	]);
555	555
556	556	$router->post('/do-bulk-action', [OrderController::class, 'handleBulkActions'])->meta([
557		- 'permissions' => 'orders/manage'
	557	+ 'permissions' => 'orders/delete' // every accepted action deletes orders — same gate as DELETE /{order_id}
558	558	]);
559	559
560	560	$router->post('/{order}/mark-as-paid', [OrderController::class, 'markAsPaid'])->meta([
561	561	'permissions' => 'orders/manage'
		@@ -610,11 +610,13 @@
610	610	$router->post('/{order}/transactions/{transaction_id}/accept-dispute/', [OrderController::class, 'acceptDispute'])->meta([
611	611	'permissions' => 'orders/manage'
612	612	]);
613	613
614		- $router->get('/{id}/transactions/{transaction_id}', [OrderController::class, 'getDetails'])->meta([
615		- 'permissions' => 'orders/view'
616		- ]);
	614	+ $router->get('/{id}/transactions/{transaction_id}', [OrderController::class, 'getTransactionDetails'])
	615	+ ->int('id', 'transaction_id')
	616	+ ->meta([
	617	+ 'permissions' => 'orders/view'
	618	+ ]);
617	619
618	620	$router->put('/{order}/address/{id}', [OrderController::class, 'updateOrderAddress'])->meta([
619	621	'permissions' => 'orders/manage'
620	622	]);
		@@ -831,10 +833,10 @@
831	833	});
832	834
833	835	$router->post('/upload-editor-file', [FileUploadController::class, 'uploadEditorFile'])->withPolicy('AdminPolicy');
834	836
835		-$router->prefix('notes')->withPolicy('AdminPolicy')->group(function (Router $router) {
836		- $router->post('/attach', [NotesController::class, 'attach']);
	837	+$router->prefix('notes')->withPolicy('OrderPolicy')->group(function (Router $router) {
	838	+ $router->post('/attach', [NotesController::class, 'attach'])->meta(['permissions' => 'orders/manage']);
837	839	});
838	840
839	841	$router->prefix('app')->withPolicy('AdminPolicy')->group(function (Router $router) {
840	842	$router->get('init', [AppController::class, 'init']);