← All changes | app/Http/Routes/api.php +3 -3 1.6.3 → 1.6.5 View file →

		@@ -553,9 +553,9 @@
553	553	'permissions' => 'orders/create'
554	554	]);
555	555
556	556	$router->post('/do-bulk-action', [OrderController::class, 'handleBulkActions'])->meta([
557		- 'permissions' => 'orders/manage'
	557	+ 'permissions' => 'orders/delete' // every accepted action deletes orders — same gate as DELETE /{order_id}
558	558	]);
559	559
560	560	$router->post('/{order}/mark-as-paid', [OrderController::class, 'markAsPaid'])->meta([
561	561	'permissions' => 'orders/manage'
		@@ -833,10 +833,10 @@
833	833	});
834	834
835	835	$router->post('/upload-editor-file', [FileUploadController::class, 'uploadEditorFile'])->withPolicy('AdminPolicy');
836	836
837		-$router->prefix('notes')->withPolicy('AdminPolicy')->group(function (Router $router) {
838		- $router->post('/attach', [NotesController::class, 'attach']);
	837	+$router->prefix('notes')->withPolicy('OrderPolicy')->group(function (Router $router) {
	838	+ $router->post('/attach', [NotesController::class, 'attach'])->meta(['permissions' => 'orders/manage']);
839	839	});
840	840
841	841	$router->prefix('app')->withPolicy('AdminPolicy')->group(function (Router $router) {
842	842	$router->get('init', [AppController::class, 'init']);