| @@ -6,8 +6,35 @@ | ||
| 6 | 6 | use FluentForm\App\Modules\Payments\PaymentHelper; |
| 7 | 7 | use FluentForm\App\Services\Manager\FormManagerService; |
| 8 | 8 | use FluentForm\Framework\Support\Arr; |
| 9 | 9 | |
| 10 | +/** | |
| 11 | + * Column properties resolved at runtime via the ORM's magic __get; declared | |
| 12 | + * here so static analysis can verify attribute access against the real schema | |
| 13 | + * (database/Migrations/Submissions.php). | |
| 14 | + * | |
| 15 | + * @property int $id | |
| 16 | + * @property int|null $form_id | |
| 17 | + * @property int|null $serial_number | |
| 18 | + * @property string|null $response | |
| 19 | + * @property string|null $source_url | |
| 20 | + * @property int|null $user_id | |
| 21 | + * @property string|null $status | |
| 22 | + * @property int $is_favourite | |
| 23 | + * @property string|null $browser | |
| 24 | + * @property string|null $device | |
| 25 | + * @property string|null $ip | |
| 26 | + * @property string|null $city | |
| 27 | + * @property string|null $country | |
| 28 | + * @property string|null $payment_status | |
| 29 | + * @property string|null $payment_method | |
| 30 | + * @property string|null $payment_type | |
| 31 | + * @property string|null $currency | |
| 32 | + * @property float|null $payment_total | |
| 33 | + * @property float|null $total_paid | |
| 34 | + * @property string|null $created_at | |
| 35 | + * @property string|null $updated_at | |
| 36 | + */ | |
| 10 | 37 | class Submission extends Model |
| 11 | 38 | { |
| 12 | 39 | /** |
| 13 | 40 | * The table associated with the model. |
| @@ -317,10 +344,25 @@ | ||
| 317 | 344 | { |
| 318 | 345 | $this->where('id', $id)->update($data); |
| 319 | 346 | } |
| 320 | 347 | |
| 321 | - public static function remove($submissionIds) | |
| 348 | + public static function remove($submissionIds, $formId = null) | |
| 322 | 349 | { |
| 350 | + // Fail-closed scope guard: $formId scopes every delete to its owning form; | |
| 351 | + // a missing scope throws rather than ever deleting unscoped. | |
| 352 | + if (empty($formId)) { | |
| 353 | + throw new \InvalidArgumentException('Submission::remove() requires a form id to scope the deletion.'); | |
| 354 | + } | |
| 355 | + | |
| 356 | + $submissionIds = static::where('form_id', $formId) | |
| 357 | + ->whereIn('id', (array) $submissionIds) | |
| 358 | + ->pluck('id') | |
| 359 | + ->all(); | |
| 360 | + | |
| 361 | + if (!$submissionIds) { | |
| 362 | + return; | |
| 363 | + } | |
| 364 | + | |
| 323 | 365 | static::whereIn('id', $submissionIds)->delete(); |
| 324 | 366 | |
| 325 | 367 | SubmissionMeta::whereIn('response_id', $submissionIds)->delete(); |
| 326 | 368 | |
