Version 4.3.0

applications/nexus/api/invoices.php

@@ -27,11 +27,13 @@ class _invoices extends \IPS\Api\Controller
 	 * GET /nexus/invoices
 	 * Get list of invoices
 	 *
-	 * @apiparam	string	customers			Comma-delimited list of customer IDs - if provided, only invoices belonging to those customers are returned
+	 * @note		For requests using an OAuth Access Token for a particular member, only the members own invoices will be included
+	 * @apiparam	string	customers			Comma-delimited list of customer IDs - if provided, only invoices belonging to those customers are returned. Ignored for requests using an OAuth Access Token for a particular member
 	 * @apiparam	string	statuses			Comma-delimited list of statuses - if provided, only invoices with those statuses are returned - see invoice object for status keys
 	 * @apiparam	string	sortBy				What to sort by. Can be 'date', 'paid' (for paid date), 'total', 'title' or do not specify for ID
 	 * @apiparam	string	sortDir				Sort direction. Can be 'asc' or 'desc' - defaults to 'asc'
 	 * @apiparam	int		page				Page number
+	 * @apiparam	int		perPage				Number of results per page - defaults to 25
 	 * @return		\IPS\Api\PaginatedResponse<IPS\nexus\Invoice>
 	 */
 	public function GETindex()
@@ -40,7 +42,11 @@ class _invoices extends \IPS\Api\Controller
 		$where = array();
 		
 		/* Customers */
-		if ( isset( \IPS\Request::i()->customers ) )
+		if ( $this->member )
+		{
+			$where[] = array( 'i_member=?', $this->member->member_id );
+		}
+		elseif ( isset( \IPS\Request::i()->customers ) )
 		{
 			$where[] = array( \IPS\Db::i()->in( 'i_member', array_map( 'intval', array_filter( explode( ',', \IPS\Request::i()->customers ) ) ) ) );
 		}
@@ -68,7 +74,9 @@ class _invoices extends \IPS\Api\Controller
 			\IPS\Db::i()->select( '*', 'nexus_invoices', $where, "{$sortBy} {$sortDir}" ),
 			isset( \IPS\Request::i()->page ) ? \IPS\Request::i()->page : 1,
 			'IPS\nexus\Invoice',
-			\IPS\Db::i()->select( 'COUNT(*)', 'nexus_invoices', $where )->first()
+			\IPS\Db::i()->select( 'COUNT(*)', 'nexus_invoices', $where )->first(),
+			$this->member,
+			isset( \IPS\Request::i()->perPage ) ? \IPS\Request::i()->perPage : NULL
 		);
 	}
 	
@@ -77,14 +85,20 @@ class _invoices extends \IPS\Api\Controller
 	 * Get information about a specific invoice
 	 *
 	 * @param		int		$id			ID Number
-	 * @throws		2X299/1	INVALID_ID	The invoice ID does not exist
+	 * @throws		2X299/1	INVALID_ID	The invoice ID does not exist or the authorized user does not have permission to view it
 	 * @return		\IPS\nexus\Invoice
 	 */
 	public function GETitem( $id )
 	{
 		try
-		{			
-			return new \IPS\Api\Response( 200, \IPS\nexus\Invoice::load( $id )->apiOutput() );
+		{
+			$object = \IPS\nexus\Invoice::load( $id );
+			if ( $this->member and !$object->canView( $this->member ) )
+			{
+				throw new \OutOfRangeException;
+			}
+			
+			return new \IPS\Api\Response( 200, $object->apiOutput( $this->member ) );
 		}
 		catch ( \OutOfRangeException $e )
 		{