Version 4.3.0

applications/nexus/api/purchases.php

@@ -27,7 +27,8 @@ class _purchases extends \IPS\Api\Controller
 	 * GET /nexus/purchases
 	 * Get list of purchases
 	 *
-	 * @apiparam	string	customers			Comma-delimited list of customer IDs - if provided, only invoices belonging to those customers are returned
+	 * @note		For requests using an OAuth Access Token for a particular member, only the members own purchases will be included
+	 * @apiparam	string	customers			Comma-delimited list of customer IDs - if provided, only invoices belonging to those customers are returned. Ignored for requests using an OAuth Access Token for a particular member
 	 * @apiparam	int		active				If 1, only active purchases are returned. If 0, only inactive
 	 * @apiparam	int		canceled			If 1, only canceled purchases are returned. If 0, only not canceled
 	 * @apiparam	string	itemApp				If specified, only purchases with this application key are returned
@@ -38,6 +39,7 @@ class _purchases extends \IPS\Api\Controller
 	 * @apiparam	string	sortBy				What to sort by. Can be 'start' (for purchase date), 'expire' (for the epiry date) or do not specify for ID
 	 * @apiparam	string	sortDir				Sort direction. Can be 'asc' or 'desc' - defaults to 'asc'
 	 * @apiparam	int		page				Page number
+	 * @apiparam	int		perPage				Number of results per page - defaults to 25
 	 * @return		\IPS\Api\PaginatedResponse<IPS\nexus\Purchase>
 	 */
 	public function GETindex()
@@ -46,7 +48,11 @@ class _purchases extends \IPS\Api\Controller
 		$where = array();
 		
 		/* Customers */
-		if ( isset( \IPS\Request::i()->customers ) )
+		if ( $this->member )
+		{
+			$where[] = array( 'ps_member=?', $this->member->member_id );
+		}
+		elseif ( isset( \IPS\Request::i()->customers ) )
 		{
 			$where[] = array( \IPS\Db::i()->in( 'ps_member', array_map( 'intval', array_filter( explode( ',', \IPS\Request::i()->customers ) ) ) ) );
 		}
@@ -104,7 +110,9 @@ class _purchases extends \IPS\Api\Controller
 			\IPS\Db::i()->select( '*', 'nexus_purchases', $where, "{$sortBy} {$sortDir}" ),
 			isset( \IPS\Request::i()->page ) ? \IPS\Request::i()->page : 1,
 			'IPS\nexus\Purchase',
-			\IPS\Db::i()->select( 'COUNT(*)', 'nexus_purchases', $where )->first()
+			\IPS\Db::i()->select( 'COUNT(*)', 'nexus_purchases', $where )->first(),
+			$this->member,
+			isset( \IPS\Request::i()->perPage ) ? \IPS\Request::i()->perPage : NULL
 		);
 	}
 	
@@ -113,14 +121,20 @@ class _purchases extends \IPS\Api\Controller
 	 * Get information about a specific purchase
 	 *
 	 * @param		int		$id			ID Number
-	 * @throws		2X310/1	INVALID_ID	The purchase ID does not exist
+	 * @throws		2X310/1	INVALID_ID	The purchase ID does not exist or the authorized user does not have permission to view it
 	 * @return		\IPS\nexus\Purchase
 	 */
 	public function GETitem( $id )
 	{
 		try
 		{			
-			return new \IPS\Api\Response( 200, \IPS\nexus\Purchase::load( $id )->apiOutput() );
+			$object = \IPS\nexus\Purchase::load( $id );
+			if ( $this->member and !$object->canView( $this->member ) )
+			{
+				throw new \OutOfRangeException;
+			}
+			
+			return new \IPS\Api\Response( 200, $object->apiOutput( $this->member ) );
 		}
 		catch ( \OutOfRangeException $e )
 		{
@@ -132,8 +146,8 @@ class _purchases extends \IPS\Api\Controller
 	 * POST /nexus/purchases/{id}
 	 * Update custom fields for a purchase
 	 *
+	 * @apiclientonly
 	 * @apiparam	object	customFields	Values for custom fields
-	 * @throws		2X310/2		INVALID_ID	The purchase ID does not exist
 	 * @return		\IPS\nexus\Purchase
 	 */
 	public function POSTitem( $id )
@@ -159,6 +173,6 @@ class _purchases extends \IPS\Api\Controller
 		
 		$purchase->save();
 		
-		return new \IPS\Api\Response( 200, $purchase->apiOutput() );
+		return new \IPS\Api\Response( 200, $purchase->apiOutput( $this->member ) );
 	}
 }