orders.py 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630
  1. import db
  2. import schemas
  3. import auth_utils
  4. import notifications
  5. import config
  6. from typing import List, Optional
  7. import json
  8. import os
  9. import uuid
  10. import shutil
  11. import hashlib
  12. import preview_utils
  13. import slicer_utils
  14. from fastapi import APIRouter, Request, Form, Depends, HTTPException, BackgroundTasks, UploadFile, File
  15. from services import pricing, order_processing, event_hooks
  16. from services.audit_service import audit_service
  17. from services.rate_limit_service import rate_limit_service
  18. from dependencies import get_current_user, require_admin, get_current_user_optional
  19. from pydantic import BaseModel
  20. from datetime import datetime
  21. import locales
  22. from services.global_manager import global_manager
  23. router = APIRouter(prefix="/orders", tags=["orders"])
  24. @router.post("")
  25. async def create_order(
  26. request: Request,
  27. background_tasks: BackgroundTasks,
  28. first_name: str = Form(...),
  29. last_name: str = Form(...),
  30. phone: str = Form(...),
  31. email: str = Form(...),
  32. shipping_address: str = Form(...),
  33. model_link: Optional[str] = Form(None),
  34. allow_portfolio: bool = Form(False),
  35. notes: Optional[str] = Form(None),
  36. material_id: int = Form(...),
  37. file_ids: str = Form("[]"),
  38. file_quantities: str = Form("[]"),
  39. quantity: int = Form(1),
  40. color_name: Optional[str] = Form(None),
  41. is_company: bool = Form(False),
  42. company_name: Optional[str] = Form(None),
  43. company_pib: Optional[str] = Form(None),
  44. company_address: Optional[str] = Form(None),
  45. user: Optional[dict] = Depends(get_current_user_optional)
  46. ):
  47. ip = request.client.host if request.client else "unknown"
  48. email_addr = email.lower()
  49. lang = request.query_params.get("lang", "en")
  50. is_admin = user.get("role") == "admin" if user else False
  51. if not is_admin and rate_limit_service.is_order_flooding(email_addr, ip):
  52. raise HTTPException(
  53. status_code=429,
  54. detail=locales.translate_error("flood_control", lang)
  55. )
  56. user_id = user.get("id") if user else None
  57. parsed_ids = []
  58. parsed_quantities = []
  59. if file_ids:
  60. try:
  61. parsed_ids = json.loads(file_ids)
  62. parsed_quantities = json.loads(file_quantities)
  63. except:
  64. pass
  65. name_col = f"name_{lang}" if lang in ["en", "ru", "me"] else "name_en"
  66. mat_info = db.execute_query(f"SELECT {name_col}, price_per_cm3 FROM materials WHERE id = %s", (material_id,))
  67. mat_name = mat_info[0][name_col] if mat_info else "Unknown"
  68. mat_price = mat_info[0]['price_per_cm3'] if mat_info else 0.0
  69. file_sizes = []
  70. if parsed_ids:
  71. format_strings = ','.join(['%s'] * len(parsed_ids))
  72. file_rows = db.execute_query(f"SELECT file_size FROM order_files WHERE id IN ({format_strings})", tuple(parsed_ids))
  73. file_sizes = [r['file_size'] for r in file_rows]
  74. estimated_price, item_prices = pricing.calculate_estimated_price(material_id, file_sizes, parsed_quantities if parsed_quantities else None, return_details=True)
  75. # Snapshoting initial parameters
  76. original_params = json.dumps({
  77. "material_name": mat_name,
  78. "material_price": float(mat_price) if mat_price is not None else 0.0,
  79. "estimated_price": float(estimated_price) if estimated_price is not None else 0.0,
  80. "quantity": quantity,
  81. "color_name": color_name,
  82. "notes": notes,
  83. "first_name": first_name,
  84. "last_name": last_name,
  85. "phone": phone,
  86. "email": email,
  87. "shipping_address": shipping_address,
  88. "model_link": model_link,
  89. "is_company": is_company,
  90. "company_name": company_name,
  91. "company_pib": company_pib,
  92. "company_address": company_address
  93. })
  94. order_query = """
  95. INSERT INTO orders (user_id, material_id, first_name, last_name, phone, email, shipping_address, model_link, status, is_company, company_name, company_pib, company_address, allow_portfolio, estimated_price, material_name, material_price, color_name, quantity, notes, original_params)
  96. VALUES (%s, %s, %s, %s, %s, %s, %s, %s, 'pending', %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
  97. """
  98. order_params = (user_id, material_id, first_name, last_name, phone, email, shipping_address, model_link, is_company, company_name, company_pib, company_address, allow_portfolio, estimated_price, mat_name, mat_price, color_name, quantity, notes, original_params)
  99. try:
  100. order_insert_id = db.execute_commit(order_query, order_params)
  101. if parsed_ids:
  102. for idx, f_id in enumerate(parsed_ids):
  103. qty = parsed_quantities[idx] if idx < len(parsed_quantities) else 1
  104. unit_p = item_prices[idx] if idx < len(item_prices) else 0.0
  105. db.execute_commit("UPDATE order_files SET order_id = %s, quantity = %s, unit_price = %s WHERE id = %s", (order_insert_id, qty, unit_p, f_id))
  106. # Create corresponding fixed order item
  107. file_row = db.execute_query("SELECT filename FROM order_files WHERE id = %s", (f_id,))
  108. fname = file_row[0]['filename'] if file_row else f"File #{f_id}"
  109. db.execute_commit(
  110. "INSERT INTO order_items (order_id, description, quantity, unit_price, total_price) VALUES (%s, %s, %s, %s, %s)",
  111. (order_insert_id, f"3D Print: {fname}", qty, unit_p, round(qty * unit_p, 2))
  112. )
  113. background_tasks.add_task(order_processing.process_order_slicing, order_insert_id)
  114. background_tasks.add_task(event_hooks.on_order_created, order_insert_id)
  115. # LOG ACTION
  116. await audit_service.log(
  117. user_id=user_id or 0,
  118. action="order_created",
  119. target_type="order",
  120. target_id=order_insert_id,
  121. details={
  122. "email": email_addr,
  123. "mat_id": material_id,
  124. "price": float(estimated_price) if estimated_price is not None else 0.0,
  125. "quantity": quantity
  126. }
  127. )
  128. # Record placement for rate limiting
  129. rate_limit_service.record_order_placement(email_addr, ip)
  130. return {"status": "success", "order_id": order_insert_id, "message": "Order submitted successfully"}
  131. except Exception as e:
  132. print(f"Error creating order: {e}")
  133. raise HTTPException(status_code=500, detail="Internal server error occurred while processing order")
  134. @router.get("/my")
  135. async def get_my_orders(
  136. page: int = 1,
  137. size: int = 10,
  138. user: dict = Depends(get_current_user)
  139. ):
  140. user_id = user.get("id")
  141. offset = (page - 1) * size
  142. # Get total count
  143. count_query = "SELECT COUNT(*) as total FROM orders WHERE user_id = %s"
  144. count_res = db.execute_query(count_query, (user_id,))
  145. total = count_res[0]['total'] if count_res else 0
  146. query = """
  147. SELECT o.*,
  148. (SELECT count(*) FROM order_messages om WHERE om.order_id = o.id AND om.is_from_admin = TRUE AND om.is_read = FALSE) as unread_count,
  149. GROUP_CONCAT(IF(f.id IS NOT NULL, JSON_OBJECT('id', f.id, 'filename', f.filename, 'file_path', f.file_path, 'quantity', f.quantity, 'preview_path', f.preview_path, 'print_time', f.print_time, 'filament_g', f.filament_g), NULL)) as files
  150. FROM orders o
  151. LEFT JOIN order_files f ON o.id = f.order_id
  152. WHERE o.user_id = %s
  153. GROUP BY o.id
  154. ORDER BY
  155. CASE
  156. WHEN status IN ('pending', 'processing', 'shipped') THEN 0
  157. ELSE 1
  158. END ASC,
  159. o.created_at DESC
  160. LIMIT %s OFFSET %s
  161. """
  162. results = db.execute_query(query, (user_id, size, offset))
  163. for row in results:
  164. if row['files']:
  165. try: row['files'] = json.loads(f"[{row['files']}]")
  166. except: row['files'] = []
  167. else: row['files'] = []
  168. row['items'] = db.execute_query("SELECT * FROM order_items WHERE order_id = %s", (row['id'],))
  169. return {"orders": results, "total": total}
  170. @router.post("/{order_id}/review")
  171. async def post_order_review(order_id: int, review: schemas.OrderReview, user: dict = Depends(get_current_user)):
  172. # Check if order belongs to user and is in appropriate status
  173. order = db.execute_query("SELECT id, status FROM orders WHERE id = %s AND user_id = %s", (order_id, user['id']))
  174. if not order:
  175. raise HTTPException(status_code=404, detail="Order not found or access denied")
  176. if order[0]['status'] not in ['shipped', 'completed']:
  177. raise HTTPException(status_code=400, detail="Reviews can only be posted for shipped or completed orders")
  178. db.execute_commit(
  179. "UPDATE orders SET review_text = %s, rating = %s, review_approved = FALSE WHERE id = %s",
  180. (review.review_text, review.rating, order_id)
  181. )
  182. # Create audit log
  183. await audit_service.log(user['id'], "ORDER_REVIEW", f"Posted review for order {order_id}", order_id)
  184. return {"message": "Review submitted successfully and is awaiting moderation"}
  185. @router.patch("/{order_id}/review/approve")
  186. async def approve_order_review(order_id: int, admin: dict = Depends(require_admin)):
  187. db.execute_commit("UPDATE orders SET review_approved = TRUE WHERE id = %s", (order_id,))
  188. await audit_service.log(admin['id'], "ORDER_REVIEW_APPROVE", f"Approved review for order {order_id}", order_id)
  189. return {"message": "Review approved successfully"}
  190. @router.get("/reviews/public", response_model=List[schemas.PublicReview])
  191. async def get_public_reviews():
  192. # Only return approved reviews, anonymized (strictly only the first word of the first name)
  193. query = "SELECT SUBSTRING_INDEX(first_name, ' ', 1) as first_name, rating, review_text FROM orders WHERE review_approved = TRUE ORDER BY created_at DESC LIMIT 10"
  194. return db.execute_query(query)
  195. @router.post("/estimate")
  196. async def get_price_estimate(data: schemas.EstimateRequest):
  197. material = db.execute_query("SELECT price_per_cm3 FROM materials WHERE id = %s", (data.material_id,))
  198. price_per_cm3 = float(material[0]['price_per_cm3']) if material else 0.0
  199. file_prices = []
  200. base_fee = 5.0
  201. for size in data.file_sizes:
  202. total_size_mb = size / (1024 * 1024)
  203. estimated_volume = total_size_mb * 8.0
  204. file_cost = base_fee + (estimated_volume * price_per_cm3)
  205. file_prices.append(round(file_cost, 2))
  206. qts = data.file_quantities if data.file_quantities else [1]*len(data.file_sizes)
  207. return {"file_prices": file_prices, "total_estimate": round(sum(p * q for p, q in zip(file_prices, qts)), 2)}
  208. # --- ADMIN ORDER ENDPOINTS ---
  209. @router.get("/admin/list") # Using /admin/list to avoid conflict with /my
  210. async def get_admin_orders(
  211. search: Optional[str] = None,
  212. status: Optional[str] = None,
  213. date_from: Optional[str] = None,
  214. date_to: Optional[str] = None,
  215. admin: dict = Depends(require_admin)
  216. ):
  217. where_clauses = []
  218. params = []
  219. if search:
  220. search_term = f"%{search}%"
  221. where_clauses.append("(o.id LIKE %s OR o.email LIKE %s OR o.first_name LIKE %s OR o.last_name LIKE %s OR o.company_name LIKE %s OR o.phone LIKE %s OR o.shipping_address LIKE %s)")
  222. params.extend([search_term] * 7)
  223. if status and status != 'all':
  224. where_clauses.append("o.status = %s")
  225. params.append(status)
  226. if date_from:
  227. where_clauses.append("o.created_at >= %s")
  228. params.append(date_from)
  229. if date_to:
  230. where_clauses.append("o.created_at <= %s")
  231. params.append(date_to)
  232. where_sql = f"WHERE {' AND '.join(where_clauses)}" if where_clauses else ""
  233. query = f"""
  234. SELECT o.*, u.can_chat, COALESCE(o.total_price, o.estimated_price) AS invoice_amount,
  235. (SELECT count(*) FROM order_messages om WHERE om.order_id = o.id AND om.is_from_admin = FALSE AND om.is_read = FALSE) as unread_count,
  236. GROUP_CONCAT(IF(f.id IS NOT NULL, JSON_OBJECT('id', f.id, 'filename', f.filename, 'file_path', f.file_path, 'file_size', f.file_size, 'quantity', f.quantity, 'preview_path', f.preview_path, 'print_time', f.print_time, 'filament_g', f.filament_g), NULL)) as files
  237. FROM orders o
  238. LEFT JOIN users u ON o.user_id = u.id
  239. LEFT JOIN order_files f ON o.id = f.order_id
  240. {where_sql}
  241. GROUP BY o.id
  242. ORDER BY o.created_at DESC
  243. """
  244. results = db.execute_query(query, tuple(params))
  245. import session_utils
  246. for row in results:
  247. row['is_online'] = session_utils.is_user_online(row['user_id']) if row.get('user_id') else False
  248. if row['files']:
  249. try: row['files'] = json.loads(f"[{row['files']}]")
  250. except: row['files'] = []
  251. else: row['files'] = []
  252. row['items'] = db.execute_query("SELECT * FROM order_items WHERE order_id = %s", (row['id'],))
  253. photos = db.execute_query("SELECT id, file_path, is_public FROM order_photos WHERE order_id = %s", (row['id'],))
  254. row['photos'] = photos
  255. return results
  256. @router.patch("/{order_id}")
  257. async def update_order(
  258. order_id: int,
  259. data: schemas.AdminOrderUpdate,
  260. background_tasks: BackgroundTasks,
  261. admin: dict = Depends(require_admin)
  262. ):
  263. print(f"DEBUG: update_order {order_id} - payload: {data.model_dump(exclude_unset=True)}")
  264. order_info = db.execute_query("SELECT * FROM orders WHERE id = %s", (order_id,))
  265. if not order_info: raise HTTPException(status_code=404, detail="Order not found")
  266. update_fields = []
  267. params = []
  268. if data.status:
  269. if order_info:
  270. background_tasks.add_task(
  271. event_hooks.on_order_status_changed,
  272. order_id,
  273. data.status,
  274. order_info[0],
  275. data.send_notification
  276. )
  277. # Generate Payment Documents based on status transitions
  278. from services.invoice_service import InvoiceService
  279. o = order_info[0]
  280. price_val = data.total_price if data.total_price is not None else (o.get('total_price') or o.get('estimated_price') or 0)
  281. price = float(price_val)
  282. # 1. Proforma / Payment Slip (on 'processing' or any initial active state)
  283. if data.status in ['processing', 'shipped']:
  284. try:
  285. if o.get('is_company'):
  286. pdf_path = InvoiceService.generate_document(o, doc_type="predracun", override_price=price)
  287. else:
  288. payer_name = f"{o['first_name']} {o.get('last_name', '')}".strip()
  289. pdf_path = InvoiceService.generate_uplatnica(order_id, payer_name, o.get('shipping_address', ''), price)
  290. update_fields.append("proforma_path = %s")
  291. params.append(pdf_path)
  292. except Exception as e:
  293. print(f"Failed to generate proforma: {e}")
  294. # 2. Final Invoice (only on 'shipped')
  295. if data.status == 'shipped':
  296. try:
  297. pdf_path = InvoiceService.generate_document(o, doc_type="faktura", override_price=price)
  298. update_fields.append("invoice_path = %s")
  299. params.append(pdf_path)
  300. except Exception as e:
  301. print(f"Failed to generate final invoice: {e}")
  302. if data.status:
  303. update_fields.append("status = %s")
  304. params.append(data.status)
  305. if data.total_price is not None:
  306. update_fields.append("total_price = %s")
  307. params.append(data.total_price)
  308. # Sync estimated_price as well to ensure display consistency in all views
  309. update_fields.append("estimated_price = %s")
  310. params.append(data.total_price)
  311. if data.material_id is not None:
  312. update_fields.append("material_id = %s")
  313. params.append(data.material_id)
  314. # Also update snapshot names and prices from handbook
  315. mat_info = db.execute_query("SELECT name_en, price_per_cm3 FROM materials WHERE id = %s", (data.material_id,))
  316. if mat_info:
  317. update_fields.append("material_name = %s")
  318. params.append(mat_info[0]['name_en'])
  319. update_fields.append("material_price = %s")
  320. params.append(mat_info[0]['price_per_cm3'])
  321. elif data.material_name is not None:
  322. update_fields.append("material_name = %s")
  323. params.append(data.material_name)
  324. if data.color_name is not None:
  325. update_fields.append("color_name = %s")
  326. params.append(data.color_name)
  327. if data.quantity is not None:
  328. update_fields.append("quantity = %s")
  329. params.append(data.quantity)
  330. if data.fiscal_qr_url is not None:
  331. update_fields.append("fiscal_qr_url = %s")
  332. params.append(data.fiscal_qr_url)
  333. # Auto-set fiscalized_at if adding URL for the first time
  334. if order_info[0].get('fiscalized_at') is None:
  335. update_fields.append("fiscalized_at = %s")
  336. params.append(datetime.now())
  337. if data.ikof is not None:
  338. update_fields.append("ikof = %s")
  339. params.append(data.ikof)
  340. if data.jikr is not None:
  341. update_fields.append("jikr = %s")
  342. params.append(data.jikr)
  343. if data.first_name is not None:
  344. update_fields.append("first_name = %s")
  345. params.append(data.first_name)
  346. if data.last_name is not None:
  347. update_fields.append("last_name = %s")
  348. params.append(data.last_name)
  349. if data.email is not None:
  350. update_fields.append("email = %s")
  351. params.append(data.email)
  352. if data.phone is not None:
  353. update_fields.append("phone = %s")
  354. params.append(data.phone)
  355. if data.shipping_address is not None:
  356. update_fields.append("shipping_address = %s")
  357. params.append(data.shipping_address)
  358. if data.notes is not None:
  359. update_fields.append("notes = %s")
  360. params.append(data.notes)
  361. if data.review_text is not None:
  362. update_fields.append("review_text = %s")
  363. params.append(data.review_text)
  364. if data.rating is not None:
  365. update_fields.append("rating = %s")
  366. params.append(data.rating)
  367. if data.review_approved is not None:
  368. update_fields.append("review_approved = %s")
  369. params.append(data.review_approved)
  370. if update_fields:
  371. query = f"UPDATE orders SET {', '.join(update_fields)} WHERE id = %s"
  372. params.append(order_id)
  373. db.execute_commit(query, tuple(params))
  374. # LOG ACTION
  375. await audit_service.log(
  376. user_id=admin.get("id"),
  377. action="update_order",
  378. target_type="order",
  379. target_id=order_id,
  380. details={"updated_fields": {k.split(" = ")[0]: v for k, v in zip(update_fields, params)}}
  381. )
  382. # NOTIFY USER VIA WEBSOCKET
  383. await global_manager.notify_order_update(order_info[0]['user_id'], order_id)
  384. return {"id": order_id, "status": "updated"}
  385. @router.post("/{order_id}/attach-file")
  386. async def admin_attach_file(
  387. order_id: int,
  388. file: UploadFile = File(...),
  389. admin: dict = Depends(require_admin)
  390. ):
  391. unique_filename = f"{uuid.uuid4()}{os.path.splitext(file.filename)[1]}"
  392. file_path = os.path.join(config.UPLOAD_DIR, unique_filename)
  393. db_file_path = f"uploads/{unique_filename}"
  394. sha256_hash = hashlib.sha256()
  395. with open(file_path, "wb") as buffer:
  396. while chunk := file.file.read(8192):
  397. sha256_hash.update(chunk)
  398. buffer.write(chunk)
  399. preview_path = None
  400. db_preview_path = None
  401. if file_path.lower().endswith(".stl"):
  402. preview_filename = f"{uuid.uuid4()}.png"
  403. preview_path = os.path.join(config.PREVIEW_DIR, preview_filename)
  404. db_preview_path = f"uploads/previews/{preview_filename}"
  405. preview_utils.generate_stl_preview(file_path, preview_path)
  406. filament_g = None
  407. print_time = None
  408. if file_path.lower().endswith(".stl"):
  409. result = slicer_utils.slice_model(file_path)
  410. if result and result.get('success'):
  411. filament_g = result.get('filament_g')
  412. print_time = result.get('print_time_str')
  413. query = "INSERT INTO order_files (order_id, filename, file_path, file_size, quantity, file_hash, print_time, filament_g, preview_path) VALUES (%s, %s, %s, %s, 1, %s, %s, %s, %s)"
  414. f_id = db.execute_commit(query, (order_id, file.filename, db_file_path, file.size, sha256_hash.hexdigest(), print_time, filament_g, db_preview_path))
  415. # NOTIFY USER VIA WEBSOCKET
  416. order_info = db.execute_query("SELECT user_id FROM orders WHERE id = %s", (order_id,))
  417. if order_info:
  418. await global_manager.notify_order_update(order_info[0]['user_id'], order_id)
  419. return {"file_id": f_id, "filename": file.filename, "preview_path": db_preview_path, "filament_g": filament_g, "print_time": print_time}
  420. @router.delete("/{order_id}/files/{file_id}")
  421. async def admin_delete_file(
  422. order_id: int,
  423. file_id: int,
  424. admin: dict = Depends(require_admin)
  425. ):
  426. file_record = db.execute_query("SELECT file_path, preview_path FROM order_files WHERE id = %s AND order_id = %s", (file_id, order_id))
  427. if not file_record:
  428. raise HTTPException(status_code=404, detail="File not found")
  429. base_dir = config.BASE_DIR
  430. try:
  431. if file_record[0]['file_path']:
  432. os.remove(os.path.join(base_dir, file_record[0]['file_path']))
  433. if file_record[0]['preview_path']:
  434. os.remove(os.path.join(base_dir, file_record[0]['preview_path']))
  435. except Exception as e:
  436. print(f"Error removing file from disk: {e}")
  437. db.execute_commit("DELETE FROM order_files WHERE id = %s AND order_id = %s", (file_id, order_id))
  438. # LOG ACTION
  439. await audit_service.log(
  440. user_id=admin.get("id"),
  441. action="delete_order_file",
  442. target_type="order",
  443. target_id=order_id,
  444. details={"file_id": file_id}
  445. )
  446. # NOTIFY USER VIA WEBSOCKET
  447. order_info = db.execute_query("SELECT user_id FROM orders WHERE id = %s", (order_id,))
  448. if order_info:
  449. await global_manager.notify_order_update(order_info[0]['user_id'], order_id)
  450. return {"status": "success"}
  451. class OrderItemSchema(BaseModel):
  452. description: str
  453. quantity: int
  454. unit_price: float
  455. @router.get("/{order_id}/items")
  456. async def get_order_items(order_id: int):
  457. items = db.execute_query("SELECT * FROM order_items WHERE order_id = %s", (order_id,))
  458. return items
  459. @router.put("/{order_id}/items")
  460. async def update_order_items(order_id: int, items: List[OrderItemSchema], admin: dict = Depends(require_admin)):
  461. db.execute_commit("DELETE FROM order_items WHERE order_id = %s", (order_id,))
  462. total_order_price = 0
  463. items_summary = []
  464. for item in items:
  465. tot_p = round(item.quantity * item.unit_price, 2)
  466. total_order_price += tot_p
  467. db.execute_commit(
  468. "INSERT INTO order_items (order_id, description, quantity, unit_price, total_price) VALUES (%s, %s, %s, %s, %s)",
  469. (order_id, item.description, item.quantity, item.unit_price, tot_p)
  470. )
  471. items_summary.append(item.dict())
  472. # Sync main order total_price
  473. db.execute_commit("UPDATE orders SET total_price = %s WHERE id = %s", (total_order_price, order_id))
  474. # LOG ACTION
  475. await audit_service.log(
  476. user_id=admin.get("id"),
  477. action="update_order_items",
  478. target_type="order",
  479. target_id=order_id,
  480. details={"total_price": total_order_price, "items": items_summary}
  481. )
  482. # NOTIFY USER VIA WEBSOCKET
  483. order_info = db.execute_query("SELECT user_id FROM orders WHERE id = %s", (order_id,))
  484. if order_info:
  485. await global_manager.notify_order_update(order_info[0]['user_id'], order_id)
  486. return {"status": "success", "total_price": total_order_price}
  487. @router.delete("/{order_id}/admin")
  488. async def delete_order_admin(
  489. order_id: int,
  490. admin: dict = Depends(require_admin)
  491. ):
  492. # Fetch user_id before deletion to notify later
  493. order_info = db.execute_query("SELECT user_id FROM orders WHERE id = %s", (order_id,))
  494. if not order_info: raise HTTPException(status_code=404, detail="Order not found")
  495. customer_id = order_info[0]['user_id']
  496. # 1. Find all related files to delete from disk
  497. files = db.execute_query("SELECT file_path, preview_path FROM order_files WHERE order_id = %s", (order_id,))
  498. photos = db.execute_query("SELECT file_path FROM order_photos WHERE order_id = %s", (order_id,))
  499. base_dir = config.BASE_DIR
  500. # Delete order_files from disk
  501. for f in files:
  502. try:
  503. if f.get('file_path'):
  504. fpath = os.path.join(base_dir, f['file_path'])
  505. if os.path.exists(fpath): os.remove(fpath)
  506. if f.get('preview_path'):
  507. ppath = os.path.join(base_dir, f['preview_path'])
  508. if os.path.exists(ppath): os.remove(ppath)
  509. except Exception as e:
  510. print(f"Error deleting order file {f.get('file_path')}: {e}")
  511. # Delete photos from disk
  512. for p in photos:
  513. try:
  514. if p.get('file_path'):
  515. fpath = os.path.join(base_dir, p['file_path'])
  516. if os.path.exists(fpath): os.remove(fpath)
  517. except Exception as e:
  518. print(f"Error deleting order photo {p.get('file_path')}: {e}")
  519. # 2. Delete from DB tables (due to possible lack of CASCADE or to be explicit)
  520. try:
  521. db.execute_commit("DELETE FROM order_messages WHERE order_id = %s", (order_id,))
  522. db.execute_commit("DELETE FROM order_items WHERE order_id = %s", (order_id,))
  523. db.execute_commit("DELETE FROM order_files WHERE order_id = %s", (order_id,))
  524. db.execute_commit("DELETE FROM order_photos WHERE order_id = %s", (order_id,))
  525. db.execute_commit("DELETE FROM orders WHERE id = %s", (order_id,))
  526. # LOG ACTION
  527. await audit_service.log(
  528. user_id=admin.get("id"),
  529. action="delete_order_entirely",
  530. target_type="order",
  531. target_id=order_id,
  532. details={"order_id": order_id}
  533. )
  534. # NOTIFY USER VIA WEBSOCKET
  535. await global_manager.notify_order_update(customer_id, order_id)
  536. return {"status": "success", "message": f"Order {order_id} deleted entirely"}
  537. except Exception as e:
  538. print(f"Failed to delete order {order_id}: {e}")
  539. raise HTTPException(status_code=500, detail=str(e))