HartmutandClaude Sonnet 4.6
b69190dd86
H2: list_invoices now passes tenant_id (from current_user) to get_invoices;
get_invoices applies WHERE tenant_id filter for non-global-admin users;
get_invoice_endpoint returns 404 when tenant mismatch for non-admins.
H3: InvoiceStatusUpdate.status changed to Literal["draft","sent","paid","cancelled"]
for schema-level validation; guard also added in update_invoice_status service.
H5: _settings_to_out masks smtp_password as "***" when set, "" when empty;
update_settings skips writing when value is the "***" sentinel.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
112 lines
3.8 KiB
Python
112 lines
3.8 KiB
Python
"""Billing router — Invoice CRUD + PDF."""
|
|
from __future__ import annotations
|
|
import uuid
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from fastapi.responses import Response
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.database import get_db
|
|
from app.utils.auth import require_admin_or_pm, _role_value
|
|
from app.domains.auth.models import ADMIN_ROLES
|
|
from app.domains.billing.schemas import InvoiceCreate, InvoiceOut, InvoiceStatusUpdate
|
|
from app.domains.billing.service import (
|
|
create_invoice, get_invoices, get_invoice,
|
|
update_invoice_status, delete_invoice, render_pdf,
|
|
)
|
|
|
|
# Keep the old pricing router re-export for backward compat
|
|
from app.api.routers.pricing import router as pricing_router
|
|
|
|
invoice_router = APIRouter(prefix="/billing", tags=["billing"])
|
|
|
|
|
|
@invoice_router.get("/invoices", response_model=list[InvoiceOut])
|
|
async def list_invoices(
|
|
skip: int = 0,
|
|
limit: int = 50,
|
|
db: AsyncSession = Depends(get_db),
|
|
current_user=Depends(require_admin_or_pm),
|
|
):
|
|
tenant_id = None if _role_value(current_user) in ADMIN_ROLES else getattr(current_user, "tenant_id", None)
|
|
return await get_invoices(db, tenant_id=tenant_id, skip=skip, limit=limit)
|
|
|
|
|
|
@invoice_router.post("/invoices", response_model=InvoiceOut, status_code=status.HTTP_201_CREATED)
|
|
async def create_invoice_endpoint(
|
|
body: InvoiceCreate,
|
|
db: AsyncSession = Depends(get_db),
|
|
current_user=Depends(require_admin_or_pm),
|
|
):
|
|
tenant_id = getattr(current_user, 'tenant_id', None)
|
|
return await create_invoice(
|
|
db,
|
|
tenant_id=tenant_id,
|
|
order_line_ids=body.order_line_ids,
|
|
notes=body.notes,
|
|
issued_at=body.issued_at,
|
|
due_at=body.due_at,
|
|
vat_rate=body.vat_rate,
|
|
currency=body.currency,
|
|
)
|
|
|
|
|
|
@invoice_router.get("/invoices/{invoice_id}", response_model=InvoiceOut)
|
|
async def get_invoice_endpoint(
|
|
invoice_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db),
|
|
current_user=Depends(require_admin_or_pm),
|
|
):
|
|
inv = await get_invoice(db, invoice_id)
|
|
if not inv:
|
|
raise HTTPException(status_code=404, detail="Invoice not found")
|
|
if _role_value(current_user) not in ADMIN_ROLES:
|
|
user_tenant = getattr(current_user, "tenant_id", None)
|
|
if inv.tenant_id != user_tenant:
|
|
raise HTTPException(status_code=404, detail="Invoice not found")
|
|
return inv
|
|
|
|
|
|
@invoice_router.patch("/invoices/{invoice_id}", response_model=InvoiceOut)
|
|
async def update_invoice_status_endpoint(
|
|
invoice_id: uuid.UUID,
|
|
body: InvoiceStatusUpdate,
|
|
db: AsyncSession = Depends(get_db),
|
|
current_user=Depends(require_admin_or_pm),
|
|
):
|
|
inv = await update_invoice_status(db, invoice_id, body.status)
|
|
if not inv:
|
|
raise HTTPException(status_code=404, detail="Invoice not found")
|
|
return inv
|
|
|
|
|
|
@invoice_router.get("/invoices/{invoice_id}/pdf")
|
|
async def download_invoice_pdf(
|
|
invoice_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db),
|
|
current_user=Depends(require_admin_or_pm),
|
|
):
|
|
key = await render_pdf(db, invoice_id)
|
|
if not key:
|
|
raise HTTPException(status_code=503, detail="PDF generation unavailable (WeasyPrint not installed)")
|
|
from app.core.storage import get_storage
|
|
pdf_bytes = get_storage().download_bytes(key)
|
|
return Response(
|
|
content=pdf_bytes,
|
|
media_type="application/pdf",
|
|
headers={"Content-Disposition": f"attachment; filename=invoice-{invoice_id}.pdf"},
|
|
)
|
|
|
|
|
|
@invoice_router.delete("/invoices/{invoice_id}", status_code=status.HTTP_204_NO_CONTENT)
|
|
async def delete_invoice_endpoint(
|
|
invoice_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db),
|
|
current_user=Depends(require_admin_or_pm),
|
|
):
|
|
ok = await delete_invoice(db, invoice_id)
|
|
if not ok:
|
|
raise HTTPException(status_code=400, detail="Only draft invoices can be deleted")
|
|
|
|
|
|
__all__ = ["invoice_router", "pricing_router"]
|