File manager

File manager - Edit - /home/webapp69.cm.in.th/u69319090006/shop/api/orders.php

Back
<?php require_once __DIR__ . '/../config/db.php'; $action = $_GET['action'] ?? 'list'; $user = requireAuth(['client', 'seller', 'admin']); // 1. GET: Orders List if ($action === 'list' && $_SERVER['REQUEST_METHOD'] === 'GET') { $sql = "SELECT o.* FROM orders o"; $params = []; if ($user['role'] === 'seller') { $sql .= " WHERE EXISTS (SELECT 1 FROM order_items oi WHERE oi.order_id = o.id AND oi.seller_id = :sid)"; $params['sid'] = $user['id']; } elseif ($user['role'] === 'client') { $sql .= " WHERE o.customer_id = :cid"; $params['cid'] = $user['id']; } $sql .= " ORDER BY o.created_at DESC"; $stmt = $pdo->prepare($sql); $stmt->execute($params); $orders = $stmt->fetchAll(); if (!empty($orders)) { $orderIds = array_column($orders, 'id'); $inClause = implode(',', array_fill(0, count($orderIds), '?')); $itemStmt = $pdo->prepare("SELECT id, order_id, product_id, variant_id, seller_id, product_name, variant_name, price, quantity, total FROM order_items WHERE order_id IN ($inClause)"); $itemStmt->execute($orderIds); $allItems = $itemStmt->fetchAll(); $itemsByOrder = []; foreach ($allItems as $item) { $itemsByOrder[$item['order_id']][] = $item; } foreach ($orders as &$ord) { $ord['items'] = $itemsByOrder[$ord['id']] ?? []; $ord['tracking_numbers'] = json_decode($ord['tracking_numbers'] ?? '{}', true) ?: (object)[]; } } sendResponse(true, ['data' => $orders]); } // 2. POST: Create Order (Checkout) if ($action === 'create' && $_SERVER['REQUEST_METHOD'] === 'POST') { $pdo->beginTransaction(); try { $orderId = "ORD-" . date("Ymd") . "-" . rand(1000, 9999); $name = $_POST['customer_name'] ?? $user['name']; $phone = $_POST['customer_phone'] ?? ''; $address = $_POST['shipping_address'] ?? ''; $paymentMethod = $_POST['payment_method'] ?? 'PromptPay'; $subtotal = (float)($_POST['subtotal'] ?? 0); $discount = (float)($_POST['discount'] ?? 0); $total = (float)($_POST['total'] ?? 0); $couponCode = $_POST['coupon_code'] ?? null; $items = json_decode($_POST['items'] ?? '[]', true); if (empty($items)) { sendResponse(false, 'ไม่มีสินค้าในคำสั่งซื้อ', 400); } // Upload Slip File $slipPath = null; if (!empty($_FILES['slip']['name']) && $_FILES['slip']['error'] === UPLOAD_ERR_OK) { $uploadDir = __DIR__ . '/../uploads/slips/'; if (!is_dir($uploadDir)) mkdir($uploadDir, 0777, true); $ext = strtolower(pathinfo($_FILES['slip']['name'], PATHINFO_EXTENSION)); if (in_array($ext, ['jpg', 'jpeg', 'png', 'webp', 'pdf'])) { $filename = "slip_{$orderId}_" . uniqid() . ".{$ext}"; if (move_uploaded_file($_FILES['slip']['tmp_name'], $uploadDir . $filename)) { $slipPath = 'uploads/slips/' . $filename; } } } $stmt = $pdo->prepare("INSERT INTO orders (id, customer_id, customer_name, customer_phone, shipping_address, subtotal, discount, coupon_code, total, payment_method, slip_image, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); $stmt->execute([$orderId, $user['id'], $name, $phone, $address, $subtotal, $discount, $couponCode, $total, $paymentMethod, $slipPath, 'Pending']); $itemStmt = $pdo->prepare("INSERT INTO order_items (order_id, product_id, variant_id, seller_id, product_name, variant_name, price, quantity, total) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"); foreach ($items as $item) { $itemStmt->execute([ $orderId, $item['productId'] ?? $item['id'], $item['variantId'] ?? null, $item['sellerId'] ?? 1, $item['name'] ?? 'Product', $item['variantName'] ?? null, $item['price'] ?? 0, $item['quantity'] ?? 1, ($item['price'] ?? 0) * ($item['quantity'] ?? 1) ]); // Deduct stock if (!empty($item['variantId'])) { $pdo->prepare("UPDATE product_variants SET stock = GREATEST(0, stock - ?) WHERE id = ?")->execute([$item['quantity'] ?? 1, $item['variantId']]); } elseif (!empty($item['productId'])) { $pdo->prepare("UPDATE products SET stock = GREATEST(0, stock - ?) WHERE id = ?")->execute([$item['quantity'] ?? 1, $item['productId']]); } } $pdo->commit(); sendResponse(true, ['message' => 'สั่งซื้อสินค้าสำเร็จ', 'order_id' => $orderId]); } catch (Exception $e) { $pdo->rollBack(); sendResponse(false, $e->getMessage(), 500); } } // 3. POST: Verify Slip (Admin Only) if ($action === 'verify_slip' && $_SERVER['REQUEST_METHOD'] === 'POST') { requireAuth(['admin']); $body = getJsonInput(); $orderId = $body['order_id'] ?? ''; $status = $body['status'] ?? ''; // 'Paid' or 'Failed' $rejectReason = $body['reject_reason'] ?? null; if (!$orderId \|\| !in_array($status, ['Paid', 'Failed'])) { sendResponse(false, 'ข้อมูลไม่ถูกต้อง', 400); } $sql = "UPDATE orders SET status = :status, reject_reason = :reject_reason, cancel_reason = :cancel_reason WHERE id = :id"; $stmt = $pdo->prepare($sql); $stmt->execute([ 'status' => $status, 'reject_reason' => $status === 'Failed' ? $rejectReason : null, 'cancel_reason' => $status === 'Failed' ? "ปฏิเสธสลิป: {$rejectReason}" : null, 'id' => $orderId ]); sendResponse(true, "อัปเดตสถานะออเดอร์ {$orderId} เป็น {$status} เรียบร้อย"); } // 4. POST: Update Tracking Number (Admin/Seller) if ($action === 'update_tracking' && $_SERVER['REQUEST_METHOD'] === 'POST') { requireAuth(['admin', 'seller']); $body = getJsonInput(); $orderId = $body['order_id'] ?? ''; $sellerKey = (string)($body['seller_id'] ?? $user['id']); $trackingNo = trim($body['tracking_number'] ?? ''); $stmt = $pdo->prepare("SELECT tracking_numbers FROM orders WHERE id = ?"); $stmt->execute([$orderId]); $order = $stmt->fetch(); if (!$order) sendResponse(false, 'ไม่พบออเดอร์', 404); $trackingObj = json_decode($order['tracking_numbers'] ?? '{}', true) ?: []; $trackingObj[$sellerKey] = $trackingNo; $updateStmt = $pdo->prepare("UPDATE orders SET tracking_numbers = :tracking, status = 'Shipped' WHERE id = :id"); $updateStmt->execute([ 'tracking' => json_encode($trackingObj), 'id' => $orderId ]); sendResponse(true, 'บันทึกเลขพัสดุเรียบร้อย'); }

| ver. 1.4 | Github | . | PHP 7.4.33 | Generation time: 0.24 | proxy | phpinfo | Settings