SidharthPL/Canteen-Management-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refund added

Browse Source
This commit is contained in:
Sidharth Prabhu
2026-06-24 14:06:31 +05:30
parent d325a704cf
commit f915a11eb8
16 changed files with 344 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
backend/src/main/java/com/rit/canteen/sales/config/SecurityConfig.java
View File

@@ -81,6 +81,7 @@ public class SecurityConfig {
.requestMatchers(HttpMethod.POST, "/api/auth/change-pin").authenticated()
.requestMatchers(HttpMethod.PUT, "/api/auth/users/*").authenticated()
.requestMatchers(HttpMethod.PUT, "/api/orders/*").authenticated()
.requestMatchers(HttpMethod.POST, "/api/orders/*/cancel").authenticated()
.requestMatchers("/api/counter/**").hasAnyRole("MASTER", "MANAGER", "STAFF")
// ── STAFF/MANAGER/MASTER: All other management APIs ──

29
backend/src/main/java/com/rit/canteen/sales/controller/OrderController.java
View File

@@ -224,6 +224,35 @@ public class OrderController {
return ResponseEntity.ok(orderRepository.findByUserIdOrderByCreatedAtDesc(userId));
}
@PostMapping("/{id}/cancel")
public ResponseEntity<?> cancelOrder(@PathVariable Long id) {
try {
return orderRepository.findById(id).map(order -> {
// ── SECURITY: Verify ownership of order ──
Long tokenUserId = getTokenUserId();
if (tokenUserId != null && !tokenUserId.equals(order.getUserId()) && !isStaff()) {
return ResponseEntity.status(403).body(Map.of("error", "Access denied"));
}
String oldStatus = order.getStatus();
if ("COMPLETED".equalsIgnoreCase(oldStatus) || "DELIVERED".equalsIgnoreCase(oldStatus) || "CANCELLED".equalsIgnoreCase(oldStatus)) {
return ResponseEntity.status(400).body(Map.of("error", "Cannot cancel an order that is already " + oldStatus));
}
if ("RITZ_TOKEN".equals(order.getPaymentMethod())) {
tokenService.refund(order.getUserId(), "ORD-" + order.getDisplayOrderId(),
order.getTotalAmount(), "Order Cancelled");
}
order.setStatus("CANCELLED");
orderRepository.save(order);
return ResponseEntity.ok(Map.of("success", true, "message", "Order cancelled successfully"));
}).orElse(ResponseEntity.notFound().build());
} catch (Exception e) {
return ResponseEntity.status(500).body(Map.of("error", e.getMessage()));
}
}
// ── STAFF/MASTER: order management ────────────────────────────────────
@PatchMapping("/{id}/status")