|
10 | 10 | use App\Exceptions\Api\OverlappingTimeEntryApiException; |
11 | 11 | use App\Exceptions\Api\PdfRendererIsNotConfiguredException; |
12 | 12 | use App\Exceptions\Api\TimeEntryCanNotBeRestartedApiException; |
| 13 | +use App\Exceptions\Api\TimeEntryInvoicedApiException; |
13 | 14 | use App\Exceptions\Api\TimeEntryStillRunningApiException; |
14 | 15 | use App\Http\Requests\V1\TimeEntry\TimeEntryAggregateExportRequest; |
15 | 16 | use App\Http\Requests\V1\TimeEntry\TimeEntryAggregateRequest; |
@@ -101,6 +102,11 @@ protected function checkPermission(Organization $organization, string $permissio |
101 | 102 | if ($timeEntry !== null && $timeEntry->organization_id !== $organization->getKey()) { |
102 | 103 | throw new AuthorizationException('Time entry does not belong to organization'); |
103 | 104 | } |
| 105 | + if ($timeEntry !== null && $timeEntry->invoiced_at !== null) { |
| 106 | + if (in_array($permission, ['time-entries:update:own', 'time-entries:update:all', 'time-entries:delete:own', 'time-entries:delete:all'], true)) { |
| 107 | + throw new TimeEntryInvoicedApiException; |
| 108 | + } |
| 109 | + } |
104 | 110 | } |
105 | 111 |
|
106 | 112 | /** |
@@ -628,9 +634,9 @@ public function update(Organization $organization, TimeEntry $timeEntry, TimeEnt |
628 | 634 | /** @var Member|null $member */ |
629 | 635 | $member = $request->has('member_id') ? Member::query()->findOrFail($request->input('member_id')) : null; |
630 | 636 | if ($timeEntry->member->user_id === Auth::id() && ($member === null || $member->user_id === Auth::id())) { |
631 | | - $this->checkPermission($organization, 'time-entries:update:own'); |
| 637 | + $this->checkPermission($organization, 'time-entries:update:own', $timeEntry); |
632 | 638 | } else { |
633 | | - $this->checkPermission($organization, 'time-entries:update:all'); |
| 639 | + $this->checkPermission($organization, 'time-entries:update:all', $timeEntry); |
634 | 640 | } |
635 | 641 |
|
636 | 642 | if ($timeEntry->end !== null && $request->has('end') && $request->input('end') === null) { |
@@ -744,6 +750,11 @@ public function updateMultiple(Organization $organization, TimeEntryUpdateMultip |
744 | 750 | continue; |
745 | 751 |
|
746 | 752 | } |
| 753 | + if ($timeEntry->invoiced_at !== null) { |
| 754 | + $error->push($id); |
| 755 | + |
| 756 | + continue; |
| 757 | + } |
747 | 758 | $oldProject = $timeEntry->project; |
748 | 759 | $oldTask = $timeEntry->task; |
749 | 760 |
|
@@ -851,6 +862,11 @@ public function destroyMultiple(Organization $organization, TimeEntryDestroyMult |
851 | 862 | continue; |
852 | 863 |
|
853 | 864 | } |
| 865 | + if ($timeEntry->invoiced_at !== null) { |
| 866 | + $error->push($id); |
| 867 | + |
| 868 | + continue; |
| 869 | + } |
854 | 870 |
|
855 | 871 | $project = $timeEntry->project; |
856 | 872 | $task = $timeEntry->task; |
|
0 commit comments