u

src/api/routes/order.js

@@ -1,5 +1,6 @@
 import * as db from '../../db/order.js';
 import { createAndAttachManifestPdf } from '../../services/manifestPdf.js';
+import { emit } from '../sse.js';
 
 // #region Helpers
 
@@ -779,4 +780,88 @@ export function register(app, basePath = '') {
     });
 
     // #endregion
+
+    /**
+     * @openapi
+     * /order/{id}/file/{fileId}:
+     *   delete:
+     *     tags: [Order]
+     *     summary: Delete order file attachment
+     *     description: |
+     *       Removes a file attachment from the order and deletes the underlying file.
+     *     security:
+     *       - cookieAuth: []
+     *     x-signals: [order]
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Order ID
+     *       - in: path
+     *         name: fileId
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: File ID or attachment ID
+     *     responses:
+     *       204:
+     *         description: Attachment deleted
+     *       400:
+     *         description: Invalid parameters or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Order or attachment not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    // #region DELETE /order/:id/file/:fileId
+
+    app.delete(`${basePath}/order/:id/file/:fileId`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const id = Number(req.params.id);
+        if (!Number.isInteger(id) || id <= 0) {
+            return res.status(400).json({ error: 'id is required' });
+        }
+
+        const fileId = Number(req.params.fileId);
+        if (!Number.isInteger(fileId) || fileId <= 0) {
+            return res.status(400).json({ error: 'fileId is required' });
+        }
+
+        try {
+            await db.removeAttachment(req.user.id, id, fileId);
+            emit('order', { companyId: selected.companyId });
+            res.sendStatus(204);
+        } catch (error) {
+            const status = orderErrorStatus(error);
+            if (status === 500) console.error('Delete order attachment failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    // #endregion
 }
+