validate getPO

app/Http/Controllers/InvoiceController.php

@@ -293,18 +293,76 @@ class InvoiceController extends Controller
 
     }
 
-    public function getPO($id)
+    public function getPO(Request $request, $id)
     {
+        // Booking Exist and Belongs to User or is Admin
+        if ($request->user()->role === 'member') {
+            if (!$this->isUser($id, $request->user()->id)) {
+                return response()->json(['message' => 'The PO Does not belongs to you.'], 403);
+            }
+        }
 
+        // Ensure Invoice Status is Approve
+        if ($this->invoiceStatus($id) !== 'approve') {
+            return response()->json(['message' => 'Invoice must and exist and approve status.'], 403);
+        }
+
+        // Generate PO
+
+        // Send
+        return response()->json(['message' => 'successful'], 200);
     }
 
     public function getDO($id)
     {
+        // Ensure Invoice Exist and Completed
+
+        // Generate PO
+
+        // Send
 
     }
 
     public function getSupplierDO($id)
     {
+        // Only Admin Can get Supplier DO
 
+        // Ensure Invoice Exist and Completed
+
+        // Generate PO
+
+        // Send
+    }
+
+    // private invoiceExist($id)
+    // {
+        
+    // }
+
+    // private invoiceStatus($id) {
+
+    // }
+
+    private function isUser($booking_id, $user_id) {
+        
+        $booking = Booking::where([
+            ['id', '=', $booking_id],
+            ['user_id', '=', $user_id]
+        ])->first();
+        
+        if ($booking) {
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    private function invoiceStatus($booking_id) {
+        $invoice = Invoice::where('booking_id', $booking_id).first();
+        if (!$invoice) {
+            return
+        }
+        $currentstatus = InvoiceStatuses::where('invoice_id', $invoice['id'])->latest('created_at')->first()->status;
+        return $currentstatus;
     }
 }