feat: additional receipts as attachments to teamer invoices

addresses #869dv97u9

src/Controller/Admin/System/Contact/CreateController.php

@@ -37,13 +37,13 @@ class CreateController extends AbstractController
             /** @var User $user */
             $user = $this->getUser();
 
-            $photo = Upload::fromUploadDto($uploadSession->getUploads()->first(), $user, Upload::TYPE_PHOTO);
+            $photo = Upload::fromUploadDto($uploadSession->getUploadsByType(Upload::TYPE_PHOTO)->first(), $user, Upload::TYPE_PHOTO);
             $contact->setPhoto($photo);
 
             $this->entityManager->flush();
 
             $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_PHOTO, $uploadSession);
-            $this->uploadHandler->destroyUploadSession();
+            $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_PHOTO);
         }
 
         $form = $this->createForm(ContactType::class, $contact, ['upload_session' => $uploadSession]);

src/Controller/Admin/System/Contact/EditController.php

@@ -34,14 +34,14 @@ class EditController extends AbstractController
         if (true === $request->isMethod('POST') && 0 < $uploadSession->getCount()) {
             /** @var User $user */
             $user = $this->getUser();
-            $photo = Upload::fromUploadDto($uploadSession->getUploads()->first(), $user, Upload::TYPE_PHOTO);
+            $photo = Upload::fromUploadDto($uploadSession->getUploadsByType(Upload::TYPE_PHOTO)->first(), $user, Upload::TYPE_PHOTO);
             if (null !== $existingPhoto = $contact->getPhoto()) {
                 $this->entityManager->remove($existingPhoto);
             }
             $contact->setPhoto($photo);
             $this->entityManager->flush();
             $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_PHOTO, $uploadSession);
-            $this->uploadHandler->destroyUploadSession();
+            $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_PHOTO);
         }
 
         $form = $this->createForm(ContactType::class, $contact, ['upload_session' => $uploadSession]);

src/Controller/Administrative/Disposition/DocumentUploadController.php

@@ -89,7 +89,7 @@ class DocumentUploadController extends AbstractController
         $uploadSession = $this->uploadHandler->getUploadSession();
 
         $upload = Upload::fromUploadDto(
-            $uploadSession->getUploads()->first(),
+            $uploadSession->getUploadsByType($type)->first(),
             $teamer->getUser(),
             $type
         );
@@ -113,7 +113,7 @@ class DocumentUploadController extends AbstractController
         $this->entityManager->flush();
 
         $this->uploadHandler->moveUploadSessionFilesFromOrphanage($type, $uploadSession);
-        $this->uploadHandler->destroyUploadSession();
+        $this->uploadHandler->removeUploadSessionUploadsByType($type);
 
         if (true === $this->featureManager->isActive('sanitize_uploads')) {
             $this->uploadHandler->ensurePdf($upload);

src/Controller/Administrative/Document/CheckController.php

@@ -94,6 +94,9 @@ class CheckController extends AbstractController
         return $this->render('administrative/document/modal_check.html.twig', [
             'document' => $document,
             'form' => $form->createView(),
+            'receipts' => Upload::TYPE_INVOICE === $document->getType()
+                ? $document->getDisposition()?->getDocumentsByType(Upload::TYPE_RECEIPT)
+                : null,
         ]);
     }
 
@@ -117,6 +120,25 @@ class CheckController extends AbstractController
         $this->entityManager->flush();
     }
 
+    private function removeReceipts(Upload $document): void
+    {
+        $receipts = $document->getDisposition()?->getDocumentsByType(Upload::TYPE_RECEIPT);
+
+        if (null === $receipts || 0 === $receipts->count()) {
+            return;
+        }
+
+        foreach ($receipts as $receipt) {
+            $this->entityManager->remove($receipt);
+        }
+
+        $this->logger->info('Delete receipts of accepted invoice', [
+            'document_id' => $document->getId(),
+            'disposition_id' => $document->getDisposition()->getId(),
+            'count' => $receipts->count(),
+        ]);
+    }
+
     private function confirmDocument(Upload $document, string $transition, string $status, DocumentCheckDto $formData): void
     {
         /** @var User $user */
@@ -147,6 +169,14 @@ class CheckController extends AbstractController
 
         if (true === $this->workflow->can($document->getDisposition(), $transition)) {
             $this->workflow->apply($document->getDisposition(), $transition);
+
+            // Belege only have to survive until the Honorarnote is accepted. Removing them here
+            // and not before the guard means a blocked confirmation - which still persists the
+            // new document status below - cannot destroy the evidence for an invoice that was in
+            // fact not approved. DeleteUploadListener removes the files from disk on preRemove.
+            if (Upload::TYPE_INVOICE === $document->getType() && Upload::STATUS_PAID === $status) {
+                $this->removeReceipts($document);
+            }
         } else {
             $blockers = $this->workflow->buildTransitionBlockerList($document->getDisposition(), $transition);
             foreach ($blockers as $blocker) {

src/Controller/Administrative/System/Document/ReplaceController.php

@@ -32,10 +32,10 @@ class ReplaceController extends AbstractController
         if (true === $request->isMethod('POST') && 0 < $uploadSession->getCount()) {
             /** @var User $user */
             $user = $this->getUser();
-            Upload::fromUploadDto($uploadSession->getUploads()->first(), $user, Upload::TYPE_DOCUMENT, $upload);
+            Upload::fromUploadDto($uploadSession->getUploadsByType(Upload::TYPE_DOCUMENT)->first(), $user, Upload::TYPE_DOCUMENT, $upload);
             $this->entityManager->flush();
             $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_DOCUMENT, $uploadSession);
-            $this->uploadHandler->destroyUploadSession();
+            $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_DOCUMENT);
         }
 
         $filenameBefore = $upload->getOriginalFilename();

src/Controller/Administrative/System/Document/UploadController.php

@@ -39,14 +39,14 @@ class UploadController extends AbstractController
         if (true === $request->isMethod('POST') && 0 < $uploadSession->getCount()) {
             /** @var User $user */
             $user = $this->getUser();
-            foreach ($uploadSession->getUploads() as $upload) {
+            foreach ($uploadSession->getUploadsByType(Upload::TYPE_DOCUMENT) as $upload) {
                 $document = Upload::fromUploadDto($upload, $user, Upload::TYPE_DOCUMENT);
                 $uploadedDocuments[] = $document;
                 $this->entityManager->persist($document);
             }
             $this->entityManager->flush();
             $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_DOCUMENT, $uploadSession);
-            $this->uploadHandler->destroyUploadSession();
+            $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_DOCUMENT);
         }
 
         if ($form->isSubmitted() && $form->isValid()) {

src/Controller/Teamer/Check/DriverLicenseController.php

@@ -133,13 +133,13 @@ class DriverLicenseController extends AbstractController
             $this->entityManager->remove($existingUpload);
         }
 
-        $upload = Upload::fromUploadDto($uploadSession->getUploads()->first(), $user, Upload::TYPE_DRIVER_LICENSE);
+        $upload = Upload::fromUploadDto($uploadSession->getUploadsByType(Upload::TYPE_DRIVER_LICENSE)->first(), $user, Upload::TYPE_DRIVER_LICENSE);
         $upload->setStatus(Upload::STATUS_NEW);
 
         $teamer->setDriverLicenseUpload($upload);
         $this->entityManager->flush();
 
         $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_DRIVER_LICENSE, $uploadSession);
-        $this->uploadHandler->destroyUploadSession();
+        $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_DRIVER_LICENSE);
     }
 }

src/Controller/Teamer/Disposition/DetailController.php

@@ -86,14 +86,18 @@ class DetailController extends AbstractController
         /** @var User $user */
         $user = $this->getUser();
 
-        $upload = Upload::fromUploadDto($uploadSession->getUploads()->first(), $user, Upload::TYPE_CONTRACT);
+        $upload = Upload::fromUploadDto(
+            $uploadSession->getUploadsByType(Upload::TYPE_CONTRACT)->first(),
+            $user,
+            Upload::TYPE_CONTRACT
+        );
         $upload->setStatus(Upload::STATUS_NEW);
 
         $disposition->addDocument($upload);
         $this->workflow->apply($disposition, 'upload_contract');
 
         $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_CONTRACT, $uploadSession);
-        $this->uploadHandler->destroyUploadSession();
+        $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_CONTRACT);
 
         if (true === $this->featureManager->isActive('sanitize_uploads')) {
             $this->uploadHandler->ensurePdf($upload);
@@ -119,14 +123,18 @@ class DetailController extends AbstractController
         /** @var User $user */
         $user = $this->getUser();
 
-        $upload = Upload::fromUploadDto($uploadSession->getUploads()->first(), $user, Upload::TYPE_INVOICE);
+        $upload = Upload::fromUploadDto(
+            $uploadSession->getUploadsByType(Upload::TYPE_INVOICE)->first(),
+            $user,
+            Upload::TYPE_INVOICE
+        );
         $upload->setStatus(Upload::STATUS_NEW);
 
         $disposition->addDocument($upload);
         $this->workflow->apply($disposition, 'upload_invoice');
 
         $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_INVOICE, $uploadSession);
-        $this->uploadHandler->destroyUploadSession();
+        $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_INVOICE);
 
         if (true === $this->featureManager->isActive('sanitize_uploads')) {
             $this->uploadHandler->ensurePdf($upload);

src/Controller/Teamer/Disposition/ReceiptController.php

@@ -0,0 +1,156 @@
+<?php
+
+namespace App\Controller\Teamer\Disposition;
+
+use App\Entity\Disposition;
+use App\Entity\Upload;
+use App\Entity\User;
+use App\Htmx\HxRedirectResponse;
+use App\Model\UploadDto;
+use App\Service\Upload\UploadHandler;
+use Doctrine\ORM\EntityManagerInterface;
+use Flagception\Manager\FeatureManagerInterface;
+use Psr\Log\LoggerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+/**
+ * Belege backing a Honorarnote.
+ *
+ * Deliberately separate from DetailController and from the disposition workflow: a receipt is
+ * evidence for the invoice, never a document in its own right. It is not approved or rejected, it
+ * carries no status, and it applies no transition - which is what lets a teamer keep managing
+ * receipts while the invoice is being checked, a phase in which the state machine offers no
+ * transition at all. The window is guarded by the MANAGE_RECEIPTS attribute on the disposition.
+ */
+class ReceiptController extends AbstractController
+{
+    public function __construct(
+        private readonly UploadHandler $uploadHandler,
+        private readonly EntityManagerInterface $entityManager,
+        private readonly LoggerInterface $logger,
+        private readonly FeatureManagerInterface $featureManager,
+    ) {
+    }
+
+    #[Route('/teamer/disposition/receipt/{uuid}', name: 'app_teamer_disposition_receipt_upload')]
+    #[IsGranted('ROLE_TEAMER')]
+    #[IsGranted('MANAGE_RECEIPTS', subject: 'disposition')]
+    public function upload(Disposition $disposition, Request $request): Response
+    {
+        // Dummy form without fields, as elsewhere: the files travel in the upload session, not in
+        // the form itself.
+        $form = $this->createFormBuilder()->getForm();
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $count = $this->processUpload($disposition);
+
+            $this->addFlash(
+                'success',
+                1 === $count ? 'Der Beleg wurde hochgeladen' : 'Die Belege wurden hochgeladen'
+            );
+
+            return new HxRedirectResponse($this->generateUrl('app_teamer_disposition_detail', [
+                'uuid' => $disposition->getUuid(),
+                'r' => $request->query->get('r'),
+            ]));
+        }
+
+        return $this->render('teamer/disposition/modal_receipt_upload.html.twig', [
+            'disposition' => $disposition,
+            'form' => $form->createView(),
+        ]);
+    }
+
+    #[Route('/teamer/disposition/receipt/delete/{uuid}', name: 'app_teamer_disposition_receipt_delete')]
+    #[IsGranted('ROLE_TEAMER')]
+    #[IsGranted('DELETE', subject: 'receipt')]
+    public function delete(Upload $receipt, Request $request): Response
+    {
+        if (Upload::TYPE_RECEIPT !== $receipt->getType()) {
+            throw $this->createNotFoundException('Not a receipt');
+        }
+
+        // UploadVoter::DELETE only asserts ownership, which would still hold once the invoice has
+        // been accepted. The window itself is the disposition's to answer.
+        $this->denyAccessUnlessGranted('MANAGE_RECEIPTS', $receipt->getDisposition());
+
+        if (true === $request->isMethod('POST')) {
+            $disposition = $receipt->getDisposition();
+
+            // Doctrine's DeleteUploadListener removes the file from disk on preRemove.
+            $this->entityManager->remove($receipt);
+            $this->entityManager->flush();
+
+            $this->addFlash('success', 'Der Beleg wurde gelöscht');
+            $this->logger->info('Delete receipt', [
+                'disposition_id' => $disposition->getId(),
+                'receipt_filename' => $receipt->getOriginalFilename(),
+                'owner' => $receipt->getOwner()->getFullName(),
+            ]);
+
+            return new HxRedirectResponse($this->generateUrl('app_teamer_disposition_detail', [
+                'uuid' => $disposition->getUuid(),
+                'r' => $request->query->get('r'),
+            ]));
+        }
+
+        return $this->render('teamer/disposition/modal_receipt_delete.html.twig', [
+            'receipt' => $receipt,
+        ]);
+    }
+
+    private function processUpload(Disposition $disposition): int
+    {
+        /** @var User $user */
+        $user = $this->getUser();
+
+        $uploadSession = $this->uploadHandler->getUploadSession();
+
+        // Only this dropzone's files: on the detail page in place "ended" the invoice dropzone is
+        // live at the same time and shares the one session.
+        $uploadDtos = $uploadSession->getUploadsByType(Upload::TYPE_RECEIPT);
+
+        $uploads = [];
+
+        /** @var UploadDto $uploadDto */
+        foreach ($uploadDtos as $uploadDto) {
+            $upload = Upload::fromUploadDto($uploadDto, $user, Upload::TYPE_RECEIPT);
+
+            // No status on purpose. UploadVoter grants CHECK only for "new" and "pending", so a
+            // null status is what keeps a receipt out of the checking process by construction.
+            $upload->setStatus(null);
+
+            $disposition->addDocument($upload);
+            $this->entityManager->persist($upload);
+
+            $uploads[] = $upload;
+        }
+
+        $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_RECEIPT, $uploadSession);
+        $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_RECEIPT);
+
+        if (true === $this->featureManager->isActive('sanitize_uploads')) {
+            foreach ($uploads as $upload) {
+                $this->uploadHandler->ensurePdf($upload);
+            }
+        }
+
+        $this->entityManager->flush();
+
+        $this->logger->info('Upload receipts', [
+            'user' => $user->getUserIdentifier(),
+            'disposition_id' => $disposition->getId(),
+            'count' => count($uploads),
+        ]);
+
+        // No DocumentUploadedEvent: its listener mails the managers about a document waiting to be
+        // checked, which is exactly what a receipt is not.
+
+        return count($uploads);
+    }
+}

src/Controller/Teamer/Profile/IndexController.php

@@ -96,11 +96,11 @@ class IndexController extends AbstractController
             $this->entityManager->remove($existingUpload);
         }
 
-        $upload = Upload::fromUploadDto($uploadSession->getUploads()->first(), $user, Upload::TYPE_PHOTO);
+        $upload = Upload::fromUploadDto($uploadSession->getUploadsByType(Upload::TYPE_PHOTO)->first(), $user, Upload::TYPE_PHOTO);
         $teamer->setPhoto($upload);
         $this->entityManager->flush();
         $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_PHOTO, $uploadSession);
-        $this->uploadHandler->destroyUploadSession();
+        $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_PHOTO);
 
         $this->addFlash('success', 'Dein Profilbild wurde aktualisiert');
         $this->logger->info('Update teamer photo', [

src/Controller/Teamer/Profile/License/AddController.php

@@ -73,11 +73,11 @@ class AddController extends AbstractController
 
     private function updateCertificate(User $user, License $license, UploadSessionDto $uploadSession): void
     {
-        $upload = Upload::fromUploadDto($uploadSession->getUploads()->first(), $user, Upload::TYPE_CERTIFICATE);
+        $upload = Upload::fromUploadDto($uploadSession->getUploadsByType(Upload::TYPE_CERTIFICATE)->first(), $user, Upload::TYPE_CERTIFICATE);
         $license->setCertificate($upload);
         $this->entityManager->flush();
         $this->uploadHandler->moveUploadSessionFilesFromOrphanage(Upload::TYPE_CERTIFICATE, $uploadSession);
-        $this->uploadHandler->destroyUploadSession();
+        $this->uploadHandler->removeUploadSessionUploadsByType(Upload::TYPE_CERTIFICATE);
 
         $this->addFlash('success', 'Der Nachweis wurde hochgeladen');
     }