fix: prevent generating offer links while booking is in draft

2026-08-19 13:00:43 +02:00
parent 2601e46ec4
commit 8617bf6c86
11 changed files with 442 additions and 36 deletions
@@ -26,6 +26,11 @@ class GenerateAccessLinkController extends AbstractController
    #[Route('/admin/accommodation-booking/{id}/generate-access-link', name: 'app_admin_accommodationbooking_generate_access_link')]
    public function index(AccommodationBooking $booking, Request $request): Response
    {
+        // A draft has not been offered to anyone yet, so there is nothing a link could show.
+        if (!$booking->isCustomerAccessible()) {
+            return $this->redirectToRoute('app_admin_accommodationbooking_show', ['id' => $booking->getId()]);
+        }
+
        if ($request->isMethod(Request::METHOD_POST)) {
            if (!$this->isCsrfTokenValid('generate_accommodation_booking_access_link_'.$booking->getId(), $request->request->getString('_token'))) {
                throw $this->createAccessDeniedException('Invalid CSRF token.');
@@ -26,7 +26,7 @@ class SendAccessLinkController extends AbstractController
    #[Route('/admin/accommodation-booking/{id}/send-access-link', name: 'app_admin_accommodationbooking_send_access_link')]
    public function index(AccommodationBooking $booking, Request $request): Response
    {
-        if (null === $booking->getAccessLinkIssuedAt()) {
+        if (!$booking->isCustomerAccessible() || null === $booking->getAccessLinkIssuedAt()) {
            return $this->redirectToRoute('app_admin_accommodationbooking_show', ['id' => $booking->getId()]);
        }

@@ -128,7 +128,7 @@ class OfferController extends AbstractController
     */
    private function isCustomerVisible(AccommodationBooking $booking): bool
    {
-        return !$booking->isDraft() && !$booking->isRequested() && !$booking->isDiscarded();
+        return $booking->isCustomerAccessible() && !$booking->isRequested() && !$booking->isDiscarded();
    }

    /**