From 073fe953e9b168db97e703d75b388d82b0796239 Mon Sep 17 00:00:00 2001
From: Marcus Hill <bcf8c9f2@opayq.com>
Date: Sat, 11 Feb 2023 15:04:10 +0000
Subject: [PATCH] Add read api endpoint for payments

---
 api/v1/payments/read.php | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 api/v1/payments/read.php

diff --git a/api/v1/payments/read.php b/api/v1/payments/read.php
new file mode 100644
index 00000000..5d8adb1e
--- /dev/null
+++ b/api/v1/payments/read.php
@@ -0,0 +1,28 @@
+<?php
+
+require_once('../validate_api_key.php');
+require_once('../require_get_method.php');
+
+// Payments aren't stored against client IDs, so we instead validate the API key is for All Clients
+
+
+if (isset($_GET['payment_id']) && $client_id !== "*") {
+    // Payment via ID (single)
+
+    $id = intval($_GET['payment_id']);
+    $sql = mysqli_query($mysqli, "SELECT * FROM payments WHERE payment_id = '$id' AND company_id = '$company_id'");
+
+} elseif (isset($_GET['payment_invoice_id']) && $client_id !== "*") {
+    // Payments for an invoice
+
+    $id = intval($_GET['payment_invoice_id']);
+    $sql = mysqli_query($mysqli, "SELECT * FROM payments WHERE payment_invoice_id = '$id' AND company_id = '$company_id'");
+
+} elseif ($client_id !== "*") {
+    // All payments
+
+    $sql = mysqli_query($mysqli, "SELECT * FROM payments WHERE company_id = '$company_id' ORDER BY payment_id LIMIT $limit OFFSET $offset");
+}
+
+// Output
+require_once("../read_output.php");