diff --git a/app/controllers/api/v4/receipts_controller.rb b/app/controllers/api/v4/receipts_controller.rb index 7406b1fd54..5a0bcb440a 100644 --- a/app/controllers/api/v4/receipts_controller.rb +++ b/app/controllers/api/v4/receipts_controller.rb @@ -4,20 +4,23 @@ module Api module V4 class ReceiptsController < ApplicationController def index - @hcb_code = authorize HcbCode.find_by_public_id(params[:transaction_id]), :show? - @receipts = @hcb_code.receipts.includes(:user) - end - - def receipt_bin - skip_authorization - @receipts = Receipt.in_receipt_bin.includes(:user).where(user: current_user) - render "index" + if params[:transaction_id].present? + @hcb_code = HcbCode.find_by_public_id(params[:transaction_id]) + authorize @hcb_code, :show? + @receipts = @hcb_code.receipts.includes(:user) + else + skip_authorization + @receipts = Receipt.in_receipt_bin.includes(:user).where(user: current_user) + end end def create - @hcb_code = HcbCode.find_by_public_id(params[:transaction_id]) - authorize @hcb_code, :upload?, policy_class: ReceiptablePolicy - + if params[:transaction_id].present? + @hcb_code = HcbCode.find_by_public_id(params[:transaction_id]) + authorize @hcb_code, :upload?, policy_class: ReceiptablePolicy + else + skip_authorization + end @receipt = Receipt.create!(file: params[:file], receiptable: @hcb_code, user: current_user, upload_method: :api) render "show" diff --git a/config/routes.rb b/config/routes.rb index c8ee18d1f7..161d9a4c55 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -575,7 +575,6 @@ end get "transactions/missing_receipt", to: "transactions#missing_receipt" - get "receipt_bin", to: "receipts#receipt_bin" get :available_icons end @@ -583,7 +582,7 @@ resources :stripe_cards, path: "cards", only: [:index] resources :card_grants, only: [:index, :create] resources :transactions, only: [:show, :update] do - resources :receipts, only: [:create, :index, :destroy] + resources :receipts, only: [:index] resources :comments, only: [:index, :create] member do @@ -601,6 +600,7 @@ end resources :transactions, only: [:show] + resources :receipts, only: [:create, :index, :destroy] resources :stripe_cards, path: "cards", only: [:show, :update, :create] do member do