Merge pull request #1763 from bburnichon/PHRAS-1005

Add Order API accept/reject

lib/Alchemy/Phrasea/Collection/Reference/ArrayCacheCollectionReferenceRepository.php

@@ -72,6 +72,25 @@ class ArrayCacheCollectionReferenceRepository implements CollectionReferenceRepo
         return null;
     }
 
+    /**
+     * @param array $baseIds
+     * @return CollectionReference[]
+     */
+    public function findMany(array $baseIds)
+    {
+        $references = $this->findAll();
+
+        $requested = [];
+
+        foreach ($baseIds as $baseId) {
+            if (isset($references[$baseId])) {
+                $requested[] = $references[$baseId];
+            }
+        }
+
+        return $requested;
+    }
+
     /**
      * @param int $databoxId
      * @param int $collectionId
@@ -90,6 +109,10 @@ class ArrayCacheCollectionReferenceRepository implements CollectionReferenceRepo
         return null;
     }
 
+    /**
+     * @param array|null $baseIdsSubset
+     * @return CollectionReference[]
+     */
     public function findHavingOrderMaster(array $baseIdsSubset = null)
     {
         return $this->repository->findHavingOrderMaster($baseIdsSubset);

lib/Alchemy/Phrasea/Collection/Reference/CollectionReferenceCollection.php

@@ -0,0 +1,58 @@
+<?php
+/*
+ * This file is part of Phraseanet
+ *
+ * (c) 2005-2016 Alchemy
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Alchemy\Phrasea\Collection\Reference;
+
+use Assert\Assertion;
+
+class CollectionReferenceCollection implements \IteratorAggregate
+{
+    /**
+     * @var CollectionReference[]
+     */
+    private $references;
+
+    /**
+     * @param CollectionReference[] $references
+     */
+    public function __construct($references)
+    {
+        Assertion::allIsInstanceOf($references, CollectionReference::class);
+        $this->references = $references instanceof \Traversable ? iterator_to_array($references) : $references;
+    }
+
+    /**
+     * Returns an array of array with actual index as leaf value.
+     *
+     * @return array<int,array<int,mixed>>
+     */
+    public function groupByDataboxIdAndCollectionId()
+    {
+        $groups = [];
+
+        foreach ($this->references as $index => $reference) {
+            $databoxId = $reference->getDataboxId();
+            $group = isset($groups[$databoxId]) ? $groups[$databoxId] : [];
+
+            $group[$reference->getCollectionId()] = $index;
+            $groups[$databoxId] = $group;
+        }
+
+        return $groups;
+    }
+
+    /**
+     * @return \ArrayIterator|CollectionReference[]
+     */
+    public function getIterator()
+    {
+        return new \ArrayIterator($this->references);
+    }
+}

lib/Alchemy/Phrasea/Collection/Reference/CollectionReferenceRepository.php

@@ -29,6 +29,12 @@ interface CollectionReferenceRepository
      */
     public function find($baseId);
 
+    /**
+     * @param int[] $baseIds
+     * @return CollectionReference[]
+     */
+    public function findMany(array $baseIds);
+
     /**
      * @param int $databoxId
      * @param int $collectionId

lib/Alchemy/Phrasea/Collection/Reference/DbalCollectionReferenceRepository.php

@@ -95,6 +95,25 @@ WHERE base_id = :baseId';
         return null;
     }
 
+    /**
+     * @param array $basesId
+     * @return CollectionReference[]
+     */
+    public function findMany(array $basesId)
+    {
+        if (empty($basesId)) {
+            return [];
+        }
+
+        $rows = $this->connection->fetchAll(
+            self::$selectQuery . ' WHERE base_id IN (:baseIds)',
+            ['baseIds' => $basesId],
+            ['baseIds' => Connection::PARAM_INT_ARRAY]
+        );
+
+        return $this->createManyReferences($rows);
+    }
+
     /**
      * @param int $databoxId
      * @param int $collectionId

lib/Alchemy/Phrasea/ControllerProvider/Api/V2.php

@@ -12,10 +12,11 @@ namespace Alchemy\Phrasea\ControllerProvider\Api;
 use Alchemy\Phrasea\Application as PhraseaApplication;
 use Alchemy\Phrasea\Controller\Api\BasketController;
 use Alchemy\Phrasea\Controller\Api\LazaretController;
-use Alchemy\Phrasea\Controller\Api\OrderController;
 use Alchemy\Phrasea\Controller\Api\SearchController;
+use Alchemy\Phrasea\Controller\LazyLocator;
 use Alchemy\Phrasea\ControllerProvider\ControllerProviderTrait;
 use Alchemy\Phrasea\Core\Event\Listener\OAuthListener;
+use Alchemy\Phrasea\Order\Controller\ApiOrderController;
 use Silex\Application;
 use Silex\Controller;
 use Silex\ControllerProviderInterface;
@@ -51,8 +52,9 @@ class V2 implements ControllerProviderInterface, ServiceProviderInterface
 
         $app['controller.api.v2.orders'] = $app->share(
             function (PhraseaApplication $app) {
-                return (new OrderController($app))
+                return (new ApiOrderController($app))
                     ->setDispatcher($app['dispatcher'])
+                    ->setEntityManagerLocator(new LazyLocator($app, 'orm.em'))
                     ->setJsonBodyHelper($app['json.body_helper']);
             }
         );
@@ -102,8 +104,17 @@ class V2 implements ControllerProviderInterface, ServiceProviderInterface
         $controllers->get('/orders/', 'controller.api.v2.orders:indexAction')
             ->bind('api_v2_orders_index');
         $controllers->get('/orders/{orderId}', 'controller.api.v2.orders:showAction')
+            ->assert('orderId', '\d+')
             ->bind('api_v2_orders_show');
 
+        $controllers->post('/orders/{orderId}/accept', 'controller.api.v2.orders:acceptElementsAction')
+            ->assert('orderId', '\d+')
+            ->bind('api_v2_orders_accept');
+
+        $controllers->post('/orders/{orderId}/deny', 'controller.api.v2.orders:denyElementsAction')
+            ->assert('orderId', '\d+')
+            ->bind('api_v2_orders_deny');
+
         return $controllers;
     }
 

lib/Alchemy/Phrasea/ControllerProvider/Prod/Order.php

@@ -13,8 +13,10 @@ namespace Alchemy\Phrasea\ControllerProvider\Prod;
 
 use Alchemy\Phrasea\Application as PhraseaApplication;
 use Alchemy\Phrasea\Controller\LazyLocator;
-use Alchemy\Phrasea\Controller\Prod\OrderController;
 use Alchemy\Phrasea\ControllerProvider\ControllerProviderTrait;
+use Alchemy\Phrasea\Order\Controller\ProdOrderController;
+use Alchemy\Phrasea\Order\OrderBasketProvider;
+use Alchemy\Phrasea\Order\OrderValidator;
 use Silex\Application;
 use Silex\ControllerProviderInterface;
 use Silex\ServiceProviderInterface;
@@ -25,8 +27,19 @@ class Order implements ControllerProviderInterface, ServiceProviderInterface
 
     public function register(Application $app)
     {
+        $app['provider.order_basket'] = $app->share(function (PhraseaApplication $app) {
+            return new OrderBasketProvider($app['orm.em'], $app['translator']);
+        });
+
+        $app['validator.order'] = $app->share(function (PhraseaApplication $app) {
+            $orderValidator = new OrderValidator($app['phraseanet.appbox'], $app['repo.collection-references']);
+            $orderValidator->setAclProvider($app['acl']);
+
+            return $orderValidator;
+        });
+
         $app['controller.prod.order'] = $app->share(function (PhraseaApplication $app) {
-            return (new OrderController($app))
+            return (new ProdOrderController($app))
                 ->setDispatcher($app['dispatcher'])
                 ->setEntityManagerLocator(new LazyLocator($app, 'orm.em'))
                 ->setUserQueryFactory(new LazyLocator($app, 'phraseanet.user-query'))

lib/Alchemy/Phrasea/Model/Entities/Order.php

@@ -1,9 +1,8 @@
 <?php
-
 /*
  * This file is part of Phraseanet
  *
- * (c) 2005-2014 Alchemy
+ * (c) 2005-2016 Alchemy
  *
  * For the full copyright and license information, please view the LICENSE
  * file that was distributed with this source code.
@@ -32,8 +31,8 @@ class Order
      * @ORM\ManyToOne(targetEntity="User")
      * @ORM\JoinColumn(name="user_id", referencedColumnName="id", nullable=false)
      *
-     * @return User
+     * @var User
-     **/
+     */
     private $user;
 
     /**
@@ -64,6 +63,7 @@ class Order
 
     /**
      * @ORM\OneToOne(targetEntity="Basket", inversedBy="order", cascade={"ALL"})
+     * @var Basket|null
      */
     private $basket;
 
@@ -209,6 +209,14 @@ class Order
         return $this->todo;
     }
 
+    /**
+     * @param int $count
+     */
+    public function decrementTodo($count)
+    {
+        $this->todo -= $count;
+    }
+
     /**
      * Returns the total number of elements.
      *
@@ -250,8 +258,16 @@ class Order
      */
     public function setBasket(Basket $basket = null)
     {
+        if ($this->basket) {
+            $this->basket->setOrder(null);
+        }
+
         $this->basket = $basket;
 
+        if ($basket) {
+            $basket->setOrder($this);
+        }
+
         return $this;
     }
 

lib/Alchemy/Phrasea/Model/Entities/OrderElement.php

@@ -41,12 +41,13 @@ class OrderElement
      * @ORM\ManyToOne(targetEntity="User")
      * @ORM\JoinColumn(name="order_master", referencedColumnName="id")
      *
-     * @return User
+     * @var null|User
      **/
     private $orderMaster;
 
     /**
      * @ORM\Column(type="boolean", nullable=true)
+     * @var bool|null
      */
     private $deny;
 
@@ -89,7 +90,7 @@ class OrderElement
     /**
      * Set deny
      *
-     * @param  boolean      $deny
+     * @param null|bool $deny
      * @return OrderElement
      */
     public function setDeny($deny)
@@ -102,7 +103,7 @@ class OrderElement
     /**
      * Get deny
      *
-     * @return boolean
+     * @return bool|null
      */
     public function getDeny()
     {

lib/Alchemy/Phrasea/Order/Controller/ApiOrderController.php

@@ -8,21 +8,20 @@
  * file that was distributed with this source code.
  */
 
-namespace Alchemy\Phrasea\Controller\Api;
+namespace Alchemy\Phrasea\Order\Controller;
 
-use Alchemy\Phrasea\Application\Helper\DispatcherAware;
 use Alchemy\Phrasea\Application\Helper\JsonBodyAware;
-use Alchemy\Phrasea\Controller\Controller;
+use Alchemy\Phrasea\Collection\Reference\CollectionReference;
+use Alchemy\Phrasea\Controller\Api\Result;
 use Alchemy\Phrasea\Controller\RecordsRequest;
 use Alchemy\Phrasea\Core\Event\OrderEvent;
 use Alchemy\Phrasea\Core\PhraseaEvents;
+use Alchemy\Phrasea\Model\Entities\BasketElement;
 use Alchemy\Phrasea\Model\Entities\Order;
 use Alchemy\Phrasea\Order\OrderElementTransformer;
 use Alchemy\Phrasea\Order\OrderFiller;
 use Alchemy\Phrasea\Order\OrderTransformer;
 use Alchemy\Phrasea\Record\RecordReferenceCollection;
-use Assert\Assertion;
-use Assert\InvalidArgumentException;
 use Doctrine\Common\Collections\ArrayCollection;
 use League\Fractal\Manager;
 use League\Fractal\Pagination\PagerfantaPaginatorAdapter;
@@ -34,12 +33,9 @@ use Pagerfanta\Pagerfanta;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
-use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
-use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
-class OrderController extends Controller
+class ApiOrderController extends BaseOrderController
 {
-    use DispatcherAware;
     use JsonBodyAware;
 
     public function createAction(Request $request)
@@ -107,20 +103,10 @@ class OrderController extends Controller
      */
     public function showAction(Request $request, $orderId)
     {
-        try {
+        $order = $this->findOr404($orderId);
-            Assertion::integerish($orderId);
-        } catch (InvalidArgumentException $exception) {
-            throw new BadRequestHttpException($exception->getMessage(), $exception);
-        }
 
         $includes = $request->get('includes', []);
 
-        $order = $this->app['repo.orders']->find((int)$orderId);
-
-        if (!$order instanceof Order) {
-            throw new NotFoundHttpException(sprintf('Order "%d" was not found', (int) $orderId));
-        }
-
         if ($order->getUser()->getId() !== $this->getAuthenticatedUser()->getId()) {
             throw new AccessDeniedHttpException(sprintf('Cannot access order "%d"', $order->getId()));
         }
@@ -130,6 +116,34 @@ class OrderController extends Controller
         return $this->returnResourceResponse($request, $includes, $resource);
     }
 
+    public function acceptElementsAction(Request $request, $orderId)
+    {
+        $elementIds = $this->fetchElementIdsFromRequest($request);
+
+        $elements = $this->doAcceptElements($orderId, $elementIds, $this->getAuthenticatedUser());
+
+        $resource = new Collection($elements, function (BasketElement $element) {
+            return [
+                'id' => $element->getId(),
+                'created' => $element->getCreated(),
+                'databox_id' => $element->getSbasId(),
+                'record_id' => $element->getRecordId(),
+                'index' => $element->getOrd(),
+            ];
+        });
+
+        return $this->returnResourceResponse($request, [], $resource);
+    }
+
+    public function denyElementsAction(Request $request, $orderId)
+    {
+        $elementIds = $this->fetchElementIdsFromRequest($request);
+
+        $this->doDenyElements($orderId, $elementIds, $this->getAuthenticatedUser());
+
+        return Result::create($request, [])->createResponse();
+    }
+
     /**
      * @param array $records
      * @return \record_adapter[]
@@ -188,4 +202,21 @@ class OrderController extends Controller
 
         return Result::create($request, $fractal->createData($resource)->toArray())->createResponse();
     }
+
+    /**
+     * @param Request $request
+     * @return array
+     */
+    private function fetchElementIdsFromRequest(Request $request)
+    {
+        $data = $this->decodeJsonBody($request, 'orders.json#/definitions/order_element_collection');
+
+        $elementIds = [];
+
+        foreach ($data as $elementId) {
+            $elementIds[] = $elementId->id;
+        }
+
+        return $elementIds;
+    }
 }

lib/Alchemy/Phrasea/Order/Controller/BaseOrderController.php

@@ -0,0 +1,206 @@
+<?php
+/**
+ * This file is part of Phraseanet
+ *
+ * (c) 2005-2016 Alchemy
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Alchemy\Phrasea\Order\Controller;
+
+use Alchemy\Phrasea\Application\Helper\DispatcherAware;
+use Alchemy\Phrasea\Application\Helper\EntityManagerAware;
+use Alchemy\Phrasea\Controller\Controller;
+use Alchemy\Phrasea\Core\Event\OrderDeliveryEvent;
+use Alchemy\Phrasea\Core\PhraseaEvents;
+use Alchemy\Phrasea\Model\Entities\Basket;
+use Alchemy\Phrasea\Model\Entities\BasketElement;
+use Alchemy\Phrasea\Model\Entities\Order;
+use Alchemy\Phrasea\Model\Entities\OrderElement;
+use Alchemy\Phrasea\Model\Entities\User;
+use Alchemy\Phrasea\Model\Repositories\OrderElementRepository;
+use Alchemy\Phrasea\Model\Repositories\OrderRepository;
+use Alchemy\Phrasea\Order\OrderValidator;
+use Alchemy\Phrasea\Order\PartialOrder;
+use Alchemy\Phrasea\Record\RecordReference;
+use Alchemy\Phrasea\Record\RecordReferenceCollection;
+use Assert\Assertion;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\HttpKernel\Exception\ConflictHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+class BaseOrderController extends Controller
+{
+    use DispatcherAware;
+    use EntityManagerAware;
+
+    /**
+     * @return OrderRepository
+     */
+    protected function getOrderRepository()
+    {
+        return $this->app['repo.orders'];
+    }
+
+    /**
+     * @return OrderElementRepository
+     */
+    protected function getOrderElementRepository()
+    {
+        return $this->app['repo.order-elements'];
+    }
+
+    /**
+     * @param int $orderId
+     * @return Order
+     */
+    protected function findOr404($orderId)
+    {
+        if (null === $order = $this->getOrderRepository()->find($orderId)) {
+            throw new NotFoundHttpException('Order not found');
+        }
+
+        return $order;
+    }
+
+    /**
+     * @param int $orderId
+     * @param array<int> $elementIds
+     * @param User $acceptor
+     * @return OrderElement[]
+     */
+    protected function findRequestedElements($orderId, $elementIds, User $acceptor)
+    {
+        try {
+            Assertion::isArray($elementIds);
+        } catch (\Exception $exception) {
+            throw new BadRequestHttpException('Improper request', $exception);
+        }
+
+        $elements = $this->getOrderElementRepository()->findBy([
+            'id' => $elementIds,
+            'order' => $orderId,
+        ]);
+
+        if (count($elements) !== count($elementIds)) {
+            throw new NotFoundHttpException(sprintf('At least one requested element does not exists or does not belong to order "%s"', $orderId));
+        }
+
+        if (!$this->getOrderValidator()->isGrantedValidation($acceptor, $elements)) {
+            throw new AccessDeniedHttpException('At least one element is in a collection you have no access to.');
+        }
+
+        return $elements;
+    }
+
+    /**
+     * @return OrderValidator
+     */
+    protected function getOrderValidator()
+    {
+        return $this->app['validator.order'];
+    }
+
+    /**
+     * @param int $order_id
+     * @param array<int> $elementIds
+     * @param User $acceptor
+     * @return BasketElement[]
+     */
+    protected function doAcceptElements($order_id, $elementIds, User $acceptor)
+    {
+        $elements = $this->findRequestedElements($order_id, $elementIds, $acceptor);
+        $order = $this->findOr404($order_id);
+
+        $basket = $this->app['provider.order_basket']->provideBasketForOrderAndUser($order, $acceptor);
+
+        $partialOrder = new PartialOrder($order, $elements);
+
+        $orderValidator = $this->getOrderValidator();
+
+        $basketElements = $orderValidator->createBasketElements($partialOrder);
+        $this->assertRequestedElementsWereNotAlreadyAdded($basket, $basketElements);
+
+        $orderValidator->accept($acceptor, $partialOrder);
+        $orderValidator->grantHD($basket->getUser(), $basketElements);
+
+        try {
+            $manager = $this->getEntityManager();
+
+            if (!empty($basketElements)) {
+                foreach ($basketElements as $element) {
+                    $basket->addElement($element);
+                    $manager->persist($element);
+                }
+
+                $this->dispatch(PhraseaEvents::ORDER_DELIVER, new OrderDeliveryEvent($order, $acceptor, count($basketElements)));
+            }
+
+            $manager->persist($basket);
+            $manager->persist($order);
+            $manager->flush();
+        } catch (\Exception $e) {
+            // I don't know why only basket persistence is not checked
+        }
+
+        return $basketElements;
+    }
+
+    /**
+     * @param int $order_id
+     * @param array<int> $elementIds
+     * @param User $acceptor
+     * @return OrderElement[]
+     */
+    protected function doDenyElements($order_id, $elementIds, User $acceptor)
+    {
+        $elements = $this->findRequestedElements($order_id, $elementIds, $acceptor);
+        $order = $this->findOr404($order_id);
+
+        $this->getOrderValidator()->deny($acceptor, new PartialOrder($order, $elements));
+
+        try {
+            if (!empty($elements)) {
+                $this->dispatch(PhraseaEvents::ORDER_DENY, new OrderDeliveryEvent($order, $acceptor, count($elements)));
+            }
+
+            $manager = $this->getEntityManager();
+            $manager->persist($order);
+            $manager->flush();
+        } catch (\Exception $e) {
+            // Don't know why this is ignored
+        }
+
+        return $elements;
+    }
+
+    /**
+     * @param Basket $basket
+     * @param BasketElement[] $elements
+     */
+    protected function assertRequestedElementsWereNotAlreadyAdded(Basket $basket, $elements)
+    {
+        if ($basket->getElements()->isEmpty()) {
+            return;
+        }
+
+        $references = new RecordReferenceCollection();
+
+        foreach ($elements as $element) {
+            $reference = RecordReference::createFromDataboxIdAndRecordId($element->getSbasId(), $element->getRecordId());
+
+            $references->addRecordReference($reference);
+        }
+
+        $groups = $references->groupPerDataboxId();
+
+        foreach ($basket->getElements() as $element) {
+            if (isset($groups[$element->getSbasId()][$element->getRecordId()])) {
+                throw new ConflictHttpException('Some records have already been handled');
+            }
+        }
+    }
+}

lib/Alchemy/Phrasea/Order/Controller/ProdOrderController.php

@@ -1,5 +1,5 @@
 <?php
-/*
+/**
  * This file is part of Phraseanet
  *
  * (c) 2005-2016 Alchemy
@@ -7,33 +7,24 @@
  * For the full copyright and license information, please view the LICENSE
  * file that was distributed with this source code.
  */
-namespace Alchemy\Phrasea\Controller\Prod;
+namespace Alchemy\Phrasea\Order\Controller;
 
-use Alchemy\Phrasea\Application\Helper\DispatcherAware;
 use Alchemy\Phrasea\Application\Helper\EntityManagerAware;
 use Alchemy\Phrasea\Application\Helper\UserQueryAware;
-use Alchemy\Phrasea\Controller\Controller;
+use Alchemy\Phrasea\Controller\Prod\OrderControllerException;
 use Alchemy\Phrasea\Controller\RecordsRequest;
-use Alchemy\Phrasea\Core\Event\OrderDeliveryEvent;
 use Alchemy\Phrasea\Core\Event\OrderEvent;
 use Alchemy\Phrasea\Core\PhraseaEvents;
-use Alchemy\Phrasea\Model\Entities\Basket;
-use Alchemy\Phrasea\Model\Entities\BasketElement;
-use Alchemy\Phrasea\Model\Entities\Order as OrderEntity;
 use Alchemy\Phrasea\Model\Entities\Order;
-use Alchemy\Phrasea\Model\Repositories\OrderRepository;
 use Alchemy\Phrasea\Order\OrderFiller;
 use Doctrine\Common\Collections\ArrayCollection;
-use Silex\Application;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
-use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
-class OrderController extends Controller
+class ProdOrderController extends BaseOrderController
 {
-    use DispatcherAware;
     use EntityManagerAware;
     use UserQueryAware;
 
@@ -59,7 +50,7 @@ class OrderController extends Controller
 
             $orderUsage = $request->request->get('use', '');
 
-            $order = new OrderEntity();
+            $order = new Order();
             $order->setUser($this->getAuthenticatedUser());
             $order->setDeadline($deadLine);
             $order->setOrderUsage($orderUsage);
@@ -136,10 +127,7 @@ class OrderController extends Controller
      */
     public function displayOneOrder($order_id)
     {
-        $order = $this->getOrderRepository()->find($order_id);
+        $order = $this->findOr404($order_id);
-        if (null === $order) {
-            throw new NotFoundHttpException('Order not found');
-        }
 
         return $this->render('prod/orders/order_item.html.twig', [
             'order' => $order,
@@ -155,62 +143,12 @@ class OrderController extends Controller
      */
     public function sendOrder(Request $request, $order_id)
     {
-        $success = false;
+        $elementIds = $request->request->get('elements', []);
-        /** @var Order $order */
+        $acceptor = $this->getAuthenticatedUser();
-        if (null === $order = $this->getOrderRepository()->find($order_id)) {
-            throw new NotFoundHttpException('Order not found');
-        }
 
-        $manager = $this->getEntityManager();
+        $basketElements = $this->doAcceptElements($order_id, $elementIds, $acceptor);
-        $basket = $order->getBasket();
-        if (null === $basket) {
-            $basket = new Basket();
-            $basket->setName($this->app->trans('Commande du %date%', [
-                '%date%' => $order->getCreatedOn()->format('Y-m-d'),
-            ]));
-            $basket->setUser($order->getUser());
-            $basket->setPusher($this->getAuthenticatedUser());
 
-            $manager->persist($basket);
+        $success = !empty($basketElements);
-            $manager->flush();
-        }
-
-        $n = 0;
-        $elements = $request->request->get('elements', []);
-        foreach ($order->getElements() as $orderElement) {
-            if (in_array($orderElement->getId(), $elements)) {
-                $sbas_id = \phrasea::sbasFromBas($this->app, $orderElement->getBaseId());
-                $record = new \record_adapter($this->app, $sbas_id, $orderElement->getRecordId());
-
-                $basketElement = new BasketElement();
-                $basketElement->setRecord($record);
-                $basketElement->setBasket($basket);
-
-                $orderElement->setOrderMaster($this->getAuthenticatedUser());
-                $orderElement->setDeny(false);
-                $orderElement->getOrder()->setBasket($basket);
-
-                $basket->addElement($basketElement);
-
-                $n++;
-                $this->getAclForUser($basket->getUser())->grant_hd_on($record, $this->getAuthenticatedUser(), 'order');
-            }
-        }
-
-        try {
-            if ($n > 0) {
-                $order->setTodo($order->getTodo() - $n);
-                $this->dispatch(PhraseaEvents::ORDER_DELIVER, new OrderDeliveryEvent($order, $this->getAuthenticatedUser(), $n));
-            }
-            $success = true;
-
-            // There was a basketElement persist here. Seems useless as all entities are managed.
-            $manager->persist($basket);
-            $manager->persist($order);
-            $manager->flush();
-        } catch (\Exception $e) {
-
-        }
 
         if ('json' === $request->getRequestFormat()) {
             return $this->app->json([
@@ -237,38 +175,12 @@ class OrderController extends Controller
      */
     public function denyOrder(Request $request, $order_id)
     {
-        $success = false;
+        $elementIds = $request->request->get('elements', []);
-        /** @var Order $order */
+        $acceptor = $this->getAuthenticatedUser();
-        $order = $this->getOrderRepository()->find($order_id);
-        if (null === $order) {
-            throw new NotFoundHttpException('Order not found');
-        }
 
-        $n = 0;
+        $elements = $this->doDenyElements($order_id, $elementIds, $acceptor);
-        $elements = $request->request->get('elements', []);
-        $manager = $this->getEntityManager();
-        foreach ($order->getElements() as $orderElement) {
-            if (in_array($orderElement->getId(),$elements)) {
-                $orderElement->setOrderMaster($this->getAuthenticatedUser());
-                $orderElement->setDeny(true);
 
-                $manager->persist($orderElement);
+        $success = !empty($elements);
-                $n++;
-            }
-        }
-
-        try {
-            if ($n > 0) {
-                $order->setTodo($order->getTodo() - $n);
-                $this->dispatch(PhraseaEvents::ORDER_DENY, new OrderDeliveryEvent($order, $this->getAuthenticatedUser(), $n));
-            }
-            $success = true;
-
-            $manager->persist($order);
-            $manager->flush();
-        } catch (\Exception $e) {
-
-        }
 
         if ('json' === $request->getRequestFormat()) {
             return $this->app->json([
@@ -286,11 +198,5 @@ class OrderController extends Controller
         ]);
     }
 
-    /**
+
-     * @return OrderRepository
-     */
-    private function getOrderRepository()
-    {
-        return $this->app['repo.orders'];
-    }
 }

lib/Alchemy/Phrasea/Order/OrderBasketProvider.php

@@ -0,0 +1,58 @@
+<?php
+/**
+ * This file is part of Phraseanet
+ *
+ * (c) 2005-2016 Alchemy
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Alchemy\Phrasea\Order;
+
+use Alchemy\Phrasea\Model\Entities\Basket;
+use Alchemy\Phrasea\Model\Entities\Order;
+use Alchemy\Phrasea\Model\Entities\User;
+use Doctrine\ORM\EntityManager;
+use Symfony\Component\Translation\TranslatorInterface;
+
+class OrderBasketProvider
+{
+    /**
+     * @var EntityManager
+     */
+    private $manager;
+
+    /**
+     * @var TranslatorInterface
+     */
+    private $translator;
+
+    public function __construct(EntityManager $manager, TranslatorInterface $translator)
+    {
+        $this->manager = $manager;
+        $this->translator = $translator;
+    }
+
+    public function provideBasketForOrderAndUser(Order $order, User $acceptor)
+    {
+        $basket = $order->getBasket();
+
+        if (null === $basket) {
+            $basket = new Basket();
+            $basket->setName($this->translator->trans('Commande du %date%', [
+                '%date%' => $order->getCreatedOn()->format('Y-m-d'),
+            ]));
+
+            $order->setBasket($basket);
+
+            $basket->setUser($order->getUser());
+            $basket->setPusher($acceptor);
+
+            $this->manager->persist($basket);
+            $this->manager->flush($basket);
+        }
+
+        return $basket;
+    }
+}

lib/Alchemy/Phrasea/Order/OrderFiller.php

@@ -34,7 +34,7 @@ class OrderFiller
     }
 
     /**
-     * @param \record_adapter[] $records
+     * @param \record_adapter[]|\Traversable $records
      */
     public function assertAllRecordsHaveOrderMaster($records)
     {
@@ -62,7 +62,7 @@ class OrderFiller
     }
 
     /**
-     * @param \record_adapter[] $records
+     * @param \record_adapter[]|\Traversable $records
      * @param Order $order
      */
     public function fillOrder(Order $order, $records)

lib/Alchemy/Phrasea/Order/OrderValidator.php

@@ -0,0 +1,176 @@
+<?php
+/**
+ * This file is part of Phraseanet
+ *
+ * (c) 2005-2016 Alchemy
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Alchemy\Phrasea\Order;
+
+use Alchemy\Phrasea\Application\Helper\AclAware;
+use Alchemy\Phrasea\Collection\Reference\CollectionReferenceRepository;
+use Alchemy\Phrasea\Model\Entities\BasketElement;
+use Alchemy\Phrasea\Model\Entities\OrderElement;
+use Alchemy\Phrasea\Model\Entities\User;
+use Alchemy\Phrasea\Record\RecordReference;
+use Alchemy\Phrasea\Record\RecordReferenceCollection;
+use Assert\Assertion;
+
+class OrderValidator
+{
+    const VALIDATION_ACCEPT = false;
+    const VALIDATION_DENY = true;
+
+    use AclAware;
+
+    /**
+     * @var \appbox
+     */
+    private $appbox;
+
+    /**
+     * @var CollectionReferenceRepository
+     */
+    private $repository;
+
+    public function __construct(\appbox $appbox, CollectionReferenceRepository $repository)
+    {
+        $this->appbox = $appbox;
+        $this->repository = $repository;
+    }
+
+    /**
+     * @param User $acceptor
+     * @param OrderElement[] $elements
+     * @return bool
+     */
+    public function isGrantedValidation(User $acceptor, $elements)
+    {
+        $acceptableCollections = $this->getAclForUser($acceptor)->getOrderMasterCollectionsBaseIds();
+
+        $elementsCollections = [];
+
+        foreach ($elements as $element) {
+            $elementsCollections[$element->getBaseId()] = true;
+        }
+
+        return empty(array_diff(array_keys($elementsCollections), $acceptableCollections));
+    }
+
+    /**
+     * @param PartialOrder $order
+     * @return BasketElement[]
+     */
+    public function createBasketElements(PartialOrder $order)
+    {
+        $basketElements = [];
+
+        $references = $this->getRecordReferenceCollection($order);
+
+        foreach ($references->toRecords($this->appbox) as $record) {
+            $basketElement = new BasketElement();
+            $basketElement->setRecord($record);
+
+            $basketElements[] = $basketElement;
+        }
+
+        return $basketElements;
+    }
+
+    /**
+     * @param User $acceptor
+     * @param PartialOrder $order
+     */
+    public function accept(User $acceptor, PartialOrder $order)
+    {
+        $this->acceptOrDenyPartialOrder($acceptor, $order, self::VALIDATION_ACCEPT);
+    }
+
+    /**
+     * @param User $acceptor
+     * @param PartialOrder $order
+     */
+    public function deny(User $acceptor, PartialOrder $order)
+    {
+        $this->acceptOrDenyPartialOrder($acceptor, $order, self::VALIDATION_DENY);
+    }
+
+    /**
+     * @param User $user
+     * @param BasketElement[] $elements
+     */
+    public function grantHD(User $user, $elements)
+    {
+        Assertion::allIsInstanceOf($elements, BasketElement::class);
+
+        $acl = $this->getAclForUser($user);
+
+        foreach ($elements as $element) {
+            $recordReference = RecordReference::createFromDataboxIdAndRecordId(
+                $element->getSbasId(),
+                $element->getRecordId()
+            );
+
+            $acl->grant_hd_on($recordReference, $user, 'order');
+        }
+    }
+
+    /**
+     * @param PartialOrder $order
+     * @return RecordReferenceCollection
+     */
+    private function getRecordReferenceCollection(PartialOrder $order)
+    {
+        $databoxIdMap = [];
+
+        foreach ($this->repository->findMany($order->getBaseIds()) as $collectionReference) {
+            $databoxIdMap[$collectionReference->getBaseId()] = $collectionReference->getDataboxId();
+        }
+
+        $references = new RecordReferenceCollection();
+
+        foreach ($order->getElements() as $orderElement) {
+            if (!isset($databoxIdMap[$orderElement->getBaseId()])) {
+                throw new \RuntimeException('At least one collection was not found.');
+            }
+
+            $references->addRecordReference(RecordReference::createFromDataboxIdAndRecordId(
+                $databoxIdMap[$orderElement->getBaseId()],
+                $orderElement->getRecordId()
+            ));
+        }
+
+        return $references;
+    }
+
+    /**
+     * @param User $acceptor
+     * @param PartialOrder $order
+     * @param bool $deny
+     */
+    private function acceptOrDenyPartialOrder(User $acceptor, PartialOrder $order, $deny)
+    {
+        $elements = $order->getElements();
+
+        if (empty($elements)) {
+            return;
+        }
+
+        $decrementCount = 0;
+
+        foreach ($elements as $element) {
+            $element->setOrderMaster($acceptor);
+            if (null === $element->getDeny()) {
+                ++$decrementCount;
+            }
+            $element->setDeny($deny);
+        }
+
+        if ($decrementCount) {
+            $order->getOrder()->decrementTodo($decrementCount);
+        }
+    }
+}

lib/Alchemy/Phrasea/Order/PartialOrder.php

@@ -0,0 +1,76 @@
+<?php
+/**
+ * This file is part of Phraseanet
+ *
+ * (c) 2005-2016 Alchemy
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Alchemy\Phrasea\Order;
+
+use Alchemy\Phrasea\Model\Entities\Order;
+use Alchemy\Phrasea\Model\Entities\OrderElement;
+use Assert\Assertion;
+
+class PartialOrder
+{
+    /**
+     * @var Order
+     */
+    private $order;
+
+    /**
+     * @var OrderElement[]
+     */
+    private $elements;
+
+    /**
+     * @param Order $order
+     * @param OrderElement[] $elements
+     */
+    public function __construct(Order $order, $elements)
+    {
+        Assertion::allIsInstanceOf($elements, OrderElement::class);
+
+        $this->order = $order;
+
+        $this->elements = [];
+
+        foreach ($elements as $element) {
+            if (null === $element->getOrder() || $element->getOrder()->getId() !== $order->getId()) {
+                throw new \InvalidArgumentException('Elements should belong to same order');
+            }
+
+            $this->elements[$element->getId()] = $element;
+        }
+    }
+
+    /**
+     * @return Order
+     */
+    public function getOrder()
+    {
+        return $this->order;
+    }
+
+    /**
+     * @return OrderElement[]
+     */
+    public function getElements()
+    {
+        return $this->elements;
+    }
+
+    public function getBaseIds()
+    {
+        $baseIds = [];
+
+        foreach ($this->elements as $element) {
+            $baseIds[$element->getBaseId()] = true;
+        }
+
+        return array_keys($baseIds);
+    }
+}

lib/Alchemy/Phrasea/Record/RecordReferenceCollection.php

@@ -15,8 +15,6 @@ use Assert\Assertion;
 
 class RecordReferenceCollection implements \IteratorAggregate
 {
-    private $groups;
-
     /**
      * @param array<int|string,array> $records
      * @return RecordReferenceCollection
@@ -43,16 +41,27 @@ class RecordReferenceCollection implements \IteratorAggregate
      */
     private $references = [];
 
+    /**
+     * @var null|array
+     */
+    private $groups;
+
     /**
      * @param RecordReferenceInterface[] $references
      */
-    public function __construct($references)
+    public function __construct($references = [])
     {
         Assertion::allIsInstanceOf($references, RecordReferenceInterface::class);
 
         $this->references = $references instanceof \Traversable ? iterator_to_array($references) : $references;
     }
 
+    public function addRecordReference(RecordReferenceInterface $reference)
+    {
+        $this->references[] = $reference;
+        $this->groups = null;
+    }
+
     public function getIterator()
     {
         return new \ArrayIterator($this->references);

lib/classes/ACL.php

@@ -10,15 +10,12 @@
  */
 
 use Alchemy\Phrasea\Application;
-use Alchemy\Phrasea\Model\Entities\User;
+use Alchemy\Phrasea\Collection\Reference\CollectionReferenceCollection;
-use Doctrine\DBAL\DBALException;
-use Alchemy\Phrasea\Model\RecordInterface;
-
-use Alchemy\Phrasea\Core\Event\Acl\AclEvents;
 use Alchemy\Phrasea\Core\Event\Acl\AccessPeriodChangedEvent;
 use Alchemy\Phrasea\Core\Event\Acl\AccessToBaseGrantedEvent;
 use Alchemy\Phrasea\Core\Event\Acl\AccessToBaseRevokedEvent;
 use Alchemy\Phrasea\Core\Event\Acl\AccessToSbasGrantedEvent;
+use Alchemy\Phrasea\Core\Event\Acl\AclEvents;
 use Alchemy\Phrasea\Core\Event\Acl\DownloadQuotasOnBaseChangedEvent;
 use Alchemy\Phrasea\Core\Event\Acl\DownloadQuotasOnBaseRemovedEvent;
 use Alchemy\Phrasea\Core\Event\Acl\DownloadQuotasResetEvent;
@@ -26,6 +23,10 @@ use Alchemy\Phrasea\Core\Event\Acl\MasksOnBaseChangedEvent;
 use Alchemy\Phrasea\Core\Event\Acl\RightsToBaseChangedEvent;
 use Alchemy\Phrasea\Core\Event\Acl\RightsToSbasChangedEvent;
 use Alchemy\Phrasea\Core\Event\Acl\SysadminChangedEvent;
+use Alchemy\Phrasea\Model\Entities\User;
+use Alchemy\Phrasea\Model\RecordInterface;
+use Alchemy\Phrasea\Model\RecordReferenceInterface;
+use Doctrine\DBAL\DBALException;
 
 
 class ACL implements cache_cacheableInterface
@@ -52,51 +53,40 @@ class ACL implements cache_cacheableInterface
     ];
 
     /**
-     *
+     * @var User
-     * @var user
      */
     protected $user;
 
     /**
-     *
+     * @var array
-     * @var Array
      */
     protected $_rights_sbas;
 
     /**
-     *
+     * @var array
-     * @var Array
      */
     protected $_rights_bas;
 
     /**
-     *
+     * @var array
-     * @var Array
      */
     protected $_rights_records_document;
 
     /**
-     *
+     * @var array
-     * @var Array
      */
     protected $_rights_records_preview;
 
     /**
-     *
+     * @var array
-     * @var Array
      */
     protected $_limited;
 
     /**
-     *
+     * @var bool
-     * @var boolean
      */
     protected $is_admin;
 
-    /**
-     *
-     * @var Array
-     */
     protected $_global_rights = [
         'addrecord'          => false,
         'addtoalbum'         => false,
@@ -121,7 +111,6 @@ class ACL implements cache_cacheableInterface
     ];
 
     /**
-     *
      * @var Application
      */
     protected $app;
@@ -140,15 +129,11 @@ class ACL implements cache_cacheableInterface
      *
      * @param User        $user
      * @param Application $app
-     *
-     * @return \ACL
      */
     public function __construct(User $user, Application $app)
     {
         $this->user = $user;
         $this->app = $app;
-
-        return $this;
     }
 
     /**
@@ -164,10 +149,10 @@ class ACL implements cache_cacheableInterface
     /**
      * Check if a hd grant has been received for a record
      *
-     * @param  \record_adapter $record
+     * @param RecordReferenceInterface $record
-     * @return boolean
+     * @return bool
      */
-    public function has_hd_grant(RecordInterface $record)
+    public function has_hd_grant(RecordReferenceInterface $record)
     {
 
         $this->load_hd_grant();
@@ -179,7 +164,7 @@ class ACL implements cache_cacheableInterface
         return false;
     }
 
-    public function grant_hd_on(RecordInterface $record, User $pusher, $action)
+    public function grant_hd_on(RecordReferenceInterface $record, User $pusher, $action)
     {
         $sql = 'REPLACE INTO records_rights
             (id, usr_id, sbas_id, record_id, document, `case`, pusher_usr_id)
@@ -203,7 +188,7 @@ class ACL implements cache_cacheableInterface
         return $this;
     }
 
-    public function grant_preview_on(RecordInterface $record, User $pusher, $action)
+    public function grant_preview_on(RecordReferenceInterface $record, User $pusher, $action)
     {
         $sql = 'REPLACE INTO records_rights
             (id, usr_id, sbas_id, record_id, preview, `case`, pusher_usr_id)
@@ -230,10 +215,10 @@ class ACL implements cache_cacheableInterface
     /**
      * Check if a hd grant has been received for a record
      *
-     * @param  \record_adapter $record
+     * @param RecordReferenceInterface $record
-     * @return boolean
+     * @return bool
      */
-    public function has_preview_grant(RecordInterface $record)
+    public function has_preview_grant(RecordReferenceInterface $record)
     {
         $this->load_hd_grant();
 
@@ -1761,24 +1746,50 @@ class ACL implements cache_cacheableInterface
     }
 
     /**
-     * Returns an array of collections on which the user is 'order master'
+     * Returns base ids on which user is 'order master'
      *
      * @return array
      */
-    public function get_order_master_collections()
+    public function getOrderMasterCollectionsBaseIds()
     {
         $sql = 'SELECT base_id FROM basusr WHERE order_master="1" AND usr_id= :usr_id';
-        $stmt = $this->app->getApplicationBox()->get_connection()->prepare($sql);
+        $result = $this->app->getApplicationBox()
-        $stmt->execute([':usr_id' => $this->user->getId()]);
+            ->get_connection()
-        $rs = $stmt->fetchAll(\PDO::FETCH_ASSOC);
+            ->executeQuery($sql, [':usr_id' => $this->user->getId()])
-        $stmt->closeCursor();
+            ->fetchAll(\PDO::FETCH_ASSOC);
+
+
+        $baseIds = [];
+
+        foreach ($result as $item) {
+            $baseIds[] = $item['base_id'];
+        }
+
+        return $baseIds;
+    }
+
+    /**
+     * Returns an array of collections on which the user is 'order master'
+     *
+     * @return collection[]
+     */
+    public function get_order_master_collections()
+    {
+        $baseIds = $this->getOrderMasterCollectionsBaseIds();
+
+        $collectionReferences = $this->app['repo.collection-references']->findHavingOrderMaster($baseIds);
+        $groups = new CollectionReferenceCollection($collectionReferences);
 
         $collections = [];
 
-        foreach ($rs as $row) {
+        foreach ($groups->groupByDataboxIdAndCollectionId() as $databoxId => $group) {
-            $collections[] = \collection::getByBaseId($this->app, $row['base_id']);
+            foreach ($group as $collectionId => $index) {
+                $collections[$index] = \collection::getByCollectionId($this->app, $databoxId, $collectionId);
+            }
         }
 
+        ksort($collections);
+
         return $collections;
     }
 

lib/classes/collection.php

@@ -192,16 +192,17 @@ class collection implements ThumbnailedElement, cache_cacheableInterface
     }
 
     /**
-     * @param  Application $app
+     * @param Application $app
-     * @param  databox $databox
+     * @param databox|int $databox
-     * @param  int $collectionId
+     * @param int $collectionId
      * @return collection
      */
-    public static function getByCollectionId(Application $app, databox $databox, $collectionId)
+    public static function getByCollectionId(Application $app, $databox, $collectionId)
     {
         assert(is_int($collectionId));
+        $databoxId = $databox instanceof databox ? $databox->get_sbas_id() : (int)$databox;
 
-        return self::getAvailableCollection($app, $databox->get_sbas_id(), $collectionId);
+        return self::getAvailableCollection($app, $databoxId, $collectionId);
     }
 
     /**

lib/conf.d/json_schema/orders.json

@@ -64,7 +64,7 @@
                 "owner_id",
                 "created",
                 "usage",
-                "records"
+                "elements"
             ]
         },
         "order_element": {
@@ -87,6 +87,23 @@
                 "id",
                 "record_id"
             ]
+        },
+        "order_element_id": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "integer"
+                }
+            },
+            "required": [
+                "id"
+            ]
+        },
+        "order_element_collection": {
+            "type": "array",
+            "items": {
+                "$ref": "#/definitions/order_element_id"
+            }
         }
     },
     "type": "object",

tests/Alchemy/Tests/Phrasea/Controller/Prod/OrderTest.php

@@ -116,12 +116,11 @@ class OrderTest extends \PhraseanetAuthenticatedWebTestCase
         foreach ($order->getElements() as $element) {
             $parameters[] = $element->getId();
         }
-        $client = $this->getClient();
+        $response = $this->request('POST', '/prod/order/' . $order->getId() . '/send/', ['elements' => $parameters]);
-        $client->request('POST', '/prod/order/' . $order->getId() . '/send/', ['elements' => $parameters]);
+        $this->assertTrue($response->isRedirect(), 'Could not validate some elements. not a redirect');
-        $this->assertTrue($client->getResponse()->isRedirect());
+        $url = parse_url($response->headers->get('location'));
-        $url = parse_url($client->getResponse()->headers->get('location'));
         parse_str($url['query']);
-        $this->assertTrue( strpos($url['query'], 'success=1') === 0);
+        $this->assertTrue(strpos($url['query'], 'success=1') === 0, 'Validation of elements is not successful');
     }
 
     /**