invoice-pdf.js

Go to the documentation of this file.

/**
 * @file routes/invoice-pdf.js
 * @module routes/invoice-pdf
 * @description Invoice PDF generation and serving endpoints.
 * Generates professional PDFs using server-side templates.
 */
 
const express = require('express');
const router = express.Router();
const path = require('path');
const fs = require('fs');
const jwt = require('jsonwebtoken');
const pool = require('../services/db');
const authenticateToken = require('../middleware/auth');
const { generateInvoicePDF, deleteInvoicePDFs, PDFS_DIR } = require('../services/pdfGenerator');
const { getTenantFilter } = require('../middleware/tenant');
 
/**
 * Custom authentication for PDF routes - accepts token from cookie, header, OR query parameter
 * Priority: 1. Cookie (preferred - secure), 2. Authorization header, 3. Query param (fallback)
 */
function authenticatePdfRequest(req, res, next) {
  // Check for token in cookie first (most secure - automatic from browser)
  let token = req.cookies.auth_token;
  
  // If not in cookie, check Authorization header (for API calls)
  if (!token) {
    const authHeader = req.headers['authorization'];
    token = authHeader && authHeader.split(' ')[1];
  }
  
  // Legacy fallback: query parameter (less secure, but backwards compatible)
  if (!token) {
    token = req.query.token;
  }
 
  if (!token) {
    return res.status(401).send('Access denied - No token provided');
  }
 
  // Verify token with JWT_SECRET
  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (!err) {
      req.user = user;
      req.user.tenantId = user.tenant_id || null;
      return next();
    }
    
    // Try AGENT_SIGN_KEY as fallback
    jwt.verify(token, process.env.AGENT_SIGN_KEY, (err2, user2) => {
      if (!err2) {
        req.user = user2;
        req.user.tenantId = user2.tenant_id || null;
        return next();
      }
      return res.status(403).send('Invalid token');
    });
  });
}
 
/**
 * @api {get} /invoices/:id/pdf Generate and Download Invoice PDF
 * @apiName GenerateInvoicePDF
 * @apiGroup Invoices
 * @apiDescription Generates a PDF for the invoice and returns it for download/viewing
 */
router.get('/:id/pdf', authenticatePdfRequest, async (req, res) => {
  const { id } = req.params;
  const { download = 'false' } = req.query;
 
  try {
    console.log('[PDF] Starting PDF generation for invoice:', id);
    
    // Fetch invoice with tenant filtering
    const { clause: tenantClause, params: tenantParams } = getTenantFilter(req, 'i');
    const baseParams = [id, ...tenantParams];
    const where = tenantClause ? `AND ${tenantClause}` : '';
 
    console.log('[PDF] Fetching invoice with params:', baseParams);
    const invoiceResult = await pool.query(`
      SELECT i.*
      FROM invoices i
      WHERE i.invoice_id = $1 ${where}
    `, baseParams);
 
    if (invoiceResult.rows.length === 0) {
      console.log('[PDF] Invoice not found:', id);
      return res.status(404).json({ error: 'Invoice not found' });
    }
 
    const invoice = invoiceResult.rows[0];
    console.log('[PDF] Invoice found:', invoice.invoice_id);
 
    // Fetch line items
    console.log('[PDF] Fetching line items');
    const itemsResult = await pool.query(
      'SELECT * FROM invoice_items WHERE invoice_id = $1 ORDER BY item_id',
      [id]
    );
    console.log('[PDF] Found', itemsResult.rows.length, 'line items');
 
    // Fetch customer
    console.log('[PDF] Fetching customer:', invoice.customer_id);
    const customerResult = await pool.query(
      'SELECT * FROM customers WHERE customer_id = $1',
      [invoice.customer_id]
    );
    const customer = customerResult.rows[0];
    console.log('[PDF] Customer found:', customer?.customer_id);
 
    // Company info - use hardcoded fallback values (settings table doesn't exist yet)
    console.log('[PDF] Using fallback company info');
    const companyInfo = {
      name: 'Independent Business Group',
      abn: '12 345 678 901',
      address: '123 Business Street, Sydney NSW 2000',
      phone: '1300 123 456',
      email: 'accounts@ibg.com.au'
    };
    console.log('[PDF] Company info:', companyInfo);
 
    // Delete old PDFs for this invoice
    console.log('[PDF] Deleting old PDFs');
    await deleteInvoicePDFs(invoice.invoice_id);
 
    // Generate new PDF
    console.log('[PDF] Calling generateInvoicePDF');
    const pdfPath = await generateInvoicePDF({
      invoice,
      customer,
      companyInfo,
      items: itemsResult.rows
    });
    console.log('[PDF] PDF generated at:', pdfPath);
 
    // Set headers
    const filename = `invoice-${String(invoice.invoice_id).padStart(5, '0')}.pdf`;
    
    res.setHeader('Content-Type', 'application/pdf');
    
    if (download === 'true') {
      res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
    } else {
      res.setHeader('Content-Disposition', `inline; filename="${filename}"`);
    }
 
    // Stream the PDF
    const stream = fs.createReadStream(pdfPath);
    stream.pipe(res);
 
    stream.on('error', (err) => {
      console.error('Error streaming PDF:', err);
      if (!res.headersSent) {
        res.status(500).json({ error: 'Error serving PDF' });
      }
    });
 
  } catch (error) {
    console.error('Error generating invoice PDF:', error);
    console.error('Error stack:', error.stack);
    console.error('Invoice ID:', req.params.id);
    console.error('User:', req.user);
    
    // Send detailed error in development
    if (process.env.NODE_ENV !== 'production') {
      return res.status(500).json({ 
        error: 'Failed to generate PDF', 
        details: error.message,
        stack: error.stack 
      });
    }
    
    res.status(500).json({ error: 'Failed to generate PDF', details: error.message });
  }
});
 
/**
 * @api {get} /public/pay/:token/pdf Generate Invoice PDF (Public)
 * @apiName GeneratePublicInvoicePDF
 * @apiGroup PublicPayment
 * @apiDescription Generates PDF for public invoice (no auth required)
 */
router.get('/public/:token/pdf', async (req, res) => {
  const { token } = req.params;
  const { download = 'false' } = req.query;
 
  try {
    // Validate token
    if (!/^[0-9a-f]{64}$/i.test(token)) {
      return res.status(400).json({ error: 'Invalid payment token format' });
    }
 
    // Fetch invoice by payment token
    const invoiceResult = await pool.query(`
      SELECT i.*
      FROM invoices i
      WHERE i.payment_token = $1
    `, [token]);
 
    if (invoiceResult.rows.length === 0) {
      return res.status(404).json({ error: 'Invoice not found' });
    }
 
    const invoice = invoiceResult.rows[0];
 
    // Fetch line items
    const itemsResult = await pool.query(
      'SELECT * FROM invoice_items WHERE invoice_id = $1 ORDER BY item_id',
      [invoice.invoice_id]
    );
 
    // Fetch customer
    const customerResult = await pool.query(
      'SELECT * FROM customers WHERE customer_id = $1',
      [invoice.customer_id]
    );
    const customer = customerResult.rows[0];
 
    // Fetch company info
    const companyResult = await pool.query(`
      SELECT 
        (SELECT value FROM settings WHERE key = 'company_name' LIMIT 1) as name,
        (SELECT value FROM settings WHERE key = 'company_abn' LIMIT 1) as abn,
        (SELECT value FROM settings WHERE key = 'company_address' LIMIT 1) as address,
        (SELECT value FROM settings WHERE key = 'company_phone' LIMIT 1) as phone,
        (SELECT value FROM settings WHERE key = 'company_email' LIMIT 1) as email
    `);
 
    const companyInfo = {
      name: companyResult.rows[0]?.name || 'Independent Business Group',
      abn: companyResult.rows[0]?.abn || '12 345 678 901',
      address: companyResult.rows[0]?.address || '123 Business Street, Sydney NSW 2000',
      phone: companyResult.rows[0]?.phone || '1300 123 456',
      email: companyResult.rows[0]?.email || 'accounts@ibg.com.au'
    };
 
    // Delete old PDFs
    await deleteInvoicePDFs(invoice.invoice_id);
 
    // Generate PDF
    const pdfPath = await generateInvoicePDF({
      invoice,
      customer,
      companyInfo,
      items: itemsResult.rows
    });
 
    // Set headers
    const filename = `invoice-${String(invoice.invoice_id).padStart(5, '0')}.pdf`;
    
    res.setHeader('Content-Type', 'application/pdf');
    
    if (download === 'true') {
      res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
    } else {
      res.setHeader('Content-Disposition', `inline; filename="${filename}"`);
    }
 
    // Stream the PDF
    const stream = fs.createReadStream(pdfPath);
    stream.pipe(res);
 
    stream.on('error', (err) => {
      console.error('Error streaming PDF:', err);
      if (!res.headersSent) {
        res.status(500).json({ error: 'Error serving PDF' });
      }
    });
 
  } catch (error) {
    console.error('Error generating public invoice PDF:', error);
    res.status(500).json({ error: 'Failed to generate PDF', details: error.message });
  }
});
 
module.exports = router;