From 2992e4805e761081752ff8fadbdebb007710b4f1 Mon Sep 17 00:00:00 2001
From: Michael Czechowski <mail@librete.ch>
Date: Thu, 8 Oct 2026 22:55:13 +0200
Subject: [PATCH] fix(order): answer 404 instead of 500 for a missing order

findOne and findOneByUuid mapped order.cart before checking that the order
exists, and the service's findOneByUuid did the same, so a missing order
threw a TypeError: GET /orders/:uuid/cart, add-product, remove-product,
generate-invoice and generate-delivery-note answered 500.

The service's findOneByUuid now returns null for a missing order, and each
caller handles it: the controllers answer 404, sendInvoice and
sendDeliveryNote throw a NotFoundError.

Refs https://git.librete.ch/libretech/mp/issues/71
---
 src/api/order/controllers/order.ts | 6 ++++--
 src/api/order/services/order.ts    | 5 ++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/api/order/controllers/order.ts b/src/api/order/controllers/order.ts
index 52be99d..d0d2830 100644
--- a/src/api/order/controllers/order.ts
+++ b/src/api/order/controllers/order.ts
@@ -68,6 +68,7 @@ export default factories.createCoreController("api::order.order", ({ strapi }) =
 			where: { id },
 			...orderDefaultParams
 		});
+		if (!order) return ctx.notFound("Order not found");
 		order.cart = order?.cart.map((item) => ({
 			...item,
 			product: {
@@ -75,7 +76,6 @@ export default factories.createCoreController("api::order.order", ({ strapi }) =
 				totalProductPrice: calculateTotalProductPrice(item.product)
 			}
 		}));
-		if (!order) return ctx.notFound("Order not found");
 		return await sanitize.contentAPI.output(order, strapi.getModel("api::order.order"));
 	},
 
@@ -85,6 +85,7 @@ export default factories.createCoreController("api::order.order", ({ strapi }) =
 			where: { uuid },
 			...orderDefaultParams
 		});
+		if (!order) return ctx.notFound("Order not found");
 		order.cart = order?.cart.map((item) => ({
 			...item,
 			product: {
@@ -92,7 +93,6 @@ export default factories.createCoreController("api::order.order", ({ strapi }) =
 				totalProductPrice: calculateTotalProductPrice(item.product)
 			}
 		}));
-		if (!order) return ctx.notFound("Order not found");
 		return await sanitize.contentAPI.output(order, strapi.getModel("api::order.order"));
 	},
 
@@ -245,6 +245,7 @@ export default factories.createCoreController("api::order.order", ({ strapi }) =
 		const { uuid } = await sanitize.contentAPI.query(ctx.params, strapi.getModel("api::order.order"));
 		strapi.log.info(`app:i:order-controller: Started invoice generation`);
 		const orderUnsafe = (await strapi.service("api::order.order").findOneByUuid(uuid)) as Order;
+		if (!orderUnsafe) return ctx.notFound("Order not found");
 
 		if (!orderUnsafe.paymentAuthorised) {
 			return ctx.locked("Payment not authorised, cannot generate invoice");
@@ -263,6 +264,7 @@ export default factories.createCoreController("api::order.order", ({ strapi }) =
 		const { uuid } = await sanitize.contentAPI.query(ctx.params, strapi.getModel("api::order.order"));
 		strapi.log.info(`app:i:order-controller: Started delivery note generation`);
 		const orderUnsafe = (await strapi.service("api::order.order").findOneByUuid(uuid)) as Order;
+		if (!orderUnsafe) return ctx.notFound("Order not found");
 
 		if (!orderUnsafe.paymentAuthorised) {
 			return ctx.locked("Payment not authorised, cannot generate delivery note");
diff --git a/src/api/order/services/order.ts b/src/api/order/services/order.ts
index dd846be..a73f856 100644
--- a/src/api/order/services/order.ts
+++ b/src/api/order/services/order.ts
@@ -1,7 +1,7 @@
 import path from "path";
 import fs from "fs";
 import { factories } from "@strapi/strapi";
-import { sanitize } from "@strapi/utils";
+import { errors, sanitize } from "@strapi/utils";
 import { ID } from "@strapi/database/dist/types";
 import { vatDecimal, vatIncludedDecimal, baseUrl, adminEmail, shopName, shopContactName, shopAddress, shopPhone, shopEmail, shopLogoUrl, shopSecondaryLogoUrl } from "../../../../config/constants";
 import { calculateTotalProductPrice, productDefaultParams } from "../../product/services/product";
@@ -32,6 +32,7 @@ export default factories.createCoreService("api::order.order", ({ strapi }) => (
 			where: { uuid },
 			...orderDefaultParams
 		});
+		if (!orderUnsafe) return null;
 		orderUnsafe.cart = orderUnsafe?.cart.map((item: CartProduct) => ({
 			...item,
 			product: {
@@ -80,6 +81,7 @@ export default factories.createCoreService("api::order.order", ({ strapi }) => (
 	sendInvoice: async (uuid: string, blob?: any) => {
 		strapi.log.info(`app:i:order-service: - Sending invoice for order ${uuid}`);
 		const oderUnsafe = (await strapi.service("api::order.order").findOneByUuid(uuid)) as Partial<Order>;
+		if (!oderUnsafe) throw new errors.NotFoundError("Order not found");
 
 		const shopContext = { shopName, shopContactName, shopAddress, shopPhone, shopEmail, shopLogoUrl, shopSecondaryLogoUrl };
 		try {
@@ -119,6 +121,7 @@ export default factories.createCoreService("api::order.order", ({ strapi }) => (
 	sendDeliveryNote: async (uuid: string, blob?: ArrayBuffer) => {
 		strapi.log.info(`app:i:order-service: - Sending delivery note for order ${uuid}`);
 		const oderUnsafe = (await strapi.service("api::order.order").findOneByUuid(uuid)) as Partial<Order>;
+		if (!oderUnsafe) throw new errors.NotFoundError("Order not found");
 		const shopContext = { shopName, shopContactName, shopAddress, shopPhone, shopEmail, shopLogoUrl, shopSecondaryLogoUrl };
 		try {
 			const emailConfig: MessageBody = {