tango-app-api-payment-subscription 3.5.18 → 3.5.19

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "tango-app-api-payment-subscription",
-    "version": "3.5.18",
+    "version": "3.5.19",
     "description": "paymentSubscription",
     "main": "index.js",
     "type": "module",

package/src/routes/billing.routes.js

@@ -42,7 +42,11 @@ billingRouter.post( '/payment-reminder', isAllowedSessionHandler, accessVerifica
 
 // Purchase Orders (brand-view Purchase Order tab).
 billingRouter.get( '/purchase-orders', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), getPurchaseOrders );
-billingRouter.post( '/purchase-orders', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), poUpload.single( 'file' ), createPurchaseOrder );
+// multer runs FIRST so it consumes the multipart stream off the live request.
+// The auth middlewares are async and do DB awaits while touching req.body;
+// running them before multer leaves the multipart stream unread and busboy
+// throws 'Unexpected end of form'. After multer, text fields are on req.body.
+billingRouter.post( '/purchase-orders', poUpload.single( 'file' ), isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Billing', permissions: [ 'isAdd' ] } ] } ), createPurchaseOrder );
 
 // Cron-triggered: sends the configured payment reminder emails. Unauthenticated
 // like the other cron endpoints; protect at the network / scheduler layer.

package/src/routes/paymentSubscription.routes.js

@@ -152,7 +152,7 @@ paymentSubscriptionRouter.post( '/updateRemind/:notificationId', isAllowedSessio
 paymentSubscriptionRouter.post( '/createDefaultbillings', paymentController.createDefaultbillings );
 
 // Brand documents (Plans & Subscription > Documents accordion).
-paymentSubscriptionRouter.post( '/client-document/upload', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), documentUpload.single( 'file' ), paymentController.uploadClientDocument );
+paymentSubscriptionRouter.post( '/client-document/upload', documentUpload.single( 'file' ), isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [ 'isEdit' ] } ] } ), paymentController.uploadClientDocument );
 paymentSubscriptionRouter.get( '/client-document/list', isAllowedSessionHandler, accessVerification( { userType: [ 'tango' ], access: [ { featureName: 'Global', name: 'Subscription', permissions: [] } ] } ), paymentController.getClientDocuments );
 
 // Toggle billing-group-wise pricing for a client (tango only, edit perm).