update ordedr list

This reverts commit a89ff00d94.

internal/handler/order_handler.go

@@ -140,6 +140,7 @@ func (h *OrderHandler) ListOrders(c *gin.Context) {
 	if modelReq.OutletID == nil && contextInfo.OutletID != uuid.Nil {
 		modelReq.OutletID = &contextInfo.OutletID
 	}
+
 	response, err := h.orderService.ListOrders(c.Request.Context(), modelReq)
 	if err != nil {
 		util.HandleResponse(c.Writer, c.Request, contract.BuildErrorResponse([]*contract.ResponseError{contract.NewResponseError("internal_error", "OrderHandler::ListOrders", err.Error())}), "OrderHandler::ListOrders")

internal/repository/order_repository.go

@@ -27,7 +27,6 @@ type OrderRepository interface {
 	UpdatePaymentStatus(ctx context.Context, id uuid.UUID, status entities.PaymentStatus) error
 	UpdateStatus(ctx context.Context, id uuid.UUID, status entities.OrderStatus) error
 	GetNextOrderNumber(ctx context.Context, organizationID, outletID uuid.UUID) (string, error)
-	ListByOutletID(ctx context.Context, outletID uuid.UUID, limit, offset int) ([]*entities.Order, int64, error)
 }
 
 type OrderRepositoryImpl struct {
@@ -99,7 +98,42 @@ func (r *OrderRepositoryImpl) List(ctx context.Context, filters map[string]inter
 	var orders []*entities.Order
 	var total int64
 
-	query := r.db.WithContext(ctx).Model(&entities.Order{}).
+	// organization_id is mandatory to prevent cross-org data leaks
+	organizationID, ok := filters["organization_id"]
+	if !ok {
+		return nil, 0, fmt.Errorf("organization_id is required for listing orders")
+	}
+
+	baseQuery := r.db.WithContext(ctx).Model(&entities.Order{}).
+		Where("organization_id = ?", organizationID)
+
+	// outlet_id is optional — if present, scope to that outlet; otherwise return all outlets in the org
+	if outletID, exists := filters["outlet_id"]; exists {
+		baseQuery = baseQuery.Where("outlet_id = ?", outletID)
+	}
+
+	for key, value := range filters {
+		switch key {
+		case "organization_id", "outlet_id":
+			// already handled above
+		case "search":
+			searchValue := "%" + value.(string) + "%"
+			baseQuery = baseQuery.Where("order_number ILIKE ?", searchValue)
+		case "date_from":
+			baseQuery = baseQuery.Where("created_at >= ?", value)
+		case "date_to":
+			baseQuery = baseQuery.Where("created_at <= ?", value)
+		default:
+			baseQuery = baseQuery.Where(key+" = ?", value)
+		}
+	}
+
+	// Use separate queries for count and find to avoid GORM state mutation issues
+	if err := baseQuery.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+
+	err := baseQuery.
 		Preload("Organization").
 		Preload("Outlet").
 		Preload("User").
@@ -108,27 +142,8 @@ func (r *OrderRepositoryImpl) List(ctx context.Context, filters map[string]inter
 		Preload("OrderItems.ProductVariant").
 		Preload("Payments").
 		Preload("Payments.PaymentMethod").
-		Preload("Payments.PaymentOrderItems")
-
-	for key, value := range filters {
-		switch key {
-		case "search":
-			searchValue := "%" + value.(string) + "%"
-			query = query.Where("order_number ILIKE ?", searchValue)
-		case "date_from":
-			query = query.Where("created_at >= ?", value)
-		case "date_to":
-			query = query.Where("created_at <= ?", value)
-		default:
-			query = query.Where(key+" = ?", value)
-		}
-	}
-
-	if err := query.Count(&total).Error; err != nil {
-		return nil, 0, err
-	}
-
-	err := query.Limit(limit).Offset(offset).Order("created_at DESC").Find(&orders).Error
+		Preload("Payments.PaymentOrderItems").
+		Limit(limit).Offset(offset).Order("created_at DESC").Find(&orders).Error
 	return orders, total, err
 }
 
@@ -271,27 +286,3 @@ func (r *OrderRepositoryImpl) GetNextOrderNumber(ctx context.Context, organizati
 	orderNumber := fmt.Sprintf("ORD/%04d%02d/%06d", year, month, sequence.SequenceNumber)
 	return orderNumber, nil
 }
-
-func (r *OrderRepositoryImpl) ListByOutletID(ctx context.Context, outletID uuid.UUID, limit, offset int) ([]*entities.Order, int64, error) {
-	var orders []*entities.Order
-	var total int64
-
-	query := r.db.WithContext(ctx).Model(&entities.Order{}).
-		Preload("Organization").
-		Preload("Outlet").
-		Preload("User").
-		Preload("OrderItems").
-		Preload("OrderItems.Product").
-		Preload("OrderItems.ProductVariant").
-		Preload("Payments").
-		Preload("Payments.PaymentMethod").
-		Preload("Payments.PaymentOrderItems").
-		Where("outlet_id = ?", outletID)
-
-	if err := query.Count(&total).Error; err != nil {
-		return nil, 0, err
-	}
-
-	err := query.Limit(limit).Offset(offset).Order("created_at DESC").Find(&orders).Error
-	return orders, total, err
-}