Abo: Doppelbestellung verhindern, Payment-Link loeschen & Pending-Status

Verhindert das Anlegen eines zweiten Abos (eigenes oder Kundenabo) wenn
bereits eines initiiert ist bzw. ein offener Abo-Payment-Link existiert
(redirectIfAboAlreadyInitiated). Payment-Links koennen jetzt geloescht
werden, abgesichert ueber canDeleteInstance + Shop-Zugehoerigkeit, mit
Erfolgs-/Fehler-Flash. Kundenabo-Uebersicht zeigt den Pending-Initial-
Payment-Status (wartend / in Bearbeitung / fehlgeschlagen).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Http/Controllers/User/OrderPaymentController.php

@@ -1,18 +1,14 @@
 <?php
 
-
 namespace App\Http\Controllers\User;
 
-
-use Request;
-use App\User;
-use App\Models\ShoppingInstance;
 use App\Http\Controllers\Controller;
+use App\Models\ShoppingInstance;
 use App\Services\OrderPaymentService;
+use App\User;
 
 class OrderPaymentController extends Controller
 {
-
     public function __construct()
     {
         $this->middleware('active.account');
@@ -22,6 +18,7 @@ class OrderPaymentController extends Controller
     {
         $data = [
         ];
+
         return view('user.order.payment.index', $data);
     }
 
@@ -29,15 +26,34 @@ class OrderPaymentController extends Controller
     {
         $data = OrderPaymentService::getCustomPayment($identifier);
         $data['backlink'] = route('user_order_payment_links');
+
         return view('user.order.payment.custom_payment', $data);
     }
 
-    public function delete($identifier){
+    public function delete($identifier)
+    {
+        $shoppingInstance = ShoppingInstance::where('identifier', $identifier)->firstOrFail();
+        $user = User::find(\Auth::user()->id);
+        $userShopId = $user->shop ? $user->shop->id : null;
+
+        if ((int) $shoppingInstance->user_shop_id !== (int) $userShopId) {
+            abort(403);
+        }
+
+        if (! OrderPaymentService::canDeleteInstance($shoppingInstance)) {
+            \Session()->flash('alert-error', __('abo.payment_link_delete_not_allowed'));
+
+            return redirect(route('user_order_payment_links'));
+        }
+
         OrderPaymentService::deleteInstance($identifier);
+        \Session()->flash('alert-success', __('abo.payment_link_delete_success'));
+
         return redirect(route('user_order_payment_links'));
     }
 
-    public function datatable(){
+    public function datatable()
+    {
 
         $user = User::find(\Auth::user()->id);
         $user_shop_id = $user->shop ? $user->shop->id : null;
@@ -50,7 +66,7 @@ class OrderPaymentController extends Controller
                 return '<a href="'.route('user_order_payment_links_detail', [$shoppingInstance->identifier]).'" class="btn icon-btn btn-sm btn-primary"><span class="fa fa-edit"></span></a>';
             })
             ->addColumn('created_at', function (ShoppingInstance $shoppingInstance) {
-                return $shoppingInstance->created_at->format("d.m.Y");
+                return $shoppingInstance->created_at->format('d.m.Y');
             })
             ->addColumn('status', function (ShoppingInstance $shoppingInstance) {
                 return OrderPaymentService::getStatusBadge($shoppingInstance);
@@ -59,9 +75,9 @@ class OrderPaymentController extends Controller
                 return $shoppingInstance->payment_method ? $shoppingInstance->payment_method->name : '-';
             })
             ->addColumn('total', function (ShoppingInstance $shoppingInstance) {
-                if($shoppingInstance->amount > 0){
-                    return '<span class="no-line-break">'.$shoppingInstance->getAmountFormatted()." €</span>";
-                }else{
+                if ($shoppingInstance->amount > 0) {
+                    return '<span class="no-line-break">'.$shoppingInstance->getAmountFormatted().' €</span>';
+                } else {
                     return '-';
                 }
             })
@@ -78,12 +94,16 @@ class OrderPaymentController extends Controller
                 return $shoppingInstance->shopping_data['billing_email'] ?? '-';
             })
             ->addColumn('delete', function (ShoppingInstance $shoppingInstance) {
+                if (! OrderPaymentService::canDeleteInstance($shoppingInstance)) {
+                    return '';
+                }
+
                 return '<a onclick="return confirm(\''.__('confirm_delete').'\');" href="'.route('user_order_payment_links_delete', [$shoppingInstance->identifier]).'" class="btn icon-btn btn-sm btn-danger"><span class="fa fa-trash"></span></a>';
             })
-           
+
             ->orderColumn('id', 'identifier $1')
             ->orderColumn('created_at', 'created_at $1')
-            ->orderColumn('status', 'status $1') 
+            ->orderColumn('status', 'status $1')
             ->orderColumn('total', 'total $1')
             ->orderColumn('type', 'type $1')
             ->orderColumn('billing_firstname', 'billing_firstname $1')
@@ -92,6 +112,4 @@ class OrderPaymentController extends Controller
             ->rawColumns(['id', 'status', 'type', 'total', 'invoice', 'delete'])
             ->make(true);
     }
-
-   
-}
+}