Update: 2026-05-07 01:18:53

app/modules_app/batches/finalize.php

@@ -28,17 +28,19 @@ $db = Database::getInstance();
 
 // 1. Verify batch
 $stmt = $db->prepare("
-    SELECT id, status, total_images 
+    SELECT id, tenant_id, status, total_images 
     FROM invoice_batches 
-    WHERE id = ? AND tenant_id = ? AND uploaded_by = ?
+    WHERE id = ? AND uploaded_by = ?
 ");
-$stmt->execute([$batchId, $tenantId, $userId]);
+$stmt->execute([$batchId, $userId]);
 $batch = $stmt->fetch();
 
-if (!$batch) {
+if (!$batch || ($decoded['role'] !== 'super_admin' && $batch['tenant_id'] !== $tenantId)) {
     json_error('الدفعة غير موجودة', 404);
 }
 
+
+
 if ($batch['status'] !== 'uploading') {
     json_error('تم إنهاء هذه الدفعة مسبقاً', 400);
 }