Issue #39 — Backend: Get Invoices Endpoints & Invoice Download

[yusuftomilola]

Location: backend/src/invoices/

Description

Members need to retrieve their invoices and download them as PDFs. Admins need to see all invoices platform-wide. This issue implements the read endpoints for the invoices module, including a dedicated download endpoint that streams the PDF back to the client.

Acceptance Criteria

• GET /invoices returns a paginated list of invoices
  • Supports query params: page (default 1), limit (default 10), status (optional, filters by InvoiceStatus)
  • If the requesting user's role is ADMIN, SUPER_ADMIN, or STAFF — returns all invoices across all members
  • If the requesting user's role is USER — returns only that user's own invoices
  • Each invoice includes the booking, booking.workspace, and user relations
  • Response shape: { success: true, data: Invoice[], meta: { total, page, limit, totalPages } }
• GET /invoices/:id returns a single invoice by UUID
  • Members can only access their own invoices — throws ForbiddenException if the invoice does not belong to them
  • Throws NotFoundException if the invoice does not exist
  • Includes booking, booking.workspace, user, and payment relations
  • Response shape: { success: true, data: Invoice }
• GET /invoices/:id/download returns the invoice as a PDF file
  • Same ownership rules apply — members can only download their own invoices
  • Calls PdfInvoiceProvider.generate() to produce the buffer
  • Sets response headers: Content-Type: application/pdf, Content-Disposition: attachment; filename="invoice-<invoiceNumber>.pdf"
  • Pipes or writes the buffer to the response using @Res() res: Response
• All three endpoints use @GetCurrentUser('id') and @GetCurrentUser('role') to determine scope
• npx tsc --noEmit passes with no errors