From e40e87efe0b1d0a2157d06c4542712c391de4adb Mon Sep 17 00:00:00 2001
From: John Mizerek <mizerek@gmail.com>
Date: Sat, 7 Feb 2026 11:58:44 -0800
Subject: [PATCH] Allow child businesses to use parent service points without
 grant

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 api/orders/getOrCreateCart.cfm | 59 ++++++++++++++++++++--------------
 1 file changed, 35 insertions(+), 24 deletions(-)

diff --git a/api/orders/getOrCreateCart.cfm b/api/orders/getOrCreateCart.cfm
index b5aa838..3b6c3d2 100644
--- a/api/orders/getOrCreateCart.cfm
+++ b/api/orders/getOrCreateCart.cfm
@@ -263,33 +263,44 @@
       { datasource = "payfrit" }
     )>
     <cfif qSPOwner.recordCount GT 0 AND qSPOwner.BusinessID NEQ BusinessID>
-      <!--- SP belongs to another business - check for active grant --->
-      <cfset qGrant = queryTimed(
-        "SELECT ID, OwnerBusinessID, EconomicsType, EconomicsValue, EligibilityScope, TimePolicyType, TimePolicyData
-         FROM ServicePointGrants
-         WHERE GuestBusinessID = ? AND ServicePointID = ? AND StatusID = 1
-         LIMIT 1",
-        [
-          { value = BusinessID, cfsqltype = "cf_sql_integer" },
-          { value = ServicePointID, cfsqltype = "cf_sql_integer" }
-        ],
+      <!--- SP belongs to another business - check if ordering business is a child of SP owner --->
+      <cfset qParent = queryTimed(
+        "SELECT ParentBusinessID FROM Businesses WHERE ID = ? LIMIT 1",
+        [ { value = BusinessID, cfsqltype = "cf_sql_integer" } ],
         { datasource = "payfrit" }
       )>
-      <cfif qGrant.recordCount EQ 0>
-        <cfset apiAbort({ "OK": false, "ERROR": "sp_not_accessible", "MESSAGE": "Service point is not accessible to your business.", "DETAIL": "" })>
+      <cfset isChildOfSPOwner = qParent.recordCount GT 0 AND val(qParent.ParentBusinessID) EQ qSPOwner.BusinessID>
+
+      <cfif NOT isChildOfSPOwner>
+        <!--- Not a child business - check for active grant --->
+        <cfset qGrant = queryTimed(
+          "SELECT ID, OwnerBusinessID, EconomicsType, EconomicsValue, EligibilityScope, TimePolicyType, TimePolicyData
+           FROM ServicePointGrants
+           WHERE GuestBusinessID = ? AND ServicePointID = ? AND StatusID = 1
+           LIMIT 1",
+          [
+            { value = BusinessID, cfsqltype = "cf_sql_integer" },
+            { value = ServicePointID, cfsqltype = "cf_sql_integer" }
+          ],
+          { datasource = "payfrit" }
+        )>
+        <cfif qGrant.recordCount EQ 0>
+          <cfset apiAbort({ "OK": false, "ERROR": "sp_not_accessible", "MESSAGE": "Service point is not accessible to your business.", "DETAIL": "" })>
+        </cfif>
+        <!--- Validate time policy --->
+        <cfif NOT isGrantTimeActive(qGrant.TimePolicyType, qGrant.TimePolicyData)>
+          <cfset apiAbort({ "OK": false, "ERROR": "grant_time_inactive", "MESSAGE": "Service point access is not available at this time.", "DETAIL": "" })>
+        </cfif>
+        <!--- Validate eligibility --->
+        <cfif NOT checkGrantEligibility(qGrant.EligibilityScope, UserID, qGrant.OwnerBusinessID, BusinessID)>
+          <cfset apiAbort({ "OK": false, "ERROR": "grant_eligibility_failed", "MESSAGE": "You are not eligible to order at this service point.", "DETAIL": "" })>
+        </cfif>
+        <cfset grantID = qGrant.ID>
+        <cfset grantOwnerBusinessID = qGrant.OwnerBusinessID>
+        <cfset grantEconomicsType = qGrant.EconomicsType>
+        <cfset grantEconomicsValue = qGrant.EconomicsValue>
       </cfif>
-      <!--- Validate time policy --->
-      <cfif NOT isGrantTimeActive(qGrant.TimePolicyType, qGrant.TimePolicyData)>
-        <cfset apiAbort({ "OK": false, "ERROR": "grant_time_inactive", "MESSAGE": "Service point access is not available at this time.", "DETAIL": "" })>
-      </cfif>
-      <!--- Validate eligibility --->
-      <cfif NOT checkGrantEligibility(qGrant.EligibilityScope, UserID, qGrant.OwnerBusinessID, BusinessID)>
-        <cfset apiAbort({ "OK": false, "ERROR": "grant_eligibility_failed", "MESSAGE": "You are not eligible to order at this service point.", "DETAIL": "" })>
-      </cfif>
-      <cfset grantID = qGrant.ID>
-      <cfset grantOwnerBusinessID = qGrant.OwnerBusinessID>
-      <cfset grantEconomicsType = qGrant.EconomicsType>
-      <cfset grantEconomicsValue = qGrant.EconomicsValue>
+      <!--- If isChildOfSPOwner is true, no grant needed - child can use parent's service points --->
     </cfif>
   </cfif>