ADD THIS BEFORE require_login() IN proforma_invoice.php

require_once __DIR__ . '/../communications/lib.php';

$addinToken = trim((string)($_GET['addin_token'] ?? ''));
$addinOrderId = (int)($_GET['order_id'] ?? 0);
$addinAuthenticated = false;

if ($addinToken !== '' && $addinOrderId > 0) {
    $stmtAddin = $pdo->prepare("SELECT user_id, order_id FROM communication_addin_sessions WHERE session_hash = :hash AND order_id = :order_id AND revoked_at IS NULL AND expires_at > NOW() LIMIT 1");
    $stmtAddin->execute([
        ':hash' => comm_hash_token($addinToken),
        ':order_id' => $addinOrderId,
    ]);
    $addinAuthenticated = (bool)$stmtAddin->fetch(PDO::FETCH_ASSOC);
}

if (!$addinAuthenticated) {
    require_login();
}

This keeps the normal login requirement and only allows a valid short-lived add-in session tied to the requested booking.
