Task: develop a backend method for updating order status, accessible only to administrators. Create a technical specification for the developer.

Technical specifications for the backend method of updating order status (admin only):

1. Description: The method updates the order status by its identifier. Accessible only to users with the administrator role.

2. URL and method:

   • URL: /api/orders/{orderId}/status
   • HTTP method: PATCH or PUT (preferably PATCH for partial updates)

3. Authentication and authorization:

   • The method requires authentication.
   • Role check: only administrators have access.
   • If access is denied, return 403 Forbidden.

4. Input data:

   • Path parameter: orderId — the order identifier.
   • Request body (JSON):

     {
       "status": "new_status"
     }
     

   • Valid status values should be predefined (e.g., "pending", "shipped", "cancelled", etc.).

5. Processing:

   • Verify the existence of the order with the given orderId.
   • Validate the new status.
   • Update the order status in the database.
   • Log the status change (who, when, from what to what).

6. Response:

   • On success: HTTP 200 OK with the updated order object or message.
   • On errors (e.g., order not found, invalid status, insufficient rights) — appropriate error codes (404, 400, 403).

7. Security:

   • CSRF protection (if applicable).
   • Validation and sanitization of input data.

8. Example request:

   PATCH /api/orders/123/status HTTP/1.1
   Authorization: Bearer <token>
   Content-Type: application/json
   
   { "status": "shipped" }
   

9. Logging and monitoring:

   • Log successful and unsuccessful attempts to update the status.

10. Tests:

    • Verify status update with valid and invalid data.
    • Check access for different roles.

This technical specification will enable the developer to implement a secure and correct method for updating order status, considering business logic and security requirements.