diff --git a/services/nginx/app/routes/usersRoute.php b/services/nginx/app/routes/usersRoute.php index ed84f274..656a0fd5 100644 --- a/services/nginx/app/routes/usersRoute.php +++ b/services/nginx/app/routes/usersRoute.php @@ -242,7 +242,7 @@ class usersRoute $enabled = strtolower((string)($this->fromQuery('include_limited_backoffice_employees') ?? 'false')) === 'true'; $filters = $this->fromQuery('filters'); - if (!$enabled || $filters === null || $filters === '') { + if ($filters === null || $filters === '') { return [ 'enabled' => false, 'filters' => null, @@ -257,16 +257,31 @@ class usersRoute || (is_array($customerNumberFilter) && in_array('0', $customerNumberFilter, true)); if (!$isEmployeeFilter) { + // When include mode is on but the filter is not a customer_number:0 query, + // pass the original filter through as forced filters so they are not discarded. + // When include mode is off, null causes listObjectsWithPaginationIfSet to fall + // back to reading the filters from the request, which is equivalent. return [ 'enabled' => false, - 'filters' => $filters, + 'filters' => $enabled ? $filters : null, 'additional_where' => null, ]; } - unset($filterArray['customer_number']); + // $activeLimitedEmployeeSubquery is a hardcoded constant with no user input. $activeLimitedEmployeeSubquery = 'SELECT `user_id` FROM `limited_backoffice_employees` WHERE `deactivated_at` IS NULL'; + if (!$enabled) { + // Exclude active limited backoffice employees when the include flag is not set. + return [ + 'enabled' => false, + 'filters' => null, + 'additional_where' => '`id` NOT IN (' . $activeLimitedEmployeeSubquery . ')', + ]; + } + + unset($filterArray['customer_number']); + return [ 'enabled' => true, 'filters' => $filterArray === [] ? 'id:NOT ZERO' : $users->array_to_filters($filterArray), diff --git a/services/nginx/app/tests/Api/LimitedBackofficeApiTest.php b/services/nginx/app/tests/Api/LimitedBackofficeApiTest.php index d53bcda4..8223c0db 100644 --- a/services/nginx/app/tests/Api/LimitedBackofficeApiTest.php +++ b/services/nginx/app/tests/Api/LimitedBackofficeApiTest.php @@ -897,19 +897,15 @@ it('creates updates lists and deactivates scoped employees without exposing raw 'edit_order_items', 'delete_order_items', 'list_order_attachments', - 'add_order_attachments', - 'download_order_attachments', 'list_products', 'list_categories', 'list_department_categories', 'list_department_order_recommended', 'vehicle_product_suggestions', - 'search_customers', 'get_user_from_customer_number', 'list_customer_notes', 'add_customer_note', 'list_customer_attributes', - 'search_vehicles', 'view_vehicle_status', 'list_unknown_customer_vehicles', 'list_vehicle_customer_suggestions',