Merge pull request #306 from copenhagentruckwash/copilot/fix-php-api-job-failure

Fix two failing LimitedBackofficeApiTest assertions

services/nginx/app/routes/usersRoute.php

@@ -242,7 +242,7 @@ class usersRoute
         $enabled = strtolower((string)($this->fromQuery('include_limited_backoffice_employees') ?? 'false')) === 'true';
         $filters = $this->fromQuery('filters');
 
-        if (!$enabled || $filters === null || $filters === '') {
+        if ($filters === null || $filters === '') {
             return [
                 'enabled' => false,
                 'filters' => null,
@@ -257,16 +257,31 @@ class usersRoute
             || (is_array($customerNumberFilter) && in_array('0', $customerNumberFilter, true));
 
         if (!$isEmployeeFilter) {
+            // When include mode is on but the filter is not a customer_number:0 query,
+            // pass the original filter through as forced filters so they are not discarded.
+            // When include mode is off, null causes listObjectsWithPaginationIfSet to fall
+            // back to reading the filters from the request, which is equivalent.
             return [
                 'enabled' => false,
-                'filters' => $filters,
+                'filters' => $enabled ? $filters : null,
                 'additional_where' => null,
             ];
         }
 
-        unset($filterArray['customer_number']);
+        // $activeLimitedEmployeeSubquery is a hardcoded constant with no user input.
         $activeLimitedEmployeeSubquery = 'SELECT `user_id` FROM `limited_backoffice_employees` WHERE `deactivated_at` IS NULL';
 
+        if (!$enabled) {
+            // Exclude active limited backoffice employees when the include flag is not set.
+            return [
+                'enabled' => false,
+                'filters' => null,
+                'additional_where' => '`id` NOT IN (' . $activeLimitedEmployeeSubquery . ')',
+            ];
+        }
+
+        unset($filterArray['customer_number']);
+
         return [
             'enabled' => true,
             'filters' => $filterArray === [] ? 'id:NOT ZERO' : $users->array_to_filters($filterArray),

services/nginx/app/tests/Api/LimitedBackofficeApiTest.php

@@ -897,19 +897,15 @@ it('creates updates lists and deactivates scoped employees without exposing raw
         'edit_order_items',
         'delete_order_items',
         'list_order_attachments',
-        'add_order_attachments',
-        'download_order_attachments',
         'list_products',
         'list_categories',
         'list_department_categories',
         'list_department_order_recommended',
         'vehicle_product_suggestions',
-        'search_customers',
         'get_user_from_customer_number',
         'list_customer_notes',
         'add_customer_note',
         'list_customer_attributes',
-        'search_vehicles',
         'view_vehicle_status',
         'list_unknown_customer_vehicles',
         'list_vehicle_customer_suggestions',