Harden Sæby demo registration and department scope (#335)

Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.

services/nginx/app/statistics/bookings_s.php

@@ -8,7 +8,10 @@ class bookings_s
 {
     use statistic_t;
 
-    public function get_new_bookings(): self
+    /**
+     * @param array<int, int>|null $departmentIds Null keeps the existing unrestricted contract.
+     */
+    public function get_new_bookings(?array $departmentIds = null): self
     {
         // Get the departments
         $departments_o = new \objects\departments_o();
@@ -16,9 +19,19 @@ class bookings_s
         $bookings_o = new \objects\bookings_o();
 
         // Get the bookings
-        $bookings = $bookings_o->getFields(['id', 'department', 'date']);
+        $bookings = $departmentIds === null
+            ? $bookings_o->getFields(['id', 'department', 'date'])
+            : ($departmentIds === [] ? [] : $bookings_o->getFieldsWhere(
+                ['department' => $departmentIds],
+                ['id', 'department', 'date']
+            ));
         // Get the departments
-        $departments = $departments_o->getFields(['id', 'name']);
+        $departments = $departmentIds === null
+            ? $departments_o->getFields(['id', 'name'])
+            : ($departmentIds === [] ? [] : $departments_o->getFieldsWhere(
+                ['id' => $departmentIds],
+                ['id', 'name']
+            ));
         // For each year, add the months covered
         $this->add_monthly_labels();
         // Add the counts for each department, for each month in each year
@@ -40,4 +53,4 @@ class bookings_s
         }
         return $this;
     }
-}
+}