Harden Sæby demo registration and department scope (#335)

Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.
2026-08-02 11:50:56 +02:00
parent 4587bdfb06
commit 1e0e051775
34 changed files with 1853 additions and 474 deletions
@@ -0,0 +1,32 @@
+<?php
+
+it('uses authoritative managed scope across every limited-role list surface', function (): void {
+    $routes = [
+        'ordersRoute.php',
+        'bookingsRoute.php',
+        'orderBookingRoute.php',
+        'departmentTimeBookingsRoute.php',
+        'departmentDailyReportsRoute.php',
+        'plateScansRoute.php',
+        'potentialOrderMatchesRoute.php',
+        'systemSearchRoute.php',
+    ];
+
+    foreach ($routes as $route) {
+        $code = (string)file_get_contents(app_path('routes/' . $route));
+        expect($code, $route)->toContain('effectiveDepartmentIds(');
+        expect($code, $route)->not->toContain('getGroup()->getDepartments()');
+    }
+
+    $trait = (string)file_get_contents(app_path('traits/route_t.php'));
+    expect($trait)->toContain('public function effectiveDepartmentIds(object $user): array');
+    expect($trait)->toContain('$managedScope = $this->limitedBackofficeDepartmentScope($user);');
+    expect($trait)->toContain('return $departmentIds === [] ? [0] : $departmentIds;');
+
+    $orders = (string)file_get_contents(app_path('routes/ordersRoute.php'));
+    expect($orders)->toContain('$managedScope === null || in_array(10, $department_ids, true)');
+
+    $bookings = (string)file_get_contents(app_path('routes/bookingsRoute.php'));
+    expect($bookings)->toContain('$this->requireLimitedBackofficeDepartmentAccess(');
+    expect($bookings)->toContain('(int)$bookings_o->department->value()');
+});