copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(auth): add scope-based access control to all existing routes (TRU-149)

Browse Source 
Adds a scope-based access control layer to all 81 existing API routes.
Sits alongside existing session-cookie auth (does not replace it).

What this PR does:
- Audits every existing route and documents required scope per route
  (see documentation/auth/route-scope-audit.md)
- Adds classes/auth/scope.php with 10 scope constants and role→scope defaults
- Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole
- Applies require*() calls to all 81 existing routes
- Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines)

Coexistence note:
This branch's classes/auth/scope.php is a stub that will be replaced
by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that
PR merges first. The two have compatible APIs.

Refs: TRU-149
This commit is contained in:
OpenClaw
2026-08-17 11:43:13 +00:00
parent 935b2d58ce
commit 51a87655d6
86 changed files with 1872 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/moduleWorkfeedRoute.php
+8
View File
@@ -9,6 +9,9 @@ use classes\workfeed;
use objects\logs_o;
use traits\route_t;
use app\auth\Scope;
use app\auth\ScopeMiddleware;
class moduleWorkfeedRoute
{
use route_t;
@@ -20,6 +23,7 @@ class moduleWorkfeedRoute
$router, $response;
$this->get('/modules/workfeed/employees', function () {
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/modules/workfeed/employees');
global $response;
$this->requirePermission('modules_workfeed_employees_view');
$user = (new authentication())->get_user();
@@ -35,6 +39,7 @@ class moduleWorkfeedRoute
]);
$this->get('/modules/workfeed/employees/{id}', function () {
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/modules/workfeed/employees/{id}');
global $response;
$this->requirePermission('modules_workfeed_employees_view');
$user = (new authentication())->get_user();
@@ -50,6 +55,7 @@ class moduleWorkfeedRoute
]);
$this->get('/modules/workfeed/shifts', function () {
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/modules/workfeed/shifts');
global $response;
$this->requirePermission('modules_workfeed_shifts_view');
$user = (new authentication())->get_user();
@@ -94,6 +100,7 @@ class moduleWorkfeedRoute
]);
$this->get('/modules/workfeed/shifts/{id}', function () {
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/modules/workfeed/shifts/{id}');
global $response;
$this->requirePermission('modules_workfeed_shifts_view');
$user = (new authentication())->get_user();
@@ -109,6 +116,7 @@ class moduleWorkfeedRoute
]);
$this->get('/modules/workfeed/departments', function () {
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/modules/workfeed/departments');
global $response;
$this->requirePermission('modules_workfeed_departments_view');
$user = (new authentication())->get_user();