Add conditional check for self-request in userRoute and fix customer_number type in orderBookingRoute

- Updated `getUserId` logic in `userRoute` to allow users to fetch their own user ID without requiring additional permissions.
- Corrected `customer_number` type in `orderBookingRoute` to always return an array.
This commit is contained in:
Jeppe Bundgaard
2025-11-10 17:11:29 +01:00
parent a6d427e3d3
commit 5333d430c4
2 changed files with 12 additions and 2 deletions
@@ -110,7 +110,7 @@ class orderBookingRoute
'department' => $user->getGroup()->getDepartments()
] : []),
...(!$has_permission_other ? [
'customer_number' => (int)$user->customer_number->value()
'customer_number' => [(int)$user->customer_number->value()]
] : [])
])
));
+11 -1
View File
@@ -148,9 +148,19 @@ class userRoute
$this->get('/admin/customer/getUserId', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('get_user_id');
// Get the user object
$user = (new authentication())->get_user();
// Check if it's the users own id request
if (!!$user && $this->isParametersSet(['customer_number']) && (int)$this->fromRequest('customer_number') === (int)$user->customer_number->value()) {
$response->success(
[
'user_id' => $user->id
]
);
}
// Otherwise, require permission.
$this->requirePermission('get_user_id');
// Check if the request was successful
if ($user) {
// Log the incident