Ensure visibility filtering for departments

Added a `visible` property to manage department visibility. Updated routes, traits, and objects to filter out non-visible departments and restrict access to internal system departments for end-users. This improves data security and enhances control over information exposure.

services/nginx/app/objects/departments_o.php

@@ -18,6 +18,7 @@ class departments_o extends db
     public object_property $slack_webhook; // The slack webhook for the department
     public department_variables_o $variables; // The department variables object
     public object_property $dimension; // The dimension of the department
+    public object_property $visible; // The visibility of the department
     public object_property $branding; // The branding of the department
     public object_property $created_at;
     public object_property $updated_at;
@@ -73,6 +74,7 @@ class departments_o extends db
         $this->variables = (new department_variables_o())->selectDepartment($this->id);
         $this->dimension = new object_property($this->table, $this->id, 'dimension', 'int', false);
         $this->branding = new object_property($this->table, $this->id, 'branding', 'int', false);
+        $this->visible = new object_property($this->table, $this->id, 'visible', 'int', false);
         $this->created_at = new object_property($this->table, $this->id, 'created_at', 'string', false);
         $this->updated_at = new object_property($this->table, $this->id, 'updated_at', 'string', false);
     }
@@ -116,11 +118,13 @@ class departments_o extends db
         }
         // Only show the name, description and id if the user isn't a super user
         if (!$superUser) {
+            // Map the departments to only show the name, description and id
             $departments = array_map(function ($department) {
                 return [
                     'name' => $department['name'],
                     'description' => $department['description'],
-                    'id' => $department['id']
+                    'id' => $department['id'],
+                    'visible' => $department['visible'],
                 ];
             }, $departments);
         }

services/nginx/app/routes/departmentsRoute.php

@@ -35,15 +35,17 @@ class departmentsRoute
                         ])
                     );
                 }
+                $departments_o = new departments_o();
                 // Return the list of departments
                 $response->success(
-                    (new departments_o())
+                    $departments_o
                         ->setSearchableFields([
                             // The fields that can be searched. This would otherwise make it possible to get secret information from the database, simply by searching for it and getting the result count back
                             'id',
                             'name',
                             'description',
-                            'economic_department_id'
+                            'economic_department_id',
+                            'visible'
                         ])
                         ->listObjectsWithPaginationIfSet(
                             function ($department) use ($user) {
@@ -62,7 +64,10 @@ class departmentsRoute
                                     $tmp_department['slack_webhook'] = $department['slack_webhook'];
                                 }
                                 return $tmp_department;
-                            }
+                            },
+                            $departments_o->forceRestrictFilters([
+                                'visible' => 1, // Only show visible departments, this is to prevent showing internal system departments to the end-user.
+                            ])
                         )
                 );
             } else {

services/nginx/app/traits/form_t.php

@@ -840,6 +840,10 @@ trait form_t
         $options = [];
         /** @var array $department */
         foreach ( $departments as $department ) {
+            // If the department is not visible, skip it
+            if (isset($department['visible']) && !$department['visible']) {
+                continue;
+            }
             $options[$department['id']] = $department['name'];
         }
         return $options;