Merge pull request #252 from copenhagentruckwash/fix-complaint-endpoints-department-access-check

Require department access for department daily report complaint routes

services/nginx/app/routes/departmentDailyReportsRoute.php

@@ -503,6 +503,8 @@ class departmentDailyReportsRoute
                     return;
                 }
 
+                self::requireDepartmentAccess((int)$complaint->department_id->value());
+
                 (new logs_o())->add('departments', 'global', 1, $user->id, 'GET_DEPARTMENT_DAILY_REPORT_COMPLAINT', 'Successfully retrieved department daily report complaint');
 
                 $response->success($repository->parseComplaint($complaint->asArray()));
@@ -524,7 +526,10 @@ class departmentDailyReportsRoute
                         'created_at',
                     ])
                     ->listObjectsWithPaginationIfSet(
-                        fn (array $complaint): array => $repository->parseComplaint($complaint)
+                        fn (array $complaint): array => $repository->parseComplaint($complaint),
+                        $repository->forceRestrictFilters([
+                            'department_id' => $user->getGroup()->getDepartments(),
+                        ])
                     )
             );
         },
@@ -560,6 +565,8 @@ class departmentDailyReportsRoute
                 return;
             }
 
+            self::requireDepartmentAccess((int)$complaint->department_id->value());
+
             $updates = [];
 
             if (self::isParametersSet(['department_id'])) {
@@ -578,6 +585,8 @@ class departmentDailyReportsRoute
                     return;
                 }
 
+                self::requireDepartmentAccess((int)self::getParameter('department_id'));
+
                 $updates['department_id'] = (int)self::getParameter('department_id');
             }
 
@@ -697,6 +706,8 @@ class departmentDailyReportsRoute
                 return;
             }
 
+            self::requireDepartmentAccess((int)$complaint->department_id->value());
+
             $complaint->deletePermanently();
 
             (new logs_o())->add('departments', 'global', 1, $user->id, 'DELETE_DEPARTMENT_DAILY_REPORT_COMPLAINT', 'Successfully deleted department daily report complaint');

services/nginx/app/tests/Unit/DailyReports/DepartmentDailyReportsComplaintsRouteContractTest.php

@@ -12,6 +12,8 @@ it('wires complaint create, lookup, list, edit, and delete routes with validatio
     expect($content)->toContain("hasPermission('create_department_daily_report_complaints')");
     expect($content)->toContain("hasPermission('edit_department_daily_report_complaints')");
     expect($content)->toContain("requireDepartmentAccess((int)self::getParameter('department_id'))");
+    expect($content)->toContain('requireDepartmentAccess((int)$complaint->department_id->value())');
+    expect($content)->toContain("'department_id' => \$user->getGroup()->getDepartments()");
     expect($content)->toContain("getOrImportCustomerByCustomerNumber");
     expect($content)->toContain("Search must be at least 2 characters");
     expect($content)->toContain("Failed to fetch complaint customers from e-conomic");