Add department access check and self-serve enabled status routes in departments API

openapi.yaml

@@ -1244,18 +1244,68 @@ paths:
         - Departments
       summary: Remove category from department
       operationId: removeDepartmentCategory
-      parameters:
-        - name: department_id
-          in: query
-          required: true
-          schema: {type: integer}
-        - name: category_id
-          in: query
-          required: true
-          schema: {type: integer}
       responses:
         '200': {description: Success}
 
+  /departments/self-serve/enabled:
+    get:
+      tags:
+        - Departments
+      summary: Get department self-serve status
+      description: Check if self-serve is enabled for a specific department
+      operationId: getDepartmentSelfServeEnabled
+      parameters:
+        - name: id
+          in: query
+          required: true
+          description: Department ID
+          schema:
+            type: integer
+      responses:
+        '200':
+          description: Successfully retrieved status
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  enabled:
+                    type: boolean
+        '404':
+          $ref: '#/components/responses/NotFound'
+    put:
+      tags:
+        - Departments
+      summary: Update department self-serve status
+      description: Enable or disable self-serve for a specific department
+      operationId: updateDepartmentSelfServeEnabled
+      parameters:
+        - name: id
+          in: query
+          required: true
+          description: Department ID
+          schema:
+            type: integer
+        - name: enabled
+          in: query
+          required: true
+          description: Enabled status (true/false)
+          schema:
+            type: string
+            enum: ['true', 'false']
+      responses:
+        '200':
+          description: Status updated successfully
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  message:
+                    type: string
+        '404':
+          $ref: '#/components/responses/NotFound'
+
   /departments/order/recommended:
     get:
       tags:

services/nginx/app/routes/departmentsRoute.php

@@ -269,7 +269,7 @@ class departmentsRoute
                 // Require the department id and enabled status
                 self::requireParameters(['id', 'enabled']);
                 self::requireType((int)self::getParameter('id'), self::type_int());
-
+                self::requireType((bool)self::getParameter('enabled'), self::type_bool());
                 // Get the department object
                 $department = (new departments_o())->select(self::getParameter('id'));
                 // Validate the department object
@@ -277,6 +277,8 @@ class departmentsRoute
                     // Return an error
                     $response->error('Department not found', 404);
                 }
+                // Check if the user has access to the department
+                self::requireDepartmentAccess($department);
                 // Set the department variable
                 $department_variables = (new department_variables_o())->selectDepartment($department->id);
                 $enabled = self::getParameter('enabled') === 'true' || self::getParameter('enabled') === true || self::getParameter('enabled') === 1 || self::getParameter('enabled') === '1';
@@ -293,7 +295,8 @@ class departmentsRoute
             }
         },
             [
-                'edit_department_selfserve_enabled' => 'Edit if department self-serve is enabled'
+                'edit_department_selfserve_enabled' => 'Edit if department self-serve is enabled (Requires department access)',
+                'department_access_:id' => 'Access the department'
             ]
         );