Expose limited backoffice role permission templates

openapi.yaml

@@ -12445,6 +12445,29 @@ paths:
             application/json:
               schema: {}
 
+  /roles/limited-backoffice-permission-templates:
+    get:
+      tags:
+        - Roles
+      summary: List limited backoffice permission templates
+      operationId: listLimitedBackofficeRolePermissionTemplates
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties:
+                    key: {type: string}
+                    label: {type: string}
+                    description: {type: string}
+                    permissions:
+                      type: array
+                      items: {type: string}
+
   /roles/permissions:
     post:
       tags:

services/nginx/app/classes/limited_backoffice_service.php

@@ -551,6 +551,23 @@ class limited_backoffice_service
         return $roles;
     }
 
+    /**
+     * @return array<int, array{key:string,label:string,description:string,permissions:array<int,string>}>
+     */
+    public function rolePermissionTemplates(): array
+    {
+        $templates = [];
+        foreach (self::ROLE_PRESETS as $key => $preset) {
+            $templates[] = [
+                'key' => $key,
+                'label' => $preset['label'],
+                'description' => $preset['description'],
+                'permissions' => array_values($preset['permissions']),
+            ];
+        }
+        return $templates;
+    }
+
     /**
      * @param array<int, string> $permissions
      * @return array<int, array{key:string,capabilities:array<int,string>}>

services/nginx/app/openapi.yaml

@@ -12422,6 +12422,29 @@ paths:
             application/json:
               schema: {}
 
+  /roles/limited-backoffice-permission-templates:
+    get:
+      tags:
+        - Roles
+      summary: List limited backoffice permission templates
+      operationId: listLimitedBackofficeRolePermissionTemplates
+      responses:
+        '200':
+          description: Success
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  type: object
+                  properties:
+                    key: {type: string}
+                    label: {type: string}
+                    description: {type: string}
+                    permissions:
+                      type: array
+                      items: {type: string}
+
   /roles/permissions:
     post:
       tags:

services/nginx/app/routes/rolesRoute.php

@@ -3,6 +3,7 @@
 namespace routes;
 
 use classes\authentication;
+use classes\limited_backoffice_service;
 use objects\groups_o;
 use objects\logs_o;
 use traits\route_t;
@@ -106,6 +107,25 @@ class rolesRoute
             ]
         );
 
+        self::get('/roles/limited-backoffice-permission-templates', function () {
+            global $response;
+            self::requirePermission('superuser');
+            self::requirePermission('add_role_permission');
+            $user = (new authentication())->get_user();
+            if ($user) {
+                (new logs_o())->add('roles', 'global', 1, $user->id, 'ROLES', 'User accessed limited backoffice role permission templates');
+                $response->success((new limited_backoffice_service())->rolePermissionTemplates());
+            } else {
+                (new logs_o())->add('roles', 'global', 0, 0, 'ROLES', 'User tried to access limited backoffice role permission templates without a valid session');
+                $response->error('Invalid session', 400);
+            }
+        },
+            [
+                'superuser' => 'Access the superuser interface',
+                'add_role_permission' => 'Add a permission to a role'
+            ]
+        );
+
         self::post('/roles/permissions', function () {
             // Require the user to be logged in
             global $response;
@@ -182,4 +202,4 @@ class rolesRoute
             ]
         );
     }
-}
+}

services/nginx/app/tests/Api/RolesApiTest.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+usesApiSuite();
+
+it('lists limited backoffice permission templates for superuser role maintenance', function (): void {
+    api_test_covers('GET /roles/limited-backoffice-permission-templates', 'happy');
+
+    $session = api_fixtures()->createUserSession([
+        'superuser',
+        'add_role_permission',
+    ]);
+
+    $response = api_client()->get('/roles/limited-backoffice-permission-templates', $session['headers']);
+
+    $response
+        ->assertStatus(200)
+        ->assertEnvelope()
+        ->assertSuccess();
+
+    $templates = $response->data();
+    expect(array_column($templates, 'key'))->toBe([
+        'viewer',
+        'cashier',
+        'booking_coordinator',
+        'operations_lead',
+        'department_admin',
+    ]);
+
+    $templatesByKey = array_column($templates, null, 'key');
+    expect($templatesByKey['cashier']['permissions'] ?? [])->toContain('list_department_daily_reports');
+    expect($templatesByKey['cashier']['permissions'] ?? [])->toContain('list_notifications');
+    expect($templatesByKey['cashier']['permissions'] ?? [])->toContain('statistics_orders_new');
+    expect($templatesByKey['department_admin']['permissions'] ?? [])->toContain('limited_backoffice_access');
+    expect($templatesByKey['department_admin']['permissions'] ?? [])->toContain('limited_backoffice_prices_manage');
+    expect($templatesByKey['department_admin']['permissions'] ?? [])->toContain('limited_backoffice_employees_manage');
+});
+
+it('requires superuser and role permission edit access for limited backoffice permission templates', function (): void {
+    api_test_covers('GET /roles/limited-backoffice-permission-templates', 'auth');
+
+    api_client()
+        ->get('/roles/limited-backoffice-permission-templates', api_fixtures()->createUserSession(['add_role_permission'])['headers'])
+        ->assertStatus(403)
+        ->assertEnvelope()
+        ->assertSuccess(false)
+        ->assertMissingPermissions(['superuser']);
+
+    api_client()
+        ->get('/roles/limited-backoffice-permission-templates', api_fixtures()->createUserSession(['superuser'])['headers'])
+        ->assertStatus(403)
+        ->assertEnvelope()
+        ->assertSuccess(false)
+        ->assertMissingPermissions(['add_role_permission']);
+});