diff --git a/openapi.yaml b/openapi.yaml index 3946f2c3..e6f14a86 100644 --- a/openapi.yaml +++ b/openapi.yaml @@ -12445,6 +12445,29 @@ paths: application/json: schema: {} + /roles/limited-backoffice-permission-templates: + get: + tags: + - Roles + summary: List limited backoffice permission templates + operationId: listLimitedBackofficeRolePermissionTemplates + responses: + '200': + description: Success + content: + application/json: + schema: + type: array + items: + type: object + properties: + key: {type: string} + label: {type: string} + description: {type: string} + permissions: + type: array + items: {type: string} + /roles/permissions: post: tags: diff --git a/services/nginx/app/classes/limited_backoffice_service.php b/services/nginx/app/classes/limited_backoffice_service.php index 90072899..ff154f1a 100644 --- a/services/nginx/app/classes/limited_backoffice_service.php +++ b/services/nginx/app/classes/limited_backoffice_service.php @@ -551,6 +551,23 @@ class limited_backoffice_service return $roles; } + /** + * @return array}> + */ + public function rolePermissionTemplates(): array + { + $templates = []; + foreach (self::ROLE_PRESETS as $key => $preset) { + $templates[] = [ + 'key' => $key, + 'label' => $preset['label'], + 'description' => $preset['description'], + 'permissions' => array_values($preset['permissions']), + ]; + } + return $templates; + } + /** * @param array $permissions * @return array}> diff --git a/services/nginx/app/openapi.yaml b/services/nginx/app/openapi.yaml index b5877d9d..c5c5e30e 100644 --- a/services/nginx/app/openapi.yaml +++ b/services/nginx/app/openapi.yaml @@ -12422,6 +12422,29 @@ paths: application/json: schema: {} + /roles/limited-backoffice-permission-templates: + get: + tags: + - Roles + summary: List limited backoffice permission templates + operationId: listLimitedBackofficeRolePermissionTemplates + responses: + '200': + description: Success + content: + application/json: + schema: + type: array + items: + type: object + properties: + key: {type: string} + label: {type: string} + description: {type: string} + permissions: + type: array + items: {type: string} + /roles/permissions: post: tags: diff --git a/services/nginx/app/routes/rolesRoute.php b/services/nginx/app/routes/rolesRoute.php index 220464b2..64ca66e4 100644 --- a/services/nginx/app/routes/rolesRoute.php +++ b/services/nginx/app/routes/rolesRoute.php @@ -3,6 +3,7 @@ namespace routes; use classes\authentication; +use classes\limited_backoffice_service; use objects\groups_o; use objects\logs_o; use traits\route_t; @@ -106,6 +107,25 @@ class rolesRoute ] ); + self::get('/roles/limited-backoffice-permission-templates', function () { + global $response; + self::requirePermission('superuser'); + self::requirePermission('add_role_permission'); + $user = (new authentication())->get_user(); + if ($user) { + (new logs_o())->add('roles', 'global', 1, $user->id, 'ROLES', 'User accessed limited backoffice role permission templates'); + $response->success((new limited_backoffice_service())->rolePermissionTemplates()); + } else { + (new logs_o())->add('roles', 'global', 0, 0, 'ROLES', 'User tried to access limited backoffice role permission templates without a valid session'); + $response->error('Invalid session', 400); + } + }, + [ + 'superuser' => 'Access the superuser interface', + 'add_role_permission' => 'Add a permission to a role' + ] + ); + self::post('/roles/permissions', function () { // Require the user to be logged in global $response; @@ -182,4 +202,4 @@ class rolesRoute ] ); } -} \ No newline at end of file +} diff --git a/services/nginx/app/tests/Api/RolesApiTest.php b/services/nginx/app/tests/Api/RolesApiTest.php new file mode 100644 index 00000000..adf4365d --- /dev/null +++ b/services/nginx/app/tests/Api/RolesApiTest.php @@ -0,0 +1,56 @@ +createUserSession([ + 'superuser', + 'add_role_permission', + ]); + + $response = api_client()->get('/roles/limited-backoffice-permission-templates', $session['headers']); + + $response + ->assertStatus(200) + ->assertEnvelope() + ->assertSuccess(); + + $templates = $response->data(); + expect(array_column($templates, 'key'))->toBe([ + 'viewer', + 'cashier', + 'booking_coordinator', + 'operations_lead', + 'department_admin', + ]); + + $templatesByKey = array_column($templates, null, 'key'); + expect($templatesByKey['cashier']['permissions'] ?? [])->toContain('list_department_daily_reports'); + expect($templatesByKey['cashier']['permissions'] ?? [])->toContain('list_notifications'); + expect($templatesByKey['cashier']['permissions'] ?? [])->toContain('statistics_orders_new'); + expect($templatesByKey['department_admin']['permissions'] ?? [])->toContain('limited_backoffice_access'); + expect($templatesByKey['department_admin']['permissions'] ?? [])->toContain('limited_backoffice_prices_manage'); + expect($templatesByKey['department_admin']['permissions'] ?? [])->toContain('limited_backoffice_employees_manage'); +}); + +it('requires superuser and role permission edit access for limited backoffice permission templates', function (): void { + api_test_covers('GET /roles/limited-backoffice-permission-templates', 'auth'); + + api_client() + ->get('/roles/limited-backoffice-permission-templates', api_fixtures()->createUserSession(['add_role_permission'])['headers']) + ->assertStatus(403) + ->assertEnvelope() + ->assertSuccess(false) + ->assertMissingPermissions(['superuser']); + + api_client() + ->get('/roles/limited-backoffice-permission-templates', api_fixtures()->createUserSession(['superuser'])['headers']) + ->assertStatus(403) + ->assertEnvelope() + ->assertSuccess(false) + ->assertMissingPermissions(['add_role_permission']); +});