copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Use prepared statements for all new DB queries in tests and route

Browse Source
This commit is contained in:
copilot-swe-agent[bot]
2026-07-06 23:15:59 +00:00
committed by GitHub
parent 1d25cbe21c
commit d0f94ac549
1 changed files with 38 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/tests/Api/LimitedBackofficeApiTest.php
+38 -14
View File
@@ -1660,16 +1660,24 @@ it('assigns list_departments to managed employees and enforces list_departments
expect($employeeId)->toBeGreaterThan(0);
limited_backoffice_cleanup_created_employee($employeeId);
$employeeRow = api_test_runtime()->queryOne(
'SELECT `managed_group_id` FROM `limited_backoffice_employees` WHERE `user_id` = ' . $employeeId . ' LIMIT 1'
$stmt = api_test_runtime()->db()->prepare(
'SELECT `managed_group_id` FROM `limited_backoffice_employees` WHERE `user_id` = ? LIMIT 1'
);
$stmt->bind_param('i', $employeeId);
$stmt->execute();
$employeeRow = $stmt->get_result()->fetch_assoc();
$stmt->close();
$managedGroupId = (int)($employeeRow['managed_group_id'] ?? 0);
expect($managedGroupId)->toBeGreaterThan(0);
$permRow = api_test_runtime()->queryOne(
'SELECT 1 FROM `groups_permissions`
WHERE `group_id` = ' . $managedGroupId . " AND `permission` = 'list_departments' LIMIT 1"
$permStmt = api_test_runtime()->db()->prepare(
'SELECT 1 FROM `groups_permissions` WHERE `group_id` = ? AND `permission` = ? LIMIT 1'
);
$listDepts = 'list_departments';
$permStmt->bind_param('is', $managedGroupId, $listDepts);
$permStmt->execute();
$permRow = $permStmt->get_result()->fetch_assoc();
$permStmt->close();
expect($permRow)->not->toBeNull('Managed employee must have list_departments permission');
});
@@ -1690,16 +1698,24 @@ it('assigns list_department_daily_reports to managed employees', function (): vo
expect($employeeId)->toBeGreaterThan(0);
limited_backoffice_cleanup_created_employee($employeeId);
$employeeRow = api_test_runtime()->queryOne(
'SELECT `managed_group_id` FROM `limited_backoffice_employees` WHERE `user_id` = ' . $employeeId . ' LIMIT 1'
$stmt = api_test_runtime()->db()->prepare(
'SELECT `managed_group_id` FROM `limited_backoffice_employees` WHERE `user_id` = ? LIMIT 1'
);
$stmt->bind_param('i', $employeeId);
$stmt->execute();
$employeeRow = $stmt->get_result()->fetch_assoc();
$stmt->close();
$managedGroupId = (int)($employeeRow['managed_group_id'] ?? 0);
expect($managedGroupId)->toBeGreaterThan(0);
$permRow = api_test_runtime()->queryOne(
'SELECT 1 FROM `groups_permissions`
WHERE `group_id` = ' . $managedGroupId . " AND `permission` = 'list_department_daily_reports' LIMIT 1"
$permStmt = api_test_runtime()->db()->prepare(
'SELECT 1 FROM `groups_permissions` WHERE `group_id` = ? AND `permission` = ? LIMIT 1'
);
$dailyReports = 'list_department_daily_reports';
$permStmt->bind_param('is', $managedGroupId, $dailyReports);
$permStmt->execute();
$permRow = $permStmt->get_result()->fetch_assoc();
$permStmt->close();
expect($permRow)->not->toBeNull('Managed employee must have list_department_daily_reports permission');
});
@@ -1720,9 +1736,13 @@ it('assigns list_notifications and list_own_notifications to managed employees',
expect($employeeId)->toBeGreaterThan(0);
limited_backoffice_cleanup_created_employee($employeeId);
$employeeRow = api_test_runtime()->queryOne(
'SELECT `managed_group_id` FROM `limited_backoffice_employees` WHERE `user_id` = ' . $employeeId . ' LIMIT 1'
$stmt = api_test_runtime()->db()->prepare(
'SELECT `managed_group_id` FROM `limited_backoffice_employees` WHERE `user_id` = ? LIMIT 1'
);
$stmt->bind_param('i', $employeeId);
$stmt->execute();
$employeeRow = $stmt->get_result()->fetch_assoc();
$stmt->close();
$managedGroupId = (int)($employeeRow['managed_group_id'] ?? 0);
expect($managedGroupId)->toBeGreaterThan(0);
@@ -1756,9 +1776,13 @@ it('assigns statistics permissions (Overblik) to all active limited backoffice r
expect($employeeId)->toBeGreaterThan(0);
limited_backoffice_cleanup_created_employee($employeeId);
$employeeRow = api_test_runtime()->queryOne(
'SELECT `managed_group_id` FROM `limited_backoffice_employees` WHERE `user_id` = ' . $employeeId . ' LIMIT 1'
$stmtEmp = api_test_runtime()->db()->prepare(
'SELECT `managed_group_id` FROM `limited_backoffice_employees` WHERE `user_id` = ? LIMIT 1'
);
$stmtEmp->bind_param('i', $employeeId);
$stmtEmp->execute();
$employeeRow = $stmtEmp->get_result()->fetch_assoc();
$stmtEmp->close();
$managedGroupId = (int)($employeeRow['managed_group_id'] ?? 0);
expect($managedGroupId)->toBeGreaterThan(0);