Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.
Resolve recommended-profile Critical and High findings, retain narrow analyzer exceptions, and update the edge-broker WebSocket dependency to a non-vulnerable release.
- Introduced Redis-backed caching for user and subuser permission evaluations in the `route_t` trait, reducing database queries.
- Enhanced `Redis` class with methods for permission caching: `cache_permission`, `get_permission`, and `clear_permission`.
- Added test coverage for the new caching logic in `PermissionRedisCacheTest.php`.
- Implemented Redis caching for authentication sessions with `cache_auth_session`, `get_auth_session`, and `clear_auth_session`.
- Improved CORS handling for preflight requests in `index.php`.
- Introduced endpoints for WebAuthn-based authentication flow (`/auth/passkey/challenge` and `/auth/passkey/verify`).
- Added support for generating and verifying WebAuthn PublicKeyCredentialRequestOptions and challenge tokens.
- Extended routing logic to expose matched route templates for improved parameter handling.
- Updated OpenAPI specifications to document passkey challenge and verification workflows.
- Included unit tests for validating both existing and non-existing user scenarios during passkey challenges.
- Add reusable helpers: `isOwnCustomerContext`, `resolveEffectiveCustomerNumber`, and `allowOwnOrDepartmentAccess` in `route_t` for streamlined permission checks.
- Replace inlined permission logic in `orderBookingRoute` with common helpers for creating, viewing, editing, and deleting bookings.
- Localize permission names, descriptions, and labels to Danish across relevant modules.
- Improve error handling and simplify context resolution for subuser and department-level permissions.
- Introduce `hasPermission` method in `subusers_o` for permission checks tied to customer context.
- Update `/subusers/me` route to return subuser grants with normalized permissions and metadata.
- Add `get_subuser_customer_number_target` in `authentication` to resolve customer context from request headers.
- Refactor route-level permission checks to handle subuser grants dynamically.
- Introduce CLI test scripts for subuser grants and permission node mappings.
- Add test coverage for subuser grants and permission nodes in new test classes.
- Ensure permissions pass only if an explicit subuser node key is granted.
- Prevent fallback to classic user permissions in this authentication branch.
- Add `permission_node` DTO to link classic permissions with subuser-specific nodes.
- Extend `authentication` to support subuser resolution via tokens.
- Introduce route traits for permission evaluation with subuser context.
- Update `requirePermission` and `hasPermission` to handle subuser grants dynamically.
- Implement fallback mechanisms for customer number context in subuser permissions.
- Introduced `selfserve_lane_command_arguments` class for managing lane command parameters (e.g., customer number, license plate).
- Added traits for handling lane timer, invoice generation, license plate, and customer number management.
- Implemented minute-based billing logic with `selfserve_minute_product_c` configuration.
- Enhanced `selfserve_lane` with new behaviors: command arguments, invoicing, and time handling.
- Added `/modules/self-serve/lane/command` route for executing lane commands (START, STOP, RESET).
- Updated `/modules/self-serve/lane/status` route to include additional lane details (wash start, elapsed time, license plate, etc.).
- Improved Shelly device relay control for port management.
- Introduced `order_bookings_o` class for interacting with the `order_bookings` database table.
- Added `hasDepartmentAccess` method to handle department-level permissions.
- Implemented new routes for creating and retrieving order bookings, including pagination support.
- Enhanced access control to differentiate between own and departmental bookings based on permissions.
- Updated input validation and improved error handling for order bookings.
- Introduced `uploadRoute` to handle image uploads with MIME type validation and size restrictions.
- Added `upload_store` class for managing file storage and generating presigned URLs for upload/download.
- Enhanced file server to differentiate between PDFs and uploaded files, supporting dynamic content delivery.
- Integrated OpenAI module for License Plate Recognition (LPR), including API configuration and schema validation.
- Updated core structure with new interfaces (`minio_uploads_i`, `openai_i`) and classes (`openai`, `upload_store`).
- Adjusted `index.php` and file routes to support dynamic MIME checks and direct link generation.
Introduced support for forced pricing in `addItemToOrder` and added stricter validation for array inputs in SQL queries. Enhanced JSON handling in type validation and improved code reuse with new objects. Added new endpoint `/modules/xlvask/related-orders` to fetch related orders by wash IDs.
Introduced a new POST route for collected vehicle subscription invoices and enhanced responses with wash subscription transactions. Refactored order handling by adding department-based pricing logic and simplifying reusable methods. Various minor improvements include exception handling, input validation, and updated permissions.
The `book_interior_wash_f` form was removed due to redundancy. Added functionality to handle wash certificate generation, including safety seal and operator data, and added a new form `complete_booking_f` to finalize bookings without certificates. Adjustments were made to several related components to ensure seamless integration.
This update refactors vehicle-related routes to include consistent endpoints, enhanced functionality, and stricter permission checks. It introduces vehicle add-on management with toggling and retrieval APIs, enabling detailed customization and user control. Additionally, the new `asArray` methods and updated logic improve data handling and validation.
Introduced a complete notifications module, including classes for managing notifications (`notifications_o`), traits for handling types and routing, and API routes to list, add, and delete notifications. Added input validation, permission handling, and JSON data processing capabilities.
This commit introduces support for `min` and `max` fields in product options. It includes backend changes to handle validation, setting, and retrieval of these new fields, ensuring compatibility. Additionally, a new `requireTypeIn` utility and `TYPE_NULL` constant were added for improved type validation.
Added date parameter support for department daily reports, including validation, new functions, and route updates. Improved functionality allows fetching or creating reports for specific dates and prevents duplicate entries for the same date. Introduced a standardized date format within the API.
Introduced a new method in `department_daily_reports_o` to select the latest daily report for a department. Added a corresponding API route to fetch the latest report details for a given department ID, with appropriate validations and access control measures. Adjusted parameter handling logic to enhance request validation.
Introduced functionality for managing department daily reports, including endpoints for creating, updating, listing, and viewing product sales data. Enhanced product handling in reports by adding support for water usage, notes, and detailed product sales metrics. These changes improve tracking and reporting accuracy across departments.
Introduced GET and POST endpoints for collected order invoices, enabling listing and creation functionalities for authorized users. Added a new database object to handle invoice-related operations and validations. Included utility functions to enforce parameter requirements and data integrity.
This update introduces functionalities for managing roles, permissions, and access control across departments. Key additions include methods for filtering, restricting, and handling user permissions, as well as new APIs for assigning/removing permissions to/from roles. Access to resources like orders, bookings, and plate scans is now securely tied to department-specific permissions.
Introduced vehicle type handling in `motorapi` with a helper class. Integrated recommended order logic based on vehicle plate and order history, enhancing order and department route functionality.
This update introduces new endpoints for managing Stripe terminal readers, locations, and department-specific configurations. It also adds support for creating, updating, and retrieving department variables along with enhanced validation, logging, and permission checks. These updates improve integration and expand functionality for Stripe and department-related operations.
Added support for defining and registering permissions for API routes. Updated methods across the router and route traits to accommodate permission details, enabling better access control. Enhanced department license plate lookup with session validation and additional endpoints.
Implemented MotorAPI lookup functionality with proper validation and logging. Added Economic products endpoint for fetching product details. Enhanced route parameter validation with length constraints and improved response handling for objects.
Implemented endpoints to list and import customers from the Economic API, including query filtering, pagination, and validation. Added supporting trait methods, database functions, and error handling. Expanded the user object for Economic integration and introduced utilities for type checking and parameter extraction.
Refactored database methods to improve code readability, reusability, and error handling. Introduced input validation helper functions and parsing capabilities for objects with optional callbacks. Added new routes for handling categories and improved product-related functionality to align with the new architecture.
Introduce reCAPTCHA integration with validation and configuration handling. Update Economic module to include layout management and dynamic configuration via API. Added traits for managing module settings and encapsulated new endpoint routes for expanded functionality.
Introduced a new POST endpoint `/invoices/draft/close` to allow closing of draft invoices, enforcing user authentication and permissions. Refactored and reorganized route and utility methods to improve readability and maintainability, including restoring `match_route` and restructuring `fromRequest`. Removed unused methods for cleaner code.
Jeppe B