copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
1,684 Commits 58 Branches 1 Tag
6566027746b740e264f68f8f71ba4e55c35aca61
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jeppe B 6566027746 Configure advisory Qodana analysis (#313) 
## Summary

- configure advisory Qodana PHP 2026.1 analysis for trusted pull
requests and master, beta, canary, and internal branch scans
- install both Composer projects and the edge-agent/edge-broker Node
dependencies before analysis
- exclude generated, vendor, build, cache, legacy-test, and local-agent
trees
- keep Quick Fixes, SARIF artifacts, baselines, thresholds, and
required-check enforcement disabled during calibration

## Safety

- fails closed when QODANA_TOKEN is absent
- skips draft, fork, and Dependabot pull requests
- uses least-privilege GitHub permissions and immutable action SHAs
- uploads findings to the dedicated api Qodana Cloud project

## Validation

- actionlint 1.7.12
- SchemaStore qodana-1.0 validation
- bootstrap shell syntax and lockfile structure checks
- immutable action tag verification
- git diff --check
- independent review completed with no findings

## Live verification

- [PR-mode
scan](https://github.com/copenhagentruckwash/api/actions/runs/29494056175)
completed successfully with 0 changed-file problems, 439 inspections,
and a passed license audit ([Qodana
report](https://qodana.cloud/projects/P2nXd/reports/LJv98e))
- [full branch
scan](https://github.com/copenhagentruckwash/api/actions/runs/29495399119)
completed successfully and uploaded 8,248 current findings across 725
files, 439 inspections, and a passed license audit to the dedicated api
project ([Qodana
report](https://qodana.cloud/projects/P2nXd/reports/qJMOxX))
- the initial debt remains advisory; baseline and required-check
enforcement are intentionally deferred until findings are triaged
 2026-07-16 14:35:59 +02:00
Jeppe B 511605b619 Verify API master branch protection (#312) 
Record the live ruleset and complete the protected-path canary.
 2026-07-16 12:55:18 +02:00
Jeppe B c2abf17cd7 Prepare API default branch protection (#311) 
Add a stable Required CI gate, branch-protection desired state, and publishing runbook.
 2026-07-16 12:38:01 +02:00
Jeppe B fefe18a719 Fix legacy customer attribute session query 2026-07-16 12:20:20 +02:00
Jeppe B 9b2d5d5291 Fix customer restriction CI regressions 2026-07-16 12:06:42 +02:00
Jeppe B e1fb79d9b6 Add customer rule product restrictions 2026-07-16 11:50:52 +02:00
Jeppe B 879dfcf79a Improve invoice period data and POS add-on validation 2026-07-15 17:04:52 +02:00
Jeppe B 0feb705059 Support collected invoice economic PDF downloads 2026-07-14 15:39:39 +02:00
Jeppe B fa1ade555f Fix self-serve cron registry test 
Fix self-serve cron registry test
 2026-07-09 11:36:11 +02:00
Jeppe B 7a1c444df0 Activate self-serve opening relays 
Activate self-serve opening relays
 2026-07-09 11:27:32 +02:00
Jeppe B 8aefbd8fb3 Guard wash subscription distribution SQL 
Guard the wash subscription distribution query after invoice-inclusion filtering removes all candidate orders, preventing an empty IN () clause on the invoicing distribution endpoint.

Verified with focused syntax, Pest, PHPStan, and invoicing unit-suite checks.
 2026-07-09 10:24:02 +02:00
Jeppe B a7181a4ab2 Fix edge gateway relay binding reactivation 
Reactivate existing relay binding rows when a gateway/relay pair is re-added after soft deletion, avoiding duplicate uniq_edge_gateway_binding inserts. Add regression coverage for the reactivation path.
 2026-07-08 18:46:33 +02:00
Jeppe B e14cddc1fb Fix API suite regressions 2026-07-08 12:54:26 +02:00
Jeppe B 31887fa8c9 Cover API CI skip prevention wiring 2026-07-08 12:32:27 +02:00
Jeppe B eac83b18a0 Preflight required extensions for API CI 2026-07-08 12:32:19 +02:00
Jeppe B 3817a37021 Make API CI fail on skipped bootstrap 2026-07-08 12:31:40 +02:00
Jeppe B b77efc538a Fix backend test gates and department product access 2026-07-07 22:16:37 +02:00
Jeppe B 579ddcf510 Merge pull request #307 from copenhagentruckwash/copilot/update-limited-backoffice-roles 
Fix limited-backoffice role permissions and enforce department access on order mutations
 2026-07-07 02:53:06 +02:00
Jeppe B 04bb26f1b0 Merge pull request #306 from copenhagentruckwash/copilot/fix-php-api-job-failure 
Fix two failing LimitedBackofficeApiTest assertions
 2026-07-07 00:44:53 +02:00
Jeppe B e208b1b2a4 Merge pull request #305 from copenhagentruckwash/codex/limited-backoffice-employee-migration 
Add limited backoffice employee migration
 2026-07-07 00:14:25 +02:00
Jeppe B 709c6acbba Fix product null department permissions 
Treats null-like optional product query params as omitted and avoids department_access_0 permission checks.
 2026-07-06 20:14:45 +02:00
Jeppe B c7f5c73a9e Merge pull request #303 from copenhagentruckwash/codex/daily-report-product-targets-api 
[codex] Add daily report product target API
 2026-07-06 19:35:37 +02:00
Jeppe B 8544ce0a18 Merge pull request #297 from copenhagentruckwash/codex/customer-product-fixed-price-overrides 
Add customer product fixed price overrides
 2026-07-06 17:23:06 +02:00
Jeppe B 742b15116d Merge pull request #295 from copenhagentruckwash/fix/economic-ean-transfer 
Fix e-conomic EAN customer transfer
 2026-07-06 17:00:57 +02:00
Jeppe B c089186046 Merge pull request #302 from copenhagentruckwash/codex/customer-orderbooking-create-without-permission 
Allow customer order booking creation without booking permission
 2026-07-06 16:39:17 +02:00
Jeppe B f262047476 Merge pull request #300 from copenhagentruckwash/codex/scoped-monthly-split-api 
Scope monthly invoice split API
 2026-07-06 16:01:54 +02:00
Jeppe B b8390ac0d3 Merge pull request #298 from copenhagentruckwash/codex/only-tankcleaning-order-enforcement 
Enforce only tankcleaning order products
 2026-07-06 16:01:40 +02:00
Jeppe B 0d4a5470e5 Add superuser department overview API (#301) 
Merge backend API for the superuser department overview.
 2026-07-06 16:01:04 +02:00
Jeppe B 845ca6e48e Merge pull request #290 from copenhagentruckwash/codex/custom-pricing-only-departments 
Add custom-only department pricing enforcement
 2026-07-06 15:31:27 +02:00
Jeppe BandJeppe Bundgaard 8e46ce1b04 [codex] Allow error reports without screenshots (#299) 
* Allow error reports without screenshots

* Stabilize edge gateway shell transcript smoke

---------

Co-authored-by: Jeppe Bundgaard <jb@truckwash.dk>
 2026-07-06 14:27:47 +02:00
Jeppe BandJeppe Bundgaard 11c2a1b72e Block restricted customer order items (#296) 
Co-authored-by: Jeppe Bundgaard <jb@truckwash.dk>
 2026-07-06 14:06:29 +02:00
Jeppe BandJeppe Bundgaard 6f3d7e0f7d Add limited backoffice employee contact fields (#294) 
Co-authored-by: Jeppe Bundgaard <jb@truckwash.dk>
 2026-07-06 13:14:06 +02:00
Jeppe B a8fba73d99 Add limited backoffice role permission details (#291) 
Adds grouped safe permission metadata for limited backoffice role presets.
 2026-07-06 12:24:54 +02:00
Jeppe B 669759461d Merge pull request #293 from copenhagentruckwash/codex/economic-collected-invoice-transfer-speed 
Optimize collected e-conomic invoice transfers
 2026-07-06 11:49:47 +02:00
Jeppe B 94c3654240 Merge pull request #292 from copenhagentruckwash/fix/limited-backoffice-price-save 
[codex] Fix limited backoffice price saves on legacy schema
 2026-07-06 11:03:44 +02:00
Jeppe BandJeppe Bundgaard 3f41eebdf6 Default vehicle subscriptions to false (#288) 
Co-authored-by: Jeppe Bundgaard <jb@truckwash.dk>
 2026-07-06 09:21:31 +02:00
Jeppe B 64e0b2444b Merge pull request #289 from copenhagentruckwash/fix/limited-backoffice-api-compat 
[codex] Fix limited backoffice schema compatibility
 2026-07-06 09:20:56 +02:00
Jeppe B f0a8299133 Merge pull request #287 from copenhagentruckwash/fix/api-ci-limited-backoffice 
Fix API CI failures
 2026-07-02 11:03:12 +02:00
Jeppe B 605efacece Merge pull request #284 from copenhagentruckwash/codex/optimize-scanner-lpr-backend 
[codex] optimize scanner LPR backend
 2026-06-12 22:08:35 +02:00
Jeppe B b3ba3c8de5 Merge pull request #283 from copenhagentruckwash/fix/pwa-selfserve-stop-latency 
[codex] Reduce self-serve latency and add PHP-FPM workers
 2026-06-12 13:15:28 +02:00
Jeppe B 5027d0c919 Merge pull request #282 from copenhagentruckwash/codex/register-cvr-welcome-email-fix 
[codex] Fix register CVR welcome email rendering
 2026-06-11 21:22:28 +02:00
Jeppe B af8968a87e Merge pull request #281 from copenhagentruckwash/codex/customer-registration-notifications 
Add Slack customer registration webhook test endpoint
 2026-06-11 15:18:07 +02:00
Jeppe B b5c24ef80a Merge pull request #280 from copenhagentruckwash/fix/self-serve-path-outcome-case-limit 
Fix self-serve path outcome case limit
 2026-06-11 14:57:16 +02:00
Jeppe B bdb1a0074b Merge pull request #279 from copenhagentruckwash/fix/self-serve-customer-property-gates 
Allow customers to open property gates for active washes
 2026-06-10 22:00:06 +02:00
Jeppe B 574b263a54 Merge pull request #278 from copenhagentruckwash/fix/self-serve-start-wash-type 
Honor wash type in self-serve lane start
 2026-06-10 20:07:46 +02:00
Jeppe B 36ff5bb438 Merge pull request #277 from copenhagentruckwash/fix-completion-confirmation-route 
Add order booking completion confirmation resend route
 2026-06-10 20:07:30 +02:00
Jeppe B d605eca574 Fallback composer installs to source in CI 2026-06-10 19:22:52 +02:00
Jeppe B 7e85c74e60 Retry composer installs in CI 2026-06-10 19:12:12 +02:00
Jeppe B 67d62eff70 Sync fake email deliveries across API tests 2026-06-10 18:53:13 +02:00
Jeppe B 8ebbd52a99 Normalize attachment object type lookups 2026-06-10 18:40:34 +02:00
Jeppe B 6d6cc501db Force completion confirmation resend email 2026-06-10 18:33:53 +02:00
Jeppe B ce999afbb3 Fix MinIO local test storage fallback 2026-06-10 18:22:53 +02:00
Jeppe B cb34b030c8 Add order booking completion confirmation resend route 2026-06-10 17:55:57 +02:00
Jeppe B 6f1c160fbb Sync generated Copilot workflow 2026-06-03 20:57:06 +02:00
Jeppe B bcbc2481c3 Source self-serve lane products from published config 2026-06-02 19:05:06 +02:00
Jeppe B 8288a1069c Merge pull request #276 
coolify-github-runner-management
 2026-06-02 17:27:42 +02:00
Jeppe B f7485f0767 Merge pull request #273 from copenhagentruckwash/update-self-serve-lane-command-access-logic 
Allow customer self-serve lane commands
 2026-06-02 10:22:21 +02:00
Jeppe B 1468e43ce2 Merge pull request #272 from copenhagentruckwash/add-endpoint-to-resend-booking-confirmations 
Add booking confirmation resend endpoint
 2026-06-02 10:12:29 +02:00
Jeppe B ee2af5091c Retry CI docker compose startup 2026-06-02 10:08:01 +02:00
Jeppe B 0672a68e8b Merge pull request #274 from copenhagentruckwash/update-self-serve-lane-command-access-logic-bft43z 
Support customer self-serve lane commands with operational/department checks and tests
 2026-06-02 10:07:27 +02:00
Jeppe B b92d1f0bdf Fix self-serve lane command API tests 2026-06-02 09:52:44 +02:00
Jeppe B ac60596218 Fix booking confirmation resend test fixture 2026-06-02 09:36:36 +02:00
Jeppe B f4b9d71d40 Merge pull request #270 from copenhagentruckwash/add-customer-self-serve-module-authorization-checks 
Guard customer self-serve command fallback behind global module flag
 2026-06-02 09:25:00 +02:00
Jeppe B 77b1c8ec78 Merge pull request #271 from copenhagentruckwash/inspect-command-authorization-for-self-serve-route 
Authorize self-serve lane commands by customer scope and operator permission
 2026-06-02 09:24:38 +02:00
Jeppe B 01221d8282 Allow customer self-serve lane commands 2026-06-02 09:24:33 +02:00
Jeppe B 47068e6d7e Add booking confirmation resend endpoint 2026-06-02 09:15:34 +02:00
Jeppe B 46bdeded78 Fix self-serve lane command customer authorization 2026-06-02 09:15:24 +02:00
Jeppe B eefa521fc5 Guard customer self-serve commands behind module flag 2026-06-02 09:14:57 +02:00
Jeppe B ec1988715d Merge pull request #269 from copenhagentruckwash/fix-parse-error-in-index.php 
Handle Release Manager gate parse-error deadlock
 2026-06-02 02:53:54 +02:00
Jeppe B c3fb2e8651 Handle release gate parse-error deadlock 2026-06-02 02:50:02 +02:00
Jeppe B 0fb279fc5f Merge pull request #268 from copenhagentruckwash/investigate-and-fix-failing-tests 
Resolve PHP merge conflicts and restore search/autoload behavior
 2026-06-02 02:33:35 +02:00
Jeppe B 3e970d9cb9 Seed subuser session cache in API fixtures 2026-06-02 02:29:52 +02:00
Jeppe B 8c10c07cc9 Resolve Caddy replication bootstrap conflict 2026-06-02 02:25:29 +02:00
Jeppe B 18a8513b40 Use namespaced subuser object in API fixtures 2026-06-02 02:21:53 +02:00
Jeppe B 4c77b78c6c Keep self-serve invoice billing customer authoritative 2026-06-02 02:15:27 +02:00
Jeppe B bb249da477 Align API tests with hardened auth and department access 2026-06-02 02:09:14 +02:00
Jeppe B eb16a4e6ce Fix collected invoice queue count expectations 2026-06-02 02:00:35 +02:00
Jeppe B a2e525fa9e Update unit expectations for hardened flows 2026-06-02 01:53:58 +02:00
Jeppe B 0bf19c9d33 Restrict indexed department filters to scoped entities 2026-06-02 01:34:21 +02:00
Jeppe B 5850bfbce7 Keep autoload cache validation test compatible 2026-06-02 01:16:20 +02:00
Jeppe B fd51a5b119 Fix search table argument ordering 2026-06-02 01:07:45 +02:00
Jeppe B 140365c8bb Resolve PHP merge conflict test failures 2026-06-02 00:58:15 +02:00
Jeppe B c9ceac8533 Merge pull request #267 from copenhagentruckwash/fix-permission-checks-for-subuser-endpoints 
Require SUBUSERS_LIST permission for GET /subusers to enforce RBAC
 2026-06-02 00:42:48 +02:00
Jeppe B 72ec62d042 Merge pull request #259 from copenhagentruckwash/fix-redis-autoload-cache-vulnerability 
Harden Redis-backed autoloader against poisoned path inclusion
 2026-06-02 00:37:33 +02:00
Jeppe B 21f5e6d9cf Enforce permission check on subuser list endpoint 2026-06-02 00:35:48 +02:00
Jeppe B 73b91ccec9 Merge pull request #265 from copenhagentruckwash/fix-unauthenticated-bird-voice-webhook 
Reinstate authorization check for Bird inbound voice webhook
 2026-06-02 00:33:43 +02:00
Jeppe B 0c809a19da Merge pull request #257 from copenhagentruckwash/propose-fix-for-redis-image-cache-vulnerability 
Limit Redis dynamic image caching to default variant only
 2026-06-02 00:33:27 +02:00
Jeppe B 3a6685c345 Merge pull request #255 from copenhagentruckwash/fix-system-search-authorization-bypass 
Enforce department scoping in system search for generic entities
 2026-06-02 00:33:02 +02:00
Jeppe B a60983f328 Merge pull request #266 from copenhagentruckwash/propose-fix-for-n8n-ssrf-vulnerability 
Harden n8n webhook trigger URL validation against SSRF
 2026-06-02 00:32:47 +02:00
Jeppe B e2c2eb21cb Harden n8n webhook trigger URL validation 2026-06-02 00:32:35 +02:00
Jeppe B cc00fb2aed Reinstate auth on Bird inbound voice webhook 2026-06-02 00:23:58 +02:00
Jeppe B 7f38cf2f7e Merge pull request #264 from copenhagentruckwash/propose-fix-for-ssrf-in-workfeed-api 
Restrict Workfeed API base URL to trusted hosts (prevent SSRF)
 2026-06-02 00:22:35 +02:00
Jeppe B d281dddbc1 Restrict Workfeed API base URL 2026-06-02 00:22:18 +02:00
Jeppe B 267ec1bed1 Merge pull request #263 from copenhagentruckwash/fix-machine-relay-set-endpoint-vulnerability 
Guard machine relay set status
 2026-06-02 00:21:49 +02:00
Jeppe B a96f40cf13 Guard machine relay set status 2026-06-02 00:21:32 +02:00
Jeppe B d6190626ce Merge pull request #262 from copenhagentruckwash/fix-cross-tenant-job-data-exposure 
Scope economic transfer queue jobs by creator
 2026-06-02 00:20:48 +02:00
Jeppe B ce8e6d0dab Scope economic transfer queue jobs by creator 2026-06-02 00:20:30 +02:00
Jeppe B c13c2e2cab Merge pull request #261 from copenhagentruckwash/fix-customer-data-leak-in-wash-endpoint 
Restrict in-progress wash details by lane department
 2026-06-02 00:20:07 +02:00
Jeppe B 7380bc729b Restrict in-progress wash details by lane department 2026-06-02 00:19:55 +02:00
Jeppe B 434a5049e2 Merge pull request #260 from copenhagentruckwash/fix-unpinned-github-actions-vulnerability 
Harden Qodana workflow permissions and pin checkout action
 2026-06-02 00:17:44 +02:00