Commit Graph
380 Commits
Author SHA1 Message Date
copilot-swe-agent[bot] 1065973b33 Merge master into fix-sql-injection-in-vehicle-plate-lookup 2026-06-01 21:07:49 +00:00
Jeppe B d1871f1420 Fix SQL injection in vehicle plate order history lookup 2026-06-01 23:03:18 +02:00
Jeppe B 08a1538ed6 Merge pull request #212 from copenhagentruckwash/propose-fix-for-sql-injection-vulnerability
Cast pickup_bool to int to prevent SQL injection in bookings sync
2026-06-01 23:02:38 +02:00
Jeppe B f2fc4f6f18 Fix SQL injection risk in booking sync pickup_bool 2026-06-01 23:02:28 +02:00
copilot-swe-agent[bot] 6995c3d1bc Merge origin/master and resolve orders_o conflict 2026-06-01 20:57:44 +00:00
Jeppe B bc4b7bde15 Fix SQL injection in vehicle plate order history lookup 2026-06-01 22:55:06 +02:00
Jeppe B 65283b8ad7 Merge pull request #196 from copenhagentruckwash/fix-sql-injection-in-recommended-order-lookup
Escape plate input to prevent SQL injection in recommended-order lookup
2026-06-01 22:45:46 +02:00
copilot-swe-agent[bot] eedde6c6d7 Merge origin/master and resolve orders_o conflict 2026-06-01 20:41:18 +00:00
copilot-swe-agent[bot] fbe700a4db Merge remote-tracking branch 'origin/master' into fix-subuser-tokens-allowing-user-impersonation
# Conflicts:
#	services/nginx/app/classes/authentication.php
2026-06-01 20:39:16 +00:00
Jeppe B c43618351e Escape plate in recommended order SQL lookup 2026-06-01 22:37:55 +02:00
Jeppe B fd4ec3dda2 Fix subuser token confusion in user auth flow 2026-06-01 22:35:24 +02:00
copilot-swe-agent[bot] 933b18b988 Merge origin/master and resolve booking conflict files 2026-06-01 18:59:05 +00:00
Jeppe B 71ffa20811 Validate booking order context before certificates 2026-06-01 20:55:26 +02:00
Jeppe B 707cf67d5c Remove OrdersApiTest to clean up obsolete test cases 2026-06-01 13:07:21 +02:00
Jeppe Bundgaard f8c254607d Implement Lane Status Audit and Comprehensive Self-Serve API Enhancements
- Introduced `machine_status_audit` in self-serve lanes for tracking changes.
- Added new methods to handle audit data including `setLaneStatusAudit` and `getMachineStatusAudit`.
- Enhanced API tests to include legacy Redis constant checks and validated comprehensive self-serve invoice creation.
- Updated department lanes to reflect audit logs in their responses.
2026-05-28 17:27:25 +02:00
Jeppe Bundgaard ae3657e7aa Add new API tests for order item note requirements, subuser route updates, and department lane status management
- Introduced tests for validating note requirements on order items.
- Updated subuser route management contract tests with new route coverage.
- Added endpoints to manage department lane and self-serve lane statuses, with associated tests.
2026-05-28 16:06:14 +02:00
Jeppe Bundgaard eef436d44b Add tests for subuser password validation and grant permission normalization
Introduce unit and API tests for subuser password policies ensuring compliance with complexity requirements. Normalize subuser grant permission handling for consistency, including support for legacy zero permissions.
2026-05-27 19:17:19 +02:00
Jeppe Bundgaard bc7c0280f2 Add .gitattributes for binary files and extend order booking update tests. Enhance dynamic image and routing logic with program_picker support. 2026-05-26 14:04:27 +02:00
Jeppe Bundgaard 00a8723347 Integrate Coolify API client and module for managing Coolify services, enhancing automation and deployment processes. 2026-05-19 13:17:07 +02:00
Jeppe Bundgaard 6c40810caf Add unit tests for invoicing period pagination, normalization, and filtering logic
- Implemented `InvoicingPeriodPaginationTest` for testing period pagination modes, normalization of options, search functionality, and visibility filters.
- Added comprehensive tests to validate scenarios such as active period views, exact counts, and customer-card level search.
- Improved cURL timeout settings with `CURLOPT_CONNECTTIMEOUT` and `CURLOPT_TIMEOUT` adjustments.
- Introduced and documented helper classes/methods for local caching, pagination response structure, and customer name retrieval.
2026-05-12 03:37:47 +02:00
Jeppe Bundgaard 70080086da Add unit tests for Redis namespace safety, MotorAPI cache functionality, and configuration classes, alongside implementation of xlvask_automation_service
- Added tests to ensure Redis namespace safety for `db_object_t` and `users_o`.
- Implemented `MotorApiCachedResultTest` to validate metadata caching behavior.
- Introduced configuration classes for `xlvask_automatic_order_attachment_enabled` and `xlvask_automatic_order_creation_enabled`.
- Developed `xlvask_automation_service` with supporting features for usage log evaluation, suggestion building, and order automation.
2026-05-12 00:22:27 +02:00
Jeppe Bundgaard c1b66a81cc Add invoice_period_flag_ classes to manage invoice period flags with schema, services, and flag lifecycle methods
- Introduced `invoice_period_flag_schema_bootstrap` to initialize the schema for invoice period flags.
- Added `invoice_period_flag_service` to handle manual and automatic flag creation, updates, filtering, and context resolution.
- Implemented lifecycle methods such as `createManualFlag`, `updateAutomaticFlagStatus`, and `applyFlagsToPeriodTypes` for handling invoice period flags and their usage in processing periods.
- Included context-specific resolution methods for efficient flag management in invoicing workflows.
2026-05-11 21:34:57 +02:00
Jeppe Bundgaard 6d4066be1c Add unit tests for InvoicingPeriodDraftOverlay and reference suggestion logic, including fake DB integration and aggregation methods
- Implemented `InvoicingPeriodDraftOverlayTest` with coverage for blocking and permitting invoicing actions based on draft states, transactions, and metadata.
- Created `ReferenceSuggestionsApiTest` to validate ranked and filtered suggestions across bookings, orders, and vehicles with varied match relevance, context, and frequency.
- Added `order_reference_suggestions_service` class, including query methods, normalization utilities, and aggregation logic for reference suggestions.
- Enhanced query handling in `InvoicingPeriodDraftOverlayFakeDb` to validate SQL constraints and column cache resets in overlapping invoicing contexts.
2026-05-11 18:18:08 +02:00
Jeppe Bundgaard bea7e5697b Handle empty inputs in Redis and database operations, improve safety seal validation, and enhance related tests
- Return empty arrays for empty inputs in Redis `mget`, `db_object_t`, and `users_o` operations.
- Refactor safety seal validation logic to handle numeric strings and improve clarity.
- Add unit and API tests to verify handling of empty inputs and numeric safety seal strings.
2026-05-11 04:36:11 +02:00
Jeppe Bundgaard 59a6297925 Refactor booking completion logic to improve wash certificate handling
- Replaced `orderWasCreatedDuringCompletion` flag with optimized checks for wash certificate attachment.
- Updated method signatures to use nullable `safety_seal` parameter for consistency.
- Enhanced `completeBooking` logic to prevent duplicate wash certificate creation or sending.
- Added `hasWashCertificateAttached` method to streamline order checks and improve clarity.
- Updated tests to cover edge cases for wash certificate attachment and email dispatch behavior.
2026-05-11 01:56:46 +02:00
Jeppe Bundgaard 0cbc3e9aa5 Add support for archived departments with schema updates, API integration, and filtering logic
- Added `archived` column and index to `departments` table, ensuring schema initialization via `departments_schema_bootstrap`.
- Updated OpenAPI spec to include `archived` attribute and `filters=archived` query parameter with superuser access control.
- Enhanced `Departments` API to support archived department filtering and retrieval.
- Modified `ApiFixtures`, `departments_o`, and related tests to validate behavior for archived departments.
- Added unit and API tests to ensure correct handling of archived departments and filter enforceability.
2026-05-07 13:50:32 +02:00
Jeppe Bundgaard 22fcb5cd0e - Refactor machine_1 drawing logic: optimize highlighted button rendering and deferred processing.
- Add branding management feature: API routes, payload handling, and OpenAPI schema updates.
- Implement department branding logic: CRUD operations, validation, and permissions.
- Add order deletion confirmation support with conflict handling and OpenAPI schema updates.
- Enhance tests and API methods for improved order handling and branding workflows.
2026-05-07 10:44:00 +02:00
Jeppe Bundgaard a71bde3211 Remove legacy booking completion forms and related logic
- Deleted `complete_booking_f` and `generate_booking_wash_certificate_f` classes.
- Updated tests to ensure legacy booking completion routes are disabled.
- Introduced tests for POST `/order-bookings/complete` to enforce POS-based booking completion management.
- Added `/collected-invoices/split-by-month` route with API and unit tests for splitting collections into monthly periods.
- Refactored impacted files to exclude legacy references and ensure continued compatibility with POS processes.
2026-05-06 14:02:48 +02:00
Jeppe Bundgaard 8bf957b273 Add support for selfserve_enabled lanes and synchronize behavior across tasks, sessions, and projections
- Introduced `selfserve_enabled` property for `department_lanes` with schema update, object properties, and associated methods/tests.
- Enhanced `selfserve_wash_flow` and session logic to respect lane self-serve settings, including block handling and task filtering.
- Updated API routes and Studio Graph projections to include `selfserve_enabled` in payloads and progress callbacks.
- Added unit tests for session statuses, lane configuration, and blocking behavior due to disabled self-serve settings.
2026-04-29 17:28:42 +02:00
Jeppe Bundgaard eeccacb2a7 Add unit tests for department lane dynamic image overrides and introduce classes for self-serve signal and virtual hardware management
- Add `DepartmentLaneDynamicImageRouteTest` to verify dynamic image preview handling for studio lanes.
- Introduce `selfserve_machine_signal` class to standardize signal normalization, recording, and gateway signal management workflows.
- Add `selfserve_virtual_hardware` class to handle virtual hardware configurations, including gateway and binding management.
- Enhance structure with auxiliary methods for payload normalization, workspace merging, and validation warnings.
2026-04-29 09:52:51 +02:00
Jeppe Bundgaard 690e114d38 Add tests for customer-scoped vehicle conditions and property gate permissions
- Introduced tests for `SelfserveNonOwnedVehicleWashAccess` to validate customer-scoped conditions for non-owned vehicles.
- Added `SelfservePropertyGatePermissionBypassTest` to ensure proper permission handling for lanes and departments.
- Updated `department_selfserve_vehicle_conditions_o` and routes to prevent cross-customer answer persistence.
- Enhanced `selfserve_wash_flow` with customer-scoped persisted answer logic and improved method parameters for vehicle eligibility and session synchronization.
- Adjusted OpenAPI spec and unit tests to reflect new customer-scoping behavior in self-serve operations.
2026-04-28 17:59:33 +02:00
Jeppe Bundgaard c73e459d26 Add edge gateway broker configurations and session management routes
- Add broker-related configuration classes (`broker_url`, `public_broker_url`, `auth_mode`, `shared_secret`) to support edge gateway functionality.
- Enhance `SelfserveRoute` with routes for managing self-serve wash sessions, including session listing, detail retrieval, and forced lane stop.
- Update unit tests to validate new configuration handling, session routes, and OpenAPI endpoint coverage.
- Include default environment variables for broker settings in `docker-compose.example.yml`.
2026-04-28 10:04:17 +02:00
Jeppe Bundgaard ebe1299089 Fix PHP unit test isolation 2026-04-24 20:17:01 +02:00
Jeppe Bundgaard 4420d76cd2 Add "stage" field and additional JSON payloads to Edge Gateway operation events schema 2026-04-23 15:50:30 +02:00
Jeppe Bundgaard c38a4379bd Add department hardware workspace and plate scanner updates 2026-04-23 13:31:57 +02:00
Jeppe Bundgaard e09e23025d Add Edge Broker service and rename 'rows' column to 'terminal_rows' in Edge Gateway schema 2026-04-22 19:31:21 +02:00
Jeppe Bundgaard 4c32eae49a Remove deprecated Edge Gateway Agent classes and related services 2026-04-22 19:08:44 +02:00
Jeppe Bundgaard 9cfb19a3ba Replace CI PHP suite execution script with Composer commands and integrate Edge Gateway Agent stack artifacts 2026-04-22 12:03:08 +02:00
Jeppe Bundgaard 0b18433fdf Add unit tests for EconomicCustomerModel parsing and validation 2026-04-21 15:07:41 +02:00
Jeppe Bundgaard 7d450e285e Remove outdated edge gateway object classes, add new agent implementation
Transitioned from obsolete gateway object classes (`edge_gateway_shell_action_jobs_o`, `edge_gateway_shell_events_o`, `edge_gateway_shell_sessions_o`, `edge_gateway_update_jobs_o`) to the new agent implementation (`edge-gateway-agent/agent.php`).
2026-04-21 14:13:17 +02:00
Jeppe Bundgaard d30a006457 Add delivery metadata support, preferred channels, and enhanced agent validation
This commit introduces delivery metadata tracking for gateway commands, updates, and shells. Adds preferred delivery channel handling, refined validation for edge agents, improved relay management logic, and broker presence reporting. Includes schema changes, enhanced shell handling, and test coverage.
2026-04-16 13:44:28 +02:00
Jeppe Bundgaard ebf7e820d5 Add safety seal support to orders and related logic for wash certificates
- Introduced `safety_seal` column in the `orders` table.
- Updated order creation and completion logic to handle safety seal values.
- Enhanced order and booking classes to manage safety seal attachment and retrieval.
- Added tests to validate safety seal functionality in order processing.
2026-04-14 10:51:25 +02:00
Jeppe Bundgaard dc79352f40 Add unit tests for vehicle search metadata alignment and extend API fixtures for vehicle and order item creation. Refactor booking and route handling logic for booked vehicle searches. 2026-04-13 21:42:37 +02:00
Jeppe Bundgaard a83b850aba Remove edge_broker_client.php and related unit tests. Add new dependencies and configuration files for edge-agent, including build scripts and package-lock updates. 2026-04-13 09:42:35 +02:00
Jeppe Bundgaard 745e68aa4f Add wash_date and category fields to complaints, update schema and OpenAPI spec, and extend unit and integration tests for validation and route handling. 2026-04-09 14:16:35 +02:00
Jeppe Bundgaard 22f856c62a Add unit tests for invoicing, orders normalization, gateway commands, and department complaints. Update schema bootstraps and improve agent command execution logic. 2026-04-09 12:24:22 +02:00
Jeppe Bundgaard 9e9372db05 Add unit tests for Bird department gate phone call logic, Edge Broker configuration, and gateway heartbeat status. Refactor warnings handling, Slack notifications, Bird client usage, and Edge gateway probes for improved maintainability and error clarity. 2026-04-09 08:53:10 +02:00
Jeppe Bundgaard 45b7250480 Add Edge Agent implementation for gateway connection lifecycle, agent commands, Shelly device discovery, relay control, and WebSocket communication with broker. Include unit tests for critical flows. 2026-04-08 19:01:42 +02:00
Jeppe Bundgaard 653680376a Add unit and integration tests for collected invoice queue handling, route hardening, lifecycle validation, and manual batch processing logic. 2026-04-08 15:53:22 +02:00
Jeppe Bundgaard ba23ad6e8f Add economic_transfer_executor and economic_transfer_queue classes for handling e-conomic invoice transfer logic, queue management, and processing. Include unit tests for Redis cache validation. 2026-04-08 11:20:08 +02:00