Adds a scope-based access control layer to all 81 existing API routes.
Sits alongside existing session-cookie auth (does not replace it).
What this PR does:
- Audits every existing route and documents required scope per route
(see documentation/auth/route-scope-audit.md)
- Adds classes/auth/scope.php with 10 scope constants and role→scope defaults
- Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole
- Applies require*() calls to all 81 existing routes
- Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines)
Coexistence note:
This branch's classes/auth/scope.php is a stub that will be replaced
by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that
PR merges first. The two have compatible APIs.
Refs: TRU-149
- Refactored department daily targets logic for optimization and better maintainability.
- Ensured department-specific targets are validated, sanitized, and consistently applied in updates.
- Improved database interaction safety by preventing unnecessary updates for unchanged object properties.
- Adjusted route and API behavior for criteria and department updates to handle validations comprehensively.
- Swap `send_message` with `send_webhook_message` to fix departmental Slack notification issues.
- Adjust `COUNT_ONLY` in `renderDanishPeriodSummary` to exclude targets for raw count-focused alerts.
- Replace `send_webhook_message` with `send_message` for improved Slack notification rendering using `goals_progress_alert_renderer`.
- Add methods for calculating and retrieving departmental progress and distribution in `goals_criteria`.
- Update `renderDanishPeriodSummary` and Slack cron logic to support departmental-specific summaries.
- Include departmental progress in serialized goal objects for better reporting.
- Add support for sending Slack notifications to multiple department webhooks.
- Adjust Danish label pluralization based on counts for departments, customers, and products.
- Implement `/goals/department/progress-alert/test` POST endpoint to send test progress alerts.
- Support email, SMS, and Slack as alert destinations with customizable parameters.
- Validate user permissions, goal existence, and alert configuration before dispatch.
- Extend alert rendering logic with destination-specific delivery methods.
- Add `validateAndSanitize` method to `goals_criteria` for input validation and defaulting incorrect values.
- Ensure JSON encoding in `response` and database interactions respects Unicode (`JSON_UNESCAPED_UNICODE`).
- Sanitize and validate input for `department_goals_o::add` and criteria usage.
- Fix header character encoding in response (`Content-Type: application/json; charset=utf-8`).
- Update criteria `label` sanitization with trimming, length limits, and safe character handling.
- Restrict goal listing and retrieval based on user permissions and department access.
- Enforce department-level access control for goal creation, updates, and deletions.
- Validate user actions against `superuser` status and department memberships.
- Implement route for listing department goals with optional pagination and single-goal retrieval.
- Add logic to create, update, and delete department goals with validation for input and permissions.
- Support department and criteria management via JSON parsing and object transformation.
OpenClaw