copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Test promotion flow - TRU-149 #1

Open
admin wants to merge 12 commits from feat/TRU-149-route-scopes into master
pull from: feat/TRU-149-route-scopes
merge into: :master
Conversation 0 Commits 12 Files Changed 101
+1956 -1
admin commented 2026-08-17 20:10:08 +00:00
Owner
Copy Link
Copy Source
No description provided.
admin added 12 commits 2026-08-17 20:10:09 +00:00
feat(auth): add scope-based access control to all existing routes (TRU-149) 51a87655d6 
Adds a scope-based access control layer to all 81 existing API routes.
Sits alongside existing session-cookie auth (does not replace it).

What this PR does:
- Audits every existing route and documents required scope per route
  (see documentation/auth/route-scope-audit.md)
- Adds classes/auth/scope.php with 10 scope constants and role→scope defaults
- Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole
- Applies require*() calls to all 81 existing routes
- Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines)

Coexistence note:
This branch's classes/auth/scope.php is a stub that will be replaced
by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that
PR merges first. The two have compatible APIs.

Refs: TRU-149
Merge branch 'master' into feat/TRU-149-route-scopes 6cf94b8cd9
Merge branch 'master' into feat/TRU-149-route-scopes e9f1b8f880
fix(auth): keep public driver registration endpoints publicly accessible (TRU-149) fd70864434 
The scope-middleware injection on the public driver registration
endpoints (POST /subusers and POST /subusers/me) breaks the public
registration contract — new drivers cannot hold a scope before they
exist, so requiring one would make self-registration impossible.

PublicSubuserRegistrationContractTest enforces the literal
'POST /subusers → registerPublicSubuser' / 'POST /subusers/me →
registerPublicSubuser' signature. Adding the ScopeMiddleware call
violates that contract and fails the test.

Drop the ScopeMiddleware::requireScope() call from both public
registration handlers; the in-method abuse controls (recaptcha,
rate limits, MySQL GET_LOCK) remain the only gate, as before.

Fixes CI on PR #397 (Required CI, PHP unit, PHP api, PHP integration).
Merge branch 'master' into feat/TRU-149-route-scopes 0c57460540
Merge branch 'master' into feat/TRU-149-route-scopes f32bca2ac7
fix(auth): add scope checks to remaining protected routes and fix scope test contract 9025a8af6e 
Three fixes for the failing CI checks (PHP api, PHP integration):

1. RouteScopeTest.php: Pest's toContain() is variadic, so both arguments
   are treated as needles. The second 'description' argument was
   being treated as a needle, causing every file to fail. Removed the
   misleading second argument.

2. Added ScopeMiddleware::requireScope() calls and the matching
   Scope/ScopeMiddleware imports to 15 protected route files that
   the integration test contract requires.

3. documentation/auth/route-scope-audit.md: added the missing
   Scope::SUPERUSER_WRITE reference and a constants reference table.

Also registered tests/auth/StripeInvoiceEmailTemplateTest.php in the
legacy test manifest.
fix(auth): grant customer role WRITE scopes for own data (TRU-149) cae91d6a11
Merge branch 'master' into feat/TRU-149-route-scopes 7258c72f60
Merge branch 'master' into feat/TRU-149-route-scopes ccae88f4ef
Merge branch 'master' into feat/TRU-149-route-scopes b0ef6aaef9
Merge branch 'master' into feat/TRU-149-route-scopes
Qodana / Qodana (pull_request) Waiting to run
Details
Tests / PHP api (required) (pull_request) Waiting to run
Details
Tests / PHP integration (required) (pull_request) Waiting to run
Details
Tests / PHP legacy (required) (pull_request) Waiting to run
Details
Tests / PHP unit (required) (pull_request) Waiting to run
Details
Tests / Edge Agent (required) (pull_request) Waiting to run
Details
Tests / Edge Broker (required) (pull_request) Waiting to run
Details
Tests / Edge Gateway Backend (required) (pull_request) Waiting to run
Details
Tests / Required CI (pull_request) Blocked by required conditions
Details
Tests / Release Manager gate (pull_request) Blocked by required conditions
Details
ef377ae6bd
Some checks are pending
Qodana / Qodana (pull_request) Waiting to run
Details
Tests / PHP api (required) (pull_request) Waiting to run
Details
Tests / PHP integration (required) (pull_request) Waiting to run
Details
Tests / PHP legacy (required) (pull_request) Waiting to run
Details
Tests / PHP unit (required) (pull_request) Waiting to run
Details
Tests / Edge Agent (required) (pull_request) Waiting to run
Details
Tests / Edge Broker (required) (pull_request) Waiting to run
Details
Tests / Edge Gateway Backend (required) (pull_request) Waiting to run
Details
Tests / Required CI (pull_request) Blocked by required conditions
Details
Tests / Release Manager gate (pull_request) Blocked by required conditions
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/TRU-149-route-scopes:feat/TRU-149-route-scopes
git checkout feat/TRU-149-route-scopes
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
admin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: copenhagentruckwash/api#1