Jeppe B
ab6c3ba5b6
## Root cause `route_t::hasPermission()` and `requirePermission()` are instance methods. Route code was invoking them with `self::`; the new XL Vask hall-scope helper made that call from a genuinely static context, causing PHP to throw: `Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot be called statically` ## Changes - Invoke route permission methods through `$this` across all 273 executable legacy calls in 45 route classes. - Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance helper and update all 13 callers. - Preserve the existing all-scope and own-scope hall selection rules. - Add a token-aware regression test that rejects executable `self::hasPermission()` and `self::requirePermission()` calls, while ignoring comments. - Add focused XL Vask tests for global scanner hall scope and group-limited own scope. - Update affected route contract assertions to the instance-call form. ## Verification - PHP lint: all 53 changed PHP files - Focused PHPStan: changed XL Vask route and both new regression tests — clean - Focused regression slice: 58 passed, 748 assertions - Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated existing warning, 1 environment skip) - Full local API suite: 285 passed, 11,704 assertions - Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API, integration, legacy, edge gateway, and supporting checks) - Independent exact-SHA QA gate: PASS, no findings - Independent exact-SHA security gate: PASS, no findings - Independent exact-SHA reviewer gate: PASS, no findings - Remote comparison: exactly one commit ahead of `40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes matched the reviewed worktree ## Delivery state Draft only for human review. No merge or deployment is included. Qodana is skipped while the PR remains draft and is therefore not represented as a passed gate.
31 lines
2.0 KiB
PHP
31 lines
2.0 KiB
PHP
<?php
|
|
|
|
it('requires id and at least one mutable field for PUT /collected-invoices in user route', function (): void {
|
|
$routeFile = app_path('routes/userInvoicesRoute.php');
|
|
$content = file_get_contents($routeFile);
|
|
|
|
expect($content)->not->toBeFalse();
|
|
expect($content)->toContain("\$this->put('/collected-invoices'");
|
|
expect($content)->toContain("self::requireParameters(['id']);");
|
|
expect($content)->toContain("\$is_superuser = \$this->hasPermission('superuser');");
|
|
expect($content)->toContain("if (!self::isParametersSet(['po_number']) && !self::isParametersSet(['closed_at'])) {");
|
|
expect($content)->toContain("\$response->error('Missing required parameters: po_number, closed_at', 400);");
|
|
expect($content)->toContain("if (self::isParametersSet(['closed_at']) && !\$is_superuser) {");
|
|
expect($content)->toContain("\$response->error('Forbidden: only superusers can update closed_at', 403);");
|
|
expect($content)->toContain("if ((int)\$invoice->customer_number->value() !== (int)\$user->customer_number->value() && !\$is_superuser) {");
|
|
});
|
|
|
|
it('supports independent po_number and closed_at updates for PUT /collected-invoices in user route', function (): void {
|
|
$routeFile = app_path('routes/userInvoicesRoute.php');
|
|
$content = file_get_contents($routeFile);
|
|
|
|
expect($content)->not->toBeFalse();
|
|
expect($content)->toContain("if (self::isParametersSet(['po_number'])) {");
|
|
expect($content)->toContain("\$invoice->po_number->set((string)self::getParameter('po_number'));");
|
|
|
|
expect($content)->toContain("if (self::isParametersSet(['closed_at'])) {");
|
|
expect($content)->toContain("if (\$closed_at !== null && \$closed_at !== '') {");
|
|
expect($content)->toContain("self::requireDateFormat((string)\$closed_at, self::FORMAT_DATE());");
|
|
expect($content)->toContain("\$invoice->closed_at->set(\$closed_at === null || \$closed_at === '' ? null : date('Y-m-d 23:59:59', strtotime((string)\$closed_at . ' 00:00:01')));");
|
|
});
|