OpenClaw
51a87655d6
Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
96 lines
3.9 KiB
PHP
96 lines
3.9 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\economic;
|
|
use classes\response;
|
|
use classes\router;
|
|
use objects\logs_o;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class moduleEconomicCustomerRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
global /** @var response $response */
|
|
/** @var router $router */
|
|
$router, $response;
|
|
|
|
|
|
/** Modules > Economic > Customer > Get customer */
|
|
$this->get('/modules/economic/customer', function () {
|
|
ScopeMiddleware::requireScope(Scope::INVOICE_READ, '/modules/economic/customer');
|
|
global $response;
|
|
$this->requirePermission('modules_economic_customer_get');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
self::requireParameters(['customer_number']);
|
|
self::requireType('customer_number', self::type_int());
|
|
self::requireMinLength('customer_number', 1);
|
|
self::requireMaxLength('customer_number', 10);
|
|
(new logs_o())->add('modules_economic', 'global', 1, 0, 'MODULES_ECONOMIC', 'User accessed the customer');
|
|
$result = (new economic())->getCustomer((int)$_GET['customer_number']);
|
|
$response->success((object)$result);
|
|
} else {
|
|
(new logs_o())->add('modules_economic', 'global', 0, 0, 'MODULES_ECONOMIC', 'User tried to access the customer without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_economic_customer_get' => 'Get customer'
|
|
]
|
|
);
|
|
|
|
/** Modules > Economic > Customer > Create customer */
|
|
$this->post('/modules/economic/customer', function () {
|
|
ScopeMiddleware::requireScope(Scope::INVOICE_WRITE, '/modules/economic/customer');
|
|
global $response;
|
|
$this->requirePermission('modules_economic_customer_create');
|
|
$user = (new authentication())->get_user();
|
|
if ($user || true) {
|
|
self::requireParameters(['customer_number', 'cvr', 'email', 'phone', 'name']);
|
|
self::requireMinLength('customer_number', 1);
|
|
self::requireMaxLength('customer_number', 10);
|
|
self::requireMinLength('cvr', 1);
|
|
self::requireMaxLength('cvr', 10);
|
|
self::requireMinLength('email', 1);
|
|
self::requireMaxLength('email', 255);
|
|
self::requireMinLength('phone', 1);
|
|
self::requireMaxLength('phone', 255);
|
|
self::requireMinLength('name', 1);
|
|
self::requireMaxLength('name', 255);
|
|
$ean = null;
|
|
if (self::isParametersSet(['ean'])) {
|
|
try {
|
|
$ean = economic::normalizeCustomerEan(self::getParameter('ean'));
|
|
} catch (\InvalidArgumentException $exception) {
|
|
$response->error($exception->getMessage(), 400);
|
|
}
|
|
}
|
|
(new logs_o())->add('modules_economic', 'global', 1, 0, 'MODULES_ECONOMIC', 'User accessed the customer');
|
|
$result = (new economic())->createCustomer(
|
|
(int)self::getParameter('customer_number'),
|
|
(string)self::getParameter('name'),
|
|
(int)self::getParameter('cvr'),
|
|
(string)self::getParameter('email'),
|
|
(int)self::getParameter('phone'),
|
|
null,
|
|
null,
|
|
$ean,
|
|
);
|
|
$response->success((object)$result);
|
|
} else {
|
|
(new logs_o())->add('modules_economic', 'global', 0, 0, 'MODULES_ECONOMIC', 'User tried to access the customer without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
});
|
|
|
|
}
|
|
}
|