OpenClaw
51a87655d6
Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
69 lines
2.3 KiB
PHP
69 lines
2.3 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\limble;
|
|
use classes\response;
|
|
use classes\router;
|
|
use classes\slack;
|
|
use limble\helpers\limble_tasks_pagination;
|
|
use limble\helpers\limble_webhook_payload_task;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class moduleLimbleRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
global /** @var response $response */
|
|
/** @var router $router */
|
|
$router, $response;
|
|
$this->post('/modules/limble/webhook/task', function () {
|
|
ScopeMiddleware::requireScope(Scope::SUPERUSER_WRITE, '/modules/limble/webhook/task');
|
|
global $response;
|
|
$slack = new slack();
|
|
$this->requirePermission('modules_limble_webhooks_task');
|
|
// Check if the module is enabled
|
|
$limble = new limble();
|
|
$limble->requireModuleEnabled();
|
|
$limble->requireWebhooksEnabled();
|
|
$payload = json_decode(file_get_contents('php://input'), true);
|
|
if (json_last_error() !== JSON_ERROR_NONE) {
|
|
$response->error('Invalid JSON payload', 400);
|
|
}
|
|
$task = new limble_webhook_payload_task($payload);
|
|
// Response
|
|
$response->success('Debug', 200);
|
|
},
|
|
[
|
|
'modules_limble_webhooks_task' => 'Send Limble Webhook Task (POST)',
|
|
]
|
|
);
|
|
|
|
$this->get('/modules/limble/tasks', function () {
|
|
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/limble/tasks');
|
|
global $response;
|
|
$slack = new slack();
|
|
$slack->send_message('Limble Tasks Endpoint Triggered', 'Limble Tasks');
|
|
$this->requirePermission('modules_limble_tasks');
|
|
// Check if the module is enabled
|
|
$limble = new limble();
|
|
$limble->requireModuleEnabled();
|
|
$pagination = new limble_tasks_pagination();
|
|
//$pagination->tasks = 2;
|
|
// Get the tasks
|
|
$tasks = $limble->getTasks()->formatTasks($limble->listTasks($pagination));
|
|
// Response
|
|
$response->success($tasks, 200);
|
|
},
|
|
[
|
|
'modules_limble_tasks' => 'Get Limble Tasks (GET)',
|
|
]
|
|
);
|
|
}
|
|
}
|