Files
api/services/nginx/app/routes/moduleXLVaskRoute.php
T
OpenClaw 51a87655d6 feat(auth): add scope-based access control to all existing routes (TRU-149)
Adds a scope-based access control layer to all 81 existing API routes.
Sits alongside existing session-cookie auth (does not replace it).

What this PR does:
- Audits every existing route and documents required scope per route
  (see documentation/auth/route-scope-audit.md)
- Adds classes/auth/scope.php with 10 scope constants and role→scope defaults
- Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole
- Applies require*() calls to all 81 existing routes
- Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines)

Coexistence note:
This branch's classes/auth/scope.php is a stub that will be replaced
by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that
PR merges first. The two have compatible APIs.

Refs: TRU-149
2026-08-17 11:43:13 +00:00

239 lines
8.6 KiB
PHP

<?php
namespace routes;
use classes\authentication;
use classes\response;
use classes\router;
use classes\xlvask;
use objects\orders_o;
use objects\xlvask_customers_o;
use traits\route_t;
use app\auth\Scope;
use app\auth\ScopeMiddleware;
class moduleXLVaskRoute
{
use route_t;
public function run(): void
{
global /** @var response $response */
/** @var router $router */
$router, $response;
$this->get('/modules/xlvask/usageLog', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/xlvask/usageLog');
global $response;
$this->requirePermission('modules_xlvask_usageLog');
$params = [
'dateFrom' => null,
'regNr' => null,
'vehicleId' => null,
'customerId' => null,
];
// Get the parameters from the request
foreach ( $params as $key => $value ) {
if ($this->isParametersSet([$key])) {
$params[$key] = $this->getParameter($key);
}
}
// Set the memory limit to 5120MB
ini_set('memory_limit', '5120M');
// Create the xlvask object
$xlvask = new xlvask();
$result = $xlvask->getUsageLog(...$params);
// Response
$response->success($result, 200);
},
[
'modules_xlvask_usageLog' => 'Get the usage log of the xlvask module'
]
);
$this->get('/modules/xlvask/vehicles', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/xlvask/vehicles');
global $response;
$this->requirePermission('modules_xlvask_vehicles');
$params = [
'customerId' => null,
'vehicleId' => null,
'registrationNumber' => null,
'changeDate' => null,
];
// Get the parameters from the request
foreach ( $params as $key => $value ) {
if ($this->isParametersSet([$key])) {
$params[$key] = $this->getParameter($key);
}
}
// Create the xlvask object
$xlvask = new xlvask();
$result = $xlvask->getVehicles(...$params);
// Response
$response->success($result, 200);
},
[
'modules_xlvask_vehicles' => 'Get the vehicles of the xlvask module'
]
);
$this->get('/modules/xlvask/customers', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/xlvask/customers');
global $response;
$this->requirePermission('modules_xlvask_customers');
$params = [
'customerId' => null,
'customerName' => null,
'customerExternalId' => null,
'vatNumber' => null,
'changeDate' => null,
'users' => null,
];
// Get the parameters from the request
foreach ( $params as $key => $value ) {
if ($this->isParametersSet([$key])) {
$params[$key] = $this->getParameter($key);
}
}
// Create the xlvask object
$xlvask = new xlvask();
$result = $xlvask->getCustomers(...$params);
// Response
$response->success($result, 200);
},
[
'modules_xlvask_customers' => 'Get the customers of the xlvask module'
]
);
$this->get('/modules/xlvask/internal/vehicle-types', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/xlvask/internal/vehicle-types');
global $response;
$this->requirePermission('modules_xlvask_internal_vehicle_types');
$user = (new authentication())->get_user();
$xlvask_vehicle_types = new \objects\xlvask_vehicle_types_o();
$result = $xlvask_vehicle_types->listObjectsWithPaginationIfSet(
function ($tmp_object_array) {
return [
...$tmp_object_array
];
}
);
// Response
$response->success($result, 200);
},
[
'modules_xlvask_internal_vehicle_types' => 'Get the vehicle types of the xlvask module'
]
);
$this->get('/modules/xlvask/related-orders', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/xlvask/related-orders');
global $response;
$this->requirePermission('modules_xlvask_related_orders');
self::requireParameters(['washIds']);
$washIds = self::getParameter('washIds');
// Check if the washIds is an array
self::requireType($washIds, self::TYPE_ARRAY());
// Require only strings in the array
foreach ( $washIds as $key => $value ) {
if (!is_string($value)) {
self::requireType($value, self::TYPE_STRING());
}
}
// Get all the related orders
$orders_o = new orders_o();
$mathing_orders = $orders_o->getFieldsWhere([
'wash_id' => $washIds,
'deleted_at' => null,
], [
'id',
'wash_id',
]);
$formatted_matches = [];
foreach ( $mathing_orders as $order ) {
$formatted_matches[(string)$order['wash_id']][] = (int)$order['id'];
}
$response->success($formatted_matches, 200);
},
[
'modules_xlvask_related_orders' => 'Get the related orders of the xlvask module'
]
);
$this->get('/modules/xlvask/tasks/sync-users', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/xlvask/tasks/sync-users');
global $response;
$this->requirePermission('modules_xlvask_sync_users');
// Create the xlvask tasks object
$xlvask = new xlvask();
// Run the sync users task
$result = $xlvask->getTasks()->runSyncUsers();
// Response
$response->success(
$result,
200
);
},
[
'modules_xlvask_sync_users' => 'Synchronize users with the xlvask module'
]
);
$this->get('/modules/xlvask/tasks/sync-usage', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/xlvask/tasks/sync-usage');
global $response;
$this->requirePermission('modules_xlvask_sync_usage');
// Create the xlvask tasks object
$xlvask = new xlvask();
// Run the sync usage task
$xlvask->getTasks()->runSyncUsage();
// Response
$response->success(
null,
200
);
},
[
'modules_xlvask_sync_usage' => 'Synchronize usage with the xlvask module'
]
);
$this->get('/modules/xlvask/tasks/import-customers', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/xlvask/tasks/import-customers');
global $response;
$this->requirePermission('modules_xlvask_import_customers');
// Create the xlvask_customers_o object
$xlvask_customers_o = new xlvask_customers_o();
$xlvask_customers_o->importCustomers();
$response->success(
'Customers imported',
200
);
},
[
'modules_xlvask_import_customers' => 'Import customers from the xlvask module'
]
);
$this->get('/modules/xlvask/tasks/import-vehicles', function () {
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/modules/xlvask/tasks/import-vehicles');
global $response;
$this->requirePermission('modules_xlvask_import_vehicles');
// Create the xlvask_vehicles_o object
$xlvask_vehicles_o = new \objects\xlvask_vehicles_o();
$xlvask_vehicles_o->importVehicles();
$response->success(
'Vehicles imported',
200
);
},
[
'modules_xlvask_import_vehicles' => 'Import vehicles from the xlvask module'
]
);
}
}