Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
184 lines
9.1 KiB
PHP
184 lines
9.1 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use objects\customer_vehicles_o;
|
|
use objects\logs_o;
|
|
use objects\orders_o;
|
|
use objects\plate_scans_o;
|
|
use objects\users_o;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class plateScansRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
|
|
$this->post('/numberplatescans', function () {
|
|
ScopeMiddleware::requireScope(Scope::CUSTOMER_WRITE, '/numberplatescans');
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePlateScannerAuth();
|
|
// Get the plate scanner object
|
|
$plate_scanner = (new authentication())->get_plate_scanner();
|
|
/**
|
|
* Define the optional request body parameters
|
|
* - plate: The license plate to scan (string, required)
|
|
* - bayId: The wash bay id (int, optional) - XLVASK lanes only
|
|
*/
|
|
$bayId = null;
|
|
// Validate the bayId if set
|
|
$bayIdParameterKey = 'bay_id';
|
|
if (self::isParametersSet([$bayIdParameterKey])) {
|
|
$bayId = self::getParameter($bayIdParameterKey);
|
|
self::requireType($bayId, self::type_string());
|
|
self::requireMinLength($bayIdParameterKey, 1);
|
|
self::requireMaxLength($bayIdParameterKey, 255);
|
|
}
|
|
// Get the post data
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
// Check if the required fields are set
|
|
if (!isset($data['plate'])) {
|
|
$response->error('Missing required body parameter plate', 400);
|
|
}
|
|
// Add the number plate scanner
|
|
(new plate_scans_o())->add($plate_scanner->id, $data['plate'], $bayId);
|
|
// Log the incident
|
|
(new logs_o())->add('numberplatescans', $plate_scanner->department_id->value(), 1, 0, 'ADD_NUMBER_PLATE_SCANS', 'Successfully added a number plate scan: ' . $data['plate']);
|
|
// Return a success message
|
|
$response->success(['message' => 'License plate scan recorded.', 'plate' => $data['plate'], 'scanner' => $plate_scanner->name->value(), 'bay_id' => $bayId], 201);
|
|
});
|
|
|
|
$this->post('/numberplatescans/department', function () {
|
|
ScopeMiddleware::requireScope(Scope::CUSTOMER_WRITE, '/numberplatescans/department');
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('list_number_plate_scans_department');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Check if the request was successful
|
|
if ($user) {
|
|
// Check if a department is set in the body
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
if (!isset($data['department_id'])) {
|
|
$response->error('Missing required body parameter department', 400);
|
|
}
|
|
$this->requirePermission('list_number_plate_scans_department_' . $data['department_id']);
|
|
// Check if the pagination parameters are set
|
|
if (!isset($data['page'])) {
|
|
$response->error('Missing required body parameter page', 400);
|
|
}
|
|
if (!isset($data['limit'])) {
|
|
$response->error('Missing required body parameter limit', 400);
|
|
}
|
|
// Get the number plate scans
|
|
$number_plate_scans = (new plate_scans_o())->getPlateScansByDepartment((int)$data['department_id'], (int)$data['page'], (int)$data['limit']);
|
|
// Log the incident
|
|
(new logs_o())->add('numberplatescans', $data['department_id'], 1, $user->id, 'LIST_NUMBER_PLATE_SCANS_DEPARTMENT', 'Successfully listed number plate scans for department: ' . $data['department_id']);
|
|
// Return the number plate scans
|
|
$response->success($number_plate_scans);
|
|
} else {
|
|
// Log the incident
|
|
(new logs_o())->add('numberplatescans', 'global', 1, 0, 'LIST_NUMBER_PLATE_SCANS_DEPARTMENT', 'No user found, or invalid session');
|
|
// Return an error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
}, [
|
|
'list_number_plate_scans_department' => 'List all number plate scans for a department'
|
|
]);
|
|
|
|
$this->get('/numberplatescans', function () {
|
|
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/numberplatescans');
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('list_number_plate_scans');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Check if the request was successful
|
|
if ($user) {
|
|
// Get the number plate scans
|
|
$number_plate_scans = (new plate_scans_o());
|
|
$result = $number_plate_scans->listObjectsWithPaginationIfSet(
|
|
function ($scan) {
|
|
$tmp_scan_seen_before = [
|
|
'seen_before' => (new orders_o())->isPlateSeenBefore((string)$scan['plate']),
|
|
];
|
|
$tmp_scan_customer = [
|
|
'barred' => false,
|
|
'customer_number' => null,
|
|
'customer_name' => null,
|
|
];
|
|
// Check if the vehicle is registered to a customer
|
|
$vehicle_customer_number = (new customer_vehicles_o())->getPlateCustomerNumber((string)$scan['plate']);
|
|
if ($vehicle_customer_number) {
|
|
// Get the vehicle details
|
|
$tmp_scan_vehicle = (new customer_vehicles_o())->selectByPlate((string)$scan['plate'])->asArray();
|
|
$tmp_scan_customer = [
|
|
'barred' => (new users_o())->isCustomerBarred($vehicle_customer_number),
|
|
'customer_number' => (int)$vehicle_customer_number,
|
|
'customer_name' => $tmp_scan_vehicle['customer_name'],
|
|
'type' => (int)$tmp_scan_vehicle['type'],
|
|
];
|
|
}
|
|
// Return the object as an array
|
|
return [
|
|
...$scan,
|
|
...$tmp_scan_customer,
|
|
...$tmp_scan_seen_before,
|
|
];
|
|
},
|
|
$number_plate_scans->forceRestrictFilters(
|
|
[
|
|
'department_id' => $this->effectiveDepartmentIds($user)
|
|
]
|
|
)
|
|
);
|
|
// Log the incident
|
|
(new logs_o())->add('numberplatescans', 'global', 1, $user->id, 'LIST_NUMBER_PLATE_SCANS', 'Successfully listed number plate scans');
|
|
// Return the number plate scans
|
|
$response->success($result);
|
|
} else {
|
|
// Log the incident
|
|
(new logs_o())->add('numberplatescans', 'global', 1, 0, 'LIST_NUMBER_PLATE_SCANS', 'No user found, or invalid session');
|
|
// Return an error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
}, [
|
|
'list_number_plate_scans' => 'List all number plate scans, provided the user has access to the department the number plate scan is in',
|
|
'department_access_:id' => 'Access to the department the number plate scan is in'
|
|
]);
|
|
|
|
self::get('/numberplatescans/post', function () {
|
|
/**
|
|
* This is here because the post method is not supported by the software some of the cameras are running on.
|
|
*/
|
|
global $response;
|
|
self::requirePlateScannerAuth();
|
|
$plate_scanner = (new authentication())->get_plate_scanner();
|
|
self::requireParameters(['plate', 'token']);
|
|
// Validate the plate
|
|
self::requireType('plate', 'string');
|
|
self::requireMinLength('plate', 1);
|
|
self::requireMaxLength('plate', 10);
|
|
// Validate the token
|
|
self::requireType('token', 'string');
|
|
self::requireMinLength('token', 1);
|
|
self::requireMaxLength('token', 100);
|
|
// Add the number plate scanner
|
|
(new plate_scans_o())->add($plate_scanner->id, self::getParameter('plate'));
|
|
// Log the incident
|
|
(new logs_o())->add('numberplatescans', $plate_scanner->department_id->value(), 1, 0, 'ADD_NUMBER_PLATE_SCANS', 'Successfully added a number plate scan: ' . self::getParameter('plate'));
|
|
// Return a success message
|
|
$response->success(['message' => 'License plate scan recorded.', 'plate' => self::getParameter('plate'), 'scanner' => $plate_scanner->name->value()], 201);
|
|
}, [
|
|
'add_number_plate_scan' => 'Add a number plate scan'
|
|
]);
|
|
}
|
|
}
|