OpenClaw
51a87655d6
Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
64 lines
1.9 KiB
PHP
64 lines
1.9 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\superuser_system_status_service;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class superuserSystemStatusRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->get('/superuser/system/status', function () {
|
|
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/superuser/system/status');
|
|
global $response;
|
|
|
|
$this->requirePermission('superuser_system_status_view');
|
|
$force = $this->toBool($this->getParameter('force'), false);
|
|
$snapshot = (new superuser_system_status_service())->getSnapshot($force);
|
|
$response->success($snapshot);
|
|
}, [
|
|
'superuser_system_status_view' => 'View the aggregated superuser system status snapshot',
|
|
]);
|
|
|
|
$this->get('/superuser/system/database/status', function () {
|
|
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/superuser/system/database/status');
|
|
global $response;
|
|
|
|
$this->requirePermission('superuser_system_status_view');
|
|
$snapshot = (new superuser_system_status_service())->getSnapshot(false);
|
|
$response->success([
|
|
'status' => $snapshot['dependencies']['database'] ?? null,
|
|
]);
|
|
}, [
|
|
'superuser_system_status_view' => 'View the aggregated superuser system status snapshot',
|
|
]);
|
|
}
|
|
|
|
private function toBool(mixed $value, bool $default): bool
|
|
{
|
|
if (is_bool($value)) {
|
|
return $value;
|
|
}
|
|
|
|
if ($value === null) {
|
|
return $default;
|
|
}
|
|
|
|
$normalized = strtolower(trim((string)$value));
|
|
if (in_array($normalized, ['1', 'true', 'yes', 'on'], true)) {
|
|
return true;
|
|
}
|
|
if (in_array($normalized, ['0', 'false', 'no', 'off'], true)) {
|
|
return false;
|
|
}
|
|
|
|
return $default;
|
|
}
|
|
}
|