Jepp9350
d28cb172a0
This update introduces explicit permission definitions for various route handlers across multiple routes. These changes enhance clarity and allow for more granular control over route access based on defined permissions. The updates ensure better manageability and scalability of endpoint permissions.
45 lines
1.6 KiB
PHP
45 lines
1.6 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use objects\logs_o;
|
|
use objects\users_o;
|
|
use traits\route_t;
|
|
|
|
class intimidateRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->post('/su/intimidate', function () {
|
|
// Get the post data
|
|
global $response;
|
|
// Make sure the user has the SUPERUSER_INTIMIDATE permission
|
|
if (!$this->requirePermission('SUPERUSER_INTIMIDATE')) {
|
|
$response->error('Permission denied', 403);
|
|
}
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Get the post data
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
// Check if the customer number, and password are set
|
|
if (!isset($data['user_id'])) {
|
|
$response->error('User id is required', 400);
|
|
}
|
|
// Get the user object
|
|
$intimidated_user = (new users_o())->getUserById($data['user_id']);
|
|
// Log the incident
|
|
(new logs_o())->add('auth', 'global', 1, $user->id, 'AUTH_SUCCESS_INTIMIDATE', 'Created intimidate token for customer: ' . $data['user_id']);
|
|
// If the credentials are valid, create a token (We're using the create_employee_token, since it's using user_id, and not customer_numbers.)
|
|
$token = (new authentication())->create_employee_token($data['user_id']);
|
|
// Return the token
|
|
$response->success(['token' => $token]);
|
|
},
|
|
[
|
|
'SUPERUSER_INTIMIDATE' => 'Intimidate a user'
|
|
]
|
|
);
|
|
}
|
|
} |