Jeppe B
ab6c3ba5b6
## Root cause `route_t::hasPermission()` and `requirePermission()` are instance methods. Route code was invoking them with `self::`; the new XL Vask hall-scope helper made that call from a genuinely static context, causing PHP to throw: `Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot be called statically` ## Changes - Invoke route permission methods through `$this` across all 273 executable legacy calls in 45 route classes. - Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance helper and update all 13 callers. - Preserve the existing all-scope and own-scope hall selection rules. - Add a token-aware regression test that rejects executable `self::hasPermission()` and `self::requirePermission()` calls, while ignoring comments. - Add focused XL Vask tests for global scanner hall scope and group-limited own scope. - Update affected route contract assertions to the instance-call form. ## Verification - PHP lint: all 53 changed PHP files - Focused PHPStan: changed XL Vask route and both new regression tests — clean - Focused regression slice: 58 passed, 748 assertions - Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated existing warning, 1 environment skip) - Full local API suite: 285 passed, 11,704 assertions - Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API, integration, legacy, edge gateway, and supporting checks) - Independent exact-SHA QA gate: PASS, no findings - Independent exact-SHA security gate: PASS, no findings - Independent exact-SHA reviewer gate: PASS, no findings - Remote comparison: exactly one commit ahead of `40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes matched the reviewed worktree ## Delivery state Draft only for human review. No merge or deployment is included. Qodana is skipped while the PR remains draft and is therefore not represented as a passed gate.
303 lines
14 KiB
PHP
303 lines
14 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\response;
|
|
use classes\router;
|
|
use classes\stripe;
|
|
use objects\departments_o;
|
|
use objects\logs_o;
|
|
use objects\orders_o;
|
|
use traits\route_t;
|
|
|
|
class moduleStripeRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
global /** @var response $response */
|
|
/** @var router $router */
|
|
$router, $response;
|
|
|
|
|
|
/** Modules > Stripe > Customers > List */
|
|
$this->get('/modules/stripe/customers', function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_customers_list');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
(new logs_o())->add('modules_stripe', 'global', 1, 0, 'MODULES_STRIPE', 'User accessed the customers list');
|
|
$result = (new stripe())->customers->list();
|
|
$response->success((object)$result);
|
|
} else {
|
|
(new logs_o())->add('modules_stripe', 'global', 0, 0, 'MODULES_STRIPE', 'User tried to access the customers list without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_stripe_customers_list' => 'List all customers'
|
|
]
|
|
);
|
|
|
|
/** Modules > Stripe > Products > List */
|
|
$this->get('/modules/stripe/products', function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_products_list');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
(new logs_o())->add('modules_stripe', 'global', 1, 0, 'MODULES_STRIPE', 'User accessed the products list');
|
|
$result = (new stripe())->product->list();
|
|
$response->success((object)$result);
|
|
} else {
|
|
(new logs_o())->add('modules_stripe', 'global', 0, 0, 'MODULES_STRIPE', 'User tried to access the products list without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_stripe_products_list' => 'List all products'
|
|
]
|
|
);
|
|
|
|
/** Modules > Stripe > Prices > List */
|
|
$this->get('/modules/stripe/prices', function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_prices_list');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
(new logs_o())->add('modules_stripe', 'global', 1, 0, 'MODULES_STRIPE', 'User accessed the prices list');
|
|
$result = (new stripe())->prices->list();
|
|
$response->success((object)$result);
|
|
} else {
|
|
(new logs_o())->add('modules_stripe', 'global', 0, 0, 'MODULES_STRIPE', 'User tried to access the prices list without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_stripe_prices_list' => 'List all prices'
|
|
]
|
|
);
|
|
|
|
/** Modules > Stripe > Retired direct payment-link creation */
|
|
$this->post('/modules/stripe/invoice', function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_invoice_send');
|
|
$response->error([
|
|
'message' => 'Direct Stripe payment links by email are no longer available. Use card payment instead.',
|
|
'code' => 'stripe_email_payment_disabled',
|
|
], 410);
|
|
},
|
|
[
|
|
'modules_stripe_invoice_send' => 'Manage legacy Stripe invoices'
|
|
]
|
|
);
|
|
|
|
/** Modules > Stripe > Cancel Invoice */
|
|
$this->delete('/modules/stripe/invoice', function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_invoice_send');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('modules_stripe', 'global', 0, 0, 'MODULES_STRIPE', 'User tried to cancel a Stripe invoice without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
|
|
self::requireParameters(['order_id']);
|
|
self::requireType((int)self::fromRequest('order_id'), self::TYPE_INT());
|
|
self::requireMinLength('order_id', 1);
|
|
self::requireMaxLength('order_id', 255);
|
|
|
|
$order = (new orders_o())->select((int)self::fromRequest('order_id'));
|
|
$order->requireSelected();
|
|
$this->requireLimitedBackofficeDepartmentAccess(
|
|
$user,
|
|
(int)$order->department_id->value()
|
|
);
|
|
|
|
if (!$order->stripe_module_orders->exists()) {
|
|
$response->success([
|
|
'stripeModuleOrders' => [],
|
|
]);
|
|
}
|
|
|
|
$invoice = $order->stripe_module_orders->retrievePaymentLink();
|
|
if ((bool)($invoice->paid ?? false) === true) {
|
|
$response->error([
|
|
'message' => 'A paid Stripe payment link cannot be cancelled.',
|
|
'code' => 'stripe_invoice_paid',
|
|
'stripeModuleOrders' => $order->stripe_module_orders->asArray(),
|
|
], 409);
|
|
}
|
|
|
|
$invoiceStatus = (string)($invoice->status ?? '');
|
|
if ($invoiceStatus !== 'void' && $invoiceStatus !== 'uncollectible' && $invoiceStatus !== 'deleted') {
|
|
(new stripe())->invoice->void((string)$order->stripe_module_orders->invoice_id->value());
|
|
}
|
|
|
|
$order->clearStripeInvoicing();
|
|
(new logs_o())->add('modules_stripe', 'global', 1, $user->id, 'MODULES_STRIPE', 'User cancelled a Stripe invoice');
|
|
|
|
$response->success([
|
|
'stripeModuleOrders' => [],
|
|
]);
|
|
},
|
|
[
|
|
'modules_stripe_invoice_send' => 'Send invoice'
|
|
]
|
|
);
|
|
|
|
self::get('/modules/stripe/terminal/readers', function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_terminal_readers_list');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
(new logs_o())->add('modules_stripe', 'global', 1, 0, 'MODULES_STRIPE', 'User accessed the readers list');
|
|
$result = (new stripe())->readers->list();
|
|
$response->success((object)$result);
|
|
} else {
|
|
(new logs_o())->add('modules_stripe', 'global', 0, 0, 'MODULES_STRIPE', 'User tried to access the readers list without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_stripe_terminal_readers_list' => 'List all Stripe terminal readers'
|
|
]
|
|
);
|
|
|
|
self::get('/modules/stripe/terminal/locations', function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_terminal_locations_list');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
(new logs_o())->add('modules_stripe', 'global', 1, 0, 'MODULES_STRIPE', 'User accessed the terminal locations list');
|
|
$result = (new stripe())->readers->listLocations();
|
|
$response->success((object)$result);
|
|
} else {
|
|
(new logs_o())->add('modules_stripe', 'global', 0, 0, 'MODULES_STRIPE', 'User tried to access the terminal locations list without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_stripe_terminal_locations_list' => 'List all Stripe terminal locations'
|
|
]
|
|
);
|
|
|
|
self::get('/modules/stripe/department/terminal/location',
|
|
function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_department_terminal_location_list');
|
|
self::requireParameters(['id']);
|
|
self::requireType((int)self::fromRequest('id'), self::TYPE_INT());
|
|
// Require the id to be above 0
|
|
if ((int)self::fromRequest('id') < 1) {
|
|
$response->error('Invalid department ID', 400);
|
|
}
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
// Make sure the user has access to the department
|
|
self::requireDepartmentAccess((int)self::fromRequest('id'));
|
|
// Make sure the department exists
|
|
$department = (new departments_o())->select((int)self::fromRequest('id'));
|
|
$department->requireSelected();
|
|
(new logs_o())->add('modules_stripe', 'global', 1, 0, 'MODULES_STRIPE', 'User accessed the department terminal location');
|
|
// Get the department terminal location
|
|
$isSet = $department->isStripeTerminalLocationSet();
|
|
// Return the result if the department terminal location is set, otherwise return null
|
|
$response->success([
|
|
'id' => (
|
|
$isSet
|
|
? $department->getStripeTerminalLocation()
|
|
: null
|
|
)
|
|
]);
|
|
} else {
|
|
(new logs_o())->add('modules_stripe', 'global', 0, 0, 'MODULES_STRIPE', 'User tried to access the department terminal location without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_stripe_department_terminal_location_list' => 'List all department terminal location',
|
|
'department_access_:id' => 'Access department. - :id'
|
|
]
|
|
);
|
|
|
|
self::post('/modules/stripe/department/terminal/location',
|
|
function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_department_terminal_location_set');
|
|
self::requireParameters(['id', 'location']);
|
|
self::requireType((int)self::fromRequest('id'), self::TYPE_INT());
|
|
self::requireType((string)self::fromRequest('location'), 'string');
|
|
self::requireMinLength('location', 1);
|
|
self::requireMaxLength('location', 255);
|
|
// Require the id to be above 0
|
|
if ((int)self::fromRequest('id') < 1) {
|
|
$response->error('Invalid department ID', 400);
|
|
}
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
// Make sure the user has access to the department
|
|
self::requireDepartmentAccess((int)self::fromRequest('id'));
|
|
// Make sure the department exists
|
|
$department = (new departments_o())->select((int)self::fromRequest('id'));
|
|
$department->requireSelected();
|
|
(new logs_o())->add('modules_stripe', 'global', 1, 0, 'MODULES_STRIPE', 'User set the department terminal location');
|
|
// Set the department terminal location
|
|
$department->setStripeTerminalLocation((string)self::fromRequest('location'));
|
|
// Return the result
|
|
$response->success([
|
|
'id' => $department->getStripeTerminalLocation()
|
|
]);
|
|
} else {
|
|
(new logs_o())->add('modules_stripe', 'global', 0, 0, 'MODULES_STRIPE', 'User tried to set the department terminal location without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_stripe_department_terminal_location_set' => 'Set department terminal location',
|
|
'department_access_:id' => 'Access department. - :id'
|
|
]
|
|
);
|
|
|
|
self::get('/modules/stripe/department/terminal/readers',
|
|
function () {
|
|
global $response;
|
|
$this->requirePermission('modules_stripe_department_terminal_readers_list');
|
|
self::requireParameters(['id']);
|
|
self::requireType((int)self::fromRequest('id'), self::TYPE_INT());
|
|
// Require the id to be above 0
|
|
if ((int)self::fromRequest('id') < 1) {
|
|
$response->error('Invalid department ID', 400);
|
|
}
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
// Make sure the user has access to the department
|
|
self::requireDepartmentAccess((int)self::fromRequest('id'));
|
|
// Make sure the department exists
|
|
$department = (new departments_o())->select((int)self::fromRequest('id'));
|
|
$department->requireSelected();
|
|
(new logs_o())->add('modules_stripe', 'global', 1, 0, 'MODULES_STRIPE', 'User accessed the department terminal readers');
|
|
if (!$department->isStripeTerminalLocationSet()) {
|
|
$response->error([
|
|
'message' => 'Card payments are not ready for this department. Open Stripe setup and choose a terminal location.',
|
|
'code' => 'stripe_terminal_setup_required',
|
|
], 409);
|
|
}
|
|
// Get the department terminal readers
|
|
$readers = $department->getStripeTerminalReaders();
|
|
// Return the result
|
|
$response->success($readers);
|
|
} else {
|
|
(new logs_o())->add('modules_stripe', 'global', 0, 0, 'MODULES_STRIPE', 'User tried to access the department terminal readers without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_stripe_department_terminal_readers_list' => 'List all department terminal readers',
|
|
'department_access_:id' => 'Access department. - :id'
|
|
]
|
|
);
|
|
}
|
|
}
|