Files
api/services/nginx/app/routes/moduleWorkfeedRoute.php
T
Jeppe B ab6c3ba5b6 Fix route permission instance calls (#344)
## Root cause

`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:

`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`

## Changes

- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.

## Verification

- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree

## Delivery state

Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
2026-08-04 16:04:41 +02:00

141 lines
5.2 KiB
PHP

<?php
namespace routes;
use classes\authentication;
use classes\response;
use classes\router;
use classes\workfeed;
use objects\logs_o;
use traits\route_t;
class moduleWorkfeedRoute
{
use route_t;
public function run(): void
{
global /** @var response $response */
/** @var router $router */
$router, $response;
$this->get('/modules/workfeed/employees', function () {
global $response;
$this->requirePermission('modules_workfeed_employees_view');
$user = (new authentication())->get_user();
if (!$user) {
$response->error('Invalid session', 400);
}
$result = (new workfeed())->listEmployees();
(new logs_o())->add('modules_workfeed', 'global', 1, $user->id, 'MODULES_WORKFEED_EMPLOYEES_LIST', 'Listed Workfeed employees');
$response->success($result, 200);
}, [
'modules_workfeed_employees_view' => 'List Workfeed employees',
]);
$this->get('/modules/workfeed/employees/{id}', function () {
global $response;
$this->requirePermission('modules_workfeed_employees_view');
$user = (new authentication())->get_user();
if (!$user) {
$response->error('Invalid session', 400);
}
$result = (new workfeed())->getEmployee((string)$this->fromRoute('id'));
(new logs_o())->add('modules_workfeed', 'global', 1, $user->id, 'MODULES_WORKFEED_EMPLOYEE_GET', 'Fetched Workfeed employee');
$response->success($result, 200);
}, [
'modules_workfeed_employees_view' => 'Get a specific Workfeed employee',
]);
$this->get('/modules/workfeed/shifts', function () {
global $response;
$this->requirePermission('modules_workfeed_shifts_view');
$user = (new authentication())->get_user();
if (!$user) {
$response->error('Invalid session', 400);
}
$filters = $this->filterRequestParameters($_GET, [
'startFrom',
'startTo',
'from',
'to',
'employeeID',
'employeeId',
'released',
]);
if (!isset($filters['startFrom']) && isset($filters['from'])) {
$filters['startFrom'] = $filters['from'];
}
if (!isset($filters['startTo']) && isset($filters['to'])) {
$filters['startTo'] = $filters['to'];
}
if (!isset($filters['employeeID']) && isset($filters['employeeId'])) {
$filters['employeeID'] = $filters['employeeId'];
}
unset($filters['from'], $filters['to'], $filters['employeeId']);
if (!isset($filters['startFrom']) || trim((string)$filters['startFrom']) === '') {
$response->error('Missing required query parameter: startFrom', 400);
}
if (!isset($filters['startTo']) || trim((string)$filters['startTo']) === '') {
$response->error('Missing required query parameter: startTo', 400);
}
$result = (new workfeed())->listShifts($filters);
(new logs_o())->add('modules_workfeed', 'global', 1, $user->id, 'MODULES_WORKFEED_SHIFTS_LIST', 'Listed Workfeed shifts');
$response->success($result, 200);
}, [
'modules_workfeed_shifts_view' => 'List Workfeed shifts',
]);
$this->get('/modules/workfeed/shifts/{id}', function () {
global $response;
$this->requirePermission('modules_workfeed_shifts_view');
$user = (new authentication())->get_user();
if (!$user) {
$response->error('Invalid session', 400);
}
$result = (new workfeed())->getShift((string)$this->fromRoute('id'));
(new logs_o())->add('modules_workfeed', 'global', 1, $user->id, 'MODULES_WORKFEED_SHIFT_GET', 'Fetched Workfeed shift');
$response->success($result, 200);
}, [
'modules_workfeed_shifts_view' => 'Get a specific Workfeed shift',
]);
$this->get('/modules/workfeed/departments', function () {
global $response;
$this->requirePermission('modules_workfeed_departments_view');
$user = (new authentication())->get_user();
if (!$user) {
$response->error('Invalid session', 400);
}
$result = (new workfeed())->listDepartments();
(new logs_o())->add('modules_workfeed', 'global', 1, $user->id, 'MODULES_WORKFEED_DEPARTMENTS_LIST', 'Listed Workfeed departments');
$response->success($result, 200);
}, [
'modules_workfeed_departments_view' => 'List Workfeed departments',
]);
}
private function filterRequestParameters(array $parameters, array $allowedKeys): array
{
$allowed = array_flip($allowedKeys);
$filtered = [];
foreach ($parameters as $key => $value) {
if (isset($allowed[$key]) && $value !== '' && $value !== null) {
$filtered[$key] = $value;
}
}
return $filtered;
}
}