Files
api/services/nginx/app/routes/customerDefaultDepartmentRoute.php
T
Jeppe B ab6c3ba5b6 Fix route permission instance calls (#344)
## Root cause

`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:

`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`

## Changes

- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.

## Verification

- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree

## Delivery state

Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
2026-08-04 16:04:41 +02:00

180 lines
9.6 KiB
PHP

<?php
namespace routes;
use classes\authentication;
use objects\customer_default_department_o;
use objects\departments_o;
use objects\logs_o;
use objects\users_o;
use traits\route_t;
class customerDefaultDepartmentRoute
{
use route_t;
public function run(): void
{
$this->get('/customer/department/default', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('get_customer_default_department');
$user = (new authentication())->get_user();
if (!$user) {
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_GET_DEFAULT_DEPARTMENT', 'User not logged in');
$response->error('Invalid session', 400);
}
// Require the customer number parameter
$customer_number = (int)$this->getCustomerNumberFromParameterOrUser($user);
// Check if the customer is its own customer number
if ($customer_number !== (int)$user->customer_number->value()) {
$this->requirePermission('get_customer_default_department_other');
}
// Check if the customer number exists
$customer = (new users_o())->getUserByCustomerNumber((int)$customer_number);
if (!$customer->exists()) {
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_GET_DEFAULT_DEPARTMENT', 'Customer not found');
$response->error('Customer not found', 400);
}
// Get the default department for the customer
$customer_default_department_o = new customer_default_department_o();
$default_department_object_id = $customer_default_department_o->getIdByCustomerNumber((int)$customer_number);
if (empty($default_department_object_id)) {
// Return "Not found"
$response->error('This customer does not have a default department', 400);
}
// Select the object
$customer_default_department_o->select((int)$default_department_object_id);
// Log the action
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_GET_DEFAULT_DEPARTMENT', 'Default department retrieved');
// Return success
$response->success($customer_default_department_o->asArray());
},
[
'get_customer_default_department' => 'Get the default department for a customer (for its both own and other customers, depending on the get_customer_default_department_other permission)',
'get_customer_default_department_other' => 'Get the default department for other customers',
]
);
$this->post('/customer/department/default', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('add_customer_default_department');
$user = (new authentication())->get_user();
if (!$user) {
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_ADD_DEFAULT_DEPARTMENT', 'User not logged in');
$response->error('Invalid session', 400);
}
// Require the customer number and department parameters
self::requireParameters(['department']);
// Require the customer number parameter
$customer_number = $this->getCustomerNumberFromParameterOrUser($user);
// Check if the customer is its own customer number
if ($customer_number !== (int)$user->customer_number->value()) {
$this->requirePermission('add_customer_default_department_other');
}
// Check if the department is valid
$department = (int)self::getParameter('department');
self::requireMinLength('department', 1);
self::requireMaxLength('department', 255);
self::requireType($department, self::type_int());
self::requireMinValue($department, 1);
// Check if the department actually exists
$departments_o = new departments_o();
$department_object = $departments_o->selectId((int)$department);
if (!$department_object->exists()) {
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_ADD_DEFAULT_DEPARTMENT', 'Department not found');
$response->error('Department not found', 400);
}
// Check if the customer number exists
$customer = (new users_o())->getUserByCustomerNumber((int)$customer_number);
if (!$customer->exists()) {
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_ADD_DEFAULT_DEPARTMENT', 'Customer not found');
$response->error('Customer not found', 400);
}
// Check if the customer already has a default department
$customer_default_department_o = new customer_default_department_o();
$default_department_object_id = $customer_default_department_o->getIdByCustomerNumber((int)$customer_number);
if (!empty($default_department_object_id)) {
// Return "Already exists"
$response->error('This customer already has a default department', 400);
}
// Add the default department
$customer_default_department_o->add((int)$customer_number, (int)$department);
// Log the action
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_ADD_DEFAULT_DEPARTMENT', 'Default department added');
// Return success
$response->success($customer_default_department_o->asArray());
},
[
'add_customer_default_department' => 'Add a default department for a customer (for its both own and other customers, depending on the add_customer_default_department_other permission)',
'add_customer_default_department_other' => 'Add a default department for other customers',
]
);
$this->delete('/customer/department/default', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('delete_customer_default_department');
$user = (new authentication())->get_user();
if (!$user) {
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_DELETE_DEFAULT_DEPARTMENT', 'User not logged in');
$response->error('Invalid session', 400);
}
// Require the customer number parameter
$customer_number = $this->getCustomerNumberFromParameterOrUser($user);
// Check if the customer is its own customer number
if ($customer_number !== (int)$user->customer_number->value()) {
$this->requirePermission('delete_customer_default_department_other');
}
// Check if the customer number exists
$customer = (new users_o())->getUserByCustomerNumber((int)$customer_number);
if (!$customer->exists()) {
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_DELETE_DEFAULT_DEPARTMENT', 'Customer not found');
$response->error('Customer not found', 400);
}
// Check if the customer already has a default department
$customer_default_department_o = new customer_default_department_o();
$default_department_object_id = $customer_default_department_o->getIdByCustomerNumber((int)$customer_number);
if (empty($default_department_object_id)) {
// Return "Not found"
$response->error('This customer does not have a default department', 400);
}
// Delete the default department
$customer_default_department_o->select((int)$default_department_object_id);
$customer_default_department_o->delete();
// Log the action
(new logs_o())->add('customer_default_department', 'global', 0, $user->id, 'CUSTOMER_DELETE_DEFAULT_DEPARTMENT', 'Default department deleted');
// Return success
$response->success('Default department deleted');
},
[
'delete_customer_default_department' => 'Delete a default department for a customer (for its both own and other customers, depending on the delete_customer_default_department_other permission)',
'delete_customer_default_department_other' => 'Delete a default department for other customers',
]
);
}
/**
* @param users_o|false $user
* @return int
*/
private function getCustomerNumberFromParameterOrUser(users_o|false $user): int
{
if (self::isParametersSet(['customer_number'])) {
self::requireParameters(['customer_number']);
// Check if the customer number is valid
$customer_number = (int)self::getParameter('customer_number');
self::requireMinLength('customer_number', 1);
self::requireMaxLength('customer_number', 255);
self::requireType($customer_number, self::type_int());
} else {
// If the customer number is not set, use the user's customer number
$customer_number = (int)$user->customer_number->value();
// Make sure the customer number is valid
}
self::requireMinValue($customer_number, 1);
return $customer_number;
}
}