Files
api/services/nginx/app/routes/moduleEconomicRoute.php
T
OpenClaw 51a87655d6 feat(auth): add scope-based access control to all existing routes (TRU-149)
Adds a scope-based access control layer to all 81 existing API routes.
Sits alongside existing session-cookie auth (does not replace it).

What this PR does:
- Audits every existing route and documents required scope per route
  (see documentation/auth/route-scope-audit.md)
- Adds classes/auth/scope.php with 10 scope constants and role→scope defaults
- Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole
- Applies require*() calls to all 81 existing routes
- Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines)

Coexistence note:
This branch's classes/auth/scope.php is a stub that will be replaced
by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that
PR merges first. The two have compatible APIs.

Refs: TRU-149
2026-08-17 11:43:13 +00:00

145 lines
6.0 KiB
PHP

<?php
namespace routes;
use classes\authentication;
use classes\economic;
use classes\response;
use classes\router;
use objects\departments_o;
use objects\logs_o;
use objects\users_o;
use traits\route_t;
use app\auth\Scope;
use app\auth\ScopeMiddleware;
class moduleEconomicRoute
{
use route_t;
public function run(): void
{
global /** @var response $response */
/** @var router $router */
$router, $response;
/** Economic > Customers > Import customer */
$this->post('/economic/customers/import', function () {
ScopeMiddleware::requireScope(Scope::INVOICE_WRITE, '/economic/customers/import');
global $response;
$this->requirePermission('economic_import_customer');
$user = (new authentication())->get_user();
if ($user) {
// Check if the customer number is set
self::requireParameters(['customer_number']);
self::requireType(self::getParameter('customer_number'), self::TYPE_INT());
$users_o = new users_o();
// Check if the customer is already imported
$isCustomerImported = $users_o->isImportedFromEconomic(self::getParameter('customer_number'));
if ($isCustomerImported) {
$response->error('Customer already imported', 400);
}
// Check if the customer exists in the economic system
$economic = new economic();
$doesCustomerExists = $economic->customers->customers->exists(self::getParameter('customer_number'));
if (!$doesCustomerExists) {
$response->error('Customer does not exist', 400);
}
// Import the customer
$customer = $users_o->getUserByCustomerNumber(self::getParameter('customer_number'));
// Make sure the user returned is valid
if (!$customer->exists()) {
$response->error('Unable to import customer', 400);
}
(new logs_o())->add('economic', 'global', 1, $user->id, 'ECONOMIC_IMPORT_CUSTOMER', 'Successfully imported customer');
$response->success(
$customer->asArray()
);
} else {
(new logs_o())->add('economic', 'global', 1, 0, 'ECONOMIC_IMPORT_CUSTOMER', 'No user found, or invalid session');
$response->error('Invalid session', 400);
}
},
[
'economic_import_customer' => 'Import customer from economic'
]
);
/** Economic > Departments > GET */
self::get('/economic/departments', function () {
// Require permission
global /** @var response $response */
$response;
$this->requirePermission('economic_departments_get');
// Get the user
$user = (new authentication())->get_user();
// Check if the user is valid
if ($user->exists()) {
// Get the departments
$economic = new economic();
$departments = $economic->departments->departments->get()->collection;
$departments_o = new departments_o();
// Parse the departments
$departments = array_map(function ($department) use ($departments_o) {
return [
'id' => $department->departmentNumber, // The department number is the ID in this case, this is added for consistency with the rest of the system. - Making it easier to use the department number as the ID, when selecting a department to link (FE).
'name' => $department->name,
'departmentNumber' => $department->departmentNumber
];
}, $departments);
// Return the departments
$response->success($departments);
} else {
// Log the error
(new logs_o())->add('economic', 'global', 1, 0, 'ECONOMIC_DEPARTMENTS', 'No user found, or invalid session');
// Return the error
$response->error('Invalid session', 400);
}
},
[
'economic_departments_get' => 'Get departments from economic'
]
);
/** Economic > Products > GET */
self::get('/economic/products', function () {
// Require permission
global /** @var response $response */
$response;
$this->requirePermission('economic_products_get');
// Get the user
$user = (new authentication())->get_user();
// Check if the user is valid
if ($user->exists()) {
// Get the products
$economic = new economic();
$products = $economic->products->products->get([], [
'skipPages' => 0,
'pageSize' => 1000, // Since the limit is 1000, we need to set the page size to 1000.
])->collection;
// Parse the products
$products = array_map(function ($product) {
return [
'id' => (int)$product->productNumber,
'name' => $product->name . ' (' . $product->productNumber . ')',
'price' => (int)($product->salesPrice ?? 0),
'productNumber' => (int)$product->productNumber
];
}, $products);
// Return the products
$response->success($products);
} else {
// Log the error
(new logs_o())->add('economic', 'global', 1, 0, 'ECONOMIC_PRODUCTS', 'No user found, or invalid session');
// Return the error
$response->error('Invalid session', 400);
}
},
[
'economic_products_get' => 'Get products from economic'
]
);
}
}