Files
api/services/nginx/app/routes/pdfGeneratorRoute.php
T
OpenClaw 51a87655d6 feat(auth): add scope-based access control to all existing routes (TRU-149)
Adds a scope-based access control layer to all 81 existing API routes.
Sits alongside existing session-cookie auth (does not replace it).

What this PR does:
- Audits every existing route and documents required scope per route
  (see documentation/auth/route-scope-audit.md)
- Adds classes/auth/scope.php with 10 scope constants and role→scope defaults
- Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole
- Applies require*() calls to all 81 existing routes
- Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines)

Coexistence note:
This branch's classes/auth/scope.php is a stub that will be replaced
by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that
PR merges first. The two have compatible APIs.

Refs: TRU-149
2026-08-17 11:43:13 +00:00

163 lines
7.2 KiB
PHP

<?php
namespace routes;
use classes\pdf_generator;
use classes\pdf_store;
use classes\response;
use classes\router;
use traits\route_t;
use app\auth\Scope;
use app\auth\ScopeMiddleware;
class pdfGeneratorRoute
{
use route_t;
public function run(): void
{
global /** @var response $response */
/** @var router $router */
$router, $response;
/** PDF Generator > GET */
$this->get('/modules/pdf-generator/test', function () {
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/modules/pdf-generator/test');
global $response;
// Check if the required parameters are present
self::requireParameters([
'id',
]);
$id = (int)self::getParameter('id');
self::requireType($id, self::type_int());
self::requireMinValue($id, 1);
// Check if the operator is set
if (self::isParametersSet(['operator'])) {
self::requireParameters([
'operator',
]);
$operator = self::getParameter('operator');
self::requireType($operator, self::type_string());
self::requireMinLength('operator', 1);
}
// Check if the safety seal / plom number is set
if (self::isParametersSet(['safety_seal'])) {
self::requireParameters([
'safety_seal',
]);
$safety_seal = (int)self::getParameter('safety_seal');
self::requireType($safety_seal, self::type_int());
self::requireMinValue($safety_seal, 1);
}
//(new logs_o())->add('orderInvoices', 'global', 1, $user->id, 'LIST_COLLECTED_INVOICES', 'User accessed the list of collected order invoices');
// Get the booking from its ID
$id = 477;
$booking = (new \objects\bookings_o())->select($id);
if (!$booking->exists()) {
$response->error('Booking not found', 404);
}
// Get the department from the booking
$department = (new \objects\departments_o())->select((int)$booking->department->value());
if (!$department->exists()) {
$response->error('Department not found', 404);
}
// Get the branding from the department
$branding = (new \objects\branding_o())->select((int)$department->branding->value());
if (!$branding->exists()) {
$response->error('Branding not found', 404);
}
// Get the customer from the booking
$customer = (new \objects\users_o())->getUserByCustomerNumber((int)$booking->customer_number->value());
$department_array = $department->asArray();
$customer_array = $customer->asArray();
$booking_array = $booking->asArray();
$department_array['branding'] = $branding->asArray();
//print_r($department_array);
//print_r($customer_array);
//print_r($booking_array);
$pdf_generator = new pdf_generator();
$pdf_generator->add_html($pdf_generator->templates->getTemplate('wash_certificate')
->setCompany([
'name' => 'Truck Wash',
'address' => 'Letland Allé 2',
'zip' => 2630,
'city' => 'Taastrup',
'phone_prefix' => 45,
'phone' => 43717886,
'email' => 'cph@truckwash.dk',
'website' => 'www.truckwash.dk',
'images' => [
'logo' => '/truckwash-banner-png.png',
'banner' => '/truckwash-banner-png.png',
'signature' => '/truckwash-underskrift.png',
],
])
->addData([
'booking_number' => $booking->id,
'seal_number' => ($safety_seal ?? null),
'reg_1' => $booking_array['regNrTraekker'],
'reg_2' => $booking_array['regNrTrailer'],
'date' => $booking_array['date'],
'time' => date('H:i'),
'carried_out_by' => ($operator ?? null),
'department_id' => $department->id,
'department_name' => $department_array['branding']['name'] ?: $department_array['name'],
'department_address' => $department_array['branding']['address'] ?: $department_array['description'],
'customer_name' => $customer->getCustomerName($customer_array['customer_number']),
'customer_address' => $customer->getCustomerEcocomicData($customer_array['customer_number'])->economic_customer->address ?: '-',
'type' => $booking_array['wash_type'],
])
->getHtml()
);
$pdf_path = $pdf_generator->generate_pdf();
// Set the PDF in the booking
$booking->wash_certificate_pdf->set($pdf_path);
$response->success([
'pdf_path' => $pdf_path,
'message' => 'PDF generated successfully',
'link' => (new pdf_store())->getPresignedUrl(
$pdf_path
),
]);
},
[
'list_collected_invoices' => 'List ALL collected order invoices. This is a superuser-only route.'
]
);
$this->get('/modules/pdf-generator/material/order', function () {
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/modules/pdf-generator/material/order');
self::requireParameters([
'id'
]);
global $response;
// Generate the PDF
$pdf_generator = new pdf_generator();
$html = $pdf_generator->add_html($pdf_generator->templates->getTemplate('material_transaction')
->addData([
'reg_1' => "AB12345",
'reg_2' => "CD67890",
'seal_number' => '123456',
'date' => '2023-10-01',
'time' => '12:00',
'carried_out_by' => 'John Doe',
'department_id' => 1,
'customer_name' => 'Customer Name',
'reference' => 'Reference Number',
'notes' => 'Some notes here',
])->getHtml());
$pdf_path = $pdf_generator->generate_pdf();
$pdf_storage = new pdf_store();
$response->success([
'pdf_path' => $pdf_path,
'link' => $pdf_storage->getPresignedUrl(
$pdf_path
),
'message' => 'PDF generated successfully'
]);
});
}
}