OpenClaw
51a87655d6
Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
94 lines
3.6 KiB
PHP
94 lines
3.6 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use objects\logs_o;
|
|
use objects\orders_o;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class userOrdersRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->get('/user/orders', function () {
|
|
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/user/orders');
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('list_own_orders');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Check if the request was successful
|
|
if ($user) {
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, $user->id, 'LIST_OWN_ORDERS', 'Successfully listed own orders');
|
|
// Return the list of the user's orders
|
|
$response->success(
|
|
(new orders_o())->getCustomerOrdersPaginated(
|
|
$user->customer_number->value(),
|
|
($this->fromRequest('page') ?? 1),
|
|
($this->fromRequest('limit') ?? 10),
|
|
['id' => 'DESC'],
|
|
$this->fromRequest('search') === null ? '' : $this->fromRequest('search'),
|
|
$this->fromRequest('filters') === null ? [] :
|
|
$response->parseFilters($this->fromRequest('filters')) ?? []
|
|
)
|
|
);
|
|
} else {
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, 0, 'LIST_OWN_ORDERS', 'No user found, or invalid session');
|
|
// Return an error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'list_own_orders' => 'List own orders'
|
|
]
|
|
);
|
|
|
|
$this->get('/user/order', function () {
|
|
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/user/order');
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('fetch_own_order');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Check if the request was successful
|
|
if ($user) {
|
|
// Check if the required fields are set
|
|
$data = $_GET;
|
|
if (!isset($data['id'])) {
|
|
$response->error('id parameter is required', 400);
|
|
}
|
|
// Make sure the user exists
|
|
if (!$user->exists()) {
|
|
$response->error('User not found', 400);
|
|
}
|
|
// Make sure the user is allowed to fetch the order
|
|
if (!$user->hasAccessToOrder($data['id'])) {
|
|
$response->error('You are not allowed to fetch this order', 400);
|
|
}
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, $user->id, 'FETCH_OWN_ORDER', 'Successfully fetched own order');
|
|
// Return the list of the user's orders
|
|
$response->success(
|
|
(new orders_o())->getOrderById($data['id'])->includeIncludes()->asArray()
|
|
);
|
|
} else {
|
|
// Log the incident
|
|
(new logs_o())->add('orders', 'global', 1, 0, 'FETCH_OWN_ORDER', 'No user found, or invalid session');
|
|
// Return an error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'fetch_own_order' => 'Fetch own order'
|
|
]
|
|
);
|
|
}
|
|
} |