## Root cause `route_t::hasPermission()` and `requirePermission()` are instance methods. Route code was invoking them with `self::`; the new XL Vask hall-scope helper made that call from a genuinely static context, causing PHP to throw: `Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot be called statically` ## Changes - Invoke route permission methods through `$this` across all 273 executable legacy calls in 45 route classes. - Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance helper and update all 13 callers. - Preserve the existing all-scope and own-scope hall selection rules. - Add a token-aware regression test that rejects executable `self::hasPermission()` and `self::requirePermission()` calls, while ignoring comments. - Add focused XL Vask tests for global scanner hall scope and group-limited own scope. - Update affected route contract assertions to the instance-call form. ## Verification - PHP lint: all 53 changed PHP files - Focused PHPStan: changed XL Vask route and both new regression tests — clean - Focused regression slice: 58 passed, 748 assertions - Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated existing warning, 1 environment skip) - Full local API suite: 285 passed, 11,704 assertions - Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API, integration, legacy, edge gateway, and supporting checks) - Independent exact-SHA QA gate: PASS, no findings - Independent exact-SHA security gate: PASS, no findings - Independent exact-SHA reviewer gate: PASS, no findings - Remote comparison: exactly one commit ahead of `40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes matched the reviewed worktree ## Delivery state Draft only for human review. No merge or deployment is included. Qodana is skipped while the PR remains draft and is therefore not represented as a passed gate.
188 lines
9.6 KiB
PHP
188 lines
9.6 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\response;
|
|
use classes\router;
|
|
use objects\department_notification_sms_o;
|
|
use objects\logs_o;
|
|
use traits\route_t;
|
|
|
|
class departmentNotificationSmsRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
global /** @var response $response */
|
|
/** @var router $router */
|
|
$router, $response;
|
|
|
|
|
|
/** Department Notification SMS -> Get */
|
|
$this->get('/department/notification/sms', function () {
|
|
global $response;
|
|
$this->requirePermission('department_notification_sms_get');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
$department_notification_sms = new department_notification_sms_o();
|
|
$result = $department_notification_sms->listObjectsWithPaginationIfSet(
|
|
function ($tmp_object_array) {
|
|
return [
|
|
'id' => (int)$tmp_object_array['id'],
|
|
'department' => (int)$tmp_object_array['department'],
|
|
'label' => (string)$tmp_object_array['label'],
|
|
'phone_country_code' => (int)$tmp_object_array['phone_country_code'],
|
|
'phone' => (int)$tmp_object_array['phone'],
|
|
'created_at' => (string)$tmp_object_array['created_at'],
|
|
'enabled' => (boolean)$tmp_object_array['enabled'],
|
|
];
|
|
},
|
|
$department_notification_sms->forceRestrictFilters(
|
|
[
|
|
// This makes sure that the user can only see orders from the departments they explicitly have access to
|
|
'department' => $user->getGroup()->getDepartments(),
|
|
]
|
|
)
|
|
);
|
|
(new logs_o())->add('department_notification_sms', 'global', 0, $user->id, 'DEPARTMENT_NOTIFICATION_SMS_GET', 'Get department notification SMS');
|
|
$response->success($result);
|
|
} else {
|
|
(new logs_o())->add('department_notification_sms', 'global', 0, 0, 'DEPARTMENT_NOTIFICATION_SMS_GET', 'Get department notification SMS failed');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'department_notification_sms_get' => 'List department notification SMS, in the departments the user has access to',
|
|
]
|
|
);
|
|
|
|
/** Department Notification SMS -> Add */
|
|
$this->post('/department/notification/sms', function () {
|
|
global $response;
|
|
$this->requirePermission('department_notification_sms_add');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
self::requireParameters([
|
|
'department',
|
|
'label',
|
|
'phone_country_code',
|
|
'phone',
|
|
]);
|
|
self::requireType(self::getParameter('department'), self::type_int());
|
|
self::requireMinValue((int)self::getParameter('department'), 1);
|
|
self::requireType(self::getParameter('label'), self::type_string());
|
|
self::requireType(self::getParameter('phone_country_code'), self::type_int());
|
|
self::requireMinValue((int)self::getParameter('phone_country_code'), 1);
|
|
self::requireType(self::getParameter('phone'), self::type_int());
|
|
self::requireMinValue((int)self::getParameter('phone'), 1);
|
|
$this->requirePermission('department_notification_sms_add');
|
|
self::requireDepartmentAccess((int)self::getParameter('department'));
|
|
|
|
$department_notification_sms = new department_notification_sms_o();
|
|
$department_notification_sms->add(
|
|
(int)self::getParameter('department'),
|
|
[
|
|
'label' => (string)self::getParameter('label'),
|
|
'phone_country_code' => (int)self::getParameter('phone_country_code'),
|
|
'phone' => (int)self::getParameter('phone'),
|
|
]
|
|
);
|
|
(new logs_o())->add('department_notification_sms', 'global', 0, $user->id, 'DEPARTMENT_NOTIFICATION_SMS_ADD', 'Add department notification SMS');
|
|
$response->success('Department notification SMS added');
|
|
} else {
|
|
(new logs_o())->add('department_notification_sms', 'global', 0, 0, 'DEPARTMENT_NOTIFICATION_SMS_ADD', 'Add department notification SMS failed');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'department_notification_sms_add' => 'Add a department notification SMS, in the departments the user has access to',
|
|
]
|
|
);
|
|
|
|
/** Department Notification SMS -> Update */
|
|
$this->put('/department/notification/sms', function () {
|
|
global $response;
|
|
$this->requirePermission('department_notification_sms_update');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
self::requireParameters([
|
|
'id',
|
|
]);
|
|
self::requireType(self::getParameter('id'), self::type_int());
|
|
self::requireMinValue((int)self::getParameter('id'), 1);
|
|
$data = [];
|
|
if (self::isParametersSet(['label'])) {
|
|
self::requireType(self::getParameter('label'), self::type_string());
|
|
$data['label'] = (string)self::getParameter('label');
|
|
}
|
|
if (self::isParametersSet(['phone_country_code'])) {
|
|
self::requireType(self::getParameter('phone_country_code'), self::type_int());
|
|
self::requireMinValue((int)self::getParameter('phone_country_code'), 1);
|
|
$data['phone_country_code'] = (int)self::getParameter('phone_country_code');
|
|
}
|
|
if (self::isParametersSet(['phone'])) {
|
|
self::requireType(self::getParameter('phone'), self::type_int());
|
|
self::requireMinValue((int)self::getParameter('phone'), 1);
|
|
$data['phone'] = (int)self::getParameter('phone');
|
|
}
|
|
if (self::isParametersSet(['enabled'])) {
|
|
self::requireType(self::getParameter('enabled'), self::type_bool());
|
|
$data['enabled'] = self::getParameter('enabled') ? 1 : 0;
|
|
}
|
|
$this->requirePermission('department_notification_sms_update');
|
|
$department_notification_sms = new department_notification_sms_o();
|
|
$department_notification_sms->select((int)self::getParameter('id'));
|
|
self::requireDepartmentAccess((int)$department_notification_sms->department->value());
|
|
if (empty($data)) {
|
|
$response->error('No data to update', 400);
|
|
}
|
|
$department_notification_sms->update(
|
|
[
|
|
...$data
|
|
]
|
|
);
|
|
(new logs_o())->add('department_notification_sms', 'global', 0, $user->id, 'DEPARTMENT_NOTIFICATION_SMS_UPDATE', 'Update department notification SMS');
|
|
$response->success('Department notification SMS updated');
|
|
} else {
|
|
(new logs_o())->add('department_notification_sms', 'global', 0, 0, 'DEPARTMENT_NOTIFICATION_SMS_UPDATE', 'Update department notification SMS failed');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'department_notification_sms_update' => 'Update a department notification SMS, in the departments the user has access to',
|
|
]
|
|
);
|
|
|
|
/** Department Notification SMS -> Delete */
|
|
$this->delete('/department/notification/sms', function () {
|
|
global $response;
|
|
$this->requirePermission('department_notification_sms_delete');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
self::requireParameters([
|
|
'id',
|
|
]);
|
|
self::requireType((int)self::getParameter('id'), self::type_int());
|
|
self::requireSameLength(self::getParameter('id'), (int)self::getParameter('id'));
|
|
self::requireMinValue((int)self::getParameter('id'), 1);
|
|
$this->requirePermission('department_notification_sms_delete');
|
|
$department_notification_sms = new department_notification_sms_o();
|
|
$department_notification_sms->select((int)self::getParameter('id'));
|
|
self::requireDepartmentAccess((int)$department_notification_sms->department->value());
|
|
$department_notification_sms->delete();
|
|
(new logs_o())->add('department_notification_sms', 'global', 0, $user->id, 'DEPARTMENT_NOTIFICATION_SMS_DELETE', 'Delete department notification SMS');
|
|
$response->success('Department notification SMS deleted');
|
|
} else {
|
|
(new logs_o())->add('department_notification_sms', 'global', 0, 0, 'DEPARTMENT_NOTIFICATION_SMS_DELETE', 'Delete department notification SMS failed');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'department_notification_sms_delete' => 'Delete a department notification SMS, in the departments the user has access to',
|
|
]
|
|
);
|
|
|
|
}
|
|
} |