Files
api/services/nginx/app/routes/departmentNotificationSmsRoute.php
T
Jeppe B ab6c3ba5b6 Fix route permission instance calls (#344)
## Root cause

`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:

`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`

## Changes

- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.

## Verification

- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree

## Delivery state

Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
2026-08-04 16:04:41 +02:00

188 lines
9.6 KiB
PHP

<?php
namespace routes;
use classes\authentication;
use classes\response;
use classes\router;
use objects\department_notification_sms_o;
use objects\logs_o;
use traits\route_t;
class departmentNotificationSmsRoute
{
use route_t;
public function run(): void
{
global /** @var response $response */
/** @var router $router */
$router, $response;
/** Department Notification SMS -> Get */
$this->get('/department/notification/sms', function () {
global $response;
$this->requirePermission('department_notification_sms_get');
$user = (new authentication())->get_user();
if ($user) {
$department_notification_sms = new department_notification_sms_o();
$result = $department_notification_sms->listObjectsWithPaginationIfSet(
function ($tmp_object_array) {
return [
'id' => (int)$tmp_object_array['id'],
'department' => (int)$tmp_object_array['department'],
'label' => (string)$tmp_object_array['label'],
'phone_country_code' => (int)$tmp_object_array['phone_country_code'],
'phone' => (int)$tmp_object_array['phone'],
'created_at' => (string)$tmp_object_array['created_at'],
'enabled' => (boolean)$tmp_object_array['enabled'],
];
},
$department_notification_sms->forceRestrictFilters(
[
// This makes sure that the user can only see orders from the departments they explicitly have access to
'department' => $user->getGroup()->getDepartments(),
]
)
);
(new logs_o())->add('department_notification_sms', 'global', 0, $user->id, 'DEPARTMENT_NOTIFICATION_SMS_GET', 'Get department notification SMS');
$response->success($result);
} else {
(new logs_o())->add('department_notification_sms', 'global', 0, 0, 'DEPARTMENT_NOTIFICATION_SMS_GET', 'Get department notification SMS failed');
$response->error('Invalid session', 400);
}
},
[
'department_notification_sms_get' => 'List department notification SMS, in the departments the user has access to',
]
);
/** Department Notification SMS -> Add */
$this->post('/department/notification/sms', function () {
global $response;
$this->requirePermission('department_notification_sms_add');
$user = (new authentication())->get_user();
if ($user) {
self::requireParameters([
'department',
'label',
'phone_country_code',
'phone',
]);
self::requireType(self::getParameter('department'), self::type_int());
self::requireMinValue((int)self::getParameter('department'), 1);
self::requireType(self::getParameter('label'), self::type_string());
self::requireType(self::getParameter('phone_country_code'), self::type_int());
self::requireMinValue((int)self::getParameter('phone_country_code'), 1);
self::requireType(self::getParameter('phone'), self::type_int());
self::requireMinValue((int)self::getParameter('phone'), 1);
$this->requirePermission('department_notification_sms_add');
self::requireDepartmentAccess((int)self::getParameter('department'));
$department_notification_sms = new department_notification_sms_o();
$department_notification_sms->add(
(int)self::getParameter('department'),
[
'label' => (string)self::getParameter('label'),
'phone_country_code' => (int)self::getParameter('phone_country_code'),
'phone' => (int)self::getParameter('phone'),
]
);
(new logs_o())->add('department_notification_sms', 'global', 0, $user->id, 'DEPARTMENT_NOTIFICATION_SMS_ADD', 'Add department notification SMS');
$response->success('Department notification SMS added');
} else {
(new logs_o())->add('department_notification_sms', 'global', 0, 0, 'DEPARTMENT_NOTIFICATION_SMS_ADD', 'Add department notification SMS failed');
$response->error('Invalid session', 400);
}
},
[
'department_notification_sms_add' => 'Add a department notification SMS, in the departments the user has access to',
]
);
/** Department Notification SMS -> Update */
$this->put('/department/notification/sms', function () {
global $response;
$this->requirePermission('department_notification_sms_update');
$user = (new authentication())->get_user();
if ($user) {
self::requireParameters([
'id',
]);
self::requireType(self::getParameter('id'), self::type_int());
self::requireMinValue((int)self::getParameter('id'), 1);
$data = [];
if (self::isParametersSet(['label'])) {
self::requireType(self::getParameter('label'), self::type_string());
$data['label'] = (string)self::getParameter('label');
}
if (self::isParametersSet(['phone_country_code'])) {
self::requireType(self::getParameter('phone_country_code'), self::type_int());
self::requireMinValue((int)self::getParameter('phone_country_code'), 1);
$data['phone_country_code'] = (int)self::getParameter('phone_country_code');
}
if (self::isParametersSet(['phone'])) {
self::requireType(self::getParameter('phone'), self::type_int());
self::requireMinValue((int)self::getParameter('phone'), 1);
$data['phone'] = (int)self::getParameter('phone');
}
if (self::isParametersSet(['enabled'])) {
self::requireType(self::getParameter('enabled'), self::type_bool());
$data['enabled'] = self::getParameter('enabled') ? 1 : 0;
}
$this->requirePermission('department_notification_sms_update');
$department_notification_sms = new department_notification_sms_o();
$department_notification_sms->select((int)self::getParameter('id'));
self::requireDepartmentAccess((int)$department_notification_sms->department->value());
if (empty($data)) {
$response->error('No data to update', 400);
}
$department_notification_sms->update(
[
...$data
]
);
(new logs_o())->add('department_notification_sms', 'global', 0, $user->id, 'DEPARTMENT_NOTIFICATION_SMS_UPDATE', 'Update department notification SMS');
$response->success('Department notification SMS updated');
} else {
(new logs_o())->add('department_notification_sms', 'global', 0, 0, 'DEPARTMENT_NOTIFICATION_SMS_UPDATE', 'Update department notification SMS failed');
$response->error('Invalid session', 400);
}
},
[
'department_notification_sms_update' => 'Update a department notification SMS, in the departments the user has access to',
]
);
/** Department Notification SMS -> Delete */
$this->delete('/department/notification/sms', function () {
global $response;
$this->requirePermission('department_notification_sms_delete');
$user = (new authentication())->get_user();
if ($user) {
self::requireParameters([
'id',
]);
self::requireType((int)self::getParameter('id'), self::type_int());
self::requireSameLength(self::getParameter('id'), (int)self::getParameter('id'));
self::requireMinValue((int)self::getParameter('id'), 1);
$this->requirePermission('department_notification_sms_delete');
$department_notification_sms = new department_notification_sms_o();
$department_notification_sms->select((int)self::getParameter('id'));
self::requireDepartmentAccess((int)$department_notification_sms->department->value());
$department_notification_sms->delete();
(new logs_o())->add('department_notification_sms', 'global', 0, $user->id, 'DEPARTMENT_NOTIFICATION_SMS_DELETE', 'Delete department notification SMS');
$response->success('Department notification SMS deleted');
} else {
(new logs_o())->add('department_notification_sms', 'global', 0, 0, 'DEPARTMENT_NOTIFICATION_SMS_DELETE', 'Delete department notification SMS failed');
$response->error('Invalid session', 400);
}
},
[
'department_notification_sms_delete' => 'Delete a department notification SMS, in the departments the user has access to',
]
);
}
}