Files
api/services/nginx/app/routes/moduleEconomicRoute.php
T
Jeppe B ab6c3ba5b6 Fix route permission instance calls (#344)
## Root cause

`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:

`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`

## Changes

- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.

## Verification

- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree

## Delivery state

Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
2026-08-04 16:04:41 +02:00

141 lines
5.9 KiB
PHP

<?php
namespace routes;
use classes\authentication;
use classes\economic;
use classes\response;
use classes\router;
use objects\departments_o;
use objects\logs_o;
use objects\users_o;
use traits\route_t;
class moduleEconomicRoute
{
use route_t;
public function run(): void
{
global /** @var response $response */
/** @var router $router */
$router, $response;
/** Economic > Customers > Import customer */
$this->post('/economic/customers/import', function () {
global $response;
$this->requirePermission('economic_import_customer');
$user = (new authentication())->get_user();
if ($user) {
// Check if the customer number is set
self::requireParameters(['customer_number']);
self::requireType(self::getParameter('customer_number'), self::TYPE_INT());
$users_o = new users_o();
// Check if the customer is already imported
$isCustomerImported = $users_o->isImportedFromEconomic(self::getParameter('customer_number'));
if ($isCustomerImported) {
$response->error('Customer already imported', 400);
}
// Check if the customer exists in the economic system
$economic = new economic();
$doesCustomerExists = $economic->customers->customers->exists(self::getParameter('customer_number'));
if (!$doesCustomerExists) {
$response->error('Customer does not exist', 400);
}
// Import the customer
$customer = $users_o->getUserByCustomerNumber(self::getParameter('customer_number'));
// Make sure the user returned is valid
if (!$customer->exists()) {
$response->error('Unable to import customer', 400);
}
(new logs_o())->add('economic', 'global', 1, $user->id, 'ECONOMIC_IMPORT_CUSTOMER', 'Successfully imported customer');
$response->success(
$customer->asArray()
);
} else {
(new logs_o())->add('economic', 'global', 1, 0, 'ECONOMIC_IMPORT_CUSTOMER', 'No user found, or invalid session');
$response->error('Invalid session', 400);
}
},
[
'economic_import_customer' => 'Import customer from economic'
]
);
/** Economic > Departments > GET */
self::get('/economic/departments', function () {
// Require permission
global /** @var response $response */
$response;
$this->requirePermission('economic_departments_get');
// Get the user
$user = (new authentication())->get_user();
// Check if the user is valid
if ($user->exists()) {
// Get the departments
$economic = new economic();
$departments = $economic->departments->departments->get()->collection;
$departments_o = new departments_o();
// Parse the departments
$departments = array_map(function ($department) use ($departments_o) {
return [
'id' => $department->departmentNumber, // The department number is the ID in this case, this is added for consistency with the rest of the system. - Making it easier to use the department number as the ID, when selecting a department to link (FE).
'name' => $department->name,
'departmentNumber' => $department->departmentNumber
];
}, $departments);
// Return the departments
$response->success($departments);
} else {
// Log the error
(new logs_o())->add('economic', 'global', 1, 0, 'ECONOMIC_DEPARTMENTS', 'No user found, or invalid session');
// Return the error
$response->error('Invalid session', 400);
}
},
[
'economic_departments_get' => 'Get departments from economic'
]
);
/** Economic > Products > GET */
self::get('/economic/products', function () {
// Require permission
global /** @var response $response */
$response;
$this->requirePermission('economic_products_get');
// Get the user
$user = (new authentication())->get_user();
// Check if the user is valid
if ($user->exists()) {
// Get the products
$economic = new economic();
$products = $economic->products->products->get([], [
'skipPages' => 0,
'pageSize' => 1000, // Since the limit is 1000, we need to set the page size to 1000.
])->collection;
// Parse the products
$products = array_map(function ($product) {
return [
'id' => (int)$product->productNumber,
'name' => $product->name . ' (' . $product->productNumber . ')',
'price' => (int)($product->salesPrice ?? 0),
'productNumber' => (int)$product->productNumber
];
}, $products);
// Return the products
$response->success($products);
} else {
// Log the error
(new logs_o())->add('economic', 'global', 1, 0, 'ECONOMIC_PRODUCTS', 'No user found, or invalid session');
// Return the error
$response->error('Invalid session', 400);
}
},
[
'economic_products_get' => 'Get products from economic'
]
);
}
}