## Root cause `route_t::hasPermission()` and `requirePermission()` are instance methods. Route code was invoking them with `self::`; the new XL Vask hall-scope helper made that call from a genuinely static context, causing PHP to throw: `Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot be called statically` ## Changes - Invoke route permission methods through `$this` across all 273 executable legacy calls in 45 route classes. - Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance helper and update all 13 callers. - Preserve the existing all-scope and own-scope hall selection rules. - Add a token-aware regression test that rejects executable `self::hasPermission()` and `self::requirePermission()` calls, while ignoring comments. - Add focused XL Vask tests for global scanner hall scope and group-limited own scope. - Update affected route contract assertions to the instance-call form. ## Verification - PHP lint: all 53 changed PHP files - Focused PHPStan: changed XL Vask route and both new regression tests — clean - Focused regression slice: 58 passed, 748 assertions - Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated existing warning, 1 environment skip) - Full local API suite: 285 passed, 11,704 assertions - Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API, integration, legacy, edge gateway, and supporting checks) - Independent exact-SHA QA gate: PASS, no findings - Independent exact-SHA security gate: PASS, no findings - Independent exact-SHA reviewer gate: PASS, no findings - Remote comparison: exactly one commit ahead of `40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes matched the reviewed worktree ## Delivery state Draft only for human review. No merge or deployment is included. Qodana is skipped while the PR remains draft and is therefore not represented as a passed gate.
141 lines
5.9 KiB
PHP
141 lines
5.9 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\economic;
|
|
use classes\response;
|
|
use classes\router;
|
|
use objects\departments_o;
|
|
use objects\logs_o;
|
|
use objects\users_o;
|
|
use traits\route_t;
|
|
|
|
class moduleEconomicRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
global /** @var response $response */
|
|
/** @var router $router */
|
|
$router, $response;
|
|
|
|
|
|
/** Economic > Customers > Import customer */
|
|
$this->post('/economic/customers/import', function () {
|
|
global $response;
|
|
$this->requirePermission('economic_import_customer');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
// Check if the customer number is set
|
|
self::requireParameters(['customer_number']);
|
|
self::requireType(self::getParameter('customer_number'), self::TYPE_INT());
|
|
$users_o = new users_o();
|
|
// Check if the customer is already imported
|
|
$isCustomerImported = $users_o->isImportedFromEconomic(self::getParameter('customer_number'));
|
|
if ($isCustomerImported) {
|
|
$response->error('Customer already imported', 400);
|
|
}
|
|
// Check if the customer exists in the economic system
|
|
$economic = new economic();
|
|
$doesCustomerExists = $economic->customers->customers->exists(self::getParameter('customer_number'));
|
|
if (!$doesCustomerExists) {
|
|
$response->error('Customer does not exist', 400);
|
|
}
|
|
// Import the customer
|
|
$customer = $users_o->getUserByCustomerNumber(self::getParameter('customer_number'));
|
|
// Make sure the user returned is valid
|
|
if (!$customer->exists()) {
|
|
$response->error('Unable to import customer', 400);
|
|
}
|
|
(new logs_o())->add('economic', 'global', 1, $user->id, 'ECONOMIC_IMPORT_CUSTOMER', 'Successfully imported customer');
|
|
$response->success(
|
|
$customer->asArray()
|
|
);
|
|
} else {
|
|
(new logs_o())->add('economic', 'global', 1, 0, 'ECONOMIC_IMPORT_CUSTOMER', 'No user found, or invalid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'economic_import_customer' => 'Import customer from economic'
|
|
]
|
|
);
|
|
|
|
/** Economic > Departments > GET */
|
|
self::get('/economic/departments', function () {
|
|
// Require permission
|
|
global /** @var response $response */
|
|
$response;
|
|
$this->requirePermission('economic_departments_get');
|
|
// Get the user
|
|
$user = (new authentication())->get_user();
|
|
// Check if the user is valid
|
|
if ($user->exists()) {
|
|
// Get the departments
|
|
$economic = new economic();
|
|
$departments = $economic->departments->departments->get()->collection;
|
|
$departments_o = new departments_o();
|
|
// Parse the departments
|
|
$departments = array_map(function ($department) use ($departments_o) {
|
|
return [
|
|
'id' => $department->departmentNumber, // The department number is the ID in this case, this is added for consistency with the rest of the system. - Making it easier to use the department number as the ID, when selecting a department to link (FE).
|
|
'name' => $department->name,
|
|
'departmentNumber' => $department->departmentNumber
|
|
];
|
|
}, $departments);
|
|
// Return the departments
|
|
$response->success($departments);
|
|
} else {
|
|
// Log the error
|
|
(new logs_o())->add('economic', 'global', 1, 0, 'ECONOMIC_DEPARTMENTS', 'No user found, or invalid session');
|
|
// Return the error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'economic_departments_get' => 'Get departments from economic'
|
|
]
|
|
);
|
|
|
|
/** Economic > Products > GET */
|
|
self::get('/economic/products', function () {
|
|
// Require permission
|
|
global /** @var response $response */
|
|
$response;
|
|
$this->requirePermission('economic_products_get');
|
|
// Get the user
|
|
$user = (new authentication())->get_user();
|
|
// Check if the user is valid
|
|
if ($user->exists()) {
|
|
// Get the products
|
|
$economic = new economic();
|
|
$products = $economic->products->products->get([], [
|
|
'skipPages' => 0,
|
|
'pageSize' => 1000, // Since the limit is 1000, we need to set the page size to 1000.
|
|
])->collection;
|
|
// Parse the products
|
|
$products = array_map(function ($product) {
|
|
return [
|
|
'id' => (int)$product->productNumber,
|
|
'name' => $product->name . ' (' . $product->productNumber . ')',
|
|
'price' => (int)($product->salesPrice ?? 0),
|
|
'productNumber' => (int)$product->productNumber
|
|
];
|
|
}, $products);
|
|
// Return the products
|
|
$response->success($products);
|
|
} else {
|
|
// Log the error
|
|
(new logs_o())->add('economic', 'global', 1, 0, 'ECONOMIC_PRODUCTS', 'No user found, or invalid session');
|
|
// Return the error
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'economic_products_get' => 'Get products from economic'
|
|
]
|
|
);
|
|
}
|
|
} |