Jeppe B
ab6c3ba5b6
## Root cause `route_t::hasPermission()` and `requirePermission()` are instance methods. Route code was invoking them with `self::`; the new XL Vask hall-scope helper made that call from a genuinely static context, causing PHP to throw: `Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot be called statically` ## Changes - Invoke route permission methods through `$this` across all 273 executable legacy calls in 45 route classes. - Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance helper and update all 13 callers. - Preserve the existing all-scope and own-scope hall selection rules. - Add a token-aware regression test that rejects executable `self::hasPermission()` and `self::requirePermission()` calls, while ignoring comments. - Add focused XL Vask tests for global scanner hall scope and group-limited own scope. - Update affected route contract assertions to the instance-call form. ## Verification - PHP lint: all 53 changed PHP files - Focused PHPStan: changed XL Vask route and both new regression tests — clean - Focused regression slice: 58 passed, 748 assertions - Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated existing warning, 1 environment skip) - Full local API suite: 285 passed, 11,704 assertions - Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API, integration, legacy, edge gateway, and supporting checks) - Independent exact-SHA QA gate: PASS, no findings - Independent exact-SHA security gate: PASS, no findings - Independent exact-SHA reviewer gate: PASS, no findings - Remote comparison: exactly one commit ahead of `40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes matched the reviewed worktree ## Delivery state Draft only for human review. No merge or deployment is included. Qodana is skipped while the PR remains draft and is therefore not represented as a passed gate.
89 lines
4.1 KiB
PHP
89 lines
4.1 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use objects\logs_o;
|
|
use objects\users_o;
|
|
use traits\route_t;
|
|
|
|
class userNotificationsRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
|
|
$this->put('/account/notifications', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('user_notifications_update');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('user_notifications', 'global', 0, 0, 'USER_NOTIFICATIONS_UPDATE', 'User not logged in');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
/**
|
|
* Parameters
|
|
*/
|
|
$wash_certificate_email = self::isParametersSet(['wash_certificate_email']) ? (string)self::getParameter('wash_certificate_email') : null;
|
|
$sms_notifications_enabled = self::isParametersSet(['sms_notifications_enabled']) ? (bool)self::getParameter('sms_notifications_enabled') : null;
|
|
$email_notifications_enabled = self::isParametersSet(['email_notifications_enabled']) ? (bool)self::getParameter('email_notifications_enabled') : null;
|
|
$superuser_new_customer_email_notifications_enabled = self::isParametersSet([users_o::KEY_SUPERUSER_NEW_CUSTOMER_EMAIL_NOTIFICATIONS])
|
|
? (bool)self::getParameter(users_o::KEY_SUPERUSER_NEW_CUSTOMER_EMAIL_NOTIFICATIONS)
|
|
: null;
|
|
/**
|
|
* Wash Certificate Email
|
|
*/
|
|
if ($wash_certificate_email !== null) {
|
|
self::requireMinLength('wash_certificate_email', 5);
|
|
self::requireMaxLength('wash_certificate_email', 255);
|
|
self::requireType($wash_certificate_email, self::type_string());
|
|
if (!filter_var($wash_certificate_email, FILTER_VALIDATE_EMAIL)) {
|
|
(new logs_o())->add('user_notifications', 'global', 0, $user->id, 'USER_NOTIFICATIONS_UPDATE', 'Invalid wash certificate email');
|
|
$response->error('Invalid wash certificate email', 400);
|
|
}
|
|
$user->wash_certificate_email->set((string)$wash_certificate_email);
|
|
}
|
|
/**
|
|
* SMS Notifications Enabled
|
|
*/
|
|
if ($sms_notifications_enabled !== null) {
|
|
self::requireType($sms_notifications_enabled, self::type_bool());
|
|
$user->sms_notifications_enabled->set($sms_notifications_enabled ? 1 : 0);
|
|
}
|
|
/**
|
|
* Email Notifications Enabled
|
|
*/
|
|
if ($email_notifications_enabled !== null) {
|
|
self::requireType($email_notifications_enabled, self::type_bool());
|
|
$user->email_notifications_enabled->set($email_notifications_enabled ? 1 : 0);
|
|
}
|
|
/**
|
|
* Superuser New Customer Email Notifications Enabled
|
|
*/
|
|
if ($superuser_new_customer_email_notifications_enabled !== null) {
|
|
$this->requirePermission('superuser');
|
|
self::requireType($superuser_new_customer_email_notifications_enabled, self::type_bool());
|
|
$user->setSuperuserNewCustomerEmailNotificationsEnabled($superuser_new_customer_email_notifications_enabled);
|
|
}
|
|
$token = str_replace('Bearer ', '', (string)($_SERVER['HTTP_AUTHORIZATION'] ?? ''));
|
|
if ($token !== '') {
|
|
try {
|
|
redis->clear_auth_session($token);
|
|
} catch (\Throwable) {
|
|
// Session cache invalidation is best-effort; the persistent update above is authoritative.
|
|
}
|
|
}
|
|
// Log the update
|
|
(new logs_o())->add('user_notifications', 'global', 0, $user->id, 'USER_NOTIFICATIONS_UPDATE', 'User notification settings updated');
|
|
// Return success
|
|
$response->success(['message' => 'User notification settings updated']);
|
|
},
|
|
[
|
|
'user_notifications_update' => 'Update user notification settings',
|
|
]
|
|
);
|
|
}
|
|
}
|