Jeppe Bundgaard
497ef1496b
- Introduce `hasPermission` method in `subusers_o` for permission checks tied to customer context. - Update `/subusers/me` route to return subuser grants with normalized permissions and metadata. - Add `get_subuser_customer_number_target` in `authentication` to resolve customer context from request headers. - Refactor route-level permission checks to handle subuser grants dynamically. - Introduce CLI test scripts for subuser grants and permission node mappings. - Add test coverage for subuser grants and permission nodes in new test classes.
89 lines
4.1 KiB
PHP
89 lines
4.1 KiB
PHP
<?php
|
|
// Lightweight bootstrap for CLI execution without full index.php
|
|
if (!defined('WD')) {
|
|
define('WD', dirname(__DIR__, 2));
|
|
}
|
|
// Minimal requires for Subusers permission classes
|
|
require_once WD . '/modules/subusers/interfaces/subusers_permission_node_i.php';
|
|
require_once WD . '/modules/subusers/interfaces/subusers_permission_nodes_i.php';
|
|
require_once WD . '/modules/subusers/interfaces/subusers_user_grant_i.php';
|
|
require_once WD . '/modules/subusers/helpers/subusers_permission_node_key.php';
|
|
require_once WD . '/modules/subusers/helpers/subusers_permission_type.php';
|
|
require_once WD . '/modules/subusers/traits/subusers_permission_node_t.php';
|
|
require_once WD . '/modules/subusers/classes/subusers_permission_node.php';
|
|
require_once WD . '/modules/subusers/traits/subusers_permission_nodes_t.php';
|
|
require_once WD . '/modules/subusers/classes/subusers_permission_nodes.php';
|
|
require_once WD . '/modules/subusers/traits/subuser_user_grant_t.php';
|
|
require_once WD . '/modules/subusers/traits/subusers_user_permissions_t.php';
|
|
require_once WD . '/modules/subusers/permissions/subusers_permission_nodes_bookings.php';
|
|
require_once WD . '/modules/subusers/permissions/subusers_permission_nodes_orders.php';
|
|
require_once WD . '/modules/subusers/permissions/subusers_permission_nodes_selfserve.php';
|
|
require_once WD . '/modules/subusers/permissions/subusers_permission_nodes_subusers.php';
|
|
require_once WD . '/modules/subusers/permissions/subusers_permission_nodes_vehicles.php';
|
|
require_once WD . '/modules/subusers/classes/subuser_user_grant.php';
|
|
|
|
use modules\subusers\classes\subuser_user_grant as base_grant;
|
|
use modules\subusers\helpers\subusers_permission_node_key;
|
|
|
|
function ok($message): void { echo "\n\033[32m✔ $message\033[0m\n"; }
|
|
function fail($message): void { echo "\n\033[31m✖ $message\033[0m\n"; }
|
|
|
|
// Test double overriding DB-backed loadGrants() to avoid database dependency in CLI tests
|
|
class TestSubuserGrant extends base_grant {
|
|
private array $injectedPermissions;
|
|
|
|
public function __construct(int $subuser_id, int $customer_number, array $injectedPermissions)
|
|
{
|
|
$this->injectedPermissions = $injectedPermissions;
|
|
parent::__construct($subuser_id, $customer_number);
|
|
}
|
|
|
|
// Override to inject permissions instead of querying DB
|
|
public function loadGrants(): void
|
|
{
|
|
// Manually enable nodes on each permission container without hitting the database
|
|
$reflection = new \ReflectionClass($this);
|
|
$properties = $reflection->getProperties();
|
|
foreach ($properties as $property) {
|
|
$type = $property->getType();
|
|
if ($type && is_a($type->getName(), \modules\subusers\classes\subusers_permission_nodes::class, true)) {
|
|
if (method_exists($property, 'isInitialized') && !$property->isInitialized($this)) {
|
|
continue;
|
|
}
|
|
$container = $property->getValue($this);
|
|
if ($container instanceof \modules\subusers\classes\subusers_permission_nodes) {
|
|
foreach ($this->injectedPermissions as $perm) {
|
|
$key = is_string($perm) ? $perm : $perm->name;
|
|
$node = $container->getNodeByKey($key);
|
|
if ($node) {
|
|
$node->value = true;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Scenario: subuser has only BOOKINGS_LIST granted => hasNode(BOOKINGS_LIST) = true, EDIT/DELETE = false
|
|
$grant = new TestSubuserGrant(9999, 42424242, [subusers_permission_node_key::BOOKINGS_LIST]);
|
|
if ($grant->hasNode(subusers_permission_node_key::BOOKINGS_LIST)) {
|
|
ok('BOOKINGS_LIST is granted as expected');
|
|
} else {
|
|
fail('BOOKINGS_LIST should be granted but was not');
|
|
}
|
|
|
|
if (!$grant->hasNode(subusers_permission_node_key::BOOKINGS_EDIT)) {
|
|
ok('BOOKINGS_EDIT is not granted as expected');
|
|
} else {
|
|
fail('BOOKINGS_EDIT should not be granted');
|
|
}
|
|
|
|
if (!$grant->hasNode(subusers_permission_node_key::BOOKINGS_DELETE)) {
|
|
ok('BOOKINGS_DELETE is not granted as expected');
|
|
} else {
|
|
fail('BOOKINGS_DELETE should not be granted');
|
|
}
|
|
|
|
echo "\nSubuserUserGrantInitTest completed.\n";
|