Jeppe B
ab6c3ba5b6
## Root cause `route_t::hasPermission()` and `requirePermission()` are instance methods. Route code was invoking them with `self::`; the new XL Vask hall-scope helper made that call from a genuinely static context, causing PHP to throw: `Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot be called statically` ## Changes - Invoke route permission methods through `$this` across all 273 executable legacy calls in 45 route classes. - Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance helper and update all 13 callers. - Preserve the existing all-scope and own-scope hall selection rules. - Add a token-aware regression test that rejects executable `self::hasPermission()` and `self::requirePermission()` calls, while ignoring comments. - Add focused XL Vask tests for global scanner hall scope and group-limited own scope. - Update affected route contract assertions to the instance-call form. ## Verification - PHP lint: all 53 changed PHP files - Focused PHPStan: changed XL Vask route and both new regression tests — clean - Focused regression slice: 58 passed, 748 assertions - Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated existing warning, 1 environment skip) - Full local API suite: 285 passed, 11,704 assertions - Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API, integration, legacy, edge gateway, and supporting checks) - Independent exact-SHA QA gate: PASS, no findings - Independent exact-SHA security gate: PASS, no findings - Independent exact-SHA reviewer gate: PASS, no findings - Remote comparison: exactly one commit ahead of `40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes matched the reviewed worktree ## Delivery state Draft only for human review. No merge or deployment is included. Qodana is skipped while the PR remains draft and is therefore not represented as a passed gate.
199 lines
9.4 KiB
PHP
199 lines
9.4 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\economic_v2_versioning_service;
|
|
use objects\customer_fixed_pricing_o;
|
|
use objects\logs_o;
|
|
use objects\users_o;
|
|
use traits\route_t;
|
|
|
|
class customerFixedPricingRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->get('/customer/pricing/fixed', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('get_customer_fixed_pricing');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('customer_fixed_pricing', 'global', 0, $user->id, 'CUSTOMER_GET_FIXED_PRICING', 'User not logged in');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
// Require the customer number parameter
|
|
self::requireParameters(['customer_number']);
|
|
// Check if the customer number is valid
|
|
$customer_number = (int)self::getParameter('customer_number');
|
|
self::requireMinLength('customer_number', 1);
|
|
self::requireMaxLength('customer_number', 255);
|
|
self::requireType($customer_number, self::type_int());
|
|
self::requireMinValue($customer_number, 1);
|
|
// Check if the customer number exists
|
|
$customer = (new users_o())->getUserByCustomerNumber((int)$customer_number);
|
|
if (!$customer->exists()) {
|
|
(new logs_o())->add('customer_fixed_pricing', 'global', 0, $user->id, 'CUSTOMER_GET_FIXED_PRICING', 'Customer not found');
|
|
$response->error('Customer not found', 400);
|
|
}
|
|
// Get the fixed price
|
|
$customer_fixed_pricing_o = new customer_fixed_pricing_o();
|
|
$fixed_pricing_object_id = $customer_fixed_pricing_o->getIdByCustomerNumber((int)$customer_number);
|
|
if (empty($fixed_pricing_object_id)) {
|
|
// Return "Not found"
|
|
$response->error('This customer does not have a fixed price', 400);
|
|
}
|
|
// Select the object
|
|
$customer_fixed_pricing_o->select((int)$fixed_pricing_object_id);
|
|
// Log the action
|
|
(new logs_o())->add('customer_fixed_pricing', 'global', 0, $user->id, 'CUSTOMER_GET_FIXED_PRICING', 'Fixed price retrieved');
|
|
// Return success
|
|
$response->success($customer_fixed_pricing_o->asArray());
|
|
},
|
|
[
|
|
'get_customer_fixed_pricing' => 'Get a fixed price for a customer',
|
|
]
|
|
);
|
|
$this->post('/customer/pricing/fixed', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('add_customer_fixed_pricing');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('customer_fixed_pricing', 'global', 0, $user->id, 'CUSTOMER_ADD_FIXED_PRICING', 'User not logged in');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
// Require the customer number, price and description parameters
|
|
self::requireParameters(['customer_number', 'price', 'description']);
|
|
// Check if the customer number is valid
|
|
$customer_number = (int)self::getParameter('customer_number');
|
|
self::requireMinLength('customer_number', 1);
|
|
self::requireMaxLength('customer_number', 255);
|
|
self::requireType($customer_number, self::type_int());
|
|
self::requireMinValue($customer_number, 1);
|
|
// Check if the price is valid
|
|
$price = (int)self::getParameter('price');
|
|
self::requireMinLength('price', 1);
|
|
self::requireMaxLength('price', 255);
|
|
self::requireType($price, self::type_int());
|
|
self::requireMinValue($price, 1);
|
|
// Check if the description is valid
|
|
$description = (string)self::getParameter('description');
|
|
self::requireMinLength('description', 1);
|
|
self::requireMaxLength('description', 255);
|
|
self::requireType($description, self::type_string());
|
|
// Check if the customer number exists
|
|
$customer = (new users_o())->getUserByCustomerNumber((int)$customer_number);
|
|
if (!$customer->exists()) {
|
|
(new logs_o())->add('customer_fixed_pricing', 'global', 0, $user->id, 'CUSTOMER_ADD_FIXED_PRICING', 'Customer not found');
|
|
$response->error('Customer not found', 400);
|
|
}
|
|
// Check if the customer already has a fixed price
|
|
$customer_fixed_pricing_o = new customer_fixed_pricing_o();
|
|
$fixed_pricing_object_id = $customer_fixed_pricing_o->getIdByCustomerNumber((int)$customer_number);
|
|
if (!empty($fixed_pricing_object_id)) {
|
|
// Return "Already exists"
|
|
$response->error('This customer already has a fixed price', 400);
|
|
}
|
|
// Add the fixed price
|
|
$customer_fixed_pricing_o->add((int)$customer_number, (int)$price, (string)$description);
|
|
try {
|
|
(new economic_v2_versioning_service())->recordFixedPricingVersion(
|
|
(int)$customer_number,
|
|
(int)$price,
|
|
(string)$description,
|
|
date('Y-m-d H:i:s'),
|
|
'live.fixed_pricing.route',
|
|
1.0,
|
|
false,
|
|
[
|
|
'route' => '/customer/pricing/fixed',
|
|
'method' => 'POST',
|
|
'actor_user_id' => (int)$user->id,
|
|
]
|
|
);
|
|
} catch (\Throwable $e) {
|
|
(new logs_o())->add(
|
|
'customer_fixed_pricing',
|
|
'global',
|
|
0,
|
|
(int)$user->id,
|
|
'CUSTOMER_ADD_FIXED_PRICING_VERSIONING_FAILED',
|
|
$e->getMessage()
|
|
);
|
|
}
|
|
// Log the action
|
|
(new logs_o())->add('customer_fixed_pricing', 'global', 0, $user->id, 'CUSTOMER_ADD_FIXED_PRICING', 'Fixed price added');
|
|
// Return success
|
|
$response->success($customer_fixed_pricing_o->asArray());
|
|
},
|
|
[
|
|
'add_customer_fixed_pricing' => 'Add a fixed price for a customer (This is a global action, should only be permitted superusers)',
|
|
]
|
|
);
|
|
|
|
$this->delete('/customer/pricing/fixed', function () {
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('delete_customer_fixed_pricing');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('customer_fixed_pricing', 'global', 0, $user->id, 'CUSTOMER_DELETE_FIXED_PRICING', 'User not logged in');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
// Require the customer number parameter
|
|
self::requireParameters(['customer_number']);
|
|
// Check if the customer number is valid
|
|
$customer_number = (int)self::getParameter('customer_number');
|
|
self::requireMinLength('customer_number', 1);
|
|
self::requireMaxLength('customer_number', 255);
|
|
self::requireType($customer_number, self::type_int());
|
|
self::requireMinValue($customer_number, 1);
|
|
// Check if the customer number exists
|
|
$customer = (new users_o())->getUserByCustomerNumber((int)$customer_number);
|
|
if (!$customer->exists()) {
|
|
(new logs_o())->add('customer_fixed_pricing', 'global', 0, $user->id, 'CUSTOMER_DELETE_FIXED_PRICING', 'Customer not found');
|
|
$response->error('Customer not found', 400);
|
|
}
|
|
// Check if the customer already has a fixed price
|
|
$customer_fixed_pricing_o = new customer_fixed_pricing_o();
|
|
$fixed_pricing_object = $customer_fixed_pricing_o->selectByCustomerNumber((int)$customer_number);
|
|
// Delete the fixed price
|
|
$fixed_pricing_object->delete();
|
|
try {
|
|
(new economic_v2_versioning_service())->closeActiveFixedPricingVersion(
|
|
(int)$customer_number,
|
|
date('Y-m-d H:i:s'),
|
|
'live.fixed_pricing.route',
|
|
1.0,
|
|
false,
|
|
[
|
|
'route' => '/customer/pricing/fixed',
|
|
'method' => 'DELETE',
|
|
'actor_user_id' => (int)$user->id,
|
|
]
|
|
);
|
|
} catch (\Throwable $e) {
|
|
(new logs_o())->add(
|
|
'customer_fixed_pricing',
|
|
'global',
|
|
0,
|
|
(int)$user->id,
|
|
'CUSTOMER_DELETE_FIXED_PRICING_VERSIONING_FAILED',
|
|
$e->getMessage()
|
|
);
|
|
}
|
|
// Log the action
|
|
(new logs_o())->add('customer_fixed_pricing', 'global', 0, $user->id, 'CUSTOMER_DELETE_FIXED_PRICING', 'Fixed price deleted');
|
|
// Return success
|
|
$response->success('Fixed price deleted');
|
|
},
|
|
[
|
|
'delete_customer_fixed_pricing' => 'Delete a fixed price for a customer (This is a global action, should only be permitted superusers)',
|
|
]
|
|
);
|
|
}
|
|
}
|