Jeppe B
ab6c3ba5b6
## Root cause `route_t::hasPermission()` and `requirePermission()` are instance methods. Route code was invoking them with `self::`; the new XL Vask hall-scope helper made that call from a genuinely static context, causing PHP to throw: `Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot be called statically` ## Changes - Invoke route permission methods through `$this` across all 273 executable legacy calls in 45 route classes. - Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance helper and update all 13 callers. - Preserve the existing all-scope and own-scope hall selection rules. - Add a token-aware regression test that rejects executable `self::hasPermission()` and `self::requirePermission()` calls, while ignoring comments. - Add focused XL Vask tests for global scanner hall scope and group-limited own scope. - Update affected route contract assertions to the instance-call form. ## Verification - PHP lint: all 53 changed PHP files - Focused PHPStan: changed XL Vask route and both new regression tests — clean - Focused regression slice: 58 passed, 748 assertions - Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated existing warning, 1 environment skip) - Full local API suite: 285 passed, 11,704 assertions - Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API, integration, legacy, edge gateway, and supporting checks) - Independent exact-SHA QA gate: PASS, no findings - Independent exact-SHA security gate: PASS, no findings - Independent exact-SHA reviewer gate: PASS, no findings - Remote comparison: exactly one commit ahead of `40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes matched the reviewed worktree ## Delivery state Draft only for human review. No merge or deployment is included. Qodana is skipped while the PR remains draft and is therefore not represented as a passed gate.
91 lines
3.7 KiB
PHP
91 lines
3.7 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\economic;
|
|
use classes\response;
|
|
use classes\router;
|
|
use objects\logs_o;
|
|
use traits\route_t;
|
|
|
|
class moduleEconomicCustomerRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
global /** @var response $response */
|
|
/** @var router $router */
|
|
$router, $response;
|
|
|
|
|
|
/** Modules > Economic > Customer > Get customer */
|
|
$this->get('/modules/economic/customer', function () {
|
|
global $response;
|
|
$this->requirePermission('modules_economic_customer_get');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
self::requireParameters(['customer_number']);
|
|
self::requireType('customer_number', self::type_int());
|
|
self::requireMinLength('customer_number', 1);
|
|
self::requireMaxLength('customer_number', 10);
|
|
(new logs_o())->add('modules_economic', 'global', 1, 0, 'MODULES_ECONOMIC', 'User accessed the customer');
|
|
$result = (new economic())->getCustomer((int)$_GET['customer_number']);
|
|
$response->success((object)$result);
|
|
} else {
|
|
(new logs_o())->add('modules_economic', 'global', 0, 0, 'MODULES_ECONOMIC', 'User tried to access the customer without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'modules_economic_customer_get' => 'Get customer'
|
|
]
|
|
);
|
|
|
|
/** Modules > Economic > Customer > Create customer */
|
|
$this->post('/modules/economic/customer', function () {
|
|
global $response;
|
|
$this->requirePermission('modules_economic_customer_create');
|
|
$user = (new authentication())->get_user();
|
|
if ($user || true) {
|
|
self::requireParameters(['customer_number', 'cvr', 'email', 'phone', 'name']);
|
|
self::requireMinLength('customer_number', 1);
|
|
self::requireMaxLength('customer_number', 10);
|
|
self::requireMinLength('cvr', 1);
|
|
self::requireMaxLength('cvr', 10);
|
|
self::requireMinLength('email', 1);
|
|
self::requireMaxLength('email', 255);
|
|
self::requireMinLength('phone', 1);
|
|
self::requireMaxLength('phone', 255);
|
|
self::requireMinLength('name', 1);
|
|
self::requireMaxLength('name', 255);
|
|
$ean = null;
|
|
if (self::isParametersSet(['ean'])) {
|
|
try {
|
|
$ean = economic::normalizeCustomerEan(self::getParameter('ean'));
|
|
} catch (\InvalidArgumentException $exception) {
|
|
$response->error($exception->getMessage(), 400);
|
|
}
|
|
}
|
|
(new logs_o())->add('modules_economic', 'global', 1, 0, 'MODULES_ECONOMIC', 'User accessed the customer');
|
|
$result = (new economic())->createCustomer(
|
|
(int)self::getParameter('customer_number'),
|
|
(string)self::getParameter('name'),
|
|
(int)self::getParameter('cvr'),
|
|
(string)self::getParameter('email'),
|
|
(int)self::getParameter('phone'),
|
|
null,
|
|
null,
|
|
$ean,
|
|
);
|
|
$response->success((object)$result);
|
|
} else {
|
|
(new logs_o())->add('modules_economic', 'global', 0, 0, 'MODULES_ECONOMIC', 'User tried to access the customer without a valid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
});
|
|
|
|
}
|
|
}
|