api/services/nginx/app/routes/departmentSelfserveConditionRulesRoute.php

<?php
/**
 * Route for department self-serve condition rules
 */

namespace routes;

use classes\authentication;
use modules\selfserve\classes\selfserve_config_versioning;
use classes\response;
use objects\department_selfserve_conditions_o;
use objects\department_selfserve_condition_rules_o;
use objects\logs_o;
use traits\route_t;

use app\auth\Scope;
use app\auth\ScopeMiddleware;

class departmentSelfserveConditionRulesRoute
{
    use route_t;

    public function run(): void
    {
        /**
         * List department self-serve condition rules
         */
        $this->get('/department/selfserve/condition/rules', function () {
            ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/department/selfserve/condition/rules');
            global $response;
            $this->requirePermission('list_department_selfserve_condition_rules');
            $user = (new authentication())->get_user();
            if ($user) {
                (new logs_o())->add('department_selfserve_condition_rules', 'global', 1, $user->id, 'LIST_RULES', 'User listed department self-serve condition rules');
                
                $rules_o = new department_selfserve_condition_rules_o();
                
                // If an ID is provided, return that specific rule
                if (self::isParametersSet(['id'])) {
                    $rules_o->select((int)self::getParameter('id'));
                    if ($rules_o->exists()) {
                        // Check access via condition -> department
                        $condition_o = new department_selfserve_conditions_o();
                        $condition_o->select((int)$rules_o->condition_id->value());
                        $authorized_department_ids = $user->getGroup()->getDepartments();
                        if ($condition_o->exists()) {
                            if (!$this->canAccessDepartment($authorized_department_ids, (int)$condition_o->department->value()) && !$this->hasPermission('view_all_department_selfserve_condition_rules')) {
                                $this->forbidDepartmentAccess((int)$condition_o->department->value(), ['view_all_department_selfserve_condition_rules']);
                            }
                        }
                        $response->success($rules_o->asArray());
                    } else {
                        $response->error('Rule not found', 404);
                    }
                }

                $filters = [];
                if (self::isParametersSet(['condition_id'])) {
                    $filters['condition_id'] = (int)self::getParameter('condition_id');
                    
                    // Verify access to this condition
                    $condition_o = new department_selfserve_conditions_o();
                    $condition_o->select($filters['condition_id']);
                    if ($condition_o->exists()) {
                        $authorized_department_ids = $user->getGroup()->getDepartments();
                        if (!$this->canAccessDepartment($authorized_department_ids, (int)$condition_o->department->value()) && !$this->hasPermission('view_all_department_selfserve_condition_rules')) {
                            $this->forbidDepartmentAccess((int)$condition_o->department->value(), ['view_all_department_selfserve_condition_rules']);
                        }
                    }
                }

                if (self::isParametersSet(['type'])) {
                    $filters['type'] = (string)self::getParameter('type');
                }

                if (self::isParametersSet(['object_type'])) {
                    $filters['object_type'] = (string)self::getParameter('object_type');
                }

                if (self::isParametersSet(['object_id'])) {
                    $filters['object_id'] = (int)self::getParameter('object_id');
                }

                $response->success(
                    $rules_o->setSearchableFields(['id', 'condition_id', 'type', 'object_type', 'object_id', 'name', 'description', 'deleted_at'])
                        ->listObjectsWithPaginationIfSet(function ($rule) {
                            $r = new department_selfserve_condition_rules_o();
                            $r->select((int)$rule['id']);
                            return $r->asArray();
                        }, $rules_o->forceRestrictFilters($filters))
                );
            } else {
                $response->error('Invalid session', 400);
            }
        }, [
            'list_department_selfserve_condition_rules' => 'List all department self-serve condition rules',
            'view_all_department_selfserve_condition_rules' => 'View all department self-serve condition rules'
        ]);

        /**
         * Add a department self-serve condition rule
         */
        $this->post('/department/selfserve/condition/rules', function () {
            ScopeMiddleware::requireScope(Scope::CUSTOMER_WRITE, '/department/selfserve/condition/rules');
            global $response;
            $this->requirePermission('add_department_selfserve_condition_rules');
            $user = (new authentication())->get_user();
            if ($user) {
                $condition_id = (int)$response->getRequestParameter('condition_id');
                $type = (string)$response->getRequestParameter('type');
                $object_type = (string)$response->getRequestParameter('object_type');
                $object_id = (int)$response->getRequestParameter('object_id');
                $name = (string)$response->getRequestParameter('name');
                $description = (string)$response->getRequestParameter('description');

                if (!$condition_id || !$type || !$object_type || !$object_id || !$name || !$description) {
                    $response->error('Missing required fields', 400);
                }

                // Verify access to this condition
                $condition_o = new department_selfserve_conditions_o();
                $condition_o->select($condition_id);
                if (!$condition_o->exists()) {
                    $response->error('Condition not found', 404);
                }
                $authorized_department_ids = $user->getGroup()->getDepartments();
                if (!$this->canAccessDepartment($authorized_department_ids, (int)$condition_o->department->value())) {
                    $this->forbidDepartmentAccess((int)$condition_o->department->value());
                }

                try {
                    $rule_o = (new department_selfserve_condition_rules_o())->add(
                        $condition_id,
                        $type,
                        $object_type,
                        $object_id,
                        $name,
                        $description
                    );
                    (new selfserve_config_versioning())->syncDraftFromLegacyForDepartment((int)$condition_o->department->value());
                    (new logs_o())->add('department_selfserve_condition_rules', 'global', 1, $user->id, 'ADD_RULE', 'User added department self-serve condition rule ' . $rule_o->id);
                    $response->success($rule_o->asArray());
                } catch (\Exception $e) {
                    $response->error($e->getMessage(), 500);
                }
            } else {
                $response->error('Invalid session', 400);
            }
        }, [
            'add_department_selfserve_condition_rules' => 'Add a department self-serve condition rule'
        ]);

        /**
         * Update a department self-serve condition rule
         */
        $this->put('/department/selfserve/condition/rules', function () {
            ScopeMiddleware::requireScope(Scope::CUSTOMER_WRITE, '/department/selfserve/condition/rules');
            global $response;
            $this->requirePermission('update_department_selfserve_condition_rules');
            $user = (new authentication())->get_user();
            if ($user) {
                $id = (int)$response->getRequestParameter('id');
                if (!$id) {
                    $response->error('Missing required fields', 400);
                }

                $rule_o = new department_selfserve_condition_rules_o();
                $rule_o->select($id);
                if (!$rule_o->exists()) {
                    $response->error('Rule not found', 404);
                }

                // Verify access via condition -> department
                $condition_o = new department_selfserve_conditions_o();
                $condition_o->select((int)$rule_o->condition_id->value());
                $authorized_department_ids = $user->getGroup()->getDepartments();
                if ($condition_o->exists() && !$this->canAccessDepartment($authorized_department_ids, (int)$condition_o->department->value())) {
                    $this->forbidDepartmentAccess((int)$condition_o->department->value());
                }
                $originalDepartment = $condition_o->exists()
                    ? (int)$condition_o->department->value()
                    : 0;

                if ($response->isRequestParameterSet('condition_id')) {
                    $new_condition_id = (int)$response->getRequestParameter('condition_id');
                    $new_condition_o = new department_selfserve_conditions_o();
                    $new_condition_o->select($new_condition_id);
                    if (!$new_condition_o->exists()) {
                        $response->error('Target condition not found', 404);
                    }
                    if (!$this->canAccessDepartment($authorized_department_ids, (int)$new_condition_o->department->value())) {
                        $this->forbidDepartmentAccess((int)$new_condition_o->department->value());
                    }
                    $rule_o->condition_id->update($new_condition_id);
                }
                if ($response->isRequestParameterSet('type')) {
                    $rule_o->type->update((string)$response->getRequestParameter('type'));
                }
                if ($response->isRequestParameterSet('object_type')) {
                    $rule_o->object_type->update((string)$response->getRequestParameter('object_type'));
                }
                if ($response->isRequestParameterSet('object_id')) {
                    $rule_o->object_id->update((int)$response->getRequestParameter('object_id'));
                }
                if ($response->isRequestParameterSet('name')) {
                    $rule_o->name->update((string)$response->getRequestParameter('name'));
                }
                if ($response->isRequestParameterSet('description')) {
                    $rule_o->description->update((string)$response->getRequestParameter('description'));
                }

                (new selfserve_config_versioning())->syncDraftFromLegacyForDepartment($originalDepartment);
                $updatedCondition = (new department_selfserve_conditions_o())->select((int)$rule_o->condition_id->value());
                if ($updatedCondition->exists()) {
                    (new selfserve_config_versioning())->syncDraftFromLegacyForDepartment((int)$updatedCondition->department->value());
                }
                (new logs_o())->add('department_selfserve_condition_rules', 'global', 1, $user->id, 'UPDATE_RULE', 'User updated department self-serve condition rule ' . $id);
                $response->success($rule_o->asArray());
            } else {
                $response->error('Invalid session', 400);
            }
        }, [
            'update_department_selfserve_condition_rules' => 'Update a department self-serve condition rule'
        ]);

        /**
         * Delete a department self-serve condition rule
         */
        $this->delete('/department/selfserve/condition/rules', function () {
            ScopeMiddleware::requireScope(Scope::CUSTOMER_WRITE, '/department/selfserve/condition/rules');
            global $response;
            $this->requirePermission('delete_department_selfserve_condition_rules');
            $user = (new authentication())->get_user();
            if ($user) {
                $id = (int)$response->getRequestParameter('id');
                if (!$id) {
                    $response->error('Missing required fields', 400);
                }

                $rule_o = new department_selfserve_condition_rules_o();
                $rule_o->select($id);
                if (!$rule_o->exists()) {
                    $response->error('Rule not found', 404);
                }

                // Verify access via condition -> department
                $condition_o = new department_selfserve_conditions_o();
                $condition_o->select((int)$rule_o->condition_id->value());
                $authorized_department_ids = $user->getGroup()->getDepartments();
                if ($condition_o->exists() && !$this->canAccessDepartment($authorized_department_ids, (int)$condition_o->department->value())) {
                    $this->forbidDepartmentAccess((int)$condition_o->department->value());
                }

                $rule_o->delete();
                if ($condition_o->exists()) {
                    (new selfserve_config_versioning())->syncDraftFromLegacyForDepartment((int)$condition_o->department->value());
                }
                (new logs_o())->add('department_selfserve_condition_rules', 'global', 1, $user->id, 'DELETE_RULE', 'User deleted department self-serve condition rule ' . $id);
                $response->success('Rule deleted');
            } else {
                $response->error('Invalid session', 400);
            }
        }, [
            'delete_department_selfserve_condition_rules' => 'Delete a department self-serve condition rule'
        ]);
    }

    private function canAccessDepartment(array $authorizedDepartmentIds, int $departmentId): bool
    {
        return $departmentId === 0 || in_array($departmentId, $authorizedDepartmentIds, true);
    }
}