OpenClaw
51a87655d6
Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
78 lines
2.3 KiB
PHP
78 lines
2.3 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\economic;
|
|
use classes\response;
|
|
use classes\router;
|
|
use objects\logs_o;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class economicPaymentTermsRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
global /** @var response $response */
|
|
/** @var router $router */
|
|
$router, $response;
|
|
|
|
|
|
$this->get('/economic/payment-terms', function () {
|
|
ScopeMiddleware::requireScope(Scope::INVOICE_READ, '/economic/payment-terms');
|
|
global $response;
|
|
$this->requirePermission('economic_payment_terms');
|
|
$user = (new authentication())->get_user();
|
|
if ($user) {
|
|
(new logs_o())->add('economic_payment_terms', 'global', 1, $user->id, 'ECONOMIC_PAYMENT_TERMS', 'Successfully fetched economic payment terms');
|
|
$paymentTermsResponse = (new economic())->payment_terms->get();
|
|
$response->success(
|
|
self::extractPaymentTermsCollection($paymentTermsResponse)
|
|
);
|
|
} else {
|
|
(new logs_o())->add('economic_payment_terms', 'global', 1, 0, 'ECONOMIC_PAYMENT_TERMS', 'No user found, or invalid session');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
},
|
|
[
|
|
'economic_payment_terms' => 'Get economic payment terms'
|
|
]
|
|
);
|
|
}
|
|
|
|
private static function extractPaymentTermsCollection(mixed $response): array
|
|
{
|
|
if (is_array($response)) {
|
|
return array_values($response);
|
|
}
|
|
|
|
if (!is_object($response)) {
|
|
return [];
|
|
}
|
|
|
|
foreach (['collection', 'paymentTerms', 'items', 'results'] as $property) {
|
|
if (!property_exists($response, $property)) {
|
|
continue;
|
|
}
|
|
|
|
$candidate = $response->{$property};
|
|
if ($candidate instanceof \Traversable) {
|
|
return iterator_to_array($candidate, false);
|
|
}
|
|
if (is_array($candidate)) {
|
|
return array_values($candidate);
|
|
}
|
|
if (is_object($candidate)) {
|
|
return array_values(get_object_vars($candidate));
|
|
}
|
|
}
|
|
|
|
return [];
|
|
}
|
|
}
|