Bugfix Subagent
9025a8af6e
Three fixes for the failing CI checks (PHP api, PHP integration): 1. RouteScopeTest.php: Pest's toContain() is variadic, so both arguments are treated as needles. The second 'description' argument was being treated as a needle, causing every file to fail. Removed the misleading second argument. 2. Added ScopeMiddleware::requireScope() calls and the matching Scope/ScopeMiddleware imports to 15 protected route files that the integration test contract requires. 3. documentation/auth/route-scope-audit.md: added the missing Scope::SUPERUSER_WRITE reference and a constants reference table. Also registered tests/auth/StripeInvoiceEmailTemplateTest.php in the legacy test manifest.
51 lines
1.7 KiB
PHP
51 lines
1.7 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use objects\logs_o;
|
|
use objects\users_o;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class intimidateRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->post('/su/intimidate', function () {
|
|
ScopeMiddleware::requireScope(Scope::SUPERUSER_WRITE, '/su/intimidate');
|
|
// Get the post data
|
|
global $response;
|
|
// Make sure the user has the SUPERUSER_INTIMIDATE permission
|
|
$this->requirePermission('SUPERUSER_INTIMIDATE');
|
|
// Get the user object
|
|
$user = (new authentication())->get_user();
|
|
// Get the post data
|
|
$data = json_decode(file_get_contents('php://input'), true);
|
|
// Check if the customer number, and password are set
|
|
if (!isset($data['user_id'])) {
|
|
$response->error('User id is required', 400);
|
|
}
|
|
// Get the user object
|
|
$intimidated_user = (new users_o())->getUserById($data['user_id']);
|
|
// Log the incident
|
|
(new logs_o())->add('auth', 'global', 1, $user->id, 'AUTH_SUCCESS_INTIMIDATE', 'Created intimidate token for customer: ' . $data['user_id']);
|
|
// If the credentials are valid, create a token (We're using the create_employee_token, since it's using user_id, and not customer_numbers.)
|
|
$token = (new authentication())->create_impersonation_token(
|
|
(int)$data['user_id'],
|
|
(int)$user->id
|
|
);
|
|
// Return the token
|
|
$response->success(['token' => $token]);
|
|
},
|
|
[
|
|
'SUPERUSER_INTIMIDATE' => 'Intimidate a user'
|
|
]
|
|
);
|
|
}
|
|
}
|