OpenClaw
51a87655d6
Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
92 lines
3.5 KiB
PHP
92 lines
3.5 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\customer_rule_product_restriction_exception;
|
|
use classes\customer_rule_product_restriction_service;
|
|
use Throwable;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class superuserCustomerRuleProductRestrictionsRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
$this->get('/superuser/customer-rules/product-restrictions', function () {
|
|
ScopeMiddleware::requireScope(Scope::SUPERUSER_READ, '/superuser/customer-rules/product-restrictions');
|
|
global $response;
|
|
$this->requireClassicSuperuserAnyPermission([
|
|
'superuser_customer_rules_view',
|
|
'superuser_customer_rules_manage',
|
|
]);
|
|
$response->success((new customer_rule_product_restriction_service())->listConfiguration());
|
|
}, [
|
|
'superuser_customer_rules_view' => 'View global customer-rule product restrictions',
|
|
]);
|
|
|
|
$this->put('/superuser/customer-rules/product-restrictions/{attribute}', function () {
|
|
ScopeMiddleware::requireScope(Scope::SUPERUSER_WRITE, '/superuser/customer-rules/product-restrictions/{attribute}');
|
|
global $response;
|
|
$this->requireClassicSuperuserPermission('superuser_customer_rules_manage');
|
|
$attribute = trim((string)$this->fromRoute('attribute'));
|
|
try {
|
|
$response->success((new customer_rule_product_restriction_service())->replaceRuleConfiguration(
|
|
$attribute,
|
|
$this->getParametersAsArray(),
|
|
$this->actorUserId()
|
|
));
|
|
} catch (customer_rule_product_restriction_exception $exception) {
|
|
$response->error([
|
|
'code' => $exception->restrictionCode(),
|
|
'message' => $exception->getMessage(),
|
|
], $exception->httpStatus());
|
|
} catch (Throwable $throwable) {
|
|
error_log('[customer_rule_product_restrictions] save failed: ' . $throwable->getMessage());
|
|
$response->error([
|
|
'code' => 'CUSTOMER_RULE_CONFIGURATION_SAVE_FAILED',
|
|
'message' => 'Unable to save customer rule configuration',
|
|
], 500);
|
|
}
|
|
}, [
|
|
'superuser_customer_rules_manage' => 'Manage global customer-rule product restrictions',
|
|
]);
|
|
}
|
|
|
|
private function requireClassicSuperuserPermission(string $permission): bool
|
|
{
|
|
global $response;
|
|
if ((new authentication())->get_subuser() !== false) {
|
|
$response->error('Subuser sessions cannot manage customer rules.', 403);
|
|
}
|
|
$this->requirePermission('superuser');
|
|
return $this->requirePermission($permission);
|
|
}
|
|
|
|
/** @param list<string> $permissions */
|
|
private function requireClassicSuperuserAnyPermission(array $permissions): bool
|
|
{
|
|
global $response;
|
|
if ((new authentication())->get_subuser() !== false) {
|
|
$response->error('Subuser sessions cannot manage customer rules.', 403);
|
|
}
|
|
$this->requirePermission('superuser');
|
|
foreach ($permissions as $permission) {
|
|
if ($this->hasPermission($permission)) {
|
|
return true;
|
|
}
|
|
}
|
|
return $this->requirePermission($permissions[0]);
|
|
}
|
|
|
|
private function actorUserId(): int
|
|
{
|
|
$user = (new authentication())->get_user();
|
|
return $user !== false && $user->exists() ? (int)$user->id : 0;
|
|
}
|
|
}
|