OpenClaw
51a87655d6
Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
67 lines
2.1 KiB
PHP
67 lines
2.1 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use classes\openai;
|
|
use classes\upload_store;
|
|
use objects\logs_o;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
|
|
class uploadRoute
|
|
{
|
|
use route_t;
|
|
|
|
protected array $allowedFileTypes = [
|
|
'image/jpeg', 'jpg',
|
|
'image/png', 'png',
|
|
'image/gif', 'gif',
|
|
'image/webp', 'webp',
|
|
];
|
|
|
|
public function run(): void
|
|
{
|
|
$this->post('/upload/image', function () {
|
|
ScopeMiddleware::requireScope(Scope::CUSTOMER_WRITE, '/upload/image');
|
|
global $response;
|
|
// Get the uploaded file
|
|
$file = $_FILES['file'] ?? null;
|
|
if (!$file) {
|
|
$response->error('No file uploaded');
|
|
}
|
|
// Validate the file type
|
|
$fileType = mime_content_type($file['tmp_name']);
|
|
if (!in_array($fileType, $this->allowedFileTypes)) {
|
|
$response->error('Invalid file type');
|
|
}
|
|
// Validate the file size (optional, e.g., max 5MB)
|
|
if ($file['size'] > 5 * 1024 * 1024) {
|
|
$response->error('File size exceeds the limit of 5MB');
|
|
}
|
|
// Generate a unique object key for the file
|
|
$objectKey = uniqid('image_', true) . '.' . pathinfo($file['name'], PATHINFO_EXTENSION);
|
|
$uploads = new upload_store();
|
|
if(!$file = $uploads->uploadFile(
|
|
$objectKey,
|
|
$file
|
|
)) {
|
|
$response->error('Failed to upload file');
|
|
}
|
|
$response->success($uploads->getPresignedUrl($objectKey));
|
|
});
|
|
$this->get('/openai/test', function () {
|
|
ScopeMiddleware::requireScope(Scope::CUSTOMER_READ, '/openai/test');
|
|
global $response;
|
|
// Validate the input parameters
|
|
// Example image URL for testing
|
|
$image = 'TRUCK_WASH_EXAMPLE_5.jpg';
|
|
// Return the response
|
|
$openai = new openai();
|
|
$response->success($openai->lpr($image));
|
|
});
|
|
}
|
|
} |