OpenClaw
51a87655d6
Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
93 lines
4.2 KiB
PHP
93 lines
4.2 KiB
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use classes\authentication;
|
|
use objects\logs_o;
|
|
use objects\users_o;
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class userNotificationsRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
|
|
$this->put('/account/notifications', function () {
|
|
ScopeMiddleware::requireScope(Scope::CUSTOMER_WRITE, '/account/notifications');
|
|
// Require the user to be logged in
|
|
global $response;
|
|
$this->requirePermission('user_notifications_update');
|
|
$user = (new authentication())->get_user();
|
|
if (!$user) {
|
|
(new logs_o())->add('user_notifications', 'global', 0, 0, 'USER_NOTIFICATIONS_UPDATE', 'User not logged in');
|
|
$response->error('Invalid session', 400);
|
|
}
|
|
/**
|
|
* Parameters
|
|
*/
|
|
$wash_certificate_email = self::isParametersSet(['wash_certificate_email']) ? (string)self::getParameter('wash_certificate_email') : null;
|
|
$sms_notifications_enabled = self::isParametersSet(['sms_notifications_enabled']) ? (bool)self::getParameter('sms_notifications_enabled') : null;
|
|
$email_notifications_enabled = self::isParametersSet(['email_notifications_enabled']) ? (bool)self::getParameter('email_notifications_enabled') : null;
|
|
$superuser_new_customer_email_notifications_enabled = self::isParametersSet([users_o::KEY_SUPERUSER_NEW_CUSTOMER_EMAIL_NOTIFICATIONS])
|
|
? (bool)self::getParameter(users_o::KEY_SUPERUSER_NEW_CUSTOMER_EMAIL_NOTIFICATIONS)
|
|
: null;
|
|
/**
|
|
* Wash Certificate Email
|
|
*/
|
|
if ($wash_certificate_email !== null) {
|
|
self::requireMinLength('wash_certificate_email', 5);
|
|
self::requireMaxLength('wash_certificate_email', 255);
|
|
self::requireType($wash_certificate_email, self::type_string());
|
|
if (!filter_var($wash_certificate_email, FILTER_VALIDATE_EMAIL)) {
|
|
(new logs_o())->add('user_notifications', 'global', 0, $user->id, 'USER_NOTIFICATIONS_UPDATE', 'Invalid wash certificate email');
|
|
$response->error('Invalid wash certificate email', 400);
|
|
}
|
|
$user->wash_certificate_email->set((string)$wash_certificate_email);
|
|
}
|
|
/**
|
|
* SMS Notifications Enabled
|
|
*/
|
|
if ($sms_notifications_enabled !== null) {
|
|
self::requireType($sms_notifications_enabled, self::type_bool());
|
|
$user->sms_notifications_enabled->set($sms_notifications_enabled ? 1 : 0);
|
|
}
|
|
/**
|
|
* Email Notifications Enabled
|
|
*/
|
|
if ($email_notifications_enabled !== null) {
|
|
self::requireType($email_notifications_enabled, self::type_bool());
|
|
$user->email_notifications_enabled->set($email_notifications_enabled ? 1 : 0);
|
|
}
|
|
/**
|
|
* Superuser New Customer Email Notifications Enabled
|
|
*/
|
|
if ($superuser_new_customer_email_notifications_enabled !== null) {
|
|
$this->requirePermission('superuser');
|
|
self::requireType($superuser_new_customer_email_notifications_enabled, self::type_bool());
|
|
$user->setSuperuserNewCustomerEmailNotificationsEnabled($superuser_new_customer_email_notifications_enabled);
|
|
}
|
|
$token = str_replace('Bearer ', '', (string)($_SERVER['HTTP_AUTHORIZATION'] ?? ''));
|
|
if ($token !== '') {
|
|
try {
|
|
redis->clear_auth_session($token);
|
|
} catch (\Throwable) {
|
|
// Session cache invalidation is best-effort; the persistent update above is authoritative.
|
|
}
|
|
}
|
|
// Log the update
|
|
(new logs_o())->add('user_notifications', 'global', 0, $user->id, 'USER_NOTIFICATIONS_UPDATE', 'User notification settings updated');
|
|
// Return success
|
|
$response->success(['message' => 'User notification settings updated']);
|
|
},
|
|
[
|
|
'user_notifications_update' => 'Update user notification settings',
|
|
]
|
|
);
|
|
}
|
|
}
|