Files
api/services/nginx/app/routes/vehiclePlateLookupRoute.php
T
Jeppe B ab6c3ba5b6 Fix route permission instance calls (#344)
## Root cause

`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:

`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`

## Changes

- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.

## Verification

- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree

## Delivery state

Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
2026-08-04 16:04:41 +02:00

110 lines
4.8 KiB
PHP

<?php
namespace routes;
use classes\authentication;
use objects\logs_o;
use objects\orders_o;
use traits\route_t;
class vehiclePlateLookupRoute
{
use route_t;
public function run(): void
{
$this->get(
'/department/license-plate/lookup',
function () {
// Require the user to be logged in
global $response;
$this->requirePermission('department_license_plate_lookup');
// Get the user object
$user = (new authentication())->get_user();
// Check if the request was successful
if ($user) {
$departmentScope = $this->limitedBackofficeDepartmentScope($user);
// Make sure the vehicle plate is set
if (!(string)$this->fromRequest('plate')) {
$response->error('Plate parameter is required', 400);
}
// Return the vehicle order history
$response->success(
(new orders_o())->get_vehicle_order_history(
$this->fromRequest('plate'),
$departmentScope
)
);
} else {
// Log the incident
(new logs_o())->add('orders', 'global', 1, 0, 'FETCH_VEHICLE_ORDER_HISTORY', 'No user found, or invalid session');
// Return an error
$response->error('Invalid session', 400);
}
},
[
'department_license_plate_lookup' => 'Departmental access to lookup a license plate and view the order history'
]
);
$this->get('/department/license-plate/customer-lookup', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('department_license_plate_lookup');
// Get the user object
$user = (new authentication())->get_user();
// Check if the request was successful
if ($user) {
$departmentScope = $this->limitedBackofficeDepartmentScope($user);
// Make sure the vehicle plate is set
self::requireParameters(['plate', 'customer_number', 'column']);
self::requireType((string)self::getParameter('plate'), 'string');
self::requireType((int)self::getParameter('customer_number'), self::type_int());
self::requireType((string)self::getParameter('column'), 'string');
self::requireMinLength('customer_number', 1);
self::requireMaxLength('customer_number', 10);
self::requireMinLength('plate', 0);
self::requireMaxLength('plate', 10);
// Make sure the column is allowed
$allowedColumns = ['reg_1', 'reg_2', 'reg_3'];
if (!in_array((string)self::getParameter('column'), $allowedColumns)) {
$response->error('Invalid column, allowed columns are: ' . implode(', ', $allowedColumns), 400);
}
if ($departmentScope === []) {
$response->success([]);
}
$filters = ['customer_id' => self::getParameter('customer_number')];
if ($departmentScope !== null) {
$filters['department_id'] = $departmentScope;
}
// Return the vehicle order history
$response->success(
(new orders_o())
->setSearchableFields(['customer_id', (string)self::getParameter('column'), 'created_at'])
->listObjectsWithPagination(
1,
10,
(string)self::getParameter('plate'),
$filters,
['created_at' => 'DESC'],
function ($order) {
return [
'registration_number' => $order[(string)self::getParameter('column')], // Get the registration number
];
}
)
);
} else {
// Log the incident
(new logs_o())->add('orders', 'global', 1, 0, 'FETCH_VEHICLE_ORDER_HISTORY', 'No user found, or invalid session');
// Return an error
$response->error('Invalid session', 400);
}
},
[
'department_license_plate_lookup' => 'List all the records for a specific customer number and registration number column in the orders table'
]
);
}
}