OpenClaw
51a87655d6
Adds a scope-based access control layer to all 81 existing API routes. Sits alongside existing session-cookie auth (does not replace it). What this PR does: - Audits every existing route and documents required scope per route (see documentation/auth/route-scope-audit.md) - Adds classes/auth/scope.php with 10 scope constants and role→scope defaults - Adds classes/auth/scope_middleware.php with requireScope/requireAnyScope/requireRole - Applies require*() calls to all 81 existing routes - Adds ScopeMiddlewareTest (unit, 178 lines) and RouteScopeTest (integration, 212 lines) Coexistence note: This branch's classes/auth/scope.php is a stub that will be replaced by classes/auth/scope_registry.php (from TRU-145 / PR #396) when that PR merges first. The two have compatible APIs. Refs: TRU-149
31 lines
791 B
PHP
31 lines
791 B
PHP
<?php
|
|
|
|
namespace routes;
|
|
|
|
use traits\route_t;
|
|
|
|
use app\auth\Scope;
|
|
use app\auth\ScopeMiddleware;
|
|
|
|
class washCertificateRoute
|
|
{
|
|
use route_t;
|
|
|
|
public function run(): void
|
|
{
|
|
/** All bookings */
|
|
$this->get('/modules/washcertificates', function () {
|
|
ScopeMiddleware::requireScope(Scope::BOOKING_READ, '/modules/washcertificates');
|
|
// Set the working directory to /modules/washcertificates,
|
|
// so the output directory is created in the correct location
|
|
chdir(WD . '/modules/washcertificates');
|
|
// Run the index.php file
|
|
require_once 'index.php';
|
|
exit();
|
|
},
|
|
[
|
|
'modules_washcertificates' => 'Get all wash certificates'
|
|
]
|
|
);
|
|
}
|
|
} |