Files
opensourcepos/app/Models/Module.php
T
objecttothis c701d21886 fix(sales): gate per-record endpoints behind reports_sales grant (#4627)
fix(sales): gate per-record endpoints behind reports_sales grant (REDACTED)

Cashiers holding only the base `sales` grant could reach per-sale endpoints
(getRow, getEdit, postSave, getReceipt, getInvoice, getSendPdf, getSendReceipt)
that require `reports_sales`. getManage() enforced this at the list level, but
individual endpoints did not re-check. Regression tests added.

Auth:
- Introduce `IsLoggedIn` filter to centralize login checks across controllers
- Replace custom `AccessDeniedRedirectException` with built-in `RedirectException`

Employees:
- Add `DISALLOW_PASSWORD_CHANGE` and `DISALLOW_GRANT_CHANGE` env vars to restrict
  credential and permission changes in locked-down environments
- Extract `hasGrantsChanged()` to streamline `postSave`

Refactor:
- Rename snake_case variables to camelCase in Sales, Items, and Employees
  controllers for PSR-12 compliance
- Use explicit `db_connect()` for transaction clarity in Items controller

Fixes:
- SMTP config entries fall back to defaults via null coalescing
- Migration uses `DROP FOREIGN KEY` instead of `DROP CONSTRAINT`
- Password hash upgrade only sets session on successful `hash_version` update
- Correct lang key for unknown error in Module model

Language:
- Translate `error_grant_change_disallowed` / `error_password_change_disallowed`
  across all 44 supported locales with => alignment matching en reference
- Fix "cannot be deleted" messages and misc typos across ~15 language files

Tests:
- Bootstrap seeder only once in ItemsCsvImportTest; close connection after
- Restore `DISALLOW_GRANT_CHANGE` in teardown to prevent side effects
- Use `uniqid()` for test user data to avoid collisions

Signed-off-by: 17935339+objecttothis@users.noreply.github.com
2026-08-23 17:40:06 +04:00

162 lines
4.9 KiB
PHP

<?php
namespace App\Models;
use CodeIgniter\Database\ResultInterface;
use CodeIgniter\Model;
/**
* Module class
*/
class Module extends Model
{
protected $table = 'modules';
protected $primaryKey = 'module_id';
protected $useAutoIncrement = false;
protected $useSoftDeletes = false;
protected $allowedFields = [
'name_lang_key',
'desc_lang_key',
'sort'
];
/**
* @param string $module_id
* @return string
*/
public function get_module_name(string $module_id): string
{
$builder = $this->db->table('modules');
$query = $builder->getWhere(['module_id' => $module_id], 1);
if ($query->getNumRows() == 1) { // TODO: ===
$row = $query->getRow();
return lang('Module.' . $row->module_id);
}
return lang('Error.unknown');
}
/**
* @param string $module_id
* @return string
*/
public function get_module_desc(string $module_id): string // TODO: This method doesn't seem to be called in the code. Is it needed? Also, probably should change the name to get_module_description()
{
$builder = $this->db->table('modules');
$query = $builder->getWhere(['module_id' => $module_id], 1);
if ($query->getNumRows() == 1) { // TODO: ===
$row = $query->getRow();
return lang('Module.' . $row->module_id . '_desc');
}
return lang('Error.unknown');
}
/**
* @return ResultInterface
*/
public function get_all_permissions(): ResultInterface
{
$builder = $this->db->table('permissions');
return $builder->get();
}
/**
* @return ResultInterface
*/
public function get_all_subpermissions(): ResultInterface
{
$builder = $this->db->table('permissions');
$builder->join('modules AS modules', 'modules.module_id = permissions.module_id'); // TODO: can the table parameter just be modules instead of modules AS modules?
// Can't quote the parameters correctly when using different operators
$builder->where('modules.module_id != ', 'permission_id', false);
return $builder->get();
}
/**
* @return ResultInterface
*/
public function get_all_modules(): ResultInterface
{
$builder = $this->db->table('modules');
$builder->orderBy('sort', 'asc');
return $builder->get();
}
/**
* @param int $person_id
* @return ResultInterface
*/
public function get_allowed_home_modules(int $person_id): ResultInterface
{
$menus = ['home', 'both'];
$builder = $this->db->table('modules'); // TODO: this is duplicated with the code below... probably refactor a method and just pass through whether home/office modules are needed.
$builder->join('permissions', 'permissions.permission_id = modules.module_id');
$builder->join('grants', 'permissions.permission_id = grants.permission_id');
$builder->where('person_id', $person_id);
$builder->whereIn('menu_group', $menus);
$builder->where('sort !=', 0);
$builder->orderBy('sort', 'asc');
return $builder->get();
}
/**
* @param int $person_id
* @return ResultInterface
*/
public function get_allowed_office_modules(int $person_id): ResultInterface
{
$menus = ['office', 'both'];
$builder = $this->db->table('modules'); // TODO: Duplicated code
$builder->join('permissions', 'permissions.permission_id = modules.module_id');
$builder->join('grants', 'permissions.permission_id = grants.permission_id');
$builder->where('person_id', $person_id);
$builder->whereIn('menu_group', $menus);
$builder->where('sort !=', 0);
$builder->orderBy('sort', 'asc');
return $builder->get();
}
/**
* This method is used to set the show the office navigation icon on the home page
* which happens when the sort value is greater than zero
*/
public function set_show_office_group(bool $show_office_group): void // TODO: Should we return the value of update() as a bool for consistency?
{
if ($show_office_group) { // TODO: This should be replaced with ternary notation
$sort = 999;
} else {
$sort = 0;
}
$modules_data = ['sort' => $sort];
$builder = $this->db->table('modules');
$builder->where('module_id', 'office');
$builder->update($modules_data);
}
/**
* This method is used to show the office navigation icon on the home page
* which happens when the sort value is greater than zero
*/
public function get_show_office_group(): int
{
$builder = $this->db->table('modules');
$builder->select('sort');
$builder->where('module_id', 'office');
return $builder->get()->getRow()->sort;
}
}