matthieu
e4fc34b90f
Backend: - Add MCP Serializer to centralize entity-to-array conversion (~300 lines deduped) - Fix race condition in task/ticket number generation (SELECT FOR UPDATE + transaction) - Add unique constraint on task (project_id, number) with migration - Fix MIME type validation: use server-detected finfo instead of client-supplied type - Add allowlist of permitted MIME types for uploads - Fix TaskDocumentDownloadController: allow ROLE_CLIENT access, add priority:1 - Fix notification sent even when ticket status unchanged - Remove redundant exception constructors - Simplify services (BookStackApi double fetch, TokenEncryptor, GiteaApi) - Consolidate duplicate checks in processors Frontend: - Fix useApi isHandlingUnauthorized scope (module-level to prevent double 401 redirect) - Fix client-tickets toast key copy-paste bug - Merge duplicated tasks service methods (getByProject + getByProjectArchived) - Extract shared uploadWithRelation helper in task-documents service - Extract formatFileSize utility from duplicated component code - Extract status transition logic into useClientTicketHelpers composable - Remove dead code (unused router, handleLogout, empty script blocks) - Merge duplicate watchers and onMounted calls - Normalize arrow functions to function declarations per convention Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
81 lines
2.5 KiB
PHP
81 lines
2.5 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\State;
|
|
|
|
use ApiPlatform\Metadata\Operation;
|
|
use ApiPlatform\State\ProviderInterface;
|
|
use App\Entity\ClientTicket;
|
|
use App\Entity\User;
|
|
use Doctrine\ORM\EntityManagerInterface;
|
|
use Symfony\Bundle\SecurityBundle\Security;
|
|
|
|
/**
|
|
* @implements ProviderInterface<ClientTicket>
|
|
*/
|
|
final readonly class ClientTicketProvider implements ProviderInterface
|
|
{
|
|
public function __construct(
|
|
private EntityManagerInterface $entityManager,
|
|
private Security $security,
|
|
) {}
|
|
|
|
public function provide(Operation $operation, array $uriVariables = [], array $context = []): array|ClientTicket|null
|
|
{
|
|
$user = $this->security->getUser();
|
|
assert($user instanceof User);
|
|
|
|
$repo = $this->entityManager->getRepository(ClientTicket::class);
|
|
|
|
// Single item
|
|
if (isset($uriVariables['id'])) {
|
|
$ticket = $repo->find($uriVariables['id']);
|
|
if (null === $ticket) {
|
|
return null;
|
|
}
|
|
if (!$this->security->isGranted('ROLE_ADMIN') && $ticket->getSubmittedBy() !== $user) {
|
|
return null;
|
|
}
|
|
|
|
return $ticket;
|
|
}
|
|
|
|
// Collection with manual filtering
|
|
$qb = $repo->createQueryBuilder('ct')
|
|
->orderBy('ct.createdAt', 'DESC')
|
|
;
|
|
|
|
// ROLE_CLIENT: only own tickets
|
|
if (!$this->security->isGranted('ROLE_ADMIN')) {
|
|
$qb->andWhere('ct.submittedBy = :user')->setParameter('user', $user);
|
|
}
|
|
|
|
// Apply filters from query parameters
|
|
$filters = $context['filters'] ?? [];
|
|
if (isset($filters['project'])) {
|
|
$qb->andWhere('ct.project = :project')
|
|
->setParameter('project', self::extractId($filters['project']))
|
|
;
|
|
}
|
|
if (isset($filters['status'])) {
|
|
$qb->andWhere('ct.status = :status')->setParameter('status', $filters['status']);
|
|
}
|
|
if (isset($filters['submittedBy']) && $this->security->isGranted('ROLE_ADMIN')) {
|
|
$qb->andWhere('ct.submittedBy = :submittedBy')
|
|
->setParameter('submittedBy', self::extractId($filters['submittedBy']))
|
|
;
|
|
}
|
|
|
|
return $qb->getQuery()->getResult();
|
|
}
|
|
|
|
/**
|
|
* Extract an entity ID from a value that may be a numeric ID or an IRI string.
|
|
*/
|
|
private static function extractId(string $value): int
|
|
{
|
|
return is_numeric($value) ? (int) $value : (int) basename($value);
|
|
}
|
|
}
|