OneBot: Leantime 改造版源码（BOM/Univer 表格/AI 接管/品牌替换等）

app/Domain/Blueprints/Controllers/ApiCanvas.php

@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Leantime\Domain\Blueprints\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Http\IncomingRequest;
+use Leantime\Core\UI\Template;
+use Leantime\Domain\Blueprints\Models\CanvasTemplate;
+use Leantime\Domain\Blueprints\Permissions\BlueprintsPermissions;
+use Leantime\Domain\Blueprints\Services\Blueprints as BlueprintsService;
+use Leantime\Domain\Blueprints\Services\TemplateRegistry;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * ApiCanvas controller - handles PATCH requests for inline canvas item updates.
+ *
+ * Provides the API endpoint used by the blueprintsController.js for inline
+ * status, relates, and user dropdown updates on the canvas board.
+ */
+class ApiCanvas
+{
+    private string $canvasSlug;
+
+    private ?CanvasTemplate $template;
+
+    /**
+     * __construct - resolve dependencies and determine the canvas slug from request.
+     *
+     * @param  IncomingRequest  $request  Incoming request
+     * @param  Template  $tpl  Template handler
+     * @param  BlueprintsService  $blueprintsService  Blueprints service (project-authorized item CRUD)
+     * @param  TemplateRegistry  $templateRegistry  Template registry
+     */
+    public function __construct(
+        private IncomingRequest $request,
+        private Template $tpl,
+        private BlueprintsService $blueprintsService,
+        TemplateRegistry $templateRegistry,
+    ) {
+        $this->canvasSlug = strip_tags((string) ($request->route('canvasSlug') ?? ''));
+        $this->template = $templateRegistry->get($this->canvasSlug);
+    }
+
+    /**
+     * patch - handle PATCH requests for inline canvas item updates.
+     *
+     * Supports updating status, relates, and author fields on individual
+     * canvas items via AJAX calls from the board view dropdowns.
+     */
+    #[RequiresPermission(BlueprintsPermissions::EDIT, entityScoped: true)]
+    public function patch(): Response
+    {
+        $data = $this->request->getRequestParams();
+
+        if ($this->template === null) {
+            return $this->tpl->displayJson(['status' => 'Unknown canvas type'], 404);
+        }
+
+        if (! isset($data['id'])) {
+            return $this->tpl->displayJson(['status' => 'failure'], 400);
+        }
+
+        // The service resolves the item's REAL project and authorizes EDIT against it before
+        // patching — closing the by-id cross-project mutation IDOR (a missing/foreign item or
+        // an insufficient role throws AuthorizationException -> 403). A false return means no
+        // allowlisted columns were present, which is a client error, not a denial.
+        if (! $this->blueprintsService->patchCanvasItem((int) $data['id'], $data, $this->template->getDatabaseType())) {
+            return $this->tpl->displayJson(['status' => 'no valid fields to update'], 400);
+        }
+
+        return $this->tpl->displayJson(['status' => 'ok']);
+    }
+}