80 lines
2.4 KiB
PHP
80 lines
2.4 KiB
PHP
<?php
|
|
|
|
/**
|
|
* canvas class - Generic canvas API controller
|
|
*/
|
|
|
|
namespace Leantime\Domain\Api\Controllers;
|
|
|
|
use Leantime\Core\Auth\Permissions\RequiresPermission;
|
|
use Leantime\Core\Controller\Controller;
|
|
use Leantime\Domain\Blueprints\Permissions\BlueprintsPermissions;
|
|
use Leantime\Domain\Blueprints\Services\Blueprints as BlueprintsService;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* @TODO: Could this class be change to abstract? As it is a generic class that should never be initiated!
|
|
*/
|
|
class Canvas extends Controller
|
|
{
|
|
/**
|
|
* Constant that must be redefined
|
|
*/
|
|
protected const CANVAS_NAME = '??';
|
|
|
|
private BlueprintsService $blueprintsService;
|
|
|
|
/**
|
|
* init - initialize private variables
|
|
*/
|
|
public function init(): void
|
|
{
|
|
$this->blueprintsService = app()->make(BlueprintsService::class);
|
|
}
|
|
|
|
/**
|
|
* get - handle get requests
|
|
*/
|
|
public function get(array $params): Response
|
|
{
|
|
return $this->tpl->displayJson(['status' => 'Not implemented'], 501);
|
|
}
|
|
|
|
/**
|
|
* post - handle post requests
|
|
*/
|
|
public function post(array $params): Response
|
|
{
|
|
return $this->tpl->displayJson(['status' => 'Not implemented'], 501);
|
|
}
|
|
|
|
/**
|
|
* patch - handle patch requests with authorization check
|
|
*/
|
|
#[RequiresPermission(BlueprintsPermissions::EDIT, entityScoped: true)]
|
|
public function patch(array $params): Response
|
|
{
|
|
if (! isset($params['id'])) {
|
|
return $this->tpl->displayJson(['status' => 'failure'], 400);
|
|
}
|
|
|
|
// The service resolves the item's REAL project and authorizes EDIT against it (throwing
|
|
// 403 for a missing/foreign item or an insufficient role) before patching — replacing
|
|
// the previous membership-only check with the permission framework. A false return means
|
|
// no allowlisted columns were present (a client error, not a denial).
|
|
if ($this->blueprintsService->patchCanvasItem((int) $params['id'], $params, static::CANVAS_NAME.'canvas') === false) {
|
|
return $this->tpl->displayJson(['status' => 'no valid fields to update'], 400);
|
|
}
|
|
|
|
return $this->tpl->displayJson(['status' => 'ok']);
|
|
}
|
|
|
|
/**
|
|
* delete - handle delete requests
|
|
*/
|
|
public function delete(array $params): Response
|
|
{
|
|
return $this->tpl->displayJson(['status' => 'Not implemented'], 501);
|
|
}
|
|
}
|