diff --git a/addon/components/entity/card.hbs b/addon/components/entity/card.hbs index ccd63de5a..9defaf2d1 100644 --- a/addon/components/entity/card.hbs +++ b/addon/components/entity/card.hbs @@ -15,6 +15,7 @@
{{#if (has-block "footer")}} diff --git a/addon/components/modals/order-label.hbs b/addon/components/modals/order-label.hbs index 68126b76d..94f53f815 100644 --- a/addon/components/modals/order-label.hbs +++ b/addon/components/modals/order-label.hbs @@ -1,6 +1,6 @@
- +
{{t "modals.order-label.loading"}}
 diff --git a/addon/services/entity-actions.js b/addon/services/entity-actions.js index 29bacc098..318667f34 100644 --- a/addon/services/entity-actions.js +++ b/addon/services/entity-actions.js @@ -1,4 +1,6 @@ import ResourceActionService from '@fleetbase/ember-core/services/resource-action'; +import { action } from '@ember/object'; +import { debug } from '@ember/debug'; export default class EntityActionsService extends ResourceActionService { constructor() { @@ -38,4 +40,34 @@ export default class EntityActionsService extends ResourceActionService { }); }, }; + + @action async viewLabel(entity) { + // render dialog to display label within + this.modalsManager.show(`modals/order-label`, { + title: this.intl.t('order.fields.entity-label'), + modalClass: 'modal-xl', + acceptButtonText: this.intl.t('common.done'), + hideDeclineButton: true, + subject: entity, + }); + + try { + // load the pdf label from base64 + // eslint-disable-next-line no-undef + const fileReader = new FileReader(); + const { data: pdfStream } = await this.fetch.get(`orders/label/${entity.public_id}?format=base64`); + // eslint-disable-next-line no-undef + const base64 = await fetch(`data:application/pdf;base64,${pdfStream}`); + const blob = await base64.blob(); + // load into file reader + fileReader.onload = (event) => { + const data = event.target.result; + this.modalsManager.setOption('data', data); + }; + fileReader.readAsDataURL(blob); + } catch (err) { + this.notifications.error(this.intl.t('order.prompts.failed-to-load-entity-label')); + debug('Error loading entity label data: ' + err.message); + } + } } diff --git a/server/src/Http/Controllers/Api/v1/LabelController.php b/server/src/Http/Controllers/Api/v1/LabelController.php index 82b653f02..f2a8a16ca 100644 --- a/server/src/Http/Controllers/Api/v1/LabelController.php +++ b/server/src/Http/Controllers/Api/v1/LabelController.php @@ -49,18 +49,42 @@ protected function findLabelSubject(?string $type, string $publicId): mixed { switch ($type) { case 'order': - return Order::where('public_id', $publicId)->orWhere('uuid', $publicId)->withoutGlobalScopes()->first(); + return $this->findLabelSubjectFor(Order::class, $publicId); case 'waypoint': - return Waypoint::where('public_id', $publicId)->orWhere('uuid', $publicId)->withoutGlobalScopes()->first(); + return $this->findLabelSubjectFor(Waypoint::class, $publicId); case 'entity': - return Entity::where('public_id', $publicId)->orWhere('uuid', $publicId)->withoutGlobalScopes()->first(); + return $this->findLabelSubjectFor(Entity::class, $publicId); } return null; } + /** + * Resolves a label subject by public id or uuid, constrained to the current company. + * + * The identifier match is grouped so the company constraint applies to both arms — + * without the closure it would read as `public_id = ? OR (uuid = ? AND company_uuid = ?)` + * and leak labels across organizations. + */ + protected function findLabelSubjectFor(string $model, string $publicId): mixed + { + $companyUuid = $this->sessionCompany(); + if (!$companyUuid) { + return null; + } + + return $model::where(function ($query) use ($publicId) { + $query->where('public_id', $publicId)->orWhere('uuid', $publicId); + })->where('company_uuid', $companyUuid)->withoutGlobalScopes()->first(); + } + + protected function sessionCompany(): ?string + { + return session('company'); + } + protected function apiError(string $message) { return response()->apiError($message); diff --git a/server/src/Http/Controllers/Internal/v1/OrderController.php b/server/src/Http/Controllers/Internal/v1/OrderController.php index 551b1e554..25462c2be 100644 --- a/server/src/Http/Controllers/Internal/v1/OrderController.php +++ b/server/src/Http/Controllers/Internal/v1/OrderController.php @@ -1608,17 +1608,41 @@ protected function makeTextResponse(string $text) protected function findOrderLabelSubject(string $id): ?Order { - return Order::where('public_id', $id)->orWhere('uuid', $id)->withoutGlobalScopes()->first(); + return $this->findLabelSubjectFor(Order::class, $id); } protected function findWaypointLabelSubject(string $id): ?Waypoint { - return Waypoint::where('public_id', $id)->orWhere('uuid', $id)->withoutGlobalScopes()->first(); + return $this->findLabelSubjectFor(Waypoint::class, $id); } protected function findEntityLabelSubject(string $id): ?Entity { - return Entity::where('public_id', $id)->orWhere('uuid', $id)->withoutGlobalScopes()->first(); + return $this->findLabelSubjectFor(Entity::class, $id); + } + + /** + * Resolves a label subject by public id or uuid, constrained to the current company. + * + * The identifier match is grouped so the company constraint applies to both arms — + * without the closure it would read as `public_id = ? OR (uuid = ? AND company_uuid = ?)` + * and leak labels across organizations. + */ + protected function findLabelSubjectFor(string $model, string $id): mixed + { + $companyUuid = $this->sessionCompany(); + if (!$companyUuid) { + return null; + } + + return $model::where(function ($query) use ($id) { + $query->where('public_id', $id)->orWhere('uuid', $id); + })->where('company_uuid', $companyUuid)->withoutGlobalScopes()->first(); + } + + protected function sessionCompany(): ?string + { + return session('company'); } /** diff --git a/server/tests/Feature/Http/Api/LabelControllerSubjectsTest.php b/server/tests/Feature/Http/Api/LabelControllerSubjectsTest.php index c5a2c656e..906172835 100644 --- a/server/tests/Feature/Http/Api/LabelControllerSubjectsTest.php +++ b/server/tests/Feature/Http/Api/LabelControllerSubjectsTest.php @@ -101,3 +101,48 @@ public function __call($method, $arguments) expect($response->getData(true))->toBe(['error' => 'Unable to render label.']); }); + +test('label subject resolution refuses subjects belonging to another company', function () { + $connection = fleetopsLabelControllerBoot(); + $connection->table('orders')->insert(['uuid' => 'order-1', 'public_id' => 'order_test', 'company_uuid' => 'company-2']); + $connection->table('waypoints')->insert(['uuid' => 'waypoint-1', 'public_id' => 'waypoint_test', 'company_uuid' => 'company-2']); + $connection->table('entities')->insert(['uuid' => 'entity-1', 'public_id' => 'entity_test', 'company_uuid' => 'company-2']); + + $probe = new FleetOpsLabelControllerProbe(); + + expect($probe->callProtected('findLabelSubject', 'order', 'order_test'))->toBeNull() + ->and($probe->callProtected('findLabelSubject', 'waypoint', 'waypoint_test'))->toBeNull() + ->and($probe->callProtected('findLabelSubject', 'entity', 'entity_test'))->toBeNull(); +}); + +test('label subject resolution scopes both identifier arms to the company', function () { + $connection = fleetopsLabelControllerBoot(); + // Guards the `where(public_id)->orWhere(uuid)->where(company_uuid)` precedence trap: without + // grouping the identifier match, a foreign public_id hit bypasses the company constraint. + $connection->table('entities')->insert(['uuid' => 'entity-1', 'public_id' => 'entity_public', 'company_uuid' => 'company-2']); + $connection->table('entities')->insert(['uuid' => 'entity_uuid_only', 'public_id' => 'entity_other', 'company_uuid' => 'company-2']); + + $probe = new FleetOpsLabelControllerProbe(); + + expect($probe->callProtected('findLabelSubject', 'entity', 'entity_public'))->toBeNull() + ->and($probe->callProtected('findLabelSubject', 'entity', 'entity_uuid_only'))->toBeNull(); +}); + +test('label subject resolution fails closed without a company session', function () { + $connection = fleetopsLabelControllerBoot(); + $connection->table('entities')->insert(['uuid' => 'entity-1', 'public_id' => 'entity_test', 'company_uuid' => 'company-1']); + session(['company' => null]); + + $probe = new FleetOpsLabelControllerProbe(); + + expect($probe->callProtected('findLabelSubject', 'entity', 'entity_test'))->toBeNull(); +}); + +test('get label refuses to render a label owned by another company', function () { + $connection = fleetopsLabelControllerBoot(); + $connection->table('entities')->insert(['uuid' => 'entity-1', 'public_id' => 'entity_test', 'company_uuid' => 'company-2']); + + $response = (new LabelController())->getLabel('entity_test', Illuminate\Http\Request::create('/x', 'GET')); + + expect($response->getData(true))->toBe(['error' => 'Unable to render label.']); +}); diff --git a/server/tests/Feature/Http/Internal/OrderControllerHelperSeamsTest.php b/server/tests/Feature/Http/Internal/OrderControllerHelperSeamsTest.php index 4272ae8b3..b5cd5b689 100644 --- a/server/tests/Feature/Http/Internal/OrderControllerHelperSeamsTest.php +++ b/server/tests/Feature/Http/Internal/OrderControllerHelperSeamsTest.php @@ -176,6 +176,35 @@ function fleetopsOrderHelperSeed(SQLiteConnection $connection): void ->and($probe->callHelper('findEntityLabelSubject', 'entity_helper1')?->uuid)->toBe('44444444-4444-4444-8444-444444444431'); }); +test('label lookup helpers refuse subjects from another company', function () { + $connection = fleetopsOrderHelperBoot(); + fleetopsOrderHelperSeed($connection); + $connection->table('orders')->where('public_id', 'order_helper1')->update(['company_uuid' => 'company-2']); + $connection->table('waypoints')->where('public_id', 'waypoint_helper1')->update(['company_uuid' => 'company-2']); + $connection->table('entities')->where('public_id', 'entity_helper1')->update(['company_uuid' => 'company-2']); + + $probe = new FleetOpsInternalOrderHelperProbe(); + + // Also covers the identifier-precedence trap: an unguarded + // `where(public_id)->orWhere(uuid)->where(company_uuid)` chain would still resolve these. + expect($probe->callHelper('findOrderLabelSubject', 'order_helper1'))->toBeNull() + ->and($probe->callHelper('findOrderLabelSubject', '44444444-4444-4444-8444-444444444401'))->toBeNull() + ->and($probe->callHelper('findWaypointLabelSubject', 'waypoint_helper1'))->toBeNull() + ->and($probe->callHelper('findEntityLabelSubject', 'entity_helper1'))->toBeNull(); +}); + +test('label lookup helpers fail closed without a company session', function () { + $connection = fleetopsOrderHelperBoot(); + fleetopsOrderHelperSeed($connection); + session(['company' => null]); + + $probe = new FleetOpsInternalOrderHelperProbe(); + + expect($probe->callHelper('findOrderLabelSubject', 'order_helper1'))->toBeNull() + ->and($probe->callHelper('findWaypointLabelSubject', 'waypoint_helper1'))->toBeNull() + ->and($probe->callHelper('findEntityLabelSubject', 'entity_helper1'))->toBeNull(); +}); + test('bulk assignment transaction and response helpers persist and wrap', function () { $connection = fleetopsOrderHelperBoot(); fleetopsOrderHelperSeed($connection); diff --git a/translations/bg-bg.yaml b/translations/bg-bg.yaml index d3fd31eab..b846e71d6 100644 --- a/translations/bg-bg.yaml +++ b/translations/bg-bg.yaml @@ -696,6 +696,7 @@ order: order-metadata: Метаданни на поръчката order-label: Етикет на поръчката waypoint-label: Етикет на междинната точка + entity-label: Етикет на единицата current-eta: Текущо очаквано време на пристигане ect: ECT current-destination: Текуща дестинация @@ -712,6 +713,7 @@ order: no-driver-assigned-error: Няма назначен шофьор за тази поръчка. failed-to-load-order-label: Неуспешно зареждане на етикета на поръчката. failed-to-load-waypoint-label: Неуспешно зареждане на етикета на точката. + failed-to-load-entity-label: Неуспешно зареждане на етикета на единицата. unable-to-add-entity: Не може да се добави нов обект към поръчката. assign-driver-success: Шофьорът ({driverName}) е назначен за поръчка {orderId}. cancel-title: Сигурни ли сте, че искате да отмените тази поръчка? diff --git a/translations/en-us.yaml b/translations/en-us.yaml index bd27d73a3..f67d0ab61 100644 --- a/translations/en-us.yaml +++ b/translations/en-us.yaml @@ -727,6 +727,7 @@ order: order-metadata: Order Metadata order-label: Order Label waypoint-label: Waypoint Label + entity-label: Entity Label current-eta: Current ETA ect: ECT current-destination: Current Destination @@ -743,6 +744,7 @@ order: no-driver-assigned-error: No driver assigned to this order. failed-to-load-order-label: Failed to load order label. failed-to-load-waypoint-label: Failed to load waypoint label. + failed-to-load-entity-label: Failed to load entity label. unable-to-add-entity: Unable to add new entity to order. assign-driver-success: Driver ({driverName}) has been assigned to order {orderId}. cancel-title: Are you sure you wish to cancel this order? diff --git a/translations/es-pa.yaml b/translations/es-pa.yaml index f0b1fa553..6c6865d3c 100644 --- a/translations/es-pa.yaml +++ b/translations/es-pa.yaml @@ -670,6 +670,7 @@ order: order-metadata: Metadatos del pedido order-label: Etiqueta de pedido waypoint-label: Etiqueta de punto de referencia + entity-label: Etiqueta de entidad current-eta: ETA actual ect: TEC current-destination: Destino actual @@ -686,6 +687,7 @@ order: no-driver-assigned-error: No hay ningún conductor asignado a este pedido. failed-to-load-order-label: No se pudo cargar la etiqueta del pedido. failed-to-load-waypoint-label: No se pudo cargar la etiqueta del waypoint. + failed-to-load-entity-label: No se pudo cargar la etiqueta de la entidad. unable-to-add-entity: No se puede agregar una nueva entidad al pedido. assign-driver-success: El conductor ({driverName}) ha sido asignado al pedido {orderId}. cancel-title: ¿Está seguro de que desea cancelar este pedido? diff --git a/translations/fr-fr.yaml b/translations/fr-fr.yaml index 76c62ab4d..578cdbfbd 100644 --- a/translations/fr-fr.yaml +++ b/translations/fr-fr.yaml @@ -704,6 +704,7 @@ order: order-metadata: Métadonnées de la commande order-label: Étiquette de la commande waypoint-label: Étiquette du point de passage + entity-label: Étiquette de l'entité current-eta: ETA actuel ect: ECT current-destination: Destination actuelle @@ -721,6 +722,7 @@ order: failed-to-load-order-label: Échec du chargement de l'étiquette de la commande. failed-to-load-waypoint-label: Échec du chargement de l'étiquette du point de passage. + failed-to-load-entity-label: Échec du chargement de l'étiquette de l'entité. unable-to-add-entity: Impossible d'ajouter une nouvelle entité à la commande. assign-driver-success: Le conducteur ({driverName}) a été assigné à la commande {orderId}. diff --git a/translations/mn-mn.yaml b/translations/mn-mn.yaml index 2bf7c0471..c85b21db9 100644 --- a/translations/mn-mn.yaml +++ b/translations/mn-mn.yaml @@ -692,6 +692,7 @@ order: order-metadata: Захиалгын мета өгөгдөл order-label: Захиалгын шошго waypoint-label: Замын цэгийн шошго + entity-label: Объектийн шошго current-eta: Одоогийн тооцоолсон хүрэх цаг ect: ECT current-destination: Одоогийн очих газар @@ -708,6 +709,7 @@ order: no-driver-assigned-error: Энэ захиалгад жолооч томилогдоогүй байна. failed-to-load-order-label: Захиалгын шошгыг ачааллахад алдаа гарлаа. failed-to-load-waypoint-label: Замын цэгийн шошгыг ачааллахад алдаа гарлаа. + failed-to-load-entity-label: Объектийн шошгыг ачааллахад алдаа гарлаа. unable-to-add-entity: Захиалгад шинэ объект нэмэх боломжгүй байна. assign-driver-success: Жолооч ({driverName}) захиалга {orderId}-д томилогдлоо. cancel-title: Та энэ захиалгыг цуцлахдаа итгэлтэй байна уу? diff --git a/translations/pt-br.yaml b/translations/pt-br.yaml index 418767f5d..208913d3c 100644 --- a/translations/pt-br.yaml +++ b/translations/pt-br.yaml @@ -695,6 +695,7 @@ order: order-metadata: Metadados do Pedido order-label: Etiqueta do Pedido waypoint-label: Etiqueta do Ponto de Passagem + entity-label: Etiqueta da Entidade current-eta: ETA Atual ect: ECT current-destination: Destino Atual @@ -711,6 +712,7 @@ order: no-driver-assigned-error: Nenhum motorista atribuído a este pedido. failed-to-load-order-label: Falha ao carregar o rótulo do pedido. failed-to-load-waypoint-label: Falha ao carregar o rótulo do ponto de passagem. + failed-to-load-entity-label: Falha ao carregar o rótulo da entidade. unable-to-add-entity: Não foi possível adicionar nova entidade ao pedido. assign-driver-success: O motorista ({driverName}) foi atribuído ao pedido {orderId}. cancel-title: Tem certeza de que deseja cancelar este pedido? diff --git a/translations/ru-ru.yaml b/translations/ru-ru.yaml index c610b7bc6..11703e38b 100644 --- a/translations/ru-ru.yaml +++ b/translations/ru-ru.yaml @@ -691,6 +691,7 @@ order: order-metadata: Метаданные заказа order-label: Этикетка заказа waypoint-label: Этикетка промежуточной точки + entity-label: Этикетка сущности current-eta: Текущее время прибытия ect: Ожидаемое время прибытия current-destination: Текущее место назначения @@ -707,6 +708,7 @@ order: no-driver-assigned-error: К этому заказу не назначен водитель. failed-to-load-order-label: Не удалось загрузить метку заказа. failed-to-load-waypoint-label: Не удалось загрузить метку контрольной точки. + failed-to-load-entity-label: Не удалось загрузить метку сущности. unable-to-add-entity: Невозможно добавить новый объект в заказ. assign-driver-success: Водитель ({driverName}) был назначен на заказ {orderId}. cancel-title: Вы уверены, что хотите отменить этот заказ?