From 17a62e50e4f5446df8b3aa09c11b2b1478e9a5ba Mon Sep 17 00:00:00 2001
From: Thanakorn S <ts_nok@hotmail.com>
Date: Wed, 27 May 2026 09:19:52 +0700
Subject: [PATCH] add missing roleGuards

---
 app/accounting/api/engine/account_stats.php    | 3 +++
 app/accounting/api/engine/department_stats.php | 3 +++
 app/contact/api/engine/contact_stats.php       | 3 +++
 app/ics/api/engine_report/product_stats.php    | 3 +++
 app/ics/api/engine_report/warehouse_stats.php  | 3 +++
 app/inventory/api/engine/product_stats.php     | 3 +++
 app/inventory/api/engine/warehouse_stats.php   | 3 +++
 7 files changed, 21 insertions(+)

diff --git a/app/accounting/api/engine/account_stats.php b/app/accounting/api/engine/account_stats.php
index 6be7eb3..84af1e7 100644
--- a/app/accounting/api/engine/account_stats.php
+++ b/app/accounting/api/engine/account_stats.php
@@ -1,8 +1,11 @@
 <?php
 session_start();
 require_once '../../../assets/utils/db_auth.php';
+require_once '../../../assets/utils/classes/UsageGuard.php';
 require_once '../../../assets/utils/classes_ac/ChartOfAccounts.php';
 
+(new UsageGuard($pdo1, $company_id, $packages))->assertFeatureAccessible('dashboard');
+
 $coa = new ChartOfAccounts($pdo2, $company_id);
 $stats = $coa->getStats();
 $answer = array_merge(['success' => 1], $stats);
diff --git a/app/accounting/api/engine/department_stats.php b/app/accounting/api/engine/department_stats.php
index d2b421a..0e5129e 100644
--- a/app/accounting/api/engine/department_stats.php
+++ b/app/accounting/api/engine/department_stats.php
@@ -1,8 +1,11 @@
 <?php
 session_start();
 require_once '../../../assets/utils/db_auth.php';
+require_once '../../../assets/utils/classes/UsageGuard.php';
 require_once '../../../assets/utils/classes_ac/DepartmentManager.php';
 
+(new UsageGuard($pdo1, $company_id, $packages))->assertFeatureAccessible('dashboard');
+
 $dept   = new DepartmentManager($pdo2, $company_id);
 $stats  = $dept->getStats();
 $answer = array_merge(['success' => 1], $stats);
diff --git a/app/contact/api/engine/contact_stats.php b/app/contact/api/engine/contact_stats.php
index a08477e..4be20ec 100644
--- a/app/contact/api/engine/contact_stats.php
+++ b/app/contact/api/engine/contact_stats.php
@@ -2,8 +2,11 @@
     session_start();
 
     require_once '../../../assets/utils/db_auth.php';
+    require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
 
+    (new UsageGuard($pdo1, $company_id, $packages))->assertFeatureAccessible('dashboard');
+
     $report = new ReportManager($pdo2, $company_id);
 
     $answer["total_category"]    = $report->getTotalContactCategory();
diff --git a/app/ics/api/engine_report/product_stats.php b/app/ics/api/engine_report/product_stats.php
index 1fa8b04..5f9e62d 100644
--- a/app/ics/api/engine_report/product_stats.php
+++ b/app/ics/api/engine_report/product_stats.php
@@ -2,8 +2,11 @@
     session_start();
 
     require_once '../../../assets/utils/db_auth.php';
+    require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
 
+    (new UsageGuard($pdo1, $company_id, $packages))->assertFeatureAccessible('reports');
+
     $report = new ReportManager($pdo2, $company_id);
 
     $answer["low_stock"]     = $report->getLowStockCount();
diff --git a/app/ics/api/engine_report/warehouse_stats.php b/app/ics/api/engine_report/warehouse_stats.php
index 0415372..3c5014c 100644
--- a/app/ics/api/engine_report/warehouse_stats.php
+++ b/app/ics/api/engine_report/warehouse_stats.php
@@ -2,8 +2,11 @@
     session_start();
 
     require_once '../../../assets/utils/db_auth.php';
+    require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
 
+    (new UsageGuard($pdo1, $company_id, $packages))->assertFeatureAccessible('reports');
+
     $report = new ReportManager($pdo2, $company_id);
 
     $answer["total_capacity"]  = $report->getTotalCapacity();
diff --git a/app/inventory/api/engine/product_stats.php b/app/inventory/api/engine/product_stats.php
index 9daf0b4..8fbe8a1 100644
--- a/app/inventory/api/engine/product_stats.php
+++ b/app/inventory/api/engine/product_stats.php
@@ -2,8 +2,11 @@
     session_start();
 
     require_once '../../../assets/utils/db_auth.php';
+    require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
 
+    (new UsageGuard($pdo1, $company_id, $packages))->assertFeatureAccessible('dashboard');
+
     $report = new ReportManager($pdo2, $company_id);
 
     $answer["total_category"]   = $report->getTotalCategory();
diff --git a/app/inventory/api/engine/warehouse_stats.php b/app/inventory/api/engine/warehouse_stats.php
index 47aca07..7c63745 100644
--- a/app/inventory/api/engine/warehouse_stats.php
+++ b/app/inventory/api/engine/warehouse_stats.php
@@ -2,8 +2,11 @@
     session_start();
 
     require_once '../../../assets/utils/db_auth.php';
+    require_once '../../../assets/utils/classes/UsageGuard.php';
     require_once '../../../assets/utils/classes/ReportManager.php';
 
+    (new UsageGuard($pdo1, $company_id, $packages))->assertFeatureAccessible('dashboard');
+
     $report = new ReportManager($pdo2, $company_id);
 
     $answer["total_warehouse"] = $report->getTotalWarehouse();