nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1) user invitation 2) app access control 3) txn quota guard

Browse Source
This commit is contained in:
Thanakorn S
2026-05-21 11:42:47 +07:00
parent 8ec2e89f79
commit 6eeebfeacb
50 changed files with 1062 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/assets/utils/classes/UserManager.php
+166 -32
View File
@@ -118,9 +118,10 @@ class UserManager {
public function getCompanyAccess(int $company_id): ?array
{
$sth = $this->pdo->prepare(
"SELECT company_id, role
FROM company_map_user
WHERE company_id = :company_id AND user_id = :user_id
"SELECT m.company_id, m.role, m.app_access, u.license, u.app_access AS user_app_access
FROM company_map_user m
JOIN user u ON u.user_id = m.user_id
WHERE m.company_id = :company_id AND m.user_id = :user_id
LIMIT 1"
);
$sth->execute([':company_id' => $company_id, ':user_id' => $this->user_id]);
@@ -146,13 +147,16 @@ class UserManager {
"SELECT
m.map_id,
m.role,
CASE WHEN u.license = 'owner' THEN u.app_access ELSE m.app_access END AS app_access,
m.created_at,
u.user_id,
u.username,
u.name,
u.surname,
u.email,
u.profile_picture
u.profile_picture,
u.status,
(m.invite_token IS NOT NULL) AS is_pending_invite
FROM company_map_user m
JOIN user u ON u.user_id = m.user_id
WHERE m.company_id = :company_id
@@ -194,17 +198,18 @@ class UserManager {
}
/**
* Add a registered user to the current company by email.
* Add a user to the current company by email.
*
* Validates email format, role, and that the target account exists.
* Blocks inviting self or someone already mapped to the company.
* If the email is already registered: maps them to this company directly.
* If the email is not registered: creates a pending account (license='user',
* default_company = this company) and returns an invite token so the caller
* can email them a link to invited_onboarding.php to complete registration.
* The invited user inherits this company's SMTP for OTP login.
*
* @param string $email Email address of the user to invite.
* @param string $role Role to assign: 'admin', 'staff', or 'viewer'.
* @return string The invited user's email, for use in the success message.
* @return array ['new_user' => bool, 'email' => string, 'token' => string|null]
* @throws Exception On any validation or constraint failure.
*/
public function inviteUser(string $email, string $role): string {
public function inviteUser(string $email, string $role, string $app_access): array {
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
throw new Exception('Invalid email address.');
}
@@ -220,36 +225,114 @@ class UserManager {
$sth->execute([':email' => $email]);
$target = $sth->fetch(PDO::FETCH_ASSOC);
if (!$target) {
throw new Exception('No registered account found with that email address.');
if ($target) {
$target_user_id = (int)$target['user_id'];
if ($target_user_id === $this->user_id) {
throw new Exception('You cannot invite yourself.');
}
$sth = $this->pdo->prepare(
"SELECT map_id FROM company_map_user
WHERE company_id = :company_id AND user_id = :user_id
LIMIT 1"
);
$sth->execute([':company_id' => $this->company_id, ':user_id' => $target_user_id]);
if ($sth->fetch()) {
throw new Exception('This user is already a member of your company.');
}
$this->pdo->prepare(
"INSERT INTO company_map_user (company_id, user_id, role, app_access, created_at)
VALUES (:company_id, :user_id, :role, :app_access, NOW())"
)->execute([
':company_id' => $this->company_id,
':user_id' => $target_user_id,
':role' => $role,
':app_access' => $app_access,
]);
return ['new_user' => false, 'email' => $target['email'], 'token' => null];
}
$target_user_id = (int)$target['user_id'];
if ($target_user_id === $this->user_id) {
throw new Exception('You cannot invite yourself.');
}
$sth = $this->pdo->prepare(
"SELECT map_id FROM company_map_user
WHERE company_id = :company_id AND user_id = :user_id
LIMIT 1"
);
$sth->execute([':company_id' => $this->company_id, ':user_id' => $target_user_id]);
if ($sth->fetch()) {
throw new Exception('This user is already a member of your company.');
}
// Email not in system — create a pending invited account
$invite_token = bin2hex(random_bytes(32));
$expires_at = date('Y-m-d H:i:s', strtotime('+7 days'));
$temp_username = 'invited_' . bin2hex(random_bytes(8));
$this->pdo->prepare(
"INSERT INTO company_map_user (company_id, user_id, role, created_at)
VALUES (:company_id, :user_id, :role, NOW())"
"INSERT INTO user
(username, name, surname, email, password, status, license, default_company,
profile_picture, verify_token, verify_expires_at)
VALUES
(:username, '', '', :email, '', 'pending', 'user', :default_company,
'', :token, :expires)"
)->execute([
':username' => $temp_username,
':email' => $email,
':default_company' => $this->company_id,
':token' => $invite_token,
':expires' => $expires_at,
]);
$new_user_id = (int)$this->pdo->lastInsertId();
$this->pdo->prepare(
"INSERT INTO company_map_user (company_id, user_id, role, app_access, invite_token, created_at)
VALUES (:company_id, :user_id, :role, :app_access, :token, NOW())"
)->execute([
':company_id' => $this->company_id,
':user_id' => $target_user_id,
':user_id' => $new_user_id,
':role' => $role,
':app_access' => $app_access,
':token' => $invite_token,
]);
return $target['email'];
return ['new_user' => true, 'email' => $email, 'token' => $invite_token];
}
/**
* Regenerate an invite token for a pending invited user and return it.
*
* Only works on license='user' + status='pending' accounts that still have
* an invite_token in company_map_user. Owner-pending accounts (mid-onboarding)
* are never touched.
*
* @param int $map_id The company_map_user.map_id of the pending member.
* @return array ['email' => string, 'token' => string]
* @throws Exception If the member is not found or is not a pending invite.
*/
public function resendInvite(int $map_id): array {
if (!$map_id) throw new Exception('Invalid request.');
$sth = $this->pdo->prepare(
"SELECT u.user_id, u.email, u.status, u.license, m.invite_token
FROM company_map_user m
JOIN user u ON u.user_id = m.user_id
WHERE m.map_id = :map_id AND m.company_id = :company_id
LIMIT 1"
);
$sth->execute([':map_id' => $map_id, ':company_id' => $this->company_id]);
$row = $sth->fetch(PDO::FETCH_ASSOC);
if (!$row) throw new Exception('User not found.');
if ($row['license'] !== 'user') throw new Exception('Cannot resend invite to an owner account.');
if ($row['status'] !== 'pending') throw new Exception('User has already accepted the invitation.');
if (!$row['invite_token']) throw new Exception('No pending invitation found for this user.');
$new_token = bin2hex(random_bytes(32));
$expires_at = date('Y-m-d H:i:s', strtotime('+7 days'));
$this->pdo->prepare(
"UPDATE user SET verify_token = :token, verify_expires_at = :expires
WHERE user_id = :uid"
)->execute([':token' => $new_token, ':expires' => $expires_at, ':uid' => (int)$row['user_id']]);
$this->pdo->prepare(
"UPDATE company_map_user SET invite_token = :token
WHERE map_id = :map_id AND company_id = :company_id"
)->execute([':token' => $new_token, ':map_id' => $map_id, ':company_id' => $this->company_id]);
return ['email' => $row['email'], 'token' => $new_token];
}
/**
@@ -290,6 +373,45 @@ class UserManager {
]);
}
/**
* Update the app_access of a non-owner company member.
*
* Owner's app_access is managed via user.app_access (their license); it
* cannot be changed here. Caller must have already validated the value is
* within the owner's license.
*
* @param int $map_id The company_map_user.map_id to update.
* @param string $app_access New value: 'wms', 'accounting', or 'all'.
* @throws Exception If the member is not found or is the owner.
*/
public function updateAppAccess(int $map_id, string $app_access): void {
if (!$map_id || $app_access === '') {
throw new Exception('Invalid request.');
}
$sth = $this->pdo->prepare(
"SELECT u.license FROM company_map_user m
JOIN user u ON u.user_id = m.user_id
WHERE m.map_id = :map_id AND m.company_id = :company_id
LIMIT 1"
);
$sth->execute([':map_id' => $map_id, ':company_id' => $this->company_id]);
$license = $sth->fetchColumn();
if ($license === false) throw new Exception('User not found.');
if ($license === 'owner') throw new Exception('Owner app access is determined by their license.');
$this->pdo->prepare(
"UPDATE company_map_user
SET app_access = :app_access
WHERE map_id = :map_id AND company_id = :company_id"
)->execute([
':app_access' => $app_access,
':map_id' => $map_id,
':company_id' => $this->company_id,
]);
}
/**
* Remove a user from the current company.
*
@@ -318,5 +440,17 @@ class UserManager {
"DELETE FROM company_map_user
WHERE map_id = :map_id AND company_id = :company_id"
)->execute([':map_id' => $map_id, ':company_id' => $this->company_id]);
// If this was a pending invited account that was never activated, delete
// the placeholder user row so the email is free for future invitations.
$sth = $this->pdo->prepare(
"SELECT license, status FROM user WHERE user_id = :uid LIMIT 1"
);
$sth->execute([':uid' => (int)$row['user_id']]);
$u = $sth->fetch(PDO::FETCH_ASSOC);
if ($u && $u['license'] === 'user' && $u['status'] === 'pending') {
$this->pdo->prepare("DELETE FROM user WHERE user_id = :uid")
->execute([':uid' => (int)$row['user_id']]);
}
}
}