← All changes | app/Http/Controllers/AgentController.php +8 -26 2.4.0 → 2.4.5 View file →

		@@ -10,14 +10,9 @@
10	10	use FluentSupport\App\Modules\PermissionManager;
11	11	use FluentSupport\App\Http\Requests\AgentCreateRequest;
12	12
13	13	/**
14		- * AgentController class for REST API
15		- * This class is responsible for getting data for all request related to agent
16		- *
17		- * @package FluentSupport\App\Http\Controllers
18		- *
19		- * @version 1.0.0
	14	+ * Support staff (agent) endpoints.
20	15	*/
21	16	class AgentController extends Controller
22	17	{
23	18	public function index(Request $request, Agent $agent)
		@@ -29,9 +24,8 @@
29	24	];
30	25	}
31	26
32	27	/**
33		- * addAgent method will add new agent in person table
34	28	* @param AgentCreateRequest $request
35	29	* @return \WP_REST_Response | array
36	30	* @throws \FluentSupport\Framework\Validator\ValidationException
37	31	*/
		@@ -51,12 +45,11 @@
51	45	}
52	46	}
53	47
54	48	/**
55		- * updateAgent method will update the information of an exiting agent
56	49	* @param AgentCreateRequest $request
57	50	* @param Agent $agent
58		- * @param $agent_id
	51	+ * @param int $agent_id
59	52	* @return \WP_REST_Response | array
60	53	* @throws \FluentSupport\Framework\Validator\ValidationException
61	54	*/
62	55	public function updateAgent(AgentCreateRequest $request, Agent $agent, $agent_id)
		@@ -80,12 +73,13 @@
80	73	}
81	74	}
82	75
83	76	/**
84		- * deleteAgent will delete an exiting agent and add an alternative agent as replacement
	77	+ * The agent's tickets and data move to fallback_agent_id.
	78	+ *
85	79	* @param Request $request
86	80	* @param Agent $agent
87		- * @param $agent_id
	81	+ * @param int $agent_id
88	82	* @return \WP_REST_Response | array
89	83	* @throws \FluentSupport\Framework\Validator\ValidationException
90	84	*/
91	85	public function deleteAgent(Request $request, Agent $agent, $agent_id)
		@@ -108,13 +102,11 @@
108	102	* @return \WP_REST_Response | array
109	103	*/
110	104	public function myStats(Request $request)
111	105	{
112		- // Get logged in agent information.
113	106	$agent = Helper::getAgentByUserId();
114	107
115	108	try {
116		- // Get ticket statistics.
117	109	$stats = StatModule::getAgentStat($agent->id);
118	110	$with = $request->get('with', []);
119	111	$with = is_array($with) ? map_deep($with, 'sanitize_text_field') : [];
120	112
		@@ -149,10 +141,8 @@
149	141	return [];
150	142	}
151	143
152	144	/**
153		- * addOrUpdateProfileImage method will upload profile picture for a given agent id
154		- * For a successful upload it's required to send file object, agent id and the user type(agent)
155	145	* @param Request $request
156	146	* @param AvatarUploder $avatarUploder
157	147	* @return \WP_REST_Response | array
158	148	*/
		@@ -167,14 +157,11 @@
167	157	}
168	158	}
169	159
170	160	/**
171		- * resetAvatar method will restore a Support Staff avatar
172		- * For a successful upload it's required to send file object, Support Staff id and the user type(Support Staff)
	161	+ * No Agent type-hint: route-model binding runs before the policy, which would
	162	+ * let unauthenticated callers probe agent IDs. Resolve after auth.
173	163	*
174		- * No Agent type-hint here: route-model binding resolves inside the
175		- * permission callback, before any policy runs, which lets unauthenticated
176		- * callers probe agent ID existence (FS-PERM-001). Resolve after auth.
177	164	* @param int|string $agent
178	165	* @return array
179	166	*/
180	167	public function resetAvatar($agent)
		@@ -207,10 +194,8 @@
207	194	];
208	195	}
209	196
210	197	/**
211		- * Sanitize payload data for create/update operations.
212		- *
213	198	* @param AgentCreateRequest $request
214	199	* @param bool $includeEmail
215	200	* @return array
216	201	*/
		@@ -227,10 +212,9 @@
227	212	'restrictions' => $this->sanitizeRestrictions($request->get('restrictions')),
228	213	];
229	214
230	215	if ($request->has('agent_signature')) {
231		- // Already unslashed at the request boundary; sanitize only, so literal
232		- // backslashes in the signature survive.
	216	+ // Already unslashed by the request. Don't unslash again or literal backslashes are lost.
233	217	$data['agent_signature'] = wp_kses_post($request->get('agent_signature', ''));
234	218	}
235	219
236	220	if ($request->has('agent_signature_enabled')) {
		@@ -244,10 +228,8 @@
244	228	return $data;
245	229	}
246	230
247	231	/**
248		- * Sanitize restrictions data for agent
249		- *
250	232	* @param mixed $restrictions
251	233	* @return array
252	234	*/
253	235	private function sanitizeRestrictions($restrictions)