From 4c532deb4d2139baec5ce2f95eedc55ce29317cc Mon Sep 17 00:00:00 2001
From: Omair Saleh <uldvstar@gmail.com>
Date: Tue, 28 Nov 2023 22:44:36 +0800
Subject: [PATCH 1/2] debug yd address update

---
 .../Modules/Orders/Processors/UpdateDoFromYDPortalProcessor.php  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/Classes/Modules/Orders/Processors/UpdateDoFromYDPortalProcessor.php b/app/Classes/Modules/Orders/Processors/UpdateDoFromYDPortalProcessor.php
index efcfd697..2273e10b 100644
--- a/app/Classes/Modules/Orders/Processors/UpdateDoFromYDPortalProcessor.php
+++ b/app/Classes/Modules/Orders/Processors/UpdateDoFromYDPortalProcessor.php
@@ -72,6 +72,7 @@ class UpdateDoFromYDPortalProcessor
 
 
         } catch (\Exception $exception){
+            log::debug($exception);
             throw new InternalServerErrorException('failed to approve address due to an error related to YD portal');
         }
     }

From 77bd84f61bc4dca41a2b5577df0d928e14b20a34 Mon Sep 17 00:00:00 2001
From: Dillon Ngo <dillonngoweijoon@gmail.com>
Date: Sun, 3 Dec 2023 00:56:42 +0800
Subject: [PATCH 2/2] Implement authorization checking for external api user
 using api key

---
 .../ProcessWePostNotificationLogic.php        | 12 ++++-
 .../WePostProcessNotificationObject.php       | 30 ++++++++++++
 .../Rules/CanProcessWePostNotification.php    | 46 +++++++++++++++++++
 routes/apipub.php                             |  1 +
 4 files changed, 88 insertions(+), 1 deletion(-)
 create mode 100644 app/Classes/Modules/WePost/DataTransferObjects/WePostProcessNotificationObject.php
 create mode 100644 app/Classes/Modules/WePost/Standards/Rules/CanProcessWePostNotification.php

diff --git a/app/Classes/Modules/WePost/ControllersLogic/ProcessWePostNotificationLogic.php b/app/Classes/Modules/WePost/ControllersLogic/ProcessWePostNotificationLogic.php
index 3fa2c6a5..39c42267 100644
--- a/app/Classes/Modules/WePost/ControllersLogic/ProcessWePostNotificationLogic.php
+++ b/app/Classes/Modules/WePost/ControllersLogic/ProcessWePostNotificationLogic.php
@@ -5,6 +5,8 @@ namespace App\Classes\Modules\WePost\ControllersLogic;
 use App\Classes\General\Abstracts\AbstractControllerLogic;
 use App\Classes\Modules\WePost\Services\CreatesWePostNotification;
 use App\Classes\Modules\WePost\DataTransferObjects\WePostNotificationObject;
+use App\Classes\Modules\WePost\DataTransferObjects\WePostProcessNotificationObject;
+use App\Classes\Modules\WePost\Standards\Rules\CanProcessWePostNotification;
 use App\Http\Resources\WePostNotificationResource;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -24,14 +26,19 @@ class ProcessWePostNotificationLogic extends AbstractControllerLogic
     /** @var CreatesWePostNotification */
     private $createsWePostNotification;
 
+    /** @var CanProcessWePostNotification */
+    private $canProcessWePostNotification;
+
     /**
      * ProcessWePostNotificationLogic constructor.
      * @param CreatesWePostNotification $createsWePostNotification
+     * @param CanProcessWePostNotification $canProcessWePostNotification
      */
     public function __construct(
-        CreatesWePostNotification $createsWePostNotification)
+        CreatesWePostNotification $createsWePostNotification, CanProcessWePostNotification $canProcessWePostNotification)
     {
         $this->createsWePostNotification = $createsWePostNotification;
+        $this->canProcessWePostNotification = $canProcessWePostNotification;
     }
 
     /**
@@ -43,6 +50,9 @@ class ProcessWePostNotificationLogic extends AbstractControllerLogic
      */
     public function logic(Request $request) : JsonResponse
     {
+        $object = new WePostProcessNotificationObject($request->query('api-key'));
+        $this->canProcessWePostNotification->passes($object);
+
         $request->merge([
             'isApiPub' => true,
         ]);
diff --git a/app/Classes/Modules/WePost/DataTransferObjects/WePostProcessNotificationObject.php b/app/Classes/Modules/WePost/DataTransferObjects/WePostProcessNotificationObject.php
new file mode 100644
index 00000000..f50f1f74
--- /dev/null
+++ b/app/Classes/Modules/WePost/DataTransferObjects/WePostProcessNotificationObject.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Classes\Modules\WePost\DataTransferObjects;
+
+use App\Classes\General\Interfaces\DataTransferObject;
+
+
+class WePostProcessNotificationObject implements DataTransferObject
+{
+    /** @var string */
+    private string $token;
+
+    /**
+     * WePostProcessNotificationObject constructor.
+     * @param string $token
+     */
+    public function __construct(
+        string $token
+    ) {
+        $this->token = $token;
+    }
+
+    /**
+     * @return string
+     */
+    public function getToken(): string
+    {
+        return $this->token;
+    }
+}
diff --git a/app/Classes/Modules/WePost/Standards/Rules/CanProcessWePostNotification.php b/app/Classes/Modules/WePost/Standards/Rules/CanProcessWePostNotification.php
new file mode 100644
index 00000000..8e17c1ba
--- /dev/null
+++ b/app/Classes/Modules/WePost/Standards/Rules/CanProcessWePostNotification.php
@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Classes\Modules\WePost\Standards\Rules;
+
+
+use App\Classes\General\Abstracts\AbstractRule;
+use App\Models\PersonalAccessTokens;
+
+class CanProcessWePostNotification extends AbstractRule
+{
+
+    /**
+     * @return bool
+     */
+    protected function authorized($object): bool
+    {
+        $personalAccessToken = PersonalAccessTokens::where('token', $object->getToken())->first();
+        if($personalAccessToken){
+            $abilities = json_decode($personalAccessToken->abilities, true);
+            if (in_array('process notification', $abilities)|| in_array('*', $abilities)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * @param $object
+     * @return bool
+     */
+    protected function validators($object): bool
+    {
+        return true;
+    }
+
+
+    /**
+     * @param $object
+     * @return bool
+     */
+    protected function criteria($object): bool
+    {
+        return true;
+    }
+
+}
diff --git a/routes/apipub.php b/routes/apipub.php
index 7ce8cc0d..b1ce64c2 100644
--- a/routes/apipub.php
+++ b/routes/apipub.php
@@ -9,6 +9,7 @@ Route::group(['middleware' => 'apipub', 'prefix' => 'v1', 'as' => 'apipub.'], fu
         Route::get('transactions/mappable/query', 'Transactions\ListMappableTransactionsController@list')->name('transaction.mappable.list');
         Route::get('groups/query', 'Transactions\ListGroupsController@list')->name('group.list');
 
+        //this is used on PerfexCRM
         Route::group(['prefix' => 'feedback', 'as' => 'feedback.', 'namespace' => 'HelpMenu'], function () {
             Route::post('/generate', 'GenerateFeedbackUrlController@generate')->name('feedback.url.generate');
         });