//Dropdown
-$partner_data = json_decode($_SESSION['partnerhierarchy']);
-$soldto_dropdown = listPartner('soldto',$_SESSION['permission'],$accounthierarchy->soldto,'');
+$partner_data = json_decode($_SESSION['authorization']['partnerhierarchy']);
+$soldto_dropdown = listPartner('soldto',$_SESSION['authorization']['permission'],$accounthierarchy->soldto,'');
$view .= '
'.$tab3.'
diff --git a/accounts.php b/accounts.php
index 72e748c..5970a50 100644
--- a/accounts.php
+++ b/accounts.php
@@ -1,7 +1,7 @@
'API_INPUT_1','error' => 'user_key is required']));
+}
+
+//GET USER_DATA
+$stmt = $pdo->prepare('SELECT * FROM users WHERE userkey = ?');
+$stmt->execute([$user_key]);
+
+if ($stmt->rowCount() == 1) {
+ //Get results
+ $user_data = $stmt->fetch();
+
+ //GET DATA
+ $user_permissions['id'] = $user_data['id'];
+ $user_permissions['email'] = $user_data['email'];
+ $user_permissions['partnerhierarchy'] = $user_data['partnerhierarchy']; //clean;
+ $user_permissions['permission'] = userRights($user_data['view']);
+ $user_permissions['profile'] = getProfile($user_data['settings'],userRights($user_data['view']));
+
+ //NEW DATA REPLACING PROFILE AND LATER PERMISSION ABOVE
+ $user_permissions['permissions'] = getUserPermissions($pdo, $user_data['id']);
+
+ if (!$user_permissions['permissions']) {
+ http_response_code(404);
+ exit(json_encode(['error_code' => 'API_NOT_FOUND','error' => 'No permissions found']));
+ }
+
+ //+++++++++++++++++++++++++++++++++++++++++++
+ //Return as JSON
+ //+++++++++++++++++++++++++++++++++++++++++++
+ echo json_encode($user_permissions);
+}
+else {
+ http_response_code(404);
+ exit(json_encode(['error_code' => 'API_NOT_FOUND','error' => 'User not found']));
+}
+
+?>
\ No newline at end of file
diff --git a/assets/functions.php b/assets/functions.php
index c2c7762..939bd98 100644
--- a/assets/functions.php
+++ b/assets/functions.php
@@ -304,7 +304,7 @@ function menu($selected,$selected_child){
$menu = '';
//filter the main_menu array based on profile
- $filteredMenu = filterMenuByProfile($main_menu, $_SESSION['profile']);
+ $filteredMenu = filterMenuByProfile($main_menu, $_SESSION['authorization']['profile']);
foreach ($filteredMenu as $menu_item){
//Main Item
@@ -340,12 +340,12 @@ function template_header($title, $selected = 'assets', $selected_child = 'view')
$domain = getDomainName($_SERVER['SERVER_NAME']);
$custom_css = (file_exists(dirname(__FILE__,2).'/custom/'.$domain.'/style/'.$domain.'.css') ? './custom/'.$domain.'/style/'.$domain.'.css' : './style/admin.css');
- $user = ucfirst($_SESSION['username']);
+ $user = ucfirst($_SESSION['authorization']['clientID']);
if (filter_var($user, FILTER_VALIDATE_EMAIL)){
$user = substr($user, 0, strpos($user, "@"));
}
- if (isset($_SESSION['id'])){$id = $_SESSION['id'];} else{$id='';}
+ if (isset($_SESSION['authorization']['id'])){$id = $_SESSION['authorization']['id'];} else{$id='';}
if(isset($_SESSION['country_code'])){
$api_file_language = dirname(__FILE__,2).'/settings/translations/translations_'.strtoupper($_SESSION['country_code']).'.php';
@@ -520,8 +520,8 @@ EOT;
//------------------------------------------
function template_footer($js_script = '') {
$js_script = $js_script ? '' : '';
- $lancode = $_SESSION['language'] ?? 'US';
- $user_mail = $_SESSION['email'] ?? '';
+ $lancode = $_SESSION['authorization']['language'] ?? 'US';
+ $user_mail = $_SESSION['authorization']['email'] ?? '';
$veliti_cim = '';
if (veliti_cim){
$veliti_cim = '
@@ -1239,7 +1239,7 @@ function ioServer($api_call, $data){
debuglog($date." - ioServer incoming call: api_call=$api_call, data=" . $data_log);
}
- $token = $_SESSION['userkey'] ?? 'authorization_request';
+ $token = $_SESSION['authorization']['userkey'] ?? 'authorization_request';
$bearertoken = createCommunicationToken($token);
$url = $baseurl.$api_call;
@@ -1541,18 +1541,16 @@ function getProfile($profile, $permission){
//+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
function isAllowed($page,$profile,$permission,$action){
- //++++++++++++++++
- //OVERRIDE
- //++++++++++++++++
- return 1;
- //++++++++++++++++
-
+ //override for testing only
+ return 1;
+
//Include settingsa
include dirname(__FILE__,2).'/settings/settings_redirector.php';
// Always allowed collections: [collection => allowed_actions_string]
$always_allowed = [
'com_log' => 'U',
+ 'user_permissions' => 'R',
'software_update' => 'R',
'software_download' => 'R',
'software_available' => 'R',
@@ -2690,7 +2688,7 @@ function listPartner($partnertype, $user_right, $input, $required)
//BASED ON USERRIGHT DEFINE SQL AND DATA RETURNED
if ($user_right != 3 || $user_right !=4) {
//NOT ADMIN USER
- $partner = json_decode($_SESSION['partnerhierarchy']);
+ $partner = json_decode($_SESSION['authorization']['partnerhierarchy']);
//SoldTo is empty
if (empty($partner->soldto) || $partner->soldto == ''){$soldto_search = '%';} else {$soldto_search = '-%';}
//BUILD CONDITION
@@ -2738,7 +2736,7 @@ function listAccounts($type, $user_right, $input)
//BASED ON USERRIGHT DEFINE SQL AND DATA RETURNED
if ($user_right != 3 || $user_right !=4) {
//NOT ADMIN USER
- $partner = json_decode($_SESSION['partnerhierarchy']);
+ $partner = json_decode($_SESSION['authorization']['partnerhierarchy']);
//SoldTo is empty
if (empty($partner->soldto) || $partner->soldto == ''){$soldto_search = '%';} else {$soldto_search = '-%';}
//BUILD CONDITION
@@ -5661,4 +5659,77 @@ function generateCountriesFile($token){
}
return false;
+}
+
+/**
+ * Get combined user permissions based on all assigned roles
+ *
+ * This function retrieves all role assignments for a user and combines permissions
+ * from multiple roles. If the same access_element appears in multiple roles,
+ * permissions are merged (OR operation) so the user gets the union of all permissions.
+ *
+ * For example:
+ * - Role A: access_element 'assets' with C=1, U=1, D=0
+ * - Role B: access_element 'assets' with C=0, U=0, D=1
+ * - Result: access_element 'assets' with C=1, U=1, D=1
+ *
+ * @param PDO $pdo Database connection
+ * @param int $user_id The user ID to get permissions for
+ * @return array Associative array of permissions indexed by access_element path
+ * Each element contains: [path, name, group, can_create, can_read, can_update, can_delete]
+ */
+function getUserPermissions($pdo, $user_id) {
+ // Get all active role assignments for the user with their permissions
+ $sql = "SELECT
+ ae.access_path,
+ ae.access_name,
+ ae.access_group,
+ rap.can_create,
+ rap.can_read,
+ rap.can_update,
+ rap.can_delete
+ FROM user_role_assignments ura
+ INNER JOIN user_roles ur ON ura.role_id = ur.rowID
+ INNER JOIN role_access_permissions rap ON ur.rowID = rap.role_id
+ INNER JOIN access_elements ae ON rap.access_id = ae.rowID
+ WHERE ura.user_id = :user_id
+ AND ura.is_active = 1
+ AND ur.is_active = 1
+ AND ae.is_active = 1
+ AND (ura.expires_at IS NULL OR ura.expires_at > NOW())
+ ORDER BY ae.access_path";
+
+ $stmt = $pdo->prepare($sql);
+ $stmt->bindParam(':user_id', $user_id, PDO::PARAM_INT);
+ $stmt->execute();
+ $results = $stmt->fetchAll(PDO::FETCH_ASSOC);
+
+ // Combine permissions for duplicate access elements
+ $combined_permissions = [];
+
+ foreach ($results as $row) {
+ $path = $row['access_path'];
+
+ if (!isset($combined_permissions[$path])) {
+ // First time seeing this access element
+ $combined_permissions[$path] = [
+ 'path' => $row['access_path'],
+ 'name' => $row['access_name'],
+ 'group' => $row['access_group'],
+ 'can_create' => (int)$row['can_create'],
+ 'can_read' => (int)$row['can_read'],
+ 'can_update' => (int)$row['can_update'],
+ 'can_delete' => (int)$row['can_delete']
+ ];
+ } else {
+ // Access element already exists, combine permissions (OR operation)
+ // If any role grants a permission, the user has that permission
+ $combined_permissions[$path]['can_create'] = max($combined_permissions[$path]['can_create'], (int)$row['can_create']);
+ $combined_permissions[$path]['can_read'] = max($combined_permissions[$path]['can_read'], (int)$row['can_read']);
+ $combined_permissions[$path]['can_update'] = max($combined_permissions[$path]['can_update'], (int)$row['can_update']);
+ $combined_permissions[$path]['can_delete'] = max($combined_permissions[$path]['can_delete'], (int)$row['can_delete']);
+ }
+ }
+
+ return $combined_permissions;
}
\ No newline at end of file
diff --git a/buildtool.php b/buildtool.php
index 553a35c..9de2e31 100644
--- a/buildtool.php
+++ b/buildtool.php
@@ -1,7 +1,7 @@
[
'CarVIN' => '',
'year' => '',
- 'NameTester'=> $_SESSION['username'],
+ 'NameTester'=> $_SESSION['authorization']['clientID'],
'SN' =>'',
'HW' =>'',
'FW' =>''
diff --git a/cartests.php b/cartests.php
index 5a49aca..141b967 100644
--- a/cartests.php
+++ b/cartests.php
@@ -1,7 +1,7 @@
'.$general_filters_clear.'';
//SHOW DOWNLOAD TO EXCELL OPTION ONLY TO ADMIN USERS
-if ($_SESSION['permission'] == 3 || $_SESSION['permission'] == 4){
+if ($_SESSION['authorization']['permission'] == 3 || $_SESSION['authorization']['permission'] == 4){
$view .= '
Download
';
diff --git a/catalog.php b/catalog.php
index e53c7b1..5bbed4b 100644
--- a/catalog.php
+++ b/catalog.php
@@ -1,7 +1,7 @@
'',
diff --git a/communication.php b/communication.php
index 5c3334e..c3d8e3d 100644
--- a/communication.php
+++ b/communication.php
@@ -3,14 +3,14 @@ defined(page_security_key) or exit;
$page = 'communication';
//Check if allowed
-if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){
+if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){
header('location: index.php');
exit;
}
//PAGE Security
-$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U');
-$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D');
-$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C');
+$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U');
+$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D');
+$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C');
// Default input communication values
$communication = [
diff --git a/communication_send.php b/communication_send.php
index c9823b2..7b9a652 100644
--- a/communication_send.php
+++ b/communication_send.php
@@ -3,14 +3,14 @@ defined(page_security_key) or exit;
$page = 'communication_send';
//Check if allowed
-if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){
+if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){
header('location: index.php');
exit;
}
//PAGE Security
-$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U');
-$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D');
-$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C');
+$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U');
+$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D');
+$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C');
$url = 'index.php?page=communications';
diff --git a/communications.php b/communications.php
index b1c6417..b3eaf24 100644
--- a/communications.php
+++ b/communications.php
@@ -1,7 +1,7 @@
'.$button_create_communication.'';
}
-if (isAllowed('communication_send',$_SESSION['profile'],$_SESSION['permission'],'U') === 1){
+if (isAllowed('communication_send',$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U') === 1){
$view .= '
'.$button_create_communication_send.'';
}
diff --git a/contract.php b/contract.php
index bbe5260..15ff325 100644
--- a/contract.php
+++ b/contract.php
@@ -1,7 +1,7 @@
←':'';
//Check if allowed
-if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){
+if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){
header('location: index.php');
exit;
}
@@ -27,11 +27,11 @@ $pagination_page = $_SESSION['p'] = isset($_GET['p']) ? $_GET['p'] : 1;
//PAGE Security
$page_manage = 'contract_manage';
-$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U');
-$update_allowed_edit = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'U');
-$delete_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'D');
-$create_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'C');
-$view_equipment = isAllowed('equipment' ,$_SESSION['profile'],$_SESSION['permission'],'R');
+$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U');
+$update_allowed_edit = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U');
+$delete_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D');
+$create_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C');
+$view_equipment = isAllowed('equipment' ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R');
//GET Details from URL
$GET_VALUES = urlGETdetails($_GET) ?? '';
diff --git a/contract_manage.php b/contract_manage.php
index 032dfae..80c0f23 100644
--- a/contract_manage.php
+++ b/contract_manage.php
@@ -3,14 +3,14 @@ defined(page_security_key) or exit;
$page = 'contract_manage';
//Check if allowed
-if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){
+if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){
header('location: index.php');
exit;
}
//PAGE Security
-$update_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'U');
-$delete_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'D');
-$create_allowed = isAllowed($page ,$_SESSION['profile'],$_SESSION['permission'],'C');
+$update_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U');
+$delete_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D');
+$create_allowed = isAllowed($page ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C');
// Default input product values
$contract = [
@@ -31,7 +31,7 @@ $contract = [
'reference' => '',
'servicetool' => [],
'assigned_users' => [],
- 'accounthierarchy' => $_SESSION['partnerhierarchy'],
+ 'accounthierarchy' => $_SESSION['authorization']['partnerhierarchy'],
'ignore_list' => []
];
@@ -248,10 +248,10 @@ $view .='
$partner_data = json_decode($contract['accounthierarchy']);
//BUID UP DROPDOWNS
-$salesid_dropdown = listPartner('salesid',$_SESSION['permission'],$partner_data->salesid,'');
-$soldto_dropdown = listPartner('soldto',$_SESSION['permission'],$partner_data->soldto,'');
-$shipto_dropdown = listPartner('shipto',$_SESSION['permission'],$partner_data->shipto,'');
-$location_dropdown = listPartner('location',$_SESSION['permission'],$partner_data->location,'');
+$salesid_dropdown = listPartner('salesid',$_SESSION['authorization']['permission'],$partner_data->salesid,'');
+$soldto_dropdown = listPartner('soldto',$_SESSION['authorization']['permission'],$partner_data->soldto,'');
+$shipto_dropdown = listPartner('shipto',$_SESSION['authorization']['permission'],$partner_data->shipto,'');
+$location_dropdown = listPartner('location',$_SESSION['authorization']['permission'],$partner_data->location,'');
//DISPLAY
$view .= '
diff --git a/contracts.php b/contracts.php
index e18eac2..50d7e99 100644
--- a/contracts.php
+++ b/contracts.php
@@ -1,7 +1,7 @@
←':'';
//Check if allowed
-if (isAllowed($page,$_SESSION['profile'],$_SESSION['permission'],'R') === 0){
+if (isAllowed($page,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 0){
header('location: index.php');
exit;
}
//PAGE Security
$page_manage = 'contract_manage';
-$update_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'U');
-$delete_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'D');
-$create_allowed = isAllowed($page_manage ,$_SESSION['profile'],$_SESSION['permission'],'C');
+$update_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'U');
+$delete_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'D');
+$create_allowed = isAllowed($page_manage ,$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'C');
//Close Contracts when end_date expired
closeContract();
diff --git a/cronjob.php b/cronjob.php
index 4902c3b..d9ed9be 100644
--- a/cronjob.php
+++ b/cronjob.php
@@ -5,7 +5,7 @@ include_once './assets/functions.php';
include_once './settings/settings_redirector.php';
include_once './settings/config_redirector.php';
-if (debug && debug_id == $_SESSION['id']){
+if (debug && debug_id == $_SESSION['authorization']['id']){
ini_set('display_errors', '1');
ini_set('display_startup_errors', '1');
error_reporting(E_ALL);
@@ -62,12 +62,10 @@ foreach ($communications as $communication){
$token ='';
$data = json_encode(array("username" => interface_user, "password" => interface_pw), JSON_UNESCAPED_UNICODE);
-//Secure data
-$payload = generate_payload($data);
//API call
-$responses = ioServer('/v1/authorization', $payload);
+$responses = ioServer('/v2/authorization', $data);
//Decode Payload
-if (!empty($responses)){$responses = decode_payload($responses);}else{$responses = '400';}
+if (!empty($responses)){$responses = json_decode($responses);}else{$responses = '400';}
if ($responses === 'NOK' || $responses === '400'){
//Not allowed
diff --git a/custom/bewellwell/settings/settingsmenu.php b/custom/bewellwell/settings/settingsmenu.php
index 954eb5d..74edb4d 100644
--- a/custom/bewellwell/settings/settingsmenu.php
+++ b/custom/bewellwell/settings/settingsmenu.php
@@ -327,7 +327,7 @@ $page_rows_software_versions = 50; //software versions
//------------------------------------------
// Languages supported
//------------------------------------------
-$supportedLanguages = ['US', 'NL', 'DE', 'ES','PT'];
+$supportedLanguages = ['US', 'NL', 'DE', 'ES','PL','PT'];
//------------------------------------------
// Pricing
diff --git a/dashboard.php b/dashboard.php
index da7f6a1..5aee031 100644
--- a/dashboard.php
+++ b/dashboard.php
@@ -1,7 +1,7 @@
'',
'full_path' =>'',
'created' => '',
- 'createdby' => $_SESSION['username'],
+ 'createdby' => $_SESSION['authorization']['clientID'],
'updated' => '',
'updatedby' => ''
];
diff --git a/dealers.php b/dealers.php
index 7ff341a..c0b01e4 100644
--- a/dealers.php
+++ b/dealers.php
@@ -1,7 +1,7 @@
'',
diff --git a/discounts.php b/discounts.php
index b30eedc..0b3cc31 100644
--- a/discounts.php
+++ b/discounts.php
@@ -1,7 +1,7 @@
sw_version_upgrade) && isset($products_software) && $prod
}
//Calculate Healthindex based on last test
-$total_score = assetHealthIndex($_SESSION['profile'],$_SESSION['permission'],$equipment_data,0);
+$total_score = assetHealthIndex($_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],$equipment_data,0);
//GetPartnerDetails
$partner_data = json_decode($responses->accounthierarchy);
@@ -163,7 +163,7 @@ $view = '
//------------------------------------
//CHECK IF USER IS ALSO CREATOR OF RECORD THEN OVERRIDE UPDATE_ALLOWED_EDIT
//------------------------------------
-$equipment_owner = (($responses->createdby == $_SESSION['username'])? 1 : 0);
+$equipment_owner = (($responses->createdby == $_SESSION['authorization']['clientID'])? 1 : 0);
//------------------------------------
//
//------------------------------------
@@ -369,7 +369,7 @@ if (!empty($responses->geolocation) || $responses->geolocation != ''){
}
//Get all related service events
-if (isAllowed('servicereports',$_SESSION['profile'],$_SESSION['permission'],'R') === 1){
+if (isAllowed('servicereports',$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 1){
$service_events = serviceEvents($history,$page);
$view .= '
@@ -382,7 +382,7 @@ $view .= '
}
//Show equipment_data when available and allowed
-if (isAllowed('equipment_data',$_SESSION['profile'],$_SESSION['permission'],'R') === 1 && !empty($equipment_data)){
+if (isAllowed('equipment_data',$_SESSION['authorization']['profile'],$_SESSION['authorization']['permission'],'R') === 1 && !empty($equipment_data)){
$view .= '