Release 2.13 (#4659)

src/API/ActivityController.php

@@ -44,10 +44,10 @@ final class ActivityController extends BaseApiController
     public const GROUPS_RATE = ['Default', 'Entity', 'Activity_Rate'];
 
     public function __construct(
-        private ViewHandlerInterface $viewHandler,
-        private ActivityRepository $repository,
-        private EventDispatcherInterface $dispatcher,
-        private ActivityRateRepository $activityRateRepository
+        private readonly ViewHandlerInterface $viewHandler,
+        private readonly ActivityRepository $repository,
+        private readonly EventDispatcherInterface $dispatcher,
+        private readonly ActivityRateRepository $activityRateRepository
     ) {
     }
 
@@ -128,6 +128,7 @@ final class ActivityController extends BaseApiController
     #[Route(methods: ['GET'], path: '/{id}', name: 'get_activity', requirements: ['id' => '\d+'])]
     #[ApiSecurity(name: 'apiUser')]
     #[ApiSecurity(name: 'apiToken')]
+    #[IsGranted('view', 'activity')]
     public function getAction(Activity $activity): Response
     {
         $view = new View($activity, 200);

src/API/CustomerController.php

@@ -44,10 +44,10 @@ final class CustomerController extends BaseApiController
     public const GROUPS_RATE = ['Default', 'Entity', 'Customer_Rate'];
 
     public function __construct(
-        private ViewHandlerInterface $viewHandler,
-        private CustomerRepository $repository,
-        private EventDispatcherInterface $dispatcher,
-        private CustomerRateRepository $customerRateRepository
+        private readonly ViewHandlerInterface $viewHandler,
+        private readonly CustomerRepository $repository,
+        private readonly EventDispatcherInterface $dispatcher,
+        private readonly CustomerRateRepository $customerRateRepository
     ) {
     }
 
@@ -105,6 +105,7 @@ final class CustomerController extends BaseApiController
     #[Route(methods: ['GET'], path: '/{id}', name: 'get_customer', requirements: ['id' => '\d+'])]
     #[ApiSecurity(name: 'apiUser')]
     #[ApiSecurity(name: 'apiToken')]
+    #[IsGranted('view', 'customer')]
     public function getAction(Customer $customer): Response
     {
         $view = new View($customer, 200);

src/API/ProjectController.php

@@ -46,11 +46,11 @@ final class ProjectController extends BaseApiController
     public const GROUPS_RATE = ['Default', 'Entity', 'Project_Rate'];
 
     public function __construct(
-        private ViewHandlerInterface $viewHandler,
-        private ProjectRepository $repository,
-        private EventDispatcherInterface $dispatcher,
-        private ProjectRateRepository $projectRateRepository,
-        private ProjectService $projectService
+        private readonly ViewHandlerInterface $viewHandler,
+        private readonly ProjectRepository $repository,
+        private readonly EventDispatcherInterface $dispatcher,
+        private readonly ProjectRateRepository $projectRateRepository,
+        private readonly ProjectService $projectService
     ) {
     }
 
@@ -159,6 +159,7 @@ final class ProjectController extends BaseApiController
     #[Route(methods: ['GET'], path: '/{id}', name: 'get_project', requirements: ['id' => '\d+'])]
     #[ApiSecurity(name: 'apiUser')]
     #[ApiSecurity(name: 'apiToken')]
+    #[IsGranted('view', 'project')]
     public function getAction(Project $project): Response
     {
         $view = new View($project, 200);

src/API/TimesheetController.php

@@ -54,11 +54,11 @@ final class TimesheetController extends BaseApiController
     public const GROUPS_COLLECTION_FULL = ['Default', 'Collection', 'Timesheet', 'Expanded'];
 
     public function __construct(
-        private ViewHandlerInterface $viewHandler,
-        private TimesheetRepository $repository,
-        private TagRepository $tagRepository,
-        private EventDispatcherInterface $dispatcher,
-        private TimesheetService $service
+        private readonly ViewHandlerInterface $viewHandler,
+        private readonly TimesheetRepository $repository,
+        private readonly TagRepository $tagRepository,
+        private readonly EventDispatcherInterface $dispatcher,
+        private readonly TimesheetService $service
     ) {
     }
 
@@ -99,6 +99,7 @@ final class TimesheetController extends BaseApiController
     public function cgetAction(ParamFetcherInterface $paramFetcher, CustomerRepository $customerRepository, ProjectRepository $projectRepository, ActivityRepository $activityRepository, UserRepository $userRepository): Response
     {
         $query = new TimesheetQuery(false);
+        $query->setCurrentUser($this->getUser());
         $seeAll = false;
 
         if ($this->isGranted('view_other_timesheet')) {