John Cardinal
445f9b0d0a
Six KPIs put the request's interval criterion into the query as
DATE_TRUNC('<interval>', ...) unchecked, reachable by staff down to
TechRestricted (security review F26). New KPIFetcher.DateTruncUnitOrNull
accepts only PostgreSQL's date_trunc unit names (any case); the seven KPIs that
read interval refuse anything else with "Invalid 'interval' criteria", the same
form as their existing missing-criteria errors. The client only sends day or
month. (WorkOrderByStatusList reads interval without using it; checked too.)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
68 lines
2.9 KiB
C#
68 lines
2.9 KiB
C#
using AyaNova.Biz;
|
|
using AyaNova.DataList;
|
|
using System.Collections.Generic;
|
|
|
|
namespace AyaNova.KPI
|
|
{
|
|
internal class WorkOrderStatusCount : IAyaKPI
|
|
{
|
|
private string _metaQuery = null;
|
|
private string _dataQuery = null;
|
|
private string _errorMessage = null;
|
|
|
|
public AuthorizationRoles AllowedRoles
|
|
{
|
|
get => AuthorizationRoles.BizAdmin
|
|
| AuthorizationRoles.BizAdminRestricted
|
|
| AuthorizationRoles.ServiceRestricted
|
|
| AuthorizationRoles.Service
|
|
| AuthorizationRoles.Accounting;
|
|
}
|
|
|
|
public string MetaQuery => _metaQuery;
|
|
public string DataQuery => _dataQuery;
|
|
public string ErrorMessage => _errorMessage;
|
|
|
|
public void BuildQuery(KPIRequestOptions options, long userId)
|
|
{
|
|
//build data and meta queries
|
|
|
|
//validate criteria exists
|
|
if (!options.Criteria.ContainsKey("timeSpan"))
|
|
{
|
|
_errorMessage = "Missing 'timeSpan' criteria";
|
|
return;
|
|
}
|
|
|
|
if (!options.Criteria.ContainsKey("interval"))
|
|
{
|
|
_errorMessage = "Missing 'interval' criteria";
|
|
return;
|
|
}
|
|
|
|
var timeSpan = (string)options.Criteria["timeSpan"];
|
|
//case 4717: interval goes into DATE_TRUNC in the query, so only PostgreSQL's own unit names are accepted
|
|
var interval = KPIFetcher.DateTruncUnitOrNull((string)options.Criteria["interval"]);
|
|
if (interval == null)
|
|
{
|
|
_errorMessage = "Invalid 'interval' criteria";
|
|
return;
|
|
}
|
|
var dateWhere = DataListSqlFilterCriteriaBuilder.DataFilterToColumnCriteria("aworkorder.createddate", UiFieldDataType.DateTime, "no-operator", timeSpan, options.ClientTimeStamp);
|
|
var wotags = options.Criteria["wotags"].ToObject<List<string>>();
|
|
bool wotagsany = options.Criteria["wotagsany"].ToObject<bool>();
|
|
string woTagsWhere = DataListSqlFilterCriteriaBuilder.TagFilterToSqlCriteriaHelper("aworkorder.tags", wotags, wotagsany);
|
|
|
|
_dataQuery = @$"SELECT row_to_json(t) as res from (
|
|
SELECT COUNT(AWORKORDER.ID) Y,DATE_TRUNC('{interval}', AWORKORDER.createddate) X, aworkorder.laststatusid Z
|
|
FROM AWORKORDER
|
|
LEFT JOIN AWORKORDERSTATUS ON (AWORKORDER.LASTSTATUSID = AWORKORDERSTATUS.ID) WHERE {dateWhere} {woTagsWhere}
|
|
GROUP BY Z, X
|
|
ORDER BY X ASC
|
|
) t";
|
|
_metaQuery = @"SELECT row_to_json(t) as res from (select id, name, color from aworkorderstatus order by name asc) t";
|
|
}
|
|
|
|
|
|
}//eoc
|
|
}//eons |