John Cardinal
445f9b0d0a
Six KPIs put the request's interval criterion into the query as
DATE_TRUNC('<interval>', ...) unchecked, reachable by staff down to
TechRestricted (security review F26). New KPIFetcher.DateTruncUnitOrNull
accepts only PostgreSQL's date_trunc unit names (any case); the seven KPIs that
read interval refuse anything else with "Invalid 'interval' criteria", the same
form as their existing missing-criteria errors. The client only sends day or
month. (WorkOrderByStatusList reads interval without using it; checked too.)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
3.9 KiB
C#
86 lines
3.9 KiB
C#
using AyaNova.Biz;
|
|
using AyaNova.DataList;
|
|
using System.Collections.Generic;
|
|
|
|
namespace AyaNova.KPI
|
|
{
|
|
internal class WorkOrderItemLaborQuantityEveryoneSummary : IAyaKPI
|
|
{
|
|
private string _metaQuery = null;
|
|
private string _dataQuery = null;
|
|
private string _errorMessage = null;
|
|
|
|
public AuthorizationRoles AllowedRoles
|
|
{
|
|
get => AuthorizationRoles.BizAdmin |
|
|
AuthorizationRoles.BizAdminRestricted |
|
|
AuthorizationRoles.ServiceRestricted |
|
|
AuthorizationRoles.Service |
|
|
AuthorizationRoles.Accounting;
|
|
}
|
|
|
|
public string MetaQuery => _metaQuery;
|
|
public string DataQuery => _dataQuery;
|
|
public string ErrorMessage => _errorMessage;
|
|
|
|
public void BuildQuery(KPIRequestOptions options, long userId)
|
|
{
|
|
if (!options.Criteria.ContainsKey("timeSpan"))
|
|
{
|
|
_errorMessage = "Missing 'timeSpan' criteria";
|
|
return;
|
|
}
|
|
if (!options.Criteria.ContainsKey("interval"))
|
|
{
|
|
_errorMessage = "Missing 'interval' criteria";
|
|
return;
|
|
}
|
|
var userid = (int?)options.Criteria["userid"];
|
|
string userWhere = string.Empty;
|
|
if (userid != null)
|
|
{
|
|
userWhere = $"AND aworkorderitemlabor.userid = {userid}";
|
|
}
|
|
var timeSpan = (string)options.Criteria["timeSpan"];
|
|
//case 4717: interval goes into DATE_TRUNC in the query, so only PostgreSQL's own unit names are accepted
|
|
var interval = KPIFetcher.DateTruncUnitOrNull((string)options.Criteria["interval"]);
|
|
if (interval == null)
|
|
{
|
|
_errorMessage = "Invalid 'interval' criteria";
|
|
return;
|
|
}
|
|
var dateWhere = DataListSqlFilterCriteriaBuilder.DataFilterToColumnCriteria("aworkorderitemlabor.servicestopdate", UiFieldDataType.DateTime, "no-operator", timeSpan, options.ClientTimeStamp);
|
|
var techtags = options.Criteria["techtags"].ToObject<List<string>>();
|
|
bool techtagsany = options.Criteria["techtagsany"].ToObject<bool>();
|
|
var wotags = options.Criteria["wotags"].ToObject<List<string>>();
|
|
bool wotagsany = options.Criteria["wotagsany"].ToObject<bool>();
|
|
var woitemtags = options.Criteria["woitemtags"].ToObject<List<string>>();
|
|
bool woitemtagsany = options.Criteria["woitemtagsany"].ToObject<bool>();
|
|
string techTagsWhere = DataListSqlFilterCriteriaBuilder.TagFilterToSqlCriteriaHelper("auser.tags", techtags, techtagsany);
|
|
string woTagsWhere = DataListSqlFilterCriteriaBuilder.TagFilterToSqlCriteriaHelper("aworkorder.tags", wotags, wotagsany);
|
|
string woItemTagsWhere = DataListSqlFilterCriteriaBuilder.TagFilterToSqlCriteriaHelper("aworkorderitem.tags", woitemtags, woitemtagsany); ;
|
|
|
|
|
|
|
|
_dataQuery = @$"SELECT row_to_json(t) as res from (
|
|
SELECT SUM(AWORKORDERITEMLABOR.SERVICERATEQUANTITY) Y,DATE_TRUNC('{interval}', AWORKORDERITEMLABOR.SERVICESTOPDATE) X, AUSER.ID Z
|
|
FROM AWORKORDER
|
|
LEFT JOIN AWORKORDERITEM ON AWORKORDER.ID = AWORKORDERITEM.WORKORDERID
|
|
LEFT JOIN AWORKORDERITEMLABOR ON AWORKORDERITEM.ID = AWORKORDERITEMLABOR.WORKORDERITEMID
|
|
LEFT JOIN AUSER ON AWORKORDERITEMLABOR.USERID = AUSER.ID
|
|
WHERE {dateWhere} {userWhere} {techTagsWhere} {woTagsWhere} {woItemTagsWhere}
|
|
GROUP BY Z, X
|
|
ORDER BY X ASC
|
|
) t";
|
|
_metaQuery =
|
|
@"SELECT row_to_json(t) as res from (
|
|
select auser.id as userid, name, uicolor from auser
|
|
left outer join auseroptions on auser.id=auseroptions.userid
|
|
where auser.usertype=1 or auser.usertype=5
|
|
order by name
|
|
) t";
|
|
}
|
|
|
|
|
|
}//eoc
|
|
}//eons |