M3 Security Fixes for scan command

2026-09-17 11:15:23 +01:00
parent 59390d20c4
commit a9378cd309
3 changed files with 233 additions and 312 deletions
@@ -69,153 +69,116 @@ class BoxPackToPalletController extends Controller
    // Scan Boxes
    public static function scanBoxes(Request $request)
    {
-        $R659PALT = $request->R659PALT ?? abort(400, 'Pallet Not Found');
-        $R659BOX = trim($request->R659BOX) ?? abort(400, 'Box Not Found');
-        $SHUSER = m3_user() !== '' ? Str::upper(m3_user()) : 'WebUser';
-        $userWhsCoPlant = self::getUserWhsCoPlant();
+        $pallet = $request->R659PALT ?? abort(400, 'Pallet Not Found');
+        $box = trim((string) ($request->R659BOX ?? ''));
+        abort_if($box === '', 400, 'Box Not Found');

-        $boxMessage = '';
+        $user = m3_user() !== '' ? Str::upper(m3_user()) : 'WebUser';
+        $profile = self::getUserWhsCoPlant();
+        $validation = self::validateScannedBox($pallet, $box, $profile);

-        // Step 1: Check for duplicate — same pallet + box combo
-        $exists = DB::connection(config('m3.connection', 'pgsql'))
-            ->table('icm659m')
-            ->select('R659PALT')
-            ->where('R659PALT', $R659PALT)
-            ->where('R659BOX', $R659BOX)
-            ->where('R659CO', trim($userWhsCoPlant['USERCO']))
-            ->where('R659WHS', trim($userWhsCoPlant['USERWHS']))
-            ->where('R659PLANT', trim($userWhsCoPlant['USERPL']))
-            ->first();
-
-        if ($exists) {
-            $boxMessage = "&bull; Box {$R659BOX} is already assigned to Pallet {$exists->R659PALT}.";
+        if ($validation !== '') {
+            return response()->json(['success' => false, 'message' => $validation], 409);
        }

-        // Step 2: Check if Box exists in ICM695M1 (with carrier + conveyor joined)
-        $ICM695M1Sel = DB::connection(config('m3.connection', 'pgsql'))
-            ->table(self::CARTON_TABLE_ALIAS)
-            ->select(
-                'c.AYINTBOX',
-                'c.AYSPR15A01',
-                'c.AYTYPE',
-                'c.AYMACPKR',
-                'cv.A4APR8N001',
-                self::CONVEYOR_SELECT,
-            )
-            ->leftJoin(self::CONVEYOR_VALUE_ALIAS, 'c.AYMACPKR', '=', 'cv.A4MACPKR')
-            ->leftJoin(self::CONVEYOR_TABLE_ALIAS, 'cv.A4APR8N001', '=', 'cnv.R652SEQ')
-            ->where('c.AYINTBOX', $R659BOX)
-            ->where('c.AYCO', trim($userWhsCoPlant['USERCO']))
-            ->where('c.AYWHS', trim($userWhsCoPlant['USERWHS']))
-            ->where('c.AYPLANT', trim($userWhsCoPlant['USERPL']))
-            ->first();
-
-        $boxExistInICM695M = isset($ICM695M1Sel->AYINTBOX);
-        $boxisPalletICM695M = isset($ICM695M1Sel->AYTYPE) && $ICM695M1Sel->AYTYPE != 'BX';
-
-        if (! $boxExistInICM695M) {
-            $br = $boxMessage == '' ? '' : '<br>';
-            $boxMessage .= $br . "&bull; Box {$R659BOX} does not exist in ICM695M1 or it belongs to another Company.";
-        }
-
-        if ($boxExistInICM695M && $boxisPalletICM695M) {
-            $br = $boxMessage == '' ? '' : '<br>';
-            $boxMessage .= $br . "&bull; Scanned barcode {$R659BOX} is not a Box.";
-        }
-
-        // Step 3: Check that all boxes on the pallet share the same Carrier and Conveyor
-        if ($boxExistInICM695M && ! $boxisPalletICM695M && ! $exists) {
-            $firstPalletBox = DB::connection(config('m3.connection', 'pgsql'))
-                ->table(self::PALLET_TABLE_ALIAS)
-                ->select(
-                    'c.AYSPR15A01',
-                    self::CONVEYOR_SELECT,
-                )
-                ->leftJoin(self::CARTON_TABLE_ALIAS, 'p.R659BOX', '=', 'c.AYINTBOX')
-                ->leftJoin(self::CONVEYOR_VALUE_ALIAS, 'c.AYMACPKR', '=', 'cv.A4MACPKR')
-                ->leftJoin(self::CONVEYOR_TABLE_ALIAS, 'cv.A4APR8N001', '=', 'cnv.R652SEQ')
-                ->where('p.R659PALT', $R659PALT)
-                ->where('p.R659CO', trim($userWhsCoPlant['USERCO']))
-                ->where('p.R659WHS', trim($userWhsCoPlant['USERWHS']))
-                ->where('p.R659PLANT', trim($userWhsCoPlant['USERPL']))
-                ->first();
-
-            if ($firstPalletBox) {
-                $incomingCarrier = trim($ICM695M1Sel->AYSPR15A01 ?? '');
-                $incomingConveyor = trim($ICM695M1Sel->CONVEYOR_NAME ?? '');
-                $palletCarrier = trim($firstPalletBox->AYSPR15A01 ?? '');
-                $palletConveyor = trim($firstPalletBox->CONVEYOR_NAME ?? '');
-
-                if ($incomingCarrier !== $palletCarrier) {
-                    $br = $boxMessage == '' ? '' : '<br>';
-                    $boxMessage .= $br . "&bull; Box {$R659BOX} has a different Carrier ({$incomingCarrier}) than the boxes already on Pallet {$R659PALT} ({$palletCarrier}).";
-                }
-
-                if ($incomingConveyor !== $palletConveyor) {
-                    $br = $boxMessage == '' ? '' : '<br>';
-                    $boxMessage .= $br . "&bull; Box {$R659BOX} has a different Conveyor ({$incomingConveyor}) than the boxes already on Pallet {$R659PALT} ({$palletConveyor}).";
-                }
-            }
-        }
-
-        if ($exists || ! $boxExistInICM695M || $boxisPalletICM695M || $boxMessage !== '') {
-            return response()->json([
-                'success' => false,
-                'message' => $boxMessage,
-            ], 409);
-        }
-
-        // Step 4: Insert new box record
-        DB::connection(config('m3.connection', 'pgsql'))
-            ->table('icm659m')
-            ->insert([
-                'R659PALT' => $R659PALT,
-                'R659BOX' => $R659BOX,
-                'R659LOADED' => '',
-                'R659USER' => $SHUSER,
-                'R659DATE' => date('Y-m-d'),
-                'R659TIME' => date('H:i:s'),
-                'R659CO' => trim($userWhsCoPlant['USERCO']),
-                'R659WHS' => trim($userWhsCoPlant['USERWHS']),
-                'R659PLANT' => trim($userWhsCoPlant['USERPL']),
-            ]);
-
-        // Step 5: Return the full refreshed box list
-        $boxes = DB::connection(config('m3.connection', 'pgsql'))->table(self::PALLET_TABLE_ALIAS)
-            ->select(
-                'p.R659PALT',
-                'p.R659BOX',
-                'p.R659LOADED',
-                'p.R659USER',
-                'p.R659DATE',
-                'p.R659TIME',
-                'c.AYMACPKR',
-                'c.AYSPR15A01',
-                'cv.A4APR8N001',
-                'cv.A4SHSHCT',
-                self::CONVEYOR_SELECT,
-            )
-            ->leftJoin(self::CARTON_TABLE_ALIAS, 'p.R659BOX', '=', 'c.AYINTBOX')
-            ->leftJoin(self::CONVEYOR_VALUE_ALIAS, 'c.AYMACPKR', '=', 'cv.A4MACPKR')
-            ->leftJoin(self::CONVEYOR_TABLE_ALIAS, 'cv.A4APR8N001', '=', 'cnv.R652SEQ')
-            ->where('p.R659PALT', $R659PALT)
-            ->where('p.R659CO', trim($userWhsCoPlant['USERCO']))
-            ->where('p.R659WHS', trim($userWhsCoPlant['USERWHS']))
-            ->where('p.R659PLANT', trim($userWhsCoPlant['USERPL']))
-            ->orderBy('p.R659DATE', 'desc')
-            ->orderBy('p.R659TIME', 'desc')
-            ->distinct()
-            ->get()
-            ->unique('R659BOX')
-            ->values();
+        self::insertScannedBox($pallet, $box, $user, $profile);

        return response()->json([
            'success' => true,
-            'message' => "&bull; Box {$R659BOX} added to Pallet {$R659PALT}.",
-            'data' => $boxes,
+            'message' => "&bull; Box {$box} added to Pallet {$pallet}.",
+            'data' => self::boxesForPallet($pallet, $profile),
        ]);
    }

+    private static function validateScannedBox($pallet, string $box, array $profile): string
+    {
+        $messages = [];
+        $existing = self::findExistingBox($pallet, $box, $profile);
+        if ($existing) {
+            $messages[] = "&bull; Box {$box} is already assigned to Pallet {$existing->R659PALT}.";
+        }
+
+        $boxRecord = self::findCarton($box, $profile);
+        if (! isset($boxRecord->AYINTBOX)) {
+            $messages[] = "&bull; Box {$box} does not exist in ICM695M1 or it belongs to another Company.";
+        } elseif (($boxRecord->AYTYPE ?? '') !== 'BX') {
+            $messages[] = "&bull; Scanned barcode {$box} is not a Box.";
+        } elseif (! $existing) {
+            $messages = array_merge($messages, self::palletCompatibilityMessages($pallet, $box, $boxRecord, $profile));
+        }
+
+        return implode('<br>', $messages);
+    }
+
+    private static function findExistingBox($pallet, string $box, array $profile): ?object
+    {
+        return DB::connection(config('m3.connection', 'pgsql'))->table('icm659m')
+            ->select('R659PALT')->where('R659PALT', $pallet)->where('R659BOX', $box)
+            ->where('R659CO', trim($profile['USERCO']))->where('R659WHS', trim($profile['USERWHS']))
+            ->where('R659PLANT', trim($profile['USERPL']))->first();
+    }
+
+    private static function findCarton(string $box, array $profile): ?object
+    {
+        return DB::connection(config('m3.connection', 'pgsql'))->table(self::CARTON_TABLE_ALIAS)
+            ->select('c.AYINTBOX', 'c.AYSPR15A01', 'c.AYTYPE', 'c.AYMACPKR', 'cv.A4APR8N001', self::CONVEYOR_SELECT)
+            ->leftJoin(self::CONVEYOR_VALUE_ALIAS, 'c.AYMACPKR', '=', 'cv.A4MACPKR')
+            ->leftJoin(self::CONVEYOR_TABLE_ALIAS, 'cv.A4APR8N001', '=', 'cnv.R652SEQ')
+            ->where('c.AYINTBOX', $box)->where('c.AYCO', trim($profile['USERCO']))
+            ->where('c.AYWHS', trim($profile['USERWHS']))->where('c.AYPLANT', trim($profile['USERPL']))->first();
+    }
+
+    private static function palletCompatibilityMessages($pallet, string $box, object $incoming, array $profile): array
+    {
+        $first = DB::connection(config('m3.connection', 'pgsql'))->table(self::PALLET_TABLE_ALIAS)
+            ->select('c.AYSPR15A01', self::CONVEYOR_SELECT)
+            ->leftJoin(self::CARTON_TABLE_ALIAS, 'p.R659BOX', '=', 'c.AYINTBOX')
+            ->leftJoin(self::CONVEYOR_VALUE_ALIAS, 'c.AYMACPKR', '=', 'cv.A4MACPKR')
+            ->leftJoin(self::CONVEYOR_TABLE_ALIAS, 'cv.A4APR8N001', '=', 'cnv.R652SEQ')
+            ->where('p.R659PALT', $pallet)->where('p.R659CO', trim($profile['USERCO']))
+            ->where('p.R659WHS', trim($profile['USERWHS']))->where('p.R659PLANT', trim($profile['USERPL']))->first();
+
+        if (! $first) {
+            return [];
+        }
+
+        $messages = [];
+        $incomingCarrier = trim($incoming->AYSPR15A01 ?? '');
+        $incomingConveyor = trim($incoming->CONVEYOR_NAME ?? '');
+        $palletCarrier = trim($first->AYSPR15A01 ?? '');
+        $palletConveyor = trim($first->CONVEYOR_NAME ?? '');
+        if ($incomingCarrier !== $palletCarrier) {
+            $messages[] = "&bull; Box {$box} has a different Carrier ({$incomingCarrier}) than the boxes already on Pallet {$pallet} ({$palletCarrier}).";
+        }
+        if ($incomingConveyor !== $palletConveyor) {
+            $messages[] = "&bull; Box {$box} has a different Conveyor ({$incomingConveyor}) than the boxes already on Pallet {$pallet} ({$palletConveyor}).";
+        }
+
+        return $messages;
+    }
+
+    private static function insertScannedBox($pallet, string $box, string $user, array $profile): void
+    {
+        DB::connection(config('m3.connection', 'pgsql'))->table('icm659m')->insert([
+            'R659PALT' => $pallet, 'R659BOX' => $box, 'R659LOADED' => '', 'R659USER' => $user,
+            'R659DATE' => date('Y-m-d'), 'R659TIME' => date('H:i:s'), 'R659CO' => trim($profile['USERCO']),
+            'R659WHS' => trim($profile['USERWHS']), 'R659PLANT' => trim($profile['USERPL']),
+        ]);
+    }
+
+    private static function boxesForPallet($pallet, array $profile)
+    {
+        return DB::connection(config('m3.connection', 'pgsql'))->table(self::PALLET_TABLE_ALIAS)
+            ->select('p.R659PALT', 'p.R659BOX', 'p.R659LOADED', 'p.R659USER', 'p.R659DATE', 'p.R659TIME',
+                'c.AYMACPKR', 'c.AYSPR15A01', 'cv.A4APR8N001', 'cv.A4SHSHCT', self::CONVEYOR_SELECT)
+            ->leftJoin(self::CARTON_TABLE_ALIAS, 'p.R659BOX', '=', 'c.AYINTBOX')
+            ->leftJoin(self::CONVEYOR_VALUE_ALIAS, 'c.AYMACPKR', '=', 'cv.A4MACPKR')
+            ->leftJoin(self::CONVEYOR_TABLE_ALIAS, 'cv.A4APR8N001', '=', 'cnv.R652SEQ')
+            ->where('p.R659PALT', $pallet)->where('p.R659CO', trim($profile['USERCO']))
+            ->where('p.R659WHS', trim($profile['USERWHS']))->where('p.R659PLANT', trim($profile['USERPL']))
+            ->orderBy('p.R659DATE', 'desc')->orderBy('p.R659TIME', 'desc')->distinct()->get()->unique('R659BOX')->values();
+    }
+
    // Delete Box
    public static function deleteBox(Request $request)
    {