[OpenSpec] wire-action-authorization-demo

[github-actions]

⚠️ OpenSpec-managed issue — this content is automatically synced
from the openspec/ directory. Manual edits will be overwritten on next sync.

Artifacts

• ✅ Metadata
• ✅ Proposal
• ✅ Specs
• 🔲 Design
• ✅ Tasks
• 🔲 Plan
• 🔲 Review

Specs

• 📄 order-lifecycle-actions

Tasks

• 1.1 Add lib/Controller/OrderController.php: constructor-injects ActionAuthService, IUserSession, and OpenRegister's ObjectService/equivalent abstraction (ADR-022 — no direct SQL, reuse the same object-mutation path the manifest-driven generic endpoints use) — ObjectService is resolved via ContainerInterface (the app's existing OR-soft-dependency pattern, matching SettingsService)
• 1.2 Implement cancel(string $id): JSONResponse, #[NoAdminRequired], that: reads the current user from IUserSession, calls $this->actionAuthService->requireAction($user, 'order.cancel'), then updates the order object's status (to cancelled) — reuses OR's updateObject(), no hand-rolled persistence
• 1.3 Return generic error responses on failure (ADR-005): OCSForbiddenException from requireAction() maps to HTTP 403 with a static message; log the real reason server-side only
• 1.4 Add SPDX header + @spec tag pointing at openspec/changes/wire-action-authorization-demo/specs/order-lifecycle-actions/spec.md#req-order-cancel-001
• 2.1 Add ['name' => 'order#cancel', 'url' => '/api/orders/{id}/cancel', 'verb' => 'POST'] to appinfo/routes.php
• 2.2 Confirm OrderController::cancel() exists with matching signature (no route-to-missing-method drift)
• 3.1 Replace lib/actions.seed.json's "actions": {} with { "order.cancel": ["admin"] }
• 3.2 Rewrite the $comment field: remove the "Template ships with an example commented pattern; remove the $comment field..." text (no longer true) and instead describe the one real entry as the worked example for apps copying this template
• 3.3 Confirm InitializeActions repair step still preserves an admin-customized matrix on upgrade (existing behavior, no change needed — verified: InitializeActions::run() returns early when the matrix already has entries)
• 4.1 Add a orderCancelAction handler function (src/actions/orderActions.js) registered in src/customComponents.js that POSTs to /api/orders/{id}/cancel and fires a refresh event on success
• 4.3 Run npm run check:manifest to confirm the action resolves — PASS (Ajv validation: 0 errors)
• 5.1 Added a cross-reference from openspec/specs/item-management/spec.md's note to specs/order-lifecycle-actions/spec.md as the concrete worked example
• 6.1 Run openspec validate wire-action-authorization-demo --strict — PASS
• 6.2 composer check:strict (PHPCS/PHPMD/Psalm/PHPStan) on the new controller — PHPCS 0 errors, PHPMD clean, Psalm no errors, PHPStan level 5 OK; OrderControllerTest 5 tests pass

---

Synced from openspec/changes/wire-action-authorization-demo by OpenSpec workflow
App: app-template