feat: complete jobcard operations and access controls

config/bootstrap.php

@@ -1,6 +1,8 @@
 <?php
 declare(strict_types=1);
 
+require_once dirname(__DIR__) . '/app/Domain/User/PasswordPolicy.php';
+
 function load_dotenv(string $path): void
 {
     if (!is_file($path) || !is_readable($path)) return;
@@ -72,7 +74,8 @@ function ensure_initial_administrator(): void
     if ((int)db()->query('SELECT COUNT(*) FROM users')->fetchColumn() !== 0) return;
     $email = strtolower(trim(env_required('ADMIN_EMAIL')));
     $password = env_required('ADMIN_PASSWORD');
-    if (strlen($password) < 12) throw new RuntimeException('ADMIN_PASSWORD must be at least 12 characters');
+    $passwordResult = (new \App\Domain\User\PasswordPolicy())->validateInitial($password);
+    if (!$passwordResult['valid']) throw new RuntimeException('ADMIN_PASSWORD does not meet the password policy');
     $roleId = (int)db()->query("SELECT id FROM roles WHERE name = 'Administrator'")->fetchColumn();
     if ($roleId < 1) throw new RuntimeException('Administrator role is missing from the database');
     $stmt = db()->prepare('INSERT INTO users (role_id, email, name, password_hash) VALUES (:role, :email, :name, :hash)');
@@ -115,6 +118,16 @@ function require_permission(string $permission): void
     if (!can($permission)) { http_response_code(403); exit('Forbidden'); }
 }
 
+function can_access_jobcard(int $jobcardId): bool
+{
+    $user = current_user();
+    if (!$user) return false;
+    if ($user['role_name'] !== 'Technician') return can('jobcards.view');
+    $stmt = db()->prepare('SELECT 1 FROM jobcard_assignments WHERE jobcard_id = :jobcard AND user_id = :user LIMIT 1');
+    $stmt->execute(['jobcard' => $jobcardId, 'user' => $user['id']]);
+    return (bool)$stmt->fetchColumn();
+}
+
 function audit(string $action, string $entityType, ?int $entityId = null, array $metadata = []): void
 {
     $user = current_user();