From 41c389633dedd9aff6f53f9d25ec818654867ce2 Mon Sep 17 00:00:00 2001
From: Marco0300 <Marco0300@users.noreply.github.com>
Date: Wed, 2 Sep 2026 00:58:49 +0200
Subject: [PATCH] fix: restrict technician client history to assigned jobcards

---
 public/index.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/public/index.php b/public/index.php
index 4509085..88a19a4 100644
--- a/public/index.php
+++ b/public/index.php
@@ -217,7 +217,10 @@ if ($route === 'client_history') {
     $clientId = filter_var(scalar_input($_GET['id'] ?? null), FILTER_VALIDATE_INT);
     if (!$clientId || !can_access_client($clientId)) { http_response_code(404); exit('Client not found'); }
     try { $filters = \ReportFilters::fromArray([...$_GET, 'client_id' => $clientId]); } catch (Throwable $exception) { http_response_code(400); exit('Invalid history filters'); }
-    $stmt = db()->prepare('SELECT h.id, j.client_id, j.reference_no, h.from_status, h.to_status, h.changed_at, u.name AS changed_by_name FROM jobcard_status_history h JOIN jobcards j ON j.id = h.jobcard_id LEFT JOIN users u ON u.id = h.changed_by WHERE j.client_id = :client ORDER BY h.changed_at ASC, h.id ASC'); $stmt->execute(['client' => $clientId]);
+    $historyScope = '';
+    $historyParams = ['client' => $clientId];
+    if ($user['role_name'] === 'Technician') { $historyScope = ' JOIN jobcard_assignments ja ON ja.jobcard_id = j.id AND ja.user_id = :history_user'; $historyParams['history_user'] = $user['id']; }
+    $stmt = db()->prepare('SELECT DISTINCT h.id, j.client_id, j.reference_no, h.from_status, h.to_status, h.changed_at, u.name AS changed_by_name FROM jobcard_status_history h JOIN jobcards j ON j.id = h.jobcard_id' . $historyScope . ' LEFT JOIN users u ON u.id = h.changed_by WHERE j.client_id = :client ORDER BY h.changed_at ASC, h.id ASC'); $stmt->execute($historyParams);
     $history = (new \App\Domain\Reporting\ClientHistoryReport($filters))->build($stmt->fetchAll(), 'client');
     if (scalar_input($_GET['format'] ?? null) === 'print') { header('Content-Type: text/html; charset=UTF-8'); echo (new \PrintReportRenderer())->render('Client history', ['Reference', 'From', 'To', 'Changed'], array_map(static fn (array $row): array => [$row['reference_no'], $row['from_status'], $row['to_status'], $row['changed_at']], $history)); exit; }
     render_header('Client history'); echo '<div class="d-flex justify-content-between mb-4"><div><a href="/?route=client&id=' . (int)$clientId . '">← Back to client</a><h1 class="h3 mt-2">Client history</h1></div><a class="btn btn-outline-secondary" target="_blank" rel="noopener" href="/?route=client_history&id=' . (int)$clientId . '&format=print">Print view</a></div><div class="card"><div class="table-responsive"><table class="table"><thead><tr><th>Jobcard</th><th>From</th><th>To</th><th>Changed</th></tr></thead><tbody>'; foreach ($history as $row) echo '<tr><td>' . e($row['reference_no']) . '</td><td>' . e($row['from_status']) . '</td><td>' . e($row['to_status']) . '</td><td>' . e($row['changed_at']) . '</td></tr>'; echo '</tbody></table></div></div>'; render_footer(); exit;