From 9627da20e1b106d0ced92b1323472dabf1c556a2 Mon Sep 17 00:00:00 2001
From: Marco0300 <Marco0300@users.noreply.github.com>
Date: Tue, 1 Sep 2026 23:10:07 +0200
Subject: [PATCH] fix: remove remaining named report parameter

---
 public/index.php                       | 4 ++--
 tests/JobcardSearchCloseReportTest.php | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/public/index.php b/public/index.php
index a0b078f..81a19ab 100644
--- a/public/index.php
+++ b/public/index.php
@@ -741,8 +741,8 @@ if ($route === 'reports') {
     $reportRows = $reportStmt->fetchAll();
     $rows = array_map(static fn (array $row): array => [$row['client_name'], (int)$row['jobcards'], round((float)$row['hours'], 2)], $reportRows);
     if ($user['role_name'] === 'Technician') {
-        $reportClientsStmt = db()->prepare('SELECT DISTINCT c.id, c.name FROM clients c JOIN jobcards j ON j.client_id = c.id JOIN jobcard_assignments ja ON ja.jobcard_id = j.id AND ja.user_id = :user ORDER BY c.name');
-        $reportClientsStmt->execute(['user' => $user['id']]);
+        $reportClientsStmt = db()->prepare('SELECT DISTINCT c.id, c.name FROM clients c JOIN jobcards j ON j.client_id = c.id JOIN jobcard_assignments ja ON ja.jobcard_id = j.id AND ja.user_id = ? ORDER BY c.name');
+        $reportClientsStmt->execute([(int)$user['id']]);
         $reportClients = $reportClientsStmt->fetchAll();
     } else {
         $reportClients = db()->query('SELECT id, name FROM clients ORDER BY name')->fetchAll();
diff --git a/tests/JobcardSearchCloseReportTest.php b/tests/JobcardSearchCloseReportTest.php
index 41c1e88..d1247af 100644
--- a/tests/JobcardSearchCloseReportTest.php
+++ b/tests/JobcardSearchCloseReportTest.php
@@ -16,6 +16,6 @@ jobcard_feature_assert(str_contains($front, "j.status = 'closed'"), 'Closed filt
 jobcard_feature_assert(str_contains($front, 'All clients') && str_contains($front, '$reportClient'), 'Reports must use a client-name dropdown.');
 jobcard_feature_assert(str_contains($front, 'format=xls&detail=1'), 'Reports must expose detailed XLS export.');
 jobcard_feature_assert(str_contains($front, "if (\$user['role_name'] === 'Technician') {") && str_contains($front, '$reportClientsStmt->execute'), 'Report client dropdown must bind parameters only on the technician prepared-query branch.');
-jobcard_feature_assert(!str_contains($front, 'if ($reportClients instanceof PDOStatement) $reportClients->execute'), 'Report client dropdown must not execute parameters against the non-technician query branch.');
+jobcard_feature_assert(str_contains($front, '$reportClientsStmt->execute([(int)$user[\'id\']])'), 'Technician report client lookup must use a positional bound parameter.');
 foreach (['Work requested', 'Technician notes / Work performed', 'Hours notes'] as $heading) jobcard_feature_assert(str_contains($front, $heading), "Detailed report must include {$heading}.");
 printf("Jobcard search/close/report tests: 10 passed\n");