Web API: публичный Customer DTO и allowlist полей профиля

core/components/minishop3/src/Controllers/Api/Web/CustomerEmailController.php

@@ -5,6 +5,7 @@
 use MiniShop3\MiniShop3;
 use MiniShop3\Model\msCustomer;
 use MiniShop3\Router\Response;
+use MiniShop3\Services\Customer\CustomerPublicDto;
 use MiniShop3\Services\Customer\EmailVerificationService;
 use MODX\Revolution\modX;
 
@@ -127,7 +128,10 @@ public function verify(array $params): array|Response
 
         return $this->success(
             $this->modx->lexicon('ms3_customer_email_verify_success'),
-            ['customer_id' => $customer->id]
+            [
+                'customer_id' => $customer->id,
+                'customer' => CustomerPublicDto::fromCustomer($customer, $this->modx, $this->ms3),
+            ]
         );
     }
 

core/components/minishop3/src/Controllers/Api/Web/CustomerProfileController.php

@@ -20,31 +20,6 @@
  */
 class CustomerProfileController
 {
-    /**
-     * Field names never editable via POST /api/v1/customer/add (security & system counters).
-     *
-     * @var list<string>
-     */
-    private const PROFILE_QUICK_UPDATE_FORBIDDEN = [
-        'id',
-        'token',
-        'user_id',
-        'password',
-        'email_verified_at',
-        'is_active',
-        'is_blocked',
-        'failed_login_attempts',
-        'blocked_until',
-        'created_at',
-        'updated_at',
-        'last_login_at',
-        'orders_count',
-        'total_spent',
-        'last_order_at',
-        'privacy_accepted_at',
-        'privacy_ip',
-    ];
-
     /** @var modX */
     protected modX $modx;
 
@@ -84,9 +59,21 @@ public function update(array $data): array
         }
 
         $customerId = (int)$customer->get('id');
-        $validator = new Validator();
-        $validation = $validator->make($data, $this->getProfileFieldRules());
+        $this->ms3->loadMap();
+        $editableKeys = CustomerPublicDto::editableFieldKeys($this->modx, $this->ms3);
+        $data = array_intersect_key($data, array_flip($editableKeys));
 
+        if ($data === []) {
+            return $this->error($this->modx->lexicon('ms3_customer_err_validation'));
+        }
+
+        // Partial update: validate only the core profile rules for fields
+        // actually present in $data. Missing core fields are left untouched
+        // rather than rejected (#424 review).
+        $rules = array_intersect_key($this->getProfileFieldRules(), $data);
+
+        $validator = new Validator();
+        $validation = $validator->make($data, $rules);
         $validation->validate();
 
         if ($validation->fails()) {
@@ -99,21 +86,33 @@ public function update(array $data): array
             );
         }
 
-        $newEmail = trim($data['email']);
-
-        if (!$this->isEmailAvailable($customer, $newEmail)) {
-            $_SESSION['ms3']['customer_profile_errors'] = [
-                'email' => $this->modx->lexicon('ms3_customer_err_email_exists')
-            ];
-            return $this->error($this->modx->lexicon('ms3_customer_err_email_exists'));
+        $fieldMeta = $this->modx->getFieldMeta(msCustomer::class);
+        if (!is_array($fieldMeta) || $fieldMeta === []) {
+            return $this->error($this->modx->lexicon('ms3_customer_err_save'));
         }
 
-        $this->resetEmailVerificationIfChanged($customer, $newEmail);
+        foreach ($data as $key => $rawValue) {
+            if ($key === 'email') {
+                $newEmail = trim((string) $rawValue);
+                if (!$this->isEmailAvailable($customer, $newEmail)) {
+                    $_SESSION['ms3']['customer_profile_errors'] = [
+                        'email' => $this->modx->lexicon('ms3_customer_err_email_exists'),
+                    ];
+
+                    return $this->error($this->modx->lexicon('ms3_customer_err_email_exists'));
+                }
+                $this->resetEmailVerificationIfChanged($customer, $newEmail);
+                $customer->set('email', $newEmail);
+                continue;
+            }
+
+            if (isset($rules[$key])) {
+                $customer->set($key, trim((string) $rawValue));
+                continue;
+            }
 
-        $customer->set('first_name', trim($data['first_name']));
-        $customer->set('last_name', trim($data['last_name']));
-        $customer->set('email', $newEmail);
-        $customer->set('phone', trim($data['phone']));
+            $customer->set($key, $this->normalizeQuickProfileValue($rawValue, $fieldMeta[$key]));
+        }
 
         if (!$customer->save()) {
             return $this->error($this->modx->lexicon('ms3_customer_err_save'));
@@ -128,7 +127,7 @@ public function update(array $data): array
 
         return $this->success(
             $this->modx->lexicon('ms3_customer_profile_updated'),
-            ['customer' => CustomerPublicDto::fromCustomer($customer)]
+            ['customer' => CustomerPublicDto::fromCustomer($customer, $this->modx, $this->ms3)]
         );
     }
 
@@ -157,16 +156,13 @@ public function updateField(array $data): array
         }
 
         $this->ms3->loadMap();
-        $fieldMeta = $this->modx->getFieldMeta(msCustomer::class);
-        if (!is_array($fieldMeta) || $fieldMeta === []) {
-            return $this->error($this->modx->lexicon('ms3_customer_err_field_not_allowed'));
-        }
-
-        if (in_array($key, self::PROFILE_QUICK_UPDATE_FORBIDDEN, true)) {
+        $editableKeys = CustomerPublicDto::editableFieldKeys($this->modx, $this->ms3);
+        if (!in_array($key, $editableKeys, true)) {
             return $this->error($this->modx->lexicon('ms3_customer_err_field_not_allowed'));
         }
 
-        if (!isset($fieldMeta[$key])) {
+        $fieldMeta = $this->modx->getFieldMeta(msCustomer::class);
+        if (!is_array($fieldMeta) || !isset($fieldMeta[$key])) {
             return $this->error($this->modx->lexicon('ms3_customer_err_field_not_allowed'));
         }
 
@@ -206,7 +202,7 @@ public function updateField(array $data): array
             $this->modx->lexicon('ms3_customer_profile_updated'),
             [
                 $key => $customer->get($key),
-                'customer' => CustomerPublicDto::fromCustomer($customer),
+                'customer' => CustomerPublicDto::fromCustomer($customer, $this->modx, $this->ms3),
             ]
         );
     }

core/components/minishop3/src/Processors/Api/Customer/Login.php

@@ -2,7 +2,9 @@
 
 namespace MiniShop3\Processors\Api\Customer;
 
+use MiniShop3\MiniShop3;
 use MiniShop3\Services\Customer\AuthManager;
+use MiniShop3\Services\Customer\CustomerPublicDto;
 use MiniShop3\Services\Customer\RateLimiter;
 use MODX\Revolution\Processors\Processor;
 
@@ -98,15 +100,11 @@ public function process()
             $redirectUrl = $this->modx->makeUrl($redirectPageId, '', '', 'full');
         }
 
+        /** @var MiniShop3 $ms3 */
+        $ms3 = $this->modx->services->get('ms3');
+
         return $this->success('', [
-            'customer' => [
-                'id' => $customer->id,
-                'email' => $customer->get('email'),
-                'first_name' => $customer->get('first_name'),
-                'last_name' => $customer->get('last_name'),
-                'phone' => $customer->get('phone'),
-                'email_verified' => !empty($customer->get('email_verified_at')),
-            ],
+            'customer' => CustomerPublicDto::fromCustomer($customer, $this->modx, $ms3),
             'token' => $session['token'],
             'expires_at' => $session['expires_at'],
             'redirect_url' => $redirectUrl,

core/components/minishop3/src/Processors/Api/Customer/Register.php

@@ -2,7 +2,9 @@
 
 namespace MiniShop3\Processors\Api\Customer;
 
+use MiniShop3\MiniShop3;
 use MiniShop3\Services\Customer\AuthManager;
+use MiniShop3\Services\Customer\CustomerPublicDto;
 use MiniShop3\Services\Customer\EmailVerificationService;
 use MiniShop3\Services\Customer\RateLimiter;
 use MiniShop3\Services\Customer\RegisterService;
@@ -110,15 +112,11 @@ public function process()
             }
         }
 
+        /** @var MiniShop3 $ms3 */
+        $ms3 = $this->modx->services->get('ms3');
+
         return $this->success($this->modx->lexicon('ms3_customer_register_success'), [
-            'customer' => [
-                'id' => $customer->id,
-                'email' => $customer->get('email'),
-                'first_name' => $customer->get('first_name'),
-                'last_name' => $customer->get('last_name'),
-                'phone' => $customer->get('phone'),
-                'email_verified' => !empty($customer->get('email_verified_at')),
-            ],
+            'customer' => CustomerPublicDto::fromCustomer($customer, $this->modx, $ms3),
             'token' => $tokenString,
             'expires_at' => $expiresAt,
             'email_verification_required' => $requireEmailVerification,

core/components/minishop3/src/Processors/Api/Customer/VerifyEmail.php

@@ -2,6 +2,8 @@
 
 namespace MiniShop3\Processors\Api\Customer;
 
+use MiniShop3\MiniShop3;
+use MiniShop3\Services\Customer\CustomerPublicDto;
 use MiniShop3\Services\Customer\EmailVerificationService;
 use MODX\Revolution\Processors\Processor;
 
@@ -39,12 +41,11 @@ public function process()
             return $this->failure($this->modx->lexicon('ms3_customer_err_email_verification_invalid'));
         }
 
+        /** @var MiniShop3 $ms3 */
+        $ms3 = $this->modx->services->get('ms3');
+
         return $this->success($this->modx->lexicon('ms3_customer_email_verify_success'), [
-            'customer' => [
-                'id' => $customer->id,
-                'email' => $customer->get('email'),
-                'email_verified' => true,
-            ],
+            'customer' => CustomerPublicDto::fromCustomer($customer, $this->modx, $ms3),
         ]);
     }
 }

core/components/minishop3/src/Services/Customer/CustomerExtraFieldRegistry.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace MiniShop3\Services\Customer;
+
+use MiniShop3\Model\msCustomer;
+use MiniShop3\Model\msExtraField;
+use MODX\Revolution\modX;
+
+/**
+ * DB lookup of active msExtraField keys for msCustomer (#424).
+ *
+ * Extracted from CustomerPublicDto so the extra-field query is reusable and
+ * testable without dragging the whole DTO allowlist along.
+ */
+final class CustomerExtraFieldRegistry
+{
+    /**
+     * Active msExtraField keys registered for msCustomer.
+     *
+     * @return list<string>
+     */
+    public static function activeKeys(modX $modx): array
+    {
+        $keys = [];
+        $iterator = $modx->getIterator(msExtraField::class, [
+            'class' => msCustomer::class,
+            'active' => 1,
+        ]);
+
+        foreach ($iterator as $field) {
+            $keys[] = (string) $field->get('key');
+        }
+
+        return $keys;
+    }
+}