Refactor: Upgrade api service

[DawoudIO]

What Changed

Fixes #

Type

• ✨ Feature
• 🐛 Bug fix
• ♻️ Refactor
• 🏗️ Build/Infrastructure
• 🔒 Security

Testing

Screenshots

Security Check

• Introduces new input validation
• Modifies authentication/authorization
• Affects data privacy/GDPR

Code Quality

• Database: Propel ORM only, no raw SQL
• No deprecated attributes (align, valign, nowrap, border, cellpadding, cellspacing, bgcolor)
• Bootstrap CSS classes used
• All CSS bundled via webpack

Pre-Merge

• Tested locally
• No new warnings
• Build passes
• Backward compatible (or migration documented)

[Copilot]

Pull request overview

This PR refactors the system upgrade API endpoints by consolidating them under the new admin API infrastructure. The upgrade endpoints are moved from /api/systemupgrade to /admin/api/upgrade, following the established pattern for admin-only APIs introduced in previous refactorings.

Key Changes:

• Introduces UpgradeAPIService to encapsulate upgrade operations following the service layer pattern
• Migrates three upgrade endpoints to the new admin API route structure with proper documentation
• Updates frontend JavaScript to use AdminAPIRequest instead of APIRequest for admin-specific endpoints

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
webpack/upgrade-wizard-app.js	Updated API calls to use AdminAPIRequest with new /admin/api/upgrade paths
src/skin/js/CRMJSOM.js	Added new AdminAPIRequest wrapper function for admin API endpoints
src/api/index.php	Removed old system-upgrade.php route registration
src/admin/routes/system.php	Added fresh release check when loading upgrade page
src/admin/routes/api/upgrade.php	Migrated upgrade endpoints with enhanced documentation
src/admin/index.php	Registered new upgrade API route file
src/ChurchCRM/dto/ChurchCRMReleaseManager.php	Added debug logging for version comparison troubleshooting
src/ChurchCRM/Service/UpgradeAPIService.php	New service class wrapping ChurchCRMReleaseManager for API routes

Comments suppressed due to low confidence (2)

src/admin/routes/api/upgrade.php:42

• Missing input validation for required parameters. The $input['fullPath'] and $input['sha1'] are accessed directly without checking if they exist in the parsed body. If these fields are missing, this will generate PHP warnings/errors.

Add validation before calling the service:

$input = $request->getParsedBody();
if (!isset($input['fullPath']) || !isset($input['sha1'])) {
    return SlimUtils::renderJSON($response, [
        'message' => 'Missing required parameters: fullPath and sha1'
    ], 400);
}
UpgradeAPIService::doUpgrade($input['fullPath'], $input['sha1']);

webpack/upgrade-wizard-app.js:177

• Inconsistent parameter name. The function uses type: 'GET' instead of method: 'GET', which is inconsistent with the other API calls in this file (lines 250, 347, 403) that use method. While jQuery's $.ajax() accepts both, the codebase should use consistent naming.

Change to:

window.CRM.AdminAPIRequest({
    method: 'GET',
    path: 'upgrade/download-latest-release',
})

 * Auto-download update when step is shown
 */
function autoDownloadUpdate() {

[Copilot]

The conditional logic is incorrect. When a method is provided, dataType should be set to "json", but the current logic only sets it when a method is NOT provided. This means GET requests won't have dataType: "json" but POST/PUT requests will.

This should be:

if (!options.method) {
    options.method = "GET";
}
options.dataType = "json";

The same bug exists in the original APIRequest function above (lines 6-10).