Extend subuser permission system and refactor route permission handling

- Update `subusersRoute` to support subuser authentication and permission checks dynamically.
- Add new permission nodes (`SELFSERVE_LIST`, `SELFSERVE_EDIT`, `SELFSERVE_DELETE`) in `subusers_permission_node_key`.
- Fix typos in vehicle permission constants and ensure proper resolution.
- Enhance `vehiclesRoute` with effective customer context and scoped permission checks.
- Localize new permission nodes with descriptions in Danish.
This commit is contained in:
Jeppe Bundgaard
2026-02-12 16:26:29 +01:00
parent 19139b08cb
commit 6302fd25df
4 changed files with 46 additions and 10 deletions
@@ -57,6 +57,17 @@ class vehiclesRoute
// Listing: restrict to effective customer when lacking the broader permission
$vehicles_o = new customer_vehicles_o();
$effectiveCustomer = self::resolveEffectiveCustomerNumber();
$permitted = self::allowOwnOrDepartmentAccess(
$permission_own,
$permission_other,
$effectiveCustomer,
null,
null,
'You do not have permission to view vehicles.'
);
if (!$permitted) {
$response->error('You do not have permission to view vehicles.');
}
$response->success(
$vehicles_o->listObjectsWithPaginationIfSet(
function ($vehicle) {