Extend subuser permission system and refactor route permission handling
- Update `subusersRoute` to support subuser authentication and permission checks dynamically. - Add new permission nodes (`SELFSERVE_LIST`, `SELFSERVE_EDIT`, `SELFSERVE_DELETE`) in `subusers_permission_node_key`. - Fix typos in vehicle permission constants and ensure proper resolution. - Enhance `vehiclesRoute` with effective customer context and scoped permission checks. - Localize new permission nodes with descriptions in Danish.
This commit is contained in:
@@ -57,6 +57,17 @@ class vehiclesRoute
|
||||
// Listing: restrict to effective customer when lacking the broader permission
|
||||
$vehicles_o = new customer_vehicles_o();
|
||||
$effectiveCustomer = self::resolveEffectiveCustomerNumber();
|
||||
$permitted = self::allowOwnOrDepartmentAccess(
|
||||
$permission_own,
|
||||
$permission_other,
|
||||
$effectiveCustomer,
|
||||
null,
|
||||
null,
|
||||
'You do not have permission to view vehicles.'
|
||||
);
|
||||
if (!$permitted) {
|
||||
$response->error('You do not have permission to view vehicles.');
|
||||
}
|
||||
$response->success(
|
||||
$vehicles_o->listObjectsWithPaginationIfSet(
|
||||
function ($vehicle) {
|
||||
|
||||
Reference in New Issue
Block a user