Require booking add node for subuser booking creation

services/nginx/app/routes/orderBookingRoute.php

@@ -87,7 +87,8 @@ class orderBookingRoute
             $response->success($order_bookings_o->asArray());
         },
             [
-                'add_bookings' => 'Permission to create order bookings for another customer or department scope.'
+                'add_bookings' => 'Permission to create order bookings for another customer or department scope.',
+                'add_own_bookings' => 'Permission to create own order bookings. Subusers require node: BOOKINGS_ADD.'
             ]
         );
 
@@ -651,7 +652,21 @@ class orderBookingRoute
 
     private function requireOrderBookingCreateAccess(int $targetCustomerNumber, int $departmentId): void
     {
-        if ($this->isOrderBookingCustomerSession() && $this->isOwnCustomerContext($targetCustomerNumber)) {
+        $auth = new authentication();
+
+        if ($auth->get_subuser() !== false && $this->isOwnCustomerContext($targetCustomerNumber)) {
+            $permissionOwn = self::definePermission('add_own_bookings', subusers_permission_node_key::BOOKINGS_ADD);
+            if (!self::hasPermission($permissionOwn)) {
+                $this->emitForbidden([$permissionOwn]);
+            }
+            return;
+        }
+
+        if (
+            $auth->get_user() !== false
+            && self::hasPermission('user')
+            && $this->isOwnCustomerContext($targetCustomerNumber)
+        ) {
             return;
         }
 

services/nginx/app/tests/Api/OrderBookingsCreateApiTest.php

@@ -65,7 +65,7 @@ it('lets customers create their own order bookings without booking permissions',
     api_fixtures()->cleanupDeleteById('order_bookings', $bookingId);
 });
 
-it('lets subusers create own customer order bookings without the bookings add node', function (): void {
+it('blocks subusers creating own customer order bookings without the bookings add node', function (): void {
     api_test_covers('POST /order-bookings', 'auth');
 
     $customer = api_fixtures()->createUser(['display_name' => 'Subuser Booking Customer']);
@@ -79,6 +79,27 @@ it('lets subusers create own customer order bookings without the bookings add no
         $session['headers']
     );
 
+    $response
+        ->assertStatus(403)
+        ->assertEnvelope()
+        ->assertSuccess(false)
+        ->assertMissingPermissions(['add_own_bookings']);
+});
+
+it('lets subusers create own customer order bookings with the bookings add node', function (): void {
+    api_test_covers('POST /order-bookings', 'auth');
+
+    $customer = api_fixtures()->createUser(['display_name' => 'Subuser Booking Customer With Add']);
+    $session = api_fixtures()->createSubuserSession((int)$customer['customer_number'], ['BOOKINGS_ADD']);
+    $department = order_booking_create_department('Subuser Booking Add Department');
+    $product = api_fixtures()->createProduct(['name' => 'Subuser Booking Add Product']);
+
+    $response = api_client()->post(
+        '/order-bookings',
+        order_booking_create_payload($customer, $department, $product, 'SUBBOOK2'),
+        $session['headers']
+    );
+
     $response
         ->assertStatus(200)
         ->assertEnvelope()

services/nginx/app/tests/Unit/Bookings/OrderBookingCreatePermissionWiringTest.php

@@ -0,0 +1,12 @@
+<?php
+
+it('requires the BOOKINGS_ADD subuser node for own order booking creation', function (): void {
+    $routeFile = app_path('routes/orderBookingRoute.php');
+    expect(is_file($routeFile))->toBeTrue();
+
+    $code = (string)file_get_contents($routeFile);
+    $normalized = preg_replace('/\s+/', ' ', $code);
+
+    expect($normalized)->toContain("definePermission('add_own_bookings', subusers_permission_node_key::BOOKINGS_ADD)");
+    expect($normalized)->toContain("'add_own_bookings' => 'Permission to create own order bookings. Subusers require node: BOOKINGS_ADD.'");
+});