copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Require booking add node for subuser booking creation

Browse Source
This commit is contained in:
Jeppe Bundgaard
2026-07-06 16:48:07 +02:00
parent c089186046
commit 8bbdf9daf5
3 changed files with 51 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/orderBookingRoute.php
+17 -2
View File
@@ -87,7 +87,8 @@ class orderBookingRoute
$response->success($order_bookings_o->asArray());
},
[
'add_bookings' => 'Permission to create order bookings for another customer or department scope.'
'add_bookings' => 'Permission to create order bookings for another customer or department scope.',
'add_own_bookings' => 'Permission to create own order bookings. Subusers require node: BOOKINGS_ADD.'
]
);
@@ -651,7 +652,21 @@ class orderBookingRoute
private function requireOrderBookingCreateAccess(int $targetCustomerNumber, int $departmentId): void
{
if ($this->isOrderBookingCustomerSession() && $this->isOwnCustomerContext($targetCustomerNumber)) {
$auth = new authentication();
if ($auth->get_subuser() !== false && $this->isOwnCustomerContext($targetCustomerNumber)) {
$permissionOwn = self::definePermission('add_own_bookings', subusers_permission_node_key::BOOKINGS_ADD);
if (!self::hasPermission($permissionOwn)) {
$this->emitForbidden([$permissionOwn]);
}
return;
}
if (
$auth->get_user() !== false
&& self::hasPermission('user')
&& $this->isOwnCustomerContext($targetCustomerNumber)
) {
return;
}