From a466c6291cc2c449e421241c726a5cc4b4eef4a1 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 20:54:44 +0200
Subject: [PATCH] Prevent XL Vask list automation execution

---
 services/nginx/app/routes/xlvaskUsageLogsRoute.php  |  2 +-
 .../Unit/XLVask/XLVaskUsageRouteContractTest.php    | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/services/nginx/app/routes/xlvaskUsageLogsRoute.php b/services/nginx/app/routes/xlvaskUsageLogsRoute.php
index fef17769..9b56b12d 100644
--- a/services/nginx/app/routes/xlvaskUsageLogsRoute.php
+++ b/services/nginx/app/routes/xlvaskUsageLogsRoute.php
@@ -67,7 +67,7 @@ class xlvaskUsageLogsRoute
                     ->setAdditionalWhereClause("`Customer` NOT IN ('" . implode("', '", $xlvask_usage_log::$default_customers) . "')")
                     ->listObjectsWithPaginationIfSet(
                         function ($log) use ($response_includes_items_link, $response_includes_items, $xlvask_usage_logs, $user, $xlvask, $automation_service, &$linked_order_ids_by_wash_id) {
-                            $automation = $automation_service->evaluateUsageLogRow($log, (int)$user->id, true);
+                            $automation = $automation_service->evaluateUsageLogRow($log, (int)$user->id, false);
                             // Remove the 'id' field from the log
                             $id = (int)$log['id'];
                             unset($log['id']);
diff --git a/services/nginx/app/tests/Unit/XLVask/XLVaskUsageRouteContractTest.php b/services/nginx/app/tests/Unit/XLVask/XLVaskUsageRouteContractTest.php
index 8d0e031b..d733c9e3 100644
--- a/services/nginx/app/tests/Unit/XLVask/XLVaskUsageRouteContractTest.php
+++ b/services/nginx/app/tests/Unit/XLVask/XLVaskUsageRouteContractTest.php
@@ -14,3 +14,16 @@ it('exposes direct linked order metadata on XL Vask usage order rows', function
         ->and($route)->toContain("'linked_order_id' => \$linked_order_id")
         ->and($route)->toContain("'usage_log_id' => \$id");
 });
+
+it('does not execute XL Vask usage automation while listing usage order rows', function (): void {
+    $route = file_get_contents(WD . '/routes/xlvaskUsageLogsRoute.php');
+
+    expect($route)->not->toBeFalse();
+
+    $route = (string)$route;
+
+    expect($route)
+        ->toContain('$automation = $automation_service->evaluateUsageLogRow($log, (int)$user->id, false);')
+        ->and($route)->not->toContain('$automation = $automation_service->evaluateUsageLogRow($log, (int)$user->id, true);')
+        ->and($route)->toContain("requirePermission('manage_xlvask_usage_automation')");
+});