## Root cause
`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:
`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`
## Changes
- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.
## Verification
- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree
## Delivery state
Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
Introduced functionality for managing department daily reports, including endpoints for creating, updating, listing, and viewing product sales data. Enhanced product handling in reports by adding support for water usage, notes, and detailed product sales metrics. These changes improve tracking and reporting accuracy across departments.
Updated customer search route permission for clarity and introduced new functionality to manage and retrieve department daily reports. Added `department_daily_reports_o` object and associated route for handling reports, including permission checks, logging, and support for pagination.
Added individual getter methods for customer details such as name, email, address, zip code, city, and country in the economic_customer module. Updated the invoices drafts endpoint to use these accessors instead of directly accessing properties. Included an exception throw for failed requests in the endpoint.
This update introduces explicit permission definitions for various route handlers across multiple routes. These changes enhance clarity and allow for more granular control over route access based on defined permissions. The updates ensure better manageability and scalability of endpoint permissions.
Implemented endpoints to list and import customers from the Economic API, including query filtering, pagination, and validation. Added supporting trait methods, database functions, and error handling. Expanded the user object for Economic integration and introduced utilities for type checking and parameter extraction.
Introduced endpoints and routes for managing draft invoices, enabling retrieval and updates. Extended object handling to include filters for deleted entries and added custom parsing for pagination results. Refactored code for improved structure and consistency.
Jeppe B