## Root cause
`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:
`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`
## Changes
- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.
## Verification
- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree
## Delivery state
Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.
## Summary
- notify customers by SMS with approve/deny links when a subuser
requests access
- notify subusers by SMS after approval or denial, including manual
grant changes
- support subuser password reset and authenticated password changes
- add read-only token previews followed by explicit POST confirmation
- store short-lived one-time purpose-bound action tokens only as SHA-256
digests
- serialize grant decisions transactionally to prevent conflicting
concurrent actions
- document the API contract in OpenAPI
## Security
- generic reset responses reduce account enumeration
- URL tokens are removed from browser history after frontend bootstrap
- approval previews never mutate state
- concurrent decisions lock the exact grant row
- SMS failures remain non-fatal and are returned as delivery status
Residual risk: existing subuser sessions cannot all be centrally
invalidated after password reset because there is no per-subuser session
index; they expire normally within the existing session lifetime.
## Verification
- backend Pest: 14 tests, 91 assertions
- PHP syntax checks passed
- focused PHPStan passed
- OpenAPI YAML parsed successfully
- `git diff --check` passed
Database-backed API integration tests were unavailable because the local
environment lacks the required database configuration.
## Paired delivery
Paired Frontend PR:
https://github.com/copenhagentruckwash/pleno-vue/pull/231
Both PRs are required before completion. The frontend PR contains the
responsive visual comparisons.
Co-authored-by: Jeppe Bundgaard <jb@truckwash.dk>
## Summary
- Add self-service deletion for the authenticated customer or subuser
identity only.
- Preserve shared customer grants, reset keys, bookings, order bookings,
vehicles, invoices, and legally required history.
- Require password/TOTP or a fresh deletion-specific, five-minute,
single-use WebAuthn assertion.
- Reject support impersonation and expired legacy plain-session tokens.
- Use durable database throttling, transactional request processing, a
durable outbox, and terminal `manual_review` state.
- Keep API and worker default-off behind separate
`account_deletion.api_enabled` and `account_deletion.worker_enabled`
module-config flags.
## Safe rollout
1. Keep both flags disabled.
2. Run `php scripts/account-deletion-schema.php check`.
3. If needed, run `php scripts/account-deletion-schema.php apply --yes`,
then rerun `check` until `ready:true`.
4. Deploy the frontend companion PR while the API remains disabled.
5. Enable `api_enabled` for a controlled canary; verify password and
passwordless request flows plus immediate authentication revocation.
6. Inspect queued request/outbox state, then enable `worker_enabled`.
7. Verify anonymization, preserved tenant/history data, outbox delivery,
retries, and manual-review behavior before broad rollout.
## Verification
- Account deletion unit tests: 2 passed, 43 assertions.
- PHP lint, both OpenAPI YAML parses, runtime-DDL scan,
destructive-scope scan, and `git diff --check` passed.
- Full API/unit/integration evidence is required from exact-head CI;
local Docker is unavailable and shared-vendor tests were explicitly
discarded.
## Security notes
- Schema mutation is CLI-only; web and cron paths perform read-only
readiness checks.
- Runtime behavior fails closed when schema/config/throttle/delivery
prerequisites are unavailable.
Resolve recommended-profile Critical and High findings, retain narrow analyzer exceptions, and update the edge-broker WebSocket dependency to a non-vulnerable release.
- Introduced tests for validating note requirements on order items.
- Updated subuser route management contract tests with new route coverage.
- Added endpoints to manage department lane and self-serve lane statuses, with associated tests.
Introduce unit and API tests for subuser password policies ensuring compliance with complexity requirements. Normalize subuser grant permission handling for consistency, including support for legacy zero permissions.
- Introduced `safety_seal` column in the `orders` table.
- Updated order creation and completion logic to handle safety seal values.
- Enhanced order and booking classes to manage safety seal attachment and retrieval.
- Added tests to validate safety seal functionality in order processing.
- Extend `users_o` and `subusers_o` with `two_factor_enabled` and `two_factor_secret` properties.
- Implement methods for managing 2FA (`isTwoFactorEnabled`, `setTwoFactorSecret`, `verify_2fa_code`) in authentication logic.
- Add 2FA handling in login flows for both users and subusers, including token generation and validation.
- Introduce `totp` class for TOTP-based authentication, including QR code generation and code verification.
- Add test cases for 2FA functionality (`TwoFactorAuthTest.php`) and coverage for login scenarios with 2FA.
- Update OpenAPI specifications to include 2FA flows (`auth/2fa/setup`, `auth/2fa/enable`, `auth/2fa/verify`, `auth/2fa/disable`).
- Add `/subusers/me` as a public registration endpoint, including CVR validation, phone lookup, and optional SMS setup link generation.
- Extend OpenAPI specification with `SubuserSelf` and `SubuserGrantSummary` schemas for returning authenticated subuser profiles and grants.
- Update `subusersRoute` to support subuser authentication and permission checks dynamically.
- Add new permission nodes (`SELFSERVE_LIST`, `SELFSERVE_EDIT`, `SELFSERVE_DELETE`) in `subusers_permission_node_key`.
- Fix typos in vehicle permission constants and ensure proper resolution.
- Enhance `vehiclesRoute` with effective customer context and scoped permission checks.
- Localize new permission nodes with descriptions in Danish.
- Introduce `hasPermission` method in `subusers_o` for permission checks tied to customer context.
- Update `/subusers/me` route to return subuser grants with normalized permissions and metadata.
- Add `get_subuser_customer_number_target` in `authentication` to resolve customer context from request headers.
- Refactor route-level permission checks to handle subuser grants dynamically.
- Introduce CLI test scripts for subuser grants and permission node mappings.
- Add test coverage for subuser grants and permission nodes in new test classes.
- Replace route method for updating grants (`PATCH` to `PUT`) and streamline grant updates by directly modifying object properties instead of using manual data arrays.
- Introduce parameter validation for consistency and permission checks for cross-customer grant management.
- Require autoloading for all subuser module components (interfaces, traits, helpers, classes, and permissions) to improve modularity and maintainability.
- Allow listing subusers with only non-enabled grants by introducing an optional `include_non_enabled` query parameter.
- Update SQL query logic to conditionally include non-enabled subuser grants.
- Extend OpenAPI documentation to reflect the new parameter with its description and schema.
- Implement routes to list and retrieve subusers based on grant visibility tied to the authenticated user's customer number.
- Extend OpenAPI documentation with detailed descriptions, parameters, and response schemas for the new endpoints.
- Replace manual grant data processing with `listObjectsWithPaginationIfSet` for cleaner pagination and mapping logic.
- Include `subusers_permission_node_key` helper in dependencies.
- Implement routes for managing subuser grants: listing, creating, updating, and deleting.
- Add endpoint to fetch available permission nodes grouped by type.
- Extend `subuser_grants_o` with new utility methods, including `asArray`.
- Update OpenAPI documentation to include new endpoints and schemas.
- Define `defaultPermissions` constant in `subuser_grants_o` for managing default subuser permissions.
- Adjust `add` method to use `defaultPermissions` instead of a hardcoded array.
- Update `/subusers` route to reflect this change.
- Add `/subusers/auth/password` route for subuser authentication using password or other username types (phone, ID, etc.).
- Implement `getSubuserByUsername` in `subusers_o` for retrieving subusers by username.
- Introduce `generateSession` in `subusers_o` for creating and caching session tokens with expiration logic.
- Introduce `invalidateSetupToken` method in `subusers_o` to invalidate setup tokens after registration completion.
- Replace regex with `filter_var` for stricter email format validation.
- Update registration link domain from `web.truckwash.dk` to `truckwash.io`.
- Introduce `subuser_grants_o` for managing subuser grant records in the database.
- Add logic to `/subusers` route for creating grant entries upon subuser creation.
- Change the registration link domain from `truckwash.io` to `web.truckwash.dk`.
- Update the response message to indicate successful setup completion.
- Introduce `/subusers` route for creating subusers and linking them to companies via phone number validation.
- Add token-based subuser setup flow including token generation, validation, and expiration handling.
- Extend `subusers_o` with methods for subuser lookup, token handling, and secure password management.
- Implement enhanced input validation for subuser creation, ensuring stricter checks for name, username, and email fields.
Jeppe B