## Root cause
`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:
`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`
## Changes
- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.
## Verification
- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree
## Delivery state
Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.
Resolve recommended-profile Critical and High findings, retain narrow analyzer exceptions, and update the edge-broker WebSocket dependency to a non-vulnerable release.
Transitioned from obsolete gateway object classes (`edge_gateway_shell_action_jobs_o`, `edge_gateway_shell_events_o`, `edge_gateway_shell_sessions_o`, `edge_gateway_update_jobs_o`) to the new agent implementation (`edge-gateway-agent/agent.php`).
- Standardize date formatting to cover full days in queries (`00:00:00` to `23:59:59`).
- Replace direct SQL queries with reusable department methods for calculating total addons and max addons.
- Update Slack notifications to include percentage breakdown with sold/total for each department.
- Remove redundant code and improve error handling for department data retrieval.
- Introduced `getTransactionsOnDateWaterUsage` method in `department_daily_reports_o` to calculate water usage based on transactions for a given date or date range.
- Updated department daily reports routes to include `water_usage` in the output.
- Introduced `is_wash` field to `products_o` for marking wash-related products.
- Updated `productsRoute` to handle `is_wash` in product creation and editing.
- Added `getTransactionsOnDateWashesCount` method in `department_daily_reports_o` for calculating wash-related transactions in reports.
- Adjusted department daily reports routes to include wash statistics output.
- Introduced optional `date_to` parameter across relevant routes and methods for handling date ranges in department daily reports.
- Added `getDate_to` method and refactored date validation logic into `validateDateLocally` for reuse and reduced redundancy.
- Updated SQL queries in `department_daily_reports_o` to support date range queries using `BETWEEN`.
- Enhanced error handling and parameter validation for date-related inputs.
- Cleaned up comments and redundant code for improved readability.
Added support for including customer name, department name, and parsed services in `asArray()` method. Introduced functionality for creating transactions, linking bookings to orders, and properly handling related services. Improved department daily report handling and removed unnecessary fields.
Introduced support for a `data` property in bookings, extended form handling with additional validation and input fields, and added functionality for retrieving booking counts by date and status. Improved safety seal labeling and enhanced PDF generation comments.
Introduced customer attribute-based filtering for individual invoicing and enhanced collected order invoice processing with proper associations to customers and orders. Added new endpoints, fields, and utility methods to streamline data retrieval, ensure consistency, and support new use cases like 'Ready to Invoice'. Includes minor fixes, validations, and optimizations throughout the affected modules.
Added date parameter support for department daily reports, including validation, new functions, and route updates. Improved functionality allows fetching or creating reports for specific dates and prevents duplicate entries for the same date. Introduced a standardized date format within the API.
Introduced a method to calculate department earnings on a given date. Enhanced department object with new properties (dimension, created_at, updated_at) and improved data serialization for flexibility. Updated routes to accommodate these additions for more robust department insights.
Introduced a new method in `department_daily_reports_o` to select the latest daily report for a department. Added a corresponding API route to fetch the latest report details for a given department ID, with appropriate validations and access control measures. Adjusted parameter handling logic to enhance request validation.
Introduced functionality for managing department daily reports, including endpoints for creating, updating, listing, and viewing product sales data. Enhanced product handling in reports by adding support for water usage, notes, and detailed product sales metrics. These changes improve tracking and reporting accuracy across departments.
Updated customer search route permission for clarity and introduced new functionality to manage and retrieve department daily reports. Added `department_daily_reports_o` object and associated route for handling reports, including permission checks, logging, and support for pagination.
Jeppe B