## Root cause
`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:
`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`
## Changes
- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.
## Verification
- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree
## Delivery state
Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
Complete and secure public customer/driver registration, authoritative limited-backoffice department scope, one-time employee QR login, and pricing concurrency for the Sæby demo.
- Added `archived` column and index to `departments` table, ensuring schema initialization via `departments_schema_bootstrap`.
- Updated OpenAPI spec to include `archived` attribute and `filters=archived` query parameter with superuser access control.
- Enhanced `Departments` API to support archived department filtering and retrieval.
- Modified `ApiFixtures`, `departments_o`, and related tests to validate behavior for archived departments.
- Added unit and API tests to ensure correct handling of archived departments and filter enforceability.
- Introduce `order_priority` property in `departments_o.php`.
- Update `departmentsRoute.php` to handle `order_priority` in input and output.
- Adjust object initialization and serialization for the new field.
- Introduced `latitude` and `longitude` properties in `departments_o` for geographic data support.
- Updated department routes to handle latitude/longitude in responses and parameter updates.
- Adjusted serialization and object creation to include new properties.
Added a `visible` property to manage department visibility. Updated routes, traits, and objects to filter out non-visible departments and restrict access to internal system departments for end-users. This improves data security and enhances control over information exposure.
This commit introduces changes to include branding information in departments. Updates were made to routes, forms, and objects to handle branding IDs and enforce validation. Additionally, a method call was added to track object changes when branding is updated.
Introduced a method to calculate department earnings on a given date. Enhanced department object with new properties (dimension, created_at, updated_at) and improved data serialization for flexibility. Updated routes to accommodate these additions for more robust department insights.
This update introduces functionalities for managing roles, permissions, and access control across departments. Key additions include methods for filtering, restricting, and handling user permissions, as well as new APIs for assigning/removing permissions to/from roles. Access to resources like orders, bookings, and plate scans is now securely tied to department-specific permissions.
Introduced vehicle type handling in `motorapi` with a helper class. Integrated recommended order logic based on vehicle plate and order history, enhancing order and department route functionality.
This update introduces new endpoints for managing Stripe terminal readers, locations, and department-specific configurations. It also adds support for creating, updating, and retrieving department variables along with enhanced validation, logging, and permission checks. These updates improve integration and expand functionality for Stripe and department-related operations.
This update introduces explicit permission definitions for various route handlers across multiple routes. These changes enhance clarity and allow for more granular control over route access based on defined permissions. The updates ensure better manageability and scalability of endpoint permissions.
Implemented MotorAPI lookup functionality with proper validation and logging. Added Economic products endpoint for fetching product details. Enhanced route parameter validation with length constraints and improved response handling for objects.
Introduce endpoints for managing product options and department categories, including listing, creating, editing, and deleting functionalities. Updated related objects and traits to support new operations, including added array serialization methods and improved query handling for better flexibility.
Added `delete`, `restore`, and other utility methods to enhance CRUD operations, including support for soft deletes. Introduced `objectChanged` hooks across objects for better cache or event handling, ensuring scalability and maintainability. Refactored and standardized object property handling while restructuring related methods.
Introduced a `setSearchableFields` method to restrict searchable fields in database queries, enhancing security by preventing unintended access to sensitive data. Updated user and department routes to leverage this feature. Default behavior remains unchanged when no searchable fields are specified.
Jeppe B