## Root cause
`route_t::hasPermission()` and `requirePermission()` are instance
methods. Route code was invoking them with `self::`; the new XL Vask
hall-scope helper made that call from a genuinely static context,
causing PHP to throw:
`Non-static method routes\\xlvaskUsageLogsRoute::hasPermission() cannot
be called statically`
## Changes
- Invoke route permission methods through `$this` across all 273
executable legacy calls in 45 route classes.
- Make `xlvaskUsageLogsRoute::allowedHallIdsForUser()` an instance
helper and update all 13 callers.
- Preserve the existing all-scope and own-scope hall selection rules.
- Add a token-aware regression test that rejects executable
`self::hasPermission()` and `self::requirePermission()` calls, while
ignoring comments.
- Add focused XL Vask tests for global scanner hall scope and
group-limited own scope.
- Update affected route contract assertions to the instance-call form.
## Verification
- PHP lint: all 53 changed PHP files
- Focused PHPStan: changed XL Vask route and both new regression tests —
clean
- Focused regression slice: 58 passed, 748 assertions
- Full local unit suite: 1,300 passed, 9,442 assertions (1 unrelated
existing warning, 1 environment skip)
- Full local API suite: 285 passed, 11,704 assertions
- Exact-SHA GitHub Tests workflow: all 7 jobs passed (unit, API,
integration, legacy, edge gateway, and supporting checks)
- Independent exact-SHA QA gate: PASS, no findings
- Independent exact-SHA security gate: PASS, no findings
- Independent exact-SHA reviewer gate: PASS, no findings
- Remote comparison: exactly one commit ahead of
`40b104abed7723a7d1b7028190ecda0e7aeef829`; all 53 remote blob hashes
matched the reviewed worktree
## Delivery state
Draft only for human review. No merge or deployment is included. Qodana
is skipped while the PR remains draft and is therefore not represented
as a passed gate.
- Update `subusersRoute` to support subuser authentication and permission checks dynamically.
- Add new permission nodes (`SELFSERVE_LIST`, `SELFSERVE_EDIT`, `SELFSERVE_DELETE`) in `subusers_permission_node_key`.
- Fix typos in vehicle permission constants and ensure proper resolution.
- Enhance `vehiclesRoute` with effective customer context and scoped permission checks.
- Localize new permission nodes with descriptions in Danish.
- Integrate `subusers_permission_node_key` for dynamic subuser-specific permission checks.
- Refactor authentication and permission logic to streamline checks for own vs. department-level access.
- Simplify error handling and enforce scoped permissions for vehicles, orders, and their attachments.
- Localize permission labels and descriptions to Danish for relevant modules.
- Updated `db_object_t` to treat both `null` and string `'null'` as null values for filtering.
- Added `deleted_at IS NULL` condition in `vehiclesRoute` booking-related queries to exclude soft-deleted entries.
- Introduced optional `department` parameter in `vehiclesRoute` for filtering booked registrations.
- Validated `department` input to ensure existence and access rights.
- Updated `getBookedRegs` to support dynamic filtering with department-specific criteria.
- Updated booking-related queries to use `order_bookings_o` for improved consistency and clarity.
- Replaced `regNrTraekker`/`regNrTrailer` with `reg_1`/`reg_2` in queries and results.
- Added `NULL` condition handling in `db_object_t` to support filtering by null field values.
- Enhanced booking data extraction with renamed fields (`reference_number` → `reference`, `notes` → `note`).
- Added logic to determine if a known vehicle has been assigned to a specific customer and retrieve the customer name.
- Integrated checks to handle barred customers by resetting vehicle status to `unknown` and clearing customer details.
- Ensured support for scenarios with multiple known customers, marking vehicles accordingly.
- Introduced a new route `/vehicles/search` to enable searching for vehicles by registration number across multiple categories (e.g., verified, known, booked, unknown).
- Added validation for search parameters, including length and format checks.
- Ensured proper classification of vehicles with clear prioritization and deduplication logic.
- Implemented helper methods to retrieve matching registrations from various sources like bookings, orders, and scanned plates.
- Enhanced response format to include vehicle status, customer details, and references for improved usability.
- Introduced a new route `/vehicles/status` to provide detailed vehicle status, including verification, booking, and last order information.
- Added `getLastOrderByPlate` method in `customer_vehicles_o` to retrieve the last order for a vehicle plate.
- Implemented validation for registration number and optional department parameter.
- Enhanced response with multiple status indicators like `verified`, `known`, `booked`, and `card`.
Updated logic to allow vehicle type to be set to 0 and handle related subscription behavior. Added safeguards to prevent setting subscriptions when type is unset. Introduced `isPlateSeenBefore` in `orders_o` and enhanced `plateScansRoute` to include `seen_before` data.
Introduced the 'barred' property to identify barred customers and vehicles. Updated relevant classes, methods, and API endpoints to handle this new field. Enhanced plate scans to include the barred status for vehicles based on customer association.
Introduce a new "reference" field for vehicles to allow storing and validating additional information. Updates include parameter handling, validation, and database integration for creating, modifying, and retrieving the "reference" field.
Introduced two new endpoints: one for listing unknown customer vehicles and another for fetching customer suggestions based on a vehicle registration. These changes include authentication, input validation, and proper logging for each new route.
Ensure correct comparison between customer ID and user number by explicitly casting both to integers. This prevents potential logical errors when checking permissions for vehicle deletion.
This update refactors vehicle-related routes to include consistent endpoints, enhanced functionality, and stricter permission checks. It introduces vehicle add-on management with toggling and retrieval APIs, enabling detailed customization and user control. Additionally, the new `asArray` methods and updated logic improve data handling and validation.
This update introduces explicit permission definitions for various route handlers across multiple routes. These changes enhance clarity and allow for more granular control over route access based on defined permissions. The updates ensure better manageability and scalability of endpoint permissions.
Jeppe B