From bab019a152d3b15c3a0e80a5c9cd9b7223272593 Mon Sep 17 00:00:00 2001
From: Rick Barrette <rickbarrette@gmail.com>
Date: Tue, 8 Sep 2026 22:35:52 -0400
Subject: [PATCH] Implement global permissions for customer actions and update
 views to check permissions before rendering buttons

---
 app/controllers/customers_controller.rb | 2 ++
 app/views/customers/_actions.html.erb   | 4 +++-
 app/views/customers/_search.html.erb    | 4 +++-
 app/views/qbo/_sidebar.html.erb         | 5 ++++-
 init.rb                                 | 9 +++++----
 5 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/app/controllers/customers_controller.rb b/app/controllers/customers_controller.rb
index 8553000..7cf78e8 100644
--- a/app/controllers/customers_controller.rb
+++ b/app/controllers/customers_controller.rb
@@ -25,6 +25,8 @@ class CustomersController < ApplicationController
   include SortHelper
   helper :timelog
 
+  # This tells Redmine to check global permissions for the current controller/action
+  before_action :authorize_global
   before_action :add_customer, only: [:new, :create]
   before_action :view_customer, except: [:new, :create, :view]
   skip_before_action :verify_authenticity_token, :check_if_login_required, only: [:view]
diff --git a/app/views/customers/_actions.html.erb b/app/views/customers/_actions.html.erb
index 57f86a9..8da3454 100644
--- a/app/views/customers/_actions.html.erb
+++ b/app/views/customers/_actions.html.erb
@@ -14,7 +14,9 @@
 
 <%= call_hook :customer_actions_bottom, { customer: @customer } %>
 
-<%= button_to t(:label_edit_customer), edit_customer_path(@customer), method: :get%> 
+<% if User.current.allowed_to?(:edit_customers, nil, global: true) %>
+  <%= button_to t(:label_edit_customer), edit_customer_path(@customer), method: :get%> 
+<% end %>
 
 <script>
   function handleSingleSelect(event, className) {
diff --git a/app/views/customers/_search.html.erb b/app/views/customers/_search.html.erb
index bebbc29..da2e1d9 100644
--- a/app/views/customers/_search.html.erb
+++ b/app/views/customers/_search.html.erb
@@ -2,5 +2,7 @@
     <%= text_field_tag :search, params[:search], class: "customer-name", placeholder: t(:label_search_customers), autocomplete: "off", data: { autocomplete_url: "/customers/autocomplete" } %>
     <%= submit_tag t(:label_search) %>
 <% end %>
-<%= button_to t(:label_new_customer), new_customer_path, method: :get%>
+<% if User.current.allowed_to?(:add_customers, nil, global: true) %>
+    <%= button_to t(:label_new_customer), new_customer_path, method: :get%>
+<% end %>
 <%= button_to(t(:label_sync), qbo_sync_path, method: :get) if User.current.admin?%>
diff --git a/app/views/qbo/_sidebar.html.erb b/app/views/qbo/_sidebar.html.erb
index f8f2749..bce97d4 100644
--- a/app/views/qbo/_sidebar.html.erb
+++ b/app/views/qbo/_sidebar.html.erb
@@ -1,6 +1,9 @@
 <% if User.current.logged? %>
 
-    <%= render partial: 'customers/sidebar' %>
+    <% if User.current.allowed_to?(:view_customers, nil, global: true) %>
+        <%= render partial: 'customers/sidebar' %>
+    <% end %>
+
     <%= render partial: 'estimates/sidebar' %>
 
 <% end %>
diff --git a/init.rb b/init.rb
index cf74cea..c7e231f 100644
--- a/init.rb
+++ b/init.rb
@@ -30,12 +30,13 @@ Redmine::Plugin.register :redmine_qbo do
   # set per_page globally
   WillPaginate.per_page = 20
 
-  # Permissions for security
-  permission :view_customers, customers: :index, public: false
-  permission :add_customers, customers: :new, public: false
+  # Global Permissions
+  permission :view_customers, { customers: [:index, :show] }, global: true
+  permission :add_customers, { customers: [:new, :create] }, global: true
+  permission :edit_customers, { customers: [:edit, :update] }, global: true
   
   # Register top menu items
-  menu :top_menu, :customers, { controller: :customers, action: :index }, caption: :label_customers, if: Proc.new {User.current.logged?}
+  menu :top_menu, :customers, { controller: :customers, action: :index }, caption: :label_customers, if: Proc.new {User.current.allowed_to?(:view_customers, nil, global: true)}
     
   Redmine::Search.map do |search|
     search.register :customers