2026.9.0

app/controllers/customers_controller.rb

@@ -25,6 +25,8 @@ class CustomersController < ApplicationController
   include SortHelper
   helper :timelog
 
+  # This tells Redmine to check global permissions for the current controller/action
+  before_action :authorize_global
   before_action :add_customer, only: [:new, :create]
   before_action :view_customer, except: [:new, :create, :view]
   skip_before_action :verify_authenticity_token, :check_if_login_required, only: [:view]

app/views/customers/_actions.html.erb

@@ -14,7 +14,9 @@
 
 <%= call_hook :customer_actions_bottom, { customer: @customer } %>
 
-<%= button_to t(:label_edit_customer), edit_customer_path(@customer), method: :get%> 
+<% if User.current.allowed_to?(:edit_customers, nil, global: true) %>
+  <%= button_to t(:label_edit_customer), edit_customer_path(@customer), method: :get%> 
+<% end %>
 
 <script>
   function handleSingleSelect(event, className) {

app/views/customers/_search.html.erb

@@ -2,5 +2,7 @@
     <%= text_field_tag :search, params[:search], class: "customer-name", placeholder: t(:label_search_customers), autocomplete: "off", data: { autocomplete_url: "/customers/autocomplete" } %>
     <%= submit_tag t(:label_search) %>
 <% end %>
-<%= button_to t(:label_new_customer), new_customer_path, method: :get%>
+<% if User.current.allowed_to?(:add_customers, nil, global: true) %>
+    <%= button_to t(:label_new_customer), new_customer_path, method: :get%>
+<% end %>
 <%= button_to(t(:label_sync), qbo_sync_path, method: :get) if User.current.admin?%>

app/views/qbo/_sidebar.html.erb

@@ -1,6 +1,9 @@
 <% if User.current.logged? %>
 
-    <%= render partial: 'customers/sidebar' %>
+    <% if User.current.allowed_to?(:view_customers, nil, global: true) %>
+        <%= render partial: 'customers/sidebar' %>
+    <% end %>
+
     <%= render partial: 'estimates/sidebar' %>
 
 <% end %>

init.rb

@@ -14,7 +14,7 @@ Redmine::Plugin.register :redmine_qbo do
   name 'Redmine QBO plugin'
   author 'Rick Barrette'
   description 'A pluging for Redmine to connect with QuickBooks Online to create Time Activity Entries for billable hours logged when an Issue is closed'
-  version '2026.8.2'
+  version '2026.9.0'
   url 'https://github.com/rickbarrette/redmine_qbo'
   author_url 'https://barrettefabrication.com'
   settings default: {empty: true}, partial: 'qbo/settings'
@@ -30,12 +30,13 @@ Redmine::Plugin.register :redmine_qbo do
   # set per_page globally
   WillPaginate.per_page = 20
 
-  # Permissions for security
-  permission :view_customers, customers: :index, public: false
-  permission :add_customers, customers: :new, public: false
+  # Global Permissions
+  permission :view_customers, { customers: [:index, :show] }, global: true
+  permission :add_customers, { customers: [:new, :create] }, global: true
+  permission :edit_customers, { customers: [:edit, :update] }, global: true
   
   # Register top menu items
-  menu :top_menu, :customers, { controller: :customers, action: :index }, caption: :label_customers, if: Proc.new {User.current.logged?}
+  menu :top_menu, :customers, { controller: :customers, action: :index }, caption: :label_customers, if: Proc.new {User.current.allowed_to?(:view_customers, nil, global: true)}
     
   Redmine::Search.map do |search|
     search.register :customers

lib/redmine_qbo.rb

@@ -29,6 +29,15 @@ module RedmineQbo
     RedmineQbo::Hooks::IssuesHookListener
     RedmineQbo::Hooks::UsersShowHookListener
     RedmineQbo::Hooks::ViewHookListener
+
+    # If the SubtaskFieldCopier plugin is installed, register our fields
+    if defined?(SubtaskFieldCopier)
+      SubtaskFieldCopier.registered_fields << :customer
+      SubtaskFieldCopier.registered_fields << :estimate
+      
+      # Ensure there are no duplicates in case of hot-reloads in development mode
+      SubtaskFieldCopier.registered_fields.uniq!
+    end
   end
 
   def self.settings