2026.9.0

app/controllers/customers_controller.rb

@@ -25,6 +25,8 @@ class CustomersController < ApplicationController
   include SortHelper
   helper :timelog
 
+  # This tells Redmine to check global permissions for the current controller/action
+  before_action :authorize_global
   before_action :add_customer, only: [:new, :create]
   before_action :view_customer, except: [:new, :create, :view]
   skip_before_action :verify_authenticity_token, :check_if_login_required, only: [:view]

app/views/customers/_actions.html.erb

@@ -14,7 +14,9 @@
 
 <%= call_hook :customer_actions_bottom, { customer: @customer } %>
 
-<%= button_to t(:label_edit_customer), edit_customer_path(@customer), method: :get%> 
+<% if User.current.allowed_to?(:edit_customers, nil, global: true) %>
+  <%= button_to t(:label_edit_customer), edit_customer_path(@customer), method: :get%> 
+<% end %>
 
 <script>
   function handleSingleSelect(event, className) {

app/views/customers/_search.html.erb

@@ -2,5 +2,7 @@
     <%= text_field_tag :search, params[:search], class: "customer-name", placeholder: t(:label_search_customers), autocomplete: "off", data: { autocomplete_url: "/customers/autocomplete" } %>
     <%= submit_tag t(:label_search) %>
 <% end %>
-<%= button_to t(:label_new_customer), new_customer_path, method: :get%>
+<% if User.current.allowed_to?(:add_customers, nil, global: true) %>
+    <%= button_to t(:label_new_customer), new_customer_path, method: :get%>
+<% end %>
 <%= button_to(t(:label_sync), qbo_sync_path, method: :get) if User.current.admin?%>

app/views/qbo/_sidebar.html.erb

@@ -1,6 +1,9 @@
 <% if User.current.logged? %>
 
-    <%= render partial: 'customers/sidebar' %>
+    <% if User.current.allowed_to?(:view_customers, nil, global: true) %>
+        <%= render partial: 'customers/sidebar' %>
+    <% end %>
+
     <%= render partial: 'estimates/sidebar' %>
 
 <% end %>

init.rb

@@ -14,7 +14,7 @@ Redmine::Plugin.register :redmine_qbo do
   name 'Redmine QBO plugin'
   author 'Rick Barrette'
   description 'A pluging for Redmine to connect with QuickBooks Online to create Time Activity Entries for billable hours logged when an Issue is closed'
-  version '2026.8.3'
+  version '2026.9.0'
   url 'https://github.com/rickbarrette/redmine_qbo'
   author_url 'https://barrettefabrication.com'
   settings default: {empty: true}, partial: 'qbo/settings'
@@ -30,12 +30,13 @@ Redmine::Plugin.register :redmine_qbo do
   # set per_page globally
   WillPaginate.per_page = 20
 
-  # Permissions for security
+  # Global Permissions
-  permission :view_customers, customers: :index, public: false
+  permission :view_customers, { customers: [:index, :show] }, global: true
-  permission :add_customers, customers: :new, public: false
+  permission :add_customers, { customers: [:new, :create] }, global: true
+  permission :edit_customers, { customers: [:edit, :update] }, global: true
   
   # Register top menu items
-  menu :top_menu, :customers, { controller: :customers, action: :index }, caption: :label_customers, if: Proc.new {User.current.logged?}
+  menu :top_menu, :customers, { controller: :customers, action: :index }, caption: :label_customers, if: Proc.new {User.current.allowed_to?(:view_customers, nil, global: true)}
     
   Redmine::Search.map do |search|
     search.register :customers