Implement global permissions for vehicle actions and update version to 2026.9.0

app/controllers/vehicles_controller.rb

@@ -13,6 +13,8 @@ class VehiclesController < ApplicationController
 
   include AuthHelper
 
+  # This tells Redmine to check global permissions for the current controller/action
+  before_action :authorize_global
   before_action :require_user
 
   def allowed_params

app/views/customer_appointments/_show_hook.html.erb

@@ -1,9 +1,11 @@
-<% if appointment.customer.present? %>
-  <% unless appointment.vehicle.present? &&%>
-    <p>
-    <%= link_to new_vehicle_path(customer_id: appointment.customer_id), class: 'icon icon-add' do %>
-      <%= l(:label_add_vehicle) %>
+<% if <% if  User.current.allowed_to?(:add_vehicles, nil, global: true) %> %>
+  <% if appointment.customer.present? %>
+    <% unless appointment.vehicle.present? &&%>
+      <p>
+      <%= link_to new_vehicle_path(customer_id: appointment.customer_id), class: 'icon icon-add' do %>
+        <%= l(:label_add_vehicle) %>
+      <% end %>
+      </p>  
     <% end %>
-    </p>  
   <% end %>
 <% end %>

app/views/customers/_show_hook.html.erb

@@ -1,5 +1,7 @@
 <h4><%=t(:field_vehicles)%>:</h4>
 <%= render partial: 'vehicles/list', locals: { vehicles: customer.vehicles.paginate(page: params[:page]), show_customer: false, show_checkbox: true } %>
 <div style="float: right;">
-    <%= button_to t(:button_new_vehicle), new_customer_vehicle_path(customer), method: :get %>
+    <% if User.current.allowed_to?(:add_vehicles, nil, global: true) %>
+        <%= button_to t(:button_new_vehicle), new_customer_vehicle_path(customer), method: :get %>
+    <% end %>
 </div>

app/views/vehicles/_details.html.erb

@@ -54,6 +54,10 @@
 <% end %>
 
 <div style="float: right;">
-  <%= button_to t(:label_edit), edit_vehicle_path(vehicle), method: :get %> 
-  <%= button_to t(:label_delete), vehicle, method: :delete, data: { confirm: t(:warn_ru_sure) } %> 
+  <% if User.current.allowed_to?(:edit_vehicles, nil, global: true) %>
+    <%= button_to t(:label_edit), edit_vehicle_path(vehicle), method: :get %> 
+  <% end %>
+  <% if User.current.allowed_to?(:delete_vehicles, nil, global: true) %>
+    <%= button_to t(:label_delete), vehicle, method: :delete, data: { confirm: t(:warn_ru_sure) } %> 
+  <% end %>
 </div>