Implement global permissions for vehicle actions and update version to 2026.9.0

app/controllers/vehicles_controller.rb

@@ -13,6 +13,8 @@ class VehiclesController < ApplicationController
 
   include AuthHelper
 
+  # This tells Redmine to check global permissions for the current controller/action
+  before_action :authorize_global
   before_action :require_user
 
   def allowed_params

app/views/customer_appointments/_show_hook.html.erb

@@ -1,4 +1,5 @@
-<% if appointment.customer.present? %>
+<% if <% if  User.current.allowed_to?(:add_vehicles, nil, global: true) %> %>
+  <% if appointment.customer.present? %>
     <% unless appointment.vehicle.present? &&%>
       <p>
       <%= link_to new_vehicle_path(customer_id: appointment.customer_id), class: 'icon icon-add' do %>
@@ -6,4 +7,5 @@
       <% end %>
       </p>  
     <% end %>
+  <% end %>
 <% end %>

app/views/customers/_show_hook.html.erb

@@ -1,5 +1,7 @@
 <h4><%=t(:field_vehicles)%>:</h4>
 <%= render partial: 'vehicles/list', locals: { vehicles: customer.vehicles.paginate(page: params[:page]), show_customer: false, show_checkbox: true } %>
 <div style="float: right;">
+    <% if User.current.allowed_to?(:add_vehicles, nil, global: true) %>
         <%= button_to t(:button_new_vehicle), new_customer_vehicle_path(customer), method: :get %>
+    <% end %>
 </div>

app/views/vehicles/_details.html.erb

@@ -54,6 +54,10 @@
 <% end %>
 
 <div style="float: right;">
+  <% if User.current.allowed_to?(:edit_vehicles, nil, global: true) %>
     <%= button_to t(:label_edit), edit_vehicle_path(vehicle), method: :get %> 
+  <% end %>
+  <% if User.current.allowed_to?(:delete_vehicles, nil, global: true) %>
     <%= button_to t(:label_delete), vehicle, method: :delete, data: { confirm: t(:warn_ru_sure) } %> 
+  <% end %>
 </div>

app/views/vehicles/_list.html.erb

@@ -6,7 +6,7 @@
       <div class="container">
 
         <% if show_checkbox %>
-          <%= check_box_tag "vehicle_ids[]", vehicle.id, false,  onchange: "updateLink()", data: { url: vehicle_path(vehicle).html_safe, text: vehicle.to_s }, class: "appointment checkbox" %>
+          <%= check_box_tag "vehicle_ids[]", vehicle.id, false,  onchange: "updateLink()", data: { url: vehicle_path(vehicle).html_safe, text: vehicle.to_s }, class: "vehicle-checkbox appointment checkbox" %>
         <% else %>
           <div class='checkbox'>
           </div>

init.rb

@@ -14,7 +14,7 @@ Redmine::Plugin.register :redmine_qbo_vehicles do
   name 'Redmine QBO Vehicles plugin'
   author 'Rick Barrette'
   description 'This is a plugin for Redmine to intergrate with the redmine_qbo plugin to provide vehicle data tracking'
-  version '2026.8.1'
+  version '2026.9.0'
   url 'https://github.com/rickbarrette/redmine_qbo_vehicles'
   author_url 'https://barrettefabrication.com'
   requires_redmine version_or_higher: '6.1.0'
@@ -29,11 +29,15 @@ Redmine::Plugin.register :redmine_qbo_vehicles do
   # Add safe attributes for core models
   Issue.safe_attributes :vehicle_id
 
-  # Permissions for security
-  permission :view_vehicles, vehicles: :new, public: false
+  # Global Permissions
+  permission :view_vehicles, { vehicles: [:index, :show] }, global: true
+  permission :add_vehicles, { vehicles: [:new, :create] }, global: true
+  permission :edit_vehicles, { vehicles: [:edit, :update] }, global: true
+  permission :delete_vehicles, { vehicles: [:destroy] }, global: true
+
 
   # Register top menu items
-  menu :top_menu, :vehicles, { controller: :vehicles, action: :index }, caption: :field_vehicles, if: Proc.new { User.current.logged? }
+  menu :top_menu, :vehicles, { controller: :vehicles, action: :index }, caption: :field_vehicles, if: Proc.new { User.current.allowed_to?(:view_vehicles, nil, global: true) }
     
   Redmine::Search.map do |search|
     search.register :vehicles

lib/redmine_qbo_vehicles.rb

@@ -19,5 +19,13 @@ module RedmineQboVehicles
     Vehicles::Hooks::PdfHookListener
     Vehicles::Hooks::ViewHookListener
     Vehicles::Hooks::CustomerAppointmentShowHookListener
+
+    # If the SubtaskFieldCopier plugin is installed, register our fields
+    if defined?(SubtaskFieldCopier)
+      SubtaskFieldCopier.registered_fields << :vehicle
+      
+      # Ensure there are no duplicates in case of hot-reloads in development mode
+      SubtaskFieldCopier.registered_fields.uniq!
+    end
   end
 end