Merge pull request #215 from copenhagentruckwash/fix-start-command-relay-activation-vulnerability

Fix self-serve START relay deferral bypass

services/nginx/app/modules/selfserve/traits/selfserve_lane_command_t.php

@@ -518,7 +518,6 @@ trait selfserve_lane_command_t
                     // Open the entrance port before marking the lane occupied. Gateway timeouts are
                     // ambiguous because the relay may already have received the pulse.
                     $this->openEntrancePortForWashStart();
-                    $this->turnOnCleanerRelayForWashStart();
                 } catch (\Throwable $e) {
                     $this->setCustomerNumber($previous_customer_number);
                     $this->setLicensePlate($previous_license_plate);

services/nginx/app/tests/Unit/Selfserve/SelfserveStartCleanerRelayWiringTest.php

@@ -13,6 +13,24 @@ it('enables cleaner relay on wash start command and webhook flow', function ():
     expect($washFlow)->toContain('setMachineCleanerRelayStatusHard(true)');
 });
 
+it('does not enable cleaner relay before deferred start relay side effects are checked', function (): void {
+    $commandTrait = file_get_contents(app_path('modules/selfserve/traits/selfserve_lane_command_t.php'));
+
+    expect($commandTrait)->not->toBeFalse();
+    $startCaseOffset = strpos($commandTrait, 'case selfserve_lane_command::START:');
+    expect($startCaseOffset)->not->toBeFalse();
+    $relaySideEffectsOffset = strpos($commandTrait, '$this->runRelaySideEffectsForWashStart($arguments);', (int)$startCaseOffset);
+    expect($relaySideEffectsOffset)->not->toBeFalse();
+
+    $startBeforeRelaySideEffects = substr(
+        $commandTrait,
+        (int)$startCaseOffset,
+        (int)$relaySideEffectsOffset - (int)$startCaseOffset
+    );
+
+    expect($startBeforeRelaySideEffects)->not->toContain('turnOnCleanerRelayForWashStart()');
+});
+
 it('keeps cleaner relay enable wired into machine relay start paths', function (): void {
     $washFlow = file_get_contents(app_path('modules/selfserve/classes/selfserve_wash_flow.php'));
     $moduleRoute = file_get_contents(app_path('routes/moduleSelfServeRoute.php'));