From a96f40cf131412b6c3629770fa965706586e39a5 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Tue, 2 Jun 2026 00:21:32 +0200
Subject: [PATCH] Guard machine relay set status

---
 .../traits/selfserve_lane_relay_controller_t.php         | 6 ++++--
 .../Selfserve/SelfserveLaneRelayShellyBatchingTest.php   | 9 +++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/services/nginx/app/modules/selfserve/traits/selfserve_lane_relay_controller_t.php b/services/nginx/app/modules/selfserve/traits/selfserve_lane_relay_controller_t.php
index 2778c7f7..7c9f3f47 100644
--- a/services/nginx/app/modules/selfserve/traits/selfserve_lane_relay_controller_t.php
+++ b/services/nginx/app/modules/selfserve/traits/selfserve_lane_relay_controller_t.php
@@ -107,14 +107,16 @@ trait selfserve_lane_relay_controller_t
     }
 
     /**
-     * Set MACHINE relay status directly.
+     * Set MACHINE relay status using the same guards as manual relay controls.
      * @param bool $on true to turn on, false to turn off
      * @return bool
      * @throws \Exception
      */
     public function setMachineRelayStatus(bool $on): bool
     {
-        return $this->setRelayStatus(selfserve_lane_relay::MACHINE, $on);
+        return $on
+            ? $this->turnOnRelay(selfserve_lane_relay::MACHINE)
+            : $this->turnOffRelay(selfserve_lane_relay::MACHINE);
     }
 
     /**
diff --git a/services/nginx/app/tests/Unit/Selfserve/SelfserveLaneRelayShellyBatchingTest.php b/services/nginx/app/tests/Unit/Selfserve/SelfserveLaneRelayShellyBatchingTest.php
index 4d77efd0..fd26c3c5 100644
--- a/services/nginx/app/tests/Unit/Selfserve/SelfserveLaneRelayShellyBatchingTest.php
+++ b/services/nginx/app/tests/Unit/Selfserve/SelfserveLaneRelayShellyBatchingTest.php
@@ -621,6 +621,14 @@ it('is a safe no-op when MACHINE relay is not configured', function (): void {
     expect($harness->getShellyCallCount('/v2/devices/api/set/switch'))->toBe(0);
 });
 
+it('blocks setMachineRelayStatus from enabling MACHINE when MACHINE is not allowed', function (): void {
+    $harness = selfserve_lane_shelly_test_harness();
+
+    expect(fn() => $harness->setMachineRelayStatus(true))
+        ->toThrow(\Exception::class, 'MACHINE relay is not allowed to be enabled at this time');
+    expect($harness->getShellyCallCount('/v2/devices/api/set/switch'))->toBe(0);
+});
+
 it('uses local demo responses and skips Shelly cloud calls for demo relay ids', function (): void {
     $harness = selfserve_lane_shelly_test_harness();
     $harness->department_lane = new SelfserveDepartmentLaneRelayFake(
@@ -628,6 +636,7 @@ it('uses local demo responses and skips Shelly cloud calls for demo relay ids',
         programPickerRelayId: 'demo-program',
         cleanerRelayId: 'demo-cleaner'
     );
+    $harness->setLaneCache($harness->id, $harness::CACHE_SELFSERVE_LANE_KEY_ALLOWED_SERVICES, ['MACHINE']);
 
     $result = $harness->setMachineRelayStatus(true);
     $status = $harness->getMachineRelayStatus();