From 300a37fce3419479f3144708e41c61e5445865a0 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 22:38:53 +0200
Subject: [PATCH] Enforce department access in department lanes routes

---
 services/nginx/app/routes/departmentLanesRoute.php | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/services/nginx/app/routes/departmentLanesRoute.php b/services/nginx/app/routes/departmentLanesRoute.php
index e3f3de0a..67e70123 100644
--- a/services/nginx/app/routes/departmentLanesRoute.php
+++ b/services/nginx/app/routes/departmentLanesRoute.php
@@ -35,6 +35,7 @@ class departmentLanesRoute
                         // Return an error
                         $response->error('Department lane not found', 404);
                     }
+                    self::requireDepartmentAccess((int)$department_lane->department->value());
                     // Log the incident
                     (new logs_o())->add('department_lanes', 'global', 1, $user->id, 'VIEW_DEPARTMENT_LANE', 'User viewed department lane with id ' . $department_lane->id);
                     // Return the department lane
@@ -63,7 +64,13 @@ class departmentLanesRoute
                                 $department_lane_o = (new department_lanes_o())->select((int)$department_lane['id']);
                                 // Return the object as an array
                                 return $department_lane_o->asArray();
-                            }
+                            },
+                            (new department_lanes_o())->forceRestrictFilters(
+                                [
+                                    // This makes sure that the user can only see lanes from departments they explicitly have access to
+                                    'department' => $user->getGroup()->getDepartments(),
+                                ]
+                            )
                         )
                 );
             } else {
@@ -251,6 +258,7 @@ class departmentLanesRoute
                 // Remove spaces from the relay_in_id and relay_out_id
                 // Check if the required fields are set
                 if ($name && $department) {
+                    self::requireDepartmentAccess((int)$department);
                     // Add the department lane
                     (new department_lanes_o())->add((int)$department, (string)$name, $relay_in_id, $relay_out_id, $relay_machine_id, $dynamic_image_id);
                     // Return a success message
@@ -301,11 +309,13 @@ class departmentLanesRoute
                     // Return an error
                     $response->error('Department lane not found', 404);
                 }
+                self::requireDepartmentAccess((int)$department_lane->department->value());
                 // Update the department lane fields that are set
                 if (self::isParametersSet(['name'])) {
                     $department_lane->name->set($name);
                 }
                 if (self::isParametersSet(['department'])) {
+                    self::requireDepartmentAccess((int)$department);
                     $department_lane->department->set((int)$department);
                 }
                 if (self::isParametersSet(['relay_in_id'])) {
@@ -342,4 +352,4 @@ class departmentLanesRoute
             ]
         );
     }
-}
\ No newline at end of file
+}