From 357cfda46e1e78b8da8665ca51f544a564caa518 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 23:26:57 +0200
Subject: [PATCH] Fix department archived filter smuggling

---
 services/nginx/app/routes/departmentsRoute.php     |  4 ++--
 .../nginx/app/tests/Api/DepartmentsApiTest.php     | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/services/nginx/app/routes/departmentsRoute.php b/services/nginx/app/routes/departmentsRoute.php
index b03cd951..334e2bc4 100644
--- a/services/nginx/app/routes/departmentsRoute.php
+++ b/services/nginx/app/routes/departmentsRoute.php
@@ -17,7 +17,7 @@ class departmentsRoute
 {
     use route_t;
 
-    private function buildDepartmentListFilters(departments_o $departments, bool $canListArchived): string
+    private function buildDepartmentListFilters(departments_o $departments, bool $canListArchived): array
     {
         global $response;
 
@@ -41,7 +41,7 @@ class departmentsRoute
         $filters['visible'] = 1;
         $filters['archived'] = $archived;
 
-        return $departments->array_to_filters($filters);
+        return $filters;
     }
 
     private static function isTruthyBooleanValue(mixed $value): bool
diff --git a/services/nginx/app/tests/Api/DepartmentsApiTest.php b/services/nginx/app/tests/Api/DepartmentsApiTest.php
index 2f4cb73a..8c68c24a 100644
--- a/services/nginx/app/tests/Api/DepartmentsApiTest.php
+++ b/services/nginx/app/tests/Api/DepartmentsApiTest.php
@@ -133,6 +133,20 @@ it('does not allow regular department listings to reveal archived departments th
     expect($departmentIds)
         ->toContain($activeDepartment['id'])
         ->not->toContain($archivedDepartment['id']);
+
+    $response = api_client()->get('/departments?filters[name]=NOT%20NULL%2Carchived:1', $session['headers']);
+
+    $response
+        ->assertStatus(200)
+        ->assertEnvelope()
+        ->assertSuccess();
+
+    $departmentIds = array_map(
+        static fn(array $department): int => (int)($department['id'] ?? 0),
+        is_array($response->data()) ? $response->data() : []
+    );
+
+    expect($departmentIds)->not->toContain($archivedDepartment['id']);
 });
 
 it('rejects department listing when the permission is missing', function (): void {