Merge pull request #251 from copenhagentruckwash/fix-subuser-management-permission-checks

Enforce own-scope subuser permissions for classic users in managed customer scope
2026-06-01 23:53:06 +02:00
parent dcc81cbdc7 45e17e196c
commit 4697c6b272
2 changed files with 11 additions and 0 deletions
@@ -81,6 +81,7 @@ class subusersRoute
            if ($targetCustomerNumber !== null && $customerNumber !== (int)$targetCustomerNumber) {
                $this->emitForbidden([$permission]);
            }
+            self::requirePermission($permission);
            return $customerNumber;
        }

@@ -95,3 +95,13 @@ it('only allows invite resend while setup is still pending', function (): void {
    expect($normalized)->toContain("Driver account already accepted the invitation.");
    expect($normalized)->toContain("if (!\$subuser->requiresSetup()) {");
 });
+
+it('requires own subuser permissions for classic customer users in managed customer scope', function (): void {
+    $routeFile = app_path('routes/subusersRoute.php');
+    expect(is_file($routeFile))->toBeTrue();
+
+    $code = (string)file_get_contents($routeFile);
+    $normalized = preg_replace('/\s+/', ' ', $code);
+
+    expect($normalized)->toContain("\$user = \$auth->get_user(); if (\$user !== false) { \$customerNumber = (int)\$user->customer_number->value(); if (\$customerNumber <= 0) { \$response->error('Unauthorized', 401); } if (\$targetCustomerNumber !== null && \$customerNumber !== (int)\$targetCustomerNumber) { \$this->emitForbidden([\$permission]); } self::requirePermission(\$permission); return \$customerNumber;");
+});