copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Fix self-serve lane command customer authorization

Browse Source
This commit is contained in:
Jeppe B
2026-06-02 09:15:24 +02:00
parent ec1988715d
commit 46bdeded78
2 changed files with 102 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/moduleSelfServeRoute.php
+29 -20
View File
@@ -460,11 +460,6 @@ class moduleSelfServeRoute
self::requireType($commandParam, self::type_string());
// Get the lane and command
$lane = $selfserve->lane($lane_id);
// Require access to the lane's department to prevent cross-department command execution
if (empty($lane->department_lane) || empty($lane->department_lane->department)) {
$response->error('Lane department not found', 404);
}
self::requireDepartmentAccess((string)$lane->department_lane->department->value());
// If the user has the bypass permission, set the lane to bypass customer number validation
if (self::hasPermission('modules_selfserve_lane_command_bypass_customer_number_validation')) {
$lane->setBypassCustomerNumberValidation(true);
@@ -482,7 +477,7 @@ class moduleSelfServeRoute
$lane,
$customer_number,
'modules_selfserve_lane_command_execute_start',
false
true
);
break;
case selfserve_lane_command::STOP:
@@ -495,34 +490,36 @@ class moduleSelfServeRoute
);
break;
case selfserve_lane_command::RESERVE:
$this->requireSelfServeLaneCommandPermission(
$this->requireOperatorLaneCommandPermission(
$lane,
$customer_number,
'modules_selfserve_lane_command_execute_reserve',
false
'modules_selfserve_lane_command_execute_reserve'
);
break;
case selfserve_lane_command::RELEASE:
$this->requireSelfServeLaneCommandPermission(
$this->requireOperatorLaneCommandPermission(
$lane,
$customer_number,
'modules_selfserve_lane_command_execute_release',
false
'modules_selfserve_lane_command_execute_release'
);
break;
case selfserve_lane_command::RESET:
$this->requireSelfServeLaneCommandPermission(
$this->requireOperatorLaneCommandPermission(
$lane,
$customer_number,
'modules_selfserve_lane_command_execute_reset',
false
'modules_selfserve_lane_command_execute_reset'
);
break;
case selfserve_lane_command::OPEN_PROPERTY_ACCESS_GATE:
self::requirePermission('modules_selfserve_lane_command_execute_open_property_access_gate');
$this->requirePropertyGateCommandPermission(
'modules_selfserve_lane_command_execute_open_property_access_gate',
$lane,
$customer_number
);
break;
case selfserve_lane_command::OPEN_PROPERTY_EXIT_GATE:
self::requirePermission('modules_selfserve_lane_command_execute_open_property_exit_gate');
$this->requirePropertyGateCommandPermission(
'modules_selfserve_lane_command_execute_open_property_exit_gate',
$lane,
$customer_number
);
break;
}
// Execute the command
@@ -1435,6 +1432,18 @@ class moduleSelfServeRoute
);
}
private function requireOperatorLaneCommandPermission(selfserve_lane $lane, string $command_permission): void
{
if (empty($lane->department_lane) || empty($lane->department_lane->department)) {
global $response;
$response->error('Lane department not found', 404);
}
self::requireDepartmentAccess((string)$lane->department_lane->department->value());
self::requirePermission('modules_selfserve_lane_command_execute');
self::requirePermission($command_permission);
}
private function requirePropertyGateCommandPermission(string $permission, selfserve_lane $lane, int $customer_number): void
{
$elevated_permissions = [