From 4703e079513b2b300acd2c8e520bdf8ae05adbc2 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 22:36:49 +0200
Subject: [PATCH] Enforce department access on Stripe payment intent order
 routes

---
 services/nginx/app/routes/ordersRoute.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/services/nginx/app/routes/ordersRoute.php b/services/nginx/app/routes/ordersRoute.php
index a05a6a97..03a87f6c 100644
--- a/services/nginx/app/routes/ordersRoute.php
+++ b/services/nginx/app/routes/ordersRoute.php
@@ -544,6 +544,8 @@ class ordersRoute
                 if (!$order->exists()) {
                     $response->error('Order not found', 400);
                 }
+                // Check if the user has access to the department
+                self::requireDepartmentAccess((int)$order->department_id->value());
                 // Get the department
                 $department = (new departments_o())->selectId((int)$order->department_id->value());
                 // Check if the department is configured for Stripe payments
@@ -653,6 +655,8 @@ class ordersRoute
                 if (!$order->exists()) {
                     $response->error('Order not found', 400);
                 }
+                // Check if the user has access to the department
+                self::requireDepartmentAccess((int)$order->department_id->value());
                 // Check if the order has a payment intent
                 $stripe_payment_intents = new stripe_payment_intents_o();
                 if (!$stripe_payment_intents->doesOrderHavePaymentIntent((int)$order->id)) {
@@ -705,6 +709,8 @@ class ordersRoute
                 if (!$order->exists()) {
                     $response->error('Order not found', 400);
                 }
+                // Check if the user has access to the department
+                self::requireDepartmentAccess((int)$order->department_id->value());
                 // Check if the order has a payment intent
                 $stripe_payment_intents = new stripe_payment_intents_o();
                 if (!$stripe_payment_intents->doesOrderHavePaymentIntent((int)$order->id)) {
@@ -1038,4 +1044,4 @@ class ordersRoute
         // Optional fields are not checked here, as they are optional and can be empty
         return $data;
     }
-}
\ No newline at end of file
+}