Enforce department access for self-serve lane commands

services/nginx/app/routes/moduleSelfServeRoute.php

@@ -68,6 +68,11 @@ class moduleSelfServeRoute
             self::requireType($commandParam, self::type_string());
             // Get the lane and command
             $lane = $selfserve->lane($lane_id);
+            // Require access to the lane's department to prevent cross-department command execution
+            if (empty($lane->department_lane) || empty($lane->department_lane->department)) {
+                $response->error('Lane department not found', 404);
+            }
+            self::requireDepartmentAccess((string)$lane->department_lane->department->value());
             // If the user has the bypass permission, set the lane to bypass customer number validation
             if (self::hasPermission('modules_selfserve_lane_command_bypass_customer_number_validation')) {
                 $lane->setBypassCustomerNumberValidation(true);
@@ -304,4 +309,4 @@ class moduleSelfServeRoute
             'modules_selfserve_lane_force_machine_disable' => 'Force disable MACHINE relay but keep lane as in-wash (superusers only)'
         ]);
     }
-}
+}