Validate booking order context before certificates

services/nginx/app/objects/order_bookings_o.php

@@ -369,6 +369,8 @@ class order_bookings_o extends db
         }
 
         $order = $this->getOrder();
+        $this->requireLinkedOrderMatchesBooking($order);
+
         $normalizedSafetySeal = orders_o::normalizeSafetySealValue($safety_seal);
         if ($normalizedSafetySeal !== null) {
             $order->setSafetySealValue($normalizedSafetySeal);
@@ -462,14 +464,34 @@ class order_bookings_o extends db
         return $order;
     }
 
+    /**
+     * @throws Exception
+     */
+    private function requireLinkedOrderMatchesBooking(orders_o $order): void
+    {
+        self::requireSelected();
+
+        $bookingCustomerNumber = (int)$this->customer_number->value();
+        $bookingDepartmentId = (int)$this->department->value();
+        $orderCustomerId = (int)$order->customer_id->value();
+        $orderDepartmentId = (int)$order->department_id->value();
+
+        if ($orderCustomerId !== $bookingCustomerNumber || $orderDepartmentId !== $bookingDepartmentId) {
+            throw new Exception('Linked order does not match booking customer or department');
+        }
+    }
+
     /**
      * @throws Exception
      */
     protected function attachWashCertificate(int $user_id, ?string $safety_seal = null): void
     {
         self::requireSelected();
+        $order = $this->getOrder();
+        $this->requireLinkedOrderMatchesBooking($order);
+
         // Check if the order already has a wash certificate attached
-        if ($this->getOrder()->hasWashCertificateAttached()) {
+        if ($order->hasWashCertificateAttached()) {
             return;
         }
         // Get the operator name