From 78a0e9869ed9f0685b53eb5d1e715594e4281b2a Mon Sep 17 00:00:00 2001
From: Jeppe Bundgaard <jb@truckwash.dk>
Date: Thu, 12 Feb 2026 16:39:49 +0100
Subject: [PATCH] Refactor `ordersRoute` to include `targetCustomerNumber` in
 permission checks

- Use `resolveEffectiveCustomerNumber` for determining customer context.
- Adjust own/department access logic and remove unnecessary casting for `customer_id`.
---
 services/nginx/app/routes/ordersRoute.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/services/nginx/app/routes/ordersRoute.php b/services/nginx/app/routes/ordersRoute.php
index 42941746..a05a6a97 100644
--- a/services/nginx/app/routes/ordersRoute.php
+++ b/services/nginx/app/routes/ordersRoute.php
@@ -40,10 +40,11 @@ class ordersRoute
             $permission_own = self::definePermission('list_own_orders', subusers_permission_node_key::ORDERS_LIST);
             $permission_other = self::definePermission('list_orders');
             $has_permission_other = self::hasPermission($permission_other);
+            $targetCustomerNumber = self::resolveEffectiveCustomerNumber();
             self::allowOwnOrDepartmentAccess(
                 $permission_own,
                 $permission_other,
-                null,
+                $targetCustomerNumber,
                 null,
                 null,
                 'You do not have permission to list orders.'
@@ -112,7 +113,7 @@ class ordersRoute
                             'department_id' => $department_ids
                         ] : []),
                         ...(!$has_permission_other && $effectiveCustomer !== null ? [
-                            'customer_id' => [(int)$effectiveCustomer]
+                            'customer_id' => $effectiveCustomer
                         ] : []),
                     ])
                 )