Merge pull request #234 from copenhagentruckwash/propose-fix-for-archived-department-vulnerability

Fix department archived filter smuggling

services/nginx/app/routes/departmentsRoute.php

@@ -17,7 +17,7 @@ class departmentsRoute
 {
     use route_t;
 
-    private function buildDepartmentListFilters(departments_o $departments, bool $canListArchived): string
+    private function buildDepartmentListFilters(departments_o $departments, bool $canListArchived): array
     {
         global $response;
 
@@ -41,7 +41,7 @@ class departmentsRoute
         $filters['visible'] = 1;
         $filters['archived'] = $archived;
 
-        return $departments->array_to_filters($filters);
+        return $filters;
     }
 
     private static function isTruthyBooleanValue(mixed $value): bool

services/nginx/app/tests/Api/DepartmentsApiTest.php

@@ -133,6 +133,20 @@ it('does not allow regular department listings to reveal archived departments th
     expect($departmentIds)
         ->toContain($activeDepartment['id'])
         ->not->toContain($archivedDepartment['id']);
+
+    $response = api_client()->get('/departments?filters[name]=NOT%20NULL%2Carchived:1', $session['headers']);
+
+    $response
+        ->assertStatus(200)
+        ->assertEnvelope()
+        ->assertSuccess();
+
+    $departmentIds = array_map(
+        static fn(array $department): int => (int)($department['id'] ?? 0),
+        is_array($response->data()) ? $response->data() : []
+    );
+
+    expect($departmentIds)->not->toContain($archivedDepartment['id']);
 });
 
 it('rejects department listing when the permission is missing', function (): void {