From 6225c4b0728e27b4b1238c359f33573b7fd80e9e Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 22:39:14 +0200
Subject: [PATCH] Enforce department access for self-serve lane commands

---
 services/nginx/app/routes/moduleSelfServeRoute.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/services/nginx/app/routes/moduleSelfServeRoute.php b/services/nginx/app/routes/moduleSelfServeRoute.php
index f8ab16d1..653956f6 100644
--- a/services/nginx/app/routes/moduleSelfServeRoute.php
+++ b/services/nginx/app/routes/moduleSelfServeRoute.php
@@ -68,6 +68,11 @@ class moduleSelfServeRoute
             self::requireType($commandParam, self::type_string());
             // Get the lane and command
             $lane = $selfserve->lane($lane_id);
+            // Require access to the lane's department to prevent cross-department command execution
+            if (empty($lane->department_lane) || empty($lane->department_lane->department)) {
+                $response->error('Lane department not found', 404);
+            }
+            self::requireDepartmentAccess((string)$lane->department_lane->department->value());
             // If the user has the bypass permission, set the lane to bypass customer number validation
             if (self::hasPermission('modules_selfserve_lane_command_bypass_customer_number_validation')) {
                 $lane->setBypassCustomerNumberValidation(true);
@@ -304,4 +309,4 @@ class moduleSelfServeRoute
             'modules_selfserve_lane_force_machine_disable' => 'Force disable MACHINE relay but keep lane as in-wash (superusers only)'
         ]);
     }
-}
\ No newline at end of file
+}