diff --git a/services/nginx/app/routes/moduleSelfServeRoute.php b/services/nginx/app/routes/moduleSelfServeRoute.php index 4d25a500..e90de548 100644 --- a/services/nginx/app/routes/moduleSelfServeRoute.php +++ b/services/nginx/app/routes/moduleSelfServeRoute.php @@ -124,7 +124,7 @@ class moduleSelfServeRoute $lane_id = (int)$this->getParameter('lane_id'); self::requireType($lane_id, self::type_int()); self::requireMinValue($lane_id, 1); - $customer_scope = $this->requireInProgressWashDetailsAccess(); + $customer_scope = $this->requireInProgressWashDetailsAccess($lane_id); $build_customer = static function (?int $customer_number): ?array { if ($customer_number === null || $customer_number <= 0) { @@ -1228,7 +1228,7 @@ class moduleSelfServeRoute ]); } - private function requireInProgressWashDetailsAccess(): ?int + private function requireInProgressWashDetailsAccess(int $lane_id): ?int { global $response; @@ -1238,6 +1238,11 @@ class moduleSelfServeRoute } if (self::hasPermission('modules_selfserve_lane_wash_in_progress_view')) { + $department_lane = (new department_lanes_o())->select($lane_id); + if (!$department_lane->exists()) { + $response->error('Department lane not found', 404); + } + self::requireDepartmentAccess((string)$department_lane->department->value()); return null; } diff --git a/services/nginx/app/tests/Unit/Selfserve/SelfserveRouteWiringTest.php b/services/nginx/app/tests/Unit/Selfserve/SelfserveRouteWiringTest.php index d5acfb96..2f6953c7 100644 --- a/services/nginx/app/tests/Unit/Selfserve/SelfserveRouteWiringTest.php +++ b/services/nginx/app/tests/Unit/Selfserve/SelfserveRouteWiringTest.php @@ -288,7 +288,9 @@ it('wires in-progress self-serve wash details endpoint', function (): void { expect($moduleSelfServeRoute)->toContain('/modules/self-serve/lane/wash/in-progress'); expect($moduleSelfServeRoute)->toContain('modules_selfserve_lane_wash_in_progress_view'); expect($moduleSelfServeRoute)->toContain('list_own_department_selfserve_vehicle_conditions'); - expect($moduleSelfServeRoute)->toContain('requireInProgressWashDetailsAccess'); + expect($moduleSelfServeRoute)->toContain('requireInProgressWashDetailsAccess($lane_id)'); + expect($moduleSelfServeRoute)->toContain('(new department_lanes_o())->select($lane_id)'); + expect($moduleSelfServeRoute)->toContain('self::requireDepartmentAccess((string)$department_lane->department->value())'); expect($moduleSelfServeRoute)->toContain('scopeInProgressWashResponseForCustomer'); expect($moduleSelfServeRoute)->toContain("'in_progress' => true"); expect($moduleSelfServeRoute)->toContain("'in_progress' => false");