Harden subuser permission customer context resolution

services/nginx/app/traits/route_t.php

@@ -296,8 +296,10 @@ trait route_t
      * Order of precedence:
      * - Explicit `$customer_number` argument if provided
      * - Main authenticated user context (if available)
-     * - Request header X-Customer-Number
-     * - Query/post parameter `customer_number`
+     *
+     * Important: never derive this value from caller-controlled request
+     * headers/parameters at this layer. Route handlers must pass a trusted
+     * customer number that is bound to the target resource when needed.
      */
     private function resolveCustomerNumberForSubuser(authentication $auth, ?int $customer_number = null): ?int
     {
@@ -308,16 +310,6 @@ trait route_t
         if ($user_ctx !== false && isset($user_ctx->customer_number)) {
             return (int)$user_ctx->customer_number->value();
         }
-        $headers = function_exists('getallheaders') ? getallheaders() : [];
-        if (isset($headers['X-Customer-Number'])) {
-            return (int)$headers['X-Customer-Number'];
-        }
-        if (isset($_GET['customer_number'])) {
-            return (int)$_GET['customer_number'];
-        }
-        if (isset($_POST['customer_number'])) {
-            return (int)$_POST['customer_number'];
-        }
         return null;
     }
 
@@ -816,4 +808,4 @@ trait route_t
         // Check if route is the same, or if it matches the regex pattern
         return $route === $this->route || preg_match($route, $this->route);
     }
-}
+}