Add custom-only department pricing enforcement

services/nginx/app/routes/productsRoute.php

@@ -53,6 +53,19 @@ class productsRoute
         return null;
     }
 
+    private function assertCanUseDepartmentPricing(mixed $user, ?int $departmentId): void
+    {
+        if (!$user instanceof users_o || $departmentId === null) {
+            return;
+        }
+
+        if ($this->hasPermission('superuser_fetch_department')) {
+            return;
+        }
+
+        $this->requirePermission('department_access_' . $departmentId);
+    }
+
     /**
      * Get the category (ID) if the category parameter is provided (In the request 'category')
      * @return int|null
@@ -91,12 +104,14 @@ class productsRoute
         // Check if the departmentId is set
         if ($departmentId) {
             // Apply the departments unique pricing
-            $products = (new products_o())->applyDepartmentPricing($products, $departmentId);
+            $products = (new products_o())->applyDepartmentPricing($products, $departmentId, true);
         }
         // Check if the customer is set
         if ($customer !== null) {
             // Apply the customers unique discounts
             $products = (new products_o())->applyCustomerDiscounts($products, $customer);
+        } else {
+            $products = products_o::stripDepartmentPriceSources($products);
         }
         return $products;
     }
@@ -197,6 +212,7 @@ class productsRoute
                 // Define the variables
                 $customer = self::getCustomerIfProvided(); // This is only used if the customer_id parameter is provided
                 $departmentId = self::getDepartmentIdIfProvided(); // This is only used if the department_id parameter is provided
+                $this->assertCanUseDepartmentPricing($user, $departmentId);
                 $category = self::getCategoryIfProvided(); // This is only used if the category parameter is provided (ID of the category)
                 $productId = self::getProductIdIfProvided(); // This is only used if the id parameter is provided (ID of the product)
                 // Check if the "final_price" parameter is set, and true.