From ed9ebc2ac870a140604dd5453acad9c7c0f511db Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 22:21:44 +0200
Subject: [PATCH] Validate subuser grants before resolving customer user

---
 services/nginx/app/classes/authentication.php | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/services/nginx/app/classes/authentication.php b/services/nginx/app/classes/authentication.php
index 0eebf25c..23654529 100644
--- a/services/nginx/app/classes/authentication.php
+++ b/services/nginx/app/classes/authentication.php
@@ -6,6 +6,7 @@ use classes\totp;
 use Exception;
 use interfaces\authentication_i;
 use objects\plate_scanners_o;
+use objects\subuser_grants_o;
 use objects\tokens_o;
 use objects\users_o;
 use objects\subusers_o;
@@ -140,6 +141,15 @@ class authentication implements authentication_i
                 return false;
             }
             $customer_number = (int)$headers['X-Customer-Number'];
+            // Resolve and validate subuser grant for the requested customer context
+            $subuser = (new subusers_o())->getSubuserBySessionToken($token->token->value());
+            if ($subuser === null) {
+                return false;
+            }
+            $grants = (new subuser_grants_o())->getGrantsForSubuserAndCustomer((int)$subuser->id, $customer_number);
+            if (count($grants) === 0) {
+                return false;
+            }
             // Get the user by the customer number
             return (new users_o())->getUserByCustomerNumber($customer_number);
         }
@@ -232,4 +242,4 @@ class authentication implements authentication_i
         }
         return (int)$headers['X-Customer-Number'];
     }
-}
\ No newline at end of file
+}