fix: mark workspace as git safe directory before qodana

Initial plan
Merge pull request #158 from copenhagentruckwash/fix-authorization-bypass-in-self-serve-lanes
2026-05-28 17:34:58 +00:00 · 2026-05-28 17:30:45 +00:00 · 2026-05-28 19:25:01 +02:00 · 2026-05-28 19:23:31 +02:00
2 changed files with 5 additions and 12 deletions
@@ -20,6 +20,8 @@ jobs:
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}  # Use PR head when available, otherwise the pushed SHA.
          fetch-depth: 0  # a full history is required for pull request analysis
      - name: Mark repository as safe for Git
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - name: Prepare Qodana cache directories
        run: |
          mkdir -p "${RUNNER_TEMP}/qodana/caches"
@@ -476,7 +476,7 @@ class moduleSelfServeRoute
                        $lane,
                        $customer_number,
                        'modules_selfserve_lane_command_execute_start',
-                        true
+                        false
                    );
                    break;
                case selfserve_lane_command::STOP:
@@ -601,11 +601,7 @@ class moduleSelfServeRoute
            // Build allowed services from provided tasks
            $lane = $selfserve->lane($lane_id);
            $customer_number = $this->resolveEffectiveCustomerNumber();
-            $this->requireSelfServeLaneAccess(
+            self::requirePermission('modules_selfserve_lane_services_set_allowed');
                $lane,
                $customer_number === null ? 0 : (int)$customer_number,
                ['modules_selfserve_lane_services_set_allowed']
            );
            $allowed_services = [];
            foreach ($task_ids as $tid) {
                if ($tid <= 0) continue;
@@ -938,12 +934,7 @@ class moduleSelfServeRoute
            }
            $lane = $selfserve->lane($lane_id);
            $customer_number = $this->resolveEffectiveCustomerNumber();
-            $this->requireSelfServeLaneAccess(
+            self::requirePermission('modules_selfserve_lane_relay_enable_machine');
                $lane,
                $customer_number === null ? 0 : (int)$customer_number,
                ['modules_selfserve_lane_relay_enable_machine'],
                true
            );
            try {
                $this->applyShellyTransportOverride($lane);
                $lane->turnOnRelay(selfserve_lane_relay::MACHINE, $duration);
Author	SHA1	Message	Date
copilot-swe-agent[bot]	31214f0af0	fix: mark workspace as git safe directory before qodana	2026-05-28 17:34:58 +00:00
copilot-swe-agent[bot]	cd0e0f0e61	Initial plan	2026-05-28 17:30:45 +00:00
Jeppe B	76dfcd70d1	Merge pull request #158 from copenhagentruckwash/fix-authorization-bypass-in-self-serve-lanes Harden self-serve lane mutation authorization	2026-05-28 19:25:01 +02:00
Jeppe B	b13abe0d30	Harden self-serve lane mutation authorization	2026-05-28 19:23:31 +02:00