Harden self-serve vehicle condition mutations

openapi.yaml

@@ -4624,7 +4624,7 @@ paths:
       tags:
         - Self-Serve
       summary: Add vehicle condition
-      description: Add a new vehicle condition (answer to a question). Customers can only add conditions for their own vehicles.
+      description: Add a new vehicle condition (answer to a question). Customers can only add conditions for their own vehicles. This answer mutation does not activate machines or synchronize live relay state; hardware changes are handled only by the explicit wash start flow.
       operationId: addSelfserveVehicleCondition
       requestBody:
         required: true
@@ -4659,14 +4659,6 @@ paths:
                   type: integer
                   nullable: true
                   description: Alias for vehicle_type.
-                activate_machine:
-                  type: boolean
-                  default: true
-                  description: Whether the session synchronization may enable the machine relay. User wash-start saves answers with false.
-                sync_relay_state:
-                  type: boolean
-                  default: true
-                  description: Whether the answer mutation should synchronize live relay state.
       responses:
         '200':
           description: Successfully added vehicle condition
@@ -4683,7 +4675,7 @@ paths:
       tags:
         - Self-Serve
       summary: Update vehicle condition
-      description: Update an existing vehicle condition. Customers can only update conditions for their own vehicles.
+      description: Update an existing vehicle condition. Customers can only update conditions for their own vehicles. This answer mutation does not activate machines or synchronize live relay state; hardware changes are handled only by the explicit wash start flow.
       operationId: updateSelfserveVehicleCondition
       parameters:
         - name: id
@@ -4719,14 +4711,6 @@ paths:
                   type: integer
                   nullable: true
                   description: Alias for vehicle_type.
-                activate_machine:
-                  type: boolean
-                  default: true
-                  description: Whether the session synchronization may enable the machine relay.
-                sync_relay_state:
-                  type: boolean
-                  default: true
-                  description: Whether the mutation should synchronize live relay state.
       responses:
         '200':
           description: Successfully updated vehicle condition

src/components/session/token/SessionUser/Objects/SelfServeVehicleConditions.vue

@@ -127,6 +127,13 @@ export const SelfServeVehicleConditions = {
     }
   },
   add: async (department, lane, customer_id, reg, question, value, options = {}) => {
+    const safeOptions = {};
+    const normalizedVehicleType = parseInt(options.vehicle_type ?? options.vehicle_type_id);
+
+    if (!Number.isNaN(normalizedVehicleType) && normalizedVehicleType > 0) {
+      safeOptions.vehicle_type = normalizedVehicleType;
+    }
+
     return ObjectsGlobal.add.object(SelfServeVehicleConditions.meta.endpoint, {
       department: parseInt(department),
       lane: parseInt(lane),
@@ -134,7 +141,9 @@ export const SelfServeVehicleConditions = {
       reg: reg,
       question: parseInt(question),
       value: value === "true" || value === true,
-      ...options
+      ...safeOptions,
+      activate_machine: false,
+      sync_relay_state: false
     });
   },
   set: {

tests/unit/self-serve-vehicle-conditions.spec.js

@@ -0,0 +1,50 @@
+import { describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  addObject: vi.fn(),
+}));
+
+vi.mock("@/components/session/token/SessionUser/Objects/ObjectsGlobal.vue", () => ({
+  ObjectsGlobal: {
+    add: {
+      object: mocks.addObject,
+    },
+  },
+}));
+
+vi.mock("@/components/session/token/SessionUser.vue", () => ({
+  SessionUser: {
+    objects: {},
+  },
+}));
+
+vi.mock("@/components/session/authenticatedRequest.vue", () => ({
+  authenticatedRequest: vi.fn(),
+}));
+
+import { SelfServeVehicleConditions } from "@/components/session/token/SessionUser/Objects/SelfServeVehicleConditions.vue";
+
+describe("SelfServeVehicleConditions", () => {
+  it("does not allow caller options to enable live relay synchronization", async () => {
+    mocks.addObject.mockResolvedValue({ data: { data: {} } });
+
+    await SelfServeVehicleConditions.add(3, 7, 12345, "AB12345", 11, true, {
+      vehicle_type_id: "2",
+      activate_machine: true,
+      sync_relay_state: true,
+      unexpected: "ignored",
+    });
+
+    expect(mocks.addObject).toHaveBeenCalledWith("/department/selfserve/vehicle/conditions", {
+      department: 3,
+      lane: 7,
+      customer_id: 12345,
+      reg: "AB12345",
+      question: 11,
+      value: true,
+      vehicle_type: 2,
+      activate_machine: false,
+      sync_relay_state: false,
+    });
+  });
+});