allow invoice owners to modify the webhook

2 files changed, 11 insertions, 6 deletions

diff --git a/index.ts b/index.ts
index 0ca35ec5..611c6ea5 100644
--- a/index.ts
+++ b/index.ts
@@ -47,7 +47,7 @@ app.get("/locations", locations.list);
 app.get("/invoice/:id", invoices.get);
 app.get("/invoices", auth, invoices.list);
 app.post("/invoice", optional, invoices.create);
-app.post("/invoice/:id", invoices.update);
+app.post("/invoice/:id", optional, invoices.update);
 app.post("/sign", auth, invoices.sign);
 
 app.get("/assetlinks.json", (_, res) => res.sendFile("assetlinks.json"));
diff --git a/routes/invoices.ts b/routes/invoices.ts
index 54b1a30b..7e98599e 100644
--- a/routes/invoices.ts
+++ b/routes/invoices.ts
@@ -53,13 +53,18 @@ export default {
     try {
       const { id } = req.params;
       const { body } = req;
-      if (body.invoice?.tip == null || body.invoice.tip < 0) fail("Invalid tip");
+      const { tip, webhook, secret } = body.invoice;
+      if (tip == null || tip < 0) fail("Invalid tip");
 
       let invoice = await g(`invoice:${id}`);
-      const user = await g(`user:${invoice.uid}`);
-      invoice.tip = body.invoice.tip;
-      invoice.webhook = body.invoice.webhook;
-      invoice.secret = body.invoice.secret;
+      const user = req.user || (await g(`user:${invoice.uid}`));
+
+      if (tip) invoice.tip = tip;
+      if (invoice.uid === user?.id) {
+        if (webhook) invoice.webhook = webhook;
+        if (secret) invoice.secret = secret;
+      }
+
       invoice = await generate({ invoice, user });
       await s(`invoice:${id}`, invoice);