check account ownership

2 files changed, 26 insertions, 1 deletions

diff --git a/index.ts b/index.ts
index a401d3d3..8c8d4eaf 100644
--- a/index.ts
+++ b/index.ts
@@ -82,6 +82,9 @@ app.post("/replace", auth, payments.replace);
 app.get("/decode/:bolt11", payments.decode);
 app.post("/fetchinvoice", payments.fetchinvoice);
 
+app.get("/auth", payments.auth);
+app.post("/order", payments.order);
+
 app.get("/encode", lnurl.encode);
 app.get("/decode", lnurl.decode);
 app.get("/lnurl/verify/:id", lnurl.verify);
diff --git a/routes/payments.ts b/routes/payments.ts
index 66a19e53..c6653f1c 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -103,6 +103,9 @@ export default {
     } = req;
     if (!aid || aid === "undefined") aid = id;
 
+    const index = await db.lPos(`${id}:accounts`, aid);
+    if (index === null) fail("unauthorized");
+
     limit = parseInt(limit);
     offset = parseInt(offset) || 0;
 
@@ -271,7 +274,16 @@ export default {
       const managers = await db.sMembers(`fund:${id}:managers`);
       if (managers.length && !managers.includes(user.id)) fail("Unauthorized");
 
-      const result: any = await db.debit(`fund:${id}`, "", "Insufficient funds", amount, 0, 0, 0, 0);
+      const result: any = await db.debit(
+        `fund:${id}`,
+        "",
+        "Insufficient funds",
+        amount,
+        0,
+        0,
+        0,
+        0,
+      );
       if (result.err) fail(result.err);
 
       const rates = await g("rates");
@@ -614,4 +626,14 @@ export default {
     const { amount, offer } = req.body;
     res.send(await ln.fetchinvoice(offer, amount ? amount * 1000 : null));
   },
+
+  async auth(req, res) {
+    console.log(req.query);
+    res.send(req.query);
+  },
+
+  async order(req, res) {
+    console.log(req.body);
+    res.send(req.body);
+  },
 };