check app ownership

1 files changed, 5 insertions, 2 deletions

diff --git a/routes/users.ts b/routes/users.ts
index 4c466529..7c6d0938 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -993,8 +993,11 @@ export default {
       const { user } = req;
       const uid = user.id;
       const { pubkey } = req.body;
-      const app = await g(pubkey);
-      if (app && uid !== app.uid) fail("Unauthorized");
+      const app = await g(`app:${pubkey}`);
+      if (app && uid !== app.uid) {
+        warn(app.uid, uid);
+        fail("Unauthorized");
+      }
       await db.sRem(`${uid}:apps`, pubkey);
       await db.del(`app:${pubkey}`);
       res.send({});