prevent negative fees

2 files changed, 17 insertions, 3 deletions

diff --git a/routes/payments.js b/routes/payments.js
index dfc8eeae..1a5bcf76 100644
--- a/routes/payments.js
+++ b/routes/payments.js
@@ -40,6 +40,7 @@ export default {
     try {
       amount = parseInt(amount);
       maxfee = maxfee ? parseInt(maxfee) : 0;
+      if (maxfee < 0) fail("Max fee cannot be negative");
 
       await requirePin({ body, user });
 
@@ -400,11 +401,12 @@ export default {
     }
   },
 
-  async fix({ body: { uid }, user }, res) {
+  async fix({ body: { uid, username }, user }, res) {
     try {
       if (!user.admin) fail("unauthorized");
 
-      let { username } = await g(`user:${uid}`);
+      if (username) uid = await g(`user:${username.toLowerCase()}`);
+      ({ username } = await g(`user:${uid}`));
       let balance = await g(`balance:${uid}`);
 
       let payments = await db.lRange(`${uid}:payments`, 0, -1);
@@ -420,6 +422,7 @@ export default {
       await s(`balance:${uid}`, total);
       res.send("ok");
     } catch (e) {
+      console.log(e);
       bail(res, e.message);
     }
   },
diff --git a/routes/users.js b/routes/users.js
index 9ac668f4..89a04004 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -1,7 +1,7 @@
 import { g, s, db } from "$lib/db";
 import config from "$config";
 import store from "$lib/store";
-import { fields, nada, pick, uniq, wait } from "$lib/utils";
+import { fields, nada, pick, uniq, wait, fail } from "$lib/utils";
 import bcrypt from "bcrypt";
 import jwt from "jsonwebtoken";
 import { authenticator } from "otplib";
@@ -46,6 +46,17 @@ export default {
       let uid = k.split(":")[1];
       let user = await g(`user:${uid}`);
       user.balance = await g(k);
+
+      let payments = await db.lRange(`${uid}:payments`, 0, -1);
+
+      let total = 0;
+      for (let pid of payments) {
+        let p = await g(`payment:${pid}`);
+        total += p.amount;
+        if (p.amount < 0) total -= (p.fee || 0) + (p.ourfee || 0);
+      }
+
+      user.expected = total;
       users.push(user);
     }