require auth for accounts

1 files changed, 5 insertions, 0 deletions

diff --git a/routes/users.ts b/routes/users.ts
index fee39344..ed638d9e 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -789,6 +789,11 @@ export default {
 
   async account(req, res) {
     const { id } = req.params;
+    const { id: uid } = req.user;
+
+    const pos = await db.lPos(`${uid}:accounts`, id);
+    if (pos == null) fail("account not found");
+
     const account = await g(`account:${id}`);
     if (account) account.balance = await g(`balance:${id}`);
     res.send(account);