allow invoice owners to modify the webhook

1 files changed, 10 insertions, 5 deletions

diff --git a/routes/invoices.ts b/routes/invoices.ts
index 54b1a30b..7e98599e 100644
--- a/routes/invoices.ts
+++ b/routes/invoices.ts
@@ -53,13 +53,18 @@ export default {
     try {
       const { id } = req.params;
       const { body } = req;
-      if (body.invoice?.tip == null || body.invoice.tip < 0) fail("Invalid tip");
+      const { tip, webhook, secret } = body.invoice;
+      if (tip == null || tip < 0) fail("Invalid tip");
 
       let invoice = await g(`invoice:${id}`);
-      const user = await g(`user:${invoice.uid}`);
-      invoice.tip = body.invoice.tip;
-      invoice.webhook = body.invoice.webhook;
-      invoice.secret = body.invoice.secret;
+      const user = req.user || (await g(`user:${invoice.uid}`));
+
+      if (tip) invoice.tip = tip;
+      if (invoice.uid === user?.id) {
+        if (webhook) invoice.webhook = webhook;
+        if (secret) invoice.secret = secret;
+      }
+
       invoice = await generate({ invoice, user });
       await s(`invoice:${id}`, invoice);