From 37d4f46c24532150654bc5e14c4cf7b16d822712 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Thu, 13 Mar 2025 16:08:52 -0700
Subject: account check

---
 routes/payments.ts | 3 +++
 routes/users.ts    | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/routes/payments.ts b/routes/payments.ts
index 4d1c55c5..ec342dc4 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -268,6 +268,9 @@ export default {
       amount = parseInt(amount);
       if (amount < 0) fail("Invalid amount");
 
+      const managers = await db.sMembers(`fund:${id}:managers`);
+      if (managers.length && !managers.includes(user.id)) fail("Unauthorized");
+
       const result: any = await db.debit(`fund:${id}`, "", amount, 0, 0, 0);
       if (result.err) fail(result.err);
 
diff --git a/routes/users.ts b/routes/users.ts
index ab8cb61a..8fb078e1 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -769,8 +769,12 @@ export default {
 
   async updateAccount(req, res) {
     const { id } = req.params;
+    const { id: uid } = req.user;
     const { name } = req.body;
 
+    const pos = await db.lPos(`${uid}:accounts`, id);
+    if (!pos) fail("account not found");
+
     const account = await g(`account:${id}`);
     account.name = name;
     await s(`account:${id}`, account);
@@ -783,6 +787,10 @@ export default {
       const { id } = req.body;
       const { id: uid } = req.user;
       const { type } = await g(`account:${id}`);
+
+      const pos = await db.lPos(`${uid}:accounts`, id);
+      if (!(type && pos)) fail("account not found");
+
       try {
         const node = rpc({ ...config[type], wallet: id });
         await node.unloadWallet(id);
-- 
cgit v1.2.3