From 136ba2a12e87178f6d83fba2874abf4c9ad32915 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Tue, 17 Mar 2026 01:21:48 -0700 Subject: fix: add account ownership checks and harden PIN validation - Validate account ownership (aid) before allowing ark send/sync/vault operations and in debit/sendOnchain as defense-in-depth - Harden PIN check to reject missing/empty pin when user has one set Co-Authored-By: Claude Opus 4.6 (1M context) --- lib/auth.ts | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'lib/auth.ts') diff --git a/lib/auth.ts b/lib/auth.ts index 30d5438b..c8d5afab 100644 --- a/lib/auth.ts +++ b/lib/auth.ts @@ -49,5 +49,12 @@ export const admin = async (c, next) => { }; export const requirePin = async ({ body, user }) => { - if (!user || (user.pin && user.pin !== body.pin)) fail("Invalid pin"); + if (!user) fail("Invalid pin"); + if (user.pin && (!body?.pin || user.pin !== body.pin)) fail("Invalid pin"); +}; + +export const requireAccountOwnership = async (db, uid, aid) => { + if (!aid || aid === uid) return; + const index = await db.lPos(`${uid}:accounts`, aid); + if (index === null) fail("unauthorized"); }; -- cgit v1.2.3