From 3edd81d85e37f6cde1120814ed8cc5b638a37f76 Mon Sep 17 00:00:00 2001 From: Tiago Vasconcelos Date: Tue, 15 Apr 2025 12:28:58 +0100 Subject: [PATCH] fix: only show stats if authenticated user (#50) * fix: only show stats if authenticated user * chore: lint --- views.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/views.py b/views.py index baf9a8d..230f599 100644 --- a/views.py +++ b/views.py @@ -1,10 +1,11 @@ from http import HTTPStatus +from typing import Optional from fastapi import APIRouter, Depends, HTTPException, Request from fastapi.responses import HTMLResponse from lnbits.core.crud import get_wallet from lnbits.core.models import User -from lnbits.decorators import check_user_exists +from lnbits.decorators import check_user_exists, optional_user_id from lnbits.helpers import template_renderer from .crud import get_card_by_external_id, get_hits, get_refunds @@ -24,15 +25,26 @@ async def index(request: Request, user: User = Depends(check_user_exists)): @boltcards_generic_router.get("/{card_id}", response_class=HTMLResponse) -async def display(request: Request, card_id: str): +async def display( + request: Request, card_id: str, user_id: Optional[str] = Depends(optional_user_id) +): + if not user_id: + raise HTTPException( + status_code=HTTPStatus.UNAUTHORIZED, detail="User not authorized." + ) card = await get_card_by_external_id(card_id) if not card: raise HTTPException( status_code=HTTPStatus.NOT_FOUND, detail="Card does not exist." ) + wallet = await get_wallet(card.wallet) wallet_balance = 0 if wallet: + if wallet.user != user_id: + raise HTTPException( + status_code=HTTPStatus.FORBIDDEN, detail="Card does not belong to user." + ) wallet_balance = wallet.balance hits = await get_hits([card.id]) hits_json = [hit.json() for hit in hits]