diff --git a/lnbits/core/views/api.py b/lnbits/core/views/api.py index d67cd7be..e43e0ce6 100644 --- a/lnbits/core/views/api.py +++ b/lnbits/core/views/api.py @@ -23,6 +23,7 @@ from lnbits.decorators import ( WalletInvoiceKeyChecker, WalletTypeInfo, get_key_type, + require_admin_key ) from lnbits.helpers import url_for, urlsafe_short_hash from lnbits.requestvars import g @@ -230,7 +231,7 @@ async def api_payments_pay_invoice(bolt11: str, wallet: Wallet): status_code=HTTPStatus.CREATED, ) async def api_payments_create( - wallet: WalletTypeInfo = Depends(get_key_type), + wallet: WalletTypeInfo = Depends(require_admin_key), invoiceData: CreateInvoiceData = Body(...), ): if wallet.wallet_type < 0 or wallet.wallet_type > 2: diff --git a/lnbits/decorators.py b/lnbits/decorators.py index 9eee1afa..37c29d3d 100644 --- a/lnbits/decorators.py +++ b/lnbits/decorators.py @@ -147,7 +147,7 @@ async def get_key_type( try: checker = WalletInvoiceKeyChecker(api_key=token) await checker.__call__(r) - wallet = WalletTypeInfo(0, checker.wallet) + wallet = WalletTypeInfo(1, checker.wallet) if (LNBITS_ADMIN_USERS and wallet.wallet.user not in LNBITS_ADMIN_USERS) and (LNBITS_ADMIN_EXTENSIONS and pathname in LNBITS_ADMIN_EXTENSIONS): raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED, detail="User not authorized.") return wallet @@ -168,6 +168,7 @@ async def require_admin_key( token = api_key_header if api_key_header else api_key_query wallet = await get_key_type(r, token) + print(wallet.__dict__) if wallet.wallet_type != 0: # If wallet type is not admin then return the unauthorized status