Fix/dead payment module security issues - #279
Merged
martinzhames merged 4 commits intoSep 1, 2026
Merged
Conversation
src/payment/payment.controller.ts imported MerchantGuard from ../auth/guards/merchant.guard, but the file never existed in the repo, breaking any full-source tsc/Nest build. Add the guard, mirroring the existing AdminGuard pattern, so it rejects requests lacking a merchantId on the authenticated user.
main.ts already applies the global api/v1 prefix to every controller. PaymentController additionally hardcoded api/v1/payments, which would double the prefix to /api/v1/api/v1/payments/... if this module were ever wired into AppModule. Use 'payments' to match every other controller in the codebase.
PaymentController's getPaymentById/ByReference/Status/QrCode/Receipt and cancelPayment never threaded a merchantId through to PaymentService, so any authenticated merchant could access or cancel another merchant's payment by guessing/incrementing a UUID or reference. Thread req.user.merchantId through every controller handler and scope every corresponding PaymentService query/mutation by merchantId, mirroring src/payments/payments.service.ts.
PaymentModule was never imported by AppModule (or anything else) and duplicated src/payments/, which is the actually-wired, more complete implementation (batch creation, refunds, webhook listener, tests). Keeping two competing implementations of the payment domain around was misleading to maintainers and hid the bugs fixed earlier on this branch from ever being caught by integration testing. Delete src/payment/ entirely per the suggested dead-code fix.
|
@celina005 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #160
Closes #159
Closes #157
Closes #158