From e9d86b5450a71f66e55d2f7104cf144c0289a81c Mon Sep 17 00:00:00 2001
From: memosr <memosr_email@gmail.com>
Date: Sat, 11 Apr 2026 23:45:30 +0300
Subject: [PATCH 1/2] fix: filter transactions by user_id to prevent data
 exposure

---
 app/api/transactions/route.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/api/transactions/route.ts b/app/api/transactions/route.ts
index ff6b0b6..b5edfa5 100644
--- a/app/api/transactions/route.ts
+++ b/app/api/transactions/route.ts
@@ -218,6 +218,7 @@ export async function GET(req: NextRequest) {
       .from("transactions")
       .select("*")
       .eq("transaction_type", "USER")
+      .eq("user_id", user.id)
       .order("created_at", { ascending: false });
 
     if (txError) {

From 9c7cec6f375c93948302bdaefb4bf83de9521e82 Mon Sep 17 00:00:00 2001
From: memosr <mehmet.sr35@gmail.com>
Date: Thu, 21 May 2026 07:46:39 +0300
Subject: [PATCH 2/2] fix: extend owner filter to single transaction,
 idempotency fallback, and dashboard

---
 app/api/transactions/[id]/route.ts | 2 +-
 app/api/transactions/route.ts      | 1 +
 app/dashboard/[txHash]/page.tsx    | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/api/transactions/[id]/route.ts b/app/api/transactions/[id]/route.ts
index 785ecfd..d75a825 100644
--- a/app/api/transactions/[id]/route.ts
+++ b/app/api/transactions/[id]/route.ts
@@ -48,11 +48,11 @@ export async function GET(
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
 
-    // Fetch transaction (RLS will ensure user can only see their own)
     const { data: transaction, error: txError } = await supabase
       .from("transactions")
       .select("*")
       .eq("id", id)
+      .eq("user_id", user.id)
       .single();
 
     if (txError) {
diff --git a/app/api/transactions/route.ts b/app/api/transactions/route.ts
index b5edfa5..14f00ad 100644
--- a/app/api/transactions/route.ts
+++ b/app/api/transactions/route.ts
@@ -130,6 +130,7 @@ export async function POST(req: NextRequest) {
           .from("transactions")
           .select("*")
           .eq("idempotency_key", idempotencyKey)
+          .eq("user_id", user.id)
           .single();
 
         if (existingTx) {
diff --git a/app/dashboard/[txHash]/page.tsx b/app/dashboard/[txHash]/page.tsx
index 04494c0..1427b2b 100644
--- a/app/dashboard/[txHash]/page.tsx
+++ b/app/dashboard/[txHash]/page.tsx
@@ -70,11 +70,11 @@ export default async function TransactionDetailsPage(
     redirect("/auth/login");
   }
 
-  // Fetch the real transaction by tx_hash
   const { data: transaction, error: txError } = await supabase
     .from("transactions")
     .select("*")
     .eq("tx_hash", txHash)
+    .eq("user_id", data.user.id)
     .single();
 
   if (txError || !transaction) {