Skip to content

fix: authorize escrow refund callers - #47

Open
kutluhaneth46 wants to merge 1 commit into
circlefin:masterfrom
kutluhaneth46:cursor/fix-escrow-refund-authz-88c1
Open

fix: authorize escrow refund callers#47
kutluhaneth46 wants to merge 1 commit into
circlefin:masterfrom
kutluhaneth46:cursor/fix-escrow-refund-authz-88c1

Conversation

@kutluhaneth46

Copy link
Copy Markdown

Summary

  • require refund callers to own either the depositor or beneficiary wallet on the agreement
  • return 403 Forbidden for non-party wallets before invoking Circle contract operations

Validation

  • npx tsc --noEmit
  • npm run build (requires CIRCLE_API_KEY during Next.js config loading)

Fixes #42

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

/api/contracts/escrow/refund missing object-level authorization — any authenticated user can refund any agreement

1 participant