Skip to content

fix: authorize escrow refund callers - #47

Closed
kutluhaneth46 wants to merge 1 commit into
circlefin:masterfrom
kutluhaneth46:cursor/fix-escrow-refund-authz-88c1
Closed

fix: authorize escrow refund callers#47
kutluhaneth46 wants to merge 1 commit into
circlefin:masterfrom
kutluhaneth46:cursor/fix-escrow-refund-authz-88c1

Conversation

@kutluhaneth46

Copy link
Copy Markdown

Summary

  • require refund callers to own either the depositor or beneficiary wallet on the agreement
  • return 403 Forbidden for non-party wallets before invoking Circle contract operations

Validation

  • npx tsc --noEmit
  • npm run build (requires CIRCLE_API_KEY during Next.js config loading)

Fixes #42

@kutluhaneth46

Copy link
Copy Markdown
Author

Closing this to reduce open-PR noise and focus my remaining reviews on a smaller set of higher-signal threads.

Happy to reopen later if maintainers still want this change — thanks for your time.

1 similar comment
@kutluhaneth46

Copy link
Copy Markdown
Author

Closing this to reduce open-PR noise and focus my remaining reviews on a smaller set of higher-signal threads.

Happy to reopen later if maintainers still want this change — thanks for your time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

/api/contracts/escrow/refund missing object-level authorization — any authenticated user can refund any agreement

1 participant