From 84b9379fed59e312aaabbe3efc9b66c80d8cf706 Mon Sep 17 00:00:00 2001 From: Lucas Jeffrey Date: Mon, 2 Feb 2026 18:39:17 -0300 Subject: [PATCH 1/4] Community administrators now can use checkorder and checkinvoice commands --- bot/start.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bot/start.ts b/bot/start.ts index 34ca46d4..4e0ad10a 100644 --- a/bot/start.ts +++ b/bot/start.ts @@ -579,7 +579,7 @@ const initialize = ( } }); - bot.command('checkorder', superAdminMiddleware, async (ctx: MainContext) => { + bot.command('checkorder', adminMiddleware, async (ctx: MainContext) => { try { const [orderId] = (await validateParams(ctx, 2, '\\<_order id_\\>'))!; if (!orderId) return; @@ -599,7 +599,7 @@ const initialize = ( bot.command( 'checkinvoice', - superAdminMiddleware, + adminMiddleware, async (ctx: MainContext) => { try { const [orderId] = (await validateParams(ctx, 2, '\\<_order id_\\>'))!; From 2610270ae75b047d86e433d80c87440c356a6786 Mon Sep 17 00:00:00 2001 From: Lucas Jeffrey Date: Mon, 2 Feb 2026 23:51:21 -0300 Subject: [PATCH 2/4] Code formatting --- bot/start.ts | 48 ++++++++++++++++++++++-------------------------- 1 file changed, 22 insertions(+), 26 deletions(-) diff --git a/bot/start.ts b/bot/start.ts index 4e0ad10a..2475db26 100644 --- a/bot/start.ts +++ b/bot/start.ts @@ -597,35 +597,31 @@ const initialize = ( } }); - bot.command( - 'checkinvoice', - adminMiddleware, - async (ctx: MainContext) => { - try { - const [orderId] = (await validateParams(ctx, 2, '\\<_order id_\\>'))!; - if (!orderId) return; - if (!(await validateObjectId(ctx, orderId))) return; - const order = await Order.findOne({ _id: orderId }); - - if (order === null) return; - if (!order.hash) return; + bot.command('checkinvoice', adminMiddleware, async (ctx: MainContext) => { + try { + const [orderId] = (await validateParams(ctx, 2, '\\<_order id_\\>'))!; + if (!orderId) return; + if (!(await validateObjectId(ctx, orderId))) return; + const order = await Order.findOne({ _id: orderId }); - const invoice = await getInvoice({ hash: order.hash }); - if (invoice === undefined) { - throw new Error('invoice is undefined'); - } + if (order === null) return; + if (!order.hash) return; - await messages.checkInvoiceMessage( - ctx, - invoice.is_confirmed, - invoice.is_canceled!, - invoice.is_held!, - ); - } catch (error) { - logger.error(error); + const invoice = await getInvoice({ hash: order.hash }); + if (invoice === undefined) { + throw new Error('invoice is undefined'); } - }, - ); + + await messages.checkInvoiceMessage( + ctx, + invoice.is_confirmed, + invoice.is_canceled!, + invoice.is_held!, + ); + } catch (error) { + logger.error(error); + } + }); bot.command('resubscribe', superAdminMiddleware, async (ctx: MainContext) => { try { From 0cfcde9a194a09d7526701e12b5467034cf3a42a Mon Sep 17 00:00:00 2001 From: lucas Date: Wed, 18 Mar 2026 23:19:53 -0300 Subject: [PATCH 3/4] Address mostronator comment, added a check for checkorder and checkinvoice commands that the order is in the community of the admin --- bot/start.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/bot/start.ts b/bot/start.ts index 2475db26..2d993af8 100644 --- a/bot/start.ts +++ b/bot/start.ts @@ -588,6 +588,11 @@ const initialize = ( if (order === null) return; + // If the user is a community admin but not a superadmin we need to check the communities match + if (!ctx.admin.admin && String(order.community_id) !== String(ctx.admin.default_community_id)) { + return await messages.notAuthorized(ctx, ctx.admin.tg_id); + } + const buyer = await User.findOne({ _id: order.buyer_id }); const seller = await User.findOne({ _id: order.seller_id }); @@ -607,6 +612,11 @@ const initialize = ( if (order === null) return; if (!order.hash) return; + // If the user is a community admin but not a superadmin we need to check the communities match + if (!ctx.admin.admin && String(order.community_id) !== String(ctx.admin.default_community_id)) { + return await messages.notAuthorized(ctx, ctx.admin.tg_id); + } + const invoice = await getInvoice({ hash: order.hash }); if (invoice === undefined) { throw new Error('invoice is undefined'); From 9ca2320130e82c645422637428588d48e4acb5ca Mon Sep 17 00:00:00 2001 From: lucas Date: Wed, 18 Mar 2026 23:21:06 -0300 Subject: [PATCH 4/4] Code formatting --- bot/start.ts | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/bot/start.ts b/bot/start.ts index 2d993af8..f115f98c 100644 --- a/bot/start.ts +++ b/bot/start.ts @@ -589,7 +589,10 @@ const initialize = ( if (order === null) return; // If the user is a community admin but not a superadmin we need to check the communities match - if (!ctx.admin.admin && String(order.community_id) !== String(ctx.admin.default_community_id)) { + if ( + !ctx.admin.admin && + String(order.community_id) !== String(ctx.admin.default_community_id) + ) { return await messages.notAuthorized(ctx, ctx.admin.tg_id); } @@ -613,7 +616,10 @@ const initialize = ( if (!order.hash) return; // If the user is a community admin but not a superadmin we need to check the communities match - if (!ctx.admin.admin && String(order.community_id) !== String(ctx.admin.default_community_id)) { + if ( + !ctx.admin.admin && + String(order.community_id) !== String(ctx.admin.default_community_id) + ) { return await messages.notAuthorized(ctx, ctx.admin.tg_id); }