fix: verify buyer ownership before entering the setinvoice flow (#833)

The addInvoicePHI handler and the setinvoice_ action looked up the order
by the id carried in the callback data and then entered the invoice flow
without checking that the caller is the order's buyer. Add an explicit
check that ctx.user is the buyer in both entry points, so only the buyer
can set or replace the payout invoice of their order.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: grunch

bot/commands.ts

@@ -668,6 +668,11 @@ const addInvoicePHI = async (
     // only orders with status PAID_HOLD_INVOICE are released payments
     if (order.status !== 'PAID_HOLD_INVOICE') return;
 
+    // Only the order's buyer may (re)submit the payout invoice. The order id
+    // comes from the callback data, so we verify the caller is the buyer
+    // before entering the invoice flow.
+    if (!ctx.user || String(order.buyer_id) !== String(ctx.user._id)) return;
+
     const buyer = await User.findOne({ _id: order.buyer_id });
     if (buyer === null) return;
     if (order.amount === 0) {

bot/start.ts

@@ -895,6 +895,11 @@ const initialize = (
       const order = await Order.findOne({ _id: ctx.match[1] });
       if (!order) return;
 
+      // Only the order's buyer may set/replace the payout invoice. The order
+      // id comes from the callback data, so we verify the caller is the buyer
+      // before driving the invoice flow.
+      if (String(order.buyer_id) !== String(ctx.user._id)) return;
+
       if (order.status === 'WAITING_BUYER_INVOICE') {
         await addInvoice(ctx, bot, order);
       } else {