fix: enforce community ownership on earnings withdrawal

[grunch]

What

The withdrawEarnings action looked up the target community using only the id taken from the inline-button callback data, without verifying that the caller owns that community. This change scopes the lookup by creator_id as well, so only the community creator can start a withdrawal of its earnings.

Why

Every other community-management handler (deleteCommunity, changeVisibility, updateCommunity) already filters by creator_id: ctx.user._id. The earnings-withdrawal path was the only one missing that ownership check, leaving it inconsistent with the rest of the module. Scoping the query keeps authorization consistent across all community operations.

Change

bot/modules/community/actions.ts — add creator_id: ctx.user._id to the Community.findOne lookup in withdrawEarnings.

Testing

• npx tsc --noEmit passes.
• npx eslint bot/modules/community/actions.ts passes.

Summary by CodeRabbit

• Bug Fixes
  • Earnings withdrawal from communities is now restricted to community creators only, preventing unauthorized withdrawals.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 54c0b334-1765-4882-a88c-50035f9f3371

📥 Commits

Reviewing files that changed from the base of the PR and between 084c0da and bacfb33.

📒 Files selected for processing (1)

• bot/modules/community/actions.ts

---

Walkthrough

The PR adds an authorization check to the withdrawEarnings function in the community actions module. The database lookup for Community now filters by both the community id from callback data and the current user's id as the creator, ensuring only the community creator can withdraw earnings. Inline comments clarify this behavior.

Changes

Community Creator Authorization

Layer / File(s)	Summary
withdrawEarnings creator authorization check bot/modules/community/actions.ts	The withdrawEarnings function now validates that the found community matches both the provided community id and requires creator_id: ctx.user._id, with added comments documenting the authorization rule and callback data source.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A bunny guards the earnings purse,
Only creators reap the rewards in this verse,
With filters tight and checks so true,
Communities safe from withdrawal by you! 🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: enforce community ownership on earnings withdrawal' clearly and concisely summarizes the main change: adding ownership verification to the earnings withdrawal functionality.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/withdraw-earnings-ownership

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed due to a network error.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Luquitasjeffrey]

tACK