fix: verify buyer ownership before entering the setinvoice flow

bot/commands.ts

@@ -668,6 +668,11 @@ const addInvoicePHI = async (
     // only orders with status PAID_HOLD_INVOICE are released payments
     if (order.status !== 'PAID_HOLD_INVOICE') return;
 
+    // Only the order's buyer may (re)submit the payout invoice. The order id
+    // comes from the callback data, so we verify the caller is the buyer
+    // before entering the invoice flow.
+    if (!ctx.user || String(order.buyer_id) !== String(ctx.user._id)) return;
+
     const buyer = await User.findOne({ _id: order.buyer_id });
     if (buyer === null) return;
     if (order.amount === 0) {

bot/start.ts

@@ -895,6 +895,11 @@ const initialize = (
       const order = await Order.findOne({ _id: ctx.match[1] });
       if (!order) return;
 
+      // Only the order's buyer may set/replace the payout invoice. The order
+      // id comes from the callback data, so we verify the caller is the buyer
+      // before driving the invoice flow.
+      if (String(order.buyer_id) !== String(ctx.user._id)) return;
+
       if (order.status === 'WAITING_BUYER_INVOICE') {
         await addInvoice(ctx, bot, order);
       } else {