Revalidate community order channel ownership lazily at order creation time

bot/messages.ts

@@ -730,8 +730,12 @@ const publishBuyOrderMessage = async (
     let publishMessage = `⚡️🍊⚡️\n${order.description}\n`;
     publishMessage += `:${order._id}:`;
 
-    const channel = await getOrderChannel(order);
-    if (channel === undefined) throw new Error('channel is undefined');
+    const channel = await getOrderChannel(order, bot.telegram);
+    if (channel === undefined) {
+      order.status = 'CLOSED';
+      await order.save();
+      throw new Error('channel is undefined');
+    }
 
     // Get the community language if available
     let communityI18n = i18n;
@@ -782,8 +786,12 @@ const publishSellOrderMessage = async (
   try {
     let publishMessage = `⚡️🍊⚡️\n${order.description}\n`;
     publishMessage += `:${order._id}:`;
-    const channel = await getOrderChannel(order);
-    if (channel === undefined) throw new Error('channel is undefined');
+    const channel = await getOrderChannel(order, ctx.telegram);
+    if (channel === undefined) {
+      order.status = 'CLOSED';
+      await order.save();
+      throw new Error('channel is undefined');
+    }
 
     // Get the community language if available
     let communityI18n = i18n;

models/community.ts

@@ -17,7 +17,7 @@ export interface IOrderChannel extends Document {
 }
 
 const OrderChannelSchema = new Schema<IOrderChannel>({
-  name: { type: String, required: true, trim: true },
+  name: { type: String, required: true, unique: true },
   type: {
     type: String,
     enum: ['buy', 'sell', 'mixed'],
@@ -64,7 +64,7 @@ const CommunitySchema = new Schema<ICommunity>({
     required: true,
   },
   creator_id: { type: String },
-  group: { type: String, trim: true }, // group Id or public name
+  group: { type: String, unique: true }, // group Id or public name
   order_channels: {
     // array of Id or public name of channels
     type: [OrderChannelSchema],
@@ -73,7 +73,7 @@ const CommunitySchema = new Schema<ICommunity>({
   fee: { type: Number, min: 0, max: 100, default: 0 },
   earnings: { type: Number, default: 0 }, // Sats amount to be paid to the community
   orders_to_redeem: { type: Number, default: 0 }, // Number of orders calculated to be redeemed
-  dispute_channel: { type: String }, // Id or public name, channel to send new disputes
+  dispute_channel: { type: String, unique: true }, // Id or public name, channel to send new disputes
   solvers: [usernameIdSchema], // users that are dispute solvers
   banned_users: [usernameIdSchema], // users that are banned from the community
   public: { type: Boolean, default: true },

util/index.ts

@@ -8,7 +8,7 @@ import { Telegram } from 'telegraf';
 import axios from 'axios';
 import fiatJson from './fiat.json';
 import languagesJson from './languages.json';
-import { Order, Community } from '../models';
+import { Order, Community, User } from '../models';
 import { logger } from '../logger';
 import QRCode from 'qrcode';
 import { Image, createCanvas } from 'canvas';
@@ -318,7 +318,7 @@ const deleteOrderFromChannel = async (order: IOrder, telegram: Telegram) => {
   }
 };
 
-const getOrderChannel = async (order: IOrder) => {
+const getOrderChannel = async (order: IOrder, bot?: Telegram) => {
   let channel = process.env.CHANNEL;
   if (order.community_id) {
     const community = await Community.findOne({ _id: order.community_id });
@@ -334,6 +334,20 @@ const getOrderChannel = async (order: IOrder) => {
         }
       });
     }
+    const communityOwner = await User.findById(community.creator_id);
+    if (!communityOwner) {
+      return undefined;
+    }
+
+    if (bot && channel) {
+      // Validate order channel if the caller of this function passed the bot instance to perform the validation
+      // If it was not passed as a parameter the order channel can be trusted because its for ui purposes (listorders for example)
+      // This validation is performed lazily when publishing the order to the community order channel
+      const isChannelOk = await isGroupAdmin(channel, communityOwner, bot);
+      if (!isChannelOk.success) {
+        return undefined;
+      }
+    }
   }
 
   return channel;