updates

Backend/src/payments/routes/payment_routes.py

@@ -79,6 +79,14 @@ async def cancel_booking_on_payment_failure(booking: Booking, db: Session, reaso
 @router.get('/')
 async def get_payments(booking_id: Optional[int]=Query(None), status_filter: Optional[str]=Query(None, alias='status'), page: int=Query(1, ge=1), limit: int=Query(10, ge=1, le=100), current_user: User=Depends(get_current_user), db: Session=Depends(get_db)):
     try:
+        # SECURITY: Verify booking ownership when booking_id is provided
+        if booking_id and not can_access_all_payments(current_user, db):
+            booking = db.query(Booking).filter(Booking.id == booking_id).first()
+            if not booking:
+                raise HTTPException(status_code=404, detail='Booking not found')
+            if booking.user_id != current_user.id:
+                raise HTTPException(status_code=403, detail='Forbidden: You do not have permission to access payments for this booking')
+        
         if booking_id:
             query = db.query(Payment).filter(Payment.booking_id == booking_id)
         else:
@@ -168,12 +176,16 @@ async def get_payments_by_booking_id(booking_id: int, current_user: User=Depends
 @router.get('/{id}')
 async def get_payment_by_id(id: int, current_user: User=Depends(get_current_user), db: Session=Depends(get_db)):
     try:
-        payment = db.query(Payment).filter(Payment.id == id).first()
+        # SECURITY: Load booking relationship to verify ownership
+        payment = db.query(Payment).options(joinedload(Payment.booking)).filter(Payment.id == id).first()
         if not payment:
             raise HTTPException(status_code=404, detail='Payment not found')
+        # SECURITY: Verify payment ownership for non-admin/accountant users
         if not can_access_all_payments(current_user, db):
-            if payment.booking and payment.booking.user_id != current_user.id:
-                raise HTTPException(status_code=403, detail='Forbidden')
+            if not payment.booking:
+                raise HTTPException(status_code=403, detail='Forbidden: Payment does not belong to any booking')
+            if payment.booking.user_id != current_user.id:
+                raise HTTPException(status_code=403, detail='Forbidden: You do not have permission to access this payment')
         payment_dict = {'id': payment.id, 'booking_id': payment.booking_id, 'amount': float(payment.amount) if payment.amount else 0.0, 'payment_method': payment.payment_method.value if isinstance(payment.payment_method, PaymentMethod) else payment.payment_method, 'payment_type': payment.payment_type.value if isinstance(payment.payment_type, PaymentType) else payment.payment_type, 'deposit_percentage': payment.deposit_percentage, 'related_payment_id': payment.related_payment_id, 'payment_status': payment.payment_status.value if isinstance(payment.payment_status, PaymentStatus) else payment.payment_status, 'transaction_id': payment.transaction_id, 'payment_date': payment.payment_date.isoformat() if payment.payment_date else None, 'notes': payment.notes, 'created_at': payment.created_at.isoformat() if payment.created_at else None}
         if payment.booking:
             payment_dict['booking'] = {'id': payment.booking.id, 'booking_number': payment.booking.booking_number}