[fix] check user extension access (#2519)

* feat: check user extension access
* fix: handle upgraded extensions

lnbits/core/crud.py

@@ -322,10 +322,7 @@ async def get_user(user_id: str, conn: Optional[Connection] = None) -> Optional[
     )
 
     if user:
-        extensions = await (conn or db).fetchall(
-            """SELECT extension FROM extensions WHERE "user" = ? AND active""",
-            (user_id,),
-        )
+        extensions = await get_user_active_extensions_ids(user_id, conn)
         wallets = await (conn or db).fetchall(
             """
             SELECT *, COALESCE((
@@ -344,7 +341,7 @@ async def get_user(user_id: str, conn: Optional[Connection] = None) -> Optional[
         email=user["email"],
         username=user["username"],
         extensions=[
-            e[0] for e in extensions if User.is_extension_for_user(e[0], user["id"])
+            e for e in extensions if User.is_extension_for_user(e[0], user["id"])
         ],
         wallets=[Wallet(**w) for w in wallets],
         admin=user["id"] == settings.super_user
@@ -482,6 +479,16 @@ async def update_user_extension(
     )
 
 
+async def get_user_active_extensions_ids(
+    user_id: str, conn: Optional[Connection] = None
+) -> List[str]:
+    rows = await (conn or db).fetchall(
+        """SELECT extension FROM extensions WHERE "user" = ? AND active""",
+        (user_id,),
+    )
+    return [e[0] for e in rows]
+
+
 # wallets
 # -------