[feat] fetch all payments for user (#3132)

lnbits/core/crud/payments.py

@@ -1,7 +1,7 @@
 from time import time
 from typing import Any, Optional, Tuple
 
-from lnbits.core.crud.wallets import get_total_balance, get_wallet
+from lnbits.core.crud.wallets import get_total_balance, get_wallet, get_wallets_ids
 from lnbits.core.db import db
 from lnbits.core.models import PaymentState
 from lnbits.db import Connection, DateTrunc, Filters, Page
@@ -95,6 +95,7 @@ async def get_latest_payments_by_extension(
 async def get_payments_paginated(
     *,
     wallet_id: Optional[str] = None,
+    user_id: Optional[str] = None,
     complete: bool = False,
     pending: bool = False,
     failed: bool = False,
@@ -121,6 +122,13 @@ async def get_payments_paginated(
     if wallet_id:
         values["wallet_id"] = wallet_id
         clause.append("wallet_id = :wallet_id")
+    elif user_id:
+        wallet_ids = await get_wallets_ids(user_id=user_id, conn=conn) or [
+            "no-wallets-for-user"
+        ]
+        # wallet ids are safe to use in sql queries
+        wallet_ids_str = [f"'{w}'" for w in wallet_ids]
+        clause.append(f""" wallet_id IN ({", ".join(wallet_ids_str)}) """)
 
     if complete and pending:
         clause.append(

lnbits/core/crud/wallets.py

@@ -135,6 +135,20 @@ async def get_wallets(
     )
 
 
+async def get_wallets_ids(
+    user_id: str, deleted: Optional[bool] = None, conn: Optional[Connection] = None
+) -> list[str]:
+    where = "AND deleted = :deleted" if deleted is not None else ""
+    result: list[dict] = await (conn or db).fetchall(
+        f"""
+        SELECT id FROM wallets
+        WHERE "user" = :user {where}
+        """,
+        {"user": user_id, "deleted": deleted},
+    )
+    return [row["id"] for row in result]
+
+
 async def get_wallets_count():
     result = await db.execute("SELECT COUNT(*) as count FROM wallets")
     row = result.mappings().first()

lnbits/core/views/payment_api.py

@@ -264,13 +264,21 @@ async def _api_payments_create_invoice(data: CreateInvoice, wallet: Wallet):
     response_description="list of payments",
     response_model=Page[Payment],
     openapi_extra=generate_filter_params_openapi(PaymentFilters),
-    dependencies=[Depends(check_admin)],
 )
 async def api_all_payments_paginated(
     filters: Filters = Depends(parse_filters(PaymentFilters)),
+    user: User = Depends(check_user_exists),
 ):
+    if user.admin:
+        # admin user can see payments from all wallets
+        for_user_id = None
+    else:
+        # regular user can only see payments from their wallets
+        for_user_id = user.id
+
     return await get_payments_paginated(
         filters=filters,
+        user_id=for_user_id,
     )