fix: revolut unsubscribe (#4009)

lnbits/core/views/callback_api.py

@@ -439,7 +439,7 @@ async def _handle_revolut_subscription(
 
     extra = {
         **(reference.extra or {}),
-        "subscription_request_id": reference.subscription_request_id,
+        "subscription_request_id": subscription_id,
         "fiat_method": "subscription",
         "tag": reference.tag,
         "subscription": {

lnbits/fiat/revolut.py

@@ -283,7 +283,7 @@ class RevolutWallet(FiatProvider):
             return FiatSubscriptionResponse(
                 ok=True,
                 checkout_session_url=checkout_url,
-                subscription_request_id=payment_options.subscription_request_id,
+                subscription_request_id=revolut_subscription_id,
             )
         except json.JSONDecodeError:
             return FiatSubscriptionResponse(
@@ -302,6 +302,15 @@ class RevolutWallet(FiatProvider):
         **kwargs,
     ) -> FiatSubscriptionResponse:
         try:
+            subscription = await self.get_subscription(subscription_id)
+            reference = self.deserialize_subscription_reference(
+                subscription.get("external_reference")
+            )
+            if not reference or reference.wallet_id != correlation_id:
+                return FiatSubscriptionResponse(
+                    ok=False, error_message="Subscription not found."
+                )
+
             r = await self.client.post(
                 f"/api/subscriptions/{subscription_id}/cancel",
                 timeout=REVOLUT_REQUEST_TIMEOUT,