AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Moderate 51 Bitcoin

fix(API): add storeId-less routes for invoices, payment requests, and pull payments (#7313)

Public commit record

What the developer wrote

Authored by Abhijay Jain

70/100 · Adequate
fix(API): add storeId-less routes for invoices, payment requests, and pull payments (#7313)
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
The short version

What changed, and why it matters

This commit changes several BTCPay Server API endpoints so that callers no longer need to supply a store ID when working with existing invoices, payment requests, and pull payments. The server now looks up the store automatically from the invoice/payment-request/pull-payment record. The old store-scoped routes are kept alongside the new shorter routes. The change is described as a convenience/cleanup fix, not as a security patch, and the diff does not show any new authorization checks being added.

Recommended action

Review the middleware/filters that populate HttpContext.GetInvoiceDataOrNull(), GetPaymentRequestDataOrNull(), and GetPullPaymentDataOrNull() to confirm they enforce store-ownership correctly for both the old and new routes. Re-add or replace the removed cross-store negative tests to ensure a caller with permission on store A cannot access or modify resources belonging to store B via the new storeId-less routes. Consider whether making storeId optional weakens any defense-in-depth assumptions elsewhere.

Security signals we found

01

API route simplification removes explicit storeId parameter for resource-scoped operations

02

Authorization still relies on existing resource-level middleware/filters and unchanged policy attributes

03

No new access-control logic is introduced in the diff

04

Two negative permission tests that exercised cross-store access were deleted

05

Client library methods drop storeId arguments, changing caller contract

Risk score

Why this scored 51/100

Our methodology →
Potential impact 12/30
Exploitability 10/25
Stealth signal 8/15
Affected reach 12/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.