From 1df768df0a9631e46c8aafe5ba0373949138e32e Mon Sep 17 00:00:00 2001
From: Catrya <140891948+Catrya@users.noreply.github.com>
Date: Thu, 21 Dec 2023 14:38:15 -0500
Subject: [PATCH] Fix pay to buyer (#456)

Now /paytobuyer can be used by admins in their communities
---
 bot/start.ts | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/bot/start.ts b/bot/start.ts
index 3bb6ae72..e6f598e8 100644
--- a/bot/start.ts
+++ b/bot/start.ts
@@ -819,7 +819,7 @@ const initialize = (botToken: string, options: Partial<Telegraf.Options<MainCont
     await release(ctx, ctx.match[1]);
   });
 
-  bot.command('paytobuyer', superAdminMiddleware, async (ctx: MainContext) => {
+  bot.command('paytobuyer', adminMiddleware, async (ctx: MainContext) => {
     try {
       const [orderId] = await validateParams(ctx, 2, '\\<_order id_\\>');
       if (!orderId) return;
@@ -828,6 +828,17 @@ const initialize = (botToken: string, options: Partial<Telegraf.Options<MainCont
         _id: orderId,
       });
       if (!order) return await messages.notActiveOrderMessage(ctx);
+      
+      // We check if this is a solver, the order must be from the same community
+      if (!ctx.admin.admin) {
+        if (!order.community_id) {
+          return await messages.notAuthorized(ctx);
+        }
+
+        if (order.community_id != ctx.admin.default_community_id) {
+          return await messages.notAuthorized(ctx);
+        }
+      }
 
       // We make sure the buyers invoice is not being paid
       const isPending = await PendingPayment.findOne({