fix: filter GET /api/transactions by authenticated user_id by kutluhaneth46 · Pull Request #61 · circlefin/arc-commerce

kutluhaneth46 · 2026-09-04T00:43:22Z

Summary

Add .eq("user_id", user.id) to the GET /api/transactions Supabase query so authenticated users only receive their own rows
Closes the data-exposure gap where any logged-in user could list all transaction_type = 'USER' records

Related: open PR #31 covers overlapping user_id filtering work; this PR is a focused fix on the list endpoint against current upstream/master.

As user A, create/list transactions and confirm only A's rows are returned
As user B, call GET /api/transactions and confirm A's transactions are not returned
Unauthenticated request still returns 401

kutluhaneth46 · 2026-09-09T14:14:50Z

Closing this to reduce open-PR noise and focus my remaining reviews on a smaller set of higher-signal threads.

Happy to reopen later if maintainers still want this change — thanks for your time.

kutluhaneth46 · 2026-09-09T14:14:51Z

Closing this to reduce open-PR noise and focus my remaining reviews on a smaller set of higher-signal threads.

Happy to reopen later if maintainers still want this change — thanks for your time.

fix: filter GET /api/transactions by authenticated user_id

ac9ffb4

kutluhaneth46 force-pushed the fix/filter-transactions-by-user-id branch from 8ce1adc to ac9ffb4 Compare September 6, 2026 14:16

kutluhaneth46 closed this Sep 9, 2026