(20241217) payment reference will now be the same as the payment id.

api/blueprints/mail/retrieve/get.py

@@ -70,6 +70,7 @@ from shared import constants
 
 # Data Models:
 from models.api.mail.get import MailGetRequestHeaders, MailGetRequestData
+from models.core.user import CoreUserInfoModel
 
 # To work with datatypes:
 from typing import Literal
@@ -80,6 +81,9 @@ import asyncio
 # To work with date and time:
 import datetime
 
+# Helpers:
+from api.helpers.user import token_check
+
 
 #   *****************************************************************************************************************
 #  *****                                                                                                          ****
@@ -165,25 +169,7 @@ async def get_one_mail(
         return ResponseModel(
             status_code = StatusCodes.FAILED,
             http_code = HttpCodes.UNAUTHORIZED,
-            messge = "invalid session"
-        )
-
-    # ┏┓    ┓   ┏┳┓  ┓
-    # ┣ ┏┓╋┏┣┓   ┃ ┏┓┃┏┏┓┏┓┏
-    # ┻ ┗ ┗┗┛┗   ┻ ┗┛┛┗┗ ┛┗┛
-
-    # We first load the authorization tokens:
-    auth_token = await current_app.mail_controller.get_token(
-        mongo_conn = current_app.data_mongo,
-        token_key = inbound_data.tokenKey,
-    )
-
-    # If we failed to load the authorization tokens:
-    if not auth_token:
-        return ResponseModel(
-            status_code = StatusCodes.FAILED,
-            http_code = HttpCodes.UNAUTHORIZED,
-            message = f"no such token key '{inbound_data.tokenKey}'"
+            message = "Invalid session."
         )
 
     # ┏┓    ┓   ┳┳┓  •┓
@@ -193,10 +179,30 @@ async def get_one_mail(
     # Get the mail:
     message = await current_app.mail_controller.get_one_mail(
         mongo_conn = current_app.data_mongo,
-        token_id = auth_token.authTokenId,
         message_id = inbound_data.messageId
     )
 
+    # ┏┓          ┓ •    ┏┓┓    ┓
+    # ┃┃┓┏┏┏┓┏┓┏┓┏┣┓┓┏┓  ┃ ┣┓┏┓┏┃┏
+    # ┗┛┗┻┛┛┗┗ ┛ ┛┛┗┗┣┛  ┗┛┛┗┗ ┗┛┗
+    #                ┛
+
+    # We check if the token that was used to fetch the mail is owned by this user:
+    if not await token_check.is_authorized(
+        mongo_conn = current_app.data_mongo,
+        user_info = CoreUserInfoModel(**kwargs["session_info"]),
+        token_ids = [message.tokenId]
+    ): return ResponseModel(
+        status_code = StatusCodes.FAILED,
+        http_code = HttpCodes.UNAUTHORIZED,
+        message = "The message does not belong to this user."
+    )
+
+    # ┳┓
+    # ┣┫┏┓┏┏┓┏┓┏┓┏┏┓
+    # ┛┗┗ ┛┣┛┗┛┛┗┛┗
+    #      ┛
+
     # Done here:
     return ResponseModel(
         status_code = StatusCodes.OK if message else StatusCodes.FAILED,