src/server/routers/invoice.ts (2)

392-421: Add an authorization guard: any logged-in user can stop someone else’s recurrence

This mutation doesn’t verify ownership of the request before patching the API and updating the DB. A logged-in user could stop recurrence for any known requestId. Enforce that the current user is the issuer (or whatever rule applies here) before proceeding.

Apply this diff to fetch the invoice, ensure it exists, and check authorization:

   .mutation(async ({ ctx, input }) => {
-      const { requestId } = input;
+      const { db, user } = ctx;
+      const { requestId } = input;
+
+      // Authorization: ensure the authenticated user owns this request
+      const invoice = await db.query.requestTable.findFirst({
+        where: eq(requestTable.requestId, requestId),
+      });
+      if (!invoice) {
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Invoice with this request ID not found",
+        });
+      }
+      if (invoice.userId !== user?.id) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "You are not allowed to stop recurrence for this invoice",
+        });
+      }
 
-      const request = await apiClient.patch(`/v2/request/${requestId}`, {
+      const response = await apiClient.patch(`/v2/request/${requestId}`, {
         isRecurrenceStopped: true,
       });
 
-      if (request.status !== 200) {
+      if (response.status < 200 || response.status >= 300) {
         throw new TRPCError({
           code: "BAD_REQUEST",
-          message: "Failed to stop recurrence",
+          message: `Failed to stop recurrence: ${response.data?.message ?? "Unknown error"}`,
         });
       }
       const updatedInvoice = await ctx.db
         .update(requestTable)
         .set({
           isRecurrenceStopped: true,
         })
         .where(eq(requestTable.requestId, requestId))
         .returning();

---

413-417: Fix misleading error message (“payment reference” vs “request ID”)

You’re filtering by requestId, but the message says “payment reference”. Update the message for accuracy.

-        throw new TRPCError({
-          code: "NOT_FOUND",
-          message: "Invoice with this payment reference not found",
-        });
+        throw new TRPCError({
+          code: "NOT_FOUND",
+          message: "Invoice with this request ID not found",
+        });

src/server/routers/invoice.ts (1)

395-401: Accept any 2xx response and surface backend error; also rename “request” to “response”

PATCH endpoints often return 200 or 204. Restricting to 200 can misclassify success as failure. Also, “request” here is actually an Axios response; rename for clarity and include the backend’s error message.

-      const request = await apiClient.patch(`/v2/request/${requestId}`, {
+      const response = await apiClient.patch(`/v2/request/${requestId}`, {
         isRecurrenceStopped: true,
       });
 
-      if (request.status !== 200) {
+      if (response.status < 200 || response.status >= 300) {
         throw new TRPCError({
           code: "BAD_REQUEST",
-          message: "Failed to stop recurrence",
+          message: `Failed to stop recurrence: ${response.data?.message ?? "Unknown error"}`,
         });
       }

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: bassgeta
PR: RequestNetwork/easy-invoice#82
File: src/server/routers/recurring-payment.ts:143-148
Timestamp: 2025-07-11T12:56:11.332Z
Learning: The `v2/payouts/recurring/{externalPaymentId}` PATCH endpoint in the RequestNetwork/easy-invoice project specifically returns a 200 status code on success or an error status code - it does not return other 2xx success codes like 201 or 204. The status check `response.status !== 200` is correct for this specific endpoint.