Validate that PayID domain matches server domain on creation
nkramer44 opened this issue · 1 comments
Currently in the admin API, you can create a PayID which has a different domain than the domain of the PayID server without the server complaining. However, that PayID is now useless because any PayID query with the configured account will return a 404.
Detailed Description
Let's say I want to create a PayID nkramer$example.com
on the PayID server locally. I could do that by hitting http://localhost8081/users
with this payload:
{
"payId": "nkramer44$example.com",
"addresses": [
{
"paymentNetwork": "XRPL",
"environment": "TESTNET",
"details": {
"address": "rE2L8SciZFHP4UX8ZWJxobeuaPTe7EShBq"
}
}
]
}
The PayID server will store the PayID nkramer44$example.com
. If I then take my username nkramer44
and do a PayID lookup like GET http://localhost:8080/nkramer44
, I will get a 404 because the server will look for a PayID like nkramer44$localhost
.
Context
This isn't a huge deal, because someone playing around with the server locally or in the sandbox could just delete the incorrect PayID, but in the interest of making this thing as fool proof as possible, I think new users would benefit from some error feedback in this case.
Possible Implementation
In the users.ts
middleware, we could just do a simple check on the payload PayID to compare it to the server domain.
Alternatives Considered
Additional Context
Bonus
Are you willing to submit a pull request to implement this change?
Yes, when you work in dev env, EVERYTHING must be "localhost".
I'm learning this as well.
The thought here is "What is the domain"?
If you are creating a payID, on a localhost, the domain is in fact, "localhost". lol