Fix authorization bypass in user document download route

[OluwapelumiElisha]

Description

Patches an Insecure Direct Object Reference (IDOR) authorization bypass vulnerability in the user document (invoice/receipt) download routes.

Previously, the /:id/receipt and /:id/invoice endpoints in transactions.ts only checked if a request contained a valid authentication token. They did not verify if the requested transaction ID actually belonged to the authenticated user, potentially allowing arbitrary users to download other users' sensitive transaction documents.

This PR adds an explicit authorization boundary verifying that transaction.userId matches the authenticated req.jwtUser.userId (or that the user holds an admin role in the V1 route).

Changes Made

• Added user ownership validation to the /receipt and /invoice endpoints in src/routes/transactions.ts.
• Added user ownership validation to the /invoice endpoint in src/routes/v1/transactions.ts.
• Endpoints now return a secure 403 Forbidden response for unauthorized access attempts.

Related Issues

Fixes #1778

[drips-wave]

@OluwapelumiElisha Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits