From 3794eac91500bc560cec8ad6280fb38bba6c9222 Mon Sep 17 00:00:00 2001
From: Vlad Stan <stan.v.vlad@gmail.com>
Date: Thu, 16 Mar 2023 09:56:30 +0200
Subject: [PATCH] fix: do not allow two merchants with the same public key

---
 static/components/customer-stall/customer-stall.js | 5 +++--
 static/js/index.js                                 | 5 +----
 views_api.py                                       | 9 +++++++++
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/static/components/customer-stall/customer-stall.js b/static/components/customer-stall/customer-stall.js
index dcf1adf..9a864a2 100644
--- a/static/components/customer-stall/customer-stall.js
+++ b/static/components/customer-stall/customer-stall.js
@@ -342,8 +342,9 @@ async function customerStall(path) {
         let json = JSON.parse(text)
         if (json.id != this.activeOrder) return
         if (json.payment_options) {
-          let payment_request = json.payment_options.find(o => o.type == 'ln')
-            .link
+          let payment_request = json.payment_options.find(
+            o => o.type == 'ln'
+          ).link
           if (!payment_request) return
           this.loading = false
           this.qrCodeDialog.data.payment_request = payment_request
diff --git a/static/js/index.js b/static/js/index.js
index 435cfd8..d530977 100644
--- a/static/js/index.js
+++ b/static/js/index.js
@@ -78,10 +78,7 @@ const merchant = async () => {
             message: 'Merchant Created!'
           })
         } catch (error) {
-          this.$q.notify({
-            type: 'negative',
-            message: `${error}`
-          })
+          LNbits.utils.notifyApiError(error)
         }
       },
       getMerchant: async function () {
diff --git a/views_api.py b/views_api.py
index ba3c0f6..ab950db 100644
--- a/views_api.py
+++ b/views_api.py
@@ -32,6 +32,7 @@ from .crud import (
     delete_stall,
     delete_zone,
     get_direct_messages,
+    get_merchant_by_pubkey,
     get_merchant_for_user,
     get_order,
     get_orders,
@@ -78,6 +79,9 @@ async def api_create_merchant(
 ) -> Merchant:
 
     try:
+        merchant = await get_merchant_by_pubkey(data.public_key)
+        assert merchant == None, "A merchant already uses this public key"
+
         merchant = await get_merchant_for_user(wallet.wallet.user)
         assert merchant == None, "A merchant already exists for this user"
 
@@ -85,6 +89,11 @@ async def api_create_merchant(
         await subscribe_to_direct_messages(data.public_key, 0)
 
         return merchant
+    except AssertionError as ex:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail=str(ex),
+        )
     except Exception as ex:
         logger.warning(ex)
         raise HTTPException(