[Yun Tianming] backend/src/services/payments/razorpay/order.service.ts: verifyOrderPayment / verifySubscriptionPayment skip ownership checks #2183

Location: backend/src/api/routes/payments/razorpay/index.routes.ts:105-116 (requires req.user then drops it), backend/src/services/payments/razorpay/order.service.ts:112-122 and :248-260, backend/src/services/payments/razorpay/subscription.service.ts:182-221.

Kind: missing authorization on a user-facing mutation.

Evidence: the services verify only the Razorpay HMAC over (orderId, paymentId, signature) and then UPDATE payments.razorpay_orders ... WHERE environment = $1 AND order_id = $2 with no subject predicate and no withUserContext RLS probe. cancelSubscription in the same file (subscription.service.ts:228) does probe ownership, so the omission is inconsistent.

Impact: any authenticated user who obtains another user's checkout triple (visible client-side in the Razorpay checkout callback) can stamp verified_payment_id/verified_at on that user's order or subscription.

Fix would touch: the two services (pass the caller and scope the update through withUserContext or a subject filter), the routes, and tests/unit/razorpay-order.service.test.ts (happy path only today).

Found by Yun Tianming: nightly sweep 2026-10-29-1300 at 21ce31dd8fb3. A security finding: reported, never fixed here, because tightening changes what the product accepts.

🤖 Generated with Claude Code