Invoice Access Control and Role-Gating UI

[Kingsman-99]

Description

All authenticated users who navigate to an invoice detail URL can see and interact with action buttons regardless of whether they are the creator, a recipient, or an unrelated party. Role-based UI gating must ensure only authorized parties see the correct actions and data.

Technical Context

src/app/invoice/[id]/page.tsx fetches the invoice and compares invoice.creatorPublicKey and invoice.recipients[].publicKey against the connected wallet's public key from src/context/WalletContext.tsx. A src/hooks/useInvoiceRole.ts (new) hook returns 'creator' | 'recipient' | 'viewer'. Action buttons, edit links, and sensitive financial breakdowns are conditionally rendered based on the role. Unauthorized direct API calls are blocked server-side in src/app/api/invoices/[id]/route.ts.

Acceptance Criteria

• Users identified as creator see edit, clone, cancel, and release actions
• Users identified as recipient see their own payment status and a "Pay my share" action
• Users identified as viewer see only publicly available invoice metadata with no action buttons
• Role determination is derived from the on-chain state and wallet public key, not from a client-settable flag
• Server routes return 403 for any action a non-creator or non-recipient attempts via direct API call
• All CI checks (npm test, npm run build, ESLint/TypeScript) pass and the branch has no merge conflicts

---

[GazzyLee]

gm gm boss, I'd like to take this on. I'll implement role-based access using the connected wallet and on-chain invoice data, ensure creators, recipients, and viewers see only the actions and information they're authorized for, enforce the same permissions server-side, and add tests to prevent unauthorized access.

[felladaniel36-hash]

@felladaniel36-hash has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I'd like to claim this issue. I have reviewed the details and can begin working on a fix right away. Please assign it to me if it's still available. Thanks!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @felladaniel36-hash to this issue.

[DevRushd]

@DevRushd has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would love to fix this issue. Can you please assign it to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @DevRushd to this issue.

[canicefavour]

@canicefavour has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I can implement this role-based access flow by deriving permissions from the connected wallet and on-chain invoice state, introducing a reusable useInvoiceRole hook, enforcing UI gating for creators, recipients, and viewers, and mirroring those permissions with server-side authorization checks so direct API requests cannot bypass access control.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @canicefavour to this issue.

[Oryke]

@Oryke has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

please assign me this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Oryke to this issue.

[Sulex45]

@Sulex45 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi id love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Sulex45 to this issue.

[Caneryy]

@Caneryy has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello, please can I work on this issue?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Caneryy to this issue.

[drips-wave]

Congratulations, @Oryke! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @Oryke: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @Oryke as part of the Stellar Wave Program's 7th Wave 🥳

😎 @Oryke: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.