---
issue: 005
title: "POST /api/payment/payments/:id/fetch-tx, POST /api/payment/payments/auto-fetch-missing, and GET /api/payment/payments/:id/debug have no authentication middleware"
severity: critical
domain: Payment
labels: [security, bug, backend, critical, missing-auth]
status: resolved
resolved: 2026-05-29
fix: "Added authenticateToken + authorizeRoles('admin') to /payments/:id/debug, /payments/:id/fetch-tx, and /payments/auto-fetch-missing in paymentRoutes.ts"
created: 2026-05-29
source: Doc vs Code Audit 2026-05-29
---

# 🔴 POST /api/payment/payments/:id/fetch-tx, POST /api/payment/payments/auto-fetch-missing, and GET /api/payment/payments/:id/debug have no authentication middleware

**Severity:** critical
**Domain:** Payment
**Labels:** security, bug, backend, critical, missing-auth

## Description

Three payment utility/debug endpoints are mounted with zero authentication. Any unauthenticated caller can read full payment internals (including blockchain metadata and wallet monitor state) or trigger on-chain fetches and state writes. These are exploitable without credentials in production.

## Current Behavior

All three return 200 with full data when called without any Authorization header.

## Expected Behavior

All three endpoints should require at minimum authenticateToken, and ideally authorizeRoles('admin').

## Reproduction Steps

curl -X POST https://api.example.com/api/payment/payments/test123/fetch-tx — expect 401, currently returns 200.

## Affected Files

- `backend/src/routes/paymentRoutes.ts`

## References

- [Doc vs Code Audit Report](../09%20-%20Audits/Doc%20vs%20Code%20Audit%20Report%20-%202026-05-29.md)