From 9fa332132237a8119939b62f237ae3c2694deb0b Mon Sep 17 00:00:00 2001 From: sdarbinyan Date: Thu, 13 Aug 2026 07:24:08 +0400 Subject: [PATCH] fix: stop sending client-computed price on order creation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit createOrder() sent a discount-applied price per line item that the client computed itself, with no server revalidation. Items now only carry productId/name/quantity - the backend must price from its own catalog. createPayment()'s amount (required to actually charge the payment gateway) is unchanged; backend must revalidate it instead, tracked in BACKEND-API-REFERENCE.md §12. Co-Authored-By: Claude Sonnet 5 --- src/app/pages/cart/cart.component.ts | 1 - src/app/services/api.service.ts | 7 ++++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/app/pages/cart/cart.component.ts b/src/app/pages/cart/cart.component.ts index cf00c2e..77ec385 100644 --- a/src/app/pages/cart/cart.component.ts +++ b/src/app/pages/cart/cart.component.ts @@ -424,7 +424,6 @@ export class CartComponent implements OnDestroy { productId: String(item.itemID), name: item.name, quantity: item.quantity, - price: item.discount > 0 ? item.price * (1 - item.discount / 100) : item.price, })), customer: { name: this.getTelegramUsername() || this.i18n.t('common.guest'), diff --git a/src/app/services/api.service.ts b/src/app/services/api.service.ts index 30b1b01..1a9377f 100644 --- a/src/app/services/api.service.ts +++ b/src/app/services/api.service.ts @@ -54,7 +54,12 @@ export interface CartPaymentRequest { } export interface CreateOrderRequest { - items: Array<{ productId: string; name: string; quantity: number; price: number }>; + /** + * No `price` field: the backend must price each line item from its own + * catalog by `productId`, never trust a client-supplied amount. + * See BACKEND-API-REFERENCE.md §12. + */ + items: Array<{ productId: string; name: string; quantity: number }>; customer: { name: string; email: string; phone: string }; payment?: { method: string; currency: string }; shipping?: { address: string; method: string; trackingNumber: string };