Invoice detail endpoint
▼-23Check Warned@oscar-diazdcfcc2d1 medium
Adds GET /invoices/{invoice_id}. The handler authenticates the caller but never checks that the invoice belongs to them, so any customer can enumerate other customers' invoices by id (IDOR).