Enforce seller exclusion and block self-purchase

[CherryCIC]

What changed

• exclude the authenticated seller from both paginated product feed endpoints, including search and subsequent pages
• resolve ownership from current userId and legacy user_id records
• reject self-purchase before creating a Stripe PaymentIntent
• reject self-purchase again during paid order creation and inside the inventory transaction
• return a clear 403 response from payment and order endpoints

Why

Authenticated feeds did not scope out the seller's own listings. Checkout also trusted the selected product without comparing its seller to the authenticated buyer, allowing a seller to begin and potentially complete a purchase of their own listing.

Impact

Buyers keep full feed pages without seeing their own listings. Self-purchase is blocked at every trusted backend boundary, even if the app guard is bypassed or an older product record uses user_id.

Checks

• NODE_ENV=production FIREBASE_PROJECT_ID=cherry-test FIREBASE_API_KEY=test npm test -- --runInBand (43 tests passed)
• npm run build
• git diff --check

App safeguard

Paired with Cherry-CIC/MVP#466 for client-side feed filtering and checkout prevention.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1abf48d4-f798-4d86-8f5d-ed8d61c5d1d7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/prevent-self-purchase

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}