From f538001c048d8a852b974579fe149c7f6ce607fa Mon Sep 17 00:00:00 2001
From: Stefan van Herwijnen <stefan@devliert.info>
Date: Thu, 15 Aug 2024 16:31:46 +0200
Subject: [PATCH] fix: clients should not be able to view canceled invoices

---
 packages/api/src/trpc/public/invoices.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/packages/api/src/trpc/public/invoices.ts b/packages/api/src/trpc/public/invoices.ts
index 79a8d79..4228cdb 100644
--- a/packages/api/src/trpc/public/invoices.ts
+++ b/packages/api/src/trpc/public/invoices.ts
@@ -32,7 +32,13 @@ export const publicInvoiceRoutes = ({
             withAmountRefunded: true
           }
         })
-        if (invoice?.status !== 'concept') return invoice
+        if (
+          invoice?.status &&
+          ![InvoiceStatus.CONCEPT, InvoiceStatus.CANCELED].includes(
+            invoice.status
+          )
+        )
+          return invoice
       }
       throw new TRPCError({
         code: 'BAD_REQUEST'