feat(dimentorin): GET /payments/session/{id} for mentee/mentor dashboard

imphnen-dimentorin/src/payments/application/payment_service.rs

@@ -234,4 +234,20 @@ impl PaymentService for PaymentServiceImpl {
 		}
 		Ok(payment)
 	}
+
+	async fn get_session_payments(
+		&self,
+		session_id: Uuid,
+		user_id: Uuid,
+	) -> Result<Vec<PaymentEntity>, AppError> {
+		// Only the session's mentee or mentor may see its payments.
+		let session = self.session_repo.find_by_id(session_id).await?
+			.ok_or_else(|| AppError::NotFoundError("Session not found".into()))?;
+		if session.mentee_id != user_id && session.mentor_id != user_id {
+			return Err(AppError::ForbiddenError(
+				"You can only view payments of your own sessions".into(),
+			));
+		}
+		self.payment_repo.find_by_session(session_id).await
+	}
 }

imphnen-dimentorin/src/payments/domain/service.rs

@@ -42,4 +42,12 @@ pub trait PaymentService: Send + Sync {
 		id: Uuid,
 		user_id: Uuid,
 	) -> Result<PaymentEntity, AppError>;
+
+	/// List payments for one session. Only the session's mentee or mentor may
+	/// access.
+	async fn get_session_payments(
+		&self,
+		session_id: Uuid,
+		user_id: Uuid,
+	) -> Result<Vec<PaymentEntity>, AppError>;
 }

imphnen-dimentorin/src/payments/infrastructure/http/handlers.rs

@@ -7,6 +7,7 @@ use imphnen_libs::ValidatedJson;
 use imphnen_libs::decode_access_token;
 use imphnen_utils::{ApiMessage, ApiSuccess, AppError};
 use std::sync::Arc;
+use uuid::Uuid;
 
 fn extract_user_id(headers: &HeaderMap) -> Result<uuid::Uuid, AppError> {
 	let token = headers
@@ -69,6 +70,17 @@ pub async fn get_my_payments(
 	Ok(ApiSuccess(items))
 }
 
+pub async fn get_session_payments(
+	headers: axum::http::HeaderMap,
+	axum::extract::Path(session_id): axum::extract::Path<Uuid>,
+	Extension(service): Extension<Arc<dyn PaymentService>>,
+) -> Result<impl axum::response::IntoResponse, AppError> {
+	let user_id = extract_user_id(&headers)?;
+	let payments = service.get_session_payments(session_id, user_id).await?;
+	let items: Vec<PaymentResponseDto> = payments.iter().map(to_dto).collect();
+	Ok(ApiSuccess(items))
+}
+
 /// GET /v1/dimentorin/payments/{id}
 pub async fn get_payment_by_id(
 	headers: axum::http::HeaderMap,

imphnen-dimentorin/src/payments/infrastructure/http/routes.rs

@@ -1,6 +1,6 @@
 use super::handlers::{
-	get_my_payments, get_payment_by_id, post_confirm_payment, post_create_payment,
-	post_refresh_payment,
+	get_my_payments, get_payment_by_id, get_session_payments, post_confirm_payment,
+	post_create_payment, post_refresh_payment,
 };
 use crate::payments::application::PaymentServiceImpl;
 use crate::payments::domain::PaymentService;
@@ -31,6 +31,7 @@ pub fn payments_protected_routes(
 	Router::new()
 		.route("/payments/sessions/{id}/create", post(post_create_payment))
 		.route("/payments/me", get(get_my_payments))
+		.route("/payments/session/{id}", get(get_session_payments))
 		.route("/payments/{id}", get(get_payment_by_id))
 		.route("/payments/{id}/confirm", post(post_confirm_payment))
 		.route("/payments/{id}/refresh", post(post_refresh_payment))