credit abuse fix

routers/payments.py

@@ -353,6 +353,24 @@ async def verify_payment(
                 credits_added=0,
                 new_balance=user.credits
             )
+            
+        # Security Check: Ensure payment_id hasn't been used for another transaction
+        # This prevents replay attacks where a valid payment_id is used for multiple orders
+        existing_usage = await db.execute(
+            select(PaymentTransaction).where(
+                PaymentTransaction.gateway_payment_id == request.razorpay_payment_id,
+                PaymentTransaction.status == "paid"
+            )
+        )
+        if existing_usage.scalar_one_or_none():
+            logger.warning(
+                f"Payment replay attempt: Payment ID {request.razorpay_payment_id} "
+                f"already used for another transaction. User: {user.user_id}"
+            )
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail="Payment ID already used"
+            )
         
         # Verify signature
         is_valid = razorpay_service.verify_payment_signature(