coinos-server.git/lib/payments.ts, branch staging

finalize: don't crash on non-integer fee delta (tbRefund NaN)

2026-06-17T14:47:47Z

Port of master 8aba0bc2, adapted to this stack's tbRefund. When xpay's response shape is unexpected (or a zero-amount invoice's decoded amount_msat is undefined) the computed p.fee becomes NaN, and the refund delta crashes the balance write, leaving finalize partial (user loses up to maxfee). Validate the computed fee is a finite integer; if not, keep the originally-reserved maxfee (zero refund, no balance corruption) and warn. Same guard on the refund delta before tbRefund. Co-Authored-By: Claude Opus 4.8

sendLightning/sendKeysend: instrument exit paths, tighten LEAKED DEBIT guard

2026-06-17T14:47:47Z

Port of master 51107ed4 + fe767002 + cb0f1962 (combined) to the staging stack. Track an outcome string through every exit path, handle the xpay failed_parts branch explicitly (verify with listpays then finalize/ reverse/leave-pending), and dump abnormal xpay/keysend response shapes. Leak guard re-reads the db record before firing: if ref is persisted the payment is settled regardless of which path threw (finalize may set ref then throw on the later tbRefund), so only a genuinely missing ref logs "LEAKED DEBIT". Uses warn (no warnThrottled on this stack) and keeps the existing retry_for: 20. Co-Authored-By: Claude Opus 4.8

withdraw-lock: refuse external sends when /locks/.locked is present

2026-06-17T14:47:47Z

Port of master 9142b4db. Out-of-band emergency stop: nobal.sh (or a human) creates a sentinel file on the host, bind-mounted at /locks in the container; debit() checks for the file on every external send and refuses with "External withdrawals temporarily disabled". /locks/ALL.locked is a global override. Lives outside the db so a db-write vector can't disable it. Internal sends are exempt. Co-Authored-By: Claude Opus 4.8

payments: freeze matches uid as well as username (rename-proof)

2026-06-17T14:47:46Z

Port of master 43427afe. The blacklist (send freeze) only matched the current username, so a compromised account could shake the freeze by renaming itself. Match on either the lowercased username OR the immutable uid; add the uid to the blacklist set to freeze durably. Co-Authored-By: Claude Opus 4.8

payments: guard /replay double-credit race with SET NX idempotency

2026-06-17T14:47:45Z

Port of master ca28c19f to the staging stack. The getPayment() pre-check in the lightning listener/replay isn't atomic, so concurrent re-credits of the same settlement each ran the credit path. Claim each lightning/bolt12 settlement with an atomic SET NX on credited: (ref = preimage) and bail if already claimed. Guard sits before tbCredit and the pointer writes so a duplicate bails cleanly. Also disable the /replay route that triggered it. Co-Authored-By: Claude Opus 4.8

getAddressType: surface lq downtime as actionable error

2026-05-18T06:51:52Z

When lq.getAddressInfo throws on a connection error (ECONNREFUSED / ETIMEDOUT / "Unable to connect"), the generic catch was reporting "unrecognized address" — misleading for both users (who think their address is wrong) and operators (who can't tell user error from infrastructure problems in the logs). Map connection errors to a specific "liquid temporarily unavailable" message instead. Co-Authored-By: Claude Opus 4.7 (1M context)

mirror payment records to arc + atomic /confirm lock to prevent double-credits

2026-05-18T06:46:58Z

Apr 29 double-credit prevention, ported from master 0e368dab and adapted to staging's hono/tigerbeetle structure. Two parallel callers of /confirm (walletnotify, catchUp, bulk sweeps) could each read p.confirmed=false and each run tbConfirm — doubling the pending→balance transfer. tbConfirm itself isn't idempotent on its own, so the race materializes as a real double-credit even with TB. - routes/payments.ts: SET NX EX 60 lock around the confirmation block keyed by `confirmlock:${txid}:${vout}`. Concurrent callers short-circuit cleanly. Released on success and on every early-return. - lib/payments.ts credit() + routes/payments.ts /confirm: mirror payment + invoice records and the `payment::` / `payment:` pointer keys into arc as soon as they're written. gf() will then find the prior credit via arc fallback even if the main-db copy is wiped by a future data-loss event. Co-Authored-By: Claude Opus 4.7 (1M context)

sendLightning / sendKeysend: only reverse when CLN reports the payment failed

2026-05-18T06:38:53Z

The catch blocks for ln.xpay and ln.keysend reversed the user's debit whenever the RPC call threw, regardless of the actual payment state in CLN. If the RPC errored transiently while the payment was still pending, the user's balance got refunded — and then the lightning payment could still complete, leaving the user with both the refund and the outgoing sats. Both call sites now mirror the safe check() logic: const failed = !pays.length || pays.every((p) => p.status === "failed"); if (completed) finalize ... else if (failed) reverse ... // else (pending) leave the debit; check() reconciles when CLN settles. If listpays itself errors, log via warn() and skip the reverse — the debit stays in the pending set and check() will retry. Co-Authored-By: Claude Opus 4.7 (1M context)

feat: blocked address protection, LNURL proxy, replay timestamps

2026-03-28T06:58:56Z

- Add lib/changeid.ts for in-process account rekeying - Block sends to addresses in redis blocked_addresses set, auto-rekey on attempt - Add created param to credit() for accurate replay timestamps - Add paid_at to replay() for correct payment dates - Add /lnurl/proxy endpoint for server-side LNURL callback fetching Co-Authored-By: Claude Opus 4.6 (1M context)

verify ark amounts

2026-03-22T15:41:12Z