fix pending payment cleanup and login password verification

Skip non-lightning entries in pending payments check and handle
malformed password hashes gracefully during login.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

2 files changed, 11 insertions, 5 deletions

diff --git a/lib/payments.ts b/lib/payments.ts
index eed9b4c5..53b8dec1 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -778,6 +778,10 @@ export const check = async () => {
     const payments = await db.sMembers("pending");
 
     for (const pr of payments) {
+      if (!pr.startsWith("ln")) {
+        await db.sRem("pending", pr);
+        continue;
+      }
       const p = await getPayment(pr);
       if (!p || Date.now() - p.created < 10000) continue;
       const { pays } = await ln.listpays(pr);
diff --git a/routes/users.ts b/routes/users.ts
index ef2ee449..9820f504 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -405,11 +405,13 @@ export default {
       let user = await getUser(username);
 
       if (!isAdmin) {
-        if (
-          !user ||
-          !user.password ||
-          !(await Bun.password.verify(password, user.password))
-        ) {
+        let verified = false;
+        try {
+          if (user?.password)
+            verified = await Bun.password.verify(password, user.password);
+        } catch (e) {}
+
+        if (!user || !verified) {
           await db.incrBy(ipFailKey, 1);
           if ((await db.ttl(ipFailKey)) < 0) await db.expire(ipFailKey, 600);
           await db.incrBy(fk, 1);