fix: add account ownership checks and harden PIN validation

- Validate account ownership (aid) before allowing ark send/sync/vault
  operations and in debit/sendOnchain as defense-in-depth
- Harden PIN check to reject missing/empty pin when user has one set

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

3 files changed, 22 insertions, 3 deletions

diff --git a/lib/auth.ts b/lib/auth.ts
index 30d5438b..c8d5afab 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -49,5 +49,12 @@ export const admin = async (c, next) => {
 };
 
 export const requirePin = async ({ body, user }) => {
-  if (!user || (user.pin && user.pin !== body.pin)) fail("Invalid pin");
+  if (!user) fail("Invalid pin");
+  if (user.pin && (!body?.pin || user.pin !== body.pin)) fail("Invalid pin");
+};
+
+export const requireAccountOwnership = async (db, uid, aid) => {
+  if (!aid || aid === uid) return;
+  const index = await db.lPos(`${uid}:accounts`, aid);
+  if (index === null) fail("unauthorized");
 };
diff --git a/lib/payments.ts b/lib/payments.ts
index 2737f886..78f20684 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -152,6 +152,12 @@ export const debit = async ({
 }) => {
   amount = Number.parseInt(amount);
 
+  // Defense-in-depth: verify account ownership at the debit level
+  if (aid && user && aid !== user.id) {
+    const index = await db.lPos(`${user.id}:accounts`, aid);
+    if (index === null) fail("unauthorized");
+  }
+
   const whitelisted = await db.sIsMember("whitelist", user?.username?.toLowerCase().trim());
 
   const blacklisted = await db.sIsMember("blacklist", user?.username?.toLowerCase().trim());
@@ -715,6 +721,8 @@ export const sendOnchain = async (params) => {
 
   // Non-custodial bitcoin account — use esplora
   if (aid !== user.id) {
+    const index = await db.lPos(`${user.id}:accounts`, aid);
+    if (index === null) fail("unauthorized");
     return sendNonCustodial(params);
   }
 
diff --git a/routes/payments.ts b/routes/payments.ts
index a41d187c..4648716f 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -1,7 +1,7 @@
 import config from "$config";
 import api from "$lib/api";
 import { getArkAddress, sendArk, verifyArkVtxo } from "$lib/ark";
-import { requirePin } from "$lib/auth";
+import { requireAccountOwnership, requirePin } from "$lib/auth";
 import { archive, db, g, gf, gfAll, s } from "$lib/db";
 import { getTx } from "$lib/esplora";
 import { generate } from "$lib/invoices";
@@ -854,6 +854,7 @@ export default {
 
     try {
       await requirePin({ body, user });
+      await requireAccountOwnership(db, user.id, aid);
 
       l("ark send", user.username, address, amount);
       const tmpHash = v4();
@@ -915,6 +916,7 @@ export default {
       const body = await c.req.json();
       const user = c.get("user");
       const { hash, amount, aid } = body;
+      await requireAccountOwnership(db, user.id, aid);
       const { rate, currency } = await getUserRate(user);
 
       const p = await createArkPayment({
@@ -938,6 +940,7 @@ export default {
       const body = await c.req.json();
       const user = c.get("user");
       const { amount, hash, aid } = body;
+      await requireAccountOwnership(db, user.id, aid);
 
       if (amount <= 0) fail("Invalid amount");
       await acquireArkLock(hash);
@@ -1021,7 +1024,8 @@ export default {
       const body = await c.req.json();
       const { transactions = [], aid } = body;
       const { id: uid } = user;
-      // verbose arkSync logging removed to reduce noise
+
+      await requireAccountOwnership(db, uid, aid);
 
       const lockKey = `arksynclock:${aid}`;
       const gotLock = await db.set(lockKey, "1", { NX: true, EX: 30 });