fix pending payment cleanup and login password verification

Skip non-lightning entries in pending payments check and handle
malformed password hashes gracefully during login.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

2 files changed, 11 insertions, 1 deletions

diff --git a/lib/payments.ts b/lib/payments.ts
index d0c43235..255774ee 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -1557,6 +1557,10 @@ export const check = async () => {
     const payments = await db.sMembers("pending");
 
     for (const pr of payments) {
+      if (!pr.startsWith("ln")) {
+        await db.sRem("pending", pr);
+        continue;
+      }
       const p = await getPayment(pr);
       if (!p || Date.now() - p.created < 10000) continue;
       const { pays } = await ln.listpays(pr);
diff --git a/routes/users.ts b/routes/users.ts
index 88c77846..f1f6a302 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -400,7 +400,13 @@ export default {
       let user = await getUser(username);
 
       if (!isAdmin) {
-        if (!user || !user.password || !(await Bun.password.verify(password, user.password))) {
+        let verified = false;
+        try {
+          if (user?.password)
+            verified = await Bun.password.verify(password, user.password);
+        } catch (e) {}
+
+        if (!user || !verified) {
           await db.incrBy(ipFailKey, 1);
           if (Number(await db.ttl(ipFailKey)) < 0) await db.expire(ipFailKey, 600);
           await db.incrBy(fk, 1);