fix pending payment cleanup and login password verification

Skip non-lightning entries in pending payments check and handle
malformed password hashes gracefully during login.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

1 files changed, 7 insertions, 1 deletions

diff --git a/routes/users.ts b/routes/users.ts
index 88c77846..f1f6a302 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -400,7 +400,13 @@ export default {
       let user = await getUser(username);
 
       if (!isAdmin) {
-        if (!user || !user.password || !(await Bun.password.verify(password, user.password))) {
+        let verified = false;
+        try {
+          if (user?.password)
+            verified = await Bun.password.verify(password, user.password);
+        } catch (e) {}
+
+        if (!user || !verified) {
           await db.incrBy(ipFailKey, 1);
           if (Number(await db.ttl(ipFailKey)) < 0) await db.expire(ipFailKey, 600);
           await db.incrBy(fk, 1);