fix pending payment cleanup and login password verification

Skip non-lightning entries in pending payments check and handle
malformed password hashes gracefully during login.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

1 files changed, 7 insertions, 5 deletions

diff --git a/routes/users.ts b/routes/users.ts
index ef2ee449..9820f504 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -405,11 +405,13 @@ export default {
       let user = await getUser(username);
 
       if (!isAdmin) {
-        if (
-          !user ||
-          !user.password ||
-          !(await Bun.password.verify(password, user.password))
-        ) {
+        let verified = false;
+        try {
+          if (user?.password)
+            verified = await Bun.password.verify(password, user.password);
+        } catch (e) {}
+
+        if (!user || !verified) {
           await db.incrBy(ipFailKey, 1);
           if ((await db.ttl(ipFailKey)) < 0) await db.expire(ipFailKey, 600);
           await db.incrBy(fk, 1);