payments: use the debited tip when crediting internal transfers

credit() now credits the tip the sender was actually debited (passed in
by the internal-transfer callers) instead of independently re-reading the
invoice. This closes a time-of-check/time-of-use gap where an invoice's
tip could be changed between the sender debit and the receiver credit,
letting a payer be credited a tip they were never charged.

External receipts (lightning/ecash) keep reading the invoice tip, since
there is no paired coinos debit to diverge from.

Also harden POST /invoice/:id: validate the tip is a sane non-negative
integer and reject tip changes on an already-settled invoice.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2 files changed, 15 insertions, 4 deletions

diff --git a/routes/invoices.ts b/routes/invoices.ts
index 0cb73687..61cf203b 100644
--- a/routes/invoices.ts
+++ b/routes/invoices.ts
@@ -49,12 +49,23 @@ export default {
       const { body } = req;
       const { tip, webhook, secret } = body.invoice;
 
-      if (tip < 0) fail("Invalid tip");
-
       let invoice = await gf(`invoice:${id}`);
+      if (!invoice) fail("invoice not found");
       const user = await g(`user:${invoice.uid}`);
 
-      if (typeof tip !== "undefined") invoice.tip = tip;
+      if (typeof tip !== "undefined") {
+        const t = Number.parseInt(tip);
+        if (!Number.isSafeInteger(t) || t < 0 || t > 2_100_000_000_000_000)
+          fail("Invalid tip");
+        // Defense-in-depth: never change the tip once the invoice is paid/
+        // settled. The primary mint guard is on the credit side (it uses the
+        // tip the sender was actually debited); this stops post-settlement
+        // tampering. The endpoint stays open by design — payers set tips on
+        // merchants' invoices before paying — so we do NOT require ownership.
+        if (invoice.received > 0 || invoice.settled)
+          fail("Invoice already settled");
+        invoice.tip = t;
+      }
 
       if (webhook && secret) {
         if (invoice.uid !== req.user?.id) fail("Unauthorized");
diff --git a/routes/payments.ts b/routes/payments.ts
index 7dc45058..9c62d2bb 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -641,7 +641,7 @@ export default {
       let p;
       if (payee === id) {
         p = await debit({ hash: pr, amount, memo, user });
-        await credit({ hash: pr, amount, memo, ref: user.id });
+        await credit({ hash: pr, amount, memo, ref: user.id, tip: p.tip });
       } else p = await sendLightning({ user, pr, amount, fee, memo });
 
       res.send(p);