payments: lowercase payreq before looking up our own invoices

An uppercase bolt11 for a coinos invoice missed the getInvoice lookup, so
it was paid over lightning to our own node instead of internally. The
listener then saw the sender's payment pointer for that bolt11 and skipped
crediting the recipient. Normalize in POST /payments and nwc pay_invoice.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 5 insertions, 0 deletions

diff --git a/routes/payments.ts b/routes/payments.ts
index 67243a12..66fd3386 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -66,6 +66,11 @@ export default {
       if (payreq != null && typeof payreq !== "string")
         fail("Invalid payment request");
       if (hash != null && typeof hash !== "string") fail("Invalid invoice");
+      // Invoices are keyed lowercase. An uppercase payreq (QR-scanned) missed
+      // the lookup below and was paid over cl to ourselves instead of
+      // internally; the listener then found the sender's payment:<bolt11>
+      // pointer and skipped crediting the recipient.
+      if (payreq) payreq = payreq.replace(/\s/g, "").toLowerCase();
 
       if (typeof amount !== "undefined") {
         amount = Number.parseInt(amount);