5 files changed, 92 insertions, 6 deletions
diff --git a/lib/sync.js b/lib/sync.js
index 40f3f56f..ba8d0a48 100644
--- a/lib/sync.js
+++ b/lib/sync.js
@@ -269,5 +269,5 @@ const sync = async () => {
   }
 };
 
-// setTimeout(sync, 5000);
-// setInterval(sync, 720000);
+setTimeout(sync, 5000);
+setInterval(sync, 720000);
diff --git a/routes/assets.js b/routes/assets.js
index cf9aca4e..62c018e4 100644
--- a/routes/assets.js
+++ b/routes/assets.js
@@ -174,6 +174,7 @@ app.post(
             model: db.User,
             as: "user"
           },
+          order: [["balance", "DESC"]],
           transaction
         });
 
diff --git a/routes/bitcoin/receive.js b/routes/bitcoin/receive.js
index 5d8e21e7..e74f9394 100644
--- a/routes/bitcoin/receive.js
+++ b/routes/bitcoin/receive.js
@@ -68,6 +68,15 @@ zmqRawTx.on("message", async (topic, message, sequence) => {
 
           if (!invoice) return;
 
+          let payment = await db.Payment.findOne({
+            where: {
+              invoice_id: invoice.id
+            },
+            order: [["id", "DESC"]],
+          });
+
+          if (payment) return;
+
           const currency = invoice ? invoice.currency : user.currency;
           const rate = invoice ? invoice.rate : app.get("rates")[user.currency];
           const tip = invoice ? invoice.tip : 0;
@@ -104,7 +113,7 @@ zmqRawTx.on("message", async (topic, message, sequence) => {
           }
           let fee = totalInputs - totalOutputs;
 
-          let payment = await db.Payment.create({
+          payment = await db.Payment.create({
             account_id: account.id,
             user_id: user.id,
             hash,
diff --git a/routes/liquid/receive.js b/routes/liquid/receive.js
index 626cb21a..92942ce4 100644
--- a/routes/liquid/receive.js
+++ b/routes/liquid/receive.js
@@ -104,15 +104,29 @@ zmqRawTx.on("message", async (topic, message, sequence) => {
 
             let invoice = await db.Invoice.findOne({
               where: {
-                unconfidential: address,
+                [Op.or]: {
+                  unconfidential: address,
+                  address
+                },
                 user_id: user.id,
                 network: "liquid"
               },
-              order: [["id", "DESC"]]
+              order: [["id", "DESC"]],
+              transaction
             });
 
             if (!invoice) return;
 
+            let payment = await db.Payment.findOne({
+              where: {
+                invoice_id: invoice.id,
+              },
+              order: [["id", "DESC"]],
+              transaction
+            });
+
+            if (payment) return;
+
             let confirmed = 0;
 
             let account = await db.Account.findOne({
@@ -156,7 +170,7 @@ zmqRawTx.on("message", async (topic, message, sequence) => {
             const tip = invoice ? invoice.tip : 0;
             const memo = invoice ? invoice.memo : "";
 
-            let payment = await db.Payment.create(
+            payment = await db.Payment.create(
               {
                 account_id: account.id,
                 user_id: user.id,
diff --git a/routes/users.js b/routes/users.js
index df42d82d..6ff515fc 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -303,6 +303,68 @@ app.post(
 );
 
 app.post(
+  "/login",
+  ah(async (req, res) => {
+    try {
+      const { params, sig, key } = req.body;
+
+      if (sig) {
+        const { callback } = params;
+
+        try {
+          const url = `${callback}&sig=${sig}&key=${key}`;
+          const response = await axios.get(url);
+          res.send(response.data);
+        } catch (e) {
+          l.error("problem calling lnurl login", e.message);
+          res.status(500).send(e.message);
+        }
+
+        return;
+      }
+
+      let twofa = req.body.token;
+
+      let user = await getUser(req.body.username);
+
+      if (
+        !user ||
+        (user.password &&
+          !(await bcrypt.compare(req.body.password, user.password)))
+      ) {
+        l.warn("invalid username or password attempt", req.body.username);
+        return res.status(401).end();
+      }
+
+      if (
+        user.twofa &&
+        (typeof twofa === "undefined" ||
+          !authenticator.check(twofa, user.otpsecret))
+      ) {
+        return res.status(401).send("2fa required");
+      }
+
+      l.info(
+        "login",
+        req.body.username,
+        req.headers["x-forwarded-for"] || req.connection.remoteAddress
+      );
+
+      let payload = { username: user.username };
+      let token = jwt.sign(payload, config.jwt);
+      res.cookie("token", token, { expires: new Date(Date.now() + 432000000) });
+      user.accounts = await user.getAccounts();
+      user.keys = await user.getKeys();
+      user = pick(user, ...whitelist);
+      res.send({ user, token });
+    } catch (e) {
+      l.error("login error", e.message);
+      res.status(401).end();
+    }
+  })
+);
+
+app.post(
   "/taboggan",
   ah(async (req, res) => {
     try {