aboutsummaryrefslogtreecommitdiffstats
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* move UTXO lockUnspent from build() to sendOnchain()Adam Soltys2026-05-171-10/+9
| | | | | | | | | | | | | | build() is called from both /payments (the actual send path) and /fee (the fee-estimation endpoint). Locking UTXOs in build() meant that every fee quote was reserving inputs that never got broadcast, slowly leaking UTXO locks until a bitcoind restart cleared them — eventually starving the wallet of selectable inputs even when balance was healthy. The lock belongs at the point where we're actually about to broadcast, which is sendOnchain. Released in the catch path on broadcast failure; on success, the inputs become spent and the lock is moot. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* mirror payment records to arc + atomic /confirm lock to prevent double-creditsAdam Soltys2026-05-171-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | Follows up the Apr 29 double-credit incident. Two parallel callers of /confirm (walletnotify, catchUp, bulk sweeps) could each read p.confirmed=false and each run the multi() that increments balance — because main-db pointers were sometimes missing while arc still had them, gf()'s arc fallback returned stale state. Three pieces here: - routes/payments.ts: SET NX EX 60 lock around the /confirm credit block keyed by `confirmlock:${txid}:${vout}`. Concurrent callers short-circuit cleanly. The lock is released on success and on every early-return. - lib/payments.ts credit() + routes/payments.ts /confirm: mirror the payment/invoice records and the `payment:<txid>:<vout>` / `payment:<hash>` pointer keys into arc as soon as they're written. gf() will then find the prior credit via arc fallback even if the main-db copy is wiped by a future data-loss event. - routes/payments.ts hide `revertedDuplicate` payments from the user's payment list — matches the same filter added to lib/nwc.ts list_transactions so reverted records never surface in either rendering path. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* nwc: handle stale client state cleanly and skip reverted-duplicate recordsAdam Soltys2026-05-171-1/+5
| | | | | | | | | | | | | | | | | | Three small NWC robustness fixes that surfaced from the Apr 29 double-credit cleanup: - fail loudly when an NWC request references a pubkey whose user record no longer exists (migrated/deleted account); previously crashed inside handle() on `user.id` - swallow `pubkey not found` and `user not found` in the per-event catch so deleted-app/migrated-user spam doesn't fill the error log — these are client-side staleness, not server faults - use gf() instead of g() when fetching payment records (consistent with the rest of the codebase: arc fallback for wiped main-db pointers) - filter `revertedDuplicate` payments out of list_transactions so clients never see the doubled records that were later reverted Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* serialize limit check + reservation under per-asset mutexAdam Soltys2026-05-171-26/+81
| | | | | | | | | | | | | | | | | | | The previous check at debit() read ${type}:limit, compared amount, and deferred any decrement to the next freezeCheck tick (every 10s). That made the check non-atomic: a burst of concurrent withdrawals could each pass the same stale limit value before any reconciliation happened. Combined with the /gateway abuse, this allowed the hot wallet to be drained. withLimitLock() serializes the check + db.decrBy inside a per-type async mutex, and freezeCheck also takes the lock when overwriting limits so its 10s reconciliation can't race in-flight checks. Single-process only; distributed lock or TigerBeetle reservation needed if app ever scales out. Trade-off: decremented limits are not refunded on payment failure — they get reset by the next freezeCheck within 10s. Acceptable false-deny window in exchange for correctness against bursts. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* prevent duplicate utxo selectionAdam Soltys2026-04-261-1/+17
|
* check listpays before reversingAdam Soltys2026-04-251-3/+12
|
* remove nwc fieldAdam Soltys2026-04-011-1/+0
|
* nwc heartbeatAdam Soltys2026-03-292-14/+28
|
* lnurl proxyAdam Soltys2026-03-273-1/+133
|
* ensure lightning payments get processedAdam Soltys2026-03-191-0/+9
|
* listener logsAdam Soltys2026-03-181-1/+1
|
* stop republishing primal eventsAdam Soltys2026-03-182-3/+14
|
* remove logsAdam Soltys2026-03-177-13/+3
|
* catch reverse errorsAdam Soltys2026-03-171-2/+2
|
* adjust ln minfeeregtest-dataAdam Soltys2026-03-155-19/+13
|
* pass bytes for app secretAdam Soltys2026-03-141-1/+1
|
* use bytes for nostr toolsAdam Soltys2026-03-131-4/+4
|
* fix pending payment cleanup and login password verificationAdam Soltys2026-03-061-0/+4
| | | | | | | Skip non-lightning entries in pending payments check and handle malformed password hashes gracefully during login. Co-Authored-By: Claude Opus 4.6 <[email protected]>
* handle socket errorsAdam Soltys2026-02-252-16/+58
|
* health checkAdam Soltys2026-02-065-112/+256
|
* consult archive for older paymentsAdam Soltys2026-01-302-6/+10
|
* relay reconnect logicAdam Soltys2026-01-302-31/+48
|
* purge old nwc eventsAdam Soltys2026-01-281-2/+12
|
* ip fallbackAdam Soltys2026-01-271-0/+5
|
* loggingAdam Soltys2026-01-261-0/+1
|
* read payments from archiveAdam Soltys2026-01-222-5/+42
|
* quiet nwc failuresAdam Soltys2026-01-211-8/+8
|
* loggingAdam Soltys2026-01-212-10/+8
|
* check usernameAdam Soltys2026-01-191-0/+1
|
* blacklist changeAdam Soltys2025-12-161-1/+1
|
* more robust lightning clientAdam Soltys2025-12-161-3/+85
|
* lintAdam Soltys2025-12-161-10/+10
|
* Merge pull request #82 from ericpp/catch-failed-keysendAdam Soltys2025-12-041-11/+12
|\ | | | | Catch failed keysend payments
| * Catch failed keysend paymentsEric P2025-11-091-11/+12
| |
* | Merge pull request #81 from ericpp/fix-keysend-extratlvsAdam Soltys2025-12-041-1/+11
|\ \ | | | | | | Fix incorrect extratlvs format in pay_keysend
| * | Fix incorrect extratlvs format in pay_keysendEric P2025-11-091-1/+11
| |/
* / fee adjustmentAdam Soltys2025-11-261-6/+3
|/
* rm logAdam Soltys2025-10-011-3/+0
|
* rotate server keyAdam Soltys2025-09-293-10/+46
|
* catch errors in pay_invoiceAdam Soltys2025-09-291-19/+23
|
* fix bolt12 issueAdam Soltys2025-09-201-5/+3
|
* fix bolt12 invoicesAdam Soltys2025-09-191-1/+1
|
* sendinvoice supportAdam Soltys2025-09-183-15/+26
|
* default account idAdam Soltys2025-09-101-5/+4
|
* check for syncSquareAdam Soltys2025-09-082-2/+2
|
* square paymentsAdam Soltys2025-09-082-16/+16
|
* wipAdam Soltys2025-09-062-232/+43
|
* create external paymentsquareAdam Soltys2025-09-041-1/+0
|
* support readonly tokensAdam Soltys2025-09-041-3/+11
|
* wipAdam Soltys2025-08-261-0/+249
|
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-19 23:34:01 +0000