aboutsummaryrefslogtreecommitdiffstats
path: root/routes/payments.ts
Commit message (Collapse)AuthorAgeFilesLines
* mirror payment records to arc + atomic /confirm lock to prevent double-creditsAdam Soltys2026-05-171-3/+27
| | | | | | | | | | | | | | | | | | | | | | | | Follows up the Apr 29 double-credit incident. Two parallel callers of /confirm (walletnotify, catchUp, bulk sweeps) could each read p.confirmed=false and each run the multi() that increments balance — because main-db pointers were sometimes missing while arc still had them, gf()'s arc fallback returned stale state. Three pieces here: - routes/payments.ts: SET NX EX 60 lock around the /confirm credit block keyed by `confirmlock:${txid}:${vout}`. Concurrent callers short-circuit cleanly. The lock is released on success and on every early-return. - lib/payments.ts credit() + routes/payments.ts /confirm: mirror the payment/invoice records and the `payment:<txid>:<vout>` / `payment:<hash>` pointer keys into arc as soon as they're written. gf() will then find the prior credit via arc fallback even if the main-db copy is wiped by a future data-loss event. - routes/payments.ts hide `revertedDuplicate` payments from the user's payment list — matches the same filter added to lib/nwc.ts list_transactions so reverted records never surface in either rendering path. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* remove /gateway endpointAdam Soltys2026-05-171-9/+0
| | | | | | | | | Unauthenticated arbitrary db.set abuse vector. Exploited to inflate user balances and override safety controls (bitcoin:limit, limit, hardfreeze, freeze) in real time, leading to a hot-wallet drain. Route and handler both fully removed. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* don't remove missing paymentsAdam Soltys2026-03-241-2/+1
|
* remove logsAdam Soltys2026-03-171-5/+0
|
* fix addmanagersAdam Soltys2026-02-101-5/+4
|
* filter null managersAdam Soltys2026-02-101-2/+2
|
* consult archive for older paymentsAdam Soltys2026-01-301-2/+3
|
* read payments from archiveAdam Soltys2026-01-221-5/+18
|
* check usernameAdam Soltys2026-01-191-1/+1
|
* get lnaddress fee from bodyAdam Soltys2025-11-171-1/+2
|
* remove default feeAdam Soltys2025-11-161-2/+2
|
* don't credit dustAdam Soltys2025-09-291-0/+1
|
* sendinvoice supportAdam Soltys2025-09-181-0/+29
|
* received flag for paymentsAdam Soltys2025-09-131-10/+10
|
* check for existenceAdam Soltys2025-08-101-2/+2
|
* authorizationsAdam Soltys2025-08-101-5/+25
|
* authorization claimed flagAdam Soltys2025-08-081-2/+3
|
* display fund userAdam Soltys2025-07-291-0/+1
|
* fund authorizationsAdam Soltys2025-07-251-36/+47
|
* authorizationsAdam Soltys2025-07-251-36/+45
|
* delete managerAdam Soltys2025-07-181-3/+29
|
* check account ownershipAdam Soltys2025-07-121-1/+23
|
* user helper for fund usersAdam Soltys2025-05-301-1/+1
|
* remove logAdam Soltys2025-05-121-1/+0
|
* debit signatureAdam Soltys2025-05-121-1/+2
|
* fix platform feesAdam Soltys2025-04-161-2/+2
|
* per-type feesAdam Soltys2025-04-161-4/+1
|
* fund routesAdam Soltys2025-03-151-14/+55
|
* account checkAdam Soltys2025-03-131-0/+3
|
* don't require 2fa for nostrloginAdam Soltys2025-03-111-2/+0
|
* check for debit failuresAdam Soltys2025-03-101-5/+15
|
* payment typesAdam Soltys2025-02-261-6/+7
|
* nwc refactorAdam Soltys2025-02-121-2/+3
|
* log login failuresAdam Soltys2025-02-041-4/+1
|
* notes and stuffAdam Soltys2025-01-211-0/+1
|
* return public fields onlyAdam Soltys2025-01-191-2/+3
|
* send zaps for internal paymentsAdam Soltys2025-01-171-4/+10
|
* allow mint self-paymentsAdam Soltys2025-01-171-3/+2
|
* set lnurlw min withdrawal to 1 satAdam Soltys2024-12-301-1/+1
|
* lnurlwAdam Soltys2024-12-241-12/+16
|
* check limitAdam Soltys2024-12-111-1/+1
|
* remove limitAdam Soltys2024-12-091-1/+1
|
* keysendAdam Soltys2024-12-021-5/+5
|
* set last time for paymentsAdam Soltys2024-11-281-3/+4
|
* min fee 5 satsAdam Soltys2024-11-191-1/+2
|
* handle blank offersAdam Soltys2024-11-171-3/+4
|
* parse offersAdam Soltys2024-11-161-2/+16
|
* decode endpointAdam Soltys2024-11-151-0/+5
|
* biome lintAdam Soltys2024-10-311-1/+1
|
* detect internal paymentsAdam Soltys2024-10-311-1/+9
|
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-23 03:50:40 +0000