aboutsummaryrefslogtreecommitdiffstats
path: root/routes
Commit message (Collapse)AuthorAgeFilesLines
* mirror payment records to arc + atomic /confirm lock to prevent double-creditsAdam Soltys2026-05-171-3/+27
| | | | | | | | | | | | | | | | | | | | | | | | Follows up the Apr 29 double-credit incident. Two parallel callers of /confirm (walletnotify, catchUp, bulk sweeps) could each read p.confirmed=false and each run the multi() that increments balance — because main-db pointers were sometimes missing while arc still had them, gf()'s arc fallback returned stale state. Three pieces here: - routes/payments.ts: SET NX EX 60 lock around the /confirm credit block keyed by `confirmlock:${txid}:${vout}`. Concurrent callers short-circuit cleanly. The lock is released on success and on every early-return. - lib/payments.ts credit() + routes/payments.ts /confirm: mirror the payment/invoice records and the `payment:<txid>:<vout>` / `payment:<hash>` pointer keys into arc as soon as they're written. gf() will then find the prior credit via arc fallback even if the main-db copy is wiped by a future data-loss event. - routes/payments.ts hide `revertedDuplicate` payments from the user's payment list — matches the same filter added to lib/nwc.ts list_transactions so reverted records never surface in either rendering path. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* remove /gateway endpointAdam Soltys2026-05-171-9/+0
| | | | | | | | | Unauthenticated arbitrary db.set abuse vector. Exploited to inflate user balances and override safety controls (bitcoin:limit, limit, hardfreeze, freeze) in real time, leading to a hot-wallet drain. Route and handler both fully removed. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* lnurl proxyAdam Soltys2026-03-271-0/+12
|
* don't remove missing paymentsAdam Soltys2026-03-241-2/+1
|
* listener logsAdam Soltys2026-03-181-2/+1
|
* remove logsAdam Soltys2026-03-176-33/+3
|
* adjust ln minfeeregtest-dataAdam Soltys2026-03-151-6/+0
|
* pass bytes for app secretAdam Soltys2026-03-141-1/+2
|
* use bytes for nostr toolsAdam Soltys2026-03-131-0/+1
|
* fix pending payment cleanup and login password verificationAdam Soltys2026-03-061-5/+7
| | | | | | | Skip non-lightning entries in pending payments check and handle malformed password hashes gracefully during login. Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix login/reset glitchesAdam Soltys2026-03-031-7/+18
|
* fix lnurl description_hash mismatchAdam Soltys2026-02-251-2/+6
| | | | Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix addmanagersAdam Soltys2026-02-101-5/+4
|
* filter null managersAdam Soltys2026-02-101-2/+2
|
* check forwarded host headerAdam Soltys2026-02-061-1/+1
|
* health checkAdam Soltys2026-02-062-45/+13
|
* whitelist ua'sAdam Soltys2026-02-041-0/+11
|
* strip email from usernameAdam Soltys2026-02-021-0/+1
|
* consult archive for older paymentsAdam Soltys2026-01-303-6/+7
|
* check usernameAdam Soltys2026-01-291-11/+1
|
* skip captcha for torAdam Soltys2026-01-271-0/+4
|
* case insensitive usernamesAdam Soltys2026-01-261-1/+4
|
* captcha bypass whitelistAdam Soltys2026-01-261-10/+13
|
* read payments from archiveAdam Soltys2026-01-222-11/+24
|
* fix admin resetsAdam Soltys2026-01-221-7/+3
|
* api key captcha bypassAdam Soltys2026-01-221-3/+11
|
* captcha thresholdsAdam Soltys2026-01-211-11/+18
|
* require auth for accountsAdam Soltys2026-01-211-0/+5
|
* recaptcha on loginAdam Soltys2026-01-211-2/+32
|
* loggingAdam Soltys2026-01-211-1/+3
|
* check usernameAdam Soltys2026-01-192-1/+2
|
* get lnaddress fee from bodyAdam Soltys2025-11-171-1/+2
|
* check app ownershipAdam Soltys2025-11-171-2/+5
|
* check usernameAdam Soltys2025-11-171-2/+5
|
* remove default feeAdam Soltys2025-11-161-2/+2
|
* don't return empty invoicesAdam Soltys2025-11-061-1/+3
|
* require challenge after login failuresAdam Soltys2025-10-101-7/+9
|
* fail fasterAdam Soltys2025-10-011-1/+1
|
* challenge verifyAdam Soltys2025-10-011-12/+4
|
* login challengeAdam Soltys2025-10-011-0/+11
|
* fix username change logicAdam Soltys2025-09-301-9/+9
|
* rotate server keyAdam Soltys2025-09-292-6/+6
|
* don't credit dustAdam Soltys2025-09-291-0/+1
|
* disable delete endpointAdam Soltys2025-09-241-1/+2
|
* fix existence checkAdam Soltys2025-09-231-1/+1
|
* fix invoice userAdam Soltys2025-09-201-2/+2
|
* remove verification on email changeAdam Soltys2025-09-181-0/+5
|
* fail if unauthorizedAdam Soltys2025-09-181-5/+8
|
* Merge branch 'patch-1'Adam Soltys2025-09-181-3/+10
|\
| * allow invoice owners to modify the webhookAdam Soltys2025-09-181-5/+10
| |
generated by cgit v1.2.3 (git 2.51.0) at 2026-11-12 05:01:53 +0000