From 8fbc6ea19c9f4959799f3d72b32e2b8661596ea8 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Mon, 2 Nov 2026 12:54:10 -0700 Subject: payments: credit each on-chain output once and require uuid invoice ids Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VMan6VN9xvnX1cgvV6hrUV --- lib/invoices.ts | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'lib/invoices.ts') diff --git a/lib/invoices.ts b/lib/invoices.ts index 0028dc91..835b1247 100644 --- a/lib/invoices.ts +++ b/lib/invoices.ts @@ -91,6 +91,15 @@ export const generate = async ({ invoice, user }) => { if (!id) id = v4(); else { + // An internal invoice's id becomes its hash, and credit() writes + // `payment:`. A free-form id like ":" therefore lets a + // payer overwrite an on-chain deposit's dedup pointer, so ids must be the + // uuids we hand out. + if ( + typeof id !== "string" || + !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id) + ) + fail("invoice not found"); // A caller-supplied id re-uses an existing record (tip/webhook update, // repeated bolt12 offer create). It must be the caller's own: the write // below replaces `invoice:` wholesale with uid = this user, and the -- cgit v1.2.3