From dfd31ad83d24e780523f4e76d04a76aba1fa8be1 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sun, 17 May 2026 23:46:58 -0700
Subject: mirror payment records to arc + atomic /confirm lock to prevent
 double-credits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apr 29 double-credit prevention, ported from master 0e368dab and adapted
to staging's hono/tigerbeetle structure. Two parallel callers of /confirm
(walletnotify, catchUp, bulk sweeps) could each read p.confirmed=false
and each run tbConfirm — doubling the pending→balance transfer.
tbConfirm itself isn't idempotent on its own, so the race materializes
as a real double-credit even with TB.

- routes/payments.ts: SET NX EX 60 lock around the confirmation block
  keyed by `confirmlock:${txid}:${vout}`. Concurrent callers short-circuit
  cleanly. Released on success and on every early-return.

- lib/payments.ts credit() + routes/payments.ts /confirm: mirror payment
  + invoice records and the `payment:<txid>:<vout>` / `payment:<hash>`
  pointer keys into arc as soon as they're written. gf() will then find
  the prior credit via arc fallback even if the main-db copy is wiped
  by a future data-loss event.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 lib/payments.ts | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/payments.ts b/lib/payments.ts
index 8b1d6366..5984a813 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -1,7 +1,7 @@
 import config from "$config";
 import api from "$lib/api";
 import changeid from "$lib/changeid";
-import { db, g, gf, s } from "$lib/db";
+import { db, g, gf, s, sa } from "$lib/db";
 import {
   broadcastTx,
   btcNetwork,
@@ -356,8 +356,13 @@ export const credit = async ({
     p.confirmed = false;
     balanceKey = "pending";
     await s(`payment:${txid}:${vout}`, id);
+    // Mirror the txid:vout pointer into arc so future bulk /confirm sweeps find
+    // the prior credit via gf() fallback and don't double-credit even if the
+    // main-db pointer is wiped by a data-loss event.
+    await sa(`payment:${txid}:${vout}`, id);
   } else {
     await s(`payment:${hash}`, id);
+    await sa(`payment:${hash}`, id);
   }
 
   let creditType = type;
@@ -374,6 +379,10 @@ export const credit = async ({
     .set(`${aid || uid}:payments:last`, p.created)
     .exec();
 
+  // Mirror the payment + invoice records into arc for the same protection.
+  await sa(`payment:${p.id}`, p);
+  await sa(`invoice:${inv.id}`, inv);
+
   if (inv.items?.length) {
     formatReceipt(inv.items, inv.currency);
     p.items = inv.items;
-- 
cgit v1.2.3