From 41018c30a2e03f5ab05be64d419542be0cff7943 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 4 Oct 2026 13:38:24 -0700 Subject: Evicted accounts can't receive or log in; limit errors say what's happening An evicted account no longer gets lightning-address invoices (stops a scam page's address from minting new ones) or a login token. A send over the server limit now says withdrawals are temporarily limited instead of a generic "Problem sending payment" that read as a frozen account. (Already live since the 2026-10-01 restart.) Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_011bvzKaZosXGHkigcGcSzAR --- routes/users.ts | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'routes/users.ts') diff --git a/routes/users.ts b/routes/users.ts index 431425b4..347b7dd4 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -482,6 +482,11 @@ export default { } } + // Evicted accounts can't use a token anyway (see lib/auth.ts), so don't + // mint one — checked after the password so it can't be used to probe. + if (!isAdmin && (await db.sIsMember("evicted", user.id))) + return res.code(403).send("account disabled"); + if (username !== "coinos") l("logged in", username, req.headers["cf-connecting-ip"]); -- cgit v1.2.3