From 136ba2a12e87178f6d83fba2874abf4c9ad32915 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Tue, 17 Mar 2026 01:21:48 -0700
Subject: fix: add account ownership checks and harden PIN validation

- Validate account ownership (aid) before allowing ark send/sync/vault
  operations and in debit/sendOnchain as defense-in-depth
- Harden PIN check to reject missing/empty pin when user has one set

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 routes/payments.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'routes')

diff --git a/routes/payments.ts b/routes/payments.ts
index a41d187c..4648716f 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -1,7 +1,7 @@
 import config from "$config";
 import api from "$lib/api";
 import { getArkAddress, sendArk, verifyArkVtxo } from "$lib/ark";
-import { requirePin } from "$lib/auth";
+import { requireAccountOwnership, requirePin } from "$lib/auth";
 import { archive, db, g, gf, gfAll, s } from "$lib/db";
 import { getTx } from "$lib/esplora";
 import { generate } from "$lib/invoices";
@@ -854,6 +854,7 @@ export default {
 
     try {
       await requirePin({ body, user });
+      await requireAccountOwnership(db, user.id, aid);
 
       l("ark send", user.username, address, amount);
       const tmpHash = v4();
@@ -915,6 +916,7 @@ export default {
       const body = await c.req.json();
       const user = c.get("user");
       const { hash, amount, aid } = body;
+      await requireAccountOwnership(db, user.id, aid);
       const { rate, currency } = await getUserRate(user);
 
       const p = await createArkPayment({
@@ -938,6 +940,7 @@ export default {
       const body = await c.req.json();
       const user = c.get("user");
       const { amount, hash, aid } = body;
+      await requireAccountOwnership(db, user.id, aid);
 
       if (amount <= 0) fail("Invalid amount");
       await acquireArkLock(hash);
@@ -1021,7 +1024,8 @@ export default {
       const body = await c.req.json();
       const { transactions = [], aid } = body;
       const { id: uid } = user;
-      // verbose arkSync logging removed to reduce noise
+
+      await requireAccountOwnership(db, uid, aid);
 
       const lockKey = `arksynclock:${aid}`;
       const gotLock = await db.set(lockKey, "1", { NX: true, EX: 30 });
-- 
cgit v1.2.3