From 4900ecb19ab9c6d279c8771b834fcb29e526a1e0 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Tue, 29 Sep 2026 08:37:39 -0700 Subject: logging: throttle log lines that clients can trigger at will Evicted-JWT replays, blocked sends from frozen or limited accounts and failed payment retries each logged one line per request, so a looping client could flood the log, and an evicted token replayed across a proxy pool made atk-autoban.sh block every IP it saw. Add quiet()/suppressed() in lib/logging.ts: the first occurrence per key logs as before, repeats within the window are counted and reported on the next line that gets through. The evicted-auth summary line is worded so the auto-banner ignores it. Co-Authored-By: Claude Fable 5.1 --- routes/payments.ts | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'routes') diff --git a/routes/payments.ts b/routes/payments.ts index 9bdcc2eb..67243a12 100644 --- a/routes/payments.ts +++ b/routes/payments.ts @@ -6,7 +6,7 @@ import { generate, getUserOffer } from "$lib/invoices"; import { replay } from "$lib/lightning"; import ln from "$lib/ln"; import { platformFee, quoteMax, quoteRoutingFee } from "$lib/lnquote"; -import { err, l, shortError, warn } from "$lib/logging"; +import { err, l, quiet, shortError, suppressed, warn } from "$lib/logging"; import mqtt from "$lib/mqtt"; import { build, @@ -105,8 +105,13 @@ export default { res.send(p); } catch (e) { - warn(user.username, "payment failed", amount, balance, hash, payreq); - err(shortError(e.message)); + // One line per account per 5 min: frozen/empty throwaway accounts retry + // failed sends in a loop and otherwise dominate the log. + const n = quiet(`payfail:${user.id}`, 5 * 60 * 1000); + if (n !== null) { + warn(user.username, "payment failed", amount, balance, hash, payreq, suppressed(n)); + err(shortError(e.message)); + } bail(res, e.message); } }, @@ -710,7 +715,9 @@ export default { res.send(p); } catch (e) { - warn(user.username, "payment failed", shortError(e.message)); + const n = quiet(`payfail:${user.id}`, 5 * 60 * 1000); + if (n !== null) + warn(user.username, "payment failed", shortError(e.message), suppressed(n)); res.code(500).send(e.message); } }, -- cgit v1.2.3