From 5f21055178875821007aec25f32ef4168b24cbbc Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Wed, 16 Sep 2026 05:36:43 -0700 Subject: lnurl: expire payRequest callback ids after seven days A callback id is read once, minutes after the metadata request, and never again, but the pointer keys were written without an expiry and had grown to roughly 45% of all keys in the main database. Let the set helper take a TTL and apply one to both lnurl pointer keys. Co-Authored-By: Claude Fable 5.1 --- routes/lnurl.ts | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'routes') diff --git a/routes/lnurl.ts b/routes/lnurl.ts index 1b3f84c1..a1ee22e5 100644 --- a/routes/lnurl.ts +++ b/routes/lnurl.ts @@ -10,6 +10,11 @@ import { v4 } from "uuid"; import { PaymentType } from "$lib/types"; +// A payRequest callback id is fetched once, minutes after the metadata +// request, and never again; without an expiry these one-shot pointers were +// ~45% of all keys in the main db. +const LNURL_TTL = 7 * 24 * 60 * 60; + const { URL } = process.env; const host = URL.split("/").at(-1); const fiveMinutes = 1000 * 60 * 5; @@ -124,7 +129,7 @@ export default { ]); const id = v4(); - await s(`lnurl:${id}`, uid); + await s(`lnurl:${id}`, uid, LNURL_TTL); res.send({ allowsNostr: true, @@ -283,8 +288,8 @@ export default { const total = (parseInt(invoice.amount || 0) + parseInt(invoice.tip || 0)) * 1000; - await s(`lnurl:${id}`, uid); - if (total > 0) await s(`lnurl:${id}:invoice`, invoice.id); + await s(`lnurl:${id}`, uid, LNURL_TTL); + if (total > 0) await s(`lnurl:${id}:invoice`, invoice.id, LNURL_TTL); res.send({ allowsNostr: true, -- cgit v1.2.3