fix(voucher): validate pending status in onchain payments

apps/voucher/app/api/lnurlw/callback/[id]/route.ts

@@ -1,7 +1,11 @@
 import { NextRequest } from "next/server"
 
-import { lockVoucherK1 } from "@/services/lock"
-import { getWithdrawLinkByK1Query, updateWithdrawLinkStatus } from "@/services/db"
+import { lockVoucherSecret } from "@/services/lock"
+import {
+  getWithdrawLinkByK1Query,
+  updateWithdrawLinkStatus,
+  WithdrawLink,
+} from "@/services/db"
 import { createMemo, getWalletDetails, decodeInvoice } from "@/utils/helpers"
 import { PaymentSendResult, Status } from "@/lib/graphql/generated"
 import { escrowApolloClient } from "@/services/galoy/client/escrow"
@@ -33,7 +37,26 @@ export async function GET(request: NextRequest, { params }: { params: { id: stri
   if (usdWallet instanceof Error || !usdWallet)
     return Response.json({ status: "ERROR", reason: "Internal Server Error" })
 
-  const result = await lockVoucherK1(k1, async () => {
+  let withdrawLink: WithdrawLink | undefined | Error
+  try {
+    withdrawLink = await getWithdrawLinkByK1Query({ k1 })
+  } catch (error) {
+    console.error("error paying lnurlw", error)
+    return Response.json({ status: "ERROR", reason: "Internal Server Error" })
+  }
+
+  if (!withdrawLink) {
+    return Response.json({ status: "ERROR", reason: "Withdraw link not found" })
+  }
+
+  if (withdrawLink instanceof Error) {
+    return Response.json({ status: "ERROR", reason: "Internal Server Error" })
+  }
+
+  if (withdrawLink.id !== id)
+    return Response.json({ error: "Invalid Request", status: 400 })
+
+  const result = await lockVoucherSecret(withdrawLink.voucherSecret, async () => {
     try {
       const withdrawLink = await getWithdrawLinkByK1Query({ k1 })
 

apps/voucher/graphql/resolvers/mutation/redeem-withdraw-link-on-chain.ts

@@ -41,40 +41,44 @@ export const redeemWithdrawLinkOnChain = async (
   if (!escrowUsdWallet || !escrowUsdWallet.id) return new Error("Internal Server Error")
 
   return lockVoucherSecret(voucherSecret, async () => {
-    const getWithdrawLinkBySecretResponse = await getWithdrawLinkBySecret({
+    const withdrawLink = await getWithdrawLinkBySecret({
       voucherSecret,
     })
-    if (getWithdrawLinkBySecretResponse instanceof Error)
-      return getWithdrawLinkBySecretResponse
+    if (withdrawLink instanceof Error) return withdrawLink
 
-    if (!getWithdrawLinkBySecretResponse) {
+    if (!withdrawLink) {
       return new Error("Withdraw link not found")
     }
 
-    if (getWithdrawLinkBySecretResponse.status === Status.Paid) {
+    if (withdrawLink.status === Status.Pending) {
+      return new Error(
+        "Withdrawal link is in pending state. Please contact support if the error persists.",
+      )
+    }
+
+    if (withdrawLink.status === Status.Paid) {
       return new Error("Withdraw link claimed")
     }
 
     const onChainUsdTxFeeResponse = await onChainUsdTxFee({
       client: escrowClient,
       input: {
         address: onChainAddress,
-        amount: getWithdrawLinkBySecretResponse.voucherAmountInCents,
+        amount: withdrawLink.voucherAmountInCents,
         walletId: escrowUsdWallet?.id,
         speed: PayoutSpeed.Fast,
       },
     })
 
     if (onChainUsdTxFeeResponse instanceof Error) return onChainUsdTxFeeResponse
     const totalAmountToBePaid =
-      getWithdrawLinkBySecretResponse.voucherAmountInCents -
-      onChainUsdTxFeeResponse.onChainUsdTxFee.amount
+      withdrawLink.voucherAmountInCents - onChainUsdTxFeeResponse.onChainUsdTxFee.amount
 
     if (totalAmountToBePaid <= 0)
       return new Error("This Voucher Cannot Withdraw On Chain amount is less than fees")
 
     const response = await updateWithdrawLinkStatus({
-      id: getWithdrawLinkBySecretResponse.id,
+      id: withdrawLink.id,
       status: Status.Paid,
     })
 
@@ -86,9 +90,9 @@ export const redeemWithdrawLinkOnChain = async (
         address: onChainAddress,
         amount: totalAmountToBePaid,
         memo: createMemo({
-          voucherAmountInCents: getWithdrawLinkBySecretResponse.voucherAmountInCents,
-          commissionPercentage: getWithdrawLinkBySecretResponse.commissionPercentage,
-          identifierCode: getWithdrawLinkBySecretResponse.identifierCode,
+          voucherAmountInCents: withdrawLink.voucherAmountInCents,
+          commissionPercentage: withdrawLink.commissionPercentage,
+          identifierCode: withdrawLink.identifierCode,
         }),
         speed: PayoutSpeed.Fast,
         walletId: escrowUsdWallet?.id,
@@ -97,15 +101,15 @@ export const redeemWithdrawLinkOnChain = async (
 
     if (onChainUsdPaymentSendResponse instanceof Error) {
       await updateWithdrawLinkStatus({
-        id: getWithdrawLinkBySecretResponse.id,
+        id: withdrawLink.id,
         status: Status.Active,
       })
       return onChainUsdPaymentSendResponse
     }
 
     if (onChainUsdPaymentSendResponse.onChainUsdPaymentSend.errors.length > 0) {
       await updateWithdrawLinkStatus({
-        id: getWithdrawLinkBySecretResponse.id,
+        id: withdrawLink.id,
         status: Status.Active,
       })
       return new Error(
@@ -118,7 +122,7 @@ export const redeemWithdrawLinkOnChain = async (
       PaymentSendResult.Success
     ) {
       await updateWithdrawLinkStatus({
-        id: getWithdrawLinkBySecretResponse.id,
+        id: withdrawLink.id,
         status: Status.Active,
       })
       return new Error(

apps/voucher/services/db/index.ts

@@ -5,7 +5,7 @@ import { knex } from "./knex"
 import { generateCode, generateRandomHash } from "@/utils/helpers"
 import { Status } from "@/lib/graphql/generated"
 
-type WithdrawLink = {
+export type WithdrawLink = {
   id: string
   userId: string
   identifierCode: string

core/api/src/servers/exporter.ts

@@ -332,7 +332,7 @@ const getWalletBalance = async (walletId: WalletId): Promise<number> => {
       }
       return walletBalance
     } catch (err) {
-      logger.warn({ err }, `Could not get wallet balace for id: ${walletId}.`)
+      logger.warn({ err }, `Could not get wallet balance for id: ${walletId}.`)
       return 0
     } finally {
       inProgressBalanceQueries.delete(inProgressKey)

core/notifications/src/notification_event/price_changed.rs

@@ -40,7 +40,7 @@ pub struct PriceChanged {
 
 impl PriceChanged {
     const NOTIFICATION_THRESHOLD: ChangePercentage = ChangePercentage(5.0);
-    #[allow(deprecated)] // recommndation is try_days but Option.unwrap() is not yet const fn
+    #[allow(deprecated)] // recommendation is try_days but Option.unwrap() is not yet const fn
     const COOL_OFF_PERIOD: chrono::Duration = chrono::Duration::days(2);
 
     pub fn should_notify(&self, last_trigger: Option<chrono::DateTime<chrono::Utc>>) -> bool {

flake.nix

@@ -176,7 +176,7 @@
             cp -rpv build/$name-$system/app/* "$out/"
 
             # Need to escape this shell variable which should not be
-            # iterpreted in Nix as a variable nor a shell variable when run
+            # interpreted in Nix as a variable nor a shell variable when run
             # but rather a literal string which happens to be a shell
             # variable. Nuclear arms race of quoting and escaping special
             # characters to make this work...