fix(lightning): resolve Lightning Addresses case-insensitively (211 users still 404ing) - #533
Merged
Merged
Conversation
The route matched profiles with .eq('username', username.toLowerCase()), a
case-sensitive comparison against a column that stores the original case. Any
mixed-case username therefore 404'd with "Unknown user" in BOTH case forms —
including its own — no matter whether the wallet had a pay link. 211 of 687
wallet holders have a mixed-case username and all of them advertise an address.
Match case-insensitively instead. ilike is only a prefilter (wildcards escaped);
the strict lowercase comparison in JS is what decides the match, so an over-broad
pattern can never resolve to the wrong person. Three usernames differ only by
case, so prefer an exact-case match and then the candidate that actually has a
wallet, which disambiguates all three.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan46 finding(s) HIGH/CRITICAL: 2 | MEDIUM: 25 | LOW: 19
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #532. That PR was squash-merged before this commit was pushed, so master has the wallet/pay-link fix but not this one, and 211 users are still broken in production right now:
The bug
/.well-known/lnurlp/<username>matched profiles with:That is a case-sensitive equality against a column that stores the username in its original case. So a profile stored as
Riot_SecOpscan never be found —/Riot_SecOpslowercases the input toriot_secopsand misses, and/riot_secopsmisses too. Every mixed-case username 404sUnknown userin both case forms, regardless of whether its wallet has a pay link.211 of 687 wallet holders have a mixed-case username, and all 211 advertise an
ln_address. The #532 backfill gave them working pay links — this is the only thing still standing between them and receiving payments.The fix
Match case-insensitively.
ilikeis used only as a prefilter and its wildcards are escaped; the authoritative check is a stricttoLowerCase()comparison in JS, so an over-broad pattern can never resolve to the wrong payee. This matters here because usernames contain_, which is a single-character wildcard in SQLLIKE.Three usernames collide case-insensitively —
AgentHansaHelper/agenthansahelper,AidenLy/aidenly,Vault9000/vault9000. In each pair exactly one profile has a wallet, so the lookup prefers an exact-case match and then the candidate that actually has a wallet, which disambiguates all three.Verification
npx tsc --noEmitclean,eslintclean.davidanup,aks_escrow,weruh,sunsonai,ratamaha,jonyd,voltron_agent,vianerds_scoutworkshop— all HTTP 200, each with its own distinct callback).Riot_SecOpsand the other 210 should return 200 rather thanUnknown user.🤖 Generated with Claude Code