cameri / nostream / 43325203152

78%

Build Type

push

github

Committed by web-flow

Commit Message

fix(payments): do not downgrade a pubkey whose dearer plan is still running (#1092)

## Description
Anyone can pay an invoice for any pubkey (`POST /invoices` takes the
pubkey and a plan, and a Lightning payment carries no proof of who
paid). `applyPayment` switched the pubkey to the paid plan at once, so
someone could buy the cheapest plan for another pubkey and take away the
dearer plan the pubkey had paid for: its rate limits and retention would
change immediately, and the purge would then delete events its own plan
keeps.

While a period of a dearer plan is running, a payment for a cheaper plan
now leaves the plan alone and credits the money to it: the running
period is extended by the share of one of its periods the payment covers
(a payment of a fifth of the price adds a fifth of the interval), with
the grace of the plan the pubkey has. Nothing the pubkey has paid for is
shortened or taken away.

Unchanged: paying for the plan the pubkey has, paying for a dearer plan
(it takes effect as before), and paying after the running period has
ended or when the pubkey has no running paid plan. `confirmInvoice`
passes the plan the pubkey has and the amount paid (converted to msats),
so the credit follows what was paid.

## Related Issue
Closes #1017

## Motivation and Context
#1017 is an automated finding, not a confirmed exploit, but the path it
describes is real: the pubkey and plan are public inputs and
`confirmInvoice` replaced the plan. I read it as a payment changing a
plan the payer has no right to change, and fixed it without a schema
change by making a payment unable to lower an existing running plan,
rather than requiring the beneficiary to authenticate (the other fix the
issue suggests), which would need an auth step in the invoice flow.

Known limits, left out on purpose: a pubkey admitted before plans
existed (the never-ending `grandfathered` plan) is still moved onto a
paid plan by a payment, and someone who really wants a cheaper plan has
t... (continued)

Coverage Stats

4905 of 6918 branches covered (70.9%)

Branch coverage included in aggregate %.

6 of 6 new or added lines in 1 file covered. (100.0%)

5 existing lines in 2 files now uncovered.

10681 of 13158 relevant lines covered (81.17%)

707.26 hits per line