From 6e61d1b7597e362021f31b1453e33e2f5bd07bdf Mon Sep 17 00:00:00 2001
From: saubyk <39208279+saubyk@users.noreply.github.com>
Date: Sun, 19 Jul 2026 16:44:37 -0700
Subject: [PATCH] Address review: coerce timeout_seconds to a positive finite
 number

The transport timeout added for the sendPayment race was derived from
req.body.timeout_seconds, which was only guarded by "|| 600": a
non-numeric value became NaN, which axios treats as no timeout,
silently dropping the transport ceiling for this endpoint.

timeout_seconds is now coerced to a positive finite number (falling
back to 600), which also normalizes the value sent to LND. Large
values are intentionally not capped: the transport bound must stay
above LND's own timeout_seconds bound or the race the margin fixes
would return.

Verified on the fixture: a payment sent with timeout_seconds "abc"
falls back to 600 and completes; the write suite re-passes.
---
 backend/controllers/lnd/payments.js | 2 +-
 server/controllers/lnd/payments.ts  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/controllers/lnd/payments.js b/backend/controllers/lnd/payments.js
index 672a5363..acf7ce58 100644
--- a/backend/controllers/lnd/payments.js
+++ b/backend/controllers/lnd/payments.js
@@ -111,7 +111,7 @@ export const sendPayment = (req, res, next) => {
         req.body.last_hop_pubkey = Buffer.from(req.body.last_hop_pubkey, 'hex').toString('base64');
     }
     req.body.amp = req.body.amp ?? false;
-    req.body.timeout_seconds = req.body.timeout_seconds || 600;
+    req.body.timeout_seconds = (Number.isFinite(+req.body.timeout_seconds) && +req.body.timeout_seconds > 0) ? +req.body.timeout_seconds : 600;
     options.form = JSON.stringify(req.body);
     logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Payments', msg: 'Send Payment Options', data: options.form });
     // LND ends the stream at timeout_seconds with a FAILURE_REASON_TIMEOUT result;
diff --git a/server/controllers/lnd/payments.ts b/server/controllers/lnd/payments.ts
index 1fa1642b..11e104ac 100644
--- a/server/controllers/lnd/payments.ts
+++ b/server/controllers/lnd/payments.ts
@@ -109,7 +109,7 @@ export const sendPayment = (req, res, next) => {
     req.body.last_hop_pubkey = Buffer.from(req.body.last_hop_pubkey, 'hex').toString('base64');
   }
   req.body.amp = req.body.amp ?? false;
-  req.body.timeout_seconds = req.body.timeout_seconds || 600;
+  req.body.timeout_seconds = (Number.isFinite(+req.body.timeout_seconds) && +req.body.timeout_seconds > 0) ? +req.body.timeout_seconds : 600;
   options.form = JSON.stringify(req.body);
   logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Payments', msg: 'Send Payment Options', data: options.form });
   // LND ends the stream at timeout_seconds with a FAILURE_REASON_TIMEOUT result;