From 89b6313a5bec27a3247e1cbf9b38aab724ea923a Mon Sep 17 00:00:00 2001
From: saubyk <39208279+saubyk@users.noreply.github.com>
Date: Sun, 19 Jul 2026 16:22:11 -0700
Subject: [PATCH] Address review: avoid the sendPayment timeout race, keep
 paymentLookup bounded

sendPayment's timeout_seconds defaults to 600, equal to the wrapper's
600 s transport bound, so the transport timer (started first) would
win the race and surface ECONNABORTED instead of LND's clean
FAILURE_REASON_* result. The call now passes timeout_seconds plus a
60 s margin as the per-call transport timeout, so LND's mapped failure
always arrives first while the transport stays bounded for the actual
hang case (and a user-supplied timeout_seconds scales the bound with
it).

paymentLookup (/v2/router/track) deliberately keeps the 10-minute
default: it holds a browser-facing response open while tracking, and
payments in flight longer than that are delivered by the websocket
subscription path instead. Documented at the call site.

Verified on the fixture: a routed payment with an explicit
timeout_seconds succeeds; an unroutable payment returns LND's mapped
failure reason (Insufficient Balance - no ECONNABORTED, no transport
timeout message); paymentLookup returns the final state of a settled
payment. Both API suites re-pass.
---
 backend/controllers/lnd/payments.js | 8 +++++++-
 server/controllers/lnd/payments.ts  | 8 +++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/backend/controllers/lnd/payments.js b/backend/controllers/lnd/payments.js
index 03343b90..672a5363 100644
--- a/backend/controllers/lnd/payments.js
+++ b/backend/controllers/lnd/payments.js
@@ -89,6 +89,9 @@ export const paymentLookup = (req, res, next) => {
         return res.status(options.statusCode).json({ message: options.message, error: options.error });
     }
     options.url = req.session.selectedNode.settings.lnServerUrl + '/v2/router/track/' + req.params.paymentHash;
+    // Deliberately keep the wrapper's default timeout here: this holds a
+    // browser-facing response open while tracking, and payments in flight
+    // longer than that are delivered via the websocket subscription instead.
     request(options).then((body) => {
         logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Payment Information Received for ' + req.params.paymentHash, data: body });
         res.status(200).json(body.result || body);
@@ -111,7 +114,10 @@ export const sendPayment = (req, res, next) => {
     req.body.timeout_seconds = req.body.timeout_seconds || 600;
     options.form = JSON.stringify(req.body);
     logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Payments', msg: 'Send Payment Options', data: options.form });
-    request.post(options).then((body) => {
+    // LND ends the stream at timeout_seconds with a FAILURE_REASON_TIMEOUT result;
+    // give the transport a margin over that so LND's mapped failure always wins
+    // the race against the wrapper's own timeout.
+    request.post({ ...options, timeout: (+req.body.timeout_seconds + 60) * 1000 }).then((body) => {
         const results = body.split('\n').filter(Boolean).map((jsonString) => JSON.parse(jsonString));
         body = results.length > 0 ? results[results.length - 1] : { result: { status: 'UNKNOWN' } };
         if (body.result.status === 'FAILED') {
diff --git a/server/controllers/lnd/payments.ts b/server/controllers/lnd/payments.ts
index c736f7c3..1fa1642b 100644
--- a/server/controllers/lnd/payments.ts
+++ b/server/controllers/lnd/payments.ts
@@ -88,6 +88,9 @@ export const paymentLookup = (req, res, next) => {
   options = common.getOptions(req);
   if (options.error) { return res.status(options.statusCode).json({ message: options.message, error: options.error }); }
   options.url = req.session.selectedNode.settings.lnServerUrl + '/v2/router/track/' + req.params.paymentHash;
+  // Deliberately keep the wrapper's default timeout here: this holds a
+  // browser-facing response open while tracking, and payments in flight
+  // longer than that are delivered via the websocket subscription instead.
   request(options).then((body) => {
     logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Payments', msg: 'Payment Information Received for ' + req.params.paymentHash, data: body });
     res.status(200).json(body.result || body);
@@ -109,7 +112,10 @@ export const sendPayment = (req, res, next) => {
   req.body.timeout_seconds = req.body.timeout_seconds || 600;
   options.form = JSON.stringify(req.body);
   logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Payments', msg: 'Send Payment Options', data: options.form });
-  request.post(options).then((body) => {
+  // LND ends the stream at timeout_seconds with a FAILURE_REASON_TIMEOUT result;
+  // give the transport a margin over that so LND's mapped failure always wins
+  // the race against the wrapper's own timeout.
+  request.post({ ...options, timeout: (+req.body.timeout_seconds + 60) * 1000 }).then((body) => {
     const results = body.split('\n').filter(Boolean).map((jsonString) => JSON.parse(jsonString));
     body = results.length > 0 ? results[results.length - 1] : { result: { status: 'UNKNOWN' } };
     if (body.result.status === 'FAILED') {