Allow cancel of own invoices without hmac (#1787)

api/resolvers/wallet.js

@@ -134,11 +134,13 @@ export async function getWithdrawl (parent, { id }, { me, models, lnd }) {
 }
 
 export function createHmac (hash) {
+  if (!hash) throw new GqlInputError('hash required to create hmac')
   const key = Buffer.from(process.env.INVOICE_HMAC_KEY, 'hex')
   return crypto.createHmac('sha256', key).update(Buffer.from(hash, 'hex')).digest('hex')
 }
 
 export function verifyHmac (hash, hmac) {
+  if (!hash || !hmac) throw new GqlInputError('hash or hmac missing')
   const hmac2 = createHmac(hash)
   if (!timingSafeEqual(Buffer.from(hmac), Buffer.from(hmac2))) {
     throw new GqlAuthorizationError('bad hmac')
@@ -487,8 +489,15 @@ const resolvers = {
     },
     createWithdrawl: createWithdrawal,
     sendToLnAddr,
-    cancelInvoice: async (parent, { hash, hmac }, { models, lnd, boss }) => {
-      verifyHmac(hash, hmac)
+    cancelInvoice: async (parent, { hash, hmac }, { me, models, lnd, boss }) => {
+      // stackers can cancel their own invoices without hmac
+      if (me && !hmac) {
+        const inv = await models.invoice.findUnique({ where: { hash } })
+        if (!inv) throw new GqlInputError('invoice not found')
+        if (inv.userId !== me.id) throw new GqlInputError('not ur invoice')
+      } else {
+        verifyHmac(hash, hmac)
+      }
       await finalizeHodlInvoice({ data: { hash }, lnd, models, boss })
       return await models.invoice.findFirst({ where: { hash } })
     },

api/typeDefs/wallet.js

@@ -78,7 +78,7 @@ const typeDefs = `
     createInvoice(amount: Int!): InvoiceOrDirect!
     createWithdrawl(invoice: String!, maxFee: Int!): Withdrawl!
     sendToLnAddr(addr: String!, amount: Int!, maxFee: Int!, comment: String, identifier: Boolean, name: String, email: String): Withdrawl!
-    cancelInvoice(hash: String!, hmac: String!): Invoice!
+    cancelInvoice(hash: String!, hmac: String): Invoice!
     dropBolt11(hash: String!): Boolean
     removeWallet(id: ID!): Boolean
     deleteWalletLogs(wallet: String): Boolean

components/use-invoice.js

@@ -37,10 +37,6 @@ export default function useInvoice () {
   }, [client])
 
   const cancel = useCallback(async ({ hash, hmac }) => {
-    if (!hash || !hmac) {
-      throw new Error('missing hash or hmac')
-    }
-
     console.log('canceling invoice:', hash)
     const { data } = await cancelInvoice({ variables: { hash, hmac } })
     return data.cancelInvoice

fragments/wallet.js

@@ -225,7 +225,7 @@ export const SET_WALLET_PRIORITY = gql`
 
 export const CANCEL_INVOICE = gql`
   ${INVOICE_FIELDS}
-  mutation cancelInvoice($hash: String!, $hmac: String!) {
+  mutation cancelInvoice($hash: String!, $hmac: String) {
     cancelInvoice(hash: $hash, hmac: $hmac) {
       ...InvoiceFields
     }