Fix TypeError if autowithdrawal creation failed (#1072)

dependabot reported vuln with CVSS score of 8.8

lib/cln.js

@@ -1,10 +1,10 @@
 import fetch from 'node-fetch'
 import https from 'https'
+import crypto from 'crypto'
 
 export const createInvoice = async ({ socket, rune, cert, label, description, msats, expiry }) => {
   const agent = cert ? new https.Agent({ ca: Buffer.from(cert, 'base64') }) : undefined
   const url = 'https://' + socket + '/v1/invoice'
-  const randomId = Math.floor(Math.random() * 1000)
   const res = await fetch(url, {
     method: 'POST',
     headers: {
@@ -16,8 +16,9 @@ export const createInvoice = async ({ socket, rune, cert, label, description, ms
     },
     agent,
     body: JSON.stringify({
-      // why does CLN require a unique label?
-      label: description ? `${description} ${randomId}` : randomId,
+      // CLN requires a unique label for every invoice
+      // see https://docs.corelightning.org/reference/lightning-invoice
+      label: crypto.randomBytes(16).toString('hex'),
       description,
       amount_msat: msats,
       expiry

package-lock.json

@@ -51,7 +51,7 @@
         "next-auth": "^4.23.2",
         "next-plausible": "^3.11.1",
         "next-seo": "^6.1.0",
-        "node-fetch": "^2.6.1",
+        "node-fetch": "^2.6.7",
         "node-s3-url-encode": "^0.0.4",
         "nodemailer": "^6.9.6",
         "nostr": "^0.2.8",
@@ -14738,11 +14738,22 @@
       "integrity": "sha512-Ntyt4AIXyaLIuMHF6IOoTakB3K+RWxwtsHNRxllEoA6vPwP9o4866g6YWDLUdnucilZhmkxiHwHr11gAENw+QA=="
     },
     "node_modules/node-fetch": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz",
-      "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==",
+      "version": "2.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
+      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
       "engines": {
         "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
       }
     },
     "node_modules/node-gyp-build": {

package.json

@@ -56,7 +56,7 @@
     "next-auth": "^4.23.2",
     "next-plausible": "^3.11.1",
     "next-seo": "^6.1.0",
-    "node-fetch": "^2.6.1",
+    "node-fetch": "^2.6.7",
     "node-s3-url-encode": "^0.0.4",
     "nodemailer": "^6.9.6",
     "nostr": "^0.2.8",

worker/autowithdraw.js

@@ -87,7 +87,7 @@ export async function autoWithdraw ({ data: { id }, models, lnd }) {
           : wallet.type === 'CLN' ? 'walletCLN' : 'walletLightningAddress',
         level: 'ERROR',
         message: 'autowithdrawal failed: ' + details
-      })
+      }, { me: user, models })
     }
   }