routerrpc: reject payment to invoice that don't have payment secret or blinded paths

Ensure that a payment is only sent if the invoice includes either a
payment address (payment secret) or at least one blinded path.

Author: erickcestari

lnrpc/routerrpc/router_backend.go

@@ -985,6 +985,14 @@ func (r *RouterBackend) extractIntentFromSendRequest(
 			return nil, err
 		}
 
+		// An invoice must include either a payment address or
+		// blinded paths.
+		if payReq.PaymentAddr.IsNone() &&
+			len(payReq.BlindedPaymentPaths) == 0 {
+			return nil, errors.New("payment request must contain " +
+				"either a payment address or blinded paths")
+		}
+
 		// If the amount was not included in the invoice, then we let
 		// the payer specify the amount of satoshis they wish to send.
 		// We override the amount to pay with the amount provided from
@@ -1001,7 +1009,7 @@ func (r *RouterBackend) extractIntentFromSendRequest(
 			if reqAmt != 0 {
 				return nil, errors.New("amount must not be " +
 					"specified when paying a non-zero " +
-					" amount invoice")
+					"amount invoice")
 			}
 
 			payIntent.Amount = *payReq.MilliSat

lnrpc/routerrpc/router_backend_test.go

@@ -497,11 +497,18 @@ type extractIntentTestCase struct {
 func TestExtractIntentFromSendRequest(t *testing.T) {
 	const paymentAmount = btcutil.Amount(300_000)
 
-	const paymentReq = "lnbcrt500u1pnh0xflpp56w08q26t896vg2e9mtdkrem320tp" +
-		"wws9z9sfr7dw86dx97d90u4sdqqcqzzsxqyz5vqsp5z9945kvfy5g9afmakz" +
-		"yrur2t4hhn2tr87un8j0r0e6l5m5zm0fus9qxpqysgqk98c6j7qefdpdmzt4" +
-		"g6aykds4ydvf2x9lpngqcfux3hv8qlraan9v3s9296r5w5eh959yzadgh5ck" +
-		"gjydgyfxdpumxtuk3p3caugmlqpz5necs"
+	const paymentReq = "lnbcrt500u1pnh0xflpp56w08q26t896vg2e9mtdkr" +
+		"em320tpwws9z9sfr7dw86dx97d90u4sdqqcqzzsxqyz5vqsp5z9945kvfy5g" +
+		"9afmakzyrur2t4hhn2tr87un8j0r0e6l5m5zm0fus9qxpqysgqk98c6j7qef" +
+		"dpdmzt4g6aykds4ydvf2x9lpngqcfux3hv8qlraan9v3s9296r5w5eh959yz" +
+		"adgh5ckgjydgyfxdpumxtuk3p3caugmlqpz5necs"
+
+	const paymentReqMissingAddr = "lnbcrt100p1p70xwfzpp5qqqsyqcyq5rqwzqfq" +
+		"qqsyqcyq5rqwzqfqqqsyqcyq5rqwzqfqypqdpl2pkx2ctnv5sxxmmwwd5kge" +
+		"tjypeh2ursdae8g6twvus8g6rfwvs8qun0dfjkxaqnp4q0n326hr8v9zprg8" +
+		"gsvezcch06gfaqqhde2aj730yg0durunfhv669qypqqqz3uu8wnr7883qzxr" +
+		"566nuhled49fx6e6q0jn06w6gpgyznwzxwf8xdmye87kpx0y8lqtcgwywsau" +
+		"0jkm66evelkw7cggwlegp4anv3cq62wusm"
 
 	destNodeBytes, err := hex.DecodeString(destKey)
 	require.NoError(t, err)
@@ -714,6 +721,23 @@ func TestExtractIntentFromSendRequest(t *testing.T) {
 			valid:            false,
 			expectedErrorMsg: "invoice expired.",
 		},
+		{
+			name: "Invoice missing payment address",
+			backend: &RouterBackend{
+				ShouldSetExpEndorsement: func() bool {
+					return false
+				},
+				ActiveNetParams:  &chaincfg.RegressionNetParams,
+				MaxTotalTimelock: 1000,
+			},
+			sendReq: &SendPaymentRequest{
+				PaymentRequest: paymentReqMissingAddr,
+				CltvLimit:      22,
+			},
+			valid: false,
+			expectedErrorMsg: "payment request must contain " +
+				"either a payment address or blinded paths",
+		},
 		{
 			name: "Invalid dest vertex length",
 			backend: &RouterBackend{