coinos-server.git/lib/app.ts, branch master

Remove response logger

2026-10-08T19:03:38Z

Co-Authored-By: Claude Opus 5.5

app: don't trust client IP headers on onion requests

2026-09-25T22:15:19Z

The tor container connects directly, bypassing Cloudflare, so the client could set cf-connecting-ip, x-forwarded-for and rate-limit-by to anything. Pin those requests to the tor container's address before the rate limiter runs. Co-Authored-By: Claude Opus 5.5 (1M context)

security: drop the admin endpoint surface and land pending hardening

2026-09-14T03:44:48Z

Removes the admin-gated endpoints and the account flags they set, plus a batch of hardening that had accumulated uncommitted in the tree. These were deployed and verified together, so they land as one change. admin surface: - drop POST /hidepay, POST /unlimit and GET /users, their handlers, and the now-unused admin preValidation export - `unlimited` was only ever written, never read; `hidepay` only appeared in output projections. Both flags go, along with their whitelist, public-fields and type entries. request log: - redactBody now recurses. It only masked top-level keys, so a body that nests credentials one level down wrote them to the log in plaintext, and pin fields were not on the list at all. payments: - sendOnchain/build gate `aid` through requireAccount, so a caller can only spend from an account it owns - sendOnchain signs only a tx we composed, matched against a short-lived per-account build receipt - raise xpay retry_for to 60s; route-finding preferred a drained zero-fee hop and burned the whole budget on it. check()'s reversal window keeps its 2x margin. ecash / invoices / webhooks: - resolve a token's mint through the IP-pinning fetcher instead of plain fetch, closing an unauthenticated SSRF path into the internal network - reject non-positive amounts before the balance write - /sign requires the caller to own the address, rather than signing under any address the hot wallet controls - webhook delivery no longer disables TLS verification; the body carries the merchant's shared secret registration: - refuse a username the v3 registrar holds unless the caller's own nostr key is the holder (lib/names.ts) liquid: - honour the deposit kill switch at invoice generation and at credit elements image: - pin 23.3.4 and verify the release tarball checksum Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0112TGi9GGNWqji1XQ5jZRzc

deps: upgrade fastify v4 to v5 line to fix dependabot alerts

2026-08-22T15:43:53Z

Fastify 4.x is EOL with no backported fixes; all six open alerts (critical http-proxy header stripping, static path traversal + auth bypass, fastify body-validation bypass / host spoofing / DoS) are only patched on the v5 line. Bump fastify to 5.12.0 and all @fastify/* plugins to their v5-compatible majors, and migrate the two options v5 deprecated (disableRequestLogging -> logController, maxParamLength -> routerOptions). Co-Authored-By: Claude Fable 5

log: redact secret and otpsecret from request bodies

2026-08-22T15:08:13Z

Extend the request-log redaction set beyond password/confirm so NWC connection secrets and TOTP seeds never reach the req/res logs. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01XiwgmQKwKnRxUmVDd4xSf7

logging: redact auth headers; set cookie flags on session token (S5)

2026-08-08T06:29:25Z

The request logger persisted full req.headers to the "req" log, including the Authorization bearer token and the token cookie — both non-expiring JWTs, so log-read access became account takeover. Redact the authorization and cookie headers. Also set httpOnly/secure/sameSite on the token cookie so it isn't readable by injected JS or sent over plaintext HTTP. (Revocation is already handled by the evicted set.) Co-Authored-By: Claude Opus 4.8

logging: redact password fields from the request log

2026-07-11T05:56:12Z

The preHandler request logger wrote the full request body, which included plaintext passwords on auth requests. Redact password/confirm fields before logging. Co-Authored-By: Claude Opus 4.8 (1M context)

adjust ln minfee

2026-03-15T22:49:17Z

ip fallback

2026-01-27T17:41:34Z

logging

2026-01-26T16:41:08Z