coinos-server.git/lib/register.ts, branch master

users: reserve service names on registration and rename

2026-09-22T02:23:57Z

A username is also a lightning address, so a name that reads as the service collects payments meant for it. "mint" was registered days after the ecash redesign freed it and received payments addressed to mint@coinos.io; the reserved list held only "ecash", and was duplicated in two places. One shared list now, checked on both paths, covering the service-sounding names an account should never be able to take. Co-Authored-By: Claude Opus 5 (1M context)

security: drop the admin endpoint surface and land pending hardening

2026-09-14T03:44:48Z

Removes the admin-gated endpoints and the account flags they set, plus a batch of hardening that had accumulated uncommitted in the tree. These were deployed and verified together, so they land as one change. admin surface: - drop POST /hidepay, POST /unlimit and GET /users, their handlers, and the now-unused admin preValidation export - `unlimited` was only ever written, never read; `hidepay` only appeared in output projections. Both flags go, along with their whitelist, public-fields and type entries. request log: - redactBody now recurses. It only masked top-level keys, so a body that nests credentials one level down wrote them to the log in plaintext, and pin fields were not on the list at all. payments: - sendOnchain/build gate `aid` through requireAccount, so a caller can only spend from an account it owns - sendOnchain signs only a tx we composed, matched against a short-lived per-account build receipt - raise xpay retry_for to 60s; route-finding preferred a drained zero-fee hop and burned the whole budget on it. check()'s reversal window keeps its 2x margin. ecash / invoices / webhooks: - resolve a token's mint through the IP-pinning fetcher instead of plain fetch, closing an unauthenticated SSRF path into the internal network - reject non-positive amounts before the balance write - /sign requires the caller to own the address, rather than signing under any address the hot wallet controls - webhook delivery no longer disables TLS verification; the body carries the merchant's shared secret registration: - refuse a username the v3 registrar holds unless the caller's own nostr key is the holder (lib/names.ts) liquid: - honour the deposit kill switch at invoice generation and at credit elements image: - pin 23.3.4 and verify the release tarball checksum Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0112TGi9GGNWqji1XQ5jZRzc

auth: hash passwords at bcrypt cost 12 with transparent upgrade (S2)

2026-08-08T06:29:24Z

Registration, password change, and admin reset all hashed at bcrypt cost 4 (16 rounds, ~1,300 guesses/s/thread) — the single factor gating the custodial balance and the nip49 passphrase for the stored nostr key. Raise all three sites to cost 12, and on successful login re-hash any legacy cost-4 hash now that we hold the verified plaintext. Co-Authored-By: Claude Opus 4.8

analytics: monthly insight reports + signup instrumentation

2026-06-04T06:10:20Z

scripts/analytics.ts — streams live db (SCAN, never KEYS) and reports for a trailing window (default 30d): MAU/WAU, new users, custody total + top holders, network volume by type (lightning/liquid/bitcoin/internal/bolt12/ fund), most-active and highest-volume users, and bolt12 recipients with a "regular" flag for the Ocean mining-reward stream. scripts/analytics-geo.ts — top countries from the request log. Counts only /login + /register events tied to a username (raw cf-ipcountry volume is dominated by datacenter/nostr traffic). Surfaces a distinct-IP-per-country column so proxy/VPN egress is visible, and filters a known credential-test bot IP. Honest result: US #1, then GB/CA/JP/DE/ES/BR. lib/register.ts — stamp `created` (ms epoch) and store `country` (CF/ ipregistry code) on new users, so future reports get real signup timing and geography from the db directly instead of log archaeology. Existing users predate this; backfill is out of scope. Co-Authored-By: Claude Opus 4.8 (1M context)

check username

2026-01-19T00:27:30Z

check for syncSquare

2025-09-08T18:13:32Z

reserved usernames

2025-08-07T15:45:36Z

rm log

2025-07-11T14:15:26Z

fresh attribute

2025-07-10T19:37:05Z

username checks

2025-06-16T20:54:29Z