coinos-server.git/routes, branch stagingcoinos server — legacy coinos.io backend (Lightning, on-chain, Liquid)https://git.coinos.io/coinos-server.git/atom?h=staging2026-06-17T14:47:46Zusers: add authenticated self-delete endpoint2026-06-17T14:47:46ZAdam Soltysadam@coinos.io2026-06-14T19:33:43Zurn:sha1:7332e55641c21e024e50f83176b302df9c488e9a
Port of master 2548f757, adapted from Express to this stack's Hono
handlers (c.get("user"), c.req.json(), setCookie, bail) and TigerBeetle
balances (getBalance/getPending instead of the Redis balance:/pending:
keys). POST /delete (auth) wipes every key tied to the calling user:
user records, payments/invoices, sub-accounts, NWC apps, nostr follow
graph + nip5. Gated by typing the username and refuses while
balance+pending > 10k sats so funds can't be destroyed by accident.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
don't remove orphan payment ids from user payment lists2026-05-18T06:50:16ZAdam Soltysadam@coinos.io2026-05-18T06:50:16Zurn:sha1:7c1eefc142c951d7db5a0fa1afeae64a2fdf02fd
When the underlying payment record is missing, removing the id from the
user's payments list was destructive — a transiently unavailable record
(arc fallback miss, database hiccup) would cause us to permanently drop
the pointer. Leave the orphan in place so a back-fill from an RDB backup
can restore the record under the same id later.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fix lnurl description_hash mismatch when sender provides a comment2026-05-18T06:49:22ZAdam Soltysadam@coinos.io2026-05-18T06:49:22Zurn:sha1:d5395a81e5475af3a41c2715f58cab6b487a5795
The bolt11 description_hash is computed from the metadata JSON, which
was being constructed with the sender's `comment` substituted into
text/plain. Wallets verify description_hash against the metadata they
received in the lnurl-pay response, so injecting the comment into the
hash made the verification fail — the invoice would settle but
description_hash verification would reject it as inconsistent.
Keep metadata canonical ("Paying user@host") so the description_hash
the wallet receives matches what they verify against. The comment is
still preserved as the human-readable memo on the invoice record.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
verifyRecaptcha: check x-forwarded-host before host header2026-05-18T06:48:59ZAdam Soltysadam@coinos.io2026-05-18T06:48:59Zurn:sha1:7f4bf4d886bd43f3b15f18e3c4f7c040892e9f73
Tor users access via .onion through a forwarding layer that puts the
real hostname in x-forwarded-host while the literal host header is the
internal target. Without checking the forwarded header first, captcha
prompted for .onion visitors who should have been exempt.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mirror payment records to arc + atomic /confirm lock to prevent double-credits2026-05-18T06:46:58ZAdam Soltysadam@coinos.io2026-05-18T06:46:58Zurn:sha1:dfd31ad83d24e780523f4e76d04a76aba1fa8be1
Apr 29 double-credit prevention, ported from master 0e368dab and adapted
to staging's hono/tigerbeetle structure. Two parallel callers of /confirm
(walletnotify, catchUp, bulk sweeps) could each read p.confirmed=false
and each run tbConfirm — doubling the pending→balance transfer.
tbConfirm itself isn't idempotent on its own, so the race materializes
as a real double-credit even with TB.
- routes/payments.ts: SET NX EX 60 lock around the confirmation block
keyed by `confirmlock:${txid}:${vout}`. Concurrent callers short-circuit
cleanly. Released on success and on every early-return.
- lib/payments.ts credit() + routes/payments.ts /confirm: mirror payment
+ invoice records and the `payment:<txid>:<vout>` / `payment:<hash>`
pointer keys into arc as soon as they're written. gf() will then find
the prior credit via arc fallback even if the main-db copy is wiped
by a future data-loss event.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
remove /gateway endpoint2026-05-18T06:42:28ZAdam Soltysadam@coinos.io2026-05-18T06:42:28Zurn:sha1:ca4bdc84f1eac1859044639ffa16bac9aa8fce1b
Unauthenticated arbitrary db.set abuse vector. Exploited on the master
deployment to inflate user balances and override safety controls in real
time, leading to a hot-wallet drain. Route and handler both fully
removed; if a webhook-by-short-channel-id mapping is ever needed again
it must be rebuilt with auth + SCID format validation + webhook URL
validation + per-user ownership check.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
feat: blocked address protection, LNURL proxy, replay timestamps2026-03-28T06:58:56ZAdam Soltysadam@coinos.io2026-03-28T06:58:51Zurn:sha1:a574e774318a37bfc1e5c638a3d83e3fb9c180d2
- Add lib/changeid.ts for in-process account rekeying
- Block sends to addresses in redis blocked_addresses set, auto-rekey on attempt
- Add created param to credit() for accurate replay timestamps
- Add paid_at to replay() for correct payment dates
- Add /lnurl/proxy endpoint for server-side LNURL callback fetching
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
verify ark amounts2026-03-22T15:41:12ZAdam Soltysasoltys@gmail.com2026-03-22T15:41:08Zurn:sha1:af568c46cb3da198ea8614d21616bac3951f3262stop republishing external events and add NWC rate limiting2026-03-18T18:39:05ZAdam Soltysadam@coinos.io2026-03-18T18:39:05Zurn:sha1:a8977f8c5c84b0c37c4fb36f0a0be5bf6f492f3d
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
fix: add account ownership checks and harden PIN validation2026-03-17T08:34:28ZAdam Soltysadam@coinos.io2026-03-17T08:21:48Zurn:sha1:136ba2a12e87178f6d83fba2874abf4c9ad32915
- Validate account ownership (aid) before allowing ark send/sync/vault
operations and in debit/sendOnchain as defense-in-depth
- Harden PIN check to reject missing/empty pin when user has one set
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>