coinos-server.git/test/security.test.ts, branch master

ecash: redeem tokens by melting to the user's own invoice

2026-09-16T11:53:22Z

Redeeming ecash is now a plain NUT-05 melt into a Lightning invoice owned by the redeeming user, credited by the regular lightning listener. Drop the house proof pool and its lock, the /mint and /melt routes, and the special-casing of a mint account in NWC and payment routing. Tokens are decoded against the mint's keyset list so short v1 ids resolve, and an empty keyset list is never cached. Co-Authored-By: Claude Fable 5.1

test: regtest regression suite for the security-disclosure fixes

2026-08-08T06:29:27Z

16 tests covering S1 (jwt.verify vs forged tokens), S2 (bcrypt cost 12 + legacy detection), S3 (adminpass fails closed on omitted/empty password), S5 (session cookie flags), S6 (atomic SET NX dedup), S7 (/upload auth), fnd-003/004 (memo truncation), fnd-006 (deleteSelf sub-account guard), and S8/fnd-007 (spend/cash mutex serialization). Black-box HTTP + redis against the live regtest stack; run with `bun run test:regtest`. Co-Authored-By: Claude Opus 4.8