coinos-server.git/test, branch master

ecash: redeem tokens by melting to the user's own invoice

2026-09-16T11:53:22Z

Redeeming ecash is now a plain NUT-05 melt into a Lightning invoice owned by the redeeming user, credited by the regular lightning listener. Drop the house proof pool and its lock, the /mint and /melt routes, and the special-casing of a mint account in NWC and payment routing. Tokens are decoded against the mint's keyset list so short v1 ids resolve, and an empty keyset list is never cached. Co-Authored-By: Claude Fable 5.1

nwc: enforce per-connection spend budgets + flag-gated incident containment

2026-08-22T15:08:04Z

Thread the remaining allowance through every spend path (pay_invoice, pay, pay_keysend, internal transfer) as maxTotal, and have debit() assert the spend stays within it after it reloads the invoice and captures the tip — so a delegated NWC credential can no longer exceed its configured budget, and a mutated tip can't slip a small-budget check and drain via the internal path. checkBudget now returns the remaining allowance alongside any error; a blank budget is treated as deliberately unlimited and a positive budget requires a known renewal period. Add operator-controlled containment for a suspected credential disclosure, all gated behind Redis flags with no hardcoded scope: nwc:disabled fail every method closed nwc:credential-cutoff retire connections created before an epoch nwc:quarantined block an individual disclosed connection nwc:guard:dormant-keysend quarantine the first keysend on a long-idle app Fix an ownership check that read the bare pubkey instead of app:, which let an authenticated user overwrite another connection's config, and validate budget/fee/renewal inputs. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01XiwgmQKwKnRxUmVDd4xSf7

test: regtest regression suite for the security-disclosure fixes

2026-08-08T06:29:27Z

16 tests covering S1 (jwt.verify vs forged tokens), S2 (bcrypt cost 12 + legacy detection), S3 (adminpass fails closed on omitted/empty password), S5 (session cookie flags), S6 (atomic SET NX dedup), S7 (/upload auth), fnd-003/004 (memo truncation), fnd-006 (deleteSelf sub-account guard), and S8/fnd-007 (spend/cash mutex serialization). Black-box HTTP + redis against the live regtest stack; run with `bun run test:regtest`. Co-Authored-By: Claude Opus 4.8

clean up unused files

2018-03-16T05:25:40Z

rename app to index

2018-02-06T03:38:15Z

Ditch client code

2017-01-22T03:46:49Z

Initial Vueification

2017-01-16T02:24:09Z