aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* mirror payment records to arc + atomic /confirm lock to prevent double-creditsAdam Soltys2026-05-172-4/+35
| | | | | | | | | | | | | | | | | | | | | Apr 29 double-credit prevention, ported from master 0e368dab and adapted to staging's hono/tigerbeetle structure. Two parallel callers of /confirm (walletnotify, catchUp, bulk sweeps) could each read p.confirmed=false and each run tbConfirm — doubling the pending→balance transfer. tbConfirm itself isn't idempotent on its own, so the race materializes as a real double-credit even with TB. - routes/payments.ts: SET NX EX 60 lock around the confirmation block keyed by `confirmlock:${txid}:${vout}`. Concurrent callers short-circuit cleanly. Released on success and on every early-return. - lib/payments.ts credit() + routes/payments.ts /confirm: mirror payment + invoice records and the `payment:<txid>:<vout>` / `payment:<hash>` pointer keys into arc as soon as they're written. gf() will then find the prior credit via arc fallback even if the main-db copy is wiped by a future data-loss event. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* remove /gateway endpointAdam Soltys2026-05-172-9/+0
| | | | | | | | | | | Unauthenticated arbitrary db.set abuse vector. Exploited on the master deployment to inflate user balances and override safety controls in real time, leading to a hot-wallet drain. Route and handler both fully removed; if a webhook-by-short-channel-id mapping is ever needed again it must be rebuilt with auth + SCID format validation + webhook URL validation + per-user ownership check. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* sendLightning / sendKeysend: only reverse when CLN reports the payment failedAdam Soltys2026-05-171-2/+26
| | | | | | | | | | | | | | | | | | | | | The catch blocks for ln.xpay and ln.keysend reversed the user's debit whenever the RPC call threw, regardless of the actual payment state in CLN. If the RPC errored transiently while the payment was still pending, the user's balance got refunded — and then the lightning payment could still complete, leaving the user with both the refund and the outgoing sats. Both call sites now mirror the safe check() logic: const failed = !pays.length || pays.every((p) => p.status === "failed"); if (completed) finalize ... else if (failed) reverse ... // else (pending) leave the debit; check() reconciles when CLN settles. If listpays itself errors, log via warn() and skip the reverse — the debit stays in the pending set and check() will retry. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* feat: blocked address protection, LNURL proxy, replay timestampsAdam Soltys2026-03-275-1/+144
| | | | | | | | | | - Add lib/changeid.ts for in-process account rekeying - Block sends to addresses in redis blocked_addresses set, auto-rekey on attempt - Add created param to credit() for accurate replay timestamps - Add paid_at to replay() for correct payment dates - Add /lnurl/proxy endpoint for server-side LNURL callback fetching Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* verify ark amountsAdam Soltys2026-03-225-21/+94
|
* remove USER bun from base image, remove unused DockerfileAdam Soltys2026-03-192-10/+0
| | | | | | | App and other containers need root access for unix sockets and file permissions. All derived images already override USER as needed. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* postgres dockerfileAdam Soltys2026-03-191-0/+0
|
* dockerfilesAdam Soltys2026-03-1912-2/+154
|
* don't republishAdam Soltys2026-03-181-3/+7
|
* stop republishing external events and add NWC rate limitingAdam Soltys2026-03-183-5/+15
| | | | Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* quieter logsAdam Soltys2026-03-172-14/+13
|
* handle ark dustAdam Soltys2026-03-173-5/+6
|
* fix: add account ownership checks and harden PIN validationAdam Soltys2026-03-173-3/+22
| | | | | | | | - Validate account ownership (aid) before allowing ark send/sync/vault operations and in debit/sendOnchain as defense-in-depth - Harden PIN check to reject missing/empty pin when user has one set Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* ui envAdam Soltys2026-03-171-0/+5
|
* use -w flagAdam Soltys2026-03-171-15/+15
|
* disk space logAdam Soltys2026-03-171-1/+1
|
* staging checkoutAdam Soltys2026-03-172-4/+1
|
* setup scriptAdam Soltys2026-03-173-8/+61
|
* prompt compose overwriteAdam Soltys2026-03-172-6/+17
|
* update readmeAdam Soltys2026-03-172-48/+77
|
* streamline dev setup and docker imagesAdam Soltys2026-03-1611-282/+1026
| | | | | | | | | | | | | | | | | | | - Rewrite setup.sh: auto-installs Docker, downloads regtest snapshot, pulls images, starts all services. Idempotent, works on fresh Ubuntu/macOS. - Create coinos-base image (196MB) shared by all containers: bitcoin, elements, lightning, strfry, kvrocks, electrs, tigerbeetle, chopsticks. Total pull ~490MB, down from ~4.3GB. - Move all images to ghcr.io/coinos/* namespace. - Drop nutshell (mint/wallet), postgres, mon from default dev compose. - Comment out ark stack (optional), guard ark.ts against empty config. - Add missing sampledata: lightningc, strfry, kvrocks, valkey configs. - Strip strfry binary (145MB debug symbols removed). - Use single CLN version (v25.12.1) for all 3 lightning nodes. - Switch valkey to alpine variant (110MB → 41MB). - Update config.ts.sample with correct service URLs. - Regtest snapshot hosted on GitHub Releases (~2MB). Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* quieter logsAdam Soltys2026-03-166-35/+40
|
* update migrate scriptAdam Soltys2026-03-164-300/+1783
|
* conditional lnbAdam Soltys2026-03-161-1/+1
|
* cln migrateAdam Soltys2026-03-152-0/+300
|
* skip bolt12 integration tests gracefully when Lightning unavailableAdam Soltys2026-03-151-23/+29
| | | | | | | Adds timeout to exec helper and catches setup failures so tests skip instead of hanging for 60s when Docker Lightning nodes aren't reachable. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
* testsAdam Soltys2026-03-157-160/+393
|
* slow down ark checksark2Adam Soltys2026-03-143-16/+53
|
* persist vtxos to valkeyAdam Soltys2026-03-135-4/+5488
|
* ark delegationAdam Soltys2026-03-132-0/+388
|
* ark fixesAdam Soltys2026-03-133-11/+26
|
* recoveryAdam Soltys2026-03-131-11/+27
|
* don't renew dustAdam Soltys2026-03-121-4/+5
|
* ark wallet monitoringAdam Soltys2026-03-124-4/+435
|
* tx recalcAdam Soltys2026-03-114-23/+42
|
* try to cpfp piggyback on in flight withdrawalsAdam Soltys2026-03-113-45/+87
|
* remove bumpestimateAdam Soltys2026-03-112-28/+7
|
* cpfp improvementsAdam Soltys2026-03-112-2/+230
|
* add network aliasAdam Soltys2026-03-111-0/+1
|
* skip server limit check for fund and internal paymentsAdam Soltys2026-03-081-1/+2
|
* accept android app origin for passkey verificationAdam Soltys2026-03-081-2/+8
|
* add assetlinks.json for Android passkey supportAdam Soltys2026-03-081-0/+10
| | | | Co-Authored-By: Claude Opus 4.6 <[email protected]>
* add LNURL-withdraw endpoints for fund-based NFC paymentsAdam Soltys2026-03-082-1/+79
| | | | Co-Authored-By: Claude Opus 4.6 <[email protected]>
* include raw event in push payload for data transportAdam Soltys2026-03-071-4/+12
| | | | | | | | Forward kind 445 Nostr events through push notifications so the client can process messages instantly without relying on WebSockets. Includes a 3KB size guard for the ~4KB push payload limit. Co-Authored-By: Claude Opus 4.6 <[email protected]>
* add group registry for MLS push notificationsAdam Soltys2026-03-062-19/+137
| | | | | | | | Server now tracks MLS groups (synced from clients) and subscribes to kind 445 events on group relays, sending push to all members except the sender. Registry persisted to Redis across restarts. Co-Authored-By: Claude Opus 4.6 <[email protected]>
* subscribe to all relays for DM push notificationsAdam Soltys2026-03-061-37/+43
| | | | | | | | The listener was only watching the local strfry relay, but MLS messages go to external relays like relay.coinos.io. Subscribe to all configured relays so gift wraps are seen. Co-Authored-By: Claude Opus 4.6 <[email protected]>
* add debug logging to DM notificationsAdam Soltys2026-03-061-1/+3
| | | | Co-Authored-By: Claude Opus 4.6 <[email protected]>
* add server-side MLS user index and fix DM push VAPIDAdam Soltys2026-03-061-0/+4
| | | | | | | | | - Add lib/mls.ts: maintains Redis-backed index of MLS users with background backfill and live subscription for kind 443 events - Add /mls/users endpoint serving the directory to the UI - Fix dmNotifications.ts: add setVapidDetails call so push delivery works Co-Authored-By: Claude Opus 4.6 <[email protected]>
* profile searchAdam Soltys2026-03-063-0/+138
|
* drop abstract pool useAdam Soltys2026-03-064-21/+7
|
generated by cgit v1.2.3 (git 2.51.0) at 2026-11-03 13:56:23 +0000