aboutsummaryrefslogtreecommitdiffstats
path: root/index.ts
Commit message (Collapse)AuthorAgeFilesLines
* users: add authenticated self-delete endpointAdam Soltys2026-06-131-0/+1
| | | | | | | | | | POST /delete (auth) wipes every key tied to the calling user, mirroring scripts/delall-legacy.ts: user records, payments/invoices, sub-accounts, NWC apps, nostr follow graph + nip5. Gated by typing the username and refuses while balance+pending > 10k sats so funds can't be destroyed by accident. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* payments: guard /replay double-credit race with SET NX idempotencyAdam Soltys2026-06-131-1/+1
| | | | | | | | | | getPayment() pre-check in the lightning listener/replay isn't atomic, so concurrent re-credits of the same settlement each ran incrBy. Claim each lightning/bolt12 settlement with an atomic SET NX on credited:<ref> (ref = preimage) and bail if already claimed. Also disable the /replay route that triggered it. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* remove /gateway endpointAdam Soltys2026-05-171-1/+0
| | | | | | | | | Unauthenticated arbitrary db.set abuse vector. Exploited to inflate user balances and override safety controls (bitcoin:limit, limit, hardfreeze, freeze) in real time, leading to a hot-wallet drain. Route and handler both fully removed. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
* check listpays before reversingAdam Soltys2026-04-251-2/+2
|
* lnurl proxyAdam Soltys2026-03-271-0/+1
|
* ensure lightning payments get processedAdam Soltys2026-03-191-1/+2
|
* remove logsAdam Soltys2026-03-171-4/+2
|
* adjust ln minfeeregtest-dataAdam Soltys2026-03-151-1/+1
|
* health checkAdam Soltys2026-02-061-0/+3
|
* challenge verifyAdam Soltys2025-10-011-1/+0
|
* login challengeAdam Soltys2025-10-011-0/+1
|
* Merge branch 'patch-1'Adam Soltys2025-09-181-1/+1
|\
| * allow invoice owners to modify the webhookAdam Soltys2025-09-181-1/+1
| |
* | sendinvoice supportAdam Soltys2025-09-181-0/+1
|/
* flash routeAdam Soltys2025-09-111-2/+2
|
* remove test routeAdam Soltys2025-09-091-1/+0
|
* create external paymentsquareAdam Soltys2025-09-041-0/+1
|
* support readonly tokensAdam Soltys2025-09-041-0/+1
|
* invoice updateAdam Soltys2025-08-201-0/+1
|
* authorizationsAdam Soltys2025-08-101-1/+2
|
* respect null tipsAdam Soltys2025-07-191-0/+1
|
* delete managerAdam Soltys2025-07-181-0/+1
|
* square endpointsAdam Soltys2025-07-171-2/+4
|
* check account ownershipAdam Soltys2025-07-121-0/+3
|
* auto payAdam Soltys2025-07-081-0/+4
|
* lnurl pay endpoint for latest invoiceAdam Soltys2025-05-061-0/+1
|
* creditsAdam Soltys2025-04-071-0/+1
|
* fund routesAdam Soltys2025-03-151-2/+4
|
* nwc date comparison in secondsAdam Soltys2025-03-071-3/+1
|
* record payment_hashAdam Soltys2025-03-051-0/+3
|
* pinned contactsAdam Soltys2025-02-261-0/+3
|
* default app on registerAdam Soltys2025-02-111-1/+1
|
* nwc apps endpointsAdam Soltys2025-02-071-2/+9
|
* log login failuresAdam Soltys2025-02-041-1/+10
|
* unified event endpointAdam Soltys2025-01-231-0/+1
|
* notes and stuffAdam Soltys2025-01-211-0/+1
|
* rm firehoseAdam Soltys2025-01-201-1/+0
|
* nostr threadsAdam Soltys2025-01-201-0/+2
|
* return event partsAdam Soltys2025-01-171-0/+1
|
* zap endpointsAdam Soltys2025-01-161-0/+3
|
* sign endpointAdam Soltys2025-01-151-0/+1
|
* use strfry scanAdam Soltys2025-01-141-2/+0
|
* nostr loginAdam Soltys2024-12-291-1/+3
|
* fix bolt12Adam Soltys2024-12-261-1/+2
|
* bolt12 replayAdam Soltys2024-12-261-16/+7
|
* invoices listAdam Soltys2024-12-261-2/+8
|
* lnurlwAdam Soltys2024-12-241-0/+1
|
* printer endpointAdam Soltys2024-12-181-0/+1
|
* contacts limitAdam Soltys2024-11-291-1/+1
|
* payload is bodyAdam Soltys2024-11-271-0/+2
|
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-24 21:42:35 +0000