aboutsummaryrefslogtreecommitdiffstats
path: root/lib
Commit message (Expand)AuthorAgeFilesLines
* register: check the reCAPTCHA v3 score, action and hostname; cap signups per ...Adam Soltys10 hours1-0/+63
* payments: refuse a lightning send over the balance before quoting its routeAdam Soltys10 hours1-1/+8
* users: open pre-NIP-49 nostr keys with the account passwordAdam Soltys10 hours1-0/+62
* lnquote: keep the quote layer until a timed-out getroutes is doneAdam Soltys10 hours1-5/+24
* bolt12: put the requested expiry and single-use on the offer itselfAdam Soltys2026-10-081-0/+9
* users: keep the encrypted nostr key and 2FA seed away from bearer tokensAdam Soltys2026-10-081-1/+1
* Remove response loggerAdam Soltys2026-10-081-19/+0
* payments: lowercase payreq before looking up our own invoicesAdam Soltys2026-10-061-1/+7
* invoices: a supplied account must belong to the invoice's userAdam Soltys2026-10-061-1/+6
* Evicted accounts can't receive or log in; limit errors say what's happeningAdam Soltys2026-10-041-1/+7
* v3 bridge: a migrated name's legacy receives are paid on to its v3 walletAdam Soltys2026-10-042-2/+147
* payments: refuse on-chain sends to blocked addresses before debitingAdam Soltys2026-09-291-0/+19
* logging: throttle log lines that clients can trigger at willAdam Soltys2026-09-293-7/+46
* invoices: don't let a supplied id overwrite another user's invoiceAdam Soltys2026-09-291-0/+11
* upload: decode images in a throwaway child process and tighten input checksAdam Soltys2026-09-263-11/+127
* app: don't trust client IP headers on onion requestsAdam Soltys2026-09-251-0/+30
* safe-fetch: decode IPv6 hosts before checking for private addressesAdam Soltys2026-09-251-10/+46
* lightning: don't wedge the listener on an already-credited preimageAdam Soltys2026-09-231-2/+8
* users: reserve service names on registration and renameAdam Soltys2026-09-212-2/+33
* ecash: identify our own tokens by keyset, not by the mint urlAdam Soltys2026-09-211-20/+28
* lightning: quote the routing fee up front and add a max-send quote endpointAdam Soltys2026-09-212-8/+340
* lnurl: expire payRequest callback ids after seven daysAdam Soltys2026-09-161-2/+2
* ecash: redeem tokens by melting to the user's own invoiceAdam Soltys2026-09-162-160/+148
* printer: publish receipts at QoS 1 and clean LNURL metadata memosAdam Soltys2026-09-141-1/+18
* ecash: make claims work against the v1 keyset mintAdam Soltys2026-09-141-19/+64
* security: drop the admin endpoint surface and land pending hardeningAdam Soltys2026-09-1312-34/+180
* ln listener: skip a settlement whose account is gone before creditingAdam Soltys2026-09-051-0/+9
* credit: skip settlements for a deleted account instead of throwingAdam Soltys2026-09-051-0/+10
* sockets: accept read-only tokens on login, deliver payment events onlyAdam Soltys2026-09-041-1/+12
* payments: finalize settled keysends in sendKeysendAdam Soltys2026-09-041-1/+54
* health: tolerate a transient receive-listener lag, fail only if it's stuckAdam Soltys2026-08-271-4/+15
* lnurl: pin SSRF-guard fetches to the validated IP (close DNS-rebinding)Adam Soltys2026-08-271-51/+92
* harden: remove debug /echo endpoint; widen LN health probe timeoutAdam Soltys2026-08-271-1/+1
* deps: upgrade fastify v4 to v5 line to fix dependabot alertsAdam Soltys2026-08-221-2/+2
* log: redact secret and otpsecret from request bodiesAdam Soltys2026-08-221-1/+1
* ln: bound receive-listener wait, phase-aware watchdog, re-enable health checkAdam Soltys2026-08-222-41/+143
* nwc: enforce per-connection spend budgets + flag-gated incident containmentAdam Soltys2026-08-223-18/+211
* nwc: reply UNAUTHORIZED on unknown connection instead of returning silentlyAdam Soltys2026-08-171-2/+13
* ln: tear down dead cl clients fully + recover invoice listener on socket deathAdam Soltys2026-08-152-10/+74
* payments: prevent same-invoice retry from orphaning an unreconciled debitAdam Soltys2026-08-081-1/+21
* ecash: serialize the shared cash-key read-modify-write (S13)Adam Soltys2026-08-071-11/+36
* payments: never lose a settled deposit to an oversized memo (S9/S10)Adam Soltys2026-08-071-1/+8
* nwc: budget keysend, atomic dedup, serialize spends (S4/S6/S8)Adam Soltys2026-08-071-12/+66
* logging: redact auth headers; set cookie flags on session token (S5)Adam Soltys2026-08-071-1/+12
* auth: hash passwords at bcrypt cost 12 with transparent upgrade (S2)Adam Soltys2026-08-071-1/+1
* sockets: verify JWT signatures on the websocket auth path (S1)Adam Soltys2026-08-071-2/+14
* nwc: republish 13194 info events unconditionally every 2 minutesAdam Soltys2026-08-041-53/+18
* Let a migrated account hand its address to coinos v3Adam Soltys2026-08-032-0/+3
* payments: guard tip credit and self-referential autowithdrawAdam Soltys2026-08-031-1/+20
* sendKeysend: verify a thrown keysend by label, not the caller's hash (COINOS-1)Adam Soltys2026-07-311-14/+55
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-30 09:14:39 +0000