From b1e175c1faa46ed67cf0575f8d8808f1ae10892c Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sun, 27 Sep 2026 14:48:24 -0700
Subject: ecash: drop anonymous token storage in favour of a stateless status
 lookup

POST /cash stored any submitted string under a fresh id with no auth, no
validation and no expiry. Replace it with POST /ecash/status, which checks a
token the client already holds and returns its total, spent amount and mint.
GET /cash/:id/:version stays so previously shared ids keep resolving.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'index.ts')

diff --git a/index.ts b/index.ts
index 2c386556..22854661 100644
--- a/index.ts
+++ b/index.ts
@@ -198,7 +198,7 @@ app.post("/shopify/:id", shopify);
 app.get("/bolt12", fixBolt12);
 
 app.get("/cash/:id/:version", ecash.get);
-app.post("/cash", ecash.save);
+app.post("/ecash/status", ecash.status);
 app.post("/claim", auth, ecash.claim);
 app.post("/ecash/:id", ecash.receive);
 
-- 
cgit v1.2.3