ecash: carry pasted tokens in the URL instead of storing them server-side

The server no longer accepts anonymous token uploads. A pasted token now
redirects straight to /ecash/<token>, and the page asks the server for the
token's status statelessly. Ids from previously shared links still resolve.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

1 files changed, 11 insertions, 2 deletions

diff --git a/src/routes/(app)/ecash/[id]/[...version]/+layout.server.ts b/src/routes/(app)/ecash/[id]/[...version]/+layout.server.ts
index 50be6986..e241930e 100644
--- a/src/routes/(app)/ecash/[id]/[...version]/+layout.server.ts
+++ b/src/routes/(app)/ecash/[id]/[...version]/+layout.server.ts
@@ -1,5 +1,5 @@
 import getRates from "$lib/rates";
-import { get } from "$lib/utils";
+import { get, post } from "$lib/utils";
 
 export async function load({ params, parent }) {
 	const { user } = await parent();
@@ -8,7 +8,16 @@ export async function load({ params, parent }) {
 	version ||= 4;
 	version = parseInt(version);
 
-	const { token, status } = await get(`/cash/${id}/${version}`);
+	// A pasted token arrives in the URL itself and is checked statelessly;
+	// anything else is an id from the share links the server used to hand out.
+	let token: string;
+	let status: any;
+	if (id.startsWith("cashu")) {
+		token = id;
+		status = await post("/ecash/status", { token });
+	} else {
+		({ token, status } = await get(`/cash/${id}/${version}`));
+	}
 	const { spent, total, mint, external } = status;
 	return {
 		id,