aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* ecash: drop the mint account special-case and the mint routeAdam Soltys2026-09-162-8/+0
| | | | | | | The server no longer keeps a house ecash pool, so there is no mint account to skip when parsing a payment and no /ecash/mint endpoint. Co-Authored-By: Claude Fable 5.1 <[email protected]>
* register: start the session from the register responseAdam Soltys2026-09-141-9/+30
| | | | | | | | | | | /register now verifies the recaptcha token itself, and Google tokens are single-use — so the follow-up /login that reused the same token came back "failed captcha" for an account that had just been created. The register response already carries the JWT; set the session cookies from it and only fall back to /login when registration itself failed. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_0166Ci2XdCair1B9ych7w8dq
* pos: reset the device and release the serial port when leaving the flasherAdam Soltys2026-09-141-6/+34
| | | | | | | | | | | | Connecting loads the esptool stub and parks the chip in the ROM download mode; only a successful flash reset it and closed the port. Navigating away, a failed connect, or a failed flash left the device looking frozen (OLED keeps its last frame, LED pin pulled up, keypad dead) with the browser still holding the port. Reset + release on component destroy and pagehide, on connect failure, and from a new Disconnect button. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01VMi2Y1oKPZ3TeeFmLej47y
* pos: offer "Flash latest release" from a published firmware manifestAdam Soltys2026-09-041-1/+70
| | | | | | | | | | | | Host the ESP32-C3 firmware under static/firmware (bootloader, partition table, boot_app0, app) with a manifest.json written by coinos-pos's publish.sh. The flasher fetches the manifest, downloads every part, verifies sizes, flashes them at their offsets and resets the device. The config partition is not in the manifest so credentials survive. Manual .bin upload stays available underneath. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_014gVYGi29FjTeLdNTiutkZx
* pos: hard-reset the device after flashingAdam Soltys2026-09-041-0/+28
| | | | | | | | | | esptool-js leaves the chip in the ROM bootloader stub after writeFlash, so the device appeared dead until power-cycled. Pulse RTS the way esptool.py does, drop the port (the C3 re-enumerates), and show a "device restarted" message next to the Connect button. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_014gVYGi29FjTeLdNTiutkZx
* pos: refuse to flash anything that is not a valid LittleFS imageAdam Soltys2026-09-042-1/+40
| | | | | | | | | | The flasher hex-encoded whatever the /flash endpoint returned, so a server error body was written to devices as the config partition. Check the response status, require a 128KB image with the LittleFS magic, and surface the error above the form instead. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_014gVYGi29FjTeLdNTiutkZx
* migrate: hand the name over to the registrar too — after flagging the ↵Adam Soltys2026-08-301-0/+28
| | | | | | | account, tell names.coinos.io which v3 identity may claim it (MIGRATE_TOKEN), with retries; without the grant the registrar squat guard refused every migrated claim Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MrkLsNScXe9b6BviUSdmMr
* migrate: shorter button, drop the destination rowAdam Soltys2026-08-031-5/+2
| | | | | | | | | | "Move my balance and address to coinos v3" wrapped on a phone; the paragraph above already says what happens, so the button is just "Migrate". The destination row went with it — it only ever said "your coinos v3 wallet". Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
* migrate: flag the account instead of renaming itAdam Soltys2026-08-032-38/+12
| | | | | | | | | | Renaming to <name>v2 was a hack for freeing the username, and v3/v4/v9 fallbacks made it worse. The page now sweeps the balance and sets the new `migrated` flag: the registrar takes over receiving for the name while the old account keeps working here, unchanged. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
* migrate: the retired name has to be letters and numbers onlyAdam Soltys2026-08-032-9/+32
| | | | | | | | | | The server enforces /^[\p{L}\p{N}]{2,24}$/u, so <name>_v2 was rejected outright. Candidates are <name>v2, v3, … each trimmed to fit the 24-char limit (so a long username still lands inside it), and the rename walks to the next one if a retired name is already taken. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
* migrate: don't show the temporary v3 addressAdam Soltys2026-08-031-1/+3
| | | | | | | | | | It's an npub-shaped placeholder, and the whole point of the page is that the user keeps their real username — seeing "[email protected]" as the destination just reads as a mistake. The row says "your coinos v3 wallet" instead. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
* migrate: run the sweep server-side, and send the whole balanceAdam Soltys2026-08-032-88/+121
| | | | | | | | | | | | | | | | | | Two fixes from the first live test: The POST went out from the browser, where $lib/utils' base is "" — so it hit the SvelteKit page route and came back "POST method not allowed". Payments in this app all run server-side with auth(cookies), because that's where the session token is usable; /migrate is a form action now like the rest of the send flows. And the routing reserve is gone: the ASP's node has two direct channels to ln.coinos.io, so a sweep is one hop and costs nothing. It sends the full balance, only retrying 0.5% lighter if a payment actually comes back short. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
* migrate: satisfy the type checker on the error pathAdam Soltys2026-08-031-1/+1
|
* Add /migrate: hand a legacy account over to coinos v3Adam Soltys2026-08-032-0/+128
| | | | | | | | | | | | coinos v3 links here with ?to=<the user's new payment address>&back=<url>. The user is already signed in on this site, so no password or key has to travel anywhere: we fetch an invoice from the v3 registrar for the balance (less a small routing reserve), pay it, then rename the account to <username>_v2 — which releases the username so v3's registrar will let them claim it. Old account stays, renamed, and stops receiving. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Wvj4aoeMZwA7VUGdJP9Swi
* Only pay internally when the name is really a local accountAdam Soltys2026-08-021-1/+10
| | | | | | | | | | Addresses at our own domain used to have the domain stripped and get paid internally on the assumption that every one of them was ours. v3 payment addresses live at the same domain, so check the account exists first and otherwise leave the address intact — it then flows through the normal lightning-address path. Co-Authored-By: Claude Fable 5 <[email protected]>
* payments: show lightning sends as pending until settledAdam Soltys2026-07-302-3/+15
| | | | | | | | | | | Lightning/bolt12 sends now start unconfirmed (server sets confirmed=false until the HTLC settles and the preimage arrives). Reflect that in the UI: the payment list and detail page show 'Pending' for an unsettled send, and the detail page shows a pending note in place of the empty preimage. Prevents the misleading 'Sent/completed with no preimage' state for held HTLCs (e.g. Ark hold invoices that stay in-flight for hours). Co-Authored-By: Claude Opus 4.8 <[email protected]>
* bolt12 zaps: accept offers in send flow, show/publish user offerAdam Soltys2026-07-3023-27/+218
| | | | | | | | | | - parse lno= from BIP-321 bitcoin: URIs; send page parses offers for preview now that /parse handles them - settings/nostr shows the user's standing lno1 offer with copy/QR and a button to publish it as a kind 10058 offer list for NIP-177 zaps - new locale strings translated Co-Authored-By: Claude Fable 5 <[email protected]>
* receive/invoice: build POST body from snapshot, don't mutate $derivedAdam Soltys2026-06-192-22/+24
| | | | | | | | | | | | | | The merchant receive and invoice pages mutated the $derived `invoice` proxy (setType/setAmount/setMemo) then POSTed it. Mutating a $derived and JSON.stringify-ing it serializes unreliably, so a stale type (on-chain when lightning was expected) and a stale/10x-shifted amount could leak from a prior interaction into POST /invoice (funk POS bug). Build the body as { ...$state.snapshot(invoice), ...changes } so the intended type/amount/address_type reliably win; update() takes the plain body. Front-end only. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* invoices fixAdam Soltys2026-06-171-20/+56
|
* fix invoices pageAdam Soltys2026-06-171-25/+72
|
* remove team sectionAdam Soltys2026-05-111-64/+0
|
* use searchparams for lnurlAdam Soltys2026-03-271-2/+4
|
* lnurl proxyAdam Soltys2026-03-271-3/+6
|
* max fee calcAdam Soltys2026-03-161-14/+7
|
* Fix subdomain matching in LNURL callback redirectAdam Soltys2026-02-251-2/+2
| | | | Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Fix parse matching subdomain addresses as local usersAdam Soltys2026-02-251-1/+1
| | | | Co-Authored-By: Claude Opus 4.6 <[email protected]>
* display lightning invoice on payment detailsAdam Soltys2026-02-231-0/+5
|
* fix getpublickeyAdam Soltys2026-02-161-43/+14
|
* fix: rename hidden maxfee field to fee to match form handlerAdam Soltys2026-02-151-1/+1
| | | | Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: pass Uint8Array to finalizeEvent and nip04 (nostr-tools API change)Adam Soltys2026-02-141-6/+7
| | | | Co-Authored-By: Claude Opus 4.6 <[email protected]>
* check userAdam Soltys2026-02-101-2/+6
|
* fix importsAdam Soltys2026-02-0916-12/+22
|
* skip captcha for fundsAdam Soltys2026-02-063-148/+60
|
* pass captcha when sweepingAdam Soltys2026-02-062-46/+146
|
* forward host headerAdam Soltys2026-02-062-2/+2
|
* fix tor loginAdam Soltys2026-02-063-13/+24
|
* strip email from username on loginAdam Soltys2026-01-291-0/+1
|
* fix importAdam Soltys2026-01-272-7/+9
|
* forward ip to backendAdam Soltys2026-01-273-2/+28
|
* fix captcha checksAdam Soltys2026-01-274-38/+38
|
* skip captcha for torAdam Soltys2026-01-274-0/+26
|
* update forgot pageAdam Soltys2026-01-212-50/+5
|
* redirect on invalid tokenAdam Soltys2026-01-215-10/+63
|
* remove challenge codeAdam Soltys2026-01-212-4/+1
|
* remove duplicate loginAdam Soltys2026-01-211-24/+11
|
* move site key to envAdam Soltys2026-01-214-8/+12
|
* captchaAdam Soltys2026-01-217-11/+164
|
* increase default maxfeeAdam Soltys2025-12-101-2/+2
|
* don't fetch locations on homepageAdam Soltys2025-10-141-35/+22
|
* update npubAdam Soltys2025-10-081-1/+1
|
generated by cgit v1.2.3 (git 2.51.0) at 2026-10-28 22:52:14 +0000