From 64f510692cd53873cf9a95ac0a2bcd00a6a0e6be Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 27 Sep 2026 14:46:30 -0700 Subject: ecash: carry pasted tokens in the URL instead of storing them server-side The server no longer accepts anonymous token uploads. A pasted token now redirects straight to /ecash/, and the page asks the server for the token's status statelessly. Ids from previously shared links still resolve. Co-Authored-By: Claude Fable 5.1 --- src/routes/(app)/ecash/[id]/[...version]/+layout.server.ts | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'src/routes') diff --git a/src/routes/(app)/ecash/[id]/[...version]/+layout.server.ts b/src/routes/(app)/ecash/[id]/[...version]/+layout.server.ts index 50be6986..e241930e 100644 --- a/src/routes/(app)/ecash/[id]/[...version]/+layout.server.ts +++ b/src/routes/(app)/ecash/[id]/[...version]/+layout.server.ts @@ -1,5 +1,5 @@ import getRates from "$lib/rates"; -import { get } from "$lib/utils"; +import { get, post } from "$lib/utils"; export async function load({ params, parent }) { const { user } = await parent(); @@ -8,7 +8,16 @@ export async function load({ params, parent }) { version ||= 4; version = parseInt(version); - const { token, status } = await get(`/cash/${id}/${version}`); + // A pasted token arrives in the URL itself and is checked statelessly; + // anything else is an id from the share links the server used to hand out. + let token: string; + let status: any; + if (id.startsWith("cashu")) { + token = id; + status = await post("/ecash/status", { token }); + } else { + ({ token, status } = await get(`/cash/${id}/${version}`)); + } const { spent, total, mint, external } = status; return { id, -- cgit v1.2.3