fix: access to extensions

lnbits/core/extensions/api.py

@@ -134,12 +134,14 @@ class ExtensionAPI:
         permissions: Iterable[Any],
         *,
         user_id: str | None = None,
+        access_token: str | None = None,
         context: str = "user",
         owner_id: str | None = None,
     ) -> None:
         self.extension_id = extension_id
         self.permissions, self.permission_policies = self._permission_data(permissions)
         self.user_id = user_id
+        self.access_token = access_token
         self.context = context
         self.owner_id = sha256s(user_id) if user_id else owner_id
         self._uuid = secrets.token_urlsafe(12).replace("-", "_")
@@ -434,6 +436,7 @@ class ExtensionAPI:
             self.extension_id,
             policy,
             self.user_id,
+            self.access_token,
             request,
         )
 

lnbits/core/extensions/extension_client.py

@@ -11,7 +11,6 @@ from lnbits.core.crud.extensions import (
     get_installed_extension,
     get_user_active_extensions_ids,
 )
-from lnbits.core.crud.wallets import get_wallets
 from lnbits.settings import settings
 
 from .models import ExtensionApiRequest, HttpResponse
@@ -34,17 +33,19 @@ async def send_extension_api_request(
     caller_extension_id: str,
     policy: dict[str, Any],
     user_id: str | None,
+    access_token: str | None,
     request: ExtensionApiRequest,
 ) -> HttpResponse:
     if not user_id:
         raise PermissionError("Extension API requests require authentication.")
+    if not access_token:
+        raise PermissionError("Extension API requests require an account access token.")
 
     target_extension_id = _target_extension_id(request.extension_id)
     access = _target_extension_access(policy, target_extension_id)
     _require_method_access(caller_extension_id, target_extension_id, access, request)
     await _require_enabled_extension(target_extension_id, user_id)
 
-    api_key = await _user_api_key(user_id, request.method)
     path = _extension_api_path(request.path)
     body = request.body.encode() if request.body is not None else b""
     if len(body) > 65_536:
@@ -60,7 +61,7 @@ async def send_extension_api_request(
             async with client.stream(
                 request.method,
                 url,
-                headers={"X-API-KEY": api_key},
+                headers={"Authorization": f"Bearer {access_token}"},
                 content=body,
             ) as response:
                 response_body = await _read_limited_response(response)
@@ -153,14 +154,6 @@ async def _require_enabled_extension(target_extension_id: str, user_id: str) ->
         )
 
 
-async def _user_api_key(user_id: str, method: str) -> str:
-    wallets = await get_wallets(user_id)
-    if not wallets:
-        raise PermissionError("Extension API request requires a user wallet.")
-    wallet = wallets[0]
-    return wallet.inkey if method in _READ_METHODS else wallet.adminkey
-
-
 def _extension_api_path(path: str) -> str:
     parts = urlsplit(path)
     if parts.scheme or parts.netloc:

lnbits/core/extensions/routes.py

@@ -179,7 +179,9 @@ def _add_wasm_extension_api_route(
         return
 
     async def invoke_wasm_api_request(
-        request: Request, account: Account | None = None
+        request: Request,
+        account: Account | None = None,
+        access_token: str | None = None,
     ) -> dict[str, Any]:
         try:
             payload = await _read_api_payload(request, path_params)
@@ -188,6 +190,7 @@ def _add_wasm_extension_api_route(
                 export_name,
                 payload,
                 user=account,
+                access_token=access_token,
             )
         except KeyError as exc:
             raise HTTPException(status_code=404, detail=str(exc)) from exc
@@ -198,9 +201,10 @@ def _add_wasm_extension_api_route(
 
     async def invoke_private_wasm_extension_export(
         request: Request,
+        access_token: Annotated[str | None, Depends(check_access_token)],
         account: Account = Depends(check_account_exists),
     ) -> dict[str, Any]:
-        return await invoke_wasm_api_request(request, account)
+        return await invoke_wasm_api_request(request, account, access_token)
 
     async def invoke_public_wasm_extension_export(request: Request) -> dict[str, Any]:
         return await invoke_wasm_api_request(request)

lnbits/core/extensions/wasm.py

@@ -21,6 +21,7 @@ async def invoke_wasm_extension_export(
     payload: Mapping[str, Any] | None = None,
     *,
     user: Any | None = None,
+    access_token: str | None = None,
     context: str = "user",
     owner_id: str | None = None,
 ) -> dict[str, Any]:
@@ -30,6 +31,7 @@ async def invoke_wasm_extension_export(
         extension.id,
         permissions,
         user_id=_user_id(user),
+        access_token=access_token,
         context=context,
         owner_id=owner_id,
     )