chore: project version bump

hotfix: check for lnbits_site_description setting (#2527 )
* fix: make `lnbits_site_description` optional again
2024-05-22 12:04:56 +03:00 · 2024-05-22 10:53:34 +02:00 · 2024-05-16 15:31:24 +02:00 · 2024-05-16 13:48:58 +01:00 · 2024-05-16 10:05:22 +02:00 · 2024-05-16 09:59:54 +02:00
260 changed files with 34117 additions and 8014 deletions
@@ -9,6 +9,7 @@ lnbits/static/bundle.js
 lnbits/static/bundle.css

 *.md
+!README.md
 *.log

 .env
@@ -0,0 +1,14 @@
+# Top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file, utf-8 charset
+[*]
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+charset = utf-8
+
+[/lnbits/static/vendor/*]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
@@ -1,81 +1,42 @@
 #For more information on .env files, their content and format: https://pypi.org/project/python-dotenv/

-HOST=127.0.0.1
-PORT=5000
+######################################
+########### Admin Settings ###########
+######################################

-# uvicorn variable, uncomment to allow https behind a proxy
-# FORWARDED_ALLOW_IPS="*"
-
-DEBUG=false
-
-# Server security, rate limiting ips, blocked ips, allowed ips
-LNBITS_RATE_LIMIT_NO="200"
-LNBITS_RATE_LIMIT_UNIT="minute"
-LNBITS_ALLOWED_IPS=""
-LNBITS_BLOCKED_IPS=""
-
-# Allow users and admins by user IDs (comma separated list)
-LNBITS_ALLOWED_USERS=""
-LNBITS_ADMIN_USERS=""
-# Extensions only admin can access
-LNBITS_ADMIN_EXTENSIONS="ngrok, admin"
-
-# Enable Admin GUI, available for the first user in LNBITS_ADMIN_USERS if available
-# Warning: Enabling this will make LNbits ignore this configuration file. Your settings will
-# be stored in your database and you will be able to change them only through the Admin UI.
+# Enable Admin GUI, available for the first user in LNBITS_ADMIN_USERS if available.
+# Warning: Enabling this will make LNbits ignore most configurations in file. Only the
+# configurations defined in `ReadOnlySettings` will still be read from the environment variables.
+# The rest of the settings will be stored in your database and you will be able to change them
+# only  through the Admin UI.
 # Disable this to make LNbits use this config file again.
 LNBITS_ADMIN_UI=false

-LNBITS_DEFAULT_WALLET_NAME="LNbits wallet"
-
-# Ad space description
-# LNBITS_AD_SPACE_TITLE="Supported by"
-# csv ad space, format "<url>;<img-light>;<img-dark>, <url>;<img-light>;<img-dark>", extensions can choose to honor
-# LNBITS_AD_SPACE="https://shop.lnbits.com/;https://raw.githubusercontent.com/lnbits/lnbits/main/lnbits/static/images/lnbits-shop-light.png;https://raw.githubusercontent.com/lnbits/lnbits/main/lnbits/static/images/lnbits-shop-dark.png"
-
-# Hides wallet api, extensions can choose to honor
-LNBITS_HIDE_API=false
-
-# LNBITS_EXTENSIONS_MANIFESTS="https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions.json,https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions-trial.json"
-# GitHub has rate-limits for its APIs. The limit can be increased specifying a GITHUB_TOKEN
-# LNBITS_EXT_GITHUB_TOKEN=github_pat_xxxxxxxxxxxxxxxxxx
-
-# Extensions to be installed by default. If an extension from this list is uninstalled then it will be re-installed on the next restart.
-# The extension must be removed from this list in order to not be re-installed.
-LNBITS_EXTENSIONS_DEFAULT_INSTALL="tpos"
-
-# Database: to use SQLite, specify LNBITS_DATA_FOLDER
-#           to use PostgreSQL, specify LNBITS_DATABASE_URL=postgres://...
-#           to use CockroachDB, specify LNBITS_DATABASE_URL=cockroachdb://...
-# for both PostgreSQL and CockroachDB, you'll need to install
-#   psycopg2 as an additional dependency
-LNBITS_DATA_FOLDER="./data"
-# LNBITS_DATABASE_URL="postgres://user:password@host:port/databasename"
-
-LNBITS_SERVICE_FEE="0.0"
-# value in millisats
-LNBITS_RESERVE_FEE_MIN=2000
-# value in percent
-LNBITS_RESERVE_FEE_PERCENT=1.0
-
-# Limit fiat currencies allowed to see in UI
-# LNBITS_ALLOWED_CURRENCIES="EUR, USD"
-
 # Change theme
 LNBITS_SITE_TITLE="LNbits"
 LNBITS_SITE_TAGLINE="free and open-source lightning wallet"
-LNBITS_SITE_DESCRIPTION="Some description about your service, will display if title is not 'LNbits'"
+LNBITS_SITE_DESCRIPTION="The world's most powerful suite of bitcoin tools. Run for yourself, for others, or as part of a stack."
 # Choose from bitcoin, mint, flamingo, freedom, salvador, autumn, monochrome, classic, cyber
 LNBITS_THEME_OPTIONS="classic, bitcoin, flamingo, freedom, mint, autumn, monochrome, salvador, cyber"
 # LNBITS_CUSTOM_LOGO="https://lnbits.com/assets/images/logo/logo.svg"

+HOST=127.0.0.1
+PORT=5000
+
+######################################
+########## Funding Source ############
+######################################
+
 # which fundingsources are allowed in the admin ui
-LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, OpenNodeWallet"
+LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, AlbyWallet, ZBDWallet, PhoenixdWallet, OpenNodeWallet"

 LNBITS_BACKEND_WALLET_CLASS=VoidWallet
 # VoidWallet is just a fallback that works without any actual Lightning capabilities,
 # just so you can see the UI before dealing with this file.

+# How many times to retry connectiong to the Funding Source before defaulting to the VoidWallet
+# FUNDING_SOURCE_MAX_RETRIES=4
+
 # Invoice expiry for LND, CLN, Eclair, LNbits funding sources
 LIGHTNING_INVOICE_EXPIRY=3600

@@ -91,22 +52,27 @@ SPARK_TOKEN=myaccesstoken
 # CoreLightningWallet
 CORELIGHTNING_RPC="/home/bob/.lightning/bitcoin/lightning-rpc"

+# CoreLightningRestWallet
+CORELIGHTNING_REST_URL=http://127.0.0.1:8185/
+CORELIGHTNING_REST_MACAROON="/path/to/clnrest/access.macaroon"  # or BASE64/HEXSTRING
+CORELIGHTNING_REST_CERT="/path/to/clnrest/tls.cert"
+
 # LnbitsWallet
-LNBITS_ENDPOINT=https://legend.lnbits.com
+LNBITS_ENDPOINT=https://demo.lnbits.com
 LNBITS_KEY=LNBITS_ADMIN_KEY

 # LndWallet
 LND_GRPC_ENDPOINT=127.0.0.1
 LND_GRPC_PORT=10009
-LND_GRPC_CERT="/home/bob/.config/Zap/lnd/bitcoin/mainnet/wallet-1/data/chain/bitcoin/mainnet/tls.cert"
-LND_GRPC_MACAROON="/home/bob/.config/Zap/lnd/bitcoin/mainnet/wallet-1/data/chain/bitcoin/mainnet/admin.macaroon or HEXSTRING"
+LND_GRPC_CERT="/home/bob/.lnd/tls.cert"
+LND_GRPC_MACAROON="/home/bob/.lnd/data/chain/bitcoin/mainnet/admin.macaroon"  # or HEXSTRING
 # To use an AES-encrypted macaroon, set
 # LND_GRPC_MACAROON="eNcRyPtEdMaCaRoOn"

 # LndRestWallet
 LND_REST_ENDPOINT=https://127.0.0.1:8080/
-LND_REST_CERT="/home/bob/.config/Zap/lnd/bitcoin/mainnet/wallet-1/data/chain/bitcoin/mainnet/tls.cert"
-LND_REST_MACAROON="/home/bob/.config/Zap/lnd/bitcoin/mainnet/wallet-1/data/chain/bitcoin/mainnet/admin.macaroon or HEXSTRING"
+LND_REST_CERT="/home/bob/.lnd/tls.cert"
+LND_REST_MACAROON="/home/bob/.lnd/data/chain/bitcoin/mainnet/admin.macaroon"  # or HEXSTRING
 # To use an AES-encrypted macaroon, set
 # LND_REST_MACAROON_ENCRYPTED="eNcRyPtEdMaCaRoOn"

@@ -117,6 +83,18 @@ LNPAY_API_KEY=LNPAY_API_KEY
 # Wallet Admin in Wallet Access Keys
 LNPAY_WALLET_KEY=LNPAY_ADMIN_KEY

+# AlbyWallet
+ALBY_API_ENDPOINT=https://api.getalby.com/
+ALBY_ACCESS_TOKEN=ALBY_ACCESS_TOKEN
+
+# ZBDWallet
+ZBD_API_ENDPOINT=https://api.zebedee.io/v0/
+ZBD_API_KEY=ZBD_ACCESS_TOKEN
+
+# PhoenixdWallet
+PHOENIXD_API_ENDPOINT=http://localhost:9740/
+PHOENIXD_API_PASSWORD=PHOENIXD_KEY
+
 # OpenNodeWallet
 OPENNODE_API_ENDPOINT=https://api.opennode.com/
 OPENNODE_KEY=OPENNODE_ADMIN_KEY
@@ -134,7 +112,141 @@ ECLAIR_PASS=eclairpw
 LNTIPS_API_KEY=LNTIPS_ADMIN_KEY
 LNTIPS_API_ENDPOINT=https://ln.tips

-# Cashu Mint
-# Use a long-enough random (!) private key.
-# Once set, you cannot change this key as for now.
-CASHU_PRIVATE_KEY="SuperSecretPrivateKey"
+######################################
+####### Auth Configurations ##########
+######################################
+# Secret Key: will default to the hash of the super user. It is strongly recommended that you set your own value.
+AUTH_SECRET_KEY=""
+AUTH_TOKEN_EXPIRE_MINUTES=525600
+# Possible authorization methods: user-id-only, username-password, google-auth, github-auth, keycloak-auth
+AUTH_ALLOWED_METHODS="user-id-only, username-password"
+# Set this flag if HTTP is used for OAuth
+# OAUTHLIB_INSECURE_TRANSPORT="1"
+
+# Google OAuth Config
+# Make sure that the authorized redirect URIs contain https://{domain}/api/v1/auth/google/token
+GOOGLE_CLIENT_ID=""
+GOOGLE_CLIENT_SECRET=""
+
+# GitHub OAuth Config
+# Make sure that the authorization callback URL is set to https://{domain}/api/v1/auth/github/token
+GITHUB_CLIENT_ID=""
+GITHUB_CLIENT_SECRET=""
+
+# Keycloak OAuth Config
+# Make sure that the valid redirect URIs contain https://{domain}/api/v1/auth/keycloak/token
+KEYCLOAK_CLIENT_ID=""
+KEYCLOAK_CLIENT_SECRET=""
+KEYCLOAK_DISCOVERY_URL=""
+
+
+######################################
+
+# uvicorn variable, uncomment to allow https behind a proxy
+# IMPORTANT: this also needs the webserver to be configured to forward the headers
+# http://docs.lnbits.org/guide/installation.html#running-behind-an-apache2-reverse-proxy-over-https
+# FORWARDED_ALLOW_IPS="*"
+
+# Server security, rate limiting ips, blocked ips, allowed ips
+LNBITS_RATE_LIMIT_NO="200"
+LNBITS_RATE_LIMIT_UNIT="minute"
+LNBITS_ALLOWED_IPS=""
+LNBITS_BLOCKED_IPS=""
+
+# Allow users and admins by user IDs (comma separated list)
+# if set new users will not be able to create accounts
+LNBITS_ALLOWED_USERS=""
+LNBITS_ADMIN_USERS=""
+# ID of the super user. The user ID must exist.
+# SUPER_USER=""
+
+# Extensions only admin can access
+LNBITS_ADMIN_EXTENSIONS="ngrok, admin"
+
+# Start LNbits core only. The extensions are not loaded.
+# LNBITS_EXTENSIONS_DEACTIVATE_ALL=true
+
+# Disable account creation for new users
+# LNBITS_ALLOW_NEW_ACCOUNTS=false
+
+# Enable Node Management without activating the LNBITS Admin GUI
+# by setting the following variables to true.
+LNBITS_NODE_UI=false
+LNBITS_PUBLIC_NODE_UI=false
+# Enabling the transactions tab can cause crashes on large Core Lightning nodes.
+LNBITS_NODE_UI_TRANSACTIONS=false
+
+LNBITS_DEFAULT_WALLET_NAME="LNbits wallet"
+
+# Ad space description
+# LNBITS_AD_SPACE_TITLE="Supported by"
+# csv ad space, format "<url>;<img-light>;<img-dark>, <url>;<img-light>;<img-dark>", extensions can choose to honor
+# LNBITS_AD_SPACE="https://shop.lnbits.com/;https://raw.githubusercontent.com/lnbits/lnbits/main/lnbits/static/images/lnbits-shop-light.png;https://raw.githubusercontent.com/lnbits/lnbits/main/lnbits/static/images/lnbits-shop-dark.png"
+# LNBITS_SHOW_HOME_PAGE_ELEMENTS=true # if set to true, the ad space will be displayed on the home page
+# LNBITS_CUSTOM_BADGE="USE WITH CAUTION - LNbits wallet is still in BETA"
+# LNBITS_CUSTOM_BADGE_COLOR="warning"
+
+# Hides wallet api, extensions can choose to honor
+LNBITS_HIDE_API=false
+
+# LNBITS_EXTENSIONS_MANIFESTS="https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions.json,https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions-trial.json"
+# GitHub has rate-limits for its APIs. The limit can be increased specifying a GITHUB_TOKEN
+# LNBITS_EXT_GITHUB_TOKEN=github_pat_xxxxxxxxxxxxxxxxxx
+
+# Path where extensions will be installed (defaults to `./lnbits/`).
+# Inside this directory the `extensions` and `upgrades` sub-directories will be created.
+# LNBITS_EXTENSIONS_PATH="/path/to/some/dir"
+
+# Extensions to be installed by default. If an extension from this list is uninstalled then it will be re-installed on the next restart.
+# The extension must be removed from this list in order to not be re-installed.
+LNBITS_EXTENSIONS_DEFAULT_INSTALL="tpos"
+
+# Database: to use SQLite, specify LNBITS_DATA_FOLDER
+#           to use PostgreSQL, specify LNBITS_DATABASE_URL=postgres://...
+#           to use CockroachDB, specify LNBITS_DATABASE_URL=cockroachdb://...
+# for both PostgreSQL and CockroachDB, you'll need to install
+#   psycopg2 as an additional dependency
+LNBITS_DATA_FOLDER="./data"
+# LNBITS_DATABASE_URL="postgres://user:password@host:port/databasename"
+
+# the service fee (in percent)
+LNBITS_SERVICE_FEE=0.0
+# the wallet where fees go to
+# LNBITS_SERVICE_FEE_WALLET=
+# the maximum fee per transaction (in satoshis)
+# LNBITS_SERVICE_FEE_MAX=1000
+# disable fees for internal transactions
+# LNBITS_SERVICE_FEE_IGNORE_INTERNAL=true
+
+# value in millisats
+LNBITS_RESERVE_FEE_MIN=2000
+# value in percent
+LNBITS_RESERVE_FEE_PERCENT=1.0
+
+# limit the maximum balance for each wallet
+# throw an error if the wallet attempts to create a new invoice
+
+# LNBITS_WALLET_LIMIT_MAX_BALANCE=1000000
+# LNBITS_WALLET_LIMIT_DAILY_MAX_WITHDRAW=1000000
+# LNBITS_WALLET_LIMIT_SECS_BETWEEN_TRANS=60
+
+# Limit fiat currencies allowed to see in UI
+# LNBITS_ALLOWED_CURRENCIES="EUR, USD"
+
+######################################
+###### Logging and Development #######
+######################################
+
+DEBUG=false
+DEBUG_DATABASE=false
+BUNDLE_ASSETS=true
+
+# logging into LNBITS_DATA_FOLDER/logs/
+ENABLE_LOG_TO_FILE=true
+
+# https://loguru.readthedocs.io/en/stable/api/logger.html#file
+LOG_ROTATION="100 MB"
+LOG_RETENTION="3 months"
+
+# for database cleanup commands
+# CLEANUP_WALLETS_DAYS=90
@@ -1 +1 @@
-custom: https://legend.lnbits.com/paywall/GAqKguK5S8f6w5VNjS9DfK
+custom: https://demo.lnbits.com/lnurlp/link/fH59GD
@@ -7,10 +7,10 @@ inputs:
    default: "3.9"
  poetry-version:
    description: "Poetry Version"
-    default: "1.5.1"
+    default: "1.7.0"
  node-version:
    description: "Node Version"
-    default: "18.x"
+    default: "20.x"
  npm:
    description: "use npm"
    default: false
@@ -21,7 +21,7 @@ runs:
  using: "composite"
  steps:
    - name: Set up Python ${{ inputs.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
      with:
        python-version: ${{ inputs.python-version }}
        # cache poetry install via pip
@@ -38,7 +38,7 @@ runs:
        poetry config virtualenvs.create true --local
        poetry config virtualenvs.in-project true --local

-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
      name: Define a cache for the virtual environment based on the dependencies lock file
      with:
        path: ./.venv
@@ -50,11 +50,11 @@ runs:

    - name: Use Node.js ${{ inputs.node-version }}
      if: ${{ (inputs.npm == 'true') }}
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}

-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
      if: ${{ (inputs.npm == 'true') }}
      name: Define a cache for the npm based on the dependencies lock file
      with:
@@ -1,12 +1,18 @@
 name: LNbits CI
-on: [push, pull_request]
+on:
+  push:
+    branches:
+      - main
+      - dev
+  pull_request:
+

 jobs:

  lint:
    uses: ./.github/workflows/lint.yml

-  tests:
+  test-api:
    needs: [ lint ]
    strategy:
      matrix:
@@ -14,17 +20,48 @@ jobs:
        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
+      custom-pytest: "poetry run pytest tests/api"
      python-version: ${{ matrix.python-version }}
+      db-url: ${{ matrix.db-url }}
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

-  migrations:
+  test-wallets:
    needs: [ lint ]
    strategy:
      matrix:
-        python-version: ["3.9"]
+        python-version: ["3.9", "3.10"]
+        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
    uses: ./.github/workflows/tests.yml
    with:
-      make: test-migration
-      db-name: migration
+      custom-pytest: "poetry run pytest tests/wallets"
+      python-version: ${{ matrix.python-version }}
+      db-url: ${{ matrix.db-url }}
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  test-unit:
+    needs: [ lint ]
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.10"]
+        db-url: ["", "postgres://lnbits:lnbits@0.0.0.0:5432/lnbits"]
+    uses: ./.github/workflows/tests.yml
+    with:
+      custom-pytest: "poetry run pytest tests/unit"
+      python-version: ${{ matrix.python-version }}
+      db-url: ${{ matrix.db-url }}
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  migration:
+    needs: [ lint ]
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.10"]
+    uses: ./.github/workflows/migration.yml
+    with:
+      python-version: ${{ matrix.python-version }}

  openapi:
    needs: [ lint ]
@@ -32,9 +69,6 @@ jobs:
    with:
      make: openapi

-  # docker:
-  #   uses: ./.github/workflows/docker.yml
-
  regtest:
    needs: [ lint ]
    uses: ./.github/workflows/regtest.yml
@@ -43,5 +77,19 @@ jobs:
        python-version: ["3.9"]
        backend-wallet-class: ["LndRestWallet", "LndWallet", "CoreLightningWallet", "CoreLightningRestWallet", "LNbitsWallet", "EclairWallet"]
    with:
+      custom-pytest: "poetry run pytest tests/regtest"
      python-version: ${{ matrix.python-version }}
      backend-wallet-class: ${{ matrix.backend-wallet-class }}
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  jmeter:
+    needs: [ lint ]
+    strategy:
+      matrix:
+        python-version: ["3.9"]
+        poetry-version: ["1.5.1"]
+    uses: ./.github/workflows/jmeter.yml
+    with:
+      python-version: ${{ matrix.python-version }}
+      poetry-version: ${{ matrix.poetry-version }}
@@ -2,9 +2,9 @@ name: codeql

 on:
  push:
-    branches: [main, ]
+    branches: [main, dev]
  pull_request:
-    branches: [main]
+    branches: [main, dev]
  schedule:
    - cron: '0 12 * * 5'

@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
        with:
          fetch-depth: 2
      - run: git checkout HEAD^2
@@ -1,20 +1,53 @@
 name: docker

 on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        default: latest
+        type: string
  workflow_call:
+    inputs:
+      tag:
+        default: latest
+        type: string
+    secrets:
+      DOCKER_USERNAME:
+        required: true
+      DOCKER_PASSWORD:
+        required: true

 jobs:
-  docker:
+  push_to_dockerhub:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
+
+      - name: Cache Docker layers
+        uses: actions/cache@v4
+        id: cache
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+
      - name: Build and push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
        with:
            context: .
-            push: false
-            tags: lnbitsdocker/lnbits-legend:latest
-            cache-from: type=registry,ref=lnbitsdocker/lnbits-legend:latest
-            cache-to: type=inline
+            push: true
+            tags: ${{ secrets.DOCKER_USERNAME }}/lnbits:${{ inputs.tag }}
+            platforms: linux/amd64,linux/arm64
+            cache-from: type=local,src=/tmp/.buildx-cache
+            cache-to: type=local,dest=/tmp/.buildx-cache
@@ -0,0 +1,53 @@
+name: JMeter Extension Tests
+
+on:
+  workflow_call:
+    inputs:
+      python-version:
+        description: "Python Version"
+        required: true
+        default: "3.9"
+        type: string
+      poetry-version:
+        description: "Poetry Version"
+        required: true
+        default: "1.5.1"
+        type: string
+
+jobs:
+  jmeter:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ./.github/actions/prepare
+        with:
+          python-version: ${{ inputs.python-version }}
+
+      - name: run LNbits
+        env:
+          LNBITS_ADMIN_UI: true
+          LNBITS_EXTENSIONS_DEFAULT_INSTALL: "watchonly, satspay, tipjar, tpos, lnurlp, withdraw"
+          LNBITS_BACKEND_WALLET_CLASS: FakeWallet
+        run: |
+          poetry run lnbits &
+          sleep 5
+
+      - name: clone lnbits-extensions, install jmeter and run tests
+        run: |
+          git clone https://github.com/lnbits/lnbits-extensions
+          cd lnbits-extensions
+          mkdir logs
+          mkdir reports
+          make install-jmeter
+          make start-mirror-server
+          make test
+
+      - name: upload jmeter test results
+        uses: actions/upload-artifact@v4
+        if: ${{ always() }}
+        with:
+          name: jmeter-extension-test-results
+          path: |
+            lnbits-extensions/reports/
+            lnbits-extensions/logs/
@@ -3,25 +3,53 @@ on:
  workflow_call:

 jobs:
+
  black:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.10"]
    with:
      make: checkblack
+      python-version: ${{ matrix.python-version }}
+
  ruff:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.10"]
    with:
      make: checkruff
+      python-version: ${{ matrix.python-version }}
+
  mypy:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.10"]
    with:
      make: mypy
+      python-version: ${{ matrix.python-version }}
+
  pyright:
    uses: ./.github/workflows/make.yml
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.10"]
    with:
      make: pyright
+      python-version: ${{ matrix.python-version }}
      npm: true
+
+
  prettier:
    uses: ./.github/workflows/make.yml
    with:
-      make: prettier
+      make: checkprettier
+      npm: true
+
+  bundle:
+    uses: ./.github/workflows/make.yml
+    with:
+      make: checkbundle
      npm: true
@@ -11,21 +11,24 @@ on:
        description: "use npm install"
        default: false
        type: boolean
+      python-version:
+        description: "python version"
+        type: string
+        default: "3.10"

 jobs:
  make:
-    name: ${{ inputs.make }} (${{ matrix.python-version }})
+    name: ${{ inputs.make }} (${{ inputs.python-version }})
    strategy:
      matrix:
        os-version: ["ubuntu-latest"]
-        python-version: ["3.9", "3.10"]
        node-version: ["18.x"]
    runs-on: ${{ matrix.os-version }}
    steps:
-      - uses: actions/checkout@v3
-      - uses: ./.github/actions/prepare
+      - uses: actions/checkout@v4
+      - uses: lnbits/lnbits/.github/actions/prepare@dev
        with:
-          python-version: ${{ matrix.python-version }}
+          python-version: ${{ inputs.python-version }}
          node-version: ${{ matrix.node-version }}
          npm: ${{ inputs.npm }}
      - run: make ${{ inputs.make }}
@@ -0,0 +1,37 @@
+name: migration
+
+on:
+  workflow_call:
+    inputs:
+      python-version:
+        description: "python version"
+        type: string
+        default: "3.10"
+
+jobs:
+  make:
+    name: migration (${{ inputs.python-version }})
+    strategy:
+      matrix:
+        os-version: ["ubuntu-latest"]
+    runs-on: ${{ matrix.os-version }}
+    services:
+      postgres:
+        image: postgres:latest
+        env:
+          POSTGRES_USER: lnbits
+          POSTGRES_PASSWORD: lnbits
+          POSTGRES_DB: migration
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/prepare
+        with:
+          python-version: ${{ inputs.python-version }}
+      - run: make test-migration
@@ -0,0 +1,41 @@
+name: LNbits CI / nix
+
+# - run   : on main, dev, nix and cachix branches when relevant files change
+# - cache : on main, dev and cachix branches when relevant files change
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+      - nix
+      - cachix
+    paths:
+      - 'flake.nix'
+      - 'flake.lock'
+      - 'pyproject.toml'
+      - 'poetry.lock'
+      - '.github/workflows/nix.yml'
+  pull_request:
+    paths:
+      - 'flake.nix'
+      - 'flake.lock'
+      - 'pyproject.toml'
+      - 'poetry.lock'
+
+jobs:
+  nix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v24
+        with:
+          nix_path: nixpkgs=channel:nixos-23.11
+      - uses: cachix/cachix-action@v13
+        if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/cachix'
+        with:
+          name: lnbits
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+      - run: nix build -L
+      - run: cachix push lnbits ./result
+        if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/cachix'
@@ -1,69 +0,0 @@
-name: Build and push Docker image on tag
-
-env:
-  DOCKER_CLI_EXPERIMENTAL: enabled
-
-on:
-  push:
-    tags:
-      - "[0-9]+.[0-9]+.[0-9]+"
-      - "[0-9]+.[0-9]+.[0-9]+.[0-9]+"
-      - "[0-9]+.[0-9]+.[0-9]+-*"
-
-jobs:
-  build:
-    runs-on: ubuntu-20.04
-    name: Build and push lnbits image
-    steps:
-      - name: Login to Docker Hub
-        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
-
-      - name: Checkout project
-        uses: actions/checkout@v3
-
-      - name: Import environment variables
-        id: import-env
-        shell: bash
-        run: echo "TAG=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
-
-      - name: Show set environment variables
-        run: |
-          printf "    TAG: %s\n"  "$TAG"
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
-        id: qemu
-
-      - name: Setup Docker buildx action
-        uses: docker/setup-buildx-action@v1
-        id: buildx
-
-      - name: Show available Docker buildx platforms
-        run: echo ${{ steps.buildx.outputs.platforms }}
-
-      - name: Cache Docker layers
-        uses: actions/cache@v2
-        id: cache
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-
-
-      - name: Run Docker buildx against tag
-        run: |
-            docker buildx build \
-            --cache-from "type=local,src=/tmp/.buildx-cache" \
-            --cache-to "type=local,dest=/tmp/.buildx-cache" \
-            --platform linux/amd64,linux/arm64 \
-            --tag ${{ secrets.DOCKER_USERNAME }}/lnbits-legend:${TAG} \
-            --output "type=registry" ./
-
-      - name: Run Docker buildx against latest
-        run: |
-            docker buildx build \
-            --cache-from "type=local,src=/tmp/.buildx-cache" \
-            --cache-to "type=local,dest=/tmp/.buildx-cache" \
-            --platform linux/amd64,linux/arm64 \
-            --tag ${{ secrets.DOCKER_USERNAME }}/lnbits-legend:latest \
-            --output "type=registry" ./
@@ -3,8 +3,9 @@ name: regtest
 on:
  workflow_call:
    inputs:
-      make:
-        default: test
+      custom-pytest:
+        description: "Custom pytest arguments"
+        required: true
        type: string
      python-version:
        default: "3.9"
@@ -15,27 +16,21 @@ on:
      backend-wallet-class:
        required: true
        type: string
+    secrets:
+      CODECOV_TOKEN:
+        required: true

 jobs:
  regtest:
    runs-on: ${{ inputs.os-version }}
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

-      - name: Set up Docker Buildx
+      - name: docker build
        if: ${{ inputs.backend-wallet-class == 'LNbitsWallet' }}
-        uses: docker/setup-buildx-action@v2
-
-      - name: Build and push
-        if: ${{ inputs.backend-wallet-class == 'LNbitsWallet' }}
-        uses: docker/build-push-action@v4
-        with:
-            context: .
-            push: false
-            tags: lnbitsdocker/lnbits-legend:latest
-            cache-from: type=registry,ref=lnbitsdocker/lnbits-legend:latest
-            cache-to: type=inline
+        run: |
+          docker build -t lnbits/lnbits .

      - name: Setup Regtest
        run: |
@@ -49,11 +44,8 @@ jobs:
        with:
          python-version: ${{ inputs.python-version }}

-      - name: Create fake admin
-        if: ${{ inputs.backend-wallet-class == 'LNbitsWallet' }}
-        run: docker exec lnbits-legend-lnbits-1 poetry run python tools/create_fake_admin.py
-
-      - name: Run Tests
+      - name: Run pytest
+        uses: pavelzw/pytest-action@v2
        env:
          LNBITS_DATABASE_URL: ${{ inputs.db-url }}
          LNBITS_BACKEND_WALLET_CLASS: ${{ inputs.backend-wallet-class }}
@@ -72,10 +64,24 @@ jobs:
          LNBITS_KEY: "d08a3313322a4514af75d488bcc27eee"
          ECLAIR_URL: http://127.0.0.1:8082
          ECLAIR_PASS: lnbits
-        run: make test-real-wallet
+          PYTHONUNBUFFERED: 1
+          DEBUG: true
+        with:
+          verbose: true
+          job-summary: true
+          emoji: false
+          click-to-expand: true
+          custom-pytest: ${{ inputs.custom-pytest }}
+          report-title: "regtest (${{ inputs.python-version }}, ${{ inputs.backend-wallet-class }}"

      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
          file: ./coverage.xml
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
+
+      - name: docker lnbits logs
+        if: ${{ inputs.backend-wallet-class == 'LNbitsWallet' }}
+        run: |
+          docker logs lnbits-lnbits-1
@@ -0,0 +1,41 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create github release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ github.ref_name }}
+        run: |
+          gh release create "$tag" --generate-notes --draft
+
+  docker:
+    needs: [ release ]
+    uses: ./.github/workflows/docker.yml
+    with:
+      tag: ${{ github.ref_name }}
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+
+  pypi:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build and publish to pypi
+        uses: JRubics/poetry-publish@v1.15
+        with:
+          pypi_token: ${{ secrets.PYPI_API_KEY }}
@@ -3,8 +3,9 @@ name: tests
 on:
  workflow_call:
    inputs:
-      make:
-        default: test
+      custom-pytest:
+        description: "Custom pytest arguments"
+        required: true
        type: string
      python-version:
        default: "3.9"
@@ -18,6 +19,9 @@ on:
      db-name:
        default: "lnbits"
        type: string
+    secrets:
+      CODECOV_TOKEN:
+        required: true

 jobs:
  tests:
@@ -39,20 +43,30 @@ jobs:
          --health-retries 5

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

      - uses: ./.github/actions/prepare
        with:
          python-version: ${{ inputs.python-version }}

-      - name: Run Tests
+      - name: Run pytest
+        uses: pavelzw/pytest-action@v2
        env:
          LNBITS_DATABASE_URL: ${{ inputs.db-url }}
          LNBITS_BACKEND_WALLET_CLASS: FakeWallet
-        run: make ${{ inputs.make }}
+          PYTHONUNBUFFERED: 1
+          DEBUG: true
+        with:
+          verbose: true
+          job-summary: true
+          emoji: false
+          click-to-expand: true
+          custom-pytest: ${{ inputs.custom-pytest }}
+          report-title: "test (${{ inputs.python-version }}, ${{ inputs.db-url }})"

      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
          file: ./coverage.xml
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: false
@@ -11,6 +11,7 @@ __pycache__
 *.egg
 *.egg-info
 .coverage
+.coverage.*
 .pytest_cache
 .webassets-cache
 htmlcov
@@ -23,7 +24,6 @@ tests/data/*.sqlite3
 *.pyc
 *.env
 .env
-.super_user
 .pre-commit-config.yaml

 data
@@ -36,6 +36,8 @@ coverage.xml
 node_modules
 lnbits/static/bundle.js
 lnbits/static/bundle.css
+lnbits/static/bundle.min.js.old
+lnbits/static/bundle.min.css.old
 docker

 # Nix
@@ -49,3 +51,6 @@ lnbits-backup.zip
 # Ignore extensions (post installable extension PR)
 extensions
 upgrades/
+
+# builded python package
+dist
@@ -14,16 +14,16 @@ repos:
      - id: mixed-line-ending
      - id: check-case-conflict
  - repo: https://github.com/psf/black
-    rev: 23.7.0
+    rev: 24.2.0
    hooks:
      - id: black
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.0.283
+    rev: v0.3.2
    hooks:
      - id: ruff
        args: [ --fix, --exit-non-zero-on-fix ]
  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: '50c5478ed9e10bf360335449280cf2a67f4edb7a'
+    rev: "v4.0.0-alpha.8"
    hooks:
      - id: prettier
        types_or: [css, javascript, html, json]
@@ -11,3 +11,7 @@
 **/lnbits/static/vendor
 **/lnbits/static/bundle.*
 **/lnbits/static/css/*
+
+flake.lock
+
+.venv
@@ -1,16 +1,17 @@
-FROM python:3.10-slim-bullseye
+FROM python:3.10-slim-bookworm

 RUN apt-get clean
 RUN apt-get update
-RUN apt-get install -y curl pkg-config build-essential
+RUN apt-get install -y curl pkg-config build-essential libnss-myhostname

 RUN curl -sSL https://install.python-poetry.org | python3 -
 ENV PATH="/root/.local/bin:$PATH"

 # needed for backups postgresql-client version 14 (pg_dump)
-RUN apt-get install -y apt-utils wget
-RUN echo "deb http://apt.postgresql.org/pub/repos/apt bullseye-pgdg main" > /etc/apt/sources.list.d/pgdg.list
-RUN wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
+RUN apt install -y postgresql-common ca-certificates
+RUN install -d /usr/share/postgresql-common/pgdg
+RUN curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
+RUN sh -c 'echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
 RUN apt-get update
 RUN apt-get install -y postgresql-client-14

@@ -4,10 +4,12 @@ all: format check

 format: prettier black ruff

-check: mypy pyright checkblack checkruff checkprettier
+check: mypy pyright checkblack checkruff checkprettier checkbundle
+
+test: test-unit test-wallets test-api test-regtest

 prettier:
-	poetry run ./node_modules/.bin/prettier --write lnbits
+	poetry run ./node_modules/.bin/prettier --write .

 pyright:
 	poetry run ./node_modules/.bin/pyright
@@ -25,41 +27,52 @@ checkruff:
 	poetry run ruff check .

 checkprettier:
-	poetry run ./node_modules/.bin/prettier --check lnbits
+	poetry run ./node_modules/.bin/prettier --check .

 checkblack:
 	poetry run black --check .

+checkeditorconfig:
+	editorconfig-checker
+
 dev:
 	poetry run lnbits --reload

-test:
+test-wallets:
 	LNBITS_BACKEND_WALLET_CLASS="FakeWallet" \
-	FAKE_WALLET_SECRET="ToTheMoon1" \
-	LNBITS_DATA_FOLDER="./tests/data" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
-	poetry run pytest
+	poetry run pytest tests/wallets

-test-real-wallet:
-	LNBITS_DATA_FOLDER="./tests/data" \
+test-unit:
+	LNBITS_BACKEND_WALLET_CLASS="FakeWallet" \
 	PYTHONUNBUFFERED=1 \
 	DEBUG=true \
-	poetry run pytest
+	poetry run pytest tests/unit
+
+test-api:
+	LNBITS_BACKEND_WALLET_CLASS="FakeWallet" \
+	PYTHONUNBUFFERED=1 \
+	DEBUG=true \
+	poetry run pytest tests/api
+
+test-regtest:
+	PYTHONUNBUFFERED=1 \
+	DEBUG=true \
+	poetry run pytest tests/regtest

 test-migration:
-	rm -rf ./migration-data
-	mkdir -p ./migration-data
-	unzip tests/data/mock_data.zip -d ./migration-data
+	LNBITS_ADMIN_UI=True \
+	make test-api
 	HOST=0.0.0.0 \
 	PORT=5002 \
-	LNBITS_DATA_FOLDER="./migration-data" \
+	LNBITS_DATA_FOLDER="./tests/data" \
 	timeout 5s poetry run lnbits --host 0.0.0.0 --port 5002 || code=$?; if [[ $code -ne 124 && $code -ne 0 ]]; then exit $code; fi
 	HOST=0.0.0.0 \
 	PORT=5002 \
 	LNBITS_DATABASE_URL="postgres://lnbits:lnbits@localhost:5432/migration" \
 	timeout 5s poetry run lnbits --host 0.0.0.0 --port 5002 || code=$?; if [[ $code -ne 124 && $code -ne 0 ]]; then exit $code; fi
-	LNBITS_DATA_FOLDER="./migration-data" \
+	LNBITS_DATA_FOLDER="./tests/data" \
 	LNBITS_DATABASE_URL="postgres://lnbits:lnbits@localhost:5432/migration" \
 	poetry run python tools/conv.py

@@ -94,9 +107,16 @@ bundle:
 	npm run vendor_minify_css
 	npm run vendor_bundle_js
 	npm run vendor_minify_js
-	# increment serviceworker version
-	sed -i -e "s/CACHE_VERSION =.*/CACHE_VERSION = $$(awk '/CACHE_VERSION =/ { print 1+$$4 }' lnbits/core/static/js/service-worker.js)/" \
-		lnbits/core/static/js/service-worker.js
+
+checkbundle:
+	cp lnbits/static/bundle.min.js lnbits/static/bundle.min.js.old
+	cp lnbits/static/bundle.min.css lnbits/static/bundle.min.css.old
+	make bundle
+	diff -q lnbits/static/bundle.min.js lnbits/static/bundle.min.js.old || exit 1
+	diff -q lnbits/static/bundle.min.css lnbits/static/bundle.min.css.old || exit 1
+	@echo "Bundle is OK"
+	rm lnbits/static/bundle.min.js.old
+	rm lnbits/static/bundle.min.css.old

 install-pre-commit-hook:
 	@echo "Installing pre-commit hook to git"
@@ -1,17 +1,16 @@
-# LNbits
+<picture >
+  <source media="(prefers-color-scheme: dark)" srcset="https://i.imgur.com/QE6SIrs.png"  style="width:300px">
+  <img src="https://i.imgur.com/fyKPgVT.png" style="width:300px">
+</picture>

-[![license-badge]](LICENSE)
-[![docs-badge]][docs]
+![phase: beta](https://img.shields.io/badge/phase-beta-C41E3A) [![license-badge]](LICENSE) [![docs-badge]][docs] ![PRs: welcome](https://img.shields.io/badge/PRs-Welcome-08A04B) [<img src="https://img.shields.io/badge/community_chat-Telegram-24A1DE">](https://t.me/lnbits) [<img src="https://img.shields.io/badge/supported_by-%3E__OpenSats-f97316">](https://opensats.org)
+![Lightning network wallet](https://i.imgur.com/DeIiO0y.png)

-![Lightning network wallet](https://i.imgur.com/EHvK6Lq.png)
+# The world's most powerful suite of bitcoin tools.

-# LNbits v0.10 BETA, free and open-source Lightning wallet accounts system
+## Run for yourself, for others, or as part of a stack.

-(Join us on [https://t.me/lnbits](https://t.me/lnbits))
-
-LNbits is beta, for responsible disclosure of any concerns please contact lnbits@pm.me
-
-Use [legend.lnbits.com](https://legend.lnbits.com), or run your own LNbits server!
+LNbits is beta, for responsible disclosure of any concerns please contact an admin in the community chat.

 LNbits is a Python server that sits on top of any funding source. It can be used as:

@@ -21,9 +20,9 @@ LNbits is a Python server that sits on top of any funding source. It can be used
 - Fallback wallet for the LNURL scheme
 - Instant wallet for LN demonstrations

-LNbits can run on top of any Lightning funding source. It supports LND, CLN, Eclair, Spark, LNpay, OpenNode, LightningTipBot, and with more being added regularly.
+LNbits can run on top of almost all Lightning funding sources.

-See [LNbits Wiki](https://github.com/lnbits/lnbits/wiki/) for more detailed documentation.
+See [LNbits manual](https://docs.lnbits.org/guide/wallets.html) for more detailed documentation about each funding source.

 Checkout the LNbits [YouTube](https://www.youtube.com/playlist?list=PLPj3KCksGbSYG0ciIQUWJru1dWstPHshe) video series.

@@ -31,40 +30,45 @@ LNbits is inspired by all the great work of [opennode.com](https://www.opennode.

 ## Running LNbits

+Test on our demo server [demo.lnbits.com](https://demo.lnbits.com), or on [lnbits.com](https://lnbits.com) software as a service, where you can spin up an LNbits instance for 21sats per hr.
+
 See the [install guide](https://github.com/lnbits/lnbits/blob/main/docs/guide/installation.md) for details on installation and setup.

-## LNbits as an account system
+## LNbits account system

-LNbits is packaged with tools to help manage funds, such as a table of transactions, line chart of spending, export to csv + more to come..
+LNbits is packaged with tools to help manage funds, such as a table of transactions, line chart of spending, export to csv. Each wallet also comes with its own API keys, to help partition the exposure of your funding source.

-![Lightning network wallet](https://i.imgur.com/w8jdGpF.png)
+<img src="https://i.imgur.com/w8jdGpF.png" style="width:800px">

-Each wallet also comes with its own API keys, to help partition the exposure of your funding source.
+## LNbits extension universe

-(LNbits M5StackSats available here https://github.com/arcbtc/M5StackSats)
+Extend YOUR LNbits to meet YOUR needs.

-![lnurl ATM](https://i.imgur.com/WfCg8wY.png)
+All non-core features are installed as extensions, reducing your code base and making your LNbits unique to you. Extend your LNbits install in any direction, and even create and share your own extensions.

-## LNbits as an LNURL-withdraw fallback
+<img src="https://i.imgur.com/aEBpwJF.png" style="width:800px">

-LNURL has a fallback scheme, so if scanned by a regular QR code reader it can default to a URL. LNbits exploits this to generate an instant wallet using the [LNURL-withdraw](https://github.com/btcontract/lnurl-rfc/blob/master/lnurl-withdraw.md).
+## LNbits API

-![lnurl fallback](https://i.imgur.com/CPBKHIv.png)
+LNbits has a powerful API, many projects use LNbits to do the heavy lifting for their bitcoin/lightning services.

-Using **lnbits.com/?lightning="LNURL-withdraw"** will trigger a withdraw that builds an LNbits wallet.
-Example use would be an ATM, which utilises LNURL, if the user scans the QR with a regular QR code scanner app, they will still be able to access the funds.
+<img src="https://i.imgur.com/V742sb9.png" style="width:800px">

-![lnurl ATM](https://i.imgur.com/Gi6bn3L.jpg)
+## LNbits node manager

-## LNbits as an instant wallet
+LNbits comes packaged with a light node management UI, to make running your node that much easier.

-Wallets can be easily generated and given out to people at events. "Go to this website", has a lot less friction than "Download this app".
+<img src="https://i.imgur.com/TYqIK60.png" style="width:800px">

-![lnurl ATM](https://i.imgur.com/xFWDnwy.png)
+## LNbits across all your devices
+
+As well as working great in a browser, LNbits has native IoS and Android apps as well as a chrome extension. So you can enjoy the same UI across ALL your devices.
+
+<img src="https://i.imgur.com/J96EbRf.png" style="width:800px">

 ## Tip us

-If you like this project [send some tip love](https://legend.lnbits.com/paywall/GAqKguK5S8f6w5VNjS9DfK)!
+If you like this project [send some tip love](https://demo.lnbits.com/lnurlp/link/fH59GD)!

 [docs]: https://github.com/lnbits/lnbits/wiki
 [docs-badge]: https://img.shields.io/badge/docs-lnbits.org-673ab7.svg
@@ -1 +1 @@
-docs.lnbits.org
+docs.lnbits.org
@@ -1,7 +1,7 @@
 title: "LNbits docs"
 remote_theme: pmarsceill/just-the-docs
 color_scheme: dark
-logo: "/logos/lnbits-full--inverse.png"
+logo: "/logos/lnbits-full-inverse.png"
 search_enabled: true
 url: https://docs.lnbits.org
 aux_links:
@@ -5,8 +5,6 @@ title: API reference
 nav_order: 3
 ---

+# API reference

-API reference
-=============
-
-[Swagger Docs](https://docs.lnbits.org/devs/swagger.html)
+[Swagger Docs](https://demo.lnbits.com/docs)
@@ -5,30 +5,27 @@ nav_order: 4
 has_children: true
 ---

-
-For developers
-==============
+# For developers

 Thanks for contributing :)

-
-Run
-=====
+# Run

 This starts the lnbits uvicorn server
+
 ```bash
 poetry run lnbits
 ```

 This starts the lnbits uvicorn with hot reloading.
+
 ```bash
 make dev
 # or
 poetry run lnbits --reload
 ```

-Precommit hooks
-=====
+# Precommit hooks

 This ensures that all commits adhere to the formatting and linting rules.

@@ -36,31 +33,35 @@ This ensures that all commits adhere to the formatting and linting rules.
 make install-pre-commit-hook
 ```

-Tests
-=====
+# Tests

 This project has unit tests that help prevent regressions. Before you can run the tests, you must install a few dependencies:
+
 ```bash
 poetry install
 npm i
 ```

 Then to run the tests:
+
 ```bash
 make test
 ```

 Run formatting:
+
 ```bash
 make format
 ```

 Run mypy checks:
+
 ```bash
 poetry run mypy
 ```

 Run everything:
+
 ```bash
 make all
 ```
@@ -5,33 +5,42 @@ title: Making extensions
 nav_order: 2
 ---

+# Extension set up

-Making extensions
-=================
+Start off by creating a fork of the [example extension](https://github.com/lnbits/example) into own GitHub repository and rename the repository to `mysuperplugin`:

-Start off by cloning the [example extension](https://github.com/lnbits/example) into your `lnbits/extensions` folder and renaming it to `mysuperplugin`:
 ```sh
-cd lnbits/extensions
-git clone https://github.com/lnbits/example.git --depth=1 mysuperplugin # Let's not use dashes or anything; it doesn't like those.
+cd [my-working-folder]
+git clone https://github.com/[my-user-name]/mysuperplugin.git --depth=1 # Let's not use dashes or anything; it doesn't like those.
 cd mysuperplugin
 rm -rf .git/
 find . -type f -print0 | xargs -0 sed -i 's/example/mysuperplugin/g' # Change all occurrences of 'example' to your plugin name 'mysuperplugin'.
 mv templates/example templates/mysuperplugin # Rename templates folder.
 ```
+
 - if you are on macOS and having difficulty with 'sed', consider `brew install gnu-sed` and use 'gsed', without -0 option after xargs.

-Going over the example extension's structure:
-* views_api.py: This is where your public API would go. It will be exposed at "$DOMAIN/$PLUGIN/$ROUTE". For example: https://lnbits.com/mysuperplugin/api/v1/tools.
-* views.py: The `/` path will show up as your plugin's home page in lnbits' UI. Other pages you can define yourself. The `templates` folder should explain itself in relation to this.
-* migrations.py: Create database tables for your plugin. They'll be created automatically when you start lnbits.
+1. Edit `manifest.json` and change the organisation name to your GitHub username.
+1. Push your changes to GitHub.
+1. In GitHub create a new release for your extension repo. Tag the release with `0.0.1`
+1. Copy the URL of the extension's raw `manifest.json` URL `https://raw.githubusercontent.com/[my-user-name]/mysuperplugin/master/manifest.json`
+1. If you are using the LMNbits Admin UI, go to the Admin UI > Server > Extension Sources, click "Add", paste the URL, then click "Save"
+1. If you are configuring LNbits via environment variables, add the URL to the .env file's `LNBITS_EXTENSIONS_MANIFESTS` variable. Restart the LNbits python process
+1. You will now see your extension in the LNbits > Extensions list. Click "Enable" to enable it.
+1. ...
+1. Profit!!!
+
+## Extension structure explained
+
+- views_api.py: This is where your public API would go. It will be exposed at "$DOMAIN/$PLUGIN/$ROUTE". For example: https://lnbits.com/mysuperplugin/api/v1/tools.
+- views.py: The `/` path will show up as your plugin's home page in lnbits' UI. Other pages you can define yourself. The `templates` folder should explain itself in relation to this.
+- migrations.py: Create database tables for your plugin. They'll be created automatically when you start lnbits.

 ... This document is a work-in-progress. Send pull requests if you get stuck, so others don't.

+## Adding new dependencies

-Adding new dependencies
-----------------------
-
-DO NOT ADD NEW DEPENDENCIES. Try to use the dependencies that are availabe in `pyproject.toml`. Getting the LNbits project to accept a new dependency is time consuming and uncertain, and may result in your extension NOT being made available to others.
+DO NOT ADD NEW DEPENDENCIES. Try to use the dependencies that are available in `pyproject.toml`. Getting the LNbits project to accept a new dependency is time consuming and uncertain, and may result in your extension NOT being made available to others.

 If for some reason your extensions must have a new python package to work, and its nees are not met in `pyproject.toml`, you can add a new package using `poerty`:

@@ -40,11 +49,9 @@ $ poetry add <package>
 ```

 **But we need an extra step to make sure LNbits doesn't break in production.**
-Dependencies need to be added to `pyproject.toml`, then tested by running on `poetry` compatability can be tested with `nix build .#checks.x86_64-linux.vmTest`.
+Dependencies need to be added to `pyproject.toml`, then tested by running on `poetry` compatibility can be tested with `nix build .#checks.x86_64-linux.vmTest`.

-
-SQLite to PostgreSQL migration
-----------------------
+## SQLite to PostgreSQL migration

 LNbits currently supports SQLite and PostgreSQL databases. There is a migration script `tools/conv.py` that helps users migrate from SQLite to PostgreSQL. This script also copies all extension databases to the new backend.

@@ -53,22 +60,31 @@ LNbits currently supports SQLite and PostgreSQL databases. There is a migration
 `mock_data.zip` contains a few lines of sample SQLite data and is used in automated GitHub test to see whether your migration in `conv.py` works. Run your extension and save a few lines of data into a SQLite `your_extension.sqlite3` file. Unzip `tests/data/mock_data.zip`, add `your_extension.sqlite3`, updated `database.sqlite3` and zip it again. Add the updated `mock_data.zip` to your PR.

 ### running migration locally
+
 you will need a running postgres database

 #### create lnbits user for migration database
+
 ```console
 sudo su - postgres -c "psql -c 'CREATE ROLE lnbits LOGIN PASSWORD 'lnbits';'"
 ```
+
 #### create migration database
+
 ```console
 sudo su - postgres -c "psql -c 'CREATE DATABASE migration;'"
 ```
+
 #### run the migration
+
 ```console
 make test-migration
 ```
+
 sudo su - postgres -c "psql -c 'CREATE ROLE lnbits LOGIN PASSWORD 'lnbits';'"
+
 #### clean migration database afterwards, fails if you try again
+
 ```console
 sudo su - postgres -c "psql -c 'DROP DATABASE IF EXISTS migration;'"
 ```
@@ -1,29 +1,32 @@
 <html>
-    <head>
-        <!-- Load the latest Swagger UI code and style from npm using unpkg.com -->
-        <script src="https://unpkg.com/swagger-ui-dist@3/swagger-ui-bundle.js"></script>
-        <link rel="stylesheet" type="text/css" href="https://unpkg.com/swagger-ui-dist@3/swagger-ui.css"/>
-        <title>My New API</title>
-    </head>
-    <body>
-        <div id="swagger-ui"></div> <!-- Div to hold the UI component -->
-        <script>
-            window.onload = function () {
-                // Begin Swagger UI call region
-                const ui = SwaggerUIBundle({
-                    url: "https://legend.lnbits.com/openapi.json", //Location of Open API spec in the repo
-                    dom_id: '#swagger-ui',
-                    deepLinking: true,
-                    presets: [
-                        SwaggerUIBundle.presets.apis,
-                        SwaggerUIBundle.SwaggerUIStandalonePreset
-                    ],
-                    plugins: [
-                        SwaggerUIBundle.plugins.DownloadUrl
-                    ],
-                })
-                window.ui = ui
-            }
-        </script>
-    </body>
+  <head>
+    <!-- Load the latest Swagger UI code and style from npm using unpkg.com -->
+    <script src="https://unpkg.com/swagger-ui-dist@3/swagger-ui-bundle.js"></script>
+    <link
+      rel="stylesheet"
+      type="text/css"
+      href="https://unpkg.com/swagger-ui-dist@3/swagger-ui.css"
+    />
+    <title>My New API</title>
+  </head>
+  <body>
+    <div id="swagger-ui"></div>
+    <!-- Div to hold the UI component -->
+    <script>
+      window.onload = function () {
+        // Begin Swagger UI call region
+        const ui = SwaggerUIBundle({
+          url: 'https://demo.lnbits.com/openapi.json', //Location of Open API spec in the repo
+          dom_id: '#swagger-ui',
+          deepLinking: true,
+          presets: [
+            SwaggerUIBundle.presets.apis,
+            SwaggerUIBundle.SwaggerUIStandalonePreset
+          ],
+          plugins: [SwaggerUIBundle.plugins.DownloadUrl]
+        })
+        window.ui = ui
+      }
+    </script>
+  </body>
 </html>
@@ -5,14 +5,11 @@ title: Websockets
 nav_order: 2
 ---

+# Websockets

-Websockets
-=================
-
-`websockets` are a great way to add a two way instant data channel between server and client. 
-
-LNbits has a useful in built websocket tool. With a websocket client connect to (obv change `somespecificid`) `wss://legend.lnbits.com/api/v1/ws/somespecificid` (you can use an online websocket tester). Now make a get to `https://legend.lnbits.com/api/v1/ws/somespecificid/somedata`. You can send data to that websocket by using `from lnbits.core.services import websocketUpdater` and the function `websocketUpdater("somespecificid", "somdata")`.
+`websockets` are a great way to add a two way instant data channel between server and client.

+LNbits has a useful in built websocket tool. With a websocket client connect to (obv change `somespecificid`) `wss://demo.lnbits.com/api/v1/ws/somespecificid` (you can use an online websocket tester). Now make a get to `https://demo.lnbits.com/api/v1/ws/somespecificid/somedata`. You can send data to that websocket by using `from lnbits.core.services import websocketUpdater` and the function `websocketUpdater("somespecificid", "somdata")`.

 Example vue-js function for listening to the websocket:

@@ -4,17 +4,15 @@ title: Admin UI
 nav_order: 4
 ---

+# Admin UI

-Admin UI
-========
 The LNbits Admin UI lets you change LNbits settings via the LNbits frontend.
-It is disabled by default and the first time you set the environment variable LNBITS_ADMIN_UI=true
+It is disabled by default and the first time you set the environment variable `LNBITS_ADMIN_UI=true`
 the settings are initialized and saved to the database and will be used from there as long the UI is enabled.
 From there on the settings from the database are used.

+# Super User

-Super User
-==========
 With the Admin UI we introduced the super user, it is created with the initialisation of the Admin UI and will be shown with a success message in the server logs.
 The super user has access to the server and can change settings that may crash the server and make it unresponsive via the frontend and api, like changing funding sources.

@@ -29,45 +27,52 @@ We also added a decorator for the API routes to check for super user.

 There is also the possibility of posting the super user via webhook to another service when it is created. you can look it up here https://github.com/lnbits/lnbits/blob/main/lnbits/settings.py `class SaaSSettings`

+# Admin Users

-Admin Users
-===========
-environment variable: LNBITS_ADMIN_USERS, comma-separated list of user ids
-Admin Users can change settings in the admin ui as well, with the exception of funding source settings, because they require e server restart and could potentially make the server inaccessable. Also they have access to all the extension defined in LNBITS_ADMIN_EXTENSIONS.
+environment variable: `LNBITS_ADMIN_USERS`, comma-separated list of user ids
+Admin Users can change settings in the admin ui as well, with the exception of funding source settings, because they require e server restart and could potentially make the server inaccessible. Also they have access to all the extension defined in `LNBITS_ADMIN_EXTENSIONS`.

+# Allowed Users

-Allowed Users
-=============
-environment variable: LNBITS_ALLOWED_USERS, comma-separated list of user ids
+environment variable: `LNBITS_ALLOWED_USERS`, comma-separated list of user ids
 By defining this users, LNbits will no longer be usable by the public, only defined users and admins can then access the LNbits frontend.

+Setting this environment variable also disables account creation.
+Account creation can be also disabled by setting `LNBITS_ALLOW_NEW_ACCOUNTS=false`
+
+# How to activate

-How to activate
-=============
 ```
 $ sudo systemctl stop lnbits.service
-$ cd ~/lnbits-legend
+$ cd ~/lnbits
 $ sudo nano .env
 ```
+
 -> set: `LNBITS_ADMIN_UI=true`

 Now start LNbits once in the terminal window
-``` 
-$ poetry run lnbits 
+
 ```
+$ poetry run lnbits
+```
+
 You can now `cat` the Super User ID:
+
 ```
-$ cat .super_user
+$ cat data/.super_user
 123de4bfdddddbbeb48c8bc8382fe123
 ```
+
 You can access your super user account at `/wallet?usr=super_user_id`. You just have to append it to your normal LNbits web domain.

-After that you will find the __`Admin` / `Manage Server`__ between `Wallets` and `Extensions`
+After that you will find the **`Admin` / `Manage Server`** between `Wallets` and `Extensions`

 Here you can design the interface, it has TOPUP to fill wallets and you can restrict access rights to extensions only for admins or generally deactivated for everyone. You can make users admins or set up Allowed Users if you want to restrict access. And of course the classic settings of the .env file, e.g. to change the funding source wallet or set a charge fee.

 Do not forget
+
 ```
 sudo systemctl start lnbits.service
 ```
+
 A little hint, if you set `RESET TO DEFAULTS`, then a new Super User Account will also be created. The old one is then no longer valid.
@@ -10,16 +10,16 @@ Go to `Manage Server` > `Server` > `Extensions Manifests`

 ![image](https://user-images.githubusercontent.com/2951406/213494038-e8152d8e-61f2-4cb7-8b5f-361fc3f9a31f.png)

-
 An `Extension Manifest` is a link to a `JSON` file which contains information about various extensions that can be installed (repository of extensions).
 Multiple repositories can be configured. For more information check the [Manifest File](https://github.com/lnbits/lnbits/blob/main/docs/guide/extension-install.md#manifest-file) section.

+**LNbits** administrators should configure their instances to use repositories that they trust (like the [lnbits-extensions](https://github.com/lnbits/lnbits-extensions/) one).

-**LNbits** administrators should configure their instances to use repositories that they trust (like the [lnbits-extensions](https://github.com/lnbits/lnbits-extensions/) one). 
 > **Warning**
 > Extensions can have bugs or malicious code, be careful what you install!!

 ## Install New Extension
+
 Only administrator users can install or upgrade extensions.

 Go to `Manage Extensions` > `Add Remove Extensions`
@@ -40,18 +40,17 @@ Click the `Manage` button in order to install a particular release of the extens
 Select the version to be installed (usually the last one) and click `Install`. One can also check the `Release Notes` first.

 > **Note**:
-> 
+>
 > For Github repository: the order of the releases is the one in the GitHub releases page
-> 
+>
 > For Explicit Release: the order of the releases is the one in the "extensions" object

-
 The extension has been installed but it cannot be accessed yet. In order to activate the extension toggle it in the `Activated` state.

 Go to `Manage Extensions` (as admin user or regular user). Search for the extension and enable it.

-
 ## Uninstall Extension
+
 On the `Install` page click `Manage` for the extension you want to uninstall:
 ![image](https://user-images.githubusercontent.com/2951406/213653194-32cbb1da-dcc8-43cf-8a82-1ec5d2d3dc16.png)

@@ -65,6 +64,7 @@ Users will no longer be able to access the extension.
 > The database for the extension is not removed. If the extension is re-installed later, the data will be accessible.

 ## Manifest File
+
 The manifest file is just a `JSON` file that lists a collection of extensions that can be installed. This file is of the form:

 ```json
@@ -77,30 +77,32 @@ The manifest file is just a `JSON` file that lists a collection of extensions th
 There are two ways to specify installable extensions:

 ### Explicit Release
+
 It goes under the `extensions` object and it is of the form:
+
 ```json
-        {
-            "id": "lnurlp",
-            "name": "LNURL Pay Links",
-            "version": 1,
-            "shortDescription": "Upgrade to version 111111111",
-            "icon": "receipt",
-            "details": "All charge names should be <code>111111111</code>. API panel must show: <br>",
-            "archive": "https://github.com/lnbits/lnbits-extensions/raw/main/new/lnurlp/1/lnurlp.zip",
-            "hash": "a22d02de6bf306a7a504cd344e032cc6d48837a1d4aeb569a55a57507bf9a43a",
-            "htmlUrl": "https://github.com/lnbits/lnbits-extensions/tree/main/new/lnurlp/1",
-            "infoNotification": "This is a very old version",
-            "dependencies": ["other-ext-id"]
-        }
+{
+  "id": "lnurlp",
+  "name": "LNURL Pay Links",
+  "version": 1,
+  "shortDescription": "Upgrade to version 111111111",
+  "icon": "receipt",
+  "details": "All charge names should be <code>111111111</code>. API panel must show: <br>",
+  "archive": "https://github.com/lnbits/lnbits-extensions/raw/main/new/lnurlp/1/lnurlp.zip",
+  "hash": "a22d02de6bf306a7a504cd344e032cc6d48837a1d4aeb569a55a57507bf9a43a",
+  "htmlUrl": "https://github.com/lnbits/lnbits-extensions/tree/main/new/lnurlp/1",
+  "infoNotification": "This is a very old version",
+  "dependencies": ["other-ext-id"]
+}
 ```

 <details><summary>Fields Detailed Description</summary>

 | Field                | Type          |           | Description                                                                                                                                                          |
-|----------------------|---------------|-----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| id                   | string        | mandatory | The ID of the extension. Must be unique for each extension. It is also used as the path in the URL.                                                                          |
+| -------------------- | ------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| id                   | string        | mandatory | The ID of the extension. Must be unique for each extension. It is also used as the path in the URL.                                                                  |
 | name                 | string        | mandatory | User friendly name for the extension. It will be displayed on the installation page.                                                                                 |
-| version              | string        | mandatory | Version of this release. [Semantic versioning](https://semver.org/) is recommended.                                                                                   |
+| version              | string        | mandatory | Version of this release. [Semantic versioning](https://semver.org/) is recommended.                                                                                  |
 | shortDescription     | string        | optional  | A few words about the extension. It will be displayed on the installation page.                                                                                      |
 | icon                 | string        | optional  | quasar valid icon name                                                                                                                                               |
 | details              | string (html) | optional  | Details about this particular release                                                                                                                                |
@@ -109,31 +111,30 @@ It goes under the `extensions` object and it is of the form:
 | htmlUrl              | string        | optional  | Link to the extension home page.                                                                                                                                     |
 | infoNotification     | string        | optional  | Users that have this release installed will see a info message for their extension. For example if the extension support will be terminated soon.                    |
 | criticalNotification | string        | optional  | Reserved for urgent notifications. The admin user will receive a message each time it visits the `Install` page. One example is if the extension has a critical bug. |
-| dependencies         | list          | optional  | A list of extension IDs. It signals that those extensions must be installed BEFORE the this one can be installed.   
+| dependencies         | list          | optional  | A list of extension IDs. It signals that those extensions must be installed BEFORE the this one can be installed.                                                    |

 </details>

 This mode has the advantage of strictly specifying what releases of an extension can be installed.
-    
+
 ### GitHub Repository
+
 It goes under the `repos` object and it is of the form:

 ```json
 {
-    "id": "withdraw",
-    "organisation": "lnbits",
-    "repository": "withdraw-extension"
+  "id": "withdraw",
+  "organisation": "lnbits",
+  "repository": "withdraw-extension"
 }
 ```

-| Field        | Type   | Description                                           |
-|--------------|--------|-------------------------------------------------------|
-| id           | string | The ID of the extension. Must be unique for each extension. It is also used as the path in the URL.                               |
-| organisation | string | The GitHub organisation (eg: `lnbits`)                |
-| repository   | string | The GitHub repository name (eg: `withdraw-extension`) |
+| Field        | Type   | Description                                                                                         |
+| ------------ | ------ | --------------------------------------------------------------------------------------------------- |
+| id           | string | The ID of the extension. Must be unique for each extension. It is also used as the path in the URL. |
+| organisation | string | The GitHub organisation (eg: `lnbits`)                                                              |
+| repository   | string | The GitHub repository name (eg: `withdraw-extension`)                                               |

 The admin user will see all releases from the Github repository:

 ![image](https://user-images.githubusercontent.com/2951406/213508934-11de5ae5-2045-471c-854b-94b6acbf4434.png)
-
-
@@ -4,10 +4,10 @@ title: FAQ
 nav_order: 5
 ---

-
 # FAQ - Frequently Asked Questions

 ## Install options
+
 <ul><p>LNbits is not a node management software but a ⚡️LN only accounting system on top of a funding source.</p>

 <details><summary>Funding my LNbits wallet from my node it doesn't work.</summary>
@@ -19,24 +19,24 @@ allow-self-payment=1
 ```

 </details>
-  
+
 <details><summary>Funding source only available via tor (e.g. Start9 or Umbrel)</summary>
  <p>If you want your setup to stay behind tor then only apps, pos and wallets that have tor activated can communicate with your wallets. Most likely you will have trouble when people try to redeem your voucher through onion or when importing your lnbits wallets into a wallet-app that doesnt support tor. If you plan to let LNbits wallets interact with plain internet shops and services you should consider <a href="https://github.com/TrezorHannes/Dual-LND-Hybrid-VPS">setting up hybrid mode for your node</a>.</p>
 </details>
-    
+
 <details><summary>Funding source is in a cloud</summary>
  <p>This means that you might not have access to some files which would allow certain administrative functions. E.g. on <a href="https://voltage.cloud/">Voltage</a> lnd.conf can not be edited. Payments from your node to LNbits wallets can therefore not be configurated in this case atm so you will need to take an extra wallet to send from funding source->wallet x->LNbits wallet (only) for the initial funding of the wallet.</p>
 </details>
-    
+
 <details><summary>LNbits via clearnet domain</summary>
  <p><a href="https://github.com/TrezorHannes/Dual-LND-Hybrid-VPS">Step by step guide how to convert your Tor only node</a> into a clearnet node to make apps like LNbits accessible via https.</p>
 </details>
-    
+
 <details><summary>Which funding sources can I use for LNbits?</summary>
  <p>There are several ways to run a LNbits instance funded from different sources. It is important to choose a source that has a good liquidity and good peers connected. If you use LNbits for public services your users´ payments can then flow happily in both directions. If you would like to fund your LNbits wallet via btc please see section Troubleshooting.</p>
-  <p>The <a href="http://docs.lnbits.org/guide/wallets.html">LNbits manual</a> shows you which sources can be used and how to configure each: CLN, LND, LNPay, Cliche, OpenNode as well as bots.</p>
+  <p>The <a href="https://docs.lnbits.org/guide/wallets.html">LNbits manual</a> shows you which sources can be used and how to configure each.</p>
 </details>
-    
+
 <!--Later to be added
 <details><summary>Advanced setup options</summary>
  <p>more text coming soon...</p>
@@ -47,13 +47,14 @@ allow-self-payment=1
  <p>When you run your LNbits in clearnet basically everyone can generate a wallet on it. Since the funds of your node are bound to these wallets you might want to prevent that. There are two ways to do so:</p>
  <ul>
   <li>Configure allowed users & extensions <a href="https://github.com/lnbits/lnbits/blob/main/.env.example">in the .env file</a></li>
-   <li>Configure allowed users & extensions <a href="https://github.com/lnbits/usermanager">via the Usermanager-Extension</a>. You can find <a href="http://docs.lnbits.org/guide/admin_ui.html">more info about the superuser and the admin extension here</a></li>
+   <li>Configure allowed users & extensions <a href="https://github.com/lnbits/usermanager">via the Usermanager-Extension</a>. You can find <a href="https://docs.lnbits.org/guide/admin_ui.html">more info about the superuser and the admin extension here</a></li>
  </ul>
  <p>Please note that all entries in the .env file will not be the taken into account once you activated the admin extension.</p>
 </details>
  </ul>

 ## Troubleshooting
+
 <ul><details><summary>Message "https error" or network error" when scanning a LNbits QR</summary>
 <p>Bad news, this is a routing error that might have quite a lot of reasons. Let´s try a few of the most possible problems and their solutions. First choose your setup</p>
  <ul>
@@ -61,7 +62,7 @@ allow-self-payment=1
      <details><summary>LNbits is running via Tor only, you can't open it on a public domain like lnbits.yourdomain.com</summary>
        <ul>
        <li>Given that you want your setup to stay like this open your LNbits wallet using the .onion URI and create it again. In this way the QR is generated to be accessible via this .onion URI so via tor only. Do not generate that QR from a .local URI, because it will not be reachable via internet - only from within your home-LAN.</li>
-        <li>Open your LN wallet app that you used to scan that QR and this time by using tor (see wallet app settings). 
+        <li>Open your LN wallet app that you used to scan that QR and this time by using tor (see wallet app settings).
          If the app doesn't offer tor, you can use Orbot (Android) instead. See section Installation->Clearnet for detailed instructions.</li>
        </ul>
      </details>
@@ -70,7 +71,7 @@ allow-self-payment=1
      <details><summary>LNbits is running via Tor only, you want to offer public LN services via https</summary>
       <ul>
       <li>For this we need to partially open LNbits to a clearnet (domain/IP) through a https SSL certificate. Follow the instructions from <a href="https://docs.lnbits.org/guide/installation.html#reverse-proxy-with-automatic-https-using-caddy">this LNbits caddy installation instruction</a>.
-        You need to have a domain and to be able to configure a CNAME for your DNS record as well as generate a subdomain dedicated to your LNbits instance like eg. lnbits.yourdomain.com. 
+        You need to have a domain and to be able to configure a CNAME for your DNS record as well as generate a subdomain dedicated to your LNbits instance like eg. lnbits.yourdomain.com.
        You also need access to your internet router to open the https port (usually 443) and forward it your LNbits IP within your LAN (usually 80). The ports might depend on your node implementation if those ports do not work please ask for them in a help group of your node supplier.</li>
       <li>You can also follow the Apache installation option, explained in the <a href="https://docs.lnbits.org/guide/installation.html#running-behind-an-apache2-reverse-proxy-over-https">LNbits installation manual</a>.</li>
       <li>If you run LNbits from a bundle node (myNode, Start9, Umbrel,Raspiblitz etc), you can follow <a href="https://github.com/TrezorHannes/vps-lnbits">this extensive guide</a> with many options to switch your Tor only LNbits into a clearnet LNbits. For Citadel there is a HTTPS Option in your manual to activate https for LNbits in the newest version.</li>
@@ -83,15 +84,15 @@ allow-self-payment=1
 <details><summary>Wallet-URL deleted, are my funds safu ?</summary>
    <ul>
      <li>
-        <details><summary>Wallet on demo server legend.lnbits</summary>
+        <details><summary>Wallet on demo server demo.lnbits.com</summary>
        <p>Always save a copy of your wallet-URL, Export2phone-QR or LNDhub for your own wallets in a safe place. LNbits CANNOT help you to recover them when lost.</p>
        </details>
      </li>
      <li>
        <details><summary>Wallet on your own funding source/node</summary>
-        <p>Always save a copy of your wallet-URL, Export2phone-QR or LNDhub for your own wallets in a safe place. 
-           You can find all LNbits users and wallet-IDs in your LNbits user manager extension or in your sqlite database. 
-           To edit or read the LNbits database, go to the LNbits /data folder and look for the file called sqlite.db. 
+        <p>Always save a copy of your wallet-URL, Export2phone-QR or LNDhub for your own wallets in a safe place.
+           You can find all LNbits users and wallet-IDs in your LNbits user manager extension or in your sqlite database.
+           To edit or read the LNbits database, go to the LNbits /data folder and look for the file called sqlite.db.
           You can open and edit it with excel or with a dedicated SQL-Editor like <a href="https://sqlitebrowser.org/">SQLite browser</a>.</p>
        </details>
      </li>
@@ -100,7 +101,7 @@ allow-self-payment=1

 <details><summary>Configure a comment that people see when paying to my LNURLp QR</summary>
  <p>When you create a LNURL-p, by default the comment box is not filled. That means comments are not allowed to be attached to payments.<p>
-  <p>In order to allow comments, add the characters lenght of the box, from 1 to 250. Once you put a number there, 
+  <p>In order to allow comments, add the characters length of the box, from 1 to 250. Once you put a number there,
     the comment box will be displayed in the payment process. You can also edit a LNURL-p already created and add that number.</p>

 ![lnbits-lnurl-comment.png](https://i.postimg.cc/HkJQ9xKr/lnbits-lnurl-comment.png)
@@ -113,16 +114,16 @@ allow-self-payment=1
    <li>
      <details><summary>A - Via an external swap service</summary>
        <p>If the user do not have full access of your LNbits, is just an external user, can use swap services like <a href="https://boltz.exchange/">Boltz</a>, <a href="https://fixedfloat.com/">FixedFloat</a>, <a href="https://swap.diamondhands.technology/">DiamondHands</a> or <a href="https://zigzag.io/">ZigZag</a>.</p>
-        <p>This is useful if you provide only LNURL/LN invoices from your LNbits instance, but a payer only has onchain sats so 
+        <p>This is useful if you provide only LNURL/LN invoices from your LNbits instance, but a payer only has onchain sats so
           they will have to the swap those sats first on their side.</p>
        <p>The procedure is simple: user sends onchain btc to the swap service and provides the LNURL / LN invoice from LNbits as destination of the swap.</p>
      </details>
    </li>
    <li>
      <details><summary>B - Using the Onchain LNbits extension</summary>
-        <p>Keep in mind that this is a separate wallet, not the LN btc one that is represented by LNbits as "your wallet" upon your LN funding source. 
-           This onchain wallet can be used also to swap LN btc to (e.g. your hardwarewallet) by using the LNbits Boltz or Deezy extension. 
-           If you run a webshop that is linked to your LNbits for LN payments, it is very handy to regularly drain all the sats from LN into onchain. 
+        <p>Keep in mind that this is a separate wallet, not the LN btc one that is represented by LNbits as "your wallet" upon your LN funding source.
+           This onchain wallet can be used also to swap LN btc to (e.g. your hardwarewallet) by using the LNbits Boltz or Deezy extension.
+           If you run a webshop that is linked to your LNbits for LN payments, it is very handy to regularly drain all the sats from LN into onchain.
           This leads to more space in your LN channels to be able to receive new fresh sats.</p>
        <p>Procedure:</p>
          <ul>
@@ -130,32 +131,31 @@ allow-self-payment=1
          <li>Go to wallet information and copy the xpub</li>
          <li>Go to LNbits - Onchain extension and create a new watch-only wallet with that xpub</li>
          <li>Go to LNbits - Tipjar extension and create a new Tipjar. Select also the onchain option besides the LN wallet.</li>
-          <li>Optional - Go to LNbits - SatsPay extension and create a new charge for onchain btc. 
+          <li>Optional - Go to LNbits - SatsPay extension and create a new charge for onchain btc.
              You can choose between onchain and LN or both. It will then create    an invoice that can be shared.</li>
-          <li>Optional - If you use your LNbits linked to a Wordpress + Woocommerce page, once you create/link a watch-only wallet to your LN btc shop wallet, 
+          <li>Optional - If you use your LNbits linked to a Wordpress + Woocommerce page, once you create/link a watch-only wallet to your LN btc shop wallet,
              the customer will have both options to pay on the same screen.</li>
          </ul>
        </details>
    </li>
  </ul>
 </details>
-   
+
 <details><summary>Where can I see payment details?</summary>
-  <p>When you receive a payment in LNbits, the transaction log will display only a resumed type of the transaction. 
+  <p>When you receive a payment in LNbits, the transaction log will display only a resumed type of the transaction.

 ![lnbits-tx-log.png](https://i.postimg.cc/gk2FMFG9/lnbits-tx-log.png)

  <p>In your transaction overview you will find a little green arrow for received and a red arrow for sended funds.<p>
  <p>If you click on those arrows, a details popup shows attached messages as well as the sender´s name if given.</p>
 </details>
- 
+
  <details><summary>Can I configure a name to the payments i make?</summary>
-  <p>In LNbits this is currently not possible to do - but to receive. This is only possible if the sender's LN wallet supports <a href="https://github.com/lnurl/luds">LUD-18</a> (nameDesc) like e.g. <a href="https://darthcoin.substack.com/p/obw-open-bitcoin-wallet">Open Bitcion Wallet - OBW</a> does. You will then see an alias/pseudonym in the details section of your LNbits transactions (click the arrows). Note that you can give any name there and it might not be related to the real sender´s name(!) if your receive such.</p>
+  <p>In LNbits this is currently not possible to do - but to receive. This is only possible if the sender's LN wallet supports <a href="https://github.com/lnurl/luds">LUD-18</a> (nameDesc) like e.g. <a href="https://darthcoin.substack.com/p/obw-open-bitcoin-wallet">Open Bitcoin Wallet - OBW</a> does. You will then see an alias/pseudonym in the details section of your LNbits transactions (click the arrows). Note that you can give any name there and it might not be related to the real sender´s name(!) if your receive such.</p>
 ![lnbits-tx-details.png](https://i.postimg.cc/yYnvyK4w/lnbits-tx-details.png)
  </p>
  </details>

-
 <details><summary>How can I use a LNbits lndhub account in other wallet apps?</summary>
  <p>Open your LNbits with the account / wallet you want to use, go to "manage extensions" and activate the <a href="https://github.com/lnbits/lndhub">LNDHUB extension</a>.</p>
  <p>Then open the LNDHUB extension, choose the wallet you want to use and scan the QR code you want to use: "admin" or "invoice only", depending on the security level you want for that wallet.</p>
@@ -166,12 +166,13 @@ allow-self-payment=1
  </ul>

 ## Building hardware tools
+
 <ul>  <p>LNbits has all sorts of open APIs and tools to program and connect to a lot of different devices for a gazillion of use-cases. Let us know what you did with it ! Come to the <a href="https://t.me/makerbits">Makerbits Telegram Group</a> if you are interested in building or if you need help with a project - we got you!</p>

 <details><summary>ATM - deposit and withdraw in your shop or at your meetup</summary>
  <p>This is a do-it-yourself project consisting of a mini-computer (Raspberry Pi Zero), a coin acceptor, a display, a 3D printed case, and a Bitcoin Lightning wallet as a funding source. It exchanges fiat coins for valuable Bitcoin Lightning ⚡ Satoshis. The user can pick up the Satoshis via QR code (LNURL-withdraw) on a mobile phone wallet. You can get the components as individual parts and build the case yourself e.g. from <a href="https://www.Fulmo.org">Fulmo</a> who also made a <a href="https://blog.fulmo.org/the-lightningatm-pocket-edition/">guide</a> on it. The shop offers payments in Bitcoin and Lightning ⚡. The code can be found on <a href="https://github.com/21isenough/LightningATM">the ATM github project page></a>.</p>
 </details>
-  
+
 <details><summary>POS Terminal - an offline terminal for merchants</summary>
  <p>The LNpos is a self-sufficient point of sale terminal which allows offline onchain payments and an offline Lightning ATM for withdrawals. Free and open source software, free from intermediaries, with integrated battery, WLAN, DIY. You can get the 3D print as well as the whole kit from the LNbits shop from 👇 Resources. It allows
    <li>LNPoS Online interactive Lightning payments</li>
@@ -183,21 +184,21 @@ allow-self-payment=1
      </p>
 </p>
 </details>
-    
+
 <details><summary>Hardware Wallet- build your own, stack harder</summary>
 <p>The hardwarewallet is a very cheap solution for builders. The projects´ <a hrel="https://github.com/lnbits/hardware-wallet">code and installation instructions for the LNbits hardware wallet can be found on github</a></p>
  <p>
    <img width="546" alt="Bildschirmfoto 2023-01-20 um 18 08 37" src="https://user-images.githubusercontent.com/63317640/213760948-38fd77b0-9247-4505-9433-f5af1b223527.png">
  </p>
 </details>
-    
+
 <details><summary>Bitcoin Switch - turn things on with bitcoin</summary>
  <p>Candy dispenser, vending machines (online), grabbing machines, jukeboxes, bandits and <a href="https://github.com/cryptoteun/awesome-lnbits">all sorts of other things have already been build with LNbits´ tools</a>. Further info see 👇 Resources.</p>
 <p>
  <img width="549" alt="Bildschirmfoto 2023-01-20 um 18 11 55" src="https://user-images.githubusercontent.com/63317640/213761646-d25d4745-e50d-4389-98e5-f83237a8cf6b.png">
  </p>
 </details>
-    
+
 <details><summary>Vending machine (offline)</summary>
 <p>This code works similar to the LNpos. Note that the <a href=" https://www.youtube.com/watch?v=Fg0UuuzsYXc&t=762s">setup-video for the vending machine</a> misses the new way of installing it via the new LNURLdevices extension. The <a href="https://github.com/arcbtc/LNURLVend">vending machine project code resides on github</a>.</p>
  <p>
@@ -216,6 +217,7 @@ allow-self-payment=1
  </ul>

 ## Use cases of LNbits
+
 <ul><details><summary>Merchant</summary>
  <p>LNbits is a powerful solution for merchants, due to the easy setup with various extensions, that can be used for many scenarios.</p>
  <p><a href="https://darthcoin.substack.com/p/lnbits-for-small-merchants">Here is an overview of the LNbits tools available for a small restaurant as well as a hotel</a></p>
@@ -262,7 +264,8 @@ allow-self-payment=1
 </ul>

 ## Developing for LNbits
- <ul> 
-    <li><a href="http://docs.lnbits.org/devs/development.html">Making Estension / how to use Websockets / API reference</a></li>
+
+ <ul>
+    <li><a href="https://docs.lnbits.org/devs/development.html">Making extensions / How to use Websockets / API reference</a></li>
    <li><a href="https://t.me/lnbits">Telegram LNbits Support Group</a></li></ul>
 </ul>
@@ -1,19 +1,23 @@
-
 ## Defining a route with path parameters
+
 **old:**
+
 ```python
-# with <> 
+# with <>
@offlineshop_ext.route("/lnurl/<item_id>", methods=["GET"])
 ```

 **new:**
+
 ```python
 # with curly braces: {}
@offlineshop_ext.get("/lnurl/{item_id}")
 ```

 ## Check if a user exists and access user object
+
 **old:**
+
 ```python
 # decorators
@check_user_exists()
@@ -24,36 +28,43 @@ async def do_routing_stuff():
 **new:**
 If user doesn't exist, `Depends(check_user_exists)` will raise an exception.
 If user exists, `user` will be the user object
+
 ```python
 # depends calls
@core_html_routes.get("/my_route")
 async def extensions(user: User = Depends(check_user_exists)):
    pass
 ```
+
 ## Returning data from API calls
+
 **old:**
+
 ```python
 return (
    {
-        "id": wallet.wallet.id, 
-        "name": wallet.wallet.name, 
+        "id": wallet.wallet.id,
+        "name": wallet.wallet.name,
        "balance": wallet.wallet.balance_msat
    },
    HTTPStatus.OK,
 )
 ```
+
 FastAPI returns `HTTPStatus.OK` by default id no Exception is raised

 **new:**
+
 ```python
 return {
-    "id": wallet.wallet.id, 
-    "name": wallet.wallet.name, 
+    "id": wallet.wallet.id,
+    "name": wallet.wallet.name,
    "balance": wallet.wallet.balance_msat
 }
 ```

 To change the default HTTPStatus, add it to the path decorator
+
 ```python
@core_app.post("/api/v1/payments", status_code=HTTPStatus.CREATED)
 async def payments():
@@ -61,7 +72,9 @@ async def payments():
 ```

 ## Raise exceptions
+
 **old:**
+
 ```python
 return (
    {"message": f"Failed to connect to {domain}."},
@@ -74,6 +87,7 @@ abort(HTTPStatus.INTERNAL_SERVER_ERROR, "Could not process withdraw LNURL.")
 **new:**

 Raise an exception to return a status code other than the default status code.
+
 ```python
 raise HTTPException(
    status_code=HTTPStatus.BAD_REQUEST,
@@ -82,7 +96,9 @@ raise HTTPException(
 ```

 ## Extensions
+
 **old:**
+
 ```python
 from quart import Blueprint

@@ -92,6 +108,7 @@ amilk_ext: Blueprint = Blueprint(
 ```

 **new:**
+
 ```python
 from fastapi import APIRouter
 from lnbits.jinja2_templating import Jinja2Templates
@@ -114,9 +131,12 @@ offlineshop_rndr = template_renderer([
 ```

 ## Possible optimizations
+
 ### Use Redis as a cache server
+
 Instead of hitting the database over and over again, we can store a short lived object in [Redis](https://redis.io) for an arbitrary key.
 Example:
-* Get transactions for a wallet ID
-* User data for a user id
-* Wallet data for a Admin / Invoice key
+
+- Get transactions for a wallet ID
+- User data for a user id
+- Wallet data for a Admin / Invoice key
@@ -13,20 +13,31 @@ By default, LNbits will use SQLite as its database. You can also use PostgreSQL
 ## Option 1 (recommended): poetry

 Mininum poetry version has is ^1.2, but it is recommended to use latest poetry. (including OSX)
+Make sure you have Python 3.9 or 3.10 installed.
+
+### install python on ubuntu

 ```sh
-git clone https://github.com/lnbits/lnbits.git
-cd lnbits
-
 # for making sure python 3.9 is installed, skip if installed. To check your installed version: python3 --version
 sudo apt update
 sudo apt install software-properties-common
 sudo add-apt-repository ppa:deadsnakes/ppa
 sudo apt install python3.9 python3.9-distutils
+```

+### install poetry
+
+```sh
 curl -sSL https://install.python-poetry.org | python3 -
 # Once the above poetry install is completed, use the installation path printed to terminal and replace in the following command
 export PATH="/home/user/.local/bin:$PATH"
+```
+
+```sh
+git clone https://github.com/lnbits/lnbits.git
+cd lnbits
+git checkout main
+
 # Next command, you can exchange with python3.10 or newer versions.
 # Identify your version with python3 --version and specify in the next line
 # command is only needed when your default python is not ^3.9 or ^3.10
@@ -47,6 +58,7 @@ poetry run lnbits
 # adding --debug in the start-up command above to help your troubleshooting and generate a more verbose output
 # Note that you have to add the line DEBUG=true in your .env file, too.
 ```
+
 #### Updating the server

 ```
@@ -60,44 +72,62 @@ poetry install --only main

 ## Option 2: Nix

-> note: currently not supported while we make some architectural changes on the path to leave beta
-
 ```sh
+# Install nix. If you have installed via another manager, remove and use this install (from https://nixos.org/download)
+sh <(curl -L https://nixos.org/nix/install) --daemon
+
+# Enable nix-command and flakes experimental features for nix:
+echo 'experimental-features = nix-command flakes' >> /etc/nix/nix.conf
+
+# Add cachix for cached binaries
+nix-env -iA cachix -f https://cachix.org/api/v1/install
+cachix use lnbits
+
+# Clone and build LNbits
 git clone https://github.com/lnbits/lnbits.git
 cd lnbits
-# Modern debian distros usually include Nix, however you can install with:
-# 'sh <(curl -L https://nixos.org/nix/install) --daemon', or use setup here https://nixos.org/download.html#nix-verify-installation
+nix build

-nix build .#lnbits
 mkdir data
-
 ```

 #### Running the server

 ```sh
-# .env variables are currently passed when running
-LNBITS_DATA_FOLDER=data LNBITS_BACKEND_WALLET_CLASS=LNbitsWallet LNBITS_ENDPOINT=https://legend.lnbits.com LNBITS_KEY=7b1a78d6c78f48b09a202f2dcb2d22eb ./result/bin/lnbits --port 9000
+nix run
 ```

+Ideally you would set the environment via the `.env` file,
+but you can also set the env variables or pass command line arguments:
+
+```sh
+# .env variables are currently passed when running, but LNbits can be managed with the admin UI.
+LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000
+
+# Once you have created a user, you can set as the super_user
+SUPER_USER=be54db7f245346c8833eaa430e1e0405 LNBITS_ADMIN_UI=true ./result/bin/lnbits --port 9000
+```

 ## Option 3: Docker

 use latest version from docker hub
+
 ```sh
-docker pull lnbitsdocker/lnbits-legend
+docker pull lnbits/lnbits
 wget https://raw.githubusercontent.com/lnbits/lnbits/main/.env.example -O .env
 mkdir data
-docker run --detach --publish 5000:5000 --name lnbits --volume ${PWD}/.env:/app/.env --volume ${PWD}/data/:/app/data lnbitsdocker/lnbits-legend
+docker run --detach --publish 5000:5000 --name lnbits --volume ${PWD}/.env:/app/.env --volume ${PWD}/data/:/app/data lnbits/lnbits
 ```
+
 build the image yourself
+
 ```sh
 git clone https://github.com/lnbits/lnbits.git
 cd lnbits
-docker build -t lnbitsdocker/lnbits-legend .
+docker build -t lnbits/lnbits .
 cp .env.example .env
 mkdir data
-docker run --detach --publish 5000:5000 --name lnbits --volume ${PWD}/.env:/app/.env --volume ${PWD}/data/:/app/data lnbitsdocker/lnbits-legend
+docker run --detach --publish 5000:5000 --name lnbits --volume ${PWD}/.env:/app/.env --volume ${PWD}/data/:/app/data lnbits/lnbits
 ```

 ## Option 4: Fly.io
@@ -133,7 +163,7 @@ You'll be prompted to enter an app name, region, postgres (choose no), deploy no

 You'll now find a file in the directory called `fly.toml`. Open that file and modify/add the following settings.

-Note: Be sure to replace `${PUT_YOUR_LNBITS_ENV_VARS_HERE}` with all relevant environment variables in `.env` or `.env.example`. Environment variable strings should be quoted here, so if in `.env` you have `LNBITS_ENDPOINT=https://legend.lnbits.com` in `fly.toml` you should have `LNBITS_ENDPOINT="https://legend.lnbits.com"`.
+Note: Be sure to replace `${PUT_YOUR_LNBITS_ENV_VARS_HERE}` with all relevant environment variables in `.env` or `.env.example`. Environment variable strings should be quoted here, so if in `.env` you have `LNBITS_ENDPOINT=https://demo.lnbits.com` in `fly.toml` you should have `LNBITS_ENDPOINT="https://demo.lnbits.com"`.

 Note: Don't enter secret environment variables here. Fly.io offers secrets (via the `fly secrets` command) that are exposed as environment variables in your runtime. So, for example, if using the LND_REST funding source, you can run `fly secrets set LND_REST_MACAROON=<hex_macaroon_data>`.

@@ -230,11 +260,10 @@ You might also need to install additional packages or perform additional setup s

 Take a look at [Polar](https://lightningpolar.com/) for an excellent way of spinning up a Lightning Network dev environment.

-
-
 # Additional guides

 ## SQLite to PostgreSQL migration
+
 If you already have LNbits installed and running, on an SQLite database, we **highly** recommend you migrate to postgres if you are planning to run LNbits on scale.

 There's a script included that can do the migration easy. You should have Postgres already installed and there should be a password for the user (see Postgres install guide above). Additionally, your LNbits instance should run once on postgres to implement the database schema before the migration works:
@@ -256,7 +285,6 @@ make migration

 Hopefully, everything works and get migrated... Launch LNbits again and check if everything is working properly.

-
 ## LNbits as a systemd service

 Systemd is great for taking care of your LNbits instance. It will start it on boot and restart it in case it crashes. If you want to run LNbits as a systemd service on your Debian/Ubuntu/Raspbian server, create a file at `/etc/systemd/system/lnbits.service` with the following content:
@@ -433,28 +461,36 @@ service restart nginx
 ```

 ## Using https without reverse proxy
+
 The most common way of using LNbits via https is to use a reverse proxy such as Caddy, nginx, or ngriok. However, you can also run LNbits via https without additional software. This is useful for development purposes or if you want to use LNbits in your local network.

 We have to create a self-signed certificate using `mkcert`. Note that this certificate is not "trusted" by most browsers but that's fine (since you know that you have created it) and encryption is always better than clear text.

 #### Install mkcert
+
 You can find the install instructions for `mkcert` [here](https://github.com/FiloSottile/mkcert).

 Install mkcert on Ubuntu:
+
 ```sh
 sudo apt install libnss3-tools
 curl -JLO "https://dl.filippo.io/mkcert/latest?for=linux/amd64"
 chmod +x mkcert-v*-linux-amd64
 sudo cp mkcert-v*-linux-amd64 /usr/local/bin/mkcert
 ```
+
 #### Create certificate
+
 To create a certificate, first `cd` into your LNbits folder and execute the following command on Linux:
+
 ```sh
 openssl req -new -newkey rsa:4096 -x509 -sha256 -days 3650 -nodes -out cert.pem -keyout key.pem
 ```
+
 This will create two new files (`key.pem` and `cert.pem `).

 Alternatively, you can use mkcert ([more info](https://kifarunix.com/how-to-create-self-signed-ssl-certificate-with-mkcert-on-ubuntu-18-04/)):
+
 ```sh
 # add your local IP (192.x.x.x) as well if you want to use it in your local network
 mkcert localhost 127.0.0.1 ::1
@@ -466,7 +502,6 @@ You can then pass the certificate files to uvicorn when you start LNbits:
 poetry run uvicorn lnbits.__main__:app --host 0.0.0.0 --port 5000 --ssl-keyfile ./key.pem --ssl-certfile ./cert.pem
 ```

-
 ## LNbits running on Umbrel behind Tor

 If you want to run LNbits on your Umbrel but want it to be reached through clearnet, _Uxellodunum_ made an extensive [guide](https://community.getumbrel.com/t/guide-lnbits-without-tor/604) on how to do it.
@@ -478,7 +513,7 @@ To install using docker you first need to build the docker image as:
 ```
 git clone https://github.com/lnbits/lnbits.git
 cd lnbits
-docker build -t lnbits-legend .
+docker build -t lnbits/lnbits .
 ```

 You can launch the docker in a different directory, but make sure to copy `.env.example` from lnbits there
@@ -490,6 +525,7 @@ cp <lnbits_repo>/.env.example .env
 and change the configuration in `.env` as required.

 Then create the data directory
+
 ```
 mkdir data
 ```
@@ -497,7 +533,7 @@ mkdir data
 Then the image can be run as:

 ```
-docker run --detach --publish 5000:5000 --name lnbits-legend -e "LNBITS_BACKEND_WALLET_CLASS='FakeWallet'" --volume ${PWD}/.env:/app/.env --volume ${PWD}/data/:/app/data lnbits-legend
+docker run --detach --publish 5000:5000 --name lnbits -e "LNBITS_BACKEND_WALLET_CLASS='FakeWallet'" --volume ${PWD}/.env:/app/.env --volume ${PWD}/data/:/app/data lnbits
 ```

 Finally you can access your lnbits on your machine at port 5000.
@@ -4,20 +4,24 @@ title: Backend wallets
 nav_order: 3
 ---

+# Backend wallets

-Backend wallets
-===============
-
-LNbits can run on top of many lightning-network funding sources. Currently there is support for CoreLightning, LND, LNbits, LNPay and OpenNode, with more being added regularly.
+LNbits can run on top of many Lightning Network funding sources with more being added regularly.

 A backend wallet can be configured using the following LNbits environment variables:

-
 ### CoreLightning

 - `LNBITS_BACKEND_WALLET_CLASS`: **CoreLightningWallet**
 - `CORELIGHTNING_RPC`: /file/path/lightning-rpc

+### CoreLightning REST
+
+- `LNBITS_BACKEND_WALLET_CLASS`: **CoreLightningRestWallet**
+- `CORELIGHTNING_REST_URL`: http://127.0.0.1:8185/
+- `CORELIGHTNING_REST_MACAROON`: /file/path/admin.macaroon or Base64/Hex
+- `CORELIGHTNING_REST_CERT`: /home/lightning/clnrest/tls.cert
+
 ### Spark (Core Lightning)

 - `LNBITS_BACKEND_WALLET_CLASS`: **SparkWallet**
@@ -29,7 +33,7 @@ A backend wallet can be configured using the following LNbits environment variab
 - `LNBITS_BACKEND_WALLET_CLASS`: **LndRestWallet**
 - `LND_REST_ENDPOINT`: http://10.147.17.230:8080/
 - `LND_REST_CERT`: /file/path/tls.cert
- `LND_REST_MACAROON`: /file/path/admin.macaroon or Bech64/Hex
+- `LND_REST_MACAROON`: /file/path/admin.macaroon or Base64/Hex

 or

@@ -41,7 +45,7 @@ or
 - `LND_GRPC_ENDPOINT`: ip_address
 - `LND_GRPC_PORT`: port
 - `LND_GRPC_CERT`: /file/path/tls.cert
- `LND_GRPC_MACAROON`: /file/path/admin.macaroon or Bech64/Hex
+- `LND_GRPC_MACAROON`: /file/path/admin.macaroon or Base64/Hex

 You can also use an AES-encrypted macaroon (more info) instead by using

@@ -64,7 +68,6 @@ For the invoice listener to work you have a publicly accessible URL in your LNbi
 - `LNPAY_API_KEY`: sak_apiKey
 - `LNPAY_WALLET_KEY`: waka_apiKey

-
 ### OpenNode

 For the invoice to work you must have a publicly accessible URL in your LNbits. No manual webhook setting is necessary.
@@ -73,6 +76,30 @@ For the invoice to work you must have a publicly accessible URL in your LNbits.
 - `OPENNODE_API_ENDPOINT`: https://api.opennode.com/
 - `OPENNODE_KEY`: opennodeAdminApiKey

+### Alby
+
+For the invoice to work you must have a publicly accessible URL in your LNbits. No manual webhook setting is necessary. You can generate an alby access token here: https://getalby.com/developer/access_tokens/new
+
+- `LNBITS_BACKEND_WALLET_CLASS`: **AlbyWallet**
+- `ALBY_API_ENDPOINT`: https://api.getalby.com/
+- `ALBY_ACCESS_TOKEN`: AlbyAccessToken
+
+### ZBD
+
+For the invoice to work you must have a publicly accessible URL in your LNbits. No manual webhook setting is necessary. You can generate an ZBD API Key here: https://zbd.dev/docs/dashboard/projects/api
+
+- `LNBITS_BACKEND_WALLET_CLASS`: **ZBDWallet**
+- `ZBD_API_ENDPOINT`: https://api.zebedee.io/v0/
+- `ZBD_API_KEY`: ZBDApiKey
+
+### Phoenixd
+
+For the invoice to work you must have a publicly accessible URL in your LNbits. You can get a phoenixd API key from the install
+~/.phoenix/phoenix.conf, also see the documentation for phoenixd.
+
+- `LNBITS_BACKEND_WALLET_CLASS`: **PhoenixdWallet**
+- `PHOENIXD_API_ENDPOINT`: http://localhost:9740/
+- `PHOENIXD_API_PASSWORD`: PhoenixdApiPassword

 ### Cliche Wallet

@@ -4,21 +4,17 @@ title: User’s Guide
 nav_order: 1
 ---

-
-LNbits, free and open-source lightning-network wallet/accounts system
-=====================================================================
+# LNbits, free and open-source Lightning Network wallet/accounts system

 LNbits is a very simple Python application that sits on top of any funding source, and can be used as:

-* Accounts system to mitigate the risk of exposing applications to your full balance, via unique API keys for each wallet
-* Extendable platform for exploring lightning-network functionality via LNbits extension framework 
-* Part of a development stack via LNbits API
-* Fallback wallet for the LNURL scheme
-* Instant wallet for LN demonstrations
+- Accounts system to mitigate the risk of exposing applications to your full balance, via unique API keys for each wallet
+- Extendable platform for exploring Lightning Network functionality via LNbits extension framework
+- Part of a development stack via LNbits API
+- Fallback wallet for the LNURL scheme
+- Instant wallet for LN demonstrations

-
-LNbits as an account system
---------------------------
+## LNbits as an account system

 LNbits is packaged with tools to help manage funds, such as a table of transactions, line chart of spending,
 export to csv + more to come...
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 101.041 30.0001"><defs><path id="a" d="M33.2619 148.1667h154.2143v68.7917H33.2619z"/></defs><g fill="#1f2234" aria-label="LNbits" font-family="sans-serif" font-size=".3095" font-weight="400" letter-spacing=".0031" style="line-height:1.25;white-space:pre;shape-inside:url(#a)" transform="matrix(72.4607 0 0 72.4607 -2399.2814 -10741.3589)"><g transform="matrix(.00244 0 0 .00244 33.0708 148.1594)"><circle cx="101.2976" cy="116.4167" r="84.6667" fill="#673ab7" fill-rule="evenodd"/><path fill="#eee" d="M79.1105 71.9667v49.0613h13.3803v40.141l31.2208-53.5213h-17.8404l17.8404-35.681z"/></g><g fill="#eee" font-family="roboto"><path d="M33.6755 148.518h.0962v.0364h-.1416v-.22h.0454zM33.9796 148.5544h-.0453l-.0883-.1448v.1448h-.0453v-.22h.0453l.0884.145v-.145h.0452z" font-weight="700" style="-inkscape-font-specification:'roboto Bold'"/><path d="M34.1625 148.4744q0 .0375-.0172.0603-.0172.0227-.0462.0227-.031 0-.048-.0219l-.0014.019h-.0256v-.2322h.028v.0866q.0168-.021.0466-.021.0298 0 .0467.0225.017.0225.017.0617zm-.028-.003q0-.0286-.011-.044-.011-.0157-.0317-.0157-.0277 0-.0398.0257v.0707q.0129.0257.04.0257.0202 0 .0314-.0156.0112-.0156.0112-.0469zM34.231 148.5544h-.028v-.1635h.028zm-.0302-.2069q0-.007.0041-.0115.0042-.005.0124-.005.0082 0 .0124.005.0042.005.0042.0115 0 .007-.0042.0113-.0042.005-.0124.005-.0082 0-.0124-.005-.004-.005-.004-.0113zM34.3167 148.3513v.0396h.0305v.0216h-.0305v.1014q0 .01.004.0148.0042.005.014.005.0048 0 .0133-.002v.0227q-.011.003-.0215.003-.0187 0-.0283-.0113-.0095-.0113-.0095-.0322v-.1014h-.0297v-.0216h.0297v-.0396zM34.478 148.511q0-.0113-.0086-.0175-.0085-.006-.0298-.0109-.0211-.005-.0337-.0109-.0124-.006-.0184-.015t-.006-.0209q0-.02.017-.034.017-.0139.0435-.0139.0278 0 .045.0144.0174.0144.0174.0367h-.028q0-.0115-.0099-.0198-.0097-.008-.0245-.008-.0152 0-.0238.007-.0086.007-.0086.0174 0 .0101.008.0153.008.005.0288.01.021.005.034.0112.013.007.0192.0157.0063.009.0063.0222 0 .022-.0175.0352-.0175.0131-.0455.0131-.0197 0-.0348-.007-.015-.007-.0237-.0193-.0085-.0125-.0085-.027h.028q.0007.014.0111.0223.0106.008.0279.008.0158 0 .0253-.006.0097-.006.0097-.0172z" style="-inkscape-font-specification:roboto"/></g></g></svg>
@@ -1,19 +1,4 @@
 <svg width="900" height="900" viewBox="0 0 900 900" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g filter="url(#filter0_i_10_29)">
 <circle cx="450" cy="450" r="450" fill="#1E1E1E"/>
-</g>
 <path d="M387.802 476.423L281.613 730.887L584.54 389.763H459.418L619.113 168.387H407.558L305.485 476.423H387.802Z" fill="#FF1FE1"/>
-<defs>
-<filter id="filter0_i_10_29" x="-0.1" y="-0.1" width="900.1" height="900.1" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
-<feFlood flood-opacity="0" result="BackgroundImageFix"/>
-<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
-<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
-<feMorphology radius="0.6" operator="dilate" in="SourceAlpha" result="effect1_innerShadow_10_29"/>
-<feOffset dx="-1" dy="-0.4"/>
-<feGaussianBlur stdDeviation="0.35"/>
-<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
-<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 0.121569 0 0 0 0 0.882353 0 0 0 1 0"/>
-<feBlend mode="normal" in2="shape" result="effect1_innerShadow_10_29"/>
-</filter>
-</defs>
 </svg>
@@ -1,12 +1,15 @@
 {
  "nodes": {
    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
      "locked": {
-        "lastModified": 1676283394,
-        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "lastModified": 1694529238,
+        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
        "owner": "numtide",
        "repo": "flake-utils",
-        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
        "type": "github"
      },
      "original": {
@@ -15,18 +18,39 @@
        "type": "github"
      }
    },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1698974481,
+        "narHash": "sha256-yPncV9Ohdz1zPZxYHQf47S8S0VrnhV7nNhCawY46hDA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "4bb5e752616262457bc7ca5882192a564c0472d2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1678470307,
-        "narHash": "sha256-OEeMUr3ueLIXyW/OaFUX5jUdimyQwMg/7e+/Q0gC/QE=",
+        "lastModified": 1702233072,
+        "narHash": "sha256-H5G2wgbim2Ku6G6w+NSaQaauv6B6DlPhY9fMvArKqRo=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "0c4800d579af4ed98ecc47d464a5e7b0870c4b1f",
+        "rev": "781e2a9797ecf0f146e81425c822dca69fe4a348",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "nixos-23.11",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -34,16 +58,19 @@
    "poetry2nix": {
      "inputs": {
        "flake-utils": "flake-utils",
+        "nix-github-actions": "nix-github-actions",
        "nixpkgs": [
          "nixpkgs"
-        ]
+        ],
+        "systems": "systems_2",
+        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1678513806,
-        "narHash": "sha256-bEto1lp9bIQ+DlJsXQyRxN5l6B/oy3Skb7DueYRJJBo=",
+        "lastModified": 1702334837,
+        "narHash": "sha256-QZG6+zFshyY+L8m2tlOTm75U5m9y7z01g0josVK+8Os=",
        "owner": "nix-community",
        "repo": "poetry2nix",
-        "rev": "bf239d53fafb53cf439a72b3a50e86dd6a3984a5",
+        "rev": "1f4bcbf1be73abc232a972a77102a3e820485a99",
        "type": "github"
      },
      "original": {
@@ -57,6 +84,56 @@
        "nixpkgs": "nixpkgs",
        "poetry2nix": "poetry2nix"
      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "id": "systems",
+        "type": "indirect"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1699786194,
+        "narHash": "sha256-3h3EH1FXQkIeAuzaWB+nK0XK54uSD46pp+dMD3gAcB4=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "e82f32aa7f06bbbd56d7b12186d555223dc399d1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
    }
  },
  "root": "root",
@@ -2,7 +2,7 @@
  description = "LNbits, free and open-source Lightning wallet and accounts system";

  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
    poetry2nix = {
      url = "github:nix-community/poetry2nix";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -13,28 +13,37 @@
      supportedSystems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
      forSystems = systems: f:
        nixpkgs.lib.genAttrs systems
-        (system: f system (import nixpkgs { inherit system; overlays = [ poetry2nix.overlay self.overlays.default ]; }));
+        (system: f system (import nixpkgs { inherit system; overlays = [ poetry2nix.overlays.default self.overlays.default ]; }));
      forAllSystems = forSystems supportedSystems;
      projectName = "lnbits";
    in
    {
-      devShells = forAllSystems (system: pkgs: {
-        default = pkgs.mkShell {
-          buildInputs = with pkgs; [
-            nodePackages.prettier
-            poetry
-          ];
-        };
-      });
      overlays = {
        default = final: prev: {
-          ${projectName} = self.packages.${final.hostPlatform.system}.${projectName};
+          ${projectName} = self.packages.${prev.stdenv.hostPlatform.system}.${projectName};
        };
      };
      packages = forAllSystems (system: pkgs: {
        default = self.packages.${system}.${projectName};
        ${projectName} = pkgs.poetry2nix.mkPoetryApplication {
          projectDir = ./.;
+          meta.rev = self.dirtyRev or self.rev;
+          meta.mainProgram = projectName;
+          overrides = pkgs.poetry2nix.overrides.withDefaults (final: prev: {
+            protobuf = prev.protobuf.override { preferWheel = true; };
+            ruff = prev.ruff.override { preferWheel = true; };
+            wallycore = prev.wallycore.override { preferWheel = true; };
+            # remove the following override when https://github.com/nix-community/poetry2nix/pull/1563 is merged
+            asgi-lifespan = prev.asgi-lifespan.overridePythonAttrs (
+              old: { buildInputs = (old.buildInputs or []) ++ [ prev.setuptools ]; }
+            );
+            pytest-md = prev.pytest-md.overridePythonAttrs (
+              old: { buildInputs = (old.buildInputs or []) ++ [ prev.setuptools ]; }
+            );
+            types-mock = prev.pytest-md.overridePythonAttrs (
+              old: { buildInputs = (old.buildInputs or []) ++ [ prev.setuptools ]; }
+            );
+          });
        };
      });
      nixosModules = {
@@ -1,52 +1,59 @@
 import asyncio
 import glob
 import importlib
-import logging
 import os
 import shutil
-import signal
 import sys
-import traceback
-from hashlib import sha256
-from http import HTTPStatus
-from typing import Callable, List
+from contextlib import asynccontextmanager
+from pathlib import Path
+from typing import Callable, List, Optional

-from fastapi import FastAPI, HTTPException, Request
-from fastapi.exceptions import RequestValidationError
+from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
 from loguru import logger
 from slowapi import Limiter
 from slowapi.util import get_remote_address
-from starlette.responses import JSONResponse
+from starlette.middleware.sessions import SessionMiddleware

-from lnbits.core.crud import get_installed_extensions
+from lnbits.core.crud import get_dbversions, get_installed_extensions
 from lnbits.core.helpers import migrate_extension_database
-from lnbits.core.services import websocketUpdater
-from lnbits.core.tasks import (  # register_watchdog,; unregister_watchdog,
-    register_killswitch,
-    register_task_listeners,
+from lnbits.core.tasks import (  # watchdog_task
+    killswitch_task,
+    wait_for_paid_invoices,
 )
+from lnbits.exceptions import register_exception_handlers
 from lnbits.settings import settings
-from lnbits.tasks import cancel_all_tasks, create_permanent_task
+from lnbits.tasks import (
+    cancel_all_tasks,
+    create_permanent_task,
+    register_invoice_listener,
+)
 from lnbits.utils.cache import cache
-from lnbits.wallets import get_wallet_class, set_wallet_class
+from lnbits.utils.logger import (
+    configure_logger,
+    initialize_server_websocket_logger,
+    log_server_info,
+)
+from lnbits.wallets import get_funding_source, set_funding_source

-from .commands import db_versions, load_disabled_extension_list, migrate_databases
-from .core import (
-    add_installed_extension,
-    core_app,
-    core_app_extra,
-    update_installed_extension_state,
+from .commands import migrate_databases
+from .core import init_core_routers
+from .core.db import core_app_extra
+from .core.services import check_admin_settings, check_webpush_settings
+from .core.views.extension_api import add_installed_extension
+from .core.views.generic import update_installed_extension_state
+from .extension_manager import (
+    Extension,
+    InstallableExtension,
+    get_valid_extensions,
+    version_parse,
 )
-from .core.services import check_admin_settings
-from .core.views.generic import core_html_routes
-from .extension_manager import Extension, InstallableExtension, get_valid_extensions
-from .helpers import template_renderer
 from .middleware import (
    CustomGZipMiddleware,
    ExtensionsRedirectMiddleware,
    InstalledExtensionMiddleware,
+    add_first_install_middleware,
    add_ip_block_middleware,
    add_ratelimit_middleware,
 )
@@ -55,10 +62,63 @@ from .tasks import (
    check_pending_payments,
    internal_invoice_listener,
    invoice_listener,
-    webhook_handler,
 )


+async def startup(app: FastAPI):
+    settings.lnbits_running = True
+
+    # wait till migration is done
+    await migrate_databases()
+
+    # setup admin settings
+    await check_admin_settings()
+    await check_webpush_settings()
+
+    log_server_info()
+
+    # initialize WALLET
+    try:
+        set_funding_source()
+    except Exception as e:
+        logger.error(f"Error initializing {settings.lnbits_backend_wallet_class}: {e}")
+        set_void_wallet_class()
+
+    # initialize funding source
+    await check_funding_source()
+
+    # register core routes
+    init_core_routers(app)
+
+    # check extensions after restart
+    if not settings.lnbits_extensions_deactivate_all:
+        await check_installed_extensions(app)
+        register_all_ext_routes(app)
+
+    # initialize tasks
+    register_async_tasks()
+
+
+async def shutdown():
+    logger.warning("LNbits shutting down...")
+    settings.lnbits_running = False
+
+    # shutdown event
+    cancel_all_tasks()
+
+    # wait a bit to allow them to finish, so that cleanup can run without problems
+    await asyncio.sleep(0.1)
+    funding_source = get_funding_source()
+    await funding_source.cleanup()
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    await startup(app)
+    yield
+    await shutdown()
+
+
 def create_app() -> FastAPI:
    configure_logger()
    app = FastAPI(
@@ -68,18 +128,21 @@ def create_app() -> FastAPI:
            "accounts system with plugins."
        ),
        version=settings.version,
+        lifespan=lifespan,
        license_info={
            "name": "MIT License",
            "url": "https://raw.githubusercontent.com/lnbits/lnbits/main/LICENSE",
        },
    )

-    app.mount("/static", StaticFiles(packages=[("lnbits", "static")]), name="static")
-    app.mount(
-        "/core/static",
-        StaticFiles(packages=[("lnbits.core", "static")]),
-        name="core_static",
-    )
+    # Allow registering new extensions routes without direct access to the `app` object
+    core_app_extra.register_new_ext_routes = register_new_ext_routes(app)
+    core_app_extra.register_new_ratelimiter = register_new_ratelimiter(app)
+
+    # register static files
+    static_path = Path("lnbits", "static")
+    static = StaticFiles(directory=static_path)
+    app.mount("/static", static, name="static")

    g().base_url = f"http://{settings.host}:{settings.port}"

@@ -91,74 +154,65 @@ def create_app() -> FastAPI:
        CustomGZipMiddleware, minimum_size=1000, exclude_paths=["/api/v1/payments/sse"]
    )

+    # required for SSO login
+    app.add_middleware(SessionMiddleware, secret_key=settings.auth_secret_key)
+
    # order of these two middlewares is important
    app.add_middleware(InstalledExtensionMiddleware)
    app.add_middleware(ExtensionsRedirectMiddleware)

-    register_startup(app)
-    register_routes(app)
-    register_async_tasks(app)
-    register_exception_handlers(app)
-    register_shutdown(app)
+    register_custom_extensions_path()

-    # Allow registering new extensions routes without direct access to the `app` object
-    setattr(core_app_extra, "register_new_ext_routes", register_new_ext_routes(app))
-    setattr(core_app_extra, "register_new_ratelimiter", register_new_ratelimiter(app))
+    add_first_install_middleware(app)
+
+    # adds security middleware
+    add_ip_block_middleware(app)
+    add_ratelimit_middleware(app)
+
+    register_exception_handlers(app)

    return app


 async def check_funding_source() -> None:
-    original_sigint_handler = signal.getsignal(signal.SIGINT)
+    funding_source = get_funding_source()

-    def signal_handler(signal, frame):
-        logger.debug(
-            f"SIGINT received, terminating LNbits. signal: {signal}, frame: {frame}"
-        )
-        sys.exit(1)
-
-    signal.signal(signal.SIGINT, signal_handler)
-
-    WALLET = get_wallet_class()
-
-    # fallback to void after 30 seconds of failures
-    sleep_time = 5
-    timeout = int(30 / sleep_time)
-
-    balance = 0
+    max_retries = settings.funding_source_max_retries
    retry_counter = 0

-    while True:
+    while settings.lnbits_running:
        try:
-            error_message, balance = await WALLET.status()
+            logger.info(f"Connecting to backend {funding_source.__class__.__name__}...")
+            error_message, balance = await funding_source.status()
            if not error_message:
                retry_counter = 0
+                logger.success(
+                    f"✔️ Backend {funding_source.__class__.__name__} connected "
+                    f"and with a balance of {balance} msat."
+                )
                break
-
            logger.error(
-                f"The backend for {WALLET.__class__.__name__} isn't "
+                f"The backend for {funding_source.__class__.__name__} isn't "
                f"working properly: '{error_message}'",
                RuntimeWarning,
            )
        except Exception as e:
-            logger.error(f"Error connecting to {WALLET.__class__.__name__}: {e}")
-            pass
+            logger.error(
+                f"Error connecting to {funding_source.__class__.__name__}: {e}"
+            )

-        if settings.lnbits_admin_ui and retry_counter == timeout:
+        if retry_counter >= max_retries:
            set_void_wallet_class()
-            WALLET = get_wallet_class()
+            funding_source = get_funding_source()
            break
-        else:
-            logger.warning(f"Retrying connection to backend in {sleep_time} seconds...")
-            retry_counter += 1
-            await asyncio.sleep(sleep_time)

-    signal.signal(signal.SIGINT, original_sigint_handler)
-
-    logger.info(
-        f"✔️ Backend {WALLET.__class__.__name__} connected "
-        f"and with a balance of {balance} msat."
-    )
+        retry_counter += 1
+        sleep_time = 0.25 * (2**retry_counter)
+        logger.warning(
+            f"Retrying connection to backend in {sleep_time} seconds... "
+            f"({retry_counter}/{max_retries})"
+        )
+        await asyncio.sleep(sleep_time)


 def set_void_wallet_class():
@@ -166,7 +220,7 @@ def set_void_wallet_class():
        "Fallback to VoidWallet, because the backend for "
        f"{settings.lnbits_backend_wallet_class} isn't working properly"
    )
-    set_wallet_class("VoidWallet")
+    set_funding_source("VoidWallet")


 async def check_installed_extensions(app: FastAPI):
@@ -177,12 +231,11 @@ async def check_installed_extensions(app: FastAPI):
    persist state. Zips that are missing will be re-downloaded.
    """
    shutil.rmtree(os.path.join("lnbits", "upgrades"), True)
-    await load_disabled_extension_list()
-    installed_extensions = await build_all_installed_extensions_list()
+    installed_extensions = await build_all_installed_extensions_list(False)

    for ext in installed_extensions:
        try:
-            installed = check_installed_extension_files(ext)
+            installed = await check_installed_extension_files(ext)
            if not installed:
                await restore_installed_extension(app, ext)
                logger.info(
@@ -200,7 +253,9 @@ async def check_installed_extensions(app: FastAPI):
        logger.info(f"{ext.id} ({ext.installed_version})")


-async def build_all_installed_extensions_list() -> List[InstallableExtension]:
+async def build_all_installed_extensions_list(
+    include_deactivated: Optional[bool] = True,
+) -> List[InstallableExtension]:
    """
    Returns a list of all the installed extensions plus the extensions that
    MUST be installed by default (see LNBITS_EXTENSIONS_DEFAULT_INSTALL).
@@ -213,7 +268,11 @@ async def build_all_installed_extensions_list() -> List[InstallableExtension]:
            continue

        ext_releases = await InstallableExtension.get_extension_releases(ext_id)
-        release = ext_releases[0] if len(ext_releases) else None
+        ext_releases = sorted(
+            ext_releases, key=lambda r: version_parse(r.version), reverse=True
+        )
+
+        release = next((e for e in ext_releases if e.is_version_compatible), None)

        if release:
            ext_info = InstallableExtension(
@@ -221,19 +280,27 @@ async def build_all_installed_extensions_list() -> List[InstallableExtension]:
            )
            installed_extensions.append(ext_info)

-    return installed_extensions
+    if include_deactivated:
+        return installed_extensions
+
+    if settings.lnbits_extensions_deactivate_all:
+        return []
+
+    return [
+        e
+        for e in installed_extensions
+        if e.id not in settings.lnbits_deactivated_extensions
+    ]


-def check_installed_extension_files(ext: InstallableExtension) -> bool:
+async def check_installed_extension_files(ext: InstallableExtension) -> bool:
    if ext.has_installed_version:
        return True

-    zip_files = glob.glob(
-        os.path.join(settings.lnbits_data_folder, "extensions", "*.zip")
-    )
+    zip_files = glob.glob(os.path.join(settings.lnbits_data_folder, "zips", "*.zip"))

-    if f"./{str(ext.zip_path)}" not in zip_files:
-        ext.download_archive()
+    if f"./{ext.zip_path!s}" not in zip_files:
+        await ext.download_archive()
    ext.extract_archive()

    return False
@@ -246,28 +313,32 @@ async def restore_installed_extension(app: FastAPI, ext: InstallableExtension):
    extension = Extension.from_installable_ext(ext)
    register_ext_routes(app, extension)

-    current_version = (await db_versions()).get(ext.id, 0)
+    current_version = (await get_dbversions()).get(ext.id, 0)
    await migrate_extension_database(extension, current_version)

    # mount routes for the new version
    core_app_extra.register_new_ext_routes(extension)
    if extension.upgrade_hash:
-        ext.nofiy_upgrade()
+        ext.notify_upgrade()


-def register_routes(app: FastAPI) -> None:
-    """Register FastAPI routes / LNbits extensions."""
-    app.include_router(core_app)
-    app.include_router(core_html_routes)
+def register_custom_extensions_path():
+    if settings.has_default_extension_path:
+        return
+    default_ext_path = os.path.join("lnbits", "extensions")
+    if os.path.isdir(default_ext_path) and len(os.listdir(default_ext_path)) != 0:
+        logger.warning(
+            "You are using a custom extensions path, "
+            + "but the default extensions directory is not empty. "
+            + f"Please clean-up the '{default_ext_path}' directory."
+        )
+        logger.warning(
+            f"You can move the existing '{default_ext_path}' directory to: "
+            + f" '{settings.lnbits_extensions_path}/extensions'"
+        )

-    for ext in get_valid_extensions():
-        try:
-            register_ext_routes(app, ext)
-        except Exception as e:
-            logger.error(str(e))
-            raise ImportError(
-                f"Please make sure that the extension `{ext.code}` follows conventions."
-            )
+    sys.path.append(str(Path(settings.lnbits_extensions_path, "extensions")))
+    sys.path.append(str(Path(settings.lnbits_extensions_path, "upgrades")))


 def register_new_ext_routes(app: FastAPI) -> Callable:
@@ -306,7 +377,10 @@ def register_ext_routes(app: FastAPI, ext: Extension) -> None:
    if hasattr(ext_module, f"{ext.code}_static_files"):
        ext_statics = getattr(ext_module, f"{ext.code}_static_files")
        for s in ext_statics:
-            app.mount(s["path"], s["app"], s["name"])
+            static_dir = Path(
+                settings.lnbits_extensions_path, "extensions", *s["path"].split("/")
+            )
+            app.mount(s["path"], StaticFiles(directory=static_dir), s["name"])

    if hasattr(ext_module, f"{ext.code}_redirect_paths"):
        ext_redirects = getattr(ext_module, f"{ext.code}_redirect_paths")
@@ -323,227 +397,30 @@ def register_ext_routes(app: FastAPI, ext: Extension) -> None:
    app.include_router(router=ext_route, prefix=prefix)


-def register_startup(app: FastAPI):
-    @app.on_event("startup")
-    async def lnbits_startup():
+def register_all_ext_routes(app: FastAPI):
+    for ext in get_valid_extensions(False):
        try:
-            # wait till migration is done
-            await migrate_databases()
-
-            # setup admin settings
-            await check_admin_settings()
-
-            log_server_info()
-
-            # adds security middleware
-            add_ratelimit_middleware(app)
-            add_ip_block_middleware(app)
-
-            # initialize WALLET
-            try:
-                set_wallet_class()
-            except Exception as e:
-                logger.error(
-                    f"Error initializing {settings.lnbits_backend_wallet_class}: "
-                    f"{str(e)}"
-                )
-                set_void_wallet_class()
-
-            # initialize funding source
-            await check_funding_source()
-
-            # check extensions after restart
-            await check_installed_extensions(app)
-
-            if settings.lnbits_admin_ui:
-                initialize_server_logger()
-
+            register_ext_routes(app, ext)
        except Exception as e:
-            logger.error(str(e))
-            raise ImportError("Failed to run 'startup' event.")
+            logger.error(f"Could not load extension `{ext.code}`: {e!s}")


-def register_shutdown(app: FastAPI):
-    @app.on_event("shutdown")
-    async def on_shutdown():
-        cancel_all_tasks()
-        # wait a bit to allow them to finish, so that cleanup can run without problems
-        await asyncio.sleep(0.1)
-        WALLET = get_wallet_class()
-        await WALLET.cleanup()
+def register_async_tasks():
+    create_permanent_task(check_pending_payments)
+    create_permanent_task(invoice_listener)
+    create_permanent_task(internal_invoice_listener)
+    create_permanent_task(cache.invalidate_forever)

+    # core invoice listener
+    invoice_queue = asyncio.Queue(5)
+    register_invoice_listener(invoice_queue, "core")
+    create_permanent_task(lambda: wait_for_paid_invoices(invoice_queue))

-def initialize_server_logger():
-    super_user_hash = sha256(settings.super_user.encode("utf-8")).hexdigest()
+    # TODO: implement watchdog properly
+    # create_permanent_task(watchdog_task)
+    create_permanent_task(killswitch_task)

-    serverlog_queue = asyncio.Queue()
-
-    async def update_websocket_serverlog():
-        while True:
-            msg = await serverlog_queue.get()
-            await websocketUpdater(super_user_hash, msg)
-
-    create_permanent_task(update_websocket_serverlog)
-
-    logger.add(
-        lambda msg: serverlog_queue.put_nowait(msg),
-        format=Formatter().format,
-    )
-
-
-def log_server_info():
-    logger.info("Starting LNbits")
-    logger.info(f"Version: {settings.version}")
-    logger.info(f"Baseurl: {settings.lnbits_baseurl}")
-    logger.info(f"Host: {settings.host}")
-    logger.info(f"Port: {settings.port}")
-    logger.info(f"Debug: {settings.debug}")
-    logger.info(f"Site title: {settings.lnbits_site_title}")
-    logger.info(f"Funding source: {settings.lnbits_backend_wallet_class}")
-    logger.info(f"Data folder: {settings.lnbits_data_folder}")
-    logger.info(f"Git version: {settings.lnbits_commit}")
-    logger.info(f"Database: {get_db_vendor_name()}")
-    logger.info(f"Service fee: {settings.lnbits_service_fee}")
-
-
-def get_db_vendor_name():
-    db_url = settings.lnbits_database_url
-    return (
-        "PostgreSQL"
-        if db_url and db_url.startswith("postgres://")
-        else (
-            "CockroachDB"
-            if db_url and db_url.startswith("cockroachdb://")
-            else "SQLite"
-        )
-    )
-
-
-def register_async_tasks(app):
-    @app.route("/wallet/webhook")
-    async def webhook_listener():
-        return await webhook_handler()
-
-    @app.on_event("startup")
-    async def listeners():
-        create_permanent_task(check_pending_payments)
-        create_permanent_task(invoice_listener)
-        create_permanent_task(internal_invoice_listener)
-        create_permanent_task(cache.invalidate_forever)
-        register_task_listeners()
-        register_killswitch()
-        # await run_deferred_async() # calle: doesn't do anyting?
-
-
-def register_exception_handlers(app: FastAPI):
-    @app.exception_handler(Exception)
-    async def exception_handler(request: Request, exc: Exception):
-        etype, _, tb = sys.exc_info()
-        traceback.print_exception(etype, exc, tb)
-        logger.error(f"Exception: {str(exc)}")
-        # Only the browser sends "text/html" request
-        # not fail proof, but everything else get's a JSON response
-        if (
-            request.headers
-            and "accept" in request.headers
-            and "text/html" in request.headers["accept"]
-        ):
-            return template_renderer().TemplateResponse(
-                "error.html", {"request": request, "err": f"Error: {str(exc)}"}
-            )
-
-        return JSONResponse(
-            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
-            content={"detail": str(exc)},
-        )
-
-    @app.exception_handler(RequestValidationError)
-    async def validation_exception_handler(
-        request: Request, exc: RequestValidationError
-    ):
-        logger.error(f"RequestValidationError: {str(exc)}")
-        # Only the browser sends "text/html" request
-        # not fail proof, but everything else get's a JSON response
-
-        if (
-            request.headers
-            and "accept" in request.headers
-            and "text/html" in request.headers["accept"]
-        ):
-            return template_renderer().TemplateResponse(
-                "error.html",
-                {"request": request, "err": f"Error: {str(exc)}"},
-            )
-
-        return JSONResponse(
-            status_code=HTTPStatus.BAD_REQUEST,
-            content={"detail": str(exc)},
-        )
-
-    @app.exception_handler(HTTPException)
-    async def http_exception_handler(request: Request, exc: HTTPException):
-        logger.error(f"HTTPException {exc.status_code}: {exc.detail}")
-        # Only the browser sends "text/html" request
-        # not fail proof, but everything else get's a JSON response
-
-        if (
-            request.headers
-            and "accept" in request.headers
-            and "text/html" in request.headers["accept"]
-        ):
-            return template_renderer().TemplateResponse(
-                "error.html",
-                {
-                    "request": request,
-                    "err": f"HTTP Error {exc.status_code}: {exc.detail}",
-                },
-            )
-
-        return JSONResponse(
-            status_code=exc.status_code,
-            content={"detail": exc.detail},
-        )
-
-
-def configure_logger() -> None:
-    logger.remove()
-    log_level: str = "DEBUG" if settings.debug else "INFO"
-    formatter = Formatter()
-    logger.add(sys.stdout, level=log_level, format=formatter.format)
-    logging.getLogger("uvicorn").handlers = [InterceptHandler()]
-    logging.getLogger("uvicorn.access").handlers = [InterceptHandler()]
-    logging.getLogger("uvicorn.error").handlers = [InterceptHandler()]
-    logging.getLogger("uvicorn.error").propagate = False
-
-
-class Formatter:
-    def __init__(self):
-        self.padding = 0
-        self.minimal_fmt = (
-            "<green>{time:YYYY-MM-DD HH:mm:ss.SS}</green> | <level>{level}</level> | "
-            "<level>{message}</level>\n"
-        )
-        if settings.debug:
-            self.fmt = (
-                "<green>{time:YYYY-MM-DD HH:mm:ss.SS}</green> | "
-                "<level>{level: <4}</level> | "
-                "<cyan>{name}</cyan>:<cyan>{function}</cyan>:<cyan>{line}</cyan> | "
-                "<level>{message}</level>\n"
-            )
-        else:
-            self.fmt = self.minimal_fmt
-
-    def format(self, record):
-        function = "{function}".format(**record)
-        if function == "emit":  # uvicorn logs
-            return self.minimal_fmt
-        return self.fmt
-
-
-class InterceptHandler(logging.Handler):
-    def emit(self, record):
-        try:
-            level = logger.level(record.levelname).name
-        except ValueError:
-            level = record.levelno
-        logger.log(level, record.getMessage())
+    # server logs for websocket
+    if settings.lnbits_admin_ui:
+        server_log_task = initialize_server_websocket_logger()
+        create_permanent_task(server_log_task)
@@ -1,365 +1,7 @@
-import hashlib
-import re
-import time
-from decimal import Decimal
-from typing import List, NamedTuple, Optional
-
-import bitstring
-import secp256k1
-from bech32 import CHARSET, bech32_decode, bech32_encode
-from ecdsa import SECP256k1, VerifyingKey
-from ecdsa.util import sigdecode_string
-
-
-class Route(NamedTuple):
-    pubkey: str
-    short_channel_id: str
-    base_fee_msat: int
-    ppm_fee: int
-    cltv: int
-
-
-class Invoice:
-    payment_hash: str
-    amount_msat: int = 0
-    description: Optional[str] = None
-    description_hash: Optional[str] = None
-    payee: Optional[str] = None
-    date: int
-    expiry: int = 3600
-    secret: Optional[str] = None
-    route_hints: List[Route] = []
-    min_final_cltv_expiry: int = 18
-
-
-def decode(pr: str) -> Invoice:
-    """bolt11 decoder,
-    based on https://github.com/rustyrussell/lightning-payencode/blob/master/lnaddr.py
-    """
-
-    hrp, decoded_data = bech32_decode(pr)
-    if hrp is None or decoded_data is None:
-        raise ValueError("Bad bech32 checksum")
-    if not hrp.startswith("ln"):
-        raise ValueError("Does not start with ln")
-
-    bitarray = _u5_to_bitarray(decoded_data)
-
-    # final signature 65 bytes, split it off.
-    if len(bitarray) < 65 * 8:
-        raise ValueError("Too short to contain signature")
-
-    # extract the signature
-    signature = bitarray[-65 * 8 :].tobytes()
-
-    # the tagged fields as a bitstream
-    data = bitstring.ConstBitStream(bitarray[: -65 * 8])
-
-    # build the invoice object
-    invoice = Invoice()
-
-    # decode the amount from the hrp
-    m = re.search(r"[^\d]+", hrp[2:])
-    if m:
-        amountstr = hrp[2 + m.end() :]
-        if amountstr != "":
-            invoice.amount_msat = _unshorten_amount(amountstr)
-
-    # pull out date
-    date_bin = data.read(35)
-    invoice.date = date_bin.uint  # type: ignore
-
-    while data.pos != data.len:
-        tag, tagdata, data = _pull_tagged(data)
-        data_length = len(tagdata or []) / 5
-
-        if tag == "d":
-            invoice.description = _trim_to_bytes(tagdata).decode()
-        elif tag == "h" and data_length == 52:
-            invoice.description_hash = _trim_to_bytes(tagdata).hex()
-        elif tag == "p" and data_length == 52:
-            invoice.payment_hash = _trim_to_bytes(tagdata).hex()
-        elif tag == "x":
-            invoice.expiry = tagdata.uint  # type: ignore
-        elif tag == "n":
-            invoice.payee = _trim_to_bytes(tagdata).hex()
-            # this won't work in most cases, we must extract the payee
-            # from the signature
-        elif tag == "s":
-            invoice.secret = _trim_to_bytes(tagdata).hex()
-        elif tag == "r":
-            s = bitstring.ConstBitStream(tagdata)
-            while s.pos + 264 + 64 + 32 + 32 + 16 < s.len:
-                route = Route(
-                    pubkey=s.read(264).tobytes().hex(),  # type: ignore
-                    short_channel_id=_readable_scid(s.read(64).intbe),  # type: ignore
-                    base_fee_msat=s.read(32).intbe,  # type: ignore
-                    ppm_fee=s.read(32).intbe,  # type: ignore
-                    cltv=s.read(16).intbe,  # type: ignore
-                )
-                invoice.route_hints.append(route)
-
-    # BOLT #11:
-    # A reader MUST check that the `signature` is valid (see the `n` tagged
-    # field specified below).
-    # A reader MUST use the `n` field to validate the signature instead of
-    # performing signature recovery if a valid `n` field is provided.
-    message = bytearray([ord(c) for c in hrp]) + data.tobytes()
-    sig = signature[0:64]
-    if invoice.payee:
-        key = VerifyingKey.from_string(bytes.fromhex(invoice.payee), curve=SECP256k1)
-        key.verify(sig, message, hashlib.sha256, sigdecode=sigdecode_string)
-    else:
-        keys = VerifyingKey.from_public_key_recovery(
-            sig, message, SECP256k1, hashlib.sha256
-        )
-        signaling_byte = signature[64]
-        key = keys[int(signaling_byte)]
-        invoice.payee = key.to_string("compressed").hex()
-
-    return invoice
-
-
-def encode(options):
-    """Convert options into LnAddr and pass it to the encoder"""
-    addr = LnAddr()
-    addr.currency = options["currency"]
-    addr.fallback = options["fallback"] if options["fallback"] else None
-    if options["amount"]:
-        addr.amount = options["amount"]
-    if options["timestamp"]:
-        addr.date = int(options["timestamp"])
-
-    addr.paymenthash = bytes.fromhex(options["paymenthash"])
-
-    if options["description"]:
-        addr.tags.append(("d", options["description"]))
-    if options["description_hash"]:
-        addr.tags.append(("h", options["description_hash"]))
-    if options["expires"]:
-        addr.tags.append(("x", options["expires"]))
-
-    if options["fallback"]:
-        addr.tags.append(("f", options["fallback"]))
-    if options["route"]:
-        for r in options["route"]:
-            splits = r.split("/")
-            route = []
-            while len(splits) >= 5:
-                route.append(
-                    (
-                        bytes.fromhex(splits[0]),
-                        bytes.fromhex(splits[1]),
-                        int(splits[2]),
-                        int(splits[3]),
-                        int(splits[4]),
-                    )
-                )
-                splits = splits[5:]
-            assert len(splits) == 0
-            addr.tags.append(("r", route))
-    return lnencode(addr, options["privkey"])
-
-
-def lnencode(addr, privkey):
-    if addr.amount:
-        amount = Decimal(str(addr.amount))
-        # We can only send down to millisatoshi.
-        if amount * 10**12 % 10:
-            raise ValueError(f"Cannot encode {addr.amount}: too many decimal places")
-
-        amount = addr.currency + shorten_amount(amount)
-    else:
-        amount = addr.currency if addr.currency else ""
-
-    hrp = f"ln{amount}0n"
-
-    # Start with the timestamp
-    data = bitstring.pack("uint:35", addr.date)
-
-    # Payment hash
-    data += tagged_bytes("p", addr.paymenthash)
-    tags_set = set()
-
-    for k, v in addr.tags:
-        # BOLT #11:
-        #
-        # A writer MUST NOT include more than one `d`, `h`, `n` or `x` fields,
-        if k in ("d", "h", "n", "x"):
-            if k in tags_set:
-                raise ValueError(f"Duplicate '{k}' tag")
-
-        if k == "r":
-            route = bitstring.BitArray()
-            for step in v:
-                pubkey, channel, feebase, feerate, cltv = step
-                route.append(
-                    bitstring.BitArray(pubkey)
-                    + bitstring.BitArray(channel)
-                    + bitstring.pack("intbe:32", feebase)
-                    + bitstring.pack("intbe:32", feerate)
-                    + bitstring.pack("intbe:16", cltv)
-                )
-            data += tagged("r", route)
-        elif k == "f":
-            # NOTE: there was an error fallback here that's now removed
-            continue
-        elif k == "d":
-            data += tagged_bytes("d", v.encode())
-        elif k == "x":
-            # Get minimal length by trimming leading 5 bits at a time.
-            expirybits = bitstring.pack("intbe:64", v)[4:64]
-            while expirybits.startswith("0b00000"):
-                expirybits = expirybits[5:]
-            data += tagged("x", expirybits)
-        elif k == "h":
-            data += tagged_bytes("h", v)
-        elif k == "n":
-            data += tagged_bytes("n", v)
-        else:
-            # FIXME: Support unknown tags?
-            raise ValueError(f"Unknown tag {k}")
-
-        tags_set.add(k)
-
-    # BOLT #11:
-    #
-    # A writer MUST include either a `d` or `h` field, and MUST NOT include
-    # both.
-    if "d" in tags_set and "h" in tags_set:
-        raise ValueError("Cannot include both 'd' and 'h'")
-    if "d" not in tags_set and "h" not in tags_set:
-        raise ValueError("Must include either 'd' or 'h'")
-
-    # We actually sign the hrp, then data (padded to 8 bits with zeroes).
-    privkey = secp256k1.PrivateKey(bytes.fromhex(privkey))
-    sig = privkey.ecdsa_sign_recoverable(
-        bytearray([ord(c) for c in hrp]) + data.tobytes()
-    )
-    # This doesn't actually serialize, but returns a pair of values :(
-    sig, recid = privkey.ecdsa_recoverable_serialize(sig)
-    data += bytes(sig) + bytes([recid])
-
-    return bech32_encode(hrp, bitarray_to_u5(data))
-
-
-class LnAddr:
-    def __init__(
-        self,
-        paymenthash=None,
-        amount=None,
-        currency="bc",
-        tags=None,
-        date=None,
-        fallback=None,
-    ):
-        self.date = int(time.time()) if not date else int(date)
-        self.tags = [] if not tags else tags
-        self.unknown_tags = []
-        self.paymenthash = paymenthash
-        self.signature = None
-        self.pubkey = None
-        self.fallback = fallback
-        self.currency = currency
-        self.amount = amount
-
-    def __str__(self):
-        assert self.pubkey, "LnAddr, pubkey must be set"
-        pubkey = bytes.hex(self.pubkey.serialize())
-        tags = ", ".join([f"{k}={v}" for k, v in self.tags])
-        return f"LnAddr[{pubkey}, amount={self.amount}{self.currency} tags=[{tags}]]"
-
-
-def shorten_amount(amount):
-    """Given an amount in bitcoin, shorten it"""
-    # Convert to pico initially
-    amount = int(amount * 10**12)
-    units = ["p", "n", "u", "m", ""]
-    unit = ""
-    for unit in units:
-        if amount % 1000 == 0:
-            amount //= 1000
-        else:
-            break
-    return str(amount) + unit
-
-
-def _unshorten_amount(amount: str) -> int:
-    """Given a shortened amount, return millisatoshis"""
-    # BOLT #11:
-    # The following `multiplier` letters are defined:
-    #
-    # * `m` (milli): multiply by 0.001
-    # * `u` (micro): multiply by 0.000001
-    # * `n` (nano): multiply by 0.000000001
-    # * `p` (pico): multiply by 0.000000000001
-    units = {"p": 10**12, "n": 10**9, "u": 10**6, "m": 10**3}
-    unit = str(amount)[-1]
-
-    # BOLT #11:
-    # A reader SHOULD fail if `amount` contains a non-digit, or is followed by
-    # anything except a `multiplier` in the table above.
-    if not re.fullmatch(r"\d+[pnum]?", str(amount)):
-        raise ValueError(f"Invalid amount '{amount}'")
-
-    if unit in units:
-        return int(int(amount[:-1]) * 100_000_000_000 / units[unit])
-    else:
-        return int(amount) * 100_000_000_000
-
-
-def _pull_tagged(stream):
-    tag = stream.read(5).uint
-    length = stream.read(5).uint * 32 + stream.read(5).uint
-    return (CHARSET[tag], stream.read(length * 5), stream)
-
-
-# Tagged field containing BitArray
-def tagged(char, bits):
-    # Tagged fields need to be zero-padded to 5 bits.
-    while bits.len % 5 != 0:
-        bits.append("0b0")
-    return (
-        bitstring.pack(
-            "uint:5, uint:5, uint:5",
-            CHARSET.find(char),
-            (bits.len / 5) / 32,
-            (bits.len / 5) % 32,
-        )
-        + bits
-    )
-
-
-def tagged_bytes(char, bits):
-    return tagged(char, bitstring.BitArray(bits))
-
-
-def _trim_to_bytes(barr):
-    # Adds a byte if necessary.
-    b = barr.tobytes()
-    if barr.len % 8 != 0:
-        return b[:-1]
-    return b
-
-
-def _readable_scid(short_channel_id: int) -> str:
-    blockheight = (short_channel_id >> 40) & 0xFFFFFF
-    transactionindex = (short_channel_id >> 16) & 0xFFFFFF
-    outputindex = short_channel_id & 0xFFFF
-    return f"{blockheight}x{transactionindex}x{outputindex}"
-
-
-def _u5_to_bitarray(arr: List[int]) -> bitstring.BitArray:
-    ret = bitstring.BitArray()
-    for a in arr:
-        ret += bitstring.pack("uint:5", a)
-    return ret
-
-
-def bitarray_to_u5(barr):
-    assert barr.len % 5 == 0
-    ret = []
-    s = bitstring.ConstBitStream(barr)
-    while s.pos != s.len:
-        ret.append(s.read(5).uint)  # type: ignore
-    return ret
+from bolt11 import (
+    Bolt11 as Invoice,  # noqa: F401
+)
+from bolt11 import (
+    decode,  # noqa: F401
+    encode,  # noqa: F401
+)
@@ -1,45 +1,122 @@
 import asyncio
+import importlib
+import time
+from functools import wraps
+from pathlib import Path
+from typing import List, Optional, Tuple
+from urllib.parse import urlparse

 import click
+import httpx
+from fastapi.exceptions import HTTPException
 from loguru import logger
+from packaging import version

+from lnbits.core.models import Payment, User
+from lnbits.core.services import check_admin_settings
+from lnbits.core.views.extension_api import (
+    api_install_extension,
+    api_uninstall_extension,
+)
 from lnbits.settings import settings
+from lnbits.wallets.base import Wallet

 from .core import db as core_db
 from .core import migrations as core_migrations
-from .core.crud import get_dbversions, get_inactive_extensions
+from .core.crud import (
+    delete_accounts_no_wallets,
+    delete_unused_wallets,
+    delete_wallet_by_id,
+    delete_wallet_payment,
+    get_dbversions,
+    get_inactive_extensions,
+    get_installed_extension,
+    get_installed_extensions,
+    get_payments,
+    remove_deleted_wallets,
+    update_payment_status,
+)
 from .core.helpers import migrate_extension_database, run_migration
 from .db import COCKROACH, POSTGRES, SQLITE
-from .extension_manager import get_valid_extensions
+from .extension_manager import (
+    CreateExtension,
+    ExtensionRelease,
+    InstallableExtension,
+    get_valid_extensions,
+)
+
+
+def coro(f):
+    @wraps(f)
+    def wrapper(*args, **kwargs):
+        return asyncio.run(f(*args, **kwargs))
+
+    return wrapper


@click.group()
-def command_group():
+def lnbits_cli():
    """
    Python CLI for LNbits
    """


-@click.command("superuser")
+@lnbits_cli.group()
+def db():
+    """
+    Database related commands
+    """
+
+
+@lnbits_cli.group()
+def extensions():
+    """
+    Extensions related commands
+    """
+
+
+def get_super_user() -> Optional[str]:
+    """Get the superuser"""
+    superuser_file = Path(settings.lnbits_data_folder, ".super_user")
+    if not superuser_file.exists() or not superuser_file.is_file():
+        raise ValueError(
+            "Superuser id not found. Please check that the file "
+            + f"'{superuser_file.absolute()}' exists and has read permissions."
+        )
+    with open(superuser_file) as file:
+        return file.readline()
+
+
+@lnbits_cli.command("superuser")
 def superuser():
    """Prints the superuser"""
-    with open(".super_user", "r") as file:
-        print(f"http://{settings.host}:{settings.port}/wallet?usr={file.readline()}")
+    try:
+        click.echo(get_super_user())
+    except ValueError as e:
+        click.echo(str(e))


-@click.command("delete-settings")
-def delete_settings():
+@lnbits_cli.command("superuser-url")
+def superuser_url():
+    """Prints the superuser"""
+    try:
+        click.echo(
+            f"http://{settings.host}:{settings.port}/wallet?usr={get_super_user()}"
+        )
+    except ValueError as e:
+        click.echo(str(e))
+
+
+@lnbits_cli.command("delete-settings")
+@coro
+async def delete_settings():
    """Deletes the settings"""

-    async def wrap():
-        async with core_db.connect() as conn:
-            await conn.execute("DELETE from settings")
-
-    loop = asyncio.get_event_loop()
-    loop.run_until_complete(wrap())
+    async with core_db.connect() as conn:
+        await conn.execute("DELETE from settings")


-@click.command("database-migrate")
+@db.command("migrate")
 def database_migrate():
    """Migrate databases"""
    loop = asyncio.get_event_loop()
@@ -47,7 +124,8 @@ def database_migrate():


 async def db_migrate():
-    asyncio.create_task(migrate_databases())
+    task = asyncio.create_task(migrate_databases())
+    await task


 async def migrate_databases():
@@ -70,26 +148,169 @@ async def migrate_databases():

        current_versions = await get_dbversions(conn)
        core_version = current_versions.get("core", 0)
-        await run_migration(conn, core_migrations, core_version)
+        await run_migration(conn, core_migrations, "core", core_version)

-    for ext in get_valid_extensions():
+    # here is the first place we can be sure that the
+    # `installed_extensions` table has been created
+    await load_disabled_extension_list()
+
+    for ext in get_valid_extensions(False):
        current_version = current_versions.get(ext.code, 0)
-        await migrate_extension_database(ext, current_version)
+        try:
+            await migrate_extension_database(ext, current_version)
+        except Exception as e:
+            logger.exception(f"Error migrating extension {ext.code}: {e}")

    logger.info("✔️ All migrations done.")


-@click.command("database-versions")
-def database_versions():
-    """Show current database versions"""
-    loop = asyncio.get_event_loop()
-    loop.run_until_complete(db_versions())
-
-
+@db.command("versions")
+@coro
 async def db_versions():
    """Show current database versions"""
    async with core_db.connect() as conn:
-        return await get_dbversions(conn)
+        click.echo(await get_dbversions(conn))
+
+
+@db.command("cleanup-wallets")
+@click.argument("days", type=int, required=False)
+@coro
+async def database_cleanup_wallets(days: Optional[int] = None):
+    """Delete all wallets that never had any transaction"""
+    async with core_db.connect() as conn:
+        delta = days or settings.cleanup_wallets_days
+        delta = delta * 24 * 60 * 60
+        await delete_unused_wallets(delta, conn)
+
+
+@db.command("cleanup-deleted-wallets")
+@coro
+async def database_cleanup_deleted_wallets():
+    """Delete all wallets that has been marked deleted"""
+    async with core_db.connect() as conn:
+        await remove_deleted_wallets(conn)
+
+
+@db.command("delete-wallet")
+@click.option("-w", "--wallet", required=True, help="ID of wallet to be deleted.")
+@coro
+async def database_delete_wallet(wallet: str):
+    """Mark wallet as deleted"""
+    async with core_db.connect() as conn:
+        count = await delete_wallet_by_id(wallet_id=wallet, conn=conn)
+        click.echo(f"Marked as deleted '{count}' rows.")
+
+
+@db.command("delete-wallet-payment")
+@click.option("-w", "--wallet", required=True, help="ID of wallet to be deleted.")
+@click.option("-c", "--checking-id", required=True, help="Payment checking Id.")
+@coro
+async def database_delete_wallet_payment(wallet: str, checking_id: str):
+    """Delete wallet payment"""
+    async with core_db.connect() as conn:
+        await delete_wallet_payment(
+            wallet_id=wallet, checking_id=checking_id, conn=conn
+        )
+
+
+@db.command("mark-payment-pending")
+@click.option("-c", "--checking-id", required=True, help="Payment checking Id.")
+@coro
+async def database_revert_payment(checking_id: str, pending: bool = True):
+    """Mark wallet as deleted"""
+    async with core_db.connect() as conn:
+        await update_payment_status(pending=pending, checking_id=checking_id, conn=conn)
+
+
+@db.command("cleanup-accounts")
+@click.argument("days", type=int, required=False)
+@coro
+async def database_cleanup_accounts(days: Optional[int] = None):
+    """Delete all accounts that have no wallets"""
+    async with core_db.connect() as conn:
+        delta = days or settings.cleanup_wallets_days
+        delta = delta * 24 * 60 * 60
+        await delete_accounts_no_wallets(delta, conn)
+
+
+@db.command("check-payments")
+@click.option("-d", "--days", help="Maximum age of payments in days.")
+@click.option("-l", "--limit", help="Maximum number of payments to be checked.")
+@click.option("-w", "--wallet", help="Only check for this wallet.")
+@click.option("-v", "--verbose", is_flag=True, help="Detailed log.")
+@coro
+async def check_invalid_payments(
+    days: Optional[int] = None,
+    limit: Optional[int] = None,
+    wallet: Optional[str] = None,
+    verbose: Optional[bool] = False,
+):
+    """Check payments that are settled in the DB but pending on the Funding Source"""
+    await check_admin_settings()
+    settled_db_payments = []
+
+    if verbose:
+        click.echo(f"Get Payments: days={days}, limit={limit}, wallet={wallet}")
+    async with core_db.connect() as conn:
+        delta = int(days) if days else 3  # default to 3 days
+        limit = int(limit) if limit else 1000
+        since = int(time.time()) - delta * 24 * 60 * 60
+
+        settled_db_payments = await get_payments(
+            complete=True,
+            incoming=True,
+            exclude_uncheckable=True,
+            since=since,
+            limit=limit,
+            wallet_id=wallet,
+            conn=conn,
+        )
+
+    click.echo("Settled Payments: " + str(len(settled_db_payments)))
+
+    wallets_module = importlib.import_module("lnbits.wallets")
+    wallet_class = getattr(wallets_module, settings.lnbits_backend_wallet_class)
+
+    funding_source: Wallet = wallet_class()
+
+    click.echo("Funding source: " + str(funding_source))
+
+    # payments that are settled in the DB, but not at the Funding source level
+    invalid_payments: List[Payment] = []
+    invalid_wallets = {}
+    for db_payment in settled_db_payments:
+        if verbose:
+            click.echo(
+                f"Checking Payment: '{db_payment.checking_id}' for wallet"
+                + f" '{db_payment.wallet_id}'."
+            )
+        payment_status = await funding_source.get_invoice_status(db_payment.checking_id)
+
+        if payment_status.pending:
+            invalid_payments.append(db_payment)
+            if db_payment.wallet_id not in invalid_wallets:
+                invalid_wallets[f"{db_payment.wallet_id}"] = [0, 0]
+            invalid_wallets[f"{db_payment.wallet_id}"][0] += 1
+            invalid_wallets[f"{db_payment.wallet_id}"][1] += db_payment.amount
+
+            click.echo(
+                "Invalid Payment:  '"
+                + " ".join(
+                    [
+                        db_payment.checking_id,
+                        db_payment.wallet_id,
+                        str(db_payment.amount / 1000).ljust(10),
+                        db_payment.memo or "",
+                    ]
+                )
+                + "'"
+            )
+
+    click.echo("Invalid Payments: " + str(len(invalid_payments)))
+    click.echo("\nInvalid Wallets: " + str(len(invalid_wallets)))
+    for w in invalid_wallets:
+        data = invalid_wallets[f"{w}"]
+        click.echo(" ".join([w, str(data[0]), str(data[1] / 1000).ljust(10)]))


 async def load_disabled_extension_list() -> None:
@@ -98,14 +319,401 @@ async def load_disabled_extension_list() -> None:
    settings.lnbits_deactivated_extensions += inactive_extensions


+@extensions.command("list")
+@coro
+async def extensions_list():
+    """Show currently installed extensions"""
+    click.echo("Installed extensions:")
+
+    from lnbits.app import build_all_installed_extensions_list
+
+    for ext in await build_all_installed_extensions_list():
+        assert ext.installed_release, f"Extension {ext.id} has no installed_release"
+        click.echo(f"  - {ext.id} ({ext.installed_release.version})")
+
+
+@extensions.command("update")
+@click.argument("extension", required=False)
+@click.option("-a", "--all-extensions", is_flag=True, help="Update all extensions.")
+@click.option(
+    "-i", "--repo-index", help="Select the index of the repository to be used."
+)
+@click.option(
+    "-s",
+    "--source-repo",
+    help="""
+        Provide the repository URL to be used for updating.
+        The URL must be one present in `LNBITS_EXTENSIONS_MANIFESTS`
+        or configured via the Admin UI. This option is required only
+        if an extension is present in more than one repository.
+    """,
+)
+@click.option(
+    "-u",
+    "--url",
+    help="Use this option to update a running server. Eg: 'http://localhost:5000'.",
+)
+@click.option(
+    "-d",
+    "--admin-user",
+    help="Admin user ID (must have permissions to install extensions).",
+)
+@coro
+async def extensions_update(
+    extension: Optional[str] = None,
+    all_extensions: Optional[bool] = False,
+    repo_index: Optional[str] = None,
+    source_repo: Optional[str] = None,
+    url: Optional[str] = None,
+    admin_user: Optional[str] = None,
+):
+    """
+    Update extension to the latest version.
+    If an extension is not present it will be instaled.
+    """
+    if not extension and not all_extensions:
+        click.echo("Extension ID is required.")
+        click.echo("Or specify the '--all-extensions' flag to update all extensions")
+        return
+    if extension and all_extensions:
+        click.echo("Only one of extension ID or the '--all' flag must be specified")
+        return
+    if url and not _is_url(url):
+        click.echo(f"Invalid '--url' option value: {url}")
+        return
+
+    if not await _can_run_operation(url):
+        return
+
+    if extension:
+        await update_extension(extension, repo_index, source_repo, url, admin_user)
+        return
+
+    click.echo("Updating all extensions...")
+    installed_extensions = await get_installed_extensions()
+    updated_extensions = []
+    for e in installed_extensions:
+        try:
+            click.echo(f"""{"="*50} {e.id} {"="*(50-len(e.id))} """)
+            success, msg = await update_extension(
+                e.id, repo_index, source_repo, url, admin_user
+            )
+            if version:
+                updated_extensions.append(
+                    {"id": e.id, "success": success, "message": msg}
+                )
+        except Exception as ex:
+            click.echo(f"Failed to install extension '{e.id}': {ex}")
+
+    if len(updated_extensions) == 0:
+        click.echo("No extension was updated.")
+        return
+
+    for u in sorted(updated_extensions, key=lambda d: str(d["id"])):
+        status = "updated to  " if u["success"] else "not updated "
+        click.echo(
+            f"""'{u["id"]}' {" "*(20-len(str(u["id"])))}"""
+            + f""" - {status}: '{u["message"]}'"""
+        )
+
+
+@extensions.command("install")
+@click.argument("extension")
+@click.option(
+    "-i", "--repo-index", help="Select the index of the repository to be used."
+)
+@click.option(
+    "-s",
+    "--source-repo",
+    help="""
+        Provide the repository URL to be used for updating.
+        The URL must be one present in `LNBITS_EXTENSIONS_MANIFESTS`
+        or configured via the Admin UI. This option is required only
+        if an extension is present in more than one repository.
+    """,
+)
+@click.option(
+    "-u",
+    "--url",
+    help="Use this option to update a running server. Eg: 'http://localhost:5000'.",
+)
+@click.option(
+    "-d",
+    "--admin-user",
+    help="Admin user ID (must have permissions to install extensions).",
+)
+@coro
+async def extensions_install(
+    extension: str,
+    repo_index: Optional[str] = None,
+    source_repo: Optional[str] = None,
+    url: Optional[str] = None,
+    admin_user: Optional[str] = None,
+):
+    """Install a extension"""
+    click.echo(f"Installing {extension}... {repo_index}")
+    if url and not _is_url(url):
+        click.echo(f"Invalid '--url' option value: {url}")
+        return
+
+    if not await _can_run_operation(url):
+        return
+    await install_extension(extension, repo_index, source_repo, url, admin_user)
+
+
+@extensions.command("uninstall")
+@click.argument("extension")
+@click.option(
+    "-u",
+    "--url",
+    help="Use this option to update a running server. Eg: 'http://localhost:5000'.",
+)
+@click.option(
+    "-d",
+    "--admin-user",
+    help="Admin user ID (must have permissions to install extensions).",
+)
+@coro
+async def extensions_uninstall(
+    extension: str, url: Optional[str] = None, admin_user: Optional[str] = None
+):
+    """Uninstall a extension"""
+    click.echo(f"Uninstalling '{extension}'...")
+
+    if url and not _is_url(url):
+        click.echo(f"Invalid '--url' option value: {url}")
+        return
+
+    if not await _can_run_operation(url):
+        return
+    try:
+        await _call_uninstall_extension(extension, url, admin_user)
+        click.echo(f"Extension '{extension}' uninstalled.")
+    except HTTPException as ex:
+        click.echo(f"Failed to uninstall '{extension}' Error: '{ex.detail}'.")
+        return False, ex.detail
+    except Exception as ex:
+        click.echo(f"Failed to uninstall '{extension}': {ex!s}.")
+        return False, str(ex)
+
+
 def main():
    """main function"""
-    command_group.add_command(superuser)
-    command_group.add_command(delete_settings)
-    command_group.add_command(database_migrate)
-    command_group.add_command(database_versions)
-    command_group()
+    lnbits_cli()


 if __name__ == "__main__":
    main()
+
+
+async def install_extension(
+    extension: str,
+    repo_index: Optional[str] = None,
+    source_repo: Optional[str] = None,
+    url: Optional[str] = None,
+    admin_user: Optional[str] = None,
+) -> Tuple[bool, str]:
+    try:
+        release = await _select_release(extension, repo_index, source_repo)
+        if not release:
+            return False, "No release selected"
+
+        data = CreateExtension(
+            ext_id=extension,
+            archive=release.archive,
+            source_repo=release.source_repo,
+            version=release.version,
+        )
+        await _call_install_extension(data, url, admin_user)
+        click.echo(f"Extension '{extension}' ({release.version}) installed.")
+        return True, release.version
+    except HTTPException as ex:
+        click.echo(f"Failed to install '{extension}' Error: '{ex.detail}'.")
+        return False, ex.detail
+    except Exception as ex:
+        click.echo(f"Failed to install '{extension}': {ex!s}.")
+        return False, str(ex)
+
+
+async def update_extension(
+    extension: str,
+    repo_index: Optional[str] = None,
+    source_repo: Optional[str] = None,
+    url: Optional[str] = None,
+    admin_user: Optional[str] = None,
+) -> Tuple[bool, str]:
+    try:
+        click.echo(f"Updating '{extension}' extension.")
+        installed_ext = await get_installed_extension(extension)
+        if not installed_ext:
+            click.echo(
+                f"Extension '{extension}' is not installed. Preparing to install..."
+            )
+            return await install_extension(extension, repo_index, source_repo, url)
+
+        click.echo(f"Current '{extension}' version: {installed_ext.installed_version}.")
+
+        assert (
+            installed_ext.installed_release
+        ), "Cannot find previously installed release. Please uninstall first."
+
+        release = await _select_release(extension, repo_index, source_repo)
+        if not release:
+            return False, "No release selected."
+        if (
+            release.version == installed_ext.installed_version
+            and release.source_repo == installed_ext.installed_release.source_repo
+        ):
+            click.echo(f"Extension '{extension}' already up to date.")
+            return False, "Already up to date"
+
+        click.echo(f"Updating '{extension}' extension to version: {release.version }")
+
+        data = CreateExtension(
+            ext_id=extension,
+            archive=release.archive,
+            source_repo=release.source_repo,
+            version=release.version,
+        )
+
+        await _call_install_extension(data, url, admin_user)
+        click.echo(f"Extension '{extension}' updated.")
+        return True, release.version
+    except HTTPException as ex:
+        click.echo(f"Failed to update '{extension}' Error: '{ex.detail}.")
+        return False, ex.detail
+    except Exception as ex:
+        click.echo(f"Failed to update '{extension}': {ex!s}.")
+        return False, str(ex)
+
+
+async def _select_release(
+    extension: str,
+    repo_index: Optional[str] = None,
+    source_repo: Optional[str] = None,
+) -> Optional[ExtensionRelease]:
+    all_releases = await InstallableExtension.get_extension_releases(extension)
+    if len(all_releases) == 0:
+        click.echo(f"No repository found for extension '{extension}'.")
+        return None
+
+    latest_repo_releases = _get_latest_release_per_repo(all_releases)
+
+    if source_repo:
+        if source_repo not in latest_repo_releases:
+            click.echo(f"Repository not found: '{source_repo}'")
+            return None
+        return latest_repo_releases[source_repo]
+
+    if len(latest_repo_releases) == 1:
+        return latest_repo_releases[next(iter(latest_repo_releases.keys()))]
+
+    repos = list(latest_repo_releases.keys())
+    repos.sort()
+    if not repo_index:
+        click.echo("Multiple repos found. Please select one using:")
+        click.echo("   --repo-index   option for index of the repo, or")
+        click.echo("   --source-repo  option for the manifest URL")
+        click.echo("")
+        click.echo("Repositories: ")
+
+        for index, repo in enumerate(repos):
+            release = latest_repo_releases[repo]
+            click.echo(f"  [{index}] {repo} --> {release.version}")
+        click.echo("")
+        return None
+
+    if not repo_index.isnumeric() or not 0 <= int(repo_index) < len(repos):
+        click.echo(f"--repo-index must be between '0' and '{len(repos) - 1}'")
+        return None
+
+    return latest_repo_releases[repos[int(repo_index)]]
+
+
+def _get_latest_release_per_repo(all_releases):
+    latest_repo_releases = {}
+    for release in all_releases:
+        try:
+            if not release.is_version_compatible:
+                continue
+            # do not remove, parsing also validates
+            release_version = version.parse(release.version)
+            if release.source_repo not in latest_repo_releases:
+                latest_repo_releases[release.source_repo] = release
+                continue
+            if release_version > version.parse(
+                latest_repo_releases[release.source_repo].version
+            ):
+                latest_repo_releases[release.source_repo] = release
+        except version.InvalidVersion as ex:
+            logger.warning(f"Invalid version {release.name}: {ex}")
+    return latest_repo_releases
+
+
+async def _call_install_extension(
+    data: CreateExtension, url: Optional[str], user_id: Optional[str] = None
+):
+    if url:
+        user_id = user_id or get_super_user()
+        async with httpx.AsyncClient() as client:
+            resp = await client.post(
+                f"{url}/api/v1/extension?usr={user_id}", json=data.dict(), timeout=40
+            )
+            resp.raise_for_status()
+    else:
+        await api_install_extension(data, User(id="mock_id"))
+
+
+async def _call_uninstall_extension(
+    extension: str, url: Optional[str], user_id: Optional[str] = None
+):
+    if url:
+        user_id = user_id or get_super_user()
+        async with httpx.AsyncClient() as client:
+            resp = await client.delete(
+                f"{url}/api/v1/extension/{extension}?usr={user_id}", timeout=40
+            )
+            resp.raise_for_status()
+    else:
+        await api_uninstall_extension(extension, User(id="mock_id"))
+
+
+async def _can_run_operation(url) -> bool:
+    await check_admin_settings()
+    if await _is_lnbits_started(url):
+        if not url:
+            click.echo("LNbits server is started. Please either:")
+            click.echo(
+                f"  - use the '--url' option. Eg: --url=http://{settings.host}:{settings.port}"
+            )
+            click.echo(
+                f"  - stop the server running at 'http://{settings.host}:{settings.port}'"
+            )
+
+            return False
+    elif url:
+        click.echo(
+            "The option '--url' has been provided,"
+            + f" but no server found runnint at '{url}'"
+        )
+        return False
+
+    return True
+
+
+async def _is_lnbits_started(url: Optional[str]):
+    try:
+        url = url or f"http://{settings.host}:{settings.port}/api/v1/health"
+        async with httpx.AsyncClient() as client:
+            await client.get(url)
+            return True
+    except Exception:
+        return False
+
+
+def _is_url(url):
+    try:
+        result = urlparse(url)
+        return all([result.scheme, result.netloc])
+    except ValueError:
+        return False
@@ -1,15 +1,40 @@
-from fastapi.routing import APIRouter
+from fastapi import APIRouter, FastAPI

-from lnbits.core.models import CoreAppExtra
-from lnbits.db import Database
+from .db import core_app_extra, db
+from .views.admin_api import admin_router
+from .views.api import api_router
+from .views.auth_api import auth_router
+from .views.extension_api import extension_router

-db = Database("database")
+# this compat is needed for usermanager extension
+from .views.generic import generic_router, update_user_extension
+from .views.node_api import node_router, public_node_router, super_node_router
+from .views.payment_api import payment_router
+from .views.public_api import public_router
+from .views.tinyurl_api import tinyurl_router
+from .views.user_api import users_router
+from .views.wallet_api import wallet_router
+from .views.webpush_api import webpush_router
+from .views.websocket_api import websocket_router

-core_app: APIRouter = APIRouter(tags=["Core"])
+# backwards compatibility for extensions
+core_app = APIRouter(tags=["Core"])

-core_app_extra: CoreAppExtra = CoreAppExtra()

-from .views.admin_api import *
-from .views.api import *
-from .views.generic import *
-from .views.public_api import *
+def init_core_routers(app: FastAPI):
+    app.include_router(core_app)
+    app.include_router(generic_router)
+    app.include_router(auth_router)
+    app.include_router(admin_router)
+    app.include_router(node_router)
+    app.include_router(extension_router)
+    app.include_router(super_node_router)
+    app.include_router(public_node_router)
+    app.include_router(public_router)
+    app.include_router(payment_router)
+    app.include_router(wallet_router)
+    app.include_router(api_router)
+    app.include_router(websocket_router)
+    app.include_router(tinyurl_router)
+    app.include_router(webpush_router)
+    app.include_router(users_router)
@@ -1,26 +1,84 @@
 import datetime
 import json
-from typing import Any, Dict, List, Optional
-from urllib.parse import urlparse
+from time import time
+from typing import Any, Dict, List, Literal, Optional
 from uuid import UUID, uuid4

 import shortuuid
+from passlib.context import CryptContext

-from lnbits import bolt11
-from lnbits.core.models import WalletType
-from lnbits.db import Connection, Database, Filters, Page
+from lnbits.core.db import db
+from lnbits.db import DB_TYPE, SQLITE, Connection, Database, Filters, Page
 from lnbits.extension_manager import InstallableExtension
-from lnbits.settings import AdminSettings, EditableSettings, SuperSettings, settings
+from lnbits.settings import (
+    AdminSettings,
+    EditableSettings,
+    SuperSettings,
+    WebPushSettings,
+    settings,
+)

-from . import db
-from .models import BalanceCheck, Payment, PaymentFilters, TinyURL, User, Wallet
+from .models import (
+    Account,
+    AccountFilters,
+    CreateUser,
+    Payment,
+    PaymentFilters,
+    PaymentHistoryPoint,
+    TinyURL,
+    UpdateUserPassword,
+    User,
+    UserConfig,
+    Wallet,
+    WebPushSubscription,
+)

 # accounts
 # --------


+async def create_user(
+    data: CreateUser, user_config: Optional[UserConfig] = None
+) -> User:
+    if not settings.new_accounts_allowed:
+        raise ValueError("Account creation is disabled.")
+    if await get_account_by_username(data.username):
+        raise ValueError("Username already exists.")
+
+    if data.email and await get_account_by_email(data.email):
+        raise ValueError("Email already exists.")
+
+    pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+    user_id = uuid4().hex
+    tsph = db.timestamp_placeholder
+    now = int(time())
+    await db.execute(
+        f"""
+            INSERT INTO accounts
+            (id, email, username, pass, extra, created_at, updated_at)
+            VALUES (?, ?, ?, ?, ?, {tsph}, {tsph})
+        """,
+        (
+            user_id,
+            data.email,
+            data.username,
+            pwd_context.hash(data.password),
+            json.dumps(dict(user_config)) if user_config else "{}",
+            now,
+            now,
+        ),
+    )
+    new_account = await get_account(user_id=user_id)
+    assert new_account, "Newly created account couldn't be retrieved"
+    return new_account
+
+
 async def create_account(
-    conn: Optional[Connection] = None, user_id: Optional[str] = None
+    conn: Optional[Connection] = None,
+    user_id: Optional[str] = None,
+    email: Optional[str] = None,
+    user_config: Optional[UserConfig] = None,
 ) -> User:
    if user_id:
        user_uuid4 = UUID(hex=user_id, version=4)
@@ -28,7 +86,15 @@ async def create_account(
    else:
        user_id = uuid4().hex

-    await (conn or db).execute("INSERT INTO accounts (id) VALUES (?)", (user_id,))
+    extra = json.dumps(dict(user_config)) if user_config else "{}"
+    now = int(time())
+    await (conn or db).execute(
+        f"""
+        INSERT INTO accounts (id, email, extra, created_at, updated_at)
+        VALUES (?, ?, ?, {db.timestamp_placeholder}, {db.timestamp_placeholder})
+        """,
+        (user_id, email, extra, now, now),
+    )

    new_account = await get_account(user_id=user_id, conn=conn)
    assert new_account, "Newly created account couldn't be retrieved"
@@ -36,19 +102,223 @@ async def create_account(
    return new_account


+async def update_account(
+    user_id: str,
+    username: Optional[str] = None,
+    email: Optional[str] = None,
+    user_config: Optional[UserConfig] = None,
+) -> Optional[User]:
+    user = await get_account(user_id)
+    assert user, "User not found"
+
+    if email:
+        assert not user.email or email == user.email, "Cannot change email."
+        account = await get_account_by_email(email)
+        assert not account or account.id == user_id, "Email already in use."
+
+    if username:
+        assert not user.username or username == user.username, "Cannot change username."
+        account = await get_account_by_username(username)
+        assert not account or account.id == user_id, "Username already in exists."
+
+    username = user.username or username
+    email = user.email or email
+    extra = user_config or user.config
+
+    now = int(time())
+    await db.execute(
+        f"""
+            UPDATE accounts SET (username, email, extra, updated_at) =
+            (?, ?, ?, {db.timestamp_placeholder})
+            WHERE id = ?
+        """,
+        (
+            username,
+            email,
+            json.dumps(dict(extra)) if extra else "{}",
+            now,
+            user_id,
+        ),
+    )
+
+    user = await get_user(user_id)
+    assert user, "Updated account couldn't be retrieved"
+    return user
+
+
+async def delete_account(user_id: str, conn: Optional[Connection] = None) -> None:
+    await (conn or db).execute(
+        "DELETE from accounts WHERE id = ?",
+        (user_id,),
+    )
+
+
+async def get_accounts(
+    filters: Optional[Filters[AccountFilters]] = None,
+    conn: Optional[Connection] = None,
+) -> Page[Account]:
+    return await (conn or db).fetch_page(
+        """
+        SELECT
+            accounts.id,
+            accounts.username,
+            accounts.email,
+            SUM(COALESCE((
+                SELECT balance FROM balances WHERE wallet = wallets.id
+            ), 0)) as balance_msat,
+            SUM((
+                SELECT COUNT(*) FROM apipayments WHERE wallet = wallets.id
+            )) as transaction_count,
+            (
+                SELECT COUNT(*) FROM wallets WHERE wallets.user = accounts.id
+            ) as wallet_count,
+            MAX((
+                SELECT time FROM apipayments
+                WHERE wallet = wallets.id ORDER BY time DESC LIMIT 1
+            )) as last_payment
+            FROM accounts LEFT JOIN wallets ON accounts.id = wallets.user
+        """,
+        [],
+        [],
+        filters=filters,
+        model=Account,
+        group_by=["accounts.id"],
+    )
+
+
 async def get_account(
    user_id: str, conn: Optional[Connection] = None
 ) -> Optional[User]:
    row = await (conn or db).fetchone(
-        "SELECT id, email, pass as password FROM accounts WHERE id = ?", (user_id,)
+        """
+           SELECT id, email, username, created_at, updated_at, extra
+           FROM accounts WHERE id = ?
+        """,
+        (user_id,),
+    )
+
+    user = User(**row) if row else None
+    if user and row["extra"]:
+        user.config = UserConfig(**json.loads(row["extra"]))
+    return user
+
+
+async def delete_accounts_no_wallets(
+    time_delta: int,
+    conn: Optional[Connection] = None,
+) -> None:
+    delta = int(time()) - time_delta
+    await (conn or db).execute(
+        f"""
+        DELETE FROM accounts
+        WHERE NOT EXISTS (
+            SELECT wallets.id FROM wallets WHERE wallets.user = accounts.id
+        ) AND (
+            (updated_at is null AND created_at < {db.timestamp_placeholder})
+            OR updated_at < {db.timestamp_placeholder}
+        )
+        """,
+        (
+            delta,
+            delta,
+        ),
+    )
+
+
+async def get_user_password(user_id: str) -> Optional[str]:
+    row = await db.fetchone(
+        "SELECT pass FROM accounts WHERE id = ?",
+        (user_id,),
+    )
+    if not row:
+        return None
+
+    return row[0]
+
+
+async def verify_user_password(user_id: str, password: str) -> bool:
+    existing_password = await get_user_password(user_id)
+    if not existing_password:
+        return False
+
+    pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+    return pwd_context.verify(password, existing_password)
+
+
+# todo: , conn: Optional[Connection] = None ??
+async def update_user_password(data: UpdateUserPassword) -> Optional[User]:
+    assert data.password == data.password_repeat, "Passwords do not match."
+
+    # old accounts do not have a pasword
+    if await get_user_password(data.user_id):
+        assert data.password_old, "Missing old password"
+        old_pwd_ok = await verify_user_password(data.user_id, data.password_old)
+        assert old_pwd_ok, "Invalid credentials."
+
+    pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+    now = int(time())
+    await db.execute(
+        f"""
+        UPDATE accounts SET pass = ?, updated_at = {db.timestamp_placeholder}
+        WHERE id = ?
+        """,
+        (
+            pwd_context.hash(data.password),
+            now,
+            data.user_id,
+        ),
+    )
+
+    user = await get_user(data.user_id)
+    assert user, "Updated account couldn't be retrieved"
+    return user
+
+
+async def get_account_by_username(
+    username: str, conn: Optional[Connection] = None
+) -> Optional[User]:
+    row = await (conn or db).fetchone(
+        """
+        SELECT id, username, email, created_at, updated_at
+        FROM accounts WHERE username = ?
+        """,
+        (username,),
    )

    return User(**row) if row else None


+async def get_account_by_email(
+    email: str, conn: Optional[Connection] = None
+) -> Optional[User]:
+    row = await (conn or db).fetchone(
+        """
+        SELECT id, username, email, created_at, updated_at
+        FROM accounts WHERE email = ?
+        """,
+        (email,),
+    )
+
+    return User(**row) if row else None
+
+
+async def get_account_by_username_or_email(
+    username_or_email: str, conn: Optional[Connection] = None
+) -> Optional[User]:
+    user = await get_account_by_username(username_or_email, conn)
+    if not user:
+        user = await get_account_by_email(username_or_email, conn)
+    return user
+
+
 async def get_user(user_id: str, conn: Optional[Connection] = None) -> Optional[User]:
    user = await (conn or db).fetchone(
-        "SELECT id, email FROM accounts WHERE id = ?", (user_id,)
+        """
+        SELECT id, email, username, pass, extra, created_at, updated_at
+        FROM accounts WHERE id = ?
+        """,
+        (user_id,),
    )

    if user:
@@ -62,7 +332,7 @@ async def get_user(user_id: str, conn: Optional[Connection] = None) -> Optional[
                SELECT balance FROM balances WHERE wallet = wallets.id
            ), 0) AS balance_msat
            FROM wallets
-            WHERE "user" = ?
+            WHERE "user" = ? and wallets.deleted = false
            """,
            (user_id,),
        )
@@ -72,6 +342,7 @@ async def get_user(user_id: str, conn: Optional[Connection] = None) -> Optional[
    return User(
        id=user["id"],
        email=user["email"],
+        username=user["username"],
        extensions=[
            e[0] for e in extensions if User.is_extension_for_user(e[0], user["id"])
        ],
@@ -79,6 +350,8 @@ async def get_user(user_id: str, conn: Optional[Connection] = None) -> Optional[
        admin=user["id"] == settings.super_user
        or user["id"] in settings.lnbits_admin_users,
        super_user=user["id"] == settings.super_user,
+        has_password=True if user["pass"] else False,
+        config=UserConfig(**json.loads(user["extra"])) if user["extra"] else None,
    )


@@ -95,6 +368,7 @@ async def add_installed_extension(
            dict(ext.installed_release) if ext.installed_release else None
        ),
        "dependencies": ext.dependencies,
+        "payments": [dict(p) for p in ext.payments] if ext.payments else None,
    }

    version = ext.installed_release.version if ext.installed_release else ""
@@ -167,13 +441,15 @@ async def drop_extension_db(*, ext_id: str, conn: Optional[Connection] = None) -
    )


-async def get_installed_extension(ext_id: str, conn: Optional[Connection] = None):
+async def get_installed_extension(
+    ext_id: str, conn: Optional[Connection] = None
+) -> Optional[InstallableExtension]:
    row = await (conn or db).fetchone(
        "SELECT * FROM installed_extensions WHERE id = ?",
        (ext_id,),
    )

-    return dict(row) if row else None
+    return InstallableExtension.from_row(row) if row else None


 async def get_installed_extensions(
@@ -217,10 +493,11 @@ async def create_wallet(
    conn: Optional[Connection] = None,
 ) -> Wallet:
    wallet_id = uuid4().hex
+    now = int(time())
    await (conn or db).execute(
-        """
-        INSERT INTO wallets (id, name, "user", adminkey, inkey)
-        VALUES (?, ?, ?, ?, ?)
+        f"""
+        INSERT INTO wallets (id, name, "user", adminkey, inkey, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, {db.timestamp_placeholder}, {db.timestamp_placeholder})
        """,
        (
            wallet_id,
@@ -228,6 +505,8 @@ async def create_wallet(
            user_id,
            uuid4().hex,
            uuid4().hex,
+            now,
+            now,
        ),
    )

@@ -244,7 +523,10 @@ async def update_wallet(
    conn: Optional[Connection] = None,
 ) -> Optional[Wallet]:
    set_clause = []
-    values = []
+    values: list = []
+    set_clause.append(f"updated_at = {db.timestamp_placeholder}")
+    now = int(time())
+    values.append(now)
    if name:
        set_clause.append("name = ?")
        values.append(name)
@@ -264,18 +546,70 @@ async def update_wallet(


 async def delete_wallet(
-    *, user_id: str, wallet_id: str, conn: Optional[Connection] = None
+    *,
+    user_id: str,
+    wallet_id: str,
+    deleted: bool = True,
+    conn: Optional[Connection] = None,
 ) -> None:
+    now = int(time())
    await (conn or db).execute(
-        """
-        UPDATE wallets AS w
-        SET
-            "user" = 'del:' || w."user",
-            adminkey = 'del:' || w.adminkey,
-            inkey = 'del:' || w.inkey
+        f"""
+        UPDATE wallets
+        SET deleted = ?, updated_at = {db.timestamp_placeholder}
        WHERE id = ? AND "user" = ?
        """,
-        (wallet_id, user_id),
+        (deleted, now, wallet_id, user_id),
+    )
+
+
+async def force_delete_wallet(
+    wallet_id: str, conn: Optional[Connection] = None
+) -> None:
+    await (conn or db).execute(
+        "DELETE FROM wallets WHERE id = ?",
+        (wallet_id,),
+    )
+
+
+async def delete_wallet_by_id(
+    *, wallet_id: str, conn: Optional[Connection] = None
+) -> Optional[int]:
+    now = int(time())
+    result = await (conn or db).execute(
+        f"""
+        UPDATE wallets
+        SET deleted = true, updated_at = {db.timestamp_placeholder}
+        WHERE id = ?
+        """,
+        (now, wallet_id),
+    )
+    return result.rowcount
+
+
+async def remove_deleted_wallets(conn: Optional[Connection] = None) -> None:
+    await (conn or db).execute("DELETE FROM wallets WHERE deleted = true")
+
+
+async def delete_unused_wallets(
+    time_delta: int,
+    conn: Optional[Connection] = None,
+) -> None:
+    delta = int(time()) - time_delta
+    await (conn or db).execute(
+        f"""
+        DELETE FROM wallets
+        WHERE (
+            SELECT COUNT(*) FROM apipayments WHERE wallet = wallets.id
+        ) = 0 AND (
+            (updated_at is null AND created_at < {db.timestamp_placeholder})
+            OR updated_at < {db.timestamp_placeholder}
+        )
+        """,
+        (
+            delta,
+            delta,
+        ),
    )


@@ -293,15 +627,27 @@ async def get_wallet(
    return Wallet(**row) if row else None


+async def get_wallets(user_id: str, conn: Optional[Connection] = None) -> List[Wallet]:
+    rows = await (conn or db).fetchall(
+        """
+        SELECT *, COALESCE((SELECT balance FROM balances WHERE wallet = wallets.id), 0)
+        AS balance_msat FROM wallets WHERE "user" = ?
+        """,
+        (user_id,),
+    )
+
+    return [Wallet(**row) for row in rows]
+
+
 async def get_wallet_for_key(
    key: str,
-    key_type: WalletType = WalletType.invoice,
    conn: Optional[Connection] = None,
 ) -> Optional[Wallet]:
    row = await (conn or db).fetchone(
        """
        SELECT *, COALESCE((SELECT balance FROM balances WHERE wallet = wallets.id), 0)
-        AS balance_msat FROM wallets WHERE adminkey = ? OR inkey = ?
+        AS balance_msat FROM wallets
+        WHERE (adminkey = ? OR inkey = ?) AND deleted = false
        """,
        (key, key),
    )
@@ -309,9 +655,6 @@ async def get_wallet_for_key(
    if not row:
        return None

-    if key_type == WalletType.admin and row["adminkey"] != key:
-        return None
-
    return Wallet(**row)


@@ -320,11 +663,6 @@ async def get_total_balance(conn: Optional[Connection] = None):
    return 0 if row[0] is None else row[0]


-async def get_active_wallet_total_balance(conn: Optional[Connection] = None):
-    row = await (conn or db).fetchone("SELECT SUM(balance) FROM balances")
-    return 0 if row[0] is None else row[0]
-
-
 # wallet payments
 # ---------------

@@ -349,6 +687,7 @@ async def get_standalone_payment(
        SELECT *
        FROM apipayments
        WHERE {clause}
+        ORDER BY amount
        LIMIT 1
        """,
        tuple(values),
@@ -523,22 +862,17 @@ async def create_payment(
    memo: str,
    fee: int = 0,
    preimage: Optional[str] = None,
+    expiry: Optional[datetime.datetime] = None,
    pending: bool = True,
    extra: Optional[Dict] = None,
    webhook: Optional[str] = None,
    conn: Optional[Connection] = None,
 ) -> Payment:
-    # todo: add this when tests are fixed
-    previous_payment = await get_wallet_payment(wallet_id, payment_hash, conn=conn)
+    # we don't allow the creation of the same invoice twice
+    # note: this can be removed if the db uniquess constarints are set appropriately
+    previous_payment = await get_standalone_payment(checking_id, conn=conn)
    assert previous_payment is None, "Payment already exists"

-    try:
-        invoice = bolt11.decode(payment_request)
-        expiration_date = datetime.datetime.fromtimestamp(invoice.date + invoice.expiry)
-    except Exception:
-        # assume maximum bolt11 expiry of 31 days to be on the safe side
-        expiration_date = datetime.datetime.now() + datetime.timedelta(days=31)
-
    await (conn or db).execute(
        """
        INSERT INTO apipayments
@@ -558,11 +892,11 @@ async def create_payment(
            fee,
            (
                json.dumps(extra)
-                if extra and extra != {} and type(extra) is dict
+                if extra and extra != {} and isinstance(extra, dict)
                else None
            ),
            webhook,
-            db.datetime_to_timestamp(expiration_date),
+            db.datetime_to_timestamp(expiry) if expiry else None,
        ),
    )

@@ -643,10 +977,77 @@ async def update_payment_extra(
    )


-async def delete_payment(checking_id: str, conn: Optional[Connection] = None) -> None:
-    await (conn or db).execute(
-        "DELETE FROM apipayments WHERE checking_id = ?", (checking_id,)
+async def update_pending_payments(wallet_id: str):
+    pending_payments = await get_payments(
+        wallet_id=wallet_id,
+        pending=True,
+        exclude_uncheckable=True,
    )
+    for payment in pending_payments:
+        await payment.check_status()
+
+
+DateTrunc = Literal["hour", "day", "month"]
+sqlite_formats = {
+    "hour": "%Y-%m-%d %H:00:00",
+    "day": "%Y-%m-%d 00:00:00",
+    "month": "%Y-%m-01 00:00:00",
+}
+
+
+async def get_payments_history(
+    wallet_id: Optional[str] = None,
+    group: DateTrunc = "day",
+    filters: Optional[Filters] = None,
+) -> List[PaymentHistoryPoint]:
+    if not filters:
+        filters = Filters()
+    where = ["(pending = False OR amount < 0)"]
+    values = []
+    if wallet_id:
+        where.append("wallet = ?")
+        values.append(wallet_id)
+
+    if DB_TYPE == SQLITE and group in sqlite_formats:
+        date_trunc = f"strftime('{sqlite_formats[group]}', time, 'unixepoch')"
+    elif group in ("day", "hour", "month"):
+        date_trunc = f"date_trunc('{group}', time)"
+    else:
+        raise ValueError(f"Invalid group value: {group}")
+
+    transactions = await db.fetchall(
+        f"""
+        SELECT {date_trunc} date,
+               SUM(CASE WHEN amount > 0 THEN amount ELSE 0 END) income,
+               SUM(CASE WHEN amount < 0 THEN abs(amount) + abs(fee) ELSE 0 END) spending
+        FROM apipayments
+        {filters.where(where)}
+        GROUP BY date
+        ORDER BY date DESC
+        """,
+        filters.values(values),
+    )
+    if wallet_id:
+        wallet = await get_wallet(wallet_id)
+        if wallet:
+            balance = wallet.balance_msat
+        else:
+            raise ValueError("Unknown wallet")
+    else:
+        balance = await get_total_balance()
+
+    # since we dont know the balance at the starting point,
+    # we take the current balance and walk backwards
+    results: list[PaymentHistoryPoint] = []
+    for row in transactions:
+        results.insert(
+            0,
+            PaymentHistoryPoint(
+                balance=balance, date=row[0], income=row[1], spending=row[2]
+            ),
+        )
+        balance -= row.income - row.spending
+    return results


 async def delete_wallet_payment(
@@ -661,6 +1062,10 @@ async def delete_wallet_payment(
 async def check_internal(
    payment_hash: str, conn: Optional[Connection] = None
 ) -> Optional[str]:
+    """
+    Returns the checking_id of the internal payment if it exists,
+    otherwise None
+    """
    row = await (conn or db).fetchone(
        """
        SELECT checking_id FROM apipayments
@@ -694,73 +1099,16 @@ async def check_internal_pending(
        return row["pending"]


-# balance_check
-# -------------
-
-
-async def save_balance_check(
-    wallet_id: str, url: str, conn: Optional[Connection] = None
-):
-    domain = urlparse(url).netloc
-
-    await (conn or db).execute(
+async def mark_webhook_sent(payment_hash: str, status: int) -> None:
+    await db.execute(
        """
-        INSERT INTO balance_check (wallet, service, url) VALUES (?, ?, ?)
-        ON CONFLICT (wallet, service) DO UPDATE SET url = ?
+        UPDATE apipayments SET webhook_status = ?
+        WHERE hash = ?
        """,
-        (wallet_id, domain, url, url),
+        (status, payment_hash),
    )


-async def get_balance_check(
-    wallet_id: str, domain: str, conn: Optional[Connection] = None
-) -> Optional[BalanceCheck]:
-    row = await (conn or db).fetchone(
-        """
-        SELECT wallet, service, url
-        FROM balance_check
-        WHERE wallet = ? AND service = ?
-        """,
-        (wallet_id, domain),
-    )
-    return BalanceCheck.from_row(row) if row else None
-
-
-async def get_balance_checks(conn: Optional[Connection] = None) -> List[BalanceCheck]:
-    rows = await (conn or db).fetchall("SELECT wallet, service, url FROM balance_check")
-    return [BalanceCheck.from_row(row) for row in rows]
-
-
-# balance_notify
-# --------------
-
-
-async def save_balance_notify(
-    wallet_id: str, url: str, conn: Optional[Connection] = None
-):
-    await (conn or db).execute(
-        """
-        INSERT INTO balance_notify (wallet, url) VALUES (?, ?)
-        ON CONFLICT (wallet) DO UPDATE SET url = ?
-        """,
-        (wallet_id, url, url),
-    )
-
-
-async def get_balance_notify(
-    wallet_id: str, conn: Optional[Connection] = None
-) -> Optional[str]:
-    row = await (conn or db).fetchone(
-        """
-        SELECT url
-        FROM balance_notify
-        WHERE wallet = ?
-        """,
-        (wallet_id,),
-    )
-    return row[0] if row else None
-
-
 # admin
 # --------

@@ -779,6 +1127,8 @@ async def get_admin_settings(is_super_user: bool = False) -> Optional[AdminSetti
        return None
    row_dict = dict(sets)
    row_dict.pop("super_user")
+    row_dict.pop("auth_all_methods")
+
    admin_settings = AdminSettings(
        is_super_user=is_super_user,
        lnbits_allowed_funding_sources=settings.lnbits_allowed_funding_sources,
@@ -787,12 +1137,17 @@ async def get_admin_settings(is_super_user: bool = False) -> Optional[AdminSetti
    return admin_settings


-async def delete_admin_settings():
+async def delete_admin_settings() -> None:
    await db.execute("DELETE FROM settings")


-async def update_admin_settings(data: EditableSettings):
-    await db.execute("UPDATE settings SET editable_settings = ?", (json.dumps(data),))
+async def update_admin_settings(data: EditableSettings) -> None:
+    row = await db.fetchone("SELECT editable_settings FROM settings")
+    editable_settings = json.loads(row["editable_settings"]) if row else {}
+    editable_settings.update(data.dict(exclude_unset=True))
+    await db.execute(
+        "UPDATE settings SET editable_settings = ?", (json.dumps(editable_settings),)
+    )


 async def update_super_user(super_user: str) -> SuperSettings:
@@ -875,3 +1230,82 @@ async def delete_tinyurl(tinyurl_id: str):
        "DELETE FROM tiny_url WHERE id = ?",
        (tinyurl_id,),
    )
+
+
+# push_notification
+# -----------------
+
+
+async def get_webpush_settings() -> Optional[WebPushSettings]:
+    row = await db.fetchone("SELECT * FROM webpush_settings")
+    if not row:
+        return None
+    vapid_keypair = json.loads(row["vapid_keypair"])
+    return WebPushSettings(**vapid_keypair)
+
+
+async def create_webpush_settings(webpush_settings: dict):
+    await db.execute(
+        "INSERT INTO webpush_settings (vapid_keypair) VALUES (?)",
+        (json.dumps(webpush_settings),),
+    )
+    return await get_webpush_settings()
+
+
+async def get_webpush_subscription(
+    endpoint: str, user: str
+) -> Optional[WebPushSubscription]:
+    row = await db.fetchone(
+        "SELECT * FROM webpush_subscriptions WHERE endpoint = ? AND user = ?",
+        (
+            endpoint,
+            user,
+        ),
+    )
+    return WebPushSubscription(**dict(row)) if row else None
+
+
+async def get_webpush_subscriptions_for_user(
+    user: str,
+) -> List[WebPushSubscription]:
+    rows = await db.fetchall(
+        "SELECT * FROM webpush_subscriptions WHERE user = ?",
+        (user,),
+    )
+    return [WebPushSubscription(**dict(row)) for row in rows]
+
+
+async def create_webpush_subscription(
+    endpoint: str, user: str, data: str, host: str
+) -> WebPushSubscription:
+    await db.execute(
+        """
+        INSERT INTO webpush_subscriptions (endpoint, user, data, host)
+        VALUES (?, ?, ?, ?)
+        """,
+        (
+            endpoint,
+            user,
+            data,
+            host,
+        ),
+    )
+    subscription = await get_webpush_subscription(endpoint, user)
+    assert subscription, "Newly created webpush subscription couldn't be retrieved"
+    return subscription
+
+
+async def delete_webpush_subscription(endpoint: str, user: str) -> None:
+    await db.execute(
+        "DELETE FROM webpush_subscriptions WHERE endpoint = ? AND user = ?",
+        (
+            endpoint,
+            user,
+        ),
+    )
+
+
+async def delete_webpush_subscriptions(endpoint: str) -> None:
+    await db.execute(
+        "DELETE FROM webpush_subscriptions WHERE endpoint = ?", (endpoint,)
+    )
@@ -0,0 +1,5 @@
+from lnbits.core.models import CoreAppExtra
+from lnbits.db import Database
+
+db = Database("database")
+core_app_extra: CoreAppExtra = CoreAppExtra()
@@ -1,16 +1,16 @@
 import importlib
 import re
-from typing import Any
+from typing import Any, Optional
 from uuid import UUID

 import httpx
 from loguru import logger

+from lnbits.core.db import db as core_db
 from lnbits.db import Connection
 from lnbits.extension_manager import Extension
 from lnbits.settings import settings

-from . import db as core_db
 from .crud import update_migration_version


@@ -18,19 +18,20 @@ async def migrate_extension_database(ext: Extension, current_version):
    try:
        ext_migrations = importlib.import_module(f"{ext.module_name}.migrations")
        ext_db = importlib.import_module(ext.module_name).db
-    except ImportError as e:
-        logger.error(e)
+    except ImportError as exc:
+        logger.error(exc)
        raise ImportError(
            f"Please make sure that the extension `{ext.code}` has a migrations file."
-        )
+        ) from exc

    async with ext_db.connect() as ext_conn:
-        await run_migration(ext_conn, ext_migrations, current_version)
+        await run_migration(ext_conn, ext_migrations, ext.code, current_version)


-async def run_migration(db: Connection, migrations_module: Any, current_version: int):
+async def run_migration(
+    db: Connection, migrations_module: Any, db_name: str, current_version: int
+):
    matcher = re.compile(r"^m(\d\d\d)_")
-    db_name = migrations_module.__name__.split(".")[-2]
    for key, migrate in migrations_module.__dict__.items():
        match = matcher.match(key)
        if match:
@@ -47,24 +48,64 @@ async def run_migration(db: Connection, migrations_module: Any, current_version:
                        await update_migration_version(conn, db_name, version)


-async def stop_extension_background_work(ext_id: str, user: str):
+async def stop_extension_background_work(
+    ext_id: str, user: str, access_token: Optional[str] = None
+):
    """
    Stop background work for extension (like asyncio.Tasks, WebSockets, etc).
-    Extensions SHOULD expose a DELETE enpoint at the root level of their API.
-    This function tries first to call the endpoint using `http`
-    and if it fails it tries using `https`.
+    Extensions SHOULD expose a `api_stop()` function and/or a DELETE enpoint
+    at the root level of their API.
    """
+    stopped = await _stop_extension_background_work(ext_id)
+
+    if not stopped:
+        # fallback to REST API call
+        await _stop_extension_background_work_via_api(ext_id, user, access_token)
+
+
+async def _stop_extension_background_work(ext_id) -> bool:
+    upgrade_hash = settings.extension_upgrade_hash(ext_id) or ""
+    ext = Extension(ext_id, True, False, upgrade_hash=upgrade_hash)
+
+    try:
+        logger.info(f"Stopping background work for extension '{ext.module_name}'.")
+        old_module = importlib.import_module(ext.module_name)
+
+        # Extensions must expose an `{ext_id}_stop()` function at the module level
+        # The `api_stop()` function is for backwards compatibility (will be deprecated)
+        stop_fns = [f"{ext_id}_stop", "api_stop"]
+        stop_fn_name = next((fn for fn in stop_fns if hasattr(old_module, fn)), None)
+        assert stop_fn_name, "No stop function found for '{ext.module_name}'"
+
+        await getattr(old_module, stop_fn_name)()
+
+        logger.info(f"Stopped background work for extension '{ext.module_name}'.")
+    except Exception as ex:
+        logger.warning(f"Failed to stop background work for '{ext.module_name}'.")
+        logger.warning(ex)
+        return False
+
+    return True
+
+
+async def _stop_extension_background_work_via_api(ext_id, user, access_token):
+    logger.info(
+        f"Stopping background work for extension '{ext_id}' using the REST API."
+    )
    async with httpx.AsyncClient() as client:
        try:
            url = f"http://{settings.host}:{settings.port}/{ext_id}/api/v1?usr={user}"
-            await client.delete(url)
+            headers = (
+                {"Authorization": "Bearer " + access_token} if access_token else None
+            )
+            resp = await client.delete(url=url, headers=headers)
+            resp.raise_for_status()
+            logger.info(f"Stopped background work for extension '{ext_id}'.")
        except Exception as ex:
+            logger.warning(
+                f"Failed to stop background work for '{ext_id}' using the REST API."
+            )
            logger.warning(ex)
-            try:
-                # try https
-                url = f"https://{settings.host}:{settings.port}/{ext_id}/api/v1?usr={user}"
-            except Exception as ex:
-                logger.warning(ex)


 def to_valid_user_id(user_id: str) -> UUID:
@@ -72,7 +113,7 @@ def to_valid_user_id(user_id: str) -> UUID:
        raise ValueError("User ID must have at least 128 bits")
    try:
        int(user_id, 16)
-    except Exception:
-        raise ValueError("Invalid hex string for User ID.")
+    except Exception as exc:
+        raise ValueError("Invalid hex string for User ID.") from exc

    return UUID(hex=user_id[:32], version=4)
@@ -1,4 +1,5 @@
 import datetime
+from time import time

 from loguru import logger
 from sqlalchemy.exc import OperationalError
@@ -327,3 +328,187 @@ async def m012_add_currency_to_wallet(db):
        ALTER TABLE wallets ADD COLUMN currency TEXT
        """
    )
+
+
+async def m013_add_deleted_to_wallets(db):
+    """
+    Adds deleted column to wallets.
+    """
+    try:
+        await db.execute(
+            "ALTER TABLE wallets ADD COLUMN deleted BOOLEAN NOT NULL DEFAULT false"
+        )
+    except OperationalError:
+        pass
+
+
+async def m014_set_deleted_wallets(db):
+    """
+    Sets deleted column to wallets.
+    """
+    try:
+        rows = await (
+            await db.execute(
+                """
+                SELECT *
+                FROM wallets
+                WHERE user LIKE 'del:%'
+                AND adminkey LIKE 'del:%'
+                AND inkey LIKE 'del:%'
+                """
+            )
+        ).fetchall()
+
+        for row in rows:
+            try:
+                user = row[2].split(":")[1]
+                adminkey = row[3].split(":")[1]
+                inkey = row[4].split(":")[1]
+                await db.execute(
+                    """
+                    UPDATE wallets SET user = ?, adminkey = ?, inkey = ?, deleted = true
+                    WHERE id = ?
+                    """,
+                    (user, adminkey, inkey, row[0]),
+                )
+            except Exception:
+                continue
+    except OperationalError:
+        # this is necessary now because it may be the case that this migration will
+        # run twice in some environments.
+        # catching errors like this won't be necessary in anymore now that we
+        # keep track of db versions so no migration ever runs twice.
+        pass
+
+
+async def m015_create_push_notification_subscriptions_table(db):
+    await db.execute(
+        f"""
+        CREATE TABLE IF NOT EXISTS webpush_subscriptions (
+            endpoint TEXT NOT NULL,
+            "user" TEXT NOT NULL,
+            data TEXT NOT NULL,
+            host TEXT NOT NULL,
+            timestamp TIMESTAMP NOT NULL DEFAULT {db.timestamp_now},
+            PRIMARY KEY (endpoint, "user")
+        );
+    """
+    )
+
+
+async def m016_add_username_column_to_accounts(db):
+    """
+    Adds username column to accounts.
+    """
+    try:
+        await db.execute("ALTER TABLE accounts ADD COLUMN username TEXT")
+        await db.execute("ALTER TABLE accounts ADD COLUMN extra TEXT")
+    except OperationalError:
+        pass
+
+
+async def m017_add_timestamp_columns_to_accounts_and_wallets(db):
+    """
+    Adds created_at and updated_at column to accounts and wallets.
+    """
+    try:
+        await db.execute(
+            "ALTER TABLE accounts "
+            f"ADD COLUMN created_at TIMESTAMP DEFAULT {db.timestamp_column_default}"
+        )
+        await db.execute(
+            "ALTER TABLE accounts "
+            f"ADD COLUMN updated_at TIMESTAMP DEFAULT {db.timestamp_column_default}"
+        )
+        await db.execute(
+            "ALTER TABLE wallets "
+            f"ADD COLUMN created_at TIMESTAMP DEFAULT {db.timestamp_column_default}"
+        )
+        await db.execute(
+            "ALTER TABLE wallets "
+            f"ADD COLUMN updated_at TIMESTAMP DEFAULT {db.timestamp_column_default}"
+        )
+
+        # # set their wallets created_at with the first payment
+        # await db.execute(
+        #     """
+        #     UPDATE wallets SET created_at = (
+        #         SELECT time FROM apipayments
+        #         WHERE apipayments.wallet = wallets.id
+        #         ORDER BY time ASC LIMIT 1
+        #     )
+        #  """
+        # )
+
+        # # then set their accounts created_at with the wallet
+        # await db.execute(
+        #     """
+        #     UPDATE accounts SET created_at = (
+        #         SELECT created_at FROM wallets
+        #         WHERE wallets.user = accounts.id
+        #         ORDER BY created_at ASC LIMIT 1
+        #     )
+        #  """
+        # )
+
+        # set all to now where they are null
+        now = int(time())
+        await db.execute(
+            f"""
+            UPDATE wallets SET created_at = {db.timestamp_placeholder}
+            WHERE created_at IS NULL
+            """,
+            (now,),
+        )
+        await db.execute(
+            f"""
+            UPDATE accounts SET created_at = {db.timestamp_placeholder}
+            WHERE created_at IS NULL
+            """,
+            (now,),
+        )
+
+    except OperationalError as exc:
+        logger.error(f"Migration 17 failed: {exc}")
+        pass
+
+
+async def m018_balances_view_exclude_deleted(db):
+    """
+    Make deleted wallets not show up in the balances view.
+    """
+    await db.execute("DROP VIEW balances")
+    await db.execute(
+        """
+        CREATE VIEW balances AS
+        SELECT apipayments.wallet,
+               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
+        FROM apipayments
+        LEFT JOIN wallets ON apipayments.wallet = wallets.id
+        WHERE (wallets.deleted = false OR wallets.deleted is NULL)
+              AND ((apipayments.pending = false AND apipayments.amount > 0)
+              OR apipayments.amount < 0)
+        GROUP BY wallet
+    """
+    )
+
+
+async def m019_balances_view_based_on_wallets(db):
+    """
+    Make deleted wallets not show up in the balances view.
+    Important for querying whole lnbits balances.
+    """
+    await db.execute("DROP VIEW balances")
+    await db.execute(
+        """
+        CREATE VIEW balances AS
+        SELECT apipayments.wallet,
+               SUM(apipayments.amount - ABS(apipayments.fee)) AS balance
+        FROM wallets
+        LEFT JOIN apipayments ON apipayments.wallet = wallets.id
+        WHERE (wallets.deleted = false OR wallets.deleted is NULL)
+              AND ((apipayments.pending = false AND apipayments.amount > 0)
+              OR apipayments.amount < 0)
+        GROUP BY apipayments.wallet
+    """
+    )
@@ -10,26 +10,32 @@ from typing import Callable, Dict, List, Optional

 from ecdsa import SECP256k1, SigningKey
 from fastapi import Query
-from lnurl import encode as lnurl_encode
 from loguru import logger
 from pydantic import BaseModel

 from lnbits.db import Connection, FilterModel, FromRowModel
 from lnbits.helpers import url_for
+from lnbits.lnurl import encode as lnurl_encode
 from lnbits.settings import settings
-from lnbits.wallets import get_wallet_class
-from lnbits.wallets.base import PaymentStatus
+from lnbits.wallets import get_funding_source
+from lnbits.wallets.base import PaymentPendingStatus, PaymentStatus


-class Wallet(BaseModel):
+class BaseWallet(BaseModel):
    id: str
    name: str
-    user: str
    adminkey: str
    inkey: str
-    currency: Optional[str]
    balance_msat: int

+
+class Wallet(BaseWallet):
+    user: str
+    currency: Optional[str]
+    deleted: bool
+    created_at: Optional[int] = None
+    updated_at: Optional[int] = None
+
    @property
    def balance(self) -> int:
        return self.balance_msat // 1000
@@ -62,7 +68,7 @@ class Wallet(BaseModel):
        return await get_standalone_payment(payment_hash)


-class WalletType(Enum):
+class KeyType(Enum):
    admin = 0
    invoice = 1
    invalid = 2
@@ -74,18 +80,66 @@ class WalletType(Enum):

@dataclass
 class WalletTypeInfo:
-    wallet_type: WalletType
+    key_type: KeyType
    wallet: Wallet


+class UserConfig(BaseModel):
+    email_verified: Optional[bool] = False
+    first_name: Optional[str] = None
+    last_name: Optional[str] = None
+    display_name: Optional[str] = None
+    picture: Optional[str] = None
+    # Auth provider, possible values:
+    # - "env": the user was created automatically by the system
+    # - "lnbits": the user was created via register form (username/pass or user_id only)
+    # - "google | github | ...": the user was created using an SSO provider
+    provider: Optional[str] = "lnbits"  # auth provider
+
+
+class Account(FromRowModel):
+    id: str
+    is_super_user: Optional[bool] = False
+    is_admin: Optional[bool] = False
+    username: Optional[str] = None
+    email: Optional[str] = None
+    balance_msat: Optional[int] = 0
+    transaction_count: Optional[int] = 0
+    wallet_count: Optional[int] = 0
+    last_payment: Optional[datetime.datetime] = None
+
+
+class AccountFilters(FilterModel):
+    __search_fields__ = ["id", "email", "username"]
+    __sort_fields__ = [
+        "balance_msat",
+        "email",
+        "username",
+        "transaction_count",
+        "wallet_count",
+        "last_payment",
+    ]
+
+    id: str
+    last_payment: Optional[datetime.datetime] = None
+    transaction_count: Optional[int] = None
+    wallet_count: Optional[int] = None
+    username: Optional[str] = None
+    email: Optional[str] = None
+
+
 class User(BaseModel):
    id: str
    email: Optional[str] = None
+    username: Optional[str] = None
    extensions: List[str] = []
    wallets: List[Wallet] = []
-    password: Optional[str] = None
    admin: bool = False
    super_user: bool = False
+    has_password: bool = False
+    config: Optional[UserConfig] = None
+    created_at: Optional[int] = None
+    updated_at: Optional[int] = None

    @property
    def wallet_ids(self) -> List[str]:
@@ -106,6 +160,43 @@ class User(BaseModel):
        return False


+class CreateUser(BaseModel):
+    email: Optional[str] = Query(default=None)
+    username: str = Query(default=..., min_length=2, max_length=20)
+    password: str = Query(default=..., min_length=8, max_length=50)
+    password_repeat: str = Query(default=..., min_length=8, max_length=50)
+
+
+class UpdateUser(BaseModel):
+    user_id: str
+    email: Optional[str] = Query(default=None)
+    username: Optional[str] = Query(default=..., min_length=2, max_length=20)
+    config: Optional[UserConfig] = None
+
+
+class UpdateUserPassword(BaseModel):
+    user_id: str
+    password: str = Query(default=..., min_length=8, max_length=50)
+    password_repeat: str = Query(default=..., min_length=8, max_length=50)
+    password_old: Optional[str] = Query(default=None, min_length=8, max_length=50)
+    username: Optional[str] = Query(default=..., min_length=2, max_length=20)
+
+
+class UpdateSuperuserPassword(BaseModel):
+    username: str = Query(default=..., min_length=2, max_length=20)
+    password: str = Query(default=..., min_length=8, max_length=50)
+    password_repeat: str = Query(default=..., min_length=8, max_length=50)
+
+
+class LoginUsr(BaseModel):
+    usr: str
+
+
+class LoginUsernamePassword(BaseModel):
+    username: str
+    password: str
+
+
 class Payment(FromRowModel):
    checking_id: str
    pending: bool
@@ -198,18 +289,18 @@ class Payment(FromRowModel):
        conn: Optional[Connection] = None,
    ) -> PaymentStatus:
        if self.is_uncheckable:
-            return PaymentStatus(None)
+            return PaymentPendingStatus()

        logger.debug(
            f"Checking {'outgoing' if self.is_out else 'incoming'} "
            f"pending payment {self.checking_id}"
        )

-        WALLET = get_wallet_class()
+        funding_source = get_funding_source()
        if self.is_out:
-            status = await WALLET.get_payment_status(self.checking_id)
+            status = await funding_source.get_payment_status(self.checking_id)
        else:
-            status = await WALLET.get_invoice_status(self.checking_id)
+            status = await funding_source.get_invoice_status(self.checking_id)

        logger.debug(f"Status: {status}")

@@ -220,11 +311,18 @@ class Payment(FromRowModel):
                f"expired {expiration_date}"
            )
            await self.delete(conn)
+        # wait at least 15 minutes before deleting failed outgoing payments
        elif self.is_out and status.failed:
-            logger.warning(
-                f"Deleting outgoing failed payment {self.checking_id}: {status}"
-            )
-            await self.delete(conn)
+            if self.time + 900 < int(time.time()):
+                logger.warning(
+                    f"Deleting outgoing failed payment {self.checking_id}: {status}"
+                )
+                await self.delete(conn)
+            else:
+                logger.warning(
+                    f"Tried to delete outgoing payment {self.checking_id}: "
+                    "skipping because it's not old enough"
+                )
        elif not status.pending:
            logger.info(
                f"Marking '{'in' if self.is_in else 'out'}' "
@@ -234,9 +332,9 @@ class Payment(FromRowModel):
        return status

    async def delete(self, conn: Optional[Connection] = None) -> None:
-        from .crud import delete_payment
+        from .crud import delete_wallet_payment

-        await delete_payment(self.checking_id, conn=conn)
+        await delete_wallet_payment(self.checking_id, self.wallet_id, conn=conn)


 class PaymentFilters(FilterModel):
@@ -257,18 +355,19 @@ class PaymentFilters(FilterModel):
    webhook_status: Optional[int]


-class BalanceCheck(BaseModel):
-    wallet: str
-    service: str
-    url: str
+class PaymentHistoryPoint(BaseModel):
+    date: datetime.datetime
+    income: int
+    spending: int
+    balance: int

-    @classmethod
-    def from_row(cls, row: Row):
-        return cls(wallet=row["wallet"], service=row["service"], url=row["url"])
+
+def _do_nothing(*_):
+    pass


 class CoreAppExtra:
-    register_new_ext_routes: Callable
+    register_new_ext_routes: Callable = _do_nothing
    register_new_ratelimiter: Callable


@@ -304,6 +403,7 @@ class CreateLnurl(BaseModel):
    amount: int
    comment: Optional[str] = None
    description: Optional[str] = None
+    unit: Optional[str] = None


 class CreateInvoice(BaseModel):
@@ -315,11 +415,10 @@ class CreateInvoice(BaseModel):
    description_hash: Optional[str] = None
    unhashed_description: Optional[str] = None
    expiry: Optional[int] = None
-    lnurl_callback: Optional[str] = None
-    lnurl_balance_check: Optional[str] = None
    extra: Optional[dict] = None
    webhook: Optional[str] = None
    bolt11: Optional[str] = None
+    lnurl_callback: Optional[str] = None


 class CreateTopup(BaseModel):
@@ -329,3 +428,28 @@ class CreateTopup(BaseModel):

 class CreateLnurlAuth(BaseModel):
    callback: str
+
+
+class CreateWallet(BaseModel):
+    name: Optional[str] = None
+
+
+class CreateWebPushSubscription(BaseModel):
+    subscription: str
+
+
+class WebPushSubscription(BaseModel):
+    endpoint: str
+    user: str
+    data: str
+    host: str
+    timestamp: str
+
+
+class BalanceDelta(BaseModel):
+    lnbits_balance_msats: int
+    node_balance_msats: int
+
+    @property
+    def delta_msats(self):
+        return self.node_balance_msats - self.lnbits_balance_msats
@@ -1,19 +1,26 @@
 import asyncio
+import datetime
 import json
+import time
 from io import BytesIO
+from pathlib import Path
 from typing import Dict, List, Optional, Tuple, TypedDict
 from urllib.parse import parse_qs, urlparse

 import httpx
+from bolt11 import decode as bolt11_decode
+from cryptography.hazmat.primitives import serialization
 from fastapi import Depends, WebSocket
-from lnurl import LnurlErrorResponse
-from lnurl import decode as decode_lnurl
 from loguru import logger
+from py_vapid import Vapid
+from py_vapid.utils import b64urlencode

-from lnbits import bolt11
+from lnbits.core.db import db
 from lnbits.db import Connection
 from lnbits.decorators import WalletTypeInfo, require_admin_key
 from lnbits.helpers import url_for
+from lnbits.lnurl import LnurlErrorResponse
+from lnbits.lnurl import decode as decode_lnurl
 from lnbits.settings import (
    EditableSettings,
    SuperSettings,
@@ -22,10 +29,14 @@ from lnbits.settings import (
    settings,
 )
 from lnbits.utils.exchange_rates import fiat_amount_as_satoshis, satoshis_amount_as_fiat
-from lnbits.wallets import FAKE_WALLET, get_wallet_class, set_wallet_class
-from lnbits.wallets.base import PaymentResponse, PaymentStatus
+from lnbits.wallets import fake_wallet, get_funding_source, set_funding_source
+from lnbits.wallets.base import (
+    PaymentPendingStatus,
+    PaymentResponse,
+    PaymentStatus,
+    PaymentSuccessStatus,
+)

-from . import db
 from .crud import (
    check_internal,
    check_internal_pending,
@@ -35,25 +46,31 @@ from .crud import (
    create_wallet,
    delete_wallet_payment,
    get_account,
+    get_payments,
    get_standalone_payment,
    get_super_settings,
    get_total_balance,
    get_wallet,
    get_wallet_payment,
+    update_admin_settings,
    update_payment_details,
    update_payment_status,
    update_super_user,
 )
 from .helpers import to_valid_user_id
-from .models import Payment, Wallet
+from .models import BalanceDelta, Payment, UserConfig, Wallet


-class PaymentFailure(Exception):
-    pass
+class PaymentError(Exception):
+    def __init__(self, message: str, status: str = "pending"):
+        self.message = message
+        self.status = status


-class InvoiceFailure(Exception):
-    pass
+class InvoiceError(Exception):
+    def __init__(self, message: str, status: str = "pending"):
+        self.message = message
+        self.status = status


 async def calculate_fiat_amounts(
@@ -87,7 +104,9 @@ async def calculate_fiat_amounts(
        extra["wallet_fiat_amount"] = round(fiat_amount, ndigits=3)
        extra["wallet_fiat_rate"] = amount_sat / fiat_amount

-    logger.debug(f"Calculated fiat amounts for {wallet}: {extra=}")
+    logger.debug(
+        f"Calculated fiat amounts {wallet.id=} {amount=} {currency=}: {extra=}"
+    )

    return amount_sat, extra

@@ -107,18 +126,36 @@ async def create_invoice(
    conn: Optional[Connection] = None,
 ) -> Tuple[str, str]:
    if not amount > 0:
-        raise InvoiceFailure("Amountless invoices not supported.")
+        raise InvoiceError("Amountless invoices not supported.", status="failed")
+
+    user_wallet = await get_wallet(wallet_id, conn=conn)
+    if not user_wallet:
+        raise InvoiceError(f"Could not fetch wallet '{wallet_id}'.", status="failed")

    invoice_memo = None if description_hash else memo

    # use the fake wallet if the invoice is for internal use only
-    wallet = FAKE_WALLET if internal else get_wallet_class()
+    funding_source = fake_wallet if internal else get_funding_source()

    amount_sat, extra = await calculate_fiat_amounts(
        amount, wallet_id, currency=currency, extra=extra, conn=conn
    )

-    ok, checking_id, payment_request, error_message = await wallet.create_invoice(
+    if settings.is_wallet_max_balance_exceeded(
+        user_wallet.balance_msat / 1000 + amount_sat
+    ):
+        raise InvoiceError(
+            f"Wallet balance cannot exceed "
+            f"{settings.lnbits_wallet_limit_max_balance} sats.",
+            status="failed",
+        )
+
+    (
+        ok,
+        checking_id,
+        payment_request,
+        error_message,
+    ) = await funding_source.create_invoice(
        amount=amount_sat,
        memo=invoice_memo,
        description_hash=description_hash,
@@ -126,9 +163,11 @@ async def create_invoice(
        expiry=expiry or settings.lightning_invoice_expiry,
    )
    if not ok or not payment_request or not checking_id:
-        raise InvoiceFailure(error_message or "unexpected backend error.")
+        raise InvoiceError(
+            error_message or "unexpected backend error.", status="pending"
+        )

-    invoice = bolt11.decode(payment_request)
+    invoice = bolt11_decode(payment_request)

    amount_msat = 1000 * amount_sat
    await create_payment(
@@ -137,6 +176,7 @@ async def create_invoice(
        payment_request=payment_request,
        payment_hash=invoice.payment_hash,
        amount=amount_msat,
+        expiry=invoice.expiry_date,
        memo=memo,
        extra=extra,
        webhook=webhook,
@@ -165,19 +205,24 @@ async def pay_invoice(
    If the payment is still in flight, we hope that some other process
    will regularly check for the payment.
    """
-    invoice = bolt11.decode(payment_request)
-    fee_reserve_msat = fee_reserve(invoice.amount_msat)
+    try:
+        invoice = bolt11_decode(payment_request)
+    except Exception as exc:
+        raise PaymentError("Bolt11 decoding failed.", status="failed") from exc
+
+    if not invoice.amount_msat or not invoice.amount_msat > 0:
+        raise PaymentError("Amountless invoices not supported.", status="failed")
+    if max_sat and invoice.amount_msat > max_sat * 1000:
+        raise PaymentError("Amount in invoice is too high.", status="failed")
+
+    await check_wallet_limits(wallet_id, conn, invoice.amount_msat)
+
    async with db.reuse_conn(conn) if conn else db.connect() as conn:
        temp_id = invoice.payment_hash
        internal_id = f"internal_{invoice.payment_hash}"

-        if invoice.amount_msat == 0:
-            raise ValueError("Amountless invoices not supported.")
-        if max_sat and invoice.amount_msat > max_sat * 1000:
-            raise ValueError("Amount in invoice is too high.")
-
        _, extra = await calculate_fiat_amounts(
-            invoice.amount_msat, wallet_id, extra=extra, conn=conn
+            invoice.amount_msat / 1000, wallet_id, extra=extra, conn=conn
        )

        # put all parameters that don't change here
@@ -187,6 +232,7 @@ async def pay_invoice(
            payment_hash: str
            amount: int
            memo: str
+            expiry: Optional[datetime.datetime]
            extra: Optional[Dict]

        payment_kwargs: PaymentKwargs = PaymentKwargs(
@@ -194,6 +240,7 @@ async def pay_invoice(
            payment_request=payment_request,
            payment_hash=invoice.payment_hash,
            amount=-invoice.amount_msat,
+            expiry=invoice.expiry_date,
            memo=description or invoice.description or "",
            extra=extra,
        )
@@ -201,12 +248,15 @@ async def pay_invoice(
        # we check if an internal invoice exists that has already been paid
        # (not pending anymore)
        if not await check_internal_pending(invoice.payment_hash, conn=conn):
-            raise PaymentFailure("Internal invoice already paid.")
+            raise PaymentError("Internal invoice already paid.", status="failed")

        # check_internal() returns the checking_id of the invoice we're waiting for
        # (pending only)
        internal_checking_id = await check_internal(invoice.payment_hash, conn=conn)
        if internal_checking_id:
+            fee_reserve_total_msat = fee_reserve_total(
+                invoice.amount_msat, internal=True
+            )
            # perform additional checks on the internal payment
            # the payment hash is not enough to make sure that this is the same invoice
            internal_invoice = await get_standalone_payment(
@@ -217,46 +267,54 @@ async def pay_invoice(
                internal_invoice.amount != invoice.amount_msat
                or internal_invoice.bolt11 != payment_request.lower()
            ):
-                raise PaymentFailure("Invalid invoice.")
+                raise PaymentError("Invalid invoice.", status="failed")

            logger.debug(f"creating temporary internal payment with id {internal_id}")
            # create a new payment from this wallet
            new_payment = await create_payment(
                checking_id=internal_id,
-                fee=0,
+                fee=0 + abs(fee_reserve_total_msat),
                pending=False,
                conn=conn,
                **payment_kwargs,
            )
        else:
+            fee_reserve_total_msat = fee_reserve_total(
+                invoice.amount_msat, internal=False
+            )
            logger.debug(f"creating temporary payment with id {temp_id}")
            # create a temporary payment here so we can check if
            # the balance is enough in the next step
            try:
                new_payment = await create_payment(
                    checking_id=temp_id,
-                    fee=-fee_reserve_msat,
+                    fee=-abs(fee_reserve_total_msat),
                    conn=conn,
                    **payment_kwargs,
                )
-            except Exception as e:
-                logger.error(f"could not create temporary payment: {e}")
+            except Exception as exc:
+                logger.error(f"could not create temporary payment: {exc}")
                # happens if the same wallet tries to pay an invoice twice
-                raise PaymentFailure("Could not make payment.")
+                raise PaymentError("Could not make payment.", status="failed") from exc

        # do the balance check
        wallet = await get_wallet(wallet_id, conn=conn)
        assert wallet, "Wallet for balancecheck could not be fetched"
        if wallet.balance_msat < 0:
            logger.debug("balance is too low, deleting temporary payment")
-            if not internal_checking_id and wallet.balance_msat > -fee_reserve_msat:
-                raise PaymentFailure(
-                    f"You must reserve at least ({round(fee_reserve_msat/1000)} sat) to"
-                    " cover potential routing fees."
+            if (
+                not internal_checking_id
+                and wallet.balance_msat > -fee_reserve_total_msat
+            ):
+                raise PaymentError(
+                    f"You must reserve at least ({round(fee_reserve_total_msat/1000)}"
+                    "  sat) to cover potential routing fees.",
+                    status="failed",
                )
-            raise PermissionError("Insufficient balance.")
+            raise PaymentError("Insufficient balance.", status="failed")

    if internal_checking_id:
+        service_fee_msat = service_fee(invoice.amount_msat, internal=True)
        logger.debug(f"marking temporary payment as not pending {internal_checking_id}")
        # mark the invoice from the other side as not pending anymore
        # so the other side only has access to his new money when we are sure
@@ -273,10 +331,12 @@ async def pay_invoice(
        logger.debug(f"enqueuing internal invoice {internal_checking_id}")
        await internal_invoice_queue.put(internal_checking_id)
    else:
+        fee_reserve_msat = fee_reserve(invoice.amount_msat, internal=False)
+        service_fee_msat = service_fee(invoice.amount_msat, internal=False)
        logger.debug(f"backend: sending payment {temp_id}")
        # actually pay the external invoice
-        WALLET = get_wallet_class()
-        payment: PaymentResponse = await WALLET.pay_invoice(
+        funding_source = get_funding_source()
+        payment: PaymentResponse = await funding_source.pay_invoice(
            payment_request, fee_reserve_msat
        )

@@ -287,6 +347,7 @@ async def pay_invoice(
            )

        logger.debug(f"backend: pay_invoice finished {temp_id}")
+        logger.debug(f"backend: pay_invoice response {payment}")
        if payment.checking_id and payment.ok is not False:
            # payment.ok can be True (paid) or None (pending)!
            logger.debug(f"updating payment {temp_id}")
@@ -294,7 +355,10 @@ async def pay_invoice(
                await update_payment_details(
                    checking_id=temp_id,
                    pending=payment.ok is not True,
-                    fee=payment.fee_msat,
+                    fee=-(
+                        abs(payment.fee_msat if payment.fee_msat else 0)
+                        + abs(service_fee_msat)
+                    ),
                    preimage=payment.preimage,
                    new_checking_id=payment.checking_id,
                    conn=conn,
@@ -312,9 +376,10 @@ async def pay_invoice(
            async with db.connect() as conn:
                logger.debug(f"deleting temporary payment {temp_id}")
                await delete_wallet_payment(temp_id, wallet_id, conn=conn)
-            raise PaymentFailure(
+            raise PaymentError(
                f"Payment failed: {payment.error_message}"
-                or "Payment failed, but backend didn't give us an error message."
+                or "Payment failed, but backend didn't give us an error message.",
+                status="failed",
            )
        else:
            logger.warning(
@@ -322,9 +387,74 @@ async def pay_invoice(
                f" database: {temp_id}"
            )

+    # credit service fee wallet
+    if settings.lnbits_service_fee_wallet and service_fee_msat:
+        new_payment = await create_payment(
+            wallet_id=settings.lnbits_service_fee_wallet,
+            fee=0,
+            amount=abs(service_fee_msat),
+            memo="Service fee",
+            checking_id="service_fee" + temp_id,
+            payment_request=payment_request,
+            payment_hash=invoice.payment_hash,
+            pending=False,
+        )
    return invoice.payment_hash


+async def check_wallet_limits(wallet_id, conn, amount_msat):
+    await check_time_limit_between_transactions(conn, wallet_id)
+    await check_wallet_daily_withdraw_limit(conn, wallet_id, amount_msat)
+
+
+async def check_time_limit_between_transactions(conn, wallet_id):
+    limit = settings.lnbits_wallet_limit_secs_between_trans
+    if not limit or limit <= 0:
+        return
+
+    payments = await get_payments(
+        since=int(time.time()) - limit,
+        wallet_id=wallet_id,
+        limit=1,
+        conn=conn,
+    )
+
+    if len(payments) == 0:
+        return
+
+    raise PaymentError(
+        status="failed",
+        message=f"The time limit of {limit} seconds between payments has been reached.",
+    )
+
+
+async def check_wallet_daily_withdraw_limit(conn, wallet_id, amount_msat):
+    limit = settings.lnbits_wallet_limit_daily_max_withdraw
+    if not limit or limit <= 0:
+        return
+
+    payments = await get_payments(
+        since=int(time.time()) - 60 * 60 * 24,
+        outgoing=True,
+        wallet_id=wallet_id,
+        limit=1,
+        conn=conn,
+    )
+    if len(payments) == 0:
+        return
+
+    total = 0
+    for pay in payments:
+        total += pay.amount
+    total = total - amount_msat
+    if limit * 1000 + total < 0:
+        raise ValueError(
+            "Daily withdrawal limit of "
+            + str(settings.lnbits_wallet_limit_daily_max_withdraw)
+            + " sats reached."
+        )
+
+
 async def redeem_lnurl_withdraw(
    wallet_id: str,
    lnurl_request: str,
@@ -338,7 +468,8 @@ async def redeem_lnurl_withdraw(

    res = {}

-    async with httpx.AsyncClient() as client:
+    headers = {"User-Agent": settings.user_agent}
+    async with httpx.AsyncClient(headers=headers) as client:
        lnurl = decode_lnurl(lnurl_request)
        r = await client.get(str(lnurl))
        res = r.json()
@@ -372,7 +503,8 @@ async def redeem_lnurl_withdraw(
    except Exception:
        pass

-    async with httpx.AsyncClient() as client:
+    headers = {"User-Agent": settings.user_agent}
+    async with httpx.AsyncClient(headers=headers) as client:
        try:
            await client.get(res["callback"], params=params)
        except Exception:
@@ -382,7 +514,6 @@ async def redeem_lnurl_withdraw(
 async def perform_lnurlauth(
    callback: str,
    wallet: WalletTypeInfo = Depends(require_admin_key),
-    conn: Optional[Connection] = None,
 ) -> Optional[LnurlErrorResponse]:
    cb = urlparse(callback)

@@ -435,7 +566,8 @@ async def perform_lnurlauth(

    sig = key.sign_digest_deterministic(k1, sigencode=encode_strict_der)

-    async with httpx.AsyncClient() as client:
+    headers = {"User-Agent": settings.user_agent}
+    async with httpx.AsyncClient(headers=headers) as client:
        assert key.verifying_key, "LNURLauth verifying_key does not exist"
        r = await client.get(
            callback,
@@ -464,25 +596,46 @@ async def check_transaction_status(
        wallet_id, payment_hash, conn=conn
    )
    if not payment:
-        return PaymentStatus(None)
+        return PaymentPendingStatus()
    if not payment.pending:
        # note: before, we still checked the status of the payment again
-        return PaymentStatus(True, fee_msat=payment.fee)
+        return PaymentSuccessStatus(fee_msat=payment.fee)

    status: PaymentStatus = await payment.check_status()
    return status


 # WARN: this same value must be used for balance check and passed to
-# WALLET.pay_invoice(), it may cause a vulnerability if the values differ
-def fee_reserve(amount_msat: int) -> int:
+# funding_source.pay_invoice(), it may cause a vulnerability if the values differ
+def fee_reserve(amount_msat: int, internal: bool = False) -> int:
+    if internal:
+        return 0
    reserve_min = settings.lnbits_reserve_fee_min
    reserve_percent = settings.lnbits_reserve_fee_percent
    return max(int(reserve_min), int(amount_msat * reserve_percent / 100.0))


+def service_fee(amount_msat: int, internal: bool = False) -> int:
+    service_fee_percent = settings.lnbits_service_fee
+    fee_max = settings.lnbits_service_fee_max * 1000
+    if settings.lnbits_service_fee_wallet:
+        if internal and settings.lnbits_service_fee_ignore_internal:
+            return 0
+        fee_percentage = int(amount_msat / 100 * service_fee_percent)
+        if fee_max > 0 and fee_percentage > fee_max:
+            return fee_max
+        else:
+            return fee_percentage
+    else:
+        return 0
+
+
+def fee_reserve_total(amount_msat: int, internal: bool = False) -> int:
+    return fee_reserve(amount_msat, internal) + service_fee(amount_msat, internal)
+
+
 async def send_payment_notification(wallet: Wallet, payment: Payment):
-    await websocketUpdater(
+    await websocket_updater(
        wallet.id,
        json.dumps(
            {
@@ -520,7 +673,7 @@ async def check_admin_settings():
            # create new settings if table is empty
            logger.warning("Settings DB empty. Inserting default settings.")
            settings_db = await init_admin_settings(settings.super_user)
-            logger.warning("Initialized settings from enviroment variables.")
+            logger.warning("Initialized settings from environment variables.")

        if settings.super_user and settings.super_user != settings_db.super_user:
            # .env super_user overwrites DB super_user
@@ -528,11 +681,8 @@ async def check_admin_settings():

        update_cached_settings(settings_db.dict())

-        admin_url = f'{settings.lnbits_baseurl}wallet?usr=<ID from ".super_user" file>'
-        logger.success(f"✔️ Access super user account at: {admin_url}")
-
-        # saving it to .super_user file
-        with open(".super_user", "w") as file:
+        # saving superuser to {data_dir}/.super_user file
+        with open(Path(settings.lnbits_data_folder) / ".super_user", "w") as file:
            file.write(settings.super_user)

        # callback for saas
@@ -543,16 +693,51 @@ async def check_admin_settings():
        ):
            send_admin_user_to_saas()

+        account = await get_account(settings.super_user)
+        if account and account.config and account.config.provider == "env":
+            settings.first_install = True
+
+        logger.success(
+            "✔️ Admin UI is enabled. run `poetry run lnbits-cli superuser` "
+            "to get the superuser."
+        )
+
+
+async def check_webpush_settings():
+    if not settings.lnbits_webpush_privkey:
+        vapid = Vapid()
+        vapid.generate_keys()
+        privkey = vapid.private_pem()
+        assert vapid.public_key, "VAPID public key does not exist"
+        pubkey = b64urlencode(
+            vapid.public_key.public_bytes(
+                serialization.Encoding.X962,
+                serialization.PublicFormat.UncompressedPoint,
+            )
+        )
+        push_settings = {
+            "lnbits_webpush_privkey": privkey.decode(),
+            "lnbits_webpush_pubkey": pubkey,
+        }
+        update_cached_settings(push_settings)
+        await update_admin_settings(EditableSettings(**push_settings))
+
+    logger.info("Initialized webpush settings with generated VAPID key pair.")
+    logger.info(f"Pubkey: {settings.lnbits_webpush_pubkey}")
+

 def update_cached_settings(sets_dict: dict):
    for key, value in sets_dict.items():
-        if key not in readonly_variables:
-            try:
-                setattr(settings, key, value)
-            except Exception:
-                logger.warning(f"Failed overriding setting: {key}, value: {value}")
+        if key in readonly_variables:
+            continue
+        if key not in settings.dict().keys():
+            continue
+        try:
+            setattr(settings, key, value)
+        except Exception:
+            logger.warning(f"Failed overriding setting: {key}, value: {value}")
    if "super_user" in sets_dict:
-        setattr(settings, "super_user", sets_dict["super_user"])
+        settings.super_user = sets_dict["super_user"]


 async def init_admin_settings(super_user: Optional[str] = None) -> SuperSettings:
@@ -560,7 +745,9 @@ async def init_admin_settings(super_user: Optional[str] = None) -> SuperSettings
    if super_user:
        account = await get_account(super_user)
    if not account:
-        account = await create_account(user_id=super_user)
+        account = await create_account(
+            user_id=super_user, user_config=UserConfig(provider="env")
+        )
    if not account.wallets or len(account.wallets) == 0:
        await create_wallet(user_id=account.id)

@@ -587,25 +774,26 @@ class WebsocketConnectionManager:
                await connection.send_text(message)


-websocketManager = WebsocketConnectionManager()
+websocket_manager = WebsocketConnectionManager()


-async def websocketUpdater(item_id, data):
-    return await websocketManager.send_data(f"{data}", item_id)
+async def websocket_updater(item_id, data):
+    return await websocket_manager.send_data(f"{data}", item_id)


 async def switch_to_voidwallet() -> None:
-    WALLET = get_wallet_class()
-    if WALLET.__class__.__name__ == "VoidWallet":
+    funding_source = get_funding_source()
+    if funding_source.__class__.__name__ == "VoidWallet":
        return
-    set_wallet_class("VoidWallet")
+    set_funding_source("VoidWallet")
    settings.lnbits_backend_wallet_class = "VoidWallet"


-async def get_balance_delta() -> Tuple[int, int, int]:
-    WALLET = get_wallet_class()
-    total_balance = await get_total_balance()
-    error_message, node_balance = await WALLET.status()
-    if error_message:
-        raise Exception(error_message)
-    return node_balance - total_balance, node_balance, total_balance
+async def get_balance_delta() -> BalanceDelta:
+    funding_source = get_funding_source()
+    status = await funding_source.status()
+    lnbits_balance = await get_total_balance()
+    return BalanceDelta(
+        lnbits_balance_msats=lnbits_balance,
+        node_balance_msats=status.balance_msat,
+    )
@@ -0,0 +1,37 @@
+"""Keycloak SSO Login Helper
+"""
+
+from typing import Optional
+
+import httpx
+from fastapi_sso.sso.base import DiscoveryDocument, OpenID, SSOBase
+
+
+class KeycloakSSO(SSOBase):
+    """Class providing login via Keycloak OAuth"""
+
+    provider = "keycloak"
+    scope = ["openid", "email", "profile"]
+    discovery_url = ""
+
+    async def openid_from_response(
+        self, response: dict, session: Optional["httpx.AsyncClient"] = None
+    ) -> OpenID:
+        """Return OpenID from user information provided by Keycloak"""
+        return OpenID(
+            email=response.get("email", ""),
+            provider=self.provider,
+            id=response.get("sub"),
+            first_name=response.get("given_name"),
+            last_name=response.get("family_name"),
+            display_name=response.get("name"),
+            picture=response.get("picture"),
+        )
+
+    async def get_discovery_document(self) -> DiscoveryDocument:
+        """Get document containing handy urls"""
+        async with httpx.AsyncClient() as session:
+            response = await session.get(self.discovery_url)
+            content = response.json()
+
+            return content
@@ -1,25 +0,0 @@
-new Vue({
-  el: '#vue',
-  mixins: [windowMixin],
-  data: function () {
-    return {
-      disclaimerDialog: {
-        show: false,
-        data: {}
-      },
-      walletName: ''
-    }
-  },
-  methods: {
-    createWallet: function () {
-      LNbits.href.createWallet(this.walletName)
-    },
-    processing: function () {
-      this.$q.notify({
-        timeout: 0,
-        message: 'Processing...',
-        icon: null
-      })
-    }
-  }
-})
@@ -4,37 +4,34 @@ from typing import Dict
 import httpx
 from loguru import logger

-from lnbits.settings import get_wallet_class, settings
-from lnbits.tasks import (
-    SseListenersDict,
-    create_permanent_task,
-    create_task,
-    register_invoice_listener,
+from lnbits.core.crud import (
+    get_wallet,
+    get_webpush_subscriptions_for_user,
+    mark_webhook_sent,
 )
-
-from . import db
-from .crud import get_balance_notify, get_wallet
-from .models import Payment
-from .services import get_balance_delta, send_payment_notification, switch_to_voidwallet
-
-api_invoice_listeners: Dict[str, asyncio.Queue] = SseListenersDict(
-    "api_invoice_listeners"
+from lnbits.core.models import Payment
+from lnbits.core.services import (
+    get_balance_delta,
+    send_payment_notification,
+    switch_to_voidwallet,
 )
+from lnbits.settings import get_funding_source, settings
+from lnbits.tasks import send_push_notification

-
-def register_killswitch():
-    """
-    Registers a killswitch which will check lnbits-status repository for a signal from
-    LNbits and will switch to VoidWallet if the killswitch is triggered.
-    """
-    logger.debug("Starting killswitch task")
-    create_permanent_task(killswitch_task)
+api_invoice_listeners: Dict[str, asyncio.Queue] = {}


 async def killswitch_task():
-    while True:
-        WALLET = get_wallet_class()
-        if settings.lnbits_killswitch and WALLET.__class__.__name__ != "VoidWallet":
+    """
+    killswitch will check lnbits-status repository for a signal from
+    LNbits and will switch to VoidWallet if the killswitch is triggered.
+    """
+    while settings.lnbits_running:
+        funding_source = get_funding_source()
+        if (
+            settings.lnbits_killswitch
+            and funding_source.__class__.__name__ != "VoidWallet"
+        ):
            with httpx.Client() as client:
                try:
                    r = client.get(settings.lnbits_status_manifest, timeout=4)
@@ -46,7 +43,7 @@ async def killswitch_task():
                                "Switching to VoidWallet. Killswitch triggered."
                            )
                            await switch_to_voidwallet()
-                except (httpx.ConnectError, httpx.RequestError):
+                except (httpx.RequestError, httpx.HTTPStatusError):
                    logger.error(
                        "Cannot fetch lnbits status manifest."
                        f" {settings.lnbits_status_manifest}"
@@ -54,22 +51,20 @@ async def killswitch_task():
        await asyncio.sleep(settings.lnbits_killswitch_interval * 60)


-async def register_watchdog():
+async def watchdog_task():
    """
    Registers a watchdog which will check lnbits balance and nodebalance
    and will switch to VoidWallet if the watchdog delta is reached.
    """
-    # TODO: implement watchdog properly
-    # logger.debug("Starting watchdog task")
-    # create_permanent_task(watchdog_task)
-
-
-async def watchdog_task():
-    while True:
-        WALLET = get_wallet_class()
-        if settings.lnbits_watchdog and WALLET.__class__.__name__ != "VoidWallet":
+    while settings.lnbits_running:
+        funding_source = get_funding_source()
+        if (
+            settings.lnbits_watchdog
+            and funding_source.__class__.__name__ != "VoidWallet"
+        ):
            try:
-                delta, *_ = await get_balance_delta()
+                balance = await get_balance_delta()
+                delta = balance.delta_msats
                logger.debug(f"Running watchdog task. current delta: {delta}")
                if delta + settings.lnbits_watchdog_delta <= 0:
                    logger.error(f"Switching to VoidWallet. current delta: {delta}")
@@ -79,45 +74,24 @@ async def watchdog_task():
        await asyncio.sleep(settings.lnbits_watchdog_interval * 60)


-def register_task_listeners():
-    """
-    Registers an invoice listener queue for the core tasks. Incoming payments in this
-    queue will eventually trigger the signals sent to all other extensions
-    and fulfill other core tasks such as dispatching webhooks.
-    """
-    invoice_paid_queue = asyncio.Queue(5)
-    # we register invoice_paid_queue to receive all incoming invoices
-    register_invoice_listener(invoice_paid_queue, "core/tasks.py")
-    # register a worker that will react to invoices
-    create_task(wait_for_paid_invoices(invoice_paid_queue))
-
-
 async def wait_for_paid_invoices(invoice_paid_queue: asyncio.Queue):
    """
-    This worker dispatches events to all extensions,
-    dispatches webhooks and balance notifys.
+    This worker dispatches events to all extensions and dispatches webhooks.
    """
-    while True:
+    while settings.lnbits_running:
        payment = await invoice_paid_queue.get()
        logger.trace("received invoice paid event")
-        # send information to sse channel
+        # dispatch api_invoice_listeners
        await dispatch_api_invoice_listeners(payment)
+        # payment notification
        wallet = await get_wallet(payment.wallet_id)
        if wallet:
            await send_payment_notification(wallet, payment)
        # dispatch webhook
        if payment.webhook and not payment.webhook_status:
            await dispatch_webhook(payment)
-
-        # dispatch balance_notify
-        url = await get_balance_notify(payment.wallet_id)
-        if url:
-            async with httpx.AsyncClient() as client:
-                try:
-                    r = await client.post(url, timeout=4)
-                    await mark_webhook_sent(payment, r.status_code)
-                except (httpx.ConnectError, httpx.RequestError):
-                    pass
+        # dispatch push notification
+        await send_payment_push_notification(payment)


 async def dispatch_api_invoice_listeners(payment: Payment):
@@ -126,10 +100,12 @@ async def dispatch_api_invoice_listeners(payment: Payment):
    """
    for chan_name, send_channel in api_invoice_listeners.items():
        try:
-            logger.debug(f"sending invoice paid event to {chan_name}")
+            logger.debug(f"api invoice listener: sending paid event to {chan_name}")
            send_channel.put_nowait(payment)
        except asyncio.QueueFull:
-            logger.error(f"removing sse listener {send_channel}:{chan_name}")
+            logger.error(
+                f"api invoice listener: QueueFull, removing {send_channel}:{chan_name}"
+            )
            api_invoice_listeners.pop(chan_name)


@@ -140,22 +116,44 @@ async def dispatch_webhook(payment: Payment):
    logger.debug("sending webhook", payment.webhook)

    if not payment.webhook:
-        return await mark_webhook_sent(payment, -1)
+        return await mark_webhook_sent(payment.payment_hash, -1)

-    async with httpx.AsyncClient() as client:
+    headers = {"User-Agent": settings.user_agent}
+    async with httpx.AsyncClient(headers=headers) as client:
        data = payment.dict()
        try:
            r = await client.post(payment.webhook, json=data, timeout=40)
-            await mark_webhook_sent(payment, r.status_code)
-        except (httpx.ConnectError, httpx.RequestError):
-            await mark_webhook_sent(payment, -1)
+            r.raise_for_status()
+            await mark_webhook_sent(payment.payment_hash, r.status_code)
+        except httpx.HTTPStatusError as exc:
+            await mark_webhook_sent(payment.payment_hash, exc.response.status_code)
+            logger.warning(
+                f"webhook returned a bad status_code: {exc.response.status_code} "
+                f"while requesting {exc.request.url!r}."
+            )
+        except httpx.RequestError:
+            await mark_webhook_sent(payment.payment_hash, -1)
+            logger.warning(f"Could not send webhook to {payment.webhook}")


-async def mark_webhook_sent(payment: Payment, status: int) -> None:
-    await db.execute(
-        """
-        UPDATE apipayments SET webhook_status = ?
-        WHERE hash = ?
-        """,
-        (status, payment.payment_hash),
-    )
+async def send_payment_push_notification(payment: Payment):
+    wallet = await get_wallet(payment.wallet_id)
+
+    if wallet:
+        subscriptions = await get_webpush_subscriptions_for_user(wallet.user)
+
+        amount = int(payment.amount / 1000)
+
+        title = f"LNbits: {wallet.name}"
+        body = f"You just received {amount} sat{'s'[:amount^1]}!"
+
+        if payment.memo:
+            body += f"\r\n{payment.memo}"
+
+        for subscription in subscriptions:
+            # todo: review permissions when user-id-only not allowed
+            # todo: replace all this logic with websockets?
+            url = (
+                f"https://{subscription.host}/wallet?usr={wallet.user}&wal={wallet.id}"
+            )
+            await send_push_notification(subscription, title, body, url)
@@ -7,112 +7,89 @@
        <div class="col">
          <p>Funding Source Info</p>
          <ul>
-            {%raw%}
-            <li>Funding Source: {{settings.lnbits_backend_wallet_class}}</li>
-            <li>
-              Node Balance: {{(auditData.node_balance_msats /
-              1000).toLocaleString()}} sats
-            </li>
-            <li>
-              LNbits Balance: {{(auditData.lnbits_balance_msats /
-              1000).toLocaleString()}} sats
-            </li>
-            <li>
-              Reserve Percent: {{(auditData.node_balance_msats /
-              auditData.lnbits_balance_msats * 100).toFixed(2)}} %
-            </li>
-            {%endraw%}
+            <li
+              v-text="'Funding Source: '+ settings.lnbits_backend_wallet_class"
+            ></li>
+            <li
+              v-text="'Node Balance: ' + (auditData.node_balance_msats /
+              1000).toLocaleString() + ' sats'"
+            ></li>
+            <li
+              v-text="'LNbits Balance: ' + (auditData.lnbits_balance_msats /
+              1000).toLocaleString() + ' sats'"
+            ></li>
+            <li
+              v-text="'Reserve Percent: ' + (auditData.node_balance_msats /
+              auditData.lnbits_balance_msats * 100).toFixed(2) + ' %'"
+            ></li>
          </ul>
          <br />
        </div>
+        <div class="col">
+          {% if LNBITS_NODE_UI_AVAILABLE %}
+          <p>Node Management</p>
+          <q-toggle
+            label="Node UI"
+            v-model="formData.lnbits_node_ui"
+          ></q-toggle>
+          <q-toggle
+            v-if="formData.lnbits_node_ui"
+            label="Public node UI"
+            v-model="formData.lnbits_public_node_ui"
+          ></q-toggle>
+          <br />
+          <q-toggle
+            v-if="formData.lnbits_node_ui"
+            label="Transactions Tab (Disable on large CLN nodes)"
+            v-model="formData.lnbits_node_ui_transactions"
+          ></q-toggle>
+          {% else %}
+          <p>Node Management not supported by active funding source</p>
+          {% endif %}
+        </div>
      </div>
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-4">
-          <div class="row">
-            <div class="col-12">
-              <p>Active Funding<small> (Requires server restart)</small></p>
-              <q-select
-                :disable="!isSuperUser"
-                filled
-                v-model="formData.lnbits_backend_wallet_class"
-                hint="Select the active funding wallet"
-                :options="settings.lnbits_allowed_funding_sources"
-              ></q-select>
-            </div>
-          </div>
+          <p>Invoice Expiry</p>
+          <q-input
+            filled
+            v-model.number="formData.lightning_invoice_expiry"
+            type="number"
+            label="Invoice expiry (seconds)"
+            mask="#######"
+          >
+          </q-input>
        </div>
        <div class="col-12 col-md-8">
+          <p>Fee reserve</p>
          <div class="row q-col-gutter-md">
-            <div class="col-12 col-md-4">
-              <p>Invoice Expiry</p>
+            <div class="col-6">
              <q-input
-                filled
-                v-model.number="formData.lightning_invoice_expiry"
                type="number"
-                label="Invoice expiry (seconds)"
-                mask="#######"
+                filled
+                v-model="formData.lnbits_reserve_fee_min"
+                label="Reserve fee in msats"
              >
              </q-input>
            </div>
-            <div class="col-12 col-md-8">
-              <p>Fee reserve</p>
-              <div class="row q-col-gutter-md">
-                <div class="col-6">
-                  <q-input
-                    type="number"
-                    filled
-                    v-model="formData.lnbits_reserve_fee_min"
-                    label="Reserve fee in msats"
-                  >
-                  </q-input>
-                </div>
-                <div class="col-6">
-                  <q-input
-                    type="number"
-                    filled
-                    name="lnbits_reserve_fee_percent"
-                    v-model="formData.lnbits_reserve_fee_percent"
-                    label="Reserve fee in percent"
-                    step="0.1"
-                  ></q-input>
-                </div>
-              </div>
+            <div class="col-6">
+              <q-input
+                type="number"
+                filled
+                name="lnbits_reserve_fee_percent"
+                v-model="formData.lnbits_reserve_fee_percent"
+                label="Reserve fee in percent"
+                step="0.1"
+              ></q-input>
            </div>
          </div>
        </div>
      </div>
      <div v-if="isSuperUser">
-        <p class="q-my-md">
-          Funding Sources<small> (Requires server restart)</small>
-        </p>
-        <q-list
-          v-for="(fund, idx) in settings.lnbits_allowed_funding_sources"
-          :key="idx"
-        >
-          <q-expansion-item
-            expand-separator
-            icon="payments"
-            :label="fund"
-            v-if="funding_sources.get(fund)"
-          >
-            <q-card>
-              <q-card-section
-                v-for="([key, prop], i) in Object.entries(funding_sources.get(fund))"
-                :key="i"
-              >
-                <q-input
-                  dense
-                  filled
-                  type="text"
-                  v-model="formData[key]"
-                  :label="prop.label"
-                  class="q-pr-md"
-                  :hint="prop.hint"
-                ></q-input>
-              </q-card-section>
-            </q-card>
-          </q-expansion-item>
-        </q-list>
+        <lnbits-funding-sources
+          :form-data="formData"
+          :allowed-funding-sources="settings.lnbits_allowed_funding_sources"
+        />
      </div>
    </div>
  </q-card-section>
@@ -1,7 +1,122 @@
 <q-tab-panel name="security">
  <q-card-section class="q-pa-none">
-    <h6 class="q-my-none" v-text="$t('security_tools')"></h6>
+    <h6 class="q-my-none q-mb-sm">Authentication</h6>
+    <div class="row">
+      <div class="col-md-6 col-sm-12 q-pr-sm">
+        <q-input
+          filled
+          v-model="formData.auth_token_expire_minutes"
+          type="number"
+          label="Token expire minutes"
+          hint="Time in minutes until the token expires"
+        >
+        </q-input>
+      </div>
+      <div class="col-md-6 col-sm-12 q-pr-sm">
+        <q-select
+          filled
+          v-model="formData.auth_allowed_methods"
+          multiple
+          hint="Allowed authorization methods"
+          label="Select authorization methods"
+          :options="formData.auth_all_methods"
+        ></q-select>
+      </div>
+    </div>
+  </q-card-section>
+  <q-card-section
+    v-if="formData.auth_allowed_methods?.includes('google-auth')"
+    class="q-pl-xl"
+  >
+    <strong class="q-my-none q-mb-sm">Google Auth</strong>
+
+    <div class="row">
+      <div class="col-md-6 col-sm-12 q-pr-sm">
+        <q-input
+          filled
+          v-model="formData.google_client_id"
+          label="Google Client ID"
+          hint="Make sure thant the authorized redirect URIs contain https://{domain}/api/v1/auth/google/token"
+        >
+        </q-input>
+      </div>
+      <div class="col-md-6 col-sm-12">
+        <q-input
+          filled
+          v-model="formData.google_client_secret"
+          type="password"
+          label="Google Client Secret"
+        >
+        </q-input>
+      </div>
+    </div>
+  </q-card-section>
+  <q-card-section
+    v-if="formData.auth_allowed_methods?.includes('github-auth')"
+    class="q-pl-xl"
+  >
+    <strong class="q-my-none q-mb-sm">GitHub Auth</strong>
+
+    <div class="row">
+      <div class="col-md-6 col-sm-12 q-pr-sm">
+        <q-input
+          filled
+          v-model="formData.github_client_id"
+          label="GitHub Client ID"
+          hint="Make sure thant the authorization callback URL is set to https://{domain}/api/v1/auth/github/token"
+        >
+        </q-input>
+      </div>
+      <div class="col-md-6 col-sm-12">
+        <q-input
+          filled
+          v-model="formData.github_client_secret"
+          type="password"
+          label="GitHub Client Secret"
+        >
+        </q-input>
+      </div>
+    </div>
+  </q-card-section>
+  <q-card-section
+    v-if="formData.auth_allowed_methods?.includes('keycloak-auth')"
+    class="q-pl-xl"
+  >
+    <strong class="q-my-none q-mb-sm">Keycloak Auth</strong>
+
+    <div class="row">
+      <div class="col-md-4 col-sm-12 q-pr-sm">
+        <q-input
+          filled
+          v-model="formData.keycloak_discovery_url"
+          label="Keycloak Discovey URL"
+        >
+        </q-input>
+      </div>
+      <div class="col-md-4 col-sm-12 q-pr-sm">
+        <q-input
+          filled
+          v-model="formData.keycloak_client_id"
+          label="Keycloak Client ID"
+          hint="Make sure thant the authorization callback URL is set to https://{domain}/api/v1/auth/keycloak/token"
+        >
+        </q-input>
+      </div>
+      <div class="col-md-4 col-sm-12">
+        <q-input
+          filled
+          v-model="formData.keycloak_client_secret"
+          type="password"
+          label="Keycloak Client Secret"
+        >
+        </q-input>
+      </div>
+    </div>
+  </q-card-section>
+  <q-separator></q-separator>
+  <q-card-section class="q-pa-none">
    <br />
+    <h6 class="q-my-none" v-text="$t('security_tools')"></h6>
    <div>
      <div class="row">
        <div v-if="serverlogEnabled" class="column" style="width: 100%">
@@ -16,7 +131,7 @@
              style="padding: 10px; color: #fafafa; height: 320px"
            >
              <small v-for="log in logs"
-                >{% raw %}{{ log }}{% endraw %}<br
+                ><span v-text="log"></span><br
              /></small>
            </q-scroll-area>
          </div>
@@ -51,7 +166,6 @@
                ></q-btn>
              </q-input>
              <div>
-                {%raw%}
                <q-chip
                  v-for="blocked_ip in formData.lnbits_blocked_ips"
                  :key="blocked_ip"
@@ -59,10 +173,8 @@
                  @remove="removeBlockedIPs(blocked_ip)"
                  color="primary"
                  text-color="white"
-                >
-                  {{ blocked_ip }}
-                </q-chip>
-                {%endraw%}
+                  v-text="blocked_ip"
+                ></q-chip>
              </div>
              <br />
            </div>
@@ -83,7 +195,6 @@
                ></q-btn>
              </q-input>
              <div>
-                {%raw%}
                <q-chip
                  v-for="allowed_ip in formData.lnbits_allowed_ips"
                  :key="allowed_ip"
@@ -91,15 +202,14 @@
                  @remove="removeAllowedIPs(allowed_ip)"
                  color="primary"
                  text-color="white"
-                >
-                  {{ allowed_ip }}
-                </q-chip>
-                {%endraw%}
+                  v-text="allowed_ip"
+                ></q-chip>
              </div>
              <br />
            </div>
          </div>
        </div>
+
        <div class="col-12 col-md-12">
          <p v-text="$t('rate_limiter')"></p>
          <div class="row q-col-gutter-md">
@@ -121,6 +231,36 @@
            </div>
          </div>
        </div>
+
+        <div class="col-12 col-md-12">
+          <p v-text="$t('wallet_limiter')"></p>
+          <div class="row q-col-gutter-md">
+            <div class="col-4">
+              <q-input
+                filled
+                type="number"
+                v-model.number="formData.lnbits_wallet_limit_max_balance"
+                :label="$t('wallet_max_ballance')"
+              ></q-input>
+            </div>
+            <div class="col-4">
+              <q-input
+                filled
+                type="number"
+                v-model.number="formData.lnbits_wallet_limit_daily_max_withdraw"
+                :label="$t('wallet_limit_max_withdraw_per_day')"
+              ></q-input>
+            </div>
+            <div class="col-4">
+              <q-input
+                filled
+                type="number"
+                v-model.number="formData.lnbits_wallet_limit_secs_between_trans"
+                :label="$t('wallet_limit_secs_between_trans')"
+              ></q-input>
+            </div>
+          </div>
+        </div>
      </div>
    </div>
    <br />
@@ -1,4 +1,3 @@
-{% raw %}
 <q-banner v-if="updateAvailable" class="bg-primary text-white">
  <q-icon size="28px" name="update"></q-icon>

@@ -8,13 +7,14 @@
      class="q-btn"
      color="white"
      target="_blank"
+      rel="noopener noreferrer"
      href="https://github.com/lnbits/lnbits/releases"
      v-text="$t('releases')"
    ></a>
  </template>
 </q-banner>
 <q-banner v-if="!updateAvailable" class="bg-green text-white">
-  <q-icon size="28px" name="checknark"></q-icon>
+  <q-icon size="28px" name="checkmark"></q-icon>
  <span v-text="$t('latest_update', {version: statusData.version})"></span>
 </q-banner>
 <q-card>
@@ -29,9 +29,12 @@
      <template v-slot:header="props">
        <q-tr :props="props">
          <q-th auto-width> </q-th>
-          <q-th v-for="col in props.cols" :key="col.name" :props="props"
-            >{{ col.label }}</q-th
-          >
+          <q-th
+            v-for="col in props.cols"
+            :key="col.name"
+            :props="props"
+            v-text="col.label"
+          ></q-th>
        </q-tr>
      </template>
      <template v-slot:body="props">
@@ -50,14 +53,19 @@
              color="red"
            ></q-icon>
          </q-td>
-          <q-td auto-width key="date" :props="props">
-            {{ formatDate(props.row.date) }}
+          <q-td
+            auto-width
+            key="date"
+            :props="props"
+            v-text="formatDate(props.row.date)"
+          >
          </q-td>
          <q-td key="message" :props="props"
-            >{{ props.row.message }}
-            <a
+            ><span v-text="props.row.message"></span
+            ><a
              v-if="props.row.link"
              target="_blank"
+              rel="noopener noreferrer"
              :href="props.row.link"
              v-text="$t('more')"
            ></a
@@ -67,4 +75,3 @@
    </q-table>
  </q-card-section>
 </q-card>
-{% endraw %}
@@ -7,53 +7,18 @@
        <div class="col">
          <p>Server Info</p>
          <ul>
-            {%raw%}
-            <li v-if="settings.lnbits_data_folder">
-              SQlite: {{settings.lnbits_data_folder}}
-            </li>
-            <li v-if="settings.lnbits_database_url">
-              Postgres: {{settings.lnbits_database_url}}
-            </li>
-            {%endraw%}
+            <li
+              v-if="settings.lnbits_data_folder"
+              v-text="'SQlite: ' + settings.lnbits_data_folder"
+            ></li>
+            <li
+              v-if="settings.lnbits_database_url"
+              v-text="'Postgres: ' + settings.lnbits_database_url"
+            ></li>
          </ul>
          <br />
        </div>
      </div>
-      <div class="row q-col-gutter-md">
-        <div class="col-12 col-md-6">
-          <p>Service Fee</p>
-          <q-input
-            filled
-            type="number"
-            v-model.number="formData.lnbits_service_fee"
-            label="Service fee (%)"
-            step="0.1"
-            hint="Fee charged per tx (%)"
-          ></q-input>
-          <br />
-        </div>
-        <div class="col-12 col-md-6">
-          <p>Miscellaneous</p>
-          <q-item tag="label" v-ripple>
-            <q-item-section>
-              <q-item-label>Hide API</q-item-label>
-              <q-item-label caption
-                >Hides wallet api, extensions can choose to honor</q-item-label
-              >
-            </q-item-section>
-            <q-item-section avatar>
-              <q-toggle
-                size="md"
-                v-model="formData.lnbits_hide_api"
-                checked-icon="check"
-                color="green"
-                unchecked-icon="clear"
-              />
-            </q-item-section>
-          </q-item>
-          <br />
-        </div>
-      </div>
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-6">
          <p>Allowed currencies</p>
@@ -75,7 +40,7 @@
            clearable
            hint="Default currency for accounting"
            label="Currency"
-            :options="formData.lnbits_allowed_currencies.length ? formData.lnbits_allowed_currencies : {{ currencies }}"
+            :options="formData.lnbits_allowed_currencies?.length ? formData.lnbits_allowed_currencies : {{ currencies }}"
          ></q-select>
          <br />
        </div>
@@ -93,8 +58,104 @@
          ></q-select>
          <br />
        </div>
+        <div class="col-12 col-md-6">
+          <p>Miscellaneous</p>
+          <q-item tag="label" v-ripple>
+            <q-item-section>
+              <q-item-label>Disable Extensions</q-item-label>
+              <q-item-label caption>Disables all extensions</q-item-label>
+            </q-item-section>
+            <q-item-section avatar>
+              <q-toggle
+                size="md"
+                v-model="formData.lnbits_extensions_deactivate_all"
+                checked-icon="check"
+                color="green"
+                unchecked-icon="clear"
+              />
+            </q-item-section>
+          </q-item>
+          <q-item tag="label" v-ripple>
+            <q-item-section>
+              <q-item-label>Hide API</q-item-label>
+              <q-item-label caption
+                >Hides wallet api, extensions can choose to honor</q-item-label
+              >
+            </q-item-section>
+            <q-item-section avatar>
+              <q-toggle
+                size="md"
+                v-model="formData.lnbits_hide_api"
+                checked-icon="check"
+                color="green"
+                unchecked-icon="clear"
+              />
+            </q-item-section>
+          </q-item>
+          <br />
+        </div>
+      </div>
+      <br />
+      <h6 class="q-my-none">Service Fee</h6>
+      <div class="row q-col-gutter-md">
+        <div class="col-12 col-md-6">
+          <p>Service Fee</p>
+          <q-input
+            filled
+            type="number"
+            v-model.number="formData.lnbits_service_fee"
+            label="Service fee (%)"
+            step="0.1"
+            hint="Fee charged per tx (%)"
+          ></q-input>
+          <br />
+        </div>
+        <div class="col-12 col-md-6">
+          <p>Service fee max</p>
+          <q-input
+            filled
+            type="number"
+            v-model.number="formData.lnbits_service_fee_max"
+            label="Service fee max (sats)"
+            hint="Max service fee to charge in (sats)"
+          ></q-input>
+          <br />
+        </div>
+        <div class="col-12 col-md-6">
+          <p>Fee Wallet</p>
+          <q-input
+            filled
+            v-model="formData.lnbits_service_fee_wallet"
+            label="Fee wallet (wallet ID)"
+            hint="Wallet ID to send funds to"
+          ></q-input>
+          <br />
+        </div>
+        <div class="col-12 col-md-6">
+          <p>Disable Service Fee for Internal Payments</p>
+          <q-item tag="label" v-ripple>
+            <q-item-section>
+              <q-item-label>Disable Fee</q-item-label>
+              <q-item-label caption
+                >Disable Service Fee for Internal Lightning
+                Payments</q-item-label
+              >
+            </q-item-section>
+            <q-item-section avatar>
+              <q-toggle
+                size="md"
+                v-model="formData.lnbits_service_fee_ignore_internal"
+                checked-icon="check"
+                color="green"
+                unchecked-icon="clear"
+              />
+            </q-item-section>
+          </q-item>
+          <br />
+        </div>
      </div>

+      <h6 class="q-my-none">Extensions</h6>
      <div>
        <p>Extension Sources</p>
        <q-input
@@ -108,7 +169,6 @@
          <q-btn @click="addExtensionsManifest" dense flat icon="add"></q-btn>
        </q-input>
        <div>
-          {%raw%}
          <q-chip
            v-for="manifestUrl in formData.lnbits_extensions_manifests"
            :key="manifestUrl"
@@ -116,10 +176,8 @@
            @remove="removeExtensionsManifest(manifestUrl)"
            color="primary"
            text-color="white"
-          >
-            {{ manifestUrl }}
-          </q-chip>
-          {%endraw%}
+            ><span v-text="manifestUrl"></span
+          ></q-chip>
        </div>
        <br />
      </div>
@@ -4,7 +4,7 @@
    <br />
    <div>
      <div class="row q-col-gutter-md">
-        <div class="col-12 col-md-6">
+        <div class="col-12 col-md-5">
          <p>Site Title</p>
          <q-input
            filled
@@ -14,7 +14,7 @@
          ></q-input>
          <br />
        </div>
-        <div class="col-12 col-md-6">
+        <div class="col-12 col-md-5">
          <p>Site Tagline</p>
          <q-input
            filled
@@ -24,19 +24,27 @@
          ></q-input>
          <br />
        </div>
+        <div class="col-12 col-md-2 q-mt-xl">
+          <q-toggle
+            tip="Remove homepage elements like 'runs on' etc"
+            v-model="formData.LNBITS_SHOW_HOME_PAGE_ELEMENTS"
+            :label="formData.LNBITS_SHOW_HOME_PAGE_ELEMENTS ? 'Enable elements on homepage' : 'Disable elements on homepage'"
+          ></q-toggle>
+        </div>
      </div>
+
      <div>
        <p>Site Description</p>
        <q-input
          v-model="formData.lnbits_site_description"
          filled
          type="textarea"
-          hint="Use plain text or raw HTML"
+          hint="Use plain text, Markdown, or raw HTML"
        />
      </div>
      <br />
      <div class="row q-col-gutter-md">
-        <div class="col-12 col-md-6">
+        <div class="col-12 col-md-4">
          <p>Default Wallet Name</p>
          <q-input
            filled
@@ -44,9 +52,8 @@
            v-model="formData.lnbits_default_wallet_name"
            label="LNbits wallet"
          ></q-input>
-          <br />
        </div>
-        <div class="col-12 col-md-6">
+        <div class="col-12 col-md-4">
          <p>Denomination</p>
          <q-input
            filled
@@ -55,9 +62,43 @@
            label="sats"
            hint="The name for the FakeWallet token"
          ></q-input>
-          <br />
+        </div>
+        <div class="col-12 col-md-4">
+          <p>QR code logo</p>
+          <q-input
+            filled
+            type="text"
+            v-model="formData.lnbits_qr_logo"
+            label="https://example.com/image.svg"
+            hint="URL to logo image in QR code"
+          ></q-input>
        </div>
      </div>
+      <div class="row q-col-gutter-md">
+        <div class="col-12 col-md-4">
+          <p>Custom Badge</p>
+          <div class="row q-col-gutter-md">
+            <div class="col-12 col-md-8">
+              <q-input
+                filled
+                type="text"
+                tip="Custom Badge"
+                v-model="formData.lnbits_custom_badge"
+                label="Custom Badge 'USE WITH CAUTION - LNbits wallet is still in BETA'"
+              ></q-input>
+            </div>
+            <div class="col-12 col-md-4">
+              <q-select
+                filled
+                v-model="formData.lnbits_custom_badge_color"
+                :options="colors"
+                label="Custom badge color"
+              ></q-select>
+            </div>
+          </div>
+        </div>
+      </div>
+      <br />
      <div class="row q-col-gutter-md">
        <div class="col-12 col-md-6">
          <p>Themes</p>
@@ -1,62 +1,78 @@
 <q-tab-panel name="users">
  <q-card-section class="q-pa-none">
-    <h6 class="q-my-none">User Management</h6>
-    <br />
-    <div>
-      <p>Admin Users</p>
-      <q-input
-        filled
-        v-model="formAddAdmin"
-        @keydown.enter="addAdminUser"
-        type="text"
-        label="User ID"
-        hint="Users with admin privileges"
-      >
-        <q-btn @click="addAdminUser" dense flat icon="add"></q-btn>
-      </q-input>
-      <div>
-        {%raw%}
-        <q-chip
-          v-for="user in formData.lnbits_admin_users"
-          :key="user"
-          removable
-          @remove="removeAdminUser(user)"
-          color="primary"
-          text-color="white"
+    <h6 class="q-my-none q-mb-sm">User Management</h6>
+
+    <div class="row">
+      <div class="col-md-6 col-sm-12 q-pr-sm">
+        <p>Admin Users</p>
+        <q-input
+          filled
+          v-model="formAddAdmin"
+          @keydown.enter="addAdminUser"
+          type="text"
+          label="User ID"
+          hint="Users with admin privileges"
        >
-          {{ user }}
-        </q-chip>
-        {%endraw%}
+          <q-btn @click="addAdminUser" dense flat icon="add"></q-btn>
+        </q-input>
+        <div>
+          <q-chip
+            v-for="user in formData.lnbits_admin_users"
+            :key="user"
+            removable
+            @remove="removeAdminUser(user)"
+            color="primary"
+            text-color="white"
+          >
+            <span v-text="user"></span>
+          </q-chip>
+        </div>
+        <br />
      </div>
-      <br />
-    </div>
-    <div>
-      <p>Allowed Users</p>
-      <q-input
-        filled
-        v-model="formAddUser"
-        @keydown.enter="addAllowedUser"
-        type="text"
-        label="User ID"
-        hint="Only these users can use LNbits"
-      >
-        <q-btn @click="addAllowedUser" dense flat icon="add"></q-btn>
-      </q-input>
-      <div>
-        {% raw %}
-        <q-chip
-          v-for="user in formData.lnbits_allowed_users"
-          :key="user"
-          removable
-          @remove="removeAllowedUser(user)"
-          color="primary"
-          text-color="white"
+      <div class="col-md-6 col-sm-12">
+        <p>Allowed Users</p>
+        <q-input
+          filled
+          v-model="formAddUser"
+          @keydown.enter="addAllowedUser"
+          type="text"
+          label="User ID"
+          hint="Only these users can use LNbits"
        >
-          {{ user }}
-        </q-chip>
-        {% endraw %}
+          <q-btn @click="addAllowedUser" dense flat icon="add"></q-btn>
+        </q-input>
+        <div>
+          <q-chip
+            v-for="user in formData.lnbits_allowed_users"
+            :key="user"
+            removable
+            @remove="removeAllowedUser(user)"
+            color="primary"
+            text-color="white"
+          >
+            <span v-text="user" />
+          </q-chip>
+        </div>
+        <br />
+        <q-item tag="label" v-ripple>
+          <q-item-section>
+            <q-item-label>Allow creation of new users</q-item-label>
+            <q-item-label caption
+              >Allow creation of new users on the index page</q-item-label
+            >
+          </q-item-section>
+          <q-item-section avatar>
+            <q-toggle
+              size="md"
+              v-model="formData.lnbits_allow_new_accounts"
+              checked-icon="check"
+              color="green"
+              unchecked-icon="clear"
+            />
+          </q-item-section>
+        </q-item>
+        <br />
      </div>
-      <br />
    </div>
  </q-card-section>
 </q-tab-panel>
@@ -8,9 +8,9 @@
      @click="updateSettings"
      :disabled="!checkChanges"
    >
-      <q-tooltip v-if="checkChanges"
-        >{%raw%}{{ $t('save_tooltip') }}{%endraw%}</q-tooltip
-      >
+      <q-tooltip v-if="checkChanges">
+        <span v-text="$t('save_tooltip')"></span>
+      </q-tooltip>

      <q-badge
        v-if="checkChanges"
@@ -27,9 +27,9 @@
      color="primary"
      @click="restartServer"
    >
-      <q-tooltip v-if="needsRestart"
-        >{%raw%}{{ $t('restart_tooltip') }}{%endraw%}</q-tooltip
-      >
+      <q-tooltip v-if="needsRestart">
+        <span v-text="$t('restart_tooltip')"></span>
+      </q-tooltip>

      <q-badge
        v-if="needsRestart"
@@ -40,15 +40,6 @@
      />
    </q-btn>

-    <q-btn
-      v-if="isSuperUser"
-      :label="$t('topup')"
-      color="primary"
-      @click="topUpDialog.show = true"
-    >
-      <q-tooltip>{%raw%}{{ $t('add_funds_tooltip') }}{%endraw%}</q-tooltip>
-    </q-btn>
-
    <q-btn :label="$t('download_backup')" flat @click="downloadBackup"></q-btn>

    <q-btn
@@ -59,7 +50,9 @@
      @click="deleteSettings"
      class="float-right"
    >
-      <q-tooltip>{%raw%}{{ $t('reset_defaults_tooltip') }}{%endraw%}</q-tooltip>
+      <q-tooltip>
+        <span v-text="$t('reset_defaults_tooltip')"></span>
+      </q-tooltip>
    </q-btn>
  </div>
 </div>
@@ -115,571 +108,6 @@
  </div>
 </div>

-<q-dialog v-if="isSuperUser" v-model="topUpDialog.show" position="top">
-  <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
-    <q-form class="q-gutter-md">
-      <p v-text="$t('topup_wallet')"></p>
-
-      <div class="row">
-        <div class="col-12">
-          <q-input
-            dense
-            type="text"
-            filled
-            v-model="wallet.id"
-            label="Wallet ID"
-            :hint="$t('topup_hint')"
-          ></q-input>
-
-          <br />
-        </div>
-
-        <div class="col-12">
-          <q-input
-            dense
-            type="number"
-            filled
-            v-model="wallet.amount"
-            :label="$t('amount')"
-          ></q-input>
-        </div>
-      </div>
-
-      <div class="row q-mt-lg">
-        <q-btn
-          :label="$t('topup')"
-          color="primary"
-          @click="topupWallet"
-        ></q-btn>
-
-        <q-btn
-          v-close-popup
-          flat
-          color="grey"
-          class="q-ml-auto"
-          :label="$t('cancel')"
-        ></q-btn>
-      </div>
-    </q-form>
-  </q-card>
-</q-dialog>
 {% endblock %} {% block scripts %} {{ window_vars(user) }}
-<script>
-  new Vue({
-    el: '#vue',
-    mixins: [windowMixin],
-    data: function () {
-      return {
-        settings: {},
-        logs: [],
-        serverlogEnabled: false,
-        lnbits_theme_options: [
-          'classic',
-          'bitcoin',
-          'flamingo',
-          'cyber',
-          'freedom',
-          'mint',
-          'autumn',
-          'monochrome',
-          'salvador'
-        ],
-        auditData: {},
-        statusData: {},
-        statusDataTable: {
-          columns: [
-            {
-              name: 'date',
-              align: 'left',
-              label: this.$t('date'),
-              field: 'date'
-            },
-            {
-              name: 'message',
-              align: 'left',
-              label: this.$t('memo'),
-              field: 'message'
-            }
-          ]
-        },
-        formData: {},
-        formAddAdmin: '',
-        formAddUser: '',
-        formAddExtensionsManifest: '',
-        formAllowedIPs: '',
-        formBlockedIPs: '',
-        isSuperUser: false,
-        wallet: {},
-        cancel: {},
-        topUpDialog: {
-          show: false
-        },
-        tab: 'funding',
-        needsRestart: false,
-        funding_sources: new Map([
-          ['VoidWallet', null],
-          [
-            'FakeWallet',
-            {
-              fake_wallet_secret: {
-                value: null,
-                label: 'Secret'
-              }
-            }
-          ],
-          [
-            'CoreLightningWallet',
-            {
-              corelightning_rpc: {
-                value: null,
-                label: 'Endpoint'
-              }
-            }
-          ],
-          [
-            'CoreLightningRestWallet',
-            {
-              corelightning_rest_url: {
-                value: null,
-                label: 'Endpoint'
-              },
-              corelightning_rest_cert: {
-                value: null,
-                label: 'Certificate'
-              },
-              corelightning_rest_macaroon: {
-                value: null,
-                label: 'Macaroon'
-              }
-            }
-          ],
-          [
-            'LndRestWallet',
-            {
-              lnd_rest_endpoint: {
-                value: null,
-                label: 'Endpoint'
-              },
-              lnd_rest_cert: {
-                value: null,
-                label: 'Certificate'
-              },
-              lnd_rest_macaroon: {
-                value: null,
-                label: 'Macaroon'
-              },
-              lnd_rest_macaroon_encrypted: {
-                value: null,
-                label: 'Encrypted Macaroon'
-              }
-            }
-          ],
-          [
-            'LndWallet',
-            {
-              lnd_grpc_endpoint: {
-                value: null,
-                label: 'Endpoint'
-              },
-              lnd_grpc_cert: {
-                value: null,
-                label: 'Certificate'
-              },
-              lnd_grpc_port: {
-                value: null,
-                label: 'Port'
-              },
-              lnd_grpc_admin_macaroon: {
-                value: null,
-                label: 'Admin Macaroon'
-              },
-              lnd_grpc_macaroon_encrypted: {
-                value: null,
-                label: 'Encrypted Macaroon'
-              }
-            }
-          ],
-          [
-            'LnTipsWallet',
-            {
-              lntips_api_endpoint: {
-                value: null,
-                label: 'Endpoint'
-              },
-              lntips_api_key: {
-                value: null,
-                label: 'API Key'
-              }
-            }
-          ],
-          [
-            'LNPayWallet',
-            {
-              lnpay_api_endpoint: {
-                value: null,
-                label: 'Endpoint'
-              },
-              lnpay_api_key: {
-                value: null,
-                label: 'API Key'
-              },
-              lnpay_wallet_key: {
-                value: null,
-                label: 'Wallet Key'
-              }
-            }
-          ],
-          [
-            'EclairWallet',
-            {
-              eclair_url: {
-                value: null,
-                label: 'URL'
-              },
-              eclair_pass: {
-                value: null,
-                label: 'Password'
-              }
-            }
-          ],
-          [
-            'LNbitsWallet',
-            {
-              lnbits_endpoint: {
-                value: null,
-                label: 'Endpoint'
-              },
-              lnbits_key: {
-                value: null,
-                label: 'Admin Key'
-              }
-            }
-          ],
-          [
-            'OpenNodeWallet',
-            {
-              opennode_api_endpoint: {
-                value: null,
-                label: 'Endpoint'
-              },
-              opennode_key: {
-                value: null,
-                label: 'Key'
-              }
-            }
-          ],
-          [
-            'ClicheWallet',
-            {
-              cliche_endpoint: {
-                value: null,
-                label: 'Endpoint'
-              }
-            }
-          ],
-          [
-            'SparkWallet',
-            {
-              spark_url: {
-                value: null,
-                label: 'Endpoint'
-              },
-              spark_token: {
-                value: null,
-                label: 'Token'
-              }
-            }
-          ]
-        ])
-      }
-    },
-    created() {
-      this.getSettings()
-      this.getAudit()
-      this.balance = +'{{ balance|safe }}'
-    },
-    computed: {
-      lnbitsVersion() {
-        return LNBITS_VERSION
-      },
-      checkChanges() {
-        return !_.isEqual(this.settings, this.formData)
-      },
-      updateAvailable() {
-        return LNBITS_VERSION !== this.statusData.version
-      }
-    },
-    methods: {
-      addAdminUser() {
-        let addUser = this.formAddAdmin
-        let admin_users = this.formData.lnbits_admin_users
-        if (addUser && addUser.length && !admin_users.includes(addUser)) {
-          //admin_users = [...admin_users, addUser]
-          this.formData.lnbits_admin_users = [...admin_users, addUser]
-          this.formAddAdmin = ''
-        }
-      },
-      removeAdminUser(user) {
-        let admin_users = this.formData.lnbits_admin_users
-        this.formData.lnbits_admin_users = admin_users.filter(u => u !== user)
-      },
-      addAllowedUser() {
-        let addUser = this.formAddUser
-        let allowed_users = this.formData.lnbits_allowed_users
-        if (addUser && addUser.length && !allowed_users.includes(addUser)) {
-          this.formData.lnbits_allowed_users = [...allowed_users, addUser]
-          this.formAddUser = ''
-        }
-      },
-      removeAllowedUser(user) {
-        let allowed_users = this.formData.lnbits_allowed_users
-        this.formData.lnbits_allowed_users = allowed_users.filter(
-          u => u !== user
-        )
-      },
-      addExtensionsManifest() {
-        const addManifest = this.formAddExtensionsManifest.trim()
-        const manifests = this.formData.lnbits_extensions_manifests
-        if (
-          addManifest &&
-          addManifest.length &&
-          !manifests.includes(addManifest)
-        ) {
-          this.formData.lnbits_extensions_manifests = [
-            ...manifests,
-            addManifest
-          ]
-          this.formAddExtensionsManifest = ''
-        }
-      },
-      removeExtensionsManifest(manifest) {
-        const manifests = this.formData.lnbits_extensions_manifests
-        this.formData.lnbits_extensions_manifests = manifests.filter(
-          m => m !== manifest
-        )
-      },
-      async toggleServerLog() {
-        this.serverlogEnabled = !this.serverlogEnabled
-        if (this.serverlogEnabled) {
-          const wsProto = location.protocol !== 'http:' ? 'wss://' : 'ws://'
-          const digestHex = await LNbits.utils.digestMessage(this.g.user.id)
-          const localUrl =
-            wsProto +
-            document.domain +
-            ':' +
-            location.port +
-            '/api/v1/ws/' +
-            digestHex
-          this.ws = new WebSocket(localUrl)
-          this.ws.addEventListener('message', async ({data}) => {
-            this.logs.push(data.toString())
-            const scrollArea = this.$refs.logScroll
-            if (scrollArea) {
-              const scrollTarget = scrollArea.getScrollTarget()
-              const duration = 0
-              scrollArea.setScrollPosition(scrollTarget.scrollHeight, duration)
-            }
-          })
-        } else {
-          this.ws.close()
-        }
-      },
-      addAllowedIPs() {
-        const allowedIPs = this.formAllowedIPs.trim()
-        const allowed_ips = this.formData.lnbits_allowed_ips
-        if (
-          allowedIPs &&
-          allowedIPs.length &&
-          !allowed_ips.includes(allowedIPs)
-        ) {
-          this.formData.lnbits_allowed_ips = [...allowed_ips, allowedIPs]
-          this.formAllowedIPs = ''
-        }
-      },
-      removeAllowedIPs(allowed_ip) {
-        const allowed_ips = this.formData.lnbits_allowed_ips
-        this.formData.lnbits_allowed_ips = allowed_ips.filter(
-          a => a !== allowed_ip
-        )
-      },
-      addBlockedIPs() {
-        const blockedIPs = this.formBlockedIPs.trim()
-        const blocked_ips = this.formData.lnbits_blocked_ips
-        if (
-          blockedIPs &&
-          blockedIPs.length &&
-          !blocked_ips.includes(blockedIPs)
-        ) {
-          this.formData.lnbits_blocked_ips = [...blocked_ips, blockedIPs]
-          this.formBlockedIPs = ''
-        }
-      },
-      removeBlockedIPs(blocked_ip) {
-        const blocked_ips = this.formData.lnbits_blocked_ips
-        this.formData.lnbits_blocked_ips = blocked_ips.filter(
-          b => b !== blocked_ip
-        )
-      },
-      restartServer() {
-        LNbits.api
-          .request('GET', '/admin/api/v1/restart/?usr=' + this.g.user.id)
-          .then(response => {
-            this.$q.notify({
-              type: 'positive',
-              message: 'Success! Restarted Server',
-              icon: null
-            })
-            this.needsRestart = false
-          })
-          .catch(function (error) {
-            LNbits.utils.notifyApiError(error)
-          })
-      },
-      topupWallet() {
-        LNbits.api
-          .request(
-            'PUT',
-            '/admin/api/v1/topup/?usr=' + this.g.user.id,
-            this.g.user.wallets[0].adminkey,
-            this.wallet
-          )
-          .then(response => {
-            this.$q.notify({
-              type: 'positive',
-              message:
-                'Success! Added ' +
-                this.wallet.amount +
-                ' to ' +
-                this.wallet.id,
-              icon: null
-            })
-            this.wallet = {}
-          })
-          .catch(function (error) {
-            LNbits.utils.notifyApiError(error)
-          })
-      },
-      updateFundingData() {
-        this.settings.lnbits_allowed_funding_sources.map(f => {
-          let opts = this.funding_sources.get(f)
-          if (!opts) return
-          Object.keys(opts).forEach(e => {
-            opts[e].value = this.settings[e]
-          })
-        })
-      },
-      formatDate(date) {
-        return moment(date * 1000).fromNow()
-      },
-      getNotifications() {
-        if (this.settings.lnbits_notifications) {
-          axios
-            .get(this.settings.lnbits_status_manifest)
-            .then(response => {
-              this.statusData = response.data
-            })
-            .catch(error => {
-              this.formData.lnbits_notifications = false
-              error.response.data = {}
-              error.response.data.message = 'Could not fetch status manifest.'
-              LNbits.utils.notifyApiError(error)
-            })
-        }
-      },
-      getAudit() {
-        LNbits.api
-          .request(
-            'GET',
-            '/admin/api/v1/audit/?usr=' + this.g.user.id,
-            this.g.user.wallets[0].adminkey
-          )
-          .then(response => {
-            this.auditData = response.data
-          })
-          .catch(function (error) {
-            LNbits.utils.notifyApiError(error)
-          })
-      },
-      getSettings() {
-        LNbits.api
-          .request(
-            'GET',
-            '/admin/api/v1/settings/?usr=' + this.g.user.id,
-            this.g.user.wallets[0].adminkey
-          )
-          .then(response => {
-            this.isSuperUser = response.data.is_super_user || false
-            this.settings = response.data
-            this.formData = {...this.settings}
-            this.updateFundingData()
-            this.getNotifications()
-          })
-          .catch(function (error) {
-            LNbits.utils.notifyApiError(error)
-          })
-      },
-      updateSettings() {
-        let data = _.omit(this.formData, [
-          'is_super_user',
-          'lnbits_allowed_funding_sources'
-        ])
-        LNbits.api
-          .request(
-            'PUT',
-            '/admin/api/v1/settings/?usr=' + this.g.user.id,
-            this.g.user.wallets[0].adminkey,
-            data
-          )
-          .then(response => {
-            this.needsRestart =
-              this.settings.lnbits_backend_wallet_class !==
-                this.formData.lnbits_backend_wallet_class ||
-              this.settings.lnbits_killswitch !==
-                this.formData.lnbits_killswitch
-            this.settings = this.formData
-            this.formData = _.clone(this.settings)
-            this.updateFundingData()
-            this.$q.notify({
-              type: 'positive',
-              message: `Success! Settings changed! ${
-                this.needsRestart ? 'Restart required!' : ''
-              }`,
-              icon: null
-            })
-          })
-          .catch(function (error) {
-            LNbits.utils.notifyApiError(error)
-          })
-      },
-      deleteSettings() {
-        LNbits.utils
-          .confirmDialog(
-            'Are you sure you want to restore settings to default?'
-          )
-          .onOk(() => {
-            LNbits.api
-              .request(
-                'DELETE',
-                '/admin/api/v1/settings/?usr=' + this.g.user.id
-              )
-              .then(response => {
-                this.$q.notify({
-                  type: 'positive',
-                  message:
-                    'Success! Restored settings to defaults, restart required!',
-                  icon: null
-                })
-                this.needsRestart = true
-              })
-              .catch(function (error) {
-                LNbits.utils.notifyApiError(error)
-              })
-          })
-      },
-      downloadBackup() {
-        window.open('/admin/api/v1/backup/?usr=' + this.g.user.id, '_blank')
-      }
-    }
-  })
-</script>
+<script src="{{ static_url_for('static', 'js/admin.js') }}"></script>
 {% endblock %}
@@ -1,10 +1,11 @@
 <q-expansion-item
  group="extras"
-  icon="swap_vertical_circle"
-  :label="$t('api_docs')"
+  icon="vpn_key"
+  :label="$t('api_keys_api_docs')"
  :content-inset-level="0.5"
 >
  <q-card-section>
+    <strong>Node URL: </strong><em v-text="origin"></em><br />
    <strong>Wallet ID: </strong><em>{{ wallet.id }}</em><br />
    <strong>Admin key: </strong><em>{{ wallet.adminkey }}</em><br />
    <strong>Invoice/read key: </strong><em>{{ wallet.inkey }}</em>
@@ -0,0 +1,436 @@
+{% extends "base.html" %}
+<!---->
+{% from "macros.jinja" import window_vars with context %}
+<!---->
+{% block scripts %} {{ window_vars(user) }}
+<script src="{{ static_url_for('static', 'js/account.js') }}"></script>
+{% endblock %} {% block page %}
+
+<div class="row q-col-gutter-md">
+  <div v-if="user" class="col-12 col-md-6 q-gutter-y-md">
+    <q-card>
+      <q-card-section>
+        <div class="row">
+          <div class="col">
+            <q-tabs v-model="tab" align="justify">
+              <q-tab
+                name="user"
+                :label="$t('account_settings')"
+                @update="val => tab = val.name"
+              ></q-tab>
+              <q-tab
+                name="theme"
+                :label="$t('look_and_feel')"
+                @update="val => tab = val.name"
+              ></q-tab>
+            </q-tabs>
+            <q-tab-panels v-model="tab">
+              <q-tab-panel name="user">
+                <div v-if="passwordData.show">
+                  <q-card-section>
+                    <div class="row">
+                      <div class="col">
+                        <h4 class="q-my-none">
+                          <span v-text="$t('password_config')"></span>
+                        </h4>
+                      </div>
+                      <div class="col">
+                        <q-img
+                          v-if="user.config.picture"
+                          style="max-width: 100px"
+                          :src="user.config.picture"
+                          class="float-right"
+                        ></q-img>
+                      </div>
+                    </div>
+                  </q-card-section>
+                  <q-separator></q-separator>
+                  <q-card-section>
+                    <q-input
+                      v-if="user.has_password"
+                      v-model="passwordData.oldPassword"
+                      type="password"
+                      autocomplete="off"
+                      label="Old Password"
+                      filled
+                      dense
+                      :rules="[(val) => !val || val.length >= 8 || $t('invalid_password')]"
+                    ></q-input>
+                    <q-input
+                      v-model="passwordData.newPassword"
+                      type="password"
+                      autocomplete="off"
+                      :label="$t('password')"
+                      filled
+                      dense
+                      :rules="[(val) => !val || val.length >= 8 || $t('invalid_password')]"
+                    ></q-input>
+                    <q-input
+                      v-model="passwordData.newPasswordRepeat"
+                      type="password"
+                      autocomplete="off"
+                      :label="$t('password_repeat')"
+                      filled
+                      dense
+                      class="q-mb-md"
+                      :rules="[(val) => !val || val.length >= 8 || $t('invalid_password')]"
+                    ></q-input>
+                  </q-card-section>
+                  <q-separator></q-separator>
+                  <q-card-section class="q-pb-lg">
+                    <q-btn
+                      @click="updatePassword"
+                      :disable="(!passwordData.newPassword || !passwordData.newPasswordRepeat) || passwordData.newPassword !== passwordData.newPasswordRepeat"
+                      unelevated
+                      color="primary"
+                      :label="$t('change_password')"
+                    >
+                    </q-btn>
+                    <q-btn
+                      @click="passwordData.show = false"
+                      :label="$t('back')"
+                      outline
+                      unelevated
+                      color="grey"
+                      class="float-right"
+                    ></q-btn>
+                  </q-card-section>
+                </div>
+                <div v-else>
+                  <q-card-section>
+                    <div class="row">
+                      <div class="col">
+                        <q-img
+                          v-if="user.config.picture"
+                          style="max-width: 100px"
+                          :src="user.config.picture"
+                          class="float-right"
+                        ></q-img>
+                      </div>
+                    </div>
+                  </q-card-section>
+                  <q-separator></q-separator>
+
+                  <q-card-section>
+                    <q-input
+                      v-model="user.id"
+                      :label="$t('user_id')"
+                      filled
+                      dense
+                      readonly
+                      :type="showUserId ? 'text': 'password'"
+                      class="q-mb-md"
+                      ><q-btn
+                        @click="showUserId = !showUserId"
+                        dense
+                        flat
+                        :icon="showUserId ? 'visibility_off' : 'visibility'"
+                        color="grey"
+                      ></q-btn>
+                    </q-input>
+                    <q-input
+                      v-model="user.username"
+                      :label="$t('username')"
+                      filled
+                      dense
+                      :readonly="hasUsername"
+                      class="q-mb-md"
+                    >
+                    </q-input>
+                    <q-input
+                      v-model="user.email"
+                      :label="$t('email')"
+                      filled
+                      dense
+                      readonly
+                      class="q-mb-md"
+                    >
+                    </q-input>
+                    <div v-if="!user.email" class="row"></div>
+                    <div v-if="!user.email" class="row">
+                      {% if "google-auth" in LNBITS_AUTH_METHODS or
+                      "github-auth" in LNBITS_AUTH_METHODS %}
+                      <div class="col q-pa-sm text-h6">
+                        <span v-text="$t('verify_email')"></span>:
+                      </div>
+                      {%endif%} {% if "google-auth" in LNBITS_AUTH_METHODS %}
+                      <div class="col q-pa-sm">
+                        <q-btn
+                          :href="`/api/v1/auth/google?user_id=${user.id}`"
+                          type="a"
+                          outline
+                          no-caps
+                          rounded
+                          color="grey"
+                          class="full-width"
+                        >
+                          <q-avatar size="32px" class="q-mr-md">
+                            <q-img
+                              :src="'{{ static_url_for('static', 'images/google-logo.png') }}'"
+                            ></q-img>
+                          </q-avatar>
+                          <div>Google</div>
+                        </q-btn>
+                      </div>
+                      {%endif%} {% if "github-auth" in LNBITS_AUTH_METHODS %}
+                      <div class="col q-pa-sm">
+                        <q-btn
+                          :href="`/api/v1/auth/github?user_id=${user.id}`"
+                          type="a"
+                          outline
+                          no-caps
+                          color="grey"
+                          rounded
+                          class="full-width"
+                        >
+                          <q-avatar size="32px" class="q-mr-md">
+                            <q-img
+                              :src="'{{ static_url_for('static', 'images/github-logo.png') }}'"
+                            ></q-img>
+                          </q-avatar>
+                          <div>GitHub</div>
+                        </q-btn>
+                      </div>
+                      {%endif%}
+                    </div>
+                  </q-card-section>
+
+                  <q-card-section v-if="user.config">
+                    <q-input
+                      v-model="user.config.first_name"
+                      :label="$t('first_name')"
+                      filled
+                      dense
+                      class="q-mb-md"
+                    >
+                    </q-input>
+                    <q-input
+                      v-model="user.config.last_name"
+                      :label="$t('last_name')"
+                      filled
+                      dense
+                      class="q-mb-md"
+                    >
+                    </q-input>
+                    <q-input
+                      v-model="user.config.provider"
+                      :label="$t('auth_provider')"
+                      filled
+                      dense
+                      readonly
+                      class="q-mb-md"
+                    >
+                    </q-input>
+                    <q-input
+                      v-model="user.config.picture"
+                      :label="$t('picture')"
+                      filled
+                      dense
+                      class="q-mb-md"
+                    >
+                    </q-input>
+                  </q-card-section>
+                  <q-separator></q-separator>
+                  <q-card-section>
+                    <q-btn @click="updateAccount" unelevated color="primary">
+                      <span v-text="$t('update_account')"></span>
+                    </q-btn>
+                    <q-btn
+                      @click="showChangePassword()"
+                      :label="user.has_password ? $t('change_password'): $t('set_password')"
+                      outline
+                      unelevated
+                      color="grey"
+                      class="float-right"
+                    ></q-btn>
+                  </q-card-section>
+                </div>
+              </q-tab-panel>
+              <q-tab-panel name="theme">
+                <div class="row q-mb-md">
+                  <div class="col-4"><span v-text="$t('language')"></span></div>
+                  <div class="col-8">
+                    <q-btn-dropdown
+                      dense
+                      flat
+                      round
+                      size="sm"
+                      icon="language"
+                      class="q-pl-md"
+                    >
+                      <q-list v-for="(lang, index) in g.langs" :key="index">
+                        <q-item
+                          clickable
+                          v-close-popup
+                          :active="activeLanguage(lang.value)"
+                          @click="changeLanguage(lang.value)"
+                          ><q-item-section>
+                            <q-item-label
+                              v-text="lang.display ?? lang.value.toUpperCase()"
+                            ></q-item-label>
+                            <q-tooltip
+                              ><span v-text="lang.label"></span
+                            ></q-tooltip>
+                          </q-item-section>
+                        </q-item>
+                      </q-list>
+                    </q-btn-dropdown>
+                  </div>
+                </div>
+                <div class="row q-mb-md">
+                  <div class="col-4">
+                    <span v-text="$t('color_scheme')"></span>
+                  </div>
+                  <div class="col-8">
+                    <q-btn
+                      v-if="g.allowedThemes.includes('classic')"
+                      dense
+                      flat
+                      @click="changeColor('classic')"
+                      icon="circle"
+                      color="deep-purple"
+                      size="md"
+                      ><q-tooltip>classic</q-tooltip>
+                    </q-btn>
+                    <q-btn
+                      v-if="g.allowedThemes.includes('bitcoin')"
+                      dense
+                      flat
+                      @click="changeColor('bitcoin')"
+                      icon="circle"
+                      color="orange"
+                      size="md"
+                      ><q-tooltip>bitcoin</q-tooltip>
+                    </q-btn>
+                    <q-btn
+                      v-if="g.allowedThemes.includes('mint')"
+                      dense
+                      flat
+                      @click="changeColor('mint')"
+                      icon="circle"
+                      color="green"
+                      size="md"
+                      ><q-tooltip>mint</q-tooltip> </q-btn
+                    ><q-btn
+                      v-if="g.allowedThemes.includes('autumn')"
+                      dense
+                      flat
+                      @click="changeColor('autumn')"
+                      icon="circle"
+                      color="brown"
+                      size="md"
+                      ><q-tooltip>autumn</q-tooltip>
+                    </q-btn>
+                    <q-btn
+                      v-if="g.allowedThemes.includes('monochrome')"
+                      dense
+                      flat
+                      @click="changeColor('monochrome')"
+                      icon="circle"
+                      color="grey"
+                      size="md"
+                      ><q-tooltip>monochrome</q-tooltip>
+                    </q-btn>
+                    <q-btn
+                      v-if="g.allowedThemes.includes('salvador')"
+                      dense
+                      flat
+                      @click="changeColor('salvador')"
+                      icon="circle"
+                      color="blue-10"
+                      size="md"
+                      ><q-tooltip>elSalvador</q-tooltip>
+                    </q-btn>
+                    <q-btn
+                      v-if="g.allowedThemes.includes('freedom')"
+                      dense
+                      flat
+                      @click="changeColor('freedom')"
+                      icon="circle"
+                      color="pink-13"
+                      size="md"
+                      ><q-tooltip>freedom</q-tooltip>
+                    </q-btn>
+                    <q-btn
+                      v-if="g.allowedThemes.includes('cyber')"
+                      dense
+                      flat
+                      @click="changeColor('cyber')"
+                      icon="circle"
+                      color="light-green-9"
+                      size="md"
+                      ><q-tooltip>cyber</q-tooltip>
+                    </q-btn>
+                    <q-btn
+                      v-if="g.allowedThemes.includes('flamingo')"
+                      dense
+                      flat
+                      @click="changeColor('flamingo')"
+                      icon="circle"
+                      color="pink-3"
+                      size="md"
+                      ><q-tooltip>flamingo</q-tooltip>
+                    </q-btn>
+                  </div>
+                </div>
+                <div class="row q-mb-md">
+                  <div class="col-4">
+                    <span v-text="$t('toggle_darkmode')"></span>
+                  </div>
+                  <div class="col-8">
+                    <q-btn
+                      dense
+                      flat
+                      round
+                      @click="toggleDarkMode"
+                      :icon="($q.dark.isActive) ? 'brightness_3' : 'wb_sunny'"
+                      size="sm"
+                    >
+                      <q-tooltip
+                        ><span v-text="$t('toggle_darkmode')"></span
+                      ></q-tooltip>
+                    </q-btn>
+                  </div>
+                </div>
+                <div class="row q-mb-md">
+                  <div class="col-4">Notifications</div>
+                  <div class="col-8">
+                    <lnbits-notifications-btn
+                      v-if="g.user"
+                      pubkey="{{ WEBPUSH_PUBKEY }}"
+                    ></lnbits-notifications-btn>
+                  </div>
+                </div>
+                <div class="row q-mb-md">
+                  <div class="col-4">
+                    <span v-text="$t('payment_reactions')"></span>
+                  </div>
+                  <div class="col-8">
+                    <q-select
+                      v-model="reactionChoice"
+                      :options="reactionOptions"
+                      label="Reactions"
+                      @input="reactionChoiceFunc"
+                    >
+                      <q-tooltip
+                        ><span v-text="$t('payment_reactions')"></span
+                      ></q-tooltip>
+                    </q-select>
+                  </div>
+                </div>
+              </q-tab-panel>
+            </q-tab-panels>
+          </div>
+        </div>
+      </q-card-section>
+    </q-card>
+  </div>
+  <div v-else class="col-12 col-md-6 q-gutter-y-md">
+    <q-card>
+      <q-card-section>
+        <h4 class="q-my-none"><span v-text="$t('account')"></span></h4>
+      </q-card-section>
+    </q-card>
+  </div>
+</div>
+{% endblock %}
@@ -2,7 +2,7 @@
 %} {{ window_vars(user, extensions) }}{% block page %}
 <div class="row q-col-gutter-md q-mb-md">
  <div class="col-sm-9 col-xs-12">
-    <p class="text-h4 gt-sm">{%raw%}{{ $t('extensions') }}{%endraw%}</p>
+    <p class="text-h4 gt-sm" v-text="$t('extensions')"></p>
  </div>

  <div class="col-sm-3 col-xs-12 q-ml-auto">
@@ -43,9 +43,10 @@
              :label="$t('featured')"
              @update="val => tab = val.name"
            ></q-tab>
-            <i v-if="!g.user.admin && tab != 'installed'"
-              >{%raw%}{{ $t('only_admins_can_install') }}{%endraw%}</i
-            >
+            <i
+              v-if="!g.user.admin && tab != 'installed'"
+              v-text="$t('only_admins_can_install')"
+            ></i>
          </q-tabs>
        </div>
      </div>
@@ -89,45 +90,42 @@
              color="green"
              class="float-right"
            >
-              <small>{%raw%}{{ $t('new_version') }}{%endraw%}</small>
+              <small v-text="$t('new_version')"></small>
              <q-tooltip
                ><span v-text="extension.latestRelease.version"></span
              ></q-tooltip>
            </q-badge>
-            {% raw %}
-            <div class="text-h5 gt-sm q-mt-sm q-mb-xs gt-sm">
-              {{ extension.name }}
-            </div>
+            <div
+              class="text-h5 gt-sm q-mt-sm q-mb-xs gt-sm"
+              v-text="extension.name"
+            ></div>
            <div
              class="text-h5 gt-sm q-mt-sm q-mb-xs lt-md"
              style="min-height: 60px"
-            >
-              {{ extension.name }}
-            </div>
+              v-text="extension.name"
+            ></div>
            <div
              class="text-subtitle2 gt-sm"
              style="font-size: 11px; height: 34px"
-            >
-              {{ extension.shortDescription ||
-              extension.installedRelease?.description }}
-            </div>
-            <div class="text-subtitle1 lt-md q-mt-sm q-mb-xs">
-              {{ extension.name }}
-            </div>
+              v-text="extension.shortDescription || extension.installedRelease?.description"
+            ></div>
+            <div
+              class="text-subtitle1 lt-md q-mt-sm q-mb-xs"
+              v-text="extension.name"
+            ></div>
            <div
              class="text-subtitle2 lt-md"
              style="font-size: 9px; height: 34px"
-            >
-              {{ extension.shortDescription }}
-            </div>
-            {% endraw %}
+              v-text="extension.shortDescription"
+            ></div>
          </div>
        </div>
        <div class="row q-pt-sm">
          <div class="col">
-            <small v-if="extension.dependencies?.length"
-              >{%raw%}{{ $t('extension_depends_on') }}{%endraw%}</small
-            >
+            <small
+              v-if="extension.dependencies?.length"
+              v-text="$t('extension_depends_on')"
+            ></small>
            <small v-else>&nbsp;</small>
            <q-badge
              v-for="dep in extension.dependencies"
@@ -148,32 +146,30 @@
            size="1.5em"
            :max="5"
            color="primary"
-            ><q-tooltip
-              >{%raw%}{{ $t('extension_rating_soon') }}{%endraw%}</q-tooltip
-            ></q-rating
-          >
+            ><q-tooltip>
+              <span v-text="$t('extension_rating_soon')"></span> </q-tooltip
+          ></q-rating>
          <q-rating
            v-model="maxStars"
            class="lt-md"
            size="1.5em"
            :max="5"
            color="primary"
-            ><q-tooltip
-              >{%raw%}{{ $t('extension_rating_soon') }}{%endraw%}</q-tooltip
-            ></q-rating
-          >
+            ><q-tooltip>
+              <span v-text="$t('extension_rating_soon')"></span> </q-tooltip
+          ></q-rating>
          <q-toggle
            v-if="extension.isAvailable && extension.isInstalled && g.user.admin"
            :label="extension.isActive ? $t('activated'):  $t('deactivated') "
-            color="secodary"
+            color="secondary"
            style="max-height: 21px"
            v-model="extension.isActive"
            @input="toggleExtension(extension)"
-            ><q-tooltip
-              >{%raw%}{{ $t('activate_extension_details')
-              }}{%endraw%}</q-tooltip
-            ></q-toggle
-          >
+            ><q-tooltip>
+              <span
+                v-text="$t('activate_extension_details')"
+              ></span> </q-tooltip
+          ></q-toggle>
        </div>
      </q-card-section>
      <q-separator></q-separator>
@@ -185,9 +181,9 @@
              flat
              color="primary"
              type="a"
-              :href="[extension.id, '/?usr=', g.user.id].join('')"
-              >{%raw%}{{ $t('open') }}{%endraw%}</q-btn
-            >
+              :href="extension.id + '/'"
+              :label="$t('open')"
+            ></q-btn>
            <q-btn
              v-if="user.extensions.includes(extension.id) && extension.isActive && extension.isInstalled"
              flat
@@ -195,12 +191,13 @@
              type="a"
              :href="['{{
                url_for('install.extensions')
-              }}', '?usr=', g.user.id, '&disable=', extension.id].join('')"
+              }}', '?disable=', extension.id].join('')"
+              :label="$t('disable')"
+            ></q-btn>
+            <q-badge
+              v-if="extension.isAdminOnly && !user.admin"
+              v-text="$t('admin_only')"
            >
-              {%raw%}{{ $t('disable') }}{%endraw%}</q-btn
-            >
-            <q-badge v-if="extension.isAdminOnly && !user.admin">
-              {%raw%}{{ $t('admin_only') }}{%endraw%}
            </q-badge>
            <q-btn
              v-else-if="extension.isInstalled && extension.isActive && !user.extensions.includes(extension.id)"
@@ -209,9 +206,9 @@
              type="a"
              :href="['{{
                url_for('install.extensions')
-              }}', '?usr=', g.user.id, '&enable=', extension.id].join('')"
+              }}', '?enable=', extension.id].join('')"
+              :label="$t('enable')"
            >
-              {%raw%}{{ $t('enable') }}{%endraw%}
              <q-tooltip>
                <span v-text="$t('enable_extension_details')">
                </span> </q-tooltip
@@ -222,12 +219,11 @@
              flat
              color="primary"
              v-if="g.user.admin"
-            >
-              {%raw%}{{ $t('manage') }}{%endraw%}<q-tooltip
-                >{%raw%}{{ $t('manage_extension_details')
-                }}{%endraw%}</q-tooltip
-              ></q-btn
-            >
+              :label="$t('manage')"
+              ><q-tooltip
+                ><span v-text="$t('manage_extension_details')"></span
+              ></q-tooltip>
+            </q-btn>
          </div>
          <div v-else>
            <q-spinner color="primary" size="2.55em"></q-spinner>
@@ -240,11 +236,10 @@
            class="float-right"
          >
            <q-badge>
-              {% raw %}{{ extension.installedRelease.version }}{% endraw
-              %}<q-tooltip
-                >{%raw%}{{ $t('extension_installed_version')
-                }}{%endraw%}</q-tooltip
-              >
+              <span v-text="extension.installedRelease.version"></span>
+              <q-tooltip>
+                <span v-text="$t('extension_installed_version')"></span>
+              </q-tooltip>
            </q-badge>
          </div>
        </div>
@@ -253,10 +248,10 @@
  </div>
  <q-dialog v-model="showUninstallDialog">
    <q-card class="q-pa-lg">
-      <h6 class="q-my-md text-primary">{%raw%}{{ $t('warning') }}{%endraw%}</h6>
+      <h6 class="q-my-md text-primary" v-text="$t('warning')"></h6>
      <p>
-        {%raw%}{{ $t('extension_uninstall_warning') }}{%endraw%} <br />
-        {%raw%}{{ $t('confirm_continue') }}{%endraw%}
+        <span v-text="$t('extension_uninstall_warning')"></span><br />
+        <span v-text="$t('confirm_continue')"></span>
      </p>

      <div class="row q-mt-lg">
@@ -265,32 +260,39 @@
          value="false"
          label="Cleanup database tables"
        >
-          <q-tooltip class="bg-grey-8" anchor="bottom left" self="top left">
-            {%raw%}{{ $t('extension_db_drop_info') }}{%endraw%}
+          <q-tooltip class="bg-grey-8" anchor="bottom left" self="top left"
+            ><span v-text="$t('extension_db_drop_info')"></span>
          </q-tooltip>
        </q-checkbox>
      </div>
      <div class="row q-mt-lg">
-        <q-btn outline color="grey" @click="uninstallExtension()"
-          >{%raw%}{{ $t('uninstall_confirm') }}{%endraw%}</q-btn
-        >
-        <q-btn v-close-popup flat color="grey" class="q-ml-auto"
-          >{%raw%}{{ $t('cancel') }}{%endraw%}</q-btn
-        >
+        <q-btn
+          outline
+          color="grey"
+          @click="uninstallExtension()"
+          v-text="$t('uninstall_confirm')"
+        ></q-btn>
+        <q-btn
+          v-close-popup
+          flat
+          color="grey"
+          class="q-ml-auto"
+          v-text="$t('cancel')"
+        ></q-btn>
      </div>
    </q-card>
  </q-dialog>

  <q-dialog v-model="showDropDbDialog">
    <q-card v-if="selectedExtension" class="q-pa-lg">
-      <h6 class="q-my-md text-primary">{%raw%}{{ $t('warning') }}{%endraw%}</h6>
-      <p>{%raw%}{{ $t('extension_db_drop_warning') }}{%endraw%} <br /></p>
+      <h6 class="q-my-md text-primary" v-text="$t('warning')"></h6>
+      <p><span v-text="$t('extension_db_drop_warning')"></span><br /></p>
      <q-input
        v-model="dropDbExtensionId"
        :label="selectedExtension.id"
      ></q-input>
      <br />
-      <p>{%raw%}{{ $t('confirm_continue') }}{%endraw%}</p>
+      <p v-text="$t('confirm_continue')"></p>

      <div class="row q-mt-lg">
        <q-btn
@@ -298,17 +300,58 @@
          outline
          color="red"
          @click="dropExtensionDb()"
-          >{%raw%}{{ $t('confirm') }}{%endraw%}</q-btn
-        >
-        <q-btn v-close-popup flat color="grey" class="q-ml-auto"
-          >{%raw%}{{ $t('cancel') }}{%endraw%}</q-btn
-        >
+          v-text="$t('confirm')"
+        ></q-btn>
+        <q-btn
+          v-close-popup
+          flat
+          color="grey"
+          class="q-ml-auto"
+          v-text="$t('cancel')"
+        ></q-btn>
      </div>
    </q-card>
  </q-dialog>

  <q-dialog v-model="showUpgradeDialog">
-    <q-card class="q-pa-lg lnbits__dialog-card">
+    <q-card v-if="selectedRelease" class="q-pa-lg lnbits__dialog-card">
+      <q-card-section>
+        <div v-if="selectedRelease.paymentRequest">
+          <a :href="'lightning:' + selectedRelease.paymentRequest">
+            <q-responsive :ratio="1" class="q-mx-xl">
+              <lnbits-qrcode
+                :value="'lightning:' + selectedRelease.paymentRequest.toUpperCase()"
+              ></lnbits-qrcode>
+            </q-responsive>
+          </a>
+        </div>
+        <div v-else>
+          <q-spinner color="primary" size="2.55em"></q-spinner>
+        </div>
+      </q-card-section>
+
+      <div class="row q-mt-lg">
+        <div class="col">
+          <q-btn
+            v-if="selectedRelease.paymentRequest"
+            outline
+            color="grey"
+            @click="copyText(selectedRelease.paymentRequest)"
+            :label="$t('copy_invoice')"
+          ></q-btn>
+        </div>
+        <div class="col">
+          <q-btn
+            v-close-popup
+            flat
+            color="grey"
+            class="float-right q-ml-lg"
+            v-text="$t('close')"
+          ></q-btn>
+        </div>
+      </div>
+    </q-card>
+    <q-card v-else class="q-pa-lg lnbits__dialog-card">
      <q-card-section>
        <div class="text-h6" v-text="selectedExtension?.name"></div>
      </q-card-section>
@@ -338,7 +381,7 @@
              <q-item-section>
                <div class="row">
                  <div class="col-10">
-                    {%raw%}{{ $t('repository') }}{%endraw%}
+                    <span v-text="$t('repository')"></span>
                    <br />
                    <small v-text="repoName"></small>
                    <q-tooltip
@@ -377,30 +420,116 @@
                      color="pink"
                      size="70px"
                    ></q-icon>
-                    Cannot get the release details.
+                    <span v-text="$t('release_details_error')"></span>
                  </div>
                  <q-card v-else>
                    <q-card-section v-if="release.is_version_compatible">
-                      <q-btn
-                        v-if="!release.isInstalled"
-                        @click="installExtension(release)"
-                        color="primary unelevated mt-lg pt-lg"
-                        >{%raw%}{{ $t('install') }}{%endraw%}</q-btn
-                      >
-                      <q-btn v-else @click="showUninstall()" flat color="red">
-                        {%raw%}{{ $t('uninstall') }}{%endraw%}</q-btn
+                      <span
+                        v-if="release.requiresPayment && !release.paid_sats"
+                        v-text="$t('extension_cost', {cost: release.cost_sats})"
+                        class="q-mb-lg"
+                      ></span>
+                      <span
+                        v-if="release.requiresPayment && release.paid_sats"
+                        class="q-mb-lg"
+                        v-text="$t('extension_paid_sats', {paid_sats: release.paid_sats})"
+                      ></span>
+                      <div
+                        v-if="!release.requiresPayment || (release.requiresPayment && release.paid_sats)"
                      >
+                        <q-btn
+                          v-if="!release.isInstalled"
+                          @click="installExtension(release)"
+                          color="primary unelevated mt-lg pt-lg"
+                          :label="$t('install')"
+                        ></q-btn>
+                      </div>
+
+                      <div v-if="release.requiresPayment && !release.paid_sats">
+                        <div v-if="!release.payment_hash">
+                          <q-input
+                            filled
+                            dense
+                            v-model.number="release.paidAmount"
+                            type="number"
+                            :min="release.cost_sats"
+                            suffix="sat"
+                            class="q-mt-sm"
+                          >
+                          </q-input>
+                          <q-select
+                            filled
+                            dense
+                            emit-value
+                            v-model="release.wallet"
+                            :options="g.user.walletOptions"
+                            label="Wallet *"
+                            class="q-mt-sm"
+                          >
+                          </q-select>
+                          <q-btn
+                            unelevated
+                            color="primary"
+                            @click="payAndInstall(release)"
+                            :disabled="!release.wallet"
+                            class="q-mt-sm"
+                            :label="$t('pay_from_wallet')"
+                          ></q-btn>
+
+                          <q-btn
+                            unelevated
+                            color="primary"
+                            @click="showQRCode(release)"
+                            class="q-mt-sm float-right"
+                            :label="$t('show_qr')"
+                          ></q-btn>
+                        </div>
+                        <div v-else>
+                          <br />
+                          <span
+                            class="q-mb-lg q-mt-lg"
+                            v-text="'There is a previous pending invoice for this release.'"
+                          ></span>
+                          <br />
+                          <q-btn
+                            unelevated
+                            @click="installExtension(release)"
+                            color="primary"
+                            class="q-mt-sm"
+                            :label="$t('retry_install')"
+                          ></q-btn>
+                          <q-btn
+                            unelevated
+                            @click="clearHangingInvoice(release)"
+                            color="primary"
+                            class="q-mt-sm float-right"
+                            :label="$t('new_payment')"
+                          ></q-btn>
+                        </div>
+                      </div>
+
+                      <div>
+                        <q-btn
+                          v-if="release.isInstalled"
+                          @click="showUninstall()"
+                          :label="$t('uninstall')"
+                          flat
+                          color="red"
+                        ></q-btn>
+                      </div>
+
                      <a
                        v-if="release.html_url"
                        class="text-secondary float-right"
                        :href="release.html_url"
                        target="_blank"
+                        rel="noopener noreferrer"
                        style="color: inherit"
-                        >{%raw%}{{ $t('release_notes') }}{%endraw%}</a
-                      >
+                        v-text="$t('release_notes')"
+                      ></a>
                    </q-card-section>
                    <q-card-section v-else>
-                      {%raw%}{{ $t('extension_min_lnbits_version') }}{%endraw%}
+                      <span v-text="$t('extension_min_lnbits_version')"></span>
                      <strong>
                        <span v-text="release.min_lnbits_version"></span>
                      </strong>
@@ -408,8 +537,11 @@
                    <q-card v-if="release.warning">
                      <q-card-section>
                        <div class="text-h6">
-                          <q-badge color="yellow" text-color="black">
-                            {%raw%}{{ $t('warning') }}{%endraw%}
+                          <q-badge
+                            color="yellow"
+                            text-color="black"
+                            v-text="$t('warning')"
+                          >
                          </q-badge>
                        </div>
                        <div class="text-subtitle2">
@@ -432,9 +564,8 @@
          @click="showUninstall()"
          flat
          color="red"
-        >
-          {%raw%}{{ $t('uninstall') }}{%endraw%}</q-btn
-        >
+          v-text="$t('uninstall')"
+        ></q-btn>
        <q-btn
          v-else-if="selectedExtension?.hasDatabaseTables"
          @click="showDropDb()"
@@ -442,9 +573,13 @@
          color="red"
          :label="$t('drop_db')"
        ></q-btn>
-        <q-btn v-close-popup flat color="grey" class="q-ml-auto">
-          {%raw%}{{ $t('close') }}{%endraw%}</q-btn
-        >
+        <q-btn
+          v-close-popup
+          flat
+          color="grey"
+          class="q-ml-auto"
+          v-text="$t('close')"
+        ></q-btn>
      </div>
    </q-card>
  </q-dialog>
@@ -464,8 +599,10 @@
        dropDbExtensionId: '',
        selectedExtension: null,
        selectedExtensionRepos: null,
+        selectedRelease: null,
        uninstallAndDropDb: false,
        maxStars: 5,
+        paylinkWebsocket: null,
        user: null
      }
    },
@@ -504,19 +641,29 @@
          .filter(extensionNameContains(term))
        this.tab = tab
      },
+
      installExtension: async function (release) {
+        // no longer required to check if the invoice was paid
+        // the install logic has been triggered one way or another
+        this.unsubscribeFromPaylinkWs()
+
        const extension = this.selectedExtension
        extension.inProgress = true
        this.showUpgradeDialog = false
+        release.payment_hash =
+          release.payment_hash || this.getPaylinkHash(release.pay_link)
+
        LNbits.api
          .request(
            'POST',
-            `/api/v1/extension?usr=${this.g.user.id}`,
+            `/api/v1/extension`,
            this.g.user.wallets[0].adminkey,
            {
              ext_id: extension.id,
              archive: release.archive,
-              source_repo: release.source_repo
+              source_repo: release.source_repo,
+              payment_hash: release.payment_hash,
+              version: release.version
            }
          )
          .then(response => {
@@ -530,8 +677,9 @@
            this.tab = 'installed'
          })
          .catch(err => {
-            LNbits.utils.notifyApiError(err)
+            console.warn(err)
            extension.inProgress = false
+            LNbits.utils.notifyApiError(err)
          })
      },
      uninstallExtension: async function () {
@@ -542,7 +690,7 @@
        LNbits.api
          .request(
            'DELETE',
-            `/api/v1/extension/${extension.id}?usr=${this.g.user.id}`,
+            `/api/v1/extension/${extension.id}`,
            this.g.user.wallets[0].adminkey
          )
          .then(response => {
@@ -576,7 +724,7 @@
        LNbits.api
          .request(
            'DELETE',
-            `/api/v1/extension/${extension.id}/db?usr=${this.g.user.id}`,
+            `/api/v1/extension/${extension.id}/db`,
            this.g.user.wallets[0].adminkey
          )
          .then(response => {
@@ -598,9 +746,8 @@
        LNbits.api
          .request(
            'GET',
-            "{{ url_for('install.extensions') }}?usr=" +
-              this.g.user.id +
-              '&' +
+            "{{ url_for('install.extensions') }}" +
+              '?' +
              action +
              '=' +
              extension.id
@@ -624,12 +771,14 @@

      showUpgrade: async function (extension) {
        this.selectedExtension = extension
-        this.showUpgradeDialog = true
+        this.selectedRelease = null
        this.selectedExtensionRepos = null
+        this.showUpgradeDialog = true
+
        try {
          const {data} = await LNbits.api.request(
            'GET',
-            `/api/v1/extension/${extension.id}/releases?usr=${this.g.user.id}`,
+            `/api/v1/extension/${extension.id}/releases`,
            this.g.user.wallets[0].adminkey
          )

@@ -649,6 +798,12 @@
            if (release.isInstalled) {
              repos[release.source_repo].isInstalled = true
            }
+            if (release.pay_link) {
+              release.requiresPayment = true
+              release.paidAmount = release.cost_sats
+              release.payment_hash = this.getPaylinkHash(release.pay_link)
+            }
+
            repos[release.source_repo].releases.push(release)
            return repos
          }, {})
@@ -657,6 +812,122 @@
          extension.inProgress = false
        }
      },
+
+      async payAndInstall(release) {
+        try {
+          this.selectedExtension.inProgress = true
+          this.showUpgradeDialog = false
+          const paymentInfo = await this.requestPayment(
+            this.selectedExtension.id,
+            release
+          )
+          this.rememberPaylinkHash(release.pay_link, paymentInfo.payment_hash)
+          const wallet = this.g.user.wallets.find(w => w.id === release.wallet)
+          const {data} = await LNbits.api.payInvoice(
+            wallet,
+            paymentInfo.payment_request
+          )
+
+          release.payment_hash = data.payment_hash
+
+          await this.installExtension(release)
+        } catch (err) {
+          console.warn(err)
+          LNbits.utils.notifyApiError(err)
+        } finally {
+          this.selectedExtension.inProgress = false
+        }
+      },
+      async showQRCode(release) {
+        this.selectedRelease = release
+
+        try {
+          const data = await this.requestPayment(
+            this.selectedExtension.id,
+            release
+          )
+
+          this.selectedRelease.paymentRequest = data.payment_request
+          this.selectedRelease.payment_hash = data.payment_hash
+          this.selectedRelease = _.clone(this.selectedRelease)
+          this.rememberPaylinkHash(
+            this.selectedRelease.pay_link,
+            this.selectedRelease.payment_hash
+          )
+
+          this.subscribeToPaylinkWs(
+            this.selectedRelease.pay_link,
+            data.payment_hash
+          )
+        } catch (err) {
+          console.warn(err)
+          LNbits.utils.notifyApiError(err)
+        }
+      },
+
+      async requestPayment(extId, release) {
+        const {data} = await LNbits.api.request(
+          'PUT',
+          `/api/v1/extension/invoice`,
+          this.g.user.wallets[0].adminkey,
+          {
+            ext_id: extId,
+            archive: release.archive,
+            source_repo: release.source_repo,
+            cost_sats: release.paidAmount,
+            version: release.version
+          }
+        )
+        return data
+      },
+
+      clearHangingInvoice(release) {
+        this.forgetPaylinkHash(release.pay_link)
+        release.payment_hash = null
+      },
+
+      rememberPaylinkHash(pay_link, payment_hash) {
+        this.$q.localStorage.set(
+          `lnbits.extensions.paylink.${pay_link}`,
+          payment_hash
+        )
+      },
+      getPaylinkHash(pay_link) {
+        return this.$q.localStorage.getItem(
+          `lnbits.extensions.paylink.${pay_link}`
+        )
+      },
+      forgetPaylinkHash(pay_link) {
+        this.$q.localStorage.remove(`lnbits.extensions.paylink.${pay_link}`)
+      },
+      subscribeToPaylinkWs(pay_link, payment_hash) {
+        const url = new URL(`${pay_link}/${payment_hash}`)
+        url.protocol = url.protocol === 'https:' ? 'wss' : 'ws'
+        this.paylinkWebsocket = new WebSocket(url)
+        this.paylinkWebsocket.addEventListener('message', async ({data}) => {
+          const resp = JSON.parse(data)
+          if (resp.paid) {
+            this.$q.notify({
+              type: 'positive',
+              message: 'Invoice Paid!'
+            })
+            this.installExtension(this.selectedRelease)
+          } else {
+            this.$q.notify({
+              type: 'warning',
+              message: 'Invoice tracking lost!'
+            })
+          }
+        })
+      },
+      unsubscribeFromPaylinkWs() {
+        try {
+          this.paylinkWebsocket && this.paylinkWebsocket.close()
+        } catch (error) {
+          console.warn(error)
+        }
+      },
+
      hasNewVersion: function (extension) {
        if (extension.installedRelease && extension.latestRelease) {
          return (
@@ -694,7 +965,7 @@
        try {
          const {data} = await LNbits.api.request(
            'GET',
-            `/api/v1/extension/release/${org}/${repo}/${release.version}?usr=${this.g.user.id}`,
+            `/api/v1/extension/release/${org}/${repo}/${release.version}`,
            this.g.user.wallets[0].adminkey
          )
          release.loaded = true
@@ -0,0 +1,139 @@
+{% extends "public.html" %} {% block page %}
+<div class="row q-col-gutter-md justify-center main">
+  <div class="col-10 col-md-8 col-lg-6 q-gutter-y-md">
+    <q-card>
+      <q-card-section class="grid">
+        <div>
+          <h6 class="q-my-none text-center">
+            <strong>Welcome to LNbits</strong>
+            <p>Set up the Superuser account below.</p>
+          </h6>
+          <br />
+          <q-form class="q-gutter-md">
+            <q-input
+              filled
+              v-model="loginData.username"
+              :label="$t('username')"
+            ></q-input>
+            <q-input
+              filled
+              v-model.trim="loginData.password"
+              :type="loginData.isPwd ? 'password' : 'text'"
+              autocomplete="off"
+              :label="$t('password')"
+              :rules="[(val) => !val || val.length >= 8 || $t('invalid_password')]"
+              ><template v-slot:append>
+                <q-icon
+                  :name="loginData.isPwd ? 'visibility_off' : 'visibility'"
+                  class="cursor-pointer"
+                  @click="loginData.isPwd = !loginData.isPwd"
+                /> </template
+            ></q-input>
+            <q-input
+              filled
+              v-model.trim="loginData.passwordRepeat"
+              :type="loginData.isPwdRepeat ? 'password' : 'text'"
+              autocomplete="off"
+              :label="$t('password_repeat')"
+              :rules="[(val) => !val || val.length >= 8 || $t('invalid_password'), (val) => val === loginData.password || 'Passwords_dont_match']"
+              ><template v-slot:append>
+                <q-icon
+                  :name="loginData.isPwdRepeat ? 'visibility_off' : 'visibility'"
+                  class="cursor-pointer"
+                  @click="loginData.isPwdRepeat = !loginData.isPwdRepeat"
+                /> </template
+            ></q-input>
+            <q-btn
+              @click="setPassword()"
+              unelevated
+              color="primary"
+              :label="$t('login')"
+              :disable="checkPasswordsMatch || !loginData.username || !loginData.password || !loginData.passwordRepeat"
+            ></q-btn>
+          </q-form>
+        </div>
+        <div class="hero-wrapper">
+          <div class="hero q-mx-auto"></div>
+        </div>
+      </q-card-section>
+    </q-card>
+  </div>
+</div>
+{% endblock %} {% block scripts %}
+<style>
+  main {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+  }
+  .grid {
+    display: block;
+  }
+  .hero-wrapper {
+    display: none;
+  }
+  .hero {
+    display: block;
+    height: 100%;
+    max-width: 250px;
+    background-image: url("{{ static_url_for('static', 'images/logos/lnbits.svg') }}");
+    background-position: center;
+    background-size: contain;
+    background-repeat: no-repeat;
+  }
+
+  @media (min-width: 992px) {
+    .grid {
+      display: grid;
+      grid-template-columns: 1fr 1fr;
+      grid-gap: 1rem;
+    }
+    .hero-wrapper {
+      display: block;
+      position: relative;
+      height: 100%;
+      padding: 1rem;
+    }
+  }
+</style>
+<script>
+  new Vue({
+    el: '#vue',
+    mixins: [windowMixin],
+    data: function () {
+      return {
+        loginData: {
+          isPwd: true,
+          isPwdRepeat: true,
+          username: '',
+          password: '',
+          passwordRepeat: ''
+        }
+      }
+    },
+    created() {
+      this.hasAdminUI = '{{ LNBITS_ADMIN_UI | tojson}}'
+    },
+    computed: {
+      checkPasswordsMatch() {
+        return this.loginData.password !== this.loginData.passwordRepeat
+      }
+    },
+    methods: {
+      async setPassword() {
+        try {
+          await LNbits.api.request('PUT', '/api/v1/auth/first_install', null, {
+            username: this.loginData.username,
+            password: this.loginData.password,
+            password_repeat: this.loginData.passwordRepeat
+          })
+
+          window.location.href = '/admin'
+        } catch (e) {
+          LNbits.utils.notifyApiError(e)
+        }
+      }
+    }
+  })
+</script>
+{% endblock %}
@@ -1,74 +1,350 @@
 {% extends "public.html" %} {% block scripts %}
-<script src="/core/static/js/index.js"></script>
+<script src="{{ static_url_for('static', 'js/index.js') }}"></script>
 {% endblock %} {% block page %}
 <div class="row q-col-gutter-md justify-center">
-  <div class="col-12 col-md-7 col-lg-6 q-gutter-y-md">
-    <q-card>
-      <q-card-section>
-        {% if lnurl %}
-        <q-btn
-          unelevated
-          color="primary"
-          @click="processing"
-          type="a"
-          href="{{ url_for('core.lnurlwallet') }}?lightning={{ lnurl }}"
-          v-text="$t('press_to_claim')"
-        ></q-btn>
-        {% else %}
-        <q-form @submit="createWallet" class="q-gutter-md">
-          <q-input
-            filled
-            dense
-            v-model="walletName"
-            :label='$t("name_your_wallet", { name: "{{ SITE_TITLE }} *" })'
-          ></q-input>
-          <q-btn
-            unelevated
-            color="primary"
-            :disable="walletName == ''"
-            type="submit"
-            :label="$t('add_wallet')"
-          ></q-btn>
-        </q-form>
-        {% endif %}
-      </q-card-section>
-    </q-card>
+  <div
+    v-if="isUserAuthorized"
+    class="col-12 col-md-6 col-lg-6 q-gutter-y-md"
+  ></div>
+  <div v-else class="col-12 col-md-4 col-lg-4 q-gutter-y-md">
+    <div class="gt-sm">
+      <h3
+        class="q-my-none"
+        v-if="'{{LNBITS_SHOW_HOME_PAGE_ELEMENTS}}' == 'True'"
+      >
+        {{SITE_TITLE}}
+      </h3>
+      <h5 class="q-my-md" v-if="'{{LNBITS_SHOW_HOME_PAGE_ELEMENTS}}' == 'True'">
+        {{SITE_TAGLINE}}
+      </h5>
+      <div
+        v-html="formatDescription"
+        v-if="'{{LNBITS_SHOW_HOME_PAGE_ELEMENTS}}' == 'True'"
+      ></div>
+    </div>
+    {% if lnurl and LNBITS_NEW_ACCOUNTS_ALLOWED and ("user-id-only" in
+    LNBITS_AUTH_METHODS)%}
+    <div class="row q-mt-xl">
+      <div class="col-12 col-md-8 col-lg-7 q-gutter-y-md">
+        <q-card>
+          <q-card-section>
+            <q-btn
+              unelevated
+              color="primary"
+              @click="processing"
+              type="a"
+              href="{{ url_for('core.lnurlwallet') }}?lightning={{ lnurl }}"
+              v-text="$t('press_to_claim')"
+              class="full-width"
+            ></q-btn>
+          </q-card-section>
+        </q-card>
+      </div>
+    </div>
+    {%else%} {% endif %}

-    <q-card>
-      <q-card-section>
-        <h3 class="q-my-none">{{SITE_TITLE}}</h3>
-        <h5 class="q-my-md">{{SITE_TAGLINE}}</h5>
-        <div v-if="'{{SITE_TITLE}}' == 'LNbits'">
-          <p v-text="$t('lnbits_description')"></p>
-          <div class="row q-mt-md q-gutter-sm">
-            <q-btn
-              outline
-              color="grey"
-              type="a"
-              href="https://github.com/lnbits/lnbits"
-              target="_blank"
-              rel="noopener"
-              :label="$t('view_github')"
-            ></q-btn>
-            <q-btn
-              outline
-              color="grey"
-              type="a"
-              href="https://legend.lnbits.com/paywall/GAqKguK5S8f6w5VNjS9DfK"
-              target="_blank"
-              rel="noopener"
-              :label="$t('donate')"
-            ></q-btn>
+    <div class="row q-mt-md">
+      <div class="col-12 col-md-10 col-lg-10 q-gutter-y-md">
+        <q-badge v-if="isAccessTokenExpired" color="primary" rounded>
+          <div class="text-h5">
+            <span v-text="$t('session_has_expired')"></span>
          </div>
-        </div>
-        <p v-else>{{SITE_DESCRIPTION | safe}}</p>
-      </q-card-section>
-    </q-card>
+        </q-badge>
+        <q-card class="shadow-12">
+          {% if "user-id-only" in LNBITS_AUTH_METHODS %}
+          <q-card-section>
+            <div class="text-h6">
+              <span v-text="$t('instant_access_question')"></span>
+              <br />
+              <q-badge
+                @click="showLogin('user-id-only')"
+                color="primary"
+                class="cursor-pointer"
+                rounded
+              >
+                <strong>
+                  <q-icon name="account_circle" size="xs"></q-icon>
+                  <span v-text="$t('login_with_user_id')"></span> </strong
+              ></q-badge>
+              {% if LNBITS_NEW_ACCOUNTS_ALLOWED %}
+              <span v-text="$t('or')"></span>
+              <q-badge
+                @click="showRegister('user-id-only')"
+                color="primary"
+                class="cursor-pointer"
+                rounded
+              >
+                <strong>
+                  <q-icon name="add" size="xs"></q-icon>
+                  <span v-text="$t('create_new_wallet')"></span>
+                </strong>
+              </q-badge>
+              {%endif%}
+            </div>
+          </q-card-section>
+          <q-separator></q-separator>
+          <q-card-section
+            v-if="authAction === 'login' && authMethod === 'user-id-only'"
+          >
+            <b> <span v-text="$t('login_with_user_id')"></span> </b><br /><br />
+            <q-form @submit="loginUsr" class="q-gutter-md">
+              <q-input
+                filled
+                dense
+                v-model="usr"
+                label="usr"
+                type="password"
+              ></q-input>
+              <div>
+                <q-btn
+                  unelevated
+                  color="primary"
+                  :disable="usr == ''"
+                  type="submit"
+                  label="Login"
+                  class="full-width"
+                ></q-btn>
+              </div>
+            </q-form>
+          </q-card-section>
+          {%endif%} {% if "username-password" in LNBITS_AUTH_METHODS %}
+          <q-card-section
+            v-if="authAction === 'login' && authMethod === 'username-password'"
+          >
+            <div class="q-mb-lg">
+              <strong>
+                <span v-text="$t('login_to_account')"></span>
+              </strong>
+            </div>
+            <q-form @submit="login" class="q-gutter-md">
+              <q-input
+                filled
+                dense
+                v-model="username"
+                name="username"
+                :label="$t('username_or_email') + ' *'"
+              ></q-input>
+              <q-input
+                filled
+                dense
+                v-model="password"
+                name="password"
+                :label="$t('password') + ' *'"
+                type="password"
+              ></q-input>
+              <div>
+                <q-btn
+                  :disable="!username || !password"
+                  color="primary"
+                  type="submit"
+                  :label="$t('login')"
+                  class="full-width"
+                ></q-btn>
+              </div>
+            </q-form>
+          </q-card-section>
+          <q-card-section
+            v-if="authAction === 'register' && authMethod === 'username-password'"
+          >
+            <b> <span v-text="$t('create_account')"></span> </b><br /><br />
+            <q-form @submit="register" class="q-gutter-md">
+              <q-input
+                filled
+                dense
+                required
+                v-model="username"
+                :label="$t('username') + ' *'"
+                :rules="[(val) => validateUsername(val) || $t('invalid_username')]"
+              ></q-input>
+              <q-input
+                filled
+                dense
+                v-model="password"
+                :label="$t('password') + ' *'"
+                type="password"
+                :rules="[(val) => !val || val.length >= 8 || $t('invalid_password')]"
+              ></q-input>
+              <q-input
+                filled
+                dense
+                v-model="passwordRepeat"
+                :label="$t('password_repeat') + ' *'"
+                type="password"
+                :rules="[(val) => !val || val.length >= 8 || $t('invalid_password')]"
+              ></q-input>
+              <div>
+                <q-btn
+                  unelevated
+                  color="primary"
+                  :disable="!password || !passwordRepeat|| !username || (password !== passwordRepeat)"
+                  type="submit"
+                  class="full-width"
+                  :label="$t('create_account')"
+                ></q-btn>
+              </div>
+            </q-form>
+          </q-card-section>
+          {%endif%} {% if LNBITS_NEW_ACCOUNTS_ALLOWED %}
+          <q-card-section
+            v-if="authAction === 'register' && authMethod === 'user-id-only'"
+          >
+            <div>
+              <q-form @submit="createWallet" class="q-gutter-md">
+                <q-input
+                  filled
+                  dense
+                  v-model="walletName"
+                  :label='$t("name_your_wallet", { name: "{{ SITE_TITLE }} *" })'
+                ></q-input>
+                <div>
+                  <q-btn
+                    color="primary"
+                    :disable="walletName == ''"
+                    type="submit"
+                    :label="$t('add_wallet')"
+                    class="full-width"
+                  ></q-btn>
+                </div>
+              </q-form>
+            </div>
+          </q-card-section>
+          {% if "username-password" in LNBITS_AUTH_METHODS %}
+          <q-card-section
+            v-if="authAction === 'login' && authMethod === 'username-password'"
+          >
+            <div>
+              <q-btn
+                color="grey"
+                outline
+                :label="$t('register')"
+                class="full-width"
+                @click="showRegister('username-password')"
+              ></q-btn>
+            </div>
+          </q-card-section>
+          {%endif%}
+          <q-separator></q-separator>
+          {% endif %}
+
+          <q-card-section
+            v-if="authAction === 'login' && authMethod === 'username-password'"
+          >
+            <div class="row">
+              {% if "google-auth" in LNBITS_AUTH_METHODS %}
+              <div class="col-12 full-width q-pa-sm">
+                <q-btn
+                  href="/api/v1/auth/google"
+                  type="a"
+                  outline
+                  no-caps
+                  rounded
+                  color="grey"
+                  class="full-width"
+                >
+                  <q-avatar size="32px" class="q-mr-md">
+                    <q-img
+                      :src="'{{ static_url_for('static', 'images/google-logo.png') }}'"
+                    ></q-img>
+                  </q-avatar>
+                  <div>
+                    <span v-text="$t('signin_with_google')"></span>
+                  </div>
+                </q-btn>
+              </div>
+              {%endif%} {% if "github-auth" in LNBITS_AUTH_METHODS %}
+              <div class="col-12 full-width q-pa-sm">
+                <q-btn
+                  href="/api/v1/auth/github"
+                  type="a"
+                  outline
+                  no-caps
+                  color="grey"
+                  rounded
+                  class="full-width"
+                >
+                  <q-avatar size="32px" class="q-mr-md">
+                    <q-img
+                      :src="'{{ static_url_for('static', 'images/github-logo.png') }}'"
+                    ></q-img>
+                  </q-avatar>
+                  <div><span v-text="$t('signin_with_github')"></span></div>
+                </q-btn>
+              </div>
+              {%endif%} {% if "keycloak-auth" in LNBITS_AUTH_METHODS %}
+              <div class="col-12 full-width q-pa-sm">
+                <q-btn
+                  href="/api/v1/auth/keycloak"
+                  type="a"
+                  outline
+                  no-caps
+                  color="grey"
+                  rounded
+                  class="full-width"
+                >
+                  <q-avatar size="32px" class="q-mr-md">
+                    <q-img
+                      :src="'{{ static_url_for('static', 'images/keycloak-logo.png') }}'"
+                    ></q-img>
+                  </q-avatar>
+                  <div><span v-text="$t('signin_with_keycloak')"></span></div>
+                </q-btn>
+              </div>
+              {%endif%}
+            </div>
+          </q-card-section>
+          <q-card-section v-else>
+            <div class="row">
+              <div class="col q-pa-sm">
+                <q-btn
+                  @click="showLogin('username-password')"
+                  :label="$t('back')"
+                  outline
+                  rounded
+                  color="grey"
+                  class="full-width"
+                >
+                </q-btn>
+              </div>
+            </div>
+          </q-card-section>
+        </q-card>
+      </div>
+    </div>
  </div>

-  <!-- Ads -->
-  <div class="col-12 col-md-3 col-lg-3" v-if="'{{SITE_TITLE}}' == 'LNbits'">
+  <div
+    v-if="'{{LNBITS_SHOW_HOME_PAGE_ELEMENTS}}' == 'False'"
+    class="col-12 col-md-5 col-lg-5 q-pt-xl"
+  >
+    <h3 class="q-my-none">{{SITE_TITLE}}</h3>
+    <h5 class="q-my-md">{{SITE_TAGLINE}}</h5>
+    <div v-html="formatDescription"></div>
+  </div>
+
+  <div class="col-12 col-md-3 col-lg-3 gt-sm" v-else>
    <div class="row q-col-gutter-lg justify-center">
+      <div class="col-6 col-sm-4 col-md-8 q-gutter-y-sm">
+        <q-btn
+          outline
+          color="grey"
+          type="a"
+          href="https://github.com/lnbits/lnbits"
+          target="_blank"
+          rel="noopener noreferrer"
+          :label="$t('view_github')"
+          class="full-width"
+        ></q-btn>
+        <q-btn
+          outline
+          color="grey"
+          type="a"
+          href="https://demo.lnbits.com/lnurlp/link/fH59GD"
+          target="_blank"
+          rel="noopener noreferrer"
+          :label="$t('donate')"
+          class="full-width q-mb-lg"
+        ></q-btn>
+      </div>
      <div class="col-6 col-sm-4 col-md-8 q-gutter-y-sm">
        <q-btn
          flat
@@ -78,18 +354,26 @@
        ></q-btn>
        <div class="row">
          <div class="col">
-            <a href="https://github.com/ElementsProject/lightning">
+            <a
+              href="https://github.com/ElementsProject/lightning"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/cln.png' : '/static/images/clnl.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/cln.png') }}' : '{{ static_url_for('static', 'images/clnl.png') }}'"
              ></q-img>
            </a>
          </div>
          <div class="col q-pl-md">
-            <a href="https://github.com/lightningnetwork/lnd">
+            <a
+              href="https://github.com/lightningnetwork/lnd"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/lnd.png' : '/static/images/lnd.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/lnd.png') }}' : '{{ static_url_for('static', 'images/lnd.png') }}'"
              ></q-img>
            </a>
          </div>
@@ -97,18 +381,26 @@

        <div class="row">
          <div class="col">
-            <a href="https://opennode.com">
+            <a
+              href="https://opennode.com"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/opennode.png' : '/static/images/opennodel.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/opennode.png') }}' : '{{ static_url_for('static', 'images/opennodel.png') }}'"
              ></q-img>
            </a>
          </div>
          <div class="col q-pl-md">
-            <a href="https://lnpay.co/">
+            <a
+              href="https://lnpay.co/"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/lnpay.png' : '/static/images/lnpayl.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/lnpay.png') }}' : '{{ static_url_for('static', 'images/lnpayl.png') }}'"
              ></q-img>
            </a>
          </div>
@@ -116,77 +408,153 @@

        <div class="row">
          <div class="col">
-            <a href="https://github.com/rootzoll/raspiblitz">
+            <a
+              href="https://github.com/rootzoll/raspiblitz"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/blitz.png' : '/static/images/blitzl.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/blitz.png') }}' : '{{ static_url_for('static', 'images/blitzl.png') }}'"
              ></q-img>
            </a>
          </div>
          <div class="col q-pl-md">
-            <a href="https://start9.com/">
+            <a
+              href="https://start9.com/"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/start9.png' : '/static/images/start9l.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/start9.png') }}' : '{{ static_url_for('static', 'images/start9l.png') }}'"
              ></q-img>
            </a>
          </div>
        </div>
        <div class="row">
          <div class="col">
-            <a href="https://getumbrel.com/">
+            <a
+              href="https://getumbrel.com/"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/umbrel.png' : '/static/images/umbrell.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/umbrel.png') }}' : '{{ static_url_for('static', 'images/umbrell.png') }}'"
              ></q-img>
            </a>
          </div>
          <div class="col q-pl-md">
-            <a href="https://mynodebtc.com">
+            <a
+              href="https://mynodebtc.com"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/mynode.png' : '/static/images/mynodel.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/mynode.png') }}' : '{{ static_url_for('static', 'images/mynodel.png') }}'"
              ></q-img>
            </a>
          </div>
        </div>
        <div class="row">
          <div class="col">
-            <a href="https://github.com/shesek/spark-wallet">
+            <a
+              href="https://github.com/shesek/spark-wallet"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/spark.png' : '/static/images/sparkl.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/spark.png') }}' : '{{ static_url_for('static', 'images/sparkl.png') }}'"
              ></q-img>
            </a>
          </div>
          <div class="col q-pl-md">
-            <a href="https://voltage.cloud">
+            <a
+              href="https://voltage.cloud"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
              <q-img
                contain
-                :src="($q.dark.isActive) ? '/static/images/voltage.png' : '/static/images/voltagel.png'"
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/voltage.png') }}' : '{{ static_url_for('static', 'images/voltagel.png') }}'"
              ></q-img>
            </a>
          </div>
        </div>
+        <div class="row">
+          <div class="col">
+            <a
+              href="https://getalby.com"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
+              <q-img
+                contain
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/alby.png') }}' : '{{ static_url_for('static', 'images/albyl.png') }}'"
+              ></q-img>
+            </a>
+          </div>
+          <div class="col q-pl-md">
+            <a href="https://zbd.gg" target="_blank" rel="noopener noreferrer">
+              <q-img
+                contain
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/zbd.png') }}' : '{{ static_url_for('static', 'images/zbdl.png') }}'"
+              ></q-img>
+            </a>
+          </div>
+        </div>
+        <div class="row">
+          <div class="col">
+            <a
+              href="https://phoenix.acinq.co/server"
+              target="_blank"
+              rel="noopener noreferrer"
+            >
+              <q-img
+                contain
+                :src="($q.dark.isActive) ? '{{ static_url_for('static', 'images/phoenixd.png') }}' : '{{ static_url_for('static', 'images/phoenixdl.png') }}'"
+              ></q-img>
+            </a>
+          </div>
+          <div class="col q-pl-md"></div>
+        </div>
      </div>
-
-      {% if AD_SPACE %} {% for ADS in AD_SPACE %} {% set AD = ADS.split(';') %}
-      <div class="col-6 col-sm-4 col-md-8 q-gutter-y-sm">
-        <q-btn flat color="secondary" class="full-width q-mb-md"
-          >{{ AD_TITLE }}</q-btn
-        >
-
-        <a href="{{ AD[0] }}" class="q-ma-md">
-          <img
-            v-if="($q.dark.isActive)"
-            src="{{ AD[1] }}"
-            style="max-width: 90%"
-          />
-          <img v-else src="{{ AD[2] }}" style="max-width: 90%" />
-        </a>
-      </div>
-      {% endfor %} {% endif %}
    </div>
  </div>
 </div>
+{% if AD_SPACE %}
+<div class="row justify-center">
+  <q-btn flat color="secondary" class="full-width q-mb-md"
+    >{{ AD_SPACE_TITLE }}</q-btn
+  >
+
+  {% for ADS in AD_SPACE %} {% set AD = ADS.split(';') %}
+  <div class="flex flex-center column">
+    <a href="{{ AD[0] }}">
+      <img
+        v-if="($q.dark.isActive)"
+        src="{{ AD[1] }}"
+        style="max-width: 420px"
+      />
+      <img v-else src="{{ AD[2] }}" style="max-width: 420px" />
+    </a>
+  </div>
+
+  {% endfor %}
+</div>
+{% endif %}
+
+<div
+  v-if="'{{LNBITS_SHOW_HOME_PAGE_ELEMENTS}}' == 'True'"
+  class="row gt-sm q-mt-xl"
+>
+  <div class="col-1"></div>
+  <div class="col-10 q-pl-xl">
+    <span v-text="$t('lnbits_description')"></span>
+  </div>
+  <div class="col-1"></div>
+</div>
 {% endblock %}
@@ -3,7 +3,7 @@
 {% from "macros.jinja" import window_vars with context %}
 <!---->
 {% block scripts %} {{ window_vars(user, wallet) }}
-<script src="/core/static/js/wallet.js"></script>
+<script src="{{ static_url_for('static', 'js/wallet.js') }}"></script>
 {% endblock %}
 <!---->
 {% block title %} {{ wallet.name }} - {{ SITE_TITLE }} {% endblock %}
@@ -15,46 +15,58 @@
    {% elif HIDE_API %}
    <div class="col-12 q-gutter-y-md">
      {% else %}
-      <div class="col-12 col-md-7 q-gutter-y-md">
+      <div
+        class="col-12 col-md-7 q-gutter-y-md"
+        :style="$q.screen.lt.md ? {
+        position: mobileSimple ? 'fixed !important': ''
+      , top: mobileSimple ? '50% !important': ''
+      , left: mobileSimple ? '50% !important': ''
+      , transform: mobileSimple ? 'translate(-50%, -50%) !important': ''
+    } : ''"
+      >
        {% endif %}
-        <q-card>
+        <q-card
+          :style="$q.screen.lt.md ? {
+            background: $q.screen.lt.md ? 'none !important': ''
+          , boxShadow: $q.screen.lt.md ? 'none !important': ''
+          , margin: $q.screen.lt.md && mobileSimple ? 'auto !important': ''
+          , width: $q.screen.lt.md && mobileSimple ? '90% !important': ''
+        } : ''"
+        >
          <q-card-section>
-            <h3 class="q-my-none">
-              <strong>{% raw %}{{ formattedBalance }} {% endraw %}</strong>
-              {{LNBITS_DENOMINATION}}
-              <q-btn
+            <h3 class="q-my-none text-no-wrap">
+              <strong v-text="formattedBalance"></strong>
+              <small>{{LNBITS_DENOMINATION}}</small>
+              <lnbits-update-balance
                v-if="'{{user.super_user}}' == 'True'"
+                :wallet_id="this.g.wallet.id"
                flat
+                :callback="updateBalanceCallback"
                round
-                color="primary"
-                icon="add"
-                size="md"
-              >
-                <q-popup-edit
-                  class="bg-accent text-white"
-                  v-slot="scope"
-                  v-model="credit"
-                >
-                  <q-input
-                    filled
-                    :label='$t("credit_label", { denomination: "{{LNBITS_DENOMINATION}}"})'
-                    :hint="$t('credit_hint')"
-                    v-model="scope.value"
-                    dense
-                    autofocus
-                    :mask="'{{LNBITS_DENOMINATION}}' != 'sats' ? '#.##' : '#'"
-                    fill-mask="0"
-                    reverse-fill-mask
-                    :step="'{{LNBITS_DENOMINATION}}' != 'sats' ? '0.01' : '1'"
-                    @keyup.enter="updateBalance(scope.value)"
-                  >
-                    <template v-slot:append>
-                      <q-icon name="edit" />
-                    </template>
-                  </q-input>
-                </q-popup-edit>
-              </q-btn>
+              />
            </h3>
+            <div class="row">
+              <div class="col">
+                <div v-if="g.wallet.currency">
+                  <span
+                    class="text-h5 text-italic"
+                    v-text="formattedFiatBalance"
+                    style="opacity: 0.75"
+                  ></span>
+                </div>
+              </div>
+              <div class="col">
+                <q-btn
+                  @click="mobileSimple = !mobileSimple"
+                  color="primary"
+                  class="float-right lt-md"
+                  size="sm"
+                  flat
+                  :icon="mobileSimple ? 'unfold_more' : 'unfold_less'"
+                  :label="mobileSimple ? $t('more') : $t('less')"
+                ></q-btn>
+              </div>
+            </div>
          </q-card-section>
          <div class="row q-pb-md q-px-md q-col-gutter-md gt-sm">
            <div class="col">
@@ -84,243 +96,36 @@
                :label="$t('scan')"
              >
                <q-tooltip
-                  >{% raw %}{{$t('camera_tooltip')}}{% endraw %}</q-tooltip
-                >
+                  ><span v-text="$t('camera_tooltip')"></span
+                ></q-tooltip>
              </q-btn>
            </div>
          </div>
        </q-card>
-
-        <q-card>
-          <q-card-section>
-            <div class="row items-center no-wrap q-mb-sm">
-              <div class="col">
-                <h5
-                  class="text-subtitle1 q-my-none"
-                  :v-text="$t('transactions')"
-                ></h5>
-              </div>
-              <div class="col-auto">
-                <q-btn
-                  flat
-                  color="grey"
-                  @click="exportCSV"
-                  :label="$t('export_csv')"
-                ></q-btn>
-                <!--<q-btn v-if="pendingPaymentsExist" dense flat round icon="update" color="grey" @click="checkPendingPayments">
-                <q-tooltip>Check pending</q-tooltip>
-              </q-btn>-->
-                <q-btn
-                  dense
-                  flat
-                  round
-                  icon="show_chart"
-                  color="grey"
-                  @click="showChart"
-                >
-                  <q-tooltip
-                    >{% raw %}{{$t('chart_tooltip')}}{% endraw %}</q-tooltip
-                  >
-                </q-btn>
-              </div>
-            </div>
-            <q-input
-              filled
-              dense
-              clearable
-              v-model="paymentsTable.filter"
-              debounce="300"
-              :placeholder="$t('search_by_tag_memo_amount')"
-              class="q-mb-md"
-            >
-            </q-input>
-            <q-table
-              dense
-              flat
-              :data="payments"
-              :row-key="paymentTableRowKey"
-              :columns="paymentsTable.columns"
-              :pagination.sync="paymentsTable.pagination"
-              :no-data-label="$t('no_transactions')"
-              :filter="paymentsTable.filter"
-              :loading="paymentsTable.loading"
-              @request="fetchPayments"
-            >
-              {% raw %}
-              <template v-slot:header="props">
-                <q-tr :props="props">
-                  <q-th auto-width></q-th>
-                  <q-th v-for="col in props.cols" :key="col.name" :props="props"
-                    >{{ col.label }}</q-th
-                  >
-                </q-tr>
-              </template>
-              <template v-slot:body="props">
-                <q-tr :props="props">
-                  <q-td auto-width class="text-center">
-                    <q-icon
-                      v-if="props.row.isPaid"
-                      size="14px"
-                      :name="props.row.isOut ? 'call_made' : 'call_received'"
-                      :color="props.row.isOut ? 'pink' : 'green'"
-                      @click="props.expand = !props.expand"
-                    ></q-icon>
-                    <q-icon
-                      v-else
-                      name="settings_ethernet"
-                      color="grey"
-                      @click="props.expand = !props.expand"
-                    >
-                      <q-tooltip>{{$t('pending')}}</q-tooltip>
-                    </q-icon>
-                  </q-td>
-                  <q-td
-                    key="time"
-                    :props="props"
-                    style="white-space: normal; word-break: break-all"
-                  >
-                    <q-badge
-                      v-if="props.row.tag"
-                      color="yellow"
-                      text-color="black"
-                    >
-                      <a
-                        class="inherit"
-                        :href="['/', props.row.tag, '/?usr=', user.id].join('')"
-                      >
-                        #{{ props.row.tag }}
-                      </a>
-                    </q-badge>
-                    {{ props.row.memo }}
-                    <br />
-
-                    <i>
-                      {{ props.row.dateFrom }}<q-tooltip
-                        >{{ props.row.date }}</q-tooltip
-                      ></i
-                    >
-                  </q-td>
-
-                  {% endraw %}
-                  <q-td
-                    auto-width
-                    key="amount"
-                    v-if="'{{LNBITS_DENOMINATION}}' != 'sats'"
-                    :props="props"
-                    >{% raw %} {{
-                    parseFloat(String(props.row.fsat).replaceAll(",", "")) / 100
-                    }}
-                  </q-td>
-                  <q-td auto-width key="amount" v-else :props="props">
-                    {{ props.row.fsat }}<br />
-                    <i v-if="props.row.extra.wallet_fiat_currency">
-                      {{ props.row.extra.wallet_fiat_currency }} {{
-                      props.row.extra.wallet_fiat_amount }}
-                      <br />
-                    </i>
-                    <i v-if="props.row.extra.fiat_currency">
-                      {{ props.row.extra.fiat_currency }} {{
-                      props.row.extra.fiat_amount }}
-                    </i>
-                  </q-td>
-                </q-tr>
-
-                <q-dialog v-model="props.expand" :props="props">
-                  <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
-                    <div class="text-center q-mb-lg">
-                      <div v-if="props.row.isIn && props.row.pending">
-                        <q-icon name="settings_ethernet" color="grey"></q-icon>
-                        <span v-text="$t('invoice_waiting')"></span>
-                        <lnbits-payment-details
-                          :payment="props.row"
-                        ></lnbits-payment-details>
-                        <div
-                          v-if="props.row.bolt11"
-                          class="text-center q-mb-lg"
-                        >
-                          <a :href="'lightning:' + props.row.bolt11">
-                            <q-responsive :ratio="1" class="q-mx-xl">
-                              <qrcode
-                                :value="'lightning:' + props.row.bolt11.toUpperCase()"
-                                :options="{width: 340}"
-                                class="rounded-borders"
-                              ></qrcode>
-                            </q-responsive>
-                          </a>
-                        </div>
-                        <div class="row q-mt-lg">
-                          <q-btn
-                            outline
-                            color="grey"
-                            @click="copyText(props.row.bolt11)"
-                            :label="$t('copy_invoice')"
-                          ></q-btn>
-                          <q-btn
-                            v-close-popup
-                            flat
-                            color="grey"
-                            class="q-ml-auto"
-                            :label="$t('close')"
-                          ></q-btn>
-                        </div>
-                      </div>
-                      <div v-else-if="props.row.isPaid && props.row.isIn">
-                        <q-icon
-                          size="18px"
-                          :name="'call_received'"
-                          :color="'green'"
-                        ></q-icon>
-                        <span v-text="$t('payment_received')"></span>
-                        <lnbits-payment-details
-                          :payment="props.row"
-                        ></lnbits-payment-details>
-                      </div>
-                      <div v-else-if="props.row.isPaid && props.row.isOut">
-                        <q-icon
-                          size="18px"
-                          :name="'call_made'"
-                          :color="'pink'"
-                        ></q-icon>
-                        <span v-text="$t('payment_sent')"></span>
-                        <lnbits-payment-details
-                          :payment="props.row"
-                        ></lnbits-payment-details>
-                      </div>
-                      <div v-else-if="props.row.isOut && props.row.pending">
-                        <q-icon name="settings_ethernet" color="grey"></q-icon>
-                        <span v-text="$t('outgoing_payment_pending')"></span>
-                        <lnbits-payment-details
-                          :payment="props.row"
-                        ></lnbits-payment-details>
-                      </div>
-                    </div>
-                  </q-card>
-                </q-dialog>
-              </template>
-              {% endraw %}
-            </q-table>
-          </q-card-section>
-        </q-card>
+        <payment-list
+          :update="updatePayments"
+          :wallet="this.g.wallet"
+          :mobile-simple="mobileSimple"
+        />
      </div>
-
      {% if HIDE_API %}
      <div class="col-12 col-md-4 q-gutter-y-md">
        {% else %}
-        <div class="col-12 col-md-5 q-gutter-y-md">
+        <div
+          v-if="!mobileSimple || $q.screen.gt.sm"
+          class="col-12 col-md-5 q-gutter-y-md"
+        >
          <q-card>
            <q-card-section>
              <h6 class="text-subtitle1 q-mt-none q-mb-sm">
                {{ SITE_TITLE }} Wallet:
-                <strong><em>{{ wallet.name }}</em></strong>
+                <strong><em>{{wallet.name}}</em></strong>
              </h6>
            </q-card-section>
            <q-card-section class="q-pa-none">
              <q-separator></q-separator>

              <q-list>
-                {% include "core/_api_docs.html" %}
-                <q-separator></q-separator>
-
                {% if wallet.lnurlwithdraw_full %}
                <q-expansion-item
                  group="extras"
@@ -330,12 +135,11 @@
                  <q-card>
                    <q-card-section class="text-center">
                      <a href="lightning:{{wallet.lnurlwithdraw_full}}">
-                        <qrcode
-                          value="lightning:{{wallet.lnurlwithdraw_full}}"
-                          :options="{width:240}"
-                        ></qrcode>
+                        <lnbits-qrcode
+                          :value="lightning:{{wallet.lnurlwithdraw_full}}"
+                        ></lnbits-qrcode>
                      </a>
-                      <p v-text="$('drain_funds_desc')"></p>
+                      <p v-text="$t('drain_funds_desc')"></p>
                    </q-card-section>
                  </q-card>
                </q-expansion-item>
@@ -351,7 +155,7 @@
                    <q-card-section class="text-center">
                      <p v-text="$t('export_to_phone_desc')"></p>
                      <qrcode
-                        :value="'{{request.base_url}}' +'wallet?usr={{user.id}}&wal={{wallet.id}}'"
+                        :value="'{{request.base_url}}wallet?usr={{user.id}}&wal={{wallet.id}}'"
                        :options="{width:240}"
                      ></qrcode>
                    </q-card-section>
@@ -428,28 +232,33 @@
                      <q-btn
                        unelevated
                        color="red-10"
-                        @click="deleteWallet('{{ wallet.id }}', '{{ user.id }}')"
+                        @click="deleteWallet()"
                        :label="$t('delete_wallet')"
                      ></q-btn>
                    </q-card-section>
                  </q-card>
                </q-expansion-item>
+
+                <q-separator></q-separator>
+                {% include "core/_api_docs.html" %}
              </q-list>
            </q-card-section>
          </q-card>
-          {% endif %} {% if AD_SPACE %} {% for ADS in AD_SPACE %} {% set AD =
-          ADS.split(";") %}
+          {% endif %} {% if AD_SPACE %}
          <q-card>
            <q-card-section>
              <h6 class="text-subtitle1 q-mt-none q-mb-sm">
                {{ AD_SPACE_TITLE }}
              </h6>
            </q-card-section>
+            {% for ADS in AD_SPACE %} {% set AD = ADS.split(";") %}
+
            <q-card-section class="q-pa-none">
              <a
                style="display: inline-block"
                href="{{ AD[0] }}"
-                class="q-ma-md"
+                class="q-ml-md q-mb-xs q-mr-md"
+                style="max-width: 80%"
              >
                <img
                  style="max-width: 100%; height: auto"
@@ -461,27 +270,28 @@
                  v-else
                  src="{{ AD[2] }}"
                />
-              </a> </q-card-section></q-card
-          >{% endfor %} {% endif %}
+              </a> </q-card-section
+            >{% endfor %}
+          </q-card>
+          {% endif %}
        </div>
      </div>

-      <q-dialog v-model="receive.show">
-        {% raw %}
+      <q-dialog v-model="receive.show" position="top">
        <q-card
          v-if="!receive.paymentReq"
          class="q-pa-lg q-pt-xl lnbits__dialog-card"
        >
          <q-form @submit="createInvoice" class="q-gutter-md">
            <p v-if="receive.lnurl" class="text-h6 text-center q-my-none">
-              <b>{{receive.lnurl.domain}}</b> is requesting an invoice:
+              <b v-text="receive.lnurl.domain"></b> is requesting an invoice:
            </p>
-            {% endraw %} {% if LNBITS_DENOMINATION != 'sats' %}
+            {% if LNBITS_DENOMINATION != 'sats' %}
            <q-input
              filled
              dense
              v-model.number="receive.data.amount"
-              :label="$('amount')+' ({{LNBITS_DENOMINATION}}) *'"
+              :label="$t('amount')+' ({{LNBITS_DENOMINATION}}) *'"
              mask="#.##"
              fill-mask="0"
              reverse-fill-mask
@@ -520,7 +330,6 @@
              v-model.trim="receive.data.memo"
              :label="$t('memo')"
            ></q-input>
-            {% raw %}
            <div v-if="receive.status == 'pending'" class="row q-mt-lg">
              <q-btn
                unelevated
@@ -528,9 +337,10 @@
                :disable="receive.data.amount == null || receive.data.amount <= 0"
                type="submit"
              >
-                <span v-if="receive.lnurl">
-                  {{$t('withdraw_from')}} {{receive.lnurl.domain}}
-                </span>
+                <span
+                  v-if="receive.lnurl"
+                  v-text="$t('withdraw_from') + receive.lnurl.domain"
+                ></span>
                <span v-else v-text="$t('create_invoice')"></span>
              </q-btn>
              <q-btn
@@ -548,15 +358,16 @@
            ></q-spinner>
          </q-form>
        </q-card>
-        <q-card v-else class="q-pa-lg q-pt-xl lnbits__dialog-card">
+        <q-card
+          v-else-if="receive.paymentReq && receive.lnurl == null"
+          class="q-pa-lg q-pt-xl lnbits__dialog-card"
+        >
          <div class="text-center q-mb-lg">
            <a :href="'lightning:' + receive.paymentReq">
              <q-responsive :ratio="1" class="q-mx-xl">
-                <qrcode
+                <lnbits-qrcode
                  :value="'lightning:' + receive.paymentReq.toUpperCase()"
-                  :options="{width: 340}"
-                  class="rounded-borders"
-                ></qrcode>
+                ></lnbits-qrcode>
              </q-responsive>
            </a>
          </div>
@@ -576,28 +387,32 @@
            ></q-btn>
          </div>
        </q-card>
-        {% endraw %}
      </q-dialog>

-      <q-dialog v-model="parse.show" @hide="closeParseDialog">
+      <q-dialog v-model="parse.show" @hide="closeParseDialog" position="top">
        <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
          <div v-if="parse.invoice">
-            <h6 v-if="'{{LNBITS_DENOMINATION}}' != 'sats'" class="q-my-none">
-              {% raw %} {{ parseFloat(String(parse.invoice.fsat).replaceAll(",",
-              "")) / 100 }} {% endraw %} {{LNBITS_DENOMINATION}} {% raw %}
-            </h6>
-            <h6 v-else class="q-my-none">
-              {{ parse.invoice.fsat }}{% endraw %} {{LNBITS_DENOMINATION}} {%
-              raw %}
-            </h6>
+            <h6
+              v-if="'{{LNBITS_DENOMINATION}}' != 'sats'"
+              class="q-my-none"
+              v-text="parseFloat(String(parse.invoice.fsat).replaceAll(',', '')) / 100 + '{{LNBITS_DENOMINATION}}'"
+            ></h6>
+            <h6
+              v-else
+              class="q-my-none"
+              v-text="parse.invoice.fsat + '{{LNBITS_DENOMINATION}}'"
+            ></h6>
            <q-separator class="q-my-sm"></q-separator>
            <p class="text-wrap">
-              <strong v-text="$t('memo')">:</strong> {{
-              parse.invoice.description }}<br />
-              <strong>Expire date:</strong> {{ parse.invoice.expireDate }}<br />
-              <strong>Hash:</strong> {{ parse.invoice.hash }}
+              <strong v-text="$t('memo') + ': '"></strong>
+              <span v-text="parse.invoice.description"></span>
+              <br />
+              <strong>Expire date: </strong>
+              <span v-text="parse.invoice.expireDate"></span>
+              <br />
+              <strong>Hash: </strong>
+              <span v-text="parse.invoice.hash"></span>
            </p>
-            {% endraw %}
            <div v-if="canPay" class="row q-mt-lg">
              <q-btn
                unelevated
@@ -631,24 +446,31 @@
            </div>
          </div>
          <div v-else-if="parse.lnurlauth">
-            {% raw %}
            <q-form @submit="authLnurl" class="q-gutter-md">
              <p class="q-my-none text-h6">
-                Authenticate with <b>{{ parse.lnurlauth.domain }}</b>?
+                Authenticate with <b v-text="parse.lnurlauth.domain"></b>?
              </p>
              <q-separator class="q-my-sm"></q-separator>
              <p>
                For every website and for every LNbits wallet, a new keypair
                will be deterministically generated so your identity can't be
                tied to your LNbits wallet or linked across websites. No other
-                data will be shared with {{ parse.lnurlauth.domain }}.
+                data will be shared with
+                <span v-text="parse.lnurlauth.domain"></span>.
+              </p>
+              <p>
+                Your public key for <b v-text="parse.lnurlauth.domain"></b> is:
              </p>
-              <p>Your public key for <b>{{ parse.lnurlauth.domain }}</b> is:</p>
              <p class="q-mx-xl">
-                <code class="text-wrap"> {{ parse.lnurlauth.pubkey }} </code>
+                <code class="text-wrap" v-text="parse.lnurlauth.pubkey"></code>
              </p>
              <div class="row q-mt-lg">
-                <q-btn unelevated color="primary" type="submit">Login</q-btn>
+                <q-btn
+                  unelevated
+                  color="primary"
+                  type="submit"
+                  :label="$t('login')"
+                ></q-btn>
                <q-btn
                  :label="$t('cancel')"
                  v-close-popup
@@ -658,55 +480,74 @@
                ></q-btn>
              </div>
            </q-form>
-            {% endraw %}
          </div>
          <div v-else-if="parse.lnurlpay">
-            {% raw %}
            <q-form @submit="payLnurl" class="q-gutter-md">
              <p v-if="parse.lnurlpay.fixed" class="q-my-none text-h6">
-                <b>{{ parse.lnurlpay.domain }}</b> is requesting {{
-                parse.lnurlpay.maxSendable | msatoshiFormat }}
-                {{LNBITS_DENOMINATION}}
+                <b v-text="parse.lnurlpay.domain"></b> is requesting
+                <span
+                  v-text="msatoshiFormat(parse.lnurlpay.maxSendable)"
+                ></span>
+                <span v-text="'{{LNBITS_DENOMINATION}}'"></span>
                <span v-if="parse.lnurlpay.commentAllowed > 0">
                  <br />
-                  and a {{parse.lnurlpay.commentAllowed}}-char comment
+                  and a
+                  <span v-text="parse.lnurlpay.commentAllowed"></span>-char
+                  comment
                </span>
              </p>
              <p v-else class="q-my-none text-h6 text-center">
-                <b>{{ parse.lnurlpay.targetUser || parse.lnurlpay.domain }}</b>
+                <b
+                  v-text="parse.lnurlpay.targetUser || parse.lnurlpay.domain"
+                ></b>
                is requesting <br />
                between
-                <b>{{ parse.lnurlpay.minSendable | msatoshiFormat }}</b> and
-                <b>{{ parse.lnurlpay.maxSendable | msatoshiFormat }}</b>
-                {% endraw %} {{LNBITS_DENOMINATION}} {% raw %}
+                <b v-text="msatoshiFormat(parse.lnurlpay.minSendable)"></b> and
+                <b v-text="msatoshiFormat(parse.lnurlpay.maxSendable)"></b>
+                <span v-text="'{{LNBITS_DENOMINATION}}'"></span>
                <span v-if="parse.lnurlpay.commentAllowed > 0">
                  <br />
-                  and a {{parse.lnurlpay.commentAllowed}}-char comment
+                  and a
+                  <span v-text="parse.lnurlpay.commentAllowed"></span>-char
+                  comment
                </span>
              </p>
              <q-separator class="q-my-sm"></q-separator>
              <div class="row">
-                <p class="col text-justify text-italic">
-                  {{ parse.lnurlpay.description }}
-                </p>
+                <p
+                  class="col text-justify text-italic"
+                  v-text="parse.lnurlpay.description"
+                ></p>
                <p class="col-4 q-pl-md" v-if="parse.lnurlpay.image">
                  <q-img :src="parse.lnurlpay.image" />
                </p>
              </div>
              <div class="row">
                <div class="col">
-                  {% endraw %}
+                  <q-select
+                    filled
+                    dense
+                    v-if="!parse.lnurlpay.fixed"
+                    v-model="parse.data.unit"
+                    type="text"
+                    :label="$t('unit')"
+                    :options="receive.units"
+                  ></q-select>
+                  <br />
                  <q-input
+                    ref="setAmount"
                    filled
                    dense
                    v-model.number="parse.data.amount"
-                    type="number"
-                    label="Amount ({{LNBITS_DENOMINATION}}) *"
+                    :label="$t('amount') + ' (' + parse.data.unit + ') *'"
+                    :mask="parse.data.unit != 'sat' ? '#.##' : '#'"
+                    :step="parse.data.unit != 'sat' ? '0.01' : '1'"
+                    fill-mask="0"
+                    reverse-fill-mask
                    :min="parse.lnurlpay.minSendable / 1000"
                    :max="parse.lnurlpay.maxSendable / 1000"
-                    :readonly="parse.lnurlpay.fixed"
+                    :readonly="parse.lnurlpay && parse.lnurlpay.fixed"
                  ></q-input>
-                  {% raw %}
                </div>
                <div
                  class="col-8 q-pl-md"
@@ -723,9 +564,7 @@
                </div>
              </div>
              <div class="row q-mt-lg">
-                <q-btn unelevated color="primary" type="submit"
-                  >Send {{LNBITS_DENOMINATION}}</q-btn
-                >
+                <q-btn unelevated color="primary" type="submit">Send</q-btn>
                <q-btn
                  :label="$t('cancel')"
                  v-close-popup
@@ -735,7 +574,6 @@
                ></q-btn>
              </div>
            </q-form>
-            {% endraw %}
          </div>
          <div v-else>
            <q-form
@@ -766,11 +604,11 @@
                  class="q-mt-xs q-ml-sm q-mr-auto"
                  v-if="parse.copy.show"
                  @click="pasteToTextArea"
-                  ><q-tooltip
-                    >{% raw %}{{$t('paste_from_clipboard')}}{% endraw
-                    %}</q-tooltip
-                  ></q-icon
                >
+                  <q-tooltip>
+                    <span v-text="$t('paste_from_clipboard')"></span>
+                  </q-tooltip>
+                </q-icon>
                <q-btn
                  v-close-popup
                  flat
@@ -803,7 +641,7 @@
        </q-card>
      </q-dialog>

-      <q-dialog v-model="parse.camera.show">
+      <q-dialog v-model="parse.camera.show" position="top">
        <q-card class="q-pa-lg q-pt-xl">
          <div class="text-center q-mb-lg">
            <qrcode-stream
@@ -824,14 +662,6 @@
        </q-card>
      </q-dialog>

-      <q-dialog v-model="paymentsChart.show">
-        <q-card class="q-pa-sm" style="width: 800px; max-width: unset">
-          <q-card-section>
-            <canvas ref="canvas" width="600" height="400"></canvas>
-          </q-card-section>
-        </q-card>
-      </q-dialog>
-
      <q-tabs
        class="lt-md fixed-bottom left-0 right-0 bg-primary text-white shadow-2 z-top"
        active-class="px-0"
@@ -858,16 +688,20 @@
        </q-btn>
      </q-tabs>

-      <q-dialog v-model="disclaimerDialog.show">
+      <q-dialog v-model="disclaimerDialog.show" position="top">
        <q-card class="q-pa-lg">
-          <h6 class="q-my-md text-primary">Warning</h6>
-          <p v-text="$t('disclaimer_dialog')"></p>
+          <h6
+            class="q-my-md text-primary"
+            v-text="$t('disclaimer_dialog_title')"
+          ></h6>
+          <p class="whitespace-pre-line" v-text="$t('disclaimer_dialog')"></p>
          <div class="row q-mt-lg">
            <q-btn
              outline
              color="grey"
-              @click="copyText(disclaimerDialog.location.href)"
-              :label="$t('copy_wallet_url')"
+              type="a"
+              href="/account"
+              :label="$t('my_account')"
            ></q-btn>
            <q-btn
              v-close-popup
@@ -0,0 +1,308 @@
+<q-tab-panel name="channels">
+  <q-dialog v-model="connectPeerDialog.show">
+    <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
+      <q-form class="q-gutter-md">
+        <q-input
+          dense
+          type="text"
+          filled
+          v-model="connectPeerDialog.data.uri"
+          label="Node URI"
+          hint="pubkey@host:port"
+        ></q-input>
+
+        <div class="row q-mt-lg">
+          <q-btn
+            :label="$t('connect')"
+            color="primary"
+            @click="connectPeer"
+          ></q-btn>
+          <q-btn
+            v-close-popup
+            flat
+            color="grey"
+            class="q-ml-auto"
+            :label="$t('cancel')"
+          ></q-btn>
+        </div>
+      </q-form>
+    </q-card>
+  </q-dialog>
+
+  <q-dialog v-model="openChannelDialog.show">
+    <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
+      <q-form class="q-gutter-md">
+        <q-input
+          dense
+          type="text"
+          filled
+          v-model="openChannelDialog.data.peer_id"
+          label="Peer ID"
+        ></q-input>
+        <q-input
+          dense
+          type="number"
+          filled
+          v-model.number="openChannelDialog.data.funding_amount"
+          label="Funding Amount"
+        ></q-input>
+        <q-expansion-item icon="warning" label="Advanced">
+          <q-card>
+            <q-card-section>
+              <div class="column q-gutter-md">
+                <q-input
+                  dense
+                  type="number"
+                  filled
+                  v-model.number="openChannelDialog.data.push_amount"
+                  label="Push Amount"
+                  hint="This gifts sats to the other side!"
+                ></q-input>
+
+                <q-input
+                  dense
+                  type="number"
+                  filled
+                  v-model.number="openChannelDialog.data.fee_rate"
+                  label="Fee Rate"
+                ></q-input>
+              </div>
+            </q-card-section>
+          </q-card>
+        </q-expansion-item>
+
+        <div class="row q-mt-lg">
+          <q-btn
+            :label="$t('open')"
+            color="primary"
+            @click="openChannel"
+          ></q-btn>
+          <q-btn
+            v-close-popup
+            flat
+            color="grey"
+            class="q-ml-auto"
+            :label="$t('cancel')"
+          ></q-btn>
+        </div>
+      </q-form>
+    </q-card>
+  </q-dialog>
+
+  <q-dialog v-model="closeChannelDialog.show">
+    <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
+      <q-form class="q-gutter-md">
+        <div>
+          <q-checkbox v-model="closeChannelDialog.data.force" label="Force" />
+        </div>
+
+        <div class="row q-mt-lg">
+          <q-btn
+            :label="$t('close')"
+            color="primary"
+            @click="closeChannel"
+          ></q-btn>
+          <q-btn
+            v-close-popup
+            flat
+            color="grey"
+            class="q-ml-auto"
+            :label="$t('cancel')"
+          ></q-btn>
+        </div>
+      </q-form>
+    </q-card>
+  </q-dialog>
+
+  <q-card-section class="q-pa-none">
+    <div class="row q-col-gutter-lg">
+      <div class="col-12 col-xl-6">
+        <q-card class="full-height">
+          <q-card-section class="q-gutter-y-sm">
+            <div class="row items-center q-mt-none q-gutter-x-sm no-wrap">
+              <div class="col-grow text-h6 q-my-none col-grow">Channels</div>
+              <q-input
+                filled
+                dense
+                clearable
+                v-model="channels.filter"
+                placeholder="Search..."
+                class="col-auto"
+              ></q-input>
+              <q-select
+                dense
+                size="sm"
+                style="min-width: 200px"
+                filled
+                multiple
+                clearable
+                v-model="stateFilters"
+                :options="this.states"
+                class="col-auto"
+              ></q-select>
+              <q-btn
+                unelevated
+                color="primary"
+                size="md"
+                class="col-auto"
+                @click="showOpenChannelDialog()"
+              >
+                Open channel
+              </q-btn>
+            </div>
+            <div>
+              <div class="text-subtitle1 col-grow">Total</div>
+              <lnbits-channel-balance
+                :balance="this.totalBalance"
+              ></lnbits-channel-balance>
+            </div>
+            <q-separator></q-separator>
+            <q-table
+              dense
+              flat
+              :data="this.filteredChannels"
+              :filter="channels.filter"
+              no-data-label="No channels opened"
+            >
+              <template v-slot:header="props">
+                <q-tr :props="props" style="height: 0"> </q-tr>
+              </template>
+              <template v-slot:body="props">
+                <q-tr :props="props">
+                  <div class="q-pb-sm">
+                    <div class="row items-center q-gutter-sm">
+                      <div
+                        class="text-subtitle1 col-grow"
+                        v-text="props.row.name"
+                      ></div>
+                      <div class="text-caption" v-if="props.row.short_id">
+                        <span v-text="props.row.short_id"></span>
+                        <q-btn
+                          size="xs"
+                          flat
+                          dense
+                          icon="content_paste"
+                          @click="copyText(props.row.short_id)"
+                        ></q-btn>
+                      </div>
+                      <q-badge
+                        rounded
+                        :color="states.find(s => s.value == props.row.state)?.color"
+                        v-text="states.find(s => s.value == props.row.state)?.label"
+                      >
+                      </q-badge>
+                      <q-btn
+                        :disable='props.row.state !== "active"'
+                        flat
+                        dense
+                        size="md"
+                        @click="showCloseChannelDialog(props.row)"
+                        icon="cancel"
+                        color="pink"
+                      ></q-btn>
+                    </div>
+                    <lnbits-channel-balance
+                      :balance="props.row.balance"
+                      :color="props.row.color"
+                    ></lnbits-channel-balance>
+                  </div>
+                </q-tr>
+              </template>
+            </q-table>
+          </q-card-section>
+        </q-card>
+      </div>
+      <div class="col-12 col-xl-6">
+        <q-card class="full-height">
+          <q-card-section class="column q-gutter-y-sm">
+            <div
+              class="row items-center q-mt-none justify-between q-gutter-x-md no-wrap"
+            >
+              <div class="col-grow text-h6 q-my-none">Peers</div>
+              <q-input
+                filled
+                dense
+                clearable
+                v-model="peers.filter"
+                placeholder="Search..."
+                class="col-auto"
+              ></q-input>
+              <q-btn
+                class="col-auto"
+                color="primary"
+                @click="connectPeerDialog.show = true"
+              >
+                Connect Peer
+              </q-btn>
+            </div>
+            <q-separator></q-separator>
+            <q-table
+              dense
+              flat
+              :data="peers.data"
+              :filter="peers.filter"
+              no-data-label="No transactions made yet"
+            >
+              <template v-slot:header="props">
+                <q-tr :props="props" style="height: 0"> </q-tr>
+              </template>
+              <template v-slot:body="props">
+                <q-tr :props="props">
+                  <div class="row no-wrap items-center q-gutter-sm">
+                    <div class="q-my-sm col-grow">
+                      <div
+                        class="text-subtitle1 text-bold"
+                        v-text="props.row.alias"
+                      ></div>
+                      <div class="row items-center q-gutter-sm">
+                        <q-badge
+                          :style="`background-color: #${props.row.color}`"
+                          class="text-bold"
+                          v-text="'#'+props.row.color"
+                        >
+                        </q-badge>
+                        <div
+                          class="text-bold"
+                          v-text="shortenNodeId(props.row.id)"
+                        ></div>
+                        <q-btn
+                          size="xs"
+                          flat
+                          dense
+                          icon="content_paste"
+                          @click="copyText(props.row.id)"
+                        ></q-btn>
+                        <q-btn
+                          size="xs"
+                          flat
+                          dense
+                          icon="qr_code"
+                          @click="showNodeInfoDialog(props.row)"
+                        ></q-btn>
+                      </div>
+                    </div>
+                    <q-btn
+                      unelevated
+                      color="primary"
+                      @click="showOpenChannelDialog(props.row.id)"
+                    >
+                      Open channel
+                    </q-btn>
+                    <q-btn
+                      flat
+                      dense
+                      size="md"
+                      @click="disconnectPeer(props.row.id)"
+                      icon="cancel"
+                      color="pink"
+                    ></q-btn>
+                  </div>
+                </q-tr>
+              </template>
+            </q-table>
+          </q-card-section>
+        </q-card>
+      </div>
+    </div>
+  </q-card-section>
+</q-tab-panel>
@@ -0,0 +1,68 @@
+<q-tab-panel name="dashboard">
+  <q-card-section class="q-pa-none">
+    <lnbits-node-info :info="this.info"></lnbits-node-info>
+    <div class="row q-col-gutter-lg q-mt-sm">
+      <div class="col-12 col-md-8 q-gutter-y-md">
+        <div class="row q-col-gutter-md q-pb-lg">
+          <div class="col-12 col-md-6 col-xl-4 q-gutter-y-md">
+            <lnbits-stat
+              :title="$t('total_capacity')"
+              :msat="this.channel_stats.total_capacity"
+            />
+          </div>
+          <div class="col-12 col-md-6 col-xl-4 q-gutter-y-md">
+            <lnbits-stat title="Balance" :msat="this.info.balance_msat" />
+          </div>
+
+          <div class="col-12 col-md-6 col-xl-4 q-gutter-y-md">
+            <lnbits-stat
+              title="Fees collected"
+              :msat="this.info.fees?.total_msat"
+            />
+          </div>
+
+          <div class="col-12 col-md-6 col-xl-4 q-gutter-y-md">
+            <lnbits-stat
+              title="Onchain Balance"
+              :btc="this.info.onchain_balance_sat / 100000000"
+            />
+          </div>
+
+          <div class="col-12 col-md-6 col-xl-4 q-gutter-y-md">
+            <lnbits-stat
+              title="Onchain Confirmed"
+              :btc="this.info.onchain_confirmed_sat / 100000000"
+            />
+          </div>
+          <div class="col-12 col-md-6 col-xl-4 q-gutter-y-md">
+            <lnbits-stat title="Peers" :amount="this.info.num_peers" />
+          </div>
+          <div class="col-12 col-md-6 col-xl-4 q-gutter-y-md">
+            <lnbits-stat
+              :title="$t('avg_channel_size')"
+              :msat="this.channel_stats.avg_size"
+            />
+          </div>
+          <div class="col-12 col-md-6 col-xl-4 q-gutter-y-md">
+            <lnbits-stat
+              :title="$t('biggest_channel_size')"
+              :msat="this.channel_stats.biggest_size"
+            />
+          </div>
+          <div class="col-12 col-md-6 col-xl-4 q-gutter-y-md">
+            <lnbits-stat
+              :title="$t('smallest_channel_size')"
+              :msat="this.channel_stats.smallest_size"
+            />
+          </div>
+        </div>
+      </div>
+      <div class="column col-12 col-md-4 q-gutter-y-md">
+        <lnbits-node-ranks :ranks="this.ranks"></lnbits-node-ranks>
+        <lnbits-channel-stats
+          :stats="this.channel_stats"
+        ></lnbits-channel-stats>
+      </div>
+    </div>
+  </q-card-section>
+</q-tab-panel>
@@ -0,0 +1,310 @@
+<q-tab-panel name="transactions">
+  <q-card-section class="q-pa-none">
+    <q-dialog v-model="transactionDetailsDialog.show">
+      <q-card class="my-card">
+        <q-card-section>
+          <div class="text-center q-mb-lg">
+            <div
+              v-if="transactionDetailsDialog.data.isIn && transactionDetailsDialog.data.pending"
+            >
+              <q-icon
+                size="18px"
+                :name="'call_received'"
+                :color="'green'"
+              ></q-icon>
+              <span v-text="$t('payment_received')"></span>
+            </div>
+            <div class="row q-my-md">
+              <div class="col-3"><b v-text="$t('payment_hash')"></b>:</div>
+              <div class="col-9 text-wrap mono">
+                <span
+                  v-text="transactionDetailsDialog.data.payment_hash"
+                ></span>
+                <q-icon
+                  name="content_copy"
+                  @click="copyText(transactionDetailsDialog.data.payment_hash)"
+                  size="1em"
+                  color="grey"
+                  class="q-mb-xs cursor-pointer"
+                />
+              </div>
+              <div
+                class="row"
+                v-if="transactionDetailsDialog.data.preimage && !transactionDetailsDialog.data.pending"
+              >
+                <div class="col-3"><b v-text="$t('payment_proof')"></b>:</div>
+                <div class="col-9 text-wrap mono">
+                  <span v-text="transactionDetailsDialog.data.preimage"></span>
+                  <q-icon
+                    name="content_copy"
+                    @click="copyText(transactionDetailsDialog.data.preimage)"
+                    size="1em"
+                    color="grey"
+                    class="q-mb-xs cursor-pointer"
+                  />
+                </div>
+              </div>
+            </div>
+            <div
+              v-if="transactionDetailsDialog.data.bolt11"
+              class="text-center q-mb-lg"
+            >
+              <a :href="'lightning:' + transactionDetailsDialog.data.bolt11">
+                <q-responsive :ratio="1" class="q-mx-xl">
+                  <qrcode
+                    :value="'lightning:' + transactionDetailsDialog.data.bolt11.toUpperCase()"
+                    :options="{width: 340}"
+                    class="rounded-borders"
+                  ></qrcode>
+                </q-responsive>
+              </a>
+              <q-btn
+                outline
+                color="grey"
+                @click="copyText(transactionDetailsDialog.data.bolt11)"
+                :label="$t('copy_invoice')"
+                class="q-mt-sm"
+              ></q-btn>
+            </div>
+          </div>
+        </q-card-section>
+      </q-card>
+    </q-dialog>
+
+    <div class="row q-col-gutter-md q-pb-lg"></div>
+
+    <div class="row q-col-gutter-lg">
+      <div class="col-12 col-lg-6 q-gutter-y-md">
+        <q-card>
+          <q-card-section>
+            <div class="row items-center no-wrap q-mb-sm">
+              <div class="col text-h6 q-my-none">Payments</div>
+              <q-input
+                v-if="payments.length > 10"
+                filled
+                dense
+                clearable
+                v-model="paymentsTable.filter"
+                debounce="300"
+                placeholder="Search by tag, memo, amount"
+                class="q-mb-md"
+              >
+              </q-input>
+            </div>
+            <q-table
+              dense
+              flat
+              :data="paymentsTable.data"
+              :columns="paymentsTable.columns"
+              :pagination.sync="paymentsTable.pagination"
+              row-key="payment_hash"
+              no-data-label="No transactions made yet"
+              :filter="paymentsTable.filter"
+              @request="getPayments"
+            >
+              <template v-slot:body-cell-pending="props">
+                <q-td auto-width class="text-center">
+                  <q-icon
+                    v-if="!props.row.pending"
+                    size="xs"
+                    name="call_made"
+                    color="green"
+                    @click="showTransactionDetailsDialog(props.row)"
+                  ></q-icon>
+                  <q-icon
+                    v-else
+                    size="xs"
+                    name="settings_ethernet"
+                    color="grey"
+                    @click="showTransactionDetailsDialog(props.row)"
+                  >
+                    <q-tooltip>Pending</q-tooltip>
+                  </q-icon>
+                  <q-dialog v-model="props.row.expand" :props="props">
+                    <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
+                      <div class="text-center q-mb-lg">
+                        <div v-if="props.row.isIn && props.row.pending">
+                          <q-icon
+                            name="settings_ethernet"
+                            color="grey"
+                          ></q-icon>
+                          <span v-text="$t('invoice_waiting')"></span>
+                          <lnbits-payment-details
+                            :payment="props.row"
+                          ></lnbits-payment-details>
+                          <div
+                            v-if="props.row.bolt11"
+                            class="text-center q-mb-lg"
+                          >
+                            <a :href="'lightning:' + props.row.bolt11">
+                              <q-responsive :ratio="1" class="q-mx-xl">
+                                <qrcode
+                                  :value="'lightning:' + props.row.bolt11.toUpperCase()"
+                                  :options="{width: 340}"
+                                  class="rounded-borders"
+                                ></qrcode>
+                              </q-responsive>
+                            </a>
+                          </div>
+                          <div class="row q-mt-lg">
+                            <q-btn
+                              outline
+                              color="grey"
+                              @click="copyText(props.row.bolt11)"
+                              :label="$t('copy_invoice')"
+                            ></q-btn>
+                            <q-btn
+                              v-close-popup
+                              flat
+                              color="grey"
+                              class="q-ml-auto"
+                              :label="$t('close')"
+                            ></q-btn>
+                          </div>
+                        </div>
+                        <div v-else-if="props.row.isPaid && props.row.isIn">
+                          <q-icon
+                            size="18px"
+                            :name="'call_received'"
+                            :color="'green'"
+                          ></q-icon>
+                          <span v-text="$t('payment_received')"></span>
+                          <lnbits-payment-details
+                            :payment="props.row"
+                          ></lnbits-payment-details>
+                        </div>
+                        <div v-else-if="props.row.isPaid && props.row.isOut">
+                          <q-icon
+                            size="18px"
+                            :name="'call_made'"
+                            :color="'pink'"
+                          ></q-icon>
+                          <span v-text="$t('payment_sent')"></span>
+                          <lnbits-payment-details
+                            :payment="props.row"
+                          ></lnbits-payment-details>
+                        </div>
+                        <div v-else-if="props.row.isOut && props.row.pending">
+                          <q-icon
+                            name="settings_ethernet"
+                            color="grey"
+                          ></q-icon>
+                          <span v-text="$t('outgoing_payment_pending')"></span>
+                          <lnbits-payment-details
+                            :payment="props.row"
+                          ></lnbits-payment-details>
+                        </div>
+                      </div>
+                    </q-card>
+                  </q-dialog>
+                </q-td>
+              </template>
+              <template v-slot:body-cell-date="props">
+                <q-td auto-width key="date" :props="props">
+                  <lnbits-date :ts="props.row.time"></lnbits-date>
+                </q-td>
+              </template>
+              <template v-slot:body-cell-destination="props">
+                <q-td auto-width key="destination">
+                  <div class="row items-center justify-between no-wrap">
+                    <q-badge
+                      :style="`background-color: #${props.row.destination?.color}`"
+                      class="text-bold"
+                      v-text="props.row.destination?.alias"
+                    ></q-badge>
+                    <div>
+                      <q-btn
+                        size="xs"
+                        flat
+                        dense
+                        icon="content_paste"
+                        @click="copyText(info.id)"
+                      ></q-btn>
+                      <q-btn
+                        size="xs"
+                        flat
+                        dense
+                        icon="qr_code"
+                        @click="showNodeInfoDialog(props.row.destination)"
+                      ></q-btn>
+                    </div>
+                  </div>
+                </q-td>
+              </template>
+            </q-table>
+          </q-card-section>
+        </q-card>
+      </div>
+      <div class="col-12 col-lg-6 q-gutter-y-md">
+        <q-card>
+          <q-card-section>
+            <div class="row items-center no-wrap q-mb-sm">
+              <div class="col text-h6 q-my-none">Invoices</div>
+              <q-input
+                v-if="payments.length > 10"
+                filled
+                dense
+                clearable
+                v-model="paymentsTable.filter"
+                debounce="300"
+                placeholder="Search by tag, memo, amount"
+                class="q-mb-md"
+              >
+              </q-input>
+            </div>
+
+            <q-table
+              dense
+              flat
+              :data="invoiceTable.data"
+              :columns="invoiceTable.columns"
+              :pagination.sync="invoiceTable.pagination"
+              no-data-label="No transactions made yet"
+              :filter="invoiceTable.filter"
+              @request="getInvoices"
+            >
+              <template v-slot:body-cell-pending="props">
+                <q-td auto-width class="text-center">
+                  <q-icon
+                    v-if="!props.row.pending"
+                    size="xs"
+                    name="call_received"
+                    color="green"
+                    @click="showTransactionDetailsDialog(props.row)"
+                  ></q-icon>
+                  <q-icon
+                    v-else
+                    size="xs"
+                    name="settings_ethernet"
+                    color="grey"
+                    @click="showTransactionDetailsDialog(props.row)"
+                  >
+                    <q-tooltip>Pending</q-tooltip>
+                  </q-icon>
+                </q-td>
+              </template>
+
+              <template v-slot:body-cell-paid_at="props">
+                <q-td auto-width :props="props">
+                  <lnbits-date
+                    v-if="props.row.paid_at"
+                    :ts="props.row.paid_at"
+                  ></lnbits-date>
+                </q-td>
+              </template>
+
+              <template v-slot:body-cell-expiry="props">
+                <q-td auto-width :props="props">
+                  <lnbits-date
+                    v-if="props.row.expiry"
+                    :ts="props.row.expiry"
+                  ></lnbits-date>
+                </q-td>
+              </template>
+            </q-table>
+          </q-card-section>
+        </q-card>
+      </div>
+    </div>
+  </q-card-section>
+</q-tab-panel>
@@ -0,0 +1,376 @@
+{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
+%} {% block page %}
+
+<q-dialog v-model="nodeInfoDialog.show">
+  <lnbits-node-qrcode :info="nodeInfoDialog.data"></lnbits-node-qrcode>
+</q-dialog>
+
+<div class="row q-col-gutter-md justify-center">
+  <div class="col q-gutter-y-md">
+    <q-card>
+      <div class="q-pa-md">
+        <div class="q-gutter-y-md">
+          <q-tabs v-model="tab" active-color="primary" align="justify">
+            <q-tab
+              name="dashboard"
+              :label="$t('dashboard')"
+              @update="val => tab = val.name"
+            ></q-tab>
+            <q-tab
+              name="channels"
+              :label="$t('channels')"
+              @update="val => tab = val.name"
+            ></q-tab>
+            <q-tab
+              name="transactions"
+              :label="$t('transactions')"
+              @update="val => tab = val.name"
+            ></q-tab>
+          </q-tabs>
+        </div>
+      </div>
+
+      <q-form name="settings_form" id="settings_form">
+        <q-tab-panels v-model="tab" animated>
+          {% include "node/_tab_dashboard.html" %} {% include
+          "node/_tab_channels.html" %} {% include "node/_tab_transactions.html"
+          %}
+        </q-tab-panels>
+      </q-form>
+    </q-card>
+  </div>
+</div>
+
+{% endblock %} {% block scripts %} {{ window_vars(user) }}
+<script src="{{ static_url_for('static', 'js/node.js') }}"></script>
+<script>
+  Vue.component(VueQrcode.name, VueQrcode)
+  Vue.use(VueQrcodeReader)
+
+  new Vue({
+    el: '#vue',
+    config: {
+      globalProperties: {
+        LNbits,
+        msg: 'hello'
+      }
+    },
+    mixins: [windowMixin],
+    data: function () {
+      return {
+        isSuperUser: false,
+        wallet: {},
+        tab: 'dashboard',
+        payments: 1000,
+        info: {},
+        channel_stats: {},
+
+        channels: {
+          data: [],
+          filter: ''
+        },
+
+        activeBalance: {},
+        ranks: {},
+
+        peers: {
+          data: [],
+          filter: ''
+        },
+
+        connectPeerDialog: {
+          show: false,
+          data: {}
+        },
+
+        openChannelDialog: {
+          show: false,
+          data: {}
+        },
+
+        closeChannelDialog: {
+          show: false,
+          data: {}
+        },
+
+        nodeInfoDialog: {
+          show: false,
+          data: {}
+        },
+
+        transactionDetailsDialog: {
+          show: false,
+          data: {}
+        },
+
+        states: [
+          {label: 'Active', value: 'active', color: 'green'},
+          {label: 'Pending', value: 'pending', color: 'orange'},
+          {label: 'Inactive', value: 'inactive', color: 'grey'},
+          {label: 'Closed', value: 'closed', color: 'red'}
+        ],
+
+        stateFilters: [
+          {label: 'Active', value: 'active'},
+          {label: 'Pending', value: 'pending'}
+        ],
+
+        paymentsTable: {
+          data: [],
+          columns: [
+            {
+              name: 'pending',
+              label: ''
+            },
+            {
+              name: 'memo',
+              align: 'left',
+              label: this.$t('memo'),
+              field: 'memo'
+            },
+            {
+              name: 'date',
+              align: 'left',
+              label: this.$t('date'),
+              field: 'date',
+              sortable: true
+            },
+            {
+              name: 'sat',
+              align: 'right',
+              label: this.$t('amount') + ' (' + LNBITS_DENOMINATION + ')',
+              field: row => this.formatMsat(row.amount),
+              sortable: true
+            },
+            {
+              name: 'fee',
+              align: 'right',
+              label: this.$t('fee') + ' (m' + LNBITS_DENOMINATION + ')',
+              field: 'fee'
+            },
+            {
+              name: 'destination',
+              align: 'right',
+              label: 'Destination',
+              field: 'destination'
+            }
+          ],
+          pagination: {
+            rowsPerPage: 10,
+            page: 1,
+            rowsNumber: 10
+          },
+          filter: null
+        },
+        invoiceTable: {
+          data: [],
+          columns: [
+            {
+              name: 'pending',
+              label: ''
+            },
+            {
+              name: 'memo',
+              align: 'left',
+              label: this.$t('memo'),
+              field: 'memo'
+            },
+            {
+              name: 'paid_at',
+              field: 'paid_at',
+              align: 'right',
+              label: 'Paid at',
+              sortable: true
+            },
+            {
+              name: 'expiry',
+              label: this.$t('expiry'),
+              field: 'expiry',
+              align: 'right',
+              sortable: true
+            },
+            {
+              name: 'amount',
+              label: this.$t('amount') + ' (' + LNBITS_DENOMINATION + ')',
+              field: row => this.formatMsat(row.amount),
+              sortable: true
+            }
+          ],
+          pagination: {
+            rowsPerPage: 10,
+            page: 1,
+            rowsNumber: 10
+          },
+          filter: null
+        }
+      }
+    },
+    created: function () {
+      this.getInfo()
+      this.get1MLStats()
+    },
+    watch: {
+      tab: function (val) {
+        if (val === 'transactions' && !this.paymentsTable.data.length) {
+          this.getPayments()
+          this.getInvoices()
+        } else if (val === 'channels' && !this.channels.data.length) {
+          this.getChannels()
+          this.getPeers()
+        }
+      }
+    },
+    computed: {
+      checkChanges() {
+        return !_.isEqual(this.settings, this.formData)
+      },
+      filteredChannels: function () {
+        return this.stateFilters
+          ? this.channels.data.filter(channel => {
+              return this.stateFilters.find(({value}) => value == channel.state)
+            })
+          : this.channels.data
+      },
+      totalBalance: function () {
+        return this.filteredChannels.reduce(
+          (balance, channel) => {
+            balance.local_msat += channel.balance.local_msat
+            balance.remote_msat += channel.balance.remote_msat
+            balance.total_msat += channel.balance.total_msat
+            return balance
+          },
+          {local_msat: 0, remote_msat: 0, total_msat: 0}
+        )
+      }
+    },
+    methods: {
+      formatMsat: function (msat) {
+        return LNbits.utils.formatMsat(msat)
+      },
+      api: function (method, url, options) {
+        const params = new URLSearchParams(options?.query)
+        return LNbits.api
+          .request(method, `/node/api/v1${url}?${params}`, {}, options?.data)
+          .catch(error => {
+            LNbits.utils.notifyApiError(error)
+          })
+      },
+      getChannels: function () {
+        return this.api('GET', '/channels').then(response => {
+          this.channels.data = response.data
+        })
+      },
+      getInfo: function () {
+        return this.api('GET', '/info').then(response => {
+          this.info = response.data
+          this.channel_stats = response.data.channel_stats
+        })
+      },
+      get1MLStats: function () {
+        return this.api('GET', '/rank').then(response => {
+          this.ranks = response.data
+        })
+      },
+      getPayments: function (props) {
+        if (props) {
+          this.paymentsTable.pagination = props.pagination
+        }
+        let pagination = this.paymentsTable.pagination
+        const query = {
+          limit: pagination.rowsPerPage,
+          offset: (pagination.page - 1) * pagination.rowsPerPage ?? 0
+        }
+        return this.api('GET', '/payments', {query}).then(response => {
+          this.paymentsTable.data = response.data.data
+          this.paymentsTable.pagination.rowsNumber = response.data.total
+        })
+      },
+      getInvoices: function (props) {
+        if (props) {
+          this.invoiceTable.pagination = props.pagination
+        }
+        let pagination = this.invoiceTable.pagination
+        const query = {
+          limit: pagination.rowsPerPage,
+          offset: (pagination.page - 1) * pagination.rowsPerPage ?? 0
+        }
+        return this.api('GET', '/invoices', {query}).then(response => {
+          this.invoiceTable.data = response.data.data
+          this.invoiceTable.pagination.rowsNumber = response.data.total
+        })
+      },
+      getPeers: function () {
+        return this.api('GET', '/peers').then(response => {
+          this.peers.data = response.data
+          console.log('peers', this.peers)
+        })
+      },
+      connectPeer: function () {
+        console.log('peer', this.connectPeerDialog)
+        this.api('POST', '/peers', {data: this.connectPeerDialog.data}).then(
+          () => {
+            this.connectPeerDialog.show = false
+            this.getPeers()
+          }
+        )
+      },
+      disconnectPeer: function (id) {
+        LNbits.utils
+          .confirmDialog('Do you really wanna disconnect this peer?')
+          .onOk(() => {
+            this.api('DELETE', `/peers/${id}`).then(response => {
+              this.$q.notify({
+                message: 'Disconnected',
+                icon: null
+              })
+              this.needsRestart = true
+              this.getPeers()
+            })
+          })
+      },
+      openChannel: function () {
+        this.api('POST', '/channels', {data: this.openChannelDialog.data})
+          .then(response => {
+            this.openChannelDialog.show = false
+            this.getChannels()
+          })
+          .catch(error => {
+            console.log(error)
+          })
+      },
+      showCloseChannelDialog: function (channel) {
+        this.closeChannelDialog.show = true
+        this.closeChannelDialog.data = {
+          force: false,
+          short_id: channel.short_id,
+          ...channel.point
+        }
+      },
+      closeChannel: function () {
+        this.api('DELETE', '/channels', {
+          query: this.closeChannelDialog.data
+        }).then(response => {
+          this.closeChannelDialog.show = false
+          this.getChannels()
+        })
+      },
+      showOpenChannelDialog: function (peer_id) {
+        this.openChannelDialog.show = true
+        this.openChannelDialog.data = {peer_id, funding_amount: 0}
+      },
+      showNodeInfoDialog: function (node) {
+        this.nodeInfoDialog.show = true
+        this.nodeInfoDialog.data = node
+      },
+      showTransactionDetailsDialog: function (details) {
+        this.transactionDetailsDialog.show = true
+        this.transactionDetailsDialog.data = details
+        console.log('details', details)
+      },
+      exportCSV: function () {},
+      shortenNodeId
+    }
+  })
+</script>
+
+{% endblock %}
@@ -0,0 +1,136 @@
+{% extends "public.html" %} {% from "macros.jinja" import window_vars with
+context %} {% block page %}
+
+<div class="q-ma-lg-xl q-mx-auto q-ma-xl" style="max-width: 1048px">
+  <lnbits-node-info :info="this.info"></lnbits-node-info>
+
+  <div class="row q-col-gutter-lg q-mt-sm">
+    <div class="col-12 col-md-8 q-gutter-y-md">
+      <div class="row q-col-gutter-md q-pb-lg">
+        <div class="col-12 col-md-6 q-gutter-y-md">
+          <lnbits-stat
+            :title="$t('total_capacity')"
+            :msat="this.channel_stats.total_capacity"
+          />
+        </div>
+
+        <div class="col-12 col-md-6 q-gutter-y-md">
+          <lnbits-stat title="Peers" :amount="this.info.num_peers" />
+        </div>
+        <div class="col-12 col-md-6 q-gutter-y-md">
+          <lnbits-stat
+            :title="$t('avg_channel_size')"
+            :msat="this.channel_stats.avg_size"
+          />
+        </div>
+        <div class="col-12 col-md-6 q-gutter-y-md">
+          <lnbits-stat
+            :title="$t('biggest_channel_size')"
+            :msat="this.channel_stats.biggest_size"
+          />
+        </div>
+        <div class="col-12 col-md-6 q-gutter-y-md">
+          <lnbits-stat
+            :title="$t('smallest_channel_size')"
+            :msat="this.channel_stats.smallest_size"
+          />
+        </div>
+        <div class="col-12 col-md-6 q-gutter-y-md">
+          <lnbits-stat
+            :title="$t('smallest_channel_size')"
+            :msat="this.channel_stats.smallest_size"
+          />
+        </div>
+      </div>
+    </div>
+    <div class="column col-12 col-md-4 q-gutter-y-md">
+      <lnbits-node-ranks :ranks="this.ranks"></lnbits-node-ranks>
+      <lnbits-channel-stats :stats="this.channel_stats"></lnbits-channel-stats>
+    </div>
+  </div>
+</div>
+
+{% endblock %} {% block scripts %} {{ window_vars(user) }}
+<script src="{{ static_url_for('static', 'js/node.js') }}"></script>
+<script>
+  Vue.component(VueQrcode.name, VueQrcode)
+  Vue.use(VueQrcodeReader)
+
+  new Vue({
+    el: '#vue',
+    config: {
+      globalProperties: {
+        LNbits,
+        msg: 'hello'
+      }
+    },
+    mixins: [windowMixin],
+    data: function () {
+      return {
+        isSuperUser: false,
+        wallet: {},
+        tab: 'dashboard',
+        payments: 1000,
+        info: {},
+        channel_stats: {},
+        channels: [],
+        activeBalance: {},
+        ranks: {},
+
+        peers: [],
+
+        connectPeerDialog: {
+          show: false,
+          data: {}
+        },
+
+        openChannelDialog: {
+          show: false,
+          data: {}
+        },
+
+        closeChannelDialog: {
+          show: false,
+          data: {}
+        },
+
+        nodeInfoDialog: {
+          show: false,
+          data: {}
+        },
+
+        states: [
+          {label: 'Active', value: 'active', color: 'green'},
+          {label: 'Pending', value: 'pending', color: 'orange'},
+          {label: 'Inactive', value: 'inactive', color: 'grey'},
+          {label: 'Closed', value: 'closed', color: 'red'}
+        ]
+      }
+    },
+    created: function () {
+      this.getInfo()
+      this.get1MLStats()
+    },
+    methods: {
+      formatMsat: function (msat) {
+        return LNbits.utils.formatMsat(msat)
+      },
+      api: function (method, url, data) {
+        return LNbits.api.request(method, '/node/public/api/v1' + url, {}, data)
+      },
+      getInfo: function () {
+        this.api('GET', '/info', {}).then(response => {
+          this.info = response.data
+          this.channel_stats = response.data.channel_stats
+        })
+      },
+      get1MLStats: function () {
+        this.api('GET', '/rank', {}).then(response => {
+          this.ranks = response.data
+        })
+      }
+    }
+  })
+</script>
+
+{% endblock %}
@@ -1,7 +1,6 @@
 // update cache version every time there is a new deployment
 // so the service worker reinitializes the cache
-const CACHE_VERSION = 53
-const CURRENT_CACHE = `lnbits-${CACHE_VERSION}-`
+const CURRENT_CACHE = 'lnbits-{{ cache_version }}-'

 const getApiKey = request => {
  let api_key = request.headers.get('X-Api-Key')
@@ -17,8 +16,7 @@ self.addEventListener('activate', evt =>
    caches.keys().then(cacheNames => {
      return Promise.all(
        cacheNames.map(cacheName => {
-          const currentCacheVersion = cacheName.split('-').slice(-2, 2)
-          if (currentCacheVersion !== CACHE_VERSION) {
+          if (!cacheName.startsWith(CURRENT_CACHE)) {
            return caches.delete(cacheName)
          }
        })
@@ -56,3 +54,32 @@ self.addEventListener('fetch', event => {
    )
  }
 })
+
+// Handle and show incoming push notifications
+self.addEventListener('push', function (event) {
+  if (!(self.Notification && self.Notification.permission === 'granted')) {
+    return
+  }
+
+  let data = event.data.json()
+  const title = data.title
+  const body = data.body
+  const url = data.url
+
+  event.waitUntil(
+    self.registration.showNotification(title, {
+      body: body,
+      icon: '/favicon.ico',
+      data: {
+        url: url
+      }
+    })
+  )
+})
+
+// User can click on the notification message to open wallet
+// Installed app will open when `url_handlers` in web app manifest is supported
+self.addEventListener('notificationclick', function (event) {
+  event.notification.close()
+  event.waitUntil(clients.openWindow(event.notification.data.url))
+})
@@ -0,0 +1,23 @@
+<q-dialog v-model="createUserDialog.show">
+  <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
+    <p>Create User</p>
+    <div class="row">
+      <div class="col-12">
+        <q-form @submit="createUser">
+          <lnbits-dynamic-fields
+            :options="createUserDialog.fields"
+            v-model="createUserDialog.data"
+          ></lnbits-dynamic-fields>
+          <div class="row q-mt-lg">
+            <q-btn v-close-popup unelevated color="primary" type="submit"
+              >Create</q-btn
+            >
+            <q-btn v-close-popup flat color="grey" class="q-ml-auto"
+              >Cancel</q-btn
+            >
+          </div>
+        </q-form>
+      </div>
+    </div>
+  </q-card>
+</q-dialog>
@@ -0,0 +1,23 @@
+<q-dialog v-model="createWalletDialog.show">
+  <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
+    <p>Create Wallet</p>
+    <div class="row">
+      <div class="col-12">
+        <q-form @submit="createWallet">
+          <lnbits-dynamic-fields
+            :options="createWalletDialog.fields"
+            v-model="createUserDialog.data"
+          ></lnbits-dynamic-fields>
+          <div class="row q-mt-lg">
+            <q-btn v-close-popup unelevated color="primary" type="submit"
+              >Create</q-btn
+            >
+            <q-btn v-close-popup flat color="grey" class="q-ml-auto"
+              >Cancel</q-btn
+            >
+          </div>
+        </q-form>
+      </div>
+    </div>
+  </q-card>
+</q-dialog>
@@ -0,0 +1,49 @@
+<q-dialog v-model="topupDialog.show" position="top">
+  <q-card class="q-pa-lg q-pt-xl lnbits__dialog-card">
+    <q-form class="q-gutter-md">
+      <p v-text="$t('topup_wallet')"></p>
+
+      <div class="row">
+        <div class="col-12">
+          <q-input
+            dense
+            type="text"
+            filled
+            v-model="wallet.id"
+            label="Wallet ID"
+            :hint="$t('topup_hint')"
+          ></q-input>
+
+          <br />
+        </div>
+
+        <div class="col-12">
+          <q-input
+            dense
+            type="number"
+            filled
+            v-model="wallet.amount"
+            :label="$t('amount')"
+          ></q-input>
+        </div>
+      </div>
+
+      <div class="row q-mt-lg">
+        <q-btn
+          :label="$t('topup')"
+          color="primary"
+          @click="topupWallet"
+          v-close-popup
+        ></q-btn>
+
+        <q-btn
+          v-close-popup
+          flat
+          color="grey"
+          class="q-ml-auto"
+          :label="$t('cancel')"
+        ></q-btn>
+      </div>
+    </q-form>
+  </q-card>
+</q-dialog>
@@ -0,0 +1,106 @@
+<q-dialog v-model="walletDialog.show">
+  <q-card class="q-pa-lg" style="width: 700px; max-width: 80vw">
+    <h2 class="text-h6 q-mb-md">Wallets</h2>
+    <q-dialog v-model="paymentDialog.show">
+      <q-card class="q-pa-lg" style="width: 700px; max-width: 80vw">
+        <payment-list :wallet="activeWallet" />
+      </q-card>
+    </q-dialog>
+    <q-table :data="wallets" :columns="walletTable.columns">
+      <template v-slot:header="props">
+        <q-tr :props="props">
+          <q-th auto-width></q-th>
+          <q-th
+            auto-width
+            v-for="col in props.cols"
+            v-text="col.label"
+            :key="col.name"
+            :props="props"
+          ></q-th>
+        </q-tr>
+      </template>
+      <template v-slot:body="props">
+        <q-tr :props="props">
+          <q-td auto-width>
+            <q-btn
+              round
+              icon="menu"
+              size="sm"
+              color="secondary"
+              @click="showPayments(props.row.id)"
+            >
+              <q-tooltip>Show Payments</q-tooltip>
+            </q-btn>
+            <q-btn
+              v-if="!props.row.deleted"
+              round
+              icon="content_copy"
+              size="sm"
+              color="primary"
+              @click="copyText(props.row.id)"
+            >
+              <q-tooltip>Copy Wallet ID</q-tooltip>
+            </q-btn>
+            <lnbits-update-balance
+              v-if="!props.row.deleted"
+              :wallet_id="props.row.id"
+              :callback="topupCallback"
+            ></lnbits-update-balance>
+            <q-btn
+              round
+              v-if="!props.row.deleted"
+              icon="vpn_key"
+              size="sm"
+              color="primary"
+              @click="copyText(props.row.adminkey)"
+            >
+              <q-tooltip>Copy Admin Key</q-tooltip>
+            </q-btn>
+            <q-btn
+              round
+              v-if="!props.row.deleted"
+              icon="vpn_key"
+              size="sm"
+              color="secondary"
+              @click="copyText(props.row.inkey)"
+            >
+              <q-tooltip>Copy Invoice Key</q-tooltip>
+            </q-btn>
+            <q-btn
+              round
+              v-if="props.row.deleted"
+              icon="toggle_off"
+              size="sm"
+              color="secondary"
+              @click="undeleteUserWallet(props.row.user, props.row.id)"
+            >
+              <q-tooltip>Undelete Wallet</q-tooltip>
+            </q-btn>
+            <q-btn
+              round
+              icon="delete"
+              size="sm"
+              color="negative"
+              @click="deleteUserWallet(props.row.user, props.row.id, props.row.deleted)"
+            >
+              <q-tooltip>Delete Wallet</q-tooltip>
+            </q-btn>
+          </q-td>
+          <q-td auto-width v-text="props.row.name"></q-td>
+          <q-td auto-width v-text="props.row.currency"></q-td>
+          <q-td auto-width v-text="formatSat(props.row.balance_msat)"></q-td>
+          <q-td auto-width v-text="props.row.deleted"></q-td>
+        </q-tr>
+      </template>
+    </q-table>
+    <div class="row q-mt-lg">
+      <q-btn
+        v-close-popup
+        flat
+        color="grey"
+        class="q-ml-auto"
+        :label="$t('close')"
+      ></q-btn>
+    </div>
+  </q-card>
+</q-dialog>
@@ -0,0 +1,116 @@
+{% extends "base.html" %} {% from "macros.jinja" import window_vars with context
+%} {% block page %} {% include "users/_walletDialog.html" %} {% include
+"users/_topupDialog.html" %} {% include "users/_createUserDialog.html" %} {%
+include "users/_createWalletDialog.html" %}
+
+<h3 class="text-subtitle q-my-none" v-text="$t('users')"></h3>
+
+<div class="row q-col-gutter-md justify-center">
+  <div class="col q-gutter-y-md" style="width: 300px">
+    <div style="width: 600px">
+      <canvas ref="chart1"></canvas>
+    </div>
+  </div>
+</div>
+<div class="row q-col-gutter-md justify-center">
+  <div class="col q-gutter-y-md">
+    <q-card>
+      <q-card-section>
+        <div class="row items-center no-wrap q-mb-sm">
+          <q-btn :label="$t('topup')" @click="topupDialog.show = true">
+            <q-tooltip
+              >{%raw%}{{ $t('add_funds_tooltip') }}{%endraw%}</q-tooltip
+            >
+          </q-btn>
+        </div>
+        <q-table
+          :data="users"
+          :row-key="usersTableRowKey"
+          :columns="usersTable.columns"
+          :pagination.sync="usersTable.pagination"
+          :no-data-label="$t('no_users')"
+          :filter="usersTable.search"
+          :loading="usersTable.loading"
+          @request="fetchUsers"
+        >
+          <template v-slot:header="props">
+            <q-tr :props="props">
+              <q-th auto-width></q-th>
+              <q-th
+                v-for="col in props.cols"
+                v-text="col.label"
+                :key="col.name"
+                :props="props"
+              ></q-th>
+            </q-tr>
+          </template>
+          <template v-slot:body="props">
+            <q-tr auto-width :props="props">
+              <q-td>
+                <q-btn
+                  round
+                  icon="list"
+                  size="sm"
+                  color="secondary"
+                  @click="fetchWallets(props.row.id)"
+                >
+                  <q-tooltip>Show Wallets</q-tooltip>
+                </q-btn>
+                <q-btn
+                  round
+                  icon="content_copy"
+                  size="sm"
+                  color="primary"
+                  @click="copyText(props.row.id)"
+                >
+                  <q-tooltip>Copy User ID</q-tooltip>
+                </q-btn>
+                <q-btn
+                  round
+                  v-if="!props.row.is_super_user"
+                  icon="build"
+                  size="sm"
+                  :color="props.row.is_admin ? 'primary' : ''"
+                  @click="toggleAdmin(props.row.id)"
+                >
+                  <q-tooltip>Toggle Admin</q-tooltip>
+                </q-btn>
+                <q-btn
+                  round
+                  v-if="props.row.is_super_user"
+                  icon="build"
+                  size="sm"
+                  color="positive"
+                >
+                  <q-tooltip>Super User</q-tooltip>
+                </q-btn>
+                <q-btn
+                  round
+                  icon="delete"
+                  size="sm"
+                  color="negative"
+                  @click="deleteUser(props.row.id, props)"
+                >
+                  <q-tooltip>Delete User</q-tooltip>
+                </q-btn>
+              </q-td>
+              <q-td
+                auto-width
+                v-text="formatSat(props.row.balance_msat)"
+              ></q-td>
+              <q-td auto-width v-text="props.row.wallet_count"></q-td>
+              <q-td auto-width v-text="props.row.transaction_count"></q-td>
+              <q-td auto-width v-text="props.row.username"></q-td>
+              <q-td auto-width v-text="props.row.email"></q-td>
+              <q-td auto-width v-text="props.row.last_payment"></q-td>
+            </q-tr>
+          </template>
+        </q-table>
+      </q-card-section>
+    </q-card>
+  </div>
+</div>
+
+{% endblock %} {% block scripts %} {{ window_vars(user) }}
+<script src="{{ static_url_for('static', 'js/users.js') }}"></script>
+{% endblock %}
@@ -6,47 +6,50 @@ from subprocess import Popen
 from typing import Optional
 from urllib.parse import urlparse

-from fastapi import Depends
+from fastapi import APIRouter, Depends
 from fastapi.responses import FileResponse
-from starlette.exceptions import HTTPException

-from lnbits.core.crud import get_wallet
-from lnbits.core.models import CreateTopup, User
+from lnbits.core.models import User
 from lnbits.core.services import (
    get_balance_delta,
    update_cached_settings,
-    update_wallet_balance,
 )
+from lnbits.core.tasks import api_invoice_listeners
 from lnbits.decorators import check_admin, check_super_user
 from lnbits.server import server_restart
-from lnbits.settings import AdminSettings, EditableSettings, settings
+from lnbits.settings import AdminSettings, UpdateSettings, settings
+from lnbits.tasks import invoice_listeners

-from .. import core_app, core_app_extra
+from .. import core_app_extra
 from ..crud import delete_admin_settings, get_admin_settings, update_admin_settings

+admin_router = APIRouter(tags=["Admin UI"], prefix="/admin")

-@core_app.get(
-    "/admin/api/v1/audit",
+
+@admin_router.get(
+    "/api/v1/audit",
    name="Audit",
    description="show the current balance of the node and the LNbits database",
    dependencies=[Depends(check_admin)],
 )
 async def api_auditor():
-    try:
-        delta, node_balance, total_balance = await get_balance_delta()
-        return {
-            "delta_msats": int(delta),
-            "node_balance_msats": int(node_balance),
-            "lnbits_balance_msats": int(total_balance),
-        }
-    except Exception:
-        raise HTTPException(
-            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
-            detail="Could not audit balance.",
-        )
+    return await get_balance_delta()


-@core_app.get("/admin/api/v1/settings/")
+@admin_router.get(
+    "/api/v1/monitor",
+    name="Monitor",
+    description="show the current listeners and other monitoring data",
+    dependencies=[Depends(check_admin)],
+)
+async def api_monitor():
+    return {
+        "invoice_listeners": list(invoice_listeners.keys()),
+        "api_invoice_listeners": list(api_invoice_listeners.keys()),
+    }
+
+
+@admin_router.get("/api/v1/settings", response_model=Optional[AdminSettings])
 async def api_get_settings(
    user: User = Depends(check_admin),
 ) -> Optional[AdminSettings]:
@@ -54,13 +57,11 @@ async def api_get_settings(
    return admin_settings


-@core_app.put(
-    "/admin/api/v1/settings/",
+@admin_router.put(
+    "/api/v1/settings",
    status_code=HTTPStatus.OK,
 )
-async def api_update_settings(
-    data: EditableSettings, user: User = Depends(check_admin)
-):
+async def api_update_settings(data: UpdateSettings, user: User = Depends(check_admin)):
    await update_admin_settings(data)
    admin_settings = await get_admin_settings(user.super_user)
    assert admin_settings, "Updated admin settings not found."
@@ -69,8 +70,8 @@ async def api_update_settings(
    return {"status": "Success"}


-@core_app.delete(
-    "/admin/api/v1/settings/",
+@admin_router.delete(
+    "/api/v1/settings",
    status_code=HTTPStatus.OK,
    dependencies=[Depends(check_super_user)],
 )
@@ -79,8 +80,8 @@ async def api_delete_settings() -> None:
    server_restart.set()


-@core_app.get(
-    "/admin/api/v1/restart/",
+@admin_router.get(
+    "/api/v1/restart",
    status_code=HTTPStatus.OK,
    dependencies=[Depends(check_super_user)],
 )
@@ -89,32 +90,8 @@ async def api_restart_server() -> dict[str, str]:
    return {"status": "Success"}


-@core_app.put(
-    "/admin/api/v1/topup/",
-    name="Topup",
-    status_code=HTTPStatus.OK,
-    dependencies=[Depends(check_super_user)],
-)
-async def api_topup_balance(data: CreateTopup) -> dict[str, str]:
-    try:
-        await get_wallet(data.id)
-    except Exception:
-        raise HTTPException(
-            status_code=HTTPStatus.FORBIDDEN, detail="wallet does not exist."
-        )
-
-    if settings.lnbits_backend_wallet_class == "VoidWallet":
-        raise HTTPException(
-            status_code=HTTPStatus.FORBIDDEN, detail="VoidWallet active"
-        )
-
-    await update_wallet_balance(wallet_id=data.id, amount=int(data.amount))
-
-    return {"status": "Success"}
-
-
-@core_app.get(
-    "/admin/api/v1/backup/",
+@admin_router.get(
+    "/api/v1/backup",
    status_code=HTTPStatus.OK,
    dependencies=[Depends(check_super_user)],
    response_class=FileResponse,
@@ -1,517 +1,87 @@
-import asyncio
 import hashlib
 import json
-import uuid
 from http import HTTPStatus
 from io import BytesIO
-from typing import Dict, List, Optional, Union
+from typing import Dict, List
 from urllib.parse import ParseResult, parse_qs, urlencode, urlparse, urlunparse

 import httpx
 import pyqrcode
 from fastapi import (
-    Body,
+    APIRouter,
    Depends,
-    Header,
-    Request,
-    Response,
-    WebSocket,
-    WebSocketDisconnect,
 )
 from fastapi.exceptions import HTTPException
-from loguru import logger
-from sse_starlette.sse import EventSourceResponse
-from starlette.responses import RedirectResponse, StreamingResponse
+from starlette.responses import StreamingResponse

-from lnbits import bolt11, lnurl
-from lnbits.core.helpers import (
-    migrate_extension_database,
-    stop_extension_background_work,
-)
 from lnbits.core.models import (
+    BaseWallet,
    ConversionData,
-    CreateInvoice,
-    CreateLnurl,
    CreateLnurlAuth,
-    DecodePayment,
-    Payment,
-    PaymentFilters,
+    CreateWallet,
    User,
    Wallet,
-    WalletType,
 )
-from lnbits.db import Filters, Page
 from lnbits.decorators import (
    WalletTypeInfo,
-    check_admin,
-    get_key_type,
-    parse_filters,
+    check_user_exists,
    require_admin_key,
    require_invoice_key,
 )
-from lnbits.extension_manager import (
-    CreateExtension,
-    Extension,
-    ExtensionRelease,
-    InstallableExtension,
-    fetch_github_release_config,
-    get_valid_extensions,
-)
-from lnbits.helpers import generate_filter_params_openapi, url_for
+from lnbits.lnurl import decode as lnurl_decode
 from lnbits.settings import settings
 from lnbits.utils.exchange_rates import (
-    currencies,
+    allowed_currencies,
    fiat_amount_as_satoshis,
    satoshis_amount_as_fiat,
 )

-from .. import core_app, core_app_extra, db
 from ..crud import (
-    add_installed_extension,
-    create_tinyurl,
-    delete_dbversion,
-    delete_installed_extension,
-    delete_tinyurl,
-    drop_extension_db,
-    get_dbversions,
-    get_payments,
-    get_payments_paginated,
-    get_standalone_payment,
-    get_tinyurl,
-    get_tinyurl_by_url,
-    get_wallet_for_key,
-    save_balance_check,
-    update_wallet,
+    create_account,
+    create_wallet,
 )
-from ..services import (
-    InvoiceFailure,
-    PaymentFailure,
-    check_transaction_status,
-    create_invoice,
-    pay_invoice,
-    perform_lnurlauth,
-    websocketManager,
-    websocketUpdater,
-)
-from ..tasks import api_invoice_listeners
+from ..services import perform_lnurlauth
+
+# backwards compatibility for extension
+# TODO: remove api_payment and pay_invoice imports from extensions
+from .payment_api import api_payment, pay_invoice  # noqa: F401
+
+api_router = APIRouter(tags=["Core"])


-@core_app.get("/api/v1/health", status_code=HTTPStatus.OK)
+@api_router.get("/api/v1/health", status_code=HTTPStatus.OK)
 async def health():
    return


-@core_app.get("/api/v1/wallet")
-async def api_wallet(wallet: WalletTypeInfo = Depends(get_key_type)):
-    if wallet.wallet_type == WalletType.admin:
-        return {
-            "id": wallet.wallet.id,
-            "name": wallet.wallet.name,
-            "balance": wallet.wallet.balance_msat,
-        }
-    else:
-        return {"name": wallet.wallet.name, "balance": wallet.wallet.balance_msat}
-
-
-@core_app.put("/api/v1/wallet/{new_name}")
-async def api_update_wallet_name(
-    new_name: str, wallet: WalletTypeInfo = Depends(require_admin_key)
-):
-    await update_wallet(wallet.wallet.id, new_name)
-    return {
-        "id": wallet.wallet.id,
-        "name": wallet.wallet.name,
-        "balance": wallet.wallet.balance_msat,
-    }
-
-
-@core_app.patch("/api/v1/wallet", response_model=Wallet)
-async def api_update_wallet(
-    name: Optional[str] = Body(None),
-    currency: Optional[str] = Body(None),
-    wallet: WalletTypeInfo = Depends(require_admin_key),
-):
-    return await update_wallet(wallet.wallet.id, name, currency)
-
-
-@core_app.get(
-    "/api/v1/payments",
-    name="Payment List",
-    summary="get list of payments",
-    response_description="list of payments",
-    response_model=List[Payment],
-    openapi_extra=generate_filter_params_openapi(PaymentFilters),
+@api_router.get(
+    "/api/v1/wallets",
+    name="Wallets",
+    description="Get basic info for all of user's wallets.",
 )
-async def api_payments(
-    wallet: WalletTypeInfo = Depends(get_key_type),
-    filters: Filters = Depends(parse_filters(PaymentFilters)),
-):
-    pending_payments = await get_payments(
-        wallet_id=wallet.wallet.id,
-        pending=True,
-        exclude_uncheckable=True,
-        filters=filters,
-    )
-    for payment in pending_payments:
-        await check_transaction_status(
-            wallet_id=payment.wallet_id, payment_hash=payment.payment_hash
+async def api_wallets(user: User = Depends(check_user_exists)) -> List[BaseWallet]:
+    return [BaseWallet(**w.dict()) for w in user.wallets]
+
+
+@api_router.post("/api/v1/account", response_model=Wallet)
+async def api_create_account(data: CreateWallet) -> Wallet:
+    if not settings.new_accounts_allowed:
+        raise HTTPException(
+            status_code=HTTPStatus.FORBIDDEN,
+            detail="Account creation is disabled.",
        )
-    return await get_payments(
-        wallet_id=wallet.wallet.id,
-        pending=True,
-        complete=True,
-        filters=filters,
-    )
+    account = await create_account()
+    return await create_wallet(user_id=account.id, wallet_name=data.name)


-@core_app.get(
-    "/api/v1/payments/paginated",
-    name="Payment List",
-    summary="get paginated list of payments",
-    response_description="list of payments",
-    response_model=Page[Payment],
-    openapi_extra=generate_filter_params_openapi(PaymentFilters),
-)
-async def api_payments_paginated(
-    wallet: WalletTypeInfo = Depends(get_key_type),
-    filters: Filters = Depends(parse_filters(PaymentFilters)),
+@api_router.get("/api/v1/lnurlscan/{code}")
+async def api_lnurlscan(
+    code: str, wallet: WalletTypeInfo = Depends(require_invoice_key)
 ):
-    pending = await get_payments_paginated(
-        wallet_id=wallet.wallet.id,
-        pending=True,
-        exclude_uncheckable=True,
-        filters=filters,
-    )
-    for payment in pending.data:
-        await check_transaction_status(
-            wallet_id=payment.wallet_id, payment_hash=payment.payment_hash
-        )
-    page = await get_payments_paginated(
-        wallet_id=wallet.wallet.id,
-        pending=True,
-        complete=True,
-        filters=filters,
-    )
-    return page
-
-
-async def api_payments_create_invoice(data: CreateInvoice, wallet: Wallet):
-    description_hash = b""
-    unhashed_description = b""
-    memo = data.memo or settings.lnbits_site_title
-    if data.description_hash or data.unhashed_description:
-        if data.description_hash:
-            try:
-                description_hash = bytes.fromhex(data.description_hash)
-            except ValueError:
-                raise HTTPException(
-                    status_code=HTTPStatus.BAD_REQUEST,
-                    detail="'description_hash' must be a valid hex string",
-                )
-        if data.unhashed_description:
-            try:
-                unhashed_description = bytes.fromhex(data.unhashed_description)
-            except ValueError:
-                raise HTTPException(
-                    status_code=HTTPStatus.BAD_REQUEST,
-                    detail="'unhashed_description' must be a valid hex string",
-                )
-        # do not save memo if description_hash or unhashed_description is set
-        memo = ""
-
-    async with db.connect() as conn:
-        try:
-            payment_hash, payment_request = await create_invoice(
-                wallet_id=wallet.id,
-                amount=data.amount,
-                memo=memo,
-                currency=data.unit,
-                description_hash=description_hash,
-                unhashed_description=unhashed_description,
-                expiry=data.expiry,
-                extra=data.extra,
-                webhook=data.webhook,
-                internal=data.internal,
-                conn=conn,
-            )
-            # NOTE: we get the checking_id with a seperate query because create_invoice
-            # does not return it and it would be a big hustle to change its return type
-            # (used across extensions)
-            payment_db = await get_standalone_payment(payment_hash, conn=conn)
-            assert payment_db is not None, "payment not found"
-            checking_id = payment_db.checking_id
-        except InvoiceFailure as e:
-            raise HTTPException(status_code=520, detail=str(e))
-        except Exception as exc:
-            raise exc
-
-    invoice = bolt11.decode(payment_request)
-
-    lnurl_response: Union[None, bool, str] = None
-    if data.lnurl_callback:
-        if data.lnurl_balance_check is not None:
-            await save_balance_check(wallet.id, data.lnurl_balance_check)
-
-        async with httpx.AsyncClient() as client:
-            try:
-                r = await client.get(
-                    data.lnurl_callback,
-                    params={
-                        "pr": payment_request,
-                        "balanceNotify": url_for(
-                            f"/withdraw/notify/{urlparse(data.lnurl_callback).netloc}",
-                            external=True,
-                            wal=wallet.id,
-                        ),
-                    },
-                    timeout=10,
-                )
-                if r.is_error:
-                    lnurl_response = r.text
-                else:
-                    resp = json.loads(r.text)
-                    if resp["status"] != "OK":
-                        lnurl_response = resp["reason"]
-                    else:
-                        lnurl_response = True
-            except (httpx.ConnectError, httpx.RequestError) as ex:
-                logger.error(ex)
-                lnurl_response = False
-
-    return {
-        "payment_hash": invoice.payment_hash,
-        "payment_request": payment_request,
-        # maintain backwards compatibility with API clients:
-        "checking_id": checking_id,
-        "lnurl_response": lnurl_response,
-    }
-
-
-async def api_payments_pay_invoice(bolt11: str, wallet: Wallet):
    try:
-        payment_hash = await pay_invoice(wallet_id=wallet.id, payment_request=bolt11)
-    except ValueError as e:
-        raise HTTPException(status_code=HTTPStatus.BAD_REQUEST, detail=str(e))
-    except PermissionError as e:
-        raise HTTPException(status_code=HTTPStatus.FORBIDDEN, detail=str(e))
-    except PaymentFailure as e:
-        raise HTTPException(status_code=520, detail=str(e))
-    except Exception as exc:
-        raise exc
-
-    return {
-        "payment_hash": payment_hash,
-        # maintain backwards compatibility with API clients:
-        "checking_id": payment_hash,
-    }
-
-
-@core_app.post(
-    "/api/v1/payments",
-    summary="Create or pay an invoice",
-    description="""
-        This endpoint can be used both to generate and pay a BOLT11 invoice.
-        To generate a new invoice for receiving funds into the authorized account,
-        specify at least the first four fields in the POST body: `out: false`,
-        `amount`, `unit`, and `memo`. To pay an arbitrary invoice from the funds
-        already in the authorized account, specify `out: true` and use the `bolt11`
-        field to supply the BOLT11 invoice to be paid.
-    """,
-    status_code=HTTPStatus.CREATED,
-)
-async def api_payments_create(
-    wallet: WalletTypeInfo = Depends(require_invoice_key),
-    invoiceData: CreateInvoice = Body(...),
-):
-    if invoiceData.out is True and wallet.wallet_type == WalletType.admin:
-        if not invoiceData.bolt11:
-            raise HTTPException(
-                status_code=HTTPStatus.BAD_REQUEST,
-                detail="BOLT11 string is invalid or not given",
-            )
-        return await api_payments_pay_invoice(
-            invoiceData.bolt11, wallet.wallet
-        )  # admin key
-    elif not invoiceData.out:
-        # invoice key
-        return await api_payments_create_invoice(invoiceData, wallet.wallet)
-    else:
-        raise HTTPException(
-            status_code=HTTPStatus.UNAUTHORIZED,
-            detail="Invoice (or Admin) key required.",
-        )
-
-
-@core_app.post("/api/v1/payments/lnurl")
-async def api_payments_pay_lnurl(
-    data: CreateLnurl, wallet: WalletTypeInfo = Depends(require_admin_key)
-):
-    domain = urlparse(data.callback).netloc
-
-    async with httpx.AsyncClient() as client:
-        try:
-            r = await client.get(
-                data.callback,
-                params={"amount": data.amount, "comment": data.comment},
-                timeout=40,
-            )
-            if r.is_error:
-                raise httpx.ConnectError("LNURL callback connection error")
-        except (httpx.ConnectError, httpx.RequestError):
-            raise HTTPException(
-                status_code=HTTPStatus.BAD_REQUEST,
-                detail=f"Failed to connect to {domain}.",
-            )
-
-    params = json.loads(r.text)
-    if params.get("status") == "ERROR":
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail=f"{domain} said: '{params.get('reason', '')}'",
-        )
-
-    if not params.get("pr"):
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail=f"{domain} did not return a payment request.",
-        )
-
-    invoice = bolt11.decode(params["pr"])
-    if invoice.amount_msat != data.amount:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail=(
-                (
-                    f"{domain} returned an invalid invoice. Expected"
-                    f" {data.amount} msat, got {invoice.amount_msat}."
-                ),
-            ),
-        )
-
-    if invoice.description_hash != data.description_hash:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail=(
-                (
-                    f"{domain} returned an invalid invoice. Expected description_hash"
-                    f" == {data.description_hash}, got {invoice.description_hash}."
-                ),
-            ),
-        )
-
-    extra = {}
-
-    if params.get("successAction"):
-        extra["success_action"] = params["successAction"]
-    if data.comment:
-        extra["comment"] = data.comment
-    assert data.description is not None, "description is required"
-    payment_hash = await pay_invoice(
-        wallet_id=wallet.wallet.id,
-        payment_request=params["pr"],
-        description=data.description,
-        extra=extra,
-    )
-
-    return {
-        "success_action": params.get("successAction"),
-        "payment_hash": payment_hash,
-        # maintain backwards compatibility with API clients:
-        "checking_id": payment_hash,
-    }
-
-
-async def subscribe_wallet_invoices(request: Request, wallet: Wallet):
-    """
-    Subscribe to new invoices for a wallet. Can be wrapped in EventSourceResponse.
-    Listenes invoming payments for a wallet and yields jsons with payment details.
-    """
-    this_wallet_id = wallet.id
-
-    payment_queue: asyncio.Queue[Payment] = asyncio.Queue(0)
-
-    uid = f"{this_wallet_id}_{str(uuid.uuid4())[:8]}"
-    logger.debug(f"adding sse listener for wallet: {uid}")
-    api_invoice_listeners[uid] = payment_queue
-
-    try:
-        while True:
-            if await request.is_disconnected():
-                await request.close()
-                break
-            payment: Payment = await payment_queue.get()
-            if payment.wallet_id == this_wallet_id:
-                logger.debug("sse listener: payment received", payment)
-                yield dict(data=payment.json(), event="payment-received")
-    except asyncio.CancelledError:
-        logger.debug(f"removing listener for wallet {uid}")
-        api_invoice_listeners.pop(uid)
-        return
-
-
-@core_app.get("/api/v1/payments/sse")
-async def api_payments_sse(
-    request: Request, wallet: WalletTypeInfo = Depends(get_key_type)
-):
-    return EventSourceResponse(
-        subscribe_wallet_invoices(request, wallet.wallet),
-        ping=20,
-        media_type="text/event-stream",
-    )
-
-
-# TODO: refactor this route into a public and admin one
-@core_app.get("/api/v1/payments/{payment_hash}")
-async def api_payment(payment_hash, X_Api_Key: Optional[str] = Header(None)):
-    # We use X_Api_Key here because we want this call to work with and without keys
-    # If a valid key is given, we also return the field "details", otherwise not
-    wallet = await get_wallet_for_key(X_Api_Key) if isinstance(X_Api_Key, str) else None
-
-    # we have to specify the wallet id here, because postgres and sqlite return
-    # internal payments in different order and get_standalone_payment otherwise
-    # just fetches the first one, causing unpredictable results
-    payment = await get_standalone_payment(
-        payment_hash, wallet_id=wallet.id if wallet else None
-    )
-    if payment is None:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="Payment does not exist."
-        )
-    await check_transaction_status(payment.wallet_id, payment_hash)
-    payment = await get_standalone_payment(
-        payment_hash, wallet_id=wallet.id if wallet else None
-    )
-    if not payment:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="Payment does not exist."
-        )
-    elif not payment.pending:
-        if wallet and wallet.id == payment.wallet_id:
-            return {"paid": True, "preimage": payment.preimage, "details": payment}
-        return {"paid": True, "preimage": payment.preimage}
-
-    try:
-        await payment.check_status()
-    except Exception:
-        if wallet and wallet.id == payment.wallet_id:
-            return {"paid": False, "details": payment}
-        return {"paid": False}
-
-    if wallet and wallet.id == payment.wallet_id:
-        return {
-            "paid": not payment.pending,
-            "preimage": payment.preimage,
-            "details": payment,
-        }
-    return {"paid": not payment.pending, "preimage": payment.preimage}
-
-
-@core_app.get("/api/v1/lnurlscan/{code}")
-async def api_lnurlscan(code: str, wallet: WalletTypeInfo = Depends(get_key_type)):
-    try:
-        url = lnurl.decode(code)
+        url = str(lnurl_decode(code))
        domain = urlparse(url).netloc
-    except Exception:
+    except Exception as exc:
        # parse internet identifier (user@domain.com)
        name_domain = code.split("@")
        if len(name_domain) == 2 and len(name_domain[1].split(".")) >= 2:
@@ -526,7 +96,7 @@ async def api_lnurlscan(code: str, wallet: WalletTypeInfo = Depends(get_key_type
        else:
            raise HTTPException(
                status_code=HTTPStatus.BAD_REQUEST, detail="invalid lnurl"
-            )
+            ) from exc

    # params is what will be returned to the client
    params: Dict = {"domain": domain}
@@ -539,7 +109,8 @@ async def api_lnurlscan(code: str, wallet: WalletTypeInfo = Depends(get_key_type
        assert lnurlauth_key.verifying_key
        params.update(pubkey=lnurlauth_key.verifying_key.to_string("compressed").hex())
    else:
-        async with httpx.AsyncClient(follow_redirects=True) as client:
+        headers = {"User-Agent": settings.user_agent}
+        async with httpx.AsyncClient(headers=headers, follow_redirects=True) as client:
            r = await client.get(url, timeout=5)
            r.raise_for_status()
            if r.is_error:
@@ -550,14 +121,14 @@ async def api_lnurlscan(code: str, wallet: WalletTypeInfo = Depends(get_key_type

        try:
            data = json.loads(r.text)
-        except json.decoder.JSONDecodeError:
+        except json.decoder.JSONDecodeError as exc:
            raise HTTPException(
                status_code=HTTPStatus.SERVICE_UNAVAILABLE,
                detail={
                    "domain": domain,
                    "message": f"got invalid response '{r.text[:200]}'",
                },
-            )
+            ) from exc

        try:
            tag: str = data.get("tag")
@@ -616,38 +187,12 @@ async def api_lnurlscan(code: str, wallet: WalletTypeInfo = Depends(get_key_type
                    "domain": domain,
                    "message": f"lnurl JSON response invalid: {exc}",
                },
-            )
+            ) from exc

    return params


-@core_app.post("/api/v1/payments/decode", status_code=HTTPStatus.OK)
-async def api_payments_decode(data: DecodePayment, response: Response):
-    payment_str = data.data
-    try:
-        if payment_str[:5] == "LNURL":
-            url = lnurl.decode(payment_str)
-            return {"domain": url}
-        else:
-            invoice = bolt11.decode(payment_str)
-            return {
-                "payment_hash": invoice.payment_hash,
-                "amount_msat": invoice.amount_msat,
-                "description": invoice.description,
-                "description_hash": invoice.description_hash,
-                "payee": invoice.payee,
-                "date": invoice.date,
-                "expiry": invoice.expiry,
-                "secret": invoice.secret,
-                "route_hints": invoice.route_hints,
-                "min_final_cltv_expiry": invoice.min_final_cltv_expiry,
-            }
-    except Exception:
-        response.status_code = HTTPStatus.BAD_REQUEST
-        return {"message": "Failed to decode"}
-
-
-@core_app.post("/api/v1/lnurlauth")
+@api_router.post("/api/v1/lnurlauth")
 async def api_perform_lnurlauth(
    data: CreateLnurlAuth, wallet: WalletTypeInfo = Depends(require_admin_key)
 ):
@@ -659,18 +204,12 @@ async def api_perform_lnurlauth(
    return ""


-@core_app.get("/api/v1/currencies")
-async def api_list_currencies_available():
-    if len(settings.lnbits_allowed_currencies) > 0:
-        return [
-            item
-            for item in currencies.keys()
-            if item.upper() in settings.lnbits_allowed_currencies
-        ]
-    return list(currencies.keys())
+@api_router.get("/api/v1/currencies")
+async def api_list_currencies_available() -> List[str]:
+    return allowed_currencies()


-@core_app.post("/api/v1/conversion")
+@api_router.post("/api/v1/conversion")
 async def api_fiat_as_sats(data: ConversionData):
    output = {}
    if data.from_ == "sat":
@@ -688,7 +227,7 @@ async def api_fiat_as_sats(data: ConversionData):
        return output


-@core_app.get("/api/v1/qrcode/{data}", response_class=StreamingResponse)
+@api_router.get("/api/v1/qrcode/{data}", response_class=StreamingResponse)
 async def img(data):
    qr = pyqrcode.create(data)
    stream = BytesIO()
@@ -707,282 +246,3 @@ async def img(data):
            "Expires": "0",
        },
    )
-
-
-@core_app.websocket("/api/v1/ws/{item_id}")
-async def websocket_connect(websocket: WebSocket, item_id: str):
-    await websocketManager.connect(websocket, item_id)
-    try:
-        while True:
-            await websocket.receive_text()
-    except WebSocketDisconnect:
-        websocketManager.disconnect(websocket)
-
-
-@core_app.post("/api/v1/ws/{item_id}")
-async def websocket_update_post(item_id: str, data: str):
-    try:
-        await websocketUpdater(item_id, data)
-        return {"sent": True, "data": data}
-    except Exception:
-        return {"sent": False, "data": data}
-
-
-@core_app.get("/api/v1/ws/{item_id}/{data}")
-async def websocket_update_get(item_id: str, data: str):
-    try:
-        await websocketUpdater(item_id, data)
-        return {"sent": True, "data": data}
-    except Exception:
-        return {"sent": False, "data": data}
-
-
-@core_app.post("/api/v1/extension")
-async def api_install_extension(
-    data: CreateExtension, user: User = Depends(check_admin)
-):
-    release = await InstallableExtension.get_extension_release(
-        data.ext_id, data.source_repo, data.archive
-    )
-    if not release:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="Release not found"
-        )
-
-    if not release.is_version_compatible:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST, detail="Incompatible extension version"
-        )
-
-    ext_info = InstallableExtension(
-        id=data.ext_id, name=data.ext_id, installed_release=release, icon=release.icon
-    )
-
-    ext_info.download_archive()
-
-    try:
-        ext_info.extract_archive()
-
-        extension = Extension.from_installable_ext(ext_info)
-
-        db_version = (await get_dbversions()).get(data.ext_id, 0)
-        await migrate_extension_database(extension, db_version)
-
-        await add_installed_extension(ext_info)
-
-        # call stop while the old routes are still active
-        await stop_extension_background_work(data.ext_id, user.id)
-
-        if data.ext_id not in settings.lnbits_deactivated_extensions:
-            settings.lnbits_deactivated_extensions += [data.ext_id]
-
-        # mount routes for the new version
-        core_app_extra.register_new_ext_routes(extension)
-
-        if extension.upgrade_hash:
-            ext_info.nofiy_upgrade()
-
-        return extension
-
-    except Exception as ex:
-        logger.warning(ex)
-        ext_info.clean_extension_files()
-        raise HTTPException(
-            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
-            detail=(
-                f"Failed to install extension {ext_info.id} "
-                f"({ext_info.installed_version})."
-            ),
-        )
-
-
-@core_app.delete("/api/v1/extension/{ext_id}")
-async def api_uninstall_extension(ext_id: str, user: User = Depends(check_admin)):
-    installable_extensions = await InstallableExtension.get_installable_extensions()
-
-    extensions = [e for e in installable_extensions if e.id == ext_id]
-    if len(extensions) == 0:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST,
-            detail=f"Unknown extension id: {ext_id}",
-        )
-
-    # check that other extensions do not depend on this one
-    for valid_ext_id in list(map(lambda e: e.code, get_valid_extensions())):
-        installed_ext = next(
-            (ext for ext in installable_extensions if ext.id == valid_ext_id), None
-        )
-        if installed_ext and ext_id in installed_ext.dependencies:
-            raise HTTPException(
-                status_code=HTTPStatus.BAD_REQUEST,
-                detail=(
-                    f"Cannot uninstall. Extension '{installed_ext.name}' "
-                    "depends on this one."
-                ),
-            )
-
-    try:
-        # call stop while the old routes are still active
-        await stop_extension_background_work(ext_id, user.id)
-
-        if ext_id not in settings.lnbits_deactivated_extensions:
-            settings.lnbits_deactivated_extensions += [ext_id]
-
-        for ext_info in extensions:
-            ext_info.clean_extension_files()
-            await delete_installed_extension(ext_id=ext_info.id)
-
-        logger.success(f"Extension '{ext_id}' uninstalled.")
-    except Exception as ex:
-        raise HTTPException(
-            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(ex)
-        )
-
-
-@core_app.get(
-    "/api/v1/extension/{ext_id}/releases", dependencies=[Depends(check_admin)]
-)
-async def get_extension_releases(ext_id: str):
-    try:
-        extension_releases: List[
-            ExtensionRelease
-        ] = await InstallableExtension.get_extension_releases(ext_id)
-
-        return extension_releases
-
-    except Exception as ex:
-        raise HTTPException(
-            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(ex)
-        )
-
-
-@core_app.get(
-    "/api/v1/extension/release/{org}/{repo}/{tag_name}",
-    dependencies=[Depends(check_admin)],
-)
-async def get_extension_release(org: str, repo: str, tag_name: str):
-    try:
-        config = await fetch_github_release_config(org, repo, tag_name)
-        if not config:
-            return {}
-
-        return {
-            "min_lnbits_version": config.min_lnbits_version,
-            "is_version_compatible": config.is_version_compatible(),
-            "warning": config.warning,
-        }
-    except Exception as ex:
-        raise HTTPException(
-            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(ex)
-        )
-
-
-@core_app.delete(
-    "/api/v1/extension/{ext_id}/db",
-    dependencies=[Depends(check_admin)],
-)
-async def delete_extension_db(ext_id: str):
-    try:
-        db_version = (await get_dbversions()).get(ext_id, None)
-        if not db_version:
-            raise HTTPException(
-                status_code=HTTPStatus.BAD_REQUEST,
-                detail=f"Unknown extension id: {ext_id}",
-            )
-        await drop_extension_db(ext_id=ext_id)
-        await delete_dbversion(ext_id=ext_id)
-        logger.success(f"Database removed for extension '{ext_id}'")
-    except HTTPException as ex:
-        logger.error(ex)
-        raise ex
-    except Exception as ex:
-        logger.error(ex)
-        raise HTTPException(
-            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
-            detail=f"Cannot delete data for extension '{ext_id}'",
-        )
-
-
-# TINYURL
-
-
-@core_app.post(
-    "/api/v1/tinyurl",
-    name="Tinyurl",
-    description="creates a tinyurl",
-)
-async def api_create_tinyurl(
-    url: str, endless: bool = False, wallet: WalletTypeInfo = Depends(get_key_type)
-):
-    tinyurls = await get_tinyurl_by_url(url)
-    try:
-        for tinyurl in tinyurls:
-            if tinyurl:
-                if tinyurl.wallet == wallet.wallet.inkey:
-                    return tinyurl
-        return await create_tinyurl(url, endless, wallet.wallet.inkey)
-    except Exception:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST, detail="Unable to create tinyurl"
-        )
-
-
-@core_app.get(
-    "/api/v1/tinyurl/{tinyurl_id}",
-    name="Tinyurl",
-    description="get a tinyurl by id",
-)
-async def api_get_tinyurl(
-    tinyurl_id: str, wallet: WalletTypeInfo = Depends(get_key_type)
-):
-    try:
-        tinyurl = await get_tinyurl(tinyurl_id)
-        if tinyurl:
-            if tinyurl.wallet == wallet.wallet.inkey:
-                return tinyurl
-        raise HTTPException(
-            status_code=HTTPStatus.FORBIDDEN, detail="Wrong key provided."
-        )
-    except Exception:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="Unable to fetch tinyurl"
-        )
-
-
-@core_app.delete(
-    "/api/v1/tinyurl/{tinyurl_id}",
-    name="Tinyurl",
-    description="delete a tinyurl by id",
-)
-async def api_delete_tinyurl(
-    tinyurl_id: str, wallet: WalletTypeInfo = Depends(get_key_type)
-):
-    try:
-        tinyurl = await get_tinyurl(tinyurl_id)
-        if tinyurl:
-            if tinyurl.wallet == wallet.wallet.inkey:
-                await delete_tinyurl(tinyurl_id)
-                return {"deleted": True}
-        raise HTTPException(
-            status_code=HTTPStatus.FORBIDDEN, detail="Wrong key provided."
-        )
-    except Exception:
-        raise HTTPException(
-            status_code=HTTPStatus.BAD_REQUEST, detail="Unable to delete"
-        )
-
-
-@core_app.get(
-    "/t/{tinyurl_id}",
-    name="Tinyurl",
-    description="redirects a tinyurl by id",
-)
-async def api_tinyurl(tinyurl_id: str):
-    tinyurl = await get_tinyurl(tinyurl_id)
-    if tinyurl:
-        response = RedirectResponse(url=tinyurl.url)
-        return response
-    else:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="unable to find tinyurl"
-        )
@@ -0,0 +1,350 @@
+import importlib
+from typing import Callable, Optional
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from fastapi.responses import JSONResponse, RedirectResponse
+from fastapi_sso.sso.base import OpenID, SSOBase
+from loguru import logger
+from starlette.status import (
+    HTTP_400_BAD_REQUEST,
+    HTTP_401_UNAUTHORIZED,
+    HTTP_403_FORBIDDEN,
+    HTTP_500_INTERNAL_SERVER_ERROR,
+)
+
+from lnbits.decorators import check_user_exists
+from lnbits.helpers import (
+    create_access_token,
+    decrypt_internal_message,
+    encrypt_internal_message,
+    is_valid_email_address,
+    is_valid_username,
+)
+from lnbits.settings import AuthMethods, settings
+
+from ..crud import (
+    create_account,
+    create_user,
+    get_account,
+    get_account_by_email,
+    get_account_by_username_or_email,
+    get_user,
+    update_account,
+    update_user_password,
+    verify_user_password,
+)
+from ..models import (
+    CreateUser,
+    LoginUsernamePassword,
+    LoginUsr,
+    UpdateSuperuserPassword,
+    UpdateUser,
+    UpdateUserPassword,
+    User,
+    UserConfig,
+)
+
+auth_router = APIRouter(prefix="/api/v1/auth", tags=["Auth"])
+
+
+@auth_router.get("", description="Get the authenticated user")
+async def get_auth_user(user: User = Depends(check_user_exists)) -> User:
+    return user
+
+
+@auth_router.post("", description="Login via the username and password")
+async def login(data: LoginUsernamePassword) -> JSONResponse:
+    if not settings.is_auth_method_allowed(AuthMethods.username_and_password):
+        raise HTTPException(
+            HTTP_401_UNAUTHORIZED, "Login by 'Username and Password' not allowed."
+        )
+
+    try:
+        user = await get_account_by_username_or_email(data.username)
+
+        if not user:
+            raise HTTPException(HTTP_401_UNAUTHORIZED, "Invalid credentials.")
+        if not await verify_user_password(user.id, data.password):
+            raise HTTPException(HTTP_401_UNAUTHORIZED, "Invalid credentials.")
+
+        return _auth_success_response(user.username, user.id)
+    except HTTPException as exc:
+        raise exc
+    except Exception as exc:
+        logger.debug(exc)
+        raise HTTPException(HTTP_500_INTERNAL_SERVER_ERROR, "Cannot login.") from exc
+
+
+@auth_router.post("/usr", description="Login via the User ID")
+async def login_usr(data: LoginUsr) -> JSONResponse:
+    if not settings.is_auth_method_allowed(AuthMethods.user_id_only):
+        raise HTTPException(HTTP_401_UNAUTHORIZED, "Login by 'User ID' not allowed.")
+
+    try:
+        user = await get_user(data.usr)
+        if not user:
+            raise HTTPException(HTTP_401_UNAUTHORIZED, "User ID does not exist.")
+
+        return _auth_success_response(user.username or "", user.id)
+    except HTTPException as exc:
+        raise exc
+    except Exception as exc:
+        logger.debug(exc)
+        raise HTTPException(HTTP_500_INTERNAL_SERVER_ERROR, "Cannot login.") from exc
+
+
+@auth_router.get("/{provider}", description="SSO Provider")
+async def login_with_sso_provider(
+    request: Request, provider: str, user_id: Optional[str] = None
+):
+    provider_sso = _new_sso(provider)
+    if not provider_sso:
+        raise HTTPException(
+            HTTP_401_UNAUTHORIZED, f"Login by '{provider}' not allowed."
+        )
+
+    provider_sso.redirect_uri = str(request.base_url) + f"api/v1/auth/{provider}/token"
+    with provider_sso:
+        state = encrypt_internal_message(user_id)
+        return await provider_sso.get_login_redirect(state=state)
+
+
+@auth_router.get("/{provider}/token", description="Handle OAuth callback")
+async def handle_oauth_token(request: Request, provider: str) -> RedirectResponse:
+    provider_sso = _new_sso(provider)
+    if not provider_sso:
+        raise HTTPException(
+            HTTP_401_UNAUTHORIZED, f"Login by '{provider}' not allowed."
+        )
+
+    try:
+        with provider_sso:
+            userinfo = await provider_sso.verify_and_process(request)
+            assert userinfo is not None
+            user_id = decrypt_internal_message(provider_sso.state)
+        request.session.pop("user", None)
+        return await _handle_sso_login(userinfo, user_id)
+    except HTTPException as exc:
+        raise exc
+    except ValueError as exc:
+        raise HTTPException(HTTP_403_FORBIDDEN, str(exc)) from exc
+    except Exception as exc:
+        logger.debug(exc)
+        raise HTTPException(
+            HTTP_500_INTERNAL_SERVER_ERROR,
+            f"Cannot authenticate user with {provider} Auth.",
+        ) from exc
+
+
+@auth_router.post("/logout")
+async def logout() -> JSONResponse:
+    response = JSONResponse({"status": "success"}, status_code=status.HTTP_200_OK)
+    response.delete_cookie("cookie_access_token")
+    response.delete_cookie("is_lnbits_user_authorized")
+    response.delete_cookie("is_access_token_expired")
+    response.delete_cookie("lnbits_last_active_wallet")
+
+    return response
+
+
+@auth_router.post("/register")
+async def register(data: CreateUser) -> JSONResponse:
+    if not settings.is_auth_method_allowed(AuthMethods.username_and_password):
+        raise HTTPException(
+            HTTP_401_UNAUTHORIZED, "Register by 'Username and Password' not allowed."
+        )
+
+    if data.password != data.password_repeat:
+        raise HTTPException(HTTP_400_BAD_REQUEST, "Passwords do not match.")
+
+    if not data.username:
+        raise HTTPException(HTTP_400_BAD_REQUEST, "Missing username.")
+    if not is_valid_username(data.username):
+        raise HTTPException(HTTP_400_BAD_REQUEST, "Invalid username.")
+
+    if data.email and not is_valid_email_address(data.email):
+        raise HTTPException(HTTP_400_BAD_REQUEST, "Invalid email.")
+
+    try:
+        user = await create_user(data)
+        return _auth_success_response(user.username)
+
+    except ValueError as exc:
+        raise HTTPException(HTTP_403_FORBIDDEN, str(exc)) from exc
+    except Exception as exc:
+        logger.debug(exc)
+        raise HTTPException(
+            HTTP_500_INTERNAL_SERVER_ERROR, "Cannot create user."
+        ) from exc
+
+
+@auth_router.put("/password")
+async def update_password(
+    data: UpdateUserPassword, user: User = Depends(check_user_exists)
+) -> Optional[User]:
+    if not settings.is_auth_method_allowed(AuthMethods.username_and_password):
+        raise HTTPException(
+            HTTP_401_UNAUTHORIZED, "Auth by 'Username and Password' not allowed."
+        )
+    if data.user_id != user.id:
+        raise HTTPException(HTTP_400_BAD_REQUEST, "Invalid user ID.")
+
+    try:
+        return await update_user_password(data)
+    except AssertionError as exc:
+        raise HTTPException(HTTP_403_FORBIDDEN, str(exc)) from exc
+    except Exception as exc:
+        logger.debug(exc)
+        raise HTTPException(
+            HTTP_500_INTERNAL_SERVER_ERROR, "Cannot update user password."
+        ) from exc
+
+
+@auth_router.put("/update")
+async def update(
+    data: UpdateUser, user: User = Depends(check_user_exists)
+) -> Optional[User]:
+    if data.user_id != user.id:
+        raise HTTPException(HTTP_400_BAD_REQUEST, "Invalid user ID.")
+    if data.username and not is_valid_username(data.username):
+        raise HTTPException(HTTP_400_BAD_REQUEST, "Invalid username.")
+    if data.email != user.email:
+        raise HTTPException(HTTP_400_BAD_REQUEST, "Email mismatch.")
+
+    try:
+        return await update_account(user.id, data.username, None, data.config)
+    except AssertionError as exc:
+        raise HTTPException(HTTP_403_FORBIDDEN, str(exc)) from exc
+    except Exception as exc:
+        logger.debug(exc)
+        raise HTTPException(
+            HTTP_500_INTERNAL_SERVER_ERROR, "Cannot update user."
+        ) from exc
+
+
+@auth_router.put("/first_install")
+async def first_install(data: UpdateSuperuserPassword) -> JSONResponse:
+    if not settings.first_install:
+        raise HTTPException(HTTP_401_UNAUTHORIZED, "This is not your first install")
+    try:
+        await update_account(
+            user_id=settings.super_user,
+            username=data.username,
+            user_config=UserConfig(provider="lnbits"),
+        )
+        super_user = UpdateUserPassword(
+            user_id=settings.super_user,
+            password=data.password,
+            password_repeat=data.password_repeat,
+            username=data.username,
+        )
+        await update_user_password(super_user)
+        settings.first_install = False
+        return _auth_success_response(username=super_user.username)
+    except AssertionError as exc:
+        raise HTTPException(HTTP_403_FORBIDDEN, str(exc)) from exc
+    except Exception as exc:
+        logger.debug(exc)
+        raise HTTPException(
+            HTTP_500_INTERNAL_SERVER_ERROR, "Cannot update user password."
+        ) from exc
+
+
+async def _handle_sso_login(userinfo: OpenID, verified_user_id: Optional[str] = None):
+    email = userinfo.email
+    if not email or not is_valid_email_address(email):
+        raise HTTPException(HTTP_400_BAD_REQUEST, "Invalid email.")
+
+    redirect_path = "/wallet"
+    user_config = UserConfig(**dict(userinfo))
+    user_config.email_verified = True
+
+    account = await get_account_by_email(email)
+
+    if verified_user_id:
+        if account:
+            raise HTTPException(HTTP_401_UNAUTHORIZED, "Email already used.")
+        account = await get_account(verified_user_id)
+        if not account:
+            raise HTTPException(HTTP_401_UNAUTHORIZED, "Cannot verify user email.")
+        redirect_path = "/account"
+
+    if account:
+        user = await update_account(account.id, email=email, user_config=user_config)
+    else:
+        if not settings.new_accounts_allowed:
+            raise HTTPException(HTTP_400_BAD_REQUEST, "Account creation is disabled.")
+        user = await create_account(email=email, user_config=user_config)
+
+    if not user:
+        raise HTTPException(HTTP_401_UNAUTHORIZED, "User not found.")
+
+    return _auth_redirect_response(redirect_path, email)
+
+
+def _auth_success_response(
+    username: Optional[str] = None,
+    user_id: Optional[str] = None,
+    email: Optional[str] = None,
+) -> JSONResponse:
+    access_token = create_access_token(
+        data={"sub": username or "", "usr": user_id, "email": email}
+    )
+    response = JSONResponse({"access_token": access_token, "token_type": "bearer"})
+    response.set_cookie("cookie_access_token", access_token, httponly=True)
+    response.set_cookie("is_lnbits_user_authorized", "true")
+    response.delete_cookie("is_access_token_expired")
+
+    return response
+
+
+def _auth_redirect_response(path: str, email: str) -> RedirectResponse:
+    access_token = create_access_token(data={"sub": "" or "", "email": email})
+    response = RedirectResponse(path)
+    response.set_cookie("cookie_access_token", access_token, httponly=True)
+    response.set_cookie("is_lnbits_user_authorized", "true")
+    response.delete_cookie("is_access_token_expired")
+    return response
+
+
+def _new_sso(provider: str) -> Optional[SSOBase]:
+    try:
+        if not settings.is_auth_method_allowed(AuthMethods(f"{provider}-auth")):
+            return None
+
+        client_id = getattr(settings, f"{provider}_client_id", None)
+        client_secret = getattr(settings, f"{provider}_client_secret", None)
+        discovery_url = getattr(settings, f"{provider}_discovery_url", None)
+
+        if not client_id or not client_secret:
+            logger.warning(f"{provider} auth allowed but not configured.")
+            return None
+
+        sso_provider_class = _find_auth_provider_class(provider)
+        sso_provider = sso_provider_class(
+            client_id, client_secret, None, allow_insecure_http=True
+        )
+        if (
+            discovery_url
+            and getattr(sso_provider, "discovery_url", discovery_url) != discovery_url
+        ):
+            sso_provider.discovery_url = discovery_url
+        return sso_provider
+    except Exception as e:
+        logger.warning(e)
+
+    return None
+
+
+def _find_auth_provider_class(provider: str) -> Callable:
+    sso_modules = ["lnbits.core.sso", "fastapi_sso.sso"]
+    for module in sso_modules:
+        try:
+            provider_module = importlib.import_module(f"{module}.{provider}")
+            provider_class = getattr(provider_module, f"{provider.title()}SSO")
+            if provider_class:
+                return provider_class
+        except Exception:
+            pass
+
+    raise ValueError(f"No SSO provider found for '{provider}'.")
@@ -0,0 +1,272 @@
+from http import HTTPStatus
+from typing import (
+    List,
+    Optional,
+)
+
+from bolt11 import decode as bolt11_decode
+from fastapi import (
+    APIRouter,
+    Depends,
+    HTTPException,
+)
+from loguru import logger
+
+from lnbits.core.db import core_app_extra
+from lnbits.core.helpers import (
+    migrate_extension_database,
+    stop_extension_background_work,
+)
+from lnbits.core.models import (
+    User,
+)
+from lnbits.decorators import (
+    check_access_token,
+    check_admin,
+)
+from lnbits.extension_manager import (
+    CreateExtension,
+    Extension,
+    ExtensionRelease,
+    InstallableExtension,
+    fetch_github_release_config,
+    fetch_release_payment_info,
+    get_valid_extensions,
+)
+from lnbits.settings import settings
+
+from ..crud import (
+    add_installed_extension,
+    delete_dbversion,
+    delete_installed_extension,
+    drop_extension_db,
+    get_dbversions,
+    get_installed_extension,
+    get_installed_extensions,
+)
+
+extension_router = APIRouter(
+    tags=["Extension Managment"],
+    prefix="/api/v1/extension",
+)
+
+
+@extension_router.post("")
+async def api_install_extension(
+    data: CreateExtension,
+    user: User = Depends(check_admin),
+    access_token: Optional[str] = Depends(check_access_token),
+):
+    release = await InstallableExtension.get_extension_release(
+        data.ext_id, data.source_repo, data.archive, data.version
+    )
+    if not release:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="Release not found"
+        )
+
+    if not release.is_version_compatible:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST, detail="Incompatible extension version"
+        )
+
+    release.payment_hash = data.payment_hash
+    ext_info = InstallableExtension(
+        id=data.ext_id, name=data.ext_id, installed_release=release, icon=release.icon
+    )
+
+    try:
+        installed_ext = await get_installed_extension(data.ext_id)
+        ext_info.payments = installed_ext.payments if installed_ext else []
+
+        await ext_info.download_archive()
+
+        ext_info.extract_archive()
+
+        extension = Extension.from_installable_ext(ext_info)
+
+        db_version = (await get_dbversions()).get(data.ext_id, 0)
+        await migrate_extension_database(extension, db_version)
+
+        await add_installed_extension(ext_info)
+
+        if extension.is_upgrade_extension:
+            # call stop while the old routes are still active
+            await stop_extension_background_work(data.ext_id, user.id, access_token)
+
+        if data.ext_id not in settings.lnbits_deactivated_extensions:
+            settings.lnbits_deactivated_extensions += [data.ext_id]
+
+        # mount routes for the new version
+        core_app_extra.register_new_ext_routes(extension)
+
+        if extension.upgrade_hash:
+            ext_info.notify_upgrade()
+
+        return extension
+    except AssertionError as exc:
+        raise HTTPException(HTTPStatus.BAD_REQUEST, str(exc)) from exc
+    except Exception as exc:
+        logger.warning(exc)
+        ext_info.clean_extension_files()
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=(
+                f"Failed to install extension {ext_info.id} "
+                f"({ext_info.installed_version})."
+            ),
+        ) from exc
+
+
+@extension_router.delete("/{ext_id}")
+async def api_uninstall_extension(
+    ext_id: str,
+    user: User = Depends(check_admin),
+    access_token: Optional[str] = Depends(check_access_token),
+):
+    installed_extensions = await get_installed_extensions()
+
+    extensions = [e for e in installed_extensions if e.id == ext_id]
+    if len(extensions) == 0:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail=f"Unknown extension id: {ext_id}",
+        )
+
+    # check that other extensions do not depend on this one
+    for valid_ext_id in [ext.code for ext in get_valid_extensions()]:
+        installed_ext = next(
+            (ext for ext in installed_extensions if ext.id == valid_ext_id), None
+        )
+        if installed_ext and ext_id in installed_ext.dependencies:
+            raise HTTPException(
+                status_code=HTTPStatus.BAD_REQUEST,
+                detail=(
+                    f"Cannot uninstall. Extension '{installed_ext.name}' "
+                    "depends on this one."
+                ),
+            )
+
+    try:
+        # call stop while the old routes are still active
+        await stop_extension_background_work(ext_id, user.id, access_token)
+
+        if ext_id not in settings.lnbits_deactivated_extensions:
+            settings.lnbits_deactivated_extensions += [ext_id]
+
+        for ext_info in extensions:
+            ext_info.clean_extension_files()
+            await delete_installed_extension(ext_id=ext_info.id)
+
+        logger.success(f"Extension '{ext_id}' uninstalled.")
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(exc)
+        ) from exc
+
+
+@extension_router.get("/{ext_id}/releases", dependencies=[Depends(check_admin)])
+async def get_extension_releases(ext_id: str):
+    try:
+        extension_releases: List[ExtensionRelease] = (
+            await InstallableExtension.get_extension_releases(ext_id)
+        )
+
+        installed_ext = await get_installed_extension(ext_id)
+        if not installed_ext:
+            return extension_releases
+
+        for release in extension_releases:
+            payment_info = installed_ext.find_existing_payment(release.pay_link)
+            if payment_info:
+                release.paid_sats = payment_info.amount
+
+        return extension_releases
+
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(exc)
+        ) from exc
+
+
+@extension_router.put("/invoice", dependencies=[Depends(check_admin)])
+async def get_extension_invoice(data: CreateExtension):
+    try:
+        assert data.cost_sats, "A non-zero amount must be specified"
+        release = await InstallableExtension.get_extension_release(
+            data.ext_id, data.source_repo, data.archive, data.version
+        )
+        assert release, "Release not found"
+        assert release.pay_link, "Pay link not found for release"
+
+        payment_info = await fetch_release_payment_info(
+            release.pay_link, data.cost_sats
+        )
+        assert payment_info and payment_info.payment_request, "Cannot request invoice"
+        invoice = bolt11_decode(payment_info.payment_request)
+
+        assert invoice.amount_msat is not None, "Invoic amount is missing"
+        invoice_amount = int(invoice.amount_msat / 1000)
+        assert (
+            invoice_amount == data.cost_sats
+        ), f"Wrong invoice amount: {invoice_amount}."
+        assert (
+            payment_info.payment_hash == invoice.payment_hash
+        ), "Wroong invoice payment hash"
+
+        return payment_info
+
+    except AssertionError as exc:
+        raise HTTPException(HTTPStatus.BAD_REQUEST, str(exc)) from exc
+    except Exception as exc:
+        logger.warning(exc)
+        raise HTTPException(
+            HTTPStatus.INTERNAL_SERVER_ERROR, "Cannot request invoice"
+        ) from exc
+
+
+@extension_router.get(
+    "/release/{org}/{repo}/{tag_name}",
+    dependencies=[Depends(check_admin)],
+)
+async def get_extension_release(org: str, repo: str, tag_name: str):
+    try:
+        config = await fetch_github_release_config(org, repo, tag_name)
+        if not config:
+            return {}
+
+        return {
+            "min_lnbits_version": config.min_lnbits_version,
+            "is_version_compatible": config.is_version_compatible(),
+            "warning": config.warning,
+        }
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(exc)
+        ) from exc
+
+
+@extension_router.delete(
+    "/{ext_id}/db",
+    dependencies=[Depends(check_admin)],
+)
+async def delete_extension_db(ext_id: str):
+    try:
+        db_version = (await get_dbversions()).get(ext_id, None)
+        if not db_version:
+            raise HTTPException(
+                status_code=HTTPStatus.BAD_REQUEST,
+                detail=f"Unknown extension id: {ext_id}",
+            )
+        await drop_extension_db(ext_id=ext_id)
+        await delete_dbversion(ext_id=ext_id)
+        logger.success(f"Database removed for extension '{ext_id}'")
+    except HTTPException as ex:
+        logger.error(ex)
+        raise ex
+    except Exception as exc:
+        logger.error(exc)
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"Cannot delete data for extension '{ext_id}'",
+        ) from exc
@@ -1,58 +1,70 @@
-import asyncio
+import sys
 from http import HTTPStatus
-from typing import List, Optional
+from pathlib import Path
+from typing import Annotated, List, Optional, Union
+from urllib.parse import urlparse

-from fastapi import Depends, Query, Request, status
+from fastapi import Cookie, Depends, Query, Request
 from fastapi.exceptions import HTTPException
-from fastapi.responses import FileResponse, RedirectResponse
+from fastapi.responses import FileResponse, HTMLResponse, RedirectResponse
 from fastapi.routing import APIRouter
 from loguru import logger
 from pydantic.types import UUID4
-from starlette.responses import HTMLResponse, JSONResponse

-from lnbits.core import db
+from lnbits.core.db import core_app_extra
 from lnbits.core.helpers import to_valid_user_id
 from lnbits.core.models import User
 from lnbits.decorators import check_admin, check_user_exists
-from lnbits.helpers import template_renderer, url_for
+from lnbits.helpers import template_renderer
 from lnbits.settings import settings
-from lnbits.wallets import get_wallet_class
+from lnbits.wallets import get_funding_source

 from ...extension_manager import InstallableExtension, get_valid_extensions
-from ...utils.exchange_rates import currencies
+from ...utils.exchange_rates import allowed_currencies, currencies
 from ..crud import (
-    create_account,
    create_wallet,
-    delete_wallet,
-    get_balance_check,
    get_dbversions,
    get_inactive_extensions,
    get_installed_extensions,
    get_user,
-    save_balance_notify,
    update_installed_extension_state,
    update_user_extension,
 )
-from ..services import pay_invoice, redeem_lnurl_withdraw

-core_html_routes: APIRouter = APIRouter(
+generic_router = APIRouter(
    tags=["Core NON-API Website Routes"], include_in_schema=False
 )


-@core_html_routes.get("/favicon.ico", response_class=FileResponse)
+@generic_router.get("/favicon.ico", response_class=FileResponse)
 async def favicon():
-    return FileResponse("lnbits/core/static/favicon.ico")
+    return FileResponse(Path("lnbits", "static", "favicon.ico"))


-@core_html_routes.get("/", response_class=HTMLResponse)
+@generic_router.get("/", response_class=HTMLResponse)
 async def home(request: Request, lightning: str = ""):
    return template_renderer().TemplateResponse(
-        "core/index.html", {"request": request, "lnurl": lightning}
+        request, "core/index.html", {"lnurl": lightning}
    )


-@core_html_routes.get("/robots.txt", response_class=HTMLResponse)
+@generic_router.get("/first_install", response_class=HTMLResponse)
+async def first_install(request: Request):
+    if not settings.first_install:
+        return template_renderer().TemplateResponse(
+            request,
+            "error.html",
+            {
+                "err": "Super user account has already been configured.",
+            },
+        )
+    return template_renderer().TemplateResponse(
+        request,
+        "core/first_install.html",
+    )
+
+
+@generic_router.get("/robots.txt", response_class=HTMLResponse)
 async def robots():
    data = """
    User-agent: *
@@ -61,7 +73,7 @@ async def robots():
    return HTMLResponse(content=data, media_type="text/plain")


-@core_html_routes.get(
+@generic_router.get(
    "/extensions", name="install.extensions", response_class=HTMLResponse
 )
 async def extensions_install(
@@ -74,18 +86,14 @@ async def extensions_install(
 ):
    await toggle_extension(enable, disable, user.id)

-    # Update user as his extensions have been updated
-    if enable or disable:
-        user = await get_user(user.id)  # type: ignore
    try:
        installed_exts: List["InstallableExtension"] = await get_installed_extensions()
        installed_exts_ids = [e.id for e in installed_exts]

-        installable_exts: List[
-            InstallableExtension
-        ] = await InstallableExtension.get_installable_extensions()
+        installable_exts = await InstallableExtension.get_installable_extensions()
+        installable_exts_ids = [e.id for e in installable_exts]
        installable_exts += [
-            e for e in installed_exts if e.id not in installed_exts_ids
+            e for e in installed_exts if e.id not in installable_exts_ids
        ]

        for e in installable_exts:
@@ -100,266 +108,154 @@ async def extensions_install(
    except Exception as ex:
        logger.warning(ex)
        installable_exts = []
+        installed_exts_ids = []

    try:
        ext_id = activate or deactivate
+        all_extensions = get_valid_extensions()
+        ext = next((e for e in all_extensions if e.code == ext_id), None)
        if ext_id and user.admin:
            if deactivate and deactivate not in settings.lnbits_deactivated_extensions:
                settings.lnbits_deactivated_extensions += [deactivate]
            elif activate:
+                # if extension never loaded (was deactivated on server startup)
+                if ext_id not in sys.modules.keys():
+                    # run extension start-up routine
+                    core_app_extra.register_new_ext_routes(ext)
+
                settings.lnbits_deactivated_extensions = list(
                    filter(
                        lambda e: e != activate, settings.lnbits_deactivated_extensions
                    )
                )
+
            await update_installed_extension_state(
                ext_id=ext_id, active=activate is not None
            )

-        all_extensions = list(map(lambda e: e.code, get_valid_extensions()))
+        all_ext_ids = [ext.code for ext in all_extensions]
        inactive_extensions = await get_inactive_extensions()
        db_version = await get_dbversions()
-        extensions = list(
-            map(
-                lambda ext: {
-                    "id": ext.id,
-                    "name": ext.name,
-                    "icon": ext.icon,
-                    "shortDescription": ext.short_description,
-                    "stars": ext.stars,
-                    "isFeatured": ext.featured,
-                    "dependencies": ext.dependencies,
-                    "isInstalled": ext.id in installed_exts_ids,
-                    "hasDatabaseTables": ext.id in db_version,
-                    "isAvailable": ext.id in all_extensions,
-                    "isAdminOnly": ext.id in settings.lnbits_admin_extensions,
-                    "isActive": ext.id not in inactive_extensions,
-                    "latestRelease": (
-                        dict(ext.latest_release) if ext.latest_release else None
-                    ),
-                    "installedRelease": (
-                        dict(ext.installed_release) if ext.installed_release else None
-                    ),
-                },
-                installable_exts,
-            )
-        )
+        extensions = [
+            {
+                "id": ext.id,
+                "name": ext.name,
+                "icon": ext.icon,
+                "shortDescription": ext.short_description,
+                "stars": ext.stars,
+                "isFeatured": ext.featured,
+                "dependencies": ext.dependencies,
+                "isInstalled": ext.id in installed_exts_ids,
+                "hasDatabaseTables": ext.id in db_version,
+                "isAvailable": ext.id in all_ext_ids,
+                "isAdminOnly": ext.id in settings.lnbits_admin_extensions,
+                "isActive": ext.id not in inactive_extensions,
+                "latestRelease": (
+                    dict(ext.latest_release) if ext.latest_release else None
+                ),
+                "installedRelease": (
+                    dict(ext.installed_release) if ext.installed_release else None
+                ),
+            }
+            for ext in installable_exts
+        ]
+
+        # refresh user state. Eg: enabled extensions.
+        user = await get_user(user.id) or user

        return template_renderer().TemplateResponse(
+            request,
            "core/extensions.html",
            {
-                "request": request,
                "user": user.dict(),
                "extensions": extensions,
            },
        )
-    except Exception as e:
-        logger.warning(e)
-        raise HTTPException(status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(e))
+    except Exception as exc:
+        logger.warning(exc)
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=str(exc)
+        ) from exc


-@core_html_routes.get(
+@generic_router.get(
    "/wallet",
    response_class=HTMLResponse,
-    description="""
-just **wallet_name**: create a new user, then create a new wallet
-                      for user with wallet_name
-just **user_id**: return the first user wallet or create one if none found
-                  (with default wallet_name)
-**user_id** and **wallet_name**: create a new wallet for user with wallet_name
-**user_id** and **wallet_id**: return that wallet if user is the owner
-nothing: create everything
-""",
+    description="show wallet page",
 )
 async def wallet(
-    request: Request = Query(None),
-    nme: Optional[str] = Query(None),
-    usr: Optional[UUID4] = Query(None),
+    request: Request,
+    lnbits_last_active_wallet: Annotated[Union[str, None], Cookie()] = None,
+    user: User = Depends(check_user_exists),
    wal: Optional[UUID4] = Query(None),
 ):
-    user_id = usr.hex if usr else None
-    wallet_id = wal.hex if wal else None
-    wallet_name = nme
-
-    if not user_id:
-        new_user = await create_account()
-        user = await get_user(new_user.id)
-        assert user, "Newly created user has to exist."
-        logger.info(f"Create user {user.id}")
+    if wal:
+        wallet_id = wal.hex
+    elif len(user.wallets) == 0:
+        wallet = await create_wallet(user_id=user.id)
+        user = await get_user(user_id=user.id) or user
+        wallet_id = wallet.id
+    elif lnbits_last_active_wallet and user.get_wallet(lnbits_last_active_wallet):
+        wallet_id = lnbits_last_active_wallet
    else:
-        user = await get_user(user_id)
-        if not user:
-            return template_renderer().TemplateResponse(
-                "error.html", {"request": request, "err": "User does not exist."}
-            )
-        if (
-            len(settings.lnbits_allowed_users) > 0
-            and user_id not in settings.lnbits_allowed_users
-            and user_id not in settings.lnbits_admin_users
-            and user_id != settings.super_user
-        ):
-            return template_renderer().TemplateResponse(
-                "error.html", {"request": request, "err": "User not authorized."}
-            )
-        if user_id == settings.super_user or user_id in settings.lnbits_admin_users:
-            user.admin = True
-        if user_id == settings.super_user:
-            user.super_user = True
+        wallet_id = user.wallets[0].id

-    if not wallet_id:
-        if user.wallets and not wallet_name:
-            wallet = user.wallets[0]
-        else:
-            wallet = await create_wallet(user_id=user.id, wallet_name=wallet_name)
-            logger.info(
-                f"Created new wallet {wallet_name if wallet_name else '(no name)'} for"
-                f" user {user.id}"
-            )
-
-        return RedirectResponse(
-            f"/wallet?usr={user.id}&wal={wallet.id}",
-            status_code=status.HTTP_307_TEMPORARY_REDIRECT,
-        )
-
-    logger.debug(
-        "Access "
-        f"{'user '+ user.id + ' ' if user else ''} "
-        f"{'wallet ' + wallet_name if wallet_name else ''}"
-    )
-    userwallet = user.get_wallet(wallet_id)
-    if not userwallet:
+    user_wallet = user.get_wallet(wallet_id)
+    if not user_wallet or user_wallet.deleted:
        return template_renderer().TemplateResponse(
-            "error.html", {"request": request, "err": "Wallet not found"}
+            request, "error.html", {"err": "Wallet not found"}
        )

-    return template_renderer().TemplateResponse(
+    resp = template_renderer().TemplateResponse(
+        request,
        "core/wallet.html",
        {
-            "request": request,
            "user": user.dict(),
-            "wallet": userwallet.dict(),
+            "wallet": user_wallet.dict(),
+            "currencies": allowed_currencies(),
            "service_fee": settings.lnbits_service_fee,
+            "service_fee_max": settings.lnbits_service_fee_max,
            "web_manifest": f"/manifest/{user.id}.webmanifest",
        },
    )
+    resp.set_cookie("lnbits_last_active_wallet", wallet_id)
+    return resp
+
+
+@generic_router.get(
+    "/account",
+    response_class=HTMLResponse,
+    description="show account page",
+)
+async def account(
+    request: Request,
+    user: User = Depends(check_user_exists),
+):
+    return template_renderer().TemplateResponse(
+        request,
+        "core/account.html",
+        {
+            "user": user.dict(),
+        },
+    )


-@core_html_routes.get("/withdraw", response_class=JSONResponse)
-async def lnurl_full_withdraw(request: Request):
-    user = await get_user(request.query_params.get("usr"))
-    if not user:
-        return {"status": "ERROR", "reason": "User does not exist."}
-
-    wallet = user.get_wallet(request.query_params.get("wal"))
-    if not wallet:
-        return {"status": "ERROR", "reason": "Wallet does not exist."}
-
-    return {
-        "tag": "withdrawRequest",
-        "callback": url_for("/withdraw/cb", external=True, usr=user.id, wal=wallet.id),
-        "k1": "0",
-        "minWithdrawable": 1000 if wallet.withdrawable_balance else 0,
-        "maxWithdrawable": wallet.withdrawable_balance,
-        "defaultDescription": (
-            f"{settings.lnbits_site_title} balance withdraw from {wallet.id[0:5]}"
-        ),
-        "balanceCheck": url_for("/withdraw", external=True, usr=user.id, wal=wallet.id),
-    }
-
-
-@core_html_routes.get("/withdraw/cb", response_class=JSONResponse)
-async def lnurl_full_withdraw_callback(request: Request):
-    user = await get_user(request.query_params.get("usr"))
-    if not user:
-        return {"status": "ERROR", "reason": "User does not exist."}
-
-    wallet = user.get_wallet(request.query_params.get("wal"))
-    if not wallet:
-        return {"status": "ERROR", "reason": "Wallet does not exist."}
-
-    pr = request.query_params.get("pr")
-
-    async def pay():
-        try:
-            await pay_invoice(wallet_id=wallet.id, payment_request=pr)
-        except Exception:
-            pass
-
-    asyncio.create_task(pay())
-
-    balance_notify = request.query_params.get("balanceNotify")
-    if balance_notify:
-        await save_balance_notify(wallet.id, balance_notify)
-
-    return {"status": "OK"}
-
-
-@core_html_routes.get("/deletewallet", response_class=RedirectResponse)
-async def deletewallet(wal: str = Query(...), usr: str = Query(...)):
-    user = await get_user(usr)
-    if not user:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "User not found.")
-
-    user_wallet_ids = [u.id for u in user.wallets]
-
-    if wal not in user_wallet_ids:
-        raise HTTPException(HTTPStatus.FORBIDDEN, "Not your wallet.")
-    else:
-        await delete_wallet(user_id=user.id, wallet_id=wal)
-        user_wallet_ids.remove(wal)
-        logger.debug("Deleted wallet {wal} of user {user.id}")
-
-    if user_wallet_ids:
-        return RedirectResponse(
-            url_for("/wallet", usr=user.id, wal=user_wallet_ids[0]),
-            status_code=status.HTTP_307_TEMPORARY_REDIRECT,
-        )
-
-    return RedirectResponse(
-        url_for("/"), status_code=status.HTTP_307_TEMPORARY_REDIRECT
+@generic_router.get("/service-worker.js")
+async def service_worker(request: Request):
+    return template_renderer().TemplateResponse(
+        request,
+        "service-worker.js",
+        {
+            "cache_version": settings.server_startup_time,
+        },
+        media_type="text/javascript",
    )


-@core_html_routes.get("/withdraw/notify/{service}")
-async def lnurl_balance_notify(request: Request, service: str):
-    bc = await get_balance_check(request.query_params.get("wal"), service)
-    if bc:
-        await redeem_lnurl_withdraw(bc.wallet, bc.url)
+@generic_router.get("/manifest/{usr}.webmanifest")
+async def manifest(request: Request, usr: str):
+    host = urlparse(str(request.url)).netloc

-
-@core_html_routes.get(
-    "/lnurlwallet", response_class=RedirectResponse, name="core.lnurlwallet"
-)
-async def lnurlwallet(request: Request):
-    async with db.connect() as conn:
-        account = await create_account(conn=conn)
-        user = await get_user(account.id, conn=conn)
-        assert user, "Newly created user not found."
-        wallet = await create_wallet(user_id=user.id, conn=conn)
-
-    asyncio.create_task(
-        redeem_lnurl_withdraw(
-            wallet.id,
-            request.query_params.get("lightning"),
-            "LNbits initial funding: voucher redeem.",
-            {"tag": "lnurlwallet"},
-            5,  # wait 5 seconds before sending the invoice to the service
-        )
-    )
-
-    return RedirectResponse(
-        f"/wallet?usr={user.id}&wal={wallet.id}",
-        status_code=status.HTTP_307_TEMPORARY_REDIRECT,
-    )
-
-
-@core_html_routes.get("/service-worker.js", response_class=FileResponse)
-async def service_worker():
-    return FileResponse("lnbits/core/static/js/service-worker.js")
-
-
-@core_html_routes.get("/manifest/{usr}.webmanifest")
-async def manifest(usr: str):
    user = await get_user(usr)
    if not user:
        raise HTTPException(status_code=HTTPStatus.NOT_FOUND)
@@ -372,11 +268,46 @@ async def manifest(usr: str):
                "src": (
                    settings.lnbits_custom_logo
                    if settings.lnbits_custom_logo
-                    else "https://cdn.jsdelivr.net/gh/lnbits/lnbits@0.3.0/docs/logos/lnbits.png"
+                    else "https://cdn.jsdelivr.net/gh/lnbits/lnbits@main/docs/logos/lnbits.png"
                ),
+                "sizes": "512x512",
                "type": "image/png",
-                "sizes": "900x900",
-            }
+            },
+            {"src": "/static/favicon.ico", "sizes": "32x32", "type": "image/x-icon"},
+            {
+                "src": "/static/images/maskable_icon_x192.png",
+                "type": "image/png",
+                "sizes": "192x192",
+                "purpose": "maskable",
+            },
+            {
+                "src": "/static/images/maskable_icon_x512.png",
+                "type": "image/png",
+                "sizes": "512x512",
+                "purpose": "maskable",
+            },
+            {
+                "src": "/static/images/maskable_icon.png",
+                "type": "image/png",
+                "sizes": "1024x1024",
+                "purpose": "maskable",
+            },
+        ],
+        "screenshots": [
+            {
+                "src": "/static/images/screenshot_desktop.png",
+                "sizes": "2394x1314",
+                "type": "image/png",
+                "form_factor": "wide",
+                "label": "LNbits - Desktop screenshot",
+            },
+            {
+                "src": "/static/images/screenshot_phone.png",
+                "sizes": "1080x1739",
+                "type": "image/png",
+                "form_factor": "narrow",
+                "label": "LNbits - Phone screenshot",
+            },
        ],
        "start_url": f"/wallet?usr={usr}&wal={user.wallets[0].id}",
        "background_color": "#1F2234",
@@ -390,24 +321,70 @@ async def manifest(usr: str):
                "short_name": wallet.name,
                "description": wallet.name,
                "url": f"/wallet?usr={usr}&wal={wallet.id}",
+                "icons": [
+                    {
+                        "src": "/static/images/maskable_icon_x96.png",
+                        "sizes": "96x96",
+                        "type": "image/png",
+                    }
+                ],
            }
            for wallet in user.wallets
        ],
+        "url_handlers": [{"origin": f"https://{host}"}],
    }


-@core_html_routes.get("/admin", response_class=HTMLResponse)
-async def index(request: Request, user: User = Depends(check_admin)):
+@generic_router.get("/node", response_class=HTMLResponse)
+async def node(request: Request, user: User = Depends(check_admin)):
+    if not settings.lnbits_node_ui:
+        raise HTTPException(status_code=HTTPStatus.SERVICE_UNAVAILABLE)
+
+    funding_source = get_funding_source()
+    _, balance = await funding_source.status()
+
+    return template_renderer().TemplateResponse(
+        request,
+        "node/index.html",
+        {
+            "user": user.dict(),
+            "settings": settings.dict(),
+            "balance": balance,
+            "wallets": user.wallets[0].dict(),
+        },
+    )
+
+
+@generic_router.get("/node/public", response_class=HTMLResponse)
+async def node_public(request: Request):
+    if not settings.lnbits_public_node_ui:
+        raise HTTPException(status_code=HTTPStatus.SERVICE_UNAVAILABLE)
+
+    funding_source = get_funding_source()
+    _, balance = await funding_source.status()
+
+    return template_renderer().TemplateResponse(
+        request,
+        "node/public.html",
+        {
+            "settings": settings.dict(),
+            "balance": balance,
+        },
+    )
+
+
+@generic_router.get("/admin", response_class=HTMLResponse)
+async def admin_index(request: Request, user: User = Depends(check_admin)):
    if not settings.lnbits_admin_ui:
        raise HTTPException(status_code=HTTPStatus.NOT_FOUND)

-    WALLET = get_wallet_class()
-    _, balance = await WALLET.status()
+    funding_source = get_funding_source()
+    _, balance = await funding_source.status()

    return template_renderer().TemplateResponse(
+        request,
        "admin/index.html",
        {
-            "request": request,
            "user": user.dict(),
            "settings": settings.dict(),
            "balance": balance,
@@ -416,13 +393,31 @@ async def index(request: Request, user: User = Depends(check_admin)):
    )


-@core_html_routes.get("/uuidv4/{hex_value}")
+@generic_router.get("/users", response_class=HTMLResponse)
+async def users_index(request: Request, user: User = Depends(check_admin)):
+    if not settings.lnbits_admin_ui:
+        raise HTTPException(status_code=HTTPStatus.NOT_FOUND)
+
+    return template_renderer().TemplateResponse(
+        "users/index.html",
+        {
+            "request": request,
+            "user": user.dict(),
+            "settings": settings.dict(),
+            "currencies": list(currencies.keys()),
+        },
+    )
+
+
+@generic_router.get("/uuidv4/{hex_value}")
 async def hex_to_uuid4(hex_value: str):
    try:
        user_id = to_valid_user_id(hex_value).hex
        return RedirectResponse(url=f"/wallet?usr={user_id}")
-    except Exception as e:
-        raise HTTPException(status_code=HTTPStatus.BAD_REQUEST, detail=str(e))
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST, detail=str(exc)
+        ) from exc


 async def toggle_extension(extension_to_enable, extension_to_disable, user_id):
@@ -0,0 +1,201 @@
+from http import HTTPStatus
+from typing import List, Optional
+
+import httpx
+from fastapi import APIRouter, Body, Depends, HTTPException
+from pydantic import BaseModel
+from starlette.status import HTTP_503_SERVICE_UNAVAILABLE
+
+from lnbits.decorators import check_admin, check_super_user, parse_filters
+from lnbits.nodes import get_node_class
+from lnbits.settings import settings
+
+from ...db import Filters, Page
+from ...nodes.base import (
+    ChannelPoint,
+    Node,
+    NodeChannel,
+    NodeInfoResponse,
+    NodeInvoice,
+    NodeInvoiceFilters,
+    NodePayment,
+    NodePaymentsFilters,
+    NodePeerInfo,
+    PublicNodeInfo,
+)
+from ...utils.cache import cache
+
+
+def require_node():
+    node_class = get_node_class()
+    if not node_class:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_IMPLEMENTED,
+            detail="Active backend does not implement Node API",
+        )
+    if not settings.lnbits_node_ui:
+        raise HTTPException(
+            status_code=HTTPStatus.SERVICE_UNAVAILABLE,
+            detail="Not enabled",
+        )
+    return node_class
+
+
+def check_public():
+    if not (settings.lnbits_node_ui and settings.lnbits_public_node_ui):
+        raise HTTPException(
+            status_code=HTTPStatus.SERVICE_UNAVAILABLE,
+            detail="Not enabled",
+        )
+
+
+node_router = APIRouter(
+    tags=["Node Managment"],
+    prefix="/node/api/v1",
+    dependencies=[Depends(check_admin)],
+)
+super_node_router = APIRouter(
+    tags=["Node Managment"],
+    prefix="/node/api/v1",
+    dependencies=[Depends(check_super_user)],
+)
+public_node_router = APIRouter(
+    tags=["Node Managment"],
+    prefix="/node/public/api/v1",
+    dependencies=[Depends(check_public)],
+)
+
+
+@node_router.get(
+    "/ok",
+    description="Check if node api can be enabled",
+    status_code=200,
+    dependencies=[Depends(require_node)],
+)
+async def api_get_ok():
+    pass
+
+
+@public_node_router.get("/info", response_model=PublicNodeInfo)
+async def api_get_public_info(node: Node = Depends(require_node)) -> PublicNodeInfo:
+    return await cache.save_result(node.get_public_info, key="node:public_info")
+
+
+@node_router.get("/info")
+async def api_get_info(
+    node: Node = Depends(require_node),
+) -> Optional[NodeInfoResponse]:
+    return await node.get_info()
+
+
+@node_router.get("/channels")
+async def api_get_channels(
+    node: Node = Depends(require_node),
+) -> Optional[List[NodeChannel]]:
+    return await node.get_channels()
+
+
+@super_node_router.post("/channels", response_model=ChannelPoint)
+async def api_create_channel(
+    node: Node = Depends(require_node),
+    peer_id: str = Body(),
+    funding_amount: int = Body(),
+    push_amount: Optional[int] = Body(None),
+    fee_rate: Optional[int] = Body(None),
+):
+    return await node.open_channel(peer_id, funding_amount, push_amount, fee_rate)
+
+
+@super_node_router.delete("/channels")
+async def api_delete_channel(
+    short_id: Optional[str],
+    funding_txid: Optional[str],
+    output_index: Optional[int],
+    force: bool = False,
+    node: Node = Depends(require_node),
+) -> Optional[List[NodeChannel]]:
+    return await node.close_channel(
+        short_id,
+        (
+            ChannelPoint(funding_txid=funding_txid, output_index=output_index)
+            if funding_txid is not None and output_index is not None
+            else None
+        ),
+        force,
+    )
+
+
+@node_router.get("/payments", response_model=Page[NodePayment])
+async def api_get_payments(
+    node: Node = Depends(require_node),
+    filters: Filters = Depends(parse_filters(NodePaymentsFilters)),
+) -> Optional[Page[NodePayment]]:
+    if not settings.lnbits_node_ui_transactions:
+        raise HTTPException(
+            HTTP_503_SERVICE_UNAVAILABLE,
+            detail="You can enable node transactions in the Admin UI",
+        )
+    return await node.get_payments(filters)
+
+
+@node_router.get("/invoices", response_model=Page[NodeInvoice])
+async def api_get_invoices(
+    node: Node = Depends(require_node),
+    filters: Filters = Depends(parse_filters(NodeInvoiceFilters)),
+) -> Optional[Page[NodeInvoice]]:
+    if not settings.lnbits_node_ui_transactions:
+        raise HTTPException(
+            HTTP_503_SERVICE_UNAVAILABLE,
+            detail="You can enable node transactions in the Admin UI",
+        )
+    return await node.get_invoices(filters)
+
+
+@node_router.get("/peers", response_model=List[NodePeerInfo])
+async def api_get_peers(node: Node = Depends(require_node)) -> List[NodePeerInfo]:
+    return await node.get_peers()
+
+
+@super_node_router.post("/peers")
+async def api_connect_peer(
+    uri: str = Body(embed=True), node: Node = Depends(require_node)
+):
+    return await node.connect_peer(uri)
+
+
+@super_node_router.delete("/peers/{peer_id}")
+async def api_disconnect_peer(peer_id: str, node: Node = Depends(require_node)):
+    return await node.disconnect_peer(peer_id)
+
+
+class NodeRank(BaseModel):
+    capacity: Optional[int]
+    channelcount: Optional[int]
+    age: Optional[int]
+    growth: Optional[int]
+    availability: Optional[int]
+
+
+# Same for public and private api
+@node_router.get(
+    "/rank",
+    description="Retrieve node ranks from https://1ml.com",
+    response_model=Optional[NodeRank],
+)
+@public_node_router.get(
+    "/rank",
+    description="Retrieve node ranks from https://1ml.com",
+    response_model=Optional[NodeRank],
+)
+async def api_get_1ml_stats(node: Node = Depends(require_node)) -> Optional[NodeRank]:
+    node_id = await node.get_id()
+    headers = {"User-Agent": settings.user_agent}
+    async with httpx.AsyncClient(headers=headers) as client:
+        r = await client.get(url=f"https://1ml.com/node/{node_id}/json", timeout=15)
+        try:
+            r.raise_for_status()
+            return r.json()["noderank"]
+        except httpx.HTTPStatusError as exc:
+            raise HTTPException(
+                status_code=404, detail="Node not found on 1ml.com"
+            ) from exc
@@ -0,0 +1,449 @@
+import asyncio
+import json
+import uuid
+from http import HTTPStatus
+from math import ceil
+from typing import List, Optional, Union
+from urllib.parse import urlparse
+
+import httpx
+from fastapi import (
+    APIRouter,
+    Body,
+    Depends,
+    Header,
+    HTTPException,
+    Query,
+    Request,
+)
+from fastapi.responses import JSONResponse
+from loguru import logger
+from sse_starlette.sse import EventSourceResponse
+
+from lnbits import bolt11
+from lnbits.core.db import db
+from lnbits.core.models import (
+    CreateInvoice,
+    CreateLnurl,
+    DecodePayment,
+    KeyType,
+    Payment,
+    PaymentFilters,
+    PaymentHistoryPoint,
+    Wallet,
+)
+from lnbits.db import Filters, Page
+from lnbits.decorators import (
+    WalletTypeInfo,
+    get_key_type,
+    parse_filters,
+    require_admin_key,
+    require_invoice_key,
+)
+from lnbits.helpers import generate_filter_params_openapi
+from lnbits.lnurl import decode as lnurl_decode
+from lnbits.settings import settings
+from lnbits.utils.exchange_rates import fiat_amount_as_satoshis
+
+from ..crud import (
+    DateTrunc,
+    get_payments,
+    get_payments_history,
+    get_payments_paginated,
+    get_standalone_payment,
+    get_wallet_for_key,
+    update_pending_payments,
+)
+from ..services import (
+    check_transaction_status,
+    create_invoice,
+    fee_reserve_total,
+    pay_invoice,
+)
+from ..tasks import api_invoice_listeners
+
+payment_router = APIRouter(prefix="/api/v1/payments", tags=["Payments"])
+
+
+@payment_router.get(
+    "",
+    name="Payment List",
+    summary="get list of payments",
+    response_description="list of payments",
+    response_model=List[Payment],
+    openapi_extra=generate_filter_params_openapi(PaymentFilters),
+)
+async def api_payments(
+    wallet: WalletTypeInfo = Depends(get_key_type),
+    filters: Filters = Depends(parse_filters(PaymentFilters)),
+):
+    await update_pending_payments(wallet.wallet.id)
+    return await get_payments(
+        wallet_id=wallet.wallet.id,
+        pending=True,
+        complete=True,
+        filters=filters,
+    )
+
+
+@payment_router.get(
+    "/history",
+    name="Get payments history",
+    response_model=List[PaymentHistoryPoint],
+    openapi_extra=generate_filter_params_openapi(PaymentFilters),
+)
+async def api_payments_history(
+    wallet: WalletTypeInfo = Depends(get_key_type),
+    group: DateTrunc = Query("day"),
+    filters: Filters[PaymentFilters] = Depends(parse_filters(PaymentFilters)),
+):
+    await update_pending_payments(wallet.wallet.id)
+    return await get_payments_history(wallet.wallet.id, group, filters)
+
+
+@payment_router.get(
+    "/paginated",
+    name="Payment List",
+    summary="get paginated list of payments",
+    response_description="list of payments",
+    response_model=Page[Payment],
+    openapi_extra=generate_filter_params_openapi(PaymentFilters),
+)
+async def api_payments_paginated(
+    wallet: WalletTypeInfo = Depends(get_key_type),
+    filters: Filters = Depends(parse_filters(PaymentFilters)),
+):
+    await update_pending_payments(wallet.wallet.id)
+    page = await get_payments_paginated(
+        wallet_id=wallet.wallet.id,
+        pending=True,
+        complete=True,
+        filters=filters,
+    )
+    return page
+
+
+async def api_payments_create_invoice(data: CreateInvoice, wallet: Wallet):
+    description_hash = b""
+    unhashed_description = b""
+    memo = data.memo or settings.lnbits_site_title
+    if data.description_hash or data.unhashed_description:
+        if data.description_hash:
+            try:
+                description_hash = bytes.fromhex(data.description_hash)
+            except ValueError as exc:
+                raise HTTPException(
+                    status_code=HTTPStatus.BAD_REQUEST,
+                    detail="'description_hash' must be a valid hex string",
+                ) from exc
+        if data.unhashed_description:
+            try:
+                unhashed_description = bytes.fromhex(data.unhashed_description)
+            except ValueError as exc:
+                raise HTTPException(
+                    status_code=HTTPStatus.BAD_REQUEST,
+                    detail="'unhashed_description' must be a valid hex string",
+                ) from exc
+        # do not save memo if description_hash or unhashed_description is set
+        memo = ""
+
+    async with db.connect() as conn:
+        payment_hash, payment_request = await create_invoice(
+            wallet_id=wallet.id,
+            amount=data.amount,
+            memo=memo,
+            currency=data.unit,
+            description_hash=description_hash,
+            unhashed_description=unhashed_description,
+            expiry=data.expiry,
+            extra=data.extra,
+            webhook=data.webhook,
+            internal=data.internal,
+            conn=conn,
+        )
+        # NOTE: we get the checking_id with a seperate query because create_invoice
+        # does not return it and it would be a big hustle to change its return type
+        # (used across extensions)
+        payment_db = await get_standalone_payment(payment_hash, conn=conn)
+        assert payment_db is not None, "payment not found"
+        checking_id = payment_db.checking_id
+
+    invoice = bolt11.decode(payment_request)
+
+    lnurl_response: Union[None, bool, str] = None
+    if data.lnurl_callback:
+        headers = {"User-Agent": settings.user_agent}
+        async with httpx.AsyncClient(headers=headers) as client:
+            try:
+                r = await client.get(
+                    data.lnurl_callback,
+                    params={
+                        "pr": payment_request,
+                    },
+                    timeout=10,
+                )
+                if r.is_error:
+                    lnurl_response = r.text
+                else:
+                    resp = json.loads(r.text)
+                    if resp["status"] != "OK":
+                        lnurl_response = resp["reason"]
+                    else:
+                        lnurl_response = True
+            except (httpx.ConnectError, httpx.RequestError) as ex:
+                logger.error(ex)
+                lnurl_response = False
+
+    return {
+        "payment_hash": invoice.payment_hash,
+        "payment_request": payment_request,
+        "lnurl_response": lnurl_response,
+        # maintain backwards compatibility with API clients:
+        "checking_id": checking_id,
+    }
+
+
+@payment_router.post(
+    "",
+    summary="Create or pay an invoice",
+    description="""
+        This endpoint can be used both to generate and pay a BOLT11 invoice.
+        To generate a new invoice for receiving funds into the authorized account,
+        specify at least the first four fields in the POST body: `out: false`,
+        `amount`, `unit`, and `memo`. To pay an arbitrary invoice from the funds
+        already in the authorized account, specify `out: true` and use the `bolt11`
+        field to supply the BOLT11 invoice to be paid.
+    """,
+    status_code=HTTPStatus.CREATED,
+    responses={
+        400: {"description": "Invalid BOLT11 string or missing fields."},
+        401: {"description": "Invoice (or Admin) key required."},
+        520: {"description": "Payment or Invoice error."},
+    },
+)
+async def api_payments_create(
+    wallet: WalletTypeInfo = Depends(require_invoice_key),
+    invoice_data: CreateInvoice = Body(...),
+):
+    if invoice_data.out is True and wallet.key_type == KeyType.admin:
+        if not invoice_data.bolt11:
+            raise HTTPException(
+                status_code=HTTPStatus.BAD_REQUEST,
+                detail="BOLT11 string is invalid or not given",
+            )
+
+        payment_hash = await pay_invoice(
+            wallet_id=wallet.wallet.id,
+            payment_request=invoice_data.bolt11,
+            extra=invoice_data.extra,
+        )
+        return {
+            "payment_hash": payment_hash,
+            # maintain backwards compatibility with API clients:
+            "checking_id": payment_hash,
+        }
+
+    elif not invoice_data.out:
+        # invoice key
+        return await api_payments_create_invoice(invoice_data, wallet.wallet)
+    else:
+        raise HTTPException(
+            status_code=HTTPStatus.UNAUTHORIZED,
+            detail="Invoice (or Admin) key required.",
+        )
+
+
+@payment_router.get("/fee-reserve")
+async def api_payments_fee_reserve(invoice: str = Query("invoice")) -> JSONResponse:
+    invoice_obj = bolt11.decode(invoice)
+    if invoice_obj.amount_msat:
+        response = {
+            "fee_reserve": fee_reserve_total(invoice_obj.amount_msat),
+        }
+        return JSONResponse(response)
+    else:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Invoice has no amount.",
+        )
+
+
+@payment_router.post("/lnurl")
+async def api_payments_pay_lnurl(
+    data: CreateLnurl, wallet: WalletTypeInfo = Depends(require_admin_key)
+):
+    domain = urlparse(data.callback).netloc
+
+    headers = {"User-Agent": settings.user_agent}
+    async with httpx.AsyncClient(headers=headers, follow_redirects=True) as client:
+        try:
+            if data.unit and data.unit != "sat":
+                amount_msat = await fiat_amount_as_satoshis(data.amount, data.unit)
+                # no msat precision
+                amount_msat = ceil(amount_msat // 1000) * 1000
+            else:
+                amount_msat = data.amount
+            r = await client.get(
+                data.callback,
+                params={"amount": amount_msat, "comment": data.comment},
+                timeout=40,
+            )
+            if r.is_error:
+                raise httpx.ConnectError("LNURL callback connection error")
+            r.raise_for_status()
+        except (httpx.ConnectError, httpx.RequestError) as exc:
+            raise HTTPException(
+                status_code=HTTPStatus.BAD_REQUEST,
+                detail=f"Failed to connect to {domain}.",
+            ) from exc
+
+    params = json.loads(r.text)
+    if params.get("status") == "ERROR":
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail=f"{domain} said: '{params.get('reason', '')}'",
+        )
+
+    if not params.get("pr"):
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail=f"{domain} did not return a payment request.",
+        )
+
+    invoice = bolt11.decode(params["pr"])
+    if invoice.amount_msat != amount_msat:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail=(
+                (
+                    f"{domain} returned an invalid invoice. Expected"
+                    f" {amount_msat} msat, got {invoice.amount_msat}."
+                ),
+            ),
+        )
+
+    extra = {}
+
+    if params.get("successAction"):
+        extra["success_action"] = params["successAction"]
+    if data.comment:
+        extra["comment"] = data.comment
+    if data.unit and data.unit != "sat":
+        extra["fiat_currency"] = data.unit
+        extra["fiat_amount"] = data.amount / 1000
+    assert data.description is not None, "description is required"
+    payment_hash = await pay_invoice(
+        wallet_id=wallet.wallet.id,
+        payment_request=params["pr"],
+        description=data.description,
+        extra=extra,
+    )
+
+    return {
+        "success_action": params.get("successAction"),
+        "payment_hash": payment_hash,
+        # maintain backwards compatibility with API clients:
+        "checking_id": payment_hash,
+    }
+
+
+async def subscribe_wallet_invoices(request: Request, wallet: Wallet):
+    """
+    Subscribe to new invoices for a wallet. Can be wrapped in EventSourceResponse.
+    Listenes invoming payments for a wallet and yields jsons with payment details.
+    """
+    this_wallet_id = wallet.id
+
+    payment_queue: asyncio.Queue[Payment] = asyncio.Queue(0)
+
+    uid = f"{this_wallet_id}_{str(uuid.uuid4())[:8]}"
+    logger.debug(f"adding sse listener for wallet: {uid}")
+    api_invoice_listeners[uid] = payment_queue
+
+    try:
+        while settings.lnbits_running:
+            if await request.is_disconnected():
+                await request.close()
+                break
+            payment: Payment = await payment_queue.get()
+            if payment.wallet_id == this_wallet_id:
+                logger.debug("sse listener: payment received", payment)
+                yield {"data": payment.json(), "event": "payment-received"}
+    except asyncio.CancelledError:
+        logger.debug(f"removing listener for wallet {uid}")
+    except Exception as exc:
+        logger.error(f"Error in sse: {exc}")
+    finally:
+        api_invoice_listeners.pop(uid)
+
+
+@payment_router.get("/sse")
+async def api_payments_sse(
+    request: Request, wallet: WalletTypeInfo = Depends(get_key_type)
+):
+    return EventSourceResponse(
+        subscribe_wallet_invoices(request, wallet.wallet),
+        ping=20,
+        media_type="text/event-stream",
+    )
+
+
+# TODO: refactor this route into a public and admin one
+@payment_router.get("/{payment_hash}")
+async def api_payment(payment_hash, x_api_key: Optional[str] = Header(None)):
+    # We use X_Api_Key here because we want this call to work with and without keys
+    # If a valid key is given, we also return the field "details", otherwise not
+    wallet = await get_wallet_for_key(x_api_key) if isinstance(x_api_key, str) else None
+
+    payment = await get_standalone_payment(
+        payment_hash, wallet_id=wallet.id if wallet else None
+    )
+    if payment is None:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="Payment does not exist."
+        )
+    await check_transaction_status(payment.wallet_id, payment_hash)
+    payment = await get_standalone_payment(
+        payment_hash, wallet_id=wallet.id if wallet else None
+    )
+    if not payment:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="Payment does not exist."
+        )
+    elif not payment.pending:
+        if wallet and wallet.id == payment.wallet_id:
+            return {"paid": True, "preimage": payment.preimage, "details": payment}
+        return {"paid": True, "preimage": payment.preimage}
+
+    try:
+        status = await payment.check_status()
+    except Exception:
+        if wallet and wallet.id == payment.wallet_id:
+            return {"paid": False, "details": payment}
+        return {"paid": False}
+
+    if wallet and wallet.id == payment.wallet_id:
+        return {
+            "paid": not payment.pending,
+            "status": f"{status!s}",
+            "preimage": payment.preimage,
+            "details": payment,
+        }
+    return {"paid": not payment.pending, "preimage": payment.preimage}
+
+
+@payment_router.post("/decode", status_code=HTTPStatus.OK)
+async def api_payments_decode(data: DecodePayment) -> JSONResponse:
+    payment_str = data.data
+    try:
+        if payment_str[:5] == "LNURL":
+            url = str(lnurl_decode(payment_str))
+            return JSONResponse({"domain": url})
+        else:
+            invoice = bolt11.decode(payment_str)
+            return JSONResponse(invoice.data)
+    except Exception as exc:
+        return JSONResponse(
+            {"message": f"Failed to decode: {exc!s}"},
+            status_code=HTTPStatus.BAD_REQUEST,
+        )
@@ -1,18 +1,18 @@
 import asyncio
-import datetime
 from http import HTTPStatus

-from fastapi import HTTPException
+from fastapi import APIRouter, HTTPException
 from loguru import logger

 from lnbits import bolt11

-from .. import core_app
 from ..crud import get_standalone_payment
 from ..tasks import api_invoice_listeners

+public_router = APIRouter(tags=["Core"])

-@core_app.get("/public/v1/payment/{payment_hash}")
+
+@public_router.get("/public/v1/payment/{payment_hash}")
 async def api_public_payment_longpolling(payment_hash):
    payment = await get_standalone_payment(payment_hash)

@@ -25,13 +25,12 @@ async def api_public_payment_longpolling(payment_hash):

    try:
        invoice = bolt11.decode(payment.bolt11)
-        expiration = datetime.datetime.fromtimestamp(invoice.date + invoice.expiry)
-        if expiration < datetime.datetime.now():
+        if invoice.has_expired():
            return {"status": "expired"}
-    except Exception:
+    except Exception as exc:
        raise HTTPException(
            status_code=HTTPStatus.BAD_REQUEST, detail="Invalid bolt11 invoice."
-        )
+        ) from exc

    payment_queue = asyncio.Queue(0)

@@ -51,7 +50,7 @@ async def api_public_payment_longpolling(payment_hash):
        cancel_scope.cancel()

    cancel_scope = asyncio.create_task(payment_info_receiver())
-    asyncio.create_task(timeouter(cancel_scope))
+    asyncio.create_task(timeouter(cancel_scope))  # noqa: RUF006

    if response:
        return response
@@ -0,0 +1,105 @@
+from http import HTTPStatus
+
+from fastapi import (
+    APIRouter,
+    Depends,
+    HTTPException,
+)
+from starlette.responses import RedirectResponse
+
+from lnbits.decorators import (
+    WalletTypeInfo,
+    require_admin_key,
+    require_invoice_key,
+)
+
+from ..crud import (
+    create_tinyurl,
+    delete_tinyurl,
+    get_tinyurl,
+    get_tinyurl_by_url,
+)
+
+tinyurl_router = APIRouter(tags=["Tinyurl"])
+
+
+@tinyurl_router.post(
+    "/api/v1/tinyurl",
+    name="Tinyurl",
+    description="creates a tinyurl",
+)
+async def api_create_tinyurl(
+    url: str, endless: bool = False, wallet: WalletTypeInfo = Depends(require_admin_key)
+):
+    tinyurls = await get_tinyurl_by_url(url)
+    try:
+        for tinyurl in tinyurls:
+            if tinyurl:
+                if tinyurl.wallet == wallet.wallet.id:
+                    return tinyurl
+        return await create_tinyurl(url, endless, wallet.wallet.id)
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST, detail="Unable to create tinyurl"
+        ) from exc
+
+
+@tinyurl_router.get(
+    "/api/v1/tinyurl/{tinyurl_id}",
+    name="Tinyurl",
+    description="get a tinyurl by id",
+)
+async def api_get_tinyurl(
+    tinyurl_id: str, wallet: WalletTypeInfo = Depends(require_invoice_key)
+):
+    try:
+        tinyurl = await get_tinyurl(tinyurl_id)
+        if tinyurl:
+            if tinyurl.wallet == wallet.wallet.id:
+                return tinyurl
+        raise HTTPException(
+            status_code=HTTPStatus.FORBIDDEN, detail="Wrong key provided."
+        )
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="Unable to fetch tinyurl"
+        ) from exc
+
+
+@tinyurl_router.delete(
+    "/api/v1/tinyurl/{tinyurl_id}",
+    name="Tinyurl",
+    description="delete a tinyurl by id",
+)
+async def api_delete_tinyurl(
+    tinyurl_id: str, wallet: WalletTypeInfo = Depends(require_admin_key)
+):
+    try:
+        tinyurl = await get_tinyurl(tinyurl_id)
+        if tinyurl:
+            if tinyurl.wallet == wallet.wallet.id:
+                await delete_tinyurl(tinyurl_id)
+                return {"deleted": True}
+        raise HTTPException(
+            status_code=HTTPStatus.FORBIDDEN, detail="Wrong key provided."
+        )
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST, detail="Unable to delete"
+        ) from exc
+
+
+@tinyurl_router.get(
+    "/t/{tinyurl_id}",
+    name="Tinyurl",
+    description="redirects a tinyurl by id",
+)
+async def api_tinyurl(tinyurl_id: str):
+    tinyurl = await get_tinyurl(tinyurl_id)
+    if tinyurl:
+        response = RedirectResponse(url=tinyurl.url)
+        return response
+    else:
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND, detail="unable to find tinyurl"
+        )
@@ -0,0 +1,159 @@
+from http import HTTPStatus
+from typing import List
+
+from fastapi import APIRouter, Depends
+from starlette.exceptions import HTTPException
+
+from lnbits.core.crud import (
+    delete_account,
+    delete_wallet,
+    force_delete_wallet,
+    get_accounts,
+    get_wallet,
+    get_wallets,
+    update_admin_settings,
+)
+from lnbits.core.models import (
+    Account,
+    AccountFilters,
+    CreateTopup,
+    User,
+    Wallet,
+)
+from lnbits.core.services import update_wallet_balance
+from lnbits.db import Filters, Page
+from lnbits.decorators import check_admin, check_super_user, parse_filters
+from lnbits.helpers import generate_filter_params_openapi
+from lnbits.settings import EditableSettings, settings
+
+users_router = APIRouter(prefix="/users/api/v1", dependencies=[Depends(check_admin)])
+
+
+@users_router.get(
+    "/user",
+    name="get accounts",
+    summary="Get paginated list of accounts",
+    openapi_extra=generate_filter_params_openapi(AccountFilters),
+)
+async def api_get_users(
+    filters: Filters = Depends(parse_filters(AccountFilters)),
+) -> Page[Account]:
+    try:
+        filtered = await get_accounts(filters=filters)
+        for user in filtered.data:
+            user.is_super_user = user.id == settings.super_user
+            user.is_admin = user.id in settings.lnbits_admin_users or user.is_super_user
+        return filtered
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"Could not fetch users. {exc!s}",
+        ) from exc
+
+
+@users_router.delete("/user/{user_id}", status_code=HTTPStatus.OK)
+async def api_users_delete_user(
+    user_id: str, user: User = Depends(check_admin)
+) -> None:
+
+    try:
+        wallets = await get_wallets(user_id)
+        if len(wallets) > 0:
+            raise Exception("Cannot delete user with wallets.")
+        if user_id == settings.super_user:
+            raise Exception("Cannot delete super user.")
+
+        if user_id in settings.lnbits_admin_users and not user.super_user:
+            raise Exception("Only super_user can delete admin user.")
+
+        await delete_account(user_id)
+
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"{exc!s}",
+        ) from exc
+
+
+@users_router.get("/user/{user_id}/admin", dependencies=[Depends(check_super_user)])
+async def api_users_toggle_admin(user_id: str) -> None:
+    try:
+        if user_id == settings.super_user:
+            raise Exception("Cannot change super user.")
+        if user_id in settings.lnbits_admin_users:
+            settings.lnbits_admin_users.remove(user_id)
+        else:
+            settings.lnbits_admin_users.append(user_id)
+            update_settings = EditableSettings(
+                lnbits_admin_users=settings.lnbits_admin_users
+            )
+            await update_admin_settings(update_settings)
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"Could not update admin settings. {exc}",
+        ) from exc
+
+
+@users_router.get("/user/{user_id}/wallet")
+async def api_users_get_user_wallet(user_id: str) -> List[Wallet]:
+    try:
+        return await get_wallets(user_id)
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"Could not fetch user wallets. {exc}",
+        ) from exc
+
+
+@users_router.get("/user/{user_id}/wallet/{wallet}/undelete")
+async def api_users_undelete_user_wallet(user_id: str, wallet: str) -> None:
+    try:
+        wal = await get_wallet(wallet)
+        if not wal:
+            raise Exception("Wallet does not exist.")
+        if user_id != wal.user:
+            raise Exception("Wallet does not belong to user.")
+        if wal.deleted:
+            await delete_wallet(user_id=user_id, wallet_id=wallet, deleted=False)
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"{exc!s}",
+        ) from exc
+
+
+@users_router.delete("/user/{user_id}/wallet/{wallet}")
+async def api_users_delete_user_wallet(user_id: str, wallet: str) -> None:
+    try:
+        wal = await get_wallet(wallet)
+        if not wal:
+            raise Exception("Wallet does not exist.")
+        if wal.deleted:
+            await force_delete_wallet(wallet)
+        await delete_wallet(user_id=user_id, wallet_id=wallet)
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"{exc!s}",
+        ) from exc
+
+
+@users_router.put(
+    "/topup",
+    name="Topup",
+    status_code=HTTPStatus.OK,
+    dependencies=[Depends(check_super_user)],
+)
+async def api_topup_balance(data: CreateTopup) -> dict[str, str]:
+    try:
+        await get_wallet(data.id)
+        if settings.lnbits_backend_wallet_class == "VoidWallet":
+            raise Exception("VoidWallet active")
+
+        await update_wallet_balance(wallet_id=data.id, amount=int(data.amount))
+        return {"status": "Success"}
+    except Exception as exc:
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail=f"{exc!s}"
+        ) from exc
@@ -0,0 +1,77 @@
+from typing import Optional
+
+from fastapi import (
+    APIRouter,
+    Body,
+    Depends,
+)
+
+from lnbits.core.models import (
+    CreateWallet,
+    KeyType,
+    Wallet,
+)
+from lnbits.decorators import (
+    WalletTypeInfo,
+    get_key_type,
+    require_admin_key,
+)
+
+from ..crud import (
+    create_wallet,
+    delete_wallet,
+    update_wallet,
+)
+
+wallet_router = APIRouter(prefix="/api/v1/wallet", tags=["Wallet"])
+
+
+@wallet_router.get("")
+async def api_wallet(wallet: WalletTypeInfo = Depends(get_key_type)):
+    if wallet.key_type == KeyType.admin:
+        return {
+            "id": wallet.wallet.id,
+            "name": wallet.wallet.name,
+            "balance": wallet.wallet.balance_msat,
+        }
+    else:
+        return {"name": wallet.wallet.name, "balance": wallet.wallet.balance_msat}
+
+
+@wallet_router.put("/{new_name}")
+async def api_update_wallet_name(
+    new_name: str, wallet: WalletTypeInfo = Depends(require_admin_key)
+):
+    await update_wallet(wallet.wallet.id, new_name)
+    return {
+        "id": wallet.wallet.id,
+        "name": wallet.wallet.name,
+        "balance": wallet.wallet.balance_msat,
+    }
+
+
+@wallet_router.patch("", response_model=Wallet)
+async def api_update_wallet(
+    name: Optional[str] = Body(None),
+    currency: Optional[str] = Body(None),
+    wallet: WalletTypeInfo = Depends(require_admin_key),
+):
+    return await update_wallet(wallet.wallet.id, name, currency)
+
+
+@wallet_router.delete("")
+async def api_delete_wallet(
+    wallet: WalletTypeInfo = Depends(require_admin_key),
+) -> None:
+    await delete_wallet(
+        user_id=wallet.wallet.user,
+        wallet_id=wallet.wallet.id,
+    )
+
+
+@wallet_router.post("", response_model=Wallet)
+async def api_create_wallet(
+    data: CreateWallet,
+    wallet: WalletTypeInfo = Depends(require_admin_key),
+) -> Wallet:
+    return await create_wallet(user_id=wallet.wallet.user, wallet_name=data.name)
@@ -0,0 +1,60 @@
+import base64
+import json
+from http import HTTPStatus
+from urllib.parse import unquote, urlparse
+
+from fastapi import (
+    APIRouter,
+    Depends,
+    Request,
+)
+
+from lnbits.core.models import (
+    CreateWebPushSubscription,
+    WebPushSubscription,
+)
+from lnbits.decorators import (
+    WalletTypeInfo,
+    require_admin_key,
+)
+
+from ..crud import (
+    create_webpush_subscription,
+    delete_webpush_subscription,
+    get_webpush_subscription,
+)
+
+webpush_router = APIRouter(prefix="/api/v1/webpush", tags=["Webpush"])
+
+
+@webpush_router.post("", status_code=HTTPStatus.CREATED)
+async def api_create_webpush_subscription(
+    request: Request,
+    data: CreateWebPushSubscription,
+    wallet: WalletTypeInfo = Depends(require_admin_key),
+) -> WebPushSubscription:
+    subscription = json.loads(data.subscription)
+    endpoint = subscription["endpoint"]
+    host = urlparse(str(request.url)).netloc
+
+    subscription = await get_webpush_subscription(endpoint, wallet.wallet.user)
+    if subscription:
+        return subscription
+    else:
+        return await create_webpush_subscription(
+            endpoint,
+            wallet.wallet.user,
+            data.subscription,
+            host,
+        )
+
+
+@webpush_router.delete("", status_code=HTTPStatus.OK)
+async def api_delete_webpush_subscription(
+    request: Request,
+    wallet: WalletTypeInfo = Depends(require_admin_key),
+):
+    endpoint = unquote(
+        base64.b64decode(str(request.query_params.get("endpoint"))).decode("utf-8")
+    )
+    await delete_webpush_subscription(endpoint, wallet.wallet.user)
@@ -0,0 +1,42 @@
+from fastapi import (
+    APIRouter,
+    WebSocket,
+    WebSocketDisconnect,
+)
+
+from lnbits.settings import settings
+
+from ..services import (
+    websocket_manager,
+    websocket_updater,
+)
+
+websocket_router = APIRouter(prefix="/api/v1/ws", tags=["Websocket"])
+
+
+@websocket_router.websocket("/{item_id}")
+async def websocket_connect(websocket: WebSocket, item_id: str):
+    await websocket_manager.connect(websocket, item_id)
+    try:
+        while settings.lnbits_running:
+            await websocket.receive_text()
+    except WebSocketDisconnect:
+        websocket_manager.disconnect(websocket)
+
+
+@websocket_router.post("/{item_id}")
+async def websocket_update_post(item_id: str, data: str):
+    try:
+        await websocket_updater(item_id, data)
+        return {"sent": True, "data": data}
+    except Exception:
+        return {"sent": False, "data": data}
+
+
+@websocket_router.get("/{item_id}/{data}")
+async def websocket_update_get(item_id: str, data: str):
+    try:
+        await websocket_updater(item_id, data)
+        return {"sent": True, "data": data}
+    except Exception:
+        return {"sent": False, "data": data}
@@ -8,7 +8,7 @@ import time
 from contextlib import asynccontextmanager
 from enum import Enum
 from sqlite3 import Row
-from typing import Any, Generic, List, Literal, Optional, Type, TypeVar
+from typing import Any, Generic, Literal, Optional, TypeVar

 from loguru import logger
 from pydantic import BaseModel, ValidationError, root_validator
@@ -50,13 +50,10 @@ if settings.lnbits_database_url:

    register_type(new_type((1184, 1114), "TIMESTAMP2INT", _parse_timestamp))
 else:
-    if os.path.isdir(settings.lnbits_data_folder):
-        DB_TYPE = SQLITE
-    else:
-        raise NotADirectoryError(
-            f"LNBITS_DATA_FOLDER named {settings.lnbits_data_folder} was not created"
-            f" - please 'mkdir {settings.lnbits_data_folder}' and try again"
-        )
+    if not os.path.isdir(settings.lnbits_data_folder):
+        os.mkdir(settings.lnbits_data_folder)
+        logger.info(f"Created {settings.lnbits_data_folder}")
+    DB_TYPE = SQLITE


 def compat_timestamp_placeholder():
@@ -94,6 +91,12 @@ class Compat:
            return "(strftime('%s', 'now'))"
        return "<nothing>"

+    @property
+    def timestamp_column_default(self) -> str:
+        if self.type in {POSTGRES, COCKROACH}:
+            return self.timestamp_now
+        return "NULL"
+
    @property
    def serial_primary_key(self) -> str:
        if self.type in {POSTGRES, COCKROACH}:
@@ -137,14 +140,14 @@ class Connection(Compat):

    def rewrite_values(self, values):
        # strip html
-        CLEANR = re.compile("<.*?>|&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-f]{1,6});")
+        clean_regex = re.compile("<.*?>|&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-f]{1,6});")

        # tuple to list and back to tuple
        raw_values = [values] if isinstance(values, str) else list(values)
        values = []
        for raw_value in raw_values:
            if isinstance(raw_value, str):
-                values.append(re.sub(CLEANR, "", raw_value))
+                values.append(re.sub(clean_regex, "", raw_value))
            elif isinstance(raw_value, datetime.datetime):
                ts = raw_value.timestamp()
                if self.type == SQLITE:
@@ -172,20 +175,31 @@ class Connection(Compat):
    async def fetch_page(
        self,
        query: str,
-        where: Optional[List[str]] = None,
-        values: Optional[List[str]] = None,
+        where: Optional[list[str]] = None,
+        values: Optional[list[str]] = None,
        filters: Optional[Filters] = None,
-        model: Optional[Type[TRowModel]] = None,
+        model: Optional[type[TRowModel]] = None,
+        group_by: Optional[list[str]] = None,
    ) -> Page[TRowModel]:
        if not filters:
            filters = Filters()
        clause = filters.where(where)
        parsed_values = filters.values(values)

+        group_by_string = ""
+        if group_by:
+            for field in group_by:
+                if not re.fullmatch(
+                    r"[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?", field
+                ):
+                    raise ValueError("Value for GROUP BY is invalid")
+            group_by_string = f"GROUP BY {', '.join(group_by)}"
+
        rows = await self.fetchall(
            f"""
            {query}
            {clause}
+            {group_by_string}
            {filters.order_by()}
            {filters.pagination()}
            """,
@@ -199,6 +213,7 @@ class Connection(Compat):
                    SELECT COUNT(*) FROM (
                        {query}
                        {clause}
+                        {group_by_string}
                    ) as count
                    """,
                    parsed_values,
@@ -239,7 +254,9 @@ class Database(Compat):
        else:
            self.schema = None

-        self.engine = create_engine(database_uri, strategy=ASYNCIO_STRATEGY)
+        self.engine = create_engine(
+            database_uri, strategy=ASYNCIO_STRATEGY, echo=settings.debug_database
+        )
        self.lock = asyncio.Lock()

        logger.trace(f"database {self.type} added for {self.name}")
@@ -281,13 +298,14 @@ class Database(Compat):
    async def fetch_page(
        self,
        query: str,
-        where: Optional[List[str]] = None,
-        values: Optional[List[str]] = None,
+        where: Optional[list[str]] = None,
+        values: Optional[list[str]] = None,
        filters: Optional[Filters] = None,
-        model: Optional[Type[TRowModel]] = None,
+        model: Optional[type[TRowModel]] = None,
+        group_by: Optional[list[str]] = None,
    ) -> Page[TRowModel]:
        async with self.connect() as conn:
-            return await conn.fetch_page(query, where, values, filters, model)
+            return await conn.fetch_page(query, where, values, filters, model, group_by)

    async def execute(self, query: str, values: tuple = ()):
        async with self.connect() as conn:
@@ -352,8 +370,8 @@ class FromRowModel(BaseModel):


 class FilterModel(BaseModel):
-    __search_fields__: List[str] = []
-    __sort_fields__: Optional[List[str]] = None
+    __search_fields__: list[str] = []
+    __sort_fields__: Optional[list[str]] = None


 T = TypeVar("T")
@@ -372,10 +390,10 @@ class Filter(BaseModel, Generic[TFilterModel]):
    op: Operator = Operator.EQ
    values: list[Any]

-    model: Optional[Type[TFilterModel]]
+    model: Optional[type[TFilterModel]]

    @classmethod
-    def parse_query(cls, key: str, raw_values: list[Any], model: Type[TFilterModel]):
+    def parse_query(cls, key: str, raw_values: list[Any], model: type[TFilterModel]):
        # Key format:
        # key[operator]
        # e.g. name[eq]
@@ -425,7 +443,7 @@ class Filters(BaseModel, Generic[TFilterModel]):
    the values can be validated. Otherwise, make sure to validate the inputs manually.
    """

-    filters: List[Filter[TFilterModel]] = []
+    filters: list[Filter[TFilterModel]] = []
    search: Optional[str] = None

    offset: Optional[int] = None
@@ -434,7 +452,7 @@ class Filters(BaseModel, Generic[TFilterModel]):
    sortby: Optional[str] = None
    direction: Optional[Literal["asc", "desc"]] = None

-    model: Optional[Type[TFilterModel]] = None
+    model: Optional[type[TFilterModel]] = None

    @root_validator(pre=True)
    def validate_sortby(cls, values):
@@ -456,12 +474,12 @@ class Filters(BaseModel, Generic[TFilterModel]):
            stmt += f"OFFSET {self.offset}"
        return stmt

-    def where(self, where_stmts: Optional[List[str]] = None) -> str:
+    def where(self, where_stmts: Optional[list[str]] = None) -> str:
        if not where_stmts:
            where_stmts = []
        if self.filters:
-            for filter in self.filters:
-                where_stmts.append(filter.statement)
+            for page_filter in self.filters:
+                where_stmts.append(page_filter.statement)
        if self.search and self.model:
            if DB_TYPE == POSTGRES:
                where_stmts.append(
@@ -480,12 +498,12 @@ class Filters(BaseModel, Generic[TFilterModel]):
            return f"ORDER BY {self.sortby} {self.direction or 'asc'}"
        return ""

-    def values(self, values: Optional[List[str]] = None) -> tuple:
+    def values(self, values: Optional[list[str]] = None) -> tuple:
        if not values:
            values = []
        if self.filters:
-            for filter in self.filters:
-                values.extend(filter.values)
+            for page_filter in self.filters:
+                values.extend(page_filter.values)
        if self.search and self.model:
            values.append(f"%{self.search}%")
        return tuple(values)
@@ -1,107 +1,27 @@
 from http import HTTPStatus
-from typing import Literal, Optional, Type
+from typing import Annotated, Literal, Optional, Type, Union

-from fastapi import Query, Request, Security
+from fastapi import Cookie, Depends, Query, Request, Security
 from fastapi.exceptions import HTTPException
-from fastapi.openapi.models import APIKey, APIKeyIn
-from fastapi.security import APIKeyHeader, APIKeyQuery
+from fastapi.openapi.models import APIKey, APIKeyIn, SecuritySchemeType
+from fastapi.security import APIKeyHeader, APIKeyQuery, OAuth2PasswordBearer
 from fastapi.security.base import SecurityBase
+from jose import ExpiredSignatureError, JWTError, jwt
+from loguru import logger
 from pydantic.types import UUID4

-from lnbits.core.crud import get_user, get_wallet_for_key
-from lnbits.core.models import User, WalletType, WalletTypeInfo
+from lnbits.core.crud import (
+    get_account,
+    get_account_by_email,
+    get_account_by_username,
+    get_user,
+    get_wallet_for_key,
+)
+from lnbits.core.models import KeyType, User, WalletTypeInfo
 from lnbits.db import Filter, Filters, TFilterModel
-from lnbits.requestvars import g
-from lnbits.settings import settings
-
-
-# TODO: fix type ignores
-class KeyChecker(SecurityBase):
-    def __init__(
-        self,
-        scheme_name: Optional[str] = None,
-        auto_error: bool = True,
-        api_key: Optional[str] = None,
-    ):
-        self.scheme_name = scheme_name or self.__class__.__name__
-        self.auto_error = auto_error
-        self._key_type = WalletType.invoice
-        self._api_key = api_key
-        if api_key:
-            key = APIKey(
-                **{"in": APIKeyIn.query},  # type: ignore
-                name="X-API-KEY",
-                description="Wallet API Key - QUERY",
-            )
-        else:
-            key = APIKey(
-                **{"in": APIKeyIn.header},  # type: ignore
-                name="X-API-KEY",
-                description="Wallet API Key - HEADER",
-            )
-        self.wallet = None
-        self.model: APIKey = key
-
-    async def __call__(self, request: Request):
-        try:
-            key_value = (
-                self._api_key
-                if self._api_key
-                else request.headers.get("X-API-KEY") or request.query_params["api-key"]
-            )
-            # FIXME: Find another way to validate the key. A fetch from DB should be
-            #        avoided here. Also, we should not return the wallet here - thats
-            #        silly. Possibly store it in a Redis DB
-            wallet = await get_wallet_for_key(key_value, self._key_type)
-            self.wallet = wallet  # type: ignore
-            if not wallet:
-                raise HTTPException(
-                    status_code=HTTPStatus.UNAUTHORIZED,
-                    detail="Invalid key or expired key.",
-                )
-        except KeyError:
-            raise HTTPException(
-                status_code=HTTPStatus.BAD_REQUEST, detail="`X-API-KEY` header missing."
-            )
-
-
-class WalletInvoiceKeyChecker(KeyChecker):
-    """
-    WalletInvoiceKeyChecker will ensure that the provided invoice
-    wallet key is correct and populate g().wallet with the wallet
-    for the key in `X-API-key`.
-
-    The checker will raise an HTTPException when the key is wrong in some ways.
-    """
-
-    def __init__(
-        self,
-        scheme_name: Optional[str] = None,
-        auto_error: bool = True,
-        api_key: Optional[str] = None,
-    ):
-        super().__init__(scheme_name, auto_error, api_key)
-        self._key_type = WalletType.invoice
-
-
-class WalletAdminKeyChecker(KeyChecker):
-    """
-    WalletAdminKeyChecker will ensure that the provided admin
-    wallet key is correct and populate g().wallet with the wallet
-    for the key in `X-API-key`.
-
-    The checker will raise an HTTPException when the key is wrong in some ways.
-    """
-
-    def __init__(
-        self,
-        scheme_name: Optional[str] = None,
-        auto_error: bool = True,
-        api_key: Optional[str] = None,
-    ):
-        super().__init__(scheme_name, auto_error, api_key)
-        self._key_type = WalletType.admin
+from lnbits.settings import AuthMethods, settings

+oauth2_scheme = OAuth2PasswordBearer(tokenUrl="api/v1/auth", auto_error=False)

 api_key_header = APIKeyHeader(
    name="X-API-KEY",
@@ -115,149 +35,158 @@ api_key_query = APIKeyQuery(
 )


+class KeyChecker(SecurityBase):
+    def __init__(
+        self,
+        api_key: Optional[str] = None,
+        expected_key_type: Optional[KeyType] = None,
+    ):
+        self.auto_error: bool = True
+        self.expected_key_type = expected_key_type
+        self._api_key = api_key
+        if api_key:
+            openapi_model = APIKey(
+                **{"in": APIKeyIn.query},
+                type=SecuritySchemeType.apiKey,
+                name="X-API-KEY",
+                description="Wallet API Key - QUERY",
+            )
+        else:
+            openapi_model = APIKey(
+                **{"in": APIKeyIn.header},
+                type=SecuritySchemeType.apiKey,
+                name="X-API-KEY",
+                description="Wallet API Key - HEADER",
+            )
+        self.model: APIKey = openapi_model
+
+    async def __call__(self, request: Request) -> WalletTypeInfo:
+
+        key_value = (
+            self._api_key
+            if self._api_key
+            else request.headers.get("X-API-KEY") or request.query_params.get("api-key")
+        )
+
+        if not key_value:
+            raise HTTPException(
+                status_code=HTTPStatus.UNAUTHORIZED,
+                detail="No Api Key provided.",
+            )
+
+        wallet = await get_wallet_for_key(key_value)
+
+        if not wallet:
+            raise HTTPException(
+                status_code=HTTPStatus.NOT_FOUND,
+                detail="Wallet not found.",
+            )
+
+        if self.expected_key_type is KeyType.admin and wallet.adminkey != key_value:
+            raise HTTPException(
+                status_code=HTTPStatus.UNAUTHORIZED,
+                detail="Invalid adminkey.",
+            )
+
+        if (
+            wallet.user != settings.super_user
+            and wallet.user not in settings.lnbits_admin_users
+            and settings.lnbits_admin_extensions
+            and request["path"].split("/")[1] in settings.lnbits_admin_extensions
+        ):
+            raise HTTPException(
+                status_code=HTTPStatus.FORBIDDEN,
+                detail="User not authorized for this extension.",
+            )
+
+        key_type = KeyType.admin if wallet.adminkey == key_value else KeyType.invoice
+        return WalletTypeInfo(key_type, wallet)
+
+
 async def get_key_type(
-    r: Request,
+    request: Request,
    api_key_header: str = Security(api_key_header),
    api_key_query: str = Security(api_key_query),
 ) -> WalletTypeInfo:
-    token = api_key_header or api_key_query
-
-    if not token:
-        raise HTTPException(
-            status_code=HTTPStatus.UNAUTHORIZED,
-            detail="Invoice (or Admin) key required.",
-        )
-
-    for wallet_type, WalletChecker in zip(
-        [WalletType.admin, WalletType.invoice],
-        [WalletAdminKeyChecker, WalletInvoiceKeyChecker],
-    ):
-        try:
-            checker = WalletChecker(api_key=token)
-            await checker.__call__(r)
-            if checker.wallet is None:
-                raise HTTPException(
-                    status_code=HTTPStatus.NOT_FOUND, detail="Wallet does not exist."
-                )
-            wallet = WalletTypeInfo(wallet_type, checker.wallet)
-            if (
-                wallet.wallet.user != settings.super_user
-                and wallet.wallet.user not in settings.lnbits_admin_users
-            ) and (
-                settings.lnbits_admin_extensions
-                and r["path"].split("/")[1] in settings.lnbits_admin_extensions
-            ):
-                raise HTTPException(
-                    status_code=HTTPStatus.FORBIDDEN,
-                    detail="User not authorized for this extension.",
-                )
-            return wallet
-        except HTTPException as exc:
-            if exc.status_code == HTTPStatus.BAD_REQUEST:
-                raise
-            elif exc.status_code == HTTPStatus.UNAUTHORIZED:
-                # we pass this in case it is not an invoice key, nor an admin key,
-                # and then return NOT_FOUND at the end of this block
-                pass
-            else:
-                raise
-        except Exception:
-            raise
-    raise HTTPException(
-        status_code=HTTPStatus.NOT_FOUND, detail="Wallet does not exist."
-    )
+    check: KeyChecker = KeyChecker(api_key=api_key_header or api_key_query)
+    return await check(request)


 async def require_admin_key(
-    r: Request,
+    request: Request,
    api_key_header: str = Security(api_key_header),
    api_key_query: str = Security(api_key_query),
-):
-    token = api_key_header or api_key_query
-
-    if not token:
-        raise HTTPException(
-            status_code=HTTPStatus.UNAUTHORIZED,
-            detail="Admin key required.",
-        )
-
-    wallet = await get_key_type(r, token)
-
-    if wallet.wallet_type != 0:
-        # If wallet type is not admin then return the unauthorized status
-        # This also covers when the user passes an invalid key type
-        raise HTTPException(
-            status_code=HTTPStatus.UNAUTHORIZED, detail="Admin key required."
-        )
-    else:
-        return wallet
+) -> WalletTypeInfo:
+    check: KeyChecker = KeyChecker(
+        api_key=api_key_header or api_key_query,
+        expected_key_type=KeyType.admin,
+    )
+    return await check(request)


 async def require_invoice_key(
-    r: Request,
+    request: Request,
    api_key_header: str = Security(api_key_header),
    api_key_query: str = Security(api_key_query),
-):
-    token = api_key_header or api_key_query
+) -> WalletTypeInfo:
+    check: KeyChecker = KeyChecker(
+        api_key=api_key_header or api_key_query,
+        expected_key_type=KeyType.invoice,
+    )
+    return await check(request)

-    if not token:
-        raise HTTPException(
-            status_code=HTTPStatus.UNAUTHORIZED,
-            detail="Invoice (or Admin) key required.",
-        )

-    wallet = await get_key_type(r, token)
+async def check_access_token(
+    header_access_token: Annotated[Union[str, None], Depends(oauth2_scheme)],
+    cookie_access_token: Annotated[Union[str, None], Cookie()] = None,
+) -> Optional[str]:
+    return header_access_token or cookie_access_token

-    if (
-        wallet.wallet_type != WalletType.admin
-        and wallet.wallet_type != WalletType.invoice
-    ):
-        raise HTTPException(
-            status_code=HTTPStatus.UNAUTHORIZED,
-            detail="Invoice (or Admin) key required.",
-        )
+
+async def check_user_exists(
+    r: Request,
+    access_token: Annotated[Optional[str], Depends(check_access_token)],
+    usr: Optional[UUID4] = None,
+) -> User:
+    if access_token:
+        account = await _get_account_from_token(access_token)
+    elif usr and settings.is_auth_method_allowed(AuthMethods.user_id_only):
+        account = await get_account(usr.hex)
    else:
-        return wallet
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Missing user ID or access token.")

+    if not account or not settings.is_user_allowed(account.id):
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "User not allowed.")

-async def check_user_exists(usr: UUID4) -> User:
-    g().user = await get_user(usr.hex)
-
-    if not g().user:
-        raise HTTPException(
-            status_code=HTTPStatus.NOT_FOUND, detail="User does not exist."
-        )
+    user = await get_user(account.id)
+    assert user, "User not found for account."

    if (
-        len(settings.lnbits_allowed_users) > 0
-        and g().user.id not in settings.lnbits_allowed_users
-        and g().user.id not in settings.lnbits_admin_users
-        and g().user.id != settings.super_user
+        user.id != settings.super_user
+        and user.id not in settings.lnbits_admin_users
+        and settings.lnbits_admin_extensions
+        and r["path"].split("/")[1] in settings.lnbits_admin_extensions
    ):
        raise HTTPException(
-            status_code=HTTPStatus.UNAUTHORIZED, detail="User not authorized."
-        )
-
-    return g().user
-
-
-async def check_admin(usr: UUID4) -> User:
-    user = await check_user_exists(usr)
-    if user.id != settings.super_user and user.id not in settings.lnbits_admin_users:
-        raise HTTPException(
-            status_code=HTTPStatus.UNAUTHORIZED,
-            detail="User not authorized. No admin privileges.",
+            HTTPStatus.UNAUTHORIZED, "User not authorized for extension."
        )

    return user


-async def check_super_user(usr: UUID4) -> User:
-    user = await check_admin(usr)
+async def check_admin(user: Annotated[User, Depends(check_user_exists)]) -> User:
+    if user.id != settings.super_user and user.id not in settings.lnbits_admin_users:
+        raise HTTPException(
+            HTTPStatus.UNAUTHORIZED, "User not authorized. No admin privileges."
+        )
+
+    return user
+
+
+async def check_super_user(user: Annotated[User, Depends(check_user_exists)]) -> User:
    if user.id != settings.super_user:
        raise HTTPException(
-            status_code=HTTPStatus.UNAUTHORIZED,
-            detail="User not authorized. No super user privileges.",
+            HTTPStatus.UNAUTHORIZED, "User not authorized. No super user privileges."
        )
    return user

@@ -295,3 +224,23 @@ def parse_filters(model: Type[TFilterModel]):
        )

    return dependency
+
+
+async def _get_account_from_token(access_token):
+    try:
+        payload = jwt.decode(access_token, settings.auth_secret_key, "HS256")
+        if "sub" in payload and payload.get("sub"):
+            return await get_account_by_username(str(payload.get("sub")))
+        if "usr" in payload and payload.get("usr"):
+            return await get_account(str(payload.get("usr")))
+        if "email" in payload and payload.get("email"):
+            return await get_account_by_email(str(payload.get("email")))
+
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Data missing for access token.")
+    except ExpiredSignatureError as exc:
+        raise HTTPException(
+            HTTPStatus.UNAUTHORIZED, "Session expired.", {"token-expired": "true"}
+        ) from exc
+    except JWTError as exc:
+        logger.debug(exc)
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "Invalid access token.") from exc
@@ -0,0 +1,101 @@
+import sys
+import traceback
+from http import HTTPStatus
+from typing import Optional
+
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.exceptions import RequestValidationError
+from fastapi.responses import JSONResponse, RedirectResponse, Response
+from loguru import logger
+
+from lnbits.core.services import InvoiceError, PaymentError
+
+from .helpers import template_renderer
+
+
+def register_exception_handlers(app: FastAPI):
+    register_exception_handler(app)
+    register_request_validation_exception_handler(app)
+    register_http_exception_handler(app)
+    register_payment_error_handler(app)
+    register_invoice_error_handler(app)
+
+
+def render_html_error(request: Request, exc: Exception) -> Optional[Response]:
+    # Only the browser sends "text/html" request
+    # not fail proof, but everything else get's a JSON response
+    if (
+        request.headers
+        and "accept" in request.headers
+        and "text/html" in request.headers["accept"]
+    ):
+        if (
+            isinstance(exc, HTTPException)
+            and exc.headers
+            and "token-expired" in exc.headers
+        ):
+            response = RedirectResponse("/")
+            response.delete_cookie("cookie_access_token")
+            response.delete_cookie("is_lnbits_user_authorized")
+            response.set_cookie("is_access_token_expired", "true")
+            return response
+
+        return template_renderer().TemplateResponse(
+            request, "error.html", {"err": f"Error: {exc!s}"}
+        )
+
+    return None
+
+
+def register_exception_handler(app: FastAPI):
+    @app.exception_handler(Exception)
+    async def exception_handler(request: Request, exc: Exception):
+        etype, _, tb = sys.exc_info()
+        traceback.print_exception(etype, exc, tb)
+        logger.error(f"Exception: {exc!s}")
+        return render_html_error(request, exc) or JSONResponse(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            content={"detail": str(exc)},
+        )
+
+
+def register_request_validation_exception_handler(app: FastAPI):
+    @app.exception_handler(RequestValidationError)
+    async def validation_exception_handler(
+        request: Request, exc: RequestValidationError
+    ):
+        logger.error(f"RequestValidationError: {exc!s}")
+        return render_html_error(request, exc) or JSONResponse(
+            status_code=HTTPStatus.BAD_REQUEST,
+            content={"detail": str(exc)},
+        )
+
+
+def register_http_exception_handler(app: FastAPI):
+    @app.exception_handler(HTTPException)
+    async def http_exception_handler(request: Request, exc: HTTPException):
+        logger.error(f"HTTPException {exc.status_code}: {exc.detail}")
+        return render_html_error(request, exc) or JSONResponse(
+            status_code=exc.status_code,
+            content={"detail": exc.detail},
+        )
+
+
+def register_payment_error_handler(app: FastAPI):
+    @app.exception_handler(PaymentError)
+    async def payment_error_handler(request: Request, exc: PaymentError):
+        logger.error(f"PaymentError: {exc.message}, {exc.status}")
+        return JSONResponse(
+            status_code=520,
+            content={"detail": exc.message, "status": exc.status},
+        )
+
+
+def register_invoice_error_handler(app: FastAPI):
+    @app.exception_handler(InvoiceError)
+    async def invoice_error_handler(request: Request, exc: InvoiceError):
+        logger.error(f"InvoiceError: {exc.message}, Status: {exc.status}")
+        return JSONResponse(
+            status_code=520,
+            content={"detail": exc.message, "status": exc.status},
+        )
@@ -1,16 +1,15 @@
+import asyncio
 import hashlib
 import json
 import os
 import shutil
 import sys
 import zipfile
-from http import HTTPStatus
 from pathlib import Path
 from typing import Any, List, NamedTuple, Optional, Tuple
 from urllib import request

 import httpx
-from fastapi import HTTPException
 from loguru import logger
 from packaging import version
 from pydantic import BaseModel
@@ -33,11 +32,12 @@ class ExplicitRelease(BaseModel):
    warning: Optional[str]
    info_notification: Optional[str]
    critical_notification: Optional[str]
+    pay_link: Optional[str]

    def is_version_compatible(self):
        if not self.min_lnbits_version:
            return True
-        return version.parse(self.min_lnbits_version) <= version.parse(settings.version)
+        return version_parse(self.min_lnbits_version) <= version_parse(settings.version)


 class GitHubRelease(BaseModel):
@@ -75,11 +75,18 @@ class ExtensionConfig(BaseModel):
    def is_version_compatible(self):
        if not self.min_lnbits_version:
            return True
-        return version.parse(self.min_lnbits_version) <= version.parse(settings.version)
+        return version_parse(self.min_lnbits_version) <= version_parse(settings.version)
+
+
+class ReleasePaymentInfo(BaseModel):
+    amount: Optional[int] = None
+    pay_link: Optional[str] = None
+    payment_hash: Optional[str] = None
+    payment_request: Optional[str] = None


 def download_url(url, save_path):
-    with request.urlopen(url) as dl_file:
+    with request.urlopen(url, timeout=60) as dl_file:
        with open(save_path, "wb") as out_file:
            out_file.write(dl_file.read())

@@ -144,22 +151,32 @@ async def fetch_github_release_config(


 async def github_api_get(url: str, error_msg: Optional[str]) -> Any:
-    async with httpx.AsyncClient() as client:
-        headers = (
-            {"Authorization": "Bearer " + settings.lnbits_ext_github_token}
-            if settings.lnbits_ext_github_token
-            else None
-        )
-        resp = await client.get(
-            url,
-            headers=headers,
-        )
+    headers = {"User-Agent": settings.user_agent}
+    if settings.lnbits_ext_github_token:
+        headers["Authorization"] = f"Bearer {settings.lnbits_ext_github_token}"
+    async with httpx.AsyncClient(headers=headers) as client:
+        resp = await client.get(url)
        if resp.status_code != 200:
            logger.warning(f"{error_msg} ({url}): {resp.text}")
        resp.raise_for_status()
        return resp.json()


+async def fetch_release_payment_info(
+    url: str, amount: Optional[int] = None
+) -> Optional[ReleasePaymentInfo]:
+    if amount:
+        url = f"{url}?amount={amount}"
+    try:
+        async with httpx.AsyncClient() as client:
+            resp = await client.get(url)
+            resp.raise_for_status()
+            return ReleasePaymentInfo(**resp.json())
+    except Exception as e:
+        logger.warning(e)
+        return None
+
+
 def icon_to_github_url(source_repo: str, path: Optional[str]) -> str:
    if not path:
        return ""
@@ -182,12 +199,19 @@ class Extension(NamedTuple):
    upgrade_hash: Optional[str] = ""

    @property
-    def module_name(self):
-        return (
-            f"lnbits.extensions.{self.code}"
-            if self.upgrade_hash == ""
-            else f"lnbits.upgrades.{self.code}-{self.upgrade_hash}.{self.code}"
-        )
+    def module_name(self) -> str:
+        if self.is_upgrade_extension:
+            if settings.has_default_extension_path:
+                return f"lnbits.upgrades.{self.code}-{self.upgrade_hash}"
+            return f"{self.code}-{self.upgrade_hash}"
+
+        if settings.has_default_extension_path:
+            return f"lnbits.extensions.{self.code}"
+        return self.code
+
+    @property
+    def is_upgrade_extension(self) -> bool:
+        return self.upgrade_hash != ""

    @classmethod
    def from_installable_ext(cls, ext_info: "InstallableExtension") -> "Extension":
@@ -205,7 +229,7 @@ class Extension(NamedTuple):

 class ExtensionManager:
    def __init__(self) -> None:
-        p = Path(settings.lnbits_path, "extensions")
+        p = Path(settings.lnbits_extensions_path, "extensions")
        Path(p).mkdir(parents=True, exist_ok=True)
        self._extension_folders: List[Path] = [f for f in p.iterdir() if f.is_dir()]

@@ -258,6 +282,26 @@ class ExtensionRelease(BaseModel):
    repo: Optional[str] = None
    icon: Optional[str] = None

+    pay_link: Optional[str] = None
+    cost_sats: Optional[int] = None
+    paid_sats: Optional[int] = 0
+    payment_hash: Optional[str] = None
+
+    @property
+    def archive_url(self) -> str:
+        if not self.pay_link:
+            return self.archive
+        return (
+            f"{self.archive}?version=v{self.version}&payment_hash={self.payment_hash}"
+        )
+
+    async def check_payment_requirements(self):
+        if not self.pay_link:
+            return
+
+        payment_info = await fetch_release_payment_info(self.pay_link)
+        self.cost_sats = payment_info.amount if payment_info else None
+
    @classmethod
    def from_github_release(
        cls, source_repo: str, r: "GitHubRepoRelease"
@@ -288,12 +332,13 @@ class ExtensionRelease(BaseModel):
            is_version_compatible=e.is_version_compatible(),
            warning=e.warning,
            html_url=e.html_url,
+            pay_link=e.pay_link,
            repo=e.repo,
            icon=e.icon,
        )

    @classmethod
-    async def all_releases(cls, org: str, repo: str) -> List["ExtensionRelease"]:
+    async def get_github_releases(cls, org: str, repo: str) -> List["ExtensionRelease"]:
        try:
            github_releases = await fetch_github_releases(org, repo)
            return [
@@ -316,6 +361,7 @@ class InstallableExtension(BaseModel):
    featured = False
    latest_release: Optional[ExtensionRelease] = None
    installed_release: Optional[ExtensionRelease] = None
+    payments: List[ReleasePaymentInfo] = []
    archive: Optional[str] = None

    @property
@@ -330,21 +376,25 @@ class InstallableExtension(BaseModel):

    @property
    def zip_path(self) -> Path:
-        extensions_data_dir = Path(settings.lnbits_data_folder, "extensions")
+        extensions_data_dir = Path(settings.lnbits_data_folder, "zips")
        Path(extensions_data_dir).mkdir(parents=True, exist_ok=True)
        return Path(extensions_data_dir, f"{self.id}.zip")

    @property
    def ext_dir(self) -> Path:
-        return Path(settings.lnbits_path, "extensions", self.id)
+        return Path(settings.lnbits_extensions_path, "extensions", self.id)

    @property
    def ext_upgrade_dir(self) -> Path:
-        return Path("lnbits", "upgrades", f"{self.id}-{self.hash}")
+        return Path(
+            settings.lnbits_extensions_path, "upgrades", f"{self.id}-{self.hash}"
+        )

    @property
    def module_name(self) -> str:
-        return f"lnbits.extensions.{self.id}"
+        if settings.has_default_extension_path:
+            return f"lnbits.extensions.{self.id}"
+        return self.id

    @property
    def module_installed(self) -> bool:
@@ -362,48 +412,55 @@ class InstallableExtension(BaseModel):
            return self.installed_release.version
        return ""

-    def download_archive(self):
+    async def download_archive(self):
        logger.info(f"Downloading extension {self.name} ({self.installed_version}).")
        ext_zip_file = self.zip_path
        if ext_zip_file.is_file():
            os.remove(ext_zip_file)
        try:
            assert self.installed_release, "installed_release is none."
-            download_url(self.installed_release.archive, ext_zip_file)
-        except Exception as ex:
-            logger.warning(ex)
-            raise HTTPException(
-                status_code=HTTPStatus.NOT_FOUND,
-                detail="Cannot fetch extension archive file",
+
+            self._restore_payment_info()
+
+            await asyncio.to_thread(
+                download_url, self.installed_release.archive_url, ext_zip_file
            )

+            self._remember_payment_info()
+
+        except Exception as exc:
+            logger.warning(exc)
+            raise AssertionError("Cannot fetch extension archive file") from exc
+
        archive_hash = file_hash(ext_zip_file)
        if self.installed_release.hash and self.installed_release.hash != archive_hash:
            # remove downloaded archive
            if ext_zip_file.is_file():
                os.remove(ext_zip_file)
-            raise HTTPException(
-                status_code=HTTPStatus.NOT_FOUND,
-                detail="File hash missmatch. Will not install.",
-            )
+            raise AssertionError("File hash missmatch. Will not install.")

    def extract_archive(self):
        logger.info(f"Extracting extension {self.name} ({self.installed_version}).")
-        Path("lnbits", "upgrades").mkdir(parents=True, exist_ok=True)
-        shutil.rmtree(self.ext_upgrade_dir, True)
-        with zipfile.ZipFile(self.zip_path, "r") as zip_ref:
-            zip_ref.extractall(self.ext_upgrade_dir)
-        generated_dir_name = os.listdir(self.ext_upgrade_dir)[0]
-        os.rename(
-            Path(self.ext_upgrade_dir, generated_dir_name),
-            Path(self.ext_upgrade_dir, self.id),
+        Path(settings.lnbits_extensions_path, "upgrades").mkdir(
+            parents=True, exist_ok=True
        )

+        tmp_dir = Path(settings.lnbits_data_folder, "unzip-temp", self.hash)
+        shutil.rmtree(tmp_dir, True)
+
+        with zipfile.ZipFile(self.zip_path, "r") as zip_ref:
+            zip_ref.extractall(tmp_dir)
+        generated_dir_name = os.listdir(tmp_dir)[0]
+        shutil.rmtree(self.ext_upgrade_dir, True)
+        shutil.copytree(
+            Path(tmp_dir, generated_dir_name),
+            Path(self.ext_upgrade_dir),
+        )
+        shutil.rmtree(tmp_dir, True)
+
        # Pre-packed extensions can be upgraded
        # Mark the extension as installed so we know it is not the pre-packed version
-        with open(
-            Path(self.ext_upgrade_dir, self.id, "config.json"), "r+"
-        ) as json_file:
+        with open(Path(self.ext_upgrade_dir, "config.json"), "r+") as json_file:
            config_json = json.load(json_file)

            self.name = config_json.get("name")
@@ -419,13 +476,10 @@ class InstallableExtension(BaseModel):
                )

        shutil.rmtree(self.ext_dir, True)
-        shutil.copytree(
-            Path(self.ext_upgrade_dir, self.id),
-            Path(settings.lnbits_path, "extensions", self.id),
-        )
+        shutil.copytree(Path(self.ext_upgrade_dir), Path(self.ext_dir))
        logger.success(f"Extension {self.name} ({self.installed_version}) installed.")

-    def nofiy_upgrade(self) -> None:
+    def notify_upgrade(self) -> None:
        """
        Update the list of upgraded extensions. The middleware will perform
        redirects based on this
@@ -437,8 +491,9 @@ class InstallableExtension(BaseModel):
                settings.lnbits_upgraded_extensions,
            )
        )
-        settings.lnbits_upgraded_extensions = clean_upgraded_exts + [
-            f"{self.hash}/{self.id}"
+        settings.lnbits_upgraded_extensions = [
+            *clean_upgraded_exts,
+            f"{self.hash}/{self.id}",
        ]

    def clean_extension_files(self):
@@ -457,17 +512,61 @@ class InstallableExtension(BaseModel):
        if not self.latest_release:
            self.latest_release = release
            return
-        if version.parse(self.latest_release.version) < version.parse(release.version):
+        if version_parse(self.latest_release.version) < version_parse(release.version):
            self.latest_release = release

+    def find_existing_payment(
+        self, pay_link: Optional[str]
+    ) -> Optional[ReleasePaymentInfo]:
+        if not pay_link:
+            return None
+        return next(
+            (p for p in self.payments if p.pay_link == pay_link),
+            None,
+        )
+
+    def _restore_payment_info(self):
+        if not self.installed_release:
+            return
+        if not self.installed_release.pay_link:
+            return
+        if self.installed_release.payment_hash:
+            return
+        payment_info = self.find_existing_payment(self.installed_release.pay_link)
+        if payment_info:
+            self.installed_release.payment_hash = payment_info.payment_hash
+
+    def _remember_payment_info(self):
+        if not self.installed_release or not self.installed_release.pay_link:
+            return
+        payment_info = ReleasePaymentInfo(
+            amount=self.installed_release.cost_sats,
+            pay_link=self.installed_release.pay_link,
+            payment_hash=self.installed_release.payment_hash,
+        )
+        self.payments = [
+            p for p in self.payments if p.pay_link != payment_info.pay_link
+        ]
+        self.payments.append(payment_info)
+
    @classmethod
    def from_row(cls, data: dict) -> "InstallableExtension":
        meta = json.loads(data["meta"])
        ext = InstallableExtension(**data)
        if "installed_release" in meta:
            ext.installed_release = ExtensionRelease(**meta["installed_release"])
+        if meta.get("payments"):
+            ext.payments = [ReleasePaymentInfo(**p) for p in meta["payments"]]
        return ext

+    @classmethod
+    def from_rows(
+        cls, rows: Optional[List[Any]] = None
+    ) -> List["InstallableExtension"]:
+        if rows is None:
+            rows = []
+        return [InstallableExtension.from_row(row) for row in rows]
+
    @classmethod
    async def from_github_release(
        cls, github_release: GitHubRelease
@@ -545,7 +644,7 @@ class InstallableExtension(BaseModel):
                    extension_list += [ext]
                    extension_id_list += [e.id]
            except Exception as e:
-                logger.warning(f"Manifest {url} failed with '{str(e)}'")
+                logger.warning(f"Manifest {url} failed with '{e!s}'")

        return extension_list

@@ -557,34 +656,38 @@ class InstallableExtension(BaseModel):
            try:
                manifest = await fetch_manifest(url)
                for r in manifest.repos:
-                    if r.id == ext_id:
-                        repo_releases = await ExtensionRelease.all_releases(
-                            r.organisation, r.repository
-                        )
-                        extension_releases += repo_releases
+                    if r.id != ext_id:
+                        continue
+                    repo_releases = await ExtensionRelease.get_github_releases(
+                        r.organisation, r.repository
+                    )
+                    extension_releases += repo_releases

                for e in manifest.extensions:
-                    if e.id == ext_id:
-                        extension_releases += [
-                            ExtensionRelease.from_explicit_release(url, e)
-                        ]
+                    if e.id != ext_id:
+                        continue
+                    explicit_release = ExtensionRelease.from_explicit_release(url, e)
+                    await explicit_release.check_payment_requirements()
+                    extension_releases.append(explicit_release)

            except Exception as e:
-                logger.warning(f"Manifest {url} failed with '{str(e)}'")
+                logger.warning(f"Manifest {url} failed with '{e!s}'")

        return extension_releases

    @classmethod
    async def get_extension_release(
-        cls, ext_id: str, source_repo: str, archive: str
+        cls, ext_id: str, source_repo: str, archive: str, version: str
    ) -> Optional["ExtensionRelease"]:
-        all_releases: List[
-            ExtensionRelease
-        ] = await InstallableExtension.get_extension_releases(ext_id)
+        all_releases: List[ExtensionRelease] = (
+            await InstallableExtension.get_extension_releases(ext_id)
+        )
        selected_release = [
            r
            for r in all_releases
-            if r.archive == archive and r.source_repo == source_repo
+            if r.archive == archive
+            and r.source_repo == source_repo
+            and r.version == version
        ]

        return selected_release[0] if len(selected_release) != 0 else None
@@ -594,9 +697,35 @@ class CreateExtension(BaseModel):
    ext_id: str
    archive: str
    source_repo: str
+    version: str
+    cost_sats: Optional[int] = 0
+    payment_hash: Optional[str] = None


-def get_valid_extensions() -> List[Extension]:
-    return [
+def get_valid_extensions(include_deactivated: Optional[bool] = True) -> List[Extension]:
+    valid_extensions = [
        extension for extension in ExtensionManager().extensions if extension.is_valid
    ]
+
+    if include_deactivated:
+        return valid_extensions
+
+    if settings.lnbits_extensions_deactivate_all:
+        return []
+
+    return [
+        e
+        for e in valid_extensions
+        if e.code not in settings.lnbits_deactivated_extensions
+    ]
+
+
+def version_parse(v: str):
+    """
+    Wrapper for version.parse() that does not throw if the version is invalid.
+    Instead it return the lowest possible version ("0.0.0")
+    """
+    try:
+        return version.parse(v)
+    except Exception:
+        return version.parse("0.0.0")
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 101.041 30.0001"><defs><path id="a" d="M33.2619 148.1667h154.2143v68.7917H33.2619z"/></defs><g fill="#1f2234" aria-label="LNbits" font-family="sans-serif" font-size=".3095" font-weight="400" letter-spacing=".0031" style="line-height:1.25;white-space:pre;shape-inside:url(#a)" transform="matrix(72.4607 0 0 72.4607 -2399.2814 -10741.3589)"><g transform="matrix(.00244 0 0 .00244 33.0708 148.1594)"><circle cx="101.2976" cy="116.4167" r="84.6667" fill="#673ab7" fill-rule="evenodd"/><path fill="#eee" d="M79.1105 71.9667v49.0613h13.3803v40.141l31.2208-53.5213h-17.8404l17.8404-35.681z"/></g><g fill="#eee" font-family="roboto"><path d="M33.6755 148.518h.0962v.0364h-.1416v-.22h.0454zM33.9796 148.5544h-.0453l-.0883-.1448v.1448h-.0453v-.22h.0453l.0884.145v-.145h.0452z" font-weight="700" style="-inkscape-font-specification:'roboto Bold'"/><path d="M34.1625 148.4744q0 .0375-.0172.0603-.0172.0227-.0462.0227-.031 0-.048-.0219l-.0014.019h-.0256v-.2322h.028v.0866q.0168-.021.0466-.021.0298 0 .0467.0225.017.0225.017.0617zm-.028-.003q0-.0286-.011-.044-.011-.0157-.0317-.0157-.0277 0-.0398.0257v.0707q.0129.0257.04.0257.0202 0 .0314-.0156.0112-.0156.0112-.0469zM34.231 148.5544h-.028v-.1635h.028zm-.0302-.2069q0-.007.0041-.0115.0042-.005.0124-.005.0082 0 .0124.005.0042.005.0042.0115 0 .007-.0042.0113-.0042.005-.0124.005-.0082 0-.0124-.005-.004-.005-.004-.0113zM34.3167 148.3513v.0396h.0305v.0216h-.0305v.1014q0 .01.004.0148.0042.005.014.005.0048 0 .0133-.002v.0227q-.011.003-.0215.003-.0187 0-.0283-.0113-.0095-.0113-.0095-.0322v-.1014h-.0297v-.0216h.0297v-.0396zM34.478 148.511q0-.0113-.0086-.0175-.0085-.006-.0298-.0109-.0211-.005-.0337-.0109-.0124-.006-.0184-.015t-.006-.0209q0-.02.017-.034.017-.0139.0435-.0139.0278 0 .045.0144.0174.0144.0174.0367h-.028q0-.0115-.0099-.0198-.0097-.008-.0245-.008-.0152 0-.0238.007-.0086.007-.0086.0174 0 .0101.008.0153.008.005.0288.01.021.005.034.0112.013.007.0192.0157.0063.009.0063.0222 0 .022-.0175.0352-.0175.0131-.0455.0131-.0197 0-.0348-.007-.015-.007-.0237-.0193-.0085-.0125-.0085-.027h.028q.0007.014.0111.0223.0106.008.0279.008.0158 0 .0253-.006.0097-.006.0097-.0172z" style="-inkscape-font-specification:roboto"/></g></g></svg>