chore: poetry lock

.github/workflows/ci.yml

@@ -64,6 +64,13 @@ jobs:
     with:
       make: openapi
 
+  test-wasm-e2e:
+    needs: [ lint ]
+    uses: ./.github/workflows/make.yml
+    with:
+      make: test-wasm-e2e
+      playwright-browser: chromium
+
   regtest:
     needs: [ lint ]
     uses: ./.github/workflows/regtest.yml
@@ -95,5 +102,5 @@ jobs:
       python-version: ${{ matrix.python-version }}
 
   bundle:
-    needs: [ lint, test-api, test-wallets, test-unit, migration, openapi, regtest, jmeter ]
+    needs: [ lint, test-api, test-wallets, test-unit, migration, openapi, test-wasm-e2e, regtest, jmeter ]
     uses: ./.github/workflows/bundle.yml

.github/workflows/make.yml

@@ -15,6 +15,10 @@ on:
         description: "python version"
         type: string
         default: "3.12"
+      playwright-browser:
+        description: "Playwright browser to install before running make"
+        default: ""
+        type: string
 
 jobs:
   make:
@@ -31,4 +35,7 @@ jobs:
           python-version: ${{ inputs.python-version }}
           node-version: ${{ matrix.node-version }}
           npm: ${{ inputs.npm }}
+      - name: Install Playwright browser
+        if: ${{ inputs.playwright-browser != '' }}
+        run: uv run playwright install --with-deps ${{ inputs.playwright-browser }}
       - run: make ${{ inputs.make }}

.prettierignore

@@ -16,3 +16,5 @@
 flake.lock
 
 .venv
+
+tests/fixtures/lnbits-wasm-test-extension/static/html-like.js

Makefile

@@ -62,6 +62,12 @@ test-api:
 	DEBUG=true \
 	uv run pytest tests/api
 
+test-wasm-e2e:
+	LNBITS_BACKEND_WALLET_CLASS="FakeWallet" \
+	PYTHONUNBUFFERED=1 \
+	DEBUG=true \
+	uv run pytest tests/wasm_ext --browser chromium
+
 test-regtest:
 	LNBITS_DATA_FOLDER="./tests/data" \
 	PYTHONUNBUFFERED=1 \

lnbits/app.py

@@ -24,12 +24,6 @@ from lnbits.core.crud import (
     update_installed_extension_state,
 )
 from lnbits.core.crud.extensions import create_installed_extension
-from lnbits.core.extensions.events import dispatch_wasm_invoice_paid
-from lnbits.core.extensions.loader import (
-    is_wasm_extension_dir,
-    is_wasm_extension_id,
-)
-from lnbits.core.extensions.routes import register_wasm_extension
 from lnbits.core.helpers import migrate_extension_database
 from lnbits.core.models.notifications import NotificationType
 from lnbits.core.services.extensions import deactivate_extension, get_valid_extensions
@@ -44,6 +38,11 @@ from lnbits.core.tasks import (
     wait_for_paid_invoices,
     wait_notification_messages,
 )
+from lnbits.core.wasm_ext.routes.register import register_wasm_extension
+from lnbits.core.wasm_ext.wasm.events import dispatch_wasm_invoice_paid
+from lnbits.core.wasm_ext.wasm.loader import (
+    is_wasm_extension_id,
+)
 from lnbits.exceptions import register_exception_handlers
 from lnbits.helpers import version_parse
 from lnbits.llms_txt import create_llms_txt_route
@@ -317,9 +316,8 @@ async def build_all_installed_extensions_list(  # noqa: C901
 
             installed_extensions.append(ext_info)
             await create_installed_extension(ext_info)
-            if not is_wasm_extension_dir(ext_dir):
-                current_version = await get_db_version(ext_id)
-                await migrate_extension_database(ext_info, current_version)
+            current_version = await get_db_version(ext_id)
+            await migrate_extension_database(ext_info, current_version)
 
         except Exception as e:
             logger.warning(e)

lnbits/core/extensions/__init__.py

@@ -1,28 +0,0 @@
-"""Extension runtime contracts."""
-
-from .api import (
-    ExtensionAPI,
-    ExtensionAPIMethod,
-    extension_api_contract,
-    extension_api_method,
-    get_extension_api_method,
-    list_extension_api_methods,
-)
-from .loader import WasmExtension, load_wasm_extension
-from .routes import register_wasm_extension
-from .runtime import ExtensionAPIHost
-from .wasm import invoke_wasm_extension_export
-
-__all__ = [
-    "ExtensionAPI",
-    "ExtensionAPIHost",
-    "ExtensionAPIMethod",
-    "WasmExtension",
-    "extension_api_contract",
-    "extension_api_method",
-    "get_extension_api_method",
-    "invoke_wasm_extension_export",
-    "list_extension_api_methods",
-    "load_wasm_extension",
-    "register_wasm_extension",
-]

lnbits/core/extensions/routes.py

@@ -1,777 +0,0 @@
-from __future__ import annotations
-
-import json
-import os
-import re
-from pathlib import Path
-from typing import Annotated, Any, NoReturn
-from uuid import uuid4
-
-from fastapi import Depends, FastAPI, HTTPException, Request
-from fastapi.responses import FileResponse, Response
-from fastapi.staticfiles import StaticFiles
-from loguru import logger
-from pydantic import UUID4
-from starlette.staticfiles import PathLike as StaticFilesPathLike
-from starlette.types import Scope
-
-from lnbits.core.crud import get_installed_extension, get_user_from_account
-from lnbits.core.db import core_app_extra
-from lnbits.core.models import Account
-from lnbits.decorators import (
-    check_access_token,
-    check_account_exists,
-    optional_user_id,
-)
-from lnbits.helpers import template_renderer
-from lnbits.settings import settings
-from lnbits.utils.cache import cache
-
-from .loader import WasmExtension, load_wasm_extension
-from .wasm import invoke_wasm_extension_export, warm_wasm_extension
-
-WASM_FRAME_TOKEN_EXPIRY_SECONDS = 60
-WASM_EXTENSION_CORE_ASSET_PREFIX = "_lnbits"
-WASM_EXTENSION_CORE_STATIC_ASSETS = {
-    "bundle.min.css": ("static/bundle.min.css", "text/css; charset=utf-8"),
-    "material-icons-v50.woff2": (
-        "static/fonts/material-icons-v50.woff2",
-        "font/woff2",
-    ),
-    "quasar.css": ("static/vendor/quasar.css", "text/css; charset=utf-8"),
-    "quasar.umd.prod.js": (
-        "static/vendor/quasar.umd.prod.js",
-        "text/javascript; charset=utf-8",
-    ),
-    "qrcode.vue.browser.js": (
-        "static/vendor/qrcode.vue.browser.js",
-        "text/javascript; charset=utf-8",
-    ),
-    "vue.global.prod.js": (
-        "static/vendor/vue.global.prod.js",
-        "text/javascript; charset=utf-8",
-    ),
-}
-WASM_EXTENSION_GENERATED_CORE_ASSETS = {
-    "material-icons.css": (
-        """
-        @font-face {
-          font-family: 'Material Icons';
-          font-style: normal;
-          font-weight: 400;
-          src: url('./material-icons-v50.woff2') format('woff2');
-        }
-        """,
-        "text/css; charset=utf-8",
-    )
-}
-WASM_EXTENSION_STATIC_MIME_TYPES = {
-    ".css": "text/css; charset=utf-8",
-    ".gif": "image/gif",
-    ".ico": "image/x-icon",
-    ".jpeg": "image/jpeg",
-    ".jpg": "image/jpeg",
-    ".js": "text/javascript; charset=utf-8",
-    ".png": "image/png",
-    ".webp": "image/webp",
-    ".woff": "font/woff",
-    ".woff2": "font/woff2",
-}
-WASM_EXTENSION_TEXT_STATIC_EXTENSIONS = {".css", ".js"}
-WASM_EXTENSION_HTML_PREFIXES = (b"<!doctype", b"<html", b"<script")
-
-
-class GuardedWasmExtensionStaticFiles(StaticFiles):
-    async def get_response(self, path: str, scope: Scope) -> Response:
-        if path.startswith(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/"):
-            return _wasm_extension_core_asset_response(path)
-        if Path(path).suffix.lower() not in WASM_EXTENSION_STATIC_MIME_TYPES:
-            raise HTTPException(status_code=404)
-        return await super().get_response(path, scope)
-
-    def file_response(
-        self,
-        full_path: StaticFilesPathLike,
-        stat_result: os.stat_result,
-        scope: Scope,
-        status_code: int = 200,
-    ) -> Response:
-        suffix = Path(full_path).suffix.lower()
-        if suffix in WASM_EXTENSION_TEXT_STATIC_EXTENSIONS:
-            _reject_html_like_wasm_static_asset(Path(full_path))
-
-        response = super().file_response(full_path, stat_result, scope, status_code)
-        response.headers["Content-Type"] = WASM_EXTENSION_STATIC_MIME_TYPES[suffix]
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Cache-Control"] = "no-store"
-        return response
-
-
-def register_wasm_extension(app: FastAPI, ext_id: str) -> WasmExtension:
-    loaded = load_wasm_extension(ext_id)
-
-    warm_wasm_extension(loaded)
-    _mount_wasm_extension_static(app, loaded)
-    _register_wasm_extension_ui_routes(app, loaded)
-    _register_wasm_extension_api_routes(app, loaded)
-
-    core_app_extra.wasm_extension_registry.register(loaded)
-
-    settings.activate_extension_paths(ext_id, "", [])
-    logger.info(
-        f"Loaded WASM extension '{loaded.id}' "
-        f"({loaded.module_path.stat().st_size} bytes)."
-    )
-    return loaded
-
-
-def _mount_wasm_extension_static(app: FastAPI, extension: WasmExtension) -> None:
-    static_path = extension.root_path / "static"
-
-    mount_path = f"/ext-assets/{extension.id}"
-    if any(getattr(route, "path", None) == mount_path for route in app.routes):
-        return
-
-    app.mount(
-        mount_path,
-        GuardedWasmExtensionStaticFiles(directory=static_path, check_dir=False),
-        name=f"{extension.id}-static",
-    )
-
-
-def _register_wasm_extension_ui_routes(app: FastAPI, extension: WasmExtension) -> None:
-    _add_wasm_extension_frame_config_route(app, extension)
-
-    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
-        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
-        entrypoint = _wasm_extension_entrypoint(
-            extension, route_config.get("entrypoint")
-        )
-        frame_path = f"/ext-frame/{extension.id}/{route_index}"
-        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
-        _add_wasm_extension_frame_route(app, extension, frame_path, entrypoint)
-        _add_wasm_extension_wrapper_route(
-            app,
-            extension,
-            route_path,
-            auth,
-        )
-
-
-def _register_wasm_extension_api_routes(app: FastAPI, extension: WasmExtension) -> None:
-    for route_config in extension.config.get("api_routes") or []:
-        _add_wasm_extension_api_route(app, extension, route_config)
-
-
-def _add_wasm_extension_api_route(
-    app: FastAPI,
-    extension: WasmExtension,
-    route_config: dict[str, Any],
-) -> None:
-    method = _wasm_extension_api_method(extension, route_config.get("method"))
-    route_path = _wasm_extension_api_path(extension, route_config.get("path"))
-    export_name = _wasm_extension_api_export(extension, route_config.get("export"))
-    path_params = route_config.get("path_params") or {}
-    auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
-
-    if _has_route(app, route_path, method):
-        return
-
-    async def invoke_wasm_api_request(
-        request: Request,
-        account: Account | None = None,
-        access_token: str | None = None,
-    ) -> dict[str, Any]:
-        try:
-            payload = await _read_api_payload(request, path_params)
-            return await invoke_wasm_extension_export(
-                extension.id,
-                export_name,
-                payload,
-                user=account,
-                access_token=access_token,
-            )
-        except KeyError as exc:
-            raise HTTPException(status_code=404, detail=str(exc)) from exc
-        except PermissionError as exc:
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
-        except (TypeError, ValueError) as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-
-    async def invoke_private_wasm_extension_export(
-        request: Request,
-        access_token: Annotated[str | None, Depends(check_access_token)],
-        account: Account = Depends(check_account_exists),
-    ) -> dict[str, Any]:
-        return await invoke_wasm_api_request(request, account, access_token)
-
-    async def invoke_public_wasm_extension_export(request: Request) -> dict[str, Any]:
-        return await invoke_wasm_api_request(request)
-
-    app.add_api_route(
-        route_path,
-        (
-            invoke_public_wasm_extension_export
-            if auth == "public"
-            else invoke_private_wasm_extension_export
-        ),
-        methods=[method],
-        name=f"{extension.id}:{method}:{route_path}",
-        include_in_schema=False,
-    )
-
-
-def _add_wasm_extension_frame_config_route(
-    app: FastAPI,
-    extension: WasmExtension,
-) -> None:
-    route_path = _wasm_extension_frame_config_path(extension)
-    if _has_route(app, route_path, "POST"):
-        return
-
-    async def create_wasm_extension_frame_config(
-        request: Request,
-        access_token: Annotated[str | None, Depends(check_access_token)],
-        usr: UUID4 | None = None,
-    ) -> dict[str, Any]:
-        try:
-            body = await _read_json_object(request)
-        except (TypeError, ValueError) as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-
-        ui_route = _match_wasm_extension_ui_route(extension, body.get("path"))
-        auth = ui_route["auth"]
-
-        if auth == "user":
-            account = await check_account_exists(request, access_token, usr)
-            user_id: str | None = account.id
-        else:
-            user_id = await _optional_wasm_user_id(request, access_token, usr)
-
-        granted_permission_ids = await _wasm_extension_granted_permission_ids(extension)
-
-        return _wasm_extension_frame_config(
-            extension,
-            ui_route["frame_path"],
-            auth,
-            ui_route["path_params"],
-            ui_route["route_params"],
-            _read_wasm_extension_route_query(body.get("query")),
-            user_id,
-            granted_permission_ids,
-        )
-
-    app.add_api_route(
-        route_path,
-        create_wasm_extension_frame_config,
-        methods=["POST"],
-        name=f"{extension.id}:frame-config",
-        include_in_schema=False,
-    )
-
-
-async def _read_api_payload(
-    request: Request,
-    path_params: dict[str, str],
-) -> dict[str, Any]:
-    payload = _read_api_path_params(request, path_params)
-    payload.update(_read_api_query_params(request))
-    if request.method in {"POST", "PUT", "PATCH"}:
-        payload.update(await _read_json_object(request))
-    return payload
-
-
-async def _read_json_object(request: Request) -> dict[str, Any]:
-    body = await request.body()
-    if not body:
-        return {}
-    value = json.loads(body)
-    if not isinstance(value, dict):
-        raise TypeError("WASM extension API payload must be a JSON object.")
-    return value
-
-
-def _read_api_path_params(
-    request: Request,
-    path_params: dict[str, str],
-) -> dict[str, Any]:
-    payload: dict[str, Any] = {}
-    for key, value in request.path_params.items():
-        target = path_params.get(key) or _snake_to_camel(key)
-        payload[target] = value
-    return payload
-
-
-def _read_api_query_params(request: Request) -> dict[str, Any]:
-    return {_snake_to_camel(key): value for key, value in request.query_params.items()}
-
-
-def _wasm_extension_api_export(extension: WasmExtension, export_name: Any) -> str:
-    if not isinstance(export_name, str) or not export_name:
-        raise ValueError(f"Invalid API export for WASM extension '{extension.id}'.")
-
-    for export in extension.exports:
-        if export.get("name") != export_name:
-            continue
-        if export.get("visibility") in {"public", "authenticated"}:
-            return export_name
-        raise PermissionError(f"WASM export '{export_name}' is not callable over HTTP.")
-    raise KeyError(f"WASM extension '{extension.id}' has no export '{export_name}'.")
-
-
-def _wasm_extension_api_method(extension: WasmExtension, method: Any) -> str:
-    if not isinstance(method, str):
-        raise ValueError(f"Invalid API method for WASM extension '{extension.id}'.")
-    method = method.upper()
-    if method not in {"GET", "POST", "PUT", "PATCH", "DELETE"}:
-        raise ValueError(f"Unsupported API method for WASM extension '{extension.id}'.")
-    return method
-
-
-def _wasm_extension_api_path(extension: WasmExtension, path: Any) -> str:
-    if not isinstance(path, str) or not path.startswith("/"):
-        raise ValueError(f"Invalid API path for WASM extension '{extension.id}'.")
-    if path == "/":
-        return f"/api/v1/ext/{extension.id}"
-    return f"/api/v1/ext/{extension.id}{path}"
-
-
-def _has_route(app: FastAPI, route_path: str, method: str) -> bool:
-    for route in app.routes:
-        if getattr(route, "path", None) != route_path:
-            continue
-        methods = getattr(route, "methods", set()) or set()
-        if method in methods:
-            return True
-    return False
-
-
-def _snake_to_camel(value: str) -> str:
-    head, *tail = value.split("_")
-    return head + "".join(part.capitalize() for part in tail)
-
-
-def _add_wasm_extension_wrapper_route(
-    app: FastAPI,
-    extension: WasmExtension,
-    route_path: str,
-    auth: str,
-) -> None:
-    if _has_route(app, route_path, "GET"):
-        return
-
-    async def serve_private_wasm_extension_page(
-        request: Request,
-        account: Account = Depends(check_account_exists),
-    ) -> Any:
-        user = await get_user_from_account(account)
-        return _wasm_extension_wrapper_response(
-            request,
-            extension,
-            auth,
-            user.json() if user else None,
-        )
-
-    async def serve_public_wasm_extension_page(request: Request) -> Any:
-        return _wasm_extension_wrapper_response(
-            request,
-            extension,
-            auth,
-            None,
-        )
-
-    app.add_api_route(
-        route_path,
-        (
-            serve_public_wasm_extension_page
-            if auth == "public"
-            else serve_private_wasm_extension_page
-        ),
-        methods=["GET"],
-        name=f"{extension.id}:{route_path}",
-        include_in_schema=False,
-    )
-
-
-def _add_wasm_extension_frame_route(
-    app: FastAPI,
-    extension: WasmExtension,
-    frame_path: str,
-    entrypoint: Path,
-) -> None:
-    if _has_route(app, frame_path, "GET"):
-        return
-
-    async def serve_wasm_extension_frame(
-        request: Request,
-        user_id: str | None = Depends(_optional_wasm_user_id),
-    ) -> FileResponse:
-        _consume_wasm_extension_frame_token(request, extension, frame_path, user_id)
-        response = FileResponse(entrypoint)
-        response.headers["Content-Security-Policy"] = _wasm_extension_frame_csp(
-            request, extension
-        )
-        response.headers["Cache-Control"] = "no-store"
-        response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
-        response.headers["Cross-Origin-Resource-Policy"] = "same-origin"
-        # Extension access goes through the parent bridge.
-        response.headers["Permissions-Policy"] = (
-            "camera=(), microphone=(), geolocation=(), payment=(), "
-            "clipboard-read=(), usb=()"
-        )
-        response.headers["Referrer-Policy"] = "no-referrer"
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        return response
-
-    app.add_api_route(
-        frame_path,
-        serve_wasm_extension_frame,
-        methods=["GET"],
-        name=f"{extension.id}:frame:{frame_path}",
-        include_in_schema=False,
-    )
-
-
-def _wasm_extension_wrapper_response(
-    request: Request,
-    extension: WasmExtension,
-    auth: str,
-    user_json: str | None,
-) -> Any:
-    public = auth == "public"
-    response = template_renderer().TemplateResponse(
-        request,
-        "wasm_extension.html",
-        {
-            "extension": extension,
-            "public": public,
-            "user": user_json,
-        },
-    )
-    response.headers["Content-Security-Policy"] = "frame-ancestors 'self'"
-    response.headers["X-Frame-Options"] = "SAMEORIGIN"
-    return response
-
-
-def _wasm_extension_frame_csp(request: Request, extension: WasmExtension) -> str:
-    origin = str(request.base_url).rstrip("/")
-    extension_assets = f"{origin}/ext-assets/{extension.id}/"
-    return (
-        "sandbox allow-scripts; "
-        "default-src 'none'; "
-        f"script-src {extension_assets}; "
-        "script-src-attr 'none'; "
-        f"style-src {extension_assets}; "
-        "style-src-attr 'none'; "
-        f"img-src {extension_assets} data:; "
-        f"font-src {extension_assets}; "
-        "connect-src 'none'; "
-        "form-action 'none'; "
-        "object-src 'none'; "
-        "base-uri 'none'; "
-        "frame-src 'none'; "
-        "worker-src 'none'; "
-        "media-src 'none'; "
-        "manifest-src 'none'; "
-        "frame-ancestors 'self'"
-    )
-
-
-def _wasm_extension_frame_url(
-    extension: WasmExtension, frame_path: str, user_id: str | None
-) -> str:
-    token = _create_wasm_extension_frame_token(extension, frame_path, user_id)
-    return f"{frame_path}?frame_token={token}"
-
-
-def _create_wasm_extension_frame_token(
-    extension: WasmExtension,
-    frame_path: str,
-    user_id: str | None,
-) -> str:
-    token = uuid4().hex
-    cache.set(
-        _wasm_extension_frame_token_cache_key(token),
-        {
-            "extension_id": extension.id,
-            "frame_path": frame_path,
-            "user_id": user_id,
-        },
-        expiry=WASM_FRAME_TOKEN_EXPIRY_SECONDS,
-    )
-    return token
-
-
-def _consume_wasm_extension_frame_token(
-    request: Request,
-    extension: WasmExtension,
-    frame_path: str,
-    user_id: str | None,
-) -> None:
-    token = request.query_params.get("frame_token")
-    if not token:
-        _raise_wasm_extension_frame_not_found(extension, frame_path, "missing")
-
-    cache_key = _wasm_extension_frame_token_cache_key(token)
-    token_data = cache.get(cache_key)
-    if (
-        not isinstance(token_data, dict)
-        or token_data.get("extension_id") != extension.id
-        or token_data.get("frame_path") != frame_path
-    ):
-        _raise_wasm_extension_frame_not_found(
-            extension, frame_path, "unknown or expired"
-        )
-
-    token_user_id = token_data.get("user_id")
-    if token_user_id and token_user_id != user_id:
-        _raise_wasm_extension_frame_not_found(extension, frame_path, "wrong user")
-
-    cache.pop(cache_key)
-
-
-def _wasm_extension_frame_token_cache_key(token: str) -> str:
-    return f"wasm-frame-token:{token}"
-
-
-def _raise_wasm_extension_frame_not_found(
-    extension: WasmExtension,
-    frame_path: str,
-    reason: str,
-) -> NoReturn:
-    logger.warning(
-        f"WASM frame token {reason} for extension '{extension.id}' at '{frame_path}'."
-    )
-    raise HTTPException(status_code=404, detail="Not found")
-
-
-def _wasm_extension_bridge_api_routes(
-    extension: WasmExtension,
-    public: bool,
-) -> list[dict[str, str]]:
-    routes: list[dict[str, str]] = []
-    for route_config in extension.config.get("api_routes") or []:
-        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
-        if public and auth != "public":
-            continue
-        method = _wasm_extension_api_method(extension, route_config.get("method"))
-        path = _wasm_extension_api_path(extension, route_config.get("path"))
-        _wasm_extension_api_export(extension, route_config.get("export"))
-        routes.append(
-            {
-                "method": method,
-                "path": path,
-                "pattern": _path_template_pattern(path),
-            }
-        )
-    return routes
-
-
-def _wasm_extension_frame_config_path(extension: WasmExtension) -> str:
-    return f"/api/v1/ext/{extension.id}/_ui/frame"
-
-
-def _match_wasm_extension_ui_route(
-    extension: WasmExtension,
-    path: Any,
-) -> dict[str, Any]:
-    if not isinstance(path, str) or not path.startswith("/"):
-        raise HTTPException(status_code=404, detail="Not found")
-
-    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
-        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
-        route_params = _path_template_params(route_path, path)
-        if route_params is None:
-            continue
-
-        return {
-            "frame_path": f"/ext-frame/{extension.id}/{route_index}",
-            "auth": _wasm_extension_route_auth(extension, route_config.get("auth")),
-            "path_params": route_config.get("path_params") or {},
-            "route_params": route_params,
-        }
-
-    raise HTTPException(status_code=404, detail="Not found")
-
-
-def _path_template_params(template: str, path: str) -> dict[str, str] | None:
-    template_parts = _path_parts(template)
-    path_parts = _path_parts(path)
-    if len(template_parts) != len(path_parts):
-        return None
-
-    params: dict[str, str] = {}
-    for template_part, path_part in zip(template_parts, path_parts, strict=False):
-        if template_part.startswith("{") and template_part.endswith("}"):
-            param_name = template_part[1:-1]
-            if not param_name:
-                return None
-            params[param_name] = path_part
-            continue
-
-        if template_part != path_part:
-            return None
-
-    return params
-
-
-def _path_parts(path: str) -> list[str]:
-    return [part for part in path.strip("/").split("/") if part]
-
-
-def _wasm_extension_frame_config(
-    extension: WasmExtension,
-    frame_path: str,
-    auth: str,
-    path_params: dict[str, str],
-    route_params: dict[str, str],
-    query: dict[str, Any],
-    user_id: str | None,
-    permissions: set[str],
-) -> dict[str, Any]:
-    public = auth == "public"
-    return {
-        "extension": {
-            "id": extension.id,
-            "name": extension.name,
-        },
-        "frameUrl": _wasm_extension_frame_url(extension, frame_path, user_id),
-        "bridge": {
-            "extensionId": extension.id,
-            "public": public,
-            "routeParams": _map_wasm_extension_route_params(route_params, path_params),
-            "query": query,
-            "permissions": sorted(permissions),
-            "apiRoutes": _wasm_extension_bridge_api_routes(extension, public),
-        },
-    }
-
-
-async def _wasm_extension_granted_permission_ids(
-    extension: WasmExtension,
-) -> set[str]:
-    installed_extension = await get_installed_extension(extension.id)
-    if not installed_extension:
-        return set()
-    return {permission.id for permission in installed_extension.permissions}
-
-
-def _map_wasm_extension_route_params(
-    route_params: dict[str, str],
-    path_params: dict[str, str],
-) -> dict[str, str]:
-    payload: dict[str, str] = {}
-    for key, value in route_params.items():
-        target = path_params.get(key) or _snake_to_camel(key)
-        payload[target] = value
-    return payload
-
-
-def _read_wasm_extension_route_query(query: Any) -> dict[str, Any]:
-    if not isinstance(query, dict):
-        return {}
-
-    payload: dict[str, Any] = {}
-    for key, value in query.items():
-        if value is None:
-            continue
-        payload[_snake_to_camel(str(key))] = value
-    return payload
-
-
-def _path_template_pattern(path: str) -> str:
-    pattern = re.sub(r"\\{[^/{}]+\\}", r"[^/]+", re.escape(path))
-    return f"^{pattern}$"
-
-
-async def _optional_wasm_user_id(
-    request: Request,
-    access_token: Annotated[str | None, Depends(check_access_token)],
-    usr: UUID4 | None = None,
-) -> str | None:
-    try:
-        return await optional_user_id(request, access_token, usr)
-    except HTTPException:
-        return None
-
-
-def _wasm_extension_route_auth(extension: WasmExtension, auth: Any) -> str:
-    if auth in {"public", "user"}:
-        return auth
-    raise ValueError(f"Invalid route auth for WASM extension '{extension.id}'.")
-
-
-def _wasm_extension_ui_route_path(extension: WasmExtension, path: Any) -> str:
-    if not isinstance(path, str) or not path.startswith("/"):
-        raise ValueError(f"Invalid route path for WASM extension '{extension.id}'.")
-    if path == "/":
-        return "/ext"
-    return f"/ext{path}"
-
-
-def _wasm_extension_entrypoint(extension: WasmExtension, entrypoint: Any) -> Path:
-    if not isinstance(entrypoint, str) or not entrypoint:
-        raise ValueError(
-            f"Invalid route entrypoint for WASM extension '{extension.id}'."
-        )
-    if entrypoint.startswith("/"):
-        raise ValueError(
-            f"Route entrypoint for WASM extension '{extension.id}' must be a "
-            "relative extension path."
-        )
-
-    path = (extension.root_path / entrypoint).resolve()
-    root_path = extension.root_path.resolve()
-    if path != root_path and root_path not in path.parents:
-        raise ValueError(f"Route entrypoint escapes extension root: {entrypoint}")
-
-    static_path = (extension.root_path / "static").resolve()
-    if path == static_path or static_path in path.parents:
-        raise ValueError(
-            f"Route entrypoint for WASM extension '{extension.id}' must not be "
-            "inside the static asset directory."
-        )
-    if path.suffix.lower() != ".html":
-        raise ValueError(
-            f"Route entrypoint for WASM extension '{extension.id}' must be "
-            "an HTML file."
-        )
-    if not path.is_file():
-        raise FileNotFoundError(f"Route entrypoint not found: {path}")
-    return path
-
-
-def _reject_html_like_wasm_static_asset(path: Path) -> None:
-    with path.open("rb") as asset_file:
-        prefix = asset_file.read(512).lstrip().lower()
-    if prefix.startswith(WASM_EXTENSION_HTML_PREFIXES):
-        raise HTTPException(status_code=404)
-
-
-def _wasm_extension_core_asset_response(path: str) -> Response:
-    asset_name = path.removeprefix(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/")
-    if not asset_name or "/" in asset_name or "\\" in asset_name:
-        raise HTTPException(status_code=404)
-
-    generated_asset = WASM_EXTENSION_GENERATED_CORE_ASSETS.get(asset_name)
-    if generated_asset:
-        content, content_type = generated_asset
-        response = Response(content=content, media_type=content_type)
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Cache-Control"] = "no-store"
-        return response
-
-    asset_config = WASM_EXTENSION_CORE_STATIC_ASSETS.get(asset_name)
-    if not asset_config:
-        raise HTTPException(status_code=404)
-
-    relative_path, content_type = asset_config
-    asset_path = Path(settings.lnbits_path, relative_path)
-    if not asset_path.is_file():
-        raise HTTPException(status_code=404)
-
-    response = FileResponse(asset_path)
-    response.headers["Content-Type"] = content_type
-    response.headers["X-Content-Type-Options"] = "nosniff"
-    response.headers["Cache-Control"] = "no-store"
-    return response

lnbits/core/helpers.py

@@ -13,10 +13,10 @@ from lnbits.core.crud import (
     update_migration_version,
 )
 from lnbits.core.db import db as core_db
-from lnbits.core.extensions.loader import is_wasm_extension_id
-from lnbits.core.extensions.storage import migrate_wasm_extension_database
 from lnbits.core.models import DbVersion
 from lnbits.core.models.extensions import InstallableExtension
+from lnbits.core.wasm_ext.storage.crud import migrate_wasm_extension_database
+from lnbits.core.wasm_ext.wasm.loader import is_wasm_extension_id
 from lnbits.db import COCKROACH, POSTGRES, SQLITE, Connection
 from lnbits.settings import settings
 

lnbits/core/models/extensions.py

@@ -82,7 +82,7 @@ class ExtensionPermission(BaseModel):
     id: str
     label: str | None = None
     description: str | None = None
-    policy: dict[str, Any] | None = None
+    policies: list[Any] | None = None
 
     @staticmethod
     def list_from_config(config_json: Mapping[str, Any]) -> list[ExtensionPermission]:

lnbits/core/services/extensions.py

@@ -16,8 +16,9 @@ from lnbits.core.crud.extensions import (
     get_installed_extensions,
     update_installed_extension,
 )
-from lnbits.core.extensions.permissions import validate_wasm_extension_permissions
 from lnbits.core.helpers import migrate_extension_database
+from lnbits.core.wasm_ext.api.permissions import validate_wasm_extension_permissions
+from lnbits.core.wasm_ext.wasm.loader import is_wasm_extension_id
 from lnbits.db import Connection
 from lnbits.settings import settings
 
@@ -122,6 +123,9 @@ async def stop_extension_background_work(ext_id: str) -> bool:
     Stop background work for extension (like asyncio.Tasks, WebSockets, etc).
     Extension must expose a `myextension_stop()` function if it is starting tasks.
     """
+    if is_wasm_extension_id(ext_id):
+        return True
+
     upgrade_hash = settings.extension_upgrade_hash(ext_id)
     ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)
 
@@ -154,6 +158,9 @@ async def start_extension_background_work(ext_id: str) -> bool:
     Extension CAN expose a `myextension_start()` function if it is starting tasks.
     Extension MUST expose a `myextension_stop()` in that case.
     """
+    if is_wasm_extension_id(ext_id):
+        return False
+
     upgrade_hash = settings.extension_upgrade_hash(ext_id)
     ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)
 

lnbits/core/views/extension_api.py

@@ -11,7 +11,6 @@ from loguru import logger
 from lnbits.core.crud.extensions import get_user_extensions
 from lnbits.core.crud.wallets import get_wallets_ids
 from lnbits.core.db import db
-from lnbits.core.extensions.permissions import validate_extension_permissions
 from lnbits.core.models import (
     SimpleStatus,
 )
@@ -42,6 +41,7 @@ from lnbits.core.services.extensions import (
     install_extension,
     uninstall_extension,
 )
+from lnbits.core.wasm_ext.api.permissions import validate_extension_permissions
 from lnbits.db import Page
 from lnbits.decorators import (
     check_account_exists,

lnbits/core/wasm_ext/__init__.py

@@ -0,0 +1,24 @@
+from .api.host import ExtensionHostAPI
+from .api.models import ExtensionAPIMethod, ExtensionAPIMethodExport
+from .api.registry import (
+    extension_api_contract,
+    extension_api_method,
+    extension_api_permission_ids,
+    get_extension_api_method,
+    list_extension_api_methods,
+)
+from .api.runtime import ExtensionAPIHost
+from .wasm.loader import WasmExtension
+
+__all__ = [
+    "ExtensionAPIHost",
+    "ExtensionAPIMethod",
+    "ExtensionAPIMethodExport",
+    "ExtensionHostAPI",
+    "WasmExtension",
+    "extension_api_contract",
+    "extension_api_method",
+    "extension_api_permission_ids",
+    "get_extension_api_method",
+    "list_extension_api_methods",
+]

lnbits/core/wasm_ext/api/__init__.py

@@ -0,0 +1,22 @@
+from .host import ExtensionHostAPI
+from .models import ExtensionAPIMethod, ExtensionAPIMethodExport
+from .registry import (
+    extension_api_contract,
+    extension_api_method,
+    extension_api_permission_ids,
+    get_extension_api_method,
+    list_extension_api_methods,
+)
+from .runtime import ExtensionAPIHost
+
+__all__ = [
+    "ExtensionAPIHost",
+    "ExtensionAPIMethod",
+    "ExtensionAPIMethodExport",
+    "ExtensionHostAPI",
+    "extension_api_contract",
+    "extension_api_method",
+    "extension_api_permission_ids",
+    "get_extension_api_method",
+    "list_extension_api_methods",
+]

lnbits/core/wasm_ext/api/host.py

@@ -1,19 +1,21 @@
 from __future__ import annotations
 
-import inspect
 import json
 import logging
 import secrets
 import time
-from collections.abc import Awaitable, Callable, Iterable, Mapping
-from dataclasses import dataclass
-from functools import wraps
-from typing import Any, TypeVar, cast, get_type_hints
-
-from pydantic import BaseModel
+from collections.abc import Iterable, Mapping
+from typing import Any
 
 from lnbits.helpers import sha256s
 
+from ..storage.crud import (
+    storage_delete_row,
+    storage_get_paginated_rows,
+    storage_get_public_row,
+    storage_get_row,
+    storage_set_row,
+)
 from .models import (
     CreateInvoicePublicRequest,
     CreateInvoiceRequest,
@@ -42,102 +44,12 @@ from .models import (
     WalletBalanceRequest,
     WalletBalanceResponse,
 )
-from .storage import (
-    storage_delete_row,
-    storage_get_paginated_rows,
-    storage_get_public_row,
-    storage_get_row,
-    storage_set_row,
-)
+from .registry import extension_api_method
 
 logger = logging.getLogger("lnbits.extensions")
 
-_EXTENSION_API_METHOD_ATTR = "__lnbits_extension_api_method__"
-_EXTENSION_RUNTIME_PERMISSION_IDS = {"ui.camera.scan_qr"}
-_RequestModel = TypeVar("_RequestModel", bound=BaseModel)
-_ResponseModel = TypeVar("_ResponseModel", bound=BaseModel)
 
-
-@dataclass(frozen=True)
-class ExtensionAPIMethodExport:
-    method_id: str
-    namespace: str
-    name: str
-    host_interface: str
-    host_name: str
-    sdk_name: str
-    description: str
-    required_permission: str | None = None
-    require_auth: bool = True
-
-
-@dataclass(frozen=True)
-class ExtensionAPIMethod:
-    method_id: str
-    namespace: str
-    name: str
-    python_name: str
-    host_interface: str
-    host_name: str
-    sdk_name: str
-    description: str
-    request_model: type[BaseModel]
-    response_model: type[BaseModel]
-    required_permission: str | None = None
-    require_auth: bool = True
-
-    @property
-    def sdk_qualified_name(self) -> str:
-        return f"{self.namespace}.{self.sdk_name}"
-
-
-def extension_api_method(
-    *,
-    method_id: str,
-    namespace: str,
-    name: str,
-    host_name: str,
-    sdk_name: str,
-    description: str,
-    host_interface: str = "host",
-    required_permission: str | None = None,
-    require_auth: bool = True,
-) -> Callable[
-    [Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]],
-    Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
-]:
-    export = ExtensionAPIMethodExport(
-        method_id=method_id,
-        namespace=namespace,
-        name=name,
-        host_interface=host_interface,
-        host_name=host_name,
-        sdk_name=sdk_name,
-        description=description,
-        required_permission=required_permission,
-        require_auth=require_auth,
-    )
-
-    def decorator(
-        function: Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
-    ) -> Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]:
-        @wraps(function)
-        async def wrapper(self: Any, request: _RequestModel) -> _ResponseModel:
-            api = getattr(self, "api", self)
-            if require_auth and not api.has_authenticated_context():
-                raise PermissionError(
-                    f"Extension API method '{method_id}' requires authentication."
-                )
-            api.require_permission(required_permission)
-            return await function(self, request)
-
-        setattr(wrapper, _EXTENSION_API_METHOD_ATTR, export)
-        return wrapper
-
-    return decorator
-
-
-class ExtensionAPI:
+class ExtensionHostAPI:
     def __init__(
         self,
         extension_id: str,
@@ -154,34 +66,10 @@ class ExtensionAPI:
         self.access_token = access_token
         self.context = context
         self.owner_id = sha256s(user_id) if user_id else owner_id
-        self._uuid = secrets.token_urlsafe(12).replace("-", "_")
-        from .api_utils import ExtensionAPIUtils
+        from .utils import ExtensionAPIUtils
 
         self.utils = ExtensionAPIUtils(self)
 
-    def __repr__(self) -> str:
-        return (
-            "ExtensionAPI("
-            f"extension_id={self.extension_id!r}, "
-            f"context={self.context!r}, "
-            f"_uuid={self._uuid!r}"
-            ")"
-        )
-
-    def require_permission(self, permission: str | None) -> None:
-        if permission and permission not in self.permissions:
-            raise PermissionError(
-                f"Extension '{self.extension_id}' is missing permission '{permission}'."
-            )
-
-    def has_authenticated_context(self) -> bool:
-        return bool(self.user_id) or self.context == "event"
-
-    def _require_owner_id(self) -> str:
-        if not self.owner_id:
-            raise PermissionError("Extension API method requires an owner context.")
-        return self.owner_id
-
     @extension_api_method(
         method_id="storage.get",
         namespace="storage",
@@ -223,6 +111,7 @@ class ExtensionAPI:
             for field_name, value in row.items()
             if field_name in public_fields
         }
+        # todo: check public fields filtering
         return StorageGetResponse(data_json=json.dumps(public_row))
 
     @extension_api_method(
@@ -312,16 +201,14 @@ class ExtensionAPI:
         from lnbits.core.models.payments import CreateInvoice
         from lnbits.core.services.payments import create_payment_request
 
-        if self.user_id:
-            wallet = await get_wallet(request.wallet_id)
-            if wallet is None or wallet.user != self.user_id:
-                raise PermissionError(
-                    "Creating an invoice for this wallet requires an "
-                    "authenticated user context."
-                )
-        else:
-            pass
-            # todo: security stuff here
+        if not self.user_id:
+            raise PermissionError(
+                "Creating an invoice for this wallet requires an "
+                "authenticated user context."
+            )
+        wallet = await get_wallet(request.wallet_id)
+        if wallet is None or wallet.user != self.user_id:
+            raise PermissionError("Not your wallet.")
 
         payment = await create_payment_request(
             request.wallet_id,
@@ -355,8 +242,18 @@ class ExtensionAPI:
         from lnbits.core.models.payments import CreateInvoice
         from lnbits.core.services.payments import create_payment_request
 
-        table, wallet_field = self._public_invoice_wallet_source()
-        row = await storage_get_public_row(self.extension_id, table, request.source_id)
+        row: dict[str, Any] | None = None
+        wallet_field = ""
+        for policy in self._public_invoice_wallet_sources():
+            row = await storage_get_public_row(
+                self.extension_id,
+                policy["table"],
+                request.source_id,
+            )
+            if row:
+                wallet_field = policy["wallet_field"]
+                break
+
         if not row:
             raise PermissionError("Public invoice source was not found.")
 
@@ -512,10 +409,10 @@ class ExtensionAPI:
         require_auth=True,
     )
     async def http_request(self, request: HttpRequest) -> HttpResponse:
-        from .http_client import send_extension_http_request
+        from ..client.http import send_extension_http_request
 
-        policy = self.permission_policies.get("http.request") or {}
-        return await send_extension_http_request(self.extension_id, policy, request)
+        policies = self.permission_policies.get("http.request") or []
+        return await send_extension_http_request(self.extension_id, policies, request)
 
     @extension_api_method(
         method_id="extension.api.request",
@@ -528,12 +425,12 @@ class ExtensionAPI:
         require_auth=True,
     )
     async def extension_api_request(self, request: ExtensionApiRequest) -> HttpResponse:
-        from .extension_client import send_extension_api_request
+        from ..client.extensions import send_extension_api_request
 
-        policy = self.permission_policies.get("extension.api.request") or {}
+        policies = self.permission_policies.get("extension.api.request") or []
         return await send_extension_api_request(
             self.extension_id,
-            policy,
+            policies,
             self.user_id,
             self.access_token,
             request,
@@ -582,9 +479,9 @@ class ExtensionAPI:
     @staticmethod
     def _permission_data(
         permissions: Iterable[Any],
-    ) -> tuple[set[str], dict[str, dict[str, Any]]]:
+    ) -> tuple[set[str], dict[str, list[Any]]]:
         permission_ids: set[str] = set()
-        policies: dict[str, dict[str, Any]] = {}
+        policies: dict[str, list[Any]] = {}
 
         for permission in permissions:
             if isinstance(permission, str):
@@ -592,28 +489,27 @@ class ExtensionAPI:
                 continue
 
             permission_id: str | None = None
-            policy: Any = None
+            permission_policies: Any = None
             if isinstance(permission, Mapping):
                 permission_id = permission.get("id")  # type: ignore[assignment]
-                policy = permission.get("policy")
+                permission_policies = permission.get("policies")
             else:
                 permission_id = getattr(permission, "id", None)
-                policy = getattr(permission, "policy", None)
+                permission_policies = getattr(permission, "policies", None)
 
             if not permission_id:
                 continue
             permission_ids.add(permission_id)
-            if isinstance(policy, dict):
-                policies[permission_id] = policy
+            if isinstance(permission_policies, list):
+                policies[permission_id] = permission_policies
 
         return permission_ids, policies
 
     def _public_storage_fields(self, table: str) -> set[str]:
-        policy = self.permission_policies.get("ext.storage.read_public") or {}
-        tables = policy.get("tables")
-        if not isinstance(tables, list):
+        tables = self.permission_policies.get("ext.storage.read_public")
+        if not isinstance(tables, list) or not tables:
             raise PermissionError(
-                "Public storage reads require a tables policy for "
+                "Public storage reads require policies for "
                 "'ext.storage.read_public'."
             )
 
@@ -633,145 +529,54 @@ class ExtensionAPI:
 
         raise PermissionError(f"Storage table '{table}' is not publicly readable.")
 
-    def _public_invoice_wallet_source(self) -> tuple[str, str]:
-        policy = self.permission_policies.get("wallet.create_invoice_public") or {}
-        table = policy.get("table")
-        wallet_field = policy.get("wallet_field")
-        if not isinstance(table, str) or not table:
-            raise PermissionError(
-                "Public invoice creation requires a storage table policy."
-            )
-        if not isinstance(wallet_field, str) or not wallet_field:
-            raise PermissionError(
-                "Public invoice creation requires a wallet field policy."
-            )
-        return table, wallet_field
+    def _public_invoice_wallet_sources(self) -> list[dict[str, str]]:
+        policies = self.permission_policies.get("wallet.create_invoice_public")
+        if not isinstance(policies, list) or not policies:
+            raise PermissionError("Public invoice creation requires a policies list.")
 
-
-def list_extension_api_methods(
-    api_cls: type[ExtensionAPI] = ExtensionAPI,
-) -> list[ExtensionAPIMethod]:
-    methods: list[ExtensionAPIMethod] = []
-
-    for prefix, method_cls in _extension_api_method_sources(api_cls):
-        for python_name, function in inspect.getmembers(method_cls, inspect.isfunction):
-            export = getattr(function, _EXTENSION_API_METHOD_ATTR, None)
-            if not export:
-                continue
-
-            request_model, response_model = _get_method_models(function)
-            methods.append(
-                ExtensionAPIMethod(
-                    method_id=export.method_id,
-                    namespace=export.namespace,
-                    name=export.name,
-                    python_name=f"{prefix}.{python_name}" if prefix else python_name,
-                    host_interface=export.host_interface,
-                    host_name=export.host_name,
-                    sdk_name=export.sdk_name,
-                    description=export.description,
-                    request_model=request_model,
-                    response_model=response_model,
-                    required_permission=export.required_permission,
-                    require_auth=export.require_auth,
+        sources: list[dict[str, str]] = []
+        for source_policy in policies:
+            if not isinstance(source_policy, dict):
+                raise PermissionError(
+                    "Public invoice creation policies must be objects."
                 )
+            table = source_policy.get("table")
+            wallet_field = source_policy.get("wallet_field")
+            if not isinstance(table, str) or not table:
+                raise PermissionError(
+                    "Public invoice creation requires a storage table policy."
+                )
+            if not isinstance(wallet_field, str) or not wallet_field:
+                raise PermissionError(
+                    "Public invoice creation requires a wallet field policy."
+                )
+            sources.append({"table": table, "wallet_field": wallet_field})
+
+        if not sources:
+            raise PermissionError(
+                "Public invoice creation requires at least one valid policy."
+            )
+        return sources
+
+    def require_permission(self, permission: str | None) -> None:
+        if permission and permission not in self.permissions:
+            raise PermissionError(
+                f"Extension '{self.extension_id}' is missing permission '{permission}'."
             )
 
-    return sorted(methods, key=lambda method: method.method_id)
+    def has_authenticated_context(self) -> bool:
+        return bool(self.user_id) or self.context == "event"
 
+    def _require_owner_id(self) -> str:
+        if not self.owner_id:
+            raise PermissionError("Extension API method requires an owner context.")
+        return self.owner_id
 
-def _extension_api_method_sources(
-    api_cls: type[ExtensionAPI],
-) -> list[tuple[str, type[Any]]]:
-    sources: list[tuple[str, type[Any]]] = [("", api_cls)]
-    if issubclass(api_cls, ExtensionAPI):
-        from .api_utils import extension_api_utils_method_classes
-
-        sources.extend(extension_api_utils_method_classes().items())
-    return sources
-
-
-def extension_api_permission_ids(
-    api_cls: type[ExtensionAPI] = ExtensionAPI,
-) -> set[str]:
-    permissions = {
-        method.required_permission
-        for method in list_extension_api_methods(api_cls)
-        if method.required_permission
-    }
-    permissions.update(_EXTENSION_RUNTIME_PERMISSION_IDS)
-    return permissions
-
-
-def get_extension_api_method(
-    method_id: str,
-    api_cls: type[ExtensionAPI] = ExtensionAPI,
-) -> ExtensionAPIMethod:
-    for method in list_extension_api_methods(api_cls):
-        if method.method_id == method_id:
-            return method
-    raise KeyError(f"Unknown extension API method '{method_id}'.")
-
-
-def extension_api_contract(
-    api_cls: type[ExtensionAPI] = ExtensionAPI,
-) -> dict[str, object]:
-    return {
-        "version": 1,
-        "methods": [
-            {
-                "id": method.method_id,
-                "namespace": method.namespace,
-                "name": method.name,
-                "python_name": method.python_name,
-                "host_interface": method.host_interface,
-                "host_name": method.host_name,
-                "sdk_name": method.sdk_name,
-                "sdk_qualified_name": method.sdk_qualified_name,
-                "description": method.description,
-                "required_permission": method.required_permission,
-                "require_auth": method.require_auth,
-                "request_schema": method.request_model.schema(
-                    ref_template="#/definitions/{model}"
-                ),
-                "response_schema": method.response_model.schema(
-                    ref_template="#/definitions/{model}"
-                ),
-            }
-            for method in list_extension_api_methods(api_cls)
-        ],
-    }
-
-
-def _get_method_models(
-    function: Callable[..., object],
-) -> tuple[type[BaseModel], type[BaseModel]]:
-    signature = inspect.signature(function)
-    request_parameters = [
-        parameter
-        for parameter in signature.parameters.values()
-        if parameter.name != "self"
-    ]
-    if len(request_parameters) != 1:
-        raise TypeError(
-            f"Extension API method '{function.__name__}' must accept one request model."
+    def __repr__(self) -> str:
+        return (
+            "ExtensionHostAPI("
+            f"extension_id={self.extension_id!r}, "
+            f"context={self.context!r}, "
+            f"owner_id={self.owner_id!r}"
+            ")"
         )
-
-    hints = get_type_hints(function)
-    request_model = hints.get(request_parameters[0].name)
-    response_model = hints.get("return")
-
-    if not _is_pydantic_model(request_model):
-        raise TypeError(
-            f"Extension API method '{function.__name__}' request must be a BaseModel."
-        )
-    if not _is_pydantic_model(response_model):
-        raise TypeError(
-            f"Extension API method '{function.__name__}' response must be a BaseModel."
-        )
-
-    return cast(type[BaseModel], request_model), cast(type[BaseModel], response_model)
-
-
-def _is_pydantic_model(value: object) -> bool:
-    return isinstance(value, type) and issubclass(value, BaseModel)

lnbits/core/wasm_ext/api/models.py

@@ -1,9 +1,43 @@
 import json
+from dataclasses import dataclass
 from typing import Any, Literal
 
 from pydantic import BaseModel, Field, root_validator
 
 
+@dataclass(frozen=True)
+class ExtensionAPIMethodExport:
+    method_id: str
+    namespace: str
+    name: str
+    host_interface: str
+    host_name: str
+    sdk_name: str
+    description: str
+    required_permission: str | None = None
+    require_auth: bool = True
+
+
+@dataclass(frozen=True)
+class ExtensionAPIMethod:
+    method_id: str
+    namespace: str
+    name: str
+    python_name: str
+    host_interface: str
+    host_name: str
+    sdk_name: str
+    description: str
+    request_model: type[BaseModel]
+    response_model: type[BaseModel]
+    required_permission: str | None = None
+    require_auth: bool = True
+
+    @property
+    def sdk_qualified_name(self) -> str:
+        return f"{self.namespace}.{self.sdk_name}"
+
+
 class EmptyRequest(BaseModel):
     pass
 
@@ -82,7 +116,12 @@ class CreateInvoiceRequest(BaseModel):
 
 
 class CreateInvoicePublicRequest(BaseModel):
-    source_id: str = Field(..., min_length=1, max_length=512)
+    source_id: str = Field(
+        ...,
+        min_length=1,
+        max_length=512,
+        description="The source ID (entry id) of the wallet to create the invoice for.",
+    )
     amount: float = Field(..., gt=0)
     currency: str = Field(..., min_length=1, max_length=8)
     memo: str = Field("", max_length=512)

lnbits/core/wasm_ext/api/permissions.py

@@ -1,8 +1,8 @@
 from collections.abc import Iterable
 from typing import Any
 
-from lnbits.core.extensions.api import extension_api_permission_ids
 from lnbits.core.models.extensions import ExtensionPermission, InstallableExtension
+from lnbits.core.wasm_ext.api.registry import extension_api_permission_ids
 
 
 def validate_extension_permissions(

lnbits/core/wasm_ext/api/registry.py

@@ -0,0 +1,199 @@
+from __future__ import annotations
+
+import inspect
+from collections.abc import Awaitable, Callable
+from functools import wraps
+from typing import Any, TypeVar, cast, get_type_hints
+
+from pydantic import BaseModel
+
+from .models import ExtensionAPIMethod, ExtensionAPIMethodExport
+
+_EXTENSION_API_METHOD_ATTR = "__lnbits_extension_api_method__"
+_EXTENSION_RUNTIME_PERMISSION_IDS = {"ui.camera.scan_qr"}
+_RequestModel = TypeVar("_RequestModel", bound=BaseModel)
+_ResponseModel = TypeVar("_ResponseModel", bound=BaseModel)
+
+
+def extension_api_method(
+    *,
+    method_id: str,
+    namespace: str,
+    name: str,
+    host_name: str,
+    sdk_name: str,
+    description: str,
+    host_interface: str = "host",
+    required_permission: str | None = None,
+    require_auth: bool = True,
+) -> Callable[
+    [Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]],
+    Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
+]:
+    export = ExtensionAPIMethodExport(
+        method_id=method_id,
+        namespace=namespace,
+        name=name,
+        host_interface=host_interface,
+        host_name=host_name,
+        sdk_name=sdk_name,
+        description=description,
+        required_permission=required_permission,
+        require_auth=require_auth,
+    )
+
+    def decorator(
+        function: Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
+    ) -> Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]:
+        @wraps(function)
+        async def wrapper(self: Any, request: _RequestModel) -> _ResponseModel:
+            api = getattr(self, "api", self)
+            if require_auth and not api.has_authenticated_context():
+                raise PermissionError(
+                    f"Extension API method '{method_id}' requires authentication."
+                )
+            api.require_permission(required_permission)
+            return await function(self, request)
+
+        setattr(wrapper, _EXTENSION_API_METHOD_ATTR, export)
+        return wrapper
+
+    return decorator
+
+
+def list_extension_api_methods(
+    api_cls: type[Any] | None = None,
+) -> list[ExtensionAPIMethod]:
+    api_cls = _default_api_cls(api_cls)
+    methods: list[ExtensionAPIMethod] = []
+
+    for prefix, method_cls in _extension_api_method_sources(api_cls):
+        for python_name, function in inspect.getmembers(method_cls, inspect.isfunction):
+            export = getattr(function, _EXTENSION_API_METHOD_ATTR, None)
+            if not export:
+                continue
+
+            request_model, response_model = _get_method_models(function)
+            methods.append(
+                ExtensionAPIMethod(
+                    method_id=export.method_id,
+                    namespace=export.namespace,
+                    name=export.name,
+                    python_name=f"{prefix}.{python_name}" if prefix else python_name,
+                    host_interface=export.host_interface,
+                    host_name=export.host_name,
+                    sdk_name=export.sdk_name,
+                    description=export.description,
+                    request_model=request_model,
+                    response_model=response_model,
+                    required_permission=export.required_permission,
+                    require_auth=export.require_auth,
+                )
+            )
+
+    return sorted(methods, key=lambda method: method.method_id)
+
+
+def extension_api_permission_ids(api_cls: type[Any] | None = None) -> set[str]:
+    permissions = {
+        method.required_permission
+        for method in list_extension_api_methods(api_cls)
+        if method.required_permission
+    }
+    permissions.update(_EXTENSION_RUNTIME_PERMISSION_IDS)
+    return permissions
+
+
+def get_extension_api_method(
+    method_id: str,
+    api_cls: type[Any] | None = None,
+) -> ExtensionAPIMethod:
+    for method in list_extension_api_methods(api_cls):
+        if method.method_id == method_id:
+            return method
+    raise KeyError(f"Unknown extension API method '{method_id}'.")
+
+
+def extension_api_contract(api_cls: type[Any] | None = None) -> dict[str, object]:
+    return {
+        "version": 1,
+        "methods": [
+            {
+                "id": method.method_id,
+                "namespace": method.namespace,
+                "name": method.name,
+                "python_name": method.python_name,
+                "host_interface": method.host_interface,
+                "host_name": method.host_name,
+                "sdk_name": method.sdk_name,
+                "sdk_qualified_name": method.sdk_qualified_name,
+                "description": method.description,
+                "required_permission": method.required_permission,
+                "require_auth": method.require_auth,
+                "request_schema": method.request_model.schema(
+                    ref_template="#/definitions/{model}"
+                ),
+                "response_schema": method.response_model.schema(
+                    ref_template="#/definitions/{model}"
+                ),
+            }
+            for method in list_extension_api_methods(api_cls)
+        ],
+    }
+
+
+def _default_api_cls(api_cls: type[Any] | None) -> type[Any]:
+    if api_cls is not None:
+        return api_cls
+
+    from .host import ExtensionHostAPI
+
+    return ExtensionHostAPI
+
+
+def _extension_api_method_sources(
+    api_cls: type[Any],
+) -> list[tuple[str, type[Any]]]:
+    sources: list[tuple[str, type[Any]]] = [("", api_cls)]
+
+    from .host import ExtensionHostAPI
+
+    if issubclass(api_cls, ExtensionHostAPI):
+        from .utils import extension_api_utils_method_classes
+
+        sources.extend(extension_api_utils_method_classes().items())
+    return sources
+
+
+def _get_method_models(
+    function: Callable[..., object],
+) -> tuple[type[BaseModel], type[BaseModel]]:
+    signature = inspect.signature(function)
+    request_parameters = [
+        parameter
+        for parameter in signature.parameters.values()
+        if parameter.name != "self"
+    ]
+    if len(request_parameters) != 1:
+        raise TypeError(
+            f"Extension API method '{function.__name__}' must accept one request model."
+        )
+
+    hints = get_type_hints(function)
+    request_model = hints.get(request_parameters[0].name)
+    response_model = hints.get("return")
+
+    if not _is_pydantic_model(request_model):
+        raise TypeError(
+            f"Extension API method '{function.__name__}' request must be a BaseModel."
+        )
+    if not _is_pydantic_model(response_model):
+        raise TypeError(
+            f"Extension API method '{function.__name__}' response must be a BaseModel."
+        )
+
+    return cast(type[BaseModel], request_model), cast(type[BaseModel], response_model)
+
+
+def _is_pydantic_model(value: object) -> bool:
+    return isinstance(value, type) and issubclass(value, BaseModel)

lnbits/core/wasm_ext/api/runtime.py

@@ -7,7 +7,9 @@ from typing import Any
 
 from pydantic import BaseModel
 
-from .api import ExtensionAPI, ExtensionAPIMethod, list_extension_api_methods
+from .host import ExtensionHostAPI
+from .models import ExtensionAPIMethod
+from .registry import list_extension_api_methods
 
 HostImport = Callable[..., Awaitable[dict[str, Any]]]
 
@@ -15,9 +17,9 @@ HostImport = Callable[..., Awaitable[dict[str, Any]]]
 class ExtensionAPIHost:
     def __init__(
         self,
-        api: ExtensionAPI,
+        api: ExtensionHostAPI,
         *,
-        api_cls: type[ExtensionAPI] = ExtensionAPI,
+        api_cls: type[ExtensionHostAPI] = ExtensionHostAPI,
     ) -> None:
         self.api = api
         self.methods = list_extension_api_methods(api_cls)

lnbits/core/wasm_ext/api/utils.py

@@ -4,7 +4,6 @@ import time
 from datetime import datetime
 from typing import TYPE_CHECKING, Any
 
-from .api import extension_api_method
 from .models import (
     Bolt11Request,
     CurrencyConvertRequest,
@@ -29,13 +28,14 @@ from .models import (
     VerifyPreimageRequest,
     VerifyPreimageResponse,
 )
+from .registry import extension_api_method
 
 if TYPE_CHECKING:
-    from .api import ExtensionAPI
+    from .host import ExtensionHostAPI
 
 
 class ExtensionAPIUtils:
-    def __init__(self, api: ExtensionAPI) -> None:
+    def __init__(self, api: ExtensionHostAPI) -> None:
         self.api = api
         self.currencies = ExtensionCurrencyUtils(api)
         self.server = ExtensionServerUtils(api)
@@ -43,7 +43,7 @@ class ExtensionAPIUtils:
 
 
 class _ExtensionAPIUtilsGroup:
-    def __init__(self, api: ExtensionAPI) -> None:
+    def __init__(self, api: ExtensionHostAPI) -> None:
         self.api = api
 
 

lnbits/core/wasm_ext/client/__init__.py

@@ -0,0 +1,4 @@
+from .extensions import send_extension_api_request
+from .http import send_extension_http_request
+
+__all__ = ["send_extension_api_request", "send_extension_http_request"]

lnbits/core/wasm_ext/client/extensions.py

@@ -13,7 +13,7 @@ from lnbits.core.crud.extensions import (
 )
 from lnbits.settings import settings
 
-from .models import ExtensionApiRequest, HttpResponse
+from ..api.models import ExtensionApiRequest, HttpResponse
 
 EXTENSION_API_TIMEOUT_SECONDS = 10.0
 EXTENSION_API_MAX_RESPONSE_BYTES = 262_144
@@ -31,7 +31,7 @@ _FORBIDDEN_RESPONSE_HEADERS = {
 
 async def send_extension_api_request(
     caller_extension_id: str,
-    policy: dict[str, Any],
+    policies: list[Any],
     user_id: str | None,
     access_token: str | None,
     request: ExtensionApiRequest,
@@ -42,7 +42,7 @@ async def send_extension_api_request(
         raise PermissionError("Extension API requests require an account access token.")
 
     target_extension_id = _target_extension_id(request.extension_id)
-    access = _target_extension_access(policy, target_extension_id)
+    access = _target_extension_access(policies, target_extension_id)
     _require_method_access(caller_extension_id, target_extension_id, access, request)
     await _require_enabled_extension(target_extension_id, user_id)
 
@@ -81,16 +81,13 @@ def _target_extension_id(extension_id: str) -> str:
     return target
 
 
-def _target_extension_access(
-    policy: dict[str, Any], target_extension_id: str
-) -> set[str]:
-    extensions = policy.get("extensions")
-    if not isinstance(extensions, list) or not extensions:
+def _target_extension_access(policies: list[Any], target_extension_id: str) -> set[str]:
+    if not isinstance(policies, list) or not policies:
         raise PermissionError(
             "Extension API requests require a non-empty extensions policy."
         )
 
-    for extension in extensions:
+    for extension in policies:
         if isinstance(extension, str):
             extension_id = extension
             access = ["read"]

lnbits/core/wasm_ext/client/http.py

@@ -7,7 +7,7 @@ from urllib.parse import urlparse
 
 import httpx
 
-from .models import HttpRequest, HttpResponse
+from ..api.models import HttpRequest, HttpResponse
 
 HTTP_REQUEST_TIMEOUT_SECONDS = 10.0
 HTTP_MAX_RESPONSE_BYTES = 262_144
@@ -30,10 +30,10 @@ _FORBIDDEN_RESPONSE_HEADERS = {
 
 async def send_extension_http_request(
     extension_id: str,
-    policy: dict[str, Any],
+    policies: list[Any],
     request: HttpRequest,
 ) -> HttpResponse:
-    allowed_origins = _allowed_origins(policy)
+    allowed_origins = _allowed_origins(policies)
     origin = _request_origin(request.url)
     if origin not in allowed_origins:
         raise PermissionError(
@@ -68,13 +68,13 @@ async def send_extension_http_request(
         raise ValueError("HTTP request failed.") from exc
 
 
-def _allowed_origins(policy: dict[str, Any]) -> set[str]:
-    hosts = policy.get("hosts")
-    if not isinstance(hosts, list) or not hosts:
+def _allowed_origins(policies: list[Any]) -> set[str]:
+    if not isinstance(policies, list) or not policies:
         raise PermissionError("HTTP requests require a non-empty hosts policy.")
 
     origins: set[str] = set()
-    for host in hosts:
+    for policy in policies:
+        host = policy.get("host") if isinstance(policy, dict) else policy
         if not isinstance(host, str) or not host:
             continue
         origins.add(_request_origin(host))

lnbits/core/wasm_ext/routes/__init__.py

@@ -0,0 +1,3 @@
+from .register import register_wasm_extension
+
+__all__ = ["register_wasm_extension"]

lnbits/core/wasm_ext/routes/api.py

@@ -0,0 +1,168 @@
+from __future__ import annotations
+
+import json
+import re
+from typing import Annotated, Any
+
+from fastapi import Depends, FastAPI, HTTPException, Request
+
+from lnbits.core.models import Account
+from lnbits.decorators import check_access_token, check_account_exists
+
+from ..wasm.invoke import invoke_wasm_extension_export
+from ..wasm.loader import WasmExtension
+
+
+def register_wasm_extension_api_routes(app: FastAPI, extension: WasmExtension) -> None:
+    for route_config in extension.config.get("api_routes") or []:
+        _add_wasm_extension_api_route(app, extension, route_config)
+
+
+def _add_wasm_extension_api_route(
+    app: FastAPI,
+    extension: WasmExtension,
+    route_config: dict[str, Any],
+) -> None:
+    method = _wasm_extension_api_method(extension, route_config.get("method"))
+    route_path = _wasm_extension_api_path(extension, route_config.get("path"))
+    export_name = _wasm_extension_api_export(extension, route_config.get("export"))
+    path_params = route_config.get("path_params") or {}
+    auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
+
+    if _has_route(app, route_path, method):
+        return
+
+    async def invoke_wasm_api_request(
+        request: Request,
+        account: Account | None = None,
+        access_token: str | None = None,
+    ) -> dict[str, Any]:
+        try:
+            payload = await _read_api_payload(request, path_params)
+            return await invoke_wasm_extension_export(
+                extension.id,
+                export_name,
+                payload,
+                user=account,
+                access_token=access_token,
+            )
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=str(exc)) from exc
+        except PermissionError as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+        except (TypeError, ValueError) as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+    async def invoke_private_wasm_extension_export(
+        request: Request,
+        access_token: Annotated[str | None, Depends(check_access_token)],
+        account: Account = Depends(check_account_exists),
+    ) -> dict[str, Any]:
+        return await invoke_wasm_api_request(request, account, access_token)
+
+    async def invoke_public_wasm_extension_export(request: Request) -> dict[str, Any]:
+        return await invoke_wasm_api_request(request)
+
+    app.add_api_route(
+        route_path,
+        (
+            invoke_public_wasm_extension_export
+            if auth == "public"
+            else invoke_private_wasm_extension_export
+        ),
+        methods=[method],
+        name=f"{extension.id}:{method}:{route_path}",
+        include_in_schema=False,
+    )
+
+
+async def _read_api_payload(
+    request: Request,
+    path_params: dict[str, str],
+) -> dict[str, Any]:
+    payload = _read_api_path_params(request, path_params)
+    payload.update(_read_api_query_params(request))
+    if request.method in {"POST", "PUT", "PATCH"}:
+        payload.update(await _read_json_object(request))
+    return payload
+
+
+async def _read_json_object(request: Request) -> dict[str, Any]:
+    body = await request.body()
+    if not body:
+        return {}
+    value = json.loads(body)
+    if not isinstance(value, dict):
+        raise TypeError("WASM extension API payload must be a JSON object.")
+    return value
+
+
+def _read_api_path_params(
+    request: Request,
+    path_params: dict[str, str],
+) -> dict[str, Any]:
+    payload: dict[str, Any] = {}
+    for key, value in request.path_params.items():
+        target = path_params.get(key) or _snake_to_camel(key)
+        payload[target] = value
+    return payload
+
+
+def _read_api_query_params(request: Request) -> dict[str, Any]:
+    return {_snake_to_camel(key): value for key, value in request.query_params.items()}
+
+
+def _wasm_extension_api_export(extension: WasmExtension, export_name: Any) -> str:
+    if not isinstance(export_name, str) or not export_name:
+        raise ValueError(f"Invalid API export for WASM extension '{extension.id}'.")
+
+    for export in extension.exports:
+        if export.get("name") != export_name:
+            continue
+        if export.get("visibility") in {"public", "authenticated"}:
+            return export_name
+        raise PermissionError(f"WASM export '{export_name}' is not callable over HTTP.")
+    raise KeyError(f"WASM extension '{extension.id}' has no export '{export_name}'.")
+
+
+def _wasm_extension_api_method(extension: WasmExtension, method: Any) -> str:
+    if not isinstance(method, str):
+        raise ValueError(f"Invalid API method for WASM extension '{extension.id}'.")
+    method = method.upper()
+    if method not in {"GET", "POST", "PUT", "PATCH", "DELETE"}:
+        raise ValueError(f"Unsupported API method for WASM extension '{extension.id}'.")
+    return method
+
+
+def _wasm_extension_api_path(extension: WasmExtension, path: Any) -> str:
+    if not isinstance(path, str) or not path.startswith("/"):
+        raise ValueError(f"Invalid API path for WASM extension '{extension.id}'.")
+    if path == "/":
+        return f"/api/v1/ext/{extension.id}"
+    return f"/api/v1/ext/{extension.id}{path}"
+
+
+def _wasm_extension_route_auth(extension: WasmExtension, auth: Any) -> str:
+    if auth in {"public", "user"}:
+        return auth
+    raise ValueError(f"Invalid route auth for WASM extension '{extension.id}'.")
+
+
+def _has_route(app: FastAPI, route_path: str, method: str) -> bool:
+    for route in app.routes:
+        if getattr(route, "path", None) != route_path:
+            continue
+        methods = getattr(route, "methods", set()) or set()
+        if method in methods:
+            return True
+    return False
+
+
+def _snake_to_camel(value: str) -> str:
+    head, *tail = value.split("_")
+    return head + "".join(part.capitalize() for part in tail)
+
+
+def _path_template_pattern(path: str) -> str:
+    pattern = re.sub(r"\\{[^/{}]+\\}", r"[^/]+", re.escape(path))
+    return f"^{pattern}$"

lnbits/core/wasm_ext/routes/assets.py

@@ -0,0 +1,139 @@
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+from fastapi import FastAPI, HTTPException
+from fastapi.responses import FileResponse, Response
+from fastapi.staticfiles import StaticFiles
+from starlette.staticfiles import PathLike as StaticFilesPathLike
+from starlette.types import Scope
+
+from lnbits.settings import settings
+
+from ..wasm.loader import WasmExtension
+
+WASM_EXTENSION_CORE_ASSET_PREFIX = "_lnbits"
+WASM_EXTENSION_CORE_STATIC_ASSETS = {
+    "bundle.min.css": ("static/bundle.min.css", "text/css; charset=utf-8"),
+    "material-icons-v50.woff2": (
+        "static/fonts/material-icons-v50.woff2",
+        "font/woff2",
+    ),
+    "quasar.css": ("static/vendor/quasar.css", "text/css; charset=utf-8"),
+    "quasar.umd.prod.js": (
+        "static/vendor/quasar.umd.prod.js",
+        "text/javascript; charset=utf-8",
+    ),
+    "qrcode.vue.browser.js": (
+        "static/vendor/qrcode.vue.browser.js",
+        "text/javascript; charset=utf-8",
+    ),
+    "vue.global.prod.js": (
+        "static/vendor/vue.global.prod.js",
+        "text/javascript; charset=utf-8",
+    ),
+}
+WASM_EXTENSION_GENERATED_CORE_ASSETS = {
+    "material-icons.css": (
+        """
+        @font-face {
+          font-family: 'Material Icons';
+          font-style: normal;
+          font-weight: 400;
+          src: url('./material-icons-v50.woff2') format('woff2');
+        }
+        """,
+        "text/css; charset=utf-8",
+    )
+}
+WASM_EXTENSION_STATIC_MIME_TYPES = {
+    ".css": "text/css; charset=utf-8",
+    ".gif": "image/gif",
+    ".ico": "image/x-icon",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".js": "text/javascript; charset=utf-8",
+    ".png": "image/png",
+    ".webp": "image/webp",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+}
+WASM_EXTENSION_TEXT_STATIC_EXTENSIONS = {".css", ".js"}
+WASM_EXTENSION_HTML_PREFIXES = (b"<!doctype", b"<html", b"<script")
+
+
+class GuardedWasmExtensionStaticFiles(StaticFiles):
+    async def get_response(self, path: str, scope: Scope) -> Response:
+        if path.startswith(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/"):
+            return _wasm_extension_core_asset_response(path)
+        if Path(path).suffix.lower() not in WASM_EXTENSION_STATIC_MIME_TYPES:
+            raise HTTPException(status_code=404)
+        return await super().get_response(path, scope)
+
+    def file_response(
+        self,
+        full_path: StaticFilesPathLike,
+        stat_result: os.stat_result,
+        scope: Scope,
+        status_code: int = 200,
+    ) -> Response:
+        suffix = Path(full_path).suffix.lower()
+        if suffix in WASM_EXTENSION_TEXT_STATIC_EXTENSIONS:
+            _reject_html_like_wasm_static_asset(Path(full_path))
+
+        response = super().file_response(full_path, stat_result, scope, status_code)
+        response.headers["Content-Type"] = WASM_EXTENSION_STATIC_MIME_TYPES[suffix]
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Cache-Control"] = "no-store"
+        return response
+
+
+def mount_wasm_extension_static(app: FastAPI, extension: WasmExtension) -> None:
+    static_path = extension.root_path / "static"
+
+    mount_path = f"/ext-assets/{extension.id}"
+    if any(getattr(route, "path", None) == mount_path for route in app.routes):
+        return
+
+    app.mount(
+        mount_path,
+        GuardedWasmExtensionStaticFiles(directory=static_path, check_dir=False),
+        name=f"{extension.id}-static",
+    )
+
+
+def _reject_html_like_wasm_static_asset(path: Path) -> None:
+    with path.open("rb") as asset_file:
+        prefix = asset_file.read(512).lstrip().lower()
+    if prefix.startswith(WASM_EXTENSION_HTML_PREFIXES):
+        raise HTTPException(status_code=404)
+
+
+def _wasm_extension_core_asset_response(path: str) -> Response:
+    asset_name = path.removeprefix(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/")
+    if not asset_name or "/" in asset_name or "\\" in asset_name:
+        raise HTTPException(status_code=404)
+
+    generated_asset = WASM_EXTENSION_GENERATED_CORE_ASSETS.get(asset_name)
+    if generated_asset:
+        content, content_type = generated_asset
+        response = Response(content=content, media_type=content_type)
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Cache-Control"] = "no-store"
+        return response
+
+    asset_config = WASM_EXTENSION_CORE_STATIC_ASSETS.get(asset_name)
+    if not asset_config:
+        raise HTTPException(status_code=404)
+
+    relative_path, content_type = asset_config
+    asset_path = Path(settings.lnbits_path, relative_path)
+    if not asset_path.is_file():
+        raise HTTPException(status_code=404)
+
+    response = FileResponse(asset_path)
+    response.headers["Content-Type"] = content_type
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["Cache-Control"] = "no-store"
+    return response

lnbits/core/wasm_ext/routes/register.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+from fastapi import FastAPI
+from loguru import logger
+
+from lnbits.core.db import core_app_extra
+from lnbits.settings import settings
+
+from ..wasm.component import warm_wasm_extension
+from ..wasm.loader import WasmExtension, load_wasm_extension
+from .api import register_wasm_extension_api_routes
+from .assets import mount_wasm_extension_static
+from .ui import register_wasm_extension_ui_routes
+
+
+def register_wasm_extension(app: FastAPI, ext_id: str) -> WasmExtension:
+    loaded = load_wasm_extension(ext_id)
+
+    warm_wasm_extension(loaded)
+    mount_wasm_extension_static(app, loaded)
+    register_wasm_extension_ui_routes(app, loaded)
+    register_wasm_extension_api_routes(app, loaded)
+
+    core_app_extra.wasm_extension_registry.register(loaded)
+
+    settings.activate_extension_paths(ext_id, "", [])
+    logger.info(
+        f"Loaded WASM extension '{loaded.id}' "
+        f"({loaded.module_path.stat().st_size} bytes)."
+    )
+    return loaded

lnbits/core/wasm_ext/routes/security.py

@@ -0,0 +1,127 @@
+from __future__ import annotations
+
+from typing import Any, NoReturn
+from uuid import uuid4
+
+from fastapi import HTTPException, Request
+from loguru import logger
+
+from lnbits.helpers import template_renderer
+from lnbits.utils.cache import cache
+
+from ..wasm.loader import WasmExtension
+
+WASM_FRAME_TOKEN_EXPIRY_SECONDS = 60
+
+
+def wasm_extension_wrapper_response(
+    request: Request,
+    extension: WasmExtension,
+    auth: str,
+    user_json: str | None,
+) -> Any:
+    public = auth == "public"
+    response = template_renderer().TemplateResponse(
+        request,
+        "wasm_extension.html",
+        {
+            "extension": extension,
+            "public": public,
+            "user": user_json,
+        },
+    )
+    response.headers["Content-Security-Policy"] = "frame-ancestors 'self'"
+    response.headers["X-Frame-Options"] = "SAMEORIGIN"
+    return response
+
+
+def wasm_extension_frame_csp(request: Request, extension: WasmExtension) -> str:
+    origin = str(request.base_url).rstrip("/")
+    extension_assets = f"{origin}/ext-assets/{extension.id}/"
+    return (
+        "sandbox allow-scripts; "
+        "default-src 'none'; "
+        f"script-src {extension_assets}; "
+        "script-src-attr 'none'; "
+        f"style-src {extension_assets}; "
+        "style-src-attr 'none'; "
+        f"img-src {extension_assets} data:; "
+        f"font-src {extension_assets}; "
+        "connect-src 'none'; "
+        "form-action 'none'; "
+        "object-src 'none'; "
+        "base-uri 'none'; "
+        "frame-src 'none'; "
+        "worker-src 'none'; "
+        "media-src 'none'; "
+        "manifest-src 'none'; "
+        "frame-ancestors 'self'"
+    )
+
+
+def wasm_extension_frame_url(
+    extension: WasmExtension, frame_path: str, user_id: str | None
+) -> str:
+    token = _create_wasm_extension_frame_token(extension, frame_path, user_id)
+    return f"{frame_path}?frame_token={token}"
+
+
+def consume_wasm_extension_frame_token(
+    request: Request,
+    extension: WasmExtension,
+    frame_path: str,
+    user_id: str | None,
+) -> None:
+    token = request.query_params.get("frame_token")
+    if not token:
+        _raise_wasm_extension_frame_not_found(extension, frame_path, "missing")
+
+    cache_key = _wasm_extension_frame_token_cache_key(token)
+    token_data = cache.get(cache_key)
+    if (
+        not isinstance(token_data, dict)
+        or token_data.get("extension_id") != extension.id
+        or token_data.get("frame_path") != frame_path
+    ):
+        _raise_wasm_extension_frame_not_found(
+            extension, frame_path, "unknown or expired"
+        )
+
+    token_user_id = token_data.get("user_id")
+    if token_user_id and token_user_id != user_id:
+        _raise_wasm_extension_frame_not_found(extension, frame_path, "wrong user")
+
+    cache.pop(cache_key)
+
+
+def _create_wasm_extension_frame_token(
+    extension: WasmExtension,
+    frame_path: str,
+    user_id: str | None,
+) -> str:
+    token = uuid4().hex
+    cache.set(
+        _wasm_extension_frame_token_cache_key(token),
+        {
+            "extension_id": extension.id,
+            "frame_path": frame_path,
+            "user_id": user_id,
+        },
+        expiry=WASM_FRAME_TOKEN_EXPIRY_SECONDS,
+    )
+    return token
+
+
+def _wasm_extension_frame_token_cache_key(token: str) -> str:
+    return f"wasm-frame-token:{token}"
+
+
+def _raise_wasm_extension_frame_not_found(
+    extension: WasmExtension,
+    frame_path: str,
+    reason: str,
+) -> NoReturn:
+    logger.warning(
+        f"WASM frame token {reason} for extension '{extension.id}' at '{frame_path}'."
+    )
+    raise HTTPException(status_code=404, detail="Not found")

lnbits/core/wasm_ext/routes/ui.py

@@ -0,0 +1,368 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Annotated, Any
+
+from fastapi import Depends, FastAPI, HTTPException, Request
+from fastapi.responses import FileResponse
+from pydantic import UUID4
+
+from lnbits.core.crud import get_installed_extension, get_user_from_account
+from lnbits.core.models import Account
+from lnbits.decorators import (
+    check_access_token,
+    check_account_exists,
+    optional_user_id,
+)
+
+from ..wasm.loader import WasmExtension
+from .api import (
+    _has_route,
+    _path_template_pattern,
+    _read_json_object,
+    _snake_to_camel,
+    _wasm_extension_api_export,
+    _wasm_extension_api_method,
+    _wasm_extension_api_path,
+    _wasm_extension_route_auth,
+)
+from .security import (
+    consume_wasm_extension_frame_token,
+    wasm_extension_frame_csp,
+    wasm_extension_frame_url,
+    wasm_extension_wrapper_response,
+)
+
+
+def register_wasm_extension_ui_routes(app: FastAPI, extension: WasmExtension) -> None:
+    _add_wasm_extension_frame_config_route(app, extension)
+
+    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
+        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
+        entrypoint = _wasm_extension_entrypoint(
+            extension, route_config.get("entrypoint")
+        )
+        frame_path = f"/ext-frame/{extension.id}/{route_index}"
+        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
+        _add_wasm_extension_frame_route(app, extension, frame_path, entrypoint)
+        _add_wasm_extension_wrapper_route(
+            app,
+            extension,
+            route_path,
+            auth,
+        )
+
+
+def _add_wasm_extension_frame_config_route(
+    app: FastAPI,
+    extension: WasmExtension,
+) -> None:
+    route_path = _wasm_extension_frame_config_path(extension)
+    if _has_route(app, route_path, "POST"):
+        return
+
+    async def create_wasm_extension_frame_config(
+        request: Request,
+        access_token: Annotated[str | None, Depends(check_access_token)],
+        usr: UUID4 | None = None,
+    ) -> dict[str, Any]:
+        try:
+            body = await _read_json_object(request)
+        except (TypeError, ValueError) as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+        ui_route = _match_wasm_extension_ui_route(extension, body.get("path"))
+        auth = ui_route["auth"]
+
+        if auth == "user":
+            account = await check_account_exists(request, access_token, usr)
+            user_id: str | None = account.id
+        else:
+            user_id = await _optional_wasm_user_id(request, access_token, usr)
+
+        granted_permission_ids = await _wasm_extension_granted_permission_ids(extension)
+
+        return _wasm_extension_frame_config(
+            extension,
+            ui_route["frame_path"],
+            auth,
+            ui_route["path_params"],
+            ui_route["route_params"],
+            _read_wasm_extension_route_query(body.get("query")),
+            user_id,
+            granted_permission_ids,
+        )
+
+    app.add_api_route(
+        route_path,
+        create_wasm_extension_frame_config,
+        methods=["POST"],
+        name=f"{extension.id}:frame-config",
+        include_in_schema=False,
+    )
+
+
+def _add_wasm_extension_wrapper_route(
+    app: FastAPI,
+    extension: WasmExtension,
+    route_path: str,
+    auth: str,
+) -> None:
+    if _has_route(app, route_path, "GET"):
+        return
+
+    async def serve_private_wasm_extension_page(
+        request: Request,
+        account: Account = Depends(check_account_exists),
+    ) -> Any:
+        user = await get_user_from_account(account)
+        return wasm_extension_wrapper_response(
+            request,
+            extension,
+            auth,
+            user.json() if user else None,
+        )
+
+    async def serve_public_wasm_extension_page(request: Request) -> Any:
+        return wasm_extension_wrapper_response(
+            request,
+            extension,
+            auth,
+            None,
+        )
+
+    app.add_api_route(
+        route_path,
+        (
+            serve_public_wasm_extension_page
+            if auth == "public"
+            else serve_private_wasm_extension_page
+        ),
+        methods=["GET"],
+        name=f"{extension.id}:{route_path}",
+        include_in_schema=False,
+    )
+
+
+def _add_wasm_extension_frame_route(
+    app: FastAPI,
+    extension: WasmExtension,
+    frame_path: str,
+    entrypoint: Path,
+) -> None:
+    if _has_route(app, frame_path, "GET"):
+        return
+
+    async def serve_wasm_extension_frame(
+        request: Request,
+        user_id: str | None = Depends(_optional_wasm_user_id),
+    ) -> FileResponse:
+        consume_wasm_extension_frame_token(request, extension, frame_path, user_id)
+        response = FileResponse(entrypoint)
+        response.headers["Content-Security-Policy"] = wasm_extension_frame_csp(
+            request, extension
+        )
+        response.headers["Cache-Control"] = "no-store"
+        response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
+        response.headers["Cross-Origin-Resource-Policy"] = "same-origin"
+        # Extension access goes through the parent bridge.
+        response.headers["Permissions-Policy"] = (
+            "camera=(), microphone=(), geolocation=(), payment=(), "
+            "clipboard-read=(), usb=()"
+        )
+        response.headers["Referrer-Policy"] = "no-referrer"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        return response
+
+    app.add_api_route(
+        frame_path,
+        serve_wasm_extension_frame,
+        methods=["GET"],
+        name=f"{extension.id}:frame:{frame_path}",
+        include_in_schema=False,
+    )
+
+
+def _wasm_extension_bridge_api_routes(
+    extension: WasmExtension,
+    public: bool,
+) -> list[dict[str, str]]:
+    routes: list[dict[str, str]] = []
+    for route_config in extension.config.get("api_routes") or []:
+        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
+        if public and auth != "public":
+            continue
+        method = _wasm_extension_api_method(extension, route_config.get("method"))
+        path = _wasm_extension_api_path(extension, route_config.get("path"))
+        _wasm_extension_api_export(extension, route_config.get("export"))
+        routes.append(
+            {
+                "method": method,
+                "path": path,
+                "pattern": _path_template_pattern(path),
+            }
+        )
+    return routes
+
+
+def _wasm_extension_frame_config_path(extension: WasmExtension) -> str:
+    return f"/api/v1/ext/{extension.id}/_ui/frame"
+
+
+def _match_wasm_extension_ui_route(
+    extension: WasmExtension,
+    path: Any,
+) -> dict[str, Any]:
+    if not isinstance(path, str) or not path.startswith("/"):
+        raise HTTPException(status_code=404, detail="Not found")
+
+    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
+        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
+        route_params = _path_template_params(route_path, path)
+        if route_params is None:
+            continue
+
+        return {
+            "frame_path": f"/ext-frame/{extension.id}/{route_index}",
+            "auth": _wasm_extension_route_auth(extension, route_config.get("auth")),
+            "path_params": route_config.get("path_params") or {},
+            "route_params": route_params,
+        }
+
+    raise HTTPException(status_code=404, detail="Not found")
+
+
+def _path_template_params(template: str, path: str) -> dict[str, str] | None:
+    template_parts = _path_parts(template)
+    path_parts = _path_parts(path)
+    if len(template_parts) != len(path_parts):
+        return None
+
+    params: dict[str, str] = {}
+    for template_part, path_part in zip(template_parts, path_parts, strict=False):
+        if template_part.startswith("{") and template_part.endswith("}"):
+            param_name = template_part[1:-1]
+            if not param_name:
+                return None
+            params[param_name] = path_part
+            continue
+
+        if template_part != path_part:
+            return None
+
+    return params
+
+
+def _path_parts(path: str) -> list[str]:
+    return [part for part in path.strip("/").split("/") if part]
+
+
+def _wasm_extension_frame_config(
+    extension: WasmExtension,
+    frame_path: str,
+    auth: str,
+    path_params: dict[str, str],
+    route_params: dict[str, str],
+    query: dict[str, Any],
+    user_id: str | None,
+    permissions: set[str],
+) -> dict[str, Any]:
+    public = auth == "public"
+    return {
+        "extension": {
+            "id": extension.id,
+            "name": extension.name,
+        },
+        "frameUrl": wasm_extension_frame_url(extension, frame_path, user_id),
+        "bridge": {
+            "extensionId": extension.id,
+            "public": public,
+            "routeParams": _map_wasm_extension_route_params(route_params, path_params),
+            "query": query,
+            "permissions": sorted(permissions),
+            "apiRoutes": _wasm_extension_bridge_api_routes(extension, public),
+        },
+    }
+
+
+async def _wasm_extension_granted_permission_ids(
+    extension: WasmExtension,
+) -> set[str]:
+    installed_extension = await get_installed_extension(extension.id)
+    if not installed_extension:
+        return set()
+    return {permission.id for permission in installed_extension.permissions}
+
+
+def _map_wasm_extension_route_params(
+    route_params: dict[str, str],
+    path_params: dict[str, str],
+) -> dict[str, str]:
+    payload: dict[str, str] = {}
+    for key, value in route_params.items():
+        target = path_params.get(key) or _snake_to_camel(key)
+        payload[target] = value
+    return payload
+
+
+def _read_wasm_extension_route_query(query: Any) -> dict[str, Any]:
+    if not isinstance(query, dict):
+        return {}
+
+    payload: dict[str, Any] = {}
+    for key, value in query.items():
+        if value is None:
+            continue
+        payload[_snake_to_camel(str(key))] = value
+    return payload
+
+
+async def _optional_wasm_user_id(
+    request: Request,
+    access_token: Annotated[str | None, Depends(check_access_token)],
+    usr: UUID4 | None = None,
+) -> str | None:
+    try:
+        return await optional_user_id(request, access_token, usr)
+    except HTTPException:
+        return None
+
+
+def _wasm_extension_ui_route_path(extension: WasmExtension, path: Any) -> str:
+    if not isinstance(path, str) or not path.startswith("/"):
+        raise ValueError(f"Invalid route path for WASM extension '{extension.id}'.")
+    if path == "/":
+        return "/ext"
+    return f"/ext{path}"
+
+
+def _wasm_extension_entrypoint(extension: WasmExtension, entrypoint: Any) -> Path:
+    if not isinstance(entrypoint, str) or not entrypoint:
+        raise ValueError(
+            f"Invalid route entrypoint for WASM extension '{extension.id}'."
+        )
+    if entrypoint.startswith("/"):
+        raise ValueError(
+            f"Route entrypoint for WASM extension '{extension.id}' must be a "
+            "relative extension path."
+        )
+
+    path = (extension.root_path / entrypoint).resolve()
+    root_path = extension.root_path.resolve()
+    if path != root_path and root_path not in path.parents:
+        raise ValueError(f"Route entrypoint escapes extension root: {entrypoint}")
+
+    static_path = (extension.root_path / "static").resolve()
+    if path == static_path or static_path in path.parents:
+        raise ValueError(
+            f"Route entrypoint for WASM extension '{extension.id}' must not be "
+            "inside the static asset directory."
+        )
+    if path.suffix.lower() != ".html":
+        raise ValueError(
+            f"Route entrypoint for WASM extension '{extension.id}' must be "
+            "an HTML file."
+        )
+    if not path.is_file():
+        raise FileNotFoundError(f"Route entrypoint not found: {path}")
+    return path

lnbits/core/wasm_ext/storage/__init__.py

@@ -0,0 +1,19 @@
+from .crud import (
+    migrate_wasm_extension_database,
+    storage_delete_row,
+    storage_get_paginated_rows,
+    storage_get_public_row,
+    storage_get_row,
+    storage_get_row_owner_id,
+    storage_set_row,
+)
+
+__all__ = [
+    "migrate_wasm_extension_database",
+    "storage_delete_row",
+    "storage_get_paginated_rows",
+    "storage_get_public_row",
+    "storage_get_row",
+    "storage_get_row_owner_id",
+    "storage_set_row",
+]

lnbits/core/wasm_ext/wasm/__init__.py

@@ -0,0 +1,13 @@
+from .component import warm_wasm_extension
+from .events import dispatch_wasm_invoice_paid
+from .invoke import invoke_wasm_extension_export
+from .loader import WasmExtension, is_wasm_extension_dir, is_wasm_extension_id
+
+__all__ = [
+    "WasmExtension",
+    "dispatch_wasm_invoice_paid",
+    "invoke_wasm_extension_export",
+    "is_wasm_extension_dir",
+    "is_wasm_extension_id",
+    "warm_wasm_extension",
+]

lnbits/core/wasm_ext/wasm/component.py

@@ -0,0 +1,45 @@
+from __future__ import annotations
+
+from functools import lru_cache
+from typing import Any
+
+from .loader import WasmExtension
+
+
+def warm_wasm_extension(extension: WasmExtension) -> None:
+    _wasm_component(extension)
+
+
+@lru_cache(maxsize=1)
+def _wasm_engine() -> Any:
+    try:
+        from wasmtime import Config, Engine
+    except ImportError as exc:
+        raise RuntimeError(
+            "WASM extension runtime is not installed. Install the 'wasmtime' "
+            "Python package to run WASM extensions."
+        ) from exc
+
+    config = Config()
+    config.wasm_component_model = True
+    return Engine(config)
+
+
+def _wasm_component(extension: WasmExtension) -> Any:
+    stat = extension.module_path.stat()
+    return _cached_wasm_component(
+        str(extension.module_path),
+        stat.st_mtime_ns,
+        stat.st_size,
+    )
+
+
+@lru_cache(maxsize=32)
+def _cached_wasm_component(
+    module_path: str,
+    mtime_ns: int,
+    size: int,
+) -> Any:
+    from wasmtime import component
+
+    return component.Component.from_file(_wasm_engine(), module_path)

lnbits/core/wasm_ext/wasm/events.py

@@ -27,7 +27,7 @@ async def dispatch_wasm_invoice_paid(payment: Any) -> None:
         return
 
     try:
-        from lnbits.core.extensions.wasm import invoke_wasm_extension_export
+        from lnbits.core.wasm_ext.wasm.invoke import invoke_wasm_extension_export
 
         await invoke_wasm_extension_export(
             extension.id,
@@ -54,13 +54,17 @@ def _payment_extension_id(payment: Any) -> str | None:
 
 async def _wasm_invoice_paid_owner_id(extension: Any, payment: Any) -> str | None:
     source_id = _payment_source_id(payment)
-    source_table = _wasm_public_invoice_source_table(extension.config)
-    if not source_id or not source_table:
+    source_tables = _wasm_public_invoice_source_tables(extension.config)
+    if not source_id or not source_tables:
         return None
 
-    from lnbits.core.extensions.storage import storage_get_row_owner_id
+    from lnbits.core.wasm_ext.storage.crud import storage_get_row_owner_id
 
-    return await storage_get_row_owner_id(extension.id, source_table, source_id)
+    for source_table in source_tables:
+        owner_id = await storage_get_row_owner_id(extension.id, source_table, source_id)
+        if owner_id:
+            return owner_id
+    return None
 
 
 def _payment_source_id(payment: Any) -> str | None:
@@ -69,17 +73,24 @@ def _payment_source_id(payment: Any) -> str | None:
     return source_id if isinstance(source_id, str) and source_id else None
 
 
-def _wasm_public_invoice_source_table(config: dict[str, Any]) -> str | None:
+def _wasm_public_invoice_source_tables(config: dict[str, Any]) -> list[str]:
     permissions = config.get("permissions") or []
     for permission in permissions:
         if not isinstance(permission, dict):
             continue
         if permission.get("id") != "wallet.create_invoice_public":
             continue
-        policy = permission.get("policy") or {}
-        table = policy.get("table")
-        return table if isinstance(table, str) and table else None
-    return None
+        policies = permission.get("policies")
+        if not isinstance(policies, list):
+            return []
+        return [
+            source_policy["table"]
+            for source_policy in policies
+            if isinstance(source_policy, dict)
+            and isinstance(source_policy.get("table"), str)
+            and source_policy["table"]
+        ]
+    return []
 
 
 def _wasm_invoice_paid_export(config: dict[str, Any]) -> str | None:

lnbits/core/wasm_ext/wasm/host.py

@@ -0,0 +1,93 @@
+from __future__ import annotations
+
+import asyncio
+import re
+from collections.abc import Mapping
+from typing import Any
+
+from ..api.models import EmptyRequest
+from ..api.registry import list_extension_api_methods
+from ..api.runtime import ExtensionAPIHost
+
+
+def add_extension_host_imports(
+    linker: Any,
+    api_host: ExtensionAPIHost,
+    event_loop: asyncio.AbstractEventLoop,
+) -> None:
+    with linker.root() as root:
+        methods_by_interface: dict[str, list[Any]] = {}
+        for method in list_extension_api_methods():
+            methods_by_interface.setdefault(method.host_interface, []).append(method)
+
+        for host_interface, methods in methods_by_interface.items():
+            with root.add_instance(f"lnbits:extension/{host_interface}") as host:
+                for method in methods:
+                    host.add_func(
+                        method.host_name.replace("_", "-"),
+                        _make_host_import(
+                            api_host,
+                            method.method_id,
+                            method.request_model is EmptyRequest,
+                            event_loop,
+                        ),
+                    )
+
+
+def _make_host_import(
+    api_host: ExtensionAPIHost,
+    host_name: str,
+    empty_request: bool,
+    event_loop: asyncio.AbstractEventLoop,
+) -> Any:
+    if empty_request:
+
+        def empty_host_import(_store: Any) -> Any:
+            future = asyncio.run_coroutine_threadsafe(
+                api_host.invoke(host_name), event_loop
+            )
+            response = future.result()
+            return _dict_to_component_record(response)
+
+        return empty_host_import
+
+    def host_import(_store: Any, request: Any = None) -> Any:
+        payload = _component_payload_to_dict(request)
+        future = asyncio.run_coroutine_threadsafe(
+            api_host.invoke(host_name, payload), event_loop
+        )
+        response = future.result()
+        return _dict_to_component_record(response)
+
+    return host_import
+
+
+def _component_payload_to_dict(value: Any) -> dict[str, Any]:
+    if value is None:
+        return {}
+    if hasattr(value, "__dict__"):
+        return dict(value.__dict__)
+    if isinstance(value, Mapping):
+        return dict(value)
+    raise TypeError("WASM host function payload must be a record.")
+
+
+def _dict_to_component_record(value: Mapping[str, Any]) -> Any:
+    from wasmtime import component
+
+    record = component.Record()
+    for key, item in value.items():
+        setattr(record, _camel_to_kebab(key), _to_component_value(item))
+    return record
+
+
+def _to_component_value(value: Any) -> Any:
+    if isinstance(value, Mapping):
+        return _dict_to_component_record(value)
+    if isinstance(value, list):
+        return [_to_component_value(item) for item in value]
+    return value
+
+
+def _camel_to_kebab(value: str) -> str:
+    return re.sub(r"([a-z0-9])([A-Z])", r"\1-\2", value).replace("_", "-").lower()

lnbits/core/wasm_ext/wasm/invoke.py

@@ -2,17 +2,17 @@ from __future__ import annotations
 
 import asyncio
 import json
-import re
 from collections.abc import Mapping
-from functools import lru_cache
 from typing import Any
 
 from lnbits.core.crud.extensions import get_installed_extension
 from lnbits.core.db import core_app_extra
 
-from .api import ExtensionAPI, list_extension_api_methods
+from ..api.host import ExtensionHostAPI
+from ..api.runtime import ExtensionAPIHost
+from .component import _wasm_component, _wasm_engine
+from .host import add_extension_host_imports
 from .loader import WasmExtension
-from .runtime import ExtensionAPIHost
 
 
 async def invoke_wasm_extension_export(
@@ -27,7 +27,7 @@ async def invoke_wasm_extension_export(
 ) -> dict[str, Any]:
     extension = _get_registered_extension(ext_id)
     permissions = await _extension_permissions(extension)
-    api = ExtensionAPI(
+    api = ExtensionHostAPI(
         extension.id,
         permissions,
         user_id=_user_id(user),
@@ -47,15 +47,11 @@ async def invoke_wasm_extension_export(
     )
 
 
-def warm_wasm_extension(extension: WasmExtension) -> None:
-    _wasm_component(extension)
-
-
 def _invoke_wasm_extension_export_sync(
     extension: WasmExtension,
     export_name: str,
     payload: Mapping[str, Any],
-    api: ExtensionAPI,
+    api: ExtensionHostAPI,
     event_loop: asyncio.AbstractEventLoop,
 ) -> dict[str, Any]:
     try:
@@ -72,7 +68,7 @@ def _invoke_wasm_extension_export_sync(
 
     linker = component.Linker(engine)
     linker.add_wasip2()
-    _add_extension_host_imports(linker, ExtensionAPIHost(api), event_loop)
+    add_extension_host_imports(linker, ExtensionAPIHost(api), event_loop)
 
     wasm_component = _wasm_component(extension)
     instance = linker.instantiate(store, wasm_component)
@@ -87,103 +83,6 @@ def _invoke_wasm_extension_export_sync(
     return _parse_wasm_export_result(extension, result)
 
 
-@lru_cache(maxsize=1)
-def _wasm_engine() -> Any:
-    try:
-        from wasmtime import Config, Engine
-    except ImportError as exc:
-        raise RuntimeError(
-            "WASM extension runtime is not installed. Install the 'wasmtime' "
-            "Python package to run WASM extensions."
-        ) from exc
-
-    config = Config()
-    config.wasm_component_model = True
-    return Engine(config)
-
-
-def _wasm_component(extension: WasmExtension) -> Any:
-    stat = extension.module_path.stat()
-    return _cached_wasm_component(
-        str(extension.module_path),
-        stat.st_mtime_ns,
-        stat.st_size,
-    )
-
-
-@lru_cache(maxsize=32)
-def _cached_wasm_component(
-    module_path: str,
-    mtime_ns: int,
-    size: int,
-) -> Any:
-    from wasmtime import component
-
-    return component.Component.from_file(_wasm_engine(), module_path)
-
-
-def _add_extension_host_imports(
-    linker: Any,
-    api_host: ExtensionAPIHost,
-    event_loop: asyncio.AbstractEventLoop,
-) -> None:
-    with linker.root() as root:
-        methods_by_interface: dict[str, list[Any]] = {}
-        for method in list_extension_api_methods():
-            methods_by_interface.setdefault(method.host_interface, []).append(method)
-
-        for host_interface, methods in methods_by_interface.items():
-            with root.add_instance(f"lnbits:extension/{host_interface}") as host:
-                for method in methods:
-                    host.add_func(
-                        method.host_name.replace("_", "-"),
-                        _make_host_import(api_host, method.method_id, event_loop),
-                    )
-
-
-def _make_host_import(
-    api_host: ExtensionAPIHost,
-    host_name: str,
-    event_loop: asyncio.AbstractEventLoop,
-) -> Any:
-    def host_import(_store: Any, request: Any = None) -> Any:
-        payload = _component_payload_to_dict(request)
-        future = asyncio.run_coroutine_threadsafe(
-            api_host.invoke(host_name, payload), event_loop
-        )
-        response = future.result()
-        return _dict_to_component_record(response)
-
-    return host_import
-
-
-def _component_payload_to_dict(value: Any) -> dict[str, Any]:
-    if value is None:
-        return {}
-    if hasattr(value, "__dict__"):
-        return dict(value.__dict__)
-    if isinstance(value, Mapping):
-        return dict(value)
-    raise TypeError("WASM host function payload must be a record.")
-
-
-def _dict_to_component_record(value: Mapping[str, Any]) -> Any:
-    from wasmtime import component
-
-    record = component.Record()
-    for key, item in value.items():
-        setattr(record, _camel_to_kebab(key), _to_component_value(item))
-    return record
-
-
-def _to_component_value(value: Any) -> Any:
-    if isinstance(value, Mapping):
-        return _dict_to_component_record(value)
-    if isinstance(value, list):
-        return [_to_component_value(item) for item in value]
-    return value
-
-
 def _parse_wasm_export_result(extension: WasmExtension, value: Any) -> dict[str, Any]:
     if isinstance(value, bytes):
         value = value.decode()
@@ -224,7 +123,3 @@ async def _extension_permissions(extension: WasmExtension) -> list[Any]:
 
 def _user_id(user: Any | None) -> str | None:
     return getattr(user, "id", None) if user else None
-
-
-def _camel_to_kebab(value: str) -> str:
-    return re.sub(r"([a-z0-9])([A-Z])", r"\1-\2", value).replace("_", "-").lower()

lnbits/core/wasm_ext/wasm/loader.py

@@ -60,7 +60,7 @@ def load_wasm_extension(ext_id: str) -> WasmExtension:
         module_path=module_path,
         wit_path=wit_path,
         world=wasm_config.get("world") or "",
-        host_api=wasm_config.get("host_api") or "lnbits.core.extensions.ExtensionAPI",
+        host_api=wasm_config.get("host_api") or "lnbits.core.wasm_ext.ExtensionHostAPI",
         exports=wasm_config.get("exports") or [],
         config=config,
     )

lnbits/static/i18n/en.js

@@ -522,13 +522,27 @@ window.localisation.en = {
   extension_permissions_title: 'Grant extension permissions',
   extension_permissions_request: 'This extension requests these permissions:',
   extension_permissions_grant_install: 'Grant and install',
+  extension_permissions_high_risk_warning:
+    'This extension requests permissions that can move funds.',
+  extension_permission_risk_low: 'Low risk',
+  extension_permission_risk_medium: 'Medium risk',
+  extension_permission_risk_high: 'High risk',
+  extension_permission_warning_wallet_pay_invoice:
+    'Can spend funds from wallets available to your account.',
+  extension_permission_warning_extension_api_request_write:
+    'Can write data or trigger actions in approved extensions.',
+  extension_permission_warning_http_request:
+    'Can send data to external services.',
   extension_permission_ext_storage_read: 'Read extension storage',
   extension_permission_ext_storage_read_public: 'Read public extension storage',
   extension_permission_ext_storage_write: 'Write extension storage',
+  extension_permission_ext_storage_read_write: 'Read & Write extension storage',
   extension_permission_extension_api_request: 'Use other extensions',
   extension_permission_extension_api_request_desc:
     'Call approved installed extensions using your account permissions.',
   extension_permission_extension_api_request_extensions: 'Allowed extensions',
+  extension_permission_access_read: 'Read',
+  extension_permission_access_write: 'Write',
   extension_permission_http_request: 'Connect to external websites',
   extension_permission_http_request_desc:
     'Make HTTP requests to approved external hosts.',

lnbits/static/js/pages/extensions.js

@@ -724,6 +724,262 @@ window.PageExtensions = {
         resolve(grantedPermissions)
       }
     },
+    permissionGrantHasHighRisk() {
+      return this.permissionGrantDisplayItems().some(
+        permission => permission.risk.level === 'high'
+      )
+    },
+    permissionGrantDisplayItems() {
+      const permissions = this.permissionGrant.permissions || []
+      const permissionsById = new Map(
+        permissions.map(permission => [permission.id, permission])
+      )
+      const hasReadWriteStorage =
+        permissionsById.has('ext.storage.read') &&
+        permissionsById.has('ext.storage.write')
+      let addedReadWriteStorage = false
+
+      return permissions
+        .map((permission, index) => {
+          if (
+            hasReadWriteStorage &&
+            ['ext.storage.read', 'ext.storage.write'].includes(permission.id)
+          ) {
+            if (addedReadWriteStorage) return null
+            addedReadWriteStorage = true
+            return {
+              index,
+              orderId: 'ext.storage.read',
+              permissions: [
+                permissionsById.get('ext.storage.read'),
+                permissionsById.get('ext.storage.write')
+              ]
+            }
+          }
+          return {
+            index,
+            orderId: permission.id,
+            permissions: [permission]
+          }
+        })
+        .filter(Boolean)
+        .sort((left, right) => {
+          const leftOrder = this.permissionOrderIndex(left.orderId)
+          const rightOrder = this.permissionOrderIndex(right.orderId)
+          return leftOrder === rightOrder
+            ? left.index - right.index
+            : leftOrder - rightOrder
+        })
+        .map(group => this.permissionDisplayItem(group.permissions))
+    },
+    permissionDisplayItem(permissions) {
+      const permission = permissions[0]
+      const isReadWriteStorage =
+        permissions.length === 2 &&
+        permissions.some(permission => permission.id === 'ext.storage.read') &&
+        permissions.some(permission => permission.id === 'ext.storage.write')
+      const descriptions = permissions
+        .map(permission => this.permissionManifestDescription(permission))
+        .filter(Boolean)
+      const item = {
+        id: isReadWriteStorage ? 'ext.storage.read_write' : permission.id,
+        label: isReadWriteStorage
+          ? this.$t('extension_permission_ext_storage_read_write')
+          : this.permissionLabel(permission),
+        risk: this.permissionRisk(permissions),
+        badges: [],
+        descriptions,
+        fieldGroups: [],
+        invoicePolicies: [],
+        extensionAccess: [],
+        httpHosts: []
+      }
+
+      if (permission.id === 'ext.storage.read_public') {
+        item.fieldGroups = this.publicStorageFieldGroups(permission)
+        item.badges = item.fieldGroups.map(group => ({
+          key: group.table,
+          label: group.table
+        }))
+      }
+
+      if (permission.id === 'extension.api.request') {
+        item.extensionAccess = this.extensionApiPermissionTargets(permission)
+        item.badges = item.extensionAccess.map(target => ({
+          key: target.id,
+          label: target.name
+        }))
+      }
+
+      if (permission.id === 'http.request') {
+        item.httpHosts = this.httpRequestPermissionHosts(permission)
+      }
+
+      if (permission.id === 'wallet.create_invoice_public') {
+        item.invoicePolicies = this.publicInvoicePolicies(permission)
+      }
+
+      return item
+    },
+    permissionRisk(permissions) {
+      const risks = permissions.map(permission =>
+        this.permissionRiskForPermission(permission)
+      )
+      const highestRisk = risks.find(risk => risk.level === 'high')
+      if (highestRisk) return highestRisk
+      return risks.find(risk => risk.level === 'medium') || this.lowRisk()
+    },
+    permissionRiskForPermission(permission) {
+      if (permission.id === 'wallet.pay_invoice') {
+        return this.highRisk('extension_permission_warning_wallet_pay_invoice')
+      }
+      if (permission.id === 'extension.api.request') {
+        const hasWriteAccess = this.extensionApiPermissionTargets(
+          permission
+        ).some(target => target.access.includes('write'))
+        return hasWriteAccess
+          ? this.highRisk(
+              'extension_permission_warning_extension_api_request_write'
+            )
+          : this.mediumRisk()
+      }
+      if (permission.id === 'http.request') {
+        return this.mediumRisk()
+      }
+      if (
+        [
+          'wallet.list',
+          'wallet.balance.read',
+          'wallet.create_invoice_public',
+          'ext.storage.read_public',
+          'payments.watch'
+        ].includes(permission.id)
+      ) {
+        return this.mediumRisk()
+      }
+      return this.lowRisk()
+    },
+    lowRisk() {
+      return {
+        level: 'low',
+        color: 'grey-6',
+        label: this.$t('extension_permission_risk_low'),
+        warning: ''
+      }
+    },
+    mediumRisk() {
+      return {
+        level: 'medium',
+        color: 'warning',
+        label: this.$t('extension_permission_risk_medium'),
+        warning: ''
+      }
+    },
+    highRisk(warningKey) {
+      return {
+        level: 'high',
+        color: 'negative',
+        label: this.$t('extension_permission_risk_high'),
+        warning: this.$t(warningKey)
+      }
+    },
+    permissionOrderIndex(permissionId) {
+      const order = [
+        'wallet.pay_invoice',
+        'wallet.list',
+        'wallet.balance.read',
+        'extension.api.request',
+        'http.request',
+        'ui.camera.scan_qr',
+        'ext.storage.read',
+        'ext.storage.write',
+        'ext.storage.read_public',
+        'wallet.create_invoice_public',
+        'wallet.create_invoice',
+        'utils.basic'
+      ]
+      const index = order.indexOf(permissionId)
+      return index === -1 ? order.length : index
+    },
+    publicStorageFieldGroups(permission) {
+      const tables = permission.policies
+      if (!Array.isArray(tables)) return []
+      return tables
+        .map(table => {
+          const tableName =
+            typeof table === 'string' ? table : table?.table_name || ''
+          const fields =
+            typeof table === 'string' || !Array.isArray(table?.public_fields)
+              ? []
+              : table.public_fields.filter(
+                  field => typeof field === 'string' && field
+                )
+          return tableName ? {table: tableName, fields} : null
+        })
+        .filter(Boolean)
+    },
+    httpRequestPermissionHosts(permission) {
+      const hosts = permission.policies
+      if (!Array.isArray(hosts)) return []
+      return hosts
+        .map(host => (typeof host === 'string' ? host : host?.host || ''))
+        .filter(host => typeof host === 'string' && host)
+    },
+    publicInvoicePolicies(permission) {
+      const policies = permission.policies
+      if (!Array.isArray(policies)) return []
+      return policies
+        .map(policy => {
+          if (!policy || typeof policy !== 'object') return null
+          const table = policy.table
+          const walletField = policy.wallet_field
+          if (typeof table !== 'string' || !table) return null
+          if (typeof walletField !== 'string' || !walletField) return null
+          return {table, walletField}
+        })
+        .filter(Boolean)
+    },
+    publicInvoicePolicySentence(policy) {
+      return `Invoices will be created using ${policy.walletField} from ${policy.table}.`
+    },
+    extensionApiPermissionTargets(permission) {
+      const extensions = permission.policies
+      if (!Array.isArray(extensions)) return []
+      return extensions
+        .map(extension => {
+          const extensionId =
+            typeof extension === 'string' ? extension : extension?.id
+          if (!extensionId) return null
+          const access =
+            typeof extension === 'string'
+              ? ['read']
+              : Array.isArray(extension.access) && extension.access.length
+                ? extension.access
+                : ['read']
+          return {
+            id: extensionId,
+            name: this.extensionDisplayName(extensionId),
+            access
+          }
+        })
+        .filter(Boolean)
+    },
+    extensionDisplayName(extensionId) {
+      const extension = (this.extensions || []).find(
+        extension => extension.id === extensionId
+      )
+      return extension?.name || extensionId
+    },
+    permissionAccessLabel(access) {
+      const key = `extension_permission_access_${access}`
+      const label = this.$t(key)
+      return label === key ? access : label
+    },
+    permissionManifestDescription(permission) {
+      return typeof permission.description === 'string'
+        ? permission.description
+        : ''
+    },
     permissionI18nKey(permission) {
       return `extension_permission_${permission.id.replace(/[^A-Za-z0-9]/g, '_')}`
     },
@@ -732,35 +988,6 @@ window.PageExtensions = {
       const label = this.$t(key)
       return label === key ? permission.id : label
     },
-    permissionDescription(permission) {
-      const key = `${this.permissionI18nKey(permission)}_desc`
-      const description = this.$t(key)
-      return description === key ? permission.description : description
-    },
-    permissionPolicyDetails(permission) {
-      if (permission.id === 'http.request') {
-        const hosts = permission.policy?.hosts
-        if (!Array.isArray(hosts) || !hosts.length) return ''
-        return `${this.$t('extension_permission_http_request_hosts')}: ${hosts.join(', ')}`
-      }
-      if (permission.id === 'extension.api.request') {
-        const extensions = permission.policy?.extensions
-        if (!Array.isArray(extensions) || !extensions.length) return ''
-        const targets = extensions
-          .map(extension => {
-            if (typeof extension === 'string') return `${extension} (read)`
-            if (!extension?.id) return null
-            const access = Array.isArray(extension.access)
-              ? extension.access.join(', ')
-              : 'read'
-            return `${extension.id} (${access})`
-          })
-          .filter(Boolean)
-        if (!targets.length) return ''
-        return `${this.$t('extension_permission_extension_api_request_extensions')}: ${targets.join(', ')}`
-      }
-      return ''
-    },
     async selectAllUpdatableExtensionss() {
       this.updatableExtensions.forEach(e => (e.selectedForUpdate = true))
     },

lnbits/templates/pages/extensions.vue

@@ -460,36 +460,129 @@
     position="top"
     @hide="onManageExtensionDialogHide"
   >
-    <q-card v-if="permissionGrant.show" class="q-pa-lg lnbits__dialog-card">
+    <q-card v-if="permissionGrant.show" class="q-pa-md lnbits__dialog-card">
       <q-card-section>
         <div class="text-h6" v-text="$t('extension_permissions_title')"></div>
         <div
           class="text-body2 q-mt-sm"
           v-text="$t('extension_permissions_request')"
         ></div>
+        <q-banner
+          v-if="permissionGrantHasHighRisk()"
+          dense
+          class="bg-red-1 text-red-10 q-mt-md"
+        >
+          <template v-slot:avatar>
+            <q-icon name="warning" color="negative"></q-icon>
+          </template>
+          <span v-text="$t('extension_permissions_high_risk_warning')"></span>
+        </q-banner>
       </q-card-section>
 
       <q-list bordered separator class="q-mt-md">
-        <q-item
-          v-for="permission of permissionGrant.permissions"
+        <q-expansion-item
+          v-for="permission of permissionGrantDisplayItems()"
           :key="permission.id"
+          dense
+          expand-separator
+          class="q-pt-xs"
         >
-          <q-item-section>
-            <q-item-label>
-              <li><strong v-text="permissionLabel(permission)"></strong></li>
-            </q-item-label>
-            <q-item-label
-              v-if="permissionDescription(permission)"
-              caption
-              v-text="permissionDescription(permission)"
-            ></q-item-label>
-            <q-item-label
-              v-if="permissionPolicyDetails(permission)"
-              caption
-              v-text="permissionPolicyDetails(permission)"
-            ></q-item-label>
-          </q-item-section>
-        </q-item>
+          <template v-slot:header>
+            <q-item-section>
+              <q-item-label class="text-weight-medium">
+                <span v-text="permission.label"></span>
+              </q-item-label>
+            </q-item-section>
+            <q-item-section
+              v-if="permission.risk.level !== 'low' || permission.badges.length"
+              side
+              top
+            >
+              <div class="row items-center justify-end q-gutter-xs">
+                <q-badge
+                  v-for="badge of permission.badges"
+                  :key="badge.key"
+                  outline
+                  color="primary"
+                  v-text="badge.label"
+                ></q-badge>
+                <q-badge
+                  v-if="permission.risk.level !== 'low'"
+                  :color="permission.risk.color"
+                  v-text="permission.risk.label"
+                ></q-badge>
+              </div>
+            </q-item-section>
+          </template>
+
+          <div class="q-px-md q-pb-sm">
+            <div
+              v-if="permission.risk.warning"
+              class="row items-center text-negative text-caption q-mb-xs"
+            >
+              <q-icon name="warning" size="16px" class="q-mr-xs"></q-icon>
+              <span v-text="permission.risk.warning"></span>
+            </div>
+            <p
+              v-for="description of permission.descriptions"
+              :key="description"
+              class="text-caption q-mb-xs"
+              v-text="description"
+            ></p>
+            <p
+              v-for="policy of permission.invoicePolicies"
+              :key="policy.table + ':' + policy.walletField"
+              class="text-caption q-mb-xs"
+              v-text="publicInvoicePolicySentence(policy)"
+            ></p>
+            <ul v-if="permission.fieldGroups.length" class="q-my-sm q-pl-md">
+              <li v-for="group of permission.fieldGroups" :key="group.table">
+                <span v-text="group.table"></span>
+                <ul v-if="group.fields.length" class="q-pl-md">
+                  <li
+                    v-for="field of group.fields"
+                    :key="group.table + ':' + field"
+                    v-text="field"
+                  ></li>
+                </ul>
+              </li>
+            </ul>
+            <div v-if="permission.extensionAccess.length" class="q-mt-sm">
+              <div
+                class="text-caption text-grey"
+                v-text="
+                  $t('extension_permission_extension_api_request_extensions')
+                "
+              ></div>
+              <div
+                v-for="target of permission.extensionAccess"
+                :key="target.id"
+                class="row items-center q-gutter-xs q-mt-xs"
+              >
+                <span class="text-caption" v-text="target.name"></span>
+                <q-badge
+                  v-for="access of target.access"
+                  :key="target.id + access"
+                  color="grey-7"
+                  v-text="permissionAccessLabel(access)"
+                ></q-badge>
+              </div>
+            </div>
+            <div v-if="permission.httpHosts.length" class="q-mt-sm">
+              <div
+                class="text-caption text-grey"
+                v-text="$t('extension_permission_http_request_hosts')"
+              ></div>
+              <ul class="q-my-sm q-pl-md">
+                <li
+                  v-for="host of permission.httpHosts"
+                  :key="host"
+                  v-text="host"
+                ></li>
+              </ul>
+            </div>
+          </div>
+        </q-expansion-item>
       </q-list>
 
       <div class="row q-mt-lg">

poetry.lock

@@ -1633,7 +1633,7 @@ version = "3.3.2"
 description = "Lightweight in-process concurrent programming"
 optional = false
 python-versions = ">=3.10"
-groups = ["main"]
+groups = ["main", "dev"]
 files = [
     {file = "greenlet-3.3.2-cp310-cp310-macosx_11_0_universal2.whl", hash = "sha256:9bc885b89709d901859cf95179ec9f6bb67a3d2bb1f0e88456461bd4b7f8fd0d"},
     {file = "greenlet-3.3.2-cp310-cp310-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b568183cf65b94919be4438dc28416b234b678c608cafac8874dfeeb2a9bbe13"},
@@ -2972,6 +2972,28 @@ files = [
     {file = "platformdirs-4.9.4.tar.gz", hash = "sha256:1ec356301b7dc906d83f371c8f487070e99d3ccf9e501686456394622a01a934"},
 ]
 
+[[package]]
+name = "playwright"
+version = "1.61.0"
+description = "A high-level API to automate web browsers"
+optional = false
+python-versions = ">=3.10"
+groups = ["dev"]
+files = [
+    {file = "playwright-1.61.0-py3-none-macosx_10_13_x86_64.whl", hash = "sha256:ff138c3a604f69911e9d42fd036e55c2a171e5616edf04c1e7f60a2a285540b0"},
+    {file = "playwright-1.61.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:009588c2a7e499bc5a8b425b61fa65490968bbda9cd69e0cf2cff10f8304659a"},
+    {file = "playwright-1.61.0-py3-none-macosx_11_0_universal2.whl", hash = "sha256:9f7de4536088d12037c13a52b7ea34b59270b78926bb56935070597ffac6b1af"},
+    {file = "playwright-1.61.0-py3-none-manylinux1_x86_64.whl", hash = "sha256:54f3b39f6eab832e33458c1dd7da0b5682aedab3b09ae731b5c59fa12fd2024e"},
+    {file = "playwright-1.61.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:93454322ade8c11d5d6c211bfd91bdfb9ffb4810e3e026371bcbc4bec1b7ee4c"},
+    {file = "playwright-1.61.0-py3-none-win32.whl", hash = "sha256:372d55a6f1248fa1dd47599686980cb8fb5bbe6fcda59eab793eb657c11d8a9b"},
+    {file = "playwright-1.61.0-py3-none-win_amd64.whl", hash = "sha256:35c6cc4589a5d00964a59d7b3e59641e0aac0c02f15479a7af77d20f6bc79597"},
+    {file = "playwright-1.61.0-py3-none-win_arm64.whl", hash = "sha256:e9fcbffcf557a8620fdedd92491eb59a32d18e23d6f3b4f6214b952be324fe51"},
+]
+
+[package.dependencies]
+greenlet = ">=3.1.1,<4.0.0"
+pyee = ">=13,<14"
+
 [[package]]
 name = "pluggy"
 version = "1.6.0"
@@ -3386,6 +3408,24 @@ typing-extensions = ">=4.2.0"
 dotenv = ["python-dotenv (>=0.10.4)"]
 email = ["email-validator (>=1.0.3)"]
 
+[[package]]
+name = "pyee"
+version = "13.0.1"
+description = "A rough port of Node.js's EventEmitter to Python with a few tricks of its own"
+optional = false
+python-versions = ">=3.8"
+groups = ["dev"]
+files = [
+    {file = "pyee-13.0.1-py3-none-any.whl", hash = "sha256:af2f8fede4171ef667dfded53f96e2ed0d6e6bd7ee3bb46437f77e3b57689228"},
+    {file = "pyee-13.0.1.tar.gz", hash = "sha256:0b931f7c14535667ed4c7e0d531716368715e860b988770fc7eb8578d1f67fc8"},
+]
+
+[package.dependencies]
+typing-extensions = "*"
+
+[package.extras]
+dev = ["black", "build", "flake8", "flake8-black", "isort", "jupyter-console", "mkdocs", "mkdocs-include-markdown-plugin", "mkdocstrings[python]", "mypy", "pytest", "pytest-asyncio ; python_version >= \"3.4\"", "pytest-trio ; python_version >= \"3.7\"", "sphinx", "toml", "tox", "trio", "trio ; python_version > \"3.6\"", "trio-typing ; python_version > \"3.6\"", "twine", "twisted", "validate-pyproject[all]"]
+
 [[package]]
 name = "pygments"
 version = "2.19.2"
@@ -3627,6 +3667,25 @@ tomli = {version = ">=1", markers = "python_version < \"3.11\""}
 [package.extras]
 dev = ["argcomplete", "attrs (>=19.2)", "hypothesis (>=3.56)", "mock", "requests", "setuptools", "xmlschema"]
 
+[[package]]
+name = "pytest-base-url"
+version = "2.1.0"
+description = "pytest plugin for URL based testing"
+optional = false
+python-versions = ">=3.8"
+groups = ["dev"]
+files = [
+    {file = "pytest_base_url-2.1.0-py3-none-any.whl", hash = "sha256:3ad15611778764d451927b2a53240c1a7a591b521ea44cebfe45849d2d2812e6"},
+    {file = "pytest_base_url-2.1.0.tar.gz", hash = "sha256:02748589a54f9e63fcbe62301d6b0496da0d10231b753e950c63e03aee745d45"},
+]
+
+[package.dependencies]
+pytest = ">=7.0.0"
+requests = ">=2.9"
+
+[package.extras]
+test = ["black (>=22.1.0)", "flake8 (>=4.0.1)", "pre-commit (>=2.17.0)", "pytest-localserver (>=0.7.1)", "tox (>=3.24.5)"]
+
 [[package]]
 name = "pytest-cov"
 version = "7.0.0"
@@ -3695,6 +3754,24 @@ pytest = ">=6.2.5"
 [package.extras]
 dev = ["pre-commit", "pytest-asyncio", "tox"]
 
+[[package]]
+name = "pytest-playwright"
+version = "0.8.0"
+description = "A pytest wrapper with fixtures for Playwright to automate web browsers"
+optional = false
+python-versions = ">=3.10"
+groups = ["dev"]
+files = [
+    {file = "pytest_playwright-0.8.0-py3-none-any.whl", hash = "sha256:856aae6efd4bc055f2ef229c647768760bcaad5cd3a5983c314ac260a974a933"},
+    {file = "pytest_playwright-0.8.0.tar.gz", hash = "sha256:7888d4a2443160c82e0c506c437076679f86b36d1910427250d90fbf1843a981"},
+]
+
+[package.dependencies]
+playwright = ">=1.18"
+pytest = ">=6.2.4,<10.0.0"
+pytest-base-url = ">=1.0.0,<3.0.0"
+python-slugify = ">=6.0.0,<9.0.0"
+
 [[package]]
 name = "python-crontab"
 version = "3.3.0"
@@ -3758,6 +3835,24 @@ files = [
     {file = "python_multipart-0.0.22.tar.gz", hash = "sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58"},
 ]
 
+[[package]]
+name = "python-slugify"
+version = "8.0.4"
+description = "A Python slugify application that also handles Unicode"
+optional = false
+python-versions = ">=3.7"
+groups = ["dev"]
+files = [
+    {file = "python-slugify-8.0.4.tar.gz", hash = "sha256:59202371d1d05b54a9e7720c5e038f928f45daaffe41dd10822f3907b937c856"},
+    {file = "python_slugify-8.0.4-py2.py3-none-any.whl", hash = "sha256:276540b79961052b66b7d116620b36518847f52d5fd9e3a70164fc8c50faa6b8"},
+]
+
+[package.dependencies]
+text-unidecode = ">=1.3"
+
+[package.extras]
+unidecode = ["Unidecode (>=1.1.1)"]
+
 [[package]]
 name = "pytokens"
 version = "0.4.1"
@@ -4350,6 +4445,18 @@ typing-extensions = {version = ">=4.10.0", markers = "python_version < \"3.13\""
 [package.extras]
 full = ["httpx (>=0.27.0,<0.29.0)", "itsdangerous", "jinja2", "python-multipart (>=0.0.18)", "pyyaml"]
 
+[[package]]
+name = "text-unidecode"
+version = "1.3"
+description = "The most basic Text::Unidecode port"
+optional = false
+python-versions = "*"
+groups = ["dev"]
+files = [
+    {file = "text-unidecode-1.3.tar.gz", hash = "sha256:bad6603bb14d279193107714b288be206cac565dfa49aa5b105294dd5c4aab93"},
+    {file = "text_unidecode-1.3-py2.py3-none-any.whl", hash = "sha256:1311f10e8b895935241623731c2ba64f4c455287888b18189350b67134a822e8"},
+]
+
 [[package]]
 name = "tibs"
 version = "0.5.7"
@@ -5148,4 +5255,4 @@ migration = ["psycopg2-binary"]
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10,<3.13"
-content-hash = "3097673d0cd279b0bf2b8fa59c1e523273f63d430f2c68ccc268a3cf232068af"
+content-hash = "09f0ddc9546d2ea7e6fb686200e3e15ab7e8db0f1ac33d49c94afe1cbd701fe8"

pyproject.toml

@@ -86,6 +86,7 @@ dev = [
   "types-mock~=5.2.0.20250924",
   "mock~=5.2.0",
   "grpcio-tools~=1.76.0",
+  "pytest-playwright>=0.8.0",
 ]
 
 [tool.uv]

tests/fixtures/lnbits-wasm-test-extension/config.json

@@ -0,0 +1,170 @@
+{
+  "id": "lnbits-wasm-test-extension",
+  "name": "WASM Test Extension",
+  "short_description": "Minimal WASM extension used by LNbits e2e tests.",
+  "version": "0.0.1",
+  "min_lnbits_version": "1.5.5",
+  "extension_type": "wasm",
+  "wasm": {
+    "module": "wasm/module.wasm",
+    "exports": [
+      {
+        "name": "list-wallets",
+        "visibility": "authenticated"
+      },
+      {
+        "name": "invoice-details",
+        "visibility": "authenticated"
+      },
+      {
+        "name": "get-selection",
+        "visibility": "authenticated"
+      },
+      {
+        "name": "save-selection",
+        "visibility": "authenticated"
+      },
+      {
+        "name": "pay-large-invoice",
+        "visibility": "authenticated"
+      },
+      {
+        "name": "create-tip-jar",
+        "visibility": "authenticated"
+      },
+      {
+        "name": "list-tip-jars",
+        "visibility": "authenticated"
+      },
+      {
+        "name": "get-public-tip-jar",
+        "visibility": "public"
+      },
+      {
+        "name": "create-tip-invoice",
+        "visibility": "public"
+      },
+      {
+        "name": "record-payment",
+        "visibility": "event"
+      }
+    ]
+  },
+  "events": {
+    "onInvoicePaid": "record-payment"
+  },
+  "ui_routes": [
+    {
+      "path": "/lnbits-wasm-test-extension",
+      "entrypoint": "ui/admin.html",
+      "auth": "user"
+    },
+    {
+      "path": "/lnbits-wasm-test-extension/public/{item_id}",
+      "entrypoint": "ui/public.html",
+      "auth": "public",
+      "path_params": {
+        "item_id": "itemId"
+      }
+    }
+  ],
+  "api_routes": [
+    {
+      "method": "GET",
+      "path": "/wallets",
+      "export": "list-wallets",
+      "auth": "user"
+    },
+    {
+      "method": "POST",
+      "path": "/payments",
+      "export": "pay-large-invoice",
+      "auth": "user"
+    },
+    {
+      "method": "GET",
+      "path": "/jars/{jar_id}",
+      "export": "get-public-tip-jar",
+      "auth": "public",
+      "path_params": {
+        "jar_id": "jarId"
+      }
+    },
+    {
+      "method": "POST",
+      "path": "/invoice",
+      "export": "create-tip-invoice",
+      "auth": "public"
+    }
+  ],
+  "permissions": [
+    {
+      "id": "wallet.pay_invoice",
+      "description": "Pay Lightning invoices from selected wallets."
+    },
+    {
+      "id": "wallet.list",
+      "description": "List wallets available to the installing user."
+    },
+    {
+      "id": "wallet.balance.read",
+      "description": "Read wallet balances for payment selection."
+    },
+    {
+      "id": "extension.api.request",
+      "description": "Call APIs exposed by another installed extension.",
+      "policies": [
+        {
+          "id": "watchonly",
+          "access": ["read", "write"]
+        }
+      ]
+    },
+    {
+      "id": "ui.camera.scan_qr",
+      "description": "Use the LNbits scanner to read QR codes when requested."
+    },
+    {
+      "id": "ext.storage.read",
+      "description": "Read extension storage rows."
+    },
+    {
+      "id": "ext.storage.write",
+      "description": "Write extension storage rows."
+    },
+    {
+      "id": "ext.storage.read_public",
+      "description": "Read public extension storage fields.",
+      "policies": [
+        {
+          "table_name": "tip_jars",
+          "public_fields": [
+            "id",
+            "title",
+            "description",
+            "currency",
+            "suggested_amounts"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "wallet.create_invoice",
+      "description": "Create incoming Lightning invoices from authenticated pages."
+    },
+    {
+      "id": "wallet.create_invoice_public",
+      "description": "Create incoming Lightning invoices from public pages.",
+      "policies": [
+        {
+          "table": "tip_jars",
+          "wallet_field": "wallet_id"
+        }
+      ]
+    },
+    {
+      "id": "utils.basic",
+      "description": "Use LNbits utility functions."
+    }
+  ]
+}

tests/fixtures/lnbits-wasm-test-extension/static/app.js

@@ -0,0 +1,49 @@
+window.__lnbitsWasmTestExtensionLoaded = true
+;(function () {
+  const channel = new MessageChannel()
+  const pending = new Map()
+  let counter = 0
+
+  const ready = new Promise(resolve => {
+    channel.port1.addEventListener('message', event => {
+      const message = event.data || {}
+
+      if (message.type === 'lnbits-extension:connected') {
+        resolve(true)
+        return
+      }
+
+      if (message.type !== 'lnbits-extension:response') return
+      const callback = pending.get(message.id)
+      if (!callback) return
+
+      pending.delete(message.id)
+      callback(message)
+    })
+    channel.port1.start()
+    window.parent.postMessage(
+      {type: 'lnbits-extension:connect', id: 'wasm-test-extension'},
+      '*',
+      [channel.port2]
+    )
+  })
+
+  window.lnbitsWasmTestBridge = {
+    ready() {
+      return ready
+    },
+    request(message) {
+      return ready.then(() => {
+        return new Promise(resolve => {
+          const id = `wasm-test-${++counter}`
+          pending.set(id, resolve)
+          channel.port1.postMessage({
+            type: 'lnbits-extension:request',
+            id,
+            ...message
+          })
+        })
+      })
+    }
+  }
+})()

tests/fixtures/lnbits-wasm-test-extension/static/data.json

@@ -0,0 +1 @@
+{"unsafe": true}

tests/fixtures/lnbits-wasm-test-extension/static/html-like.js

@@ -0,0 +1,4 @@
+<!doctype html>
+<html>
+  <body>This must not be served as JavaScript.</body>
+</html>

tests/fixtures/lnbits-wasm-test-extension/ui/admin.html

@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>WASM Test Extension Admin</title>
+    <script src="/ext-assets/lnbits-wasm-test-extension/app.js"></script>
+  </head>
+  <body>
+    <main id="wasm-test-admin">WASM Test Admin</main>
+  </body>
+</html>

tests/fixtures/lnbits-wasm-test-extension/ui/public.html

@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>WASM Test Extension Public</title>
+    <script src="/ext-assets/lnbits-wasm-test-extension/app.js"></script>
+  </head>
+  <body>
+    <main id="wasm-test-public">WASM Test Public</main>
+  </body>
+</html>

tests/unit/test_wasm_extension_permissions.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+import pytest
+
+from lnbits.core.models.extensions import ExtensionPermission, InstallableExtension
+from lnbits.core.wasm_ext.api.permissions import (
+    validate_extension_permissions,
+    validate_wasm_extension_permissions,
+)
+
+
+def test_validate_extension_permissions_rejects_unknown_permission() -> None:
+    permissions = [
+        ExtensionPermission(id="wallet.list"),
+        ExtensionPermission(id="unknown.permission"),
+    ]
+
+    with pytest.raises(ValueError, match="unknown.permission"):
+        validate_extension_permissions("demo", permissions)
+
+
+def test_validate_wasm_extension_permissions_requires_grant() -> None:
+    extension = InstallableExtension(id="demo", name="Demo", version="0.0.1")
+    config = {
+        "extension_type": "wasm",
+        "permissions": [{"id": "wallet.list"}],
+    }
+
+    with pytest.raises(ValueError, match="requires permission approval"):
+        validate_wasm_extension_permissions(extension, None, config)
+
+
+def test_validate_wasm_extension_permissions_requires_exact_grants() -> None:
+    extension = InstallableExtension(id="demo", name="Demo", version="0.0.1")
+    config = {
+        "extension_type": "wasm",
+        "permissions": [{"id": "wallet.list"}, {"id": "utils.basic"}],
+    }
+
+    with pytest.raises(ValueError, match="was not granted all requested permissions"):
+        validate_wasm_extension_permissions(
+            extension,
+            [ExtensionPermission(id="wallet.list")],
+            config,
+        )
+
+
+def test_validate_wasm_extension_permissions_returns_core_normalized_grants() -> None:
+    extension = InstallableExtension(id="demo", name="Demo", version="0.0.1")
+    config = {
+        "extension_type": "wasm",
+        "permissions": [
+            {
+                "id": "wallet.list",
+                "label": "Extension supplied label",
+                "description": "Show wallets.",
+            }
+        ],
+    }
+
+    permissions = validate_wasm_extension_permissions(
+        extension,
+        [ExtensionPermission(id="wallet.list", label="Extension supplied label")],
+        config,
+    )
+
+    assert len(permissions) == 1
+    assert permissions[0].id == "wallet.list"
+    assert permissions[0].label is None
+    assert permissions[0].description == "Show wallets."

tests/wasm_ext/__init__.py

@@ -0,0 +1 @@
+

tests/wasm_ext/conftest.py

@@ -0,0 +1,151 @@
+from __future__ import annotations
+
+import os
+import shutil
+import socket
+import subprocess
+import sys
+import time
+from collections.abc import Iterator
+from typing import Any
+
+import httpx
+import pytest
+
+from tests.wasm_ext.helpers import (
+    EXTENSION_ID,
+    REPO_ROOT,
+    SERVER_HOST,
+    LiveLNbitsServer,
+)
+
+
+@pytest.fixture(scope="session")
+def browser_name() -> str:
+    return "chromium"
+
+
+@pytest.fixture(scope="session")
+def lnbits_server(
+    tmp_path_factory: pytest.TempPathFactory,
+) -> Iterator[LiveLNbitsServer]:
+    run_root = tmp_path_factory.mktemp("wasm_ext_e2e")
+    data_dir = run_root / "data"
+    extensions_root = run_root / "extensions-root"
+    extension_target = extensions_root / "extensions" / EXTENSION_ID
+    fixture_extension = REPO_ROOT / "tests" / "fixtures" / EXTENSION_ID
+
+    shutil.copytree(fixture_extension, extension_target)
+
+    port = _free_tcp_port()
+    base_url = f"http://{SERVER_HOST}:{port}"
+    env = {
+        **os.environ,
+        "AUTH_HTTPS_ONLY": "false",
+        "DEBUG": "true",
+        "HOST": SERVER_HOST,
+        "LNBITS_ADMIN_UI": "true",
+        "LNBITS_BACKEND_WALLET_CLASS": "FakeWallet",
+        "LNBITS_DATA_FOLDER": str(data_dir),
+        "LNBITS_EXTENSIONS_DEACTIVATE_ALL": "false",
+        "LNBITS_EXTENSIONS_PATH": str(extensions_root),
+        "LNBITS_PATH": str(REPO_ROOT),
+        "PORT": str(port),
+        "PYTHONUNBUFFERED": "1",
+    }
+
+    process = subprocess.Popen(  # noqa: S603
+        [
+            sys.executable,
+            "-m",
+            "uvicorn",
+            "lnbits.__main__:app",
+            "--host",
+            SERVER_HOST,
+            "--port",
+            str(port),
+            "--loop",
+            "asyncio",
+            "--log-level",
+            "warning",
+        ],
+        cwd=REPO_ROOT,
+        env=env,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        text=True,
+    )
+
+    try:
+        _wait_for_first_install_page(process, base_url)
+        auth_cookies = _complete_first_install(base_url)
+        yield LiveLNbitsServer(base_url=base_url, auth_cookies=auth_cookies)
+    finally:
+        process.terminate()
+        try:
+            process.wait(timeout=10)
+        except subprocess.TimeoutExpired:
+            process.kill()
+            process.wait(timeout=10)
+
+
+@pytest.fixture
+def authenticated_page(page: Any, lnbits_server: LiveLNbitsServer) -> Any:
+    page.context.add_cookies(lnbits_server.auth_cookies)
+    return page
+
+
+def _free_tcp_port() -> int:
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.bind((SERVER_HOST, 0))
+        return int(sock.getsockname()[1])
+
+
+def _wait_for_first_install_page(
+    process: subprocess.Popen[str],
+    base_url: str,
+) -> None:
+    deadline = time.monotonic() + 60
+    last_error: Exception | None = None
+    with httpx.Client(follow_redirects=False, timeout=2) as client:
+        while time.monotonic() < deadline:
+            if process.poll() is not None:
+                output = process.stdout.read() if process.stdout else ""
+                raise RuntimeError(f"LNbits exited before startup:\n{output}")
+            try:
+                response = client.get(f"{base_url}/first_install")
+                if response.status_code == 200:
+                    return
+            except httpx.HTTPError as exc:
+                last_error = exc
+            time.sleep(0.25)
+
+    output = process.stdout.read() if process.stdout else ""
+    raise TimeoutError(f"LNbits did not start: {last_error}\n{output}")
+
+
+def _complete_first_install(base_url: str) -> list[dict[str, Any]]:
+    with httpx.Client(base_url=base_url, follow_redirects=False, timeout=10) as client:
+        response = client.put(
+            "/api/v1/auth/first_install",
+            json={
+                "username": "wasmtest-admin",
+                "password": "secret1234",
+                "password_repeat": "secret1234",
+            },
+        )
+        response.raise_for_status()
+
+        enable_response = client.put(f"/api/v1/extension/{EXTENSION_ID}/enable")
+        enable_response.raise_for_status()
+
+        return [
+            {
+                "name": cookie.name,
+                "value": cookie.value,
+                "url": base_url,
+                "secure": cookie.secure,
+                "sameSite": "Lax",
+            }
+            for cookie in client.cookies.jar
+        ]

tests/wasm_ext/helpers.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+EXTENSION_ID = "lnbits-wasm-test-extension"
+REPO_ROOT = Path(__file__).resolve().parents[2]
+SERVER_HOST = "127.0.0.1"
+
+
+@dataclass(frozen=True)
+class LiveLNbitsServer:
+    base_url: str
+    auth_cookies: list[dict[str, Any]]
+    extension_id: str = EXTENSION_ID

tests/wasm_ext/test_wasm_extension_e2e.py

@@ -0,0 +1,385 @@
+from __future__ import annotations
+
+import json
+import re
+from re import Pattern
+from typing import Any
+
+from playwright.sync_api import Frame, Page, expect
+
+from tests.wasm_ext.helpers import EXTENSION_ID, REPO_ROOT, LiveLNbitsServer
+
+
+def test_permission_grant_dialog_logic_is_compact_and_explicit(page: Page) -> None:
+    permissions = _fixture_permissions()
+    page.goto("about:blank")
+    page.add_script_tag(path=str(REPO_ROOT / "lnbits/static/js/pages/extensions.js"))
+
+    result = page.evaluate(
+        """
+        ({permissions, translations}) => {
+          const methods = window.PageExtensions.methods
+          const context = {
+            extensions: [{id: 'watchonly', name: 'Watchonly'}],
+            permissionGrant: {show: false, permissions: [], resolve: null},
+            selectedExtension: {isWasm: true},
+            selectedRelease: null,
+            showManageExtensionDialog: false,
+            $t: key => translations[key] || key
+          }
+          Object.assign(context, methods)
+
+          const release = {extension_type: 'wasm', permissions}
+          const pendingGrant = context.resolveExtensionPermissionGrant(release)
+          const opened =
+            context.permissionGrant.show === true &&
+            context.showManageExtensionDialog === true
+          const items = context.permissionGrantDisplayItems()
+          context.grantExtensionPermissions()
+
+          return pendingGrant.then(grantedPermissions => ({
+            opened,
+            closed:
+              context.permissionGrant.show === false &&
+              context.showManageExtensionDialog === false,
+            grantedPermissionIds: grantedPermissions.map(permission => permission.id),
+            items
+          }))
+        }
+        """,
+        {"permissions": permissions, "translations": _permission_translations()},
+    )
+
+    assert result["opened"] is True
+    assert result["closed"] is True
+    assert result["grantedPermissionIds"] == [
+        permission["id"] for permission in permissions
+    ]
+
+    items = result["items"]
+    assert [item["id"] for item in items] == [
+        "wallet.pay_invoice",
+        "wallet.list",
+        "wallet.balance.read",
+        "extension.api.request",
+        "ui.camera.scan_qr",
+        "ext.storage.read_write",
+        "ext.storage.read_public",
+        "wallet.create_invoice_public",
+        "wallet.create_invoice",
+        "utils.basic",
+    ]
+
+    by_id = {item["id"]: item for item in items}
+    assert by_id["wallet.pay_invoice"]["risk"]["level"] == "high"
+    assert by_id["extension.api.request"]["risk"]["level"] == "high"
+    assert by_id["ext.storage.read_write"]["risk"]["level"] == "low"
+    assert by_id["wallet.create_invoice"]["risk"]["level"] == "low"
+    assert by_id["ui.camera.scan_qr"]["risk"]["level"] == "low"
+
+    assert by_id["ext.storage.read_write"]["label"] == (
+        "Read & Write extension storage"
+    )
+    assert by_id["ext.storage.read_public"]["badges"] == [
+        {"key": "tip_jars", "label": "tip_jars"}
+    ]
+    assert by_id["ext.storage.read_public"]["fieldGroups"] == [
+        {
+            "table": "tip_jars",
+            "fields": [
+                "id",
+                "title",
+                "description",
+                "currency",
+                "suggested_amounts",
+            ],
+        }
+    ]
+    assert by_id["extension.api.request"]["badges"] == [
+        {"key": "watchonly", "label": "Watchonly"}
+    ]
+    assert by_id["extension.api.request"]["extensionAccess"] == [
+        {"id": "watchonly", "name": "Watchonly", "access": ["read", "write"]}
+    ]
+    assert by_id["wallet.create_invoice_public"]["invoicePolicies"] == [
+        {"table": "tip_jars", "walletField": "wallet_id"}
+    ]
+
+
+def test_public_wasm_page_loads_sandboxed_frame(
+    page: Page,
+    lnbits_server: LiveLNbitsServer,
+) -> None:
+    public_url = (
+        f"{lnbits_server.base_url}/ext/{lnbits_server.extension_id}/public/item-123"
+        "?source=test"
+    )
+    frame_url_part = f"/ext-frame/{lnbits_server.extension_id}/1"
+
+    with page.expect_response(lambda response: frame_url_part in response.url) as info:
+        page.goto(public_url)
+
+    frame_response = info.value
+    assert frame_response.status == 200
+    assert "sandbox allow-scripts" in frame_response.headers["content-security-policy"]
+    assert frame_response.headers["cache-control"] == "no-store"
+    assert frame_response.headers["x-content-type-options"] == "nosniff"
+
+    frame = page.locator("iframe.wasm-extension-frame")
+    expect(frame).to_have_attribute("sandbox", "allow-scripts")
+    expect(frame).to_have_attribute("allow", "clipboard-write")
+    expect(frame).to_have_attribute("referrerpolicy", "no-referrer")
+    expect(frame).to_have_attribute("src", _frame_src_pattern(frame_url_part))
+    expect(
+        page.frame_locator("iframe.wasm-extension-frame").locator("body")
+    ).to_contain_text("WASM Test Public")
+
+
+def test_static_assets_are_strictly_whitelisted(
+    page: Page,
+    lnbits_server: LiveLNbitsServer,
+) -> None:
+    assets_base = f"{lnbits_server.base_url}/ext-assets/{lnbits_server.extension_id}"
+
+    script = page.request.get(f"{assets_base}/app.js")
+    assert script.status == 200
+    assert script.headers["content-type"].startswith("text/javascript")
+    assert script.headers["x-content-type-options"] == "nosniff"
+    assert script.headers["cache-control"] == "no-store"
+
+    core_script = page.request.get(f"{assets_base}/_lnbits/vue.global.prod.js")
+    assert core_script.status == 200
+    assert core_script.headers["content-type"].startswith("text/javascript")
+    assert core_script.headers["x-content-type-options"] == "nosniff"
+
+    unsupported_extension = page.request.get(f"{assets_base}/data.json")
+    assert unsupported_extension.status == 404
+
+    html_like_javascript = page.request.get(f"{assets_base}/html-like.js")
+    assert html_like_javascript.status == 404
+
+
+def test_frame_config_exposes_permissions_and_filters_public_routes(
+    authenticated_page: Page,
+    lnbits_server: LiveLNbitsServer,
+) -> None:
+    public_config = authenticated_page.request.post(
+        _frame_config_url(lnbits_server),
+        data={
+            "path": f"/ext/{lnbits_server.extension_id}/public/item-123",
+            "query": {"source_id": "abc", "empty": None},
+        },
+    )
+    assert public_config.status == 200
+    public_bridge = public_config.json()["bridge"]
+    assert public_bridge["public"] is True
+    assert public_bridge["routeParams"] == {"itemId": "item-123"}
+    assert public_bridge["query"] == {"sourceId": "abc"}
+    assert {route["path"] for route in public_bridge["apiRoutes"]} == {
+        f"/api/v1/ext/{lnbits_server.extension_id}/jars/{{jar_id}}",
+        f"/api/v1/ext/{lnbits_server.extension_id}/invoice",
+    }
+
+    private_config = authenticated_page.request.post(
+        _frame_config_url(lnbits_server),
+        data={"path": f"/ext/{lnbits_server.extension_id}", "query": {}},
+    )
+    assert private_config.status == 200
+    private_bridge = private_config.json()["bridge"]
+    assert private_bridge["public"] is False
+    assert set(private_bridge["permissions"]) == {
+        permission["id"] for permission in _fixture_permissions()
+    }
+    assert {route["path"] for route in private_bridge["apiRoutes"]} == {
+        f"/api/v1/ext/{lnbits_server.extension_id}/wallets",
+        f"/api/v1/ext/{lnbits_server.extension_id}/payments",
+        f"/api/v1/ext/{lnbits_server.extension_id}/jars/{{jar_id}}",
+        f"/api/v1/ext/{lnbits_server.extension_id}/invoice",
+    }
+
+
+def test_private_frame_config_and_api_routes_require_auth(
+    page: Page,
+    lnbits_server: LiveLNbitsServer,
+) -> None:
+    private_config = page.request.post(
+        _frame_config_url(lnbits_server),
+        data={"path": f"/ext/{lnbits_server.extension_id}", "query": {}},
+    )
+    assert private_config.status == 401
+
+    private_api = page.request.get(
+        f"{lnbits_server.base_url}/api/v1/ext/{lnbits_server.extension_id}/wallets"
+    )
+    assert private_api.status == 401
+
+    public_config = page.request.post(
+        _frame_config_url(lnbits_server),
+        data={
+            "path": f"/ext/{lnbits_server.extension_id}/public/item-123",
+            "query": {},
+        },
+    )
+    assert public_config.status == 200
+
+
+def test_bridge_context_and_denied_api_request(
+    page: Page,
+    lnbits_server: LiveLNbitsServer,
+) -> None:
+    frame_url_part = f"/ext-frame/{lnbits_server.extension_id}/1"
+
+    with page.expect_response(lambda response: frame_url_part in response.url):
+        page.goto(
+            f"{lnbits_server.base_url}/ext/{lnbits_server.extension_id}"
+            "/public/item-123?source=test"
+        )
+
+    frame = _wasm_frame(page, frame_url_part)
+    assert frame.evaluate("() => window.lnbitsWasmTestBridge.ready()") is True
+
+    context_response = frame.evaluate("""
+        () => window.lnbitsWasmTestBridge.request({
+          action: 'context'
+        })
+        """)
+    assert context_response == {
+        "type": "lnbits-extension:response",
+        "id": "wasm-test-1",
+        "ok": True,
+        "data": {
+            "extensionId": EXTENSION_ID,
+            "public": True,
+            "routeParams": {"itemId": "item-123"},
+            "query": {"source": "test"},
+        },
+    }
+
+    denied_response = frame.evaluate("""
+        () => window.lnbitsWasmTestBridge.request({
+          action: 'api',
+          method: 'GET',
+          path: '/api/v1/wallets'
+        })
+        """)
+    assert denied_response["ok"] is False
+    assert denied_response["error"] == "Extension API route is not allowed."
+
+    unknown_response = frame.evaluate("""
+        () => window.lnbitsWasmTestBridge.request({
+          action: 'unknown'
+        })
+        """)
+    assert unknown_response["ok"] is False
+    assert unknown_response["error"] == "Unknown extension bridge action."
+
+
+def test_frame_token_is_route_bound_required_and_single_use(
+    page: Page,
+    lnbits_server: LiveLNbitsServer,
+) -> None:
+    frame_config = page.request.post(
+        f"{lnbits_server.base_url}/api/v1/ext/"
+        f"{lnbits_server.extension_id}/_ui/frame",
+        data={
+            "path": f"/ext/{lnbits_server.extension_id}/public/item-123",
+            "query": {"source": "test"},
+        },
+    )
+    assert frame_config.status == 200
+    frame_url = frame_config.json()["frameUrl"]
+
+    missing_token = page.request.get(
+        f"{lnbits_server.base_url}/ext-frame/{lnbits_server.extension_id}/1"
+    )
+    assert missing_token.status == 404
+
+    wrong_route = page.request.get(
+        f"{lnbits_server.base_url}{frame_url.replace('/1?', '/0?')}"
+    )
+    assert wrong_route.status == 404
+
+    first_use = page.request.get(f"{lnbits_server.base_url}{frame_url}")
+    assert first_use.status == 200
+    assert "form-action 'none'" in first_use.headers["content-security-policy"]
+
+    second_use = page.request.get(f"{lnbits_server.base_url}{frame_url}")
+    assert second_use.status == 404
+
+
+def test_private_wasm_page_uses_lnbits_shell_and_private_frame(
+    authenticated_page: Page,
+    lnbits_server: LiveLNbitsServer,
+) -> None:
+    page = authenticated_page
+    frame_url_part = f"/ext-frame/{lnbits_server.extension_id}/0"
+
+    with page.expect_response(lambda response: frame_url_part in response.url) as info:
+        page.goto(f"{lnbits_server.base_url}/ext/{lnbits_server.extension_id}")
+
+    assert info.value.status == 200
+    expect(page.locator("body")).to_contain_text("LNbits")
+    frame = page.locator("iframe.wasm-extension-frame")
+    expect(frame).to_have_attribute("sandbox", "allow-scripts")
+    expect(frame).to_have_attribute("src", _frame_src_pattern(frame_url_part))
+    expect(
+        page.frame_locator("iframe.wasm-extension-frame").locator("body")
+    ).to_contain_text("WASM Test Admin")
+
+
+def _frame_src_pattern(frame_url_part: str) -> Pattern[str]:
+    return re.compile(f"^{re.escape(frame_url_part)}\\?frame_token=[a-f0-9]{{32}}$")
+
+
+def _frame_config_url(lnbits_server: LiveLNbitsServer) -> str:
+    return (
+        f"{lnbits_server.base_url}/api/v1/ext/"
+        f"{lnbits_server.extension_id}/_ui/frame"
+    )
+
+
+def _fixture_permissions() -> list[dict[str, Any]]:
+    config = json.loads(
+        (REPO_ROOT / "tests/fixtures" / EXTENSION_ID / "config.json").read_text()
+    )
+    permissions = config["permissions"]
+    assert isinstance(permissions, list)
+    return permissions
+
+
+def _permission_translations() -> dict[str, str]:
+    return {
+        "extension_permission_access_read": "Read",
+        "extension_permission_access_write": "Write",
+        "extension_permission_ext_storage_read_public": (
+            "Read public extension storage"
+        ),
+        "extension_permission_ext_storage_read_write": (
+            "Read & Write extension storage"
+        ),
+        "extension_permission_extension_api_request": "Use other extensions",
+        "extension_permission_risk_high": "High risk",
+        "extension_permission_risk_low": "Low risk",
+        "extension_permission_risk_medium": "Medium risk",
+        "extension_permission_ui_camera_scan_qr": "Scan QR codes",
+        "extension_permission_utils_basic": "Use basic LNbits utilities",
+        "extension_permission_wallet_balance_read": "View wallet balances",
+        "extension_permission_wallet_create_invoice": "Create invoices",
+        "extension_permission_wallet_create_invoice_public": (
+            "Create Lightning invoices from public pages"
+        ),
+        "extension_permission_wallet_list": "List wallets",
+        "extension_permission_wallet_pay_invoice": "Pay invoices",
+        "extension_permission_warning_extension_api_request_write": (
+            "This extension can write to another extension."
+        ),
+        "extension_permission_warning_wallet_pay_invoice": (
+            "This extension can spend from selected wallets."
+        ),
+    }
+
+
+def _wasm_frame(page: Page, frame_url_part: str) -> Frame:
+    frame = page.frame(url=lambda url: frame_url_part in url)
+    assert frame is not None
+    return frame

tools/codegen/extension_sdk_typescript.py

@@ -10,24 +10,24 @@ from typing import Any, Literal, Union, get_args, get_origin
 
 from pydantic import BaseModel
 
-from lnbits.core.extensions import (
-    ExtensionAPI,
+from lnbits.core.wasm_ext import (
     ExtensionAPIMethod,
+    ExtensionHostAPI,
     get_extension_api_method,
     list_extension_api_methods,
 )
 
 
 def generate_typescript_sdk(
-    api_cls: type[ExtensionAPI] | None = None,
+    api_cls: type[ExtensionHostAPI] | None = None,
     method_ids: Sequence[str] | None = None,
 ) -> str:
-    api_cls = api_cls or ExtensionAPI
+    api_cls = api_cls or ExtensionHostAPI
     methods = _select_methods(api_cls, method_ids)
     models = _collect_models(methods)
 
     lines = [
-        "/* Generated by LNbits ExtensionAPI codegen. */",
+        "/* Generated by LNbits ExtensionHostAPI codegen. */",
         "/* Do not edit by hand. */",
         "",
         "export type MaybePromise<T> = T | Promise<T>",
@@ -52,7 +52,7 @@ def generate_typescript_sdk(
 
 def write_typescript_sdk(
     path: str | Path,
-    api_cls: type[ExtensionAPI] | None = None,
+    api_cls: type[ExtensionHostAPI] | None = None,
     method_ids: Sequence[str] | None = None,
 ) -> None:
     Path(path).write_text(
@@ -61,7 +61,7 @@ def write_typescript_sdk(
 
 
 def _select_methods(
-    api_cls: type[ExtensionAPI], method_ids: Sequence[str] | None
+    api_cls: type[ExtensionHostAPI], method_ids: Sequence[str] | None
 ) -> list[ExtensionAPIMethod]:
     if not method_ids:
         return list_extension_api_methods(api_cls)
@@ -342,13 +342,13 @@ def _is_empty_model(model: type[BaseModel]) -> bool:
 
 def main(argv: Sequence[str] | None = None) -> int:
     parser = argparse.ArgumentParser(
-        description="Generate a TypeScript SDK from the LNbits ExtensionAPI."
+        description="Generate a TypeScript SDK from the LNbits ExtensionHostAPI."
     )
     parser.add_argument(
         "--method",
         action="append",
         dest="method_ids",
-        help="ExtensionAPI method id to include. Can be passed multiple times.",
+        help="ExtensionHostAPI method id to include. Can be passed multiple times.",
     )
     parser.add_argument(
         "--out",

uv.lock

@@ -1368,6 +1368,7 @@ dev = [
     { name = "pytest-httpserver" },
     { name = "pytest-md" },
     { name = "pytest-mock" },
+    { name = "pytest-playwright" },
     { name = "ruff" },
     { name = "types-mock" },
     { name = "types-passlib" },
@@ -1446,6 +1447,7 @@ dev = [
     { name = "pytest-httpserver", specifier = "~=1.1.3" },
     { name = "pytest-md", specifier = "~=0.2.0" },
     { name = "pytest-mock", specifier = "~=3.15.1" },
+    { name = "pytest-playwright", specifier = ">=0.8.0" },
     { name = "ruff", specifier = "~=0.14.10" },
     { name = "types-mock", specifier = "~=5.2.0.20250924" },
     { name = "types-passlib", specifier = "~=1.7.7.20250602" },
@@ -1832,6 +1834,25 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/75/a6/a0a304dc33b49145b21f4808d763822111e67d1c3a32b524a1baf947b6e1/platformdirs-4.9.6-py3-none-any.whl", hash = "sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917", size = 21348, upload-time = "2026-04-09T00:04:09.463Z" },
 ]
 
+[[package]]
+name = "playwright"
+version = "1.61.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "greenlet" },
+    { name = "pyee" },
+]
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/44/ee/31e4e0db36588b817a10b299a0285082545fde7d36543c2abe498bb3d61a/playwright-1.61.0-py3-none-macosx_10_13_x86_64.whl", hash = "sha256:ff138c3a604f69911e9d42fd036e55c2a171e5616edf04c1e7f60a2a285540b0", size = 43421877, upload-time = "2026-06-29T10:32:48.428Z" },
+    { url = "https://files.pythonhosted.org/packages/42/35/71395dd3ecc798965be4a3ef8c443217d4abca168e7cb34536304f9489e6/playwright-1.61.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:009588c2a7e499bc5a8b425b61fa65490968bbda9cd69e0cf2cff10f8304659a", size = 42205016, upload-time = "2026-06-29T10:32:52.104Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/44/323164cf5cd1647bdefce76ffce27651aadb959d089b48f53ea40918276e/playwright-1.61.0-py3-none-macosx_11_0_universal2.whl", hash = "sha256:9f7de4536088d12037c13a52b7ea34b59270b78926bb56935070597ffac6b1af", size = 43421884, upload-time = "2026-06-29T10:32:55.773Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/f8/a35bf179e4ba2522c1893635094a64e407572547bd61528820fc0abc87fe/playwright-1.61.0-py3-none-manylinux1_x86_64.whl", hash = "sha256:54f3b39f6eab832e33458c1dd7da0b5682aedab3b09ae731b5c59fa12fd2024e", size = 47421381, upload-time = "2026-06-29T10:32:59.903Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/eb/e3f922348ec17c315f98c463f72faa1181a1c3de0bfe31a8d2edf6561723/playwright-1.61.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:93454322ade8c11d5d6c211bfd91bdfb9ffb4810e3e026371bcbc4bec1b7ee4c", size = 47120545, upload-time = "2026-06-29T10:33:03.574Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/a6/5be4e52b40a9c0c8a073e7c5b0785c05cf5a9ea8f8a7b5b260e32d970342/playwright-1.61.0-py3-none-win32.whl", hash = "sha256:372d55a6f1248fa1dd47599686980cb8fb5bbe6fcda59eab793eb657c11d8a9b", size = 37844841, upload-time = "2026-06-29T10:33:07.361Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/fd/2b78036e5fbe9d5f5645bbe08a1eac7160c51243c0093963edbcf67c35d9/playwright-1.61.0-py3-none-win_amd64.whl", hash = "sha256:35c6cc4589a5d00964a59d7b3e59641e0aac0c02f15479a7af77d20f6bc79597", size = 37844846, upload-time = "2026-06-29T10:33:10.637Z" },
+    { url = "https://files.pythonhosted.org/packages/27/0d/1b0f3c4ee4eb0514bc805b5c2f9a223e5b6de4f11a926f5235d51d0fc81b/playwright-1.61.0-py3-none-win_arm64.whl", hash = "sha256:e9fcbffcf557a8620fdedd92491eb59a32d18e23d6f3b4f6214b952be324fe51", size = 33955127, upload-time = "2026-06-29T10:33:14.008Z" },
+]
+
 [[package]]
 name = "pluggy"
 version = "1.6.0"
@@ -2059,6 +2080,18 @@ email = [
     { name = "email-validator" },
 ]
 
+[[package]]
+name = "pyee"
+version = "13.0.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/8b/04/e7c1fe4dc78a6fdbfd6c337b1c3732ff543b8a397683ab38378447baa331/pyee-13.0.1.tar.gz", hash = "sha256:0b931f7c14535667ed4c7e0d531716368715e860b988770fc7eb8578d1f67fc8", size = 31655, upload-time = "2026-02-14T21:12:28.044Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a0/c4/b4d4827c93ef43c01f599ef31453ccc1c132b353284fc6c87d535c233129/pyee-13.0.1-py3-none-any.whl", hash = "sha256:af2f8fede4171ef667dfded53f96e2ed0d6e6bd7ee3bb46437f77e3b57689228", size = 15659, upload-time = "2026-02-14T21:12:26.263Z" },
+]
+
 [[package]]
 name = "pygments"
 version = "2.20.0"
@@ -2201,6 +2234,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
 ]
 
+[[package]]
+name = "pytest-base-url"
+version = "2.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pytest" },
+    { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ae/1a/b64ac368de6b993135cb70ca4e5d958a5c268094a3a2a4cac6f0021b6c4f/pytest_base_url-2.1.0.tar.gz", hash = "sha256:02748589a54f9e63fcbe62301d6b0496da0d10231b753e950c63e03aee745d45", size = 6702, upload-time = "2024-01-31T22:43:00.81Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/98/1c/b00940ab9eb8ede7897443b771987f2f4a76f06be02f1b3f01eb7567e24a/pytest_base_url-2.1.0-py3-none-any.whl", hash = "sha256:3ad15611778764d451927b2a53240c1a7a591b521ea44cebfe45849d2d2812e6", size = 5302, upload-time = "2024-01-31T22:42:58.897Z" },
+]
+
 [[package]]
 name = "pytest-cov"
 version = "7.0.0"
@@ -2251,6 +2297,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/5a/cc/06253936f4a7fa2e0f48dfe6d851d9c56df896a9ab09ac019d70b760619c/pytest_mock-3.15.1-py3-none-any.whl", hash = "sha256:0a25e2eb88fe5168d535041d09a4529a188176ae608a6d249ee65abc0949630d", size = 10095, upload-time = "2025-09-16T16:37:25.734Z" },
 ]
 
+[[package]]
+name = "pytest-playwright"
+version = "0.8.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "playwright" },
+    { name = "pytest" },
+    { name = "pytest-base-url" },
+    { name = "python-slugify" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/58/ef/172eb8e23c80491fc72f1401c72f9305663873649351306a38b18406b0c9/pytest_playwright-0.8.0.tar.gz", hash = "sha256:7888d4a2443160c82e0c506c437076679f86b36d1910427250d90fbf1843a981", size = 17132, upload-time = "2026-05-18T10:16:15.919Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fe/71/1c545fac6a9054b52b3771238fb2dc6e8f1d0ccec116e1c7786ec191887c/pytest_playwright-0.8.0-py3-none-any.whl", hash = "sha256:856aae6efd4bc055f2ef229c647768760bcaad5cd3a5983c314ac260a974a933", size = 17143, upload-time = "2026-05-18T10:16:18.226Z" },
+]
+
 [[package]]
 name = "python-crontab"
 version = "3.3.0"
@@ -2291,6 +2352,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/5e/1e/7f7f299527a5a8ad90acd5f2f78dfa6c8495c6301a3205106ea68a84de96/python_multipart-0.0.31-py3-none-any.whl", hash = "sha256:8408153d68a9773291fc1da39a8b85a50044bddbabd2dd72e9229776b7b15e28", size = 29996, upload-time = "2026-06-04T08:27:47.804Z" },
 ]
 
+[[package]]
+name = "python-slugify"
+version = "8.0.4"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "text-unidecode" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/87/c7/5e1547c44e31da50a460df93af11a535ace568ef89d7a811069ead340c4a/python-slugify-8.0.4.tar.gz", hash = "sha256:59202371d1d05b54a9e7720c5e038f928f45daaffe41dd10822f3907b937c856", size = 10921, upload-time = "2024-02-08T18:32:45.488Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a4/62/02da182e544a51a5c3ccf4b03ab79df279f9c60c5e82d5e8bec7ca26ac11/python_slugify-8.0.4-py2.py3-none-any.whl", hash = "sha256:276540b79961052b66b7d116620b36518847f52d5fd9e3a70164fc8c50faa6b8", size = 10051, upload-time = "2024-02-08T18:32:43.911Z" },
+]
+
 [[package]]
 name = "pytokens"
 version = "0.4.1"
@@ -2630,6 +2703,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ce/fd/901cfa59aaa5b30a99e16876f11abe38b59a1a2c51ffb3d7142bb6089069/starlette-0.47.3-py3-none-any.whl", hash = "sha256:89c0778ca62a76b826101e7c709e70680a1699ca7da6b44d38eb0a7e61fe4b51", size = 72991, upload-time = "2025-08-24T13:36:40.887Z" },
 ]
 
+[[package]]
+name = "text-unidecode"
+version = "1.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ab/e2/e9a00f0ccb71718418230718b3d900e71a5d16e701a3dae079a21e9cd8f8/text-unidecode-1.3.tar.gz", hash = "sha256:bad6603bb14d279193107714b288be206cac565dfa49aa5b105294dd5c4aab93", size = 76885, upload-time = "2019-08-30T21:36:45.405Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a6/a5/c0b6468d3824fe3fde30dbb5e1f687b291608f9473681bbf7dabbf5a87d7/text_unidecode-1.3-py2.py3-none-any.whl", hash = "sha256:1311f10e8b895935241623731c2ba64f4c455287888b18189350b67134a822e8", size = 78154, upload-time = "2019-08-30T21:37:03.543Z" },
+]
+
 [[package]]
 name = "tibs"
 version = "0.5.7"