refactor: extract functions

This reverts commit e7c359c1e0e21a8aeea391fd5b2cd6316526d42c.

.github/workflows/appimage.yml

@@ -7,6 +7,10 @@ on:
         description: 'The tag name for the release'
         required: true
         type: string
+      upload_url:
+        description: 'The upload URL for the release'
+        required: true
+        type: string
 
   workflow_dispatch:
     inputs:
@@ -14,6 +18,10 @@ on:
         description: 'The tag name for the release'
         required: true
         type: string
+      upload_url:
+        description: 'The upload URL for the release'
+        required: true
+        type: string
 
 jobs:
   build-linux-package:
@@ -105,6 +113,11 @@ jobs:
         shell: bash
 
       - name: Upload Linux Release Asset
+        uses: actions/upload-release-asset@v1
+        with:
+          upload_url: ${{ inputs.upload_url }}
+          asset_path: ${{ env.APPIMAGE_NAME }}
+          asset_name: ${{ env.APPIMAGE_NAME }}
+          asset_content_type: application/octet-stream
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload "${{ inputs.tag_name }}" "${{ env.APPIMAGE_NAME }}" --clobber

.github/workflows/release-rc.yml

@@ -12,6 +12,8 @@ jobs:
 
   release:
     runs-on: ubuntu-24.04
+    outputs:
+      upload_url: ${{ steps.get_upload_url.outputs.upload_url }}
     steps:
       - uses: actions/checkout@v4
       - name: Create github pre-release
@@ -20,6 +22,14 @@ jobs:
           tag: ${{ github.ref_name }}
         run: |
           gh release create "$tag" --prerelease --generate-notes --draft
+      - id: get_upload_url
+        name: Get upload url of Github release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ github.ref_name }}
+        run: |
+          upload_url=$(gh release view "$tag" --json uploadUrl -q ".uploadUrl")
+          echo "upload_url=$upload_url" >> "$GITHUB_OUTPUT"
 
   docker:
     if: github.repository == 'lnbits/lnbits'
@@ -64,3 +74,4 @@ jobs:
     uses: ./.github/workflows/appimage.yml
     with:
       tag_name: ${{ github.ref_name }}
+      upload_url: ${{ needs.release.outputs.upload_url }}

.github/workflows/release.yml

@@ -13,6 +13,8 @@ jobs:
 
   release:
     runs-on: ubuntu-24.04
+    outputs:
+      upload_url: ${{ steps.get_upload_url.outputs.upload_url }}
     steps:
       - uses: actions/checkout@v4
       - name: Create github release
@@ -21,6 +23,14 @@ jobs:
           tag: ${{ github.ref_name }}
         run: |
           gh release create "$tag" --generate-notes --draft
+      - id: get_upload_url
+        name: Get upload url of Github release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ github.ref_name }}
+        run: |
+          upload_url=$(gh release view "$tag" --json uploadUrl -q ".uploadUrl")
+          echo "upload_url=$upload_url" >> "$GITHUB_OUTPUT"
 
   docker:
     if: github.repository == 'lnbits/lnbits'
@@ -75,3 +85,4 @@ jobs:
     uses: ./.github/workflows/appimage.yml
     with:
       tag_name: ${{ github.ref_name }}
+      upload_url: ${{ needs.release.outputs.upload_url }}

lnbits/app.py

@@ -23,40 +23,36 @@ from lnbits.core.crud import (
     get_installed_extensions,
     update_installed_extension_state,
 )
-from lnbits.core.crud.audit import delete_expired_audit_entries
 from lnbits.core.crud.extensions import create_installed_extension
+from lnbits.core.extensions.events import dispatch_wasm_invoice_paid
+from lnbits.core.extensions.loader import (
+    is_wasm_extension_dir,
+    is_wasm_extension_id,
+)
+from lnbits.core.extensions.routes import register_wasm_extension
 from lnbits.core.helpers import migrate_extension_database
 from lnbits.core.models.notifications import NotificationType
 from lnbits.core.services.extensions import deactivate_extension, get_valid_extensions
-from lnbits.core.services.funding_source import (
-    check_balance_delta_changed,
-    check_server_balance_against_node,
-)
-from lnbits.core.services.notifications import (
-    dispatch_payment_notification,
-    enqueue_admin_notification,
-    process_next_notification,
-)
-from lnbits.core.services.payments import (
-    check_pending_payments,
-    fundingsource_invoice_producer,
-)
+from lnbits.core.services.notifications import enqueue_admin_notification
+from lnbits.core.services.payments import check_pending_payments
 from lnbits.core.tasks import (
     audit_queue,
     collect_exchange_rates_data,
-    notify_server_status,
-    process_next_audit_entry,
-    refresh_extension_cache,
-)
-from lnbits.core.wasm_ext.routes.register import register_wasm_extension
-from lnbits.core.wasm_ext.wasm.events import dispatch_wasm_invoice_paid
-from lnbits.core.wasm_ext.wasm.loader import (
-    is_wasm_extension_id,
+    purge_audit_data,
+    run_by_the_minute_tasks,
+    wait_for_audit_data,
+    wait_for_paid_invoices,
+    wait_notification_messages,
 )
 from lnbits.exceptions import register_exception_handlers
 from lnbits.helpers import version_parse
 from lnbits.llms_txt import create_llms_txt_route
 from lnbits.settings import settings
+from lnbits.tasks import (
+    cancel_all_tasks,
+    create_permanent_task,
+    register_invoice_listener,
+)
 from lnbits.utils.cache import cache
 from lnbits.utils.logger import (
     configure_logger,
@@ -79,7 +75,7 @@ from .middleware import (
     add_profiler_middleware,
     add_ratelimit_middleware,
 )
-from .task_manager import task_manager
+from .tasks import internal_invoice_listener, invoice_listener, run_interval
 
 
 async def startup(app: FastAPI):
@@ -143,7 +139,7 @@ async def shutdown():
     settings.lnbits_running = False
 
     # shutdown event
-    task_manager.cancel_all_tasks()
+    cancel_all_tasks()
 
     # wait a bit to allow them to finish, so that cleanup can run without problems
     await asyncio.sleep(0.1)
@@ -321,8 +317,9 @@ async def build_all_installed_extensions_list(  # noqa: C901
 
             installed_extensions.append(ext_info)
             await create_installed_extension(ext_info)
-            current_version = await get_db_version(ext_id)
-            await migrate_extension_database(ext_info, current_version)
+            if not is_wasm_extension_dir(ext_dir):
+                current_version = await get_db_version(ext_id)
+                await migrate_extension_database(ext_info, current_version)
 
         except Exception as e:
             logger.warning(e)
@@ -495,42 +492,34 @@ async def check_and_register_extensions(app: FastAPI) -> None:
 
 def register_async_tasks() -> None:
 
-    task_manager.init()
+    create_permanent_task(wait_for_audit_data)
+    create_permanent_task(wait_notification_messages)
 
-    # listen to all incoming payments and dispatch payment notifications
-    # note: should be the first in task list for a bit quicker notifications
-    task_manager.register_invoice_listener(dispatch_payment_notification, "core")
+    create_permanent_task(
+        run_interval(
+            settings.lnbits_funding_source_pending_interval_seconds,
+            check_pending_payments,
+        )
+    )
+    create_permanent_task(invoice_listener)
+    create_permanent_task(internal_invoice_listener)
+    create_permanent_task(cache.invalidate_forever)
 
-    # periodic tasks
-    task_manager.create_permanent_task(cache.invalidate_cache, interval=10)
-    task_manager.create_permanent_task(delete_expired_audit_entries, interval=60 * 60)
-    task_manager.create_permanent_task(
-        check_pending_payments,
-        interval=settings.lnbits_funding_source_pending_interval_seconds,
-    )
-    task_manager.create_permanent_task(
-        collect_exchange_rates_data,
-        interval=max(60, settings.lnbits_exchange_history_refresh_interval_seconds),
-    )
-    task_manager.create_permanent_task(check_balance_delta_changed, interval=60)
-    task_manager.create_permanent_task(
-        check_server_balance_against_node,
-        interval=60 * settings.lnbits_watchdog_interval_minutes,
-    )
-    task_manager.create_permanent_task(
-        notify_server_status,
-        interval=60 * 60 * settings.lnbits_notification_server_status_hours,
-    )
-    task_manager.create_permanent_task(refresh_extension_cache, interval=60)
+    # core invoice listener
+    invoice_queue: asyncio.Queue = asyncio.Queue()
+    register_invoice_listener(invoice_queue, "core")
 
-    # permanent tasks run in a loop, will be restarted if they fail
-    task_manager.create_permanent_task(fundingsource_invoice_producer)
-    task_manager.create_permanent_task(process_next_notification)
-    task_manager.create_permanent_task(process_next_audit_entry)
+    async def dispatch_extension_invoice_paid(payment) -> None:
+        await dispatch_wasm_invoice_paid(payment)
+
+    core_app_extra.dispatch_extension_invoice_paid = dispatch_extension_invoice_paid
+    create_permanent_task(lambda: wait_for_paid_invoices(invoice_queue))
+
+    create_permanent_task(run_by_the_minute_tasks)
+    create_permanent_task(purge_audit_data)
+    create_permanent_task(collect_exchange_rates_data)
 
     # server logs for websocket
     if settings.lnbits_admin_ui:
         server_log_task = initialize_server_websocket_logger()
-        task_manager.create_permanent_task(
-            server_log_task, name="server_websocket_logger"
-        )
+        create_permanent_task(server_log_task)

lnbits/core/crud/settings.py

@@ -8,18 +8,11 @@ from lnbits.db import dict_to_model
 from lnbits.settings import (
     AdminSettings,
     EditableSettings,
-    FundingSourcesSettings,
     SettingsField,
     SuperSettings,
     settings,
 )
 
-RESET_PRESERVED_SETTINGS = (
-    "lnbits_webpush_pubkey",
-    "lnbits_webpush_privkey",
-    *FundingSourcesSettings.__fields__,
-)
-
 
 async def get_super_settings() -> SuperSettings | None:
     data = await get_settings_by_tag("core")
@@ -76,14 +69,16 @@ async def delete_admin_settings(tag: str | None = "core") -> None:
 
 
 async def reset_core_settings() -> None:
-    core_settings = await get_settings_by_tag("core") or {}
-    super_user = await get_settings_field("super_user")
-    await delete_admin_settings()
-    if super_user:
-        await set_settings_field("super_user", super_user.value)
-    for field in RESET_PRESERVED_SETTINGS:
-        if field in core_settings:
-            await set_settings_field(field, core_settings[field])
+    await db.execute(
+        """
+        DELETE FROM system_settings WHERE tag = 'core'
+        AND id NOT IN (
+            'super_user',
+            'lnbits_webpush_pubkey',
+            'lnbits_webpush_privkey'
+        )
+        """,
+    )
 
 
 async def create_admin_settings(super_user: str, new_settings: dict) -> SuperSettings:

lnbits/core/extensions/__init__.py

@@ -0,0 +1,28 @@
+"""Extension runtime contracts."""
+
+from .api import (
+    ExtensionAPI,
+    ExtensionAPIMethod,
+    extension_api_contract,
+    extension_api_method,
+    get_extension_api_method,
+    list_extension_api_methods,
+)
+from .loader import WasmExtension, load_wasm_extension
+from .routes import register_wasm_extension
+from .runtime import ExtensionAPIHost
+from .wasm import invoke_wasm_extension_export
+
+__all__ = [
+    "ExtensionAPI",
+    "ExtensionAPIHost",
+    "ExtensionAPIMethod",
+    "WasmExtension",
+    "extension_api_contract",
+    "extension_api_method",
+    "get_extension_api_method",
+    "invoke_wasm_extension_export",
+    "list_extension_api_methods",
+    "load_wasm_extension",
+    "register_wasm_extension",
+]

lnbits/core/extensions/api.py

@@ -1,22 +1,19 @@
 from __future__ import annotations
 
+import inspect
 import json
 import logging
 import secrets
 import time
-from collections.abc import Iterable, Mapping
-from typing import Any
+from collections.abc import Awaitable, Callable, Iterable, Mapping
+from dataclasses import dataclass
+from functools import wraps
+from typing import Any, TypeVar, cast, get_type_hints
+
+from pydantic import BaseModel
 
 from lnbits.helpers import sha256s
 
-from ..client.extensions import send_extension_api_request
-from ..storage.crud import (
-    storage_delete_row,
-    storage_get_paginated_rows,
-    storage_get_public_row,
-    storage_get_row,
-    storage_set_row,
-)
 from .models import (
     CreateInvoicePublicRequest,
     CreateInvoiceRequest,
@@ -45,12 +42,102 @@ from .models import (
     WalletBalanceRequest,
     WalletBalanceResponse,
 )
-from .registry import extension_api_method
+from .storage import (
+    storage_delete_row,
+    storage_get_paginated_rows,
+    storage_get_public_row,
+    storage_get_row,
+    storage_set_row,
+)
 
 logger = logging.getLogger("lnbits.extensions")
 
+_EXTENSION_API_METHOD_ATTR = "__lnbits_extension_api_method__"
+_EXTENSION_RUNTIME_PERMISSION_IDS = {"ui.camera.scan_qr"}
+_RequestModel = TypeVar("_RequestModel", bound=BaseModel)
+_ResponseModel = TypeVar("_ResponseModel", bound=BaseModel)
 
-class ExtensionHostAPI:
+
+@dataclass(frozen=True)
+class ExtensionAPIMethodExport:
+    method_id: str
+    namespace: str
+    name: str
+    host_interface: str
+    host_name: str
+    sdk_name: str
+    description: str
+    required_permission: str | None = None
+    require_auth: bool = True
+
+
+@dataclass(frozen=True)
+class ExtensionAPIMethod:
+    method_id: str
+    namespace: str
+    name: str
+    python_name: str
+    host_interface: str
+    host_name: str
+    sdk_name: str
+    description: str
+    request_model: type[BaseModel]
+    response_model: type[BaseModel]
+    required_permission: str | None = None
+    require_auth: bool = True
+
+    @property
+    def sdk_qualified_name(self) -> str:
+        return f"{self.namespace}.{self.sdk_name}"
+
+
+def extension_api_method(
+    *,
+    method_id: str,
+    namespace: str,
+    name: str,
+    host_name: str,
+    sdk_name: str,
+    description: str,
+    host_interface: str = "host",
+    required_permission: str | None = None,
+    require_auth: bool = True,
+) -> Callable[
+    [Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]],
+    Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
+]:
+    export = ExtensionAPIMethodExport(
+        method_id=method_id,
+        namespace=namespace,
+        name=name,
+        host_interface=host_interface,
+        host_name=host_name,
+        sdk_name=sdk_name,
+        description=description,
+        required_permission=required_permission,
+        require_auth=require_auth,
+    )
+
+    def decorator(
+        function: Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
+    ) -> Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]:
+        @wraps(function)
+        async def wrapper(self: Any, request: _RequestModel) -> _ResponseModel:
+            api = getattr(self, "api", self)
+            if require_auth and not api.has_authenticated_context():
+                raise PermissionError(
+                    f"Extension API method '{method_id}' requires authentication."
+                )
+            api.require_permission(required_permission)
+            return await function(self, request)
+
+        setattr(wrapper, _EXTENSION_API_METHOD_ATTR, export)
+        return wrapper
+
+    return decorator
+
+
+class ExtensionAPI:
     def __init__(
         self,
         extension_id: str,
@@ -67,9 +154,33 @@ class ExtensionHostAPI:
         self.access_token = access_token
         self.context = context
         self.owner_id = sha256s(user_id) if user_id else owner_id
-        from .utils import ExtensionAPIUtils
+        self._uuid = secrets.token_urlsafe(12).replace("-", "_")
+        from .api_utils import ExtensionAPIUtils
 
-        self.utils = ExtensionAPIUtils(self.extension_id, self.permissions)
+        self.utils = ExtensionAPIUtils(self)
+
+    def __repr__(self) -> str:
+        return (
+            "ExtensionAPI("
+            f"extension_id={self.extension_id!r}, "
+            f"context={self.context!r}, "
+            f"_uuid={self._uuid!r}"
+            ")"
+        )
+
+    def require_permission(self, permission: str | None) -> None:
+        if permission and permission not in self.permissions:
+            raise PermissionError(
+                f"Extension '{self.extension_id}' is missing permission '{permission}'."
+            )
+
+    def has_authenticated_context(self) -> bool:
+        return bool(self.user_id) or self.context == "event"
+
+    def _require_owner_id(self) -> str:
+        if not self.owner_id:
+            raise PermissionError("Extension API method requires an owner context.")
+        return self.owner_id
 
     @extension_api_method(
         method_id="storage.get",
@@ -112,7 +223,6 @@ class ExtensionHostAPI:
             for field_name, value in row.items()
             if field_name in public_fields
         }
-        # todo: check public fields filtering
         return StorageGetResponse(data_json=json.dumps(public_row))
 
     @extension_api_method(
@@ -202,14 +312,16 @@ class ExtensionHostAPI:
         from lnbits.core.models.payments import CreateInvoice
         from lnbits.core.services.payments import create_payment_request
 
-        if not self.user_id:
-            raise PermissionError(
-                "Creating an invoice for this wallet requires an "
-                "authenticated user context."
-            )
-        wallet = await get_wallet(request.wallet_id)
-        if wallet is None or wallet.user != self.user_id:
-            raise PermissionError("Not your wallet.")
+        if self.user_id:
+            wallet = await get_wallet(request.wallet_id)
+            if wallet is None or wallet.user != self.user_id:
+                raise PermissionError(
+                    "Creating an invoice for this wallet requires an "
+                    "authenticated user context."
+                )
+        else:
+            pass
+            # todo: security stuff here
 
         payment = await create_payment_request(
             request.wallet_id,
@@ -243,18 +355,8 @@ class ExtensionHostAPI:
         from lnbits.core.models.payments import CreateInvoice
         from lnbits.core.services.payments import create_payment_request
 
-        row: dict[str, Any] | None = None
-        wallet_field = ""
-        for policy in self._public_invoice_wallet_sources():
-            row = await storage_get_public_row(
-                self.extension_id,
-                policy["table"],
-                request.source_id,
-            )
-            if row:
-                wallet_field = policy["wallet_field"]
-                break
-
+        table, wallet_field = self._public_invoice_wallet_source()
+        row = await storage_get_public_row(self.extension_id, table, request.source_id)
         if not row:
             raise PermissionError("Public invoice source was not found.")
 
@@ -410,10 +512,10 @@ class ExtensionHostAPI:
         require_auth=True,
     )
     async def http_request(self, request: HttpRequest) -> HttpResponse:
-        from ..client.http import send_extension_http_request
+        from .http_client import send_extension_http_request
 
-        policies = self.permission_policies.get("http.request") or []
-        return await send_extension_http_request(self.extension_id, policies, request)
+        policy = self.permission_policies.get("http.request") or {}
+        return await send_extension_http_request(self.extension_id, policy, request)
 
     @extension_api_method(
         method_id="extension.api.request",
@@ -426,11 +528,12 @@ class ExtensionHostAPI:
         require_auth=True,
     )
     async def extension_api_request(self, request: ExtensionApiRequest) -> HttpResponse:
+        from .extension_client import send_extension_api_request
 
-        policies = self.permission_policies.get("extension.api.request") or []
+        policy = self.permission_policies.get("extension.api.request") or {}
         return await send_extension_api_request(
             self.extension_id,
-            policies,
+            policy,
             self.user_id,
             self.access_token,
             request,
@@ -479,9 +582,9 @@ class ExtensionHostAPI:
     @staticmethod
     def _permission_data(
         permissions: Iterable[Any],
-    ) -> tuple[set[str], dict[str, list[Any]]]:
+    ) -> tuple[set[str], dict[str, dict[str, Any]]]:
         permission_ids: set[str] = set()
-        policies: dict[str, list[Any]] = {}
+        policies: dict[str, dict[str, Any]] = {}
 
         for permission in permissions:
             if isinstance(permission, str):
@@ -489,27 +592,28 @@ class ExtensionHostAPI:
                 continue
 
             permission_id: str | None = None
-            permission_policies: Any = None
+            policy: Any = None
             if isinstance(permission, Mapping):
                 permission_id = permission.get("id")  # type: ignore[assignment]
-                permission_policies = permission.get("policies")
+                policy = permission.get("policy")
             else:
                 permission_id = getattr(permission, "id", None)
-                permission_policies = getattr(permission, "policies", None)
+                policy = getattr(permission, "policy", None)
 
             if not permission_id:
                 continue
             permission_ids.add(permission_id)
-            if isinstance(permission_policies, list):
-                policies[permission_id] = permission_policies
+            if isinstance(policy, dict):
+                policies[permission_id] = policy
 
         return permission_ids, policies
 
     def _public_storage_fields(self, table: str) -> set[str]:
-        tables = self.permission_policies.get("ext.storage.read_public")
-        if not isinstance(tables, list) or not tables:
+        policy = self.permission_policies.get("ext.storage.read_public") or {}
+        tables = policy.get("tables")
+        if not isinstance(tables, list):
             raise PermissionError(
-                "Public storage reads require policies for "
+                "Public storage reads require a tables policy for "
                 "'ext.storage.read_public'."
             )
 
@@ -529,54 +633,145 @@ class ExtensionHostAPI:
 
         raise PermissionError(f"Storage table '{table}' is not publicly readable.")
 
-    def _public_invoice_wallet_sources(self) -> list[dict[str, str]]:
-        policies = self.permission_policies.get("wallet.create_invoice_public")
-        if not isinstance(policies, list) or not policies:
-            raise PermissionError("Public invoice creation requires a policies list.")
-
-        sources: list[dict[str, str]] = []
-        for source_policy in policies:
-            if not isinstance(source_policy, dict):
-                raise PermissionError(
-                    "Public invoice creation policies must be objects."
-                )
-            table = source_policy.get("table")
-            wallet_field = source_policy.get("wallet_field")
-            if not isinstance(table, str) or not table:
-                raise PermissionError(
-                    "Public invoice creation requires a storage table policy."
-                )
-            if not isinstance(wallet_field, str) or not wallet_field:
-                raise PermissionError(
-                    "Public invoice creation requires a wallet field policy."
-                )
-            sources.append({"table": table, "wallet_field": wallet_field})
-
-        if not sources:
+    def _public_invoice_wallet_source(self) -> tuple[str, str]:
+        policy = self.permission_policies.get("wallet.create_invoice_public") or {}
+        table = policy.get("table")
+        wallet_field = policy.get("wallet_field")
+        if not isinstance(table, str) or not table:
             raise PermissionError(
-                "Public invoice creation requires at least one valid policy."
+                "Public invoice creation requires a storage table policy."
             )
-        return sources
-
-    def require_permission(self, permission: str | None) -> None:
-        if permission and permission not in self.permissions:
+        if not isinstance(wallet_field, str) or not wallet_field:
             raise PermissionError(
-                f"Extension '{self.extension_id}' is missing permission '{permission}'."
+                "Public invoice creation requires a wallet field policy."
+            )
+        return table, wallet_field
+
+
+def list_extension_api_methods(
+    api_cls: type[ExtensionAPI] = ExtensionAPI,
+) -> list[ExtensionAPIMethod]:
+    methods: list[ExtensionAPIMethod] = []
+
+    for prefix, method_cls in _extension_api_method_sources(api_cls):
+        for python_name, function in inspect.getmembers(method_cls, inspect.isfunction):
+            export = getattr(function, _EXTENSION_API_METHOD_ATTR, None)
+            if not export:
+                continue
+
+            request_model, response_model = _get_method_models(function)
+            methods.append(
+                ExtensionAPIMethod(
+                    method_id=export.method_id,
+                    namespace=export.namespace,
+                    name=export.name,
+                    python_name=f"{prefix}.{python_name}" if prefix else python_name,
+                    host_interface=export.host_interface,
+                    host_name=export.host_name,
+                    sdk_name=export.sdk_name,
+                    description=export.description,
+                    request_model=request_model,
+                    response_model=response_model,
+                    required_permission=export.required_permission,
+                    require_auth=export.require_auth,
+                )
             )
 
-    def has_authenticated_context(self) -> bool:
-        return bool(self.user_id) or self.context == "event"
+    return sorted(methods, key=lambda method: method.method_id)
 
-    def _require_owner_id(self) -> str:
-        if not self.owner_id:
-            raise PermissionError("Extension API method requires an owner context.")
-        return self.owner_id
 
-    def __repr__(self) -> str:
-        return (
-            "ExtensionHostAPI("
-            f"extension_id={self.extension_id!r}, "
-            f"context={self.context!r}, "
-            f"owner_id={self.owner_id!r}"
-            ")"
+def _extension_api_method_sources(
+    api_cls: type[ExtensionAPI],
+) -> list[tuple[str, type[Any]]]:
+    sources: list[tuple[str, type[Any]]] = [("", api_cls)]
+    if issubclass(api_cls, ExtensionAPI):
+        from .api_utils import extension_api_utils_method_classes
+
+        sources.extend(extension_api_utils_method_classes().items())
+    return sources
+
+
+def extension_api_permission_ids(
+    api_cls: type[ExtensionAPI] = ExtensionAPI,
+) -> set[str]:
+    permissions = {
+        method.required_permission
+        for method in list_extension_api_methods(api_cls)
+        if method.required_permission
+    }
+    permissions.update(_EXTENSION_RUNTIME_PERMISSION_IDS)
+    return permissions
+
+
+def get_extension_api_method(
+    method_id: str,
+    api_cls: type[ExtensionAPI] = ExtensionAPI,
+) -> ExtensionAPIMethod:
+    for method in list_extension_api_methods(api_cls):
+        if method.method_id == method_id:
+            return method
+    raise KeyError(f"Unknown extension API method '{method_id}'.")
+
+
+def extension_api_contract(
+    api_cls: type[ExtensionAPI] = ExtensionAPI,
+) -> dict[str, object]:
+    return {
+        "version": 1,
+        "methods": [
+            {
+                "id": method.method_id,
+                "namespace": method.namespace,
+                "name": method.name,
+                "python_name": method.python_name,
+                "host_interface": method.host_interface,
+                "host_name": method.host_name,
+                "sdk_name": method.sdk_name,
+                "sdk_qualified_name": method.sdk_qualified_name,
+                "description": method.description,
+                "required_permission": method.required_permission,
+                "require_auth": method.require_auth,
+                "request_schema": method.request_model.schema(
+                    ref_template="#/definitions/{model}"
+                ),
+                "response_schema": method.response_model.schema(
+                    ref_template="#/definitions/{model}"
+                ),
+            }
+            for method in list_extension_api_methods(api_cls)
+        ],
+    }
+
+
+def _get_method_models(
+    function: Callable[..., object],
+) -> tuple[type[BaseModel], type[BaseModel]]:
+    signature = inspect.signature(function)
+    request_parameters = [
+        parameter
+        for parameter in signature.parameters.values()
+        if parameter.name != "self"
+    ]
+    if len(request_parameters) != 1:
+        raise TypeError(
+            f"Extension API method '{function.__name__}' must accept one request model."
         )
+
+    hints = get_type_hints(function)
+    request_model = hints.get(request_parameters[0].name)
+    response_model = hints.get("return")
+
+    if not _is_pydantic_model(request_model):
+        raise TypeError(
+            f"Extension API method '{function.__name__}' request must be a BaseModel."
+        )
+    if not _is_pydantic_model(response_model):
+        raise TypeError(
+            f"Extension API method '{function.__name__}' response must be a BaseModel."
+        )
+
+    return cast(type[BaseModel], request_model), cast(type[BaseModel], response_model)
+
+
+def _is_pydantic_model(value: object) -> bool:
+    return isinstance(value, type) and issubclass(value, BaseModel)

lnbits/core/extensions/api_utils.py

@@ -1,20 +1,10 @@
 from __future__ import annotations
 
 import time
-from collections.abc import Iterable
 from datetime import datetime
-from typing import Any
-
-from lnbits import bolt11
-from lnbits.settings import settings
-from lnbits.utils.crypto import random_secret_and_hash, verify_preimage
-from lnbits.utils.exchange_rates import (
-    allowed_currencies,
-    fiat_amount_as_satoshis,
-    get_fiat_rate_and_price_satoshis,
-    satoshis_amount_as_fiat,
-)
+from typing import TYPE_CHECKING, Any
 
+from .api import extension_api_method
 from .models import (
     Bolt11Request,
     CurrencyConvertRequest,
@@ -39,30 +29,22 @@ from .models import (
     VerifyPreimageRequest,
     VerifyPreimageResponse,
 )
-from .registry import extension_api_method
+
+if TYPE_CHECKING:
+    from .api import ExtensionAPI
 
 
 class ExtensionAPIUtils:
-    def __init__(self, extension_id: str, permissions: Iterable[str]) -> None:
-        permission_set = set(permissions)
-        self.currencies = ExtensionCurrencyUtils(extension_id, permission_set)
-        self.server = ExtensionServerUtils(extension_id, permission_set)
-        self.lightning = ExtensionLightningUtils(extension_id, permission_set)
+    def __init__(self, api: ExtensionAPI) -> None:
+        self.api = api
+        self.currencies = ExtensionCurrencyUtils(api)
+        self.server = ExtensionServerUtils(api)
+        self.lightning = ExtensionLightningUtils(api)
 
 
 class _ExtensionAPIUtilsGroup:
-    def __init__(self, extension_id: str, permissions: Iterable[str]) -> None:
-        self.extension_id = extension_id
-        self.permissions = set(permissions)
-
-    def require_permission(self, permission: str | None) -> None:
-        if permission and permission not in self.permissions:
-            raise PermissionError(
-                f"Extension '{self.extension_id}' is missing permission '{permission}'."
-            )
-
-    def has_authenticated_context(self) -> bool:
-        return False
+    def __init__(self, api: ExtensionAPI) -> None:
+        self.api = api
 
 
 class ExtensionCurrencyUtils(_ExtensionAPIUtilsGroup):
@@ -78,6 +60,7 @@ class ExtensionCurrencyUtils(_ExtensionAPIUtilsGroup):
         require_auth=False,
     )
     async def list(self, request: EmptyRequest) -> CurrencyListResponse:
+        from lnbits.utils.exchange_rates import allowed_currencies
 
         return CurrencyListResponse(currencies=allowed_currencies())
 
@@ -93,6 +76,7 @@ class ExtensionCurrencyUtils(_ExtensionAPIUtilsGroup):
         require_auth=False,
     )
     async def rate(self, request: CurrencyRateRequest) -> CurrencyRateResponse:
+        from lnbits.utils.exchange_rates import get_fiat_rate_and_price_satoshis
 
         rate, price = await get_fiat_rate_and_price_satoshis(request.currency)
         return CurrencyRateResponse(rate=rate, price=price)
@@ -109,6 +93,10 @@ class ExtensionCurrencyUtils(_ExtensionAPIUtilsGroup):
         require_auth=False,
     )
     async def convert(self, request: CurrencyConvertRequest) -> CurrencyConvertResponse:
+        from lnbits.utils.exchange_rates import (
+            fiat_amount_as_satoshis,
+            satoshis_amount_as_fiat,
+        )
 
         from_currency = request.from_currency
         if from_currency == "sats":
@@ -147,6 +135,7 @@ class ExtensionCurrencyUtils(_ExtensionAPIUtilsGroup):
         require_auth=False,
     )
     async def fiat_to_sats(self, request: FiatToSatsRequest) -> FiatToSatsResponse:
+        from lnbits.utils.exchange_rates import fiat_amount_as_satoshis
 
         return FiatToSatsResponse(
             amount_sat=await fiat_amount_as_satoshis(
@@ -167,6 +156,7 @@ class ExtensionCurrencyUtils(_ExtensionAPIUtilsGroup):
         require_auth=False,
     )
     async def sats_to_fiat(self, request: SatsToFiatRequest) -> SatsToFiatResponse:
+        from lnbits.utils.exchange_rates import satoshis_amount_as_fiat
 
         return SatsToFiatResponse(
             amount=await satoshis_amount_as_fiat(request.amount, request.currency)
@@ -186,6 +176,7 @@ class ExtensionServerUtils(_ExtensionAPIUtilsGroup):
         require_auth=False,
     )
     async def health(self, request: EmptyRequest) -> ServerHealthResponse:
+        from lnbits.settings import settings
 
         return ServerHealthResponse(
             server_time=int(time.time()),
@@ -307,6 +298,7 @@ class ExtensionLightningUtils(_ExtensionAPIUtilsGroup):
     async def verify_preimage(
         self, request: VerifyPreimageRequest
     ) -> VerifyPreimageResponse:
+        from lnbits.utils.crypto import verify_preimage
 
         return VerifyPreimageResponse(
             valid=verify_preimage(request.preimage, request.payment_hash)
@@ -326,6 +318,7 @@ class ExtensionLightningUtils(_ExtensionAPIUtilsGroup):
     async def random_secret_and_hash(
         self, request: RandomSecretAndHashRequest
     ) -> RandomSecretAndHashResponse:
+        from lnbits.utils.crypto import random_secret_and_hash
 
         secret, payment_hash = random_secret_and_hash(request.length)
         return RandomSecretAndHashResponse(secret=secret, hash=payment_hash)
@@ -340,6 +333,7 @@ def extension_api_utils_method_classes() -> dict[str, type[_ExtensionAPIUtilsGro
 
 
 def _decode_bolt11(payment_request: str) -> Any:
+    from lnbits import bolt11
 
     return bolt11.decode(payment_request)
 

lnbits/core/extensions/events.py

@@ -4,8 +4,6 @@ from typing import Any
 from loguru import logger
 
 from lnbits.core.db import core_app_extra
-from lnbits.core.wasm_ext.storage.crud import storage_get_row_owner_id
-from lnbits.core.wasm_ext.wasm.invoke import invoke_wasm_extension_export
 
 
 async def dispatch_wasm_invoice_paid(payment: Any) -> None:
@@ -29,6 +27,8 @@ async def dispatch_wasm_invoice_paid(payment: Any) -> None:
         return
 
     try:
+        from lnbits.core.extensions.wasm import invoke_wasm_extension_export
+
         await invoke_wasm_extension_export(
             extension.id,
             export_name,
@@ -54,15 +54,13 @@ def _payment_extension_id(payment: Any) -> str | None:
 
 async def _wasm_invoice_paid_owner_id(extension: Any, payment: Any) -> str | None:
     source_id = _payment_source_id(payment)
-    source_tables = _wasm_public_invoice_source_tables(extension.config)
-    if not source_id or not source_tables:
+    source_table = _wasm_public_invoice_source_table(extension.config)
+    if not source_id or not source_table:
         return None
 
-    for source_table in source_tables:
-        owner_id = await storage_get_row_owner_id(extension.id, source_table, source_id)
-        if owner_id:
-            return owner_id
-    return None
+    from lnbits.core.extensions.storage import storage_get_row_owner_id
+
+    return await storage_get_row_owner_id(extension.id, source_table, source_id)
 
 
 def _payment_source_id(payment: Any) -> str | None:
@@ -71,24 +69,17 @@ def _payment_source_id(payment: Any) -> str | None:
     return source_id if isinstance(source_id, str) and source_id else None
 
 
-def _wasm_public_invoice_source_tables(config: dict[str, Any]) -> list[str]:
+def _wasm_public_invoice_source_table(config: dict[str, Any]) -> str | None:
     permissions = config.get("permissions") or []
     for permission in permissions:
         if not isinstance(permission, dict):
             continue
         if permission.get("id") != "wallet.create_invoice_public":
             continue
-        policies = permission.get("policies")
-        if not isinstance(policies, list):
-            return []
-        return [
-            source_policy["table"]
-            for source_policy in policies
-            if isinstance(source_policy, dict)
-            and isinstance(source_policy.get("table"), str)
-            and source_policy["table"]
-        ]
-    return []
+        policy = permission.get("policy") or {}
+        table = policy.get("table")
+        return table if isinstance(table, str) and table else None
+    return None
 
 
 def _wasm_invoice_paid_export(config: dict[str, Any]) -> str | None:

lnbits/core/extensions/extension_client.py

@@ -13,7 +13,7 @@ from lnbits.core.crud.extensions import (
 )
 from lnbits.settings import settings
 
-from ..api.models import ExtensionApiRequest, HttpResponse
+from .models import ExtensionApiRequest, HttpResponse
 
 EXTENSION_API_TIMEOUT_SECONDS = 10.0
 EXTENSION_API_MAX_RESPONSE_BYTES = 262_144
@@ -31,7 +31,7 @@ _FORBIDDEN_RESPONSE_HEADERS = {
 
 async def send_extension_api_request(
     caller_extension_id: str,
-    policies: list[Any],
+    policy: dict[str, Any],
     user_id: str | None,
     access_token: str | None,
     request: ExtensionApiRequest,
@@ -42,7 +42,7 @@ async def send_extension_api_request(
         raise PermissionError("Extension API requests require an account access token.")
 
     target_extension_id = _target_extension_id(request.extension_id)
-    access = _target_extension_access(policies, target_extension_id)
+    access = _target_extension_access(policy, target_extension_id)
     _require_method_access(caller_extension_id, target_extension_id, access, request)
     await _require_enabled_extension(target_extension_id, user_id)
 
@@ -81,13 +81,16 @@ def _target_extension_id(extension_id: str) -> str:
     return target
 
 
-def _target_extension_access(policies: list[Any], target_extension_id: str) -> set[str]:
-    if not isinstance(policies, list) or not policies:
+def _target_extension_access(
+    policy: dict[str, Any], target_extension_id: str
+) -> set[str]:
+    extensions = policy.get("extensions")
+    if not isinstance(extensions, list) or not extensions:
         raise PermissionError(
             "Extension API requests require a non-empty extensions policy."
         )
 
-    for extension in policies:
+    for extension in extensions:
         if isinstance(extension, str):
             extension_id = extension
             access = ["read"]

lnbits/core/extensions/http_client.py

@@ -7,7 +7,7 @@ from urllib.parse import urlparse
 
 import httpx
 
-from ..api.models import HttpRequest, HttpResponse
+from .models import HttpRequest, HttpResponse
 
 HTTP_REQUEST_TIMEOUT_SECONDS = 10.0
 HTTP_MAX_RESPONSE_BYTES = 262_144
@@ -30,10 +30,10 @@ _FORBIDDEN_RESPONSE_HEADERS = {
 
 async def send_extension_http_request(
     extension_id: str,
-    policies: list[Any],
+    policy: dict[str, Any],
     request: HttpRequest,
 ) -> HttpResponse:
-    allowed_origins = _allowed_origins(policies)
+    allowed_origins = _allowed_origins(policy)
     origin = _request_origin(request.url)
     if origin not in allowed_origins:
         raise PermissionError(
@@ -68,13 +68,13 @@ async def send_extension_http_request(
         raise ValueError("HTTP request failed.") from exc
 
 
-def _allowed_origins(policies: list[Any]) -> set[str]:
-    if not isinstance(policies, list) or not policies:
+def _allowed_origins(policy: dict[str, Any]) -> set[str]:
+    hosts = policy.get("hosts")
+    if not isinstance(hosts, list) or not hosts:
         raise PermissionError("HTTP requests require a non-empty hosts policy.")
 
     origins: set[str] = set()
-    for policy in policies:
-        host = policy.get("host") if isinstance(policy, dict) else policy
+    for host in hosts:
         if not isinstance(host, str) or not host:
             continue
         origins.add(_request_origin(host))

lnbits/core/extensions/loader.py

@@ -60,7 +60,7 @@ def load_wasm_extension(ext_id: str) -> WasmExtension:
         module_path=module_path,
         wit_path=wit_path,
         world=wasm_config.get("world") or "",
-        host_api=wasm_config.get("host_api") or "lnbits.core.wasm_ext.ExtensionHostAPI",
+        host_api=wasm_config.get("host_api") or "lnbits.core.extensions.ExtensionAPI",
         exports=wasm_config.get("exports") or [],
         config=config,
     )

lnbits/core/extensions/models.py

@@ -1,43 +1,9 @@
 import json
-from dataclasses import dataclass
 from typing import Any, Literal
 
 from pydantic import BaseModel, Field, root_validator
 
 
-@dataclass(frozen=True)
-class ExtensionAPIMethodExport:
-    method_id: str
-    namespace: str
-    name: str
-    host_interface: str
-    host_name: str
-    sdk_name: str
-    description: str
-    required_permission: str | None = None
-    require_auth: bool = True
-
-
-@dataclass(frozen=True)
-class ExtensionAPIMethod:
-    method_id: str
-    namespace: str
-    name: str
-    python_name: str
-    host_interface: str
-    host_name: str
-    sdk_name: str
-    description: str
-    request_model: type[BaseModel]
-    response_model: type[BaseModel]
-    required_permission: str | None = None
-    require_auth: bool = True
-
-    @property
-    def sdk_qualified_name(self) -> str:
-        return f"{self.namespace}.{self.sdk_name}"
-
-
 class EmptyRequest(BaseModel):
     pass
 
@@ -116,12 +82,7 @@ class CreateInvoiceRequest(BaseModel):
 
 
 class CreateInvoicePublicRequest(BaseModel):
-    source_id: str = Field(
-        ...,
-        min_length=1,
-        max_length=512,
-        description="The source ID (entry id) of the wallet to create the invoice for.",
-    )
+    source_id: str = Field(..., min_length=1, max_length=512)
     amount: float = Field(..., gt=0)
     currency: str = Field(..., min_length=1, max_length=8)
     memo: str = Field("", max_length=512)

lnbits/core/extensions/permissions.py

@@ -1,8 +1,8 @@
 from collections.abc import Iterable
 from typing import Any
 
+from lnbits.core.extensions.api import extension_api_permission_ids
 from lnbits.core.models.extensions import ExtensionPermission, InstallableExtension
-from lnbits.core.wasm_ext.api.registry import extension_api_permission_ids
 
 
 def validate_extension_permissions(

lnbits/core/extensions/routes.py

@@ -0,0 +1,777 @@
+from __future__ import annotations
+
+import json
+import os
+import re
+from pathlib import Path
+from typing import Annotated, Any, NoReturn
+from uuid import uuid4
+
+from fastapi import Depends, FastAPI, HTTPException, Request
+from fastapi.responses import FileResponse, Response
+from fastapi.staticfiles import StaticFiles
+from loguru import logger
+from pydantic import UUID4
+from starlette.staticfiles import PathLike as StaticFilesPathLike
+from starlette.types import Scope
+
+from lnbits.core.crud import get_installed_extension, get_user_from_account
+from lnbits.core.db import core_app_extra
+from lnbits.core.models import Account
+from lnbits.decorators import (
+    check_access_token,
+    check_account_exists,
+    optional_user_id,
+)
+from lnbits.helpers import template_renderer
+from lnbits.settings import settings
+from lnbits.utils.cache import cache
+
+from .loader import WasmExtension, load_wasm_extension
+from .wasm import invoke_wasm_extension_export, warm_wasm_extension
+
+WASM_FRAME_TOKEN_EXPIRY_SECONDS = 60
+WASM_EXTENSION_CORE_ASSET_PREFIX = "_lnbits"
+WASM_EXTENSION_CORE_STATIC_ASSETS = {
+    "bundle.min.css": ("static/bundle.min.css", "text/css; charset=utf-8"),
+    "material-icons-v50.woff2": (
+        "static/fonts/material-icons-v50.woff2",
+        "font/woff2",
+    ),
+    "quasar.css": ("static/vendor/quasar.css", "text/css; charset=utf-8"),
+    "quasar.umd.prod.js": (
+        "static/vendor/quasar.umd.prod.js",
+        "text/javascript; charset=utf-8",
+    ),
+    "qrcode.vue.browser.js": (
+        "static/vendor/qrcode.vue.browser.js",
+        "text/javascript; charset=utf-8",
+    ),
+    "vue.global.prod.js": (
+        "static/vendor/vue.global.prod.js",
+        "text/javascript; charset=utf-8",
+    ),
+}
+WASM_EXTENSION_GENERATED_CORE_ASSETS = {
+    "material-icons.css": (
+        """
+        @font-face {
+          font-family: 'Material Icons';
+          font-style: normal;
+          font-weight: 400;
+          src: url('./material-icons-v50.woff2') format('woff2');
+        }
+        """,
+        "text/css; charset=utf-8",
+    )
+}
+WASM_EXTENSION_STATIC_MIME_TYPES = {
+    ".css": "text/css; charset=utf-8",
+    ".gif": "image/gif",
+    ".ico": "image/x-icon",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".js": "text/javascript; charset=utf-8",
+    ".png": "image/png",
+    ".webp": "image/webp",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+}
+WASM_EXTENSION_TEXT_STATIC_EXTENSIONS = {".css", ".js"}
+WASM_EXTENSION_HTML_PREFIXES = (b"<!doctype", b"<html", b"<script")
+
+
+class GuardedWasmExtensionStaticFiles(StaticFiles):
+    async def get_response(self, path: str, scope: Scope) -> Response:
+        if path.startswith(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/"):
+            return _wasm_extension_core_asset_response(path)
+        if Path(path).suffix.lower() not in WASM_EXTENSION_STATIC_MIME_TYPES:
+            raise HTTPException(status_code=404)
+        return await super().get_response(path, scope)
+
+    def file_response(
+        self,
+        full_path: StaticFilesPathLike,
+        stat_result: os.stat_result,
+        scope: Scope,
+        status_code: int = 200,
+    ) -> Response:
+        suffix = Path(full_path).suffix.lower()
+        if suffix in WASM_EXTENSION_TEXT_STATIC_EXTENSIONS:
+            _reject_html_like_wasm_static_asset(Path(full_path))
+
+        response = super().file_response(full_path, stat_result, scope, status_code)
+        response.headers["Content-Type"] = WASM_EXTENSION_STATIC_MIME_TYPES[suffix]
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Cache-Control"] = "no-store"
+        return response
+
+
+def register_wasm_extension(app: FastAPI, ext_id: str) -> WasmExtension:
+    loaded = load_wasm_extension(ext_id)
+
+    warm_wasm_extension(loaded)
+    _mount_wasm_extension_static(app, loaded)
+    _register_wasm_extension_ui_routes(app, loaded)
+    _register_wasm_extension_api_routes(app, loaded)
+
+    core_app_extra.wasm_extension_registry.register(loaded)
+
+    settings.activate_extension_paths(ext_id, "", [])
+    logger.info(
+        f"Loaded WASM extension '{loaded.id}' "
+        f"({loaded.module_path.stat().st_size} bytes)."
+    )
+    return loaded
+
+
+def _mount_wasm_extension_static(app: FastAPI, extension: WasmExtension) -> None:
+    static_path = extension.root_path / "static"
+
+    mount_path = f"/ext-assets/{extension.id}"
+    if any(getattr(route, "path", None) == mount_path for route in app.routes):
+        return
+
+    app.mount(
+        mount_path,
+        GuardedWasmExtensionStaticFiles(directory=static_path, check_dir=False),
+        name=f"{extension.id}-static",
+    )
+
+
+def _register_wasm_extension_ui_routes(app: FastAPI, extension: WasmExtension) -> None:
+    _add_wasm_extension_frame_config_route(app, extension)
+
+    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
+        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
+        entrypoint = _wasm_extension_entrypoint(
+            extension, route_config.get("entrypoint")
+        )
+        frame_path = f"/ext-frame/{extension.id}/{route_index}"
+        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
+        _add_wasm_extension_frame_route(app, extension, frame_path, entrypoint)
+        _add_wasm_extension_wrapper_route(
+            app,
+            extension,
+            route_path,
+            auth,
+        )
+
+
+def _register_wasm_extension_api_routes(app: FastAPI, extension: WasmExtension) -> None:
+    for route_config in extension.config.get("api_routes") or []:
+        _add_wasm_extension_api_route(app, extension, route_config)
+
+
+def _add_wasm_extension_api_route(
+    app: FastAPI,
+    extension: WasmExtension,
+    route_config: dict[str, Any],
+) -> None:
+    method = _wasm_extension_api_method(extension, route_config.get("method"))
+    route_path = _wasm_extension_api_path(extension, route_config.get("path"))
+    export_name = _wasm_extension_api_export(extension, route_config.get("export"))
+    path_params = route_config.get("path_params") or {}
+    auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
+
+    if _has_route(app, route_path, method):
+        return
+
+    async def invoke_wasm_api_request(
+        request: Request,
+        account: Account | None = None,
+        access_token: str | None = None,
+    ) -> dict[str, Any]:
+        try:
+            payload = await _read_api_payload(request, path_params)
+            return await invoke_wasm_extension_export(
+                extension.id,
+                export_name,
+                payload,
+                user=account,
+                access_token=access_token,
+            )
+        except KeyError as exc:
+            raise HTTPException(status_code=404, detail=str(exc)) from exc
+        except PermissionError as exc:
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+        except (TypeError, ValueError) as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+    async def invoke_private_wasm_extension_export(
+        request: Request,
+        access_token: Annotated[str | None, Depends(check_access_token)],
+        account: Account = Depends(check_account_exists),
+    ) -> dict[str, Any]:
+        return await invoke_wasm_api_request(request, account, access_token)
+
+    async def invoke_public_wasm_extension_export(request: Request) -> dict[str, Any]:
+        return await invoke_wasm_api_request(request)
+
+    app.add_api_route(
+        route_path,
+        (
+            invoke_public_wasm_extension_export
+            if auth == "public"
+            else invoke_private_wasm_extension_export
+        ),
+        methods=[method],
+        name=f"{extension.id}:{method}:{route_path}",
+        include_in_schema=False,
+    )
+
+
+def _add_wasm_extension_frame_config_route(
+    app: FastAPI,
+    extension: WasmExtension,
+) -> None:
+    route_path = _wasm_extension_frame_config_path(extension)
+    if _has_route(app, route_path, "POST"):
+        return
+
+    async def create_wasm_extension_frame_config(
+        request: Request,
+        access_token: Annotated[str | None, Depends(check_access_token)],
+        usr: UUID4 | None = None,
+    ) -> dict[str, Any]:
+        try:
+            body = await _read_json_object(request)
+        except (TypeError, ValueError) as exc:
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+        ui_route = _match_wasm_extension_ui_route(extension, body.get("path"))
+        auth = ui_route["auth"]
+
+        if auth == "user":
+            account = await check_account_exists(request, access_token, usr)
+            user_id: str | None = account.id
+        else:
+            user_id = await _optional_wasm_user_id(request, access_token, usr)
+
+        granted_permission_ids = await _wasm_extension_granted_permission_ids(extension)
+
+        return _wasm_extension_frame_config(
+            extension,
+            ui_route["frame_path"],
+            auth,
+            ui_route["path_params"],
+            ui_route["route_params"],
+            _read_wasm_extension_route_query(body.get("query")),
+            user_id,
+            granted_permission_ids,
+        )
+
+    app.add_api_route(
+        route_path,
+        create_wasm_extension_frame_config,
+        methods=["POST"],
+        name=f"{extension.id}:frame-config",
+        include_in_schema=False,
+    )
+
+
+async def _read_api_payload(
+    request: Request,
+    path_params: dict[str, str],
+) -> dict[str, Any]:
+    payload = _read_api_path_params(request, path_params)
+    payload.update(_read_api_query_params(request))
+    if request.method in {"POST", "PUT", "PATCH"}:
+        payload.update(await _read_json_object(request))
+    return payload
+
+
+async def _read_json_object(request: Request) -> dict[str, Any]:
+    body = await request.body()
+    if not body:
+        return {}
+    value = json.loads(body)
+    if not isinstance(value, dict):
+        raise TypeError("WASM extension API payload must be a JSON object.")
+    return value
+
+
+def _read_api_path_params(
+    request: Request,
+    path_params: dict[str, str],
+) -> dict[str, Any]:
+    payload: dict[str, Any] = {}
+    for key, value in request.path_params.items():
+        target = path_params.get(key) or _snake_to_camel(key)
+        payload[target] = value
+    return payload
+
+
+def _read_api_query_params(request: Request) -> dict[str, Any]:
+    return {_snake_to_camel(key): value for key, value in request.query_params.items()}
+
+
+def _wasm_extension_api_export(extension: WasmExtension, export_name: Any) -> str:
+    if not isinstance(export_name, str) or not export_name:
+        raise ValueError(f"Invalid API export for WASM extension '{extension.id}'.")
+
+    for export in extension.exports:
+        if export.get("name") != export_name:
+            continue
+        if export.get("visibility") in {"public", "authenticated"}:
+            return export_name
+        raise PermissionError(f"WASM export '{export_name}' is not callable over HTTP.")
+    raise KeyError(f"WASM extension '{extension.id}' has no export '{export_name}'.")
+
+
+def _wasm_extension_api_method(extension: WasmExtension, method: Any) -> str:
+    if not isinstance(method, str):
+        raise ValueError(f"Invalid API method for WASM extension '{extension.id}'.")
+    method = method.upper()
+    if method not in {"GET", "POST", "PUT", "PATCH", "DELETE"}:
+        raise ValueError(f"Unsupported API method for WASM extension '{extension.id}'.")
+    return method
+
+
+def _wasm_extension_api_path(extension: WasmExtension, path: Any) -> str:
+    if not isinstance(path, str) or not path.startswith("/"):
+        raise ValueError(f"Invalid API path for WASM extension '{extension.id}'.")
+    if path == "/":
+        return f"/api/v1/ext/{extension.id}"
+    return f"/api/v1/ext/{extension.id}{path}"
+
+
+def _has_route(app: FastAPI, route_path: str, method: str) -> bool:
+    for route in app.routes:
+        if getattr(route, "path", None) != route_path:
+            continue
+        methods = getattr(route, "methods", set()) or set()
+        if method in methods:
+            return True
+    return False
+
+
+def _snake_to_camel(value: str) -> str:
+    head, *tail = value.split("_")
+    return head + "".join(part.capitalize() for part in tail)
+
+
+def _add_wasm_extension_wrapper_route(
+    app: FastAPI,
+    extension: WasmExtension,
+    route_path: str,
+    auth: str,
+) -> None:
+    if _has_route(app, route_path, "GET"):
+        return
+
+    async def serve_private_wasm_extension_page(
+        request: Request,
+        account: Account = Depends(check_account_exists),
+    ) -> Any:
+        user = await get_user_from_account(account)
+        return _wasm_extension_wrapper_response(
+            request,
+            extension,
+            auth,
+            user.json() if user else None,
+        )
+
+    async def serve_public_wasm_extension_page(request: Request) -> Any:
+        return _wasm_extension_wrapper_response(
+            request,
+            extension,
+            auth,
+            None,
+        )
+
+    app.add_api_route(
+        route_path,
+        (
+            serve_public_wasm_extension_page
+            if auth == "public"
+            else serve_private_wasm_extension_page
+        ),
+        methods=["GET"],
+        name=f"{extension.id}:{route_path}",
+        include_in_schema=False,
+    )
+
+
+def _add_wasm_extension_frame_route(
+    app: FastAPI,
+    extension: WasmExtension,
+    frame_path: str,
+    entrypoint: Path,
+) -> None:
+    if _has_route(app, frame_path, "GET"):
+        return
+
+    async def serve_wasm_extension_frame(
+        request: Request,
+        user_id: str | None = Depends(_optional_wasm_user_id),
+    ) -> FileResponse:
+        _consume_wasm_extension_frame_token(request, extension, frame_path, user_id)
+        response = FileResponse(entrypoint)
+        response.headers["Content-Security-Policy"] = _wasm_extension_frame_csp(
+            request, extension
+        )
+        response.headers["Cache-Control"] = "no-store"
+        response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
+        response.headers["Cross-Origin-Resource-Policy"] = "same-origin"
+        # Extension access goes through the parent bridge.
+        response.headers["Permissions-Policy"] = (
+            "camera=(), microphone=(), geolocation=(), payment=(), "
+            "clipboard-read=(), usb=()"
+        )
+        response.headers["Referrer-Policy"] = "no-referrer"
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        return response
+
+    app.add_api_route(
+        frame_path,
+        serve_wasm_extension_frame,
+        methods=["GET"],
+        name=f"{extension.id}:frame:{frame_path}",
+        include_in_schema=False,
+    )
+
+
+def _wasm_extension_wrapper_response(
+    request: Request,
+    extension: WasmExtension,
+    auth: str,
+    user_json: str | None,
+) -> Any:
+    public = auth == "public"
+    response = template_renderer().TemplateResponse(
+        request,
+        "wasm_extension.html",
+        {
+            "extension": extension,
+            "public": public,
+            "user": user_json,
+        },
+    )
+    response.headers["Content-Security-Policy"] = "frame-ancestors 'self'"
+    response.headers["X-Frame-Options"] = "SAMEORIGIN"
+    return response
+
+
+def _wasm_extension_frame_csp(request: Request, extension: WasmExtension) -> str:
+    origin = str(request.base_url).rstrip("/")
+    extension_assets = f"{origin}/ext-assets/{extension.id}/"
+    return (
+        "sandbox allow-scripts; "
+        "default-src 'none'; "
+        f"script-src {extension_assets}; "
+        "script-src-attr 'none'; "
+        f"style-src {extension_assets}; "
+        "style-src-attr 'none'; "
+        f"img-src {extension_assets} data:; "
+        f"font-src {extension_assets}; "
+        "connect-src 'none'; "
+        "form-action 'none'; "
+        "object-src 'none'; "
+        "base-uri 'none'; "
+        "frame-src 'none'; "
+        "worker-src 'none'; "
+        "media-src 'none'; "
+        "manifest-src 'none'; "
+        "frame-ancestors 'self'"
+    )
+
+
+def _wasm_extension_frame_url(
+    extension: WasmExtension, frame_path: str, user_id: str | None
+) -> str:
+    token = _create_wasm_extension_frame_token(extension, frame_path, user_id)
+    return f"{frame_path}?frame_token={token}"
+
+
+def _create_wasm_extension_frame_token(
+    extension: WasmExtension,
+    frame_path: str,
+    user_id: str | None,
+) -> str:
+    token = uuid4().hex
+    cache.set(
+        _wasm_extension_frame_token_cache_key(token),
+        {
+            "extension_id": extension.id,
+            "frame_path": frame_path,
+            "user_id": user_id,
+        },
+        expiry=WASM_FRAME_TOKEN_EXPIRY_SECONDS,
+    )
+    return token
+
+
+def _consume_wasm_extension_frame_token(
+    request: Request,
+    extension: WasmExtension,
+    frame_path: str,
+    user_id: str | None,
+) -> None:
+    token = request.query_params.get("frame_token")
+    if not token:
+        _raise_wasm_extension_frame_not_found(extension, frame_path, "missing")
+
+    cache_key = _wasm_extension_frame_token_cache_key(token)
+    token_data = cache.get(cache_key)
+    if (
+        not isinstance(token_data, dict)
+        or token_data.get("extension_id") != extension.id
+        or token_data.get("frame_path") != frame_path
+    ):
+        _raise_wasm_extension_frame_not_found(
+            extension, frame_path, "unknown or expired"
+        )
+
+    token_user_id = token_data.get("user_id")
+    if token_user_id and token_user_id != user_id:
+        _raise_wasm_extension_frame_not_found(extension, frame_path, "wrong user")
+
+    cache.pop(cache_key)
+
+
+def _wasm_extension_frame_token_cache_key(token: str) -> str:
+    return f"wasm-frame-token:{token}"
+
+
+def _raise_wasm_extension_frame_not_found(
+    extension: WasmExtension,
+    frame_path: str,
+    reason: str,
+) -> NoReturn:
+    logger.warning(
+        f"WASM frame token {reason} for extension '{extension.id}' at '{frame_path}'."
+    )
+    raise HTTPException(status_code=404, detail="Not found")
+
+
+def _wasm_extension_bridge_api_routes(
+    extension: WasmExtension,
+    public: bool,
+) -> list[dict[str, str]]:
+    routes: list[dict[str, str]] = []
+    for route_config in extension.config.get("api_routes") or []:
+        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
+        if public and auth != "public":
+            continue
+        method = _wasm_extension_api_method(extension, route_config.get("method"))
+        path = _wasm_extension_api_path(extension, route_config.get("path"))
+        _wasm_extension_api_export(extension, route_config.get("export"))
+        routes.append(
+            {
+                "method": method,
+                "path": path,
+                "pattern": _path_template_pattern(path),
+            }
+        )
+    return routes
+
+
+def _wasm_extension_frame_config_path(extension: WasmExtension) -> str:
+    return f"/api/v1/ext/{extension.id}/_ui/frame"
+
+
+def _match_wasm_extension_ui_route(
+    extension: WasmExtension,
+    path: Any,
+) -> dict[str, Any]:
+    if not isinstance(path, str) or not path.startswith("/"):
+        raise HTTPException(status_code=404, detail="Not found")
+
+    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
+        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
+        route_params = _path_template_params(route_path, path)
+        if route_params is None:
+            continue
+
+        return {
+            "frame_path": f"/ext-frame/{extension.id}/{route_index}",
+            "auth": _wasm_extension_route_auth(extension, route_config.get("auth")),
+            "path_params": route_config.get("path_params") or {},
+            "route_params": route_params,
+        }
+
+    raise HTTPException(status_code=404, detail="Not found")
+
+
+def _path_template_params(template: str, path: str) -> dict[str, str] | None:
+    template_parts = _path_parts(template)
+    path_parts = _path_parts(path)
+    if len(template_parts) != len(path_parts):
+        return None
+
+    params: dict[str, str] = {}
+    for template_part, path_part in zip(template_parts, path_parts, strict=False):
+        if template_part.startswith("{") and template_part.endswith("}"):
+            param_name = template_part[1:-1]
+            if not param_name:
+                return None
+            params[param_name] = path_part
+            continue
+
+        if template_part != path_part:
+            return None
+
+    return params
+
+
+def _path_parts(path: str) -> list[str]:
+    return [part for part in path.strip("/").split("/") if part]
+
+
+def _wasm_extension_frame_config(
+    extension: WasmExtension,
+    frame_path: str,
+    auth: str,
+    path_params: dict[str, str],
+    route_params: dict[str, str],
+    query: dict[str, Any],
+    user_id: str | None,
+    permissions: set[str],
+) -> dict[str, Any]:
+    public = auth == "public"
+    return {
+        "extension": {
+            "id": extension.id,
+            "name": extension.name,
+        },
+        "frameUrl": _wasm_extension_frame_url(extension, frame_path, user_id),
+        "bridge": {
+            "extensionId": extension.id,
+            "public": public,
+            "routeParams": _map_wasm_extension_route_params(route_params, path_params),
+            "query": query,
+            "permissions": sorted(permissions),
+            "apiRoutes": _wasm_extension_bridge_api_routes(extension, public),
+        },
+    }
+
+
+async def _wasm_extension_granted_permission_ids(
+    extension: WasmExtension,
+) -> set[str]:
+    installed_extension = await get_installed_extension(extension.id)
+    if not installed_extension:
+        return set()
+    return {permission.id for permission in installed_extension.permissions}
+
+
+def _map_wasm_extension_route_params(
+    route_params: dict[str, str],
+    path_params: dict[str, str],
+) -> dict[str, str]:
+    payload: dict[str, str] = {}
+    for key, value in route_params.items():
+        target = path_params.get(key) or _snake_to_camel(key)
+        payload[target] = value
+    return payload
+
+
+def _read_wasm_extension_route_query(query: Any) -> dict[str, Any]:
+    if not isinstance(query, dict):
+        return {}
+
+    payload: dict[str, Any] = {}
+    for key, value in query.items():
+        if value is None:
+            continue
+        payload[_snake_to_camel(str(key))] = value
+    return payload
+
+
+def _path_template_pattern(path: str) -> str:
+    pattern = re.sub(r"\\{[^/{}]+\\}", r"[^/]+", re.escape(path))
+    return f"^{pattern}$"
+
+
+async def _optional_wasm_user_id(
+    request: Request,
+    access_token: Annotated[str | None, Depends(check_access_token)],
+    usr: UUID4 | None = None,
+) -> str | None:
+    try:
+        return await optional_user_id(request, access_token, usr)
+    except HTTPException:
+        return None
+
+
+def _wasm_extension_route_auth(extension: WasmExtension, auth: Any) -> str:
+    if auth in {"public", "user"}:
+        return auth
+    raise ValueError(f"Invalid route auth for WASM extension '{extension.id}'.")
+
+
+def _wasm_extension_ui_route_path(extension: WasmExtension, path: Any) -> str:
+    if not isinstance(path, str) or not path.startswith("/"):
+        raise ValueError(f"Invalid route path for WASM extension '{extension.id}'.")
+    if path == "/":
+        return "/ext"
+    return f"/ext{path}"
+
+
+def _wasm_extension_entrypoint(extension: WasmExtension, entrypoint: Any) -> Path:
+    if not isinstance(entrypoint, str) or not entrypoint:
+        raise ValueError(
+            f"Invalid route entrypoint for WASM extension '{extension.id}'."
+        )
+    if entrypoint.startswith("/"):
+        raise ValueError(
+            f"Route entrypoint for WASM extension '{extension.id}' must be a "
+            "relative extension path."
+        )
+
+    path = (extension.root_path / entrypoint).resolve()
+    root_path = extension.root_path.resolve()
+    if path != root_path and root_path not in path.parents:
+        raise ValueError(f"Route entrypoint escapes extension root: {entrypoint}")
+
+    static_path = (extension.root_path / "static").resolve()
+    if path == static_path or static_path in path.parents:
+        raise ValueError(
+            f"Route entrypoint for WASM extension '{extension.id}' must not be "
+            "inside the static asset directory."
+        )
+    if path.suffix.lower() != ".html":
+        raise ValueError(
+            f"Route entrypoint for WASM extension '{extension.id}' must be "
+            "an HTML file."
+        )
+    if not path.is_file():
+        raise FileNotFoundError(f"Route entrypoint not found: {path}")
+    return path
+
+
+def _reject_html_like_wasm_static_asset(path: Path) -> None:
+    with path.open("rb") as asset_file:
+        prefix = asset_file.read(512).lstrip().lower()
+    if prefix.startswith(WASM_EXTENSION_HTML_PREFIXES):
+        raise HTTPException(status_code=404)
+
+
+def _wasm_extension_core_asset_response(path: str) -> Response:
+    asset_name = path.removeprefix(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/")
+    if not asset_name or "/" in asset_name or "\\" in asset_name:
+        raise HTTPException(status_code=404)
+
+    generated_asset = WASM_EXTENSION_GENERATED_CORE_ASSETS.get(asset_name)
+    if generated_asset:
+        content, content_type = generated_asset
+        response = Response(content=content, media_type=content_type)
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Cache-Control"] = "no-store"
+        return response
+
+    asset_config = WASM_EXTENSION_CORE_STATIC_ASSETS.get(asset_name)
+    if not asset_config:
+        raise HTTPException(status_code=404)
+
+    relative_path, content_type = asset_config
+    asset_path = Path(settings.lnbits_path, relative_path)
+    if not asset_path.is_file():
+        raise HTTPException(status_code=404)
+
+    response = FileResponse(asset_path)
+    response.headers["Content-Type"] = content_type
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["Cache-Control"] = "no-store"
+    return response

lnbits/core/extensions/runtime.py

@@ -7,9 +7,7 @@ from typing import Any
 
 from pydantic import BaseModel
 
-from .host import ExtensionHostAPI
-from .models import ExtensionAPIMethod
-from .registry import list_extension_api_methods
+from .api import ExtensionAPI, ExtensionAPIMethod, list_extension_api_methods
 
 HostImport = Callable[..., Awaitable[dict[str, Any]]]
 
@@ -17,9 +15,9 @@ HostImport = Callable[..., Awaitable[dict[str, Any]]]
 class ExtensionAPIHost:
     def __init__(
         self,
-        api: ExtensionHostAPI,
+        api: ExtensionAPI,
         *,
-        api_cls: type[ExtensionHostAPI] = ExtensionHostAPI,
+        api_cls: type[ExtensionAPI] = ExtensionAPI,
     ) -> None:
         self.api = api
         self.methods = list_extension_api_methods(api_cls)

lnbits/core/extensions/wasm.py

@@ -0,0 +1,230 @@
+from __future__ import annotations
+
+import asyncio
+import json
+import re
+from collections.abc import Mapping
+from functools import lru_cache
+from typing import Any
+
+from lnbits.core.crud.extensions import get_installed_extension
+from lnbits.core.db import core_app_extra
+
+from .api import ExtensionAPI, list_extension_api_methods
+from .loader import WasmExtension
+from .runtime import ExtensionAPIHost
+
+
+async def invoke_wasm_extension_export(
+    ext_id: str,
+    export_name: str,
+    payload: Mapping[str, Any] | None = None,
+    *,
+    user: Any | None = None,
+    access_token: str | None = None,
+    context: str = "user",
+    owner_id: str | None = None,
+) -> dict[str, Any]:
+    extension = _get_registered_extension(ext_id)
+    permissions = await _extension_permissions(extension)
+    api = ExtensionAPI(
+        extension.id,
+        permissions,
+        user_id=_user_id(user),
+        access_token=access_token,
+        context=context,
+        owner_id=owner_id,
+    )
+    event_loop = asyncio.get_running_loop()
+
+    return await asyncio.to_thread(
+        _invoke_wasm_extension_export_sync,
+        extension,
+        export_name,
+        payload or {},
+        api,
+        event_loop,
+    )
+
+
+def warm_wasm_extension(extension: WasmExtension) -> None:
+    _wasm_component(extension)
+
+
+def _invoke_wasm_extension_export_sync(
+    extension: WasmExtension,
+    export_name: str,
+    payload: Mapping[str, Any],
+    api: ExtensionAPI,
+    event_loop: asyncio.AbstractEventLoop,
+) -> dict[str, Any]:
+    try:
+        from wasmtime import Store, WasiConfig, component
+    except ImportError as exc:
+        raise RuntimeError(
+            "WASM extension runtime is not installed. Install the 'wasmtime' "
+            "Python package to run WASM extensions."
+        ) from exc
+
+    engine = _wasm_engine()
+    store = Store(engine)
+    store.set_wasi(WasiConfig())
+
+    linker = component.Linker(engine)
+    linker.add_wasip2()
+    _add_extension_host_imports(linker, ExtensionAPIHost(api), event_loop)
+
+    wasm_component = _wasm_component(extension)
+    instance = linker.instantiate(store, wasm_component)
+    function = instance.get_func(store, export_name)
+    if not function:
+        raise KeyError(
+            f"WASM extension '{extension.id}' has no export '{export_name}'."
+        )
+
+    result = function(store, json.dumps(payload))
+    function.post_return(store)
+    return _parse_wasm_export_result(extension, result)
+
+
+@lru_cache(maxsize=1)
+def _wasm_engine() -> Any:
+    try:
+        from wasmtime import Config, Engine
+    except ImportError as exc:
+        raise RuntimeError(
+            "WASM extension runtime is not installed. Install the 'wasmtime' "
+            "Python package to run WASM extensions."
+        ) from exc
+
+    config = Config()
+    config.wasm_component_model = True
+    return Engine(config)
+
+
+def _wasm_component(extension: WasmExtension) -> Any:
+    stat = extension.module_path.stat()
+    return _cached_wasm_component(
+        str(extension.module_path),
+        stat.st_mtime_ns,
+        stat.st_size,
+    )
+
+
+@lru_cache(maxsize=32)
+def _cached_wasm_component(
+    module_path: str,
+    mtime_ns: int,
+    size: int,
+) -> Any:
+    from wasmtime import component
+
+    return component.Component.from_file(_wasm_engine(), module_path)
+
+
+def _add_extension_host_imports(
+    linker: Any,
+    api_host: ExtensionAPIHost,
+    event_loop: asyncio.AbstractEventLoop,
+) -> None:
+    with linker.root() as root:
+        methods_by_interface: dict[str, list[Any]] = {}
+        for method in list_extension_api_methods():
+            methods_by_interface.setdefault(method.host_interface, []).append(method)
+
+        for host_interface, methods in methods_by_interface.items():
+            with root.add_instance(f"lnbits:extension/{host_interface}") as host:
+                for method in methods:
+                    host.add_func(
+                        method.host_name.replace("_", "-"),
+                        _make_host_import(api_host, method.method_id, event_loop),
+                    )
+
+
+def _make_host_import(
+    api_host: ExtensionAPIHost,
+    host_name: str,
+    event_loop: asyncio.AbstractEventLoop,
+) -> Any:
+    def host_import(_store: Any, request: Any = None) -> Any:
+        payload = _component_payload_to_dict(request)
+        future = asyncio.run_coroutine_threadsafe(
+            api_host.invoke(host_name, payload), event_loop
+        )
+        response = future.result()
+        return _dict_to_component_record(response)
+
+    return host_import
+
+
+def _component_payload_to_dict(value: Any) -> dict[str, Any]:
+    if value is None:
+        return {}
+    if hasattr(value, "__dict__"):
+        return dict(value.__dict__)
+    if isinstance(value, Mapping):
+        return dict(value)
+    raise TypeError("WASM host function payload must be a record.")
+
+
+def _dict_to_component_record(value: Mapping[str, Any]) -> Any:
+    from wasmtime import component
+
+    record = component.Record()
+    for key, item in value.items():
+        setattr(record, _camel_to_kebab(key), _to_component_value(item))
+    return record
+
+
+def _to_component_value(value: Any) -> Any:
+    if isinstance(value, Mapping):
+        return _dict_to_component_record(value)
+    if isinstance(value, list):
+        return [_to_component_value(item) for item in value]
+    return value
+
+
+def _parse_wasm_export_result(extension: WasmExtension, value: Any) -> dict[str, Any]:
+    if isinstance(value, bytes):
+        value = value.decode()
+    if not isinstance(value, str):
+        return {"ok": True, "data": value}
+
+    max_response_bytes = (
+        (extension.config.get("wasm") or {})
+        .get("resource_limits", {})
+        .get("max_response_bytes")
+    )
+    if isinstance(max_response_bytes, int):
+        response_size = len(value.encode())
+        if response_size > max_response_bytes:
+            raise ValueError(
+                f"WASM extension response is too large: {response_size} bytes."
+            )
+
+    parsed = json.loads(value)
+    if isinstance(parsed, dict):
+        return parsed
+    return {"ok": True, "data": parsed}
+
+
+def _get_registered_extension(ext_id: str) -> WasmExtension:
+    extension = core_app_extra.wasm_extension_registry.get(ext_id)
+    if extension:
+        return extension
+    raise RuntimeError(f"WASM extension '{ext_id}' is not registered.")
+
+
+async def _extension_permissions(extension: WasmExtension) -> list[Any]:
+    installed_extension = await get_installed_extension(extension.id)
+    if not installed_extension:
+        return []
+    return installed_extension.permissions
+
+
+def _user_id(user: Any | None) -> str | None:
+    return getattr(user, "id", None) if user else None
+
+
+def _camel_to_kebab(value: str) -> str:
+    return re.sub(r"([a-z0-9])([A-Z])", r"\1-\2", value).replace("_", "-").lower()

lnbits/core/helpers.py

@@ -13,10 +13,10 @@ from lnbits.core.crud import (
     update_migration_version,
 )
 from lnbits.core.db import db as core_db
+from lnbits.core.extensions.loader import is_wasm_extension_id
+from lnbits.core.extensions.storage import migrate_wasm_extension_database
 from lnbits.core.models import DbVersion
 from lnbits.core.models.extensions import InstallableExtension
-from lnbits.core.wasm_ext.storage.crud import migrate_wasm_extension_database
-from lnbits.core.wasm_ext.wasm.loader import is_wasm_extension_id
 from lnbits.db import COCKROACH, POSTGRES, SQLITE, Connection
 from lnbits.settings import settings
 
@@ -27,13 +27,7 @@ async def migrate_extension_database(
     if is_wasm_extension_id(ext.id):
         await migrate_wasm_extension_database(ext, current_version)
         return
-    else:
-        await migrate_py_extension_database(ext, current_version)
 
-
-async def migrate_py_extension_database(
-    ext: InstallableExtension, current_version: DbVersion | None = None
-):
     try:
         ext_migrations = importlib.import_module(f"{ext.module_name}.migrations")
         ext_db = importlib.import_module(ext.module_name).db

lnbits/core/models/extensions.py

@@ -6,7 +6,9 @@ import json
 import os
 import shutil
 import zipfile
-from pathlib import Path
+from asyncio.tasks import create_task
+from collections.abc import Mapping
+from pathlib import Path, PurePosixPath
 from typing import Any
 
 import httpx
@@ -20,7 +22,6 @@ from lnbits.helpers import (
     version_parse,
 )
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager
 from lnbits.utils.cache import cache
 
 
@@ -81,7 +82,7 @@ class ExtensionPermission(BaseModel):
     id: str
     label: str | None = None
     description: str | None = None
-    policies: list[Any] | None = None
+    policy: dict[str, Any] | None = None
 
     @staticmethod
     def list_from_config(config_json: Mapping[str, Any]) -> list[ExtensionPermission]:
@@ -178,8 +179,6 @@ class Extension(BaseModel):
 
     @property
     def is_upgrade_extension(self) -> bool:
-        if self.is_wasm:
-            return False
         return self.upgrade_hash != ""
 
     @classmethod
@@ -190,11 +189,19 @@ class Extension(BaseModel):
             is_wasm=ext_info.is_wasm,
             name=ext_info.name,
             short_description=ext_info.short_description,
-            tile=_extension_tile(ext_info),
+            tile=(
+                wasm_extension_icon_url(ext_info.id)
+                if ext_info.is_wasm
+                else ext_info.icon
+            ),
             upgrade_hash=ext_info.hash if ext_info.ext_upgrade_dir.is_dir() else "",
         )
 
 
+def wasm_extension_icon_url(ext_id: str) -> str:
+    return f"/ext-assets/{ext_id}/assets/icon.png"
+
+
 class ExtensionRelease(BaseModel):
     name: str
     version: str
@@ -472,7 +479,7 @@ class InstallableExtension(BaseModel):
 
         try:
             with zipfile.ZipFile(self.zip_path, "r") as archive:
-                config_name = _archive_config_name(archive.namelist())
+                config_name = self._archive_config_name(archive.namelist())
                 if not config_name:
                     return {}
                 with archive.open(config_name) as config_file:
@@ -482,6 +489,14 @@ class InstallableExtension(BaseModel):
 
         return config if isinstance(config, dict) else {}
 
+    @staticmethod
+    def _archive_config_name(names: list[str]) -> str | None:
+        for name in names:
+            path = PurePosixPath(name)
+            if len(path.parts) == 2 and path.name == "config.json":
+                return name
+        return None
+
     def extract_archive(self):
         logger.info(f"Extracting extension {self.name} ({self.installed_version}).")
         Path(settings.lnbits_extensions_upgrade_path).mkdir(parents=True, exist_ok=True)
@@ -693,10 +708,7 @@ class InstallableExtension(BaseModel):
 
         if cache_value.older_than(10 * 60) or post_refresh_cache:
             # refresh cache in background if older than 10 minutes or requested
-            task_manager.create_task(
-                cls._refresh_installable_extensions_cache(),
-                "refresh_installable_extensions_cache",
-            )
+            create_task(cls._refresh_installable_extensions_cache())
 
         extension_list = cache_value.value  # type: ignore
         return extension_list
@@ -907,21 +919,3 @@ def icon_to_github_url(source_repo: str, path: str | None) -> str:
     _, _, *rest = path.split("/")
     tail = "/".join(rest)
     return f"https://github.com/{source_repo}/raw/main/{tail}"
-
-
-def wasm_extension_icon_url(ext_id: str) -> str:
-    return f"/ext-assets/{ext_id}/assets/icon.png"
-
-
-def _extension_tile(ext_info: InstallableExtension) -> str | None:
-    if ext_info.is_wasm:
-        return wasm_extension_icon_url(ext_info.id)
-    return ext_info.icon
-
-
-def _archive_config_name(names: list[str]) -> str | None:
-    for name in names:
-        path = PurePosixPath(name)
-        if len(path.parts) == 2 and path.name == "config.json":
-            return name
-    return None

lnbits/core/services/extensions.py

@@ -16,9 +16,8 @@ from lnbits.core.crud.extensions import (
     get_installed_extensions,
     update_installed_extension,
 )
+from lnbits.core.extensions.permissions import validate_wasm_extension_permissions
 from lnbits.core.helpers import migrate_extension_database
-from lnbits.core.wasm_ext.api.permissions import validate_wasm_extension_permissions
-from lnbits.core.wasm_ext.wasm.loader import is_wasm_extension_id
 from lnbits.db import Connection
 from lnbits.settings import settings
 
@@ -71,7 +70,7 @@ async def install_extension(
         await update_installed_extension(ext_info)
 
     extension = Extension.from_installable_ext(ext_info)
-    if extension.is_upgrade_extension:
+    if extension.is_upgrade_extension and not extension.is_wasm:
         # call stop while the old routes are still active
         await stop_extension_background_work(ext_info.id)
 
@@ -123,9 +122,6 @@ async def stop_extension_background_work(ext_id: str) -> bool:
     Stop background work for extension (like asyncio.Tasks, WebSockets, etc).
     Extension must expose a `myextension_stop()` function if it is starting tasks.
     """
-    if is_wasm_extension_id(ext_id):
-        return True
-
     upgrade_hash = settings.extension_upgrade_hash(ext_id)
     ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)
 
@@ -158,9 +154,6 @@ async def start_extension_background_work(ext_id: str) -> bool:
     Extension CAN expose a `myextension_start()` function if it is starting tasks.
     Extension MUST expose a `myextension_stop()` in that case.
     """
-    if is_wasm_extension_id(ext_id):
-        return False
-
     upgrade_hash = settings.extension_upgrade_hash(ext_id)
     ext = Extension(code=ext_id, is_valid=True, upgrade_hash=upgrade_hash)
 

lnbits/core/services/fiat_providers.py

@@ -20,7 +20,6 @@ from lnbits.fiat.base import (
     FiatPaymentSuccessStatus,
 )
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager
 
 
 async def handle_fiat_payment_confirmation(
@@ -61,7 +60,11 @@ async def check_fiat_status(payment: Payment) -> FiatPaymentStatus:
         payment.status = PaymentState.SUCCESS.value
         await update_payment(payment)
         await handle_fiat_payment_confirmation(payment)
-        task_manager.internal_invoice_queue.put_nowait(payment)
+
+        # notify receivers asynchronously
+        from lnbits.tasks import internal_invoice_queue
+
+        await internal_invoice_queue.put(payment.checking_id)
 
     return fiat_status
 

lnbits/core/services/funding_source.py

@@ -66,8 +66,6 @@ async def check_server_balance_against_node():
 
 
 async def check_balance_delta_changed():
-    if settings.notification_balance_delta_threshold_sats <= 0:
-        return
     status = await get_balance_delta()
     if settings.latest_balance_delta_sats is None:
         settings.latest_balance_delta_sats = status.delta_sats

lnbits/core/services/notifications.py

@@ -237,15 +237,6 @@ async def send_email(
         return False
 
 
-async def dispatch_payment_notification(payment: Payment) -> None:
-    """
-    This worker dispatches the payment notifications.
-    """
-    wallet = await get_wallet(payment.wallet_id)
-    if wallet:
-        await send_payment_notification(wallet, payment)
-
-
 async def dispatch_webhook(payment: Payment):
     """
     Dispatches the webhook to the webhook url.

lnbits/core/services/payments.py

@@ -19,7 +19,6 @@ from lnbits.exceptions import InvoiceError, PaymentError, UnsupportedError
 from lnbits.fiat import get_fiat_provider
 from lnbits.helpers import check_callback_url
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager
 from lnbits.utils.crypto import fake_privkey, random_secret_and_hash, verify_preimage
 from lnbits.utils.exchange_rates import fiat_amount_as_satoshis, satoshis_amount_as_fiat
 from lnbits.wallets import fake_wallet, get_funding_source
@@ -517,7 +516,9 @@ async def update_wallet_balance(
         )
         payment.status = PaymentState.SUCCESS
         await update_payment(payment, conn=conn)
-        task_manager.internal_invoice_queue.put_nowait(payment)
+        from lnbits.tasks import internal_invoice_queue_put
+
+        await internal_invoice_queue_put(payment.checking_id)
 
 
 async def check_wallet_limits(
@@ -788,8 +789,10 @@ async def _pay_internal_invoice(
     )  # notify the receiver
 
     # notify receiver asynchronously (extension listeners)
+    from lnbits.tasks import internal_invoice_queue
+
     logger.debug(f"enqueuing internal invoice {internal_payment.checking_id}")
-    task_manager.internal_invoice_queue.put_nowait(internal_payment)
+    await internal_invoice_queue.put(internal_payment.checking_id)
 
     return payment
 
@@ -826,15 +829,16 @@ async def _pay_external_invoice(
 
     fee_reserve_msat = fee_reserve(amount_msat, internal=False)
 
-    task = task_manager.create_task(
-        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat),
-        f"fundingsource_pay_invoice_{checking_id}",
+    from lnbits.tasks import create_task
+
+    task = create_task(
+        _fundingsource_pay_invoice(checking_id, payment.bolt11, fee_reserve_msat)
     )
 
     # make sure a hold invoice or deferred payment is not blocking the server
     wait_time = max(1, settings.lnbits_funding_source_pay_invoice_wait_seconds)
     try:
-        payment_response = await asyncio.wait_for(task.task, timeout=wait_time)
+        payment_response = await asyncio.wait_for(task, timeout=wait_time)
     except asyncio.TimeoutError:
         # return pending payment on timeout
         logger.debug(
@@ -1104,18 +1108,3 @@ async def update_invoice_from_paid_invoices_stream(checking_id: str) -> Payment
     payment = await update_payment(payment)
 
     return payment
-
-
-async def fundingsource_invoice_producer() -> None:
-    """
-    will collect all invoices that come directly from the backend wallet.
-
-    Called registered in the app startup sequence and run by taskmanager.
-    """
-    funding_source = get_funding_source()
-    async for checking_id in funding_source.paid_invoices_stream():
-        logger.info(f"got a payment notification {checking_id}")
-        payment = await update_invoice_from_paid_invoices_stream(checking_id)
-        if payment:
-            logger.success(f"fundingsource invoice {checking_id} settled")
-            task_manager.invoice_queue.put_nowait(payment)

lnbits/core/tasks.py

@@ -2,7 +2,11 @@ import asyncio
 
 from loguru import logger
 
-from lnbits.core.crud import create_audit_entry
+from lnbits.core.crud import (
+    create_audit_entry,
+    get_wallet,
+)
+from lnbits.core.crud.audit import delete_expired_audit_entries
 from lnbits.core.crud.payments import get_payments_status_count
 from lnbits.core.crud.users import get_accounts
 from lnbits.core.crud.wallets import get_wallets_count
@@ -10,36 +14,66 @@ from lnbits.core.db import core_app_extra
 from lnbits.core.models.audit import AuditEntry
 from lnbits.core.models.extensions import InstallableExtension
 from lnbits.core.models.notifications import NotificationType
-from lnbits.core.services.funding_source import get_balance_delta
+from lnbits.core.services.funding_source import (
+    check_balance_delta_changed,
+    check_server_balance_against_node,
+    get_balance_delta,
+)
 from lnbits.core.services.notifications import (
     enqueue_admin_notification,
+    process_next_notification,
+    send_payment_notification,
 )
 from lnbits.db import Filters
 from lnbits.settings import settings
 from lnbits.utils.cache import cache
-from lnbits.utils.exchange_rates import btc_price_from_aggregator, btc_rates
+from lnbits.utils.exchange_rates import btc_rates
 
 audit_queue: asyncio.Queue[AuditEntry] = asyncio.Queue()
 
 
-async def process_next_audit_entry() -> None:
-    """
-    Waits for audit entries to be pushed to the queue.
-    Then it inserts the entries into the DB.
-    """
-    data = await audit_queue.get()
-    await create_audit_entry(data)
+async def run_by_the_minute_tasks() -> None:
+    minute_counter = 0
+    while settings.lnbits_running:
+        status_minutes = settings.lnbits_notification_server_status_hours * 60
+
+        if settings.notification_balance_delta_threshold_sats > 0:
+            try:
+                # runs by default every minute, the delta should not change that often
+                await check_balance_delta_changed()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % settings.lnbits_watchdog_interval_minutes == 0:
+            try:
+                await check_server_balance_against_node()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % status_minutes == 0:
+            try:
+                await _notify_server_status()
+            except Exception as ex:
+                logger.error(ex)
+
+        if minute_counter % 60 == 0:
+            try:
+                # initialize the list of all extensions
+                await InstallableExtension.get_installable_extensions(
+                    post_refresh_cache=True
+                )
+            except Exception as ex:
+                logger.error(ex)
+
+        minute_counter += 1
+        await asyncio.sleep(60)
 
 
-async def refresh_extension_cache() -> None:
-    # only refreshes every 10 minutes
-    await InstallableExtension.get_installable_extensions()
-
-
-async def notify_server_status() -> None:
+async def _notify_server_status() -> None:
     accounts = await get_accounts(filters=Filters(limit=0))
     wallets_count = await get_wallets_count()
     payments = await get_payments_status_count()
+
     status = await get_balance_delta()
     values = {
         "up_time": settings.lnbits_server_up_time,
@@ -56,38 +90,82 @@ async def notify_server_status() -> None:
     enqueue_admin_notification(NotificationType.server_status, values)
 
 
+async def wait_for_paid_invoices(invoice_paid_queue: asyncio.Queue) -> None:
+    """
+    This worker dispatches events to all extensions and dispatches webhooks.
+    """
+    while settings.lnbits_running:
+        payment = await invoice_paid_queue.get()
+        logger.trace("received invoice paid event")
+        # payment notification
+        wallet = await get_wallet(payment.wallet_id)
+        if wallet:
+            await send_payment_notification(wallet, payment)
+        await core_app_extra.dispatch_extension_invoice_paid(payment)
+
+
+async def wait_for_audit_data() -> None:
+    """
+    Waits for audit entries to be pushed to the queue.
+    Then it inserts the entries into the DB.
+    """
+    while settings.lnbits_running:
+        data = await audit_queue.get()
+        try:
+            await create_audit_entry(data)
+        except Exception as ex:
+            logger.warning(ex)
+            await asyncio.sleep(3)
+
+
+async def wait_notification_messages() -> None:
+
+    while settings.lnbits_running:
+        try:
+            await process_next_notification()
+        except Exception as ex:
+            logger.warning("Payment notification error", ex)
+            await asyncio.sleep(3)
+
+
+async def purge_audit_data() -> None:
+    """
+    Remove audit entries which have passed their retention period.
+    """
+    while settings.lnbits_running:
+        try:
+            await delete_expired_audit_entries()
+        except Exception as ex:
+            logger.warning(ex)
+
+        # clean every hour
+        await asyncio.sleep(60 * 60)
+
+
 async def collect_exchange_rates_data() -> None:
     """
     Collect exchange rates data. Used for monitoring only.
     """
-    currency = settings.lnbits_default_accounting_currency or "USD"
-    max_history_size = settings.lnbits_exchange_history_size
-    try:
-        if (
-            settings.lnbits_price_aggregator_enabled
-            and settings.lnbits_price_aggregator_url
-        ):
-            price = await btc_price_from_aggregator(currency)
-            if price:
-                cache.set(
-                    f"btc-price-{currency}",
-                    price,
-                    expiry=settings.lnbits_exchange_rate_cache_seconds,
-                )
-                settings.append_exchange_rate_datapoint(
-                    {"Aggregator": price}, max_history_size
-                )
+    while settings.lnbits_running:
+        currency = settings.lnbits_default_accounting_currency or "USD"
+        max_history_size = settings.lnbits_exchange_history_size
+        sleep_time = settings.lnbits_exchange_history_refresh_interval_seconds
+
+        if sleep_time > 0:
+            try:
+                rates = await btc_rates(currency)
+                if rates:
+                    rates_values = [r[1] for r in rates]
+                    lnbits_rate = sum(rates_values) / len(rates_values)
+                    rates.append(("LNbits", lnbits_rate))
+                    cache.set(
+                        f"btc-price-{currency}",
+                        lnbits_rate,
+                        expiry=settings.lnbits_exchange_rate_cache_seconds,
+                    )
+                settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
+            except Exception as ex:
+                logger.warning(ex)
         else:
-            rates = await btc_rates(currency)
-            if rates:
-                rates_values = [r[1] for r in rates]
-                lnbits_rate = sum(rates_values) / len(rates_values)
-                rates.append(("LNbits", lnbits_rate))
-                cache.set(
-                    f"btc-price-{currency}",
-                    lnbits_rate,
-                    expiry=settings.lnbits_exchange_rate_cache_seconds,
-                )
-            settings.append_exchange_rate_datapoint(dict(rates), max_history_size)
-    except Exception as ex:
-        logger.warning(ex)
+            sleep_time = 60
+        await asyncio.sleep(sleep_time)

lnbits/core/views/admin_api.py

@@ -20,7 +20,7 @@ from lnbits.core.services.settings import dict_to_settings
 from lnbits.decorators import check_admin, check_super_user
 from lnbits.server import server_restart
 from lnbits.settings import AdminSettings, Settings, UpdateSettings, settings
-from lnbits.task_manager import PublicTask, task_manager
+from lnbits.tasks import invoice_listeners
 
 from .. import core_app_extra
 from ..crud import get_admin_settings, reset_core_settings, update_admin_settings
@@ -44,10 +44,11 @@ async def api_auditor():
     name="Monitor",
     description="show the current listeners and other monitoring data",
     dependencies=[Depends(check_admin)],
-    response_model=list[PublicTask],
 )
-async def api_monitor() -> list[PublicTask]:
-    return task_manager.get_public_tasks()
+async def api_monitor():
+    return {
+        "invoice_listeners": list(invoice_listeners.keys()),
+    }
 
 
 @admin_router.get(

lnbits/core/views/extension_api.py

@@ -11,6 +11,7 @@ from loguru import logger
 from lnbits.core.crud.extensions import get_user_extensions
 from lnbits.core.crud.wallets import get_wallets_ids
 from lnbits.core.db import db
+from lnbits.core.extensions.permissions import validate_extension_permissions
 from lnbits.core.models import (
     SimpleStatus,
 )
@@ -41,7 +42,6 @@ from lnbits.core.services.extensions import (
     install_extension,
     uninstall_extension,
 )
-from lnbits.core.wasm_ext.api.permissions import validate_extension_permissions
 from lnbits.db import Page
 from lnbits.decorators import (
     check_account_exists,

lnbits/core/wasm_ext/__init__.py

@@ -1,24 +0,0 @@
-from .api.host import ExtensionHostAPI
-from .api.models import ExtensionAPIMethod, ExtensionAPIMethodExport
-from .api.registry import (
-    extension_api_contract,
-    extension_api_method,
-    extension_api_permission_ids,
-    get_extension_api_method,
-    list_extension_api_methods,
-)
-from .api.runtime import ExtensionAPIHost
-from .wasm.loader import WasmExtension
-
-__all__ = [
-    "ExtensionAPIHost",
-    "ExtensionAPIMethod",
-    "ExtensionAPIMethodExport",
-    "ExtensionHostAPI",
-    "WasmExtension",
-    "extension_api_contract",
-    "extension_api_method",
-    "extension_api_permission_ids",
-    "get_extension_api_method",
-    "list_extension_api_methods",
-]

lnbits/core/wasm_ext/api/__init__.py

@@ -1,22 +0,0 @@
-from .host import ExtensionHostAPI
-from .models import ExtensionAPIMethod, ExtensionAPIMethodExport
-from .registry import (
-    extension_api_contract,
-    extension_api_method,
-    extension_api_permission_ids,
-    get_extension_api_method,
-    list_extension_api_methods,
-)
-from .runtime import ExtensionAPIHost
-
-__all__ = [
-    "ExtensionAPIHost",
-    "ExtensionAPIMethod",
-    "ExtensionAPIMethodExport",
-    "ExtensionHostAPI",
-    "extension_api_contract",
-    "extension_api_method",
-    "extension_api_permission_ids",
-    "get_extension_api_method",
-    "list_extension_api_methods",
-]

lnbits/core/wasm_ext/api/registry.py

@@ -1,199 +0,0 @@
-from __future__ import annotations
-
-import inspect
-from collections.abc import Awaitable, Callable
-from functools import wraps
-from typing import Any, TypeVar, cast, get_type_hints
-
-from pydantic import BaseModel
-
-from .models import ExtensionAPIMethod, ExtensionAPIMethodExport
-
-_EXTENSION_API_METHOD_ATTR = "__lnbits_extension_api_method__"
-_EXTENSION_RUNTIME_PERMISSION_IDS = {"ui.camera.scan_qr"}
-_RequestModel = TypeVar("_RequestModel", bound=BaseModel)
-_ResponseModel = TypeVar("_ResponseModel", bound=BaseModel)
-
-
-def extension_api_method(
-    *,
-    method_id: str,
-    namespace: str,
-    name: str,
-    host_name: str,
-    sdk_name: str,
-    description: str,
-    host_interface: str = "host",
-    required_permission: str | None = None,
-    require_auth: bool = True,
-) -> Callable[
-    [Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]],
-    Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
-]:
-    export = ExtensionAPIMethodExport(
-        method_id=method_id,
-        namespace=namespace,
-        name=name,
-        host_interface=host_interface,
-        host_name=host_name,
-        sdk_name=sdk_name,
-        description=description,
-        required_permission=required_permission,
-        require_auth=require_auth,
-    )
-
-    def decorator(
-        function: Callable[[Any, _RequestModel], Awaitable[_ResponseModel]],
-    ) -> Callable[[Any, _RequestModel], Awaitable[_ResponseModel]]:
-        @wraps(function)
-        async def wrapper(self: Any, request: _RequestModel) -> _ResponseModel:
-            api = getattr(self, "api", self)
-            if require_auth and not api.has_authenticated_context():
-                raise PermissionError(
-                    f"Extension API method '{method_id}' requires authentication."
-                )
-            api.require_permission(required_permission)
-            return await function(self, request)
-
-        setattr(wrapper, _EXTENSION_API_METHOD_ATTR, export)
-        return wrapper
-
-    return decorator
-
-
-def list_extension_api_methods(
-    api_cls: type[Any] | None = None,
-) -> list[ExtensionAPIMethod]:
-    api_cls = _default_api_cls(api_cls)
-    methods: list[ExtensionAPIMethod] = []
-
-    for prefix, method_cls in _extension_api_method_sources(api_cls):
-        for python_name, function in inspect.getmembers(method_cls, inspect.isfunction):
-            export = getattr(function, _EXTENSION_API_METHOD_ATTR, None)
-            if not export:
-                continue
-
-            request_model, response_model = _get_method_models(function)
-            methods.append(
-                ExtensionAPIMethod(
-                    method_id=export.method_id,
-                    namespace=export.namespace,
-                    name=export.name,
-                    python_name=f"{prefix}.{python_name}" if prefix else python_name,
-                    host_interface=export.host_interface,
-                    host_name=export.host_name,
-                    sdk_name=export.sdk_name,
-                    description=export.description,
-                    request_model=request_model,
-                    response_model=response_model,
-                    required_permission=export.required_permission,
-                    require_auth=export.require_auth,
-                )
-            )
-
-    return sorted(methods, key=lambda method: method.method_id)
-
-
-def extension_api_permission_ids(api_cls: type[Any] | None = None) -> set[str]:
-    permissions = {
-        method.required_permission
-        for method in list_extension_api_methods(api_cls)
-        if method.required_permission
-    }
-    permissions.update(_EXTENSION_RUNTIME_PERMISSION_IDS)
-    return permissions
-
-
-def get_extension_api_method(
-    method_id: str,
-    api_cls: type[Any] | None = None,
-) -> ExtensionAPIMethod:
-    for method in list_extension_api_methods(api_cls):
-        if method.method_id == method_id:
-            return method
-    raise KeyError(f"Unknown extension API method '{method_id}'.")
-
-
-def extension_api_contract(api_cls: type[Any] | None = None) -> dict[str, object]:
-    return {
-        "version": 1,
-        "methods": [
-            {
-                "id": method.method_id,
-                "namespace": method.namespace,
-                "name": method.name,
-                "python_name": method.python_name,
-                "host_interface": method.host_interface,
-                "host_name": method.host_name,
-                "sdk_name": method.sdk_name,
-                "sdk_qualified_name": method.sdk_qualified_name,
-                "description": method.description,
-                "required_permission": method.required_permission,
-                "require_auth": method.require_auth,
-                "request_schema": method.request_model.schema(
-                    ref_template="#/definitions/{model}"
-                ),
-                "response_schema": method.response_model.schema(
-                    ref_template="#/definitions/{model}"
-                ),
-            }
-            for method in list_extension_api_methods(api_cls)
-        ],
-    }
-
-
-def _default_api_cls(api_cls: type[Any] | None) -> type[Any]:
-    if api_cls is not None:
-        return api_cls
-
-    from .host import ExtensionHostAPI
-
-    return ExtensionHostAPI
-
-
-def _extension_api_method_sources(
-    api_cls: type[Any],
-) -> list[tuple[str, type[Any]]]:
-    sources: list[tuple[str, type[Any]]] = [("", api_cls)]
-
-    from .host import ExtensionHostAPI
-
-    if issubclass(api_cls, ExtensionHostAPI):
-        from .utils import extension_api_utils_method_classes
-
-        sources.extend(extension_api_utils_method_classes().items())
-    return sources
-
-
-def _get_method_models(
-    function: Callable[..., object],
-) -> tuple[type[BaseModel], type[BaseModel]]:
-    signature = inspect.signature(function)
-    request_parameters = [
-        parameter
-        for parameter in signature.parameters.values()
-        if parameter.name != "self"
-    ]
-    if len(request_parameters) != 1:
-        raise TypeError(
-            f"Extension API method '{function.__name__}' must accept one request model."
-        )
-
-    hints = get_type_hints(function)
-    request_model = hints.get(request_parameters[0].name)
-    response_model = hints.get("return")
-
-    if not _is_pydantic_model(request_model):
-        raise TypeError(
-            f"Extension API method '{function.__name__}' request must be a BaseModel."
-        )
-    if not _is_pydantic_model(response_model):
-        raise TypeError(
-            f"Extension API method '{function.__name__}' response must be a BaseModel."
-        )
-
-    return cast(type[BaseModel], request_model), cast(type[BaseModel], response_model)
-
-
-def _is_pydantic_model(value: object) -> bool:
-    return isinstance(value, type) and issubclass(value, BaseModel)

lnbits/core/wasm_ext/client/__init__.py

@@ -1,4 +0,0 @@
-from .extensions import send_extension_api_request
-from .http import send_extension_http_request
-
-__all__ = ["send_extension_api_request", "send_extension_http_request"]

lnbits/core/wasm_ext/routes/__init__.py

@@ -1,3 +0,0 @@
-from .register import register_wasm_extension
-
-__all__ = ["register_wasm_extension"]

lnbits/core/wasm_ext/routes/api.py

@@ -1,168 +0,0 @@
-from __future__ import annotations
-
-import json
-import re
-from typing import Annotated, Any
-
-from fastapi import Depends, FastAPI, HTTPException, Request
-
-from lnbits.core.models import Account
-from lnbits.decorators import check_access_token, check_account_exists
-
-from ..wasm.invoke import invoke_wasm_extension_export
-from ..wasm.loader import WasmExtension
-
-
-def register_wasm_extension_api_routes(app: FastAPI, extension: WasmExtension) -> None:
-    for route_config in extension.config.get("api_routes") or []:
-        _add_wasm_extension_api_route(app, extension, route_config)
-
-
-def _add_wasm_extension_api_route(
-    app: FastAPI,
-    extension: WasmExtension,
-    route_config: dict[str, Any],
-) -> None:
-    method = _wasm_extension_api_method(extension, route_config.get("method"))
-    route_path = _wasm_extension_api_path(extension, route_config.get("path"))
-    export_name = _wasm_extension_api_export(extension, route_config.get("export"))
-    path_params = route_config.get("path_params") or {}
-    auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
-
-    if _has_route(app, route_path, method):
-        return
-
-    async def invoke_wasm_api_request(
-        request: Request,
-        account: Account | None = None,
-        access_token: str | None = None,
-    ) -> dict[str, Any]:
-        try:
-            payload = await _read_api_payload(request, path_params)
-            return await invoke_wasm_extension_export(
-                extension.id,
-                export_name,
-                payload,
-                user=account,
-                access_token=access_token,
-            )
-        except KeyError as exc:
-            raise HTTPException(status_code=404, detail=str(exc)) from exc
-        except PermissionError as exc:
-            raise HTTPException(status_code=403, detail=str(exc)) from exc
-        except (TypeError, ValueError) as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-
-    async def invoke_private_wasm_extension_export(
-        request: Request,
-        access_token: Annotated[str | None, Depends(check_access_token)],
-        account: Account = Depends(check_account_exists),
-    ) -> dict[str, Any]:
-        return await invoke_wasm_api_request(request, account, access_token)
-
-    async def invoke_public_wasm_extension_export(request: Request) -> dict[str, Any]:
-        return await invoke_wasm_api_request(request)
-
-    app.add_api_route(
-        route_path,
-        (
-            invoke_public_wasm_extension_export
-            if auth == "public"
-            else invoke_private_wasm_extension_export
-        ),
-        methods=[method],
-        name=f"{extension.id}:{method}:{route_path}",
-        include_in_schema=False,
-    )
-
-
-async def _read_api_payload(
-    request: Request,
-    path_params: dict[str, str],
-) -> dict[str, Any]:
-    payload = _read_api_path_params(request, path_params)
-    payload.update(_read_api_query_params(request))
-    if request.method in {"POST", "PUT", "PATCH"}:
-        payload.update(await _read_json_object(request))
-    return payload
-
-
-async def _read_json_object(request: Request) -> dict[str, Any]:
-    body = await request.body()
-    if not body:
-        return {}
-    value = json.loads(body)
-    if not isinstance(value, dict):
-        raise TypeError("WASM extension API payload must be a JSON object.")
-    return value
-
-
-def _read_api_path_params(
-    request: Request,
-    path_params: dict[str, str],
-) -> dict[str, Any]:
-    payload: dict[str, Any] = {}
-    for key, value in request.path_params.items():
-        target = path_params.get(key) or _snake_to_camel(key)
-        payload[target] = value
-    return payload
-
-
-def _read_api_query_params(request: Request) -> dict[str, Any]:
-    return {_snake_to_camel(key): value for key, value in request.query_params.items()}
-
-
-def _wasm_extension_api_export(extension: WasmExtension, export_name: Any) -> str:
-    if not isinstance(export_name, str) or not export_name:
-        raise ValueError(f"Invalid API export for WASM extension '{extension.id}'.")
-
-    for export in extension.exports:
-        if export.get("name") != export_name:
-            continue
-        if export.get("visibility") in {"public", "authenticated"}:
-            return export_name
-        raise PermissionError(f"WASM export '{export_name}' is not callable over HTTP.")
-    raise KeyError(f"WASM extension '{extension.id}' has no export '{export_name}'.")
-
-
-def _wasm_extension_api_method(extension: WasmExtension, method: Any) -> str:
-    if not isinstance(method, str):
-        raise ValueError(f"Invalid API method for WASM extension '{extension.id}'.")
-    method = method.upper()
-    if method not in {"GET", "POST", "PUT", "PATCH", "DELETE"}:
-        raise ValueError(f"Unsupported API method for WASM extension '{extension.id}'.")
-    return method
-
-
-def _wasm_extension_api_path(extension: WasmExtension, path: Any) -> str:
-    if not isinstance(path, str) or not path.startswith("/"):
-        raise ValueError(f"Invalid API path for WASM extension '{extension.id}'.")
-    if path == "/":
-        return f"/api/v1/ext/{extension.id}"
-    return f"/api/v1/ext/{extension.id}{path}"
-
-
-def _wasm_extension_route_auth(extension: WasmExtension, auth: Any) -> str:
-    if auth in {"public", "user"}:
-        return auth
-    raise ValueError(f"Invalid route auth for WASM extension '{extension.id}'.")
-
-
-def _has_route(app: FastAPI, route_path: str, method: str) -> bool:
-    for route in app.routes:
-        if getattr(route, "path", None) != route_path:
-            continue
-        methods = getattr(route, "methods", set()) or set()
-        if method in methods:
-            return True
-    return False
-
-
-def _snake_to_camel(value: str) -> str:
-    head, *tail = value.split("_")
-    return head + "".join(part.capitalize() for part in tail)
-
-
-def _path_template_pattern(path: str) -> str:
-    pattern = re.sub(r"\\{[^/{}]+\\}", r"[^/]+", re.escape(path))
-    return f"^{pattern}$"

lnbits/core/wasm_ext/routes/assets.py

@@ -1,139 +0,0 @@
-from __future__ import annotations
-
-import os
-from pathlib import Path
-
-from fastapi import FastAPI, HTTPException
-from fastapi.responses import FileResponse, Response
-from fastapi.staticfiles import StaticFiles
-from starlette.staticfiles import PathLike as StaticFilesPathLike
-from starlette.types import Scope
-
-from lnbits.settings import settings
-
-from ..wasm.loader import WasmExtension
-
-WASM_EXTENSION_CORE_ASSET_PREFIX = "_lnbits"
-WASM_EXTENSION_CORE_STATIC_ASSETS = {
-    "bundle.min.css": ("static/bundle.min.css", "text/css; charset=utf-8"),
-    "material-icons-v50.woff2": (
-        "static/fonts/material-icons-v50.woff2",
-        "font/woff2",
-    ),
-    "quasar.css": ("static/vendor/quasar.css", "text/css; charset=utf-8"),
-    "quasar.umd.prod.js": (
-        "static/vendor/quasar.umd.prod.js",
-        "text/javascript; charset=utf-8",
-    ),
-    "qrcode.vue.browser.js": (
-        "static/vendor/qrcode.vue.browser.js",
-        "text/javascript; charset=utf-8",
-    ),
-    "vue.global.prod.js": (
-        "static/vendor/vue.global.prod.js",
-        "text/javascript; charset=utf-8",
-    ),
-}
-WASM_EXTENSION_GENERATED_CORE_ASSETS = {
-    "material-icons.css": (
-        """
-        @font-face {
-          font-family: 'Material Icons';
-          font-style: normal;
-          font-weight: 400;
-          src: url('./material-icons-v50.woff2') format('woff2');
-        }
-        """,
-        "text/css; charset=utf-8",
-    )
-}
-WASM_EXTENSION_STATIC_MIME_TYPES = {
-    ".css": "text/css; charset=utf-8",
-    ".gif": "image/gif",
-    ".ico": "image/x-icon",
-    ".jpeg": "image/jpeg",
-    ".jpg": "image/jpeg",
-    ".js": "text/javascript; charset=utf-8",
-    ".png": "image/png",
-    ".webp": "image/webp",
-    ".woff": "font/woff",
-    ".woff2": "font/woff2",
-}
-WASM_EXTENSION_TEXT_STATIC_EXTENSIONS = {".css", ".js"}
-WASM_EXTENSION_HTML_PREFIXES = (b"<!doctype", b"<html", b"<script")
-
-
-class GuardedWasmExtensionStaticFiles(StaticFiles):
-    async def get_response(self, path: str, scope: Scope) -> Response:
-        if path.startswith(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/"):
-            return _wasm_extension_core_asset_response(path)
-        if Path(path).suffix.lower() not in WASM_EXTENSION_STATIC_MIME_TYPES:
-            raise HTTPException(status_code=404)
-        return await super().get_response(path, scope)
-
-    def file_response(
-        self,
-        full_path: StaticFilesPathLike,
-        stat_result: os.stat_result,
-        scope: Scope,
-        status_code: int = 200,
-    ) -> Response:
-        suffix = Path(full_path).suffix.lower()
-        if suffix in WASM_EXTENSION_TEXT_STATIC_EXTENSIONS:
-            _reject_html_like_wasm_static_asset(Path(full_path))
-
-        response = super().file_response(full_path, stat_result, scope, status_code)
-        response.headers["Content-Type"] = WASM_EXTENSION_STATIC_MIME_TYPES[suffix]
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Cache-Control"] = "no-store"
-        return response
-
-
-def mount_wasm_extension_static(app: FastAPI, extension: WasmExtension) -> None:
-    static_path = extension.root_path / "static"
-
-    mount_path = f"/ext-assets/{extension.id}"
-    if any(getattr(route, "path", None) == mount_path for route in app.routes):
-        return
-
-    app.mount(
-        mount_path,
-        GuardedWasmExtensionStaticFiles(directory=static_path, check_dir=False),
-        name=f"{extension.id}-static",
-    )
-
-
-def _reject_html_like_wasm_static_asset(path: Path) -> None:
-    with path.open("rb") as asset_file:
-        prefix = asset_file.read(512).lstrip().lower()
-    if prefix.startswith(WASM_EXTENSION_HTML_PREFIXES):
-        raise HTTPException(status_code=404)
-
-
-def _wasm_extension_core_asset_response(path: str) -> Response:
-    asset_name = path.removeprefix(f"{WASM_EXTENSION_CORE_ASSET_PREFIX}/")
-    if not asset_name or "/" in asset_name or "\\" in asset_name:
-        raise HTTPException(status_code=404)
-
-    generated_asset = WASM_EXTENSION_GENERATED_CORE_ASSETS.get(asset_name)
-    if generated_asset:
-        content, content_type = generated_asset
-        response = Response(content=content, media_type=content_type)
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        response.headers["Cache-Control"] = "no-store"
-        return response
-
-    asset_config = WASM_EXTENSION_CORE_STATIC_ASSETS.get(asset_name)
-    if not asset_config:
-        raise HTTPException(status_code=404)
-
-    relative_path, content_type = asset_config
-    asset_path = Path(settings.lnbits_path, relative_path)
-    if not asset_path.is_file():
-        raise HTTPException(status_code=404)
-
-    response = FileResponse(asset_path)
-    response.headers["Content-Type"] = content_type
-    response.headers["X-Content-Type-Options"] = "nosniff"
-    response.headers["Cache-Control"] = "no-store"
-    return response

lnbits/core/wasm_ext/routes/register.py

@@ -1,31 +0,0 @@
-from __future__ import annotations
-
-from fastapi import FastAPI
-from loguru import logger
-
-from lnbits.core.db import core_app_extra
-from lnbits.settings import settings
-
-from ..wasm.component import warm_wasm_extension
-from ..wasm.loader import WasmExtension, load_wasm_extension
-from .api import register_wasm_extension_api_routes
-from .assets import mount_wasm_extension_static
-from .ui import register_wasm_extension_ui_routes
-
-
-def register_wasm_extension(app: FastAPI, ext_id: str) -> WasmExtension:
-    loaded = load_wasm_extension(ext_id)
-
-    warm_wasm_extension(loaded)
-    mount_wasm_extension_static(app, loaded)
-    register_wasm_extension_ui_routes(app, loaded)
-    register_wasm_extension_api_routes(app, loaded)
-
-    core_app_extra.wasm_extension_registry.register(loaded)
-
-    settings.activate_extension_paths(ext_id, "", [])
-    logger.info(
-        f"Loaded WASM extension '{loaded.id}' "
-        f"({loaded.module_path.stat().st_size} bytes)."
-    )
-    return loaded

lnbits/core/wasm_ext/routes/security.py

@@ -1,127 +0,0 @@
-from __future__ import annotations
-
-from typing import Any, NoReturn
-from uuid import uuid4
-
-from fastapi import HTTPException, Request
-from loguru import logger
-
-from lnbits.helpers import template_renderer
-from lnbits.utils.cache import cache
-
-from ..wasm.loader import WasmExtension
-
-WASM_FRAME_TOKEN_EXPIRY_SECONDS = 60
-
-
-def wasm_extension_wrapper_response(
-    request: Request,
-    extension: WasmExtension,
-    auth: str,
-    user_json: str | None,
-) -> Any:
-    public = auth == "public"
-    response = template_renderer().TemplateResponse(
-        request,
-        "wasm_extension.html",
-        {
-            "extension": extension,
-            "public": public,
-            "user": user_json,
-        },
-    )
-    response.headers["Content-Security-Policy"] = "frame-ancestors 'self'"
-    response.headers["X-Frame-Options"] = "SAMEORIGIN"
-    return response
-
-
-def wasm_extension_frame_csp(request: Request, extension: WasmExtension) -> str:
-    origin = str(request.base_url).rstrip("/")
-    extension_assets = f"{origin}/ext-assets/{extension.id}/"
-    return (
-        "sandbox allow-scripts; "
-        "default-src 'none'; "
-        f"script-src {extension_assets}; "
-        "script-src-attr 'none'; "
-        f"style-src {extension_assets}; "
-        "style-src-attr 'none'; "
-        f"img-src {extension_assets} data:; "
-        f"font-src {extension_assets}; "
-        "connect-src 'none'; "
-        "form-action 'none'; "
-        "object-src 'none'; "
-        "base-uri 'none'; "
-        "frame-src 'none'; "
-        "worker-src 'none'; "
-        "media-src 'none'; "
-        "manifest-src 'none'; "
-        "frame-ancestors 'self'"
-    )
-
-
-def wasm_extension_frame_url(
-    extension: WasmExtension, frame_path: str, user_id: str | None
-) -> str:
-    token = _create_wasm_extension_frame_token(extension, frame_path, user_id)
-    return f"{frame_path}?frame_token={token}"
-
-
-def consume_wasm_extension_frame_token(
-    request: Request,
-    extension: WasmExtension,
-    frame_path: str,
-    user_id: str | None,
-) -> None:
-    token = request.query_params.get("frame_token")
-    if not token:
-        _raise_wasm_extension_frame_not_found(extension, frame_path, "missing")
-
-    cache_key = _wasm_extension_frame_token_cache_key(token)
-    token_data = cache.get(cache_key)
-    if (
-        not isinstance(token_data, dict)
-        or token_data.get("extension_id") != extension.id
-        or token_data.get("frame_path") != frame_path
-    ):
-        _raise_wasm_extension_frame_not_found(
-            extension, frame_path, "unknown or expired"
-        )
-
-    token_user_id = token_data.get("user_id")
-    if token_user_id and token_user_id != user_id:
-        _raise_wasm_extension_frame_not_found(extension, frame_path, "wrong user")
-
-    cache.pop(cache_key)
-
-
-def _create_wasm_extension_frame_token(
-    extension: WasmExtension,
-    frame_path: str,
-    user_id: str | None,
-) -> str:
-    token = uuid4().hex
-    cache.set(
-        _wasm_extension_frame_token_cache_key(token),
-        {
-            "extension_id": extension.id,
-            "frame_path": frame_path,
-            "user_id": user_id,
-        },
-        expiry=WASM_FRAME_TOKEN_EXPIRY_SECONDS,
-    )
-    return token
-
-
-def _wasm_extension_frame_token_cache_key(token: str) -> str:
-    return f"wasm-frame-token:{token}"
-
-
-def _raise_wasm_extension_frame_not_found(
-    extension: WasmExtension,
-    frame_path: str,
-    reason: str,
-) -> NoReturn:
-    logger.warning(
-        f"WASM frame token {reason} for extension '{extension.id}' at '{frame_path}'."
-    )
-    raise HTTPException(status_code=404, detail="Not found")

lnbits/core/wasm_ext/routes/ui.py

@@ -1,368 +0,0 @@
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Annotated, Any
-
-from fastapi import Depends, FastAPI, HTTPException, Request
-from fastapi.responses import FileResponse
-from pydantic import UUID4
-
-from lnbits.core.crud import get_installed_extension, get_user_from_account
-from lnbits.core.models import Account
-from lnbits.decorators import (
-    check_access_token,
-    check_account_exists,
-    optional_user_id,
-)
-
-from ..wasm.loader import WasmExtension
-from .api import (
-    _has_route,
-    _path_template_pattern,
-    _read_json_object,
-    _snake_to_camel,
-    _wasm_extension_api_export,
-    _wasm_extension_api_method,
-    _wasm_extension_api_path,
-    _wasm_extension_route_auth,
-)
-from .security import (
-    consume_wasm_extension_frame_token,
-    wasm_extension_frame_csp,
-    wasm_extension_frame_url,
-    wasm_extension_wrapper_response,
-)
-
-
-def register_wasm_extension_ui_routes(app: FastAPI, extension: WasmExtension) -> None:
-    _add_wasm_extension_frame_config_route(app, extension)
-
-    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
-        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
-        entrypoint = _wasm_extension_entrypoint(
-            extension, route_config.get("entrypoint")
-        )
-        frame_path = f"/ext-frame/{extension.id}/{route_index}"
-        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
-        _add_wasm_extension_frame_route(app, extension, frame_path, entrypoint)
-        _add_wasm_extension_wrapper_route(
-            app,
-            extension,
-            route_path,
-            auth,
-        )
-
-
-def _add_wasm_extension_frame_config_route(
-    app: FastAPI,
-    extension: WasmExtension,
-) -> None:
-    route_path = _wasm_extension_frame_config_path(extension)
-    if _has_route(app, route_path, "POST"):
-        return
-
-    async def create_wasm_extension_frame_config(
-        request: Request,
-        access_token: Annotated[str | None, Depends(check_access_token)],
-        usr: UUID4 | None = None,
-    ) -> dict[str, Any]:
-        try:
-            body = await _read_json_object(request)
-        except (TypeError, ValueError) as exc:
-            raise HTTPException(status_code=400, detail=str(exc)) from exc
-
-        ui_route = _match_wasm_extension_ui_route(extension, body.get("path"))
-        auth = ui_route["auth"]
-
-        if auth == "user":
-            account = await check_account_exists(request, access_token, usr)
-            user_id: str | None = account.id
-        else:
-            user_id = await _optional_wasm_user_id(request, access_token, usr)
-
-        granted_permission_ids = await _wasm_extension_granted_permission_ids(extension)
-
-        return _wasm_extension_frame_config(
-            extension,
-            ui_route["frame_path"],
-            auth,
-            ui_route["path_params"],
-            ui_route["route_params"],
-            _read_wasm_extension_route_query(body.get("query")),
-            user_id,
-            granted_permission_ids,
-        )
-
-    app.add_api_route(
-        route_path,
-        create_wasm_extension_frame_config,
-        methods=["POST"],
-        name=f"{extension.id}:frame-config",
-        include_in_schema=False,
-    )
-
-
-def _add_wasm_extension_wrapper_route(
-    app: FastAPI,
-    extension: WasmExtension,
-    route_path: str,
-    auth: str,
-) -> None:
-    if _has_route(app, route_path, "GET"):
-        return
-
-    async def serve_private_wasm_extension_page(
-        request: Request,
-        account: Account = Depends(check_account_exists),
-    ) -> Any:
-        user = await get_user_from_account(account)
-        return wasm_extension_wrapper_response(
-            request,
-            extension,
-            auth,
-            user.json() if user else None,
-        )
-
-    async def serve_public_wasm_extension_page(request: Request) -> Any:
-        return wasm_extension_wrapper_response(
-            request,
-            extension,
-            auth,
-            None,
-        )
-
-    app.add_api_route(
-        route_path,
-        (
-            serve_public_wasm_extension_page
-            if auth == "public"
-            else serve_private_wasm_extension_page
-        ),
-        methods=["GET"],
-        name=f"{extension.id}:{route_path}",
-        include_in_schema=False,
-    )
-
-
-def _add_wasm_extension_frame_route(
-    app: FastAPI,
-    extension: WasmExtension,
-    frame_path: str,
-    entrypoint: Path,
-) -> None:
-    if _has_route(app, frame_path, "GET"):
-        return
-
-    async def serve_wasm_extension_frame(
-        request: Request,
-        user_id: str | None = Depends(_optional_wasm_user_id),
-    ) -> FileResponse:
-        consume_wasm_extension_frame_token(request, extension, frame_path, user_id)
-        response = FileResponse(entrypoint)
-        response.headers["Content-Security-Policy"] = wasm_extension_frame_csp(
-            request, extension
-        )
-        response.headers["Cache-Control"] = "no-store"
-        response.headers["Cross-Origin-Opener-Policy"] = "same-origin"
-        response.headers["Cross-Origin-Resource-Policy"] = "same-origin"
-        # Extension access goes through the parent bridge.
-        response.headers["Permissions-Policy"] = (
-            "camera=(), microphone=(), geolocation=(), payment=(), "
-            "clipboard-read=(), usb=()"
-        )
-        response.headers["Referrer-Policy"] = "no-referrer"
-        response.headers["X-Content-Type-Options"] = "nosniff"
-        return response
-
-    app.add_api_route(
-        frame_path,
-        serve_wasm_extension_frame,
-        methods=["GET"],
-        name=f"{extension.id}:frame:{frame_path}",
-        include_in_schema=False,
-    )
-
-
-def _wasm_extension_bridge_api_routes(
-    extension: WasmExtension,
-    public: bool,
-) -> list[dict[str, str]]:
-    routes: list[dict[str, str]] = []
-    for route_config in extension.config.get("api_routes") or []:
-        auth = _wasm_extension_route_auth(extension, route_config.get("auth"))
-        if public and auth != "public":
-            continue
-        method = _wasm_extension_api_method(extension, route_config.get("method"))
-        path = _wasm_extension_api_path(extension, route_config.get("path"))
-        _wasm_extension_api_export(extension, route_config.get("export"))
-        routes.append(
-            {
-                "method": method,
-                "path": path,
-                "pattern": _path_template_pattern(path),
-            }
-        )
-    return routes
-
-
-def _wasm_extension_frame_config_path(extension: WasmExtension) -> str:
-    return f"/api/v1/ext/{extension.id}/_ui/frame"
-
-
-def _match_wasm_extension_ui_route(
-    extension: WasmExtension,
-    path: Any,
-) -> dict[str, Any]:
-    if not isinstance(path, str) or not path.startswith("/"):
-        raise HTTPException(status_code=404, detail="Not found")
-
-    for route_index, route_config in enumerate(extension.config.get("ui_routes") or []):
-        route_path = _wasm_extension_ui_route_path(extension, route_config.get("path"))
-        route_params = _path_template_params(route_path, path)
-        if route_params is None:
-            continue
-
-        return {
-            "frame_path": f"/ext-frame/{extension.id}/{route_index}",
-            "auth": _wasm_extension_route_auth(extension, route_config.get("auth")),
-            "path_params": route_config.get("path_params") or {},
-            "route_params": route_params,
-        }
-
-    raise HTTPException(status_code=404, detail="Not found")
-
-
-def _path_template_params(template: str, path: str) -> dict[str, str] | None:
-    template_parts = _path_parts(template)
-    path_parts = _path_parts(path)
-    if len(template_parts) != len(path_parts):
-        return None
-
-    params: dict[str, str] = {}
-    for template_part, path_part in zip(template_parts, path_parts, strict=False):
-        if template_part.startswith("{") and template_part.endswith("}"):
-            param_name = template_part[1:-1]
-            if not param_name:
-                return None
-            params[param_name] = path_part
-            continue
-
-        if template_part != path_part:
-            return None
-
-    return params
-
-
-def _path_parts(path: str) -> list[str]:
-    return [part for part in path.strip("/").split("/") if part]
-
-
-def _wasm_extension_frame_config(
-    extension: WasmExtension,
-    frame_path: str,
-    auth: str,
-    path_params: dict[str, str],
-    route_params: dict[str, str],
-    query: dict[str, Any],
-    user_id: str | None,
-    permissions: set[str],
-) -> dict[str, Any]:
-    public = auth == "public"
-    return {
-        "extension": {
-            "id": extension.id,
-            "name": extension.name,
-        },
-        "frameUrl": wasm_extension_frame_url(extension, frame_path, user_id),
-        "bridge": {
-            "extensionId": extension.id,
-            "public": public,
-            "routeParams": _map_wasm_extension_route_params(route_params, path_params),
-            "query": query,
-            "permissions": sorted(permissions),
-            "apiRoutes": _wasm_extension_bridge_api_routes(extension, public),
-        },
-    }
-
-
-async def _wasm_extension_granted_permission_ids(
-    extension: WasmExtension,
-) -> set[str]:
-    installed_extension = await get_installed_extension(extension.id)
-    if not installed_extension:
-        return set()
-    return {permission.id for permission in installed_extension.permissions}
-
-
-def _map_wasm_extension_route_params(
-    route_params: dict[str, str],
-    path_params: dict[str, str],
-) -> dict[str, str]:
-    payload: dict[str, str] = {}
-    for key, value in route_params.items():
-        target = path_params.get(key) or _snake_to_camel(key)
-        payload[target] = value
-    return payload
-
-
-def _read_wasm_extension_route_query(query: Any) -> dict[str, Any]:
-    if not isinstance(query, dict):
-        return {}
-
-    payload: dict[str, Any] = {}
-    for key, value in query.items():
-        if value is None:
-            continue
-        payload[_snake_to_camel(str(key))] = value
-    return payload
-
-
-async def _optional_wasm_user_id(
-    request: Request,
-    access_token: Annotated[str | None, Depends(check_access_token)],
-    usr: UUID4 | None = None,
-) -> str | None:
-    try:
-        return await optional_user_id(request, access_token, usr)
-    except HTTPException:
-        return None
-
-
-def _wasm_extension_ui_route_path(extension: WasmExtension, path: Any) -> str:
-    if not isinstance(path, str) or not path.startswith("/"):
-        raise ValueError(f"Invalid route path for WASM extension '{extension.id}'.")
-    if path == "/":
-        return "/ext"
-    return f"/ext{path}"
-
-
-def _wasm_extension_entrypoint(extension: WasmExtension, entrypoint: Any) -> Path:
-    if not isinstance(entrypoint, str) or not entrypoint:
-        raise ValueError(
-            f"Invalid route entrypoint for WASM extension '{extension.id}'."
-        )
-    if entrypoint.startswith("/"):
-        raise ValueError(
-            f"Route entrypoint for WASM extension '{extension.id}' must be a "
-            "relative extension path."
-        )
-
-    path = (extension.root_path / entrypoint).resolve()
-    root_path = extension.root_path.resolve()
-    if path != root_path and root_path not in path.parents:
-        raise ValueError(f"Route entrypoint escapes extension root: {entrypoint}")
-
-    static_path = (extension.root_path / "static").resolve()
-    if path == static_path or static_path in path.parents:
-        raise ValueError(
-            f"Route entrypoint for WASM extension '{extension.id}' must not be "
-            "inside the static asset directory."
-        )
-    if path.suffix.lower() != ".html":
-        raise ValueError(
-            f"Route entrypoint for WASM extension '{extension.id}' must be "
-            "an HTML file."
-        )
-    if not path.is_file():
-        raise FileNotFoundError(f"Route entrypoint not found: {path}")
-    return path

lnbits/core/wasm_ext/storage/__init__.py

@@ -1,19 +0,0 @@
-from .crud import (
-    migrate_wasm_extension_database,
-    storage_delete_row,
-    storage_get_paginated_rows,
-    storage_get_public_row,
-    storage_get_row,
-    storage_get_row_owner_id,
-    storage_set_row,
-)
-
-__all__ = [
-    "migrate_wasm_extension_database",
-    "storage_delete_row",
-    "storage_get_paginated_rows",
-    "storage_get_public_row",
-    "storage_get_row",
-    "storage_get_row_owner_id",
-    "storage_set_row",
-]

lnbits/core/wasm_ext/wasm/__init__.py

@@ -1,13 +0,0 @@
-from .component import warm_wasm_extension
-from .events import dispatch_wasm_invoice_paid
-from .invoke import invoke_wasm_extension_export
-from .loader import WasmExtension, is_wasm_extension_dir, is_wasm_extension_id
-
-__all__ = [
-    "WasmExtension",
-    "dispatch_wasm_invoice_paid",
-    "invoke_wasm_extension_export",
-    "is_wasm_extension_dir",
-    "is_wasm_extension_id",
-    "warm_wasm_extension",
-]

lnbits/core/wasm_ext/wasm/component.py

@@ -1,39 +0,0 @@
-from __future__ import annotations
-
-from functools import lru_cache
-from typing import Any
-
-from wasmtime import Config, Engine
-
-from .loader import WasmExtension
-
-
-def warm_wasm_extension(extension: WasmExtension) -> None:
-    _wasm_component(extension)
-
-
-@lru_cache(maxsize=1)
-def _wasm_engine() -> Any:
-    config = Config()
-    config.wasm_component_model = True
-    return Engine(config)
-
-
-def _wasm_component(extension: WasmExtension) -> Any:
-    stat = extension.module_path.stat()
-    return _cached_wasm_component(
-        str(extension.module_path),
-        stat.st_mtime_ns,
-        stat.st_size,
-    )
-
-
-@lru_cache(maxsize=32)
-def _cached_wasm_component(
-    module_path: str,
-    mtime_ns: int,
-    size: int,
-) -> Any:
-    from wasmtime import component
-
-    return component.Component.from_file(_wasm_engine(), module_path)

lnbits/core/wasm_ext/wasm/host.py

@@ -1,94 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-import re
-from collections.abc import Mapping
-from typing import Any
-
-from wasmtime import component
-
-from ..api.models import EmptyRequest
-from ..api.registry import list_extension_api_methods
-from ..api.runtime import ExtensionAPIHost
-
-
-def add_extension_host_imports(
-    linker: Any,
-    api_host: ExtensionAPIHost,
-    event_loop: asyncio.AbstractEventLoop,
-) -> None:
-    with linker.root() as root:
-        methods_by_interface: dict[str, list[Any]] = {}
-        for method in list_extension_api_methods():
-            methods_by_interface.setdefault(method.host_interface, []).append(method)
-
-        for host_interface, methods in methods_by_interface.items():
-            with root.add_instance(f"lnbits:extension/{host_interface}") as host:
-                for method in methods:
-                    host.add_func(
-                        method.host_name.replace("_", "-"),
-                        _make_host_import(
-                            api_host,
-                            method.method_id,
-                            method.request_model is EmptyRequest,
-                            event_loop,
-                        ),
-                    )
-
-
-def _make_host_import(
-    api_host: ExtensionAPIHost,
-    host_name: str,
-    empty_request: bool,
-    event_loop: asyncio.AbstractEventLoop,
-) -> Any:
-    if empty_request:
-
-        def empty_host_import(_store: Any) -> Any:
-            future = asyncio.run_coroutine_threadsafe(
-                api_host.invoke(host_name), event_loop
-            )
-            response = future.result()
-            return _dict_to_component_record(response)
-
-        return empty_host_import
-
-    def host_import(_store: Any, request: Any = None) -> Any:
-        payload = _component_payload_to_dict(request)
-        future = asyncio.run_coroutine_threadsafe(
-            api_host.invoke(host_name, payload), event_loop
-        )
-        response = future.result()
-        return _dict_to_component_record(response)
-
-    return host_import
-
-
-def _component_payload_to_dict(value: Any) -> dict[str, Any]:
-    if value is None:
-        return {}
-    if hasattr(value, "__dict__"):
-        return dict(value.__dict__)
-    if isinstance(value, Mapping):
-        return dict(value)
-    raise TypeError("WASM host function payload must be a record.")
-
-
-def _dict_to_component_record(value: Mapping[str, Any]) -> Any:
-
-    record = component.Record()
-    for key, item in value.items():
-        setattr(record, _camel_to_kebab(key), _to_component_value(item))
-    return record
-
-
-def _to_component_value(value: Any) -> Any:
-    if isinstance(value, Mapping):
-        return _dict_to_component_record(value)
-    if isinstance(value, list):
-        return [_to_component_value(item) for item in value]
-    return value
-
-
-def _camel_to_kebab(value: str) -> str:
-    return re.sub(r"([a-z0-9])([A-Z])", r"\1-\2", value).replace("_", "-").lower()

lnbits/core/wasm_ext/wasm/invoke.py

@@ -1,120 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-import json
-from collections.abc import Mapping
-from typing import Any
-
-from wasmtime import Store, WasiConfig, component
-
-from lnbits.core.crud.extensions import get_installed_extension
-from lnbits.core.db import core_app_extra
-
-from ..api.host import ExtensionHostAPI
-from ..api.runtime import ExtensionAPIHost
-from .component import _wasm_component, _wasm_engine
-from .host import add_extension_host_imports
-from .loader import WasmExtension
-
-
-async def invoke_wasm_extension_export(
-    ext_id: str,
-    export_name: str,
-    payload: Mapping[str, Any] | None = None,
-    *,
-    user: Any | None = None,
-    access_token: str | None = None,
-    context: str = "user",
-    owner_id: str | None = None,
-) -> dict[str, Any]:
-    extension = _get_registered_extension(ext_id)
-    permissions = await _extension_permissions(extension)
-    api = ExtensionHostAPI(
-        extension.id,
-        permissions,
-        user_id=_user_id(user),
-        access_token=access_token,
-        context=context,
-        owner_id=owner_id,
-    )
-    event_loop = asyncio.get_running_loop()
-
-    return await asyncio.to_thread(
-        _invoke_wasm_extension_export_sync,
-        extension,
-        export_name,
-        payload or {},
-        api,
-        event_loop,
-    )
-
-
-def _invoke_wasm_extension_export_sync(
-    extension: WasmExtension,
-    export_name: str,
-    payload: Mapping[str, Any],
-    api: ExtensionHostAPI,
-    event_loop: asyncio.AbstractEventLoop,
-) -> dict[str, Any]:
-
-    engine = _wasm_engine()
-    store = Store(engine)
-    store.set_wasi(WasiConfig())
-
-    linker = component.Linker(engine)
-    linker.add_wasip2()
-    add_extension_host_imports(linker, ExtensionAPIHost(api), event_loop)
-
-    wasm_component = _wasm_component(extension)
-    instance = linker.instantiate(store, wasm_component)
-    function = instance.get_func(store, export_name)
-    if not function:
-        raise KeyError(
-            f"WASM extension '{extension.id}' has no export '{export_name}'."
-        )
-
-    result = function(store, json.dumps(payload))
-    function.post_return(store)
-    return _parse_wasm_export_result(extension, result)
-
-
-def _parse_wasm_export_result(extension: WasmExtension, value: Any) -> dict[str, Any]:
-    if isinstance(value, bytes):
-        value = value.decode()
-    if not isinstance(value, str):
-        return {"ok": True, "data": value}
-
-    max_response_bytes = (
-        (extension.config.get("wasm") or {})
-        .get("resource_limits", {})
-        .get("max_response_bytes")
-    )
-    if isinstance(max_response_bytes, int):
-        response_size = len(value.encode())
-        if response_size > max_response_bytes:
-            raise ValueError(
-                f"WASM extension response is too large: {response_size} bytes."
-            )
-
-    parsed = json.loads(value)
-    if isinstance(parsed, dict):
-        return parsed
-    return {"ok": True, "data": parsed}
-
-
-def _get_registered_extension(ext_id: str) -> WasmExtension:
-    extension = core_app_extra.wasm_extension_registry.get(ext_id)
-    if extension:
-        return extension
-    raise RuntimeError(f"WASM extension '{ext_id}' is not registered.")
-
-
-async def _extension_permissions(extension: WasmExtension) -> list[Any]:
-    installed_extension = await get_installed_extension(extension.id)
-    if not installed_extension:
-        return []
-    return installed_extension.permissions
-
-
-def _user_id(user: Any | None) -> str | None:
-    return getattr(user, "id", None) if user else None

lnbits/settings.py

@@ -362,8 +362,6 @@ class ExchangeProvidersSettings(LNbitsSettings):
     lnbits_exchange_rate_cache_seconds: int = Field(default=60, ge=0)
     lnbits_exchange_history_size: int = Field(default=60, ge=0)
     lnbits_exchange_history_refresh_interval_seconds: int = Field(default=300, ge=0)
-    lnbits_price_aggregator_enabled: bool = Field(default=True)
-    lnbits_price_aggregator_url: str = Field(default="https://price.lnbits.com")
 
     lnbits_exchange_rate_providers: list[ExchangeRateProvider] = Field(
         default=[
@@ -589,7 +587,6 @@ class PhoenixdFundingSource(LNbitsSettings):
     phoenixd_api_password: str | None = Field(default=None)
     phoenixd_data_dir: str | None = Field(default=None)
     phoenixd_mnemonic: str | None = Field(default=None)
-    phoenixd_mnemonic_backup_confirmed: bool = Field(default=False)
 
 
 class AlbyFundingSource(LNbitsSettings):
@@ -614,7 +611,6 @@ class SparkL2FundingSource(LNbitsSettings):
     spark_l2_external_endpoint: str | None = Field(default="http://localhost:8765")
     spark_l2_external_api_key: str | None = Field(default=None)
     spark_l2_mnemonic: str | None = Field(default=None)
-    spark_l2_mnemonic_backup_confirmed: bool = Field(default=False)
     spark_l2_pay_wait_ms: int = Field(default=4000, ge=0)
     spark_l2_pay_poll_ms: int = Field(default=500, ge=0)
     spark_l2_stream_keepalive_ms: int = Field(default=15000, ge=0)
@@ -652,7 +648,6 @@ class BoltzFundingSource(LNbitsSettings):
     boltz_client_password: str = Field(default="")
     boltz_client_cert: str | None = Field(default=None)
     boltz_mnemonic: str | None = Field(default=None)
-    boltz_mnemonic_backup_confirmed: bool = Field(default=False)
 
 
 class StrikeFundingSource(LNbitsSettings):
@@ -1077,12 +1072,11 @@ class EnvSettings(LNbitsSettings):
     log_rotation: str = Field(default="100 MB")
     log_retention: str = Field(default="3 months")
     first_install_token: str | None = Field(default=None)
+
     cleanup_wallets_days: int = Field(default=90, ge=0)
     funding_source_max_retries: int = Field(default=4, ge=0)
     lnbits_max_users: int = Field(default=0, ge=0)
     lnbits_max_extensions: int = Field(default=0, ge=0)
-    task_heart_beat_verbose: bool = Field(default=False)
-    task_heart_beat_interval: int = Field(default=30)
 
     @property
     def has_default_extension_path(self) -> bool:

lnbits/static/i18n/en.js

@@ -520,35 +520,38 @@ window.localisation.en = {
   extension_cost: 'This release requires a payment of minimum {cost} sats.',
   extension_paid_sats: 'You have already paid {paid_sats} sats.',
   extension_permissions_title: 'Grant extension permissions',
+  extension_permissions_request: 'This extension requests these permissions:',
   extension_permissions_grant_install: 'Grant and install',
-  extension_permissions_high_risk_warning:
-    'This extension requests permissions that can move funds.',
-  extension_permission_risk_low: 'Low risk',
-  extension_permission_risk_medium: 'Medium risk',
-  extension_permission_risk_high: 'High risk',
-  extension_permission_warning_wallet_pay_invoice:
-    'Can spend funds from wallets available to your account.',
-  extension_permission_warning_extension_api_request_write:
-    'Can write data or trigger actions in approved extensions.',
   extension_permission_ext_storage_read: 'Read extension storage',
   extension_permission_ext_storage_read_public: 'Read public extension storage',
   extension_permission_ext_storage_write: 'Write extension storage',
-  extension_permission_ext_storage_read_write: 'Read & Write extension storage',
   extension_permission_extension_api_request: 'Use other extensions',
+  extension_permission_extension_api_request_desc:
+    'Call approved installed extensions using your account permissions.',
   extension_permission_extension_api_request_extensions: 'Allowed extensions',
-  extension_permission_access_read: 'Read',
-  extension_permission_access_write: 'Write',
   extension_permission_http_request: 'Connect to external websites',
+  extension_permission_http_request_desc:
+    'Make HTTP requests to approved external hosts.',
   extension_permission_http_request_hosts: 'Allowed hosts',
   extension_permission_utils_basic: 'Use basic LNbits utilities',
+  extension_permission_utils_basic_desc:
+    'Use public currency conversion, server health, and Lightning invoice helper functions.',
   extension_permission_ui_camera_scan_qr: 'Scan QR codes',
+  extension_permission_ui_camera_scan_qr_desc:
+    'Use the LNbits scanner to read QR codes when you choose to scan.',
   extension_permission_payments_watch: 'Watch payments',
   extension_permission_wallet_create_invoice: 'Create invoices',
   extension_permission_wallet_create_invoice_public:
     'Create Lightning invoices from public pages',
+  extension_permission_wallet_create_invoice_public_desc:
+    'Create incoming Lightning invoices from public pages.',
   extension_permission_wallet_balance_read: 'View wallet balances',
+  extension_permission_wallet_balance_read_desc:
+    'Read balances of wallets available to your account.',
   extension_permission_wallet_list: 'List wallets',
   extension_permission_wallet_pay_invoice: 'Pay invoices',
+  extension_permission_wallet_pay_invoice_desc:
+    'Send Lightning payments from wallets available to your account.',
   create_extension: 'Create Extension',
   release_details_error: 'Cannot get the release details.',
   pay_from_wallet: 'Pay from Wallet',

lnbits/static/js/components/admin/lnbits-admin-exchange-providers.js

@@ -62,6 +62,12 @@ window.app.component('lnbits-admin-exchange-providers', {
   mounted() {
     this.getExchangeRateHistory()
   },
+  created() {
+    const hash = window.location.hash.replace('#', '')
+    if (hash === 'exchange_providers') {
+      this.showExchangeProvidersTab(hash)
+    }
+  },
   methods: {
     getDefaultSetting(fieldName) {
       LNbits.api.getDefaultSetting(fieldName).then(response => {
@@ -121,21 +127,18 @@ window.app.component('lnbits-admin-exchange-providers', {
       this.exchangeData.showTickerConversion = true
     },
     initExchangeChart(data) {
-      if (this.exchangeRatesChart) {
-        this.exchangeRatesChart.destroy()
-        this.exchangeRatesChart = null
-      }
       const xValues = data.map(d =>
         this.utils.formatTimestamp(d.timestamp, 'HH:mm')
       )
-      const exchanges = this.formData.lnbits_price_aggregator_enabled
-        ? [{name: 'Aggregator'}]
-        : [...this.formData.lnbits_exchange_rate_providers, {name: 'LNbits'}]
+      const exchanges = [
+        ...this.formData.lnbits_exchange_rate_providers,
+        {name: 'LNbits'}
+      ]
       const datasets = exchanges.map(exchange => ({
         label: exchange.name,
         data: data.map(d => d.rates[exchange.name]),
         pointStyle: true,
-        borderWidth: exchange.name === 'LNbits' ? 4 : 2,
+        borderWidth: exchange.name === 'LNbits' ? 4 : 1,
         tension: 0.4
       }))
       this.exchangeRatesChart = new Chart(
@@ -145,11 +148,7 @@ window.app.component('lnbits-admin-exchange-providers', {
           options: {
             plugins: {
               legend: {
-                display: true
-              },
-              title: {
-                display: true,
-                text: 'Bitcoin Price History'
+                display: false
               }
             }
           },

lnbits/static/js/components/admin/lnbits-admin-funding-seed-backup.js

@@ -1,151 +0,0 @@
-window.app.component('lnbits-admin-funding-seed-backup', {
-  props: ['active', 'is-super-user', 'form-data', 'settings'],
-  template: '#lnbits-admin-funding-seed-backup',
-  data() {
-    return {
-      dialog: {
-        show: false,
-        step: 1,
-        seed: '',
-        visible: false,
-        challenge: [],
-        answers: {},
-        error: '',
-        confirmField: ''
-      }
-    }
-  },
-  watch: {
-    active(isActive) {
-      if (isActive) {
-        this.openIfRequired()
-      }
-    },
-    'formData.lnbits_backend_wallet_class'(walletClass, previousWalletClass) {
-      const source = this.seedBackupSource(walletClass)
-      if (previousWalletClass && source && this.formData[source.seedField]) {
-        this.formData[source.confirmField] = false
-      }
-      this.openIfRequired()
-    },
-    'formData.boltz_mnemonic'() {
-      this.formData.boltz_mnemonic_backup_confirmed =
-        this.formData.boltz_mnemonic === this.settings.boltz_mnemonic
-          ? this.settings.boltz_mnemonic_backup_confirmed
-          : false
-      this.openIfRequired()
-    },
-    'formData.phoenixd_mnemonic'() {
-      this.formData.phoenixd_mnemonic_backup_confirmed =
-        this.formData.phoenixd_mnemonic === this.settings.phoenixd_mnemonic
-          ? this.settings.phoenixd_mnemonic_backup_confirmed
-          : false
-      this.openIfRequired()
-    },
-    'formData.spark_l2_mnemonic'() {
-      this.formData.spark_l2_mnemonic_backup_confirmed =
-        this.formData.spark_l2_mnemonic === this.settings.spark_l2_mnemonic
-          ? this.settings.spark_l2_mnemonic_backup_confirmed
-          : false
-      this.openIfRequired()
-    }
-  },
-  computed: {
-    seedWords() {
-      return this.dialog.seed
-        .split(/\s+/)
-        .filter(Boolean)
-        .map((word, index) => ({index, word}))
-    }
-  },
-  created() {
-    this.openIfRequired()
-  },
-  methods: {
-    seedBackupSource(walletClass = this.formData.lnbits_backend_wallet_class) {
-      if (walletClass === 'BoltzWallet') {
-        return {
-          seedField: 'boltz_mnemonic',
-          confirmField: 'boltz_mnemonic_backup_confirmed'
-        }
-      }
-      if (walletClass === 'PhoenixdWallet') {
-        return {
-          seedField: 'phoenixd_mnemonic',
-          confirmField: 'phoenixd_mnemonic_backup_confirmed'
-        }
-      }
-      if (walletClass === 'SparkL2Wallet') {
-        return {
-          seedField: 'spark_l2_mnemonic',
-          confirmField: 'spark_l2_mnemonic_backup_confirmed'
-        }
-      }
-    },
-    openIfRequired() {
-      if (!this.active || !this.isSuperUser) return
-
-      const source = this.seedBackupSource()
-      if (!source) return
-
-      const seed = (this.formData[source.seedField] || '').trim()
-      const confirmed = this.formData[source.confirmField]
-      if (!seed || confirmed || this.dialog.show) return
-
-      this.dialog = {
-        show: true,
-        step: 1,
-        seed,
-        visible: false,
-        challenge: [],
-        answers: {},
-        error: '',
-        confirmField: source.confirmField
-      }
-    },
-    prepareChallenge() {
-      const words = this.dialog.seed.split(/\s+/).filter(Boolean)
-      const count = Math.min(4, words.length)
-      const indexes = _.shuffle([...Array(words.length).keys()]).slice(0, count)
-      this.dialog.challenge = indexes
-        .sort((a, b) => a - b)
-        .map(index => ({index, word: words[index]}))
-      this.dialog.answers = {}
-      this.dialog.error = ''
-      this.dialog.step = 2
-    },
-    submitChallenge() {
-      const isValid = this.dialog.challenge.every(({index, word}) => {
-        const answer = this.dialog.answers[index] || ''
-        return answer.trim().toLowerCase() === word.toLowerCase()
-      })
-      if (!isValid) {
-        this.dialog.error =
-          'One or more words are incorrect. Check your backup and try again.'
-        return
-      }
-
-      const field = this.dialog.confirmField
-      LNbits.api
-        .request(
-          'PATCH',
-          '/admin/api/v1/settings',
-          this.g.user.wallets[0].adminkey,
-          {
-            [field]: true
-          }
-        )
-        .then(() => {
-          this.formData[field] = true
-          this.settings[field] = true
-          this.dialog.show = false
-          Quasar.Notify.create({
-            type: 'positive',
-            message: 'Seed backup confirmed',
-            icon: 'check'
-          })
-        })
-        .catch(LNbits.utils.notifyApiError)
-    }
-  }
-})

lnbits/static/js/components/admin/lnbits-admin-funding.js

@@ -1,5 +1,5 @@
 window.app.component('lnbits-admin-funding', {
-  props: ['active', 'is-super-user', 'form-data', 'settings'],
+  props: ['is-super-user', 'form-data', 'settings'],
   template: '#lnbits-admin-funding',
   data() {
     return {

lnbits/static/js/components/lnbits-extension-permissions.js

@@ -1,324 +0,0 @@
-;(function () {
-  function translate(translateFn, key) {
-    return translateFn ? translateFn(key) : key
-  }
-
-  function permissionI18nKey(permission) {
-    return `extension_permission_${permission.id.replace(/[^A-Za-z0-9]/g, '_')}`
-  }
-
-  function permissionLabel(permission, translateFn) {
-    const key = permissionI18nKey(permission)
-    const label = translate(translateFn, key)
-    return label === key ? permission.id : label
-  }
-
-  function permissionManifestDescription(permission) {
-    return typeof permission.description === 'string'
-      ? permission.description
-      : ''
-  }
-
-  function lowRisk(translateFn) {
-    return {
-      level: 'low',
-      color: 'grey-6',
-      label: translate(translateFn, 'extension_permission_risk_low'),
-      warning: ''
-    }
-  }
-
-  function mediumRisk(translateFn) {
-    return {
-      level: 'medium',
-      color: 'warning',
-      label: translate(translateFn, 'extension_permission_risk_medium'),
-      warning: ''
-    }
-  }
-
-  function highRisk(translateFn, warningKey) {
-    return {
-      level: 'high',
-      color: 'negative',
-      label: translate(translateFn, 'extension_permission_risk_high'),
-      warning: translate(translateFn, warningKey)
-    }
-  }
-
-  function extensionDisplayName(extensions, extensionId) {
-    const extension = (extensions || []).find(
-      extension => extension.id === extensionId
-    )
-    return extension?.name || extensionId
-  }
-
-  function extensionApiPermissionTargets(permission, extensions) {
-    const extensionPolicies = permission.policies
-    if (!Array.isArray(extensionPolicies)) return []
-    return extensionPolicies
-      .map(extension => {
-        const extensionId =
-          typeof extension === 'string' ? extension : extension?.id
-        if (!extensionId) return null
-        const access =
-          typeof extension === 'string'
-            ? ['read']
-            : Array.isArray(extension.access) && extension.access.length
-              ? extension.access
-              : ['read']
-        return {
-          id: extensionId,
-          name: extensionDisplayName(extensions, extensionId),
-          access
-        }
-      })
-      .filter(Boolean)
-  }
-
-  function permissionRiskForPermission(permission, extensions, translateFn) {
-    if (permission.id === 'wallet.pay_invoice') {
-      return highRisk(
-        translateFn,
-        'extension_permission_warning_wallet_pay_invoice'
-      )
-    }
-    if (permission.id === 'extension.api.request') {
-      const hasWriteAccess = extensionApiPermissionTargets(
-        permission,
-        extensions
-      ).some(target => target.access.includes('write'))
-      return hasWriteAccess
-        ? highRisk(
-            translateFn,
-            'extension_permission_warning_extension_api_request_write'
-          )
-        : mediumRisk(translateFn)
-    }
-    if (permission.id === 'http.request') {
-      return mediumRisk(translateFn)
-    }
-    if (
-      [
-        'wallet.list',
-        'wallet.balance.read',
-        'wallet.create_invoice_public',
-        'ext.storage.read_public',
-        'payments.watch'
-      ].includes(permission.id)
-    ) {
-      return mediumRisk(translateFn)
-    }
-    return lowRisk(translateFn)
-  }
-
-  function permissionRisk(permissions, extensions, translateFn) {
-    const risks = permissions.map(permission =>
-      permissionRiskForPermission(permission, extensions, translateFn)
-    )
-    const highestRisk = risks.find(risk => risk.level === 'high')
-    if (highestRisk) return highestRisk
-    return risks.find(risk => risk.level === 'medium') || lowRisk(translateFn)
-  }
-
-  function permissionOrderIndex(permissionId) {
-    const order = [
-      'wallet.pay_invoice',
-      'wallet.list',
-      'wallet.balance.read',
-      'extension.api.request',
-      'http.request',
-      'ui.camera.scan_qr',
-      'ext.storage.read',
-      'ext.storage.write',
-      'ext.storage.read_public',
-      'wallet.create_invoice_public',
-      'wallet.create_invoice',
-      'utils.basic'
-    ]
-    const index = order.indexOf(permissionId)
-    return index === -1 ? order.length : index
-  }
-
-  function publicStorageFieldGroups(permission) {
-    const tables = permission.policies
-    if (!Array.isArray(tables)) return []
-    return tables
-      .map(table => {
-        const tableName =
-          typeof table === 'string' ? table : table?.table_name || ''
-        const fields =
-          typeof table === 'string' || !Array.isArray(table?.public_fields)
-            ? []
-            : table.public_fields.filter(
-                field => typeof field === 'string' && field
-              )
-        return tableName ? {table: tableName, fields} : null
-      })
-      .filter(Boolean)
-  }
-
-  function httpRequestPermissionHosts(permission) {
-    const hosts = permission.policies
-    if (!Array.isArray(hosts)) return []
-    return hosts
-      .map(host => (typeof host === 'string' ? host : host?.host || ''))
-      .filter(host => typeof host === 'string' && host)
-  }
-
-  function publicInvoicePolicies(permission) {
-    const policies = permission.policies
-    if (!Array.isArray(policies)) return []
-    return policies
-      .map(policy => {
-        if (!policy || typeof policy !== 'object') return null
-        const table = policy.table
-        const walletField = policy.wallet_field
-        if (typeof table !== 'string' || !table) return null
-        if (typeof walletField !== 'string' || !walletField) return null
-        return {table, walletField}
-      })
-      .filter(Boolean)
-  }
-
-  function permissionDisplayItem(permissions, extensions, translateFn) {
-    const permission = permissions[0]
-    const isReadWriteStorage =
-      permissions.length === 2 &&
-      permissions.some(permission => permission.id === 'ext.storage.read') &&
-      permissions.some(permission => permission.id === 'ext.storage.write')
-    const descriptions = permissions
-      .map(permission => permissionManifestDescription(permission))
-      .filter(Boolean)
-    const item = {
-      id: isReadWriteStorage ? 'ext.storage.read_write' : permission.id,
-      label: isReadWriteStorage
-        ? translate(translateFn, 'extension_permission_ext_storage_read_write')
-        : permissionLabel(permission, translateFn),
-      risk: permissionRisk(permissions, extensions, translateFn),
-      badges: [],
-      descriptions,
-      fieldGroups: [],
-      invoicePolicies: [],
-      extensionAccess: [],
-      httpHosts: []
-    }
-
-    if (permission.id === 'ext.storage.read_public') {
-      item.fieldGroups = publicStorageFieldGroups(permission)
-      item.badges = item.fieldGroups.map(group => ({
-        key: group.table,
-        label: group.table
-      }))
-    }
-
-    if (permission.id === 'extension.api.request') {
-      item.extensionAccess = extensionApiPermissionTargets(
-        permission,
-        extensions
-      )
-      item.badges = item.extensionAccess.map(target => ({
-        key: target.id,
-        label: target.name
-      }))
-    }
-
-    if (permission.id === 'http.request') {
-      item.httpHosts = httpRequestPermissionHosts(permission)
-    }
-
-    if (permission.id === 'wallet.create_invoice_public') {
-      item.invoicePolicies = publicInvoicePolicies(permission)
-    }
-
-    return item
-  }
-
-  function displayItems({permissions, extensions, translate}) {
-    const permissionList = permissions || []
-    const permissionsById = new Map(
-      permissionList.map(permission => [permission.id, permission])
-    )
-    const hasReadWriteStorage =
-      permissionsById.has('ext.storage.read') &&
-      permissionsById.has('ext.storage.write')
-    let addedReadWriteStorage = false
-
-    return permissionList
-      .map((permission, index) => {
-        if (
-          hasReadWriteStorage &&
-          ['ext.storage.read', 'ext.storage.write'].includes(permission.id)
-        ) {
-          if (addedReadWriteStorage) return null
-          addedReadWriteStorage = true
-          return {
-            index,
-            orderId: 'ext.storage.read',
-            permissions: [
-              permissionsById.get('ext.storage.read'),
-              permissionsById.get('ext.storage.write')
-            ]
-          }
-        }
-        return {
-          index,
-          orderId: permission.id,
-          permissions: [permission]
-        }
-      })
-      .filter(Boolean)
-      .sort((left, right) => {
-        const leftOrder = permissionOrderIndex(left.orderId)
-        const rightOrder = permissionOrderIndex(right.orderId)
-        return leftOrder === rightOrder
-          ? left.index - right.index
-          : leftOrder - rightOrder
-      })
-      .map(group =>
-        permissionDisplayItem(group.permissions, extensions || [], translate)
-      )
-  }
-
-  window.LNbitsExtensionPermissions = {
-    displayItems,
-    hasHighRisk({permissions, extensions, translate}) {
-      return displayItems({permissions, extensions, translate}).some(
-        permission => permission.risk.level === 'high'
-      )
-    }
-  }
-
-  window.app.component('lnbits-extension-permissions', {
-    template: '#lnbits-extension-permissions',
-    props: {
-      permissions: {
-        type: Array,
-        default: () => []
-      },
-      extensions: {
-        type: Array,
-        default: () => []
-      }
-    },
-    computed: {
-      displayItems() {
-        return window.LNbitsExtensionPermissions.displayItems({
-          permissions: this.permissions,
-          extensions: this.extensions,
-          translate: key => this.$t(key)
-        })
-      }
-    },
-    methods: {
-      publicInvoicePolicySentence(policy) {
-        return `Invoices will be created using ${policy.walletField} from ${policy.table}.`
-      },
-      permissionAccessLabel(access) {
-        const key = `extension_permission_access_${access}`
-        const label = this.$t(key)
-        return label === key ? access : label
-      }
-    }
-  })
-})()

lnbits/static/js/pages/extensions.js

@@ -724,12 +724,42 @@ window.PageExtensions = {
         resolve(grantedPermissions)
       }
     },
-    permissionGrantHasHighRisk() {
-      return window.LNbitsExtensionPermissions.hasHighRisk({
-        permissions: this.permissionGrant.permissions,
-        extensions: this.extensions,
-        translate: key => this.$t(key)
-      })
+    permissionI18nKey(permission) {
+      return `extension_permission_${permission.id.replace(/[^A-Za-z0-9]/g, '_')}`
+    },
+    permissionLabel(permission) {
+      const key = this.permissionI18nKey(permission)
+      const label = this.$t(key)
+      return label === key ? permission.id : label
+    },
+    permissionDescription(permission) {
+      const key = `${this.permissionI18nKey(permission)}_desc`
+      const description = this.$t(key)
+      return description === key ? permission.description : description
+    },
+    permissionPolicyDetails(permission) {
+      if (permission.id === 'http.request') {
+        const hosts = permission.policy?.hosts
+        if (!Array.isArray(hosts) || !hosts.length) return ''
+        return `${this.$t('extension_permission_http_request_hosts')}: ${hosts.join(', ')}`
+      }
+      if (permission.id === 'extension.api.request') {
+        const extensions = permission.policy?.extensions
+        if (!Array.isArray(extensions) || !extensions.length) return ''
+        const targets = extensions
+          .map(extension => {
+            if (typeof extension === 'string') return `${extension} (read)`
+            if (!extension?.id) return null
+            const access = Array.isArray(extension.access)
+              ? extension.access.join(', ')
+              : 'read'
+            return `${extension.id} (${access})`
+          })
+          .filter(Boolean)
+        if (!targets.length) return ''
+        return `${this.$t('extension_permission_extension_api_request_extensions')}: ${targets.join(', ')}`
+      }
+      return ''
     },
     async selectAllUpdatableExtensionss() {
       this.updatableExtensions.forEach(e => (e.selectedForUpdate = true))

lnbits/static/js/pages/wallet.js

@@ -414,19 +414,12 @@ window.PageWallet = {
             switch (action.tag) {
               case 'url':
                 Quasar.Notify.create({
-                  message: action.url,
+                  message: `<a target="_blank" style="color: inherit" href="${action.url}">${action.url}</a>`,
                   caption: action.description,
-                  html: false,
+                  html: true,
                   type: 'positive',
                   timeout: 0,
-                  closeBtn: true,
-                  actions: [
-                    {
-                      label: 'Open link',
-                      color: 'white',
-                      handler: () => this.utils.openUrlInNewTab(action.url)
-                    }
-                  ]
+                  closeBtn: true
                 })
                 break
               case 'message':
@@ -438,29 +431,15 @@ window.PageWallet = {
                 })
                 break
               case 'aes':
-                this.utils
-                  .decryptLnurlPayAES(action, response.data.preimage)
-                  .then(value => {
-                    Quasar.Notify.create({
-                      message: value,
-                      caption: action.description,
-                      html: false,
-                      type: 'positive',
-                      timeout: 0,
-                      closeBtn: true
-                    })
-                  })
-                  .catch(error => {
-                    Quasar.Notify.create({
-                      message: action.description || 'Payment successful.',
-                      caption: 'Could not decrypt success action.',
-                      html: false,
-                      type: 'warning',
-                      timeout: 0,
-                      closeBtn: true
-                    })
-                  })
-                break
+                this.utils.decryptLnurlPayAES(action, response.data.preimage)
+                Quasar.Notify.create({
+                  message: value,
+                  caption: extra.success_action.description,
+                  html: true,
+                  type: 'positive',
+                  timeout: 0,
+                  closeBtn: true
+                })
             }
           }
         })

lnbits/static/js/utils.js

@@ -365,27 +365,5 @@ window._lnbitsUtils = {
         let decoder = new TextDecoder('utf-8')
         return decoder.decode(valueb)
       })
-  },
-  validateBrowsableUrl(urlString, allowLoopback = false) {
-    const url = new URL(urlString)
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-      throw new Error('Invalid protocol')
-    }
-    if (!allowLoopback) {
-      const host = url.hostname
-      if (
-        host === 'localhost' ||
-        host === '[::1]' ||
-        host === '::1' ||
-        host.startsWith('127.') ||
-        host.startsWith('::ffff:127.')
-      ) {
-        throw new Error('Loopback addresses are not allowed')
-      }
-    }
-  },
-  openUrlInNewTab(urlString, allowLoopback = false) {
-    this.validateBrowsableUrl(urlString, allowLoopback)
-    window.open(urlString, '_blank', 'noopener,noreferrer')
   }
 }

lnbits/static/vendor.json

@@ -58,7 +58,6 @@
     "js/pages/users.js",
     "js/pages/account.js",
     "js/pages/admin.js",
-    "js/components/admin/lnbits-admin-funding-seed-backup.js",
     "js/components/admin/lnbits-admin-funding.js",
     "js/components/admin/lnbits-admin-funding-sources.js",
     "js/components/admin/lnbits-admin-fiat-providers.js",
@@ -90,7 +89,6 @@
     "js/components/lnbits-theme.js",
     "js/components/lnbits-qrcode-scanner.js",
     "js/components/lnbits-manage-extension-list.js",
-    "js/components/lnbits-extension-permissions.js",
     "js/components/lnbits-manage-wallet-list.js",
     "js/components/lnbits-language-dropdown.js",
     "js/components/lnbits-payment-list.js",

lnbits/task_manager.py

@@ -1,200 +0,0 @@
-import asyncio
-import traceback
-import uuid
-from collections.abc import Callable, Coroutine
-from datetime import datetime, timezone
-
-from loguru import logger
-from pydantic import BaseModel
-
-from lnbits.core.models import Payment
-from lnbits.settings import settings
-
-
-class PublicTask(BaseModel):
-    """Public model used to expose task information via the API."""
-
-    name: str
-    created_at: datetime
-
-
-class Task:
-    """Model used on the backend to keep track of background tasks."""
-
-    coro: Coroutine
-    name: str
-    created_at: datetime
-    task: asyncio.Task
-    invoice_queue: asyncio.Queue[Payment] | None = None
-
-    def __init__(
-        self,
-        coro: Coroutine,
-        name: str | None = None,
-        invoice_queue: asyncio.Queue | None = None,
-    ) -> None:
-        self.coro = coro
-        self.name = name or f"task_{uuid.uuid4()}"
-        self.created_at = datetime.now(timezone.utc)
-        self.task = asyncio.create_task(self.coro, name=self.name)
-        self.invoice_queue = invoice_queue
-
-
-class TaskManager:
-    """Singleton class to manage background tasks."""
-
-    tasks: list[Task] = []
-    invoice_queue: asyncio.Queue[Payment] = asyncio.Queue()
-    internal_invoice_queue: asyncio.Queue[Payment] = asyncio.Queue()
-
-    def init(self) -> None:
-        self.create_permanent_task(
-            func=self._heart_beat,
-            interval=settings.task_heart_beat_interval,
-        )
-        self.create_permanent_task(self._invoice_listener_consumer)
-        self.create_permanent_task(self._internal_invoice_listener_consumer)
-
-    def get_task(self, name: str) -> Task | None:
-        """Get a running task by name."""
-        for task in self.tasks:
-            if task.name == name:
-                return task
-        return None
-
-    def get_public_tasks(self) -> list[PublicTask]:
-        """Get a list of public tasks."""
-        return [PublicTask(name=t.name, created_at=t.created_at) for t in self.tasks]
-
-    def cancel_task(self, task: Task) -> None:
-        """Cancel a running task."""
-        self.tasks.remove(task)
-        try:
-            task.task.cancel()
-        except Exception as exc:
-            logger.warning(f"error while cancelling task `{task.name}`: {exc!s}")
-
-    def cancel_all_tasks(self) -> None:
-        """Cancel all running tasks."""
-        for task in list(self.tasks):
-            self.cancel_task(task)
-
-    def create_task(
-        self,
-        coro: Coroutine,
-        name: str | None = None,
-        invoice_queue: asyncio.Queue | None = None,
-    ) -> Task:
-        """Create a task. If a task with the same name exists, it will be cancelled."""
-        if name:
-            task = self.get_task(name)
-            if task:
-                self.cancel_task(task)
-        task = Task(coro=coro, name=name, invoice_queue=invoice_queue)
-        self.tasks.append(task)
-        return task
-
-    def create_permanent_task(
-        self,
-        func: Callable[[], Coroutine],
-        invoice_queue: asyncio.Queue | None = None,
-        name: str | None = None,
-        interval: int = 0,
-    ) -> Task:
-        """Create a task that runs forever and restarts on failure."""
-
-        async def wrapper():
-            while settings.lnbits_running:
-                await self._catch_everything_and_restart(func)
-                if interval > 0:
-                    await asyncio.sleep(interval)
-
-        return self.create_task(
-            coro=wrapper(), name=name or func.__name__, invoice_queue=invoice_queue
-        )
-
-    def register_invoice_listener(
-        self,
-        func: Callable[[Payment], Coroutine],
-        name: str | None = None,
-    ) -> Task:
-        """
-        A method intended for extensions to call when they want to be notified about
-        incoming payments. Will call provided Coroutine with the updated payment.
-        """
-        name = f"{name or uuid.uuid4()}_invoice_listener"
-        queue: asyncio.Queue[Payment] = asyncio.Queue()
-        return self.create_permanent_task(
-            self._invoice_listener_worker(func, queue),
-            name=name,
-            invoice_queue=queue,
-        )
-
-    async def _heart_beat(self) -> None:
-        """A heartbeat that removes done tasks logs the number of tasks."""
-        for task in self.tasks:
-            state = task.task._state if task.task else "NOT RUNNING"
-            if settings.task_heart_beat_verbose:
-                logger.debug(
-                    f"Task Manager: `{task.name}` state: `{state}` "
-                    f"created: {task.created_at.strftime('%Y-%m-%d %H:%M:%S')}`"
-                )
-            if task.task and task.task.done():
-                logger.debug(f"Task Manager: task `{task.name}` is done.")
-                self.cancel_task(task)
-        listeners_count = sum(1 for task in self.tasks if task.invoice_queue)
-        logger.debug(
-            f"Task Manager: {len(self.tasks) - listeners_count} tasks "
-            f"and {listeners_count} invoice listeners."
-        )
-
-    async def _catch_everything_and_restart(
-        self,
-        func: Callable[[], Coroutine],
-        restart_interval: int = 5,
-    ) -> None:
-        """Catches all exceptions from a function and restarts it after 5 seconds."""
-        while settings.lnbits_running:
-            try:
-                return await func()
-            except asyncio.CancelledError:
-                raise  # because we must pass this up
-            except Exception as exc:
-                if not settings.lnbits_running:
-                    return
-                logger.error(f"exception in background task `{func.__name__}`:", exc)
-                logger.error(traceback.format_exc())
-                logger.info(
-                    f"`{func.__name__}` restarts in {restart_interval} seconds."
-                )
-                await asyncio.sleep(restart_interval)
-
-    def _invoice_listener_worker(
-        self, func: Callable[[Payment], Coroutine], queue: asyncio.Queue[Payment]
-    ) -> Callable:
-        async def wrapper() -> None:
-            payment: Payment = await queue.get()
-            await func(payment)
-
-        return wrapper
-
-    def _invoice_dispatcher(self, payment: Payment) -> None:
-        """Dispatches a payment to all registered invoice listeners."""
-        for task in self.tasks:
-            if not task.invoice_queue:
-                continue
-            logger.debug(f"Enqueing payment to task {task.name}")
-            task.invoice_queue.put_nowait(payment)
-
-    async def _invoice_listener_consumer(self) -> None:
-        payment = await self.invoice_queue.get()
-        logger.info(f"got a payment notification {payment.checking_id}")
-        self._invoice_dispatcher(payment)
-
-    async def _internal_invoice_listener_consumer(self) -> None:
-        payment = await self.internal_invoice_queue.get()
-        logger.info(f"got an internal payment notification {payment.checking_id}")
-        self._invoice_dispatcher(payment)
-
-
-task_manager = TaskManager()

lnbits/tasks.py

@@ -1,83 +1,146 @@
 import asyncio
+import traceback
 import uuid
 from collections.abc import Callable, Coroutine
 
 from loguru import logger
 
 from lnbits.core.models import Payment
-from lnbits.core.services.payments import get_standalone_payment
+from lnbits.core.services.payments import (
+    get_standalone_payment,
+    update_invoice_from_paid_invoices_stream,
+)
 from lnbits.settings import settings
-from lnbits.task_manager import task_manager
+from lnbits.wallets import get_funding_source
+
+tasks: list[asyncio.Task] = []
+unique_tasks: dict[str, asyncio.Task] = {}
 
 
-# DEPRECATED: use task_manager.create_task instead.
 def create_task(coro: Coroutine) -> asyncio.Task:
-    logger.debug("DEPRECATED: use task_manager.create_task instead.")
-    return task_manager.create_task(coro).task
+    task = asyncio.create_task(coro)
+    tasks.append(task)
+    return task
 
 
-# DEPRECATED: use task_manager.create_task with `name` kwarg.
 def create_unique_task(name: str, coro: Coroutine) -> asyncio.Task:
-    logger.debug("DEPRECATED: use task_manager.create_task instead.")
-    return task_manager.create_task(coro, name=name).task
+    if unique_tasks.get(name):
+        logger.warning(f"task `{name}` already exists, cancelling it")
+        try:
+            unique_tasks[name].cancel()
+        except Exception as exc:
+            logger.warning(f"error while cancelling task `{name}`: {exc!s}")
+    task = asyncio.create_task(coro)
+    unique_tasks[name] = task
+    return task
 
 
-# DEPRECATED: use task_manager.create_permanent_task instead.
 def create_permanent_task(func: Callable[[], Coroutine]) -> asyncio.Task:
-    logger.debug("DEPRECATED: use task_manager.create_permanent_task instead.")
-    return task_manager.create_permanent_task(func).task
+    return create_task(catch_everything_and_restart(func))
 
 
-# DEPRECATED: use task_manager.create_permanent_task with `name` argument instead.
 def create_permanent_unique_task(
     name: str, coro: Callable[[], Coroutine]
 ) -> asyncio.Task:
     return create_unique_task(name, catch_everything_and_restart(coro, name))
 
 
-# DEPRECATED don't use this, use task_manager.create_permanent_task instead.
+def cancel_all_tasks() -> None:
+    for task in tasks:
+        try:
+            task.cancel()
+        except Exception as exc:
+            logger.warning(f"error while cancelling task: {exc!s}")
+    for name, task in unique_tasks.items():
+        try:
+            task.cancel()
+        except Exception as exc:
+            logger.warning(f"error while cancelling task `{name}`: {exc!s}")
+
+
 async def catch_everything_and_restart(
     func: Callable[[], Coroutine],
     name: str = "unnamed",
-) -> None:
-    _ = name
-    return await task_manager._catch_everything_and_restart(func)
+) -> Coroutine:
+    try:
+        return await func()
+    except asyncio.CancelledError:
+        raise  # because we must pass this up
+    except Exception as exc:
+        logger.error(f"exception in background task `{name}`:", exc)
+        logger.error(traceback.format_exc())
+        logger.error("will restart the task in 5 seconds.")
+        await asyncio.sleep(5)
+        return await catch_everything_and_restart(func, name)
 
 
+invoice_listeners: dict[str, asyncio.Queue] = {}
+
+
+# TODO: name should not be optional
+# some extensions still dont use a name, but they should
 def register_invoice_listener(send_chan: asyncio.Queue, name: str | None = None):
     """
-    DEPRECATED: use task_manager.register_invoice_listener instead,
-    which also allows to pass a callback instead of a queue.
-    This method will still work but it is not recommended for new code.
+    A method intended for extensions (and core/tasks.py) to call when they want to be
+    notified about new invoice payments incoming. Will emit all incoming payments.
     """
-    logger.debug("DEPRECATED: use task_manager.register_invoice_listener instead.")
-    name = f"forward_{name or str(uuid.uuid4())[:8]}"
+    if not name:
+        # fallback to a random name if extension didn't provide one
+        name = f"no_name_{str(uuid.uuid4())[:8]}"
 
-    # here we just forwarding the payments to the provided queue
-    async def forward_queue(payment: Payment):
-        send_chan.put_nowait(payment)
+    if invoice_listeners.get(name):
+        logger.warning(f"invoice listener `{name}` already exists, replacing it")
 
-    task_manager.register_invoice_listener(forward_queue, name=name)
+    logger.trace(f"registering invoice listener `{name}`")
+    invoice_listeners[name] = send_chan
+
+
+internal_invoice_queue: asyncio.Queue = asyncio.Queue(0)
 
 
 async def internal_invoice_queue_put(checking_id: str) -> None:
     """
-    DEPRECATED: use task_manager.internal_invoice_queue instead,
     A method to call when it wants to notify about an internal invoice payment.
     """
-    payment = await get_standalone_payment(checking_id, incoming=True)
-    if not payment:
-        logger.warning(f"internal_invoice_queue_put: payment {checking_id} not found")
-        return
-    await task_manager.internal_invoice_queue.put(payment)
+    await internal_invoice_queue.put(checking_id)
+
+
+async def internal_invoice_listener() -> None:
+    """
+    internal_invoice_queue will be filled directly in core/services.py
+    after the payment was deemed to be settled internally.
+
+    Called by the app startup sequence.
+    """
+    while settings.lnbits_running:
+        checking_id = await internal_invoice_queue.get()
+        logger.info(f"got an internal payment notification {checking_id}")
+        payment = await get_standalone_payment(checking_id, incoming=True)
+        if payment:
+            logger.success(f"internal invoice {checking_id} settled")
+            await invoice_callback_dispatcher(payment)
+
+
+async def invoice_listener() -> None:
+    """
+    invoice_listener will collect all invoices that come directly
+    from the backend wallet.
+
+    Called by the app startup sequence.
+    """
+    funding_source = get_funding_source()
+    async for checking_id in funding_source.paid_invoices_stream():
+        logger.info(f"got a payment notification {checking_id}")
+        payment = await update_invoice_from_paid_invoices_stream(checking_id)
+        if payment:
+            logger.success(f"fundingsource invoice {checking_id} settled")
+            await invoice_callback_dispatcher(payment)
 
 
-# DEPRECATED use task_manager.register_invoice_listener(coro, name="myext")
 def wait_for_paid_invoices(
     invoice_listener_name: str,
     func: Callable[[Payment], Coroutine],
 ) -> Callable[[], Coroutine]:
-    logger.debug("DEPRECATED: use task_manager.register_invoice_listener instead.")
 
     async def wrapper() -> None:
         invoice_queue: asyncio.Queue = asyncio.Queue()
@@ -87,3 +150,27 @@ def wait_for_paid_invoices(
             await func(payment)
 
     return wrapper
+
+
+def run_interval(
+    interval_seconds: int,
+    func: Callable[[], Coroutine],
+) -> Callable[[], Coroutine]:
+    """Run a function at a specified interval in seconds, while the server is running"""
+
+    async def wrapper() -> None:
+        while settings.lnbits_running:
+            try:
+                await func()
+            except Exception as e:
+                logger.error(f"Error occurred in interval task: {e}")
+                logger.warning(traceback.format_exc())
+            await asyncio.sleep(interval_seconds)
+
+    return wrapper
+
+
+async def invoice_callback_dispatcher(payment: Payment):
+    for name, send_chan in invoice_listeners.items():
+        logger.trace(f"invoice listeners: sending to `{name}`")
+        await send_chan.put(payment)

lnbits/templates/components.vue

@@ -1,5 +1,4 @@
-{% include('components/admin/funding_seed_backup.vue') %} {%
-include('components/admin/funding.vue') %} {%
+{% include('components/admin/funding.vue') %} {%
 include('components/admin/funding_sources.vue') %} {%
 include('components/admin/fiat_providers.vue') %} {%
 include('components/admin/exchange_providers.vue') %} {%
@@ -20,7 +19,6 @@ include('components/lnbits-header-wallets.vue') %} {%
 include('components/lnbits-drawer.vue') %} {%
 include('components/lnbits-home-logos.vue') %} {%
 include('components/lnbits-manage-extension-list.vue') %} {%
-include('components/lnbits-extension-permissions.vue') %} {%
 include('components/lnbits-manage-wallet-list.vue') %} {%
 include('components/lnbits-language-dropdown.vue') %} {%
 include('components/lnbits-payment-list.vue') %} {%

lnbits/templates/components/admin/exchange_providers.vue

@@ -1,46 +1,7 @@
 <template id="lnbits-admin-exchange-providers">
-  <h6 class="q-my-none q-mb-xs">LNbits Price Aggregator</h6>
-  <p class="q-mb-md text-caption text-grey">
-    A privacy-friendly, open-source Bitcoin price aggregator maintained by the
-    LNbits team. Aggregates prices from multiple exchanges and returns a median,
-    no API keys required.
-    <a href="https://price.lnbits.com" target="_blank" rel="noopener"
-      >price.lnbits.com</a
-    >
-    &mdash;
-    <a
-      href="https://github.com/lnbits/lnbits-price-aggregator"
-      target="_blank"
-      rel="noopener"
-      >GitHub</a
-    >
-  </p>
-
-  <div class="row q-mb-md items-start">
-    <div class="col-auto q-mr-md q-mt-sm">
-      <q-toggle
-        v-model="formData.lnbits_price_aggregator_enabled"
-        @update:model-value="formData.touch = null"
-        label="Use Price Aggregator"
-      >
-      </q-toggle>
-    </div>
-    <div class="col-12 col-md-7">
-      <q-input
-        filled
-        v-model="formData.lnbits_price_aggregator_url"
-        type="text"
-        label="Price Aggregator URL"
-        hint="Fetch BTC price from this aggregator instead of individual providers below."
-        :disable="!formData.lnbits_price_aggregator_enabled"
-        @update:model-value="formData.touch = null"
-      >
-      </q-input>
-    </div>
-  </div>
-
-  <q-separator class="q-my-md"></q-separator>
-  <h6 class="q-my-none q-mb-sm">Bitcoin Price History</h6>
+  <h6 class="q-my-none q-mb-sm">
+    <span v-text="$t('exchange_providers')"></span>
+  </h6>
 
   <div class="row">
     <div class="col-12 col-md-8">
@@ -92,11 +53,6 @@
     </div>
   </div>
 
-  <q-separator class="q-my-md"></q-separator>
-  <h6 class="q-my-none q-mb-sm">
-    <span v-text="$t('exchange_providers')"></span>
-  </h6>
-
   <div class="row q-mt-md">
     <div class="col-6">
       <q-btn
@@ -104,7 +60,6 @@
         label="Add Exchange Provider"
         color="primary"
         class="q-mb-md"
-        :disable="formData.lnbits_price_aggregator_enabled"
       >
       </q-btn>
     </div>
@@ -115,20 +70,12 @@
         :label="$t('reset_defaults')"
         color="primary"
         class="float-right"
-        :disable="formData.lnbits_price_aggregator_enabled"
       >
       </q-btn>
     </div>
   </div>
 
-  <div
-    class="overflow-auto"
-    :style="
-      formData.lnbits_price_aggregator_enabled
-        ? 'opacity:0.4;pointer-events:none'
-        : ''
-    "
-  >
+  <div class="overflow-auto">
     <q-table
       row-key="name"
       :rows="formData.lnbits_exchange_rate_providers"

lnbits/templates/components/admin/funding.vue

@@ -301,11 +301,5 @@
         </div>
       </div>
     </div>
-    <lnbits-admin-funding-seed-backup
-      :active="active"
-      :is-super-user="isSuperUser"
-      :form-data="formData"
-      :settings="settings"
-    ></lnbits-admin-funding-seed-backup>
   </q-card-section>
 </template>

lnbits/templates/components/admin/funding_seed_backup.vue

@@ -1,136 +0,0 @@
-<template id="lnbits-admin-funding-seed-backup">
-  <q-dialog v-model="dialog.show">
-    <q-card style="width: 760px; max-width: 95vw; border-radius: 8px">
-      <q-card-section class="q-pb-md">
-        <div class="row q-col-gutter-sm">
-          <div class="col-6">
-            <q-chip
-              square
-              class="full-width"
-              icon="looks_one"
-              :color="dialog.step === 1 ? 'primary' : 'grey-9'"
-              text-color="white"
-              label="Backup"
-            ></q-chip>
-          </div>
-          <div class="col-6">
-            <q-chip
-              square
-              class="full-width"
-              icon="looks_two"
-              :color="dialog.step === 2 ? 'primary' : 'grey-9'"
-              text-color="white"
-              label="Verify"
-            ></q-chip>
-          </div>
-        </div>
-      </q-card-section>
-
-      <q-separator></q-separator>
-
-      <q-card-section v-if="dialog.step === 1">
-        <div class="row items-center justify-between q-mb-md">
-          <div>
-            <div
-              class="text-subtitle1"
-              v-text="`${seedWords.length}-word recovery phrase`"
-            ></div>
-            <div
-              class="text-caption text-grey-5"
-              v-text="'Write these words down in order.'"
-            ></div>
-          </div>
-          <q-btn
-            outline
-            no-caps
-            color="primary"
-            :icon="dialog.visible ? 'visibility_off' : 'visibility'"
-            :label="dialog.visible ? 'Hide words' : 'Show words'"
-            @click="dialog.visible = !dialog.visible"
-          ></q-btn>
-        </div>
-
-        <div class="row q-col-gutter-sm">
-          <div
-            class="col-4 col-md-3"
-            v-for="word in seedWords"
-            :key="word.index"
-          >
-            <div
-              class="row items-center no-wrap rounded-borders"
-              style="
-                min-height: 42px;
-                border: 1px solid rgba(255, 255, 255, 0.14);
-                background: rgba(255, 255, 255, 0.035);
-              "
-            >
-              <div
-                class="text-caption text-grey-5 text-center"
-                style="
-                  width: 42px;
-                  border-right: 1px solid rgba(255, 255, 255, 0.1);
-                "
-                v-text="word.index + 1"
-              ></div>
-              <div
-                class="text-body2 text-weight-medium q-px-sm"
-                style="min-width: 0; overflow-wrap: anywhere"
-                v-text="dialog.visible ? word.word : '••••••'"
-              ></div>
-            </div>
-          </div>
-        </div>
-
-        <div class="row justify-end q-mt-lg">
-          <q-btn
-            color="primary"
-            no-caps
-            label="I have written it down"
-            @click="prepareChallenge"
-          ></q-btn>
-        </div>
-      </q-card-section>
-
-      <q-card-section v-if="dialog.step === 2">
-        <div class="q-mb-md">
-          <div class="text-subtitle1" v-text="'Confirm your backup'"></div>
-          <div
-            class="text-caption text-grey-5"
-            v-text="
-              'Enter the requested words from your written recovery phrase.'
-            "
-          ></div>
-        </div>
-
-        <div class="row q-col-gutter-md">
-          <div
-            class="col-12 col-sm-6"
-            v-for="word in dialog.challenge"
-            :key="word.index"
-          >
-            <q-input
-              v-model.trim="dialog.answers[word.index]"
-              filled
-              :label="`Word ${word.index + 1}`"
-            ></q-input>
-          </div>
-        </div>
-        <div
-          class="text-negative q-mt-sm"
-          v-if="dialog.error"
-          v-text="dialog.error"
-        ></div>
-        <div class="row justify-between q-mt-lg">
-          <q-btn flat no-caps label="Back" @click="dialog.step = 1"></q-btn>
-          <q-btn
-            color="primary"
-            icon="check"
-            no-caps
-            label="Confirm backup"
-            @click="submitChallenge"
-          ></q-btn>
-        </div>
-      </q-card-section>
-    </q-card>
-  </q-dialog>
-</template>

lnbits/templates/components/lnbits-extension-permissions.vue

@@ -1,105 +0,0 @@
-<template id="lnbits-extension-permissions">
-  <q-list bordered separator>
-    <q-expansion-item
-      v-for="permission of displayItems"
-      :key="permission.id"
-      dense
-      expand-separator
-      class="q-pt-xs"
-    >
-      <template v-slot:header>
-        <q-item-section>
-          <q-item-label class="text-weight-medium">
-            <span v-text="permission.label"></span>
-          </q-item-label>
-        </q-item-section>
-        <q-item-section
-          v-if="permission.risk.level !== 'low' || permission.badges.length"
-          side
-          top
-        >
-          <div class="row items-center justify-end q-gutter-xs">
-            <q-badge
-              v-for="badge of permission.badges"
-              :key="badge.key"
-              outline
-              color="primary"
-              v-text="badge.label"
-            ></q-badge>
-            <q-badge
-              v-if="permission.risk.level !== 'low'"
-              :color="permission.risk.color"
-              v-text="permission.risk.label"
-            ></q-badge>
-          </div>
-        </q-item-section>
-      </template>
-
-      <div class="q-px-md q-pb-sm">
-        <div
-          v-if="permission.risk.warning"
-          class="row items-center text-negative text-caption q-mb-xs"
-        >
-          <q-icon name="warning" size="16px" class="q-mr-xs"></q-icon>
-          <span v-text="permission.risk.warning"></span>
-        </div>
-        <p
-          v-for="description of permission.descriptions"
-          :key="description"
-          class="text-caption q-mb-xs"
-          v-text="description"
-        ></p>
-        <p
-          v-for="policy of permission.invoicePolicies"
-          :key="policy.table + ':' + policy.walletField"
-          class="text-caption q-mb-xs"
-          v-text="publicInvoicePolicySentence(policy)"
-        ></p>
-        <ul v-if="permission.fieldGroups.length" class="q-my-sm q-pl-md">
-          <li v-for="group of permission.fieldGroups" :key="group.table">
-            <span v-text="group.table"></span>
-            <ul v-if="group.fields.length" class="q-pl-md">
-              <li
-                v-for="field of group.fields"
-                :key="group.table + ':' + field"
-                v-text="field"
-              ></li>
-            </ul>
-          </li>
-        </ul>
-        <div v-if="permission.extensionAccess.length" class="q-mt-sm">
-          <div
-            class="text-caption text-grey"
-            v-text="$t('extension_permission_extension_api_request_extensions')"
-          ></div>
-          <div
-            v-for="target of permission.extensionAccess"
-            :key="target.id"
-            class="row items-center q-gutter-xs q-mt-xs"
-          >
-            <span class="text-caption" v-text="target.name"></span>
-            <q-badge
-              v-for="access of target.access"
-              :key="target.id + access"
-              color="grey-7"
-              v-text="permissionAccessLabel(access)"
-            ></q-badge>
-          </div>
-        </div>
-        <div v-if="permission.httpHosts.length" class="q-mt-sm">
-          <div
-            class="text-caption text-grey"
-            v-text="$t('extension_permission_http_request_hosts')"
-          ></div>
-          <ul class="q-my-sm q-pl-md">
-            <li
-              v-for="host of permission.httpHosts"
-              :key="host"
-              v-text="host"
-            ></li>
-          </ul>
-        </div>
-      </div>
-    </q-expansion-item>
-  </q-list>
-</template>

lnbits/templates/components/lnbits-wallet-api-docs.vue

@@ -6,9 +6,6 @@
     :content-inset-level="0.5"
   >
     <q-card-section>
-      <q-banner dense rounded class="bg-warning text-black q-mb-md">
-        These keys should be kept safe, sharing them could risk losing funds.
-      </q-banner>
       <q-list>
         <q-item dense class="q-pa-none">
           <q-item-section>

lnbits/templates/pages/admin.vue

@@ -199,7 +199,6 @@
                 >
                   <q-tab-panel name="funding">
                     <lnbits-admin-funding
-                      :active="tab === 'funding'"
                       :is-super-user="isSuperUser"
                       :settings="settings"
                       :form-data="formData"

lnbits/templates/pages/extensions.vue

@@ -460,26 +460,37 @@
     position="top"
     @hide="onManageExtensionDialogHide"
   >
-    <q-card v-if="permissionGrant.show" class="q-pa-md lnbits__dialog-card">
+    <q-card v-if="permissionGrant.show" class="q-pa-lg lnbits__dialog-card">
       <q-card-section>
         <div class="text-h6" v-text="$t('extension_permissions_title')"></div>
-        <q-banner
-          v-if="permissionGrantHasHighRisk()"
-          dense
-          class="bg-red-1 text-red-10 q-mt-md"
-        >
-          <template v-slot:avatar>
-            <q-icon name="warning" color="negative"></q-icon>
-          </template>
-          <span v-text="$t('extension_permissions_high_risk_warning')"></span>
-        </q-banner>
+        <div
+          class="text-body2 q-mt-sm"
+          v-text="$t('extension_permissions_request')"
+        ></div>
       </q-card-section>
 
-      <lnbits-extension-permissions
-        class="q-mt-md"
-        :permissions="permissionGrant.permissions"
-        :extensions="extensions"
-      ></lnbits-extension-permissions>
+      <q-list bordered separator class="q-mt-md">
+        <q-item
+          v-for="permission of permissionGrant.permissions"
+          :key="permission.id"
+        >
+          <q-item-section>
+            <q-item-label>
+              <li><strong v-text="permissionLabel(permission)"></strong></li>
+            </q-item-label>
+            <q-item-label
+              v-if="permissionDescription(permission)"
+              caption
+              v-text="permissionDescription(permission)"
+            ></q-item-label>
+            <q-item-label
+              v-if="permissionPolicyDetails(permission)"
+              caption
+              v-text="permissionPolicyDetails(permission)"
+            ></q-item-label>
+          </q-item-section>
+        </q-item>
+      </q-list>
 
       <div class="row q-mt-lg">
         <q-btn

lnbits/utils/cache.py

@@ -1,8 +1,13 @@
 from __future__ import annotations
 
+import asyncio
 from time import time
 from typing import Any, NamedTuple
 
+from loguru import logger
+
+from lnbits.settings import settings
+
 
 class Cached(NamedTuple):
     value: Any
@@ -17,7 +22,8 @@ class Cache:
     Small caching utility providing simple get/set interface (very much like redis)
     """
 
-    def __init__(self) -> None:
+    def __init__(self, interval: float = 10) -> None:
+        self.interval = interval
         self._values: dict[Any, Cached] = {}
 
     def value(self, key: str) -> Cached | None:
@@ -53,11 +59,16 @@ class Cache:
             self.set(key, value, expiry=expiry)
             return value
 
-    async def invalidate_cache(self):
-        ts = time()
-        expired = [k for k, v in self._values.items() if v.expiry < ts]
-        for k in expired:
-            self._values.pop(k)
+    async def invalidate_forever(self):
+        while settings.lnbits_running:
+            try:
+                await asyncio.sleep(self.interval)
+                ts = time()
+                expired = [k for k, v in self._values.items() if v.expiry < ts]
+                for k in expired:
+                    self._values.pop(k)
+            except Exception:
+                logger.error("Error invalidating cache")
 
 
 cache = Cache()

lnbits/utils/exchange_rates.py

@@ -289,32 +289,7 @@ async def btc_rates(currency: str) -> list[tuple[str, float]]:
     return apply_trimmed_mean_filter(all_rates)
 
 
-async def btc_price_from_aggregator(currency: str) -> float | None:
-    url = settings.lnbits_price_aggregator_url.rstrip("/")
-    try:
-        headers = {"User-Agent": settings.user_agent}
-        async with httpx.AsyncClient(headers=headers) as client:
-            r = await client.get(f"{url}/rate/{currency.upper()}", timeout=3)
-            r.raise_for_status()
-            data = r.json()
-            median = data.get("rates", {}).get("median")
-            if median:
-                return float(median)
-    except Exception as e:
-        logger.warning(f"Failed to fetch price from aggregator {url}: {e}")
-    return None
-
-
 async def btc_price(currency: str) -> float:
-    if (
-        settings.lnbits_price_aggregator_enabled
-        and settings.lnbits_price_aggregator_url
-    ):
-        price = await btc_price_from_aggregator(currency)
-        if price:
-            return price
-        logger.warning("Price aggregator failed, falling back to exchange providers.")
-
     rates = await btc_rates(currency)
     if not rates:
         logger.warning("Could not fetch any Bitcoin price.")

lnbits/utils/logger.py

@@ -41,16 +41,19 @@ def log_server_info():
 
 def initialize_server_websocket_logger() -> Callable:
     super_user_hash = sha256(settings.super_user.encode("utf-8")).hexdigest()
+
     serverlog_queue: asyncio.Queue = asyncio.Queue()
+
+    async def update_websocket_serverlog():
+        while settings.lnbits_running:
+            msg = await serverlog_queue.get()
+            await websocket_updater(super_user_hash, msg)
+
     logger.add(
         lambda msg: serverlog_queue.put_nowait(msg),
         format=Formatter().format,
     )
 
-    async def update_websocket_serverlog():
-        msg = await serverlog_queue.get()
-        await websocket_updater(super_user_hash, msg)
-
     return update_websocket_serverlog
 
 

package.json

@@ -111,7 +111,6 @@
       "js/pages/users.js",
       "js/pages/account.js",
       "js/pages/admin.js",
-      "js/components/admin/lnbits-admin-funding-seed-backup.js",
       "js/components/admin/lnbits-admin-funding.js",
       "js/components/admin/lnbits-admin-funding-sources.js",
       "js/components/admin/lnbits-admin-fiat-providers.js",
@@ -143,7 +142,6 @@
       "js/components/lnbits-theme.js",
       "js/components/lnbits-qrcode-scanner.js",
       "js/components/lnbits-manage-extension-list.js",
-      "js/components/lnbits-extension-permissions.js",
       "js/components/lnbits-manage-wallet-list.js",
       "js/components/lnbits-language-dropdown.js",
       "js/components/lnbits-payment-list.js",

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lnbits"
-version = "1.5.6"
+version = "1.5.5"
 requires-python = ">=3.10,<3.13"
 description = "LNbits, free and open-source Lightning wallet and accounts system."
 authors = [{ name = "Alan Bits", email = "alan@lnbits.com" }]

tests/api/test_admin_api.py

@@ -3,7 +3,6 @@ from pathlib import Path
 import pytest
 from httpx import AsyncClient
 
-from lnbits.core.crud.settings import get_settings_field, set_settings_field
 from lnbits.server import server_restart
 from lnbits.settings import Settings
 
@@ -82,8 +81,7 @@ async def test_admin_audit_monitor_and_test_email(
         headers={"Authorization": f"Bearer {superuser_token}"},
     )
     assert monitor.status_code == 200
-    task_names = [t["name"] for t in monitor.json()]
-    assert any("invoice_listener" in name for name in task_names)
+    assert "invoice_listeners" in monitor.json()
 
     test_email = await client.get(
         "/admin/api/v1/testemail",
@@ -152,15 +150,6 @@ async def test_admin_partial_reset_restart_and_backup(
 async def test_admin_delete_settings_requires_superuser(
     client: AsyncClient, superuser_token: str
 ):
-    await set_settings_field("lnbits_site_title", "Reset me")
-    await set_settings_field("lnbits_backend_wallet_class", "BoltzWallet")
-    await set_settings_field("boltz_mnemonic", "keep boltz seed")
-    await set_settings_field("boltz_mnemonic_backup_confirmed", True)
-    await set_settings_field("phoenixd_mnemonic", "keep phoenixd seed")
-    await set_settings_field("phoenixd_mnemonic_backup_confirmed", True)
-    await set_settings_field("spark_l2_mnemonic", "keep spark seed")
-    await set_settings_field("spark_l2_mnemonic_backup_confirmed", True)
-
     server_restart.clear()
     response = await client.delete(
         "/admin/api/v1/settings",
@@ -168,21 +157,4 @@ async def test_admin_delete_settings_requires_superuser(
     )
     assert response.status_code == 200
     assert server_restart.is_set() is True
-    assert await get_settings_field("lnbits_site_title") is None
-
-    backend_wallet = await get_settings_field("lnbits_backend_wallet_class")
-    boltz_seed = await get_settings_field("boltz_mnemonic")
-    boltz_confirmed = await get_settings_field("boltz_mnemonic_backup_confirmed")
-    phoenixd_seed = await get_settings_field("phoenixd_mnemonic")
-    phoenixd_confirmed = await get_settings_field("phoenixd_mnemonic_backup_confirmed")
-    spark_l2_seed = await get_settings_field("spark_l2_mnemonic")
-    spark_l2_confirmed = await get_settings_field("spark_l2_mnemonic_backup_confirmed")
-    assert backend_wallet and backend_wallet.value == "BoltzWallet"
-    assert boltz_seed and boltz_seed.value == "keep boltz seed"
-    assert boltz_confirmed and boltz_confirmed.value is True
-    assert phoenixd_seed and phoenixd_seed.value == "keep phoenixd seed"
-    assert phoenixd_confirmed and phoenixd_confirmed.value is True
-    assert spark_l2_seed and spark_l2_seed.value == "keep spark seed"
-    assert spark_l2_confirmed and spark_l2_confirmed.value is True
-
     server_restart.clear()

tests/regtest/test_real_invoice.py

@@ -13,13 +13,10 @@ from lnbits.core.services import (
     fee_reserve_total,
     get_balance_delta,
 )
-from lnbits.core.services.payments import (
-    pay_invoice,
-    update_wallet_balance,
-)
+from lnbits.core.services.payments import pay_invoice, update_wallet_balance
 from lnbits.core.services.users import create_user_account
 from lnbits.exceptions import PaymentError
-from lnbits.task_manager import task_manager
+from lnbits.tasks import create_task, wait_for_paid_invoices
 from lnbits.wallets import get_funding_source
 
 from ..helpers import is_fake, is_regtest
@@ -163,11 +160,12 @@ async def test_create_real_invoice(
     assert not payment_status["paid"]
 
     on_paid_mock = mocker.AsyncMock()
-    task_manager.register_invoice_listener(on_paid_mock, "test_create_invoice")
+    create_task(wait_for_paid_invoices("test_create_invoice", on_paid_mock)())
 
     pay_real_invoice(invoice["bolt11"])
 
     await asyncio.sleep(1)
+
     assert on_paid_mock.call_count == 1
     payment = on_paid_mock.call_args_list[0][0][0]
 
@@ -395,11 +393,12 @@ async def test_receive_real_invoice_set_pending_and_check_state(
     assert not payment_status["paid"]
 
     on_paid_mock = mocker.AsyncMock()
-    task_manager.register_invoice_listener(on_paid_mock, "test_create_invoice")
+    create_task(wait_for_paid_invoices("test_create_invoice", on_paid_mock)())
 
     pay_real_invoice(invoice["bolt11"])
 
     await asyncio.sleep(1)
+
     assert on_paid_mock.call_count == 1
     payment = on_paid_mock.call_args_list[0][0][0]
 
@@ -413,8 +412,6 @@ async def test_receive_real_invoice_set_pending_and_check_state(
     payment_status = response.json()
     assert payment_status["paid"]
 
-    assert payment
-
     # set the incoming invoice to pending
     payment.status = PaymentState.PENDING
     await update_payment(payment)

tests/unit/test_cache.py

@@ -5,7 +5,6 @@ import pytest
 from pytest_mock.plugin import MockerFixture
 
 from lnbits.settings import Settings
-from lnbits.task_manager import task_manager
 from lnbits.utils.cache import Cache, Cached
 
 key = "foo"
@@ -14,10 +13,11 @@ value = "bar"
 
 @pytest.fixture
 async def cache():
-    cache = Cache()
-    task = task_manager.create_permanent_task(cache.invalidate_cache, interval=1)
+    cache = Cache(interval=0.1)
+
+    task = asyncio.create_task(cache.invalidate_forever())
     yield cache
-    task_manager.cancel_task(task)
+    task.cancel()
 
 
 @pytest.mark.anyio
@@ -31,13 +31,13 @@ async def test_cache_get_set(cache):
 @pytest.mark.anyio
 async def test_cache_expiry(cache):
     # gets expired by `get` call
-    cache.set(key, value, expiry=1)
-    await asyncio.sleep(2)
+    cache.set(key, value, expiry=0.01)
+    await asyncio.sleep(0.02)
     assert not cache.get(key)
 
     # gets expired by invalidation task
-    cache.set(key, value, expiry=1)
-    await asyncio.sleep(2)
+    cache.set(key, value, expiry=0.1)
+    await asyncio.sleep(0.2)
     assert key not in cache._values
     assert not cache.get(key)
 
@@ -94,33 +94,23 @@ async def test_cache_pop_expired_returns_default(cache):
 async def test_invalidate_forever_logs_and_recovers_from_errors(
     settings: Settings, mocker: MockerFixture
 ):
-    test_cache = Cache()
+    test_cache = Cache(interval=0)
+    logger_error = mocker.patch("lnbits.utils.cache.logger.error")
     original_running = settings.lnbits_running
     calls = 0
 
-    original_invalidate = test_cache.invalidate_cache
-
-    async def fake_invalidate():
+    async def fake_sleep(_interval):
         nonlocal calls
         calls += 1
         if calls == 1:
             raise RuntimeError("boom")
         settings.lnbits_running = False
-        await original_invalidate()
 
-    mocker.patch.object(test_cache, "invalidate_cache", side_effect=fake_invalidate)
-    mocker.patch("lnbits.task_manager.asyncio.sleep")
-    logger_error = mocker.patch("lnbits.task_manager.logger.error")
-
-    bg_task = None
     try:
         settings.lnbits_running = True
-        bg_task = task_manager.create_permanent_task(test_cache.invalidate_cache)
-        await bg_task.task
+        mocker.patch("lnbits.utils.cache.asyncio.sleep", side_effect=fake_sleep)
+        await test_cache.invalidate_forever()
     finally:
         settings.lnbits_running = original_running
-        if bg_task:
-            task_manager.cancel_task(bg_task)
 
-    assert logger_error.called
-    assert calls == 2
+    logger_error.assert_called_once_with("Error invalidating cache")

tests/unit/test_exchange_rates.py

@@ -275,10 +275,6 @@ async def test_btc_rates_skips_unsupported_and_failing_providers(
 
 @pytest.mark.anyio
 async def test_btc_price_handles_empty_single_and_multiple_rates(mocker: MockerFixture):
-    mocker.patch(
-        "lnbits.utils.exchange_rates.btc_price_from_aggregator",
-        AsyncMock(return_value=None),
-    )
     mocker.patch("lnbits.utils.exchange_rates.btc_rates", AsyncMock(return_value=[]))
     assert await btc_price("usd") == 0.0
 

tests/unit/test_fiat_providers.py

@@ -1717,9 +1717,7 @@ async def test_check_fiat_status_handles_internal_states(mocker: MockerFixture):
         "lnbits.core.services.fiat_providers.get_fiat_provider",
         AsyncMock(return_value=provider),
     )
-    queue_put = mocker.patch(
-        "lnbits.task_manager.task_manager.internal_invoice_queue.put_nowait"
-    )
+    queue_put = mocker.patch("lnbits.tasks.internal_invoice_queue.put", AsyncMock())
 
     success_status = await check_fiat_status(
         Payment(
@@ -1736,8 +1734,7 @@ async def test_check_fiat_status_handles_internal_states(mocker: MockerFixture):
     )
 
     assert success_status.success is True
-    queue_put.assert_called_once()
-    assert queue_put.call_args[0][0].checking_id == "fiat_pending"
+    queue_put.assert_awaited_once_with("fiat_pending")
 
     await check_fiat_status(
         Payment(
@@ -1752,7 +1749,7 @@ async def test_check_fiat_status_handles_internal_states(mocker: MockerFixture):
             extra={"fiat_checking_id": "stripe_checking_id"},
         )
     )
-    assert queue_put.call_count == 1
+    assert queue_put.await_count == 1
 
 
 @pytest.mark.anyio
@@ -1789,9 +1786,7 @@ async def test_check_fiat_status_persists_successful_payment(
         "lnbits.fiat.StripeWallet.get_invoice_status",
         AsyncMock(return_value=FiatPaymentStatus(paid=True)),
     )
-    queue_put = mocker.patch(
-        "lnbits.task_manager.task_manager.internal_invoice_queue.put_nowait"
-    )
+    queue_put = mocker.patch("lnbits.tasks.internal_invoice_queue.put", AsyncMock())
 
     status = await check_fiat_status(payment)
 
@@ -1799,7 +1794,7 @@ async def test_check_fiat_status_persists_successful_payment(
     assert payment.status == PaymentState.SUCCESS
     updated_payment = await get_payment(payment.checking_id)
     assert updated_payment.status == PaymentState.SUCCESS
-    queue_put.assert_called_once_with(payment)
+    queue_put.assert_awaited_once_with(payment.checking_id)
 
 
 @pytest.mark.anyio

tests/unit/test_pay_invoice.py

@@ -12,12 +12,15 @@ from lnbits.core.crud import create_wallet, get_standalone_payment, get_wallet
 from lnbits.core.crud.payments import get_payment, get_payments_paginated
 from lnbits.core.models import PaymentState, Wallet
 from lnbits.core.services import create_invoice, create_user_account, pay_invoice
-from lnbits.core.services.payments import (
-    update_wallet_balance,
-)
+from lnbits.core.services.payments import update_wallet_balance
 from lnbits.exceptions import InvoiceError, PaymentError
 from lnbits.settings import Settings
-from lnbits.task_manager import task_manager
+from lnbits.tasks import (
+    create_task,
+    internal_invoice_listener,
+    internal_invoice_queue,
+    wait_for_paid_invoices,
+)
 from lnbits.wallets.base import PaymentResponse
 from lnbits.wallets.fake import FakeWallet
 
@@ -234,30 +237,24 @@ async def test_notification_for_internal_payment(
     test_name = "test_notification_for_internal_payment"
 
     # Drain stale items left by session-scoped fixtures (e.g. update_wallet_balance)
-    while not task_manager.internal_invoice_queue.empty():
+    while not internal_invoice_queue.empty():
         try:
-            task_manager.internal_invoice_queue.get_nowait()
+            internal_invoice_queue.get_nowait()
         except asyncio.QueueEmpty:
             break
 
     on_paid_mock = mocker.AsyncMock()
-    # create_task(internal_invoice_listener())
-
-    task_manager.register_invoice_listener(on_paid_mock, test_name)
-
+    create_task(internal_invoice_listener())
+    create_task(wait_for_paid_invoices(test_name, on_paid_mock)())
     payment = await create_invoice(
         wallet_id=to_wallet.id,
         amount=123,
         memo=test_name,
         webhook="http://test.404.lnbits.com",
     )
-    paid_payment = await pay_invoice(
+    await pay_invoice(
         wallet_id=to_wallet.id, payment_request=payment.bolt11, extra={"tag": "lnurlp"}
     )
-    assert paid_payment.status == PaymentState.SUCCESS.value
-    assert paid_payment.bolt11 == payment.bolt11
-    assert paid_payment.amount == -123_000
-
     await asyncio.sleep(1)
 
     assert on_paid_mock.call_count == 1
@@ -267,8 +264,6 @@ async def test_notification_for_internal_payment(
     assert _payment.status == PaymentState.SUCCESS.value
     assert _payment.bolt11 == payment.bolt11
     assert _payment.amount == 123_000
-    assert _payment.checking_id == payment.checking_id
-
     updated_payment = await get_payment(_payment.checking_id)
     assert (
         updated_payment.webhook_status is not None

tests/unit/test_services_payments.py

@@ -197,7 +197,8 @@ async def test_update_wallet_balance_validates_credit_and_debit(
 
         settings.lnbits_wallet_limit_max_balance = 0
         queue_mock = mocker.patch(
-            "lnbits.task_manager.task_manager.internal_invoice_queue.put_nowait",
+            "lnbits.tasks.internal_invoice_queue_put",
+            mocker.AsyncMock(),
         )
 
         await update_wallet_balance(wallet, 5)
@@ -211,8 +212,7 @@ async def test_update_wallet_balance_validates_credit_and_debit(
     ]
     assert credit_payments
     assert credit_payments[0].status == PaymentState.SUCCESS
-    queue_mock.assert_called_once()
-    assert queue_mock.call_args[0][0].checking_id == credit_payments[0].checking_id
+    queue_mock.assert_awaited_once_with(credit_payments[0].checking_id)
 
 
 @pytest.mark.anyio

tests/wallets/test_nwc_wallets.py

@@ -1,4 +1,3 @@
-import asyncio
 import base64
 import hashlib
 import json
@@ -13,7 +12,7 @@ from Cryptodome.Util.Padding import pad, unpad
 from websockets import ServerConnection
 from websockets import serve as ws_serve
 
-from lnbits.wallets.nwc import NWCConnection, NWCWallet
+from lnbits.wallets.nwc import NWCWallet
 from tests.wallets.helpers import (
     WalletTest,
     build_test_id,
@@ -100,8 +99,6 @@ async def handle(  # noqa: C901
                     event,
                 )
                 await websocket.send(json.dumps(["EVENT", sub_id, event]))
-            elif 23195 in kinds:
-                assert sub_filter["authors"] == [mock_settings["service_public_key"]]
         elif msg[0] == "EVENT":
             event = msg[1]
             decrypted_content = decrypt_content(
@@ -180,129 +177,6 @@ async def run(data: WalletTest):
             await nwcwallet.cleanup()
 
 
-@pytest.mark.anyio
-async def test_nwc_rejects_event_from_unexpected_pubkey(mocker):
-    async def _noop(*args, **kwargs):
-        return None
-
-    mocker.patch("lnbits.wallets.nwc.NWCConnection._connect_to_relay", new=_noop)
-    mocker.patch("lnbits.wallets.nwc.NWCConnection._handle_timeouts", new=_noop)
-
-    service_private_key = PrivateKey()
-    service_public_key = service_private_key.public_key.format().hex()[2:]
-    attacker_private_key = PrivateKey()
-    attacker_public_key = attacker_private_key.public_key.format().hex()[2:]
-    account_private_key = PrivateKey()
-
-    conn = NWCConnection(
-        service_public_key,
-        account_private_key.secret.hex(),
-        "ws://127.0.0.1:8555",
-    )
-    try:
-        event = {
-            "kind": 23195,
-            "content": "{}",
-            "created_at": int(time.time()),
-            "tags": [["e", "request-event-id"]],
-        }
-        sign_event(attacker_public_key, attacker_private_key.secret.hex(), event)
-
-        with pytest.raises(Exception, match="Invalid event signature"):
-            await conn._on_event_message(["EVENT", "subid", event])
-    finally:
-        await conn.close()
-
-
-@pytest.mark.anyio
-async def test_nwc_marks_pending_invoice_settled_only_once():
-    wallet = NWCWallet.__new__(NWCWallet)
-    wallet.pending_invoice_details = {"checking-id": {"checking_id": "checking-id"}}
-    wallet.pending_invoices = ["checking-id"]
-    wallet.paid_invoices_queue = asyncio.Queue(0)
-
-    wallet._mark_invoice_settled("checking-id", source="notification")
-    wallet._mark_invoice_settled("checking-id", source="notification")
-
-    assert wallet.paid_invoices_queue.qsize() == 1
-    assert await wallet.paid_invoices_queue.get() == "checking-id"
-
-
-@pytest.mark.anyio
-async def test_nwc_registers_notification_subscriptions(mocker):
-    async def _noop(*args, **kwargs):
-        return None
-
-    mocker.patch("lnbits.wallets.nwc.NWCConnection._connect_to_relay", new=_noop)
-    mocker.patch("lnbits.wallets.nwc.NWCConnection._handle_timeouts", new=_noop)
-
-    service_private_key = PrivateKey()
-    service_public_key = service_private_key.public_key.format().hex()[2:]
-    account_private_key = PrivateKey()
-
-    conn = NWCConnection(
-        service_public_key,
-        account_private_key.secret.hex(),
-        "ws://127.0.0.1:8555",
-    )
-    send_mock = mocker.patch.object(conn, "_send", mocker.AsyncMock())
-
-    try:
-        await conn._subscribe_to_notifications()
-
-        assert len(conn.notification_subscription_ids) == 2
-        assert len(conn.subscriptions) == 2
-        assert set(conn.subscriptions.keys()) == conn.notification_subscription_ids
-        assert all(
-            subscription["method"] == "notification_sub"
-            and subscription["event_id"] == subscription["sub_id"]
-            for subscription in conn.subscriptions.values()
-        )
-        assert send_mock.await_count == 2
-    finally:
-        await conn.close()
-
-
-@pytest.mark.anyio
-async def test_nwc_spreads_fallback_lookups_with_cooldown(mocker):
-    def _schedule_next_lookup(
-        invoice: dict[str, object], now: float | None = None
-    ) -> None:
-        assert now is not None
-        invoice["next_lookup_at"] = now + 1
-
-    wallet = NWCWallet.__new__(NWCWallet)
-    wallet.shutdown = False
-    wallet.pending_invoices = ["checking-1", "checking-2"]
-    wallet.pending_invoice_details = {
-        "checking-1": {
-            "checking_id": "checking-1",
-            "next_lookup_at": 0.0,
-            "lookup_attempts": 0,
-        },
-        "checking-2": {
-            "checking_id": "checking-2",
-            "next_lookup_at": 0.0,
-            "lookup_attempts": 0,
-        },
-    }
-    wallet.pending_invoices_lookup_cooldown = 1.0
-    wallet._is_shutting_down = lambda: False
-    wallet._payment_data_is_settled = lambda payment_data: False
-    wallet._cache_payment_data = lambda *args, **kwargs: None
-    wallet._schedule_next_lookup = _schedule_next_lookup
-    wallet.conn = mocker.Mock()
-    wallet.conn.get_info = mocker.AsyncMock()
-    wallet.conn.supports_method = mocker.Mock(return_value=True)
-    wallet.conn.call = mocker.AsyncMock(return_value={"settled_at": None})
-    sleep_mock = mocker.patch("lnbits.wallets.nwc.asyncio.sleep", mocker.AsyncMock())
-
-    await wallet._run_fallback_lookups(100.0)
-
-    assert wallet.conn.call.await_count == 2
-    sleep_mock.assert_awaited_once_with(1.0)
-
-
 @pytest.mark.anyio
 @pytest.mark.parametrize(
     "test_data",

tools/codegen/extension_sdk_typescript.py

@@ -10,24 +10,24 @@ from typing import Any, Literal, Union, get_args, get_origin
 
 from pydantic import BaseModel
 
-from lnbits.core.wasm_ext import (
+from lnbits.core.extensions import (
+    ExtensionAPI,
     ExtensionAPIMethod,
-    ExtensionHostAPI,
     get_extension_api_method,
     list_extension_api_methods,
 )
 
 
 def generate_typescript_sdk(
-    api_cls: type[ExtensionHostAPI] | None = None,
+    api_cls: type[ExtensionAPI] | None = None,
     method_ids: Sequence[str] | None = None,
 ) -> str:
-    api_cls = api_cls or ExtensionHostAPI
+    api_cls = api_cls or ExtensionAPI
     methods = _select_methods(api_cls, method_ids)
     models = _collect_models(methods)
 
     lines = [
-        "/* Generated by LNbits ExtensionHostAPI codegen. */",
+        "/* Generated by LNbits ExtensionAPI codegen. */",
         "/* Do not edit by hand. */",
         "",
         "export type MaybePromise<T> = T | Promise<T>",
@@ -52,7 +52,7 @@ def generate_typescript_sdk(
 
 def write_typescript_sdk(
     path: str | Path,
-    api_cls: type[ExtensionHostAPI] | None = None,
+    api_cls: type[ExtensionAPI] | None = None,
     method_ids: Sequence[str] | None = None,
 ) -> None:
     Path(path).write_text(
@@ -61,7 +61,7 @@ def write_typescript_sdk(
 
 
 def _select_methods(
-    api_cls: type[ExtensionHostAPI], method_ids: Sequence[str] | None
+    api_cls: type[ExtensionAPI], method_ids: Sequence[str] | None
 ) -> list[ExtensionAPIMethod]:
     if not method_ids:
         return list_extension_api_methods(api_cls)
@@ -342,13 +342,13 @@ def _is_empty_model(model: type[BaseModel]) -> bool:
 
 def main(argv: Sequence[str] | None = None) -> int:
     parser = argparse.ArgumentParser(
-        description="Generate a TypeScript SDK from the LNbits ExtensionHostAPI."
+        description="Generate a TypeScript SDK from the LNbits ExtensionAPI."
     )
     parser.add_argument(
         "--method",
         action="append",
         dest="method_ids",
-        help="ExtensionHostAPI method id to include. Can be passed multiple times.",
+        help="ExtensionAPI method id to include. Can be passed multiple times.",
     )
     parser.add_argument(
         "--out",

uv.lock

@@ -1288,7 +1288,7 @@ wheels = [
 
 [[package]]
 name = "lnbits"
-version = "1.5.6"
+version = "1.5.5"
 source = { editable = "." }
 dependencies = [
     { name = "aiosqlite" },