feat: download specific release

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.env.example

@@ -55,7 +55,7 @@ LNBITS_EXTENSIONS_DEFAULT_INSTALL="tpos"
 # LNBITS_EXT_GITHUB_TOKEN=github_pat_xxxxxxxxxxxxxxxxxx
 
 # which fundingsources are allowed in the admin ui
-# LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, BlinkWallet, AlbyWallet, ZBDWallet, PhoenixdWallet, OpenNodeWallet, NWCWallet, BreezSdkWallet, BoltzWallet, StrikeWallet, CLNRestWallet"
+# LNBITS_ALLOWED_FUNDING_SOURCES="VoidWallet, FakeWallet, CoreLightningWallet, CoreLightningRestWallet, LndRestWallet, EclairWallet, LndWallet, LnTipsWallet, LNPayWallet, LNbitsWallet, BlinkWallet, AlbyWallet, ZBDWallet, PhoenixdWallet, OpenNodeWallet, NWCWallet, BreezSdkWallet, BoltzWallet, StrikeWallet, CLNRestWallet, SparkWallet, LightsparkSparkWallet"
 
 # uvicorn variable, allow https behind a proxy
 # IMPORTANT: this also needs the webserver to be configured to forward the headers
@@ -187,6 +187,8 @@ BOLTZ_CLIENT_MACAROON="/home/bob/.boltz/macaroons/admin.macaroon"
 # HEXSTRING instead of path also possible
 BOLTZ_CLIENT_CERT="/home/bob/.boltz/tls.cert"
 
+# TODO: add Spark
+
 # StrikeWallet
 STRIKE_API_ENDPOINT=https://api.strike.me/v1
 STRIKE_API_KEY=YOUR_STRIKE_API_KEY

docs/guide/funding-sources-table.md

@@ -57,7 +57,7 @@ Below is a side-by-side comparison of Lightning funding sources you can use with
 | **LN.tips**                    | Custodial/Self-Custodial | Depends on provider | Medium                         | ❌                        | Low               | Provider-managed         | Moderate          | Low                    | Transaction fees may apply                   | Medium          | Simple hosted service; use LN.tips API as your backend.                                    |
 | **Fake Wallet**                | Testing (simulated)      | ❌                  | Low                            | ❌                        | N/A               | N/A                      | Easy              | Low                    | None (test only)                             | N/A             | For testing only; mints accounting units in LNbits (no real sats, unit name configurable). |
 
----
+## TODO: add Spark
 
 ### Notes for readers
 

docs/guide/wallets.md

@@ -52,7 +52,7 @@ A backend wallet is selected and configured entirely through LNbits environment
 
 ### CLNRest (using [runes](https://docs.corelightning.org/reference/lightning-createrune))
 
-[Core Lightning REST API docs](https://docs.corelightning.org/docs/rest)  
+[Core Lightning REST API docs](https://docs.corelightning.org/docs/rest)
 Should also work with the [Rust version of CLNRest](https://github.com/daywalker90/clnrest-rs)
 
 **Environment variables**
@@ -338,6 +338,8 @@ Configure in the admin UI or via env vars:
 
 <a id="strike"></a>
 
+## TODO: add Spark
+
 ## Strike (alpha)
 
 Custodial provider integrated via **Strike OAuth Connect** (OAuth 2.0 / OIDC). Authenticate a Strike user in your app, then call Strike APIs on the user’s behalf once scopes are granted. Requires a Strike business account, registered OAuth client, minimal scopes, and login/logout redirect URLs.

lnbits/core/models/extensions.py

@@ -269,10 +269,30 @@ class ExtensionRelease(BaseModel):
     async def get_github_releases(cls, org: str, repo: str) -> list[ExtensionRelease]:
         try:
             github_releases = await cls.fetch_github_releases(org, repo)
-            return [
+            extension_releases = [
                 ExtensionRelease.from_github_release(f"{org}/{repo}", r)
                 for r in github_releases
             ]
+            for release in extension_releases:
+                if not release.details_link:
+                    continue
+                try:
+                    config = await ExtensionConfig.fetch_github_release_config(
+                        org, repo, release.version
+                    )
+                except Exception as e:
+                    logger.warning(e)
+                    config = None
+                if not config:
+                    continue
+
+                release.min_lnbits_version = config.min_lnbits_version
+                release.max_lnbits_version = config.max_lnbits_version
+                release.is_version_compatible = config.is_version_compatible()
+
+                release.icon = icon_to_github_url(f"{org}/{repo}", config.tile)
+
+            return extension_releases
         except Exception as e:
             logger.warning(e)
             return []

lnbits/core/models/extensions_builder.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import json
+import random
+import uuid
 from datetime import datetime, timedelta, timezone
 from typing import Any, Literal
 
@@ -55,6 +57,29 @@ class DataField(BaseModel):
             field_type += ' = "sat"'
         return f"{field_name}: {field_type}"
 
+    def field_to_random_value(self) -> str:
+        field_name = camel_to_snake(self.name)
+        field_value: Any = f'"{self.type}"'
+        if self.type == "json":
+            field_value = '"{}"'
+        elif self.type == "wallet":
+            field_value = f'"{uuid.uuid4()}"'
+        elif self.type == "currency":
+            field_value = '"sat"'
+        elif self.type in ["str", "text"]:
+            field_value = f'"{field_name}_{urlsafe_short_hash()}"'
+        elif self.type == "int":
+            field_value = random.randint(1, 100)  # noqa: S311
+        elif self.type == "float":
+            field_value = random.uniform(1.0, 100.0)  # noqa: S311
+        elif self.type == "bool":
+            field_value = random.choice([True, False])  # noqa: S311
+        elif self.type == "datetime":
+            random_days = random.randint(-30, 30)  # noqa: S311
+            random_date = datetime.now(timezone.utc) - timedelta(days=random_days)
+            field_value = f"""datetime.fromisoformat("{random_date.isoformat()}")"""
+        return f"{field_name} = {field_value},"
+
     def field_to_js(self) -> str:
         field_name = camel_to_snake(self.name)
         default_value = "null"

lnbits/core/services/assets.py

@@ -3,6 +3,7 @@ import io
 from uuid import uuid4
 
 from fastapi import UploadFile
+from loguru import logger
 from PIL import Image
 
 from lnbits.core.crud.assets import create_asset, get_user_assets_count
@@ -29,17 +30,7 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
             f"File limit of {settings.lnbits_max_asset_size_mb}MB exceeded."
         )
 
-    image = Image.open(io.BytesIO(contents))
-
-    thumbnail_width = min(256, settings.lnbits_asset_thumbnail_width)
-    thumbnail_height = min(256, settings.lnbits_asset_thumbnail_height)
-    image.thumbnail((thumbnail_width, thumbnail_height))
-
-    # Save thumbnail to an in-memory buffer
-    thumb_buffer = io.BytesIO()
-    thumbnail_format = settings.lnbits_asset_thumbnail_format or "PNG"
-    image.save(thumb_buffer, format=thumbnail_format)
-    thumb_buffer.seek(0)
+    thumb_buffer = thumbnail_from_bytes(contents)
 
     asset = Asset(
         id=uuid4().hex,
@@ -48,9 +39,32 @@ async def create_user_asset(user_id: str, file: UploadFile, is_public: bool) ->
         is_public=is_public,
         name=file.filename or "unnamed",
         size_bytes=len(contents),
-        thumbnail_base64=base64.b64encode(thumb_buffer.getvalue()).decode("utf-8"),
+        thumbnail_base64=(
+            base64.b64encode(thumb_buffer.getvalue()).decode("utf-8")
+            if thumb_buffer
+            else None
+        ),
         data=contents,
     )
 
     await create_asset(asset)
     return asset
+
+
+def thumbnail_from_bytes(contents: bytes) -> io.BytesIO | None:
+    try:
+        image = Image.open(io.BytesIO(contents))
+
+        thumbnail_width = min(256, settings.lnbits_asset_thumbnail_width)
+        thumbnail_height = min(256, settings.lnbits_asset_thumbnail_height)
+        image.thumbnail((thumbnail_width, thumbnail_height))
+
+        # Save thumbnail to an in-memory buffer
+        thumb_buffer = io.BytesIO()
+        thumbnail_format = settings.lnbits_asset_thumbnail_format or "PNG"
+        image.save(thumb_buffer, format=thumbnail_format)
+        thumb_buffer.seek(0)
+        return thumb_buffer
+    except Exception as exc:
+        logger.warning(f"Failed to create thumbnail: {exc}")
+        return None

lnbits/core/services/extensions_builder.py

@@ -20,6 +20,7 @@ from lnbits.helpers import (
     camel_to_words,
     download_url,
     lowercase_first_letter,
+    snake_to_camel,
 )
 from lnbits.settings import settings
 
@@ -195,13 +196,29 @@ def _copy_ext_stub_to_build_dir(
     ext_build_dir = Path(working_dir, new_ext_id, working_dir_name, new_ext_id)
     shutil.rmtree(ext_build_dir, True)
 
-    shutil.copytree(ext_stub_cache_dir, ext_build_dir)
+    shutil.copytree(
+        ext_stub_cache_dir,
+        ext_build_dir,
+        ignore=shutil.ignore_patterns(
+            "__pycache__",
+            ".git",
+            ".env",
+            ".venv",
+            "*.env",
+            "*.log",
+            "node_modules",
+            ".mypy_cache",
+            ".pytest_cache",
+            ".ruff_cache",
+        ),
+    )
     return ext_build_dir
 
 
 def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None:
     parsed_data = _parse_extension_data(data)
-    for py_file in py_files:
+    test_files = [f"tests/{p.name}" for p in Path(ext_stub_dir, "tests").glob("*.py")]
+    for py_file in py_files + test_files:
         template_path = Path(ext_stub_dir, py_file).as_posix()
         rederer = _render_file(template_path, parsed_data)
         with open(template_path, "w", encoding="utf-8") as f:
@@ -209,7 +226,7 @@ def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None
 
         _remove_lines_with_string(template_path, remove_line_marker)
 
-    template_path = Path(ext_stub_dir, "static", "js", "index.js").as_posix()
+    template_path = Path(ext_stub_dir, "static", "index.js").as_posix()
     rederer = _render_file(
         template_path, {"preview": data.preview_action, **parsed_data}
     )
@@ -234,9 +251,7 @@ def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None
         "settingsFormDialog.data",
         ext_stub_dir,
     )
-    template_path = Path(
-        ext_stub_dir, "templates", "extension_builder_stub", "index.html"
-    ).as_posix()
+    template_path = Path(ext_stub_dir, "static", "index.vue").as_posix()
     rederer = _render_file(
         template_path,
         {
@@ -263,12 +278,12 @@ def _replace_jinja_placeholders(data: ExtensionData, ext_stub_dir: Path) -> None
         "publicClientData",
         ext_stub_dir,
     )
-    public_template_path = Path(
-        ext_stub_dir, "templates", "extension_builder_stub", "public_page.html"
-    )
+    public_template_path = Path(ext_stub_dir, "static", "public_page.vue")
+    public_component_path = Path(ext_stub_dir, "static", "public_page.js")
     template_path = public_template_path.as_posix()
     if not data.public_page.has_public_page:
         public_template_path.unlink(missing_ok=True)
+        public_component_path.unlink(missing_ok=True)
     else:
         rederer = _render_file(
             template_path,
@@ -308,8 +323,10 @@ def zip_directory(source_dir, zip_path):
 
 def _rename_extension_builder_stub(data: ExtensionData, extension_dir: Path) -> None:
     extension_dir_path = extension_dir.as_posix()
+    # the order of fields is important, do not chage
     rename_values = {
         "extension_builder_stub_name": data.name,
+        "extension_builder_stub_camel_name": snake_to_camel(data.id, True),
         "extension_builder_stub_short_description": data.short_description or "",
         "extension_builder_stub": data.id,
         "OwnerData": data.owner_data.name,
@@ -328,7 +345,7 @@ def _rename_extension_builder_stub(data: ExtensionData, extension_dir: Path) ->
             directory=extension_dir_path,
             old_text=old_text,
             new_text=new_text,
-            file_extensions=[".py", ".js", ".html", ".md", ".json", ".toml"],
+            file_extensions=[".py", ".js", ".vue", ".html", ".md", ".json", ".toml"],
         )
 
     _rename_files_and_dirs_in_directory(
@@ -406,6 +423,7 @@ def _parse_extension_data(data: ExtensionData) -> dict:
         "owner_data": {
             "name": data.owner_data.name,
             "editable": data.owner_data.editable,
+            "fields": [field.name for field in data.owner_data.fields],
             "js_fields": [
                 field.field_to_js()
                 for field in data.owner_data.fields
@@ -432,6 +450,18 @@ def _parse_extension_data(data: ExtensionData) -> dict:
             ],
             "db_fields": [field.field_to_db() for field in data.owner_data.fields],
             "all_fields": [field.field_to_py() for field in data.owner_data.fields],
+            "random_fields_values": [
+                field.field_to_random_value() for field in data.owner_data.fields
+            ],
+            "public_fields": [
+                field.field_to_py()
+                for field in data.owner_data.fields
+                if field.name
+                in [
+                    data.public_page.owner_data_fields.name,
+                    data.public_page.owner_data_fields.description,
+                ]
+            ],
         },
         "client_data": {
             "name": data.client_data.name,
@@ -457,6 +487,9 @@ def _parse_extension_data(data: ExtensionData) -> dict:
             ],
             "db_fields": [field.field_to_db() for field in data.client_data.fields],
             "all_fields": [field.field_to_py() for field in data.client_data.fields],
+            "random_fields_values": [
+                field.field_to_random_value() for field in data.client_data.fields
+            ],
         },
         "settings_data": {
             "enabled": data.settings_data.enabled,
@@ -536,7 +569,7 @@ def _rename_files_and_dirs_in_directory(directory, old_text, new_text):
                     logger.warning(f"Failed to rename directory {old_dir_path}: {e}")
 
 
-def _is_excluded_dir(path):
+def _is_excluded_dir(path: str) -> bool:
     for excluded_dir in excluded_dirs:
         if path.startswith(excluded_dir):
             return True

lnbits/core/views/asset_api.py

@@ -57,11 +57,11 @@ async def api_get_asset(
 
 
 @asset_router.get(
-    "/{asset_id}/binary",
-    name="Get user asset binary",
-    summary="Get user asset binary data by ID",
+    "/{asset_id}/data",
+    name="Get user asset data",
+    summary="Get user asset data data by ID",
 )
-async def api_get_asset_binary(
+async def api_get_asset_data(
     asset_id: str,
     user_id: str | None = Depends(optional_user_id),
 ) -> Response:

lnbits/core/views/auth_api.py

@@ -4,9 +4,10 @@ import json
 from collections.abc import Callable
 from http import HTTPStatus
 from time import time
+from typing import Annotated
 from uuid import uuid4
 
-from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi import APIRouter, Cookie, Depends, HTTPException, Request
 from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi_sso.sso.base import OpenID, SSOBase
 from loguru import logger
@@ -29,6 +30,7 @@ from lnbits.core.services.users import update_user_account
 from lnbits.decorators import (
     access_token_payload,
     check_account_exists,
+    check_admin,
     check_user_exists,
 )
 from lnbits.helpers import (
@@ -120,6 +122,63 @@ async def login_usr(data: LoginUsr) -> JSONResponse:
     return _auth_success_response(account.username, account.id, account.email)
 
 
+@auth_router.post("/impersonate", description="Login via the User ID of another user")
+async def impersonate_user(
+    data: LoginUsr,
+    user: User = Depends(check_admin),
+    cookie_access_token: Annotated[str | None, Cookie()] = None,
+) -> JSONResponse:
+    if not cookie_access_token:
+        raise HTTPException(
+            HTTPStatus.UNAUTHORIZED, "Only cookie based impersonation is allowed."
+        )
+    if data.usr == user.id:
+        raise HTTPException(HTTPStatus.FORBIDDEN, "You cannot impersonate yourself.")
+    if settings.is_admin_user(data.usr):
+        # this check includes the superuser
+        raise HTTPException(
+            HTTPStatus.FORBIDDEN, "You cannot impersonate another admin user."
+        )
+
+    account = await get_account(data.usr)
+    if not account:
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "User ID does not exist.")
+
+    response = _auth_success_response(account.username, account.id, account.email)
+
+    max_age = settings.auth_token_expire_minutes * 60
+    response.set_cookie(
+        "admin_access_token", cookie_access_token, httponly=True, max_age=max_age
+    )
+    response.set_cookie("is_lnbits_user_impersonated", "true", max_age=max_age)
+    return response
+
+
+@auth_router.delete(
+    "/impersonate", description="Stop impersonation and go back to admin"
+)
+async def stop_impersonate_user(
+    user: User = Depends(check_user_exists),
+    admin_access_token: Annotated[str | None, Cookie()] = None,
+) -> JSONResponse:
+    if not admin_access_token:
+        raise HTTPException(
+            HTTPStatus.UNAUTHORIZED,
+            "No admin access token found to stop impersonation.",
+        )
+    response = JSONResponse(
+        {"access_token": admin_access_token, "token_type": "bearer"}
+    )
+    max_age = settings.auth_token_expire_minutes * 60
+    response.set_cookie(
+        "cookie_access_token", admin_access_token, httponly=True, max_age=max_age
+    )
+    response.delete_cookie("admin_access_token")
+    response.delete_cookie("is_access_token_expired")
+    response.delete_cookie("is_lnbits_user_impersonated")
+    return response
+
+
 @auth_router.get("/acl")
 async def api_get_user_acls(
     request: Request,

lnbits/core/views/generic.py

@@ -42,54 +42,38 @@ async def robots():
 
 
 @generic_router.get(
-    "/extensions/builder/preview/{ext_id}",
+    "/extensions/builder/preview/{ext_id}/{resource}",
     name="extensions builder",
     dependencies=[Depends(check_extension_builder)],
 )
 async def extensions_builder_preview(
-    request: Request,
     ext_id: str,
+    resource: str | None = None,
     page_name: str | None = None,
     user: User = Depends(check_user_exists),
-) -> HTMLResponse:
+) -> FileResponse:
     working_dir_name = "preview_" + sha256(user.id.encode("utf-8")).hexdigest()
-    html_file_name = "index.html"
-    if page_name == "public_page":
-        html_file_name = "public_page.html"
 
-    html_file_path = Path(
+    file_name = "index"
+    if page_name == "public_page":
+        file_name = "public_page"
+
+    resource_path = Path(
+        settings.extension_builder_working_dir_path,
         "extension_builder_stub",
         ext_id,
         working_dir_name,
         ext_id,
-        "templates",
-        ext_id,
-        html_file_name,
+        "static",
     )
 
-    html_file_full_path = Path(
-        settings.extension_builder_working_dir_path, html_file_path
-    )
+    file_ext = ".vue" if resource == "template" else ".js"
+    file_full_path = Path(resource_path, file_name + file_ext)
 
-    if not html_file_full_path.is_file():
-        return template_renderer().TemplateResponse(
-            request,
-            "error.html",
-            {
-                "status_code": 404,
-                "message": f"Extension {ext_id} not found, refresh Preview.",
-            },
-            status_code=HTTPStatus.NOT_FOUND,
-        )
-
-    response = template_renderer().TemplateResponse(
-        request,
-        html_file_path.as_posix(),
-        {
-            "user": user.json(),
-        },
-    )
+    if not file_full_path.is_file():
+        raise HTTPException(status_code=HTTPStatus.NOT_FOUND)
 
+    response = FileResponse(file_full_path.absolute().as_posix())
     response.headers["Content-Security-Policy"] = (
         "default-src 'self'; "
         "style-src 'self' 'unsafe-inline'; "
@@ -208,6 +192,9 @@ admin_ui_checks = [Depends(check_admin), Depends(check_admin_ui)]
 @generic_router.get(
     "/extensions/builder", dependencies=[Depends(check_extension_builder)]
 )
+@generic_router.get(
+    "/extensions/builder/preview", dependencies=[Depends(check_extension_builder)]
+)
 async def index(
     request: Request, user: User = Depends(check_user_exists)
 ) -> HTMLResponse:

lnbits/db.py

@@ -337,7 +337,8 @@ class Database(Compat):
                     f = "%Y-%m-%d %H:%M:%S.%f"
                     if "." not in value:
                         f = "%Y-%m-%d %H:%M:%S"
-                    return datetime.strptime(value, f)
+                    # Parse and add UTC timezone info
+                    return datetime.strptime(value, f).replace(tzinfo=timezone.utc)
 
                 dbapi_connection.run_async(
                     lambda connection: connection.set_type_codec(
@@ -756,7 +757,11 @@ def dict_to_model(_row: dict, model: type[TModel]) -> TModel:  # noqa: C901
             if DB_TYPE == SQLITE:
                 _dict[key] = datetime.fromtimestamp(value, timezone.utc)
             else:
-                _dict[key] = value
+                # Ensure PostgreSQL datetime values have timezone info
+                if isinstance(value, datetime) and value.tzinfo is None:
+                    _dict[key] = value.replace(tzinfo=timezone.utc)
+                else:
+                    _dict[key] = value
             continue
         if issubclass(type_, BaseModel):
             _dict[key] = dict_to_submodel(type_, value)

lnbits/exceptions.py

@@ -109,7 +109,7 @@ def register_exception_handlers(app: FastAPI):  # noqa: C901
         logger.error(f"RequestValidationError: {exc!s}")
         return render_html_error(request, exc) or JSONResponse(
             status_code=HTTPStatus.BAD_REQUEST,
-            content={"detail": str(exc)},
+            content={"detail": [dict(e) for e in exc.errors()]},
         )
 
     @app.exception_handler(HTTPException)

lnbits/helpers.py

@@ -391,6 +391,14 @@ def camel_to_snake(name: str) -> str:
     return name.lower()
 
 
+def snake_to_camel(name: str, capitalize_first: bool | None = False) -> str:
+    components = name.split("_")
+    camel = components[0] + "".join(x.capitalize() for x in components[1:])
+    if capitalize_first:
+        camel = camel[0].upper() + camel[1:]
+    return camel
+
+
 def is_camel_case(v: str) -> bool:
     return re.match(r"^[A-Z][a-z0-9]+([A-Z][a-z0-9]+)*$", v) is not None
 

lnbits/settings.py

@@ -306,6 +306,10 @@ class AssetSettings(LNbitsSettings):
             "heic",
             "heif",
             "heics",
+            "text/plain",
+            "text/json" "text/xml",
+            "application/json",
+            "application/pdf",
         ]
     )
     lnbits_asset_thumbnail_width: int = Field(default=128, ge=0)
@@ -585,6 +589,17 @@ class SparkFundingSource(LNbitsSettings):
     spark_token: str | None = Field(default=None)
 
 
+class SparkL2FundingSource(LNbitsSettings):
+    spark_l2_mnemonic: str | None = Field(default=None)
+    spark_l2_network: str = Field(default="MAINNET")
+    spark_l2_internal_sidecar_version: str | None = Field(default="0.1.1")
+    spark_l2_external_endpoint: str | None = Field(default=None)
+    spark_l2_external_api_key: str | None = Field(default=None)
+    spark_l2_pay_wait_ms: int = Field(default=4000, ge=0)
+    spark_l2_pay_poll_ms: int = Field(default=500, ge=0)
+    spark_l2_stream_keepalive_ms: int = Field(default=15000, ge=0)
+
+
 class LnTipsFundingSource(LNbitsSettings):
     lntips_api_endpoint: str | None = Field(default=None)
     lntips_api_key: str | None = Field(default=None)
@@ -690,6 +705,7 @@ class FundingSourcesSettings(
     PhoenixdFundingSource,
     OpenNodeFundingSource,
     SparkFundingSource,
+    SparkL2FundingSource,
     LnTipsFundingSource,
     NWCFundingSource,
     BreezSdkFundingSource,
@@ -1017,6 +1033,7 @@ class SuperUserSettings(LNbitsSettings):
             "FakeWallet",
             "LNPayWallet",
             "LNbitsWallet",
+            "LightsparkSparkWallet",
             "LnTipsWallet",
             "LndRestWallet",
             "LndWallet",

lnbits/static/i18n/en.js

@@ -695,6 +695,8 @@ window.localisation.en = {
   allow_creation_user: 'Allow creation of new users',
   allow_creation_user_desc: 'Allow creation of new users on the index page',
   new_user_not_allowed: 'Registration is disabled.',
+  start_user_impersonation: 'Impersonate this user',
+  stop_user_impersonation: 'Stop User Impersonation',
   components: 'Components',
   long_running_endpoints: 'Top 5 Long Running Endpoints',
   http_request_methods: 'HTTP Request Methods',

lnbits/static/js/api.js

@@ -123,6 +123,19 @@ window._lnbitsApi = {
       url: '/api/v1/auth/logout'
     })
   },
+  impersonateUser(usr) {
+    return axios({
+      method: 'POST',
+      url: '/api/v1/auth/impersonate',
+      data: {usr}
+    })
+  },
+  stopImpersonation() {
+    return axios({
+      method: 'DELETE',
+      url: '/api/v1/auth/impersonate'
+    })
+  },
   getAuthenticatedUser() {
     return this.request('get', '/api/v1/auth')
   },

lnbits/static/js/components.js

@@ -33,23 +33,7 @@ window.app.component('lnbits-extension-rating', {
   }
 })
 
-window.app.component('lnbits-fsat', {
-  template: '<span>{{ fsat }}</span>',
-  props: {
-    amount: {
-      type: Number,
-      default: 0
-    }
-  },
-  computed: {
-    fsat() {
-      return LNbits.utils.formatSat(this.amount)
-    }
-  }
-})
-
 window.app.component('lnbits-manage', {
-  mixins: [window.windowMixin],
   template: '#lnbits-manage',
   computed: {
     showAdmin() {
@@ -81,10 +65,8 @@ window.app.component('lnbits-manage', {
 })
 
 window.app.component('lnbits-payment-details', {
-  mixins: [window.windowMixin],
   template: '#lnbits-payment-details',
   props: ['payment'],
-  mixins: [window.windowMixin],
   computed: {
     hasPreimage() {
       return (
@@ -128,7 +110,6 @@ window.app.component('lnbits-payment-details', {
 })
 
 window.app.component('lnbits-lnurlpay-success-action', {
-  mixins: [window.windowMixin],
   template: '#lnbits-lnurlpay-success-action',
   props: ['payment', 'success_action'],
   data() {
@@ -148,7 +129,6 @@ window.app.component('lnbits-lnurlpay-success-action', {
 
 window.app.component('lnbits-notifications-btn', {
   template: '#lnbits-notifications-btn',
-  mixins: [window.windowMixin],
   props: ['pubkey'],
   data() {
     return {
@@ -319,7 +299,6 @@ window.app.component('lnbits-notifications-btn', {
 
 window.app.component('lnbits-dynamic-fields', {
   template: '#lnbits-dynamic-fields',
-  mixins: [window.windowMixin],
   props: ['options', 'modelValue'],
   data() {
     return {
@@ -352,7 +331,6 @@ window.app.component('lnbits-dynamic-fields', {
 
 window.app.component('lnbits-dynamic-chips', {
   template: '#lnbits-dynamic-chips',
-  mixins: [window.windowMixin],
   props: ['modelValue'],
   data() {
     return {
@@ -383,7 +361,6 @@ window.app.component('lnbits-dynamic-chips', {
 
 window.app.component('lnbits-update-balance', {
   template: '#lnbits-update-balance',
-  mixins: [window.windowMixin],
   props: ['wallet_id', 'small_btn'],
   computed: {
     admin() {
@@ -422,7 +399,6 @@ window.app.component('lnbits-update-balance', {
 
 window.app.component('user-id-only', {
   template: '#user-id-only',
-  mixins: [window.windowMixin],
   props: {
     allowed_new_users: Boolean,
     authAction: String,
@@ -466,7 +442,6 @@ window.app.component('user-id-only', {
 
 window.app.component('username-password', {
   template: '#username-password',
-  mixins: [window.windowMixin],
   props: {
     allowed_new_users: Boolean,
     authMethods: Array,
@@ -704,7 +679,6 @@ window.app.component('lnbits-stat', {
 
 window.app.component('lnbits-node-qrcode', {
   props: ['info'],
-  mixins: [window.windowMixin],
   template: `
     <q-card class="my-card">
       <q-card-section>
@@ -783,7 +757,6 @@ window.app.component('lnbits-node-info', {
       showDialog: false
     }
   },
-  mixins: [window.windowMixin],
   methods: {
     shortenNodeId(nodeId) {
       return nodeId

lnbits/static/js/components/admin/lnbits-admin-assets-config.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-assets-config', {
   props: ['form-data'],
   template: '#lnbits-admin-assets-config',
-  mixins: [window.windowMixin],
   data() {
     return {
       newAllowedAssetMimeType: '',
@@ -17,6 +16,7 @@ window.app.component('lnbits-admin-assets-config', {
           this.newAllowedAssetMimeType
         )
         this.newAllowedAssetMimeType = ''
+        this.formData.touch = null
       }
     },
     removeAllowedAssetMimeType(type) {
@@ -24,18 +24,21 @@ window.app.component('lnbits-admin-assets-config', {
       if (index !== -1) {
         this.formData.lnbits_assets_allowed_mime_types.splice(index, 1)
       }
+      this.formData.touch = null
     },
     addNewNoLimitUser() {
       if (this.newNoLimitUser) {
         this.removeNoLimitUser(this.newNoLimitUser)
         this.formData.lnbits_assets_no_limit_users.push(this.newNoLimitUser)
         this.newNoLimitUser = ''
+        this.formData.touch = null
       }
     },
     removeNoLimitUser(user) {
       if (user) {
         this.formData.lnbits_assets_no_limit_users =
           this.formData.lnbits_assets_no_limit_users.filter(u => u !== user)
+        this.formData.touch = null
       }
     }
   }

lnbits/static/js/components/admin/lnbits-admin-audit.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-audit', {
   props: ['form-data'],
   template: '#lnbits-admin-audit',
-  mixins: [window.windowMixin],
   data() {
     return {
       formAddIncludePath: '',

lnbits/static/js/components/admin/lnbits-admin-exchange-providers.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-exchange-providers', {
   props: ['form-data'],
   template: '#lnbits-admin-exchange-providers',
-  mixins: [window.windowMixin],
   data() {
     return {
       exchangeData: {

lnbits/static/js/components/admin/lnbits-admin-extensions.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-extensions', {
   props: ['form-data'],
   template: '#lnbits-admin-extensions',
-  mixins: [window.windowMixin],
   data() {
     return {
       formAddExtensionsManifest: ''

lnbits/static/js/components/admin/lnbits-admin-fiat-providers.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-fiat-providers', {
   props: ['form-data'],
   template: '#lnbits-admin-fiat-providers',
-  mixins: [window.windowMixin],
   data() {
     return {
       formAddStripeUser: '',

lnbits/static/js/components/admin/lnbits-admin-funding-sources.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-admin-funding-sources', {
   template: '#lnbits-admin-funding-sources',
-  mixins: [window.windowMixin],
   props: ['form-data', 'allowed-funding-sources'],
   methods: {
     getFundingSourceLabel(item) {
@@ -229,6 +228,51 @@ window.app.component('lnbits-admin-funding-sources', {
             spark_token: 'Token'
           }
         ],
+        [
+          'LightsparkSparkWallet',
+          'Spark (L2)',
+          {
+            spark_l2_internal_sidecar_version: {
+              label: 'Internal Sidecar Version (eg: 0.1.1).',
+              hint: 'If specified then the sidecar will be downloaded. Alternatively you can specify an External Sidecar endpoint in the Advanced section.',
+              value: ''
+            },
+            spark_l2_mnemonic: {
+              label: 'Mnemonic',
+              hint: 'Only required if Interna Sidecar version is specified.'
+            },
+            spark_l2_network: {
+              label: 'Network',
+              value: 'MAINNET'
+            },
+
+            spark_l2_external_endpoint: {
+              label: 'External Sidecar Endpoint. ',
+              hint: 'If specified then this endpoint will be used instead of the internal sidecar. Make sure to also specify the API key if your sidecar requires authentication.',
+              value: '',
+              advanced: true
+            },
+            spark_l2_external_api_key: {
+              label: 'External Sidecar API Key. ',
+              hint: 'API Key for authenticating with the external sidecar if it requires authentication.',
+              value: '',
+              advanced: true
+            },
+
+            spark_l2_pay_wait_ms: {
+              label: 'Pay Wait Time (ms)',
+              advanced: true
+            },
+            spark_l2_pay_poll_ms: {
+              label: 'Pay Poll Time (ms)',
+              advanced: true
+            },
+            spark_l2_stream_keepalive_ms: {
+              label: 'Stream Keepalive Time (ms)',
+              advanced: true
+            }
+          }
+        ],
         [
           'NWCWallet',
           'Nostr Wallet Connect',

lnbits/static/js/components/admin/lnbits-admin-funding.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-funding', {
   props: ['is-super-user', 'form-data', 'settings'],
   template: '#lnbits-admin-funding',
-  mixins: [window.windowMixin],
   data() {
     return {
       auditData: []

lnbits/static/js/components/admin/lnbits-admin-notifications.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-notifications', {
   props: ['form-data'],
   template: '#lnbits-admin-notifications',
-  mixins: [window.windowMixin],
   data() {
     return {
       nostrNotificationIdentifier: '',

lnbits/static/js/components/admin/lnbits-admin-security.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-security', {
   props: ['form-data'],
   template: '#lnbits-admin-security',
-  mixins: [window.windowMixin],
   data() {
     return {
       logs: [],

lnbits/static/js/components/admin/lnbits-admin-server.js

@@ -1,5 +1,4 @@
 window.app.component('lnbits-admin-server', {
   props: ['form-data'],
-  template: '#lnbits-admin-server',
-  mixins: [window.windowMixin]
+  template: '#lnbits-admin-server'
 })

lnbits/static/js/components/admin/lnbits-admin-site-customisation.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-site-customisation', {
   props: ['form-data'],
   template: '#lnbits-admin-site-customisation',
-  mixins: [window.windowMixin],
   data() {
     return {
       lnbits_theme_options: [

lnbits/static/js/components/admin/lnbits-admin-users.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-admin-users', {
   props: ['form-data'],
   template: '#lnbits-admin-users',
-  mixins: [window.windowMixin],
   data() {
     return {
       formAddUser: '',

lnbits/static/js/components/lnbits-disclaimer.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-disclaimer', {
   template: '#lnbits-disclaimer',
-  mixins: [window.windowMixin],
   computed: {
     showDisclaimer() {
       return !g.disclaimerShown && g.isUserAuthorized

lnbits/static/js/components/lnbits-drawer.js

@@ -1,4 +1,3 @@
 window.app.component('lnbits-drawer', {
-  template: '#lnbits-drawer',
-  mixins: [window.windowMixin]
+  template: '#lnbits-drawer'
 })

lnbits/static/js/components/lnbits-error.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-error', {
   template: '#lnbits-error',
-  mixins: [window.windowMixin],
   props: ['dynamic', 'code', 'message'],
   computed: {
     isExtension() {

lnbits/static/js/components/lnbits-footer.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-footer', {
   template: '#lnbits-footer',
-  mixins: [window.windowMixin],
   computed: {
     version() {
       return this.LNBITS_VERSION || 'unknown version'

lnbits/static/js/components/lnbits-header-wallets.js

@@ -1,4 +1,3 @@
 window.app.component('lnbits-header-wallets', {
-  template: '#lnbits-header-wallets',
-  mixins: [window.windowMixin]
+  template: '#lnbits-header-wallets'
 })

lnbits/static/js/components/lnbits-header.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-header', {
   template: '#lnbits-header',
-  mixins: [window.windowMixin],
   computed: {
     hasServiceFeeMax() {
       return (
@@ -61,5 +60,17 @@ window.app.component('lnbits-header', {
         return 'User'
       }
     }
+  },
+  methods: {
+    async stopImpersonation() {
+      try {
+        await LNbits.api.stopImpersonation()
+        LNbits.utils.restoreLocalStorage('impersonation')
+        window.location = '/users'
+      } catch (e) {
+        console.warn(e)
+        LNbits.utils.notifyApiError(e)
+      }
+    }
   }
 })

lnbits/static/js/components/lnbits-home-logos.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-home-logos', {
   template: '#lnbits-home-logos',
-  mixins: [window.windowMixin],
   data() {
     return {
       logos: [

lnbits/static/js/components/lnbits-label-selector.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-label-selector', {
   template: '#lnbits-label-selector',
   props: ['labels'],
-  mixins: [window.windowMixin],
   data() {
     return {
       labelFilter: '',

lnbits/static/js/components/lnbits-language-dropdown.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-language-dropdown', {
   template: '#lnbits-language-dropdown',
-  mixins: [window.windowMixin],
   methods: {
     activeLanguage(lang) {
       return window.i18n.global.locale === lang

lnbits/static/js/components/lnbits-manage-extension-list.js

@@ -1,5 +1,4 @@
 window.app.component('lnbits-manage-extension-list', {
-  mixins: [window.windowMixin],
   template: '#lnbits-manage-extension-list',
   data() {
     return {

lnbits/static/js/components/lnbits-manage-wallet-list.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-manage-wallet-list', {
   template: '#lnbits-manage-wallet-list',
-  mixins: [window.windowMixin],
   data() {
     return {
       activeWalletId: null

lnbits/static/js/components/lnbits-payment-list.js

@@ -1,7 +1,6 @@
 window.app.component('lnbits-payment-list', {
   template: '#lnbits-payment-list',
   props: ['wallet', 'paymentFilter'],
-  mixins: [window.windowMixin],
   data() {
     return {
       payments: [],

lnbits/static/js/components/lnbits-qrcode-lnurl.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-qrcode-lnurl', {
   template: '#lnbits-qrcode-lnurl',
-  mixins: [window.windowMixin],
   props: {
     url: {
       required: true,

lnbits/static/js/components/lnbits-qrcode.js

@@ -1,5 +1,4 @@
 window.app.component('lnbits-qrcode', {
-  mixins: [window.windowMixin],
   template: '#lnbits-qrcode',
   components: {
     QrcodeVue: QrcodeVue.default

lnbits/static/js/components/lnbits-theme.js

@@ -1,5 +1,4 @@
 window.app.component('lnbits-theme', {
-  mixins: [window.windowMixin],
   watch: {
     'g.walletFlip'(val) {
       this.$q.localStorage.setItem('lnbits.walletFlip', val)

lnbits/static/js/components/lnbits-wallet-api-docs.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-api-docs', {
   template: '#lnbits-wallet-api-docs',
-  mixins: [window.windowMixin],
   methods: {
     resetKeys() {
       LNbits.utils

lnbits/static/js/components/lnbits-wallet-charts.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-charts', {
   template: '#lnbits-wallet-charts',
-  mixins: [window.windowMixin],
   props: ['paymentFilter', 'chartConfig'],
   data() {
     return {

lnbits/static/js/components/lnbits-wallet-icon.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-icon', {
   template: '#lnbits-wallet-icon',
-  mixins: [window.windowMixin],
   data() {
     return {
       icon: {

lnbits/static/js/components/lnbits-wallet-new.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-new', {
   template: '#lnbits-wallet-new',
-  mixins: [window.windowMixin],
   data() {
     return {
       walletTypes: [{label: 'Lightning Wallet', value: 'lightning'}],

lnbits/static/js/components/lnbits-wallet-paylinks.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-paylinks', {
   template: '#lnbits-wallet-paylinks',
-  mixins: [window.windowMixin],
   data() {
     return {
       storedPaylinks: []

lnbits/static/js/components/lnbits-wallet-share.js

@@ -1,6 +1,5 @@
 window.app.component('lnbits-wallet-share', {
   template: '#lnbits-wallet-share',
-  mixins: [window.windowMixin],
   computed: {
     walletApprovedShares() {
       return this.g.wallet.extra.shared_with.filter(

lnbits/static/js/globals.js

@@ -15,6 +15,7 @@ window.g = Vue.reactive({
   wallet: null,
   isPublicPage: true,
   isUserAuthorized: !!Quasar.Cookies.get('is_lnbits_user_authorized'),
+  isUserImpersonated: !!Quasar.Cookies.get('is_lnbits_user_impersonated'),
   offline: !navigator.onLine,
   hasCamera: false,
   visibleDrawer: false,

lnbits/static/js/init-app.js

@@ -106,6 +106,11 @@ const routes = [
     name: 'ExtensionsBuilder',
     component: PageExtensionBuilder
   },
+  {
+    path: '/extensions/builder/preview',
+    name: 'ExtensionsBuilderPreview',
+    component: PageExtensionBuilderPreview
+  },
   {
     path: '/extensions',
     name: 'Extensions',

lnbits/static/js/pages/account.js

@@ -1,6 +1,5 @@
 window.PageAccount = {
   template: '#page-account',
-  mixins: [window.windowMixin],
   data() {
     return {
       untouchedUser: null,
@@ -610,7 +609,7 @@ window.PageAccount = {
       }
     },
     copyAssetLinkToClipboard(asset) {
-      const assetUrl = `${window.location.origin}/api/v1/assets/${asset.id}/binary`
+      const assetUrl = `${window.location.origin}/api/v1/assets/${asset.id}/data`
       this.utils.copyText(assetUrl)
     },
     addUserLabel() {

lnbits/static/js/pages/admin.js

@@ -1,6 +1,5 @@
 window.PageAdmin = {
   template: '#page-admin',
-  mixins: [windowMixin],
   data() {
     return {
       tab: 'funding',

lnbits/static/js/pages/audit.js

@@ -1,6 +1,5 @@
 window.PageAudit = {
   template: '#page-audit',
-  mixins: [window.windowMixin],
   data() {
     return {
       chartsReady: false,

lnbits/static/js/pages/error.js

@@ -1,4 +1,3 @@
 window.PageError = {
-  template: '#page-error',
-  mixins: [window.windowMixin]
+  template: '#page-error'
 }

lnbits/static/js/pages/extensions.js

@@ -1,6 +1,5 @@
 window.PageExtensions = {
   template: '#page-extensions',
-  mixins: [window.windowMixin],
   data() {
     return {
       extbuilderEnabled: false,

lnbits/static/js/pages/extensions_builder.js

@@ -1,6 +1,5 @@
 window.PageExtensionBuilder = {
   template: '#page-extension-builder',
-  mixins: [windowMixin],
   data() {
     return {
       step: 1,
@@ -288,11 +287,10 @@ window.PageExtensionBuilder = {
           `/api/v1/extension/${stub_ext_id}/releases`
         )
 
-        this.extensionStubVersions = data.sort((a, b) =>
-          a.version < b.version ? 1 : -1
-        )
-        this.extensionData.stub_version = this.extensionStubVersions[0]
-          ? this.extensionStubVersions[0].version
+        this.extensionStubVersions = data
+        const validVersions = data.filter(v => v.is_version_compatible)
+        this.extensionData.stub_version = validVersions[0]
+          ? validVersions[0].version
           : ''
       } catch (error) {
         LNbits.utils.notifyApiError(error)
@@ -311,7 +309,20 @@ window.PageExtensionBuilder = {
         iframeDoc.body.style.transform = 'scale(0.8)'
         iframeDoc.body.style.transformOrigin = 'center top'
       }
-      iframe.src = `/extensions/builder/preview/${this.extensionData.id}?page_name=${previewPageName}`
+
+      let componentName =
+        'Page' +
+        this.extensionData.id
+          .toLowerCase()
+          .split('_')
+          .map(word => word.charAt(0).toUpperCase() + word.slice(1))
+          .join('')
+      if (previewPageName === 'public_page') componentName += 'Public'
+      iframe.src =
+        `/extensions/builder/preview?` +
+        `ext_id=${this.extensionData.id}` +
+        `&page=${previewPageName}` +
+        `&component=${componentName}`
     },
     initBasicData() {
       this.extensionData.owner_data.fields = [

lnbits/static/js/pages/extensions_builder_preview.js

@@ -0,0 +1,46 @@
+window.PageExtensionBuilderPreview = {
+  template: '#page-extension-builder-preview',
+  mixins: [windowMixin],
+  watch: {
+    name: 'reload'
+  },
+  data() {
+    return {
+      extId: '',
+      pageName: '',
+      componentName: null
+    }
+  },
+  methods: {
+    async reload() {
+      await LNbits.utils.loadTemplate(
+        `/extensions/builder/preview/${this.extId}/template?page_name=${this.pageName}`
+      )
+      await LNbits.utils.loadScript(
+        `/extensions/builder/preview/${this.extId}/component?page_name=${this.pageName}`
+      )
+
+      this._component = window[this.componentName]
+      console.log(
+        'LNbits preview reloaded componentName:',
+        this.componentName,
+        !!this._component
+      )
+      this.$forceUpdate()
+    }
+  },
+  async created() {
+    const urlParams = new URLSearchParams(window.location.search)
+    this.extId = urlParams.get('ext_id') || ''
+    this.pageName = urlParams.get('page') || ''
+    this.componentName = urlParams.get('component') || ''
+
+    await this.reload()
+  },
+  render() {
+    if (this._component) {
+      return Vue.h(this._component)
+    }
+    return Vue.h('div', 'Loading...')
+  }
+}

lnbits/static/js/pages/first-install.js

@@ -1,6 +1,5 @@
 window.PageFirstInstall = {
   template: '#page-first-install',
-  mixins: [window.windowMixin],
   data() {
     return {
       loginData: {

lnbits/static/js/pages/home.js

@@ -1,6 +1,5 @@
 window.PageHome = {
   template: '#page-home',
-  mixins: [window.windowMixin],
   data() {
     return {
       lnurl: '',

lnbits/static/js/pages/node-public.js

@@ -1,6 +1,5 @@
 window.PageNodePublic = {
   template: '#page-node-public',
-  mixins: [window.windowMixin],
   data() {
     return {
       enabled: false,

lnbits/static/js/pages/node.js

@@ -1,5 +1,4 @@
 window.PageNode = {
-  mixins: [window.windowMixin],
   template: '#page-node',
   config: {
     globalProperties: {

lnbits/static/js/pages/payments.js

@@ -1,6 +1,5 @@
 window.PagePayments = {
   template: '#page-payments',
-  mixins: [window.windowMixin],
   data() {
     return {
       payments: [],

lnbits/static/js/pages/users.js

@@ -1,6 +1,5 @@
 window.PageUsers = {
   template: '#page-users',
-  mixins: [window.windowMixin],
   data() {
     return {
       paymentsWallet: {},
@@ -439,6 +438,20 @@ window.PageUsers = {
         this.activeUser.show = false
       }
     },
+    async impersonateUser(user_id) {
+      try {
+        await LNbits.api.impersonateUser(user_id)
+        LNbits.utils.backupLocalStorage('impersonation', true)
+        this.$q.localStorage.setItem('lnbits.disclaimerShown', true)
+        window.location = '/wallet'
+      } catch (error) {
+        console.warn(error)
+        Quasar.Notify.create({
+          type: 'warning',
+          message: 'Failed to impersonate user!'
+        })
+      }
+    },
     async showWalletPayments(walletId) {
       this.activeUser.show = false
       await this.fetchWallets(this.users[0].id)

lnbits/static/js/pages/wallet.js

@@ -1,6 +1,5 @@
 window.PageWallet = {
   template: '#page-wallet',
-  mixins: [window.windowMixin],
   data() {
     return {
       parse: {

lnbits/static/js/pages/wallets.js

@@ -1,6 +1,5 @@
 window.PageWallets = {
   template: '#page-wallets',
-  mixins: [window.windowMixin],
   data() {
     return {
       user: null,

lnbits/static/js/utils.js

@@ -67,6 +67,29 @@ window._lnbitsUtils = {
         }
       })
   },
+  backupLocalStorage(backupKey, cleanup = false) {
+    const lnbitsEntries =
+      Object.entries(Quasar.LocalStorage.getAll()).filter(
+        ([k, v]) => k.startsWith('lnbits.') && k !== `lnbits.${backupKey}`
+      ) || []
+
+    Quasar.LocalStorage.setItem(`lnbits.${backupKey}`, lnbitsEntries)
+    if (cleanup) {
+      lnbitsEntries.forEach(([k, v]) => Quasar.LocalStorage.remove(k))
+    }
+  },
+  restoreLocalStorage(backupKey) {
+    Object.entries(Quasar.LocalStorage.getAll())
+      .filter(
+        ([k, v]) => k.startsWith('lnbits.') && k !== `lnbits.${backupKey}`
+      )
+      .forEach(([k, v]) => Quasar.LocalStorage.remove(k))
+
+    const lnbitsEntries =
+      Quasar.LocalStorage.getItem(`lnbits.${backupKey}`) || []
+    lnbitsEntries.forEach(([k, v]) => Quasar.LocalStorage.setItem(k, v))
+    Quasar.LocalStorage.remove(`lnbits.${backupKey}`)
+  },
   async digestMessage(message) {
     const msgUint8 = new TextEncoder().encode(message)
     const hashBuffer = await crypto.subtle.digest('SHA-256', msgUint8)
@@ -114,6 +137,13 @@ window._lnbitsUtils = {
   formatMsat(value) {
     return this.formatSat(value / 1000)
   },
+  parseJSONSafe(str) {
+    try {
+      return JSON.parse(str)
+    } catch (e) {
+      return null
+    }
+  },
   notifyApiError(error) {
     if (!error.response) {
       return console.error(error)
@@ -123,17 +153,28 @@ window._lnbitsUtils = {
       401: 'warning',
       500: 'negative'
     }
-    Quasar.Notify.create({
-      timeout: 5000,
-      type: types[error.response.status] || 'warning',
-      message:
-        error.response.data.message || error.response.data.detail || null,
-      caption:
-        [error.response.status, ' ', error.response.statusText]
-          .join('')
-          .toUpperCase() || null,
-      icon: null
-    })
+    let messages = error.response.data.detail
+    if (messages) {
+      messages = Array.isArray(messages)
+        ? messages.map(e => e.msg + ` (${e.loc?.join('/')})`)
+        : (messages = [messages])
+    } else {
+      messages = [error.response.data.message || error.response.data.detail]
+    }
+
+    messages.forEach(message =>
+      Quasar.Notify.create({
+        timeout: 5000,
+        type: types[error.response.status] || 'warning',
+        message,
+        caption:
+          [error.response.status, ' ', error.response.statusText]
+            .join('')
+            .toUpperCase() || null,
+        icon: null,
+        closeBtn: true
+      })
+    )
   },
   search(data, q, field, separator) {
     try {

lnbits/static/vendor.json

@@ -45,6 +45,8 @@
     "js/pages/error.js",
     "js/pages/home.js",
     "js/pages/extensions_builder.js",
+    "js/pages/extensions_builder.js",
+    "js/pages/extensions_builder_preview.js",
     "js/pages/extensions.js",
     "js/pages/first-install.js",
     "js/pages/payments.js",

lnbits/templates/components/lnbits-header.vue

@@ -72,7 +72,6 @@
       </q-badge>
 
       <lnbits-language-dropdown></lnbits-language-dropdown>
-
       <q-btn-dropdown v-if="g.user" flat rounded size="sm" class="q-pl-sm">
         <template v-slot:label>
           <q-avatar
@@ -136,6 +135,20 @@
           </q-item>
         </q-list>
       </q-btn-dropdown>
+      <q-btn
+        v-if="g.isUserImpersonated"
+        @click="stopImpersonation"
+        rounded
+        size="sm"
+        class="q-pl-sm"
+        color="negative"
+        icon="face_retouching_off"
+        label="Stop"
+      >
+        <q-tooltip
+          ><span v-text="$t('stop_user_impersonation')"></span
+        ></q-tooltip>
+      </q-btn>
     </q-toolbar>
   </q-header>
 </template>

lnbits/templates/pages/account.vue

@@ -941,7 +941,7 @@
                                 v-if="props.row.thumbnail_base64"
                                 target="_blank"
                                 style="color: inherit"
-                                :href="`/api/v1/assets/${props.row.id}/binary`"
+                                :href="`/api/v1/assets/${props.row.id}/data`"
                               >
                                 <q-img
                                   :src="

lnbits/templates/pages/users.vue

@@ -656,7 +656,20 @@
                   </q-btn>
                   <span v-text="shortify(props.row.id)"></span>
                 </q-td>
-                <q-td v-text="props.row.username"></q-td>
+                <q-td>
+                  <q-btn
+                    icon="face"
+                    size="sm"
+                    flat
+                    class="cursor-pointer q-mr-xs"
+                    @click="impersonateUser(props.row.id)"
+                  >
+                    <q-tooltip
+                      ><span v-text="$t('start_user_impersonation')"></span
+                    ></q-tooltip>
+                  </q-btn>
+                  <span v-text="props.row.username"></span>
+                </q-td>
 
                 <q-td v-text="props.row.email"></q-td>
 

lnbits/wallets/__init__.py

@@ -20,6 +20,7 @@ from .corelightning import CoreLightningWallet as CLightningWallet
 from .corelightningrest import CoreLightningRestWallet
 from .eclair import EclairWallet
 from .fake import FakeWallet
+from .lightspark import LightsparkSparkWallet
 from .lnbits import LNbitsWallet
 from .lndgrpc import LndWallet
 from .lndrest import LndRestWallet
@@ -69,6 +70,7 @@ __all__ = [
     "FakeWallet",
     "LNPayWallet",
     "LNbitsWallet",
+    "LightsparkSparkWallet",
     "LnTipsWallet",
     "LndRestWallet",
     "LndWallet",

lnbits/wallets/lightspark.py

@@ -0,0 +1,417 @@
+import asyncio
+import hashlib
+import json
+import shutil
+import subprocess
+import uuid
+from collections.abc import AsyncGenerator
+from pathlib import Path
+from typing import Any, cast
+
+import httpx
+from bolt11 import decode as bolt11_decode
+from loguru import logger
+
+from lnbits.helpers import download_url, normalize_endpoint
+from lnbits.settings import settings
+
+from .base import (
+    InvoiceResponse,
+    PaymentFailedStatus,
+    PaymentPendingStatus,
+    PaymentResponse,
+    PaymentStatus,
+    PaymentSuccessStatus,
+    StatusResponse,
+    Wallet,
+)
+
+
+class SparkSidecarError(Exception):
+    pass
+
+
+class LightsparkSparkWallet(Wallet):
+    """
+    Spark L2 funding source via a local sidecar service.
+
+    Required settings/env:
+      - SPARK_L2_ENDPOINT (default http://127.0.0.1:8765)
+    Optional:
+      - SPARK_L2_API_KEY
+    """
+
+    def __init__(self):
+        self._status = "Initializing"
+        self._sidecar_path = Path(settings.lnbits_data_folder, "light_spark")
+
+        self.pending_invoices: list[str] = []
+
+        self.endpoint = "http://127.0.0.1:8765"
+        self._api_key = uuid.uuid4().hex
+        if settings.spark_l2_internal_sidecar_version:
+            self._sidecar_version = settings.spark_l2_internal_sidecar_version
+            self.sidecar_task = asyncio.create_task(self._start_sidecar())
+            logger.info(f"Internal Spark sidecar ({self._sidecar_version}).")
+        elif settings.spark_l2_external_endpoint:
+            self.endpoint = normalize_endpoint(
+                cast(str, settings.spark_l2_external_endpoint)
+            )
+            self._api_key = settings.spark_l2_external_api_key
+            logger.info(f"Using external Spark sidecar endpoint: {self.endpoint}")
+        else:
+            logger.error(
+                "No Spark sidecar configuration found. Please set either "
+                "spark_l2_internal_sidecar_version or spark_l2_external_endpoint."
+            )
+
+        headers = {"User-Agent": settings.user_agent, "X-Api-Key": self._api_key}
+
+        self.client = httpx.AsyncClient(
+            base_url=self.endpoint,
+            headers=headers,
+            timeout=60,
+        )
+
+    async def cleanup(self):
+        try:
+            await self.client.aclose()
+            self.sidecar_task.cancel()
+        except RuntimeError as e:
+            logger.warning(f"Error closing wallet connection: {e}")
+
+    async def _request(
+        self, method: str, path: str, json_data: dict[str, Any] | None = None
+    ) -> dict[str, Any]:
+        error_message = None
+        try:
+            r = await self.client.request(method, path, json=json_data)
+            r.raise_for_status()
+            j = r.json()
+        except (httpx.RequestError, httpx.HTTPStatusError, json.JSONDecodeError) as exc:
+            if isinstance(exc, httpx.HTTPStatusError) and exc.response is not None:
+                try:
+                    error_json = exc.response.json()
+                    if "error" in error_json:
+                        error_message = error_json["error"]
+                except Exception as json_exc:
+                    logger.error(
+                        f"Failed to parse Spark error response as JSON: {json_exc}"
+                    )
+            raise SparkSidecarError(
+                error_message or f"Spark sidecar request error: '{exc}'"
+            ) from exc
+
+        if error_message or j.get("error"):
+            raise SparkSidecarError(
+                error_message or f"Spark sidecar error: {j['error']}"
+            )
+        return j
+
+    async def status(self) -> StatusResponse:
+        try:
+            res = await self._request("POST", "/v1/balance")
+            balance_msat = res.get("balance_msat")
+            if balance_msat is not None:
+                return StatusResponse(None, int(balance_msat))
+            balance_sats = res.get("balance_sats")
+            if balance_sats is None:
+                return StatusResponse("Spark sidecar: missing balance.", 0)
+            return StatusResponse(None, int(balance_sats) * 1000)
+        except Exception as e:
+            return StatusResponse(f"Spark sidecar status error: {e}", 0)
+
+    async def create_invoice(
+        self,
+        amount: int,
+        memo: str | None = None,
+        description_hash: bytes | None = None,
+        unhashed_description: bytes | None = None,
+        **kwargs,
+    ) -> InvoiceResponse:
+        expiry = kwargs.get("expiry")
+        expiry_secs = int(expiry) if expiry else None
+
+        description_hash_hex = None
+        if description_hash:
+            description_hash_hex = description_hash.hex()
+        elif unhashed_description:
+            description_hash_hex = hashlib.sha256(unhashed_description).hexdigest()
+
+        try:
+            payload = {
+                "amount_sats": int(amount),
+                "memo": (memo or "") if not description_hash_hex else None,
+                "description_hash": description_hash_hex,
+                "expiry_seconds": expiry_secs,
+            }
+            res = await self._request("POST", "/v1/invoices", payload)
+            bolt11 = res.get("payment_request")
+            checking_id = res.get("checking_id")
+            if not bolt11 or not checking_id:
+                raise SparkSidecarError(
+                    "Spark sidecar invoice response missing fields."
+                )
+            self.pending_invoices.append(checking_id)
+
+            return InvoiceResponse(
+                ok=True,
+                payment_request=bolt11,
+                checking_id=checking_id,
+                preimage=res.get("preimage"),
+            )
+        except Exception as e:
+            return InvoiceResponse(ok=False, error_message=str(e))
+
+    async def pay_invoice(self, bolt11: str, fee_limit_msat: int) -> PaymentResponse:
+        try:
+            max_fee_sats = (int(fee_limit_msat) + 999) // 1000
+
+            payment_hash = None
+            try:
+                payment_hash = bolt11_decode(bolt11).payment_hash
+            except Exception:
+                payment_hash = None
+            payload = {
+                "bolt11": bolt11,
+                "max_fee_sats": max_fee_sats,
+                "payment_hash": payment_hash,
+            }
+            res = await self._request("POST", "/v1/payments", payload)
+            checking_id = payment_hash or res.get("checking_id")
+            if not checking_id:
+                raise SparkSidecarError(
+                    "Spark sidecar payment response missing checking_id."
+                )
+            status = res.get("status")
+            fee_msat = res.get("fee_msat")
+            ok = None
+            if status:
+                ok = self._map_payment_ok(status)
+            return PaymentResponse(
+                ok=ok,
+                checking_id=checking_id,
+                fee_msat=int(fee_msat) if fee_msat is not None else None,
+                preimage=res.get("preimage"),
+            )
+
+        except Exception as e:
+            return PaymentResponse(ok=False, error_message=str(e))
+
+    async def get_invoice_status(self, checking_id: str) -> PaymentStatus:
+        try:
+            res = await self._request("GET", f"/v1/invoices/{checking_id}")
+            status = res.get("status")
+            if not status:
+                return PaymentPendingStatus()
+            return self._map_invoice_status(status)
+        except Exception:
+            return PaymentPendingStatus()
+
+    async def get_payment_status(self, checking_id: str) -> PaymentStatus:
+        try:
+            res = await self._request("GET", f"/v1/payments/{checking_id}")
+            status = res.get("status")
+            fee_msat = res.get("fee_msat")
+            preimage = res.get("preimage")
+            if not status:
+                return PaymentPendingStatus()
+            mapped = self._map_payment_status(status)
+            if mapped.success:
+                return PaymentSuccessStatus(
+                    fee_msat=int(fee_msat) if fee_msat is not None else None,
+                    preimage=preimage,
+                )
+            if mapped.failed:
+                return PaymentFailedStatus()
+            return PaymentPendingStatus()
+        except Exception:
+            return PaymentPendingStatus()
+
+    def _map_invoice_status(self, status: str) -> PaymentStatus:
+        success = {
+            "LIGHTNING_PAYMENT_RECEIVED",
+            "TRANSFER_COMPLETED",
+            "PAYMENT_PREIMAGE_RECOVERED",
+        }
+        failed = {
+            "TRANSFER_FAILED",
+            "PAYMENT_PREIMAGE_RECOVERING_FAILED",
+            "REFUND_SIGNING_FAILED",
+            "REFUND_SIGNING_COMMITMENTS_QUERYING_FAILED",
+            "TRANSFER_CREATION_FAILED",
+        }
+        if status in success:
+            return PaymentSuccessStatus()
+        if status in failed:
+            return PaymentFailedStatus()
+        return PaymentPendingStatus()
+
+    def _map_payment_status(self, status: str) -> PaymentStatus:
+        success = {
+            "LIGHTNING_PAYMENT_SUCCEEDED",
+            "TRANSFER_COMPLETED",
+            "PREIMAGE_PROVIDED",
+        }
+        failed = {
+            "LIGHTNING_PAYMENT_FAILED",
+            "TRANSFER_FAILED",
+            "PREIMAGE_PROVIDING_FAILED",
+            "USER_TRANSFER_VALIDATION_FAILED",
+            "USER_SWAP_RETURN_FAILED",
+        }
+        if status in success:
+            return PaymentSuccessStatus()
+        if status in failed:
+            return PaymentFailedStatus()
+        return PaymentPendingStatus()
+
+    def _map_payment_ok(self, status: str) -> bool | None:
+        mapped = self._map_payment_status(status)
+        if mapped.success:
+            return True
+        if mapped.failed:
+            return False
+        return None
+
+    async def _poll_pending_invoices(self) -> AsyncGenerator[str, None]:
+        while settings.lnbits_running:
+            for invoice in list(self.pending_invoices):
+                try:
+                    status = await self.get_invoice_status(invoice)
+                    if status.paid:
+                        yield invoice
+                        self.pending_invoices.remove(invoice)
+                    elif status.failed:
+                        self.pending_invoices.remove(invoice)
+                except Exception as exc:
+                    logger.error(f"could not get status of invoice {invoice}: '{exc}' ")
+            await asyncio.sleep(5)
+
+    async def paid_invoices_stream(self) -> AsyncGenerator[str, None]:
+        stream_path = "/v1/invoices/stream"
+        while settings.lnbits_running:
+            try:
+                async with self.client.stream("GET", stream_path, timeout=None) as r:
+                    if r.status_code in {404, 405}:
+                        logger.warning(
+                            "Spark sidecar invoice stream not available, "
+                            "falling back to polling."
+                        )
+                        async for checking_id in self._poll_pending_invoices():
+                            yield checking_id
+                        return
+                    r.raise_for_status()
+                    logger.info("connected to Spark sidecar invoice stream.")
+                    async for line in r.aiter_lines():
+                        if not line or not line.startswith("data:"):
+                            continue
+                        data = json.loads(line[5:].strip())
+                        checking_id = data.get("checking_id")
+                        if not checking_id:
+                            continue
+                        yield checking_id
+            except Exception as exc:
+                logger.error(
+                    "lost connection to Spark sidecar invoice stream: "
+                    f"'{exc}' retrying in 5 seconds"
+                )
+                await asyncio.sleep(5)
+
+    async def _start_sidecar(self):
+        logger.info("Starting Spark sidecar")
+        node_path = shutil.which("node")
+        if not node_path:
+            logger.error("Node.js not found in PATH, cannot start Spark sidecar")
+            return
+        logger.info(f"Node.js found: {node_path}")
+
+        repo, version = "spark_sidecar", self._sidecar_version
+        node_modules_path = Path(self._sidecar_path, f"{repo}-{version}")
+        await self._prepare_sidecar(repo, version, node_modules_path)
+
+        await self._start_sidecar_process(node_path, node_modules_path)
+
+    async def _prepare_sidecar(self, repo: str, version: str, node_modules_path: Path):
+        if not Path(node_modules_path, "package.json").is_file():
+            await self._download_sidecar(repo, version)
+        else:
+            logger.info("Spark sidecar already downloaded.")
+
+        if not Path(node_modules_path, "node_modules").is_dir():
+            self._install_sidecar_packages(node_modules_path)
+        else:
+            logger.info("Spark sidecar npm dependencies already installed.")
+
+    def _install_sidecar_packages(self, node_modules_path: Path):
+        logger.info(f"Installing Spark sidecar npm dependencies {node_modules_path}")
+        npm_path = shutil.which("npm")
+        if not npm_path:
+            logger.error("npm not found in PATH, cannot start Spark sidecar")
+            return
+        logger.info(f"npm found: {npm_path}")
+
+        result = subprocess.run(  # noqa: S603
+            [npm_path, "install"],
+            cwd=str(node_modules_path),
+            capture_output=True,
+            text=True,
+            shell=False,
+            check=True,  # raises an exception if npm fails
+        )
+        logger.info("Spark sidecar npm dependencies installed.")
+        logger.info("npm install output:")
+        logger.info(result.stdout)
+        logger.error(result.stderr)
+
+    async def _start_sidecar_process(self, node_path: str, node_modules_path: Path):
+        logger.info("Starting Spark sidecar node process.")
+
+        env = {
+            "SPARK_NETWORK": settings.spark_l2_network,
+            "SPARK_SIDECAR_API_KEY": self._api_key or "",
+            "SPARK_PAY_WAIT_MS": str(settings.spark_l2_pay_wait_ms),
+            "SPARK_MNEMONIC": str(settings.spark_l2_mnemonic),
+        }
+
+        process = subprocess.Popen(  # noqa: S603
+            [node_path, "server.mjs"],
+            env=env,
+            cwd=str(node_modules_path),
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            shell=False,
+            text=True,
+        )
+
+        logger.info("Started Spark sidecar node process.")
+        await asyncio.to_thread(self._log_process_output, process)
+
+    async def _download_sidecar(self, repo: str, version: str):
+        zip_path = Path(self._sidecar_path, f"{repo}.zip")
+        logger.info(f"⏳ Downloading Spark sidecar to {zip_path}")
+        Path(zip_path).parent.mkdir(parents=True, exist_ok=True)
+
+        await asyncio.to_thread(
+            download_url,
+            f"https://github.com/lnbits/{repo}/archive/refs/tags/v{version}.zip",
+            zip_path,
+        )
+        logger.info("✅ Downloaded Spark sidecar.")
+
+        logger.info("⏳ Extracting Spark sidecar.")
+
+        shutil.unpack_archive(
+            zip_path,
+            self._sidecar_path,
+        )
+        logger.info("✅ Extracted Spark sidecar.")
+        shutil.rmtree(zip_path, ignore_errors=True)
+        # todo: remove zip
+
+    def _log_process_output(self, process: subprocess.Popen):
+        if process.stdout:
+            for line in process.stdout:
+                logger.warning(f"[Lightspark]: {line}", end="")
+        else:
+            logger.error(" No output captured for Spark sidecar.")

package.json

@@ -98,6 +98,8 @@
       "js/pages/error.js",
       "js/pages/home.js",
       "js/pages/extensions_builder.js",
+      "js/pages/extensions_builder.js",
+      "js/pages/extensions_builder_preview.js",
       "js/pages/extensions.js",
       "js/pages/first-install.js",
       "js/pages/payments.js",

pyproject.toml

@@ -8,31 +8,31 @@ urls = { Homepage = "https://lnbits.com", Repository = "https://github.com/lnbit
 readme = "README.md"
 dependencies = [
     "bech32==1.2.0",
-    "click==8.2.1",
+    "click==8.3.1",
     "ecdsa==0.19.1",
     "fastapi==0.116.1",
     "starlette==0.47.1",
-    "httpx==0.27.0",
+    "httpx==0.27.2",
     "jinja2==3.1.6",
     "lnurl==0.8.3",
-    "pydantic==1.10.22",
+    "pydantic==1.10.26",
     "pyqrcode==1.2.1",
     "shortuuid==1.0.13",
     "sse-starlette==2.3.6",
-    "typing-extensions==4.14.0",
-    "uvicorn==0.34.3",
+    "typing-extensions==4.15.0",
+    "uvicorn==0.40.0",
     "sqlalchemy==1.4.54",
-    "aiosqlite==0.21.0",
-    "asyncpg==0.30.0",
-    "uvloop==0.21.0",
+    "aiosqlite==0.22.1",
+    "asyncpg==0.31.0",
+    "uvloop==0.22.1",
     "websockets==15.0.1",
     "loguru==0.7.3",
-    "grpcio==1.69.0",
-    "protobuf==5.29.5",
-    "pyln-client==25.5",
-    "pywebpush==2.0.3",
+    "grpcio==1.76.0",
+    "protobuf==6.33.2",
+    "pyln-client==25.12",
+    "pywebpush==2.2.0",
     "slowapi==0.1.9",
-    "websocket-client==1.8.0",
+    "websocket-client==1.9.0",
     "pycryptodomex==3.23.0",
     "packaging==25.0",
     "bolt11==2.1.1",
@@ -42,14 +42,14 @@ dependencies = [
     # needed for boltz, lnurldevice, watchonly extensions
     "embit==0.8.0",
     # needed for scheduler extension
-    "python-crontab==3.2.0",
-    "pynostr==0.6.2",
-    "python-multipart==0.0.20",
+    "python-crontab==3.3.0",
+    "pynostr==0.7.0",
+    "python-multipart==0.0.21",
     "filetype==1.2.0",
-    "nostr-sdk==0.42.1",
-    "bcrypt==4.3.0",
+    "nostr-sdk==0.44.0",
+    "bcrypt==5.0.0",
     "jsonpath-ng==1.7.0",
-    "pillow>=12.0.0",
+    "pillow>=12.1.0",
     "python-dotenv>=1.2.1",
     "greenlet (>=3.3.0,<4.0.0)",
 ]
@@ -60,30 +60,30 @@ lnbits-cli = "lnbits.commands:main"
 
 [project.optional-dependencies]
 breez = ["breez-sdk==0.8.0", "breez-sdk-liquid==0.11.11"]
-liquid = ["wallycore==1.4.0"]
-migration = ["psycopg2-binary==2.9.10"]
+liquid = ["wallycore==1.5.1"]
+migration = ["psycopg2-binary==2.9.11"]
 
 [dependency-groups]
 dev = [
-  "black>=25.1.0,<26.0.0",
+  "black>=25.12.0,<26.0.0",
   "mypy==1.17.1",
-  "types-protobuf>=6.30.2.20250516,<7.0.0",
-  "pre-commit>=4.2.0,<5.0.0",
-  "openapi-spec-validator>=0.7.1,<1.0.0",
-  "ruff>=0.12.0,<1.0.0",
-  "types-passlib>=1.7.7.20240327,<2.0.0",
-  "openai>=1.39.0,<2.0.0",
-  "json5>=0.12.0,<1.0.0",
+  "types-protobuf>=6.32.1.20251210,<7.0.0",
+  "pre-commit>=4.5.1,<5.0.0",
+  "openapi-spec-validator>=0.7.2,<1.0.0",
+  "ruff>=0.14.10,<1.0.0",
+  "types-passlib>=1.7.7.20250602,<2.0.0",
+  "openai>=2.14.0",
+  "json5>=0.13.0,<1.0.0",
   "asgi-lifespan>=2.1.0,<3.0.0",
-  "anyio>=4.7.0,<5.0.0",
-  "pytest>=8.3.4,<9.0.0",
-  "pytest-cov>=6.0.0,<7.0.0",
+  "anyio>=4.12.1",
+  "pytest>=9.0.2",
+  "pytest-cov>=7.0.0",
   "pytest-md>=0.2.0,<0.3.0",
-  "pytest-httpserver>=1.1.0,<2.0.0",
-  "pytest-mock>=3.14.0,<4.0.0",
-  "types-mock>=5.1.0.20240425,<6.0.0",
-  "mock>=5.1.0,<6.0.0",
-  "grpcio-tools>=1.69.0,<2.0.0"
+  "pytest-httpserver>=1.1.3,<2.0.0",
+  "pytest-mock>=3.15.1,<4.0.0",
+  "types-mock>=5.2.0.20250924,<6.0.0",
+  "mock>=5.2.0,<6.0.0",
+  "grpcio-tools>=1.76.0,<2.0.0"
 ]
 
 [tool.poetry]
@@ -92,27 +92,6 @@ packages = [
   {include = "lnbits/py.typed"},
 ]
 
-[tool.poetry.group.dev.dependencies]
-black = "^25.1.0"
-mypy = "^1.17.1"
-types-protobuf = "^6.30.2.20250516"
-pre-commit = "^4.2.0"
-openapi-spec-validator = "^0.7.1"
-ruff = "^0.12.0"
-types-passlib = "^1.7.7.20240327"
-openai = "^1.39.0"
-json5 = "^0.12.0"
-asgi-lifespan = "^2.1.0"
-anyio = "^4.7.0"
-pytest = "^8.3.4"
-pytest-cov = "^6.0.0"
-pytest-md = "^0.2.0"
-pytest-httpserver = "^1.1.0"
-pytest-mock = "^3.14.0"
-types-mock = "^5.1.0.20240425"
-mock = "^5.1.0"
-grpcio-tools = "^1.69.0"
-
 [tool.pyright]
 include = [
   "lnbits",

tests/api/test_api.py

@@ -245,7 +245,7 @@ async def test_create_invoice_validates_used_currency(
     )
     assert response.status_code == 400
     res_data = response.json()
-    assert "The provided unit is not supported" in res_data["detail"]
+    assert "The provided unit is not supported" in res_data["detail"][0]["msg"]
 
 
 # check POST /api/v1/payments: invoice creation for internal payments only
@@ -823,7 +823,7 @@ async def test_api_payments_pay_lnurl(client, adminkey_headers_from):
         "/api/v1/payments/lnurl", json=lnurl_data, headers=adminkey_headers_from
     )
     assert response.status_code == 400
-    assert "value_error.url.scheme" in response.json()["detail"]
+    assert "invalid or missing URL scheme" in response.json()["detail"][0]["msg"]
 
 
 ################################ Labels ################################

tests/api/test_auth.py

@@ -2044,5 +2044,196 @@ async def test_api_update_user_labels(http_client: AsyncClient):
     assert response.status_code == 400
     data = response.json()
     assert (
-        """string does not match regex "([A-Za-z0-9 ._-]{1,100}$)""" in data["detail"]
+        """string does not match regex "([A-Za-z0-9 ._-]{1,100}$)"""
+        in data["detail"][0]["msg"]
+    )
+
+
+@pytest.mark.anyio
+async def test_impersonate_user_success(http_client: AsyncClient, admin_user: User):
+    tiny_id = shortuuid.uuid()[:8]
+    user_id = uuid4().hex
+    account = Account(
+        id=user_id,
+        username=f"u_{tiny_id}",
+        email=f"u_{tiny_id}@lnbits.com",
+    )
+    account.hash_password("secret1234")
+    await create_user_account(account)
+
+    # Login as admin to get access token
+    response = await http_client.post(
+        "/api/v1/auth", json={"username": admin_user.username, "password": "secret1234"}
+    )
+    assert response.status_code == 200
+    admin_token = response.json()["access_token"]
+
+    # Impersonate the user
+    response = await http_client.post(
+        "/api/v1/auth/impersonate",
+        json={"usr": user_id},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 200
+    data = response.json()
+    assert "access_token" in data
+    assert data["token_type"] == "bearer"
+
+    # Check impersonation cookies
+    assert "cookie_access_token" in response.cookies
+    assert "admin_access_token" in response.cookies
+    assert response.cookies.get("is_lnbits_user_impersonated") == "true"
+
+    response = await http_client.delete("/api/v1/auth/impersonate")
+    assert "cookie_access_token" in response.cookies
+    assert response.cookies.get("cookie_access_token") == admin_token
+    assert "admin_access_token" not in response.cookies
+    assert "is_lnbits_user_impersonated" not in response.cookies
+
+
+@pytest.mark.anyio
+async def test_impersonate_user_no_cookie(http_client: AsyncClient, admin_user: User):
+    response = await http_client.post(
+        "/api/v1/auth", json={"username": admin_user.username, "password": "secret1234"}
+    )
+    admin_token = response.json()["access_token"]
+    user_id = uuid4().hex
+    http_client.cookies.clear()
+    response = await http_client.post(
+        "/api/v1/auth/impersonate",
+        json={"usr": user_id},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+
+    assert response.status_code == 401
+    assert response.json()["detail"] == "Only cookie based impersonation is allowed."
+
+
+@pytest.mark.anyio
+async def test_impersonate_user_self(http_client: AsyncClient, admin_user: User):
+    # Admin tries to impersonate themselves
+    response = await http_client.post(
+        "/api/v1/auth", json={"username": admin_user.username, "password": "secret1234"}
+    )
+    admin_token = response.json()["access_token"]
+    response = await http_client.post(
+        "/api/v1/auth/impersonate",
+        json={"usr": admin_user.id},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+
+    assert response.status_code == 403
+    assert response.json()["detail"] == "You cannot impersonate yourself."
+
+
+@pytest.mark.anyio
+async def test_impersonate_user_admin_target(
+    http_client: AsyncClient, admin_user: User, settings: Settings
+):
+    other_admin_id = uuid4().hex
+    tiny_id = shortuuid.uuid()[:8]
+    account = Account(
+        id=other_admin_id, username=f"u_{tiny_id}", email=f"u_{tiny_id}@lnbits.com"
+    )
+    account.hash_password("secret1234")
+
+    await create_user_account(account)
+    settings.lnbits_admin_users.append(other_admin_id)
+
+    response = await http_client.post(
+        "/api/v1/auth", json={"username": admin_user.username, "password": "secret1234"}
+    )
+    admin_token = response.json()["access_token"]
+    response = await http_client.post(
+        "/api/v1/auth/impersonate",
+        json={"usr": other_admin_id},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 403
+    assert response.json()["detail"] == "You cannot impersonate another admin user."
+
+
+@pytest.mark.anyio
+async def test_impersonate_user_nonexistent(
+    http_client: AsyncClient, admin_user: User, settings: Settings
+):
+    http_client.cookies.clear()
+    response = await http_client.post(
+        "/api/v1/auth", json={"username": admin_user.username, "password": "secret1234"}
+    )
+    admin_token = response.json()["access_token"]
+    fake_id = "deadbeef"
+    response = await http_client.post(
+        "/api/v1/auth/impersonate",
+        json={"usr": fake_id},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 401
+    assert response.json()["detail"] == "User ID does not exist."
+
+
+@pytest.mark.anyio
+async def test_impersonate_user_invalid_data(
+    http_client: AsyncClient, admin_user: User
+):
+    response = await http_client.post(
+        "/api/v1/auth", json={"username": admin_user.username, "password": "secret1234"}
+    )
+    admin_token = response.json()["access_token"]
+    response = await http_client.post(
+        "/api/v1/auth/impersonate",
+        json={"usr": None},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+
+    assert response.status_code == 400
+    assert "type_error.none.not_allowed" in str(response.json()["detail"])
+
+
+@pytest.mark.anyio
+async def test_impersonate_user_missing_usr_field(
+    http_client: AsyncClient, admin_user: User
+):
+    response = await http_client.post(
+        "/api/v1/auth", json={"username": admin_user.username, "password": "secret1234"}
+    )
+    admin_token = response.json()["access_token"]
+    response = await http_client.post(
+        "/api/v1/auth/impersonate",
+        json={},
+        headers={"Authorization": f"Bearer {admin_token}"},
+    )
+    assert response.status_code == 400
+    assert "value_error.missing" in str(response.json()["detail"])
+
+
+@pytest.mark.anyio
+async def test_impersonate_user_by_non_admin(http_client: AsyncClient, user_alan: User):
+    response = await http_client.post(
+        "/api/v1/auth", json={"username": user_alan.username, "password": "secret1234"}
+    )
+    alan_token = response.json()["access_token"]
+    response = await http_client.post(
+        "/api/v1/auth/impersonate",
+        json={},
+        headers={"Authorization": f"Bearer {alan_token}"},
+    )
+    assert response.status_code == 403
+    assert response.json()["detail"] == "User not authorized. No admin privileges."
+
+
+@pytest.mark.anyio
+async def test_stop_impersonate_user_by_non_admin(
+    http_client: AsyncClient, user_alan: User
+):
+    response = await http_client.post(
+        "/api/v1/auth", json={"username": user_alan.username, "password": "secret1234"}
+    )
+
+    response = await http_client.delete("/api/v1/auth/impersonate")
+
+    assert response.status_code == 401
+    assert (
+        response.json()["detail"]
+        == "No admin access token found to stop impersonation."
     )

tests/conftest.py

@@ -14,9 +14,9 @@ from lnbits.core.crud import (
     delete_account,
     get_account_by_username,
     get_payment,
+    get_user,
     update_payment,
 )
-from lnbits.core.crud.users import get_user_from_account
 from lnbits.core.models import Account, CreateInvoice, PaymentState, User
 from lnbits.core.models.users import UpdateSuperuserPassword
 from lnbits.core.services import create_user_account, update_wallet_balance
@@ -114,10 +114,10 @@ async def user_alan():
 
 @pytest.fixture(scope="session")
 async def admin_user():
-    username = "admin"
-    account = await get_account_by_username(username)
-    if account:
-        return await get_user_from_account(account)
+    username = "admin_" + uuid4().hex[:8]
+    user = await get_user(ADMIN_USER_ID)
+    if user:
+        return user
 
     account = Account(
         id=ADMIN_USER_ID,

tests/unit/test_db.py

@@ -1,4 +1,4 @@
-from datetime import date
+from datetime import date, timezone
 
 import pytest
 
@@ -8,6 +8,9 @@ from lnbits.core.crud import (
     get_wallet,
     get_wallet_for_key,
 )
+from lnbits.core.crud.payments import get_payment
+from lnbits.core.models import CreateInvoice
+from lnbits.core.services.payments import create_wallet_invoice
 from lnbits.db import POSTGRES
 
 
@@ -18,6 +21,24 @@ async def test_date_conversion(db):
         assert row and isinstance(row.get("now"), date)
 
 
+@pytest.mark.anyio
+async def test_payment_datetime_fields_have_timezone(app, to_user):
+    """Test that Payment datetime fields always have UTC timezone info."""
+    wallet = await create_wallet(user_id=to_user.id, wallet_name="test_tz_wallet")
+    invoice_data = CreateInvoice(amount=10, memo="timezone_test", out=False)
+    invoice = await create_wallet_invoice(wallet.id, invoice_data)
+
+    payment = await get_payment(invoice.checking_id)
+    assert payment is not None
+
+    # All datetime fields should have UTC timezone info
+    assert payment.time.tzinfo == timezone.utc
+    assert payment.created_at.tzinfo == timezone.utc
+    assert payment.updated_at.tzinfo == timezone.utc
+    if payment.expiry:
+        assert payment.expiry.tzinfo == timezone.utc
+
+
 # make test to create wallet and delete wallet
 @pytest.mark.anyio
 async def test_create_wallet_and_delete_wallet(app, to_user):

tools/conv.py

@@ -100,8 +100,8 @@ def insert_to_pg(query, data):
                 logger.error(exc)
                 logger.error(f"Failed to insert {d}")
             else:
-                logger.error("query:", query)
-                logger.error("data:", d)
+                logger.error("query: " + query)
+                logger.error("data: " + str(d))
                 raise ValueError(f"Failed to insert {d}") from exc
     connection.commit()
 
@@ -125,6 +125,7 @@ def migrate_ext(file: str):
         migrate_db(file, schema)
         logger.info(f"✅ Migrated ext: {schema}")
     except Exception as exc:
+        logger.error(exc)
         logger.error(f"🛑  Failed to migrate extension {schema}: {exc}")
 
 
@@ -134,8 +135,8 @@ def migrate_db(file: str, schema: str, exclude_tables: list[str] | None = None):
         exclude_tables = []
     assert os.path.isfile(file), f"{file} does not exist!"
 
-    cursor = get_sqlite_cursor(file)
-    tables = cursor.execute(
+    sqlite_cursor = get_sqlite_cursor(file)
+    tables = sqlite_cursor.execute(
         """
         SELECT name FROM sqlite_master
         WHERE type='table' AND name not like 'sqlite?_%' escape '?'
@@ -151,16 +152,18 @@ def migrate_db(file: str, schema: str, exclude_tables: list[str] | None = None):
         if exclude_tables and table_name in exclude_tables:
             continue
 
-        columns = cursor.execute(f"PRAGMA table_info({table_name})").fetchall()
+        columns = build_table_columns(file, schema, table_name)
         q = build_insert_query(schema, table_name, columns)
 
-        data = cursor.execute(f"SELECT * FROM {table_name};").fetchall()
+        data = sqlite_cursor.execute(f"SELECT * FROM {table_name};").fetchall()
 
         if len(data) == 0:
-            logger.warning(f"🛑 You sneaky dev! Table {table_name} is empty!")
+            logger.warning(f"⚠️ You sneaky dev! Table {table_name} is empty!")
+            continue
 
         insert_to_pg(q, data)
-    cursor.close()
+        logger.info(f"✅ Migrated table '{schema}.{table_name}' successfully")
+    sqlite_cursor.close()
 
 
 def build_insert_query(schema, table_name, columns):
@@ -174,6 +177,30 @@ def build_insert_query(schema, table_name, columns):
         """
 
 
+def build_table_columns(file: str, schema: str, table_name: str):
+    sqlite_cursor = get_sqlite_cursor(file)
+    pg_cursor = get_postgres_cursor()
+
+    sqlite_columns = sqlite_cursor.execute(
+        f"PRAGMA table_info({table_name})"
+    ).fetchall()
+    pg_cursor.execute(
+        f"""
+        SELECT table_name, column_name, udt_name FROM information_schema.columns
+        WHERE table_schema = '{schema}'AND table_name   = '{table_name}';"""
+    )
+    pg_columns = pg_cursor.fetchall()
+
+    columns = []
+    for sqlite_col in sqlite_columns:
+        for pg_col in pg_columns:
+            if sqlite_col[1].lower() == pg_col[1].lower():
+                columns.append((sqlite_col[0], sqlite_col[1], pg_col[2]))
+                break
+    sqlite_cursor.close()
+    return columns
+
+
 def build_on_conflict_query_statement(schema, table_name, columns):
     unique_cols = table_unique_columns(schema, table_name)
     if len(unique_cols) == 0:
@@ -191,23 +218,36 @@ def build_on_conflict_query_statement(schema, table_name, columns):
 def table_unique_columns(schema, table_name):
     cursor = get_postgres_cursor()
     query = f"""
-        SELECT a.attname
-        FROM   pg_index i
-        JOIN   pg_attribute a ON a.attrelid = i.indrelid
-                             AND a.attnum = ANY(i.indkey)
-        WHERE  i.indrelid = '{schema}.{table_name}'::regclass
-        AND    i.indisunique;
+        SELECT
+            array_agg(a.attname ORDER BY a.attnum) AS columns,
+            i.indisprimary as is_primary,
+            i.indexrelid::regclass AS index_name,
+            COUNT(*) AS column_count,
+            (COUNT(*) = 1) AS is_individual
+        FROM pg_index i
+        JOIN pg_attribute a
+        ON a.attrelid = i.indrelid
+        AND a.attnum = ANY (i.indkey)
+        WHERE i.indrelid = '{schema}.{table_name}'::regclass
+        AND i.indisunique
+        GROUP BY i.indexrelid;
     """
     cursor.execute(query)
-    columns = [row[0] for row in cursor.fetchall()]
+    rows = cursor.fetchall()
+    columns = [row[0] for row in rows if not row[1]]  # exclude primary keys
+    if len(columns) == 0:
+        # use primary keys if no unique keys found
+        columns = [row[0] for row in rows if row[1]]
     cursor.close()
-    return columns
+    if len(columns) == 0:
+        return []
+    return columns[0]
 
 
-def to_column_type(column_type):
-    if column_type == "TIMESTAMP":
+def to_column_type(column_type: str):
+    if column_type.upper() == "TIMESTAMP":
         return "to_timestamp(%s)"
-    if column_type in ["BOOLEAN", "BOOL"]:
+    if column_type.upper() in ["BOOLEAN", "BOOL"]:
         return "%s::boolean"
     return "%s"
 
@@ -255,7 +295,7 @@ parser.add_argument(
 
 args = parser.parse_args()
 
-logger.info("Selected path: ", args.sqlite_path)
+logger.info("Selected path: " + args.sqlite_path)
 
 if os.path.isdir(args.sqlite_path):
     exclude_tables = ["dbversions"]